nucleus-core-ts 0.10.4 → 0.10.6

package/dist/server.js

@@ -540,7 +540,7 @@ ${strMDSAlgs}`)}if(attestationStatementAlg!==void 0&&authenticatorGetInfo?.algor
       where table_schema = ${schemaName}
         and table_name = ${tableName}
         and column_name = 'expires_at'
-    `),first=((Array.isArray(current)?current:current?.rows)??[])[0];if(!first)return{action:"already-nullable"};if(first.is_nullable==="YES")return{action:"already-nullable"};return await db.execute(sql13.raw(`ALTER TABLE "${schemaName}"."${tableName}" ALTER COLUMN "expires_at" DROP NOT NULL`)),logger2?.info(`[Schema] "${schemaName}"."${tableName}".expires_at may now be empty \u2014 this install runs sessions that never expire, and a session with no expiry is a row with no expiry.`),{action:"relaxed"}}catch(error3){let reason=error3 instanceof Error?error3.message:String(error3);return logger2?.warn(`[Schema] Could not let "${schemaName}"."${tableName}".expires_at be empty: ${reason}. Sign-in will fail with "Missing required field: expires_at" until this column allows nulls.`),{action:"failed",reason}}}var SAFE_IDENTIFIER;var init_relaxSessionExpiry=__esm(()=>{SAFE_IDENTIFIER=/^[A-Za-z_][A-Za-z0-9_]*$/});function normSegment(input){return input.toLowerCase().replace(/[^a-z0-9]+/g,"_").replace(/_+/g,"_").replace(/^_|_$/g,"")}function normPath(path7){return normSegment(path7.replace(/\{[^}]+\}/g,(m)=>m.slice(1,-1)))}function shortHash(input){let h=5381;for(let i=0;i<input.length;i++)h=(h*33^input.charCodeAt(i))>>>0;return h.toString(36)}function capAction(action,max=100){if(action.length<=max)return action;let suffix=`_${shortHash(action)}`;return action.slice(0,Math.max(1,max-suffix.length))+suffix}function resourceFromPath(path7){let segs=path7.split("/").filter(Boolean).filter((s)=>!s.startsWith("{"));for(let s of segs){if(s==="api"||/^v\d+$/i.test(s))continue;return normSegment(s)}return normSegment(segs[0]??"root")}function matchesExclude(path7,patterns3){if(!patterns3?.length)return!1;for(let raw of patterns3){let p=raw.trim();if(!p)continue;if(p.endsWith("/*")){let prefix=p.slice(0,-2);if(path7===prefix||path7.startsWith(`${prefix}/`))return!0}else if(p.endsWith("*")){if(path7.startsWith(p.slice(0,-1)))return!0}else if(path7===p)return!0}return!1}function parseOpenApiToClaims(serviceId,doc,opts={}){let sid=normSegment(serviceId);if(!sid)throw Error("endpointDiscovery: serviceId is empty after normalization");if(RESERVED_SERVICE_IDS.has(sid))throw Error(`endpointDiscovery: serviceId "${serviceId}" collides with an HTTP-method claim prefix; pick another id`);let specs=[],seen=new Set,paths=doc.paths??{};for(let[path7,ops]of Object.entries(paths)){if(!ops||matchesExclude(path7,opts.exclude))continue;for(let method of HTTP_METHODS2){let op=ops[method];if(!op)continue;let tag=(op.tags?.[0]?normSegment(op.tags[0]):"")||resourceFromPath(path7),opToken=(op.operationId?normSegment(op.operationId):"")||`${method}_${normPath(path7)}`,action=capAction(`${sid}.${tag||"root"}.${opToken||method}`);if(seen.has(action)){action=capAction(`${action}_${shortHash(`${method} ${path7}`)}`);while(seen.has(action))action=capAction(`${action}_${shortHash(action)}`)}seen.add(action),specs.push({action,path:path7,method:method.toUpperCase(),description:op.summary||op.description||`${method.toUpperCase()} ${path7}`})}}return specs}function diffClaims(existing,specs){let specByAction=new Map(specs.map((s)=>[s.action,s])),existByAction=new Map(existing.map((e)=>[e.action,e]));return{toInsert:specs.filter((s)=>!existByAction.has(s.action)),toReactivate:specs.filter((s)=>existByAction.get(s.action)?.isActive===!1),toDeactivate:existing.filter((e)=>e.isActive&&!specByAction.has(e.action)),unchanged:specs.filter((s)=>existByAction.get(s.action)?.isActive===!0)}}async function fetchOpenApi(baseUrl,openapiPath,fetchImpl=fetch){let url=`${baseUrl.replace(/\/$/,"")}${openapiPath.startsWith("/")?"":"/"}${openapiPath}`,res=await fetchImpl(url);if(!res.ok)throw Error(`endpointDiscovery: OpenAPI fetch failed ${res.status} for ${url}`);return await res.json()}var HTTP_METHODS2,RESERVED_SERVICE_IDS;var init_EndpointDiscovery=__esm(()=>{HTTP_METHODS2=["get","post","put","patch","delete"],RESERVED_SERVICE_IDS=new Set(["get","post","put","patch","delete","toggle","bulk"])});var exports_seed={};__export(exports_seed,{seedDiscoveredClaims:()=>seedDiscoveredClaims,runEndpointDiscovery:()=>runEndpointDiscovery,getRouteManifest:()=>getRouteManifest,getRoleClaimsManifest:()=>getRoleClaimsManifest});import{eq as eq65,like as like2}from"drizzle-orm";function col16(table,name2){return table[name2]}async function seedDiscoveredClaims(db,claimsTable,serviceId,specs,logger2){let actionCol=col16(claimsTable,"action"),prefix=specs[0]?.action.split(".")[0]??serviceId.toLowerCase(),existing=(await db.select().from(claimsTable).where(like2(actionCol,`${prefix}.%`))).map((r)=>({action:String(r.action),isActive:r.isActive!==!1,path:String(r.path??""),method:String(r.method??""),description:String(r.description??"")})),plan=diffClaims(existing,specs);for(let s of plan.toInsert)await db.insert(claimsTable).values({action:s.action,path:s.path,method:s.method,description:s.description});for(let s of plan.toReactivate)await db.update(claimsTable).set({isActive:!0,path:s.path,method:s.method,description:s.description}).where(eq65(actionCol,s.action));for(let e of plan.toDeactivate)await db.update(claimsTable).set({isActive:!1}).where(eq65(actionCol,e.action));let summary={added:plan.toInsert.length,reactivated:plan.toReactivate.length,deactivated:plan.toDeactivate.length,unchanged:plan.unchanged.length,total:specs.length};return logger2.info(`[Discovery] Reconciled "${serviceId}"`,summary),summary}async function runEndpointDiscovery(db,schemaTables,config,logger2,fetchImpl=fetch){let claimsTable=schemaTables.claims,services=config.services??[],results=[];if(!claimsTable)return logger2.warn("[Discovery] No claims table in schema; skipping endpoint discovery"),{services:[]};for(let svc of services)try{let doc=await fetchOpenApi(svc.baseUrl,svc.openapi??"/openapi.json",fetchImpl),specs=parseOpenApiToClaims(svc.id,doc,{exclude:svc.exclude}),summary=await seedDiscoveredClaims(db,claimsTable,svc.id,specs,logger2);results.push({id:svc.id,...summary})}catch(err){let message=err instanceof Error?err.message:String(err);logger2.error(`[Discovery] Service "${svc.id}" discovery failed`,{error:message}),results.push({id:svc.id,added:0,reactivated:0,deactivated:0,unchanged:0,total:0,error:message})}return{services:results}}async function getRouteManifest(db,claimsTable,serviceId){return(await db.select().from(claimsTable).where(like2(col16(claimsTable,"action"),`${serviceId.toLowerCase()}.%`))).filter((r)=>r.isActive!==!1).map((r)=>({action:String(r.action),path:String(r.path??""),method:String(r.method??"")}))}async function getRoleClaimsManifest(db,schemaTables,serviceId){let{roles:rolesTable,claims:claimsTable}=schemaTables,roleClaimsTable=schemaTables.roleClaims??schemaTables.role_claims;if(!rolesTable||!claimsTable||!roleClaimsTable)return{};let sid=serviceId.toLowerCase(),claimRows=await db.select().from(claimsTable),claimIdToAction=new Map;for(let c of claimRows){if(c.isActive===!1)continue;let action=String(c.action??"");if(action===sid||action.startsWith(`${sid}.`))claimIdToAction.set(String(c.id),action)}if(claimIdToAction.size===0)return{};let roleRows=await db.select().from(rolesTable),roleIdToName=new Map;for(let r of roleRows)roleIdToName.set(String(r.id),String(r.name??""));let rcRows=await db.select().from(roleClaimsTable),out={};for(let rc of rcRows){if(rc.isActive===!1)continue;let action=claimIdToAction.get(String(rc.claimId??rc.claim_id)),roleName=roleIdToName.get(String(rc.roleId??rc.role_id));if(!action||!roleName)continue;let actions=out[roleName];if(!actions)actions=[],out[roleName]=actions;actions.push(action)}return out}var init_seed=__esm(()=>{init_EndpointDiscovery()});var OPS_BY_TYPE;var init_types23=__esm(()=>{OPS_BY_TYPE={int:["gt","gte","lt","lte","eq","ne"],boolean:["eq","ne"],string:["eq","ne"]}});function isRecord(v){return typeof v==="object"&&v!==null}function guardActionFromName(name2){let brace=name2.indexOf("{");return(brace>=0?name2.slice(0,brace):name2).replace(/:$/,"")}function parseGuardCatalogEntry(entry){if(!isRecord(entry))return null;let name2=typeof entry.name==="string"?entry.name.trim():"";if(!name2)return null;let valueType=entry.value;if(typeof valueType!=="string"||!VALUE_TYPES.includes(valueType))return null;let action=guardActionFromName(name2);if(!action)return null;return{action,policy:{kind:"guard",keyTemplate:name2,valueType}}}function parseGuardPolicy(raw){if(!isRecord(raw)||raw.kind!=="guard")return null;if(typeof raw.keyTemplate!=="string"||!raw.keyTemplate)return null;let vt=raw.valueType;if(typeof vt!=="string"||!VALUE_TYPES.includes(vt))return null;return{kind:"guard",keyTemplate:raw.keyTemplate,valueType:vt}}function resolveGuardKey(keyTemplate,ctx){return keyTemplate.replaceAll("{userId}",ctx.userId).replaceAll("{tenant}",ctx.tenant??"default")}function coerceThreshold(value2,type4){if(type4==="int"){if(value2==null)return null;if(typeof value2==="boolean"||typeof value2==="symbol")return null;if(typeof value2==="string"&&value2.trim()==="")return null;if(typeof value2==="object")return null;let n=Number(value2);return Number.isFinite(n)?n:null}if(type4==="boolean"){if(typeof value2==="boolean")return value2;if(value2==="true"||value2===1||value2==="1")return!0;if(value2==="false"||value2===0||value2==="0")return!1;return null}return value2==null?null:String(value2)}function parseGuardCondition(scope,valueType){let raw=scope;if(typeof scope==="string")try{raw=JSON.parse(scope)}catch{return null}if(!isRecord(raw))return null;let op=raw.op;if(typeof op!=="string"||!OPS_BY_TYPE[valueType].includes(op))return null;let value2=coerceThreshold(raw.value,valueType);if(value2===null)return null;let invalidates=Array.isArray(raw.invalidates)?raw.invalidates.filter((a)=>typeof a==="string"&&a.length>0):[];return{op,value:value2,invalidates}}function coerceStateValue(raw,type4){if(raw==null)return null;let v=isRecord(raw)&&"data"in raw?raw.data:raw;if(v==null)return null;if(typeof v==="object")return null;if(type4==="int"&&typeof v==="string"&&v.trim()==="")return null;return coerceThreshold(v,type4)}function guardConditionHolds(rawValue,valueType,condition){let actual=coerceStateValue(rawValue,valueType);if(actual===null)return!1;let target2=condition.value;switch(condition.op){case"gt":return actual>target2;case"gte":return actual>=target2;case"lt":return actual<target2;case"lte":return actual<=target2;case"eq":return actual===target2;case"ne":return actual!==target2;default:return!1}}function parseClaimGuardCatalog(entries){if(!entries?.length)return[];let out=[],seen=new Set;for(let e of entries){let parsed=parseGuardCatalogEntry(e);if(parsed&&!seen.has(parsed.action))seen.add(parsed.action),out.push(parsed)}return out}var VALUE_TYPES;var init_evaluate=__esm(()=>{init_types23();VALUE_TYPES=["int","boolean","string"]});async function resolveClaimGuards(db,schemaTables,userId,read2,ctx={}){let claimsTable=schemaTables.claims,roleClaimsTable=schemaTables.roleClaims??schemaTables.role_claims,userRolesTable=schemaTables.userRoles??schemaTables.user_roles;if(!claimsTable||!roleClaimsTable||!userRolesTable)return EMPTY;let claimRows=await db.select().from(claimsTable),guardByClaimId=new Map;for(let c of claimRows){if(c.isActive===!1)continue;let policy=parseGuardPolicy(c.policy);if(policy)guardByClaimId.set(String(c.id),{action:String(c.action??""),policy})}if(guardByClaimId.size===0)return EMPTY;let urRows=await db.select().from(userRolesTable),roleIds=new Set(urRows.filter((r)=>r.isActive!==!1&&String(r.userId??r.user_id)===userId).map((r)=>String(r.roleId??r.role_id)));if(roleIds.size===0)return EMPTY;let rcRows=await db.select().from(roleClaimsTable),guards=[],suppressed=new Set,firedGuards=[],stateCache=new Map;for(let rc of rcRows){if(rc.isActive===!1)continue;if(!roleIds.has(String(rc.roleId??rc.role_id)))continue;let guard4=guardByClaimId.get(String(rc.claimId??rc.claim_id));if(!guard4)continue;let condition=parseGuardCondition(rc.scope,guard4.policy.valueType);if(!condition)continue;let key2=resolveGuardKey(guard4.policy.keyTemplate,{userId,tenant:ctx.tenant}),value2;if(stateCache.has(key2))value2=stateCache.get(key2);else value2=await read2(key2).catch(()=>null),stateCache.set(key2,value2);let holds=guardConditionHolds(value2,guard4.policy.valueType,condition),current=normalizeCurrent(value2,guard4.policy.valueType);if(guards.push({action:guard4.action,key:key2,valueType:guard4.policy.valueType,op:condition.op,threshold:condition.value,current,invalidates:condition.invalidates,holds}),holds&&condition.invalidates.length>0){for(let a of condition.invalidates)suppressed.add(a);firedGuards.push({action:guard4.action,key:key2,invalidates:condition.invalidates})}}return{guards,suppressedClaims:[...suppressed],firedGuards}}function normalizeCurrent(raw,type4){if(raw==null)return null;let v=typeof raw==="object"&&raw!==null&&"data"in raw?raw.data:raw;if(v==null)return null;if(type4==="int"){let n=Number(v);return Number.isFinite(n)?n:null}if(type4==="boolean")return v===!0||v==="true"||v===1||v==="1";return String(v)}var EMPTY;var init_resolve=__esm(()=>{init_evaluate();EMPTY={guards:[],suppressedClaims:[],firedGuards:[]}});import{eq as eq66}from"drizzle-orm";async function seedClaimGuards(db,schemaTables,claimGuards,logger2){let claimsTable=schemaTables.claims;if(!claimsTable)return{created:0,updated:0,deactivated:0};let actionCol=claimsTable.action,desired=parseClaimGuardCatalog(claimGuards),desiredByAction=new Map(desired.map((d)=>[d.action,d.policy])),existing=await db.select().from(claimsTable),existingGuardActions=new Set,result={created:0,updated:0,deactivated:0};for(let row of existing){if(!parseGuardPolicy(row.policy))continue;let action=String(row.action??"");existingGuardActions.add(action);let want=desiredByAction.get(action);if(!want){if(row.isActive!==!1)await db.update(claimsTable).set({isActive:!1}).where(eq66(actionCol,action)),result.deactivated++;continue}let current=row.policy;if(JSON.stringify(current)!==JSON.stringify(want)||row.isActive===!1)await db.update(claimsTable).set({policy:want,isActive:!0,path:want.keyTemplate,method:"GUARD"}).where(eq66(actionCol,action)),result.updated++}for(let{action,policy}of desired){if(existingGuardActions.has(action))continue;await db.insert(claimsTable).values({action,description:`ClaimGuard [${policy.valueType}] key=${policy.keyTemplate}`,path:policy.keyTemplate,method:"GUARD",policy,isActive:!0}),result.created++}return logger2?.info?.(`[Authorization] ClaimGuards seeded (created=${result.created}, updated=${result.updated}, deactivated=${result.deactivated})`),result}var init_seed2=__esm(()=>{init_evaluate()});var exports_ClaimGuard={};__export(exports_ClaimGuard,{seedClaimGuards:()=>seedClaimGuards,resolveGuardKey:()=>resolveGuardKey,resolveClaimGuards:()=>resolveClaimGuards,parseGuardPolicy:()=>parseGuardPolicy,parseGuardCondition:()=>parseGuardCondition,parseGuardCatalogEntry:()=>parseGuardCatalogEntry,parseClaimGuardCatalog:()=>parseClaimGuardCatalog,guardConditionHolds:()=>guardConditionHolds,guardActionFromName:()=>guardActionFromName,OPS_BY_TYPE:()=>OPS_BY_TYPE});var init_ClaimGuard=__esm(()=>{init_evaluate();init_resolve();init_seed2();init_types23()});var exports_dbStorage={};__export(exports_dbStorage,{createDbWebAuthnStorage:()=>createDbWebAuthnStorage});import{and as and26,eq as eq67,isNull as isNull6}from"drizzle-orm";function rowToRecord(row){return{id:row.id,userId:row.userId,credentialId:row.credentialId,publicKey:row.publicKey,counter:typeof row.counter==="bigint"?Number(row.counter):Number(row.counter??0),transports:parseTransports(row.transports),deviceType:parseDeviceType(row.deviceType),backedUp:row.backedUp,aaguid:row.aaguid,authenticatorAttachment:row.authenticatorAttachment==="platform"||row.authenticatorAttachment==="cross-platform"?row.authenticatorAttachment:null,nickname:row.nickname,lastUsedAt:row.lastUsedAt,revokedAt:row.revokedAt,createdAt:row.createdAt}}function col17(table,key2){return table[key2]}function createDbWebAuthnStorage(deps){let{db,resolveTable}=deps,credentialsName="webauthnCredentials",challengesName="webauthnChallenges";return{storeChallenge:async(challenge,schemaName)=>{let table=resolveTable("webauthnChallenges",schemaName);if(!table)return;await db.insert(table).values({userId:challenge.userId??null,challenge:challenge.challenge,challengeType:challenge.challengeType,expiresAt:challenge.expiresAt})},consumeChallenge:async(challenge,challengeType,schemaName)=>{let table=resolveTable("webauthnChallenges",schemaName);if(!table)return null;let row=(await db.update(table).set({consumedAt:new Date}).where(and26(eq67(col17(table,"challenge"),challenge),eq67(col17(table,"challengeType"),challengeType),isNull6(col17(table,"consumedAt")))).returning())[0];if(!row)return null;return{challenge:row.challenge,challengeType:row.challengeType,userId:row.userId,expiresAt:row.expiresAt}},listCredentialsByUser:async(userId,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return[];return(await db.select().from(table).where(eq67(col17(table,"userId"),userId))).map(rowToRecord)},findCredentialById:async(credentialId,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return null;let rows=await db.select().from(table).where(eq67(col17(table,"credentialId"),credentialId)).limit(1);return rows[0]?rowToRecord(rows[0]):null},insertCredential:async(record3,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)throw Error("webauthn_credentials table not configured");let row=(await db.insert(table).values({userId:record3.userId,credentialId:record3.credentialId,publicKey:record3.publicKey,counter:record3.counter,transports:record3.transports??null,deviceType:record3.deviceType??null,backedUp:record3.backedUp,aaguid:record3.aaguid??null,authenticatorAttachment:record3.authenticatorAttachment??null,nickname:record3.nickname??null}).returning())[0];if(!row)throw Error("Failed to insert webauthn credential");return rowToRecord(row)},updateCredentialCounter:async(credentialId,counter,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return;await db.update(table).set({counter,lastUsedAt:new Date}).where(eq67(col17(table,"credentialId"),credentialId))},revokeCredential:async(credentialId,userId,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return!1;return(await db.update(table).set({revokedAt:new Date}).where(and26(eq67(col17(table,"credentialId"),credentialId),eq67(col17(table,"userId"),userId))).returning()).length>0},renameCredential:async(credentialId,userId,nickname,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return!1;return(await db.update(table).set({nickname}).where(and26(eq67(col17(table,"credentialId"),credentialId),eq67(col17(table,"userId"),userId))).returning()).length>0}}}var init_dbStorage=()=>{};function isValidUploadId(id){return typeof id==="string"&&/^[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(id)}function offsetVerdict(input){let{declaredOffset,actualOffset,chunkBytes,totalSize}=input;if(!Number.isFinite(declaredOffset)||declaredOffset<0)return{ok:!1,reason:"offset_mismatch",expected:actualOffset};if(declaredOffset!==actualOffset)return{ok:!1,reason:"offset_mismatch",expected:actualOffset};if(actualOffset+chunkBytes>totalSize)return{ok:!1,reason:"too_long",expected:actualOffset};return{ok:!0}}function isComplete(actualOffset,totalSize){return actualOffset===totalSize&&totalSize>0}function sessionRefusal(input){let{session,callerId,fingerprint,now}=input;if(!session)return"not_found";if(!callerId||session.owner!==callerId)return"not_yours";if(now-session.createdAt>86400000)return"expired";if(fingerprint!=null&&fingerprint!==session.fingerprint)return"wrong_file";return null}function isExpired(session,now){return now-session.createdAt>86400000}function sessionStatus(session,offset){return{uploadId:session.id,offset,size:session.size,originalName:session.originalName,complete:isComplete(offset,session.size)}}var SESSION_TTL_MS=86400000,CHUNK_SIZE_BYTES=8388608,MAX_CHUNK_BYTES=33554432;import{randomUUID as randomUUID10}from"crypto";import{mkdir as mkdir8,open as open2,readdir as readdir3,readFile as readFile2,rm as rm2,stat as stat8,writeFile as writeFile2}from"fs/promises";import path7 from"path";function createResumableStore(basePath){let root=path7.join(basePath,UPLOAD_DIR);function pathsFor(id){if(!isValidUploadId(id))return null;let part=path7.join(root,`${id}.part`),meta=path7.join(root,`${id}.json`);if(!isPathWithinBase(root,part)||!isPathWithinBase(root,meta))return null;return{part,meta}}async function create4(input,now){await mkdir8(root,{recursive:!0});let session={...input,id:randomUUID10(),createdAt:now},paths=pathsFor(session.id);if(!paths)throw Error("Generated upload id was rejected by its own validator");return await writeFile2(paths.meta,JSON.stringify(session),"utf8"),await writeFile2(paths.part,""),session}async function read2(id){let paths=pathsFor(id);if(!paths)return null;try{let raw=await readFile2(paths.meta,"utf8"),parsed=JSON.parse(raw);if(!parsed||typeof parsed.owner!=="string"||typeof parsed.size!=="number")return null;return parsed}catch{return null}}async function offsetOf(id){let paths=pathsFor(id);if(!paths)return null;try{return(await stat8(paths.part)).size}catch{return null}}async function writeAt(id,offset,chunk){let paths=pathsFor(id);if(!paths)return null;let handle=await open2(paths.part,"r+");try{await handle.write(chunk,0,chunk.byteLength,offset)}finally{await handle.close()}return(await stat8(paths.part)).size}async function readAssembled(id){let paths=pathsFor(id);if(!paths)return null;try{return await readFile2(paths.part)}catch{return null}}function partPath(id){return pathsFor(id)?.part??null}async function discardMeta(id){let paths=pathsFor(id);if(!paths)return;await rm2(paths.meta,{force:!0})}async function discard2(id){let paths=pathsFor(id);if(!paths)return;await rm2(paths.part,{force:!0}),await rm2(paths.meta,{force:!0})}async function sweep(now){let removed=0,entries;try{entries=await readdir3(root)}catch{return 0}for(let entry of entries){if(!entry.endsWith(".json"))continue;let id=entry.slice(0,-5);try{let session=await read2(id);if(session&&!isExpired(session,now))continue;await discard2(id),removed+=1}catch{}}return removed}return{create:create4,read:read2,offsetOf,writeAt,readAssembled,partPath,discard:discard2,discardMeta,sweep,root}}var UPLOAD_DIR=".uploads";var init_store4=__esm(()=>{init_helpers3()});var exports_resumable={};__export(exports_resumable,{createResumableRoutes:()=>createResumableRoutes,SESSION_TTL_MS:()=>SESSION_TTL_MS,CHUNK_SIZE_BYTES:()=>CHUNK_SIZE_BYTES});function toBytes(body){if(body instanceof Uint8Array)return body;if(body instanceof ArrayBuffer)return new Uint8Array(body);if(ArrayBuffer.isView(body))return new Uint8Array(body.buffer,body.byteOffset,body.byteLength);if(typeof body==="string")return new TextEncoder().encode(body);return new Uint8Array(0)}function createResumableRoutes(config){let{basePath,storage,logger:logger2,getUserId:getUserId3,canUpload,register}=config,store=createResumableStore(basePath),openSession=async(id,request,fingerprint)=>{let userId=getUserId3(request);if(!await canUpload(request))return{ok:!1,status:403,message:"You are not allowed to upload files."};let session=isValidUploadId(id)?await store.read(id):null,refusal=sessionRefusal({session,callerId:userId,fingerprint,now:Date.now()});if(refusal)return{ok:!1,status:REFUSAL_STATUS[refusal],message:REFUSAL_MESSAGE[refusal]};return{ok:!0,session,userId}},routePostRoot=defineRoute({method:"POST",path:"/",body:Type.Object({originalName:Type.String({minLength:1,maxLength:500}),size:Type.Number(),mimeType:Type.String({maxLength:200}),type:Type.Optional(Type.String({maxLength:40})),fingerprint:Type.String({minLength:1,maxLength:200})}),detail:{tags:["Storage"],summary:"Start a resumable upload"},handler:async({body,request,set:set2})=>{let userId=getUserId3(request);if(!userId)return set2.status=401,{success:!1,message:"Sign in to upload."};if(!await canUpload(request))return set2.status=403,{success:!1,message:"You are not allowed to upload files."};if(!Number.isFinite(body.size)||body.size<=0)return set2.status=400,{success:!1,message:"A size is required to start an upload."};if(body.size>storage.maxFileSizeBytes)return set2.status=413,{success:!1,message:`This file is larger than the ${Math.round(storage.maxFileSizeBytes/1048576)} MB limit.`};if(isMimeTypeListed(storage.blockedMimeTypes,body.mimeType))return set2.status=415,{success:!1,message:"This kind of file cannot be uploaded."};if(storage.allowedMimeTypes?.length&&!isMimeTypeListed(storage.allowedMimeTypes,body.mimeType))return set2.status=415,{success:!1,message:"This kind of file cannot be uploaded."};let session=await store.create({owner:userId,originalName:body.originalName,size:body.size,mimeType:body.mimeType,type:body.type??"file",fingerprint:body.fingerprint},Date.now());return set2.status=201,{success:!0,data:sessionStatus(session,0)}}}),routeGetId=defineRoute({method:"GET",path:"/:id",handler:async({params,request,set:set2})=>{let opened=await openSession(params.id,request);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};let offset=await store.offsetOf(params.id)??0;return{success:!0,data:sessionStatus(opened.session,offset)}}}),routePatchId=defineRoute({method:"PATCH",path:"/:id",detail:{tags:["Storage"],summary:"Append a piece"},handler:async({params,request,body,set:set2})=>{let fingerprint=request.headers.get("upload-fingerprint"),opened=await openSession(params.id,request,fingerprint);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};let declared2=Number(request.headers.get("upload-offset")),actual=await store.offsetOf(params.id)??0,chunk=toBytes(body);if(chunk.byteLength>MAX_CHUNK_BYTES)return set2.status=413,{success:!1,message:`A single piece may not exceed ${MAX_CHUNK_BYTES/1048576} MB.`,data:{offset:actual}};let verdict=offsetVerdict({declaredOffset:declared2,actualOffset:actual,chunkBytes:chunk.byteLength,totalSize:opened.session.size});if(!verdict.ok)return set2.status=409,{success:!1,message:verdict.reason==="too_long"?"This piece would take the file past the size it was started with.":"This piece does not continue where the file ends.",data:{offset:verdict.expected}};let offset=await store.writeAt(params.id,actual,chunk);if(offset===null)return set2.status=500,{success:!1,message:"The piece could not be written."};return{success:!0,data:sessionStatus(opened.session,offset)}}}),routePostIdComplete=defineRoute({method:"POST",path:"/:id/complete",handler:async({params,request,set:set2})=>{let opened=await openSession(params.id,request);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};let offset=await store.offsetOf(params.id)??0;if(!isComplete(offset,opened.session.size))return set2.status=409,{success:!1,message:"The file is not complete yet.",data:sessionStatus(opened.session,offset)};let partPath=store.partPath(params.id);if(!partPath)return set2.status=500,{success:!1,message:"The assembled file could not be found."};let registered=await register({partPath,size:offset,originalName:opened.session.originalName,mimeType:opened.session.mimeType,type:opened.session.type,userId:opened.userId});if(!registered)return set2.status=500,{success:!1,message:"The file could not be registered. Try completing again."};return await store.discardMeta(params.id),logger2.info(`[Storage] Resumable upload finished: ${opened.session.originalName} (${offset} bytes)`),{success:!0,data:{id:registered.id}}}}),routeDeleteId=defineRoute({method:"DELETE",path:"/:id",handler:async({params,request,set:set2})=>{let opened=await openSession(params.id,request);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};return await store.discard(params.id),{success:!0,data:{discarded:!0}}}});return{plugin:collectRoutes([{prefix:"/uploads",routes:[routePostRoot,routeGetId,routePatchId,routePostIdComplete,routeDeleteId]}]),sweep:(now)=>store.sweep(now)}}var REFUSAL_STATUS,REFUSAL_MESSAGE;var init_resumable=__esm(()=>{init_esm3();init_routeCollector();init_helpers3();init_store4();REFUSAL_STATUS={not_found:404,not_yours:404,expired:410,wrong_file:409},REFUSAL_MESSAGE={not_found:"No such upload.",not_yours:"No such upload.",expired:"This upload was abandoned and has been cleaned up. Start it again.",wrong_file:"This is a different file from the one this upload started with."}});var exports_authorization={};__export(exports_authorization,{createAuthorizationDiscoveryRoutes:()=>createAuthorizationDiscoveryRoutes});import{timingSafeEqual as timingSafeEqual4}from"crypto";function tokensMatch2(a,b){let ba=Buffer.from(a),bb=Buffer.from(b);if(ba.length!==bb.length)return!1;return timingSafeEqual4(ba,bb)}function createAuthorizationDiscoveryRoutes(cfg){let{db,schemaTables,logger:logger2,discovery,readState}=cfg,token=discovery.token||process.env.NUCLEUS_DISCOVERY_TOKEN,claimsTable=schemaTables.claims,manifestAuthorized=(request)=>{if(hasGodminRole(request))return!0;if(token){let presented=request.headers.get("x-discovery-token")??"";return tokensMatch2(presented,token)}return!1},authorizeGuardRead=(request,query,set2)=>{let callerId=request.headers.get("x-user-id")??"",isGodmin4=hasGodminRole(request),requested=query.userId;if(requested&&requested!==callerId&&!isGodmin4)return{error:fail6(set2,403,"Forbidden: only godmin can read another user's guards")};let targetUserId=requested&&isGodmin4?requested:callerId;if(!targetUserId)return{error:fail6(set2,401,"Unauthorized: no user context")};return{userId:targetUserId}},guardsHandler=async({request,query,set:set2})=>{let auth=authorizeGuardRead(request,query,set2);if("error"in auth)return auth.error;let tenant=request.headers.get("x-tenant-id")??void 0;if(!readState)return{success:!0,data:{userId:auth.userId,guards:[]}};let{guards}=await resolveClaimGuards(db,schemaTables,auth.userId,readState,{tenant});return{success:!0,data:{userId:auth.userId,guards}}},declared=[defineRoute({method:"POST",path:"/authorization/discover",handler:async({request,set:set2})=>{if(!hasGodminRole(request))return fail6(set2,403,"Forbidden: endpoint discovery requires godmin");if(!discovery.enabled)return fail6(set2,400,"endpointDiscovery is not enabled");return{success:!0,message:"Discovery completed",data:await runEndpointDiscovery(db,schemaTables,discovery,logger2)}}}),defineRoute({method:"GET",path:"/authorization/route-manifest",handler:async({request,query,set:set2})=>{if(!manifestAuthorized(request))return fail6(set2,403,"Forbidden: godmin or a valid x-discovery-token required");if(!claimsTable)return fail6(set2,503,"Claims table unavailable");let service=query.service;if(service){let rows=await getRouteManifest(db,claimsTable,service);return{success:!0,data:{service,routes:rows}}}let all={};for(let svc of discovery.services??[])all[svc.id]=await getRouteManifest(db,claimsTable,svc.id);return{success:!0,data:all}}}),defineRoute({method:"GET",path:"/authorization/role-claims-manifest",handler:async({request,query,set:set2})=>{if(!manifestAuthorized(request))return fail6(set2,403,"Forbidden: godmin or a valid x-discovery-token required");let service=query.service;if(!service)return fail6(set2,400,"service query param required");let map3=await getRoleClaimsManifest(db,schemaTables,service);return{success:!0,data:{service,roleClaims:map3}}}}),defineRoute({method:"GET",path:"/authorization/guards",handler:guardsHandler}),defineRoute({method:"GET",path:"/authorization/quotas",handler:guardsHandler}),defineRoute({method:"GET",path:"/authorization/suppressed-claims",handler:async({request,query,set:set2})=>{let auth=authorizeGuardRead(request,query,set2);if("error"in auth)return auth.error;if(!readState)return{success:!0,data:{userId:auth.userId,suppressedClaims:[],firedGuards:[]}};let tenant=request.headers.get("x-tenant-id")??void 0,{suppressedClaims,firedGuards}=await resolveClaimGuards(db,schemaTables,auth.userId,readState,{tenant});return{success:!0,data:{userId:auth.userId,suppressedClaims,firedGuards}}}})];return collectRoutes([{routes:declared}])}var fail6=(set2,status,message)=>{return set2.status=status,{success:!1,message,data:null}};var init_authorization=__esm(()=>{init_ClaimGuard();init_seed();init_routeCollector();init_adminGuard()});var import_reflect_metadata2=__toESM(require_Reflect(),1);import{createHash as createHash5,randomUUID as randomUUID11}from"crypto";import{pushSchema}from"drizzle-kit/api";import{and as and27,desc as desc7,eq as eq68,lt as lt3,ne as ne4,sql as sql13}from"drizzle-orm";import{drizzle as drizzle2}from"drizzle-orm/node-postgres";import{pgSchema as pgSchema2}from"drizzle-orm/pg-core";import{join as join3}from"path";class LiveStorageProvider{resolve;constructor(resolve){this.resolve=resolve}get kind(){return this.resolve().kind}get describe(){return this.resolve().describe}isAvailable(){return this.resolve().isAvailable()}exists(relativePath){return this.resolve().exists(relativePath)}stat(relativePath){return this.resolve().stat(relativePath)}read(relativePath){return this.resolve().read(relativePath)}write(relativePath,data){return this.resolve().write(relativePath,data)}delete(relativePath){return this.resolve().delete(relativePath)}ensureDir(relativeDir){return this.resolve().ensureDir(relativeDir)}list(relativeDir){return this.resolve().list(relativeDir)}localPath(relativePath){return this.resolve().localPath(relativePath)}close(){return this.resolve().close()}}import{mkdir,readdir,stat,unlink}from"fs/promises";import{dirname,join}from"path";function normalizeRelativePath(relativePath){let cleaned=relativePath.replace(/\\/g,"/").replace(/^\/+/,""),segments=[];for(let segment of cleaned.split("/")){if(!segment||segment===".")continue;if(segment==="..")throw Error(`Path traversal rejected: ${relativePath}`);segments.push(segment)}return segments.join("/")}class LocalStorageProvider{kind="local";describe;basePath;constructor(basePath,_deps){this.basePath=basePath,this.describe=`local:${basePath}`}resolve(relativePath){return join(this.basePath,normalizeRelativePath(relativePath))}async isAvailable(){try{return await mkdir(this.basePath,{recursive:!0}),!0}catch{return!1}}async exists(relativePath){return Bun.file(this.resolve(relativePath)).exists()}async stat(relativePath){try{let info=await stat(this.resolve(relativePath));return{size:info.size,modifiedAt:info.mtime,isDirectory:info.isDirectory()}}catch{return null}}async read(relativePath){let file=Bun.file(this.resolve(relativePath));if(!await file.exists())return null;return Buffer.from(await file.arrayBuffer())}async write(relativePath,data){let full=this.resolve(relativePath);await mkdir(dirname(full),{recursive:!0}),await Bun.write(full,data)}async delete(relativePath){try{return await unlink(this.resolve(relativePath)),!0}catch{return!1}}async ensureDir(relativeDir){await mkdir(this.resolve(relativeDir),{recursive:!0})}async list(relativeDir){try{return await readdir(this.resolve(relativeDir))}catch{return[]}}async localPath(relativePath){let full=this.resolve(relativePath);return await Bun.file(full).exists()?full:null}async close(){}}import{stat as fsStat,mkdir as mkdir2,rename,unlink as unlink2}from"fs/promises";import{dirname as dirname2,join as join2}from"path";var DEFAULT_TIMEOUT_MS=15000,DEFAULT_CACHE_TTL_SECONDS=300;class SmbStorageProvider{kind="smb";describe;getConfig;logger;client=null;clientFingerprint="";cacheDir;cacheTtlMs;cacheEnabled;inFlight=new Map;constructor(getConfig,deps,defaultCacheDir){this.getConfig=getConfig,this.logger=deps.logger;let config=getConfig();this.cacheEnabled=config.cache?.enabled!==!1,this.cacheDir=config.cache?.path||defaultCacheDir,this.cacheTtlMs=(config.cache?.ttlSeconds??DEFAULT_CACHE_TTL_SECONDS)*1000,this.describe=`smb://${config.host}/${config.share}${config.basePath?`/${config.basePath}`:""}`}async getClient(){let{host,share,domain,username,password,port,timeoutMs}=this.getConfig(),fingerprint=`${host}|${share}|${domain}|${username}|${password}|${port}`;if(this.client&&fingerprint===this.clientFingerprint)return this.client;if(this.client){try{this.client.disconnect()}catch{}this.client=null}let imported=await Promise.resolve().then(() => __toESM(require_smb2(),1)).catch(()=>{throw Error('storage.provider is "smb" but the optional @marsaud/smb2 dependency is not installed \u2014 run: bun add @marsaud/smb2')}),SMB2=imported.default??imported;return this.client=new SMB2({share:`\\\\${host}\\${share}`,domain:domain||"WORKGROUP",username,password,port:port??445,autoCloseTimeout:timeoutMs??DEFAULT_TIMEOUT_MS}),this.clientFingerprint=fingerprint,this.client}async call(fn){let client=await this.getClient(),timeoutMs=this.getConfig().timeoutMs??DEFAULT_TIMEOUT_MS;return new Promise((resolve,reject)=>{let settled=!1,timer=setTimeout(()=>{if(settled)return;settled=!0,reject(Error(`SMB operation timed out after ${timeoutMs}ms (${this.describe})`))},timeoutMs);fn(client,(err,value)=>{if(settled)return;if(settled=!0,clearTimeout(timer),err)reject(err);else resolve(value)})})}remotePath(relativePath){let normalized=normalizeRelativePath(relativePath),configuredBase=this.getConfig().basePath,base=configuredBase?normalizeRelativePath(configuredBase):"";return(base?`${base}/${normalized}`:normalized).replace(/\//g,"\\")}cachePath(relativePath){return join2(this.cacheDir,normalizeRelativePath(relativePath))}async isAvailable(){try{return await this.call((client,cb)=>client.readdir(this.getConfig().basePath?this.remotePath(""):"",cb)),!0}catch(error){return this.logger.warn("[Storage/SMB] Share is not reachable",{target:this.describe,error:error instanceof Error?error.message:String(error)}),!1}}async exists(relativePath){try{return await this.call((client,cb)=>client.exists(this.remotePath(relativePath),cb))}catch{return!1}}async stat(relativePath){try{let info=await this.call((client,cb)=>client.stat(this.remotePath(relativePath),cb));return{size:Number(info.size),modifiedAt:new Date(info.mtime),isDirectory:typeof info.isDirectory==="function"?info.isDirectory():await this.looksLikeDirectory(relativePath)}}catch{return null}}async read(relativePath){try{return await this.call((client,cb)=>client.readFile(this.remotePath(relativePath),cb))}catch(error){return this.logger.warn("[Storage/SMB] Read failed",{path:relativePath,error:error instanceof Error?error.message:String(error)}),null}}async write(relativePath,data){let parent=normalizeRelativePath(relativePath).split("/").slice(0,-1).join("/");if(parent)await this.ensureDir(parent);let payload=typeof data==="string"?Buffer.from(data,"utf-8"):Buffer.from(data);if(await this.call((client,cb)=>client.writeFile(this.remotePath(relativePath),payload,cb)),this.cacheEnabled){let target=this.cachePath(relativePath);await mkdir2(dirname2(target),{recursive:!0}).catch(()=>{}),await Bun.write(target,payload).catch(()=>{})}}async delete(relativePath){try{if(await this.call((client,cb)=>client.unlink(this.remotePath(relativePath),cb)),this.cacheEnabled)await unlink2(this.cachePath(relativePath)).catch(()=>{});return!0}catch{return!1}}async ensureDir(relativeDir){let normalized=normalizeRelativePath(relativeDir);if(!normalized)return;let segments=normalized.split("/");for(let i=1;i<=segments.length;i++){let partial=segments.slice(0,i).join("/");try{await this.call((client,cb)=>client.mkdir(this.remotePath(partial),cb))}catch{}}}async looksLikeDirectory(relativePath){try{return await this.call((client,cb)=>client.readdir(this.remotePath(relativePath),cb)),!0}catch{return!1}}async list(relativeDir){try{return await this.call((client,cb)=>client.readdir(this.remotePath(relativeDir),cb))}catch{return[]}}async localPath(relativePath){if(!this.cacheEnabled)return null;let target=this.cachePath(relativePath),cached=await fsStat(target).catch(()=>null);if(cached&&Date.now()-cached.mtimeMs<this.cacheTtlMs)return target;let pending=this.inFlight.get(target);if(pending)return pending;let download=(async()=>{let data=await this.read(relativePath);if(!data)return null;await mkdir2(dirname2(target),{recursive:!0}).catch(()=>{});let tmp=`${target}.${process.pid}.tmp`;try{return await Bun.write(tmp,data),await rename(tmp,target),target}catch(error){return await unlink2(tmp).catch(()=>{}),this.logger.warn("[Storage/SMB] Could not cache file locally",{path:relativePath,error:error instanceof Error?error.message:String(error)}),null}})().finally(()=>{this.inFlight.delete(target)});return this.inFlight.set(target,download),download}async close(){try{this.client?.disconnect()}catch{}this.client=null}}var DEFAULT_EXCLUDES=[".cache",".tmp","lost+found"];async function migrateStorage(options,deps){let{from,to,onProgress}=options,exclude=new Set([...DEFAULT_EXCLUDES,...options.exclude??[]]),maxFiles=options.maxFiles??50000,report={copied:0,skipped:0,failed:0,bytes:0,failures:[],truncated:!1},walk=async(dir)=>{if(report.truncated)return;let entries=await from.list(dir);for(let entry of entries){if(report.truncated)return;if(!entry||entry==="."||entry==="..")continue;let relative=dir?`${dir}/${entry}`:entry;if(exclude.has(entry))continue;let info=await from.stat(relative);if(!info){if(report.failed+=1,report.failures.length<50)report.failures.push(relative);continue}if(info.isDirectory){await walk(relative);continue}if(report.copied+report.skipped>=maxFiles){report.truncated=!0;return}if(await to.exists(relative)){report.skipped+=1;continue}try{let bytes=await from.read(relative);if(!bytes){if(report.failed+=1,report.failures.length<50)report.failures.push(relative);continue}let parent=relative.includes("/")?relative.slice(0,relative.lastIndexOf("/")):"";if(parent)await to.ensureDir(parent);await to.write(relative,bytes),report.copied+=1,report.bytes+=bytes.length,onProgress?.(report.copied,relative)}catch(error){if(report.failed+=1,report.failures.length<50)report.failures.push(relative);deps.logger.warn("[Storage] Migration copy failed",{path:relative,error:error instanceof Error?error.message:String(error)})}}};return await walk(""),deps.logger.info("[Storage] Migration finished",{from:from.describe,to:to.describe,copied:report.copied,skipped:report.skipped,failed:report.failed,truncated:report.truncated}),report}function parseSmbUrl(value){let raw=(value??"").trim();if(!raw)return{host:"",share:""};let withoutScheme=raw.replace(/^smb:\/\//i,"").replace(/^\\\\/,"").replace(/\\/g,"/"),[host="",share="",...rest]=withoutScheme.split("/").filter(Boolean);return{host,share,basePath:rest.length>0?rest.join("/"):void 0}}function createStorageProvider(options,deps){let{basePath,smb,resolveCredential}=options,setting=(key,configValue)=>resolveCredential?.("storage.smb",key,configValue)??configValue,resolveSmbConfig=()=>{let fromUrl=parseSmbUrl(setting("url"));return{...smb,host:fromUrl.host||setting("host",smb?.host)||"",share:fromUrl.share||setting("share",smb?.share)||"",basePath:fromUrl.basePath??setting("base_path",smb?.basePath),domain:setting("domain",smb?.domain),username:setting("username",smb?.username),password:setting("password",smb?.password)}},resolveKind=()=>{let chosen=resolveCredential?.("storage","provider",options.provider);return chosen==="smb"?"smb":chosen==="local"?"local":options.provider??"local"},local=new LocalStorageProvider(basePath,deps),smbProvider=null,smbSignature="",warnedIncomplete=!1;return new LiveStorageProvider(()=>{if(resolveKind()!=="smb")return local;let config=resolveSmbConfig();if(!config.host||!config.share){if(!warnedIncomplete)warnedIncomplete=!0,deps.logger.error('[Storage] provider is "smb" but the host/share are not set \u2014 using local storage until they are');return local}warnedIncomplete=!1;let signature=JSON.stringify([config.host,config.share,config.basePath,config.domain,config.username,config.password,config.port]);if(!smbProvider||signature!==smbSignature)smbProvider?.close(),smbProvider=new SmbStorageProvider(resolveSmbConfig,deps,join3(basePath,".cache","smb")),smbSignature=signature,deps.logger.info("[Storage] SMB target configured",{target:smbProvider.describe});return smbProvider})}init_Services();init_ApiKey();init_Middleware();init_Captcha();init_Domain();init_ServerLogBuffer();init_transports();init_Secrets();var SYSTEM_TABLES=[{table_name:"users",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"email",type:"varchar",length:255},{name:"password",type:"varchar",length:255},{name:"verified_at",type:"timestamp"},{name:"email_verification_token",type:"varchar",length:255},{name:"email_verification_token_expires_at",type:"timestamp"},{name:"email_verification_sent_at",type:"timestamp"},{name:"email_verification_attempts",type:"integer",default:0},{name:"last_login_at",type:"timestamp"},{name:"login_count",type:"integer",default:0},{name:"is_locked",type:"boolean",default:!1},{name:"locked_until",type:"timestamp"},{name:"failed_login_attempts",type:"integer",default:0},{name:"is_god",type:"boolean",default:!1},{name:"cohort_id",type:"uuid",references:{table:"user_cohorts",column:"id",onDelete:"set null"}},{name:"email_verified",type:"boolean",default:!1}],indexes:[{columns:["email"],unique:!0},{columns:["email","is_active"]},{columns:["last_login_at"]},{columns:["is_locked","locked_until"]}]},{table_name:"profiles",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id"}},{name:"first_name",type:"varchar",length:100,notNull:!0},{name:"last_name",type:"varchar",length:100,notNull:!0}],indexes:[{columns:["user_id"],unique:!0},{columns:["first_name","last_name"]}]},{table_name:"roles",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"name",type:"varchar",length:100,notNull:!0},{name:"description",type:"varchar",length:500}],indexes:[{columns:["name"],unique:!0}]},{table_name:"claims",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"action",type:"varchar",length:100,notNull:!0},{name:"description",type:"varchar",length:500},{name:"path",type:"varchar",length:200,notNull:!0},{name:"method",type:"varchar",length:10,notNull:!0},{name:"policy",type:"jsonb"}],indexes:[{columns:["action"],unique:!0},{columns:["path","method"]}]},{table_name:"user_roles",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"role_id",type:"uuid",notNull:!0,references:{table:"roles",column:"id",onDelete:"cascade"}}],indexes:[{columns:["user_id"]},{columns:["role_id"]}],constraints:{unique:[{name:"unique_user_role",columns:["user_id","role_id"]}]}},{table_name:"role_claims",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"role_id",type:"uuid",notNull:!0,references:{table:"roles",column:"id",onDelete:"cascade"}},{name:"claim_id",type:"uuid",notNull:!0,references:{table:"claims",column:"id",onDelete:"cascade"}},{name:"scope",type:"text"}],indexes:[{columns:["role_id"]},{columns:["claim_id"]},{columns:["role_id","claim_id","scope"]}]},{table_name:"files",feature_set:["storage"],add_base_columns:!0,is_form_data:!0,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"name",type:"varchar",length:255,notNull:!0},{name:"original_name",type:"varchar",length:255,notNull:!0},{name:"type",type:"varchar",length:50,enumValues:["image","document","video","audio","profile_picture"]},{name:"path",type:"varchar",length:500,notNull:!0},{name:"size",type:"bigint",mode:"number",notNull:!0},{name:"mime_type",type:"varchar",length:100,notNull:!0},{name:"extension",type:"varchar",length:10,notNull:!0},{name:"uploaded_by",type:"uuid",references:{table:"users",column:"id"}}],indexes:[{columns:["type"]},{columns:["uploaded_by"]},{columns:["size"]}]},{table_name:"addresses",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"owner_type",type:"varchar",length:50,notNull:!0,enumValues:["user","company","contact"]},{name:"owner_id",type:"uuid",notNull:!0},{name:"name",type:"varchar",length:100,notNull:!0},{name:"street",type:"varchar",length:255},{name:"city",type:"varchar",length:100},{name:"state",type:"varchar",length:50},{name:"zip",type:"varchar",length:20},{name:"country",type:"varchar",length:50,default:"US"},{name:"latitude",type:"decimal",precision:10,scale:8},{name:"longitude",type:"decimal",precision:11,scale:8},{name:"neighborhood",type:"varchar",length:100},{name:"apartment",type:"varchar",length:50},{name:"province",type:"varchar",length:100},{name:"district",type:"varchar",length:100},{name:"type",type:"varchar",length:50}],indexes:[{columns:["city","state"]},{columns:["latitude","longitude"]},{columns:["type"]},{columns:["owner_type","owner_id"]}]},{table_name:"phones",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"owner_type",type:"varchar",length:50,notNull:!0,enumValues:["user","company","contact"]},{name:"owner_id",type:"uuid",notNull:!0},{name:"name",type:"varchar",length:100,notNull:!0},{name:"type",type:"varchar",length:50,enumValues:["mobile","office","fax"]},{name:"number",type:"varchar",length:20,notNull:!0},{name:"country_code",type:"varchar",length:10,notNull:!0,default:"+1"},{name:"extension",type:"varchar",length:10}],indexes:[{columns:["number"]},{columns:["type"]},{columns:["owner_type","owner_id"]}]},{table_name:"notifications",feature_set:["notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",notNull:!0},{name:"title",type:"varchar",length:255,notNull:!0},{name:"body",type:"varchar",length:1000},{name:"entity_name",type:"varchar",length:100},{name:"entity_id",type:"uuid"},{name:"type",type:"varchar",length:50,notNull:!0,default:"system",enumValues:["verification","system","custom"]},{name:"source",type:"varchar",length:100},{name:"is_seen",type:"boolean",notNull:!0,default:!1},{name:"seen_at",type:"timestamptz"}],indexes:[{columns:["user_id","created_at"]},{columns:["is_seen"]},{columns:["type"]},{columns:["user_id","type","is_seen"]}]},{table_name:"tenants",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:[],columns:[{name:"subdomain",type:"varchar",length:100,notNull:!0,unique:!0},{name:"schema_name",type:"varchar",length:100,notNull:!0,unique:!0},{name:"company_id",type:"uuid",notNull:!0},{name:"company_name",type:"varchar",length:255},{name:"god_admin_email",type:"varchar",length:255,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"provisioning"},{name:"plan",type:"varchar",length:50,default:"free"},{name:"domain",type:"varchar",length:255},{name:"settings",type:"jsonb",default:"{}"},{name:"trusted_sources",type:"jsonb",default:"[]"},{name:"max_users",type:"integer"},{name:"provisioned_at",type:"timestamptz"},{name:"suspended_at",type:"timestamptz"},{name:"suspended_reason",type:"text"}],indexes:[{columns:["status"]}]},{table_name:"tenant_events",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"tenant_id",type:"uuid",notNull:!0,references:{table:"tenants",column:"id",onDelete:"cascade"}},{name:"event_type",type:"varchar",length:50,notNull:!0},{name:"event_data",type:"jsonb",default:"{}"},{name:"performed_by",type:"varchar",length:255},{name:"ip_address",type:"varchar",length:45}],indexes:[{columns:["tenant_id"]},{columns:["event_type"]}]},{table_name:"tenant_features",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:[],columns:[{name:"tenant_id",type:"uuid",notNull:!0,references:{table:"tenants",column:"id",onDelete:"cascade"}},{name:"feature_name",type:"varchar",length:100,notNull:!0},{name:"enabled",type:"boolean",notNull:!0,default:!0},{name:"config",type:"jsonb",default:"{}"}],indexes:[{columns:["tenant_id","feature_name"],unique:!0},{columns:["feature_name"]}]},{table_name:"domain_hostnames",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Domains",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant",comment:"tenant | organization | user | external"},{name:"owner_id",type:"uuid",notNull:!0,comment:"Product-defined owner reference (e.g. band id, org id)"},{name:"tenant_id",type:"uuid",references:{table:"tenants",column:"id",onDelete:"cascade"},comment:"Tenant this hostname routes to; null for non-tenant owners"},{name:"schema_name",type:"varchar",length:100,comment:"Resolved tenant schema for routing"},{name:"hostname",type:"varchar",length:255,notNull:!0,comment:"Original hostname as entered by the user"},{name:"normalized_hostname",type:"varchar",length:255,notNull:!0,unique:!0,comment:"Lowercased, punycode, port-stripped hostname used for matching"},{name:"hostname_kind",type:"varchar",length:20,notNull:!0,default:"apex",comment:"platform_subdomain | apex | www | subdomain"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending_verification",comment:"draft | pending_verification | verifying | active | failed | disabled | archived"},{name:"routing_status",type:"varchar",length:20,notNull:!0,default:"inactive",comment:"inactive | pending | active | failed"},{name:"certificate_status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"not_required | pending | active | failed"},{name:"verification_status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | verified | failed | expired"},{name:"provider",type:"varchar",length:30,notNull:!0,default:"manual_dns",comment:"manual_dns | cloudflare_for_saas | cloudflare_registrar"},{name:"provider_hostname_id",type:"varchar",length:255},{name:"dns_target",type:"varchar",length:255,comment:"CNAME / A target the customer must point at"},{name:"is_primary",type:"boolean",notNull:!0,default:!1},{name:"redirect_to_hostname_id",type:"uuid",comment:"When set, this hostname 301-redirects to another hostname (e.g. apex to www)"},{name:"activated_at",type:"timestamptz"},{name:"disabled_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["tenant_id"]},{columns:["schema_name"]},{columns:["status"]},{columns:["owner_type","owner_id"]},{columns:["provider","provider_hostname_id"]}]},{table_name:"domain_registrations",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Domains",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant"},{name:"owner_id",type:"uuid",notNull:!0},{name:"tenant_id",type:"uuid",references:{table:"tenants",column:"id",onDelete:"set null"}},{name:"requested_domain",type:"varchar",length:255,notNull:!0},{name:"registered_domain",type:"varchar",length:255},{name:"provider",type:"varchar",length:30,notNull:!0,default:"cloudflare_registrar"},{name:"provider_registration_id",type:"varchar",length:255},{name:"registrant_owner_type",type:"varchar",length:20,notNull:!0,default:"customer",comment:"customer | platform"},{name:"registrant_contact_snapshot",type:"jsonb",default:"{}"},{name:"status",type:"varchar",length:30,notNull:!0,default:"draft",comment:"draft | availability_checked | awaiting_payment | registering | active | failed | transfer_requested | transferred_out | cancelled | expired"},{name:"price_amount",type:"numeric",precision:12,scale:2},{name:"currency",type:"varchar",length:10},{name:"renewal_date",type:"timestamptz"},{name:"auto_renew",type:"boolean",notNull:!0,default:!0},{name:"terms_version",type:"varchar",length:50},{name:"terms_accepted_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"]},{columns:["tenant_id"]},{columns:["status"]}]},{table_name:"domain_verification_challenges",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",notNull:!0,references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"challenge_type",type:"varchar",length:30,notNull:!0,default:"ownership_validation",comment:"hostname_validation | certificate_validation | ownership_validation"},{name:"record_type",type:"varchar",length:10,notNull:!0,default:"TXT",comment:"TXT | CNAME | A | AAAA | HTTP"},{name:"record_name",type:"varchar",length:255,notNull:!0},{name:"record_value",type:"text",notNull:!0},{name:"expected_target",type:"varchar",length:255},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | verified | failed | expired"},{name:"expires_at",type:"timestamptz"},{name:"verified_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["status"]}]},{table_name:"domain_provider_records",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",notNull:!0,references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:30,notNull:!0},{name:"provider_resource_type",type:"varchar",length:30,notNull:!0,comment:"custom_hostname | certificate | validation | zone | dns_record | registration"},{name:"provider_resource_id",type:"varchar",length:255},{name:"provider_status",type:"varchar",length:50},{name:"last_synced_at",type:"timestamptz"},{name:"raw_status",type:"jsonb",default:"{}"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["provider","provider_resource_id"]}]},{table_name:"domain_events",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"domain_registration_id",type:"uuid",references:{table:"domainRegistrations",column:"id",onDelete:"cascade"}},{name:"event_type",type:"varchar",length:50,notNull:!0},{name:"actor_type",type:"varchar",length:20},{name:"actor_id",type:"varchar",length:255},{name:"message",type:"text"},{name:"ip_address",type:"varchar",length:45},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["event_type"]}]},{table_name:"verifications",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"requirement_id",type:"uuid",notNull:!0,references:{table:"verificationRequirements",column:"id"}},{name:"verifier_id",type:"uuid",notNull:!0,references:{table:"users",column:"id"}},{name:"signature_id",type:"uuid",references:{table:"files",column:"id"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"decision",type:"varchar",length:50,notNull:!0,default:"pending",enumValues:["approved","rejected","pending"]},{name:"reason",type:"text"},{name:"diff",type:"jsonb"}],indexes:[{columns:["instance_id"]},{columns:["requirement_id"]},{columns:["verifier_id"]},{columns:["entity_name","entity_id"]},{columns:["entity_name","entity_id","step_order"]},{columns:["decision"]}]},{table_name:"verificationRequirements",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"step_node_id",type:"varchar",length:100,notNull:!0},{name:"verifier_node_id",type:"varchar",length:100,notNull:!0},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"verifier_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role"]},{name:"verifier_user_id",type:"uuid"},{name:"verifier_role",type:"varchar",length:100},{name:"require_signature",type:"boolean",notNull:!0,default:!1},{name:"all_must_approve",type:"boolean",notNull:!0,default:!1},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","approved","rejected"]}],indexes:[{columns:["instance_id"]},{columns:["instance_id","step_order"]},{columns:["entity_name","entity_id"]},{columns:["verifier_user_id"]},{columns:["status"]}]},{table_name:"verificationFlows",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"trigger_on",type:"varchar",length:50,notNull:!0,default:"update",enumValues:["create","update","delete","manual"]},{name:"trigger_fields",type:"jsonb"},{name:"is_draft",type:"boolean",notNull:!0,default:!0},{name:"published_at",type:"timestamptz"},{name:"viewport",type:"jsonb"}],indexes:[{columns:["entity_name"]},{columns:["entity_name","trigger_on"]},{columns:["is_draft"]}]},{table_name:"verificationSteps",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"node_type",type:"varchar",length:50,notNull:!0,default:"step",enumValues:["step","verifier","notification"]},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"name",type:"varchar",length:255},{name:"description",type:"text"},{name:"position_x",type:"numeric",notNull:!0,default:0},{name:"position_y",type:"numeric",notNull:!0,default:0},{name:"width",type:"numeric"},{name:"height",type:"numeric"},{name:"style",type:"jsonb"},{name:"data",type:"jsonb"}],indexes:[{columns:["flow_id"]},{columns:["entity_name"]},{columns:["flow_id","node_id"],unique:!0},{columns:["entity_name","step_order"]}]},{table_name:"verificationEdges",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"edge_id",type:"varchar",length:100,notNull:!0},{name:"source_node_id",type:"varchar",length:100,notNull:!0},{name:"target_node_id",type:"varchar",length:100,notNull:!0},{name:"source_handle",type:"varchar",length:50},{name:"target_handle",type:"varchar",length:50},{name:"edge_type",type:"varchar",length:50,default:"default",enumValues:["default","conditional","success","failure"]},{name:"label",type:"varchar",length:255},{name:"condition",type:"jsonb"},{name:"style",type:"jsonb"},{name:"animated",type:"boolean",default:!1}],indexes:[{columns:["flow_id"]},{columns:["flow_id","edge_id"],unique:!0},{columns:["source_node_id"]},{columns:["target_node_id"]}]},{table_name:"verificationNotificationRules",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"trigger",type:"varchar",length:50,notNull:!0,enumValues:["on_flow_started","on_step_reached","on_approved","on_rejected","on_flow_completed"]},{name:"title_template",type:"varchar",length:255},{name:"body_template",type:"text"},{name:"starts_at",type:"timestamptz"},{name:"expires_at",type:"timestamptz"}],indexes:[{columns:["flow_id"]},{columns:["flow_id","node_id"],unique:!0},{columns:["trigger"]}]},{table_name:"verificationNotificationRecipients",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"rule_id",type:"uuid",notNull:!0,references:{table:"verificationNotificationRules",column:"id",onDelete:"cascade"}},{name:"recipient_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role","all_verifiers","step_verifier","entity_creator"]},{name:"recipient_user_id",type:"uuid"},{name:"recipient_role",type:"varchar",length:100}],indexes:[{columns:["rule_id"]},{columns:["recipient_type"]}]},{table_name:"verificationVerifierConfigs",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"verifier_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role"]},{name:"verifier_user_id",type:"uuid"},{name:"verifier_role",type:"varchar",length:100},{name:"require_signature",type:"boolean",notNull:!0,default:!1},{name:"all_must_approve",type:"boolean",notNull:!0,default:!1}],indexes:[{columns:["flow_id"]},{columns:["flow_id","node_id"],unique:!0},{columns:["verifier_type"]}]},{table_name:"verificationInstances",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"started_by",type:"uuid",references:{table:"users",column:"id"}},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","completed","rejected","cancelled"]},{name:"current_step_order",type:"integer",notNull:!0,default:1},{name:"started_at",type:"timestamptz",notNull:!0,defaultRaw:"now()"},{name:"completed_at",type:"timestamptz"}],indexes:[{columns:["flow_id"]},{columns:["entity_name","entity_id"]},{columns:["entity_name","entity_id","status"]},{columns:["status"]},{columns:["started_by"]}]},{table_name:"verificationNotificationChannels",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"rule_id",type:"uuid",notNull:!0,references:{table:"verificationNotificationRules",column:"id",onDelete:"cascade"}},{name:"channel",type:"varchar",length:30,notNull:!0,enumValues:["portal","email","sms","telegram","webhook"]}],indexes:[{columns:["rule_id"]},{columns:["rule_id","channel"],unique:!0},{columns:["channel"]}]},{table_name:"user_cohorts",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"created_by",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}},{name:"expires_at",type:"timestamptz"},{name:"user_count",type:"integer",notNull:!0,default:0},{name:"metadata",type:"jsonb",default:"{}"}]},{table_name:"user_sessions",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"refresh_token_hash",type:"varchar",length:255},{name:"device_fingerprint",type:"varchar",length:255},{name:"device_name",type:"varchar",length:100},{name:"device_type",type:"varchar",length:50,enumValues:["desktop","mobile","tablet","unknown"]},{name:"browser_name",type:"varchar",length:50},{name:"browser_version",type:"varchar",length:20},{name:"os_name",type:"varchar",length:50},{name:"os_version",type:"varchar",length:20},{name:"ip_address",type:"varchar",length:45,notNull:!0},{name:"location_country",type:"varchar",length:100},{name:"location_city",type:"varchar",length:100},{name:"location_coordinates",type:"varchar",length:50},{name:"last_activity_at",type:"timestamptz",notNull:!0,defaultRaw:"now()"},{name:"expires_at",type:"timestamptz",notNull:!1},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:100,enumValues:["user_logout","user_revoked","admin_revoked","security_concern","password_changed","expired","replaced"]},{name:"is_current",type:"boolean",notNull:!0,default:!1},{name:"login_method",type:"varchar",length:50,enumValues:["password","oauth_google","oauth_github","oauth_microsoft","magic_link","sso","api_key"]},{name:"remember_me",type:"boolean",notNull:!0,default:!1},{name:"trust_score",type:"integer",default:100},{name:"approval_status",type:"varchar",length:20,default:"approved",enumValues:["approved","pending","rejected"]},{name:"approval_token",type:"varchar",length:64},{name:"approval_requested_at",type:"timestamptz"},{name:"approval_responded_at",type:"timestamptz"}],indexes:[{columns:["user_id"]},{columns:["token_hash"],unique:!0},{columns:["refresh_token_hash"]},{columns:["user_id","is_active"]},{columns:["expires_at"]},{columns:["device_fingerprint"]},{columns:["ip_address"]},{columns:["last_activity_at"]},{columns:["approval_status"]},{columns:["approval_token"]}]},{table_name:"trusted_devices",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:64,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",enumValues:["pending","trusted","revoked"]},{name:"origin_session_id",type:"uuid"},{name:"label",type:"varchar",length:120},{name:"device_fingerprint",type:"varchar",length:255},{name:"first_seen_ip",type:"varchar",length:45},{name:"last_seen_ip",type:"varchar",length:45},{name:"last_seen_at",type:"timestamptz"},{name:"expires_at",type:"timestamptz"},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:30,enumValues:["user_revoked","password_reset","logout","admin_revoked","expired","replaced"]}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["user_id","status"]},{columns:["origin_session_id"]},{columns:["expires_at"]}]},{table_name:"password_reset_tokens",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:["email"],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"used_at",type:"timestamptz"}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["expires_at"]}]},{table_name:"magic_link_tokens",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:["email"],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"email",type:"varchar",length:255,notNull:!0},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"used_at",type:"timestamptz"}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["email"]},{columns:["expires_at"]}]},{table_name:"webauthn_credentials",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:[],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"credential_id",type:"text",notNull:!0},{name:"public_key",type:"text",notNull:!0},{name:"counter",type:"bigint",mode:"number",notNull:!0,defaultValue:0},{name:"transports",type:"jsonb"},{name:"device_type",type:"varchar",length:32},{name:"backed_up",type:"boolean",notNull:!0,defaultValue:!1},{name:"aaguid",type:"varchar",length:64},{name:"authenticator_attachment",type:"varchar",length:32},{name:"nickname",type:"varchar",length:128},{name:"last_used_at",type:"timestamptz"},{name:"revoked_at",type:"timestamptz"}],indexes:[{columns:["credential_id"],unique:!0},{columns:["user_id"]}]},{table_name:"webauthn_challenges",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:[],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id",onDelete:"cascade"}},{name:"challenge",type:"text",notNull:!0},{name:"challenge_type",type:"varchar",length:32,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"consumed_at",type:"timestamptz"}],indexes:[{columns:["challenge"],unique:!0},{columns:["user_id"]},{columns:["expires_at"]}]},{table_name:"audit_logs",feature_set:["audit"],add_base_columns:!1,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","DELETE","PATCH","TOGGLE","VERIFICATION"],columns:[{name:"id",type:"uuid",primaryKey:!0,defaultRaw:"gen_random_uuid()"},{name:"entity_id",type:"uuid"},{name:"entity_name",type:"text",notNull:!0},{name:"operation_type",type:"text",notNull:!0},{name:"user_id",type:"uuid"},{name:"ip_address",type:"text"},{name:"user_agent",type:"text"},{name:"summary",type:"text"},{name:"severity",type:"text",default:"info"},{name:"category",type:"text"},{name:"occurrence_count",type:"integer",default:1},{name:"last_occurrence_at",type:"timestamp"},{name:"old_values",type:"jsonb"},{name:"new_values",type:"jsonb"},{name:"created_at",type:"timestamp",notNull:!0,defaultRaw:"now()"},{name:"path",type:"text"},{name:"query",type:"text"}],indexes:[{columns:["entity_id"]},{columns:["entity_name"]},{columns:["user_id"]},{columns:["created_at"]},{columns:["severity"]},{columns:["category"]}]},{table_name:"monitoring_metrics",feature_set:["monitoring"],add_base_columns:!1,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","DELETE","PATCH","TOGGLE","VERIFICATION"],columns:[{name:"id",type:"uuid",primaryKey:!0,defaultRaw:"gen_random_uuid()"},{name:"metric_type",type:"text",notNull:!0},{name:"metric_name",type:"text",notNull:!0},{name:"value",type:"doublePrecision",notNull:!0},{name:"tags",type:"jsonb"},{name:"recorded_at",type:"timestamp",notNull:!0}],indexes:[{columns:["metric_type"]},{columns:["metric_name"]},{columns:["recorded_at"]}]},{table_name:"oauth_accounts",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0,enumValues:["google","github","microsoft","discord","facebook","twitter","apple","custom"]},{name:"provider_account_id",type:"varchar",length:255,notNull:!0},{name:"provider_email",type:"varchar",length:255},{name:"provider_name",type:"varchar",length:255},{name:"provider_avatar_url",type:"text"},{name:"access_token",type:"text"},{name:"refresh_token",type:"text"},{name:"token_expires_at",type:"timestamp"},{name:"scope",type:"text"},{name:"raw_profile",type:"jsonb"},{name:"is_primary",type:"boolean",notNull:!0,default:!1},{name:"last_used_at",type:"timestamp"}],indexes:[{columns:["user_id"]},{columns:["provider","provider_account_id"],unique:!0},{columns:["provider_email"]},{columns:["user_id","provider"]}],constraints:{unique:[{name:"unique_provider_account",columns:["provider","provider_account_id"]}]}},{table_name:"api_keys",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],bulk_endpoints_enabled:!1,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"key_hash",type:"varchar",length:255,notNull:!0},{name:"key_preview",type:"varchar",length:20,notNull:!0},{name:"owner_type",type:"varchar",length:30,notNull:!0,default:"personal",enumValues:["personal","application"]},{name:"application_name",type:"varchar",length:255},{name:"allowed_roles",type:"jsonb",notNull:!0,default:"[]"},{name:"allowed_claims",type:"jsonb",notNull:!0,default:"[]"},{name:"allowed_scopes",type:"jsonb",notNull:!0,default:"[]"},{name:"expires_at",type:"timestamptz"},{name:"last_used_at",type:"timestamptz"},{name:"last_used_ip",type:"varchar",length:45},{name:"usage_count",type:"integer",notNull:!0,default:0},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:255}],indexes:[{columns:["key_hash"],unique:!0},{columns:["user_id"]},{columns:["user_id","is_active"]},{columns:["owner_type"]},{columns:["expires_at"]},{columns:["last_used_at"]}]},{table_name:"backup_logs",feature_set:["backup"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main","all"],excluded_schemas:[],excluded_methods:["PUT","PATCH"],columns:[{name:"backup_name",type:"varchar",length:255,notNull:!0},{name:"file_name",type:"varchar",length:500,notNull:!0},{name:"schema_name",type:"varchar",length:100,notNull:!0},{name:"format",type:"varchar",length:20,notNull:!0,default:"json"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending"},{name:"trigger",type:"varchar",length:20,notNull:!0,default:"manual"},{name:"size_bytes",type:"integer"},{name:"table_count",type:"integer"},{name:"row_count",type:"integer"},{name:"included_tables",type:"jsonb",default:"[]"},{name:"excluded_tables",type:"jsonb",default:"[]"},{name:"error_message",type:"text"},{name:"started_at",type:"timestamp"},{name:"completed_at",type:"timestamp"},{name:"performed_by",type:"varchar",length:255},{name:"cron_expression",type:"varchar",length:100},{name:"retention_days",type:"integer"}],indexes:[{columns:["schema_name"]},{columns:["status"]},{columns:["trigger"]},{columns:["created_at"]}]},{table_name:"payment_transactions",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"order_id",type:"varchar",length:255},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_transaction_id",type:"varchar",length:255},{name:"provider_payment_id",type:"varchar",length:255},{name:"payment_method",type:"varchar",length:50},{name:"amount",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"currency",type:"varchar",length:10,notNull:!0,default:"TRY"},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","processing","completed","failed","refunded","partially_refunded","cancelled"]},{name:"status_code",type:"integer"},{name:"status_message",type:"text"},{name:"card_last_four",type:"varchar",length:4},{name:"card_type",type:"varchar",length:50},{name:"card_association",type:"varchar",length:50},{name:"installment",type:"integer",default:1},{name:"is_three_d_secure",type:"boolean",default:!1},{name:"provider_response",type:"jsonb",default:"{}"},{name:"metadata",type:"jsonb",default:"{}"},{name:"refunded_amount",type:"numeric",precision:12,scale:2,default:0},{name:"refunded_at",type:"timestamptz"},{name:"completed_at",type:"timestamptz"},{name:"failed_at",type:"timestamptz"},{name:"ip_address",type:"varchar",length:45}],indexes:[{columns:["user_id"]},{columns:["order_id"]},{columns:["provider"]},{columns:["provider_payment_id"]},{columns:["status"]},{columns:["user_id","status"]}]},{table_name:"payment_methods",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"type",type:"varchar",length:30,notNull:!0,default:"card",enumValues:["card","bank_account","wallet"]},{name:"alias",type:"varchar",length:100},{name:"card_last_four",type:"varchar",length:4},{name:"card_type",type:"varchar",length:50},{name:"card_association",type:"varchar",length:50},{name:"card_family",type:"varchar",length:100},{name:"card_bank_name",type:"varchar",length:100},{name:"provider_card_user_key",type:"varchar",length:255},{name:"provider_card_token",type:"varchar",length:255},{name:"bin_number",type:"varchar",length:8},{name:"is_default",type:"boolean",default:!1},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["user_id","is_default"]},{columns:["provider_card_user_key"]}]},{table_name:"payment_webhook_logs",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["PUT","PATCH","DELETE"],columns:[{name:"provider",type:"varchar",length:50,notNull:!0},{name:"event_type",type:"varchar",length:100,notNull:!0},{name:"provider_payment_id",type:"varchar",length:255},{name:"raw_payload",type:"jsonb",notNull:!0},{name:"processed",type:"boolean",default:!1},{name:"processing_result",type:"jsonb"},{name:"error_message",type:"text"},{name:"ip_address",type:"varchar",length:45},{name:"idempotency_key",type:"varchar",length:255}],indexes:[{columns:["provider"]},{columns:["event_type"]},{columns:["provider_payment_id"]},{columns:["processed"]},{columns:["idempotency_key"],unique:!0}]},{table_name:"payment_sub_merchants",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_sub_merchant_key",type:"varchar",length:255},{name:"external_id",type:"varchar",length:255},{name:"type",type:"varchar",length:50,notNull:!0,default:"personal",enumValues:["personal","private_company","limited_or_joint_stock_company"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","active","suspended","rejected"]},{name:"name",type:"varchar",length:255,notNull:!0},{name:"email",type:"varchar",length:255,notNull:!0},{name:"gsm_number",type:"varchar",length:20},{name:"address",type:"text"},{name:"iban",type:"varchar",length:50},{name:"contact_name",type:"varchar",length:100},{name:"contact_surname",type:"varchar",length:100},{name:"identity_number",type:"varchar",length:20},{name:"tax_office",type:"varchar",length:100},{name:"tax_number",type:"varchar",length:20},{name:"legal_company_title",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,default:"TRY"},{name:"commission_rate",type:"numeric",precision:5,scale:2,default:0},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["provider_sub_merchant_key"]},{columns:["external_id"]},{columns:["status"]},{columns:["email"]}]},{table_name:"payment_commission_splits",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"transaction_id",type:"uuid",notNull:!0,references:{table:"payment_transactions",column:"id",onDelete:"cascade"}},{name:"sub_merchant_id",type:"uuid",notNull:!0,references:{table:"payment_sub_merchants",column:"id"}},{name:"basket_item_id",type:"varchar",length:255},{name:"item_price",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"sub_merchant_price",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"platform_commission",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"commission_rate",type:"numeric",precision:5,scale:2,default:0},{name:"provider_split_id",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,notNull:!0,default:"TRY"},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","approved","disapproved","refunded"]},{name:"approved_at",type:"timestamptz"},{name:"disapproved_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["transaction_id"]},{columns:["sub_merchant_id"]},{columns:["status"]},{columns:["transaction_id","sub_merchant_id"]},{columns:["provider_split_id"]}]},{table_name:"payment_products",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_product_id",type:"varchar",length:255},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"type",type:"varchar",length:30,default:"service",enumValues:["service","good"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","archived","draft"]},{name:"images",type:"jsonb",default:"[]"},{name:"unit_label",type:"varchar",length:50},{name:"url",type:"varchar",length:500},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["provider"]},{columns:["provider_product_id"]},{columns:["name"]},{columns:["status"]},{columns:["type"]}]},{table_name:"payment_prices",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"product_id",type:"uuid",notNull:!0,references:{table:"payment_products",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_price_id",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,notNull:!0,default:"USD"},{name:"unit_amount",type:"integer",notNull:!0,default:0},{name:"unit_amount_decimal",type:"varchar",length:30},{name:"type",type:"varchar",length:30,notNull:!0,default:"one_time",enumValues:["one_time","recurring"]},{name:"billing_scheme",type:"varchar",length:30,default:"per_unit",enumValues:["per_unit","tiered"]},{name:"nickname",type:"varchar",length:255},{name:"recurring_interval",type:"varchar",length:20,enumValues:["day","week","month","year"]},{name:"recurring_interval_count",type:"integer",default:1},{name:"recurring_usage_type",type:"varchar",length:20,default:"licensed",enumValues:["licensed","metered"]},{name:"recurring_aggregate_usage",type:"varchar",length:30,enumValues:["sum","last_during_period","last_ever","max"]},{name:"transform_quantity_divide_by",type:"integer"},{name:"transform_quantity_round",type:"varchar",length:10,enumValues:["up","down"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","archived"]},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["product_id"]},{columns:["provider"]},{columns:["provider_price_id"]},{columns:["type"]},{columns:["currency"]},{columns:["status"]},{columns:["product_id","status"]}]},{table_name:"payment_customers",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_customer_id",type:"varchar",length:255,notNull:!0},{name:"email",type:"varchar",length:255,notNull:!0},{name:"name",type:"varchar",length:255},{name:"phone",type:"varchar",length:50},{name:"description",type:"text"},{name:"address",type:"jsonb",default:"{}"},{name:"tax_id_type",type:"varchar",length:50},{name:"tax_id_value",type:"varchar",length:100},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["provider_customer_id"]},{columns:["email"]},{columns:["user_id","provider"],unique:!0}]},{table_name:"payment_subscriptions",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"customer_id",type:"uuid",notNull:!0,references:{table:"payment_customers",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_subscription_id",type:"varchar",length:255},{name:"status",type:"varchar",length:30,notNull:!0,default:"incomplete",enumValues:["active","past_due","unpaid","canceled","incomplete","incomplete_expired","trialing","paused"]},{name:"collection_method",type:"varchar",length:30,default:"charge_automatically",enumValues:["charge_automatically","send_invoice"]},{name:"current_period_start",type:"timestamptz"},{name:"current_period_end",type:"timestamptz"},{name:"cancel_at_period_end",type:"boolean",default:!1},{name:"canceled_at",type:"timestamptz"},{name:"trial_start",type:"timestamptz"},{name:"trial_end",type:"timestamptz"},{name:"items",type:"jsonb",default:"[]"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["customer_id"]},{columns:["provider"]},{columns:["provider_subscription_id"]},{columns:["status"]},{columns:["customer_id","status"]}]},{table_name:"payment_invoices",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"customer_id",type:"uuid",notNull:!0,references:{table:"payment_customers",column:"id"}},{name:"subscription_id",type:"uuid",references:{table:"payment_subscriptions",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_invoice_id",type:"varchar",length:255},{name:"status",type:"varchar",length:30,notNull:!0,default:"draft",enumValues:["draft","open","paid","uncollectible","void"]},{name:"collection_method",type:"varchar",length:30,default:"charge_automatically",enumValues:["charge_automatically","send_invoice"]},{name:"currency",type:"varchar",length:10,notNull:!0,default:"USD"},{name:"amount_due",type:"integer",default:0},{name:"amount_paid",type:"integer",default:0},{name:"amount_remaining",type:"integer",default:0},{name:"description",type:"text"},{name:"hosted_invoice_url",type:"varchar",length:1000},{name:"invoice_pdf",type:"varchar",length:1000},{name:"due_date",type:"timestamptz"},{name:"days_until_due",type:"integer"},{name:"period_start",type:"timestamptz"},{name:"period_end",type:"timestamptz"},{name:"paid_at",type:"timestamptz"},{name:"voided_at",type:"timestamptz"},{name:"lines",type:"jsonb",default:"[]"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["customer_id"]},{columns:["subscription_id"]},{columns:["provider"]},{columns:["provider_invoice_id"]},{columns:["status"]},{columns:["customer_id","status"]}]},{table_name:"chat_conversations",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"type",type:"varchar",length:20,notNull:!0,default:"direct",enumValues:["direct","group"]},{name:"title",type:"varchar",length:255},{name:"description",type:"text"},{name:"avatar_file_id",type:"uuid"},{name:"direct_key",type:"varchar",length:255},{name:"last_message_at",type:"timestamptz"},{name:"last_message_preview",type:"varchar",length:500},{name:"last_message_sender_id",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}}],indexes:[{columns:["direct_key"],unique:!0},{columns:["type"]},{columns:["last_message_at"]}]},{table_name:"chat_participants",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"role",type:"varchar",length:20,notNull:!0,default:"member",enumValues:["member","admin","owner"]},{name:"last_read_message_id",type:"uuid"},{name:"last_read_at",type:"timestamptz"},{name:"unread_count",type:"integer",notNull:!0,default:0},{name:"muted",type:"boolean",notNull:!0,default:!1},{name:"muted_until",type:"timestamptz"},{name:"notifications_enabled",type:"boolean",notNull:!0,default:!0},{name:"left_at",type:"timestamptz"}],indexes:[{columns:["user_id"]},{columns:["conversation_id"]}],constraints:{unique:[{name:"unique_conversation_participant",columns:["conversation_id","user_id"]}]}},{table_name:"chat_messages",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"sender_id",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}},{name:"content",type:"text"},{name:"content_type",type:"varchar",length:20,notNull:!0,default:"text",enumValues:["text","image","file","video","audio","system"]},{name:"reply_to_id",type:"uuid",references:{table:"chat_messages",column:"id",onDelete:"set null"}},{name:"metadata",type:"jsonb",default:"{}"},{name:"client_message_id",type:"varchar",length:100},{name:"edited_at",type:"timestamptz"},{name:"deleted_at",type:"timestamptz"}],indexes:[{columns:["conversation_id","created_at"]},{columns:["sender_id"]},{columns:["reply_to_id"]}]},{table_name:"chat_message_attachments",feature_set:["authentication","chat","storage"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"message_id",type:"uuid",notNull:!0,references:{table:"chat_messages",column:"id",onDelete:"cascade"}},{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"file_id",type:"uuid",notNull:!0,references:{table:"files",column:"id",onDelete:"cascade"}},{name:"kind",type:"varchar",length:20,notNull:!0,default:"file",enumValues:["image","video","audio","file"]},{name:"original_name",type:"varchar",length:255},{name:"mime_type",type:"varchar",length:100},{name:"size",type:"bigint",mode:"number"},{name:"width",type:"integer"},{name:"height",type:"integer"},{name:"duration",type:"integer"}],indexes:[{columns:["message_id"]},{columns:["conversation_id"]},{columns:["file_id"]}]},{table_name:"payment_splits",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"transaction_id",type:"uuid",references:{table:"paymentTransactions",column:"id",onDelete:"set null"}},{name:"recipient_owner_type",type:"varchar",length:20,notNull:!0,default:"seller",comment:"seller | platform | tenant | user"},{name:"recipient_owner_id",type:"uuid",notNull:!0},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"gross_amount",type:"bigint",mode:"number",notNull:!0,comment:"Minor units"},{name:"provider_fee_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"platform_fee_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"reserve_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"net_payable_amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"available_for_payout_at",type:"timestamptz"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | available | payout_requested | paid | held | refunded | disputed | cancelled"},{name:"source_type",type:"varchar",length:50},{name:"source_id",type:"varchar",length:255},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["recipient_owner_type","recipient_owner_id"]},{columns:["status"]},{columns:["transaction_id"]}]},{table_name:"payment_ledger_entries",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"account",type:"varchar",length:40,notNull:!0,comment:"platform_revenue | provider_fee | seller_payable | reserve | refund_liability | dispute_liability | payout_in_transit | payout_completed"},{name:"owner_type",type:"varchar",length:20},{name:"owner_id",type:"uuid"},{name:"direction",type:"varchar",length:6,notNull:!0,comment:"debit | credit"},{name:"amount",type:"bigint",mode:"number",notNull:!0,comment:"Minor units"},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"entry_type",type:"varchar",length:40,notNull:!0,comment:"split | refund | payout | reserve_hold | reserve_release | dispute | adjustment"},{name:"reference_type",type:"varchar",length:50},{name:"reference_id",type:"varchar",length:255},{name:"split_id",type:"uuid",references:{table:"paymentSplits",column:"id",onDelete:"set null"}},{name:"description",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["account"]},{columns:["owner_type","owner_id"]},{columns:["entry_type"]},{columns:["reference_type","reference_id"]}]},{table_name:"payment_settlement_policies",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],group_name:"Payments Marketplace",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant",comment:"tenant | seller"},{name:"owner_id",type:"uuid",notNull:!0},{name:"default_delay_days",type:"integer",notNull:!0,default:7},{name:"new_seller_delay_days",type:"integer",notNull:!0,default:14},{name:"reserve_rate",type:"numeric",precision:5,scale:4,notNull:!0,default:0,comment:"Fraction 0..1 held as reserve"},{name:"reserve_days",type:"integer",notNull:!0,default:0},{name:"minimum_payout_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"currency",type:"varchar",length:10},{name:"early_payout_enabled",type:"boolean",notNull:!0,default:!1},{name:"status",type:"varchar",length:20,notNull:!0,default:"active"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"],unique:!0}]},{table_name:"payment_reserves",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"seller"},{name:"owner_id",type:"uuid",notNull:!0},{name:"split_id",type:"uuid",references:{table:"paymentSplits",column:"id",onDelete:"set null"}},{name:"amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"reason",type:"varchar",length:30,notNull:!0,default:"refund_window",comment:"refund_window | chargeback_risk | new_seller | manual_hold | dispute | compliance_review"},{name:"status",type:"varchar",length:20,notNull:!0,default:"held",comment:"held | released | consumed | cancelled"},{name:"release_at",type:"timestamptz"},{name:"released_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"]},{columns:["status"]},{columns:["release_at"]}]},{table_name:"payment_payout_requests",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"recipient_owner_type",type:"varchar",length:20,notNull:!0,default:"seller"},{name:"recipient_owner_id",type:"uuid",notNull:!0},{name:"amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | approved | rejected | processing | completed | failed | cancelled"},{name:"provider",type:"varchar",length:50},{name:"provider_payout_id",type:"varchar",length:255},{name:"provider_transfer_id",type:"varchar",length:255},{name:"destination",type:"varchar",length:255},{name:"requested_by",type:"uuid"},{name:"decided_by",type:"uuid"},{name:"decided_at",type:"timestamptz"},{name:"completed_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["recipient_owner_type","recipient_owner_id"]},{columns:["status"]}]},{table_name:"payment_disputes",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Payments Marketplace",columns:[{name:"transaction_id",type:"uuid",references:{table:"paymentTransactions",column:"id",onDelete:"set null"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_dispute_id",type:"varchar",length:255},{name:"owner_type",type:"varchar",length:20},{name:"owner_id",type:"uuid"},{name:"amount",type:"bigint",mode:"number"},{name:"currency",type:"varchar",length:10},{name:"reason",type:"varchar",length:100},{name:"status",type:"varchar",length:30,notNull:!0,default:"open",comment:"open | under_review | won | lost | accepted | cancelled"},{name:"evidence_due_at",type:"timestamptz"},{name:"resolved_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["provider","provider_dispute_id"]},{columns:["status"]},{columns:["owner_type","owner_id"]},{columns:["transaction_id"]}]},{table_name:"nucleus_secrets",feature_set:["secrets"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["GET","POST","PUT","PATCH","DELETE","TOGGLE"],bulk_endpoints_enabled:!1,group_name:"Secrets",columns:[{name:"scope",type:"varchar",length:200,notNull:!0,comment:"Config dot-path that owns the credential, e.g. authentication.oauth.providers.microsoft"},{name:"key",type:"varchar",length:120,notNull:!0,comment:"Leaf key under that path, e.g. clientSecret"},{name:"value_enc",type:"text",notNull:!0,comment:"AES-256-GCM envelope v1:iv:tag:ciphertext \u2014 never returned by any route"},{name:"previous_enc",type:"text",comment:"Value replaced by the last rotation, retained for one-step rollback"},{name:"preview",type:"varchar",length:80},{name:"kind",type:"varchar",length:30,notNull:!0,default:"text",enumValues:["text","password","json","connection_string","pem"]},{name:"description",type:"varchar",length:500},{name:"version",type:"integer",notNull:!0,default:1},{name:"rotated_at",type:"timestamptz"},{name:"last_used_at",type:"timestamptz"}],indexes:[{columns:["scope","key"],unique:!0},{columns:["scope"]}]},{table_name:"integration_sources",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"name",type:"varchar",length:150,notNull:!0},{name:"slug",type:"varchar",length:150,notNull:!0,comment:"Stable machine name; referenced by exports and by operators in logs"},{name:"base_url",type:"varchar",length:500,notNull:!0,comment:"Any scheme, host and port \u2014 https, plain http, in-cluster DNS, IP. HTTPS is NOT required and must never be enforced: reaching a service inside the same cluster over http is a legitimate deployment."},{name:"description",type:"text"},{name:"enabled",type:"boolean",default:!0},{name:"auth_type",type:"varchar",length:20,notNull:!0,default:"none",enumValues:["none","bearer","api_key","basic","oauth2"]},{name:"auth_token_encrypted",type:"text",sensitive:!0,comment:"Static credential (bearer / api key / basic blob), encrypted at rest"},{name:"auth_token_hint",type:"varchar",length:24},{name:"auth_header_name",type:"varchar",length:80,default:"Authorization"},{name:"auth_query_param",type:"varchar",length:80,comment:"When set, an api_key credential travels as this query parameter instead of a header"},{name:"extra_headers",type:"jsonb",default:{}},{name:"token_url",type:"varchar",length:500},{name:"oauth_grant_type",type:"varchar",length:40,default:"password",enumValues:["password","client_credentials"]},{name:"oauth_client_id",type:"varchar",length:200},{name:"oauth_client_secret_encrypted",type:"text",sensitive:!0},{name:"oauth_client_secret_hint",type:"varchar",length:24},{name:"oauth_username",type:"varchar",length:200},{name:"oauth_password_encrypted",type:"text",sensitive:!0},{name:"oauth_password_hint",type:"varchar",length:24},{name:"oauth_scope",type:"varchar",length:300},{name:"oauth_client_auth",type:"varchar",length:20,default:"basic",enumValues:["basic","body"]},{name:"tls_verify",type:"boolean",notNull:!0,default:!0,comment:"Per-source certificate verification. Turning it off applies to THIS source's connections only \u2014 never to the process, which is what a NODE_TLS_REJECT_UNAUTHORIZED toggle would do."},{name:"timeout_ms",type:"integer",notNull:!0,default:30000},{name:"spec_url",type:"varchar",length:500,comment:"Optional API description document (OpenAPI/Swagger/Postman/Bruno). Discovery is a convenience: every endpoint can always be defined by hand instead."},{name:"spec_format",type:"varchar",length:20,default:"manual",enumValues:["manual","openapi","swagger","postman","bruno","har"]}],constraints:{unique:[{name:"uniq_integration_source_slug",columns:["slug"]}]},indexes:[{columns:["enabled"]}]},{table_name:"integration_endpoints",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"source_id",type:"uuid",notNull:!0,references:{table:"integrationSources",column:"id",onDelete:"cascade"}},{name:"tag",type:"varchar",length:120,notNull:!0},{name:"name",type:"varchar",length:200},{name:"method",type:"varchar",length:10,notNull:!0,default:"GET",enumValues:["GET","POST","PUT","PATCH","DELETE"]},{name:"path",type:"varchar",length:500,notNull:!0,comment:"Appended to the source base URL. May carry {brace} or :colon path tokens, whose values come from param_bindings."},{name:"description",type:"text"},{name:"query_params",type:"jsonb",default:{}},{name:"request_body",type:"jsonb",default:{}},{name:"param_bindings",type:"jsonb",default:[],comment:"Where each path/query parameter comes from: a static value, another endpoint's records (fan-out), or a column of one of our own tables."},{name:"pagination",type:"jsonb",default:{},comment:"Explicitly chosen paging profile (none/page_number/offset/cursor/link_header). Never guessed \u2014 a wrong guess silently imports one page."},{name:"response_root_path",type:"varchar",length:200},{name:"tree_children_path",type:"varchar",length:200,comment:"Field holding a record's children when the source answers with a shape rather than a list \u2014 each node then becomes its own row and knows its parent"},{name:"sample_response",type:"jsonb",default:{},comment:"A few real records captured by a live test, so the mapping screen still shows fields when the source is unreachable"},{name:"enabled",type:"boolean",default:!0}],indexes:[{columns:["source_id"]},{columns:["source_id","tag"]}]},{table_name:"integration_mappings",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"endpoint_id",type:"uuid",notNull:!0,references:{table:"integrationEndpoints",column:"id",onDelete:"cascade"}},{name:"name",type:"varchar",length:200,notNull:!0},{name:"target_entity",type:"varchar",length:120,notNull:!0,comment:"snake_case table name this mapping writes into"},{name:"field_mappings",type:"jsonb",notNull:!0,default:[]},{name:"reference_checks",type:"jsonb",notNull:!0,default:[],comment:"Columns whose value must already exist in another entity, and what to do when it does not."},{name:"dedup_source_field",type:"varchar",length:200},{name:"dedup_target_field",type:"varchar",length:200,comment:"Target column that identifies the same record across runs. Without it nothing can be matched and every run appends."},{name:"write_mode",type:"varchar",length:20,notNull:!0,default:"upsert",enumValues:["upsert","append","replace"],comment:"replace is the destructive wipe-and-rewrite; it is no longer the default and is gated by the completeness check."},{name:"missing_record_policy",type:"varchar",length:20,notNull:!0,default:"ignore",enumValues:["ignore","deactivate","delete"],comment:"What happens to a row that exists here but no longer in the source. deactivate is the right answer for most HR data and could not be expressed before."},{name:"missing_record_column",type:"varchar",length:120},{name:"missing_record_value",type:"varchar",length:200},{name:"removal_scope_column",type:"varchar",length:120,comment:"Target column carrying whatever the fan-out varies \u2014 a company code, a branch, a tenant. Set it when one mapping reads its source through several calls: removal is then confined to the values actually read, so a call that answers HTTP 500 costs that slice its cleanup instead of costing the whole run. Without it a single failing call refuses every removal, and a source whose one bad endpoint fails every night is never cleaned at all."},{name:"origin_column",type:"varchar",length:120,comment:"Column this mapping stamps on rows it owns. Set it when the target table ALSO holds rows people create by hand: without it every hand-made row looks like one the source stopped carrying, and the first run with a removal policy deletes them all."},{name:"origin_value",type:"varchar",length:120,comment:"The value written into origin_column. Rows carrying it are the only removal candidates."},{name:"max_removal_share",type:"numeric",comment:"Share of the target table (0-1) above which an UNATTENDED run refuses to remove. A scheduled run passes through neither the preview nor a confirmation, so this is the only thing between a wrong plan and the table. 0 or null disables."},{name:"password_target_column",type:"varchar",length:100,comment:"Column that receives the shared opening password given at run time. The password itself is never stored."},{name:"account_rule",type:"jsonb",comment:"Creates a login alongside each imported record, in the same transaction, and links it. The password belongs to the run, never to this row."},{name:"schedule_cron",type:"varchar",length:120},{name:"schedule_timezone",type:"varchar",length:64,comment:"IANA zone the cron expression is read in. Without it a nightly job drifts with the container's clock."},{name:"schedule_enabled",type:"boolean",notNull:!0,default:!1},{name:"last_run_at",type:"timestamptz"},{name:"enabled",type:"boolean",default:!0}],indexes:[{columns:["endpoint_id"]},{columns:["target_entity"]},{columns:["schedule_enabled"]}]},{table_name:"integration_runs",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"mapping_id",type:"uuid",references:{table:"integrationMappings",column:"id",onDelete:"set null"},comment:"Nullable and NOT cascaded: deleting a mapping must not erase the record that it once rewrote a table."},{name:"target_entity",type:"varchar",length:120},{name:"write_mode",type:"varchar",length:20,enumValues:["upsert","append","replace"]},{name:"status",type:"varchar",length:20,notNull:!0,default:"queued",enumValues:["queued","running","succeeded","failed","cancelled","reverted"],comment:"There is deliberately no 'partial': a run either applied in full or not at all."},{name:"trigger",type:"varchar",length:20,notNull:!0,default:"manual",enumValues:["manual","schedule","api"]},{name:"total_fetched",type:"integer",notNull:!0,default:0},{name:"source_reported_total",type:"integer",comment:"What the source said it had. When this and total_fetched disagree, a destructive run refuses to start."},{name:"created_count",type:"integer",notNull:!0,default:0},{name:"references_created_count",type:"integer",notNull:!0,default:0,comment:"Rows this run added to OTHER tables so its records could point at them."},{name:"accounts_created_count",type:"integer",notNull:!0,default:0,comment:"Logins this run created so its records could be signed in to."},{name:"updated_count",type:"integer",notNull:!0,default:0},{name:"skipped_count",type:"integer",notNull:!0,default:0},{name:"deleted_count",type:"integer",notNull:!0,default:0},{name:"deactivated_count",type:"integer",notNull:!0,default:0},{name:"error_count",type:"integer",notNull:!0,default:0},{name:"external_call_count",type:"integer",notNull:!0,default:0},{name:"issues",type:"jsonb",default:[]},{name:"errors",type:"jsonb",default:[]},{name:"cancel_requested",type:"boolean",notNull:!0,default:!1,comment:"Set by the cancel endpoint; the engine checks it at every batch boundary. A dropped HTTP connection is NOT a cancellation."},{name:"started_at",type:"timestamptz"},{name:"finished_at",type:"timestamptz"},{name:"pre_images_expire_at",type:"timestamptz",comment:"After this, the run can no longer be reverted and the UI says so rather than offering a button that quietly does nothing."},{name:"reverted_at",type:"timestamptz"},{name:"reverted_by",type:"uuid",references:{table:"users",column:"id"}},{name:"reverted_run_id",type:"uuid"}],indexes:[{columns:["mapping_id"]},{columns:["status"]},{columns:["target_entity"]},{columns:["created_at"]}]},{table_name:"integration_run_items",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"run_id",type:"uuid",notNull:!0,references:{table:"integrationRuns",column:"id",onDelete:"cascade"}},{name:"target_entity",type:"varchar",length:120,notNull:!0},{name:"row_id",type:"uuid"},{name:"action",type:"varchar",length:20,notNull:!0,enumValues:["create","update","delete","deactivate"]},{name:"before",type:"jsonb",comment:"The row as it stood before this run touched it. This is what makes a successful run reversible; the bulk delete path already produced these rows and threw them away."},{name:"after",type:"jsonb"}],indexes:[{columns:["run_id"]},{columns:["run_id","action"]},{columns:["target_entity","row_id"]}]}];var exceedsBodyLimit=(contentLengthHeader,maxBytes)=>{if(!maxBytes||maxBytes<=0)return!1;if(!contentLengthHeader)return!1;let len=Number(contentLengthHeader);if(!Number.isFinite(len)||len<0)return!1;return len>maxBytes};init_internalHeaders();init_response();function createInboundGuard(options={}){return({request,set})=>{for(let header of INTERNAL_HEADERS)request.headers.delete(header);if(exceedsBodyLimit(request.headers.get("content-length"),options.maxRequestBodyBytes))return set.status=413,Response.json(withEnvelopeFlags({isSuccess:!1,message:"Request body too large",status:413,errors:[{message:"Request body too large"}],data:null}));return}}init_response();init_routeCollector();init_routeMount();init_routeRecording();init_lifetime();import{and as and11,eq as eq16,inArray as inArray3,isNull as isNull2}from"drizzle-orm";var DEFAULT_CHAT_CONFIG={enabled:!1,basePath:"/chat",groupsEnabled:!0,maxGroupParticipants:256,maxMessageLength:8000,editingEnabled:!0,deletionEnabled:!0,typingIndicators:!0,readReceipts:!0,presence:!0,realtimeTopicPrefix:"chat",messagePageSize:50,moderatorRoles:[],attachments:{enabled:!0,maxPerMessage:10,maxFileSizeBytes:null,allowedMimeTypes:[]}};function mergeChatConfig(input){let base=DEFAULT_CHAT_CONFIG;if(!input)return base;return{enabled:input.enabled??base.enabled,basePath:input.basePath??base.basePath,groupsEnabled:input.groupsEnabled??base.groupsEnabled,maxGroupParticipants:input.maxGroupParticipants??base.maxGroupParticipants,maxMessageLength:input.maxMessageLength??base.maxMessageLength,editingEnabled:input.editingEnabled??base.editingEnabled,deletionEnabled:input.deletionEnabled??base.deletionEnabled,typingIndicators:input.typingIndicators??base.typingIndicators,readReceipts:input.readReceipts??base.readReceipts,presence:input.presence??base.presence,realtimeTopicPrefix:input.realtimeTopicPrefix??base.realtimeTopicPrefix,messagePageSize:input.messagePageSize??base.messagePageSize,moderatorRoles:input.moderatorRoles??base.moderatorRoles,attachments:{enabled:input.attachments?.enabled??base.attachments.enabled,maxPerMessage:input.attachments?.maxPerMessage??base.attachments.maxPerMessage,maxFileSizeBytes:input.attachments?.maxFileSizeBytes??base.attachments.maxFileSizeBytes,allowedMimeTypes:input.attachments?.allowedMimeTypes??base.attachments.allowedMimeTypes}}}function getCol(table,col7){return table[col7]}function getTable(schemaTables,name2,logger2){return resolveSchemaTable(schemaTables,name2,logger2)}function computeDirectKey(userA,userB){return[userA,userB].sort().join(":")}function kindFromMime(mime){if(!mime)return"file";if(mime.startsWith("image/"))return"image";if(mime.startsWith("video/"))return"video";if(mime.startsWith("audio/"))return"audio";return"file"}function str3(value){return typeof value==="string"?value:null}function num2(value){return typeof value==="number"?value:null}function date(value){if(value instanceof Date)return value;if(typeof value==="string")return new Date(value);return null}function cdnUrl(cdnBasePath,fileId){if(!fileId)return null;return`${cdnBasePath}/${fileId}`}function mapConversation(row,cdnBasePath){let avatarFileId=str3(row.avatarFileId);return{id:String(row.id),type:str3(row.type)??"direct",title:str3(row.title),description:str3(row.description),avatarFileId,avatarUrl:cdnUrl(cdnBasePath,avatarFileId),directKey:str3(row.directKey),lastMessageAt:date(row.lastMessageAt),lastMessagePreview:str3(row.lastMessagePreview),lastMessageSenderId:str3(row.lastMessageSenderId),createdBy:str3(row.createdBy),createdAt:date(row.createdAt)??new Date(0),updatedAt:date(row.updatedAt)??new Date(0),isActive:row.isActive!==!1}}function mapParticipant(row){return{id:String(row.id),conversationId:String(row.conversationId),userId:String(row.userId),role:str3(row.role)??"member",lastReadMessageId:str3(row.lastReadMessageId),lastReadAt:date(row.lastReadAt),unreadCount:num2(row.unreadCount)??0,muted:row.muted===!0,mutedUntil:date(row.mutedUntil),notificationsEnabled:row.notificationsEnabled!==!1,leftAt:date(row.leftAt),joinedAt:date(row.createdAt)??new Date(0)}}function mapAttachment(row,cdnBasePath){let fileId=String(row.fileId);return{id:String(row.id),messageId:String(row.messageId),conversationId:String(row.conversationId),fileId,kind:str3(row.kind)??"file",originalName:str3(row.originalName),mimeType:str3(row.mimeType),size:num2(row.size),width:num2(row.width),height:num2(row.height),duration:num2(row.duration),url:`${cdnBasePath}/${fileId}`}}function mapMessage(row,attachments){let metadata=row.metadata;return{id:String(row.id),conversationId:String(row.conversationId),senderId:str3(row.senderId),content:str3(row.content),contentType:str3(row.contentType)??"text",replyToId:str3(row.replyToId),metadata:metadata&&typeof metadata==="object"?metadata:null,clientMessageId:str3(row.clientMessageId),editedAt:date(row.editedAt),deletedAt:date(row.deletedAt),createdAt:date(row.createdAt)??new Date(0),updatedAt:date(row.updatedAt)??new Date(0),attachments}}function buildPreview(content,contentType,attachmentCount){if(content&&content.trim().length>0){let trimmed=content.trim();return trimmed.length>280?`${trimmed.slice(0,277)}...`:trimmed}if(attachmentCount>0){if(contentType==="image")return attachmentCount>1?`${attachmentCount} photos`:"Photo";if(contentType==="video")return attachmentCount>1?`${attachmentCount} videos`:"Video";if(contentType==="audio")return"Audio";return attachmentCount>1?`${attachmentCount} files`:"File"}if(contentType==="system")return"System message";return""}async function checkAttachmentFileAccess(args){let{db,schemaTables,fileId,userId}=args,attachments=getTable(schemaTables,"chat_message_attachments"),participants=getTable(schemaTables,"chat_participants");if(!attachments||!participants)return"not_attachment";let linked=await db.select().from(attachments).where(eq16(getCol(attachments,"fileId"),fileId));if(linked.length===0)return"not_attachment";if(!userId)return"denied";let conversationIds=[...new Set(linked.map((row)=>String(row.conversationId)))];return(await db.select().from(participants).where(and11(inArray3(getCol(participants,"conversationId"),conversationIds),eq16(getCol(participants,"userId"),userId),isNull2(getCol(participants,"leftAt")))).limit(1)).length>0?"allowed":"denied"}import{and as and13,desc as desc3,eq as eq18,inArray as inArray5}from"drizzle-orm";import{and as and12,eq as eq17,inArray as inArray4}from"drizzle-orm";class ChatError extends Error{code;constructor(code,message){super(message);this.code=code,this.name="ChatError"}}function resolveChatTables(ctx){let conversations=getTable(ctx.schemaTables,"chat_conversations",ctx.logger),participants=getTable(ctx.schemaTables,"chat_participants",ctx.logger),messages=getTable(ctx.schemaTables,"chat_messages",ctx.logger);if(!conversations||!participants||!messages)throw new ChatError("disabled","Chat tables are not available in this schema");let attachments=getTable(ctx.schemaTables,"chat_message_attachments")??null,files=getTable(ctx.schemaTables,"files")??null;return{conversations,participants,messages,attachments,files}}function chatTopic(ctx){return ctx.config.realtimeTopicPrefix||"chat"}async function getConversationRow(ctx,tables,conversationId){return(await ctx.db.select().from(tables.conversations).where(eq17(getCol(tables.conversations,"id"),conversationId)).limit(1))[0]??null}async function getParticipant(ctx,tables,conversationId,userId){let row=(await ctx.db.select().from(tables.participants).where(and12(eq17(getCol(tables.participants,"conversationId"),conversationId),eq17(getCol(tables.participants,"userId"),userId))).limit(1))[0];return row?mapParticipant(row):null}async function requireActiveMembership(ctx,tables,conversationId,userId){let participant=await getParticipant(ctx,tables,conversationId,userId);if(!participant||participant.leftAt)throw new ChatError("forbidden","You are not a participant of this conversation");return participant}async function listParticipants(ctx,tables,conversationId,includeLeft=!1){let all=(await ctx.db.select().from(tables.participants).where(eq17(getCol(tables.participants,"conversationId"),conversationId))).map(mapParticipant);return includeLeft?all:all.filter((p)=>!p.leftAt)}async function assertUsersExist(ctx,userIds){let unique=[...new Set(userIds)];if(unique.length===0)return;let usersTable=getTable(ctx.schemaTables,"users",ctx.logger);if(!usersTable)throw new ChatError("disabled","Users table is not available in this schema");let rows=await ctx.db.select({id:getCol(usersTable,"id")}).from(usersTable).where(inArray4(getCol(usersTable,"id"),unique)),found=new Set(rows.map((r)=>r.id));for(let id of unique)if(!found.has(id))throw new ChatError("not_found",`User ${id} does not exist`)}function deliverToParticipants(ctx,participants,event,exceptUserId){if(!ctx.broadcaster)return;let topic=chatTopic(ctx);for(let participant of participants){if(participant.leftAt)continue;if(exceptUserId&&participant.userId===exceptUserId)continue;ctx.broadcaster.broadcastToUser(participant.userId,topic,event)}}async function buildSummary(ctx,tables,conversationRow,userId,participantsOverride){let conversation=mapConversation(conversationRow,ctx.cdnBasePath),participants=participantsOverride??await listParticipants(ctx,tables,conversation.id),myParticipant=participants.find((p)=>p.userId===userId)??null;return{...conversation,participants,myParticipant,unreadCount:myParticipant?.unreadCount??0}}async function getOrCreateDirect(ctx,params){let tables=resolveChatTables(ctx),{userId,targetUserId}=params;if(!targetUserId||targetUserId===userId)throw new ChatError("validation","A different target user is required");await assertUsersExist(ctx,[targetUserId]);let directKey=computeDirectKey(userId,targetUserId),existing=(await ctx.db.select().from(tables.conversations).where(eq18(getCol(tables.conversations,"directKey"),directKey)).limit(1))[0];if(existing)return await rejoinIfNeeded(ctx,tables,String(existing.id),[userId,targetUserId]),buildSummary(ctx,tables,existing,userId);let now=new Date,conversationRow;try{conversationRow=(await ctx.db.insert(tables.conversations).values({type:"direct",directKey,createdBy:userId,lastMessageAt:now,lastMessagePreview:""}).returning())[0]}catch(_err){let raced=(await ctx.db.select().from(tables.conversations).where(eq18(getCol(tables.conversations,"directKey"),directKey)).limit(1))[0];if(!raced)throw new ChatError("conflict","Failed to create direct conversation");return await rejoinIfNeeded(ctx,tables,String(raced.id),[userId,targetUserId]),buildSummary(ctx,tables,raced,userId)}let conversationId=String(conversationRow.id);await ctx.db.insert(tables.participants).values([{conversationId,userId,role:"member",createdBy:userId},{conversationId,userId:targetUserId,role:"member",createdBy:userId}]);let summary=await buildSummary(ctx,tables,conversationRow,userId);return deliverToParticipants(ctx,summary.participants,{type:"conversation.created",conversationId,conversation:summary},userId),summary}async function createGroup(ctx,params){if(!ctx.config.groupsEnabled)throw new ChatError("disabled","Group conversations are disabled");let tables=resolveChatTables(ctx),{creatorId,title}=params;if(!title||title.trim().length===0)throw new ChatError("validation","A group title is required");let memberIds=[...new Set([creatorId,...params.participantIds])];if(memberIds.length>ctx.config.maxGroupParticipants)throw new ChatError("validation",`A group cannot exceed ${ctx.config.maxGroupParticipants} participants`);if(await assertUsersExist(ctx,memberIds),params.avatarFileId){if(!tables.files)throw new ChatError("disabled","Avatar files require storage to be enabled");let avatarRow=(await ctx.db.select().from(tables.files).where(eq18(getCol(tables.files,"id"),params.avatarFileId)).limit(1))[0],owner=avatarRow?String(avatarRow.uploadedBy??avatarRow.createdBy??""):"";if(!avatarRow||owner!==creatorId)throw new ChatError("forbidden","Avatar file is not owned by the creator")}let now=new Date,conversationRow=(await ctx.db.insert(tables.conversations).values({type:"group",title:title.trim(),description:params.description??null,avatarFileId:params.avatarFileId??null,createdBy:creatorId,lastMessageAt:now,lastMessagePreview:""}).returning())[0],conversationId=String(conversationRow.id);await ctx.db.insert(tables.participants).values(memberIds.map((memberId)=>({conversationId,userId:memberId,role:memberId===creatorId?"owner":"member",createdBy:creatorId})));let summary=await buildSummary(ctx,tables,conversationRow,creatorId);return deliverToParticipants(ctx,summary.participants,{type:"conversation.created",conversationId,conversation:summary},creatorId),summary}async function listConversations(ctx,params){let tables=resolveChatTables(ctx),limit=Math.min(Math.max(params.limit??30,1),100),offset=Math.max(params.offset??0,0),myParticipants=(await ctx.db.select().from(tables.participants).where(eq18(getCol(tables.participants,"userId"),params.userId))).map(mapParticipant).filter((p)=>!p.leftAt);if(myParticipants.length===0)return[];let conversationIds=myParticipants.map((p)=>p.conversationId),pageRows=await ctx.db.select().from(tables.conversations).where(and13(inArray5(getCol(tables.conversations,"id"),conversationIds),eq18(getCol(tables.conversations,"isActive"),!0))).orderBy(desc3(getCol(tables.conversations,"lastMessageAt"))).limit(limit).offset(offset);if(pageRows.length===0)return[];let pageIds=pageRows.map((r)=>String(r.id)),participantRows=await ctx.db.select().from(tables.participants).where(inArray5(getCol(tables.participants,"conversationId"),pageIds)),byConversation=new Map;for(let row of participantRows){let mapped=mapParticipant(row);if(mapped.leftAt)continue;let list2=byConversation.get(mapped.conversationId)??[];list2.push(mapped),byConversation.set(mapped.conversationId,list2)}let summaries=[];for(let row of pageRows){let id=String(row.id);summaries.push(await buildSummary(ctx,tables,row,params.userId,byConversation.get(id)??[]))}return summaries}async function getConversation(ctx,conversationId,userId){let tables=resolveChatTables(ctx);await requireActiveMembership(ctx,tables,conversationId,userId);let row=await getConversationRow(ctx,tables,conversationId);if(!row)throw new ChatError("not_found","Conversation not found");return buildSummary(ctx,tables,row,userId)}async function rejoinIfNeeded(ctx,tables,conversationId,userIds){for(let userId of userIds){let participant=await getParticipant(ctx,tables,conversationId,userId);if(!participant)await ctx.db.insert(tables.participants).values({conversationId,userId,role:"member",createdBy:userId});else if(participant.leftAt)await ctx.db.update(tables.participants).set({leftAt:null}).where(eq18(getCol(tables.participants,"id"),participant.id))}}function assertCanManage(actor){if(actor.role!=="owner"&&actor.role!=="admin")throw new ChatError("forbidden","Only group admins can manage participants")}async function addParticipants(ctx,conversationId,actorId,userIds){let tables=resolveChatTables(ctx),conversation=await getConversationRow(ctx,tables,conversationId);if(!conversation)throw new ChatError("not_found","Conversation not found");if(mapConversation(conversation,ctx.cdnBasePath).type!=="group")throw new ChatError("validation","Participants can only be managed in group conversations");let actor=await requireActiveMembership(ctx,tables,conversationId,actorId);assertCanManage(actor);let toAdd=[...new Set(userIds)];await assertUsersExist(ctx,toAdd);let current=await listParticipants(ctx,tables,conversationId,!0),activeCount=current.filter((p)=>!p.leftAt).length,newOnes=toAdd.filter((id)=>!current.some((p)=>p.userId===id&&!p.leftAt));if(activeCount+newOnes.length>ctx.config.maxGroupParticipants)throw new ChatError("validation","Group participant limit exceeded");for(let userId of toAdd)await rejoinIfNeeded(ctx,tables,conversationId,[userId]);let participants=await listParticipants(ctx,tables,conversationId);return deliverToParticipants(ctx,participants,{type:"participant.added",conversationId,userIds:toAdd,by:actorId}),participants}async function removeParticipant(ctx,conversationId,actorId,targetUserId){let tables=resolveChatTables(ctx),actor=await requireActiveMembership(ctx,tables,conversationId,actorId);if(actorId!==targetUserId)assertCanManage(actor);let target2=await getParticipant(ctx,tables,conversationId,targetUserId);if(!target2||target2.leftAt)throw new ChatError("not_found","Participant not found in conversation");await ctx.db.update(tables.participants).set({leftAt:new Date}).where(eq18(getCol(tables.participants,"id"),target2.id));let participants=await listParticipants(ctx,tables,conversationId),event={type:"participant.removed",conversationId,userId:targetUserId,by:actorId};if(deliverToParticipants(ctx,participants,event),ctx.broadcaster)ctx.broadcaster.broadcastToUser(targetUserId,ctx.config.realtimeTopicPrefix||"chat",event)}import{and as and14,desc as desc4,eq as eq19,inArray as inArray6,isNull as isNull3,lt,ne,sql as sql6}from"drizzle-orm";async function loadAttachments(ctx,tables,messageIds){let grouped=new Map;if(!tables.attachments||messageIds.length===0)return grouped;let rows=await ctx.db.select().from(tables.attachments).where(inArray6(getCol(tables.attachments,"messageId"),messageIds));for(let row of rows){let attachment=mapAttachment(row,ctx.cdnBasePath),list2=grouped.get(attachment.messageId)??[];list2.push(attachment),grouped.set(attachment.messageId,list2)}return grouped}function inferContentType(explicit,attachments){if(explicit)return explicit;if(attachments.length===0)return"text";let kind=attachments[0]?.kind;if(kind==="image")return"image";if(kind==="video")return"video";if(kind==="audio")return"audio";return"file"}async function persistAttachments(ctx,tables,conversationId,messageId,params){let inputs=params.attachments??[];if(inputs.length===0)return[];if(!ctx.attachmentsAvailable||!tables.attachments||!tables.files)throw new ChatError("disabled","File attachments require storage and CDN to be enabled");if(inputs.length>ctx.config.attachments.maxPerMessage)throw new ChatError("validation",`A message cannot have more than ${ctx.config.attachments.maxPerMessage} attachments`);let fileIds=inputs.map((a)=>a.fileId),fileRows=await ctx.db.select().from(tables.files).where(inArray6(getCol(tables.files,"id"),fileIds)),filesById=new Map;for(let row of fileRows)filesById.set(String(row.id),row);let payloads=inputs.map((input)=>{let fileRow=filesById.get(input.fileId);if(!fileRow)throw new ChatError("not_found",`Attachment file ${input.fileId} was not found`);if(String(fileRow.uploadedBy??fileRow.createdBy??"")!==params.senderId)throw new ChatError("forbidden",`Attachment file ${input.fileId} is not owned by the sender`);let mimeType=fileRow.mimeType??input.mimeType??null;return{conversationId,messageId,fileId:input.fileId,kind:input.kind??kindFromMime(mimeType),originalName:fileRow.originalName??input.originalName??null,mimeType,size:fileRow.size??input.size??null,width:input.width??null,height:input.height??null,duration:input.duration??null,createdBy:params.senderId}});return(await ctx.db.insert(tables.attachments).values(payloads).returning()).map((row)=>mapAttachment(row,ctx.cdnBasePath))}async function sendMessage(ctx,params){let tables=resolveChatTables(ctx);await requireActiveMembership(ctx,tables,params.conversationId,params.senderId);let content=params.content?.trim()?params.content:null,hasAttachments=(params.attachments?.length??0)>0;if(!content&&!hasAttachments)throw new ChatError("validation","A message must contain text or at least one attachment");if(content&&content.length>ctx.config.maxMessageLength)throw new ChatError("validation",`Message exceeds the maximum length of ${ctx.config.maxMessageLength} characters`);if(params.metadata!==void 0&&params.metadata!==null){if(JSON.stringify(params.metadata).length>4096)throw new ChatError("validation","Message metadata exceeds the maximum size of 4096 bytes")}let{message,participants}=await ctx.db.transaction(async(tx)=>{let txCtx={...ctx,db:tx},messageRow=(await tx.insert(tables.messages).values({conversationId:params.conversationId,senderId:params.senderId,content,contentType:params.contentType??"text",replyToId:params.replyToId??null,clientMessageId:params.clientMessageId??null,metadata:params.metadata??{},createdBy:params.senderId}).returning())[0],messageId=String(messageRow.id),attachments=await persistAttachments(txCtx,tables,params.conversationId,messageId,params),contentType=inferContentType(params.contentType,attachments);if(contentType!==messageRow.contentType)await tx.update(tables.messages).set({contentType}).where(eq19(getCol(tables.messages,"id"),messageId)),messageRow.contentType=contentType;let mappedMessage=mapMessage(messageRow,attachments),preview=buildPreview(mappedMessage.content,mappedMessage.contentType,attachments.length),now=mappedMessage.createdAt;await tx.update(tables.conversations).set({lastMessageAt:now,lastMessagePreview:preview,lastMessageSenderId:params.senderId,updatedAt:new Date}).where(eq19(getCol(tables.conversations,"id"),params.conversationId)),await tx.update(tables.participants).set({unreadCount:sql6`${getCol(tables.participants,"unreadCount")} + 1`}).where(and14(eq19(getCol(tables.participants,"conversationId"),params.conversationId),ne(getCol(tables.participants,"userId"),params.senderId),isNull3(getCol(tables.participants,"leftAt"))));let parts=await listParticipants(txCtx,tables,params.conversationId);return{message:mappedMessage,participants:parts}});return deliverToParticipants(ctx,participants,{type:"message.created",conversationId:params.conversationId,message}),message}async function getMessages(ctx,params){let tables=resolveChatTables(ctx);await requireActiveMembership(ctx,tables,params.conversationId,params.userId);let limit=Math.min(Math.max(params.limit??ctx.config.messagePageSize,1),100),conditions=[eq19(getCol(tables.messages,"conversationId"),params.conversationId)];if(params.before){let cursor=(await ctx.db.select().from(tables.messages).where(eq19(getCol(tables.messages,"id"),params.before)).limit(1))[0];if(cursor?.createdAt)conditions.push(lt(getCol(tables.messages,"createdAt"),cursor.createdAt))}let rows=await ctx.db.select().from(tables.messages).where(and14(...conditions)).orderBy(desc4(getCol(tables.messages,"createdAt"))).limit(limit+1),pageRows=rows.slice(0,limit),hasMore=rows.length>limit,attachmentsByMessage=await loadAttachments(ctx,tables,pageRows.map((r)=>String(r.id)));return{messages:pageRows.map((row)=>mapMessage(row,attachmentsByMessage.get(String(row.id))??[])),hasMore}}async function markRead(ctx,conversationId,userId,messageId){let tables=resolveChatTables(ctx),participant=await requireActiveMembership(ctx,tables,conversationId,userId),targetMessageId=messageId??null;if(targetMessageId){if(!(await ctx.db.select().from(tables.messages).where(and14(eq19(getCol(tables.messages,"id"),targetMessageId),eq19(getCol(tables.messages,"conversationId"),conversationId))).limit(1))[0])throw new ChatError("not_found","Message not found in this conversation")}else{let latestRow=(await ctx.db.select().from(tables.messages).where(eq19(getCol(tables.messages,"conversationId"),conversationId)).orderBy(desc4(getCol(tables.messages,"createdAt"))).limit(1))[0];targetMessageId=latestRow?String(latestRow.id):null}let readAt=new Date;if(await ctx.db.update(tables.participants).set({lastReadMessageId:targetMessageId,lastReadAt:readAt,unreadCount:0}).where(eq19(getCol(tables.participants,"id"),participant.id)),ctx.config.readReceipts){let participants=await listParticipants(ctx,tables,conversationId);deliverToParticipants(ctx,participants,{type:"conversation.read",conversationId,userId,lastReadMessageId:targetMessageId,readAt:readAt.toISOString()},userId)}return{lastReadMessageId:targetMessageId,readAt}}async function editMessage(ctx,messageId,userId,content){if(!ctx.config.editingEnabled)throw new ChatError("disabled","Message editing is disabled");let tables=resolveChatTables(ctx),row=(await ctx.db.select().from(tables.messages).where(eq19(getCol(tables.messages,"id"),messageId)).limit(1))[0];if(!row||row.deletedAt)throw new ChatError("not_found","Message not found");if(String(row.senderId)!==userId)throw new ChatError("forbidden","You can only edit your own messages");let trimmed=content.trim();if(!trimmed)throw new ChatError("validation","Message content cannot be empty");if(trimmed.length>ctx.config.maxMessageLength)throw new ChatError("validation","Message exceeds the maximum length");let editedAt=new Date,updated=await ctx.db.update(tables.messages).set({content:trimmed,editedAt,updatedAt:editedAt}).where(eq19(getCol(tables.messages,"id"),messageId)).returning(),attachments=await loadAttachments(ctx,tables,[messageId]),message=mapMessage(updated[0],attachments.get(messageId)??[]),participants=await listParticipants(ctx,tables,String(row.conversationId));return deliverToParticipants(ctx,participants,{type:"message.updated",conversationId:String(row.conversationId),message}),message}async function deleteMessage(ctx,messageId,userId,asModerator=!1){if(!ctx.config.deletionEnabled&&!asModerator)throw new ChatError("disabled","Message deletion is disabled");let tables=resolveChatTables(ctx),row=(await ctx.db.select().from(tables.messages).where(eq19(getCol(tables.messages,"id"),messageId)).limit(1))[0];if(!row||row.deletedAt)throw new ChatError("not_found","Message not found");if(!asModerator&&String(row.senderId)!==userId)throw new ChatError("forbidden","You can only delete your own messages");let deletedAt=new Date,orphanedFiles=await ctx.db.transaction(async(tx)=>{if(await tx.update(tables.messages).set({content:null,deletedAt,updatedAt:deletedAt}).where(eq19(getCol(tables.messages,"id"),messageId)),!tables.attachments)return[];let attachmentRows=await tx.select().from(tables.attachments).where(eq19(getCol(tables.attachments,"messageId"),messageId));if(attachmentRows.length===0)return[];await tx.delete(tables.attachments).where(eq19(getCol(tables.attachments,"messageId"),messageId));let fileIds=[...new Set(attachmentRows.map((a)=>String(a.fileId)))];if(!tables.files||fileIds.length===0)return[];let stillLinked=await tx.select().from(tables.attachments).where(inArray6(getCol(tables.attachments,"fileId"),fileIds)),keep=new Set(stillLinked.map((a)=>String(a.fileId))),removable=fileIds.filter((id)=>!keep.has(id));if(removable.length===0)return[];let fileRows=await tx.select().from(tables.files).where(inArray6(getCol(tables.files,"id"),removable));return await tx.delete(tables.files).where(inArray6(getCol(tables.files,"id"),removable)),fileRows.filter((f)=>typeof f.path==="string"&&typeof f.name==="string").map((f)=>({path:String(f.path),name:String(f.name)}))});for(let file of orphanedFiles)if(await ctx.deleteStoredFile?.(file)===!1)ctx.logger.warn("[Chat] Attachment blob cleanup failed",{messageId,name:file.name});let participants=await listParticipants(ctx,tables,String(row.conversationId));deliverToParticipants(ctx,participants,{type:"message.deleted",conversationId:String(row.conversationId),messageId})}async function setTyping(ctx,conversationId,userId,isTyping=!0){if(!ctx.config.typingIndicators)return;let tables=resolveChatTables(ctx),participants=await listParticipants(ctx,tables,conversationId);if(!participants.some((p)=>p.userId===userId))throw new ChatError("forbidden","You are not a participant of this conversation");deliverToParticipants(ctx,participants,{type:"typing",conversationId,userId,isTyping},userId)}class ChatService{ctx;constructor(init){this.ctx={db:init.db,schemaTables:init.schemaTables,config:init.config,logger:init.logger,broadcaster:init.broadcaster??null,cdnBasePath:init.cdnBasePath??"/cdn",attachmentsAvailable:init.attachmentsAvailable??!1,deleteStoredFile:init.deleteStoredFile??null}}get config(){return this.ctx.config}getOrCreateDirect(userId,targetUserId){return getOrCreateDirect(this.ctx,{userId,targetUserId})}createGroup(params){return createGroup(this.ctx,params)}listConversations(userId,opts){return listConversations(this.ctx,{userId,limit:opts?.limit,offset:opts?.offset})}getConversation(conversationId,userId){return getConversation(this.ctx,conversationId,userId)}addParticipants(conversationId,actorId,userIds){return addParticipants(this.ctx,conversationId,actorId,userIds)}removeParticipant(conversationId,actorId,targetUserId){return removeParticipant(this.ctx,conversationId,actorId,targetUserId)}sendMessage(params){return sendMessage(this.ctx,params)}getMessages(params){return getMessages(this.ctx,params)}markRead(conversationId,userId,messageId){return markRead(this.ctx,conversationId,userId,messageId)}editMessage(messageId,userId,content){return editMessage(this.ctx,messageId,userId,content)}deleteMessage(messageId,userId,asModerator=!1){return deleteMessage(this.ctx,messageId,userId,asModerator)}setTyping(conversationId,userId,isTyping){return setTyping(this.ctx,conversationId,userId,isTyping)}}init_SystemCollector();init_lifecycle();init_Notification();var EXTEND_ALLOWED_KEYS=new Set(["table_name","extends","columns","indexes"]);function hasDbDefault(column){return column.default!==void 0||column.defaultRaw!==void 0||column.generatedAlwaysAs!==void 0||column.generatedAlwaysAsIdentity===!0||column.generatedByDefaultAsIdentity===!0}var AUTH_FEATURES=new Set(["authentication","authorization"]);function resolveEntities(systemTables,configEntities,options={}){let errors2=[],warnings=[],consumed=new Set,entities=[];for(let system of systemTables){let config=configEntities.find((c)=>c.table_name===system.table_name);if(!config){entities.push(system);continue}if(consumed.add(config.table_name),!config.extends){warnings.push(`[Schema] "${config.table_name}" is declared in config.entities AND ships as a system table. Using YOUR definition and skipping the built-in one. Add "extends": true to inherit the built-in columns and route policy instead.`),entities.push(config);continue}for(let key2 of Object.keys(config))if(!EXTEND_ALLOWED_KEYS.has(key2))warnings.push(`[Schema] "${config.table_name}" sets "${key2}" alongside "extends": true \u2014 ignored. `+"An extending entry inherits every table-level setting from the built-in definition.");if(options.enabledTableNames&&!options.enabledTableNames.has(system.table_name))errors2.push({code:"E5_FEATURE_DISABLED",table:system.table_name,message:`"${system.table_name}" is extended but its feature is disabled, so the table is never created. Enable the feature or remove the extending entry.`});if(options.consumerMode&&(system.feature_set??[]).some((f)=>AUTH_FEATURES.has(f)))errors2.push({code:"E3_CONSUMER_AUTH_TABLE",table:system.table_name,message:`"${system.table_name}" is an auth system table and cannot be extended in consumer mode \u2014 `+"the identity tables live in the IDP. Extending it would create a local copy here."});let builtInNames=new Set((system.columns??[]).map((c)=>c.name));if(system.add_base_columns!==!1)for(let name2 of options.baseColumnNames??[])builtInNames.add(name2);for(let column of config.columns??[]){if(builtInNames.has(column.name))errors2.push({code:"E1_COLUMN_COLLISION",table:system.table_name,column:column.name,message:`"${system.table_name}.${column.name}" already exists in the built-in definition. An extending entry may only ADD columns; rename yours.`});if(column.notNull===!0&&column.nullable!==!0&&!hasDbDefault(column))errors2.push({code:"E2_NOT_NULL_WITHOUT_DEFAULT",table:system.table_name,column:column.name,message:`"${system.table_name}.${column.name}" is notNull without a default. The framework writes this table from fixed-column inserts (register, invite, admin create-user, godmin seed, `+"tenant provisioning) that cannot supply it \u2014 every one of them would fail. Make it "+"nullable or give it a default."})}let merged={...system,columns:[...system.columns??[],...config.columns??[]],indexes:[...system.indexes??[],...config.indexes??[]]};entities.push(merged)}for(let config of configEntities){if(consumed.has(config.table_name))continue;if(config.extends){errors2.push({code:"E4_UNKNOWN_SYSTEM_TABLE",table:config.table_name,message:`"${config.table_name}" sets "extends": true but there is no system table with that name. Remove the flag to declare it as an ordinary entity.`});continue}entities.push(config)}return{entities,errors:errors2,warnings}}function resolveAuthType(pathname,auth){let at=(route)=>pathname===route||pathname.endsWith(route)||pathname.includes(`${route}/`);if(at(auth?.login?.route||"/auth/login"))return"login";if(at(auth?.register?.route||"/auth/register"))return"register";if(at(auth?.passwordReset?.route||"/auth/password-reset"))return"passwordReset";if(at(auth?.magicLink?.route||"/auth/magic-link"))return"magicLink";if(at(auth?.invite?.route||"/auth/invite"))return"other";if(at("/sessions/approve")||at("/sessions/reject"))return"login";return}init_Logger2();var METHOD_MAP={GET:["GET"],POST:["POST"],PUT:["PUT"],DELETE:["DELETE"],PATCH:["PATCH"],TOGGLE:["PATCH"],VERIFICATION:["POST"]};function buildAuthPublicRoutes(config,basePath){let routes=[],auth=config.authentication;if(!auth)return routes;if(auth.login?.enabled&&auth.login?.isPublic)routes.push({path:auth.login.route||`${basePath}/auth/login`,method:"POST",source:"auth"});if(auth.register?.enabled&&auth.register?.isPublic)routes.push({path:auth.register.route||`${basePath}/auth/register`,method:"POST",source:"auth"});if(auth.logout?.enabled&&auth.logout?.isPublic)routes.push({path:auth.logout.route||`${basePath}/auth/logout`,method:"POST",source:"auth"});if(auth.refresh?.enabled&&auth.refresh?.isPublic)routes.push({path:auth.refresh.route||`${basePath}/auth/refresh`,method:"POST",source:"auth"});if(auth.admin?.impersonate?.enabled!==!1)routes.push({path:`${basePath}/auth/admin/impersonate/stop`,method:"POST",source:"system"});if(auth.passwordReset?.enabled&&auth.passwordReset?.isPublic){let baseRoute=auth.passwordReset.route||`${basePath}/auth/password-reset`;routes.push({path:`${baseRoute}/request`,method:"POST",source:"auth"},{path:`${baseRoute}/confirm`,method:"POST",source:"auth"})}if(auth.passwordChange?.enabled&&auth.passwordChange?.isPublic)routes.push({path:auth.passwordChange.route||`${basePath}/auth/password-change`,method:"POST",source:"auth"});if(auth.magicLink?.enabled&&auth.magicLink?.isPublic)routes.push({path:auth.magicLink.route||`${basePath}/auth/magic-link`,method:"POST",source:"auth"},{path:auth.magicLink.verifyRoute||`${basePath}/auth/magic-link/verify`,method:"GET",source:"auth"});if(auth.register?.enabled&&auth.register?.emailVerification?.enabled)routes.push({path:`${basePath}/verify-email`,method:"GET",source:"auth"},{path:`${basePath}/resend-verification`,method:"POST",source:"auth"});if(auth.invite?.enabled&&auth.invite?.isPublic)routes.push({path:auth.invite.route||`${basePath}/auth/invite`,method:"POST",source:"auth"});if(auth.invite?.enabled){let inviteRoute=auth.invite.route||`${basePath}/auth/invite`;routes.push({path:`${inviteRoute}/verify`,method:"POST",source:"auth"})}if(auth.passwordSet?.enabled)routes.push({path:auth.passwordSet.route||`${basePath}/auth/password-set`,method:"POST",source:"auth"});if(auth.webauthn?.enabled){let webauthnRoute=auth.webauthn.route||`${basePath}/auth/webauthn`;routes.push({path:`${webauthnRoute}/authenticate/options`,method:"POST",source:"auth"},{path:`${webauthnRoute}/authenticate/verify`,method:"POST",source:"auth"})}if(auth.captcha?.enabled&&auth.captcha?.isPublic){let baseRoute=auth.captcha.route||`${basePath}/auth/captcha`;routes.push({path:`${baseRoute}/generate`,method:"GET",source:"auth"},{path:`${baseRoute}/validate`,method:"POST",source:"auth"})}if(auth.sessions?.enabled){let sessionsRoute=auth.sessions.route||`${basePath}/auth/sessions`;routes.push({path:`${sessionsRoute}/approve`,method:"POST",source:"auth"},{path:`${sessionsRoute}/reject`,method:"POST",source:"auth"},{path:`${sessionsRoute}/approve-page`,method:"GET",source:"auth"},{path:`${sessionsRoute}/reject-page`,method:"GET",source:"auth"},{path:`${sessionsRoute}/approval-status`,method:"GET",source:"auth"})}if(auth.oauth?.enabled){let oauthBase=auth.oauth.basePath||`${basePath}/auth/oauth`,knownProviders=["google","github","microsoft","discord","facebook","twitter","apple","custom"];routes.push({path:`${oauthBase}/providers`,method:"GET",source:"auth"});for(let provider of knownProviders)routes.push({path:`${oauthBase}/${provider}`,method:"GET",source:"auth"},{path:`${oauthBase}/${provider}/callback`,method:"GET",source:"auth"})}return routes}function buildEntityPublicRoutes(entities,basePath,_schema){let routes=[];for(let entity of entities){if(!entity.is_public)continue;let camelName=entity.table_name.replace(/_([a-z])/g,(_,l)=>l.toUpperCase()),entityPath=`${basePath}/${camelName}`;for(let[nucleusMethod,isPublic]of Object.entries(entity.is_public)){if(!isPublic)continue;let httpMethods=METHOD_MAP[nucleusMethod];if(!httpMethods)continue;for(let method of httpMethods)if(method==="GET")routes.push({path:entityPath,method:"GET",source:"entity"}),routes.push({path:`${entityPath}/:id`,method:"GET",source:"entity"});else if(method==="POST")routes.push({path:entityPath,method:"POST",source:"entity"});else if(method==="PUT"||method==="PATCH")routes.push({path:`${entityPath}/:id`,method,source:"entity"});else if(method==="DELETE")routes.push({path:`${entityPath}/:id`,method:"DELETE",source:"entity"})}}return routes}function buildSystemTablePublicRoutes(systemTables,basePath,schema){return buildEntityPublicRoutes(systemTables,basePath,schema)}function buildPublicRoutes(config,systemTables,basePath="",schema="public"){let authRoutes=buildAuthPublicRoutes(config,basePath),entityRoutes=buildEntityPublicRoutes(config.entities||[],basePath,schema),systemRoutes=buildSystemTablePublicRoutes(systemTables,basePath,schema),pubsubRoutes=[];if(config.pubsub?.enabled){let pubsubBasePath=config.pubsub.basePath||"/subs",wsPath=config.pubsub.wsPath||"/api/events/subscribe";pubsubRoutes.push({path:`${pubsubBasePath}/:topic`,method:"POST",source:"system"},{path:wsPath,method:"GET",source:"system"})}let paymentRoutes=[];if(config.payment?.enabled){let paymentBasePath=config.payment.basePath||"/payment";paymentRoutes.push({path:`${paymentBasePath}/callback`,method:"POST",source:"system"},{path:`${paymentBasePath}/callback`,method:"OPTIONS",source:"system"},{path:`${paymentBasePath}/bin-query`,method:"POST",source:"system"},{path:`${paymentBasePath}/webhook`,method:"POST",source:"system"})}let discoveryRoutes=[];if(config.authorization?.endpointDiscovery?.enabled){let manifestAuth={bypassHeaders:["x-discovery-token"]};discoveryRoutes.push({path:"/authorization/route-manifest",method:"GET",source:"system",authenticateWhenCredentialed:manifestAuth},{path:"/authorization/route-manifest",method:"OPTIONS",source:"system"},{path:"/authorization/role-claims-manifest",method:"GET",source:"system",authenticateWhenCredentialed:manifestAuth},{path:"/authorization/role-claims-manifest",method:"OPTIONS",source:"system"})}let domainRoutes=[];if(config.domains?.enabled){let domainsBasePath=config.domains.basePath||"/domains";domainRoutes.push({path:`${basePath}${domainsBasePath}/resolve`,method:"GET",source:"system"})}let tenantRoutes=[];if(config.database?.isMultiTenant)tenantRoutes.push({path:`${basePath}/tenants/check-subdomain/:subdomain`,method:"GET",source:"system"}),tenantRoutes.push({path:`${basePath}/tenants/self-signup`,method:"POST",source:"system"}),tenantRoutes.push({path:`${basePath}/tenants/refresh`,method:"POST",source:"system"});let customRoutes=[{path:"/nucleus-core",method:"GET",source:"custom"},{path:"/public",method:"GET",source:"custom"},{path:"/docs",method:"GET",source:"custom"},{path:"/docs/json",method:"GET",source:"custom"},{path:"/swagger",method:"GET",source:"custom"},{path:"/swagger/json",method:"GET",source:"custom"}],configPublicPaths=config.authorization?.publicPaths||[],ALL_PUBLIC_METHODS=["GET","HEAD","POST","PUT","PATCH","DELETE","OPTIONS"],withHead=(path,source)=>[{path,method:"HEAD",source}],configPublicRoutes=configPublicPaths.flatMap((entry)=>{let trimmed=entry.trim(),qualified=trimmed.match(/^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS)\s+(.+)$/i);if(qualified?.[1]&&qualified[2]){let method=qualified[1].toUpperCase(),path=qualified[2].trim(),routes=[{path,method,source:"custom"}];if(method!=="OPTIONS")routes.push({path,method:"OPTIONS",source:"custom"});if(method==="GET")routes.push(...withHead(path,"custom"));return routes}if(trimmed.startsWith("/auth/"))return ALL_PUBLIC_METHODS.map((method)=>({path:trimmed,method,source:"custom"}));return logger.warn(`[Security] publicPaths entry "${trimmed}" is unqualified \u2014 exposing GET + HEAD + OPTIONS only. To make a write method public, use the explicit form, e.g. "POST ${trimmed}".`),[{path:trimmed,method:"GET",source:"custom"},...withHead(trimmed,"custom"),{path:trimmed,method:"OPTIONS",source:"custom"}]});return[...authRoutes,...entityRoutes,...systemRoutes,...pubsubRoutes,...paymentRoutes,...discoveryRoutes,...domainRoutes,...tenantRoutes,...customRoutes,...configPublicRoutes]}function isPublicRoute(publicRoutes,path,method,caller){return findPublicRoute(publicRoutes,path,method,caller)!==void 0}function findPublicRoute(publicRoutes,path,method,caller){if(/\/\/|\\|%2f|%2e|%5c/i.test(path))return;let normalizedPath=path.replace(/\/$/,""),normalizedMethod=method.toUpperCase();for(let route of publicRoutes){if(route.method!==normalizedMethod)continue;if(matchPath(route.path,normalizedPath)){let opt=route.authenticateWhenCredentialed;if(opt&&caller){if(!(opt.bypassHeaders??[]).some((name2)=>!!caller.headers.get(name2))&&caller.credentialed())continue}return route}}return}function matchPath(pattern,path){if(pattern===path)return!0;let patternParts=pattern.split("/").filter(Boolean),pathParts=path.split("/").filter(Boolean);if(patternParts.length!==pathParts.length)return!1;for(let i=0;i<patternParts.length;i++){let patternPart=patternParts[i],pathPart=pathParts[i];if(patternPart?.startsWith(":"))continue;if(patternPart!==pathPart)return!1}return!0}init_routeCollector();import{eq as eq22}from"drizzle-orm";init_requireGodmin();import{eq as eq21}from"drizzle-orm";var col7=(table,name2)=>{let tableRecord=table,snakeCase=name2.replace(/([A-Z])/g,"_$1").toLowerCase();return tableRecord[name2]||tableRecord[snakeCase]};async function requireGodmin(db,usersTable,userId){let user=(await db.select().from(usersTable).where(eq21(col7(usersTable,"id"),userId)).limit(1))[0];if(!user?.isGod)return!1;return accountStateRefusal(user)===null}function validatePassword(pwd,policy){let errors2=[],minLen=policy?.minLength??8,maxLen=policy?.maxLength??128,needUpper=policy?.requireUppercase??!0,needLower=policy?.requireLowercase??!0,needDigit=policy?.requireNumber??!0,needSpecial=policy?.requireSpecialChar??!1;if(pwd.length<minLen)errors2.push(`Password must be at least ${minLen} characters`);if(pwd.length>maxLen)errors2.push(`Password must be at most ${maxLen} characters`);if(needUpper&&!/[A-Z]/.test(pwd))errors2.push("Password must contain uppercase letter");if(needLower&&!/[a-z]/.test(pwd))errors2.push("Password must contain lowercase letter");if(needDigit&&!/[0-9]/.test(pwd))errors2.push("Password must contain a number");if(needSpecial&&!/[!@#$%^&*()_+\-=[\]{};':"\\|,.<>/?]/.test(pwd))errors2.push("Password must contain a special character");return{valid:errors2.length===0,errors:errors2}}var handleActivateUsers=(db,usersTable,logger2)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let result=await db.update(usersTable).set({isLocked:!1,lockedUntil:null,failedLoginAttempts:0,updatedAt:new Date}).where(eq22(col7(usersTable,"cohortId"),ctx.params.id)).returning();return logger2.audit({entityName:"user_cohorts",entityId:ctx.params.id,operation:"COHORT_ACTIVATE_USERS",userId,summary:`Activated ${result.length} users in cohort`}),{success:!0,data:{affected:result.length}}};init_assignDefaultRole();init_utils6();import{count,eq as eq24,inArray as inArray7}from"drizzle-orm";var handleBulkCreateUsers=(config,logger2)=>{let{db,usersTable,cohortsTable,rolesTable,userRolesTable,profilesTable}=config;return async(ctx)=>{if(!db||!usersTable||!cohortsTable)return ctx.set.status=500,{success:!1,message:"Server misconfigured"};let callerId=ctx.request.headers.get("x-user-id");if(!callerId||!await requireGodmin(db,usersTable,callerId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let cohortId=ctx.params.id;if((await db.select().from(cohortsTable).where(eq24(col7(cohortsTable,"id"),cohortId)).limit(1)).length===0)return ctx.set.status=404,{success:!1,message:"Cohort not found"};let{users:explicitUsers,emailPrefix,emailDomain,sharedPassword,count:userCount,roleIds}=ctx.body,userList=[];if(explicitUsers&&explicitUsers.length>0)for(let u of explicitUsers)userList.push({email:u.email.toLowerCase().trim(),password:u.password,firstName:u.profile?.firstName,lastName:u.profile?.lastName});else if(emailPrefix&&emailDomain&&sharedPassword&&userCount){let padLen=String(userCount).length;for(let i=1;i<=userCount;i++){let paddedNum=String(i).padStart(padLen,"0");userList.push({email:`${emailPrefix}-${paddedNum}@${emailDomain}`.toLowerCase(),password:sharedPassword})}}else return ctx.set.status=400,{success:!1,message:'Provide either "users" array or "emailPrefix" + "emailDomain" + "sharedPassword" + "count"'};if(userList.length>500)return ctx.set.status=400,{success:!1,message:"Maximum 500 users per batch"};for(let entry of userList){let validation=validatePassword(entry.password,config.passwordPolicy);if(!validation.valid)return ctx.set.status=400,{success:!1,message:`Password too weak for ${entry.email}`,errors:validation.errors}}let emails=userList.map((u)=>u.email),existingRows=await db.select({email:col7(usersTable,"email")}).from(usersTable).where(inArray7(col7(usersTable,"email"),emails)),existingEmails=new Set(existingRows.map((r)=>String(r.email).toLowerCase())),created=[],skipped=[],now=new Date;for(let entry of userList){if(existingEmails.has(entry.email)){skipped.push(entry.email);continue}let hashedPw=await hashPassword(entry.password),newUser=(await db.insert(usersTable).values({email:entry.email,password:hashedPw,emailVerified:!0,verifiedAt:now,isLocked:!1,cohortId,createdAt:now,updatedAt:now}).returning())[0];if(!newUser)continue;let newUserId=String(newUser.id);if(created.push({id:newUserId,email:entry.email,password:entry.password}),roleIds&&roleIds.length>0&&rolesTable&&userRolesTable){let validIds=(await db.select({id:col7(rolesTable,"id")}).from(rolesTable).where(inArray7(col7(rolesTable,"id"),roleIds))).map((r)=>String(r.id));if(validIds.length>0)await db.insert(userRolesTable).values(validIds.map((roleId)=>({userId:newUserId,roleId})))}else{let cohortDefaultRoles=resolveDefaultRoleNames(config);if(cohortDefaultRoles.length>0)await assignDefaultRoles({db,userId:newUserId,roleNames:cohortDefaultRoles,rolesTable,userRolesTable,logger:logger2})}if((entry.firstName||entry.lastName)&&profilesTable)await db.insert(profilesTable).values({userId:newUserId,firstName:entry.firstName??null,lastName:entry.lastName??null,createdAt:now,updatedAt:now}).catch((err)=>{logger2.warn("[Cohort] Failed to create profile for user",{userId:newUserId,error:err.message})})}let countResult=await db.select({count:count()}).from(usersTable).where(eq24(col7(usersTable,"cohortId"),cohortId)),totalUsers=Number(countResult[0]?.count)||0;return await db.update(cohortsTable).set({userCount:totalUsers,updatedAt:new Date}).where(eq24(col7(cohortsTable,"id"),cohortId)),logger2.audit({entityName:"user_cohorts",entityId:cohortId,operation:"COHORT_BULK_CREATE",userId:callerId,summary:`Bulk created ${created.length} users in cohort (${skipped.length} skipped)`}),{success:!0,data:{created:created.length,skipped:skipped.length,skippedEmails:skipped,users:created}}}};var handleCreateCohort=(db,usersTable,cohortsTable,logger2)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let{name:name2,description,expiresAt,metadata}=ctx.body,now=new Date,inserted=await db.insert(cohortsTable).values({name:name2,description:description??null,createdBy:userId,expiresAt:expiresAt?new Date(expiresAt):null,userCount:0,metadata:metadata??{},createdAt:now,updatedAt:now}).returning();return logger2.audit({entityName:"user_cohorts",entityId:inserted[0]?.id,operation:"COHORT_CREATE",userId,summary:`Created cohort "${name2}"`}),{success:!0,data:inserted[0]}};init_revokeUserSessions();import{eq as eq25}from"drizzle-orm";var handleDeactivateUsers=(db,usersTable,logger2,sessionsTable)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let result=await db.update(usersTable).set({isLocked:!0,updatedAt:new Date}).where(eq25(col7(usersTable,"cohortId"),ctx.params.id)).returning(),signedOut=await revokeUserSessions({db,sessionsTable,onError:(error)=>logger2.error("Cohort sessions could not be revoked after deactivating",{error,cohortId:ctx.params.id})},result.map((row)=>String(row.id)));return logger2.audit({entityName:"user_cohorts",entityId:ctx.params.id,operation:"COHORT_DEACTIVATE_USERS",userId,summary:`Deactivated ${result.length} users in cohort, ending ${signedOut} session(s)`}),{success:!0,data:{affected:result.length,signedOut}}};import{eq as eq26,inArray as inArray10}from"drizzle-orm";var handleDeleteUsers=(db,usersTable,cohortsTable,userRolesTable,profilesTable,logger2)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let userIds=(await db.select({id:col7(usersTable,"id")}).from(usersTable).where(eq26(col7(usersTable,"cohortId"),ctx.params.id))).map((u)=>String(u.id));if(userIds.length>0){if(userRolesTable)await db.delete(userRolesTable).where(inArray10(col7(userRolesTable,"userId"),userIds));if(profilesTable)await db.delete(profilesTable).where(inArray10(col7(profilesTable,"userId"),userIds));await db.delete(usersTable).where(inArray10(col7(usersTable,"id"),userIds))}return await db.update(cohortsTable).set({userCount:0,updatedAt:new Date}).where(eq26(col7(cohortsTable,"id"),ctx.params.id)),logger2.audit({entityName:"user_cohorts",entityId:ctx.params.id,operation:"COHORT_DELETE_USERS",userId,summary:`Deleted ${userIds.length} users from cohort`}),{success:!0,data:{deleted:userIds.length}}};import{eq as eq27}from"drizzle-orm";var handleGetCohort=(db,usersTable,cohortsTable)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let rows=await db.select().from(cohortsTable).where(eq27(col7(cohortsTable,"id"),ctx.params.id)).limit(1);if(rows.length===0)return ctx.set.status=404,{success:!1,message:"Cohort not found"};let userRows=await db.select().from(usersTable).where(eq27(col7(usersTable,"cohortId"),ctx.params.id));return{success:!0,data:{...rows[0],users:userRows}}};import{eq as eq28}from"drizzle-orm";var csvCell=(value)=>{let s=value==null?"":String(value);if(/^[=+\-@\t\r]/.test(s))s=`'${s}`;if(/[",\n\r]/.test(s))s=`"${s.replace(/"/g,'""')}"`;return s},handleExportUsers=(db,usersTable)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let userRows=await db.select().from(usersTable).where(eq28(col7(usersTable,"cohortId"),ctx.params.id)),lines=["email,status,locked,created_at"];for(let row of userRows){let u=row;lines.push([csvCell(u.email),csvCell(u.isActive?"active":"inactive"),csvCell(u.isLocked?"yes":"no"),csvCell(u.createdAt)].join(","))}return ctx.set.headers["content-type"]="text/csv",ctx.set.headers["content-disposition"]=`attachment; filename="cohort-${ctx.params.id}-users.csv"`,lines.join(`
+    `),first=((Array.isArray(current)?current:current?.rows)??[])[0];if(!first)return{action:"already-nullable"};if(first.is_nullable==="YES")return{action:"already-nullable"};return await db.execute(sql13.raw(`ALTER TABLE "${schemaName}"."${tableName}" ALTER COLUMN "expires_at" DROP NOT NULL`)),logger2?.info(`[Schema] "${schemaName}"."${tableName}".expires_at may now be empty \u2014 this install runs sessions that never expire, and a session with no expiry is a row with no expiry.`),{action:"relaxed"}}catch(error3){let reason=error3 instanceof Error?error3.message:String(error3);return logger2?.warn(`[Schema] Could not let "${schemaName}"."${tableName}".expires_at be empty: ${reason}. Sign-in will fail with "Missing required field: expires_at" until this column allows nulls.`),{action:"failed",reason}}}var SAFE_IDENTIFIER;var init_relaxSessionExpiry=__esm(()=>{SAFE_IDENTIFIER=/^[A-Za-z_][A-Za-z0-9_]*$/});function normSegment(input){return input.toLowerCase().replace(/[^a-z0-9]+/g,"_").replace(/_+/g,"_").replace(/^_|_$/g,"")}function normPath(path7){return normSegment(path7.replace(/\{[^}]+\}/g,(m)=>m.slice(1,-1)))}function shortHash(input){let h=5381;for(let i=0;i<input.length;i++)h=(h*33^input.charCodeAt(i))>>>0;return h.toString(36)}function capAction(action,max=100){if(action.length<=max)return action;let suffix=`_${shortHash(action)}`;return action.slice(0,Math.max(1,max-suffix.length))+suffix}function resourceFromPath(path7){let segs=path7.split("/").filter(Boolean).filter((s)=>!s.startsWith("{"));for(let s of segs){if(s==="api"||/^v\d+$/i.test(s))continue;return normSegment(s)}return normSegment(segs[0]??"root")}function matchesExclude(path7,patterns3){if(!patterns3?.length)return!1;for(let raw of patterns3){let p=raw.trim();if(!p)continue;if(p.endsWith("/*")){let prefix=p.slice(0,-2);if(path7===prefix||path7.startsWith(`${prefix}/`))return!0}else if(p.endsWith("*")){if(path7.startsWith(p.slice(0,-1)))return!0}else if(path7===p)return!0}return!1}function parseOpenApiToClaims(serviceId,doc,opts={}){let sid=normSegment(serviceId);if(!sid)throw Error("endpointDiscovery: serviceId is empty after normalization");if(RESERVED_SERVICE_IDS.has(sid))throw Error(`endpointDiscovery: serviceId "${serviceId}" collides with an HTTP-method claim prefix; pick another id`);let specs=[],seen=new Set,paths=doc.paths??{};for(let[path7,ops]of Object.entries(paths)){if(!ops||matchesExclude(path7,opts.exclude))continue;for(let method of HTTP_METHODS2){let op=ops[method];if(!op)continue;let tag=(op.tags?.[0]?normSegment(op.tags[0]):"")||resourceFromPath(path7),opToken=(op.operationId?normSegment(op.operationId):"")||`${method}_${normPath(path7)}`,action=capAction(`${sid}.${tag||"root"}.${opToken||method}`);if(seen.has(action)){action=capAction(`${action}_${shortHash(`${method} ${path7}`)}`);while(seen.has(action))action=capAction(`${action}_${shortHash(action)}`)}seen.add(action),specs.push({action,path:path7,method:method.toUpperCase(),description:op.summary||op.description||`${method.toUpperCase()} ${path7}`})}}return specs}function diffClaims(existing,specs){let specByAction=new Map(specs.map((s)=>[s.action,s])),existByAction=new Map(existing.map((e)=>[e.action,e]));return{toInsert:specs.filter((s)=>!existByAction.has(s.action)),toReactivate:specs.filter((s)=>existByAction.get(s.action)?.isActive===!1),toDeactivate:existing.filter((e)=>e.isActive&&!specByAction.has(e.action)),unchanged:specs.filter((s)=>existByAction.get(s.action)?.isActive===!0)}}async function fetchOpenApi(baseUrl,openapiPath,fetchImpl=fetch){let url=`${baseUrl.replace(/\/$/,"")}${openapiPath.startsWith("/")?"":"/"}${openapiPath}`,res=await fetchImpl(url);if(!res.ok)throw Error(`endpointDiscovery: OpenAPI fetch failed ${res.status} for ${url}`);return await res.json()}var HTTP_METHODS2,RESERVED_SERVICE_IDS;var init_EndpointDiscovery=__esm(()=>{HTTP_METHODS2=["get","post","put","patch","delete"],RESERVED_SERVICE_IDS=new Set(["get","post","put","patch","delete","toggle","bulk"])});var exports_seed={};__export(exports_seed,{seedDiscoveredClaims:()=>seedDiscoveredClaims,runEndpointDiscovery:()=>runEndpointDiscovery,getRouteManifest:()=>getRouteManifest,getRoleClaimsManifest:()=>getRoleClaimsManifest});import{eq as eq65,like as like2}from"drizzle-orm";function col16(table,name2){return table[name2]}async function seedDiscoveredClaims(db,claimsTable,serviceId,specs,logger2){let actionCol=col16(claimsTable,"action"),prefix=specs[0]?.action.split(".")[0]??serviceId.toLowerCase(),existing=(await db.select().from(claimsTable).where(like2(actionCol,`${prefix}.%`))).map((r)=>({action:String(r.action),isActive:r.isActive!==!1,path:String(r.path??""),method:String(r.method??""),description:String(r.description??"")})),plan=diffClaims(existing,specs);for(let s of plan.toInsert)await db.insert(claimsTable).values({action:s.action,path:s.path,method:s.method,description:s.description});for(let s of plan.toReactivate)await db.update(claimsTable).set({isActive:!0,path:s.path,method:s.method,description:s.description}).where(eq65(actionCol,s.action));for(let e of plan.toDeactivate)await db.update(claimsTable).set({isActive:!1}).where(eq65(actionCol,e.action));let summary={added:plan.toInsert.length,reactivated:plan.toReactivate.length,deactivated:plan.toDeactivate.length,unchanged:plan.unchanged.length,total:specs.length};return logger2.info(`[Discovery] Reconciled "${serviceId}"`,summary),summary}async function runEndpointDiscovery(db,schemaTables,config,logger2,fetchImpl=fetch){let claimsTable=schemaTables.claims,services=config.services??[],results=[];if(!claimsTable)return logger2.warn("[Discovery] No claims table in schema; skipping endpoint discovery"),{services:[]};for(let svc of services)try{let doc=await fetchOpenApi(svc.baseUrl,svc.openapi??"/openapi.json",fetchImpl),specs=parseOpenApiToClaims(svc.id,doc,{exclude:svc.exclude}),summary=await seedDiscoveredClaims(db,claimsTable,svc.id,specs,logger2);results.push({id:svc.id,...summary})}catch(err){let message=err instanceof Error?err.message:String(err);logger2.error(`[Discovery] Service "${svc.id}" discovery failed`,{error:message}),results.push({id:svc.id,added:0,reactivated:0,deactivated:0,unchanged:0,total:0,error:message})}return{services:results}}async function getRouteManifest(db,claimsTable,serviceId){return(await db.select().from(claimsTable).where(like2(col16(claimsTable,"action"),`${serviceId.toLowerCase()}.%`))).filter((r)=>r.isActive!==!1).map((r)=>({action:String(r.action),path:String(r.path??""),method:String(r.method??"")}))}async function getRoleClaimsManifest(db,schemaTables,serviceId){let{roles:rolesTable,claims:claimsTable}=schemaTables,roleClaimsTable=schemaTables.roleClaims??schemaTables.role_claims;if(!rolesTable||!claimsTable||!roleClaimsTable)return{};let sid=serviceId.toLowerCase(),claimRows=await db.select().from(claimsTable),claimIdToAction=new Map;for(let c of claimRows){if(c.isActive===!1)continue;let action=String(c.action??"");if(action===sid||action.startsWith(`${sid}.`))claimIdToAction.set(String(c.id),action)}if(claimIdToAction.size===0)return{};let roleRows=await db.select().from(rolesTable),roleIdToName=new Map;for(let r of roleRows)roleIdToName.set(String(r.id),String(r.name??""));let rcRows=await db.select().from(roleClaimsTable),out={};for(let rc of rcRows){if(rc.isActive===!1)continue;let action=claimIdToAction.get(String(rc.claimId??rc.claim_id)),roleName=roleIdToName.get(String(rc.roleId??rc.role_id));if(!action||!roleName)continue;let actions=out[roleName];if(!actions)actions=[],out[roleName]=actions;actions.push(action)}return out}var init_seed=__esm(()=>{init_EndpointDiscovery()});var OPS_BY_TYPE;var init_types23=__esm(()=>{OPS_BY_TYPE={int:["gt","gte","lt","lte","eq","ne"],boolean:["eq","ne"],string:["eq","ne"]}});function isRecord(v){return typeof v==="object"&&v!==null}function guardActionFromName(name2){let brace=name2.indexOf("{");return(brace>=0?name2.slice(0,brace):name2).replace(/:$/,"")}function parseGuardCatalogEntry(entry){if(!isRecord(entry))return null;let name2=typeof entry.name==="string"?entry.name.trim():"";if(!name2)return null;let valueType=entry.value;if(typeof valueType!=="string"||!VALUE_TYPES.includes(valueType))return null;let action=guardActionFromName(name2);if(!action)return null;return{action,policy:{kind:"guard",keyTemplate:name2,valueType}}}function parseGuardPolicy(raw){if(!isRecord(raw)||raw.kind!=="guard")return null;if(typeof raw.keyTemplate!=="string"||!raw.keyTemplate)return null;let vt=raw.valueType;if(typeof vt!=="string"||!VALUE_TYPES.includes(vt))return null;return{kind:"guard",keyTemplate:raw.keyTemplate,valueType:vt}}function resolveGuardKey(keyTemplate,ctx){return keyTemplate.replaceAll("{userId}",ctx.userId).replaceAll("{tenant}",ctx.tenant??"default")}function coerceThreshold(value2,type4){if(type4==="int"){if(value2==null)return null;if(typeof value2==="boolean"||typeof value2==="symbol")return null;if(typeof value2==="string"&&value2.trim()==="")return null;if(typeof value2==="object")return null;let n=Number(value2);return Number.isFinite(n)?n:null}if(type4==="boolean"){if(typeof value2==="boolean")return value2;if(value2==="true"||value2===1||value2==="1")return!0;if(value2==="false"||value2===0||value2==="0")return!1;return null}return value2==null?null:String(value2)}function parseGuardCondition(scope,valueType){let raw=scope;if(typeof scope==="string")try{raw=JSON.parse(scope)}catch{return null}if(!isRecord(raw))return null;let op=raw.op;if(typeof op!=="string"||!OPS_BY_TYPE[valueType].includes(op))return null;let value2=coerceThreshold(raw.value,valueType);if(value2===null)return null;let invalidates=Array.isArray(raw.invalidates)?raw.invalidates.filter((a)=>typeof a==="string"&&a.length>0):[];return{op,value:value2,invalidates}}function coerceStateValue(raw,type4){if(raw==null)return null;let v=isRecord(raw)&&"data"in raw?raw.data:raw;if(v==null)return null;if(typeof v==="object")return null;if(type4==="int"&&typeof v==="string"&&v.trim()==="")return null;return coerceThreshold(v,type4)}function guardConditionHolds(rawValue,valueType,condition){let actual=coerceStateValue(rawValue,valueType);if(actual===null)return!1;let target2=condition.value;switch(condition.op){case"gt":return actual>target2;case"gte":return actual>=target2;case"lt":return actual<target2;case"lte":return actual<=target2;case"eq":return actual===target2;case"ne":return actual!==target2;default:return!1}}function parseClaimGuardCatalog(entries){if(!entries?.length)return[];let out=[],seen=new Set;for(let e of entries){let parsed=parseGuardCatalogEntry(e);if(parsed&&!seen.has(parsed.action))seen.add(parsed.action),out.push(parsed)}return out}var VALUE_TYPES;var init_evaluate=__esm(()=>{init_types23();VALUE_TYPES=["int","boolean","string"]});async function resolveClaimGuards(db,schemaTables,userId,read2,ctx={}){let claimsTable=schemaTables.claims,roleClaimsTable=schemaTables.roleClaims??schemaTables.role_claims,userRolesTable=schemaTables.userRoles??schemaTables.user_roles;if(!claimsTable||!roleClaimsTable||!userRolesTable)return EMPTY;let claimRows=await db.select().from(claimsTable),guardByClaimId=new Map;for(let c of claimRows){if(c.isActive===!1)continue;let policy=parseGuardPolicy(c.policy);if(policy)guardByClaimId.set(String(c.id),{action:String(c.action??""),policy})}if(guardByClaimId.size===0)return EMPTY;let urRows=await db.select().from(userRolesTable),roleIds=new Set(urRows.filter((r)=>r.isActive!==!1&&String(r.userId??r.user_id)===userId).map((r)=>String(r.roleId??r.role_id)));if(roleIds.size===0)return EMPTY;let rcRows=await db.select().from(roleClaimsTable),guards=[],suppressed=new Set,firedGuards=[],stateCache=new Map;for(let rc of rcRows){if(rc.isActive===!1)continue;if(!roleIds.has(String(rc.roleId??rc.role_id)))continue;let guard4=guardByClaimId.get(String(rc.claimId??rc.claim_id));if(!guard4)continue;let condition=parseGuardCondition(rc.scope,guard4.policy.valueType);if(!condition)continue;let key2=resolveGuardKey(guard4.policy.keyTemplate,{userId,tenant:ctx.tenant}),value2;if(stateCache.has(key2))value2=stateCache.get(key2);else value2=await read2(key2).catch(()=>null),stateCache.set(key2,value2);let holds=guardConditionHolds(value2,guard4.policy.valueType,condition),current=normalizeCurrent(value2,guard4.policy.valueType);if(guards.push({action:guard4.action,key:key2,valueType:guard4.policy.valueType,op:condition.op,threshold:condition.value,current,invalidates:condition.invalidates,holds}),holds&&condition.invalidates.length>0){for(let a of condition.invalidates)suppressed.add(a);firedGuards.push({action:guard4.action,key:key2,invalidates:condition.invalidates})}}return{guards,suppressedClaims:[...suppressed],firedGuards}}function normalizeCurrent(raw,type4){if(raw==null)return null;let v=typeof raw==="object"&&raw!==null&&"data"in raw?raw.data:raw;if(v==null)return null;if(type4==="int"){let n=Number(v);return Number.isFinite(n)?n:null}if(type4==="boolean")return v===!0||v==="true"||v===1||v==="1";return String(v)}var EMPTY;var init_resolve=__esm(()=>{init_evaluate();EMPTY={guards:[],suppressedClaims:[],firedGuards:[]}});import{eq as eq66}from"drizzle-orm";async function seedClaimGuards(db,schemaTables,claimGuards,logger2){let claimsTable=schemaTables.claims;if(!claimsTable)return{created:0,updated:0,deactivated:0};let actionCol=claimsTable.action,desired=parseClaimGuardCatalog(claimGuards),desiredByAction=new Map(desired.map((d)=>[d.action,d.policy])),existing=await db.select().from(claimsTable),existingGuardActions=new Set,result={created:0,updated:0,deactivated:0};for(let row of existing){if(!parseGuardPolicy(row.policy))continue;let action=String(row.action??"");existingGuardActions.add(action);let want=desiredByAction.get(action);if(!want){if(row.isActive!==!1)await db.update(claimsTable).set({isActive:!1}).where(eq66(actionCol,action)),result.deactivated++;continue}let current=row.policy;if(JSON.stringify(current)!==JSON.stringify(want)||row.isActive===!1)await db.update(claimsTable).set({policy:want,isActive:!0,path:want.keyTemplate,method:"GUARD"}).where(eq66(actionCol,action)),result.updated++}for(let{action,policy}of desired){if(existingGuardActions.has(action))continue;await db.insert(claimsTable).values({action,description:`ClaimGuard [${policy.valueType}] key=${policy.keyTemplate}`,path:policy.keyTemplate,method:"GUARD",policy,isActive:!0}),result.created++}return logger2?.info?.(`[Authorization] ClaimGuards seeded (created=${result.created}, updated=${result.updated}, deactivated=${result.deactivated})`),result}var init_seed2=__esm(()=>{init_evaluate()});var exports_ClaimGuard={};__export(exports_ClaimGuard,{seedClaimGuards:()=>seedClaimGuards,resolveGuardKey:()=>resolveGuardKey,resolveClaimGuards:()=>resolveClaimGuards,parseGuardPolicy:()=>parseGuardPolicy,parseGuardCondition:()=>parseGuardCondition,parseGuardCatalogEntry:()=>parseGuardCatalogEntry,parseClaimGuardCatalog:()=>parseClaimGuardCatalog,guardConditionHolds:()=>guardConditionHolds,guardActionFromName:()=>guardActionFromName,OPS_BY_TYPE:()=>OPS_BY_TYPE});var init_ClaimGuard=__esm(()=>{init_evaluate();init_resolve();init_seed2();init_types23()});var exports_dbStorage={};__export(exports_dbStorage,{createDbWebAuthnStorage:()=>createDbWebAuthnStorage});import{and as and26,eq as eq67,isNull as isNull6}from"drizzle-orm";function rowToRecord(row){return{id:row.id,userId:row.userId,credentialId:row.credentialId,publicKey:row.publicKey,counter:typeof row.counter==="bigint"?Number(row.counter):Number(row.counter??0),transports:parseTransports(row.transports),deviceType:parseDeviceType(row.deviceType),backedUp:row.backedUp,aaguid:row.aaguid,authenticatorAttachment:row.authenticatorAttachment==="platform"||row.authenticatorAttachment==="cross-platform"?row.authenticatorAttachment:null,nickname:row.nickname,lastUsedAt:row.lastUsedAt,revokedAt:row.revokedAt,createdAt:row.createdAt}}function col17(table,key2){return table[key2]}function createDbWebAuthnStorage(deps){let{db,resolveTable}=deps,credentialsName="webauthnCredentials",challengesName="webauthnChallenges";return{storeChallenge:async(challenge,schemaName)=>{let table=resolveTable("webauthnChallenges",schemaName);if(!table)return;await db.insert(table).values({userId:challenge.userId??null,challenge:challenge.challenge,challengeType:challenge.challengeType,expiresAt:challenge.expiresAt})},consumeChallenge:async(challenge,challengeType,schemaName)=>{let table=resolveTable("webauthnChallenges",schemaName);if(!table)return null;let row=(await db.update(table).set({consumedAt:new Date}).where(and26(eq67(col17(table,"challenge"),challenge),eq67(col17(table,"challengeType"),challengeType),isNull6(col17(table,"consumedAt")))).returning())[0];if(!row)return null;return{challenge:row.challenge,challengeType:row.challengeType,userId:row.userId,expiresAt:row.expiresAt}},listCredentialsByUser:async(userId,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return[];return(await db.select().from(table).where(eq67(col17(table,"userId"),userId))).map(rowToRecord)},findCredentialById:async(credentialId,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return null;let rows=await db.select().from(table).where(eq67(col17(table,"credentialId"),credentialId)).limit(1);return rows[0]?rowToRecord(rows[0]):null},insertCredential:async(record3,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)throw Error("webauthn_credentials table not configured");let row=(await db.insert(table).values({userId:record3.userId,credentialId:record3.credentialId,publicKey:record3.publicKey,counter:record3.counter,transports:record3.transports??null,deviceType:record3.deviceType??null,backedUp:record3.backedUp,aaguid:record3.aaguid??null,authenticatorAttachment:record3.authenticatorAttachment??null,nickname:record3.nickname??null}).returning())[0];if(!row)throw Error("Failed to insert webauthn credential");return rowToRecord(row)},updateCredentialCounter:async(credentialId,counter,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return;await db.update(table).set({counter,lastUsedAt:new Date}).where(eq67(col17(table,"credentialId"),credentialId))},revokeCredential:async(credentialId,userId,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return!1;return(await db.update(table).set({revokedAt:new Date}).where(and26(eq67(col17(table,"credentialId"),credentialId),eq67(col17(table,"userId"),userId))).returning()).length>0},renameCredential:async(credentialId,userId,nickname,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return!1;return(await db.update(table).set({nickname}).where(and26(eq67(col17(table,"credentialId"),credentialId),eq67(col17(table,"userId"),userId))).returning()).length>0}}}var init_dbStorage=()=>{};function isValidUploadId(id){return typeof id==="string"&&/^[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(id)}function offsetVerdict(input){let{declaredOffset,actualOffset,chunkBytes,totalSize}=input;if(!Number.isFinite(declaredOffset)||declaredOffset<0)return{ok:!1,reason:"offset_mismatch",expected:actualOffset};if(declaredOffset!==actualOffset)return{ok:!1,reason:"offset_mismatch",expected:actualOffset};if(actualOffset+chunkBytes>totalSize)return{ok:!1,reason:"too_long",expected:actualOffset};return{ok:!0}}function isComplete(actualOffset,totalSize){return actualOffset===totalSize&&totalSize>0}function sessionRefusal(input){let{session,callerId,fingerprint,now}=input;if(!session)return"not_found";if(!callerId||session.owner!==callerId)return"not_yours";if(now-session.createdAt>86400000)return"expired";if(fingerprint!=null&&fingerprint!==session.fingerprint)return"wrong_file";return null}function isExpired(session,now){return now-session.createdAt>86400000}function sessionStatus(session,offset){return{uploadId:session.id,offset,size:session.size,originalName:session.originalName,complete:isComplete(offset,session.size)}}var SESSION_TTL_MS=86400000,CHUNK_SIZE_BYTES=8388608,MAX_CHUNK_BYTES=33554432;import{randomUUID as randomUUID10}from"crypto";import{mkdir as mkdir8,open as open2,readdir as readdir3,readFile as readFile2,rm as rm2,stat as stat8,writeFile as writeFile2}from"fs/promises";import path7 from"path";function createResumableStore(basePath){let root=path7.join(basePath,UPLOAD_DIR);function pathsFor(id){if(!isValidUploadId(id))return null;let part=path7.join(root,`${id}.part`),meta=path7.join(root,`${id}.json`);if(!isPathWithinBase(root,part)||!isPathWithinBase(root,meta))return null;return{part,meta}}async function create4(input,now){await mkdir8(root,{recursive:!0});let session={...input,id:randomUUID10(),createdAt:now},paths=pathsFor(session.id);if(!paths)throw Error("Generated upload id was rejected by its own validator");return await writeFile2(paths.meta,JSON.stringify(session),"utf8"),await writeFile2(paths.part,""),session}async function read2(id){let paths=pathsFor(id);if(!paths)return null;try{let raw=await readFile2(paths.meta,"utf8"),parsed=JSON.parse(raw);if(!parsed||typeof parsed.owner!=="string"||typeof parsed.size!=="number")return null;return parsed}catch{return null}}async function offsetOf(id){let paths=pathsFor(id);if(!paths)return null;try{return(await stat8(paths.part)).size}catch{return null}}async function writeAt(id,offset,chunk){let paths=pathsFor(id);if(!paths)return null;let handle=await open2(paths.part,"r+");try{await handle.write(chunk,0,chunk.byteLength,offset)}finally{await handle.close()}return(await stat8(paths.part)).size}async function readAssembled(id){let paths=pathsFor(id);if(!paths)return null;try{return await readFile2(paths.part)}catch{return null}}function partPath(id){return pathsFor(id)?.part??null}async function discardMeta(id){let paths=pathsFor(id);if(!paths)return;await rm2(paths.meta,{force:!0})}async function discard2(id){let paths=pathsFor(id);if(!paths)return;await rm2(paths.part,{force:!0}),await rm2(paths.meta,{force:!0})}async function sweep(now){let removed=0,entries;try{entries=await readdir3(root)}catch{return 0}for(let entry of entries){if(!entry.endsWith(".json"))continue;let id=entry.slice(0,-5);try{let session=await read2(id);if(session&&!isExpired(session,now))continue;await discard2(id),removed+=1}catch{}}return removed}return{create:create4,read:read2,offsetOf,writeAt,readAssembled,partPath,discard:discard2,discardMeta,sweep,root}}var UPLOAD_DIR=".uploads";var init_store4=__esm(()=>{init_helpers3()});var exports_resumable={};__export(exports_resumable,{createResumableRoutes:()=>createResumableRoutes,SESSION_TTL_MS:()=>SESSION_TTL_MS,CHUNK_SIZE_BYTES:()=>CHUNK_SIZE_BYTES});function toBytes(body){if(body instanceof Uint8Array)return body;if(body instanceof ArrayBuffer)return new Uint8Array(body);if(ArrayBuffer.isView(body))return new Uint8Array(body.buffer,body.byteOffset,body.byteLength);if(typeof body==="string")return new TextEncoder().encode(body);return new Uint8Array(0)}function createResumableRoutes(config){let{basePath,storage,logger:logger2,getUserId:getUserId3,canUpload,register}=config,store=createResumableStore(basePath),openSession=async(id,request,fingerprint)=>{let userId=getUserId3(request);if(!await canUpload(request))return{ok:!1,status:403,message:"You are not allowed to upload files."};let session=isValidUploadId(id)?await store.read(id):null,refusal=sessionRefusal({session,callerId:userId,fingerprint,now:Date.now()});if(refusal)return{ok:!1,status:REFUSAL_STATUS[refusal],message:REFUSAL_MESSAGE[refusal]};return{ok:!0,session,userId}},routePostRoot=defineRoute({method:"POST",path:"/",body:Type.Object({originalName:Type.String({minLength:1,maxLength:500}),size:Type.Number(),mimeType:Type.String({maxLength:200}),type:Type.Optional(Type.String({maxLength:40})),fingerprint:Type.String({minLength:1,maxLength:200})}),detail:{tags:["Storage"],summary:"Start a resumable upload"},handler:async({body,request,set:set2})=>{let userId=getUserId3(request);if(!userId)return set2.status=401,{success:!1,message:"Sign in to upload."};if(!await canUpload(request))return set2.status=403,{success:!1,message:"You are not allowed to upload files."};if(!Number.isFinite(body.size)||body.size<=0)return set2.status=400,{success:!1,message:"A size is required to start an upload."};if(body.size>storage.maxFileSizeBytes)return set2.status=413,{success:!1,message:`This file is larger than the ${Math.round(storage.maxFileSizeBytes/1048576)} MB limit.`};if(isMimeTypeListed(storage.blockedMimeTypes,body.mimeType))return set2.status=415,{success:!1,message:"This kind of file cannot be uploaded."};if(storage.allowedMimeTypes?.length&&!isMimeTypeListed(storage.allowedMimeTypes,body.mimeType))return set2.status=415,{success:!1,message:"This kind of file cannot be uploaded."};let session=await store.create({owner:userId,originalName:body.originalName,size:body.size,mimeType:body.mimeType,type:body.type??"file",fingerprint:body.fingerprint},Date.now());return set2.status=201,{success:!0,data:sessionStatus(session,0)}}}),routeGetId=defineRoute({method:"GET",path:"/:id",handler:async({params,request,set:set2})=>{let opened=await openSession(params.id,request);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};let offset=await store.offsetOf(params.id)??0;return{success:!0,data:sessionStatus(opened.session,offset)}}}),routePatchId=defineRoute({method:"PATCH",path:"/:id",detail:{tags:["Storage"],summary:"Append a piece"},handler:async({params,request,body,set:set2})=>{let fingerprint=request.headers.get("upload-fingerprint"),opened=await openSession(params.id,request,fingerprint);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};let declared2=Number(request.headers.get("upload-offset")),actual=await store.offsetOf(params.id)??0,chunk=toBytes(body);if(chunk.byteLength>MAX_CHUNK_BYTES)return set2.status=413,{success:!1,message:`A single piece may not exceed ${MAX_CHUNK_BYTES/1048576} MB.`,data:{offset:actual}};let verdict=offsetVerdict({declaredOffset:declared2,actualOffset:actual,chunkBytes:chunk.byteLength,totalSize:opened.session.size});if(!verdict.ok)return set2.status=409,{success:!1,message:verdict.reason==="too_long"?"This piece would take the file past the size it was started with.":"This piece does not continue where the file ends.",data:{offset:verdict.expected}};let offset=await store.writeAt(params.id,actual,chunk);if(offset===null)return set2.status=500,{success:!1,message:"The piece could not be written."};return{success:!0,data:sessionStatus(opened.session,offset)}}}),routePostIdComplete=defineRoute({method:"POST",path:"/:id/complete",handler:async({params,request,set:set2})=>{let opened=await openSession(params.id,request);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};let offset=await store.offsetOf(params.id)??0;if(!isComplete(offset,opened.session.size))return set2.status=409,{success:!1,message:"The file is not complete yet.",data:sessionStatus(opened.session,offset)};let partPath=store.partPath(params.id);if(!partPath)return set2.status=500,{success:!1,message:"The assembled file could not be found."};let registered=await register({partPath,size:offset,originalName:opened.session.originalName,mimeType:opened.session.mimeType,type:opened.session.type,userId:opened.userId});if(!registered)return set2.status=500,{success:!1,message:"The file could not be registered. Try completing again."};return await store.discardMeta(params.id),logger2.info(`[Storage] Resumable upload finished: ${opened.session.originalName} (${offset} bytes)`),{success:!0,data:{id:registered.id}}}}),routeDeleteId=defineRoute({method:"DELETE",path:"/:id",handler:async({params,request,set:set2})=>{let opened=await openSession(params.id,request);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};return await store.discard(params.id),{success:!0,data:{discarded:!0}}}});return{plugin:collectRoutes([{prefix:"/uploads",routes:[routePostRoot,routeGetId,routePatchId,routePostIdComplete,routeDeleteId]}]),sweep:(now)=>store.sweep(now)}}var REFUSAL_STATUS,REFUSAL_MESSAGE;var init_resumable=__esm(()=>{init_esm3();init_routeCollector();init_helpers3();init_store4();REFUSAL_STATUS={not_found:404,not_yours:404,expired:410,wrong_file:409},REFUSAL_MESSAGE={not_found:"No such upload.",not_yours:"No such upload.",expired:"This upload was abandoned and has been cleaned up. Start it again.",wrong_file:"This is a different file from the one this upload started with."}});var exports_authorization={};__export(exports_authorization,{createAuthorizationDiscoveryRoutes:()=>createAuthorizationDiscoveryRoutes});import{timingSafeEqual as timingSafeEqual4}from"crypto";function tokensMatch2(a,b){let ba=Buffer.from(a),bb=Buffer.from(b);if(ba.length!==bb.length)return!1;return timingSafeEqual4(ba,bb)}function createAuthorizationDiscoveryRoutes(cfg){let{db,schemaTables,logger:logger2,discovery,readState}=cfg,token=discovery.token||process.env.NUCLEUS_DISCOVERY_TOKEN,claimsTable=schemaTables.claims,manifestAuthorized=(request)=>{if(hasGodminRole(request))return!0;if(token){let presented=request.headers.get("x-discovery-token")??"";return tokensMatch2(presented,token)}return!1},authorizeGuardRead=(request,query,set2)=>{let callerId=request.headers.get("x-user-id")??"",isGodmin4=hasGodminRole(request),requested=query.userId;if(requested&&requested!==callerId&&!isGodmin4)return{error:fail6(set2,403,"Forbidden: only godmin can read another user's guards")};let targetUserId=requested&&isGodmin4?requested:callerId;if(!targetUserId)return{error:fail6(set2,401,"Unauthorized: no user context")};return{userId:targetUserId}},guardsHandler=async({request,query,set:set2})=>{let auth=authorizeGuardRead(request,query,set2);if("error"in auth)return auth.error;let tenant=request.headers.get("x-tenant-id")??void 0;if(!readState)return{success:!0,data:{userId:auth.userId,guards:[]}};let{guards}=await resolveClaimGuards(db,schemaTables,auth.userId,readState,{tenant});return{success:!0,data:{userId:auth.userId,guards}}},declared=[defineRoute({method:"POST",path:"/authorization/discover",handler:async({request,set:set2})=>{if(!hasGodminRole(request))return fail6(set2,403,"Forbidden: endpoint discovery requires godmin");if(!discovery.enabled)return fail6(set2,400,"endpointDiscovery is not enabled");return{success:!0,message:"Discovery completed",data:await runEndpointDiscovery(db,schemaTables,discovery,logger2)}}}),defineRoute({method:"GET",path:"/authorization/route-manifest",handler:async({request,query,set:set2})=>{if(!manifestAuthorized(request))return fail6(set2,403,"Forbidden: godmin or a valid x-discovery-token required");if(!claimsTable)return fail6(set2,503,"Claims table unavailable");let service=query.service;if(service){let rows=await getRouteManifest(db,claimsTable,service);return{success:!0,data:{service,routes:rows}}}let all={};for(let svc of discovery.services??[])all[svc.id]=await getRouteManifest(db,claimsTable,svc.id);return{success:!0,data:all}}}),defineRoute({method:"GET",path:"/authorization/role-claims-manifest",handler:async({request,query,set:set2})=>{if(!manifestAuthorized(request))return fail6(set2,403,"Forbidden: godmin or a valid x-discovery-token required");let service=query.service;if(!service)return fail6(set2,400,"service query param required");let map3=await getRoleClaimsManifest(db,schemaTables,service);return{success:!0,data:{service,roleClaims:map3}}}}),defineRoute({method:"GET",path:"/authorization/guards",handler:guardsHandler}),defineRoute({method:"GET",path:"/authorization/quotas",handler:guardsHandler}),defineRoute({method:"GET",path:"/authorization/suppressed-claims",handler:async({request,query,set:set2})=>{let auth=authorizeGuardRead(request,query,set2);if("error"in auth)return auth.error;if(!readState)return{success:!0,data:{userId:auth.userId,suppressedClaims:[],firedGuards:[]}};let tenant=request.headers.get("x-tenant-id")??void 0,{suppressedClaims,firedGuards}=await resolveClaimGuards(db,schemaTables,auth.userId,readState,{tenant});return{success:!0,data:{userId:auth.userId,suppressedClaims,firedGuards}}}})];return collectRoutes([{routes:declared}])}var fail6=(set2,status,message)=>{return set2.status=status,{success:!1,message,data:null}};var init_authorization=__esm(()=>{init_ClaimGuard();init_seed();init_routeCollector();init_adminGuard()});var import_reflect_metadata2=__toESM(require_Reflect(),1);import{createHash as createHash5,randomUUID as randomUUID11}from"crypto";import{pushSchema}from"drizzle-kit/api";import{and as and27,desc as desc7,eq as eq68,lt as lt3,ne as ne4,sql as sql13}from"drizzle-orm";import{drizzle as drizzle2}from"drizzle-orm/node-postgres";import{pgSchema as pgSchema2}from"drizzle-orm/pg-core";import{join as join3}from"path";class LiveStorageProvider{resolve;constructor(resolve){this.resolve=resolve}get kind(){return this.resolve().kind}get describe(){return this.resolve().describe}isAvailable(){return this.resolve().isAvailable()}exists(relativePath){return this.resolve().exists(relativePath)}stat(relativePath){return this.resolve().stat(relativePath)}read(relativePath){return this.resolve().read(relativePath)}write(relativePath,data){return this.resolve().write(relativePath,data)}delete(relativePath){return this.resolve().delete(relativePath)}ensureDir(relativeDir){return this.resolve().ensureDir(relativeDir)}list(relativeDir){return this.resolve().list(relativeDir)}localPath(relativePath){return this.resolve().localPath(relativePath)}close(){return this.resolve().close()}}import{mkdir,readdir,stat,unlink}from"fs/promises";import{dirname,join}from"path";function normalizeRelativePath(relativePath){let cleaned=relativePath.replace(/\\/g,"/").replace(/^\/+/,""),segments=[];for(let segment of cleaned.split("/")){if(!segment||segment===".")continue;if(segment==="..")throw Error(`Path traversal rejected: ${relativePath}`);segments.push(segment)}return segments.join("/")}class LocalStorageProvider{kind="local";describe;basePath;constructor(basePath,_deps){this.basePath=basePath,this.describe=`local:${basePath}`}resolve(relativePath){return join(this.basePath,normalizeRelativePath(relativePath))}async isAvailable(){try{return await mkdir(this.basePath,{recursive:!0}),!0}catch{return!1}}async exists(relativePath){return Bun.file(this.resolve(relativePath)).exists()}async stat(relativePath){try{let info=await stat(this.resolve(relativePath));return{size:info.size,modifiedAt:info.mtime,isDirectory:info.isDirectory()}}catch{return null}}async read(relativePath){let file=Bun.file(this.resolve(relativePath));if(!await file.exists())return null;return Buffer.from(await file.arrayBuffer())}async write(relativePath,data){let full=this.resolve(relativePath);await mkdir(dirname(full),{recursive:!0}),await Bun.write(full,data)}async delete(relativePath){try{return await unlink(this.resolve(relativePath)),!0}catch{return!1}}async ensureDir(relativeDir){await mkdir(this.resolve(relativeDir),{recursive:!0})}async list(relativeDir){try{return await readdir(this.resolve(relativeDir))}catch{return[]}}async localPath(relativePath){let full=this.resolve(relativePath);return await Bun.file(full).exists()?full:null}async close(){}}import{stat as fsStat,mkdir as mkdir2,rename,unlink as unlink2}from"fs/promises";import{dirname as dirname2,join as join2}from"path";var DEFAULT_TIMEOUT_MS=15000,DEFAULT_CACHE_TTL_SECONDS=300;class SmbStorageProvider{kind="smb";describe;getConfig;logger;client=null;clientFingerprint="";cacheDir;cacheTtlMs;cacheEnabled;inFlight=new Map;constructor(getConfig,deps,defaultCacheDir){this.getConfig=getConfig,this.logger=deps.logger;let config=getConfig();this.cacheEnabled=config.cache?.enabled!==!1,this.cacheDir=config.cache?.path||defaultCacheDir,this.cacheTtlMs=(config.cache?.ttlSeconds??DEFAULT_CACHE_TTL_SECONDS)*1000,this.describe=`smb://${config.host}/${config.share}${config.basePath?`/${config.basePath}`:""}`}async getClient(){let{host,share,domain,username,password,port,timeoutMs}=this.getConfig(),fingerprint=`${host}|${share}|${domain}|${username}|${password}|${port}`;if(this.client&&fingerprint===this.clientFingerprint)return this.client;if(this.client){try{this.client.disconnect()}catch{}this.client=null}let imported=await Promise.resolve().then(() => __toESM(require_smb2(),1)).catch(()=>{throw Error('storage.provider is "smb" but the optional @marsaud/smb2 dependency is not installed \u2014 run: bun add @marsaud/smb2')}),SMB2=imported.default??imported;return this.client=new SMB2({share:`\\\\${host}\\${share}`,domain:domain||"WORKGROUP",username,password,port:port??445,autoCloseTimeout:timeoutMs??DEFAULT_TIMEOUT_MS}),this.clientFingerprint=fingerprint,this.client}async call(fn){let client=await this.getClient(),timeoutMs=this.getConfig().timeoutMs??DEFAULT_TIMEOUT_MS;return new Promise((resolve,reject)=>{let settled=!1,timer=setTimeout(()=>{if(settled)return;settled=!0,reject(Error(`SMB operation timed out after ${timeoutMs}ms (${this.describe})`))},timeoutMs);fn(client,(err,value)=>{if(settled)return;if(settled=!0,clearTimeout(timer),err)reject(err);else resolve(value)})})}remotePath(relativePath){let normalized=normalizeRelativePath(relativePath),configuredBase=this.getConfig().basePath,base=configuredBase?normalizeRelativePath(configuredBase):"";return(base?`${base}/${normalized}`:normalized).replace(/\//g,"\\")}cachePath(relativePath){return join2(this.cacheDir,normalizeRelativePath(relativePath))}async isAvailable(){try{return await this.call((client,cb)=>client.readdir(this.getConfig().basePath?this.remotePath(""):"",cb)),!0}catch(error){return this.logger.warn("[Storage/SMB] Share is not reachable",{target:this.describe,error:error instanceof Error?error.message:String(error)}),!1}}async exists(relativePath){try{return await this.call((client,cb)=>client.exists(this.remotePath(relativePath),cb))}catch{return!1}}async stat(relativePath){try{let info=await this.call((client,cb)=>client.stat(this.remotePath(relativePath),cb));return{size:Number(info.size),modifiedAt:new Date(info.mtime),isDirectory:typeof info.isDirectory==="function"?info.isDirectory():await this.looksLikeDirectory(relativePath)}}catch{return null}}async read(relativePath){try{return await this.call((client,cb)=>client.readFile(this.remotePath(relativePath),cb))}catch(error){return this.logger.warn("[Storage/SMB] Read failed",{path:relativePath,error:error instanceof Error?error.message:String(error)}),null}}async write(relativePath,data){let parent=normalizeRelativePath(relativePath).split("/").slice(0,-1).join("/");if(parent)await this.ensureDir(parent);let payload=typeof data==="string"?Buffer.from(data,"utf-8"):Buffer.from(data);if(await this.call((client,cb)=>client.writeFile(this.remotePath(relativePath),payload,cb)),this.cacheEnabled){let target=this.cachePath(relativePath);await mkdir2(dirname2(target),{recursive:!0}).catch(()=>{}),await Bun.write(target,payload).catch(()=>{})}}async delete(relativePath){try{if(await this.call((client,cb)=>client.unlink(this.remotePath(relativePath),cb)),this.cacheEnabled)await unlink2(this.cachePath(relativePath)).catch(()=>{});return!0}catch{return!1}}async ensureDir(relativeDir){let normalized=normalizeRelativePath(relativeDir);if(!normalized)return;let segments=normalized.split("/");for(let i=1;i<=segments.length;i++){let partial=segments.slice(0,i).join("/");try{await this.call((client,cb)=>client.mkdir(this.remotePath(partial),cb))}catch{}}}async looksLikeDirectory(relativePath){try{return await this.call((client,cb)=>client.readdir(this.remotePath(relativePath),cb)),!0}catch{return!1}}async list(relativeDir){try{return await this.call((client,cb)=>client.readdir(this.remotePath(relativeDir),cb))}catch{return[]}}async localPath(relativePath){if(!this.cacheEnabled)return null;let target=this.cachePath(relativePath),cached=await fsStat(target).catch(()=>null);if(cached&&Date.now()-cached.mtimeMs<this.cacheTtlMs)return target;let pending=this.inFlight.get(target);if(pending)return pending;let download=(async()=>{let data=await this.read(relativePath);if(!data)return null;await mkdir2(dirname2(target),{recursive:!0}).catch(()=>{});let tmp=`${target}.${process.pid}.tmp`;try{return await Bun.write(tmp,data),await rename(tmp,target),target}catch(error){return await unlink2(tmp).catch(()=>{}),this.logger.warn("[Storage/SMB] Could not cache file locally",{path:relativePath,error:error instanceof Error?error.message:String(error)}),null}})().finally(()=>{this.inFlight.delete(target)});return this.inFlight.set(target,download),download}async close(){try{this.client?.disconnect()}catch{}this.client=null}}var DEFAULT_EXCLUDES=[".cache",".tmp","lost+found"];async function migrateStorage(options,deps){let{from,to,onProgress}=options,exclude=new Set([...DEFAULT_EXCLUDES,...options.exclude??[]]),maxFiles=options.maxFiles??50000,report={copied:0,skipped:0,failed:0,bytes:0,failures:[],truncated:!1},walk=async(dir)=>{if(report.truncated)return;let entries=await from.list(dir);for(let entry of entries){if(report.truncated)return;if(!entry||entry==="."||entry==="..")continue;let relative=dir?`${dir}/${entry}`:entry;if(exclude.has(entry))continue;let info=await from.stat(relative);if(!info){if(report.failed+=1,report.failures.length<50)report.failures.push(relative);continue}if(info.isDirectory){await walk(relative);continue}if(report.copied+report.skipped>=maxFiles){report.truncated=!0;return}if(await to.exists(relative)){report.skipped+=1;continue}try{let bytes=await from.read(relative);if(!bytes){if(report.failed+=1,report.failures.length<50)report.failures.push(relative);continue}let parent=relative.includes("/")?relative.slice(0,relative.lastIndexOf("/")):"";if(parent)await to.ensureDir(parent);await to.write(relative,bytes),report.copied+=1,report.bytes+=bytes.length,onProgress?.(report.copied,relative)}catch(error){if(report.failed+=1,report.failures.length<50)report.failures.push(relative);deps.logger.warn("[Storage] Migration copy failed",{path:relative,error:error instanceof Error?error.message:String(error)})}}};return await walk(""),deps.logger.info("[Storage] Migration finished",{from:from.describe,to:to.describe,copied:report.copied,skipped:report.skipped,failed:report.failed,truncated:report.truncated}),report}function parseSmbUrl(value){let raw=(value??"").trim();if(!raw)return{host:"",share:""};let withoutScheme=raw.replace(/^smb:\/\//i,"").replace(/^\\\\/,"").replace(/\\/g,"/"),[host="",share="",...rest]=withoutScheme.split("/").filter(Boolean);return{host,share,basePath:rest.length>0?rest.join("/"):void 0}}function createStorageProvider(options,deps){let{basePath,smb,resolveCredential}=options,setting=(key,configValue)=>resolveCredential?.("storage.smb",key,configValue)??configValue,resolveSmbConfig=()=>{let fromUrl=parseSmbUrl(setting("url"));return{...smb,host:fromUrl.host||setting("host",smb?.host)||"",share:fromUrl.share||setting("share",smb?.share)||"",basePath:fromUrl.basePath??setting("base_path",smb?.basePath),domain:setting("domain",smb?.domain),username:setting("username",smb?.username),password:setting("password",smb?.password)}},resolveKind=()=>{let chosen=resolveCredential?.("storage","provider",options.provider);return chosen==="smb"?"smb":chosen==="local"?"local":options.provider??"local"},local=new LocalStorageProvider(basePath,deps),smbProvider=null,smbSignature="",warnedIncomplete=!1;return new LiveStorageProvider(()=>{if(resolveKind()!=="smb")return local;let config=resolveSmbConfig();if(!config.host||!config.share){if(!warnedIncomplete)warnedIncomplete=!0,deps.logger.error('[Storage] provider is "smb" but the host/share are not set \u2014 using local storage until they are');return local}warnedIncomplete=!1;let signature=JSON.stringify([config.host,config.share,config.basePath,config.domain,config.username,config.password,config.port]);if(!smbProvider||signature!==smbSignature)smbProvider?.close(),smbProvider=new SmbStorageProvider(resolveSmbConfig,deps,join3(basePath,".cache","smb")),smbSignature=signature,deps.logger.info("[Storage] SMB target configured",{target:smbProvider.describe});return smbProvider})}init_Services();init_ApiKey();init_Middleware();init_Captcha();init_Domain();init_ServerLogBuffer();init_transports();init_Secrets();var SYSTEM_TABLES=[{table_name:"users",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"email",type:"varchar",length:255},{name:"password",type:"varchar",length:255},{name:"verified_at",type:"timestamp"},{name:"email_verification_token",type:"varchar",length:255},{name:"email_verification_token_expires_at",type:"timestamp"},{name:"email_verification_sent_at",type:"timestamp"},{name:"email_verification_attempts",type:"integer",default:0},{name:"last_login_at",type:"timestamp"},{name:"login_count",type:"integer",default:0},{name:"is_locked",type:"boolean",default:!1},{name:"locked_until",type:"timestamp"},{name:"failed_login_attempts",type:"integer",default:0},{name:"is_god",type:"boolean",default:!1},{name:"cohort_id",type:"uuid",references:{table:"user_cohorts",column:"id",onDelete:"set null"}},{name:"email_verified",type:"boolean",default:!1}],indexes:[{columns:["email"],unique:!0},{columns:["email","is_active"]},{columns:["last_login_at"]},{columns:["is_locked","locked_until"]}]},{table_name:"profiles",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id"}},{name:"first_name",type:"varchar",length:100,notNull:!0},{name:"last_name",type:"varchar",length:100,notNull:!0}],indexes:[{columns:["user_id"],unique:!0},{columns:["first_name","last_name"]}]},{table_name:"roles",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"name",type:"varchar",length:100,notNull:!0},{name:"description",type:"varchar",length:500}],indexes:[{columns:["name"],unique:!0}]},{table_name:"claims",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"action",type:"varchar",length:100,notNull:!0},{name:"description",type:"varchar",length:500},{name:"path",type:"varchar",length:200,notNull:!0},{name:"method",type:"varchar",length:10,notNull:!0},{name:"policy",type:"jsonb"}],indexes:[{columns:["action"],unique:!0},{columns:["path","method"]}]},{table_name:"user_roles",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"role_id",type:"uuid",notNull:!0,references:{table:"roles",column:"id",onDelete:"cascade"}}],indexes:[{columns:["user_id"]},{columns:["role_id"]}],constraints:{unique:[{name:"unique_user_role",columns:["user_id","role_id"]}]}},{table_name:"role_claims",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"role_id",type:"uuid",notNull:!0,references:{table:"roles",column:"id",onDelete:"cascade"}},{name:"claim_id",type:"uuid",notNull:!0,references:{table:"claims",column:"id",onDelete:"cascade"}},{name:"scope",type:"text"}],indexes:[{columns:["role_id"]},{columns:["claim_id"]},{columns:["role_id","claim_id","scope"]}]},{table_name:"files",feature_set:["storage"],add_base_columns:!0,is_form_data:!0,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"name",type:"varchar",length:255,notNull:!0},{name:"original_name",type:"varchar",length:255,notNull:!0},{name:"type",type:"varchar",length:50,enumValues:["image","document","video","audio","profile_picture"]},{name:"path",type:"varchar",length:500,notNull:!0},{name:"size",type:"bigint",mode:"number",notNull:!0},{name:"mime_type",type:"varchar",length:100,notNull:!0},{name:"extension",type:"varchar",length:10,notNull:!0},{name:"uploaded_by",type:"uuid",references:{table:"users",column:"id"}}],indexes:[{columns:["type"]},{columns:["uploaded_by"]},{columns:["size"]}]},{table_name:"addresses",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"owner_type",type:"varchar",length:50,notNull:!0,enumValues:["user","company","contact"]},{name:"owner_id",type:"uuid",notNull:!0},{name:"name",type:"varchar",length:100,notNull:!0},{name:"street",type:"varchar",length:255},{name:"city",type:"varchar",length:100},{name:"state",type:"varchar",length:50},{name:"zip",type:"varchar",length:20},{name:"country",type:"varchar",length:50,default:"US"},{name:"latitude",type:"decimal",precision:10,scale:8},{name:"longitude",type:"decimal",precision:11,scale:8},{name:"neighborhood",type:"varchar",length:100},{name:"apartment",type:"varchar",length:50},{name:"province",type:"varchar",length:100},{name:"district",type:"varchar",length:100},{name:"type",type:"varchar",length:50}],indexes:[{columns:["city","state"]},{columns:["latitude","longitude"]},{columns:["type"]},{columns:["owner_type","owner_id"]}]},{table_name:"phones",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"owner_type",type:"varchar",length:50,notNull:!0,enumValues:["user","company","contact"]},{name:"owner_id",type:"uuid",notNull:!0},{name:"name",type:"varchar",length:100,notNull:!0},{name:"type",type:"varchar",length:50,enumValues:["mobile","office","fax"]},{name:"number",type:"varchar",length:20,notNull:!0},{name:"country_code",type:"varchar",length:10,notNull:!0,default:"+1"},{name:"extension",type:"varchar",length:10}],indexes:[{columns:["number"]},{columns:["type"]},{columns:["owner_type","owner_id"]}]},{table_name:"notifications",feature_set:["notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",notNull:!0},{name:"title",type:"varchar",length:255,notNull:!0},{name:"body",type:"varchar",length:1000},{name:"entity_name",type:"varchar",length:100},{name:"entity_id",type:"uuid"},{name:"type",type:"varchar",length:50,notNull:!0,default:"system",enumValues:["verification","system","custom"]},{name:"source",type:"varchar",length:100},{name:"is_seen",type:"boolean",notNull:!0,default:!1},{name:"seen_at",type:"timestamptz"}],indexes:[{columns:["user_id","created_at"]},{columns:["is_seen"]},{columns:["type"]},{columns:["user_id","type","is_seen"]}]},{table_name:"tenants",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:[],columns:[{name:"subdomain",type:"varchar",length:100,notNull:!0,unique:!0},{name:"schema_name",type:"varchar",length:100,notNull:!0,unique:!0},{name:"company_id",type:"uuid",notNull:!0},{name:"company_name",type:"varchar",length:255},{name:"god_admin_email",type:"varchar",length:255,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"provisioning"},{name:"plan",type:"varchar",length:50,default:"free"},{name:"domain",type:"varchar",length:255},{name:"settings",type:"jsonb",default:"{}"},{name:"trusted_sources",type:"jsonb",default:"[]"},{name:"max_users",type:"integer"},{name:"provisioned_at",type:"timestamptz"},{name:"suspended_at",type:"timestamptz"},{name:"suspended_reason",type:"text"}],indexes:[{columns:["status"]}]},{table_name:"tenant_events",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"tenant_id",type:"uuid",notNull:!0,references:{table:"tenants",column:"id",onDelete:"cascade"}},{name:"event_type",type:"varchar",length:50,notNull:!0},{name:"event_data",type:"jsonb",default:"{}"},{name:"performed_by",type:"varchar",length:255},{name:"ip_address",type:"varchar",length:45}],indexes:[{columns:["tenant_id"]},{columns:["event_type"]}]},{table_name:"tenant_features",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:[],columns:[{name:"tenant_id",type:"uuid",notNull:!0,references:{table:"tenants",column:"id",onDelete:"cascade"}},{name:"feature_name",type:"varchar",length:100,notNull:!0},{name:"enabled",type:"boolean",notNull:!0,default:!0},{name:"config",type:"jsonb",default:"{}"}],indexes:[{columns:["tenant_id","feature_name"],unique:!0},{columns:["feature_name"]}]},{table_name:"domain_hostnames",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Domains",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant",comment:"tenant | organization | user | external"},{name:"owner_id",type:"uuid",notNull:!0,comment:"Product-defined owner reference (e.g. band id, org id)"},{name:"tenant_id",type:"uuid",references:{table:"tenants",column:"id",onDelete:"cascade"},comment:"Tenant this hostname routes to; null for non-tenant owners"},{name:"schema_name",type:"varchar",length:100,comment:"Resolved tenant schema for routing"},{name:"hostname",type:"varchar",length:255,notNull:!0,comment:"Original hostname as entered by the user"},{name:"normalized_hostname",type:"varchar",length:255,notNull:!0,unique:!0,comment:"Lowercased, punycode, port-stripped hostname used for matching"},{name:"hostname_kind",type:"varchar",length:20,notNull:!0,default:"apex",comment:"platform_subdomain | apex | www | subdomain"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending_verification",comment:"draft | pending_verification | verifying | active | failed | disabled | archived"},{name:"routing_status",type:"varchar",length:20,notNull:!0,default:"inactive",comment:"inactive | pending | active | failed"},{name:"certificate_status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"not_required | pending | active | failed"},{name:"verification_status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | verified | failed | expired"},{name:"provider",type:"varchar",length:30,notNull:!0,default:"manual_dns",comment:"manual_dns | cloudflare_for_saas | cloudflare_registrar"},{name:"provider_hostname_id",type:"varchar",length:255},{name:"dns_target",type:"varchar",length:255,comment:"CNAME / A target the customer must point at"},{name:"is_primary",type:"boolean",notNull:!0,default:!1},{name:"redirect_to_hostname_id",type:"uuid",comment:"When set, this hostname 301-redirects to another hostname (e.g. apex to www)"},{name:"activated_at",type:"timestamptz"},{name:"disabled_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["tenant_id"]},{columns:["schema_name"]},{columns:["status"]},{columns:["owner_type","owner_id"]},{columns:["provider","provider_hostname_id"]}]},{table_name:"domain_registrations",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Domains",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant"},{name:"owner_id",type:"uuid",notNull:!0},{name:"tenant_id",type:"uuid",references:{table:"tenants",column:"id",onDelete:"set null"}},{name:"requested_domain",type:"varchar",length:255,notNull:!0},{name:"registered_domain",type:"varchar",length:255},{name:"provider",type:"varchar",length:30,notNull:!0,default:"cloudflare_registrar"},{name:"provider_registration_id",type:"varchar",length:255},{name:"registrant_owner_type",type:"varchar",length:20,notNull:!0,default:"customer",comment:"customer | platform"},{name:"registrant_contact_snapshot",type:"jsonb",default:"{}"},{name:"status",type:"varchar",length:30,notNull:!0,default:"draft",comment:"draft | availability_checked | awaiting_payment | registering | active | failed | transfer_requested | transferred_out | cancelled | expired"},{name:"price_amount",type:"numeric",precision:12,scale:2},{name:"currency",type:"varchar",length:10},{name:"renewal_date",type:"timestamptz"},{name:"auto_renew",type:"boolean",notNull:!0,default:!0},{name:"terms_version",type:"varchar",length:50},{name:"terms_accepted_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"]},{columns:["tenant_id"]},{columns:["status"]}]},{table_name:"domain_verification_challenges",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",notNull:!0,references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"challenge_type",type:"varchar",length:30,notNull:!0,default:"ownership_validation",comment:"hostname_validation | certificate_validation | ownership_validation"},{name:"record_type",type:"varchar",length:10,notNull:!0,default:"TXT",comment:"TXT | CNAME | A | AAAA | HTTP"},{name:"record_name",type:"varchar",length:255,notNull:!0},{name:"record_value",type:"text",notNull:!0},{name:"expected_target",type:"varchar",length:255},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | verified | failed | expired"},{name:"expires_at",type:"timestamptz"},{name:"verified_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["status"]}]},{table_name:"domain_provider_records",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",notNull:!0,references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:30,notNull:!0},{name:"provider_resource_type",type:"varchar",length:30,notNull:!0,comment:"custom_hostname | certificate | validation | zone | dns_record | registration"},{name:"provider_resource_id",type:"varchar",length:255},{name:"provider_status",type:"varchar",length:50},{name:"last_synced_at",type:"timestamptz"},{name:"raw_status",type:"jsonb",default:"{}"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["provider","provider_resource_id"]}]},{table_name:"domain_events",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"domain_registration_id",type:"uuid",references:{table:"domainRegistrations",column:"id",onDelete:"cascade"}},{name:"event_type",type:"varchar",length:50,notNull:!0},{name:"actor_type",type:"varchar",length:20},{name:"actor_id",type:"varchar",length:255},{name:"message",type:"text"},{name:"ip_address",type:"varchar",length:45},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["event_type"]}]},{table_name:"verifications",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"requirement_id",type:"uuid",notNull:!0,references:{table:"verificationRequirements",column:"id"}},{name:"verifier_id",type:"uuid",notNull:!0,references:{table:"users",column:"id"}},{name:"signature_id",type:"uuid",references:{table:"files",column:"id"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"decision",type:"varchar",length:50,notNull:!0,default:"pending",enumValues:["approved","rejected","pending"]},{name:"reason",type:"text"},{name:"diff",type:"jsonb"}],indexes:[{columns:["instance_id"]},{columns:["requirement_id"]},{columns:["verifier_id"]},{columns:["entity_name","entity_id"]},{columns:["entity_name","entity_id","step_order"]},{columns:["decision"]}]},{table_name:"verificationRequirements",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"step_node_id",type:"varchar",length:100,notNull:!0},{name:"verifier_node_id",type:"varchar",length:100,notNull:!0},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"verifier_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role"]},{name:"verifier_user_id",type:"uuid"},{name:"verifier_role",type:"varchar",length:100},{name:"require_signature",type:"boolean",notNull:!0,default:!1},{name:"all_must_approve",type:"boolean",notNull:!0,default:!1},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","approved","rejected"]}],indexes:[{columns:["instance_id"]},{columns:["instance_id","step_order"]},{columns:["entity_name","entity_id"]},{columns:["verifier_user_id"]},{columns:["status"]}]},{table_name:"verificationFlows",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"trigger_on",type:"varchar",length:50,notNull:!0,default:"update",enumValues:["create","update","delete","manual"]},{name:"trigger_fields",type:"jsonb"},{name:"is_draft",type:"boolean",notNull:!0,default:!0},{name:"published_at",type:"timestamptz"},{name:"viewport",type:"jsonb"}],indexes:[{columns:["entity_name"]},{columns:["entity_name","trigger_on"]},{columns:["is_draft"]}]},{table_name:"verificationSteps",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"node_type",type:"varchar",length:50,notNull:!0,default:"step",enumValues:["step","verifier","notification"]},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"name",type:"varchar",length:255},{name:"description",type:"text"},{name:"position_x",type:"numeric",notNull:!0,default:0},{name:"position_y",type:"numeric",notNull:!0,default:0},{name:"width",type:"numeric"},{name:"height",type:"numeric"},{name:"style",type:"jsonb"},{name:"data",type:"jsonb"}],indexes:[{columns:["flow_id"]},{columns:["entity_name"]},{columns:["flow_id","node_id"],unique:!0},{columns:["entity_name","step_order"]}]},{table_name:"verificationEdges",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"edge_id",type:"varchar",length:100,notNull:!0},{name:"source_node_id",type:"varchar",length:100,notNull:!0},{name:"target_node_id",type:"varchar",length:100,notNull:!0},{name:"source_handle",type:"varchar",length:50},{name:"target_handle",type:"varchar",length:50},{name:"edge_type",type:"varchar",length:50,default:"default",enumValues:["default","conditional","success","failure"]},{name:"label",type:"varchar",length:255},{name:"condition",type:"jsonb"},{name:"style",type:"jsonb"},{name:"animated",type:"boolean",default:!1}],indexes:[{columns:["flow_id"]},{columns:["flow_id","edge_id"],unique:!0},{columns:["source_node_id"]},{columns:["target_node_id"]}]},{table_name:"verificationNotificationRules",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"trigger",type:"varchar",length:50,notNull:!0,enumValues:["on_flow_started","on_step_reached","on_approved","on_rejected","on_flow_completed"]},{name:"title_template",type:"varchar",length:255},{name:"body_template",type:"text"},{name:"starts_at",type:"timestamptz"},{name:"expires_at",type:"timestamptz"}],indexes:[{columns:["flow_id"]},{columns:["flow_id","node_id"],unique:!0},{columns:["trigger"]}]},{table_name:"verificationNotificationRecipients",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"rule_id",type:"uuid",notNull:!0,references:{table:"verificationNotificationRules",column:"id",onDelete:"cascade"}},{name:"recipient_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role","all_verifiers","step_verifier","entity_creator"]},{name:"recipient_user_id",type:"uuid"},{name:"recipient_role",type:"varchar",length:100}],indexes:[{columns:["rule_id"]},{columns:["recipient_type"]}]},{table_name:"verificationVerifierConfigs",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"verifier_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role"]},{name:"verifier_user_id",type:"uuid"},{name:"verifier_role",type:"varchar",length:100},{name:"require_signature",type:"boolean",notNull:!0,default:!1},{name:"all_must_approve",type:"boolean",notNull:!0,default:!1}],indexes:[{columns:["flow_id"]},{columns:["flow_id","node_id"],unique:!0},{columns:["verifier_type"]}]},{table_name:"verificationInstances",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"started_by",type:"uuid",references:{table:"users",column:"id"}},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","completed","rejected","cancelled"]},{name:"current_step_order",type:"integer",notNull:!0,default:1},{name:"started_at",type:"timestamptz",notNull:!0,defaultRaw:"now()"},{name:"completed_at",type:"timestamptz"}],indexes:[{columns:["flow_id"]},{columns:["entity_name","entity_id"]},{columns:["entity_name","entity_id","status"]},{columns:["status"]},{columns:["started_by"]}]},{table_name:"verificationNotificationChannels",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"rule_id",type:"uuid",notNull:!0,references:{table:"verificationNotificationRules",column:"id",onDelete:"cascade"}},{name:"channel",type:"varchar",length:30,notNull:!0,enumValues:["portal","email","sms","telegram","webhook"]}],indexes:[{columns:["rule_id"]},{columns:["rule_id","channel"],unique:!0},{columns:["channel"]}]},{table_name:"user_cohorts",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"created_by",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}},{name:"expires_at",type:"timestamptz"},{name:"user_count",type:"integer",notNull:!0,default:0},{name:"metadata",type:"jsonb",default:"{}"}]},{table_name:"user_sessions",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"refresh_token_hash",type:"varchar",length:255},{name:"device_fingerprint",type:"varchar",length:255},{name:"device_name",type:"varchar",length:100},{name:"device_type",type:"varchar",length:50,enumValues:["desktop","mobile","tablet","unknown"]},{name:"browser_name",type:"varchar",length:50},{name:"browser_version",type:"varchar",length:20},{name:"os_name",type:"varchar",length:50},{name:"os_version",type:"varchar",length:20},{name:"ip_address",type:"varchar",length:45,notNull:!0},{name:"location_country",type:"varchar",length:100},{name:"location_city",type:"varchar",length:100},{name:"location_coordinates",type:"varchar",length:50},{name:"last_activity_at",type:"timestamptz",notNull:!0,defaultRaw:"now()"},{name:"expires_at",type:"timestamptz",notNull:!1},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:100,enumValues:["user_logout","user_revoked","admin_revoked","security_concern","password_changed","expired","replaced"]},{name:"is_current",type:"boolean",notNull:!0,default:!1},{name:"login_method",type:"varchar",length:50,enumValues:["password","oauth_google","oauth_github","oauth_microsoft","magic_link","sso","api_key"]},{name:"remember_me",type:"boolean",notNull:!0,default:!1},{name:"trust_score",type:"integer",default:100},{name:"approval_status",type:"varchar",length:20,default:"approved",enumValues:["approved","pending","rejected"]},{name:"approval_token",type:"varchar",length:64},{name:"approval_requested_at",type:"timestamptz"},{name:"approval_responded_at",type:"timestamptz"}],indexes:[{columns:["user_id"]},{columns:["token_hash"],unique:!0},{columns:["refresh_token_hash"]},{columns:["user_id","is_active"]},{columns:["expires_at"]},{columns:["device_fingerprint"]},{columns:["ip_address"]},{columns:["last_activity_at"]},{columns:["approval_status"]},{columns:["approval_token"]}]},{table_name:"trusted_devices",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:64,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",enumValues:["pending","trusted","revoked"]},{name:"origin_session_id",type:"uuid"},{name:"label",type:"varchar",length:120},{name:"device_fingerprint",type:"varchar",length:255},{name:"first_seen_ip",type:"varchar",length:45},{name:"last_seen_ip",type:"varchar",length:45},{name:"last_seen_at",type:"timestamptz"},{name:"expires_at",type:"timestamptz"},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:30,enumValues:["user_revoked","password_reset","logout","admin_revoked","expired","replaced"]}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["user_id","status"]},{columns:["origin_session_id"]},{columns:["expires_at"]}]},{table_name:"password_reset_tokens",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:["email"],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"used_at",type:"timestamptz"}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["expires_at"]}]},{table_name:"magic_link_tokens",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:["email"],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"email",type:"varchar",length:255,notNull:!0},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"used_at",type:"timestamptz"}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["email"]},{columns:["expires_at"]}]},{table_name:"webauthn_credentials",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:[],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"credential_id",type:"text",notNull:!0},{name:"public_key",type:"text",notNull:!0},{name:"counter",type:"bigint",mode:"number",notNull:!0,defaultValue:0},{name:"transports",type:"jsonb"},{name:"device_type",type:"varchar",length:32},{name:"backed_up",type:"boolean",notNull:!0,defaultValue:!1},{name:"aaguid",type:"varchar",length:64},{name:"authenticator_attachment",type:"varchar",length:32},{name:"nickname",type:"varchar",length:128},{name:"last_used_at",type:"timestamptz"},{name:"revoked_at",type:"timestamptz"}],indexes:[{columns:["credential_id"],unique:!0},{columns:["user_id"]}]},{table_name:"webauthn_challenges",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:[],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id",onDelete:"cascade"}},{name:"challenge",type:"text",notNull:!0},{name:"challenge_type",type:"varchar",length:32,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"consumed_at",type:"timestamptz"}],indexes:[{columns:["challenge"],unique:!0},{columns:["user_id"]},{columns:["expires_at"]}]},{table_name:"audit_logs",feature_set:["audit"],add_base_columns:!1,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","DELETE","PATCH","TOGGLE","VERIFICATION"],columns:[{name:"id",type:"uuid",primaryKey:!0,defaultRaw:"gen_random_uuid()"},{name:"entity_id",type:"uuid"},{name:"entity_name",type:"text",notNull:!0},{name:"operation_type",type:"text",notNull:!0},{name:"user_id",type:"uuid"},{name:"ip_address",type:"text"},{name:"user_agent",type:"text"},{name:"summary",type:"text"},{name:"severity",type:"text",default:"info"},{name:"category",type:"text"},{name:"occurrence_count",type:"integer",default:1},{name:"last_occurrence_at",type:"timestamp"},{name:"old_values",type:"jsonb"},{name:"new_values",type:"jsonb"},{name:"created_at",type:"timestamp",notNull:!0,defaultRaw:"now()"},{name:"path",type:"text"},{name:"query",type:"text"}],indexes:[{columns:["entity_id"]},{columns:["entity_name"]},{columns:["user_id"]},{columns:["created_at"]},{columns:["severity"]},{columns:["category"]}]},{table_name:"monitoring_metrics",feature_set:["monitoring"],add_base_columns:!1,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","DELETE","PATCH","TOGGLE","VERIFICATION"],columns:[{name:"id",type:"uuid",primaryKey:!0,defaultRaw:"gen_random_uuid()"},{name:"metric_type",type:"text",notNull:!0},{name:"metric_name",type:"text",notNull:!0},{name:"value",type:"doublePrecision",notNull:!0},{name:"tags",type:"jsonb"},{name:"recorded_at",type:"timestamp",notNull:!0}],indexes:[{columns:["metric_type"]},{columns:["metric_name"]},{columns:["recorded_at"]}]},{table_name:"oauth_accounts",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0,enumValues:["google","github","microsoft","discord","facebook","twitter","apple","custom"]},{name:"provider_account_id",type:"varchar",length:255,notNull:!0},{name:"provider_email",type:"varchar",length:255},{name:"provider_name",type:"varchar",length:255},{name:"provider_avatar_url",type:"text"},{name:"access_token",type:"text"},{name:"refresh_token",type:"text"},{name:"token_expires_at",type:"timestamp"},{name:"scope",type:"text"},{name:"raw_profile",type:"jsonb"},{name:"is_primary",type:"boolean",notNull:!0,default:!1},{name:"last_used_at",type:"timestamp"}],indexes:[{columns:["user_id"]},{columns:["provider","provider_account_id"],unique:!0},{columns:["provider_email"]},{columns:["user_id","provider"]}],constraints:{unique:[{name:"unique_provider_account",columns:["provider","provider_account_id"]}]}},{table_name:"api_keys",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],bulk_endpoints_enabled:!1,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"key_hash",type:"varchar",length:255,notNull:!0},{name:"key_preview",type:"varchar",length:20,notNull:!0},{name:"owner_type",type:"varchar",length:30,notNull:!0,default:"personal",enumValues:["personal","application"]},{name:"application_name",type:"varchar",length:255},{name:"allowed_roles",type:"jsonb",notNull:!0,default:"[]"},{name:"allowed_claims",type:"jsonb",notNull:!0,default:"[]"},{name:"allowed_scopes",type:"jsonb",notNull:!0,default:"[]"},{name:"expires_at",type:"timestamptz"},{name:"last_used_at",type:"timestamptz"},{name:"last_used_ip",type:"varchar",length:45},{name:"usage_count",type:"integer",notNull:!0,default:0},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:255}],indexes:[{columns:["key_hash"],unique:!0},{columns:["user_id"]},{columns:["user_id","is_active"]},{columns:["owner_type"]},{columns:["expires_at"]},{columns:["last_used_at"]}]},{table_name:"backup_logs",feature_set:["backup"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main","all"],excluded_schemas:[],excluded_methods:["PUT","PATCH"],columns:[{name:"backup_name",type:"varchar",length:255,notNull:!0},{name:"file_name",type:"varchar",length:500,notNull:!0},{name:"schema_name",type:"varchar",length:100,notNull:!0},{name:"format",type:"varchar",length:20,notNull:!0,default:"json"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending"},{name:"trigger",type:"varchar",length:20,notNull:!0,default:"manual"},{name:"size_bytes",type:"integer"},{name:"table_count",type:"integer"},{name:"row_count",type:"integer"},{name:"included_tables",type:"jsonb",default:"[]"},{name:"excluded_tables",type:"jsonb",default:"[]"},{name:"error_message",type:"text"},{name:"started_at",type:"timestamp"},{name:"completed_at",type:"timestamp"},{name:"performed_by",type:"varchar",length:255},{name:"cron_expression",type:"varchar",length:100},{name:"retention_days",type:"integer"}],indexes:[{columns:["schema_name"]},{columns:["status"]},{columns:["trigger"]},{columns:["created_at"]}]},{table_name:"payment_transactions",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"order_id",type:"varchar",length:255},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_transaction_id",type:"varchar",length:255},{name:"provider_payment_id",type:"varchar",length:255},{name:"payment_method",type:"varchar",length:50},{name:"amount",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"currency",type:"varchar",length:10,notNull:!0,default:"TRY"},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","processing","completed","failed","refunded","partially_refunded","cancelled"]},{name:"status_code",type:"integer"},{name:"status_message",type:"text"},{name:"card_last_four",type:"varchar",length:4},{name:"card_type",type:"varchar",length:50},{name:"card_association",type:"varchar",length:50},{name:"installment",type:"integer",default:1},{name:"is_three_d_secure",type:"boolean",default:!1},{name:"provider_response",type:"jsonb",default:"{}"},{name:"metadata",type:"jsonb",default:"{}"},{name:"refunded_amount",type:"numeric",precision:12,scale:2,default:0},{name:"refunded_at",type:"timestamptz"},{name:"completed_at",type:"timestamptz"},{name:"failed_at",type:"timestamptz"},{name:"ip_address",type:"varchar",length:45}],indexes:[{columns:["user_id"]},{columns:["order_id"]},{columns:["provider"]},{columns:["provider_payment_id"]},{columns:["status"]},{columns:["user_id","status"]}]},{table_name:"payment_methods",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"type",type:"varchar",length:30,notNull:!0,default:"card",enumValues:["card","bank_account","wallet"]},{name:"alias",type:"varchar",length:100},{name:"card_last_four",type:"varchar",length:4},{name:"card_type",type:"varchar",length:50},{name:"card_association",type:"varchar",length:50},{name:"card_family",type:"varchar",length:100},{name:"card_bank_name",type:"varchar",length:100},{name:"provider_card_user_key",type:"varchar",length:255},{name:"provider_card_token",type:"varchar",length:255},{name:"bin_number",type:"varchar",length:8},{name:"is_default",type:"boolean",default:!1},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["user_id","is_default"]},{columns:["provider_card_user_key"]}]},{table_name:"payment_webhook_logs",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["PUT","PATCH","DELETE"],columns:[{name:"provider",type:"varchar",length:50,notNull:!0},{name:"event_type",type:"varchar",length:100,notNull:!0},{name:"provider_payment_id",type:"varchar",length:255},{name:"raw_payload",type:"jsonb",notNull:!0},{name:"processed",type:"boolean",default:!1},{name:"processing_result",type:"jsonb"},{name:"error_message",type:"text"},{name:"ip_address",type:"varchar",length:45},{name:"idempotency_key",type:"varchar",length:255}],indexes:[{columns:["provider"]},{columns:["event_type"]},{columns:["provider_payment_id"]},{columns:["processed"]},{columns:["idempotency_key"],unique:!0}]},{table_name:"payment_sub_merchants",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_sub_merchant_key",type:"varchar",length:255},{name:"external_id",type:"varchar",length:255},{name:"type",type:"varchar",length:50,notNull:!0,default:"personal",enumValues:["personal","private_company","limited_or_joint_stock_company"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","active","suspended","rejected"]},{name:"name",type:"varchar",length:255,notNull:!0},{name:"email",type:"varchar",length:255,notNull:!0},{name:"gsm_number",type:"varchar",length:20},{name:"address",type:"text"},{name:"iban",type:"varchar",length:50},{name:"contact_name",type:"varchar",length:100},{name:"contact_surname",type:"varchar",length:100},{name:"identity_number",type:"varchar",length:20},{name:"tax_office",type:"varchar",length:100},{name:"tax_number",type:"varchar",length:20},{name:"legal_company_title",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,default:"TRY"},{name:"commission_rate",type:"numeric",precision:5,scale:2,default:0},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["provider_sub_merchant_key"]},{columns:["external_id"]},{columns:["status"]},{columns:["email"]}]},{table_name:"payment_commission_splits",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"transaction_id",type:"uuid",notNull:!0,references:{table:"payment_transactions",column:"id",onDelete:"cascade"}},{name:"sub_merchant_id",type:"uuid",notNull:!0,references:{table:"payment_sub_merchants",column:"id"}},{name:"basket_item_id",type:"varchar",length:255},{name:"item_price",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"sub_merchant_price",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"platform_commission",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"commission_rate",type:"numeric",precision:5,scale:2,default:0},{name:"provider_split_id",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,notNull:!0,default:"TRY"},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","approved","disapproved","refunded"]},{name:"approved_at",type:"timestamptz"},{name:"disapproved_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["transaction_id"]},{columns:["sub_merchant_id"]},{columns:["status"]},{columns:["transaction_id","sub_merchant_id"]},{columns:["provider_split_id"]}]},{table_name:"payment_products",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_product_id",type:"varchar",length:255},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"type",type:"varchar",length:30,default:"service",enumValues:["service","good"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","archived","draft"]},{name:"images",type:"jsonb",default:"[]"},{name:"unit_label",type:"varchar",length:50},{name:"url",type:"varchar",length:500},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["provider"]},{columns:["provider_product_id"]},{columns:["name"]},{columns:["status"]},{columns:["type"]}]},{table_name:"payment_prices",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"product_id",type:"uuid",notNull:!0,references:{table:"payment_products",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_price_id",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,notNull:!0,default:"USD"},{name:"unit_amount",type:"integer",notNull:!0,default:0},{name:"unit_amount_decimal",type:"varchar",length:30},{name:"type",type:"varchar",length:30,notNull:!0,default:"one_time",enumValues:["one_time","recurring"]},{name:"billing_scheme",type:"varchar",length:30,default:"per_unit",enumValues:["per_unit","tiered"]},{name:"nickname",type:"varchar",length:255},{name:"recurring_interval",type:"varchar",length:20,enumValues:["day","week","month","year"]},{name:"recurring_interval_count",type:"integer",default:1},{name:"recurring_usage_type",type:"varchar",length:20,default:"licensed",enumValues:["licensed","metered"]},{name:"recurring_aggregate_usage",type:"varchar",length:30,enumValues:["sum","last_during_period","last_ever","max"]},{name:"transform_quantity_divide_by",type:"integer"},{name:"transform_quantity_round",type:"varchar",length:10,enumValues:["up","down"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","archived"]},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["product_id"]},{columns:["provider"]},{columns:["provider_price_id"]},{columns:["type"]},{columns:["currency"]},{columns:["status"]},{columns:["product_id","status"]}]},{table_name:"payment_customers",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_customer_id",type:"varchar",length:255,notNull:!0},{name:"email",type:"varchar",length:255,notNull:!0},{name:"name",type:"varchar",length:255},{name:"phone",type:"varchar",length:50},{name:"description",type:"text"},{name:"address",type:"jsonb",default:"{}"},{name:"tax_id_type",type:"varchar",length:50},{name:"tax_id_value",type:"varchar",length:100},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["provider_customer_id"]},{columns:["email"]},{columns:["user_id","provider"],unique:!0}]},{table_name:"payment_subscriptions",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"customer_id",type:"uuid",notNull:!0,references:{table:"payment_customers",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_subscription_id",type:"varchar",length:255},{name:"status",type:"varchar",length:30,notNull:!0,default:"incomplete",enumValues:["active","past_due","unpaid","canceled","incomplete","incomplete_expired","trialing","paused"]},{name:"collection_method",type:"varchar",length:30,default:"charge_automatically",enumValues:["charge_automatically","send_invoice"]},{name:"current_period_start",type:"timestamptz"},{name:"current_period_end",type:"timestamptz"},{name:"cancel_at_period_end",type:"boolean",default:!1},{name:"canceled_at",type:"timestamptz"},{name:"trial_start",type:"timestamptz"},{name:"trial_end",type:"timestamptz"},{name:"items",type:"jsonb",default:"[]"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["customer_id"]},{columns:["provider"]},{columns:["provider_subscription_id"]},{columns:["status"]},{columns:["customer_id","status"]}]},{table_name:"payment_invoices",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"customer_id",type:"uuid",notNull:!0,references:{table:"payment_customers",column:"id"}},{name:"subscription_id",type:"uuid",references:{table:"payment_subscriptions",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_invoice_id",type:"varchar",length:255},{name:"status",type:"varchar",length:30,notNull:!0,default:"draft",enumValues:["draft","open","paid","uncollectible","void"]},{name:"collection_method",type:"varchar",length:30,default:"charge_automatically",enumValues:["charge_automatically","send_invoice"]},{name:"currency",type:"varchar",length:10,notNull:!0,default:"USD"},{name:"amount_due",type:"integer",default:0},{name:"amount_paid",type:"integer",default:0},{name:"amount_remaining",type:"integer",default:0},{name:"description",type:"text"},{name:"hosted_invoice_url",type:"varchar",length:1000},{name:"invoice_pdf",type:"varchar",length:1000},{name:"due_date",type:"timestamptz"},{name:"days_until_due",type:"integer"},{name:"period_start",type:"timestamptz"},{name:"period_end",type:"timestamptz"},{name:"paid_at",type:"timestamptz"},{name:"voided_at",type:"timestamptz"},{name:"lines",type:"jsonb",default:"[]"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["customer_id"]},{columns:["subscription_id"]},{columns:["provider"]},{columns:["provider_invoice_id"]},{columns:["status"]},{columns:["customer_id","status"]}]},{table_name:"chat_conversations",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"type",type:"varchar",length:20,notNull:!0,default:"direct",enumValues:["direct","group"]},{name:"title",type:"varchar",length:255},{name:"description",type:"text"},{name:"avatar_file_id",type:"uuid"},{name:"direct_key",type:"varchar",length:255},{name:"last_message_at",type:"timestamptz"},{name:"last_message_preview",type:"varchar",length:500},{name:"last_message_sender_id",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}}],indexes:[{columns:["direct_key"],unique:!0},{columns:["type"]},{columns:["last_message_at"]}]},{table_name:"chat_participants",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"role",type:"varchar",length:20,notNull:!0,default:"member",enumValues:["member","admin","owner"]},{name:"last_read_message_id",type:"uuid"},{name:"last_read_at",type:"timestamptz"},{name:"unread_count",type:"integer",notNull:!0,default:0},{name:"muted",type:"boolean",notNull:!0,default:!1},{name:"muted_until",type:"timestamptz"},{name:"notifications_enabled",type:"boolean",notNull:!0,default:!0},{name:"left_at",type:"timestamptz"}],indexes:[{columns:["user_id"]},{columns:["conversation_id"]}],constraints:{unique:[{name:"unique_conversation_participant",columns:["conversation_id","user_id"]}]}},{table_name:"chat_messages",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"sender_id",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}},{name:"content",type:"text"},{name:"content_type",type:"varchar",length:20,notNull:!0,default:"text",enumValues:["text","image","file","video","audio","system"]},{name:"reply_to_id",type:"uuid",references:{table:"chat_messages",column:"id",onDelete:"set null"}},{name:"metadata",type:"jsonb",default:"{}"},{name:"client_message_id",type:"varchar",length:100},{name:"edited_at",type:"timestamptz"},{name:"deleted_at",type:"timestamptz"}],indexes:[{columns:["conversation_id","created_at"]},{columns:["sender_id"]},{columns:["reply_to_id"]}]},{table_name:"chat_message_attachments",feature_set:["authentication","chat","storage"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"message_id",type:"uuid",notNull:!0,references:{table:"chat_messages",column:"id",onDelete:"cascade"}},{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"file_id",type:"uuid",notNull:!0,references:{table:"files",column:"id",onDelete:"cascade"}},{name:"kind",type:"varchar",length:20,notNull:!0,default:"file",enumValues:["image","video","audio","file"]},{name:"original_name",type:"varchar",length:255},{name:"mime_type",type:"varchar",length:100},{name:"size",type:"bigint",mode:"number"},{name:"width",type:"integer"},{name:"height",type:"integer"},{name:"duration",type:"integer"}],indexes:[{columns:["message_id"]},{columns:["conversation_id"]},{columns:["file_id"]}]},{table_name:"payment_splits",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"transaction_id",type:"uuid",references:{table:"paymentTransactions",column:"id",onDelete:"set null"}},{name:"recipient_owner_type",type:"varchar",length:20,notNull:!0,default:"seller",comment:"seller | platform | tenant | user"},{name:"recipient_owner_id",type:"uuid",notNull:!0},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"gross_amount",type:"bigint",mode:"number",notNull:!0,comment:"Minor units"},{name:"provider_fee_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"platform_fee_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"reserve_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"net_payable_amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"available_for_payout_at",type:"timestamptz"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | available | payout_requested | paid | held | refunded | disputed | cancelled"},{name:"source_type",type:"varchar",length:50},{name:"source_id",type:"varchar",length:255},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["recipient_owner_type","recipient_owner_id"]},{columns:["status"]},{columns:["transaction_id"]}]},{table_name:"payment_ledger_entries",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"account",type:"varchar",length:40,notNull:!0,comment:"platform_revenue | provider_fee | seller_payable | reserve | refund_liability | dispute_liability | payout_in_transit | payout_completed"},{name:"owner_type",type:"varchar",length:20},{name:"owner_id",type:"uuid"},{name:"direction",type:"varchar",length:6,notNull:!0,comment:"debit | credit"},{name:"amount",type:"bigint",mode:"number",notNull:!0,comment:"Minor units"},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"entry_type",type:"varchar",length:40,notNull:!0,comment:"split | refund | payout | reserve_hold | reserve_release | dispute | adjustment"},{name:"reference_type",type:"varchar",length:50},{name:"reference_id",type:"varchar",length:255},{name:"split_id",type:"uuid",references:{table:"paymentSplits",column:"id",onDelete:"set null"}},{name:"description",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["account"]},{columns:["owner_type","owner_id"]},{columns:["entry_type"]},{columns:["reference_type","reference_id"]}]},{table_name:"payment_settlement_policies",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],group_name:"Payments Marketplace",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant",comment:"tenant | seller"},{name:"owner_id",type:"uuid",notNull:!0},{name:"default_delay_days",type:"integer",notNull:!0,default:7},{name:"new_seller_delay_days",type:"integer",notNull:!0,default:14},{name:"reserve_rate",type:"numeric",precision:5,scale:4,notNull:!0,default:0,comment:"Fraction 0..1 held as reserve"},{name:"reserve_days",type:"integer",notNull:!0,default:0},{name:"minimum_payout_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"currency",type:"varchar",length:10},{name:"early_payout_enabled",type:"boolean",notNull:!0,default:!1},{name:"status",type:"varchar",length:20,notNull:!0,default:"active"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"],unique:!0}]},{table_name:"payment_reserves",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"seller"},{name:"owner_id",type:"uuid",notNull:!0},{name:"split_id",type:"uuid",references:{table:"paymentSplits",column:"id",onDelete:"set null"}},{name:"amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"reason",type:"varchar",length:30,notNull:!0,default:"refund_window",comment:"refund_window | chargeback_risk | new_seller | manual_hold | dispute | compliance_review"},{name:"status",type:"varchar",length:20,notNull:!0,default:"held",comment:"held | released | consumed | cancelled"},{name:"release_at",type:"timestamptz"},{name:"released_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"]},{columns:["status"]},{columns:["release_at"]}]},{table_name:"payment_payout_requests",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"recipient_owner_type",type:"varchar",length:20,notNull:!0,default:"seller"},{name:"recipient_owner_id",type:"uuid",notNull:!0},{name:"amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | approved | rejected | processing | completed | failed | cancelled"},{name:"provider",type:"varchar",length:50},{name:"provider_payout_id",type:"varchar",length:255},{name:"provider_transfer_id",type:"varchar",length:255},{name:"destination",type:"varchar",length:255},{name:"requested_by",type:"uuid"},{name:"decided_by",type:"uuid"},{name:"decided_at",type:"timestamptz"},{name:"completed_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["recipient_owner_type","recipient_owner_id"]},{columns:["status"]}]},{table_name:"payment_disputes",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Payments Marketplace",columns:[{name:"transaction_id",type:"uuid",references:{table:"paymentTransactions",column:"id",onDelete:"set null"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_dispute_id",type:"varchar",length:255},{name:"owner_type",type:"varchar",length:20},{name:"owner_id",type:"uuid"},{name:"amount",type:"bigint",mode:"number"},{name:"currency",type:"varchar",length:10},{name:"reason",type:"varchar",length:100},{name:"status",type:"varchar",length:30,notNull:!0,default:"open",comment:"open | under_review | won | lost | accepted | cancelled"},{name:"evidence_due_at",type:"timestamptz"},{name:"resolved_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["provider","provider_dispute_id"]},{columns:["status"]},{columns:["owner_type","owner_id"]},{columns:["transaction_id"]}]},{table_name:"nucleus_secrets",feature_set:["secrets"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["GET","POST","PUT","PATCH","DELETE","TOGGLE"],bulk_endpoints_enabled:!1,group_name:"Secrets",columns:[{name:"scope",type:"varchar",length:200,notNull:!0,comment:"Config dot-path that owns the credential, e.g. authentication.oauth.providers.microsoft"},{name:"key",type:"varchar",length:120,notNull:!0,comment:"Leaf key under that path, e.g. clientSecret"},{name:"value_enc",type:"text",notNull:!0,comment:"AES-256-GCM envelope v1:iv:tag:ciphertext \u2014 never returned by any route"},{name:"previous_enc",type:"text",comment:"Value replaced by the last rotation, retained for one-step rollback"},{name:"preview",type:"varchar",length:80},{name:"kind",type:"varchar",length:30,notNull:!0,default:"text",enumValues:["text","password","json","connection_string","pem"]},{name:"description",type:"varchar",length:500},{name:"version",type:"integer",notNull:!0,default:1},{name:"rotated_at",type:"timestamptz"},{name:"last_used_at",type:"timestamptz"}],indexes:[{columns:["scope","key"],unique:!0},{columns:["scope"]}]},{table_name:"integration_sources",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"name",type:"varchar",length:150,notNull:!0},{name:"slug",type:"varchar",length:150,notNull:!0,comment:"Stable machine name; referenced by exports and by operators in logs"},{name:"base_url",type:"varchar",length:500,notNull:!0,comment:"Any scheme, host and port \u2014 https, plain http, in-cluster DNS, IP. HTTPS is NOT required and must never be enforced: reaching a service inside the same cluster over http is a legitimate deployment."},{name:"description",type:"text"},{name:"enabled",type:"boolean",default:!0},{name:"auth_type",type:"varchar",length:20,notNull:!0,default:"none",enumValues:["none","bearer","api_key","basic","oauth2"]},{name:"auth_token_encrypted",type:"text",sensitive:!0,comment:"Static credential (bearer / api key / basic blob), encrypted at rest"},{name:"auth_token_hint",type:"varchar",length:24},{name:"auth_header_name",type:"varchar",length:80,default:"Authorization"},{name:"auth_query_param",type:"varchar",length:80,comment:"When set, an api_key credential travels as this query parameter instead of a header"},{name:"extra_headers",type:"jsonb",default:{}},{name:"token_url",type:"varchar",length:500},{name:"oauth_grant_type",type:"varchar",length:40,default:"password",enumValues:["password","client_credentials"]},{name:"oauth_client_id",type:"varchar",length:200},{name:"oauth_client_secret_encrypted",type:"text",sensitive:!0},{name:"oauth_client_secret_hint",type:"varchar",length:24},{name:"oauth_username",type:"varchar",length:200},{name:"oauth_password_encrypted",type:"text",sensitive:!0},{name:"oauth_password_hint",type:"varchar",length:24},{name:"oauth_scope",type:"varchar",length:300},{name:"oauth_client_auth",type:"varchar",length:20,default:"basic",enumValues:["basic","body"]},{name:"tls_verify",type:"boolean",notNull:!0,default:!0,comment:"Per-source certificate verification. Turning it off applies to THIS source's connections only \u2014 never to the process, which is what a NODE_TLS_REJECT_UNAUTHORIZED toggle would do."},{name:"timeout_ms",type:"integer",notNull:!0,default:30000},{name:"spec_url",type:"varchar",length:500,comment:"Optional API description document (OpenAPI/Swagger/Postman/Bruno). Discovery is a convenience: every endpoint can always be defined by hand instead."},{name:"spec_format",type:"varchar",length:20,default:"manual",enumValues:["manual","openapi","swagger","postman","bruno","har"]}],constraints:{unique:[{name:"uniq_integration_source_slug",columns:["slug"]}]},indexes:[{columns:["enabled"]}]},{table_name:"integration_endpoints",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"source_id",type:"uuid",notNull:!0,references:{table:"integrationSources",column:"id",onDelete:"cascade"}},{name:"tag",type:"varchar",length:120,notNull:!0},{name:"name",type:"varchar",length:200},{name:"method",type:"varchar",length:10,notNull:!0,default:"GET",enumValues:["GET","POST","PUT","PATCH","DELETE"]},{name:"path",type:"varchar",length:500,notNull:!0,comment:"Appended to the source base URL. May carry {brace} or :colon path tokens, whose values come from param_bindings."},{name:"description",type:"text"},{name:"query_params",type:"jsonb",default:{}},{name:"request_body",type:"jsonb",default:{}},{name:"param_bindings",type:"jsonb",default:[],comment:"Where each path/query parameter comes from: a static value, another endpoint's records (fan-out), or a column of one of our own tables."},{name:"pagination",type:"jsonb",default:{},comment:"Explicitly chosen paging profile (none/page_number/offset/cursor/link_header). Never guessed \u2014 a wrong guess silently imports one page."},{name:"response_root_path",type:"varchar",length:200},{name:"tree_children_path",type:"varchar",length:200,comment:"Field holding a record's children when the source answers with a shape rather than a list \u2014 each node then becomes its own row and knows its parent"},{name:"sample_response",type:"jsonb",default:{},comment:"A few real records captured by a live test, so the mapping screen still shows fields when the source is unreachable"},{name:"enabled",type:"boolean",default:!0}],indexes:[{columns:["source_id"]},{columns:["source_id","tag"]}]},{table_name:"integration_mappings",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"endpoint_id",type:"uuid",notNull:!0,references:{table:"integrationEndpoints",column:"id",onDelete:"cascade"}},{name:"name",type:"varchar",length:200,notNull:!0},{name:"target_entity",type:"varchar",length:120,notNull:!0,comment:"snake_case table name this mapping writes into"},{name:"field_mappings",type:"jsonb",notNull:!0,default:[]},{name:"reference_checks",type:"jsonb",notNull:!0,default:[],comment:"Columns whose value must already exist in another entity, and what to do when it does not."},{name:"dedup_source_field",type:"varchar",length:200},{name:"dedup_target_field",type:"varchar",length:200,comment:"Target column that identifies the same record across runs. Without it nothing can be matched and every run appends."},{name:"write_mode",type:"varchar",length:20,notNull:!0,default:"upsert",enumValues:["upsert","append","replace"],comment:"replace is the destructive wipe-and-rewrite; it is no longer the default and is gated by the completeness check."},{name:"missing_record_policy",type:"varchar",length:20,notNull:!0,default:"ignore",enumValues:["ignore","deactivate","delete"],comment:"What happens to a row that exists here but no longer in the source. deactivate is the right answer for most HR data and could not be expressed before."},{name:"missing_record_column",type:"varchar",length:120},{name:"missing_record_value",type:"varchar",length:200},{name:"removal_scope_column",type:"varchar",length:120,comment:"Target column carrying whatever the fan-out varies \u2014 a company code, a branch, a tenant. Set it when one mapping reads its source through several calls: removal is then confined to the values actually read, so a call that answers HTTP 500 costs that slice its cleanup instead of costing the whole run. Without it a single failing call refuses every removal, and a source whose one bad endpoint fails every night is never cleaned at all."},{name:"origin_column",type:"varchar",length:120,comment:"Column this mapping stamps on rows it owns. Set it when the target table ALSO holds rows people create by hand: without it every hand-made row looks like one the source stopped carrying, and the first run with a removal policy deletes them all."},{name:"origin_value",type:"varchar",length:120,comment:"The value written into origin_column. Rows carrying it are the only removal candidates."},{name:"max_removal_share",type:"numeric",comment:"Share of the target table (0-1) above which an UNATTENDED run refuses to remove. A scheduled run passes through neither the preview nor a confirmation, so this is the only thing between a wrong plan and the table. 0 or null disables."},{name:"password_target_column",type:"varchar",length:100,comment:"Column that receives the shared opening password given at run time. The password itself is never stored."},{name:"account_rule",type:"jsonb",comment:"Creates a login alongside each imported record, in the same transaction, and links it. The password belongs to the run, never to this row."},{name:"schedule_cron",type:"varchar",length:120},{name:"schedule_timezone",type:"varchar",length:64,comment:"IANA zone the cron expression is read in. Without it a nightly job drifts with the container's clock."},{name:"schedule_enabled",type:"boolean",notNull:!0,default:!1},{name:"last_run_at",type:"timestamptz"},{name:"enabled",type:"boolean",default:!0}],indexes:[{columns:["endpoint_id"]},{columns:["target_entity"]},{columns:["schedule_enabled"]}]},{table_name:"integration_runs",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"mapping_id",type:"uuid",references:{table:"integrationMappings",column:"id",onDelete:"set null"},comment:"Nullable and NOT cascaded: deleting a mapping must not erase the record that it once rewrote a table."},{name:"target_entity",type:"varchar",length:120},{name:"write_mode",type:"varchar",length:20,enumValues:["upsert","append","replace"]},{name:"status",type:"varchar",length:20,notNull:!0,default:"queued",enumValues:["queued","running","succeeded","failed","cancelled","reverted"],comment:"There is deliberately no 'partial': a run either applied in full or not at all."},{name:"trigger",type:"varchar",length:20,notNull:!0,default:"manual",enumValues:["manual","schedule","api"]},{name:"total_fetched",type:"integer",notNull:!0,default:0},{name:"source_reported_total",type:"integer",comment:"What the source said it had. When this and total_fetched disagree, a destructive run refuses to start."},{name:"created_count",type:"integer",notNull:!0,default:0},{name:"references_created_count",type:"integer",notNull:!0,default:0,comment:"Rows this run added to OTHER tables so its records could point at them."},{name:"accounts_created_count",type:"integer",notNull:!0,default:0,comment:"Logins this run created so its records could be signed in to."},{name:"updated_count",type:"integer",notNull:!0,default:0},{name:"skipped_count",type:"integer",notNull:!0,default:0},{name:"deleted_count",type:"integer",notNull:!0,default:0},{name:"deactivated_count",type:"integer",notNull:!0,default:0},{name:"error_count",type:"integer",notNull:!0,default:0},{name:"external_call_count",type:"integer",notNull:!0,default:0},{name:"issues",type:"jsonb",default:[]},{name:"errors",type:"jsonb",default:[]},{name:"cancel_requested",type:"boolean",notNull:!0,default:!1,comment:"Set by the cancel endpoint; the engine checks it at every batch boundary. A dropped HTTP connection is NOT a cancellation."},{name:"started_at",type:"timestamptz"},{name:"finished_at",type:"timestamptz"},{name:"pre_images_expire_at",type:"timestamptz",comment:"After this, the run can no longer be reverted and the UI says so rather than offering a button that quietly does nothing."},{name:"reverted_at",type:"timestamptz"},{name:"reverted_by",type:"uuid",references:{table:"users",column:"id"}},{name:"reverted_run_id",type:"uuid"}],indexes:[{columns:["mapping_id"]},{columns:["status"]},{columns:["target_entity"]},{columns:["created_at"]}]},{table_name:"integration_run_items",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"run_id",type:"uuid",notNull:!0,references:{table:"integrationRuns",column:"id",onDelete:"cascade"}},{name:"target_entity",type:"varchar",length:120,notNull:!0},{name:"row_id",type:"uuid"},{name:"action",type:"varchar",length:20,notNull:!0,enumValues:["create","update","delete","deactivate"]},{name:"before",type:"jsonb",comment:"The row as it stood before this run touched it. This is what makes a successful run reversible; the bulk delete path already produced these rows and threw them away."},{name:"after",type:"jsonb"}],indexes:[{columns:["run_id"]},{columns:["run_id","action"]},{columns:["target_entity","row_id"]}]}];var exceedsBodyLimit=(contentLengthHeader,maxBytes)=>{if(!maxBytes||maxBytes<=0)return!1;if(!contentLengthHeader)return!1;let len=Number(contentLengthHeader);if(!Number.isFinite(len)||len<0)return!1;return len>maxBytes};init_internalHeaders();init_response();function createInboundGuard(options={}){return({request,set})=>{for(let header of INTERNAL_HEADERS)request.headers.delete(header);if(exceedsBodyLimit(request.headers.get("content-length"),options.maxRequestBodyBytes))return set.status=413,Response.json(withEnvelopeFlags({isSuccess:!1,message:"Request body too large",status:413,errors:[{message:"Request body too large"}],data:null}));return}}function columnOfScope(scope){if(!scope)return null;let[field]=scope.split("="),trimmed=field?.trim();return trimmed?trimmed:null}function findUnstampedOwnership(assignments,ownership){let required=new Map;for(let{table,column}of ownership){let columns=required.get(table)??new Set;columns.add(column),required.set(table,columns)}let seen=new Map;for(let assignment of assignments){let scopeColumn=columnOfScope(assignment.scope);for(let claim of assignment.claims??[]){if(!claim.startsWith("post."))continue;let table=claim.slice(5),columns=required.get(table);if(!columns)continue;let perTable=seen.get(table)??new Map;for(let column of columns){let entry=perTable.get(column)??{scoped:new Set,unscoped:new Set},role=assignment.role??"(unnamed role)";if(scopeColumn===column)entry.scoped.add(role);else entry.unscoped.add(role);perTable.set(column,entry)}seen.set(table,perTable)}}let findings=[];for(let[table,perTable]of seen)for(let[column,entry]of perTable){if(entry.scoped.size===0||entry.unscoped.size===0)continue;findings.push({table,column,unscopedRoles:[...entry.unscoped].sort(),scopedRoles:[...entry.scoped].sort()})}return findings.sort((a,b)=>a.table.localeCompare(b.table)||a.column.localeCompare(b.column))}function describeUnstamped(findings){return findings.map((f)=>`[Authorization] ${f.table}.${f.column} is stamped for ${f.scopedRoles.join(", ")} (scoped create) but NOT for ${f.unscopedRoles.join(", ")}. Those roles must send ${f.column} themselves or their writes fail with "${f.column} is required". `+"Give them a scoped claim, or have the client send it \u2014 a scoped caller's value is "+"overridden server-side either way.")}init_response();init_routeCollector();init_routeMount();init_routeRecording();init_lifetime();import{and as and11,eq as eq16,inArray as inArray3,isNull as isNull2}from"drizzle-orm";var DEFAULT_CHAT_CONFIG={enabled:!1,basePath:"/chat",groupsEnabled:!0,maxGroupParticipants:256,maxMessageLength:8000,editingEnabled:!0,deletionEnabled:!0,typingIndicators:!0,readReceipts:!0,presence:!0,realtimeTopicPrefix:"chat",messagePageSize:50,moderatorRoles:[],attachments:{enabled:!0,maxPerMessage:10,maxFileSizeBytes:null,allowedMimeTypes:[]}};function mergeChatConfig(input){let base=DEFAULT_CHAT_CONFIG;if(!input)return base;return{enabled:input.enabled??base.enabled,basePath:input.basePath??base.basePath,groupsEnabled:input.groupsEnabled??base.groupsEnabled,maxGroupParticipants:input.maxGroupParticipants??base.maxGroupParticipants,maxMessageLength:input.maxMessageLength??base.maxMessageLength,editingEnabled:input.editingEnabled??base.editingEnabled,deletionEnabled:input.deletionEnabled??base.deletionEnabled,typingIndicators:input.typingIndicators??base.typingIndicators,readReceipts:input.readReceipts??base.readReceipts,presence:input.presence??base.presence,realtimeTopicPrefix:input.realtimeTopicPrefix??base.realtimeTopicPrefix,messagePageSize:input.messagePageSize??base.messagePageSize,moderatorRoles:input.moderatorRoles??base.moderatorRoles,attachments:{enabled:input.attachments?.enabled??base.attachments.enabled,maxPerMessage:input.attachments?.maxPerMessage??base.attachments.maxPerMessage,maxFileSizeBytes:input.attachments?.maxFileSizeBytes??base.attachments.maxFileSizeBytes,allowedMimeTypes:input.attachments?.allowedMimeTypes??base.attachments.allowedMimeTypes}}}function getCol(table,col7){return table[col7]}function getTable(schemaTables,name2,logger2){return resolveSchemaTable(schemaTables,name2,logger2)}function computeDirectKey(userA,userB){return[userA,userB].sort().join(":")}function kindFromMime(mime){if(!mime)return"file";if(mime.startsWith("image/"))return"image";if(mime.startsWith("video/"))return"video";if(mime.startsWith("audio/"))return"audio";return"file"}function str3(value){return typeof value==="string"?value:null}function num2(value){return typeof value==="number"?value:null}function date(value){if(value instanceof Date)return value;if(typeof value==="string")return new Date(value);return null}function cdnUrl(cdnBasePath,fileId){if(!fileId)return null;return`${cdnBasePath}/${fileId}`}function mapConversation(row,cdnBasePath){let avatarFileId=str3(row.avatarFileId);return{id:String(row.id),type:str3(row.type)??"direct",title:str3(row.title),description:str3(row.description),avatarFileId,avatarUrl:cdnUrl(cdnBasePath,avatarFileId),directKey:str3(row.directKey),lastMessageAt:date(row.lastMessageAt),lastMessagePreview:str3(row.lastMessagePreview),lastMessageSenderId:str3(row.lastMessageSenderId),createdBy:str3(row.createdBy),createdAt:date(row.createdAt)??new Date(0),updatedAt:date(row.updatedAt)??new Date(0),isActive:row.isActive!==!1}}function mapParticipant(row){return{id:String(row.id),conversationId:String(row.conversationId),userId:String(row.userId),role:str3(row.role)??"member",lastReadMessageId:str3(row.lastReadMessageId),lastReadAt:date(row.lastReadAt),unreadCount:num2(row.unreadCount)??0,muted:row.muted===!0,mutedUntil:date(row.mutedUntil),notificationsEnabled:row.notificationsEnabled!==!1,leftAt:date(row.leftAt),joinedAt:date(row.createdAt)??new Date(0)}}function mapAttachment(row,cdnBasePath){let fileId=String(row.fileId);return{id:String(row.id),messageId:String(row.messageId),conversationId:String(row.conversationId),fileId,kind:str3(row.kind)??"file",originalName:str3(row.originalName),mimeType:str3(row.mimeType),size:num2(row.size),width:num2(row.width),height:num2(row.height),duration:num2(row.duration),url:`${cdnBasePath}/${fileId}`}}function mapMessage(row,attachments){let metadata=row.metadata;return{id:String(row.id),conversationId:String(row.conversationId),senderId:str3(row.senderId),content:str3(row.content),contentType:str3(row.contentType)??"text",replyToId:str3(row.replyToId),metadata:metadata&&typeof metadata==="object"?metadata:null,clientMessageId:str3(row.clientMessageId),editedAt:date(row.editedAt),deletedAt:date(row.deletedAt),createdAt:date(row.createdAt)??new Date(0),updatedAt:date(row.updatedAt)??new Date(0),attachments}}function buildPreview(content,contentType,attachmentCount){if(content&&content.trim().length>0){let trimmed=content.trim();return trimmed.length>280?`${trimmed.slice(0,277)}...`:trimmed}if(attachmentCount>0){if(contentType==="image")return attachmentCount>1?`${attachmentCount} photos`:"Photo";if(contentType==="video")return attachmentCount>1?`${attachmentCount} videos`:"Video";if(contentType==="audio")return"Audio";return attachmentCount>1?`${attachmentCount} files`:"File"}if(contentType==="system")return"System message";return""}async function checkAttachmentFileAccess(args){let{db,schemaTables,fileId,userId}=args,attachments=getTable(schemaTables,"chat_message_attachments"),participants=getTable(schemaTables,"chat_participants");if(!attachments||!participants)return"not_attachment";let linked=await db.select().from(attachments).where(eq16(getCol(attachments,"fileId"),fileId));if(linked.length===0)return"not_attachment";if(!userId)return"denied";let conversationIds=[...new Set(linked.map((row)=>String(row.conversationId)))];return(await db.select().from(participants).where(and11(inArray3(getCol(participants,"conversationId"),conversationIds),eq16(getCol(participants,"userId"),userId),isNull2(getCol(participants,"leftAt")))).limit(1)).length>0?"allowed":"denied"}import{and as and13,desc as desc3,eq as eq18,inArray as inArray5}from"drizzle-orm";import{and as and12,eq as eq17,inArray as inArray4}from"drizzle-orm";class ChatError extends Error{code;constructor(code,message){super(message);this.code=code,this.name="ChatError"}}function resolveChatTables(ctx){let conversations=getTable(ctx.schemaTables,"chat_conversations",ctx.logger),participants=getTable(ctx.schemaTables,"chat_participants",ctx.logger),messages=getTable(ctx.schemaTables,"chat_messages",ctx.logger);if(!conversations||!participants||!messages)throw new ChatError("disabled","Chat tables are not available in this schema");let attachments=getTable(ctx.schemaTables,"chat_message_attachments")??null,files=getTable(ctx.schemaTables,"files")??null;return{conversations,participants,messages,attachments,files}}function chatTopic(ctx){return ctx.config.realtimeTopicPrefix||"chat"}async function getConversationRow(ctx,tables,conversationId){return(await ctx.db.select().from(tables.conversations).where(eq17(getCol(tables.conversations,"id"),conversationId)).limit(1))[0]??null}async function getParticipant(ctx,tables,conversationId,userId){let row=(await ctx.db.select().from(tables.participants).where(and12(eq17(getCol(tables.participants,"conversationId"),conversationId),eq17(getCol(tables.participants,"userId"),userId))).limit(1))[0];return row?mapParticipant(row):null}async function requireActiveMembership(ctx,tables,conversationId,userId){let participant=await getParticipant(ctx,tables,conversationId,userId);if(!participant||participant.leftAt)throw new ChatError("forbidden","You are not a participant of this conversation");return participant}async function listParticipants(ctx,tables,conversationId,includeLeft=!1){let all=(await ctx.db.select().from(tables.participants).where(eq17(getCol(tables.participants,"conversationId"),conversationId))).map(mapParticipant);return includeLeft?all:all.filter((p)=>!p.leftAt)}async function assertUsersExist(ctx,userIds){let unique=[...new Set(userIds)];if(unique.length===0)return;let usersTable=getTable(ctx.schemaTables,"users",ctx.logger);if(!usersTable)throw new ChatError("disabled","Users table is not available in this schema");let rows=await ctx.db.select({id:getCol(usersTable,"id")}).from(usersTable).where(inArray4(getCol(usersTable,"id"),unique)),found=new Set(rows.map((r)=>r.id));for(let id of unique)if(!found.has(id))throw new ChatError("not_found",`User ${id} does not exist`)}function deliverToParticipants(ctx,participants,event,exceptUserId){if(!ctx.broadcaster)return;let topic=chatTopic(ctx);for(let participant of participants){if(participant.leftAt)continue;if(exceptUserId&&participant.userId===exceptUserId)continue;ctx.broadcaster.broadcastToUser(participant.userId,topic,event)}}async function buildSummary(ctx,tables,conversationRow,userId,participantsOverride){let conversation=mapConversation(conversationRow,ctx.cdnBasePath),participants=participantsOverride??await listParticipants(ctx,tables,conversation.id),myParticipant=participants.find((p)=>p.userId===userId)??null;return{...conversation,participants,myParticipant,unreadCount:myParticipant?.unreadCount??0}}async function getOrCreateDirect(ctx,params){let tables=resolveChatTables(ctx),{userId,targetUserId}=params;if(!targetUserId||targetUserId===userId)throw new ChatError("validation","A different target user is required");await assertUsersExist(ctx,[targetUserId]);let directKey=computeDirectKey(userId,targetUserId),existing=(await ctx.db.select().from(tables.conversations).where(eq18(getCol(tables.conversations,"directKey"),directKey)).limit(1))[0];if(existing)return await rejoinIfNeeded(ctx,tables,String(existing.id),[userId,targetUserId]),buildSummary(ctx,tables,existing,userId);let now=new Date,conversationRow;try{conversationRow=(await ctx.db.insert(tables.conversations).values({type:"direct",directKey,createdBy:userId,lastMessageAt:now,lastMessagePreview:""}).returning())[0]}catch(_err){let raced=(await ctx.db.select().from(tables.conversations).where(eq18(getCol(tables.conversations,"directKey"),directKey)).limit(1))[0];if(!raced)throw new ChatError("conflict","Failed to create direct conversation");return await rejoinIfNeeded(ctx,tables,String(raced.id),[userId,targetUserId]),buildSummary(ctx,tables,raced,userId)}let conversationId=String(conversationRow.id);await ctx.db.insert(tables.participants).values([{conversationId,userId,role:"member",createdBy:userId},{conversationId,userId:targetUserId,role:"member",createdBy:userId}]);let summary=await buildSummary(ctx,tables,conversationRow,userId);return deliverToParticipants(ctx,summary.participants,{type:"conversation.created",conversationId,conversation:summary},userId),summary}async function createGroup(ctx,params){if(!ctx.config.groupsEnabled)throw new ChatError("disabled","Group conversations are disabled");let tables=resolveChatTables(ctx),{creatorId,title}=params;if(!title||title.trim().length===0)throw new ChatError("validation","A group title is required");let memberIds=[...new Set([creatorId,...params.participantIds])];if(memberIds.length>ctx.config.maxGroupParticipants)throw new ChatError("validation",`A group cannot exceed ${ctx.config.maxGroupParticipants} participants`);if(await assertUsersExist(ctx,memberIds),params.avatarFileId){if(!tables.files)throw new ChatError("disabled","Avatar files require storage to be enabled");let avatarRow=(await ctx.db.select().from(tables.files).where(eq18(getCol(tables.files,"id"),params.avatarFileId)).limit(1))[0],owner=avatarRow?String(avatarRow.uploadedBy??avatarRow.createdBy??""):"";if(!avatarRow||owner!==creatorId)throw new ChatError("forbidden","Avatar file is not owned by the creator")}let now=new Date,conversationRow=(await ctx.db.insert(tables.conversations).values({type:"group",title:title.trim(),description:params.description??null,avatarFileId:params.avatarFileId??null,createdBy:creatorId,lastMessageAt:now,lastMessagePreview:""}).returning())[0],conversationId=String(conversationRow.id);await ctx.db.insert(tables.participants).values(memberIds.map((memberId)=>({conversationId,userId:memberId,role:memberId===creatorId?"owner":"member",createdBy:creatorId})));let summary=await buildSummary(ctx,tables,conversationRow,creatorId);return deliverToParticipants(ctx,summary.participants,{type:"conversation.created",conversationId,conversation:summary},creatorId),summary}async function listConversations(ctx,params){let tables=resolveChatTables(ctx),limit=Math.min(Math.max(params.limit??30,1),100),offset=Math.max(params.offset??0,0),myParticipants=(await ctx.db.select().from(tables.participants).where(eq18(getCol(tables.participants,"userId"),params.userId))).map(mapParticipant).filter((p)=>!p.leftAt);if(myParticipants.length===0)return[];let conversationIds=myParticipants.map((p)=>p.conversationId),pageRows=await ctx.db.select().from(tables.conversations).where(and13(inArray5(getCol(tables.conversations,"id"),conversationIds),eq18(getCol(tables.conversations,"isActive"),!0))).orderBy(desc3(getCol(tables.conversations,"lastMessageAt"))).limit(limit).offset(offset);if(pageRows.length===0)return[];let pageIds=pageRows.map((r)=>String(r.id)),participantRows=await ctx.db.select().from(tables.participants).where(inArray5(getCol(tables.participants,"conversationId"),pageIds)),byConversation=new Map;for(let row of participantRows){let mapped=mapParticipant(row);if(mapped.leftAt)continue;let list2=byConversation.get(mapped.conversationId)??[];list2.push(mapped),byConversation.set(mapped.conversationId,list2)}let summaries=[];for(let row of pageRows){let id=String(row.id);summaries.push(await buildSummary(ctx,tables,row,params.userId,byConversation.get(id)??[]))}return summaries}async function getConversation(ctx,conversationId,userId){let tables=resolveChatTables(ctx);await requireActiveMembership(ctx,tables,conversationId,userId);let row=await getConversationRow(ctx,tables,conversationId);if(!row)throw new ChatError("not_found","Conversation not found");return buildSummary(ctx,tables,row,userId)}async function rejoinIfNeeded(ctx,tables,conversationId,userIds){for(let userId of userIds){let participant=await getParticipant(ctx,tables,conversationId,userId);if(!participant)await ctx.db.insert(tables.participants).values({conversationId,userId,role:"member",createdBy:userId});else if(participant.leftAt)await ctx.db.update(tables.participants).set({leftAt:null}).where(eq18(getCol(tables.participants,"id"),participant.id))}}function assertCanManage(actor){if(actor.role!=="owner"&&actor.role!=="admin")throw new ChatError("forbidden","Only group admins can manage participants")}async function addParticipants(ctx,conversationId,actorId,userIds){let tables=resolveChatTables(ctx),conversation=await getConversationRow(ctx,tables,conversationId);if(!conversation)throw new ChatError("not_found","Conversation not found");if(mapConversation(conversation,ctx.cdnBasePath).type!=="group")throw new ChatError("validation","Participants can only be managed in group conversations");let actor=await requireActiveMembership(ctx,tables,conversationId,actorId);assertCanManage(actor);let toAdd=[...new Set(userIds)];await assertUsersExist(ctx,toAdd);let current=await listParticipants(ctx,tables,conversationId,!0),activeCount=current.filter((p)=>!p.leftAt).length,newOnes=toAdd.filter((id)=>!current.some((p)=>p.userId===id&&!p.leftAt));if(activeCount+newOnes.length>ctx.config.maxGroupParticipants)throw new ChatError("validation","Group participant limit exceeded");for(let userId of toAdd)await rejoinIfNeeded(ctx,tables,conversationId,[userId]);let participants=await listParticipants(ctx,tables,conversationId);return deliverToParticipants(ctx,participants,{type:"participant.added",conversationId,userIds:toAdd,by:actorId}),participants}async function removeParticipant(ctx,conversationId,actorId,targetUserId){let tables=resolveChatTables(ctx),actor=await requireActiveMembership(ctx,tables,conversationId,actorId);if(actorId!==targetUserId)assertCanManage(actor);let target2=await getParticipant(ctx,tables,conversationId,targetUserId);if(!target2||target2.leftAt)throw new ChatError("not_found","Participant not found in conversation");await ctx.db.update(tables.participants).set({leftAt:new Date}).where(eq18(getCol(tables.participants,"id"),target2.id));let participants=await listParticipants(ctx,tables,conversationId),event={type:"participant.removed",conversationId,userId:targetUserId,by:actorId};if(deliverToParticipants(ctx,participants,event),ctx.broadcaster)ctx.broadcaster.broadcastToUser(targetUserId,ctx.config.realtimeTopicPrefix||"chat",event)}import{and as and14,desc as desc4,eq as eq19,inArray as inArray6,isNull as isNull3,lt,ne,sql as sql6}from"drizzle-orm";async function loadAttachments(ctx,tables,messageIds){let grouped=new Map;if(!tables.attachments||messageIds.length===0)return grouped;let rows=await ctx.db.select().from(tables.attachments).where(inArray6(getCol(tables.attachments,"messageId"),messageIds));for(let row of rows){let attachment=mapAttachment(row,ctx.cdnBasePath),list2=grouped.get(attachment.messageId)??[];list2.push(attachment),grouped.set(attachment.messageId,list2)}return grouped}function inferContentType(explicit,attachments){if(explicit)return explicit;if(attachments.length===0)return"text";let kind=attachments[0]?.kind;if(kind==="image")return"image";if(kind==="video")return"video";if(kind==="audio")return"audio";return"file"}async function persistAttachments(ctx,tables,conversationId,messageId,params){let inputs=params.attachments??[];if(inputs.length===0)return[];if(!ctx.attachmentsAvailable||!tables.attachments||!tables.files)throw new ChatError("disabled","File attachments require storage and CDN to be enabled");if(inputs.length>ctx.config.attachments.maxPerMessage)throw new ChatError("validation",`A message cannot have more than ${ctx.config.attachments.maxPerMessage} attachments`);let fileIds=inputs.map((a)=>a.fileId),fileRows=await ctx.db.select().from(tables.files).where(inArray6(getCol(tables.files,"id"),fileIds)),filesById=new Map;for(let row of fileRows)filesById.set(String(row.id),row);let payloads=inputs.map((input)=>{let fileRow=filesById.get(input.fileId);if(!fileRow)throw new ChatError("not_found",`Attachment file ${input.fileId} was not found`);if(String(fileRow.uploadedBy??fileRow.createdBy??"")!==params.senderId)throw new ChatError("forbidden",`Attachment file ${input.fileId} is not owned by the sender`);let mimeType=fileRow.mimeType??input.mimeType??null;return{conversationId,messageId,fileId:input.fileId,kind:input.kind??kindFromMime(mimeType),originalName:fileRow.originalName??input.originalName??null,mimeType,size:fileRow.size??input.size??null,width:input.width??null,height:input.height??null,duration:input.duration??null,createdBy:params.senderId}});return(await ctx.db.insert(tables.attachments).values(payloads).returning()).map((row)=>mapAttachment(row,ctx.cdnBasePath))}async function sendMessage(ctx,params){let tables=resolveChatTables(ctx);await requireActiveMembership(ctx,tables,params.conversationId,params.senderId);let content=params.content?.trim()?params.content:null,hasAttachments=(params.attachments?.length??0)>0;if(!content&&!hasAttachments)throw new ChatError("validation","A message must contain text or at least one attachment");if(content&&content.length>ctx.config.maxMessageLength)throw new ChatError("validation",`Message exceeds the maximum length of ${ctx.config.maxMessageLength} characters`);if(params.metadata!==void 0&&params.metadata!==null){if(JSON.stringify(params.metadata).length>4096)throw new ChatError("validation","Message metadata exceeds the maximum size of 4096 bytes")}let{message,participants}=await ctx.db.transaction(async(tx)=>{let txCtx={...ctx,db:tx},messageRow=(await tx.insert(tables.messages).values({conversationId:params.conversationId,senderId:params.senderId,content,contentType:params.contentType??"text",replyToId:params.replyToId??null,clientMessageId:params.clientMessageId??null,metadata:params.metadata??{},createdBy:params.senderId}).returning())[0],messageId=String(messageRow.id),attachments=await persistAttachments(txCtx,tables,params.conversationId,messageId,params),contentType=inferContentType(params.contentType,attachments);if(contentType!==messageRow.contentType)await tx.update(tables.messages).set({contentType}).where(eq19(getCol(tables.messages,"id"),messageId)),messageRow.contentType=contentType;let mappedMessage=mapMessage(messageRow,attachments),preview=buildPreview(mappedMessage.content,mappedMessage.contentType,attachments.length),now=mappedMessage.createdAt;await tx.update(tables.conversations).set({lastMessageAt:now,lastMessagePreview:preview,lastMessageSenderId:params.senderId,updatedAt:new Date}).where(eq19(getCol(tables.conversations,"id"),params.conversationId)),await tx.update(tables.participants).set({unreadCount:sql6`${getCol(tables.participants,"unreadCount")} + 1`}).where(and14(eq19(getCol(tables.participants,"conversationId"),params.conversationId),ne(getCol(tables.participants,"userId"),params.senderId),isNull3(getCol(tables.participants,"leftAt"))));let parts=await listParticipants(txCtx,tables,params.conversationId);return{message:mappedMessage,participants:parts}});return deliverToParticipants(ctx,participants,{type:"message.created",conversationId:params.conversationId,message}),message}async function getMessages(ctx,params){let tables=resolveChatTables(ctx);await requireActiveMembership(ctx,tables,params.conversationId,params.userId);let limit=Math.min(Math.max(params.limit??ctx.config.messagePageSize,1),100),conditions=[eq19(getCol(tables.messages,"conversationId"),params.conversationId)];if(params.before){let cursor=(await ctx.db.select().from(tables.messages).where(eq19(getCol(tables.messages,"id"),params.before)).limit(1))[0];if(cursor?.createdAt)conditions.push(lt(getCol(tables.messages,"createdAt"),cursor.createdAt))}let rows=await ctx.db.select().from(tables.messages).where(and14(...conditions)).orderBy(desc4(getCol(tables.messages,"createdAt"))).limit(limit+1),pageRows=rows.slice(0,limit),hasMore=rows.length>limit,attachmentsByMessage=await loadAttachments(ctx,tables,pageRows.map((r)=>String(r.id)));return{messages:pageRows.map((row)=>mapMessage(row,attachmentsByMessage.get(String(row.id))??[])),hasMore}}async function markRead(ctx,conversationId,userId,messageId){let tables=resolveChatTables(ctx),participant=await requireActiveMembership(ctx,tables,conversationId,userId),targetMessageId=messageId??null;if(targetMessageId){if(!(await ctx.db.select().from(tables.messages).where(and14(eq19(getCol(tables.messages,"id"),targetMessageId),eq19(getCol(tables.messages,"conversationId"),conversationId))).limit(1))[0])throw new ChatError("not_found","Message not found in this conversation")}else{let latestRow=(await ctx.db.select().from(tables.messages).where(eq19(getCol(tables.messages,"conversationId"),conversationId)).orderBy(desc4(getCol(tables.messages,"createdAt"))).limit(1))[0];targetMessageId=latestRow?String(latestRow.id):null}let readAt=new Date;if(await ctx.db.update(tables.participants).set({lastReadMessageId:targetMessageId,lastReadAt:readAt,unreadCount:0}).where(eq19(getCol(tables.participants,"id"),participant.id)),ctx.config.readReceipts){let participants=await listParticipants(ctx,tables,conversationId);deliverToParticipants(ctx,participants,{type:"conversation.read",conversationId,userId,lastReadMessageId:targetMessageId,readAt:readAt.toISOString()},userId)}return{lastReadMessageId:targetMessageId,readAt}}async function editMessage(ctx,messageId,userId,content){if(!ctx.config.editingEnabled)throw new ChatError("disabled","Message editing is disabled");let tables=resolveChatTables(ctx),row=(await ctx.db.select().from(tables.messages).where(eq19(getCol(tables.messages,"id"),messageId)).limit(1))[0];if(!row||row.deletedAt)throw new ChatError("not_found","Message not found");if(String(row.senderId)!==userId)throw new ChatError("forbidden","You can only edit your own messages");let trimmed=content.trim();if(!trimmed)throw new ChatError("validation","Message content cannot be empty");if(trimmed.length>ctx.config.maxMessageLength)throw new ChatError("validation","Message exceeds the maximum length");let editedAt=new Date,updated=await ctx.db.update(tables.messages).set({content:trimmed,editedAt,updatedAt:editedAt}).where(eq19(getCol(tables.messages,"id"),messageId)).returning(),attachments=await loadAttachments(ctx,tables,[messageId]),message=mapMessage(updated[0],attachments.get(messageId)??[]),participants=await listParticipants(ctx,tables,String(row.conversationId));return deliverToParticipants(ctx,participants,{type:"message.updated",conversationId:String(row.conversationId),message}),message}async function deleteMessage(ctx,messageId,userId,asModerator=!1){if(!ctx.config.deletionEnabled&&!asModerator)throw new ChatError("disabled","Message deletion is disabled");let tables=resolveChatTables(ctx),row=(await ctx.db.select().from(tables.messages).where(eq19(getCol(tables.messages,"id"),messageId)).limit(1))[0];if(!row||row.deletedAt)throw new ChatError("not_found","Message not found");if(!asModerator&&String(row.senderId)!==userId)throw new ChatError("forbidden","You can only delete your own messages");let deletedAt=new Date,orphanedFiles=await ctx.db.transaction(async(tx)=>{if(await tx.update(tables.messages).set({content:null,deletedAt,updatedAt:deletedAt}).where(eq19(getCol(tables.messages,"id"),messageId)),!tables.attachments)return[];let attachmentRows=await tx.select().from(tables.attachments).where(eq19(getCol(tables.attachments,"messageId"),messageId));if(attachmentRows.length===0)return[];await tx.delete(tables.attachments).where(eq19(getCol(tables.attachments,"messageId"),messageId));let fileIds=[...new Set(attachmentRows.map((a)=>String(a.fileId)))];if(!tables.files||fileIds.length===0)return[];let stillLinked=await tx.select().from(tables.attachments).where(inArray6(getCol(tables.attachments,"fileId"),fileIds)),keep=new Set(stillLinked.map((a)=>String(a.fileId))),removable=fileIds.filter((id)=>!keep.has(id));if(removable.length===0)return[];let fileRows=await tx.select().from(tables.files).where(inArray6(getCol(tables.files,"id"),removable));return await tx.delete(tables.files).where(inArray6(getCol(tables.files,"id"),removable)),fileRows.filter((f)=>typeof f.path==="string"&&typeof f.name==="string").map((f)=>({path:String(f.path),name:String(f.name)}))});for(let file of orphanedFiles)if(await ctx.deleteStoredFile?.(file)===!1)ctx.logger.warn("[Chat] Attachment blob cleanup failed",{messageId,name:file.name});let participants=await listParticipants(ctx,tables,String(row.conversationId));deliverToParticipants(ctx,participants,{type:"message.deleted",conversationId:String(row.conversationId),messageId})}async function setTyping(ctx,conversationId,userId,isTyping=!0){if(!ctx.config.typingIndicators)return;let tables=resolveChatTables(ctx),participants=await listParticipants(ctx,tables,conversationId);if(!participants.some((p)=>p.userId===userId))throw new ChatError("forbidden","You are not a participant of this conversation");deliverToParticipants(ctx,participants,{type:"typing",conversationId,userId,isTyping},userId)}class ChatService{ctx;constructor(init){this.ctx={db:init.db,schemaTables:init.schemaTables,config:init.config,logger:init.logger,broadcaster:init.broadcaster??null,cdnBasePath:init.cdnBasePath??"/cdn",attachmentsAvailable:init.attachmentsAvailable??!1,deleteStoredFile:init.deleteStoredFile??null}}get config(){return this.ctx.config}getOrCreateDirect(userId,targetUserId){return getOrCreateDirect(this.ctx,{userId,targetUserId})}createGroup(params){return createGroup(this.ctx,params)}listConversations(userId,opts){return listConversations(this.ctx,{userId,limit:opts?.limit,offset:opts?.offset})}getConversation(conversationId,userId){return getConversation(this.ctx,conversationId,userId)}addParticipants(conversationId,actorId,userIds){return addParticipants(this.ctx,conversationId,actorId,userIds)}removeParticipant(conversationId,actorId,targetUserId){return removeParticipant(this.ctx,conversationId,actorId,targetUserId)}sendMessage(params){return sendMessage(this.ctx,params)}getMessages(params){return getMessages(this.ctx,params)}markRead(conversationId,userId,messageId){return markRead(this.ctx,conversationId,userId,messageId)}editMessage(messageId,userId,content){return editMessage(this.ctx,messageId,userId,content)}deleteMessage(messageId,userId,asModerator=!1){return deleteMessage(this.ctx,messageId,userId,asModerator)}setTyping(conversationId,userId,isTyping){return setTyping(this.ctx,conversationId,userId,isTyping)}}init_SystemCollector();init_lifecycle();init_Notification();var EXTEND_ALLOWED_KEYS=new Set(["table_name","extends","columns","indexes"]);function hasDbDefault(column){return column.default!==void 0||column.defaultRaw!==void 0||column.generatedAlwaysAs!==void 0||column.generatedAlwaysAsIdentity===!0||column.generatedByDefaultAsIdentity===!0}var AUTH_FEATURES=new Set(["authentication","authorization"]);function resolveEntities(systemTables,configEntities,options={}){let errors2=[],warnings=[],consumed=new Set,entities=[];for(let system of systemTables){let config=configEntities.find((c)=>c.table_name===system.table_name);if(!config){entities.push(system);continue}if(consumed.add(config.table_name),!config.extends){warnings.push(`[Schema] "${config.table_name}" is declared in config.entities AND ships as a system table. Using YOUR definition and skipping the built-in one. Add "extends": true to inherit the built-in columns and route policy instead.`),entities.push(config);continue}for(let key2 of Object.keys(config))if(!EXTEND_ALLOWED_KEYS.has(key2))warnings.push(`[Schema] "${config.table_name}" sets "${key2}" alongside "extends": true \u2014 ignored. `+"An extending entry inherits every table-level setting from the built-in definition.");if(options.enabledTableNames&&!options.enabledTableNames.has(system.table_name))errors2.push({code:"E5_FEATURE_DISABLED",table:system.table_name,message:`"${system.table_name}" is extended but its feature is disabled, so the table is never created. Enable the feature or remove the extending entry.`});if(options.consumerMode&&(system.feature_set??[]).some((f)=>AUTH_FEATURES.has(f)))errors2.push({code:"E3_CONSUMER_AUTH_TABLE",table:system.table_name,message:`"${system.table_name}" is an auth system table and cannot be extended in consumer mode \u2014 `+"the identity tables live in the IDP. Extending it would create a local copy here."});let builtInNames=new Set((system.columns??[]).map((c)=>c.name));if(system.add_base_columns!==!1)for(let name2 of options.baseColumnNames??[])builtInNames.add(name2);for(let column of config.columns??[]){if(builtInNames.has(column.name))errors2.push({code:"E1_COLUMN_COLLISION",table:system.table_name,column:column.name,message:`"${system.table_name}.${column.name}" already exists in the built-in definition. An extending entry may only ADD columns; rename yours.`});if(column.notNull===!0&&column.nullable!==!0&&!hasDbDefault(column))errors2.push({code:"E2_NOT_NULL_WITHOUT_DEFAULT",table:system.table_name,column:column.name,message:`"${system.table_name}.${column.name}" is notNull without a default. The framework writes this table from fixed-column inserts (register, invite, admin create-user, godmin seed, `+"tenant provisioning) that cannot supply it \u2014 every one of them would fail. Make it "+"nullable or give it a default."})}let merged={...system,columns:[...system.columns??[],...config.columns??[]],indexes:[...system.indexes??[],...config.indexes??[]]};entities.push(merged)}for(let config of configEntities){if(consumed.has(config.table_name))continue;if(config.extends){errors2.push({code:"E4_UNKNOWN_SYSTEM_TABLE",table:config.table_name,message:`"${config.table_name}" sets "extends": true but there is no system table with that name. Remove the flag to declare it as an ordinary entity.`});continue}entities.push(config)}return{entities,errors:errors2,warnings}}function resolveAuthType(pathname,auth){let at=(route)=>pathname===route||pathname.endsWith(route)||pathname.includes(`${route}/`);if(at(auth?.login?.route||"/auth/login"))return"login";if(at(auth?.register?.route||"/auth/register"))return"register";if(at(auth?.passwordReset?.route||"/auth/password-reset"))return"passwordReset";if(at(auth?.magicLink?.route||"/auth/magic-link"))return"magicLink";if(at(auth?.invite?.route||"/auth/invite"))return"other";if(at("/sessions/approve")||at("/sessions/reject"))return"login";return}init_Logger2();var METHOD_MAP={GET:["GET"],POST:["POST"],PUT:["PUT"],DELETE:["DELETE"],PATCH:["PATCH"],TOGGLE:["PATCH"],VERIFICATION:["POST"]};function buildAuthPublicRoutes(config,basePath){let routes=[],auth=config.authentication;if(!auth)return routes;if(auth.login?.enabled&&auth.login?.isPublic)routes.push({path:auth.login.route||`${basePath}/auth/login`,method:"POST",source:"auth"});if(auth.register?.enabled&&auth.register?.isPublic)routes.push({path:auth.register.route||`${basePath}/auth/register`,method:"POST",source:"auth"});if(auth.logout?.enabled&&auth.logout?.isPublic)routes.push({path:auth.logout.route||`${basePath}/auth/logout`,method:"POST",source:"auth"});if(auth.refresh?.enabled&&auth.refresh?.isPublic)routes.push({path:auth.refresh.route||`${basePath}/auth/refresh`,method:"POST",source:"auth"});if(auth.admin?.impersonate?.enabled!==!1)routes.push({path:`${basePath}/auth/admin/impersonate/stop`,method:"POST",source:"system"});if(auth.passwordReset?.enabled&&auth.passwordReset?.isPublic){let baseRoute=auth.passwordReset.route||`${basePath}/auth/password-reset`;routes.push({path:`${baseRoute}/request`,method:"POST",source:"auth"},{path:`${baseRoute}/confirm`,method:"POST",source:"auth"})}if(auth.passwordChange?.enabled&&auth.passwordChange?.isPublic)routes.push({path:auth.passwordChange.route||`${basePath}/auth/password-change`,method:"POST",source:"auth"});if(auth.magicLink?.enabled&&auth.magicLink?.isPublic)routes.push({path:auth.magicLink.route||`${basePath}/auth/magic-link`,method:"POST",source:"auth"},{path:auth.magicLink.verifyRoute||`${basePath}/auth/magic-link/verify`,method:"GET",source:"auth"});if(auth.register?.enabled&&auth.register?.emailVerification?.enabled)routes.push({path:`${basePath}/verify-email`,method:"GET",source:"auth"},{path:`${basePath}/resend-verification`,method:"POST",source:"auth"});if(auth.invite?.enabled&&auth.invite?.isPublic)routes.push({path:auth.invite.route||`${basePath}/auth/invite`,method:"POST",source:"auth"});if(auth.invite?.enabled){let inviteRoute=auth.invite.route||`${basePath}/auth/invite`;routes.push({path:`${inviteRoute}/verify`,method:"POST",source:"auth"})}if(auth.passwordSet?.enabled)routes.push({path:auth.passwordSet.route||`${basePath}/auth/password-set`,method:"POST",source:"auth"});if(auth.webauthn?.enabled){let webauthnRoute=auth.webauthn.route||`${basePath}/auth/webauthn`;routes.push({path:`${webauthnRoute}/authenticate/options`,method:"POST",source:"auth"},{path:`${webauthnRoute}/authenticate/verify`,method:"POST",source:"auth"})}if(auth.captcha?.enabled&&auth.captcha?.isPublic){let baseRoute=auth.captcha.route||`${basePath}/auth/captcha`;routes.push({path:`${baseRoute}/generate`,method:"GET",source:"auth"},{path:`${baseRoute}/validate`,method:"POST",source:"auth"})}if(auth.sessions?.enabled){let sessionsRoute=auth.sessions.route||`${basePath}/auth/sessions`;routes.push({path:`${sessionsRoute}/approve`,method:"POST",source:"auth"},{path:`${sessionsRoute}/reject`,method:"POST",source:"auth"},{path:`${sessionsRoute}/approve-page`,method:"GET",source:"auth"},{path:`${sessionsRoute}/reject-page`,method:"GET",source:"auth"},{path:`${sessionsRoute}/approval-status`,method:"GET",source:"auth"})}if(auth.oauth?.enabled){let oauthBase=auth.oauth.basePath||`${basePath}/auth/oauth`,knownProviders=["google","github","microsoft","discord","facebook","twitter","apple","custom"];routes.push({path:`${oauthBase}/providers`,method:"GET",source:"auth"});for(let provider of knownProviders)routes.push({path:`${oauthBase}/${provider}`,method:"GET",source:"auth"},{path:`${oauthBase}/${provider}/callback`,method:"GET",source:"auth"})}return routes}function buildEntityPublicRoutes(entities,basePath,_schema){let routes=[];for(let entity of entities){if(!entity.is_public)continue;let camelName=entity.table_name.replace(/_([a-z])/g,(_,l)=>l.toUpperCase()),entityPath=`${basePath}/${camelName}`;for(let[nucleusMethod,isPublic]of Object.entries(entity.is_public)){if(!isPublic)continue;let httpMethods=METHOD_MAP[nucleusMethod];if(!httpMethods)continue;for(let method of httpMethods)if(method==="GET")routes.push({path:entityPath,method:"GET",source:"entity"}),routes.push({path:`${entityPath}/:id`,method:"GET",source:"entity"});else if(method==="POST")routes.push({path:entityPath,method:"POST",source:"entity"});else if(method==="PUT"||method==="PATCH")routes.push({path:`${entityPath}/:id`,method,source:"entity"});else if(method==="DELETE")routes.push({path:`${entityPath}/:id`,method:"DELETE",source:"entity"})}}return routes}function buildSystemTablePublicRoutes(systemTables,basePath,schema){return buildEntityPublicRoutes(systemTables,basePath,schema)}function buildPublicRoutes(config,systemTables,basePath="",schema="public"){let authRoutes=buildAuthPublicRoutes(config,basePath),entityRoutes=buildEntityPublicRoutes(config.entities||[],basePath,schema),systemRoutes=buildSystemTablePublicRoutes(systemTables,basePath,schema),pubsubRoutes=[];if(config.pubsub?.enabled){let pubsubBasePath=config.pubsub.basePath||"/subs",wsPath=config.pubsub.wsPath||"/api/events/subscribe";pubsubRoutes.push({path:`${pubsubBasePath}/:topic`,method:"POST",source:"system"},{path:wsPath,method:"GET",source:"system"})}let paymentRoutes=[];if(config.payment?.enabled){let paymentBasePath=config.payment.basePath||"/payment";paymentRoutes.push({path:`${paymentBasePath}/callback`,method:"POST",source:"system"},{path:`${paymentBasePath}/callback`,method:"OPTIONS",source:"system"},{path:`${paymentBasePath}/bin-query`,method:"POST",source:"system"},{path:`${paymentBasePath}/webhook`,method:"POST",source:"system"})}let discoveryRoutes=[];if(config.authorization?.endpointDiscovery?.enabled){let manifestAuth={bypassHeaders:["x-discovery-token"]};discoveryRoutes.push({path:"/authorization/route-manifest",method:"GET",source:"system",authenticateWhenCredentialed:manifestAuth},{path:"/authorization/route-manifest",method:"OPTIONS",source:"system"},{path:"/authorization/role-claims-manifest",method:"GET",source:"system",authenticateWhenCredentialed:manifestAuth},{path:"/authorization/role-claims-manifest",method:"OPTIONS",source:"system"})}let domainRoutes=[];if(config.domains?.enabled){let domainsBasePath=config.domains.basePath||"/domains";domainRoutes.push({path:`${basePath}${domainsBasePath}/resolve`,method:"GET",source:"system"})}let tenantRoutes=[];if(config.database?.isMultiTenant)tenantRoutes.push({path:`${basePath}/tenants/check-subdomain/:subdomain`,method:"GET",source:"system"}),tenantRoutes.push({path:`${basePath}/tenants/self-signup`,method:"POST",source:"system"}),tenantRoutes.push({path:`${basePath}/tenants/refresh`,method:"POST",source:"system"});let customRoutes=[{path:"/nucleus-core",method:"GET",source:"custom"},{path:"/public",method:"GET",source:"custom"},{path:"/docs",method:"GET",source:"custom"},{path:"/docs/json",method:"GET",source:"custom"},{path:"/swagger",method:"GET",source:"custom"},{path:"/swagger/json",method:"GET",source:"custom"}],configPublicPaths=config.authorization?.publicPaths||[],ALL_PUBLIC_METHODS=["GET","HEAD","POST","PUT","PATCH","DELETE","OPTIONS"],withHead=(path,source)=>[{path,method:"HEAD",source}],configPublicRoutes=configPublicPaths.flatMap((entry)=>{let trimmed=entry.trim(),qualified=trimmed.match(/^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS)\s+(.+)$/i);if(qualified?.[1]&&qualified[2]){let method=qualified[1].toUpperCase(),path=qualified[2].trim(),routes=[{path,method,source:"custom"}];if(method!=="OPTIONS")routes.push({path,method:"OPTIONS",source:"custom"});if(method==="GET")routes.push(...withHead(path,"custom"));return routes}if(trimmed.startsWith("/auth/"))return ALL_PUBLIC_METHODS.map((method)=>({path:trimmed,method,source:"custom"}));return logger.warn(`[Security] publicPaths entry "${trimmed}" is unqualified \u2014 exposing GET + HEAD + OPTIONS only. To make a write method public, use the explicit form, e.g. "POST ${trimmed}".`),[{path:trimmed,method:"GET",source:"custom"},...withHead(trimmed,"custom"),{path:trimmed,method:"OPTIONS",source:"custom"}]});return[...authRoutes,...entityRoutes,...systemRoutes,...pubsubRoutes,...paymentRoutes,...discoveryRoutes,...domainRoutes,...tenantRoutes,...customRoutes,...configPublicRoutes]}function isPublicRoute(publicRoutes,path,method,caller){return findPublicRoute(publicRoutes,path,method,caller)!==void 0}function findPublicRoute(publicRoutes,path,method,caller){if(/\/\/|\\|%2f|%2e|%5c/i.test(path))return;let normalizedPath=path.replace(/\/$/,""),normalizedMethod=method.toUpperCase();for(let route of publicRoutes){if(route.method!==normalizedMethod)continue;if(matchPath(route.path,normalizedPath)){let opt=route.authenticateWhenCredentialed;if(opt&&caller){if(!(opt.bypassHeaders??[]).some((name2)=>!!caller.headers.get(name2))&&caller.credentialed())continue}return route}}return}function matchPath(pattern,path){if(pattern===path)return!0;let patternParts=pattern.split("/").filter(Boolean),pathParts=path.split("/").filter(Boolean);if(patternParts.length!==pathParts.length)return!1;for(let i=0;i<patternParts.length;i++){let patternPart=patternParts[i],pathPart=pathParts[i];if(patternPart?.startsWith(":"))continue;if(patternPart!==pathPart)return!1}return!0}init_routeCollector();import{eq as eq22}from"drizzle-orm";init_requireGodmin();import{eq as eq21}from"drizzle-orm";var col7=(table,name2)=>{let tableRecord=table,snakeCase=name2.replace(/([A-Z])/g,"_$1").toLowerCase();return tableRecord[name2]||tableRecord[snakeCase]};async function requireGodmin(db,usersTable,userId){let user=(await db.select().from(usersTable).where(eq21(col7(usersTable,"id"),userId)).limit(1))[0];if(!user?.isGod)return!1;return accountStateRefusal(user)===null}function validatePassword(pwd,policy){let errors2=[],minLen=policy?.minLength??8,maxLen=policy?.maxLength??128,needUpper=policy?.requireUppercase??!0,needLower=policy?.requireLowercase??!0,needDigit=policy?.requireNumber??!0,needSpecial=policy?.requireSpecialChar??!1;if(pwd.length<minLen)errors2.push(`Password must be at least ${minLen} characters`);if(pwd.length>maxLen)errors2.push(`Password must be at most ${maxLen} characters`);if(needUpper&&!/[A-Z]/.test(pwd))errors2.push("Password must contain uppercase letter");if(needLower&&!/[a-z]/.test(pwd))errors2.push("Password must contain lowercase letter");if(needDigit&&!/[0-9]/.test(pwd))errors2.push("Password must contain a number");if(needSpecial&&!/[!@#$%^&*()_+\-=[\]{};':"\\|,.<>/?]/.test(pwd))errors2.push("Password must contain a special character");return{valid:errors2.length===0,errors:errors2}}var handleActivateUsers=(db,usersTable,logger2)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let result=await db.update(usersTable).set({isLocked:!1,lockedUntil:null,failedLoginAttempts:0,updatedAt:new Date}).where(eq22(col7(usersTable,"cohortId"),ctx.params.id)).returning();return logger2.audit({entityName:"user_cohorts",entityId:ctx.params.id,operation:"COHORT_ACTIVATE_USERS",userId,summary:`Activated ${result.length} users in cohort`}),{success:!0,data:{affected:result.length}}};init_assignDefaultRole();init_utils6();import{count,eq as eq24,inArray as inArray7}from"drizzle-orm";var handleBulkCreateUsers=(config,logger2)=>{let{db,usersTable,cohortsTable,rolesTable,userRolesTable,profilesTable}=config;return async(ctx)=>{if(!db||!usersTable||!cohortsTable)return ctx.set.status=500,{success:!1,message:"Server misconfigured"};let callerId=ctx.request.headers.get("x-user-id");if(!callerId||!await requireGodmin(db,usersTable,callerId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let cohortId=ctx.params.id;if((await db.select().from(cohortsTable).where(eq24(col7(cohortsTable,"id"),cohortId)).limit(1)).length===0)return ctx.set.status=404,{success:!1,message:"Cohort not found"};let{users:explicitUsers,emailPrefix,emailDomain,sharedPassword,count:userCount,roleIds}=ctx.body,userList=[];if(explicitUsers&&explicitUsers.length>0)for(let u of explicitUsers)userList.push({email:u.email.toLowerCase().trim(),password:u.password,firstName:u.profile?.firstName,lastName:u.profile?.lastName});else if(emailPrefix&&emailDomain&&sharedPassword&&userCount){let padLen=String(userCount).length;for(let i=1;i<=userCount;i++){let paddedNum=String(i).padStart(padLen,"0");userList.push({email:`${emailPrefix}-${paddedNum}@${emailDomain}`.toLowerCase(),password:sharedPassword})}}else return ctx.set.status=400,{success:!1,message:'Provide either "users" array or "emailPrefix" + "emailDomain" + "sharedPassword" + "count"'};if(userList.length>500)return ctx.set.status=400,{success:!1,message:"Maximum 500 users per batch"};for(let entry of userList){let validation=validatePassword(entry.password,config.passwordPolicy);if(!validation.valid)return ctx.set.status=400,{success:!1,message:`Password too weak for ${entry.email}`,errors:validation.errors}}let emails=userList.map((u)=>u.email),existingRows=await db.select({email:col7(usersTable,"email")}).from(usersTable).where(inArray7(col7(usersTable,"email"),emails)),existingEmails=new Set(existingRows.map((r)=>String(r.email).toLowerCase())),created=[],skipped=[],now=new Date;for(let entry of userList){if(existingEmails.has(entry.email)){skipped.push(entry.email);continue}let hashedPw=await hashPassword(entry.password),newUser=(await db.insert(usersTable).values({email:entry.email,password:hashedPw,emailVerified:!0,verifiedAt:now,isLocked:!1,cohortId,createdAt:now,updatedAt:now}).returning())[0];if(!newUser)continue;let newUserId=String(newUser.id);if(created.push({id:newUserId,email:entry.email,password:entry.password}),roleIds&&roleIds.length>0&&rolesTable&&userRolesTable){let validIds=(await db.select({id:col7(rolesTable,"id")}).from(rolesTable).where(inArray7(col7(rolesTable,"id"),roleIds))).map((r)=>String(r.id));if(validIds.length>0)await db.insert(userRolesTable).values(validIds.map((roleId)=>({userId:newUserId,roleId})))}else{let cohortDefaultRoles=resolveDefaultRoleNames(config);if(cohortDefaultRoles.length>0)await assignDefaultRoles({db,userId:newUserId,roleNames:cohortDefaultRoles,rolesTable,userRolesTable,logger:logger2})}if((entry.firstName||entry.lastName)&&profilesTable)await db.insert(profilesTable).values({userId:newUserId,firstName:entry.firstName??null,lastName:entry.lastName??null,createdAt:now,updatedAt:now}).catch((err)=>{logger2.warn("[Cohort] Failed to create profile for user",{userId:newUserId,error:err.message})})}let countResult=await db.select({count:count()}).from(usersTable).where(eq24(col7(usersTable,"cohortId"),cohortId)),totalUsers=Number(countResult[0]?.count)||0;return await db.update(cohortsTable).set({userCount:totalUsers,updatedAt:new Date}).where(eq24(col7(cohortsTable,"id"),cohortId)),logger2.audit({entityName:"user_cohorts",entityId:cohortId,operation:"COHORT_BULK_CREATE",userId:callerId,summary:`Bulk created ${created.length} users in cohort (${skipped.length} skipped)`}),{success:!0,data:{created:created.length,skipped:skipped.length,skippedEmails:skipped,users:created}}}};var handleCreateCohort=(db,usersTable,cohortsTable,logger2)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let{name:name2,description,expiresAt,metadata}=ctx.body,now=new Date,inserted=await db.insert(cohortsTable).values({name:name2,description:description??null,createdBy:userId,expiresAt:expiresAt?new Date(expiresAt):null,userCount:0,metadata:metadata??{},createdAt:now,updatedAt:now}).returning();return logger2.audit({entityName:"user_cohorts",entityId:inserted[0]?.id,operation:"COHORT_CREATE",userId,summary:`Created cohort "${name2}"`}),{success:!0,data:inserted[0]}};init_revokeUserSessions();import{eq as eq25}from"drizzle-orm";var handleDeactivateUsers=(db,usersTable,logger2,sessionsTable)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let result=await db.update(usersTable).set({isLocked:!0,updatedAt:new Date}).where(eq25(col7(usersTable,"cohortId"),ctx.params.id)).returning(),signedOut=await revokeUserSessions({db,sessionsTable,onError:(error)=>logger2.error("Cohort sessions could not be revoked after deactivating",{error,cohortId:ctx.params.id})},result.map((row)=>String(row.id)));return logger2.audit({entityName:"user_cohorts",entityId:ctx.params.id,operation:"COHORT_DEACTIVATE_USERS",userId,summary:`Deactivated ${result.length} users in cohort, ending ${signedOut} session(s)`}),{success:!0,data:{affected:result.length,signedOut}}};import{eq as eq26,inArray as inArray10}from"drizzle-orm";var handleDeleteUsers=(db,usersTable,cohortsTable,userRolesTable,profilesTable,logger2)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let userIds=(await db.select({id:col7(usersTable,"id")}).from(usersTable).where(eq26(col7(usersTable,"cohortId"),ctx.params.id))).map((u)=>String(u.id));if(userIds.length>0){if(userRolesTable)await db.delete(userRolesTable).where(inArray10(col7(userRolesTable,"userId"),userIds));if(profilesTable)await db.delete(profilesTable).where(inArray10(col7(profilesTable,"userId"),userIds));await db.delete(usersTable).where(inArray10(col7(usersTable,"id"),userIds))}return await db.update(cohortsTable).set({userCount:0,updatedAt:new Date}).where(eq26(col7(cohortsTable,"id"),ctx.params.id)),logger2.audit({entityName:"user_cohorts",entityId:ctx.params.id,operation:"COHORT_DELETE_USERS",userId,summary:`Deleted ${userIds.length} users from cohort`}),{success:!0,data:{deleted:userIds.length}}};import{eq as eq27}from"drizzle-orm";var handleGetCohort=(db,usersTable,cohortsTable)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let rows=await db.select().from(cohortsTable).where(eq27(col7(cohortsTable,"id"),ctx.params.id)).limit(1);if(rows.length===0)return ctx.set.status=404,{success:!1,message:"Cohort not found"};let userRows=await db.select().from(usersTable).where(eq27(col7(usersTable,"cohortId"),ctx.params.id));return{success:!0,data:{...rows[0],users:userRows}}};import{eq as eq28}from"drizzle-orm";var csvCell=(value)=>{let s=value==null?"":String(value);if(/^[=+\-@\t\r]/.test(s))s=`'${s}`;if(/[",\n\r]/.test(s))s=`"${s.replace(/"/g,'""')}"`;return s},handleExportUsers=(db,usersTable)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let userRows=await db.select().from(usersTable).where(eq28(col7(usersTable,"cohortId"),ctx.params.id)),lines=["email,status,locked,created_at"];for(let row of userRows){let u=row;lines.push([csvCell(u.email),csvCell(u.isActive?"active":"inactive"),csvCell(u.isLocked?"yes":"no"),csvCell(u.createdAt)].join(","))}return ctx.set.headers["content-type"]="text/csv",ctx.set.headers["content-disposition"]=`attachment; filename="cohort-${ctx.params.id}-users.csv"`,lines.join(`
 `)};var handleListCohorts=(db,usersTable,cohortsTable)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let rows=await db.select().from(cohortsTable);return{success:!0,data:{items:rows,meta:{totalItems:rows.length}}}};import{eq as eq29}from"drizzle-orm";var handleDeleteCohort=(db,usersTable,cohortsTable,logger2)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};return await db.update(usersTable).set({cohortId:null,updatedAt:new Date}).where(eq29(col7(usersTable,"cohortId"),ctx.params.id)),await db.delete(cohortsTable).where(eq29(col7(cohortsTable,"id"),ctx.params.id)),logger2.audit({entityName:"user_cohorts",entityId:ctx.params.id,operation:"COHORT_DELETE",userId,summary:`Deleted cohort ${ctx.params.id}`}),{success:!0,data:null}};import{eq as eq30}from"drizzle-orm";var handleUpdateCohort=(db,usersTable,cohortsTable)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let updates={updatedAt:new Date};if(ctx.body.name!==void 0)updates.name=ctx.body.name;if(ctx.body.description!==void 0)updates.description=ctx.body.description;if(ctx.body.expiresAt!==void 0)updates.expiresAt=ctx.body.expiresAt?new Date(ctx.body.expiresAt):null;if(ctx.body.metadata!==void 0)updates.metadata=ctx.body.metadata;if(ctx.body.isActive!==void 0)updates.isActive=ctx.body.isActive;let updated=await db.update(cohortsTable).set(updates).where(eq30(col7(cohortsTable,"id"),ctx.params.id)).returning();if(updated.length===0)return ctx.set.status=404,{success:!1,message:"Cohort not found"};return{success:!0,data:updated[0]}};init_esm3();var CohortBodySchema=Type.Object({name:Type.String({minLength:1,maxLength:255}),description:Type.Optional(Type.String()),expiresAt:Type.Optional(Type.String()),metadata:Type.Optional(Type.Record(Type.String(),Type.Unknown()))}),CohortUpdateSchema=Type.Object({name:Type.Optional(Type.String({minLength:1,maxLength:255})),description:Type.Optional(Type.String()),expiresAt:Type.Optional(Type.Union([Type.String(),Type.Null()])),metadata:Type.Optional(Type.Record(Type.String(),Type.Unknown())),isActive:Type.Optional(Type.Boolean())}),BulkCreateUserItem=Type.Object({email:Type.String({format:"email"}),password:Type.String({minLength:8}),profile:Type.Optional(Type.Object({firstName:Type.Optional(Type.String()),lastName:Type.Optional(Type.String())}))}),BulkCreateSchema=Type.Object({users:Type.Optional(Type.Array(BulkCreateUserItem)),emailPrefix:Type.Optional(Type.String()),emailDomain:Type.Optional(Type.String()),sharedPassword:Type.Optional(Type.String({minLength:8})),count:Type.Optional(Type.Integer({minimum:1,maximum:500})),roleIds:Type.Optional(Type.Array(Type.String()))});function createCohortRoutes(config){let{db,logger:logger2,cohortsTable,usersTable,userRolesTable,profilesTable,basePath}=config;if(!db||!cohortsTable||!usersTable)return logger2.warn("[Cohort] Skipped \u2014 missing tables",{hasDb:!!db,hasCohortsTable:!!cohortsTable,hasUsersTable:!!usersTable}),collectRoutes();let declared=[defineRoute({method:"GET",path:"/",handler:handleListCohorts(db,usersTable,cohortsTable)}),defineRoute({method:"GET",path:"/:id",handler:handleGetCohort(db,usersTable,cohortsTable)}),defineRoute({method:"POST",path:"/",body:CohortBodySchema,handler:handleCreateCohort(db,usersTable,cohortsTable,logger2)}),defineRoute({method:"PATCH",path:"/:id",body:CohortUpdateSchema,handler:handleUpdateCohort(db,usersTable,cohortsTable)}),defineRoute({method:"DELETE",path:"/:id",handler:handleDeleteCohort(db,usersTable,cohortsTable,logger2)}),defineRoute({method:"POST",path:"/:id/bulk-create",body:BulkCreateSchema,handler:handleBulkCreateUsers(config,logger2)}),defineRoute({method:"POST",path:"/:id/deactivate-users",handler:handleDeactivateUsers(db,usersTable,logger2,config.sessionsTable??null)}),defineRoute({method:"POST",path:"/:id/activate-users",handler:handleActivateUsers(db,usersTable,logger2)}),defineRoute({method:"POST",path:"/:id/delete-users",handler:handleDeleteUsers(db,usersTable,cohortsTable,userRolesTable,profilesTable,logger2)}),defineRoute({method:"GET",path:"/:id/export",handler:handleExportUsers(db,usersTable)})];return collectRoutes([{prefix:basePath,routes:declared}])}init_deviceInfo();function shouldNotifyDevice(question){if(question.isImpersonationLogin)return!1;if(!question.emailAvailable)return!1;if(question.requiresApproval)return!0;if(question.trustScore<question.lowTrustThreshold)return!0;return question.notifyOnNewDevice&&question.isNewDevice}init_routeCollector();init_storage2();init_esm3();init_routeCollector();init_Authorization();function getUserId(request){return request.headers.get("x-user-id")}function isChatModerator(request,moderatorRoles){let roles=decodeHeaderList(request.headers.get("x-user-roles"));if(roles.includes(GODMIN_ROLE_NAME))return!0;if(moderatorRoles.length===0)return!1;let allowed=new Set(moderatorRoles.map((role)=>role.toLowerCase()));return roles.some((role)=>allowed.has(role.toLowerCase()))}function chatErrorStatus(code){switch(code){case"forbidden":return 403;case"not_found":return 404;case"validation":return 400;case"conflict":return 409;case"disabled":return 409;default:return 400}}async function guard3(set2,logger2,fn){try{return{success:!0,data:await fn()}}catch(err){if(err instanceof ChatError)return set2.status=chatErrorStatus(err.code),{success:!1,message:err.message};return logger2.error("[Chat] Unhandled route error",{error:err instanceof Error?err.message:String(err)}),set2.status=500,{success:!1,message:"Internal server error"}}}function unauthorized(set2){return set2.status=401,{success:!1,message:"Authentication required"}}function createConversationRoutes(deps){let{logger:logger2,getService}=deps,declared=[defineRoute({method:"GET",path:"/conversations",handler:({request,query,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request);return guard3(set2,logger2,()=>service.listConversations(userId,{limit:query.limit?Number(query.limit):void 0,offset:query.offset?Number(query.offset):void 0}))},query:Type.Object({limit:Type.Optional(Type.String()),offset:Type.Optional(Type.String())}),detail:{tags:["Chat"],summary:"List my conversations"}}),defineRoute({method:"POST",path:"/conversations",handler:({request,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),input=body;return guard3(set2,logger2,()=>{if(input.type==="group"){if(!input.title)throw new ChatError("validation","A group title is required");return service.createGroup({creatorId:userId,title:input.title,description:input.description,avatarFileId:input.avatarFileId,participantIds:input.participantIds??[]})}if(!input.targetUserId)throw new ChatError("validation","targetUserId is required for a direct conversation");return service.getOrCreateDirect(userId,input.targetUserId)})},body:Type.Object({type:Type.Optional(Type.Union([Type.Literal("direct"),Type.Literal("group")])),targetUserId:Type.Optional(Type.String()),title:Type.Optional(Type.String()),description:Type.Optional(Type.String()),avatarFileId:Type.Optional(Type.String()),participantIds:Type.Optional(Type.Array(Type.String()))}),detail:{tags:["Chat"],summary:"Create or open a conversation"}}),defineRoute({method:"GET",path:"/conversations/:id",handler:({request,params,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request);return guard3(set2,logger2,()=>service.getConversation(params.id,userId))},params:Type.Object({id:Type.String()}),detail:{tags:["Chat"],summary:"Get a conversation"}}),defineRoute({method:"POST",path:"/conversations/:id/participants",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),{userIds}=body;return guard3(set2,logger2,()=>service.addParticipants(params.id,userId,userIds))},params:Type.Object({id:Type.String()}),body:Type.Object({userIds:Type.Array(Type.String())}),detail:{tags:["Chat"],summary:"Add group participants"}}),defineRoute({method:"DELETE",path:"/conversations/:id/participants/:userId",handler:({request,params,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request);return guard3(set2,logger2,async()=>{return await service.removeParticipant(params.id,userId,params.userId),{removed:params.userId}})},params:Type.Object({id:Type.String(),userId:Type.String()}),detail:{tags:["Chat"],summary:"Remove a participant / leave group"}})];return collectRoutes([{prefix:deps.config.basePath,routes:declared}])}init_esm3();init_esm3();function FileSchema(){return Type.Object({size:Type.Number(),type:Type.String()},{format:"binary",additionalProperties:!0})}function FilesSchema(){return Type.Union([FileSchema(),Type.Array(FileSchema())])}init_routeCollector();init_storage2();var CONTENT_TYPE_SCHEMA=Type.Optional(Type.Union([Type.Literal("text"),Type.Literal("image"),Type.Literal("file"),Type.Literal("video"),Type.Literal("audio")]));function createMessageRoutes(deps){let{logger:logger2,getService}=deps,declared=[defineRoute({method:"GET",path:"/conversations/:id/messages",handler:({request,params,query,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request);return guard3(set2,logger2,()=>service.getMessages({conversationId:params.id,userId,limit:query.limit?Number(query.limit):void 0,before:query.before||void 0}))},params:Type.Object({id:Type.String()}),query:Type.Object({limit:Type.Optional(Type.String()),before:Type.Optional(Type.String())}),detail:{tags:["Chat"],summary:"Get conversation messages (newest first)"}}),defineRoute({method:"POST",path:"/conversations/:id/messages",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),input=body;return guard3(set2,logger2,()=>service.sendMessage({conversationId:params.id,senderId:userId,content:input.content,contentType:input.contentType,replyToId:input.replyToId,clientMessageId:input.clientMessageId,attachments:input.attachmentIds?.map((fileId)=>({fileId})),metadata:input.metadata}))},params:Type.Object({id:Type.String()}),body:Type.Object({content:Type.Optional(Type.String()),contentType:CONTENT_TYPE_SCHEMA,replyToId:Type.Optional(Type.String()),clientMessageId:Type.Optional(Type.String()),attachmentIds:Type.Optional(Type.Array(Type.String())),metadata:Type.Optional(Type.Any())}),detail:{tags:["Chat"],summary:"Send a message (link pre-uploaded attachments)"}}),defineRoute({method:"POST",path:"/conversations/:id/messages/upload",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);if(!deps.attachmentsAvailable)return set2.status=409,{success:!1,message:"File attachments require storage and CDN to be enabled"};let{service,schemaTables}=getService(request);return guard3(set2,logger2,async()=>{let filesTable=resolveSchemaTable(schemaTables,"files",logger2);if(!filesTable)throw new ChatError("disabled","Files table unavailable in this schema");let{data,files}=parseFormDataBody(body,deps.storageConfig);if(files.length===0)throw new ChatError("validation","At least one file is required");let{records,failed}=await persistUploadedFiles({db:deps.db,filesTable,files,storageConfig:deps.storageConfig,subFolder:"chat",userId});if(records.length===0)throw new ChatError("validation",failed[0]?.error??"File upload failed");if(deps.cdnMedia)scheduleUploadMediaProcessing(records,{storagePath:deps.storageConfig.basePath,media:deps.cdnMedia,logger:logger2});let content=typeof data.content==="string"?data.content:void 0,replyToId=typeof data.replyToId==="string"?data.replyToId:void 0,clientMessageId=typeof data.clientMessageId==="string"?data.clientMessageId:void 0;return service.sendMessage({conversationId:params.id,senderId:userId,content,replyToId,clientMessageId,attachments:records.map((record3)=>({fileId:record3.id,originalName:record3.originalName,mimeType:record3.mimeType,size:record3.size}))})})},type:"formdata",params:Type.Object({id:Type.String()}),body:Type.Object({[deps.storageConfig.formData.dataField]:Type.Optional(Type.Union([Type.String(),Type.Any()])),[deps.storageConfig.formData.filesField]:Type.Optional(FilesSchema())}),detail:{tags:["Chat"],summary:"Send a message with uploaded file attachments"}}),defineRoute({method:"POST",path:"/conversations/:id/read",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),{messageId}=body;return guard3(set2,logger2,()=>service.markRead(params.id,userId,messageId))},params:Type.Object({id:Type.String()}),body:Type.Object({messageId:Type.Optional(Type.String())}),detail:{tags:["Chat"],summary:"Mark a conversation as read"}}),defineRoute({method:"POST",path:"/conversations/:id/typing",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),{isTyping}=body;return guard3(set2,logger2,async()=>{return await service.setTyping(params.id,userId,isTyping??!0),{ok:!0}})},params:Type.Object({id:Type.String()}),body:Type.Object({isTyping:Type.Optional(Type.Boolean())}),detail:{tags:["Chat"],summary:"Broadcast a typing indicator"}}),defineRoute({method:"PATCH",path:"/messages/:id",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),{content}=body;return guard3(set2,logger2,()=>service.editMessage(params.id,userId,content))},params:Type.Object({id:Type.String()}),body:Type.Object({content:Type.String()}),detail:{tags:["Chat"],summary:"Edit a message"}}),defineRoute({method:"DELETE",path:"/messages/:id",handler:({request,params,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),asModerator=isChatModerator(request,deps.config.moderatorRoles??[]);return guard3(set2,logger2,async()=>{if(await service.deleteMessage(params.id,userId,asModerator),asModerator)logger2.warn("[CHAT] Message deleted by a moderator",{actorId:userId,messageId:params.id});return{deleted:params.id}})},params:Type.Object({id:Type.String()}),detail:{tags:["Chat"],summary:"Delete a message",description:"Sender-only, unless the caller is godmin or holds a role from chat.moderatorRoles \u2014 then any message, and `deletionEnabled` does not apply."}})];return collectRoutes([{prefix:deps.config.basePath,routes:declared}])}function createChatRoutes(routeConfig){let{db,schemaTables,config,logger:logger2,broadcaster,tenantRegistry,storageConfig,attachmentsAvailable,cdnBasePath,cdnMedia}=routeConfig,buildService=(tables)=>new ChatService({db,schemaTables:tables,config,logger:logger2,broadcaster,cdnBasePath,attachmentsAvailable,deleteStoredFile:(file)=>deleteFile(file.path,file.name,storageConfig.basePath)}),defaultService=buildService(schemaTables),deps={db,config,logger:logger2,storageConfig,attachmentsAvailable,getService:(request)=>{if(!tenantRegistry)return{service:defaultService,schemaTables};let schemaName=request.headers.get("x-tenant-schema");if(!schemaName)return{service:defaultService,schemaTables};let ctx=tenantRegistry.getSchemaContext(schemaName);if(!ctx)return{service:defaultService,schemaTables};return{service:buildService(ctx.schemaTables),schemaTables:ctx.schemaTables}},cdnMedia},routes=collectRoutes();return routes.use(createConversationRoutes(deps)),routes.use(createMessageRoutes(deps)),logger2.info(`[Chat] Routes registered at ${config.basePath}`,{attachmentsAvailable,groupsEnabled:config.groupsEnabled}),{routes,chatService:defaultService}}init_esm3();init_routeCollector();init_godminGuard();init_helpers4();function createConfigRoutes(routeConfig){let{logger:logger2,resolvedOptions,configFilePath,basePath,onConfigUpdate,db,schemaTables,getRedis}=routeConfig,guard4=createGodminGuard({logger:logger2,db:db??null,schemaTables,area:"config management"});logger2.info(`[ConfigManagement] Routes enabled at ${basePath}`);let declared=[defineRoute({method:"GET",path:"/",handler:()=>{let configCopy=JSON.parse(JSON.stringify(resolvedOptions));return{isSuccess:!0,message:"Current running configuration",data:{config:maskSensitiveFields(configCopy),configFilePath,sections:buildSectionsMeta(resolvedOptions)}}},detail:{tags:["Config Management"],summary:"Get full running configuration",description:"Returns the full running configuration with sensitive fields masked."}}),defineRoute({method:"GET",path:"/sections",handler:()=>({isSuccess:!0,message:"Config section metadata",data:{sections:buildSectionsMeta(resolvedOptions)}}),detail:{tags:["Config Management"],summary:"List all config sections with metadata",description:"Section list is derived at runtime from the config object \u2014 no hardcoding."}}),defineRoute({method:"GET",path:"/env",handler:()=>{let configCopy=JSON.parse(JSON.stringify(resolvedOptions)),declared2=scanEnvVars(configCopy),declaredNames=new Set(declared2.map((e)=>e.envName)),undeclared=scanUndeclaredEnv(declaredNames),entries=[...declared2,...undeclared],resolvedCount=entries.filter((e)=>e.resolved).length,missingCount=entries.length-resolvedCount,unrecognizedCount=undeclared.length;return{isSuccess:!0,message:`Found ${entries.length} env vars (${resolvedCount} resolved, ${missingCount} missing, ${unrecognizedCount} unrecognized)`,data:{entries,totalCount:entries.length,resolvedCount,missingCount,unrecognizedCount}}},detail:{tags:["Config Management"],summary:"Get environment variables (declared + undeclared)",description:"Surfaces both (a) DECLARED env vars \u2014 UPPER_SNAKE_CASE references found in the config tree (recognized:true) \u2014 and (b) UNDECLARED env vars actually present in process.env but not declared (recognized:false), minus Kubernetes service-link and OS/interpreter infra noise, so orphaned / junk config surfaces for cleanup. Sensitive values are masked; AI-provider *_API_KEY vars are never surfaced."}}),defineRoute({method:"GET",path:"/overrides",handler:async()=>{let redis=getRedis();if(!redis)return{isSuccess:!0,message:"Redis not available \u2014 no overrides stored",data:{overrides:null,sectionCount:0,sections:[]}};let overrides=await readOverridesFromRedis(redis,resolvedOptions.appId||"nucleus"),sections=overrides?Object.keys(overrides).filter((k)=>{let v=overrides[k];return v!==void 0&&v!==null&&(typeof v!=="object"||Object.keys(v).length>0)}):[];return{isSuccess:!0,message:sections.length>0?`${sections.length} section override(s) stored in Redis`:"No overrides in Redis",data:{overrides:overrides?maskSensitiveFields(overrides):null,sectionCount:sections.length,sections}}},detail:{tags:["Config Management"],summary:"View Redis config overrides",description:"Returns overrides stored in Redis that will be merged on next restart."}}),defineRoute({method:"DELETE",path:"/overrides",handler:async(ctx)=>{let redis=getRedis();if(!redis)return ctx.set.status=503,{isSuccess:!1,message:"Redis not available",data:null};let existing=await readOverridesFromRedis(redis,resolvedOptions.appId||"nucleus"),clearedSections=existing?Object.keys(existing):[];return await clearOverridesFromRedis(redis,resolvedOptions.appId||"nucleus"),logger2.info("[ConfigManagement] Redis overrides cleared",{clearedSections}),{isSuccess:!0,message:clearedSections.length>0?`Cleared ${clearedSections.length} override(s) from Redis. Restart to revert to config.json defaults.`:"No overrides to clear.",data:{message:"Redis overrides cleared",clearedSections}}},detail:{tags:["Config Management"],summary:"Clear all Redis config overrides",description:"Removes all stored overrides from Redis. Restart to revert to config.json defaults."}}),defineRoute({method:"GET",path:"/:section",handler:({params,set:set2})=>{let{section}=params;if(!hasSection(resolvedOptions,section))return set2.status=404,{isSuccess:!1,message:`Unknown config section: ${section}`,data:null};let sectionValue=extractSection(resolvedOptions,section),restart=isRestartRequired(section),maskedValue=sectionValue;if(typeof sectionValue==="object"&&sectionValue!==null&&!Array.isArray(sectionValue))maskedValue=maskSensitiveFields({[section]:sectionValue})[section];return{isSuccess:!0,message:`Config section: ${section}`,data:{section,config:maskedValue??null,restartRequired:restart}}},params:Type.Object({section:Type.String()}),detail:{tags:["Config Management"],summary:"Get a specific config section",description:"Returns a specific config section with sensitive fields masked."}}),defineRoute({method:"PATCH",path:"/:section",handler:async({params,body,set:set2})=>{let{section}=params,payload=body;if(!hasSection(resolvedOptions,section))return set2.status=404,{isSuccess:!1,message:`Unknown config section: ${section}`,data:null};if(!payload.config||typeof payload.config!=="object")return set2.status=400,{isSuccess:!1,message:'Request body must contain a "config" object',data:null};let restart=isRestartRequired(section),currentValue=extractSection(resolvedOptions,section),submitted=Array.isArray(currentValue)||currentValue===void 0||typeof currentValue==="string"||typeof currentValue==="number"||typeof currentValue==="boolean"?payload.config.value!==void 0?payload.config.value:payload.config:payload.config,incoming=restoreMaskedEchoes(section,currentValue,submitted),newValue;if(typeof currentValue==="object"&&currentValue!==null&&!Array.isArray(currentValue))newValue=deepMerge(currentValue,incoming);else newValue=incoming;if(applySectionUpdate(resolvedOptions,section,newValue),!restart)onConfigUpdate(section,newValue);let persistMethod="memory-only",persistWarning=null;if(configFilePath)try{await persistConfigToDisk(configFilePath,resolvedOptions),persistMethod="disk",logger2.info(`[ConfigManagement] Section "${section}" persisted to disk`)}catch(diskErr){let diskMsg=diskErr instanceof Error?diskErr.message:String(diskErr);logger2.warn(`[ConfigManagement] Disk persist failed: ${diskMsg}`);let redis=getRedis();if(redis)try{await persistSectionToRedis(redis,resolvedOptions.appId||"nucleus",section,newValue),persistMethod="redis",logger2.info(`[ConfigManagement] Section "${section}" persisted to Redis (disk unavailable)`)}catch(redisErr){let redisMsg=redisErr instanceof Error?redisErr.message:String(redisErr);logger2.error(`[ConfigManagement] Redis persist also failed: ${redisMsg}`),persistWarning=`Disk: ${diskMsg}. Redis: ${redisMsg}. Changes are in-memory only and will be lost on restart.`}else persistWarning=`Disk: ${diskMsg}. Redis not available. Changes are in-memory only and will be lost on restart.`}logger2.info(`[ConfigManagement] Section "${section}" updated (persist: ${persistMethod}, restart-required: ${restart})`);let updatedValue=extractSection(resolvedOptions,section),maskedUpdated=updatedValue;if(typeof updatedValue==="object"&&updatedValue!==null&&!Array.isArray(updatedValue))maskedUpdated=maskSensitiveFields({[section]:updatedValue})[section];let baseMsg=restart?`Config section "${section}" saved (${persistMethod}). Restart required for changes to take effect.`:`Config section "${section}" updated and applied (${persistMethod}).`;return{isSuccess:!0,message:persistWarning?`${baseMsg} Warning: ${persistWarning}`:baseMsg,data:{section,applied:!restart,restartRequired:restart,config:maskedUpdated}}},params:Type.Object({section:Type.String()}),body:Type.Object({config:Type.Record(Type.String(),Type.Unknown())}),detail:{tags:["Config Management"],summary:"Update a config section",description:"Deep-merges the payload into the section. Hot-reloadable sections apply immediately. Restart-required sections are saved to disk only."}}),defineRoute({method:"POST",path:"/restart",handler:({body})=>{let delayMs=body.delayMs??1000;logger2.info(`[ConfigManagement] Restart scheduled in ${delayMs}ms`);let scheduledAt=new Date().toISOString();return setTimeout(()=>{logger2.info("[ConfigManagement] Restarting process..."),process.exit(0)},delayMs),{isSuccess:!0,message:`Server restart scheduled in ${delayMs}ms`,data:{message:`Process will exit in ${delayMs}ms. Orchestrator (K8s/PM2/systemd) will restart it.`,scheduledAt}}},body:Type.Optional(Type.Object({delayMs:Type.Optional(Type.Number())})),detail:{tags:["Config Management"],summary:"Restart the server process",description:"Triggers a graceful process exit after a configurable delay. The orchestrator (K8s, PM2, systemd) is expected to restart the process automatically."}})];return collectRoutes([{prefix:basePath,guards:[guard4],routes:declared}])}init_routeMount();init_esm3();init_routeCollector();init_adminGuard();var requireAuth=(ctx)=>ctx.request.headers.get("x-user-id"),fail=(ctx,status,message)=>{return ctx.set.status=status,{success:!1,message,data:null}},callerSchemaOf=(ctx)=>ctx.request.headers.get("x-tenant-schema"),isGodmin=(ctx)=>hasGodminRole(ctx.request),ownsHostname=(ctx,record3)=>{if(isGodmin(ctx))return!0;let caller=callerSchemaOf(ctx);return record3.schemaName!=null&&record3.schemaName===caller};function createHostnameRoutes(config){let base=config.basePath,declared=[defineRoute({method:"POST",path:`${base}/hostnames`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail(ctx,503,"Domains not available");if(!requireAuth(ctx))return fail(ctx,401,"Authentication required");let body=ctx.body,callerSchema=callerSchemaOf(ctx),schemaName=body.schemaName??null,tenantId=body.tenantId??null;if(!hasGodminRole(ctx.request)){if(schemaName&&schemaName!==callerSchema)return fail(ctx,403,"Cannot bind a hostname to another tenant's schema");schemaName=callerSchema;let ownTenantId=config.resolveTenantIdForSchema?.(callerSchema)??null;if(tenantId&&tenantId!==ownTenantId)return fail(ctx,403,"Cannot bind a hostname to another tenant");tenantId=ownTenantId}try{let result=await service.createHostname({hostname:body.hostname,ownerId:body.ownerId,ownerType:body.ownerType,tenantId,schemaName,isPrimary:body.isPrimary});return{success:!0,message:"Custom hostname created",data:{hostname:result.hostname,instructions:result.instructions}}}catch(err){return fail(ctx,400,err instanceof Error?err.message:"Failed to create hostname")}},body:Type.Object({hostname:Type.String(),ownerId:Type.String(),ownerType:Type.Optional(Type.Union([Type.Literal("tenant"),Type.Literal("organization"),Type.Literal("user"),Type.Literal("external")])),tenantId:Type.Optional(Type.String()),schemaName:Type.Optional(Type.String()),isPrimary:Type.Optional(Type.Boolean())}),detail:{tags:["Domains"],summary:"Create custom hostname"}}),defineRoute({method:"GET",path:`${base}/hostnames`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail(ctx,503,"Domains not available");if(!requireAuth(ctx))return fail(ctx,401,"Authentication required");let url=new URL(ctx.request.url),items;if(isGodmin(ctx))items=await service.listHostnames({ownerId:url.searchParams.get("ownerId")??void 0,tenantId:url.searchParams.get("tenantId")??void 0});else{let ownTenantId=config.resolveTenantIdForSchema?.(callerSchemaOf(ctx))??null;items=ownTenantId?await service.listHostnames({tenantId:ownTenantId}):[]}return{success:!0,message:`Found ${items.length} hostnames`,data:{items}}}}),defineRoute({method:"GET",path:`${base}/hostnames/:id`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail(ctx,503,"Domains not available");if(!requireAuth(ctx))return fail(ctx,401,"Authentication required");let record3=await service.getHostname(ctx.params.id);if(!record3||!ownsHostname(ctx,record3))return fail(ctx,404,"Hostname not found");return{success:!0,message:"Hostname found",data:record3}}}),defineRoute({method:"GET",path:`${base}/hostnames/:id/instructions`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail(ctx,503,"Domains not available");if(!requireAuth(ctx))return fail(ctx,401,"Authentication required");let id=ctx.params.id,record3=await service.getHostname(id);if(!record3||!ownsHostname(ctx,record3))return fail(ctx,404,"Hostname not found");return{success:!0,message:"DNS instructions",data:{instructions:await service.getInstructions(id)}}}})],svc=(ctx)=>{let s=config.getDomainService();if(!s)return ctx.set.status=503,null;return s},lifecycle2=(suffix,run,summary)=>{declared.push(defineRoute({method:"POST",path:`${base}/hostnames/:id/${suffix}`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail(ctx,503,"Domains not available");if(!requireAuth(ctx))return fail(ctx,401,"Authentication required");let id=ctx.params.id,record3=await service.getHostname(id);if(!record3||!ownsHostname(ctx,record3))return fail(ctx,404,"Hostname not found");try{let data=await run(service,id);if(!data)return fail(ctx,404,"Hostname not found");return{success:!0,message:summary,data}}catch(err){return fail(ctx,400,err instanceof Error?err.message:summary)}}}))};return lifecycle2("verify",(s,id)=>s.verifyHostname(id),"Verification processed"),lifecycle2("activate",(s,id)=>s.activateHostname(id),"Hostname activated"),lifecycle2("disable",(s,id)=>s.disableHostname(id),"Hostname disabled"),lifecycle2("make-primary",(s,id)=>s.makePrimary(id),"Primary hostname set"),lifecycle2("refresh-status",(s,id)=>s.refreshStatus(id),"Status refreshed"),collectRoutes([{routes:declared}])}init_esm3();init_routeCollector();init_adminGuard();var requireAuth2=(ctx)=>ctx.request.headers.get("x-user-id"),fail2=(ctx,status,message)=>{return ctx.set.status=status,{success:!1,message,data:null}},callerSchemaOf2=(ctx)=>ctx.request.headers.get("x-tenant-schema"),isGodmin2=(ctx)=>hasGodminRole(ctx.request);function createRegistrationRoutes(config){let base=config.basePath,svc=(ctx)=>{let s=config.getRegistrationService();if(!s)return ctx.set.status=503,null;return s},ownTenantId=(ctx)=>config.resolveTenantIdForSchema?.(callerSchemaOf2(ctx))??null,ownsRegistration=(ctx,record3)=>{if(isGodmin2(ctx))return!0;let own=ownTenantId(ctx);return record3.tenantId!=null&&own!=null&&record3.tenantId===own},declared=[defineRoute({method:"POST",path:`${base}/registrations`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail2(ctx,503,"Domains not available");if(!requireAuth2(ctx))return fail2(ctx,401,"Authentication required");let body=ctx.body,tenantId=body.tenantId??null,registrantOwnerType=body.registrantOwnerType;if(!isGodmin2(ctx)){let own=ownTenantId(ctx);if(tenantId&&tenantId!==own)return fail2(ctx,403,"Cannot register a domain for another tenant");if(tenantId=own,registrantOwnerType==="platform")return fail2(ctx,403,"Only a platform admin may register as 'platform'");registrantOwnerType="customer"}try{return{success:!0,message:"Registration requested",data:await service.createRequest({requestedDomain:body.requestedDomain,ownerId:body.ownerId,ownerType:body.ownerType,tenantId,registrantOwnerType,termsVersion:body.termsVersion,termsAccepted:body.termsAccepted,autoRenew:body.autoRenew})}}catch(err){return fail2(ctx,400,err instanceof Error?err.message:"Failed to request registration")}},body:Type.Object({requestedDomain:Type.String(),ownerId:Type.String(),ownerType:Type.Optional(Type.Union([Type.Literal("tenant"),Type.Literal("organization"),Type.Literal("user"),Type.Literal("external")])),tenantId:Type.Optional(Type.String()),registrantOwnerType:Type.Optional(Type.Union([Type.Literal("customer"),Type.Literal("platform")])),termsVersion:Type.String(),termsAccepted:Type.Boolean(),autoRenew:Type.Optional(Type.Boolean())}),detail:{tags:["Domains"],summary:"Request managed domain registration"}}),defineRoute({method:"GET",path:`${base}/registrations`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail2(ctx,503,"Domains not available");if(!requireAuth2(ctx))return fail2(ctx,401,"Authentication required");let url=new URL(ctx.request.url),items;if(isGodmin2(ctx))items=await service.listRegistrations({ownerId:url.searchParams.get("ownerId")??void 0,tenantId:url.searchParams.get("tenantId")??void 0});else{let own=ownTenantId(ctx);items=own?await service.listRegistrations({tenantId:own}):[]}return{success:!0,message:`Found ${items.length} registrations`,data:{items}}}}),defineRoute({method:"GET",path:`${base}/registrations/:id`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail2(ctx,503,"Domains not available");if(!requireAuth2(ctx))return fail2(ctx,401,"Authentication required");let record3=await service.getRegistration(ctx.params.id);if(!record3||!ownsRegistration(ctx,record3))return fail2(ctx,404,"Registration not found");return{success:!0,message:"Registration found",data:record3}}}),defineRoute({method:"POST",path:`${base}/registrations/:id/cancel`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail2(ctx,503,"Domains not available");if(!requireAuth2(ctx))return fail2(ctx,401,"Authentication required");let id=ctx.params.id,record3=await service.getRegistration(id);if(!record3||!ownsRegistration(ctx,record3))return fail2(ctx,404,"Registration not found");let cancelled=await service.cancel(id);if(!cancelled)return fail2(ctx,404,"Registration not found");return{success:!0,message:"Registration cancelled",data:cancelled}}}),defineRoute({method:"POST",path:`${base}/registrations/:id/transfer-out`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail2(ctx,503,"Domains not available");if(!requireAuth2(ctx))return fail2(ctx,401,"Authentication required");let id=ctx.params.id,record3=await service.getRegistration(id);if(!record3||!ownsRegistration(ctx,record3))return fail2(ctx,404,"Registration not found");let out=await service.requestTransferOut(id);if(!out)return fail2(ctx,404,"Registration not found");return{success:!0,message:"Transfer-out requested",data:out}}})];return collectRoutes([{routes:declared}])}init_routeCollector();function createResolveRoute(config){let base=config.basePath,declared=[defineRoute({method:"GET",path:`${base}/resolve`,isPublic:!0,handler:async(ctx)=>{let service=config.getDomainService();if(!service)return ctx.set.status=503,{success:!1,message:"Domains not available",data:null};let hostname=new URL(ctx.request.url).searchParams.get("hostname")||ctx.request.headers.get("host")||"";if(!hostname)return ctx.set.status=400,{success:!1,message:"hostname is required",data:null};let match=await service.resolveHostname(hostname);if(!match)return ctx.set.status=404,{success:!1,message:"No active hostname matched",data:null};return{success:!0,message:"Resolved",data:match}},detail:{tags:["Domains"],summary:"Resolve hostname to tenant",description:"Public."}})];return collectRoutes([{routes:declared}])}function createDomainRoutes(app,config){return useRoutes(app,createResolveRoute(config)),useRoutes(app,createHostnameRoutes(config)),useRoutes(app,createRegistrationRoutes(config)),app}init_esm3();import{and as and16,arrayContains,arrayOverlaps,asc,createTableRelationsHelpers,desc as desc5,eq as eq31,getTableName,gt,gte,ilike,inArray as inArray11,isNotNull,isNull as isNull4,like,lt as lt2,lte,ne as ne2,notInArray,or as or3,sql as sql7}from"drizzle-orm";import{drizzle}from"drizzle-orm/node-postgres";init_AccountLink();init_Authorization();init_routeMount();init_utils5();init_revokeUserSessions();function decideRoleAssign(params){let{callerIsGod,callerRoleNames,allowRoles,targetRoleName,subjectIsGodmin,godminRoleName}=params,callerIsGodmin=callerIsGod||callerRoleNames.includes(godminRoleName);if(!(callerIsGodmin||callerRoleNames.some((name2)=>allowRoles.includes(name2))))return{allowed:!1,status:403,reason:"not_privileged"};if(targetRoleName===godminRoleName&&!callerIsGodmin)return{allowed:!1,status:403,reason:"godmin_assignment_forbidden"};if(subjectIsGodmin&&!callerIsGodmin)return{allowed:!1,status:403,reason:"target_is_godmin"};return{allowed:!0,callerIsGodmin}}var ROLE_ASSIGN_REFUSALS={not_privileged:"You are not allowed to assign roles.",godmin_assignment_forbidden:"Only a system administrator can grant this role.",target_is_godmin:"This person\u2019s roles can only be changed by a system administrator."};init_adminGuard();init_sensitiveColumns();var snakeToCamel2=(s)=>s.replace(/_([a-z])/g,(_,l)=>l.toUpperCase()),SENSITIVE_SYSTEM_TABLE_SNAKE=["domain_hostnames","domain_registrations","domain_provider_records","domain_verification_challenges","domain_events","payment_sub_merchants","payment_invoices","payment_subscriptions","payment_customers","payment_transactions","payment_methods","payment_products","payment_prices","payment_commission_splits","payment_splits","payment_reserves","payment_ledger_entries","payment_payout_requests","payment_settlement_policies","payment_disputes","payment_webhook_logs","verifications","api_keys","magic_link_tokens","user_sessions","trusted_devices","integration_sources","integration_endpoints","integration_mappings"],SENSITIVE_SYSTEM_TABLES=new Set(SENSITIVE_SYSTEM_TABLE_SNAKE.flatMap((name2)=>[name2,snakeToCamel2(name2)]));function isSensitiveSystemTable(tableName){return SENSITIVE_SYSTEM_TABLES.has(tableName)}function delegatedWriteRoles(question){if(question.isRbacTable)return new Set;let roles=(question.featureSet??[]).flatMap((feature)=>question.featureAdminRoles?.[feature]??[]);return new Set(roles.map((role)=>role.toLowerCase()))}function isFeatureAdmin(question){let allowed=delegatedWriteRoles(question);if(allowed.size===0)return!1;return question.callerRoles.some((role)=>allowed.has(role.toLowerCase()))}init_storage2();function isAnonymousCreate(table,payload){let rule=table.anonymous_create;if(!rule)return!1;if(rule===!0)return!0;let column=rule.column;if(!column)return!1;let value2=payload[column]??payload[toCamelCase2(column)]??payload[toSnakeCase2(column)];return isTruthy(value2)}function isTruthy(value2){if(typeof value2==="boolean")return value2;if(typeof value2==="number")return value2!==0;if(typeof value2==="string"){let normalized=value2.trim().toLowerCase();return normalized==="true"||normalized==="1"||normalized==="yes"||normalized==="on"}return!1}function createAuditIdentity(anonymous,userId,headers){if(anonymous)return{userId:void 0,ipAddress:"anonymous",userAgent:"anonymous"};return{userId:userId||void 0,ipAddress:headers.get("x-forwarded-for")?.split(",")[0]?.trim()||headers.get("x-real-ip")?.trim()||"unknown",userAgent:headers.get("user-agent")||"unknown"}}function toCamelCase2(value2){return value2.replace(/_([a-z0-9])/g,(_m,c)=>c.toUpperCase())}function toSnakeCase2(value2){return value2.replace(/[A-Z]/g,(c)=>`_${c.toLowerCase()}`)}var snakeToCamel3=(s)=>s.replace(/_([a-z])/g,(_,l)=>l.toUpperCase());function forceCreateScope(payload,authResult,resolveColumn){let scopeFilters=authResult?.scopeFilters;if(!scopeFilters)return{ok:!0};for(let[field,value2]of Object.entries(scopeFilters)){if(!resolveColumn(field))return{ok:!1,field};payload[snakeToCamel3(field)]=value2}return{ok:!0}}function decideRelationExpansion(params){let{authEnabled,targetTable,relAuth,isTargetPublicGet}=params;if(!authEnabled||!targetTable)return{expand:!0};if(relAuth===null)return isTargetPublicGet?{expand:!0}:{expand:!1};if(!relAuth.authorized)return{expand:!1};let scope=relAuth.scopeFilters;if(scope&&Object.keys(scope).length>0)return{expand:!0,scope};return{expand:!0}}function resolveRelationScopeColumn(fields,key2,toCamel5){if(Object.hasOwn(fields,key2))return fields[key2];let camel=toCamel5(key2);return Object.hasOwn(fields,camel)?fields[camel]:void 0}init_Authorization();init_types3();function targetFromBody(body){let record3=body??{},read2=(...keys)=>{for(let key2 of keys){let value2=record3[key2];if(typeof value2==="string"&&value2.length>0)return value2}return null};return{userId:read2("userId","user_id"),roleId:read2("roleId","role_id")}}async function readRow(db,userRolesTable,rowId,logger2){try{let{eq:eq31}=await import("drizzle-orm"),columns=userRolesTable,row=(await db.select().from(userRolesTable).where(eq31(columns.id,rowId)).limit(1))[0];if(!row)return{userId:null,roleId:null};let text=(value2)=>typeof value2==="string"&&value2.length>0?value2:null;return{userId:text(row.userId??row.user_id),roleId:text(row.roleId??row.role_id)}}catch(err){return logger2.warn("[UserRoleWrite] Failed to read the user_roles row",{error:err instanceof Error?err.message:String(err)}),{userId:null,roleId:null}}}async function roleNameOf(db,rolesTable,roleId,logger2){try{let{eq:eq31}=await import("drizzle-orm"),columns=rolesTable,name2=(await db.select({name:columns.name}).from(rolesTable).where(eq31(columns.id,roleId)).limit(1))[0]?.name;return typeof name2==="string"&&name2.length>0?name2:null}catch(err){return logger2.warn("[UserRoleWrite] Failed to read the role name",{error:err instanceof Error?err.message:String(err)}),null}}async function isGodmin3(db,userRolesTable,rolesTable,userId,logger2){try{let{eq:eq31}=await import("drizzle-orm"),ur=userRolesTable,r=rolesTable;return(await db.select({roleName:r.name}).from(userRolesTable).innerJoin(rolesTable,eq31(ur.roleId,r.id)).where(eq31(ur.userId,userId))).some((row)=>isGodminRole(String(row.roleName??"")))}catch(err){return logger2.warn("[UserRoleWrite] Failed to check whether the subject is a godmin",{error:err instanceof Error?err.message:String(err)}),!0}}async function resolveUserRoleSubject(deps,write){let{db,schemaTables,logger:logger2}=deps,userRolesTable=schemaTables[AUTHORIZATION_TABLE_KEYS.userRoles],rolesTable=schemaTables[AUTHORIZATION_TABLE_KEYS.roles];if(!db||!userRolesTable||!rolesTable)return{targetRoleName:null,subjectIsGodmin:!0};let fromBody=targetFromBody(write.body),fromRow=write.rowId?await readRow(db,userRolesTable,write.rowId,logger2):{userId:null,roleId:null},roleIds=[fromRow.roleId,fromBody.roleId].filter((id)=>Boolean(id)),userIds=[fromRow.userId,fromBody.userId].filter((id)=>Boolean(id));if(roleIds.length===0||userIds.length===0)return{targetRoleName:null,subjectIsGodmin:!0};let names2=await Promise.all(roleIds.map((id)=>roleNameOf(db,rolesTable,id,logger2)));if(names2.some((name2)=>name2===null))return{targetRoleName:null,subjectIsGodmin:!0};let readable=names2.filter((name2)=>name2!==null),targetRoleName=readable.find((name2)=>isGodminRole(name2))??readable[0]??null,godminFlags=await Promise.all(userIds.map((id)=>isGodmin3(db,userRolesTable,rolesTable,id,logger2)));return{targetRoleName,subjectIsGodmin:godminFlags.some(Boolean)}}init_esm3();function buildBodySchemaFromEntityColumns(entityColumns){let properties={};if(!entityColumns||entityColumns.length===0)return Type.Object({},{additionalProperties:!0});for(let col8 of entityColumns)switch(col8.type?.toLowerCase()||"string"){case"integer":case"int":case"serial":case"bigserial":case"numeric":case"decimal":properties[col8.name]=col8.notNull?Type.Number():Type.Optional(Type.Number());break;case"boolean":properties[col8.name]=col8.notNull?Type.Boolean():Type.Optional(Type.Boolean());break;case"timestamp":case"timestamptz":case"date":properties[col8.name]=col8.notNull?Type.String({format:"date-time"}):Type.Optional(Type.String({format:"date-time"}));break;case"json":case"jsonb":properties[col8.name]=Type.Optional(Type.Unknown());break;case"uuid":properties[col8.name]=col8.notNull?Type.String({format:"uuid"}):Type.Optional(Type.String({format:"uuid"}));break;default:properties[col8.name]=col8.notNull?Type.String():Type.Optional(Type.String())}return Type.Object(properties,{additionalProperties:!0})}function createBulkUpdateSchema(entityColumns){return Type.Array(Type.Object({id:Type.String(),data:Type.Partial(buildBodySchemaFromEntityColumns(entityColumns))}))}var MAX_BULK_ITEMS=500;function collectFilterFields(filter,out=[]){if(filter.operator==="or"||filter.operator==="and"){let group=Array.isArray(filter.value)?filter.value:[];for(let f of group)collectFilterFields(f,out)}else if(filter.field)out.push(String(filter.field));return out}function firstUnknownField(fields,resolveCol){for(let field of fields){let trimmed=field.trim();if(trimmed!==""&&!resolveCol(trimmed))return trimmed}return null}var FILTER_OPERATORS=new Set(["eq","neq","gt","gte","lt","lte","like","ilike","in","notIn","isNull","isNotNull","arrayOverlaps","arrayContains","arrayEmpty","or","and"]);function firstUnusableCondition(filter){let operator=filter.operator;if(typeof operator!=="string"||!FILTER_OPERATORS.has(operator))return`Unknown operator in filter: ${String(operator)}`;if(operator==="or"||operator==="and"){let group=Array.isArray(filter.value)?filter.value:[];if(group.length===0)return`Empty "${operator}" group in filter`;for(let sub of group){let unusable=firstUnusableCondition(sub);if(unusable)return unusable}return null}if(typeof filter.field!=="string"||filter.field.trim()==="")return'A filter condition needs a "field"';return null}function buildFilterCondition(filter,resolveCol){if(filter.operator==="or"||filter.operator==="and"){let subs=(Array.isArray(filter.value)?filter.value:[]).map((f)=>buildFilterCondition(f,resolveCol)).filter((c)=>c!==null);if(subs.length===0)return null;return(filter.operator==="or"?or3(...subs):and16(...subs))??null}if(!filter.field)return null;let col8=resolveCol(filter.field);if(!col8)return null;let sqlCol=col8,dataType=col8.dataType,coerce2=(v)=>dataType==="date"&&(typeof v==="string"||typeof v==="number")?new Date(v):v;switch(filter.operator){case"eq":return eq31(sqlCol,coerce2(filter.value));case"neq":return ne2(sqlCol,coerce2(filter.value));case"gt":return gt(sqlCol,coerce2(filter.value));case"gte":return gte(sqlCol,coerce2(filter.value));case"lt":return lt2(sqlCol,coerce2(filter.value));case"lte":return lte(sqlCol,coerce2(filter.value));case"like":return like(sqlCol,filter.value);case"ilike":return ilike(sqlCol,filter.value);case"in":return inArray11(sqlCol,filter.value);case"notIn":return notInArray(sqlCol,filter.value);case"arrayOverlaps":return arrayOverlaps(sqlCol,filter.value??[]);case"arrayContains":return arrayContains(sqlCol,filter.value??[]);case"arrayEmpty":return sql7`cardinality(${sqlCol}) = 0`;case"isNull":return isNull4(sqlCol);case"isNotNull":return isNotNull(sqlCol);default:return null}}function createEntityRoutes(app,config){let{db,schemaTables,schemaRelations,entities,logger:logger2,dbPool,storage,cdnMedia,authorization,authMode,idpUrl,featureAdminRoles}=config,getRegistry=()=>config.getTenantRegistry?config.getTenantRegistry():config.tenantRegistry??null,getReqSchema=(request)=>{let tenantRegistry=getRegistry();if(!tenantRegistry)return{tables:schemaTables,relations:schemaRelations};let schemaName=request.headers.get("x-tenant-schema");if(!schemaName)return{tables:schemaTables,relations:schemaRelations};let ctx=tenantRegistry.getSchemaContext(schemaName);return ctx?{tables:ctx.schemaTables,relations:ctx.schemaRelations}:{tables:schemaTables,relations:schemaRelations}},storageConfig=mergeStorageConfig(storage),warmUploadedMedia=(uploaded)=>{if(!cdnMedia||!uploaded||uploaded.success.length===0)return;scheduleUploadMediaProcessing(uploaded.success,{storagePath:storageConfig.basePath,media:cdnMedia,logger:logger2})},authEnabled=authorization?.enabled??!1,enforceFieldWrites=authEnabled&&authorization?.enforceFieldWriteClaims!==!1,isConsumerMode=authMode==="consumer",filterWritePayload=(payload,authResult)=>{if(!enforceFieldWrites||!authResult?.allowedFields)return payload;return filterResponseFields(payload,authResult.allowedFields)},auditPathContext=(request)=>{let url=new URL(request.url);return{path:url.pathname,query:url.search}},auditIdentityFor=(table,payload,userId,headers)=>createAuditIdentity(isAnonymousCreate(table,payload),userId,headers),UUID_RE=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,auditEntityId=(id)=>{let s=id==null?"":String(id);return UUID_RE.test(s)?s:null},projectWrittenRow=(row,authResult)=>{let scoped2=authEnabled&&authResult?.allowedFields?filterResponseFields(row,[...authResult.allowedFields,...authResult.allowedRelations??[]]):row;return stripUnclaimedSensitive(redactSensitiveOutput(scoped2),authResult?.allowedFields)};if(!db)return app;function snakeToCamel4(s){return s.replace(/_([a-z])/g,(_,l)=>l.toUpperCase())}let{entities:mergedEntities}=resolveEntities(SYSTEM_TABLES,entities),extendedByName=new Map(mergedEntities.filter((t)=>entities.some((e)=>e.table_name===t.table_name&&e.extends===!0)).map((t)=>[t.table_name,t])),effectiveEntities=entities.map((e)=>extendedByName.get(e.table_name)??e),allTables=Object.keys(schemaTables),entityTableNames=effectiveEntities.map((e)=>snakeToCamel4(e.table_name)),systemTableNames=allTables.filter((tbl)=>!entityTableNames.includes(tbl)),systemTableDefMap=new Map(SYSTEM_TABLES.map((t)=>[snakeToCamel4(t.table_name),t])),asMeta=(def)=>def??void 0,hasUnmetRequirement=(def)=>{let requires=def?.requires;if(!requires||requires.length===0)return null;for(let req of requires)if(req==="email"&&!config.isEmailServiceAvailable?.())return"email";return null},deriveGroupName=(def,fallback)=>{if(def?.group_name)return def.group_name;let primaryFeature=def?.feature_set?.[0];if(!primaryFeature)return fallback;return primaryFeature.charAt(0).toUpperCase()+primaryFeature.slice(1)},systemTables=systemTableNames.filter((name2)=>{let unmet=hasUnmetRequirement(asMeta(systemTableDefMap.get(name2)));if(unmet)return logger2.info(`Skipping ${name2} routes - missing required dependency: ${unmet}`),!1;return!0}).map((name2)=>{let def=systemTableDefMap.get(name2),meta=asMeta(def);return{table_name:def?.table_name??name2,group_name:deriveGroupName(meta,name2),is_form_data:def?.is_form_data===!0,bulk_endpoints_enabled:def?.bulk_endpoints_enabled??!1,excluded_methods:def?.excluded_methods?[...def.excluded_methods]:[],columns:def?.columns?[...def.columns]:void 0}}),allEntities=[...effectiveEntities,...systemTables],publicGetEntities=new Set;for(let e of allEntities)if(e.is_public?.GET===!0)publicGetEntities.add(e.table_name),publicGetEntities.add(snakeToCamel4(e.table_name));logger2.info(`All entities: ${allEntities.map((e)=>e.table_name).join(", ")}`);for(let table of allEntities){let rawTableName=table.table_name,tableName=snakeToCamel4(rawTableName),swaggerTag=table.group_name||rawTableName,writeFields=enforceFieldWrites?table.columns?.map((c)=>c.name):void 0,defaultDrizzleTable=schemaTables[tableName];if(!defaultDrizzleTable)continue;let tableRelations=schemaRelations[`${tableName}Relations`];logger2.info(`Creating routes for table: ${tableName}`);let relationTargetTable={};{let rels=tableRelations;if(rels?.table&&typeof rels?.config==="function")try{let built=rels.config(createTableRelationsHelpers(rels.table));for(let[relName,rel]of Object.entries(built))if(rel?.referencedTable)relationTargetTable[relName]=getTableName(rel.referencedTable)}catch(err){logger2.warn(`[Authorization] Could not map relations for ${tableName}`,{error:err instanceof Error?err.message:String(err)})}}let defaultTableColumns=defaultDrizzleTable,defaultIdCol=defaultTableColumns.id,database=db,drizzleTable=defaultDrizzleTable,tableColumns=defaultTableColumns,idCol=defaultIdCol,resolveCol=(field)=>{if(Object.hasOwn(tableColumns,field))return tableColumns[field];let camel=snakeToCamel4(field);return Object.hasOwn(tableColumns,camel)?tableColumns[camel]:void 0},getTableForRequest=(request)=>{if(!getRegistry())return{drizzleTable,tableColumns,idCol,resolveCol,schemaTables,schemaRelations};let reqSchema=getReqSchema(request),reqTable=reqSchema.tables[tableName]||drizzleTable,reqCols=reqTable,reqIdCol=reqCols.id;return{drizzleTable:reqTable,tableColumns:reqCols,idCol:reqIdCol,resolveCol:(field)=>{if(Object.hasOwn(reqCols,field))return reqCols[field];let camel=snakeToCamel4(field);return Object.hasOwn(reqCols,camel)?reqCols[camel]:void 0},schemaTables:reqSchema.tables,schemaRelations:reqSchema.relations}},bulkUpdateSchema=createBulkUpdateSchema(table.columns),bulkDeleteSchema=Type.Array(Type.String()),authzLog=logger2.scoped("authorization.check"),performAuthCheck=async(request,method,reqFields,reqRelations)=>{let result=await runAuthCheck(request,method,reqFields,reqRelations);if(result){let userId=request.headers.get("x-user-id"),requestId=request.headers.get("x-request-id")||void 0;if(!result.authorized)authzLog.warn(`Denied ${method} ${table.table_name}`,{requestId,userId,entity:table.table_name,method,reason:result.reason||"no reason provided",mode:isConsumerMode?idpUrl?"idp":"jwt":"local"});else if(result.scopeFilters||result.allowedFields||result.allowedRelations)authzLog.debug(`Allowed ${method} ${table.table_name} (restricted)`,{requestId,userId,entity:table.table_name,method,scopeFilters:result.scopeFilters,allowedFieldCount:result.allowedFields?.length,allowedRelations:result.allowedRelations})}return result},scopeConditionsFor=(authResult,resolveColumn)=>{if(!authEnabled||!authResult?.scopeFilters)return[];let{conditions,unresolvedFields}=buildScopeConditions(authResult.scopeFilters,resolveColumn);if(unresolvedFields.length>0)authzLog.error(`Scope references unknown column(s) on ${table.table_name}; failing closed (0 rows)`,{entity:table.table_name,unresolvedFields});return conditions},runAuthCheck=async(request,method,reqFields,reqRelations,entityName=table.table_name)=>{let userId=request.headers.get("x-user-id");if(!authEnabled||!userId)return null;if(isConsumerMode){let userClaims=decodeHeaderList(request.headers.get("x-user-claims")),userRoles=decodeHeaderList(request.headers.get("x-user-roles")),userClaimScopes=decodeClaimScopesHeader(request.headers.get("x-user-claim-scopes"));if(idpUrl&&authorization?.jwtClaimsMode==="resolve"){let accessToken=request.headers.get("x-access-token")||(request.headers.get("cookie")||"").match(/access_token=([^;]+)/)?.[1]||"";return checkAuthorizationViaIDP({idpUrl,accessToken,method,entity:entityName,requestedFields:reqFields,requestedRelations:reqRelations,logger:logger2})}return checkAuthorizationFromJWT({userClaims,userRoles,method,entity:entityName,requestedFields:reqFields,requestedRelations:reqRelations,logger:logger2,requireClaimSpecificity:authorization?.requireClaimSpecificity,claimScopes:userClaimScopes})}let reqCtx=getTableForRequest(request);return checkAuthorization({userId,method,entity:entityName,requestedFields:reqFields,requestedRelations:reqRelations,db:database,schemaTables:reqCtx.schemaTables,logger:logger2,requireClaimSpecificity:authorization?.requireClaimSpecificity,getUserData:async()=>{if(!database)return;let usersTbl=reqCtx.schemaTables[AUTHORIZATION_TABLE_KEYS.users];if(!usersTbl)return;let idCol2=usersTbl.id;if(!idCol2)return;return(await database.select().from(usersTbl).where(eq31(idCol2,userId)).limit(1))[0]}})},endSessionsForDeactivated=async(request,changed)=>{if(tableName!==AUTHORIZATION_TABLE_KEYS.users)return;let userIds=changed.filter((one)=>one.after?.isActive===!1&&one.before?.isActive!==!1).map((one)=>String(one.after?.id??"").trim()).filter(Boolean);if(userIds.length===0)return;let authTables=resolveAuthTablesForRequest(request,{usersTable:schemaTables[AUTHORIZATION_TABLE_KEYS.users],sessionsTable:schemaTables.userSessions??schemaTables.sessions,schemaTables,tenantRegistry:config.tenantRegistry,getTenantRegistry:config.getTenantRegistry});await revokeUserSessions({db:database,sessionsTable:authTables.sessionsTable,onError:(error3)=>logger2.error("[Entity] users rows were deactivated but their open sessions were not cleared",{error:error3,userIds})},userIds)},declared=[],entityGuards=[],listLog=logger2.scoped("entity.list"),isRbacTable=tableName===AUTHORIZATION_TABLE_KEYS.roles||tableName===AUTHORIZATION_TABLE_KEYS.claims||tableName===AUTHORIZATION_TABLE_KEYS.roleClaims,isUserRoleTable=tableName===AUTHORIZATION_TABLE_KEYS.userRoles,roleAssignRoles=featureAdminRoles?.authorization??[];if(isRbacTable||isUserRoleTable||isSensitiveSystemTable(tableName)){let denyMessage=isRbacTable?"Forbidden: managing roles and claims requires godmin privileges":isUserRoleTable?"Forbidden: assigning roles requires godmin privileges":`Forbidden: writing to '${tableName}' via the generic entity API requires godmin privileges \u2014 use the dedicated route`;entityGuards.push(async({request,set:set2,body,params})=>{let method=request.method.toUpperCase();if(method==="GET"||method==="HEAD"||method==="OPTIONS")return;if(hasGodminRole(request))return;if(isFeatureAdmin({isRbacTable:isRbacTable||isUserRoleTable,featureSet:table.feature_set,featureAdminRoles,callerRoles:decodeHeaderList(request.headers.get("x-user-roles"))}))return;if(isUserRoleTable&&roleAssignRoles.length>0){let subject=await resolveUserRoleSubject({db,schemaTables:getReqSchema(request).tables,logger:logger2},{rowId:typeof params?.id==="string"?params.id:null,body}),decision=decideRoleAssign({callerIsGod:!1,callerRoleNames:decodeHeaderList(request.headers.get("x-user-roles")),allowRoles:roleAssignRoles,targetRoleName:subject.targetRoleName??GODMIN_ROLE_NAME,subjectIsGodmin:subject.subjectIsGodmin,godminRoleName:GODMIN_ROLE_NAME});if(decision.allowed)return;if(await userHasGodminRoleInDb(db,schemaTables,request.headers.get("x-user-id"),logger2))return;return set2.status=403,{success:!1,reason:decision.reason,message:ROLE_ASSIGN_REFUSALS[decision.reason]}}if(await userHasGodminRoleInDb(db,schemaTables,request.headers.get("x-user-id"),logger2))return;return set2.status=403,{success:!1,message:denyMessage}})}if(!table.excluded_methods?.includes("GET"))declared.push(defineRoute({method:"GET",path:"/",detail:{tags:[swaggerTag],summary:`List ${tableName}`,description:`Get paginated list of ${tableName} records with filtering, sorting, and search`},handler:async(ctx)=>{if(!database)return ctx.set.status=500,{success:!1,message:"DB not initialized"};let{drizzleTable:drizzleTable2,resolveCol:resolveCol2,schemaRelations:schemaRelations2}=getTableForRequest(ctx.request),requestedFields=table.columns?.map((c)=>c.name),requestedRelations=Object.keys(schemaRelations2).filter((k)=>k.startsWith(`${tableName}Relations`)).map((k)=>k.replace("Relations","")),authResult=await performAuthCheck(ctx.request,"GET",requestedFields,requestedRelations);if(authResult&&!authResult.authorized)return ctx.set.status=403,{success:!1,message:authResult.reason||"Forbidden"};let fieldQueryable=(field)=>{if(isSensitiveOutputKey(field))return!1;if(!sensitiveFieldQueryable(field,{authEnabled,allowedFields:authResult?.allowedFields}))return!1;if(authEnabled&&authResult?.allowedFields&&!authResult.allowedFields.includes(field))return!1;return!0},q=parseQueryParams(ctx.query);if(q.malformed)return ctx.set.status=400,{success:!1,message:`Malformed query parameter: ${q.malformed.join(", ")} (expected a JSON array)`};let conditions=[];if(conditions.push(...scopeConditionsFor(authResult,resolveCol2)),q.search&&q.searchFields){for(let f of q.searchFields)if(!fieldQueryable(f.trim()))return ctx.set.status=403,{success:!1,message:`Cannot search on field: ${f.trim()}`};let unknown3=firstUnknownField(q.searchFields,resolveCol2);if(unknown3)return ctx.set.status=400,{success:!1,message:`Unknown field in search: ${unknown3}`};let searchConditions=q.searchFields.map((f)=>ilike(resolveCol2(f.trim()),`%${q.search}%`)).filter((c)=>c!==null);if(searchConditions.length>0){let orCondition=or3(...searchConditions);if(orCondition)conditions.push(orCondition)}}if(Array.isArray(q.filters))for(let filter of q.filters){let referenced=collectFilterFields(filter);for(let f of referenced)if(!fieldQueryable(f))return ctx.set.status=403,{success:!1,message:`Cannot filter on field: ${f}`};let unknownFilterField=firstUnknownField(referenced,resolveCol2);if(unknownFilterField)return ctx.set.status=400,{success:!1,message:`Unknown field in filter: ${unknownFilterField}`};let unusable=firstUnusableCondition(filter);if(unusable)return ctx.set.status=400,{success:!1,message:unusable};let cond=buildFilterCondition(filter,resolveCol2);if(cond)conditions.push(cond)}let projection;if(q.select&&q.select.length>0){let requested=[...new Set(["id",...q.select.map((f)=>f.trim())])].filter(Boolean),columns={};for(let field of requested){if(!fieldQueryable(field))return ctx.set.status=403,{success:!1,message:`Cannot select field: ${field}`};let col8=resolveCol2(field);if(!col8)return ctx.set.status=400,{success:!1,message:`Unknown field in select: ${field}`};columns[field]=col8}if(Object.keys(columns).length>0)projection=columns}let unprojected=database.select().from(drizzleTable2),baseQuery=projection?database.select(projection).from(drizzleTable2):unprojected;if(conditions.length>0){let combined=and16(...conditions);if(combined)baseQuery=baseQuery.where(combined)}if(q.sort&&q.sort.length>0){let orderClauses=[];for(let s of q.sort){let field=typeof s?.field==="string"?s.field.trim():"";if(field==="")return ctx.set.status=400,{success:!1,message:'Malformed query parameter: sort (every entry needs a "field")'};if(!fieldQueryable(field))return ctx.set.status=403,{success:!1,message:`Cannot sort on field: ${field}`};let col8=resolveCol2(field);if(!col8)return ctx.set.status=400,{success:!1,message:`Unknown field in sort: ${field}`};orderClauses.push(s.direction==="desc"?desc5(col8):asc(col8))}if(orderClauses.length>0)baseQuery=baseQuery.orderBy(...orderClauses)}let page=q.page??1,limit=q.limit??20,offset=q.offset??(page-1)*limit;if(q.groupBy){let field=q.groupBy.trim();if(!fieldQueryable(field))return ctx.set.status=403,{success:!1,message:`Cannot group by field: ${field}`};let groupCol=resolveCol2(field);if(!groupCol)return ctx.set.status=400,{success:!1,message:`Unknown field in groupBy: ${field}`};let where=conditions.length>0?and16(...conditions):void 0,col8=groupCol,distinctCount=await database.select({n:sql7`count(distinct ${col8})::int`}).from(drizzleTable2).where(where),totalGroups=Number(distinctCount[0]?.n??0);return{success:!0,data:{items:(await database.select({value:col8,count:sql7`count(*)::int`}).from(drizzleTable2).where(where).groupBy(col8).orderBy(sql7`count(*) desc`,col8).limit(limit).offset(offset)).map((g)=>({value:g.value,count:Number(g.count)})),meta:buildPaginationMeta(page,limit,offset,totalGroups)}}}let queryStart=performance.now(),combinedCount=conditions.length>0?and16(...conditions):void 0,countResult=await database.select({n:sql7`count(*)::int`}).from(drizzleTable2).where(combinedCount),totalItems=Number(countResult[0]?.n??0);baseQuery=baseQuery.limit(limit).offset(offset);let items=await baseQuery,meta=buildPaginationMeta(page,limit,offset,totalItems);if(listLog.debug(`List ${rawTableName}: ${items.length}/${totalItems} rows`,{requestId:ctx.request.headers.get("x-request-id")||void 0,table:rawTableName,page,limit,totalItems,returned:items.length,conditionCount:conditions.length,search:q.search||void 0,sort:Array.isArray(q.sort)?q.sort.map((s)=>`${s.field}:${s.direction}`):void 0,queryMs:Math.round(performance.now()-queryStart)}),authEnabled&&authResult?.allowedFields)items=filterResponseFields(items,authResult.allowedFields);return{success:!0,data:{items:items.map((r)=>stripUnclaimedSensitive(redactSensitiveOutput(r),authResult?.allowedFields)),meta}}}})),declared.push(defineRoute({method:"GET",path:"/:id",detail:{tags:[swaggerTag],summary:`Get ${tableName} by ID`,description:`Get a single ${tableName} record by its ID with optional relations`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,schemaTables:schemaTables2,schemaRelations:schemaRelations2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let params=ctx.params,q=parseQueryParams(ctx.query),requestedFields=table.columns?.map((c)=>c.name),requestedRelations=q.with?.map((w)=>w.name),authResult=await performAuthCheck(ctx.request,"GET",requestedFields,requestedRelations);if(authResult&&!authResult.authorized)return ctx.set.status=403,{success:!1,message:authResult.reason||"Forbidden"};if(q.malformed?.includes("with"))return ctx.set.status=400,{success:!1,message:"Malformed query parameter: with (expected a JSON array)"};let getScope=scopeConditionsFor(authResult,resolveCol2),getWhere=getScope.length>0?and16(eq31(idCol2,params.id),...getScope):eq31(idCol2,params.id);if(q.with&&q.with.length>0&&tableRelations&&dbPool){let allowedWith=authEnabled&&authResult?.allowedRelations?q.with.filter((w)=>authResult.allowedRelations?.includes(w.name)??!1):q.with,dbWithRelations=drizzle(dbPool,{schema:{...schemaTables2,...schemaRelations2}}),withClause={};for(let rel of allowedWith){let targetTable=relationTargetTable[rel.name],relAuth=authEnabled&&targetTable?await runAuthCheck(ctx.request,"GET",void 0,void 0,targetTable):null,decision=decideRelationExpansion({authEnabled,targetTable,relAuth,isTargetPublicGet:targetTable?publicGetEntities.has(targetTable):!1});if(!decision.expand)continue;let relScope=decision.scope;if(relScope&&Object.keys(relScope).length>0)withClause[rel.name]={...rel.limit?{limit:rel.limit}:{},where:(fields,ops)=>{let preds=[],unresolved=!1;for(let[k,v]of Object.entries(relScope)){let col8=resolveRelationScopeColumn(fields,k,snakeToCamel4);if(col8)preds.push(ops.eq(col8,v));else unresolved=!0}if(unresolved)return sql7`1 = 0`;return preds.length>0?ops.and(...preds):void 0}};else withClause[rel.name]=rel.limit?{limit:rel.limit}:!0}let result2=await dbWithRelations.query[tableName]?.findFirst({where:getWhere,with:withClause});if(!result2)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};if(authEnabled&&authResult?.allowedFields)result2=filterResponseFields(result2,[...authResult.allowedFields,...authResult.allowedRelations??[]]);if(authEnabled&&authResult?.allowedRelations)result2=filterResponseRelations(result2,authResult.allowedRelations);return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result2),authResult?.allowedFields)}}let result=(await database.select().from(drizzleTable2).where(getWhere))[0]||null;if(!result)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};if(authEnabled&&authResult?.allowedFields)result=filterResponseFields(result,authResult.allowedFields);return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result),authResult?.allowedFields)}}})),declared.push(defineRoute({method:"GET",path:"/distinct/:field",detail:{tags:[swaggerTag],summary:`Get distinct ${tableName} values`,description:`Get distinct values for a specific field in ${tableName}`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database)return ctx.set.status=500,{success:!1,message:"DB not initialized"};let params=ctx.params,authResult=await performAuthCheck(ctx.request,"GET",[params.field],[]);if(authResult&&!authResult.authorized)return ctx.set.status=403,{success:!1,message:authResult.reason||"Forbidden"};if(authEnabled&&authResult?.allowedFields&&!authResult.allowedFields.includes(params.field))return ctx.set.status=403,{success:!1,message:"Forbidden: field not permitted"};if(isSensitiveOutputKey(params.field))return ctx.set.status=403,{success:!1,message:"Forbidden: field not permitted"};if(!sensitiveFieldQueryable(params.field,{authEnabled,allowedFields:authResult?.allowedFields}))return ctx.set.status=403,{success:!1,message:"Forbidden: field not permitted"};let col8=resolveCol2(params.field);if(!col8)return ctx.set.status=404,{success:!1,message:"Field not found"};let distinctScope=scopeConditionsFor(authResult,resolveCol2),distinctQuery=database.selectDistinct({value:col8}).from(drizzleTable2);return{success:!0,data:distinctScope.length>0?await distinctQuery.where(and16(...distinctScope)):await distinctQuery}}}));if(!table.excluded_methods?.includes("POST"))if(table.is_form_data&&storageConfig.enabled)declared.push(defineRoute({method:"POST",path:"/",type:"formdata",body:Type.Object({[storageConfig.formData.dataField]:Type.Optional(Type.Union([Type.String(),Type.Any()])),[storageConfig.formData.filesField]:Type.Optional(FilesSchema())}),detail:{tags:[swaggerTag],summary:`Create ${tableName} with files`,description:`Create a new ${tableName} record with file upload support`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database)return ctx.set.status=500,{success:!1,message:"DB not initialized"};let userId=ctx.request.headers.get("x-user-id"),postFormAuthResult=await performAuthCheck(ctx.request,"POST",writeFields);if(postFormAuthResult&&!postFormAuthResult.authorized)return ctx.set.status=403,{success:!1,message:postFormAuthResult.reason||"Forbidden"};let{data,files}=parseFormDataBody(ctx.body,storageConfig),payload=data,uploadedFiles=null;if(files.length>0){if(uploadedFiles=await uploadFiles(files,storageConfig,table.table_name),uploadedFiles.failed.length>0&&uploadedFiles.success.length===0){let allRefused=uploadedFiles.failed.every((one)=>one.rejected===!0),aboutType=allRefused&&uploadedFiles.failed.some((one)=>one.error.includes("File type"));return ctx.set.status=allRefused?aboutType?415:400:500,{success:!1,message:allRefused?"File refused":"File upload failed",errors:uploadedFiles.failed}}warmUploadedMedia(uploadedFiles)}let mergeUploadedMetadata=()=>{let firstFile=uploadedFiles?.success[0];if(firstFile)payload={...payload,...buildFileRecordPayload(firstFile,userId)}};if(table.columns)payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0}),payload=filterWritePayload(payload,postFormAuthResult),mergeUploadedMetadata();else mergeUploadedMetadata();let scopedForm=forceCreateScope(payload,postFormAuthResult,resolveCol2);if(!scopedForm.ok)return ctx.set.status=403,{success:!1,message:`Forbidden: ownership scope references a column '${scopedForm.field}' this entity does not have`};if(table.columns){let validation=validatePayload(payload,table.columns,!1);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}let anonymous=isAnonymousCreate(table,payload);if(userId&&!anonymous)payload.createdBy=userId;let result=await database.insert(drizzleTable2).values(payload).returning();{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:String(result[0]?.id??""),operation:"CREATE",summary:`Created ${table.table_name}`,newValues:result[0],...createAuditIdentity(anonymous,userId,ctx.request.headers),path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result[0]),postFormAuthResult?.allowedFields)}}}));else declared.push(defineRoute({method:"POST",path:"/",body:Type.Object({},{additionalProperties:!0}),detail:{tags:[swaggerTag],summary:`Create ${tableName}`,description:`Create a new ${tableName} record`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,schemaTables:schemaTables2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database)return ctx.set.status=500,{success:!1,message:"DB not initialized"};let payload=ctx.body,userId=ctx.request.headers.get("x-user-id"),postAuthResult=await performAuthCheck(ctx.request,"POST",writeFields);if(postAuthResult&&!postAuthResult.authorized)return ctx.set.status=403,{success:!1,message:postAuthResult.reason||"Forbidden"};if(table.columns)payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0}),payload=filterWritePayload(payload,postAuthResult);let scoped2=forceCreateScope(payload,postAuthResult,resolveCol2);if(!scoped2.ok)return ctx.set.status=403,{success:!1,message:`Forbidden: ownership scope references a column '${scoped2.field}' this entity does not have`};if(table.columns){let validation=validatePayload(payload,table.columns,!1);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}let anonymous=isAnonymousCreate(table,payload);if(userId&&!anonymous)payload.createdBy=userId;if(tableName===AUTHORIZATION_TABLE_KEYS.userRoles&&payload.userId&&payload.roleId){let cols=drizzleTable2,existing=await database.select().from(drizzleTable2).where(and16(eq31(cols.userId,payload.userId),eq31(cols.roleId,payload.roleId))).limit(1);if(existing.length>0)return{success:!0,data:existing[0]}}let result=await database.insert(drizzleTable2).values(payload).returning();if(tableName===AUTHORIZATION_TABLE_KEYS.roleClaims&&config.claimsCache)config.claimsCache.invalidate().catch(()=>{});if(tableName===AUTHORIZATION_TABLE_KEYS.userRoles&&payload.roleId&&payload.userId)try{let rolesTable=schemaTables2[AUTHORIZATION_TABLE_KEYS.roles],usersTable=schemaTables2[AUTHORIZATION_TABLE_KEYS.users];if(rolesTable&&usersTable){let roleName=(await database.select().from(rolesTable).where(eq31(rolesTable.id,payload.roleId)).limit(1))[0]?.name;if(roleName===GODMIN_ROLE_NAME)await database.update(usersTable).set({isGod:!0}).where(eq31(usersTable.id,payload.userId));if(roleName)config.onRoleChanged?.({userId:String(payload.userId),roleName,assigned:!0,actorId:userId??void 0})}}catch(_e){logger2.warn("[Entity] Failed to sync is_god flag on userRole create")}{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:String(result[0]?.id??""),operation:"CREATE",summary:`Created ${table.table_name}`,newValues:result[0],...createAuditIdentity(anonymous,userId,ctx.request.headers),path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result[0]),postAuthResult?.allowedFields)}}}));if(!table.excluded_methods?.includes("PUT"))if(table.is_form_data&&storageConfig.enabled)declared.push(defineRoute({method:"PUT",path:"/:id",type:"formdata",body:Type.Object({[storageConfig.formData.dataField]:Type.Optional(Type.Union([Type.String(),Type.Any()])),[storageConfig.formData.filesField]:Type.Optional(FilesSchema())}),detail:{tags:[swaggerTag],summary:`Update ${tableName} with files`,description:`Full update of ${tableName} record with file upload support`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let params=ctx.params,userId=ctx.request.headers.get("x-user-id"),putFormAuthResult=await performAuthCheck(ctx.request,"PUT",writeFields);if(putFormAuthResult&&!putFormAuthResult.authorized)return ctx.set.status=403,{success:!1,message:putFormAuthResult.reason||"Forbidden"};let putFormScope=scopeConditionsFor(putFormAuthResult,resolveCol2),putFormWhere=putFormScope.length>0?and16(eq31(idCol2,params.id),...putFormScope):eq31(idCol2,params.id),{data,files}=parseFormDataBody(ctx.body,storageConfig),payload=data,oldRecord=await database.select().from(drizzleTable2).where(putFormWhere).limit(1);if(oldRecord.length===0)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};if(table.columns){payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0}),payload=filterWritePayload(payload,putFormAuthResult);let validation=validatePayload(payload,table.columns,!1);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}let uploadedFiles=null;if(files.length>0)uploadedFiles=await uploadFiles(files,storageConfig,table.table_name),warmUploadedMedia(uploadedFiles);let result=await database.update(drizzleTable2).set(payload).where(putFormWhere).returning();{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:params.id,operation:"UPDATE",userId:userId||void 0,summary:`Updated ${table.table_name} (${params.id})`,oldValues:oldRecord[0],newValues:result[0],ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||ctx.request.headers.get("x-real-ip")?.trim()||"unknown",userAgent:ctx.request.headers.get("user-agent")||"unknown",path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:{record:result[0],files:uploadedFiles?.success||[],fileErrors:uploadedFiles?.failed||[]}}}}));else declared.push(defineRoute({method:"PUT",path:"/:id",body:Type.Object({},{additionalProperties:!0}),detail:{tags:[swaggerTag],summary:`Update ${tableName}`,description:`Full update of ${tableName} record`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let{params,body:payload}=ctx,userId=ctx.request.headers.get("x-user-id"),putAuthResult=await performAuthCheck(ctx.request,"PUT",writeFields);if(putAuthResult&&!putAuthResult.authorized)return ctx.set.status=403,{success:!1,message:putAuthResult.reason||"Forbidden"};let putScope=scopeConditionsFor(putAuthResult,resolveCol2),putWhere=putScope.length>0?and16(eq31(idCol2,params.id),...putScope):eq31(idCol2,params.id),oldRecord=await database.select().from(drizzleTable2).where(putWhere).limit(1);if(oldRecord.length===0)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};if(table.columns){payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0}),payload=filterWritePayload(payload,putAuthResult);let validation=validatePayload(payload,table.columns,!1);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}if(payload.updatedAt=new Date,userId)payload.updatedBy=userId;let result=await database.update(drizzleTable2).set(payload).where(putWhere).returning();await endSessionsForDeactivated(ctx.request,[{before:oldRecord[0],after:result[0]}]);{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:params.id,operation:"UPDATE",userId:userId||void 0,summary:`Updated ${table.table_name} (${params.id})`,oldValues:oldRecord[0],newValues:result[0],ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||ctx.request.headers.get("x-real-ip")?.trim()||"unknown",userAgent:ctx.request.headers.get("user-agent")||"unknown",path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result[0]),putAuthResult?.allowedFields)}}}));if(!table.excluded_methods?.includes("PATCH"))declared.push(defineRoute({method:"PATCH",path:"/:id",body:Type.Object({},{additionalProperties:!0}),detail:{tags:[swaggerTag],summary:`Patch ${tableName}`,description:`Partial update of ${tableName} record`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let{params,body:payload}=ctx,userId=ctx.request.headers.get("x-user-id"),patchAuthResult=await performAuthCheck(ctx.request,"PATCH",writeFields);if(patchAuthResult&&!patchAuthResult.authorized)return ctx.set.status=403,{success:!1,message:patchAuthResult.reason||"Forbidden"};let patchScope=scopeConditionsFor(patchAuthResult,resolveCol2),patchWhere=patchScope.length>0?and16(eq31(idCol2,params.id),...patchScope):eq31(idCol2,params.id),oldRecord=await database.select().from(drizzleTable2).where(patchWhere).limit(1);if(oldRecord.length===0)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};if(table.columns){payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0}),payload=filterWritePayload(payload,patchAuthResult);let validation=validatePayload(payload,table.columns,!0);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}if(payload.updatedAt=new Date,userId)payload.updatedBy=userId;let result=await database.update(drizzleTable2).set(payload).where(patchWhere).returning();await endSessionsForDeactivated(ctx.request,[{before:oldRecord[0],after:result[0]}]);{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:params.id,operation:"PATCH",userId:userId||void 0,summary:`Patched ${table.table_name} (${params.id})`,oldValues:oldRecord[0],newValues:result[0],ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||ctx.request.headers.get("x-real-ip")?.trim()||"unknown",userAgent:ctx.request.headers.get("user-agent")||"unknown",path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result[0]),patchAuthResult?.allowedFields)}}}));if(!table.excluded_methods?.includes("DELETE"))declared.push(defineRoute({method:"DELETE",path:"/:id",detail:{tags:[swaggerTag],summary:`Delete ${tableName}`,description:`Delete a ${tableName} record`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,schemaTables:schemaTables2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let params=ctx.params,userId=ctx.request.headers.get("x-user-id"),deleteAuthResult=await performAuthCheck(ctx.request,"DELETE");if(deleteAuthResult&&!deleteAuthResult.authorized)return ctx.set.status=403,{success:!1,message:deleteAuthResult.reason||"Forbidden"};let deleteScope=scopeConditionsFor(deleteAuthResult,resolveCol2),deleteWhere=deleteScope.length>0?and16(eq31(idCol2,params.id),...deleteScope):eq31(idCol2,params.id),oldRecord=await database.select().from(drizzleTable2).where(deleteWhere).limit(1);if(oldRecord.length===0)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};if(await database.delete(drizzleTable2).where(deleteWhere),table.is_form_data&&storageConfig.enabled&&oldRecord[0]){let rec=oldRecord[0],filePath=rec.path,fileName=rec.name;if(typeof filePath==="string"&&typeof fileName==="string"){if(!await deleteFile(filePath,fileName,storageConfig.basePath))logger2.warn(`[Entity] Blob cleanup failed for ${table.table_name} (${params.id})`)}}if(oldRecord[0]){let link=accountLinkFor(config.accountLinks,tableName),userIds=link?accountIdsIn([oldRecord[0]],link.userColumn):[];if(userIds.length>0){let authTables=resolveAuthTablesForRequest(ctx.request,{usersTable:schemaTables2[AUTHORIZATION_TABLE_KEYS.users],sessionsTable:schemaTables2.userSessions??schemaTables2.sessions,schemaTables:schemaTables2,tenantRegistry:config.tenantRegistry,getTenantRegistry:config.getTenantRegistry}),result=await closeAccounts({db:database,usersTable:authTables.usersTable,sessionsTable:authTables.sessionsTable,onError:(error3)=>logger2.error(`[Entity] ${tableName} ${params.id} was deleted but its account could not be closed`,{error:error3})},userIds);if(result.closed>0&&!result.signedOut)logger2.warn(`[Entity] Account behind ${tableName} ${params.id} was deactivated but its open sessions were not cleared`)}}if(tableName===AUTHORIZATION_TABLE_KEYS.roleClaims&&config.claimsCache)config.claimsCache.invalidate().catch(()=>{});if(tableName===AUTHORIZATION_TABLE_KEYS.userRoles&&oldRecord[0])try{let deletedUserRole=oldRecord[0],rolesTable=schemaTables2[AUTHORIZATION_TABLE_KEYS.roles],usersTable=schemaTables2[AUTHORIZATION_TABLE_KEYS.users];if(rolesTable&&usersTable&&deletedUserRole.roleId&&deletedUserRole.userId){let roleName=(await database.select().from(rolesTable).where(eq31(rolesTable.id,deletedUserRole.roleId)).limit(1))[0]?.name;if(roleName===GODMIN_ROLE_NAME)await database.update(usersTable).set({isGod:!1}).where(eq31(usersTable.id,deletedUserRole.userId));if(roleName)config.onRoleChanged?.({userId:String(deletedUserRole.userId),roleName,assigned:!1,actorId:ctx.request.headers.get("x-user-id")??void 0})}}catch(_e){logger2.warn("[Entity] Failed to sync is_god flag on userRole delete")}{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:params.id,operation:"DELETE",userId:userId||void 0,summary:`Deleted ${table.table_name} (${params.id})`,oldValues:oldRecord[0],ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||ctx.request.headers.get("x-real-ip")?.trim()||"unknown",userAgent:ctx.request.headers.get("user-agent")||"unknown",path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:null}}}));if(table.bulk_endpoints_enabled){if(!table.excluded_methods?.includes("POST"))declared.push(defineRoute({method:"POST",path:"/bulk",body:Type.Array(Type.Object({},{additionalProperties:!0})),detail:{tags:[swaggerTag],summary:`Bulk create ${tableName}`,description:`Create multiple ${tableName} records`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database)return ctx.set.status=500,{success:!1,message:"DB not initialized"};let items=ctx.body;if(!Array.isArray(items))return ctx.set.status=400,{success:!1,message:"Body must be an array"};if(items.length>MAX_BULK_ITEMS)return ctx.set.status=400,{success:!1,message:`Bulk request exceeds ${MAX_BULK_ITEMS} items`};let userId=ctx.request.headers.get("x-user-id"),bulkPostAuth=await performAuthCheck(ctx.request,"POST",writeFields);if(bulkPostAuth&&!bulkPostAuth.authorized)return ctx.set.status=403,{success:!1,message:bulkPostAuth.reason||"Forbidden"};let sanitizedItems=[];for(let raw of items){let payload=raw;if(table.columns)payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0}),payload=filterWritePayload(payload,bulkPostAuth);let scopedItem=forceCreateScope(payload,bulkPostAuth,resolveCol2);if(!scopedItem.ok)return ctx.set.status=403,{success:!1,message:`Forbidden: ownership scope references a column '${scopedItem.field}' this entity does not have`};if(table.columns){let validation=validatePayload(payload,table.columns,!1);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}if(userId&&!isAnonymousCreate(table,payload))payload.createdBy=userId;sanitizedItems.push(payload)}let txResult=await database.transaction(async(tx)=>{let results=[];for(let payload of sanitizedItems){let result=await tx.insert(drizzleTable2).values(payload).returning();results.push(result[0])}return results}),auditPath=auditPathContext(ctx.request);for(let[i,row]of txResult.entries())await logger2.audit({entityName:table.table_name,entityId:auditEntityId(row.id),operation:"CREATE",summary:`Bulk created ${table.table_name} (${row.id})`,newValues:row,...auditIdentityFor(table,sanitizedItems[i]??{},userId,ctx.request.headers),...auditPath});return{success:!0,data:txResult.map((r)=>projectWrittenRow(r,bulkPostAuth))}}}));if(!table.excluded_methods?.includes("PUT"))declared.push(defineRoute({method:"PUT",path:"/bulk",body:bulkUpdateSchema,detail:{tags:[swaggerTag],summary:`Bulk update ${tableName}`,description:`Update multiple ${tableName} records`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let items=ctx.body;if(!Array.isArray(items))return ctx.set.status=400,{success:!1,message:"Body must be an array"};if(items.length>MAX_BULK_ITEMS)return ctx.set.status=400,{success:!1,message:`Bulk request exceeds ${MAX_BULK_ITEMS} items`};let userId=ctx.request.headers.get("x-user-id"),bulkPutAuth=await performAuthCheck(ctx.request,"PUT",writeFields);if(bulkPutAuth&&!bulkPutAuth.authorized)return ctx.set.status=403,{success:!1,message:bulkPutAuth.reason||"Forbidden"};let bulkPutScope=scopeConditionsFor(bulkPutAuth,resolveCol2),prepared=[];for(let item of items){let payload=item.data;if(table.columns){payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0}),payload=filterWritePayload(payload,bulkPutAuth);let validation=validatePayload(payload,table.columns,!0);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}if(payload.updatedAt=new Date,userId)payload.updatedBy=userId;prepared.push({id:item.id,payload})}let beforeById=new Map,txResult=await database.transaction(async(tx)=>{if(prepared.length>0){let idFilter=inArray11(idCol2,prepared.map((p)=>p.id)),beforeRows=await tx.select().from(drizzleTable2).where(bulkPutScope.length>0?and16(idFilter,...bulkPutScope):idFilter);for(let row of beforeRows)if(row.id!=null)beforeById.set(String(row.id),row)}let results=[];for(let{id,payload}of prepared){let result=await tx.update(drizzleTable2).set(payload).where(bulkPutScope.length>0?and16(eq31(idCol2,id),...bulkPutScope):eq31(idCol2,id)).returning();if(result[0])results.push(result[0])}return results});await endSessionsForDeactivated(ctx.request,txResult.map((row)=>({before:beforeById.get(String(row.id)),after:row})));let auditPath=auditPathContext(ctx.request);for(let row of txResult){let rowId=String(row.id);await logger2.audit({entityName:table.table_name,entityId:auditEntityId(row.id),operation:"UPDATE",userId:userId||void 0,summary:`Bulk updated ${table.table_name} (${rowId})`,oldValues:beforeById.get(rowId),newValues:row,...auditPath})}return{success:!0,data:txResult.map((r)=>projectWrittenRow(r,bulkPutAuth))}}}));if(!table.excluded_methods?.includes("DELETE"))declared.push(defineRoute({method:"DELETE",path:"/bulk",body:bulkDeleteSchema,detail:{tags:[swaggerTag],summary:`Bulk delete ${tableName}`,description:`Delete multiple ${tableName} records`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let ids=ctx.body;if(!Array.isArray(ids))return{success:!1,message:"Body must be an array of ids"};if(ids.length>MAX_BULK_ITEMS)return ctx.set.status=400,{success:!1,message:`Bulk request exceeds ${MAX_BULK_ITEMS} items`};let bulkDeleteAuth=await performAuthCheck(ctx.request,"DELETE");if(bulkDeleteAuth&&!bulkDeleteAuth.authorized)return ctx.set.status=403,{success:!1,message:bulkDeleteAuth.reason||"Forbidden"};let bulkDeleteScope=scopeConditionsFor(bulkDeleteAuth,resolveCol2),userId=ctx.request.headers.get("x-user-id"),removed=[];await database.transaction(async(tx)=>{for(let id of ids){let r=await tx.delete(drizzleTable2).where(bulkDeleteScope.length>0?and16(eq31(idCol2,id),...bulkDeleteScope):eq31(idCol2,id)).returning();removed.push(...r)}});{let link=accountLinkFor(config.accountLinks,tableName),bulkUserIds=link?accountIdsIn(removed,link.userColumn):[];if(bulkUserIds.length>0){let authTables=resolveAuthTablesForRequest(ctx.request,{usersTable:schemaTables[AUTHORIZATION_TABLE_KEYS.users],sessionsTable:schemaTables.userSessions??schemaTables.sessions,schemaTables,tenantRegistry:config.tenantRegistry,getTenantRegistry:config.getTenantRegistry}),result=await closeAccounts({db:database,usersTable:authTables.usersTable,sessionsTable:authTables.sessionsTable,onError:(error3)=>logger2.error(`[Entity] ${removed.length} ${tableName} rows were deleted but their accounts could not be closed`,{error:error3})},bulkUserIds);if(result.closed>0&&!result.signedOut)logger2.warn(`[Entity] ${result.closed} account(s) behind deleted ${tableName} rows were deactivated but their open sessions were not cleared`)}}let auditPath=auditPathContext(ctx.request);for(let row of removed)await logger2.audit({entityName:table.table_name,entityId:auditEntityId(row.id),operation:"DELETE",userId:userId||void 0,summary:`Bulk deleted ${table.table_name} (${row.id})`,oldValues:row,...auditPath});return{success:!0,data:{deleted:removed.length}}}}))}mountRoutes(app,[{prefix:`/${tableName}`,guards:entityGuards,routes:declared}])}return app}init_esm3();init_AccountLink();import{randomUUID as randomUUID9}from"crypto";var LOCK_TTL_SECONDS2=60,RENEW_INTERVAL_MS=20000,lockKeyFor=(mappingId)=>`integrations:run:${mappingId}`;async function acquireRunLock(store,mappingId,deps={}){let key2=lockKeyFor(mappingId),now=deps.now??Date.now,ttl=deps.ttlSeconds??LOCK_TTL_SECONDS2,token=randomUUID9(),existing=await store.read(key2);if(!existing.success)return{ok:!1,reason:"unavailable",error:existing.error};if(existing.data)return{ok:!1,reason:"held",heldSince:existing.data.acquiredAt??null};let created=await store.create(key2,{token,acquiredAt:now()},ttl);if(!created.success)return{ok:!1,reason:"unavailable",error:created.error};let readBack=await store.read(key2);if(!readBack.success)return{ok:!1,reason:"unavailable",error:readBack.error};if(readBack.data?.token!==token)return{ok:!1,reason:"held",heldSince:readBack.data?.acquiredAt??null};let held=!0,timer=setInterval(()=>{(async()=>{let current=await store.read(key2);if(!current.success)return;if(current.data?.token!==token){held=!1,clearInterval(timer),deps.logger?.warn("[Integrations] Run lock was taken over",{mappingId});return}await store.create(key2,current.data,ttl)})()},RENEW_INTERVAL_MS);return timer.unref?.(),{ok:!0,handle:{token,isHeld:()=>held,release:async()=>{if(clearInterval(timer),!held)return;held=!1;let current=await store.read(key2);if(current.success&&current.data?.token===token)await store.remove(key2)}}}}import{createHash as createHash2}from"crypto";function buildUrl(baseUrl,path7,params){let base=baseUrl.trim().replace(/\/+$/,"");if(!base)return{ok:!1,error:"The source has no base address."};let raw=(path7??"").trim();if(/^[a-z][a-z0-9+.-]*:\/\//i.test(raw)||raw.startsWith("//"))return{ok:!1,error:`The endpoint path points at another host (${raw}). A path must be relative to the source address.`};let suffix=raw===""?"":raw.startsWith("/")?raw:`/${raw}`,url;try{url=new URL(`${base}${suffix}`)}catch{return{ok:!1,error:`The source address is not a valid URL: ${baseUrl}`}}for(let[key2,value2]of Object.entries(params??{})){if(value2==null)continue;url.searchParams.set(key2,String(value2))}return{ok:!0,url}}function applyAuth(source,url){let headers={accept:"application/json",...source.extraHeaders??{}},token=source.token?.trim();if(!token)return{headers};switch(source.authType){case"bearer":case"oauth2":headers[source.authHeaderName||"Authorization"]=`Bearer ${token}`;break;case"api_key":if(source.authQueryParam)url.searchParams.set(source.authQueryParam,token);else headers[source.authHeaderName||"X-API-Key"]=token;break;case"basic":headers.Authorization=`Basic ${token}`;break;default:break}return{headers}}function describeTransportError(error3){let message=error3 instanceof Error?error3.message:String(error3),cause=error3?.cause,code=cause?.code??"",blob=`${message} ${code} ${cause?.message??""}`;if(/UNABLE_TO_GET_ISSUER_CERT|SELF_SIGNED|self.signed|CERT_|unable to verify|ERR_TLS|altnames/i.test(blob))return`Certificate verification failed (${code||"incomplete chain"}). If this server's certificate is knowingly self-signed or incomplete, turn off certificate verification for this source and try again.`;if(/ENOTFOUND|EAI_AGAIN|getaddrinfo|Unable to resolve/i.test(blob))return`The address could not be resolved (DNS${code?`: ${code}`:""}). Check the source address.`;if(/ECONNREFUSED/i.test(blob))return`The connection was refused (${code||"ECONNREFUSED"}). The address and port are reachable but nothing is listening.`;if(/ETIMEDOUT|timeout|timed out|aborted|AbortError|UND_ERR/i.test(blob))return`The connection timed out (${code||"timeout"}). Check network and firewall access to this address.`;if(/ECONNRESET|EPIPE/i.test(blob))return`The connection was closed by the other side (${code||"ECONNRESET"}).`;return`Connection error: ${message}`}async function fetchOnce(source,request,deps={}){let impl=deps.fetchImpl??fetch,headers={...request.headers},method=request.method.toUpperCase(),hasBody=request.body!==void 0&&method!=="GET"&&method!=="HEAD";if(hasBody&&!headers["content-type"]&&!headers["Content-Type"])headers["content-type"]="application/json";let init={method,headers,cache:"no-store",signal:AbortSignal.timeout(source.timeoutMs??30000),tls:{rejectUnauthorized:source.tlsVerify!==!1},...hasBody?{body:typeof request.body==="string"?request.body:JSON.stringify(request.body)}:{}},response;try{response=await impl(request.url.toString(),init)}catch(error3){return deps.logger?.warn("[Integrations] Outbound request failed",{sourceId:source.id,url:request.url.origin+request.url.pathname,error:error3 instanceof Error?error3.message:String(error3)}),{ok:!1,status:0,body:null,linkHeader:null,error:describeTransportError(error3)}}let text=await response.text().catch(()=>""),body=null;if(text)try{body=JSON.parse(text)}catch{body=text}let linkHeader=response.headers.get("link");if(!response.ok){let detail=typeof body==="string"?body:body==null?"":JSON.stringify(body);return{ok:!1,status:response.status,body,linkHeader,error:`The source returned HTTP ${response.status}${detail?` \u2014 ${detail.slice(0,300)}`:""}`}}return{ok:!0,status:response.status,body,linkHeader}}var EXPIRY_SKEW_MS=5000,DEFAULT_TTL_MS=300000,DEFAULT_REFRESH_TTL_MS=1800000,FIELD_SEPARATOR="\x00";function credentialFingerprint(config){let material=[config.tokenUrl,config.grantType,config.clientId??"",config.clientSecret??"",config.username??"",config.password??"",config.scope??"",config.clientAuth??"basic"].join(FIELD_SEPARATOR);return createHash2("sha256").update(material).digest("hex").slice(0,32)}class TokenCache{entries=new Map;get(sourceId,fingerprint){let entry=this.entries.get(sourceId);if(!entry)return null;if(entry.fingerprint!==fingerprint)return this.entries.delete(sourceId),null;return entry}set(sourceId,token){this.entries.set(sourceId,token)}invalidate(sourceId){this.entries.delete(sourceId)}clear(){this.entries.clear()}}var isUsable=(token,now)=>token.expiresAt>now+EXPIRY_SKEW_MS,canRefresh=(token,now)=>Boolean(token.refreshToken)&&(token.refreshExpiresAt??0)>now+EXPIRY_SKEW_MS;function buildTokenRequest(config,form){let headers={"content-type":"application/x-www-form-urlencoded",accept:"application/json"};if(config.scope&&!form.has("scope"))form.set("scope",config.scope);let clientId=config.clientId??"",clientSecret=config.clientSecret??"";if((config.clientAuth??"basic")==="basic")headers.authorization=`Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString("base64")}`;else{if(clientId)form.set("client_id",clientId);if(clientSecret)form.set("client_secret",clientSecret)}return{headers,body:form.toString()}}async function requestToken(config,form,now,fetchImpl){let{headers,body}=buildTokenRequest(config,form),response;try{response=await fetchImpl(config.tokenUrl,{method:"POST",headers,body,cache:"no-store",signal:AbortSignal.timeout(config.timeoutMs??30000),tls:{rejectUnauthorized:config.tlsVerify!==!1}})}catch(error3){return{ok:!1,error:`Token request failed \u2014 ${describeTransportError(error3)}`}}let text=await response.text().catch(()=>""),json={};try{json=text?JSON.parse(text):{}}catch{}if(!response.ok||!json.access_token){let detail=json.error_description||json.error||text.slice(0,200);return{ok:!1,error:`Could not obtain an OAuth2 token (HTTP ${response.status})${detail?`: ${detail}`:""}`}}return{ok:!0,token:{accessToken:json.access_token,expiresAt:now+(json.expires_in?json.expires_in*1000:DEFAULT_TTL_MS),refreshToken:json.refresh_token,refreshExpiresAt:json.refresh_token?now+(json.refresh_expires_in?json.refresh_expires_in*1000:DEFAULT_REFRESH_TTL_MS):void 0,fingerprint:credentialFingerprint(config)}}}async function getAccessToken(config,cache,deps={}){let fetchImpl=deps.fetchImpl??fetch,now=deps.now?.()??Date.now();if(!config.tokenUrl?.trim())return{ok:!1,error:"No token URL is configured for this source."};let fingerprint=credentialFingerprint(config),cached=cache.get(config.sourceId,fingerprint);if(cached&&isUsable(cached,now))return{ok:!0,accessToken:cached.accessToken,fromCache:!0};if(cached&&canRefresh(cached,now)){let refreshed=await requestToken(config,new URLSearchParams({grant_type:"refresh_token",refresh_token:cached.refreshToken}),now,fetchImpl);if(refreshed.ok)return cache.set(config.sourceId,refreshed.token),{ok:!0,accessToken:refreshed.token.accessToken,fromCache:!1}}let form=new URLSearchParams({grant_type:config.grantType});if(config.grantType==="password")form.set("username",config.username??""),form.set("password",config.password??"");let minted=await requestToken(config,form,now,fetchImpl);if(!minted.ok)return{ok:!1,error:minted.error};return cache.set(config.sourceId,minted.token),{ok:!0,accessToken:minted.token.accessToken,fromCache:!1}}import{and as and17,eq as eq32,inArray as inArray12}from"drizzle-orm";var DEFAULT_IGNORED=["updatedAt","updated_at","updatedBy","updated_by"];function planRevert(input){let ignored=new Set([...DEFAULT_IGNORED,...input.ignoreColumns??[]]),ops={deletes:[],restores:[],reinserts:[],conflicts:[]};for(let image of input.preImages)switch(image.action){case"create":{if(!image.rowId)break;let now=input.current.get(image.rowId);if(!now)break;if(!input.force&&changedSince(image.after,now,ignored)){ops.conflicts.push({id:image.rowId,reason:"This record was edited after the import; deleting it would discard that edit."});break}ops.deletes.push(image.rowId);break}case"update":case"deactivate":{if(!image.rowId||!image.before)break;let now=input.current.get(image.rowId);if(!now)break;if(!input.force&&changedSince(image.after,now,ignored)){ops.conflicts.push({id:image.rowId,reason:"This record was edited after the import; restoring it would discard that edit."});break}ops.restores.push({id:image.rowId,row:image.before});break}case"delete":{if(!image.before)break;if(image.rowId&&input.current.has(image.rowId)){ops.conflicts.push({id:image.rowId,reason:"A record with this identifier exists again; it was not replaced."});break}ops.reinserts.push(image.before);break}default:break}return ops}function changedSince(after,now,ignored){if(!after)return!1;for(let[key2,value2]of Object.entries(after)){if(ignored.has(key2))continue;if(!sameValue(value2,now[key2]))return!0}return!1}function sameValue(a,b){if(a===b)return!0;if(a==null&&b==null)return!0;if(a instanceof Date&&b instanceof Date)return a.getTime()===b.getTime();if(a instanceof Date||b instanceof Date){let da=a instanceof Date?a:new Date(String(a)),db=b instanceof Date?b:new Date(String(b));return!Number.isNaN(da.getTime())&&!Number.isNaN(db.getTime())?da.getTime()===db.getTime():!1}if(typeof a==="object"||typeof b==="object")try{return JSON.stringify(a)===JSON.stringify(b)}catch{return!1}return String(a)===String(b)}var CHUNK=500;async function applyRevert(deps,ops,meta){let idCol=deps.resolveCol("id");if(!idCol)return{ok:!1,conflicts:ops.conflicts.length,error:`"${meta.targetEntity}" has no id column; its rows cannot be addressed.`};let now=new Date;try{let work=async(tx)=>{let deleted=0,restored=0,reinserted=0;for(let i=0;i<ops.deletes.length;i+=CHUNK){let chunk=ops.deletes.slice(i,i+CHUNK),removed=await tx.delete(deps.drizzleTable).where(inArray12(idCol,chunk)).returning();deleted+=removed.length}for(let restore of ops.restores){let{id:_id,createdAt:_c,createdBy:_cb,...rest3}=restore.row,written=await tx.update(deps.drizzleTable).set({...rest3,updatedAt:now,updatedBy:meta.userId}).where(and17(eq32(idCol,restore.id))).returning();restored+=written.length}if(ops.reinserts.length>0)for(let i=0;i<ops.reinserts.length;i+=CHUNK){let chunk=ops.reinserts.slice(i,i+CHUNK),written=await tx.insert(deps.drizzleTable).values(chunk).returning();reinserted+=written.length}return{deleted,restored,reinserted}};return{ok:!0,...meta.tx?await work(meta.tx):await deps.db.transaction(work),conflicts:ops.conflicts.length}}catch(error3){return deps.logger.error("[Integrations] Revert transaction failed",{targetEntity:meta.targetEntity,error:error3 instanceof Error?error3.message:String(error3)}),{ok:!1,conflicts:ops.conflicts.length,error:"The database rejected this undo; it was rolled back and nothing changed."}}}function groupPreImagesByEntity(preImages){let byEntity=new Map;for(let image of preImages){let list2=byEntity.get(image.targetEntity);if(list2)list2.push(image);else byEntity.set(image.targetEntity,[image])}return[...byEntity.entries()].map(([targetEntity,images])=>({targetEntity,preImages:images}))}function touchedRowIds(preImages){let ids=new Set;for(let image of preImages)if(image.rowId)ids.add(image.rowId);return[...ids]}var TREE_PARENT_KEY="__treeParent";function flattenTree(records,childrenPath){let out=[],truncated=!1,visit=(node,parent,depth)=>{if(!node||typeof node!=="object")return;if(depth>64){truncated=!0;return}let source=node,children=source[childrenPath],{[childrenPath]:_nested,...own}=source;if(out.push({...own,["__depth"]:depth,["__treeParent"]:parent??null}),!Array.isArray(children))return;for(let child of children)visit(child,own,depth+1)};for(let root of records)visit(root,null,0);return{records:out,truncated}}function treeChildrenPath(value2){let trimmed=(value2??"").trim();return trimmed.length>0?trimmed:null}function getByPath(obj,path7){if(!path7)return;let cur=obj;for(let part of path7.split(".")){if(cur==null||typeof cur!=="object")return;cur=cur[part]}return cur}function readSourceValue(external,parent,path7){return readOne(external,parent,path7)}function readOne(external,parent,path7){return path7.startsWith("__parent.")?getByPath(parent,path7.slice(9)):getByPath(external,path7)}var TEMPLATE_TOKEN=/\{([^{}]+)\}/g;function isTemplateSource(source){return TEMPLATE_TOKEN.lastIndex=0,TEMPLATE_TOKEN.test(source)}function renderTemplate(template,external,parent){let treeParentAbsent=external!=null&&typeof external==="object"&&TREE_PARENT_KEY in external&&external[TREE_PARENT_KEY]==null,readsTreeParent=(text)=>text.includes(`{${TREE_PARENT_KEY}.`),readToken=(token)=>{let[path7="",transform3]=token.split("|"),value2=readOne(external,parent,path7.trim());if(transform3===void 0)return value2;let result=applyTransform(value2,transform3.trim());return result.ok?result.value:value2};for(let alternative of template.split("||")){let candidate=alternative.trim();if(candidate==="")continue;if(treeParentAbsent&&readsTreeParent(candidate))continue;let complete=!0,rendered=candidate.replace(TEMPLATE_TOKEN,(_match,token)=>{let value2=readToken(token);if(value2==null||String(value2).trim()==="")complete=!1;return value2==null?"":String(value2)});if(complete&&rendered.trim()!=="")return rendered}let last=template.split("||").pop()??template;if(treeParentAbsent&&readsTreeParent(last))return"";return last.trim().replace(TEMPLATE_TOKEN,(_match,token)=>{let value2=readToken(token);return value2==null?"":String(value2)})}function extractRecords(body,rootPath){if(rootPath){let at=getByPath(body,rootPath);if(Array.isArray(at))return at;return at&&typeof at==="object"?[at]:[]}let candidate=firstArrayLike(body)??deepFirstArrayOfObjects(body);return Array.isArray(candidate)?candidate:[]}var ENVELOPE_KEYS=["content","items","data","results","records","rows","list","value","responseObject"];function firstArrayLike(body){if(Array.isArray(body))return body;if(!body||typeof body!=="object")return;let b=body;for(let key2 of ENVELOPE_KEYS){let v=b[key2];if(Array.isArray(v))return v;if(v&&typeof v==="object"){let nested=v.items;if(Array.isArray(nested))return nested}}return}function deepFirstArrayOfObjects(body,depth=0){if(depth>5||body==null||typeof body!=="object"||body instanceof Date)return;if(Array.isArray(body))return body.length>0&&typeof body[0]==="object"&&body[0]!==null?body:void 0;let entries=Object.values(body);for(let v of entries)if(Array.isArray(v)&&v.length>0&&typeof v[0]==="object"&&v[0]!==null)return v;for(let v of entries)if(v&&typeof v==="object"&&!Array.isArray(v)){let found=deepFirstArrayOfObjects(v,depth+1);if(found)return found}for(let v of entries)if(Array.isArray(v))return v;return}var FOLD={\u{131}:"i",\u{130}:"I",\u{15f}:"s",\u{15e}:"S",\u{11f}:"g",\u{11e}:"G",\u{f8}:"o",\u{d8}:"O",\u{e6}:"ae",\u{c6}:"AE",\u{df}:"ss",\u{111}:"d",\u{110}:"D",\u{142}:"l",\u{141}:"L"};function foldToAscii(value2){return value2.replace(/[\u0131\u0130\u015F\u015E\u011F\u011E\u00F8\u00D8\u00E6\u00C6\u00DF\u0111\u0110\u0142\u0141]/g,(ch)=>FOLD[ch]??ch).normalize("NFD").replace(/[\u0300-\u036f]/g,"")}var TRUTHY=new Set(["true","1","yes","y","evet","e","on"]),FALSY=new Set(["false","0","no","n","hayir","hay\u0131r","h","off"]);function applyTransform(value2,transform3,locale){if(value2==null)return{ok:!0,value:value2};switch(transform3){case"trim":return{ok:!0,value:String(value2).trim()};case"upper":return{ok:!0,value:String(value2).trim().toLocaleUpperCase(locale)};case"lower":return{ok:!0,value:String(value2).trim().toLocaleLowerCase(locale)};case"toString":return{ok:!0,value:String(value2)};case"toNumber":{if(typeof value2==="boolean")return{ok:!1,reason:"not a number",raw:value2};let s=String(value2).trim();if(s==="")return{ok:!0,value:null};let n=Number(s);return Number.isFinite(n)?{ok:!0,value:n}:{ok:!1,reason:"not a number",raw:value2}}case"toBoolean":{if(typeof value2==="boolean")return{ok:!0,value:value2};let s=String(value2).trim().toLocaleLowerCase("tr-TR");if(s==="")return{ok:!0,value:null};if(TRUTHY.has(s))return{ok:!0,value:!0};if(FALSY.has(s))return{ok:!0,value:!1};return{ok:!1,reason:"not a yes/no value",raw:value2}}case"emailSafe":return{ok:!0,value:foldToAscii(String(value2)).toLowerCase().trim().replace(/[^a-z0-9._@+-]+/g,".").replace(/\.{2,}/g,".").replace(/\.*@\.*/g,"@").replace(/^[.\-_]+|[.\-_]+$/g,"")};case"slug":return{ok:!0,value:foldToAscii(String(value2)).toLowerCase().trim().replace(/[^a-z0-9]+/g,"-").replace(/-{2,}/g,"-").replace(/^-+|-+$/g,"")};case"pathLeaf":{let parts=String(value2).split(/[/\\>\u203A\u00BB]|->/).map((part)=>part.trim()).filter((part)=>part!=="");return{ok:!0,value:parts.length>0?parts[parts.length-1]:""}}case"toList":{if(Array.isArray(value2))return{ok:!0,value:value2};let s=String(value2).trim();if(s==="")return{ok:!0,value:[]};return{ok:!0,value:s.split(",").map((part)=>part.trim()).filter((part)=>part!=="")}}case"dateOnly":{let s=String(value2).trim();if(s==="")return{ok:!0,value:null};let leading=s.match(/^\d{4}-\d{2}-\d{2}/);if(leading)return{ok:!0,value:leading[0]};let d=new Date(s);return Number.isNaN(d.getTime())?{ok:!1,reason:"not a date",raw:value2}:{ok:!0,value:d.toISOString().slice(0,10)}}default:return{ok:!0,value:value2}}}function isEmpty(v){return v==null||typeof v==="string"&&v.trim()===""}function mapRecord(external,mappings,parent){let row={},problems=[];for(let fm of mappings){if(!fm.target)continue;let value2;if(fm.constant!=null&&fm.constant!=="")value2=fm.constant;else{let raw=isTemplateSource(fm.source)?renderTemplate(fm.source,external,parent):readOne(external,parent,fm.source),result=applyTransform(raw,fm.transform);if(!result.ok)problems.push(`${fm.source} \u2192 ${fm.target}: ${result.reason} (${String(result.raw)})`),value2=null;else value2=result.value}if(isEmpty(value2)&&fm.fallback!=null&&fm.fallback!==""){let raw=isTemplateSource(fm.fallback)?renderTemplate(fm.fallback,external,parent):fm.fallback,result=applyTransform(raw,fm.transform);if(result.ok)value2=result.value;else problems.push(`fallback \u2192 ${fm.target}: ${result.reason} (${String(result.raw)})`),value2=null}if(value2!==void 0)row[fm.target]=value2}return{row,problems}}function buildMappedRecords(externalRecords,mappings,dedupTargetField,parents){let records=[],issues=[];return externalRecords.forEach((ext,i)=>{let{row,problems}=mapRecord(ext,mappings,parents?.[i]);for(let message of problems)issues.push({sourceIndex:i,kind:"invalid_value",message});let dedupKey=dedupTargetField&&!isEmpty(row[dedupTargetField])?String(row[dedupTargetField]).trim():null;records.push({data:row,dedupKey,sourceIndex:i,external:ext,parent:parents?.[i]})}),{records,issues}}function flattenKeys(obj,prefix="",out=[],depth=0){if(out.length>200||depth>4||obj==null||typeof obj!=="object")return out;if(Array.isArray(obj)){if(prefix)out.push(prefix);return out}for(let[k,v]of Object.entries(obj)){let path7=prefix?`${prefix}.${k}`:k;if(v!=null&&typeof v==="object"&&!Array.isArray(v))flattenKeys(v,path7,out,depth+1);else out.push(path7)}return out}var MAX_FANOUT_COMBINATIONS=5000;function resolvePath2(rawPath,values){let missing=new Set,used=new Set;return{path:rawPath.replace(/\{([a-zA-Z_][\w-]*)\}|:([a-zA-Z_]\w*)/g,(_full,brace,colon)=>{let key2=brace??colon,v=values[key2];if(v==null||v==="")return missing.add(key2),brace?`{${key2}}`:`:${key2}`;return used.add(key2),encodeURIComponent(String(v))}),missing:[...missing],used}}function planFetchOrder(endpoints,roots){let byId=new Map(endpoints.map((e)=>[e.id,e])),order=[],settled=new Set,onPath=[],onPathSet=new Set,visit=(id,requiredBy)=>{if(settled.has(id))return null;if(onPathSet.has(id))return{ok:!1,reason:"cycle",chain:[...onPath.slice(onPath.indexOf(id)),id]};let node=byId.get(id);if(!node)return{ok:!1,reason:"unknown_endpoint",missing:id,requiredBy:requiredBy??id};onPath.push(id),onPathSet.add(id);for(let binding of node.paramBindings??[]){if(binding.from!=="endpoint")continue;let failure=visit(binding.endpointId,id);if(failure)return failure}return onPath.pop(),onPathSet.delete(id),settled.add(id),order.push(id),null};for(let id of roots??endpoints.map((e)=>e.id)){let failure=visit(id,null);if(failure)return failure}return{ok:!0,order}}function expandBindings(bindings,sources,limit=MAX_FANOUT_COMBINATIONS){if(!bindings||bindings.length===0)return{ok:!0,calls:[{values:{}}]};let axes=[];for(let binding of bindings){if(binding.from==="static"){axes.push({param:binding.param,options:[{value:binding.value}]});continue}if(binding.from==="endpoint"){let options=(sources.parents?.[binding.endpointId]??[]).map((record3)=>({value:getByPath(record3,binding.field),parent:record3})).filter((o)=>o.value!=null&&o.value!=="");axes.push({param:binding.param,options});continue}let values=sources.entityValues?.[`${binding.entity}.${binding.field}`]??[];axes.push({param:binding.param,options:values.filter((v)=>v!=null&&v!=="").map((value2)=>({value:value2}))})}if(axes.some((a)=>a.options.length===0))return{ok:!0,calls:[]};let combinations=axes.reduce((n,a)=>n*a.options.length,1);if(combinations>limit)return{ok:!1,reason:"too_many",combinations,limit};let calls=[{values:{}}];for(let axis of axes){let next=[];for(let call of calls)for(let option of axis.options)next.push({values:{...call.values,[axis.param]:option.value},parent:option.parent??call.parent});calls=next}return{ok:!0,calls}}function parentEndpointIds(bindings){let ids=new Set;for(let b of bindings??[])if(b.from==="endpoint")ids.add(b.endpointId);return[...ids]}function entityValueKeys(bindings){let keys=new Set;for(let b of bindings??[])if(b.from==="entity")keys.add(`${b.entity}.${b.field}`);return[...keys]}var MAX_PAGES=1000,DEFAULT_PAGE_SIZE=200,initialState=()=>({pagesFetched:0,recordsFetched:0,cursor:null});function firstPageParams(profile){switch(profile.kind){case"page_number":{let params={[profile.pageParam]:String(profile.firstPage??0)};if(profile.sizeParam)params[profile.sizeParam]=String(pageSize(profile));return params}case"offset":return{[profile.offsetParam]:"0",[profile.limitParam]:String(pageSize(profile))};case"cursor":{let params={};if(profile.sizeParam)params[profile.sizeParam]=String(pageSize(profile));return params}case"link_header":{let params={};if(profile.sizeParam)params[profile.sizeParam]=String(pageSize(profile));return params}default:return{}}}function reportedTotal(profile,body){let path7=profile.kind==="page_number"||profile.kind==="offset"?profile.totalPath:void 0;if(!path7)return null;let raw=getByPath(body,path7);if(typeof raw==="number"&&Number.isFinite(raw)&&raw>=0)return Math.floor(raw);if(typeof raw==="string"&&raw.trim()!==""){let n=Number(raw);if(Number.isFinite(n)&&n>=0)return Math.floor(n)}return null}function nextPage(profile,state,observed){if(profile.kind==="none")return{kind:"done",reason:"single request"};if(state.pagesFetched>=MAX_PAGES)return{kind:"failed",reason:`Paging stopped after ${MAX_PAGES} requests without reaching the end. The source may not be honouring the paging parameters; importing this would be a partial read.`};if(observed.recordCount===0)return{kind:"done",reason:"empty page"};switch(profile.kind){case"page_number":{if(isLastPage(profile.lastPagePath,observed.body))return{kind:"done",reason:"source reported the last page"};let total=reportedTotal(profile,observed.body);if(total!==null&&state.recordsFetched>=total)return{kind:"done",reason:"reported total reached"};if(observed.recordCount<pageSize(profile))return{kind:"done",reason:"short page"};let next=(profile.firstPage??0)+state.pagesFetched,params={[profile.pageParam]:String(next)};if(profile.sizeParam)params[profile.sizeParam]=String(pageSize(profile));return{kind:"params",params}}case"offset":{let total=reportedTotal(profile,observed.body);if(total!==null&&state.recordsFetched>=total)return{kind:"done",reason:"reported total reached"};if(observed.recordCount<pageSize(profile))return{kind:"done",reason:"short page"};return{kind:"params",params:{[profile.offsetParam]:String(state.recordsFetched),[profile.limitParam]:String(pageSize(profile))}}}case"cursor":{let raw=getByPath(observed.body,profile.nextCursorPath),next=raw==null?"":String(raw).trim();if(next==="")return{kind:"done",reason:"no further cursor"};if(state.cursor!=null&&next===state.cursor)return{kind:"failed",reason:`The source returned the same cursor twice (${next}); paging would not advance.`};let params={[profile.cursorParam]:next};if(profile.sizeParam)params[profile.sizeParam]=String(pageSize(profile));return{kind:"params",params}}case"link_header":{let url=parseNextLink(observed.linkHeader);if(!url)return{kind:"done",reason:"no rel=next link"};return{kind:"url",url}}default:return{kind:"done",reason:"single request"}}}function pageSize(profile){let declared="pageSize"in profile?profile.pageSize:void 0;return declared&&declared>0?declared:DEFAULT_PAGE_SIZE}function isLastPage(path7,body){if(!path7)return!1;let raw=getByPath(body,path7);if(typeof raw==="boolean")return raw;if(typeof raw==="string")return raw.trim().toLowerCase()==="true";return!1}function parseNextLink(header){if(!header)return null;for(let part of splitLinks(header)){let match=part.match(/<([^>]*)>(.*)/);if(!match)continue;let url=(match[1]??"").trim(),attrs=match[2]??"";if(!url)continue;if(/;\s*rel\s*=\s*["']?\s*next\s*["']?(\s*;|\s*$)/i.test(attrs))return url}return null}function splitLinks(header){let parts=[],depth=0,current="";for(let ch of header){if(ch==="<")depth++;else if(ch===">")depth--;if(ch===","&&depth===0){parts.push(current),current="";continue}current+=ch}if(current.trim()!=="")parts.push(current);return parts}var DEFAULT_MAX_CONCURRENT=4,DEFAULT_MAX_RECORDS=50000;async function collectOne(source,endpoint,params,deps,counters){let profile=endpoint.pagination??{kind:"none"},maxRecords=deps.maxRecords??DEFAULT_MAX_RECORDS,values={...endpoint.queryParams??{},...params.values},resolved=resolvePath2(endpoint.path,values);if(resolved.missing.length>0)return{ok:!1,error:`This endpoint needs path parameter(s) ${resolved.missing.map((m)=>`{${m}}`).join(", ")} and nothing supplies them. Add a parameter binding, or a static value.`};let baseQuery={};for(let[key2,value2]of Object.entries(values)){if(value2==null||resolved.used.has(key2))continue;baseQuery[key2]=value2}let records=[],total=null,state=initialState(),pageParams=firstPageParams(profile),absoluteUrl=null;for(;;){if(deps.isCancelled?.())return{ok:!1,error:"Cancelled."};let url;if(absoluteUrl)try{url=new URL(absoluteUrl)}catch{return{ok:!1,error:`The source returned an unusable next-page link: ${absoluteUrl}`}}else{let built=buildUrl(source.baseUrl,resolved.path,{...baseQuery,...pageParams});if(!built.ok)return{ok:!1,error:built.error};url=built.url}let headers={accept:"application/json"};if(deps.bearerToken)headers.Authorization=`Bearer ${deps.bearerToken}`;counters.calls++;let outcome=await fetchOnce({...source,token:deps.bearerToken??source.token},{method:endpoint.method,url,headers,body:endpoint.method.toUpperCase()==="GET"?void 0:endpoint.requestBody??{}},{fetchImpl:deps.fetchImpl});if(!outcome.ok)return{ok:!1,error:outcome.error??`HTTP ${outcome.status}`};let raw=extractRecords(outcome.body,endpoint.responseRootPath),childrenPath=treeChildrenPath(endpoint.treeChildrenPath),flattened=childrenPath?flattenTree(raw,childrenPath):null;if(flattened?.truncated)return{ok:!1,error:"This source answered with a structure that nests into itself. Nothing was imported \u2014 a company that contains itself has no order to write it in."};let page=flattened?flattened.records:raw;if(records.push(...page),counters.records+=page.length,total===null)total=reportedTotal(profile,outcome.body);if(counters.records>maxRecords)return{ok:!1,error:`This run would hold more than ${maxRecords} records at once. Narrow the source with a filter, or raise maxRecordsPerRun.`};deps.onProgress?.(counters.records),state={pagesFetched:state.pagesFetched+1,recordsFetched:records.length,cursor:pageParams[cursorParamOf(profile)??""]??state.cursor};let next=nextPage(profile,state,{recordCount:page.length,body:outcome.body,linkHeader:outcome.linkHeader});if(next.kind==="done")break;if(next.kind==="failed")return{ok:!1,error:next.reason};if(next.kind==="url"){absoluteUrl=next.url,pageParams={};continue}absoluteUrl=null,pageParams=next.params}return{ok:!0,records,total}}function cursorParamOf(profile){return profile.kind==="cursor"?profile.cursorParam:null}function describeCallFailure(call,error3){let params=call.values??{},named=Object.entries(params).map(([key2,value2])=>`${key2}=${String(value2)}`).join(", ");return named?`${named}: ${error3}`:error3}async function collectEndpoint(source,endpoint,sources,deps={}){let counters={calls:0,records:0},expansion=expandBindings(endpoint.paramBindings??void 0,sources);if(!expansion.ok)return{ok:!1,callCount:0,error:`This endpoint would be called ${expansion.combinations} times (the ceiling is ${expansion.limit}). Narrow the parent list, or remove one of the parameter bindings.`};if(expansion.calls.length===0)return{ok:!0,records:[],reportedTotal:null,callCount:0};let limit=Math.max(1,deps.maxConcurrent??DEFAULT_MAX_CONCURRENT),collected=[],total=null,failure=null,partial3=[],cursor=0,worker=async()=>{for(;;){if(failure||deps.isCancelled?.())return;let index=cursor++,call=expansion.calls[index];if(!call)return;let result=await collectOne(source,endpoint,call,deps,counters);if(!result.ok){if(expansion.calls.length>1){partial3.push(describeCallFailure(call,result.error));continue}failure??=result.error;return}for(let record3 of result.records)collected.push({record:record3,parent:call.parent});if(expansion.calls.length===1)total=result.total}};if(await Promise.all(Array.from({length:Math.min(limit,expansion.calls.length)},worker)),failure)return{ok:!1,error:failure,callCount:counters.calls};if(deps.isCancelled?.())return{ok:!1,error:"Cancelled.",callCount:counters.calls};if(partial3.length>0&&collected.length===0&&partial3.length===expansion.calls.length)return{ok:!1,error:`Every call to this endpoint failed. First: ${partial3[0]}`,callCount:counters.calls};return{ok:!0,records:collected,reportedTotal:total,callCount:counters.calls,...partial3.length>0?{partialFailures:partial3}:{}}}function isDestructive(writeMode,missingPolicy){return writeMode==="replace"||missingPolicy==="delete"||missingPolicy==="deactivate"}function destructiveGate(input){if(!isDestructive(input.writeMode,input.missingPolicy))return{allowed:!0};if(input.partialFailures>0&&!input.scopedRemoval)return{allowed:!1,kind:"incomplete_source",message:`${input.partialFailures} call(s) in this source never answered, so part of it was not read. This run removes records the source does not send, and those unread records would be removed as if the source had dropped them. Fix the failing call, or switch this mapping to leave missing records alone.`};if(input.fetched===0)return{allowed:!1,kind:"incomplete_source",message:"The source returned no records at all. This run removes what the source does not send, so it would empty the target table. A source that is genuinely empty and one that could "+"not be read look the same from here, so this will not proceed on its own \u2014 preview it, "+"and if the source really is empty, remove the rows deliberately."};if(input.reported!==null&&input.fetched<input.reported)return{allowed:!1,kind:"incomplete_source",message:`The source reports ${input.reported} records but only ${input.fetched} were read. This run deletes what the source does not send, so it will not proceed on a partial read. Check the paging settings for this endpoint.`};return{allowed:!0}}function checkPlanVolume(input){if(input.maxShare<=0)return{allowed:!0};if(input.removing===0||input.existing===0)return{allowed:!0};let share=input.removing/input.existing;if(share<=input.maxShare)return{allowed:!0};let asPercent=(value2)=>`${Math.round(value2*100)}%`;return{allowed:!1,kind:"incomplete_source",message:`This run would remove ${input.removing} of ${input.existing} rows (${asPercent(share)}), which is above the ${asPercent(input.maxShare)} this mapping allows unattended. `+"A source can return perfectly good records and still produce a removal this large \u2014 a "+"changed dedup column, a repointed endpoint, a filter added upstream. Preview the run; if the removal is right, apply it deliberately."}}function orphanLinkNote(input){let{made,unresolved}=input;if(unresolved<=0)return null;let total=made+unresolved,share=total>0?unresolved/total:1,column=input.column?` (${input.column})`:"",consequence=`${unresolved} record${unresolved===1?"":"s"} could not find the parent to attach to${column} \u2014 `+"they are drawn at the TOP of the tree, at the same level as the chief executive.";if(share>=0.2)return`${consequence} Next to the ${made} that did attach, that is a large share: either the source is not sending a parent for these people, or one of the matching fields is written differently in the two places. Look at the source before trusting the chart.`;return`${consequence} ${made} link${made===1?" was":"s were"} made.`}function looksLikeKeyDrift(input){if(input.existing<=0)return!1;if(input.creating<=0||input.unmatched<=0)return!1;return input.creating/input.existing>=0.1&&input.unmatched/input.existing>=0.1}function keyDriftWarning(input){if(!looksLikeKeyDrift(input))return null;return`This run will add ${input.creating} rows, and the source no longer sends ${input.unmatched} of the rows already here. Both being this large points at the matching values in the `+"source having changed \u2014 so these are not new records, they are the same records under "+"new names. Run it with \u201Cmissing rows: leave alone\u201D and both generations survive: the "+`table grows to ${input.existing+input.creating} rows, and where records point at each other (an organisation tree, for instance) the new rows cannot find their old parents and the structure breaks. Either switch the policy to delete/deactivate and clean up `+"once, or correct the matching column to the source\u2019s new value."}var referenceKey=(check)=>`${check.entity}.${check.entityColumn}`,pointsAtOwnTable=(check,targetEntity)=>check.entity===targetEntity;function referenceValuesOf(raw){if(Array.isArray(raw))return{values:raw.map((item)=>String(item??"").trim()).filter((item)=>item!==""),wasList:!0};if(raw===null||raw===void 0)return{values:[],wasList:!1};let single=String(raw).trim();return{values:single===""?[]:[single],wasList:!1}}var isEmptyReference=(raw)=>referenceValuesOf(raw).values.length===0;function resolveReference(raw,ids){let{values,wasList}=referenceValuesOf(raw),found=[],unmatched=[];for(let value2 of values){let id=ids?.[value2];if(id===void 0)unmatched.push(value2);else if(!found.includes(id))found.push(id)}return{ids:found,unmatched,wasList}}function resolvedColumnValue(resolution){return resolution.wasList?resolution.ids:resolution.ids[0]??null}function applyReferenceIds(row,references,ids,targetEntity){let next={...row},deferred=[];for(let check of references){if(!check.writeIdTo)continue;let raw=row[check.column];if(pointsAtOwnTable(check,targetEntity)){if(next[check.writeIdTo]=Array.isArray(raw)?[]:null,!isEmptyReference(raw))deferred.push({check,raw});continue}next[check.writeIdTo]=resolvedColumnValue(resolveReference(raw,ids[referenceKey(check)]))}return{row:next,deferred}}function unambiguousIds(rows){let seen=new Map;for(let row of rows){if(row.value==null||row.id==null)continue;let key2=String(row.value).trim();if(key2==="")continue;seen.set(key2,seen.has(key2)?null:String(row.id))}let ids={};for(let[key2,id]of seen)if(id!==null)ids[key2]=id;return ids}function ambiguousValues(rows){let counts=new Map;for(let row of rows){if(row.value==null||row.id==null)continue;let key2=String(row.value).trim();if(key2==="")continue;counts.set(key2,(counts.get(key2)??0)+1)}return[...counts.entries()].filter(([,n])=>n>1).map(([key2])=>key2)}var UNRESOLVED_TEMPLATE=/^\s*(\$\{[^}]*\}|\{\{[^}]*\}\})\s*$/,isEmpty2=(v)=>v==null||typeof v==="string"&&(v.trim()===""||UNRESOLVED_TEMPLATE.test(v));function displayValue(value2){if(value2!==null&&typeof value2==="object")try{return JSON.stringify(value2)}catch{return"(a value that cannot be shown)"}return String(value2)}function buildFallbackIdentifier(format2,data){let complete=!0,rendered=format2.replace(/\{([^{}]+)\}/g,(_match,path7)=>{let value2=data[path7.trim()];if(value2==null||String(value2).trim()==="")complete=!1;return value2==null?"":String(value2)});if(!complete)return null;let cleaned=foldToAscii(rendered).toLowerCase().trim().replace(/[^a-z0-9._@+-]+/g,".").replace(/\.{2,}/g,".").replace(/\.*@\.*/g,"@").replace(/^[.\-_]+|[.\-_]+$/g,"");return cleaned===""?null:cleaned}function missingReferences(row,references,known){let broken=[];for(let check of references){let raw=row[check.column];if(isEmpty2(raw))continue;let value2=displayValue(raw).trim(),present=known[`${check.entity}.${check.entityColumn}`];if(!present)continue;if(!present.has(value2))broken.push({check,value:value2,raw})}return broken}async function loadReferenceValues(references,read2){let values={};for(let check of references){let key2=`${check.entity}.${check.entityColumn}`;if(values[key2])continue;let rows=await read2(check.entity,check.entityColumn);values[key2]=new Set(rows.filter((v)=>!isEmpty2(v)).map((v)=>String(v).trim()))}return values}async function loadReferenceIds(references,targetEntity,read2){let ids={},ambiguous={};for(let check of references){if(!check.writeIdTo)continue;if(pointsAtOwnTable(check,targetEntity))continue;let key2=referenceKey(check);if(ids[key2])continue;let pairs=await read2(check.entity,check.entityColumn);ids[key2]=unambiguousIds(pairs);let shared=ambiguousValues(pairs);if(shared.length>0)ambiguous[key2]=shared}return{ids,ambiguous}}function ambiguityWarnings(ambiguous){return Object.entries(ambiguous).map(([key2,values])=>{let shown=values.slice(0,5).join(", "),rest3=values.length>5?` and ${values.length-5} more`:"";return`${values.length} value(s) in ${key2} belong to more than one row \u2014 ${shown}${rest3}. Records pointing at them are left unlinked rather than linked to whichever row came first.`})}function planWrites(input){let{records,existing,dedupTargetField,writeMode,missingPolicy,missingColumn,missingValue,removalScope=null,originColumn,originValue,requiredFields=[],uniqueFields=[],createDefaults={},accountRule=null,existingAccounts={},references=[],referenceValues={},referenceIds={},targetEntity=""}=input,issues=[],warnings=[],creates=[],referenceInserts=[],accountInserts=[],accountJoinInserts=[],plannedAccounts=new Set,plannedRefs=new Set,updates=[],deletes=[],deactivates=[],departures=[],deferredLinks=[],dedupConfigured=Boolean(dedupTargetField),accountClaims=new Map,accountIdIsUnique=accountRule?uniqueFields.includes(accountRule.idColumn):!1,fillIdentifier=(data)=>{let format2=accountRule?.emailFormat?.trim();if(!accountRule||!format2)return data;if(!isEmpty2(data[accountRule.matchFrom]))return data;let built=buildFallbackIdentifier(format2,data);return built===null?data:{...data,[accountRule.matchFrom]:built}},withAccount=(record3,input2)=>{if(!accountRule)return input2;let data=fillIdentifier(input2),raw=data[accountRule.matchFrom];if(isEmpty2(raw))return issues.push({sourceIndex:record3.sourceIndex,kind:"account_unmatched",field:accountRule.matchFrom,message:`${accountRule.matchFrom} is empty, so this record gets no account \u2014 it is imported without one.`,dedupKey:record3.dedupKey,row:data}),data;let value2=String(raw).trim(),claimedBy=accountClaims.get(value2);if(claimedBy&&accountIdIsUnique)return issues.push({sourceIndex:record3.sourceIndex,kind:"duplicate_value",field:accountRule.matchFrom,value:String(value2),message:`${accountRule.matchFrom} is \u201C${value2}\u201D, which another record in this import already uses \u2014 and ${accountRule.idColumn} allows one record per account. This one is left out.`,dedupKey:record3.dedupKey,row:data,keptRow:claimedBy.data}),null;accountClaims.set(value2,record3);let existingId=existingAccounts[value2];if(existingId)return{...data,[accountRule.idColumn]:existingId};if(!plannedAccounts.has(value2)){plannedAccounts.add(value2);let accountData={[accountRule.matchColumn]:value2};for(let pair of accountRule.values??[]){let from=data[pair.from];if(!isEmpty2(from))accountData[pair.column]=from}accountInserts.push({entity:accountRule.entity,matchColumn:accountRule.matchColumn,matchValue:value2,data:accountData});for(let join7 of accountRule.joins??[])accountJoinInserts.push({entity:join7.entity,accountColumn:join7.accountColumn,values:join7.values,matchValue:value2})}return data},hasDefaults=Object.keys(createDefaults).length>0,stamp2=originColumn?{[originColumn]:originValue}:{},newRecord=(data)=>hasDefaults?{...createDefaults,...data,...stamp2}:{...data,...stamp2},existingByKey=new Map;if(dedupTargetField)for(let row of existing){let value2=row.row[dedupTargetField];if(!isEmpty2(value2))existingByKey.set(String(value2).trim(),row)}let claimedUnique=new Map;for(let field of uniqueFields){let taken=new Map;for(let existingRow of existing){let value2=existingRow.row[field];if(!isEmpty2(value2))taken.set(String(value2).trim(),existingRow.id)}claimedUnique.set(field,taken)}let ownsRow=(row)=>{if(!originColumn)return!0;let value2=row.row[originColumn];return String(value2??"")===String(originValue??"")},matchedIds=new Set,seenIds=new Set,seenInBatch=new Map;for(let sourceRecord of records){let broken=missingReferences(sourceRecord.data,references,referenceValues),resolvedRow=applyReferenceIds(sourceRecord.data,references,referenceIds,targetEntity),record3={...sourceRecord,data:fillIdentifier(resolvedRow.row)};if(record3.dedupKey!=null){let carried=existingByKey.get(record3.dedupKey);if(carried)seenIds.add(carried.id)}for(let link of resolvedRow.deferred){if(!dedupTargetField)continue;let matchValue=record3.data[dedupTargetField];if(isEmpty2(matchValue))continue;deferredLinks.push({matchColumn:dedupTargetField,matchValue:String(matchValue).trim(),writeIdTo:link.check.writeIdTo,lookupColumn:link.check.entityColumn,raw:link.raw,isList:Array.isArray(link.raw)})}let blocking=broken.find((b)=>b.check.onMissing==="skipRecord");if(blocking){let{check,value:value2}=blocking;issues.push({sourceIndex:record3.sourceIndex,kind:"missing_reference",message:typeof blocking.raw==="object"&&blocking.raw!==null?`${check.column} is not a single value but a whole object \u2014 ${value2}. Point the mapping at one field of it, e.g. \`${check.column}.code\`, and it will have something to match against ${check.entity}.${check.entityColumn}.`:`${check.column} is \u201C${value2}\u201D, which does not exist in ${check.entity}.${check.entityColumn} \u2014 this record is left out.`,dedupKey:record3.dedupKey,row:record3.data,reference:{column:check.column,value:value2,entity:check.entity,entityColumn:check.entityColumn}});continue}let keepReferences=()=>{for(let{check,value:value2}of broken){if(check.onMissing!=="create")continue;let token=`${check.entity}.${check.entityColumn}::${value2}`;if(plannedRefs.has(token))continue;plannedRefs.add(token);let data={};for(let pair of check.createValues??[]){let fromSource=isTemplateSource(pair.from)?renderTemplate(pair.from,record3.external,record3.parent):readSourceValue(record3.external,record3.parent,pair.from),value3=isEmpty2(fromSource)?record3.data[pair.from]:fromSource;if(!isEmpty2(value3))data[pair.column]=value3}referenceInserts.push({entity:check.entity,column:check.entityColumn,value:value2,...Object.keys(data).length>0?{data}:{}})}},uniqueCollision=(data,ownRowId)=>{for(let field of uniqueFields){let raw=data[field];if(isEmpty2(raw))continue;let value2=String(raw).trim(),holder2=claimedUnique.get(field)?.get(value2);if(holder2===void 0)continue;if(holder2!==null&&holder2===ownRowId)continue;return{field,value:value2}}return null},claimUnique=(data,rowId)=>{for(let field of uniqueFields){let raw=data[field];if(isEmpty2(raw))continue;claimedUnique.get(field)?.set(String(raw).trim(),rowId)}},collide=(field,value2)=>{issues.push({sourceIndex:record3.sourceIndex,kind:"duplicate_value",field,value:String(value2),message:`${field} is \u201C${value2}\u201D, which something else already has \u2014 ${field} has to be unique, so this record is left out.`,dedupKey:record3.dedupKey,row:record3.data})},missingRequired=requiredFields.filter((f)=>isEmpty2(record3.data[f])&&isEmpty2(createDefaults[f]));if(missingRequired.length>0){issues.push({sourceIndex:record3.sourceIndex,kind:"missing_required",field:missingRequired.join(", "),message:`Required field(s) empty: ${missingRequired.join(", ")}`,dedupKey:record3.dedupKey,row:record3.data});continue}if(!dedupConfigured){let clash2=uniqueCollision(record3.data,null);if(clash2){collide(clash2.field,clash2.value);continue}keepReferences(),claimUnique(record3.data,null);let withLogin=withAccount(record3,newRecord(record3.data));if(!withLogin)continue;creates.push({data:withLogin,sourceIndex:record3.sourceIndex});continue}if(record3.dedupKey==null){let clash2=uniqueCollision(record3.data,null);if(clash2){collide(clash2.field,clash2.value);continue}issues.push({sourceIndex:record3.sourceIndex,kind:"missing_dedup_key",message:"Deduplication field is empty on this record \u2014 it will be added as new."}),keepReferences(),claimUnique(record3.data,null);let withLogin=withAccount(record3,newRecord(record3.data));if(!withLogin)continue;creates.push({data:withLogin,sourceIndex:record3.sourceIndex});continue}let claimedBy=seenInBatch.get(record3.dedupKey);if(claimedBy){issues.push({sourceIndex:record3.sourceIndex,kind:"duplicate_in_batch",value:String(record3.dedupKey??""),message:`The source carries this key more than once: ${record3.dedupKey} \u2014 this occurrence is skipped.`,dedupKey:record3.dedupKey,row:record3.data,keptRow:claimedBy});continue}if(seenInBatch.set(record3.dedupKey,record3.data),writeMode==="replace"||writeMode==="append"){let clash2=uniqueCollision(record3.data,null);if(clash2&&!(writeMode==="replace"&&claimedUnique.get(clash2.field)?.get(clash2.value))){collide(clash2.field,clash2.value);continue}keepReferences(),claimUnique(record3.data,null);let withLogin=withAccount(record3,newRecord(record3.data));if(!withLogin)continue;creates.push({data:withLogin,sourceIndex:record3.sourceIndex});continue}let match=existingByKey.get(record3.dedupKey),clash=uniqueCollision(record3.data,match?.id??null);if(clash){collide(clash.field,clash.value);continue}if(keepReferences(),claimUnique(record3.data,match?.id??null),match)matchedIds.add(match.id),updates.push({id:match.id,data:{...record3.data,...stamp2},before:match.row,sourceIndex:record3.sourceIndex});else{let withLogin=withAccount(record3,newRecord(record3.data));if(!withLogin)continue;creates.push({data:withLogin,sourceIndex:record3.sourceIndex})}}if(writeMode==="replace")deletes.push(...existing);else if(writeMode==="upsert"&&missingPolicy!=="ignore"){let wasRead=(row)=>{if(!removalScope)return!0;let value2=row.row[removalScope.column];if(isEmpty2(value2))return!1;return removalScope.readValues.includes(String(value2).trim())},gone=existing.filter((row)=>!seenIds.has(row.id)).filter((row)=>ownsRow(row)).filter(wasRead);if(missingPolicy==="delete")deletes.push(...gone);else deactivates.push(...gone);departures.push(...gone)}if(writeMode==="upsert"&&missingPolicy==="ignore"){let owned=existing.filter((row)=>ownsRow(row)),unmatched=owned.filter((row)=>!seenIds.has(row.id)).length,drift=keyDriftWarning({creating:creates.length,unmatched,existing:owned.length});if(drift)warnings.push(drift)}if(!dedupConfigured&&writeMode==="upsert")warnings.push("No deduplication field is set. Nothing can be matched against what is already here, so every record is added as new and each run will duplicate the last.");if(dedupConfigured&&records.length>0&&records.every((r)=>r.dedupKey==null))warnings.push(`The deduplication field is empty on every record \u2014 it is probably not among the mapped fields. As it stands nothing can ever match: all ${records.length} records will be re-added on every run.`);if(writeMode==="append"&&dedupConfigured)warnings.push("Append mode ignores the deduplication field: records already here will be added again.");if(writeMode==="replace"){if(warnings.push(`Replace mode: all ${existing.length} rows currently in the table are deleted and rebuilt from the source. Row identifiers change, so anything referring to them by id breaks.`),dedupConfigured)warnings.push('A deduplication field is set, so "update existing" would keep the current rows and their identifiers. Replace mode is only necessary when records cannot be matched at all.')}if(deactivates.length>0&&(!missingColumn||isEmpty2(missingValue)))warnings.push('The policy for records missing from the source is "deactivate", but no column and value are configured \u2014 those rows will be left untouched.'),deactivates.length=0;return{creates,updates,deletes,deactivates,departures,deferredLinks,issues,warnings,referenceInserts,accountInserts,accountJoinInserts}}var SKIPPING_ISSUE_KINDS=new Set(["missing_required","duplicate_in_batch","duplicate_value","invalid_value","missing_reference"]);function skippedRecordCount(issues){let records=new Set;for(let issue of issues){if(!SKIPPING_ISSUE_KINDS.has(issue.kind))continue;if(issue.sourceIndex<0)continue;records.add(issue.sourceIndex)}return records.size}function summarize(ops,meta){let sampleSize=meta.sampleSize??8,sample=[...ops.creates.map((c)=>c.data),...ops.updates.map((u)=>u.data)].slice(0,sampleSize);return{targetEntity:meta.targetEntity,writeMode:meta.writeMode,totalFetched:meta.totalFetched,reportedTotal:meta.reportedTotal,toCreate:ops.creates.length,toUpdate:ops.updates.length,toSkip:skippedRecordCount(ops.issues),missing:ops.deletes.length+ops.deactivates.length,missingPolicy:meta.missingPolicy,existingCount:meta.existingCount,dedupConfigured:meta.dedupConfigured,issues:ops.issues,warnings:ops.warnings,referenceInserts:ops.referenceInserts,accountsToCreate:ops.accountInserts.length,sample}}function removalScopeFor(column,records){if(!column)return null;let readValues=new Set;for(let record3 of records){let value2=record3.data[column];if(!isEmpty2(value2))readValues.add(String(value2).trim())}return{column,readValues:[...readValues]}}init_AccountLink();import{and as and18,eq as eq33,inArray as inArray13}from"drizzle-orm";var INSERT_CHUNK=500,DELETE_CHUNK=1000;function validateAll(ops,columns,validatePayload2){let issues=[];for(let op of ops.creates){let result=validatePayload2(op.data,columns,!1);if(!result.valid)issues.push({sourceIndex:op.sourceIndex,kind:"invalid_value",message:result.errors.map((e)=>`${e.field}: ${e.message}`).join("; "),row:op.data})}for(let op of ops.updates){let result=validatePayload2(op.data,columns,!0);if(!result.valid)issues.push({sourceIndex:op.sourceIndex,kind:"invalid_value",message:result.errors.map((e)=>`${e.field}: ${e.message}`).join("; "),row:op.data})}return issues}function referenceRow(columns,column,value2,extra){let row={...extra,[column]:value2},unfillable=[];for(let col8 of columns){let name2=camel(col8.name);if(name2===column)continue;if(SYSTEM_COLUMNS.has(name2))continue;if(row[name2]!==void 0)continue;if(!(col8.notNull===!0&&col8.default===void 0&&!col8.defaultRaw&&!col8.nullable))continue;if(TEXTUAL_TYPES.has(String(col8.type)))row[name2]=value2;else unfillable.push(name2)}return unfillable.length>0?{ok:!1,unfillable}:{ok:!0,row}}var SYSTEM_COLUMNS=new Set(["id","createdAt","updatedAt","createdBy","updatedBy"]),TEXTUAL_TYPES=new Set(["text","varchar","char"]),camel=(s)=>s.replace(/_([a-z])/g,(_m,l)=>l.toUpperCase());function linkAccount(data,rule,idByValue){let value2=data[rule.matchFrom];if(value2==null)return{};let id=idByValue.get(String(value2).trim());return id?{[rule.idColumn]:id}:{}}function groupDeferred(links){let groups=new Map;for(let link of links){let key2=`${link.writeIdTo}|${link.lookupColumn}|${link.matchColumn}`,group=groups.get(key2)??{writeIdTo:link.writeIdTo,lookupColumn:link.lookupColumn,matchColumn:link.matchColumn,links:[]};group.links.push(link),groups.set(key2,group)}return[...groups.values()]}async function applyWrites(deps,input){let{ops,targetEntity,userId}=input,scope=input.scopeConditions??[],writeIssues=[],cancelled=()=>input.isCancelled?.()===!0,invalid=validateAll(ops,deps.columns,deps.validatePayload);if(invalid.length>0)return{ok:!1,failure:{kind:"validation_failed",message:`${invalid.length} record(s) did not pass validation; nothing was written.`,issues:invalid}};let refGroups=new Map;for(let insert of ops.referenceInserts){let resolved=deps.resolveEntity?.(insert.entity);if(!resolved)return{ok:!1,failure:{kind:"write_failed",message:`This mapping would add \u201C${insert.value}\u201D to "${insert.entity}", which does not exist.`}};let built=referenceRow(resolved.columns,insert.column,insert.value,insert.data);if(!built.ok)return{ok:!1,failure:{kind:"write_failed",message:`\u201C${insert.value}\u201D cannot be added to "${insert.entity}" automatically: ${built.unfillable.join(", ")} is required and cannot be filled from a ${insert.column}. Add the missing ${insert.entity} by hand, or set this reference to leave those records out.`}};let group=refGroups.get(insert.entity)??{table:resolved.table,rows:[]};group.rows.push(built.row),refGroups.set(insert.entity,group)}let accountRule=input.account??null,accountEntity=ops.accountInserts[0]?.entity,accountTable=accountEntity?deps.resolveEntity?.(accountEntity):null;if(ops.accountInserts.length>0&&(!accountRule||!accountTable))return{ok:!1,failure:{kind:"write_failed",message:accountRule?`This import creates accounts in "${accountEntity}", which does not exist.`:"This import creates accounts but no password was supplied, so nothing was written."}};if(cancelled())return{ok:!1,failure:{kind:"cancelled",message:"Cancelled before writing."}};let idCol=deps.resolveCol("id");if(!idCol)return{ok:!1,failure:{kind:"write_failed",message:`Target "${targetEntity}" has no id column; the engine cannot address its rows.`}};let preImages=[],now=new Date,deactivating=ops.deactivates.length>0&&input.missingColumn&&input.missingValue!=null?{column:input.missingColumn,value:input.missingValue}:null;try{let linksMade=0,linksUnresolved=0;return{ok:!0,...await deps.db.transaction(async(tx)=>{let created=0,accountsCreated=0,referencesCreated=0,updated=0,deleted=0,deactivated=0,accountsClosed=0;if(ops.deletes.length>0){let ids=ops.deletes.map((r)=>r.id);for(let i=0;i<ids.length;i+=DELETE_CHUNK){if(cancelled())throw new CancelledError;let chunk=ids.slice(i,i+DELETE_CHUNK),where=scope.length?and18(inArray13(idCol,chunk),...scope):inArray13(idCol,chunk),removed=await tx.delete(deps.drizzleTable).where(where).returning();deleted+=removed.length;for(let row of removed)preImages.push({targetEntity,rowId:String(row.id),action:"delete",before:row,after:null})}}for(let op of ops.updates){if(cancelled())throw new CancelledError;let where=scope.length?and18(eq33(idCol,op.id),...scope):eq33(idCol,op.id),written=await tx.update(deps.drizzleTable).set({...op.data,updatedAt:now,updatedBy:userId}).where(where).returning();if(written.length===0)throw new ScopeError(op.id);updated+=written.length,preImages.push({targetEntity,rowId:op.id,action:"update",before:op.before,after:written[0]??null})}if(deactivating){let ids=ops.deactivates.map((r)=>r.id);for(let i=0;i<ids.length;i+=DELETE_CHUNK){if(cancelled())throw new CancelledError;let chunk=ids.slice(i,i+DELETE_CHUNK),where=scope.length?and18(inArray13(idCol,chunk),...scope):inArray13(idCol,chunk),written=await tx.update(deps.drizzleTable).set({[deactivating.column]:deactivating.value,updatedAt:now,updatedBy:userId}).where(where).returning();deactivated+=written.length;let beforeById=new Map(ops.deactivates.map((r)=>[r.id,r.row]));for(let row of written){let id=String(row.id);preImages.push({targetEntity,rowId:id,action:"deactivate",before:beforeById.get(id)??null,after:row})}}}if(deps.accountClosure){let written=new Set(preImages.filter((image)=>image.action==="delete"||image.action==="deactivate").map((image)=>image.rowId)),removedRows=ops.departures.filter((row)=>written.has(row.id)).map((row)=>row.row),leaverIds=accountIdsIn(removedRows,deps.accountClosure.userColumn);if(leaverIds.length>0){let closed=await closeAccounts({db:tx,usersTable:deps.accountClosure.usersTable,sessionsTable:deps.accountClosure.sessionsTable,atomic:!0,onError:(error3)=>{deps.logger.error("[Integrations] A departure\u2019s account stayed open",{error:error3})}},leaverIds);accountsClosed=closed.closed;for(let userId2 of closed.closedIds)preImages.push({targetEntity:deps.accountClosure.accountEntity,rowId:userId2,action:"update",before:{isActive:!0},after:{isActive:!1}});if(closed.closed>0&&!closed.signedOut)writeIssues.push({sourceIndex:-1,kind:"account_sessions_not_cleared",value:String(closed.closed),message:`${closed.closed} account(s) behind removed records were deactivated, but their open sessions could not be cleared \u2014 those people stay signed in until the session expires.`})}}for(let[entity,group]of refGroups){let rows=group.rows.map((r)=>({...r,createdAt:now,updatedAt:now,createdBy:userId}));for(let i=0;i<rows.length;i+=INSERT_CHUNK){if(cancelled())throw new CancelledError;let written=await tx.insert(group.table).values(rows.slice(i,i+INSERT_CHUNK)).returning();referencesCreated+=written.length;for(let row of written)preImages.push({targetEntity:entity,rowId:row.id?String(row.id):null,action:"create",before:null,after:row})}}let accountIdByValue=new Map;if(accountRule&&accountTable&&ops.accountInserts.length>0){let rows=ops.accountInserts.map((account)=>({...account.data,[accountRule.passwordColumn]:accountRule.passwordHash,createdAt:now,updatedAt:now,createdBy:userId}));for(let i=0;i<rows.length;i+=INSERT_CHUNK){if(cancelled())throw new CancelledError;let written=await tx.insert(accountTable.table).values(rows.slice(i,i+INSERT_CHUNK)).returning();accountsCreated+=written.length;for(let row of written){let value2=row[accountRule.matchColumn];if(row.id!=null&&value2!=null)accountIdByValue.set(String(value2).trim(),String(row.id));preImages.push({targetEntity:ops.accountInserts[0]?.entity??"",rowId:row.id?String(row.id):null,action:"create",before:null,after:row})}}}if(accountRule&&ops.accountJoinInserts.length>0){let byEntity=new Map;for(let join7 of ops.accountJoinInserts){let accountId=accountIdByValue.get(join7.matchValue);if(!accountId){writeIssues.push({sourceIndex:-1,kind:"account_role_missing",message:`No account was found for \u201C${join7.matchValue}\u201D, so its ${join7.entity} row was not written \u2014 that person can sign in and do nothing.`});continue}let rows=byEntity.get(join7.entity)??[];rows.push({...join7.values,[join7.accountColumn]:accountId,createdAt:now,updatedAt:now,createdBy:userId}),byEntity.set(join7.entity,rows)}for(let[entity,rows]of byEntity){let resolved=deps.resolveEntity?.(entity);if(!resolved){writeIssues.push({sourceIndex:-1,kind:"account_role_missing",message:`The \u201C${entity}\u201D table is not available here, so ${rows.length} role membership(s) were not written. The accounts exist but hold no role.`});continue}for(let i=0;i<rows.length;i+=INSERT_CHUNK){if(cancelled())throw new CancelledError;let written=await tx.insert(resolved.table).values(rows.slice(i,i+INSERT_CHUNK)).returning();for(let row of written)preImages.push({targetEntity:entity,rowId:row.id?String(row.id):null,action:"create",before:null,after:row})}}}if(ops.creates.length>0){let rows=ops.creates.map((c)=>({...c.data,...accountRule&&c.data[accountRule.idColumn]==null?linkAccount(c.data,accountRule,accountIdByValue):{},createdAt:now,updatedAt:now,createdBy:userId}));for(let i=0;i<rows.length;i+=INSERT_CHUNK){if(cancelled())throw new CancelledError;let chunk=rows.slice(i,i+INSERT_CHUNK),written=await tx.insert(deps.drizzleTable).values(chunk).returning();created+=written.length;for(let row of written)preImages.push({targetEntity,rowId:row.id?String(row.id):null,action:"create",before:null,after:row})}}if(ops.deferredLinks.length>0)for(let group of groupDeferred(ops.deferredLinks)){if(cancelled())throw new CancelledError;let lookupCol=deps.resolveCol(group.lookupColumn),matchCol=deps.resolveCol(group.matchColumn),targetCol=deps.resolveCol(group.writeIdTo);if(!lookupCol||!matchCol||!targetCol){deps.logger.error(`[Integrations] Cannot fill "${group.writeIdTo}": ${[!lookupCol?group.lookupColumn:null,!matchCol?group.matchColumn:null,!targetCol?group.writeIdTo:null].filter(Boolean).join(", ")} is not a column of "${targetEntity}".`);continue}let rows=await tx.select({v:lookupCol,id:idCol}).from(deps.drizzleTable),idByValue={};for(let row of rows){if(row.v==null||row.v===""||row.id==null)continue;let key2=String(row.v).trim();if(!idByValue[key2])idByValue[key2]=String(row.id)}let imageByMatch=new Map;for(let image of preImages){let value2=image.after?.[group.matchColumn];if(value2!=null)imageByMatch.set(String(value2).trim(),image)}for(let link of group.links){let resolution=resolveReference(link.raw,idByValue);if(resolution.ids.length===0){linksUnresolved+=1;continue}let value2=link.isList?resolution.ids:resolution.ids[0],where=scope.length?and18(eq33(matchCol,link.matchValue),...scope):eq33(matchCol,link.matchValue);if((await tx.update(deps.drizzleTable).set({[group.writeIdTo]:value2}).where(where).returning()).length===0){linksUnresolved+=1;continue}linksMade+=1;let image=imageByMatch.get(String(link.matchValue).trim());if(image?.after)image.after={...image.after,[group.writeIdTo]:value2}}}return{created,accountsCreated,referencesCreated,updated,deleted,deactivated,accountsClosed,linksMade,linksUnresolved}}),preImages,issues:writeIssues}}catch(error3){if(error3 instanceof CancelledError)return{ok:!1,failure:{kind:"cancelled",message:"Cancelled while writing; the transaction was rolled back and nothing changed."}};if(error3 instanceof ScopeError)return{ok:!1,failure:{kind:"write_failed",message:`Row ${error3.rowId} is outside what this account may write. Nothing was written.`}};return deps.logger.error(`[Integrations] Write transaction failed for "${targetEntity}": ${reasonOf2(error3)}`),{ok:!1,failure:{kind:"write_failed",message:"The database rejected this import; it was rolled back and nothing changed."}}}}function reasonOf2(error3){if(!(error3 instanceof Error))return String(error3);let extra=error3;return[error3.message,extra.detail?`detail: ${String(extra.detail)}`:"",extra.constraint?`constraint: ${String(extra.constraint)}`:"",extra.hint?`hint: ${String(extra.hint)}`:"",extra.code?`code: ${String(extra.code)}`:""].filter(Boolean).join(" \u2014 ")}class CancelledError extends Error{constructor(){super("cancelled");this.name="CancelledError"}}class ScopeError extends Error{rowId;constructor(rowId){super(`row ${rowId} outside scope`);this.rowId=rowId;this.name="ScopeError"}}var DAY_MS=86400000;async function executeRun(context,deps,lock){let{mapping,source}=context,empty={runId:null,status:"failed",failure:null,plan:null,created:0,accountsCreated:0,referencesCreated:0,updated:0,deleted:0,deactivated:0,externalCalls:0,issues:[]},opened=await deps.repo.openRun({mappingId:mapping.id,targetEntity:mapping.targetEntity,writeMode:mapping.writeMode,trigger:context.trigger,userId:context.userId});if(!opened.ok)return{...empty,failure:{kind:"write_failed",message:`Could not open a run record: ${opened.error}`}};let runId=opened.runId;deps.onRunOpened?.(runId);let cancelChecked=0,cancelSeen=!1,isCancelled=()=>{if(cancelSeen)return!0;if(deps.abortSignal?.aborted)return cancelSeen=!0,!0;if(!lock.isHeld())return cancelSeen=!0,!0;return!1},refreshCancelFlag=async()=>{if(cancelChecked++,await deps.repo.isCancelRequested(runId))cancelSeen=!0},progress=(p)=>deps.publishProgress?.({runId,...p}),preImagesStored=!0,finish=async(outcome)=>{let revertible=outcome.status==="succeeded"&&preImagesStored;return await deps.repo.closeRun(runId,{status:outcome.status,totalFetched:outcome.plan?.totalFetched??0,sourceReportedTotal:outcome.plan?.reportedTotal??null,createdCount:outcome.created,accountsCreatedCount:outcome.accountsCreated,referencesCreatedCount:outcome.referencesCreated,updatedCount:outcome.updated,skippedCount:outcome.plan?.toSkip??0,deletedCount:outcome.deleted,deactivatedCount:outcome.deactivated,errorCount:outcome.failure?1:0,externalCallCount:outcome.externalCalls,issues:outcome.issues,errors:outcome.failure?[outcome.failure.message]:[],finishedAt:new Date,preImagesExpireAt:revertible?new Date(Date.now()+(deps.retainPreImagesMs??30*DAY_MS)):null}),progress({phase:"done",message:outcome.failure?.message}),{runId,...outcome}};progress({phase:"fetching"});let nodes=context.endpoints.map((e)=>({id:e.id,paramBindings:e.paramBindings??void 0})),order=planFetchOrder(nodes,[context.rootEndpointId]);if(!order.ok){let failure=order.reason==="cycle"?{kind:"cycle_detected",message:`These endpoints depend on each other in a loop (${order.chain.join(" \u2192 ")}), so there is no correct place to start.`,chain:order.chain}:{kind:"fetch_failed",message:`"${order.requiredBy}" takes a parameter from an endpoint that no longer exists (${order.missing}).`};return finish({...empty,failure,status:"failed"})}let bearerToken=null;if(context.oauth){let token=await getAccessToken(context.oauth,deps.tokenCache,{fetchImpl:deps.fetchImpl});if(!token.ok)return finish({...empty,failure:{kind:"fetch_failed",message:token.error}});bearerToken=token.accessToken}let byId=new Map(context.endpoints.map((e)=>[e.id,e])),parents={},entityValues={},externalCalls=0,rootRecords=[],fetchWarnings=[],reportedTotal2=null;for(let endpointId of order.order){let endpoint=byId.get(endpointId);if(!endpoint)continue;if(await refreshCancelFlag(),isCancelled())return finish({...empty,status:"cancelled",externalCalls,failure:{kind:"cancelled",message:"Cancelled before anything was written."}});for(let key2 of entityValueKeys(endpoint.paramBindings??void 0)){if(entityValues[key2])continue;let[entity,field]=key2.split(".");entityValues[key2]=await deps.repo.readEntityColumn(entity,field)}let collected=await collectEndpoint(source,endpoint,{parents,entityValues},{fetchImpl:deps.fetchImpl,bearerToken,maxConcurrent:deps.maxConcurrentFanout,maxRecords:deps.maxRecordsPerRun,isCancelled,onProgress:(n)=>progress({phase:"fetching",processed:n})});if(externalCalls+=collected.callCount,!collected.ok){let cancelled=isCancelled();return finish({...empty,externalCalls,status:cancelled?"cancelled":"failed",failure:cancelled?{kind:"cancelled",message:"Cancelled before anything was written."}:{kind:"fetch_failed",message:collected.error}})}if(collected.partialFailures?.length)fetchWarnings.push(...collected.partialFailures.map((failure)=>`Could not read part of this source \u2014 ${failure}`));if(parents[endpointId]=collected.records.map((r)=>r.record),endpointId===context.rootEndpointId)rootRecords=collected.records,reportedTotal2=collected.reportedTotal}for(let id of Object.keys(parents))if(!(id===context.rootEndpointId||context.endpoints.some((e)=>parentEndpointIds(e.paramBindings??void 0).includes(id))))delete parents[id];let verdict=destructiveGate({writeMode:mapping.writeMode,missingPolicy:mapping.missingPolicy,fetched:rootRecords.length,reported:reportedTotal2,partialFailures:fetchWarnings.length,scopedRemoval:Boolean(mapping.removalScopeColumn)});if(!verdict.allowed)return finish({...empty,externalCalls,failure:{kind:verdict.kind,message:fetchWarnings.length?`${verdict.message}
 
 ${fetchWarnings.join(`
@@ -591,7 +591,7 @@ ${content}
   ${warningBanner}
   ${deviceTable}
   <p style="margin:16px 0 0;color:#6b7280;font-size:13px;">If this wasn't you, please secure your account immediately.</p>
-`)}deliver(getEmailService(),{to:user.email,subject,html:emailHtml},"[AUTH] login notification").then((report)=>{if(report.level==="warn")logger2.warn(report.message,{userId:params.userId,trustScore,requiresApproval});else logger2.info(report.message,{userId:params.userId})})}}}if(logger2.info("[AUTH] Session saved to DB",{sessionId,userId:params.userId,isNewDevice,requiresApproval,deviceFingerprint,ipAddress:deviceInfo.ipAddress}),deviceTrustMint&&dtTable&&deviceTrustCfg?.enabled)try{let DT2=await Promise.resolve().then(() => (init_DeviceTrust(),exports_DeviceTrust)),DTStore2=await Promise.resolve().then(() => (init_store3(),exports_store)),{randomUUID:randomUUID12}=await import("crypto"),{raw,hash}=DT2.mintDeviceToken(),ttlSec=parseTimeToSeconds2(deviceTrustCfg.tokenExpiresIn??"30d");await DTStore2.insertDeviceRow(db,dtTable,{id:randomUUID12(),userId:params.userId,tokenHash:hash,status:deviceTrustMint,originSessionId:sessionId,label:deviceInfo.deviceName||`${deviceInfo.browserName||"Unknown"} on ${deviceInfo.osName||"Unknown"}`,deviceFingerprint,firstSeenIp:deviceInfo.ipAddress,expiresAt:new Date(Date.now()+ttlSec*1000)});let rawDomainDT=authentication.cookieDomain,resolvedDomainDT=rawDomainDT?process.env[rawDomainDT]??rawDomainDT:void 0,domainDT=resolvedDomainDT==="localhost"||resolvedDomainDT===".localhost"?void 0:resolvedDomainDT;deviceTokenToSet=DT2.buildDeviceTokenCookie(raw,{cookieName:deviceTrustCfg.cookieName,cookiePrefix:deviceTrustCfg.cookiePrefix,sameSite:deviceTrustCfg.sameSite,maxAgeSeconds:ttlSec,domain:domainDT,secure:!!domainDT})}catch(dtErr){logger2.warn("[AUTH] Device-trust token mint failed \u2014 continuing",{userId:params.userId,error:dtErr instanceof Error?dtErr.message:String(dtErr)})}return{requiresApproval,sessionId,deviceTokenCookie:deviceTokenToSet??void 0}},storeResetToken:async(userId,token,expiresAt,reqSchemaName)=>{let resetTokensTable=resolveTableForTenant("passwordResetTokens",reqSchemaName);if(!resetTokensTable||!db)return;await db.insert(resetTokensTable).values({userId,tokenHash:createHash5("sha256").update(token).digest("hex"),expiresAt})},getResetToken:async(token,reqSchemaName)=>{let{eq:eq69}=__require("drizzle-orm"),resetTokensTable=resolveTableForTenant("passwordResetTokens",reqSchemaName);if(!resetTokensTable||!db)return null;let tokenHash=createHash5("sha256").update(token).digest("hex"),row=(await db.select().from(resetTokensTable).where(eq69(resetTokensTable.tokenHash,tokenHash)).limit(1))[0];if(!row||row.usedAt)return null;return{userId:row.userId,expiresAt:row.expiresAt}},deleteResetToken:async(token,reqSchemaName)=>{let{eq:eq69}=__require("drizzle-orm"),resetTokensTable=resolveTableForTenant("passwordResetTokens",reqSchemaName);if(!resetTokensTable||!db)return;let tokenHash=createHash5("sha256").update(token).digest("hex");await db.delete(resetTokensTable).where(eq69(resetTokensTable.tokenHash,tokenHash))},revokeSessionInDb:async(sessionId,reason,reqSchemaName)=>{let revokeTable=resolveTableForTenant("userSessions",reqSchemaName)||resolveTableForTenant("user_sessions",reqSchemaName)||resolveTableForTenant("sessions",reqSchemaName)||sessionsTable;if(!revokeTable||!db)return;await db.update(revokeTable).set({isActive:!1,revokedAt:new Date,revokedReason:reason}).where(eq68(revokeTable.id,sessionId)),logger2.info("[AUTH] Session revoked in DB",{sessionId,reason})},sendResetEmail:async(email,token,request)=>{if(isEmailExempt(email,authentication?.emailExemptDomains))return logger2.info("[AUTH] Skipping reset email \u2014 domain exempt",{email}),{sent:!1,reason:"exempt"};let mailer=getEmailService();if(!mailer?.isAvailable())return logger2.warn("[AUTH] Cannot send reset email \u2014 no email provider configured"),{sent:!1,reason:"no_provider"};let configuredResetUrl=authentication.passwordReset?.redirectUrl||"http://localhost:3000/reset-password",resetUrl=request?buildEmailActionLink({request,configuredUrl:configuredResetUrl,path:extractConfiguredPath(configuredResetUrl,"/reset-password"),query:{token},allowedOrigins:trustedAppOrigins()}):`${configuredResetUrl}?token=${token}`,result=await mailer.sendEmail({to:email,subject:"Password Reset Request",html:`<p>Click the link to reset your password:</p><a href="${resetUrl}">${resetUrl}</a>`});if(result?.success===!1){let refused=result.rejected;return{sent:!1,reason:Array.isArray(refused)&&refused.length>0?"rejected":"error",detail:result.error}}return{sent:!0}},storeMagicToken:async(params,reqSchemaName)=>{let magicTokensTable=resolveTableForTenant("magicLinkTokens",reqSchemaName);if(!magicTokensTable||!db)return;await db.insert(magicTokensTable).values({userId:params.userId,email:params.email,tokenHash:params.tokenHash,expiresAt:params.expiresAt})},getMagicToken:async(tokenHash,reqSchemaName)=>{let{eq:eq69}=__require("drizzle-orm"),magicTokensTable=resolveTableForTenant("magicLinkTokens",reqSchemaName);if(!magicTokensTable||!db)return null;let row=(await db.select().from(magicTokensTable).where(eq69(magicTokensTable.tokenHash,tokenHash)).limit(1))[0];if(!row||row.usedAt)return null;return{userId:row.userId,email:row.email,tokenHash:row.tokenHash,expiresAt:row.expiresAt}},deleteMagicToken:async(tokenHash,reqSchemaName)=>{let{eq:eq69}=__require("drizzle-orm"),magicTokensTable=resolveTableForTenant("magicLinkTokens",reqSchemaName);if(!magicTokensTable||!db)return;await db.delete(magicTokensTable).where(eq69(magicTokensTable.tokenHash,tokenHash))}}}),logger2.info("[AUTH] Routes registered")}}if(resolvedOptions.storage?.enabled&&resolvedOptions.storage?.cdn?.enabled){let{createCdnRoutes:createCdnRoutes2,mergeCdnConfig:mergeCdnConfig2,mergeStorageConfig:mergeStorageConfig2}=(init_storage2(),__toCommonJS(exports_storage)),cdnConfig=mergeCdnConfig2(resolvedOptions.storage.cdn),storageConfig=mergeStorageConfig2(resolvedOptions.storage),filesTable=schemaTables.files;if(useRoutes(plugin,createCdnRoutes2({cdn:cdnConfig,storagePath:storageConfig.basePath,logger:logger2,getStorageProvider:()=>storageProvider,buildStorageProvider,authorizeFile:db?async({id,request,schemaName:reqSchemaName})=>{let tables=schemaTables;if(reqSchemaName&&tenantRegistry){let ctx=tenantRegistry.getSchemaContext(reqSchemaName);if(ctx?.schemaTables)tables=ctx.schemaTables}return await checkAttachmentFileAccess({db,schemaTables:tables,fileId:id,userId:request.headers.get("x-user-id")})!=="denied"}:void 0,getFileRecord:filesTable&&db?async(id,reqSchemaName)=>{let tbl=filesTable;if(reqSchemaName&&tenantRegistry){let ctx=tenantRegistry.getSchemaContext(reqSchemaName);if(ctx?.schemaTables.files)tbl=ctx.schemaTables.files}let t=tbl,result=await db.select().from(t).where(eq68(t.id,id)).limit(1);if(result.length===0)return null;let record3=result[0];return{id:record3.id,name:record3.name,path:record3.path,mime_type:record3.mimeType||record3.mime_type,original_name:record3.originalName||record3.original_name}}:void 0})),logger2.info(`[Storage] CDN routes enabled at ${cdnConfig.basePath}`),filesTable&&db){let{createResumableRoutes:createResumableRoutes2}=(init_resumable(),__toCommonJS(exports_resumable)),resumable=createResumableRoutes2({basePath:storageConfig.basePath,storage:storageConfig,logger:logger2,getUserId:(request)=>request.headers.get("x-user-id"),canUpload:(request)=>{if(resolvedOptions.authorization?.enabled===!1)return!0;return checkAuthorizationFromJWT({userClaims:decodeHeaderList(request.headers.get("x-user-claims")),userRoles:decodeHeaderList(request.headers.get("x-user-roles")),claimScopes:decodeClaimScopesHeader(request.headers.get("x-user-claim-scopes")),method:"POST",entity:"files",logger:logger2,requireClaimSpecificity:resolvedOptions.authorization?.requireClaimSpecificity}).authorized},register:async(input)=>{let nodePath=__require("path"),{rename:rename6}=__require("fs/promises"),{randomUUID:randomUUID12}=__require("crypto"),id=randomUUID12(),extension2=nodePath.extname(input.originalName),storedName=`${id}${extension2}`,destination=nodePath.join(storageConfig.basePath,storedName);try{await rename6(input.partPath,destination)}catch(error3){return logger2.error("[Storage] A finished upload could not be moved into place",{error:error3}),null}let uploaded={id,name:storedName,originalName:input.originalName,path:storageConfig.basePath,mimeType:input.mimeType,size:input.size,createdAt:new Date},{buildFileRecordPayload:buildFileRecordPayload2,scheduleUploadMediaProcessing:scheduleUploadMediaProcessing2}=(init_storage2(),__toCommonJS(exports_storage)),t=filesTable,payload={...buildFileRecordPayload2(uploaded,input.userId),type:input.type},row=(await db.insert(t).values(payload).returning())[0];if(!row?.id)return null;return scheduleUploadMediaProcessing2([uploaded],{storagePath:storageConfig.basePath,media:{transform:mergeTransformConfig(resolvedOptions.storage?.cdn?.transform),video:mergeVideoConfig(resolvedOptions.storage?.cdn?.video),pdf:mergePdfConfig(resolvedOptions.storage?.cdn?.pdf)},logger:logger2}),{id:String(row.id)}}});useRoutes(plugin,resumable.plugin),setInterval(()=>{resumable.sweep(Date.now()).then((removed)=>{if(removed>0)logger2.info(`[Storage] Reclaimed ${removed} abandoned upload(s)`)}).catch(()=>{})},3600000).unref?.(),logger2.info("[Storage] Resumable uploads enabled at /uploads")}}if(resolvedOptions.notification?.enabled&&db){let notificationConfig=resolvedOptions.notification;if(notificationConfig.endpoints?.enabled!==!1){warnOnEntityBasePathCollision("Notification",notificationConfig.endpoints?.basePath||"/notifications",resolvedOptions.entities,logger2);let{routes:notificationRoutes}=createNotificationRoutes({db,schemaTables,config:notificationConfig,logger:logger2,getEmailService,tenantRegistry});useRoutes(plugin,notificationRoutes),logger2.info(`[Notification] Routes registered at ${notificationConfig.endpoints?.basePath||"/notifications"}`)}}if(resolvedOptions.verification?.enabled&&db){let{routes:verificationRoutes}=createVerificationRoutes({db,schemaTables,config:resolvedOptions.verification,notificationConfig:resolvedOptions.notification,logger:logger2,getEmailService,tenantRegistry});useRoutes(plugin,verificationRoutes)}if(resolvedOptions.backup?.enabled&&db){let{createBackupRoutes:createBackupRoutes2}=(init_backup(),__toCommonJS(exports_backup)),{routes:backupRoutes}=createBackupRoutes2({db,logger:logger2,config:{enabled:!0,basePath:resolvedOptions.backup.basePath||"/admin/backup",storagePath:resolvedOptions.backup.storagePath||"./backups",format:resolvedOptions.backup.format||"json",maxBackups:resolvedOptions.backup.maxBackups||50,allowRestore:resolvedOptions.backup.allowRestore??!0,excludeTables:resolvedOptions.backup.excludeTables||["audit_logs","backup_logs"],encryptionKey:resolvedOptions.backup.encryptionKey?process.env[resolvedOptions.backup.encryptionKey]||resolvedOptions.backup.encryptionKey:void 0,schedule:{enabled:resolvedOptions.backup.schedule?.enabled??!1,cron:resolvedOptions.backup.schedule?.cron||"0 2 * * *",retentionDays:resolvedOptions.backup.schedule?.retentionDays||30,timeZone:resolvedOptions.backup.schedule?.timeZone}},schemaTables,schemaName:targetSchemaName,getTenantRegistry:()=>tenantRegistry,lock:getRedisManager()});useRoutes(plugin,backupRoutes),logger2.info("[Backup] Routes registered",{basePath:resolvedOptions.backup.basePath||"/admin/backup",scheduleEnabled:resolvedOptions.backup.schedule?.enabled??!1})}if(resolvedOptions.authorization?.endpointDiscovery?.enabled&&db&&resolvedOptions.authentication?.mode!=="consumer"){let{createAuthorizationDiscoveryRoutes:createAuthorizationDiscoveryRoutes2}=(init_authorization(),__toCommonJS(exports_authorization));useRoutes(plugin,createAuthorizationDiscoveryRoutes2({db,schemaTables,logger:logger2,discovery:resolvedOptions.authorization.endpointDiscovery,readState:async(key2)=>{let rm3=getRedisManager();if(!rm3)return null;let res=await rm3.read(key2);return res?.success?res.data:null}})),logger2.info("[Authorization] Endpoint-discovery routes registered",{discover:"/authorization/discover",manifest:"/authorization/route-manifest"})}let pubsubClientManager=null;if(resolvedOptions.pubsub?.enabled){let redis=getRedisManager();if(redis){let pubsubConfig=resolvedOptions.pubsub,{routes:pubsubRoutes,socket:pubsubSocket,clientManager}=createPubSubRoutes({redis,logger:logger2,basePath:pubsubConfig.basePath||"/subs",wsPath:pubsubConfig.wsPath||"/api/events/subscribe",pubsubName:pubsubConfig.pubsubName||"pubsub-redis",maxClientsPerUser:pubsubConfig.maxClientsPerUser??10,maxTopicsPerClient:pubsubConfig.maxTopicsPerClient??DEFAULT_MAX_TOPICS_PER_CLIENT,wsIdleTimeout:pubsubConfig.wsIdleTimeout??120,ack:{enabled:pubsubConfig.ack?.enabled??!0,ttlSeconds:pubsubConfig.ack?.ttlSeconds??300,maxRetries:pubsubConfig.ack?.maxRetries??3,retryIntervalMs:pubsubConfig.ack?.retryIntervalMs??5000},presence:{enabled:pubsubConfig.presence?.enabled??!0,debounceMs:pubsubConfig.presence?.debounceMs??5000},cleanupIntervalMs:pubsubConfig.cleanupIntervalMs??60000,daprApiToken:pubsubConfig.daprApiToken,getLiveMonitoringService:()=>liveMonitoringService,authenticate:envResolved.accessTokenSecret?createHandshakeAuthenticator({accessTokenSecret:envResolved.accessTokenSecret,tokenNames,issuer:authentication?.accessToken?.issuer,audience:authentication?.accessToken?.audience,requireLiveSession:authentication?.mode!=="consumer",db,resolveSessionsTable:(tenant)=>{let tables=schemaTables;if(tenant&&tenantRegistry){let ctx=tenantRegistry.getSchemaContext(tenant);if(ctx?.schemaTables)tables=ctx.schemaTables}return tables?.userSessions??null},logger:logger2}):void 0});useRoutes(plugin,pubsubRoutes),recordSocket(pubsubSocket),recordAdapterStep((app)=>{mountWebSocketRoute(app,pubsubSocket)}),pubsubClientManager=clientManager,logger2.info("[PubSub] Enabled",{basePath:pubsubConfig.basePath||"/subs",wsPath:pubsubConfig.wsPath||"/api/events/subscribe"})}else logger2.warn("[PubSub] pubsub is enabled but Redis is not configured. Disabling PubSub.")}if(resolvedOptions.chat?.enabled&&db){let chatConfig=mergeChatConfig(resolvedOptions.chat),chatStorageConfig=mergeStorageConfig(resolvedOptions.storage),attachmentsAvailable=resolvedOptions.storage?.enabled===!0&&resolvedOptions.storage?.cdn?.enabled===!0&&chatConfig.attachments.enabled,cdnBasePath=resolvedOptions.storage?.cdn?.basePath||"/cdn",cdnMedia={transform:mergeTransformConfig(resolvedOptions.storage?.cdn?.transform),video:mergeVideoConfig(resolvedOptions.storage?.cdn?.video),pdf:mergePdfConfig(resolvedOptions.storage?.cdn?.pdf)},{routes:chatRoutes}=createChatRoutes({db,schemaTables,config:chatConfig,logger:logger2,broadcaster:pubsubClientManager,tenantRegistry,storageConfig:chatStorageConfig,attachmentsAvailable,cdnBasePath,cdnMedia});useRoutes(plugin,chatRoutes),logger2.info("[Chat] Enabled",{basePath:chatConfig.basePath,attachmentsAvailable,realtime:pubsubClientManager!==null})}if(resolvedOptions.payment?.enabled&&db){let{createPaymentService:createPaymentService2}=(init_Payment(),__toCommonJS(exports_Payment)),{createPaymentRoutes:createPaymentRoutes2}=(init_payment(),__toCommonJS(exports_payment)),paymentService=createPaymentService2(resolvedOptions);if(paymentService){let paymentConfig=resolvedOptions.payment,marketplaceServices=null;if(paymentConfig?.marketplace?.enabled){let{createMarketplaceServices:createMarketplaceServices2}=(init_Payment(),__toCommonJS(exports_Payment));marketplaceServices=createMarketplaceServices2({options:resolvedOptions,logger:logger2,getDb:()=>db,provider:paymentService.providerInstance,schemaTables})}let paymentRoutes=createPaymentRoutes2({provider:paymentService.providerInstance,webhookSecret:paymentService.webhookSecret,getPayoutService:()=>marketplaceServices?.payoutService??null,basePath:paymentConfig?.basePath||"/payment",defaultCurrency:paymentConfig?.defaultCurrency||"TRY",defaultLocale:paymentConfig?.defaultLocale||"tr",successRedirectUrl:paymentConfig?.successRedirectUrl||"/payment/success",failedRedirectUrl:paymentConfig?.failedRedirectUrl||"/payment/failed",errorRedirectUrl:paymentConfig?.errorRedirectUrl||"/payment/error",callbackUrl:paymentConfig?.callbackUrl,savedMethodsEnabled:paymentConfig?.savedMethodsEnabled??!0,threeDSecureEnabled:paymentConfig?.threeDSecureEnabled??!0,subMerchantsEnabled:paymentConfig?.subMerchantsEnabled??!1,transactionsTable:schemaTables.paymentTransactions??schemaTables.payment_transactions,methodsTable:schemaTables.paymentMethods??schemaTables.payment_methods,webhookLogsTable:schemaTables.paymentWebhookLogs??schemaTables.payment_webhook_logs,subMerchantsTable:schemaTables.paymentSubMerchants??schemaTables.payment_sub_merchants,commissionSplitsTable:schemaTables.paymentCommissionSplits??schemaTables.payment_commission_splits,productsTable:schemaTables.paymentProducts??schemaTables.payment_products,pricesTable:schemaTables.paymentPrices??schemaTables.payment_prices,customersTable:schemaTables.paymentCustomers??schemaTables.payment_customers,subscriptionsTable:schemaTables.paymentSubscriptions??schemaTables.payment_subscriptions,invoicesTable:schemaTables.paymentInvoices??schemaTables.payment_invoices,db,logger:logger2});if(useRoutes(plugin,paymentRoutes),logger2.info("[Payment] Routes registered",{basePath:paymentConfig?.basePath||"/payment",provider:paymentService.provider}),marketplaceServices){let{createMarketplaceRoutes:createMarketplaceRoutes2}=(init_marketplace(),__toCommonJS(exports_marketplace)),services=marketplaceServices;createMarketplaceRoutes2(plugin,{getMarketplaceService:()=>services.marketplaceService,getPayoutService:()=>services.payoutService,basePath:paymentConfig?.basePath||"/payment",logger:logger2}),logger2.info("[Payment] Marketplace routes registered",{basePath:`${paymentConfig?.basePath||"/payment"}/marketplace`})}}}let cohortConfig=authentication?.cohorts;if(cohortConfig?.enabled!==!1&&!isConsumerMode&&db){let cohortBasePath=cohortConfig?.basePath||"/auth/admin/cohorts",resolveTable=(key2,fallback)=>schemaTables[key2]??(fallback?schemaTables[fallback]:null)??null,resolvedCohortsTable=resolveTable("userCohorts","user_cohorts");if(!resolvedCohortsTable)logger2.warn("[Cohort] user_cohorts table not found in schema \u2014 cohort routes will be inactive. Re-generate schema with nucleus-core >= 0.9.120");if(useRoutes(plugin,createCohortRoutes({db,logger:logger2,cohortsTable:resolvedCohortsTable,usersTable:resolveTable("users"),sessionsTable:resolveTable("userSessions","user_sessions"),rolesTable:resolveTable("roles"),userRolesTable:resolveTable("userRoles","user_roles"),profilesTable:resolveTable("profiles"),basePath:cohortBasePath,get defaultRole(){return resolvedOptions.authentication?.defaultRole},get defaultRoles(){return resolvedOptions.authentication?.defaultRoles},emailExemptDomains:authentication?.emailExemptDomains,passwordPolicy:authentication?.passwordPolicy})),resolvedCohortsTable)logger2.info("[Cohort] Routes registered",{basePath:cohortBasePath})}if(resolvedOptions.configManagement?.enabled){let configBasePath=resolvedOptions.configManagement.basePath||"/nucleus/config";useRoutes(plugin,createConfigRoutes({logger:logger2,resolvedOptions,configFilePath,basePath:configBasePath,db,schemaTables,getRedis:()=>{let redis=getRedisManager();if(!redis)return null;return{read:async(key2)=>{let r=await redis.read(key2);return{success:r.success,data:r.success?r.data:null}},create:async(key2,value2)=>{return{success:(await redis.create(key2,value2)).success}}}},onConfigUpdate:(section,_newValue)=>{logger2.info(`[ConfigManagement] Section "${section}" updated in-memory`,{section})}})),logger2.info(`[ConfigManagement] Routes enabled at ${configBasePath}`)}if(resolvedOptions.secrets?.enabled){let secretsBasePath=resolvedOptions.secrets.basePath||"/secrets";warnOnEntityBasePathCollision("Secrets",secretsBasePath,resolvedOptions.entities,logger2),useRoutes(plugin,createSecretsRoutes({logger:logger2,basePath:secretsBasePath,db,schemaTables,resolvedOptions,getService:()=>secretsService,getEmailService,getStorageProvider:()=>storageProvider,buildStorageProvider,adminRoles:resolvedOptions.secrets.adminRoles})),logger2.info(`[Secrets] Routes enabled at ${secretsBasePath}`)}if(resolvedOptions.integrations?.enabled){let integrationsBasePath=resolvedOptions.integrations.basePath||"/integrations";warnOnEntityBasePathCollision("Integrations",integrationsBasePath,resolvedOptions.entities,logger2),useRoutes(plugin,createIntegrationRoutes({logger:logger2,basePath:integrationsBasePath,db,schemaTables,resolvedOptions,getEncryptionKey:()=>resolveMasterKey(resolvedOptions.secrets?.encryptionKey)??null,getLockStore:()=>getRedisManager(),publish:(topic,payload)=>pubsubClientManager?.broadcastEvent(topic,payload),adminRoles:resolvedOptions.integrations.adminRoles}))}recordBootStep((app)=>{let requiredBody=requiredBodyCeiling({storageEnabled:resolvedOptions.storage?.enabled,maxFileSizeBytes:resolvedOptions.storage?.maxFileSizeBytes,maxFiles:resolvedOptions.storage?.formData?.maxFiles}),complaint=bodyCeilingComplaint({configured:app?.config?.serve?.maxRequestBodySize,required:requiredBody});if(complaint)logger2.error(`[Storage] ${complaint}`);else if(requiredBody!==null){let configuredCeiling=app?.config?.serve?.maxRequestBodySize,mb2=(bytes)=>`${Math.round(bytes/1048576)} MB`;logger2.info(`[Storage] Uploads are configured up to ${mb2(requiredBody)}, and the server accepts ${configuredCeiling?mb2(configuredCeiling):"Bun's default"}.`)}let memoryComplaint=memoryCeilingComplaint({required:requiredBody,cgroupLimit:readCgroupLimitBytes()});if(memoryComplaint)logger2.error(`[Storage] ${memoryComplaint}`);let memoryAdvice=readRuntimeMemoryAdvice();if(memoryAdvice){let mib=(bytes)=>`${Math.round(bytes/1024/1024)} MiB`;logger2.warn(`[Runtime] The JS engine sizes its heap for ${mib(memoryAdvice.hostTotal)} but this container is capped at ${mib(memoryAdvice.cgroupLimit)} \u2014 it feels no memory `+"pressure and may grow past the limit and be OOM-killed. Raising the container memory limit delays this; no runtime option we have measured prevents it.")}let port=Number(process.env.PORT)||3000,appId=resolvedOptions.appId||"nucleus",mode=resolvedOptions.mode||"production";console.log(""),console.log(`  \x1B[32m\uD83D\uDE80 ${appId}\x1B[0m \x1B[90mv${Date.now()}\x1B[0m`),console.log(`  \x1B[36m\u279C\x1B[0m  Local:   \x1B[36mhttp://localhost:${port}\x1B[0m`),console.log(`  \x1B[36m\u279C\x1B[0m  Mode:    \x1B[33m${mode}\x1B[0m`),console.log("")});let shuttingDown=!1,drainResources=async(trigger)=>{if(shuttingDown)return;shuttingDown=!0,logger2.info(`[Shutdown] ${trigger} \u2014 draining resources`);try{await lifecycleRecorder?.recordStop(trigger)}catch{}try{liveMonitoringService?.stop(),monitoringService?.stop(),secretsService?.stop(),storageProvider?.close()}catch(err){logger2.warn("[Shutdown] failed stopping monitoring",{error:err instanceof Error?err.message:String(err)})}try{let redisClient=getRedisManager()?.getDirectClient?.();if(redisClient)await redisClient.quit()}catch(err){logger2.warn("[Shutdown] failed closing Redis",{error:err instanceof Error?err.message:String(err)})}try{for(let timer of backgroundIntervals)clearInterval(timer);backgroundIntervals.length=0}catch(err){logger2.warn("[Shutdown] failed clearing background intervals",{error:err instanceof Error?err.message:String(err)})}try{let{destroyAckCleanup:destroyAckCleanup2}=await Promise.resolve().then(() => (init_ack_manager(),exports_ack_manager));destroyAckCleanup2()}catch{}try{if(dbPool)await dbPool.end()}catch(err){logger2.warn("[Shutdown] failed draining DB pool",{error:err instanceof Error?err.message:String(err)})}logger2.info("[Shutdown] complete")};if(recordShutdownStep(async()=>{await drainResources("server stop")}),resolvedOptions.gracefulShutdown!==!1){let onSignal=(signal)=>{drainResources(signal).finally(()=>process.exit(0))};process.once("SIGTERM",()=>onSignal("SIGTERM")),process.once("SIGINT",()=>onSignal("SIGINT"))}return recordAdapterStep((app)=>{for(let step of getRecordedBootSteps())app.onStart(step);for(let step of getRecordedShutdownSteps())app.onStop(step)}),lastMountedSocket=getRecordedSocket(),lastStaticAssets=getRecordedStaticAssets(),lastBootSteps=getRecordedBootSteps(),lastShutdownSteps=getRecordedShutdownSteps(),lastMountedGroups=resolveOverrides(endRouteRecording(),logger2),lastAuthMiddleware=authMiddleware,lastErrorHandler=errorResponder,lastAfterHandler=afterHandler,plugin}init_response();class BodyParseError extends Error{status=400;constructor(){super("Bad Request");this.name="BodyParseError"}}function looksStructured(value2){return value2.startsWith("{")||value2.startsWith("[")}function assignPath(target2,key2,value2){let steps=key2.replace(/\[(\w*)\]/g,".$1").split(".").filter((step)=>step!=="");if(steps.length<=1){mergeInto(target2,key2,value2);return}let cursor=target2;for(let index=0;index<steps.length-1;index++){let step=steps[index],next=steps[index+1],wanted=/^\d+$/.test(next)?[]:{},holder2=cursor;if(typeof holder2[step]!=="object"||holder2[step]===null)holder2[step]=wanted;cursor=holder2[step]}let last=steps[steps.length-1];if(Array.isArray(cursor))cursor[Number(last)]=value2;else mergeInto(cursor,last,value2)}function mergeInto(target2,key2,value2){if(key2 in target2){let existing=target2[key2];target2[key2]=Array.isArray(existing)?[...existing,value2]:[existing,value2];return}target2[key2]=value2}function fromFormData(form){let out={};for(let[key2,value2]of form.entries()){let parsed=value2;if(typeof value2==="string"&&looksStructured(value2))try{parsed=JSON.parse(value2)}catch{parsed=value2}assignPath(out,key2,parsed)}return out}async function parseBody(request,declared){let contentType=request.headers.get("content-type");if(!contentType&&!declared)return;let kind=(contentType?.includes("multipart/form-data")?"formdata":contentType?.includes("application/x-www-form-urlencoded")?"urlencoded":contentType?.includes("application/json")?"json":contentType?.startsWith("text/")?"text":contentType?.includes("application/octet-stream")?"binary":void 0)??declared;if(!kind)return;if(kind==="formdata")try{return fromFormData(await request.formData())}catch{throw new BodyParseError}if(kind==="urlencoded"){let params=new URLSearchParams(await request.text()),out={};for(let[key2,value2]of params)if(key2 in out){let existing=out[key2];out[key2]=Array.isArray(existing)?[...existing,value2]:[existing,value2]}else out[key2]=value2;return out}if(kind==="binary")return await request.arrayBuffer();if(kind==="text")return await request.text();let raw=await request.text();if(raw===""&&!request.body)return;try{return JSON.parse(raw)}catch{throw new BodyParseError}}init_response();init_esm3();init_keyof2();init_registry4();init_extends_undefined();init_symbols2();function DefaultErrorFunction(error3){switch(error3.errorType){case ValueErrorType.ArrayContains:return"Expected array to contain at least one matching value";case ValueErrorType.ArrayMaxContains:return`Expected array to contain no more than ${error3.schema.maxContains} matching values`;case ValueErrorType.ArrayMinContains:return`Expected array to contain at least ${error3.schema.minContains} matching values`;case ValueErrorType.ArrayMaxItems:return`Expected array length to be less or equal to ${error3.schema.maxItems}`;case ValueErrorType.ArrayMinItems:return`Expected array length to be greater or equal to ${error3.schema.minItems}`;case ValueErrorType.ArrayUniqueItems:return"Expected array elements to be unique";case ValueErrorType.Array:return"Expected array";case ValueErrorType.AsyncIterator:return"Expected AsyncIterator";case ValueErrorType.BigIntExclusiveMaximum:return`Expected bigint to be less than ${error3.schema.exclusiveMaximum}`;case ValueErrorType.BigIntExclusiveMinimum:return`Expected bigint to be greater than ${error3.schema.exclusiveMinimum}`;case ValueErrorType.BigIntMaximum:return`Expected bigint to be less or equal to ${error3.schema.maximum}`;case ValueErrorType.BigIntMinimum:return`Expected bigint to be greater or equal to ${error3.schema.minimum}`;case ValueErrorType.BigIntMultipleOf:return`Expected bigint to be a multiple of ${error3.schema.multipleOf}`;case ValueErrorType.BigInt:return"Expected bigint";case ValueErrorType.Boolean:return"Expected boolean";case ValueErrorType.DateExclusiveMinimumTimestamp:return`Expected Date timestamp to be greater than ${error3.schema.exclusiveMinimumTimestamp}`;case ValueErrorType.DateExclusiveMaximumTimestamp:return`Expected Date timestamp to be less than ${error3.schema.exclusiveMaximumTimestamp}`;case ValueErrorType.DateMinimumTimestamp:return`Expected Date timestamp to be greater or equal to ${error3.schema.minimumTimestamp}`;case ValueErrorType.DateMaximumTimestamp:return`Expected Date timestamp to be less or equal to ${error3.schema.maximumTimestamp}`;case ValueErrorType.DateMultipleOfTimestamp:return`Expected Date timestamp to be a multiple of ${error3.schema.multipleOfTimestamp}`;case ValueErrorType.Date:return"Expected Date";case ValueErrorType.Function:return"Expected function";case ValueErrorType.IntegerExclusiveMaximum:return`Expected integer to be less than ${error3.schema.exclusiveMaximum}`;case ValueErrorType.IntegerExclusiveMinimum:return`Expected integer to be greater than ${error3.schema.exclusiveMinimum}`;case ValueErrorType.IntegerMaximum:return`Expected integer to be less or equal to ${error3.schema.maximum}`;case ValueErrorType.IntegerMinimum:return`Expected integer to be greater or equal to ${error3.schema.minimum}`;case ValueErrorType.IntegerMultipleOf:return`Expected integer to be a multiple of ${error3.schema.multipleOf}`;case ValueErrorType.Integer:return"Expected integer";case ValueErrorType.IntersectUnevaluatedProperties:return"Unexpected property";case ValueErrorType.Intersect:return"Expected all values to match";case ValueErrorType.Iterator:return"Expected Iterator";case ValueErrorType.Literal:return`Expected ${typeof error3.schema.const==="string"?`'${error3.schema.const}'`:error3.schema.const}`;case ValueErrorType.Never:return"Never";case ValueErrorType.Not:return"Value should not match";case ValueErrorType.Null:return"Expected null";case ValueErrorType.NumberExclusiveMaximum:return`Expected number to be less than ${error3.schema.exclusiveMaximum}`;case ValueErrorType.NumberExclusiveMinimum:return`Expected number to be greater than ${error3.schema.exclusiveMinimum}`;case ValueErrorType.NumberMaximum:return`Expected number to be less or equal to ${error3.schema.maximum}`;case ValueErrorType.NumberMinimum:return`Expected number to be greater or equal to ${error3.schema.minimum}`;case ValueErrorType.NumberMultipleOf:return`Expected number to be a multiple of ${error3.schema.multipleOf}`;case ValueErrorType.Number:return"Expected number";case ValueErrorType.Object:return"Expected object";case ValueErrorType.ObjectAdditionalProperties:return"Unexpected property";case ValueErrorType.ObjectMaxProperties:return`Expected object to have no more than ${error3.schema.maxProperties} properties`;case ValueErrorType.ObjectMinProperties:return`Expected object to have at least ${error3.schema.minProperties} properties`;case ValueErrorType.ObjectRequiredProperty:return"Expected required property";case ValueErrorType.Promise:return"Expected Promise";case ValueErrorType.RegExp:return"Expected string to match regular expression";case ValueErrorType.StringFormatUnknown:return`Unknown format '${error3.schema.format}'`;case ValueErrorType.StringFormat:return`Expected string to match '${error3.schema.format}' format`;case ValueErrorType.StringMaxLength:return`Expected string length less or equal to ${error3.schema.maxLength}`;case ValueErrorType.StringMinLength:return`Expected string length greater or equal to ${error3.schema.minLength}`;case ValueErrorType.StringPattern:return`Expected string to match '${error3.schema.pattern}'`;case ValueErrorType.String:return"Expected string";case ValueErrorType.Symbol:return"Expected symbol";case ValueErrorType.TupleLength:return`Expected tuple to have ${error3.schema.maxItems||0} elements`;case ValueErrorType.Tuple:return"Expected tuple";case ValueErrorType.Uint8ArrayMaxByteLength:return`Expected byte length less or equal to ${error3.schema.maxByteLength}`;case ValueErrorType.Uint8ArrayMinByteLength:return`Expected byte length greater or equal to ${error3.schema.minByteLength}`;case ValueErrorType.Uint8Array:return"Expected Uint8Array";case ValueErrorType.Undefined:return"Expected undefined";case ValueErrorType.Union:return"Expected union value";case ValueErrorType.Void:return"Expected void";case ValueErrorType.Kind:return`Expected kind '${error3.schema[Kind]}'`;default:return"Unknown error type"}}var errorFunction=DefaultErrorFunction;function GetErrorFunction(){return errorFunction}init_error2();init_error2();init_symbols2();class TypeDereferenceError extends TypeBoxError{constructor(schema3){super(`Unable to dereference schema with $id '${schema3.$ref}'`);this.schema=schema3}}function Resolve(schema3,references){let target2=references.find((target3)=>target3.$id===schema3.$ref);if(target2===void 0)throw new TypeDereferenceError(schema3);return Deref(target2,references)}function Pushref(schema3,references){if(!IsString2(schema3.$id)||references.some((target2)=>target2.$id===schema3.$id))return references;return references.push(schema3),references}function Deref(schema3,references){return schema3[Kind]==="This"||schema3[Kind]==="Ref"?Resolve(schema3,references):schema3}init_guard();init_error2();class ValueHashError extends TypeBoxError{constructor(value2){super("Unable to hash value");this.value=value2}}var ByteMarker;(function(ByteMarker2){ByteMarker2[ByteMarker2.Undefined=0]="Undefined",ByteMarker2[ByteMarker2.Null=1]="Null",ByteMarker2[ByteMarker2.Boolean=2]="Boolean",ByteMarker2[ByteMarker2.Number=3]="Number",ByteMarker2[ByteMarker2.String=4]="String",ByteMarker2[ByteMarker2.Object=5]="Object",ByteMarker2[ByteMarker2.Array=6]="Array",ByteMarker2[ByteMarker2.Date=7]="Date",ByteMarker2[ByteMarker2.Uint8Array=8]="Uint8Array",ByteMarker2[ByteMarker2.Symbol=9]="Symbol",ByteMarker2[ByteMarker2.BigInt=10]="BigInt"})(ByteMarker||(ByteMarker={}));var Accumulator=BigInt("14695981039346656037"),[Prime,Size]=[BigInt("1099511628211"),BigInt("18446744073709551616")],Bytes=Array.from({length:256}).map((_,i)=>BigInt(i)),F64=new Float64Array(1),F64In=new DataView(F64.buffer),F64Out=new Uint8Array(F64.buffer);function*NumberToBytes(value2){let byteCount=value2===0?1:Math.ceil(Math.floor(Math.log2(value2)+1)/8);for(let i=0;i<byteCount;i++)yield value2>>8*(byteCount-1-i)&255}function ArrayType2(value2){FNV1A64(ByteMarker.Array);for(let item of value2)Visit4(item)}function BooleanType(value2){FNV1A64(ByteMarker.Boolean),FNV1A64(value2?1:0)}function BigIntType(value2){FNV1A64(ByteMarker.BigInt),F64In.setBigInt64(0,value2);for(let byte of F64Out)FNV1A64(byte)}function DateType2(value2){FNV1A64(ByteMarker.Date),Visit4(value2.getTime())}function NullType(value2){FNV1A64(ByteMarker.Null)}function NumberType(value2){FNV1A64(ByteMarker.Number),F64In.setFloat64(0,value2);for(let byte of F64Out)FNV1A64(byte)}function ObjectType2(value2){FNV1A64(ByteMarker.Object);for(let key2 of globalThis.Object.getOwnPropertyNames(value2).sort())Visit4(key2),Visit4(value2[key2])}function StringType(value2){FNV1A64(ByteMarker.String);for(let i=0;i<value2.length;i++)for(let byte of NumberToBytes(value2.charCodeAt(i)))FNV1A64(byte)}function SymbolType(value2){FNV1A64(ByteMarker.Symbol),Visit4(value2.description)}function Uint8ArrayType2(value2){FNV1A64(ByteMarker.Uint8Array);for(let i=0;i<value2.length;i++)FNV1A64(value2[i])}function UndefinedType(value2){return FNV1A64(ByteMarker.Undefined)}function Visit4(value2){if(IsArray2(value2))return ArrayType2(value2);if(IsBoolean2(value2))return BooleanType(value2);if(IsBigInt2(value2))return BigIntType(value2);if(IsDate2(value2))return DateType2(value2);if(IsNull2(value2))return NullType(value2);if(IsNumber2(value2))return NumberType(value2);if(IsObject2(value2))return ObjectType2(value2);if(IsString2(value2))return StringType(value2);if(IsSymbol2(value2))return SymbolType(value2);if(IsUint8Array2(value2))return Uint8ArrayType2(value2);if(IsUndefined2(value2))return UndefinedType(value2);throw new ValueHashError(value2)}function FNV1A64(byte){Accumulator=Accumulator^Bytes[byte],Accumulator=Accumulator*Prime%Size}function Hash(value2){return Accumulator=BigInt("14695981039346656037"),Visit4(value2),Accumulator}init_symbols2();init_keyof2();init_extends2();init_registry4();init_error2();init_never2();init_guard();init_kind();class ValueCheckUnknownTypeError extends TypeBoxError{constructor(schema3){super("Unknown type");this.schema=schema3}}function IsAnyOrUnknown(schema3){return schema3[Kind]==="Any"||schema3[Kind]==="Unknown"}function IsDefined(value2){return value2!==void 0}function FromAny2(schema3,references,value2){return!0}function FromArgument2(schema3,references,value2){return!0}function FromArray7(schema3,references,value2){if(!IsArray2(value2))return!1;if(IsDefined(schema3.minItems)&&!(value2.length>=schema3.minItems))return!1;if(IsDefined(schema3.maxItems)&&!(value2.length<=schema3.maxItems))return!1;if(!value2.every((value3)=>Visit5(schema3.items,references,value3)))return!1;if(schema3.uniqueItems===!0&&!function(){let set2=new Set;for(let element of value2){let hashed=Hash(element);if(set2.has(hashed))return!1;else set2.add(hashed)}return!0}())return!1;if(!(IsDefined(schema3.contains)||IsNumber2(schema3.minContains)||IsNumber2(schema3.maxContains)))return!0;let containsSchema=IsDefined(schema3.contains)?schema3.contains:Never(),containsCount=value2.reduce((acc,value3)=>Visit5(containsSchema,references,value3)?acc+1:acc,0);if(containsCount===0)return!1;if(IsNumber2(schema3.minContains)&&containsCount<schema3.minContains)return!1;if(IsNumber2(schema3.maxContains)&&containsCount>schema3.maxContains)return!1;return!0}function FromAsyncIterator4(schema3,references,value2){return IsAsyncIterator2(value2)}function FromBigInt2(schema3,references,value2){if(!IsBigInt2(value2))return!1;if(IsDefined(schema3.exclusiveMaximum)&&!(value2<schema3.exclusiveMaximum))return!1;if(IsDefined(schema3.exclusiveMinimum)&&!(value2>schema3.exclusiveMinimum))return!1;if(IsDefined(schema3.maximum)&&!(value2<=schema3.maximum))return!1;if(IsDefined(schema3.minimum)&&!(value2>=schema3.minimum))return!1;if(IsDefined(schema3.multipleOf)&&value2%schema3.multipleOf!==BigInt(0))return!1;return!0}function FromBoolean2(schema3,references,value2){return IsBoolean2(value2)}function FromConstructor4(schema3,references,value2){return Visit5(schema3.returns,references,value2.prototype)}function FromDate2(schema3,references,value2){if(!IsDate2(value2))return!1;if(IsDefined(schema3.exclusiveMaximumTimestamp)&&!(value2.getTime()<schema3.exclusiveMaximumTimestamp))return!1;if(IsDefined(schema3.exclusiveMinimumTimestamp)&&!(value2.getTime()>schema3.exclusiveMinimumTimestamp))return!1;if(IsDefined(schema3.maximumTimestamp)&&!(value2.getTime()<=schema3.maximumTimestamp))return!1;if(IsDefined(schema3.minimumTimestamp)&&!(value2.getTime()>=schema3.minimumTimestamp))return!1;if(IsDefined(schema3.multipleOfTimestamp)&&value2.getTime()%schema3.multipleOfTimestamp!==0)return!1;return!0}function FromFunction4(schema3,references,value2){return IsFunction2(value2)}function FromImport(schema3,references,value2){let definitions=globalThis.Object.values(schema3.$defs),target2=schema3.$defs[schema3.$ref];return Visit5(target2,[...references,...definitions],value2)}function FromInteger2(schema3,references,value2){if(!IsInteger(value2))return!1;if(IsDefined(schema3.exclusiveMaximum)&&!(value2<schema3.exclusiveMaximum))return!1;if(IsDefined(schema3.exclusiveMinimum)&&!(value2>schema3.exclusiveMinimum))return!1;if(IsDefined(schema3.maximum)&&!(value2<=schema3.maximum))return!1;if(IsDefined(schema3.minimum)&&!(value2>=schema3.minimum))return!1;if(IsDefined(schema3.multipleOf)&&value2%schema3.multipleOf!==0)return!1;return!0}function FromIntersect9(schema3,references,value2){let check1=schema3.allOf.every((schema4)=>Visit5(schema4,references,value2));if(schema3.unevaluatedProperties===!1){let keyPattern=new RegExp(KeyOfPattern(schema3)),check2=Object.getOwnPropertyNames(value2).every((key2)=>keyPattern.test(key2));return check1&&check2}else if(IsSchema(schema3.unevaluatedProperties)){let keyCheck=new RegExp(KeyOfPattern(schema3)),check2=Object.getOwnPropertyNames(value2).every((key2)=>keyCheck.test(key2)||Visit5(schema3.unevaluatedProperties,references,value2[key2]));return check1&&check2}else return check1}function FromIterator4(schema3,references,value2){return IsIterator2(value2)}function FromLiteral3(schema3,references,value2){return value2===schema3.const}function FromNever2(schema3,references,value2){return!1}function FromNot2(schema3,references,value2){return!Visit5(schema3.not,references,value2)}function FromNull2(schema3,references,value2){return IsNull2(value2)}function FromNumber2(schema3,references,value2){if(!TypeSystemPolicy.IsNumberLike(value2))return!1;if(IsDefined(schema3.exclusiveMaximum)&&!(value2<schema3.exclusiveMaximum))return!1;if(IsDefined(schema3.exclusiveMinimum)&&!(value2>schema3.exclusiveMinimum))return!1;if(IsDefined(schema3.minimum)&&!(value2>=schema3.minimum))return!1;if(IsDefined(schema3.maximum)&&!(value2<=schema3.maximum))return!1;if(IsDefined(schema3.multipleOf)&&value2%schema3.multipleOf!==0)return!1;return!0}function FromObject8(schema3,references,value2){if(!TypeSystemPolicy.IsObjectLike(value2))return!1;if(IsDefined(schema3.minProperties)&&!(Object.getOwnPropertyNames(value2).length>=schema3.minProperties))return!1;if(IsDefined(schema3.maxProperties)&&!(Object.getOwnPropertyNames(value2).length<=schema3.maxProperties))return!1;let knownKeys=Object.getOwnPropertyNames(schema3.properties);for(let knownKey of knownKeys){let property=schema3.properties[knownKey];if(schema3.required&&schema3.required.includes(knownKey)){if(!Visit5(property,references,value2[knownKey]))return!1;if((ExtendsUndefinedCheck(property)||IsAnyOrUnknown(property))&&!(knownKey in value2))return!1}else if(TypeSystemPolicy.IsExactOptionalProperty(value2,knownKey)&&!Visit5(property,references,value2[knownKey]))return!1}if(schema3.additionalProperties===!1){let valueKeys=Object.getOwnPropertyNames(value2);if(schema3.required&&schema3.required.length===knownKeys.length&&valueKeys.length===knownKeys.length)return!0;else return valueKeys.every((valueKey)=>knownKeys.includes(valueKey))}else if(typeof schema3.additionalProperties==="object")return Object.getOwnPropertyNames(value2).every((key2)=>knownKeys.includes(key2)||Visit5(schema3.additionalProperties,references,value2[key2]));else return!0}function FromPromise4(schema3,references,value2){return IsPromise(value2)}function FromRecord4(schema3,references,value2){if(!TypeSystemPolicy.IsRecordLike(value2))return!1;if(IsDefined(schema3.minProperties)&&!(Object.getOwnPropertyNames(value2).length>=schema3.minProperties))return!1;if(IsDefined(schema3.maxProperties)&&!(Object.getOwnPropertyNames(value2).length<=schema3.maxProperties))return!1;let[patternKey,patternSchema]=Object.entries(schema3.patternProperties)[0],regex=new RegExp(patternKey),check1=Object.entries(value2).every(([key2,value3])=>{return regex.test(key2)?Visit5(patternSchema,references,value3):!0}),check2=typeof schema3.additionalProperties==="object"?Object.entries(value2).every(([key2,value3])=>{return!regex.test(key2)?Visit5(schema3.additionalProperties,references,value3):!0}):!0,check3=schema3.additionalProperties===!1?Object.getOwnPropertyNames(value2).every((key2)=>{return regex.test(key2)}):!0;return check1&&check2&&check3}function FromRef5(schema3,references,value2){return Visit5(Deref(schema3,references),references,value2)}function FromRegExp2(schema3,references,value2){let regex=new RegExp(schema3.source,schema3.flags);if(IsDefined(schema3.minLength)){if(!(value2.length>=schema3.minLength))return!1}if(IsDefined(schema3.maxLength)){if(!(value2.length<=schema3.maxLength))return!1}return regex.test(value2)}function FromString2(schema3,references,value2){if(!IsString2(value2))return!1;if(IsDefined(schema3.minLength)){if(!(value2.length>=schema3.minLength))return!1}if(IsDefined(schema3.maxLength)){if(!(value2.length<=schema3.maxLength))return!1}if(IsDefined(schema3.pattern)){if(!new RegExp(schema3.pattern).test(value2))return!1}if(IsDefined(schema3.format)){if(!exports_format.Has(schema3.format))return!1;return exports_format.Get(schema3.format)(value2)}return!0}function FromSymbol2(schema3,references,value2){return IsSymbol2(value2)}function FromTemplateLiteral4(schema3,references,value2){return IsString2(value2)&&new RegExp(schema3.pattern).test(value2)}function FromThis(schema3,references,value2){return Visit5(Deref(schema3,references),references,value2)}function FromTuple6(schema3,references,value2){if(!IsArray2(value2))return!1;if(schema3.items===void 0&&value2.length!==0)return!1;if(value2.length!==schema3.maxItems)return!1;if(!schema3.items)return!0;for(let i=0;i<schema3.items.length;i++)if(!Visit5(schema3.items[i],references,value2[i]))return!1;return!0}function FromUndefined2(schema3,references,value2){return IsUndefined2(value2)}function FromUnion11(schema3,references,value2){return schema3.anyOf.some((inner)=>Visit5(inner,references,value2))}function FromUint8Array2(schema3,references,value2){if(!IsUint8Array2(value2))return!1;if(IsDefined(schema3.maxByteLength)&&!(value2.length<=schema3.maxByteLength))return!1;if(IsDefined(schema3.minByteLength)&&!(value2.length>=schema3.minByteLength))return!1;return!0}function FromUnknown2(schema3,references,value2){return!0}function FromVoid2(schema3,references,value2){return TypeSystemPolicy.IsVoidLike(value2)}function FromKind(schema3,references,value2){if(!exports_type2.Has(schema3[Kind]))return!1;return exports_type2.Get(schema3[Kind])(schema3,value2)}function Visit5(schema3,references,value2){let references_=IsDefined(schema3.$id)?Pushref(schema3,references):references,schema_=schema3;switch(schema_[Kind]){case"Any":return FromAny2(schema_,references_,value2);case"Argument":return FromArgument2(schema_,references_,value2);case"Array":return FromArray7(schema_,references_,value2);case"AsyncIterator":return FromAsyncIterator4(schema_,references_,value2);case"BigInt":return FromBigInt2(schema_,references_,value2);case"Boolean":return FromBoolean2(schema_,references_,value2);case"Constructor":return FromConstructor4(schema_,references_,value2);case"Date":return FromDate2(schema_,references_,value2);case"Function":return FromFunction4(schema_,references_,value2);case"Import":return FromImport(schema_,references_,value2);case"Integer":return FromInteger2(schema_,references_,value2);case"Intersect":return FromIntersect9(schema_,references_,value2);case"Iterator":return FromIterator4(schema_,references_,value2);case"Literal":return FromLiteral3(schema_,references_,value2);case"Never":return FromNever2(schema_,references_,value2);case"Not":return FromNot2(schema_,references_,value2);case"Null":return FromNull2(schema_,references_,value2);case"Number":return FromNumber2(schema_,references_,value2);case"Object":return FromObject8(schema_,references_,value2);case"Promise":return FromPromise4(schema_,references_,value2);case"Record":return FromRecord4(schema_,references_,value2);case"Ref":return FromRef5(schema_,references_,value2);case"RegExp":return FromRegExp2(schema_,references_,value2);case"String":return FromString2(schema_,references_,value2);case"Symbol":return FromSymbol2(schema_,references_,value2);case"TemplateLiteral":return FromTemplateLiteral4(schema_,references_,value2);case"This":return FromThis(schema_,references_,value2);case"Tuple":return FromTuple6(schema_,references_,value2);case"Undefined":return FromUndefined2(schema_,references_,value2);case"Union":return FromUnion11(schema_,references_,value2);case"Uint8Array":return FromUint8Array2(schema_,references_,value2);case"Unknown":return FromUnknown2(schema_,references_,value2);case"Void":return FromVoid2(schema_,references_,value2);default:if(!exports_type2.Has(schema_[Kind]))throw new ValueCheckUnknownTypeError(schema_);return FromKind(schema_,references_,value2)}}function Check(...args){return args.length===3?Visit5(args[0],args[1],args[2]):Visit5(args[0],[],args[1])}init_symbols2();init_never2();init_guard();var ValueErrorType;(function(ValueErrorType2){ValueErrorType2[ValueErrorType2.ArrayContains=0]="ArrayContains",ValueErrorType2[ValueErrorType2.ArrayMaxContains=1]="ArrayMaxContains",ValueErrorType2[ValueErrorType2.ArrayMaxItems=2]="ArrayMaxItems",ValueErrorType2[ValueErrorType2.ArrayMinContains=3]="ArrayMinContains",ValueErrorType2[ValueErrorType2.ArrayMinItems=4]="ArrayMinItems",ValueErrorType2[ValueErrorType2.ArrayUniqueItems=5]="ArrayUniqueItems",ValueErrorType2[ValueErrorType2.Array=6]="Array",ValueErrorType2[ValueErrorType2.AsyncIterator=7]="AsyncIterator",ValueErrorType2[ValueErrorType2.BigIntExclusiveMaximum=8]="BigIntExclusiveMaximum",ValueErrorType2[ValueErrorType2.BigIntExclusiveMinimum=9]="BigIntExclusiveMinimum",ValueErrorType2[ValueErrorType2.BigIntMaximum=10]="BigIntMaximum",ValueErrorType2[ValueErrorType2.BigIntMinimum=11]="BigIntMinimum",ValueErrorType2[ValueErrorType2.BigIntMultipleOf=12]="BigIntMultipleOf",ValueErrorType2[ValueErrorType2.BigInt=13]="BigInt",ValueErrorType2[ValueErrorType2.Boolean=14]="Boolean",ValueErrorType2[ValueErrorType2.DateExclusiveMaximumTimestamp=15]="DateExclusiveMaximumTimestamp",ValueErrorType2[ValueErrorType2.DateExclusiveMinimumTimestamp=16]="DateExclusiveMinimumTimestamp",ValueErrorType2[ValueErrorType2.DateMaximumTimestamp=17]="DateMaximumTimestamp",ValueErrorType2[ValueErrorType2.DateMinimumTimestamp=18]="DateMinimumTimestamp",ValueErrorType2[ValueErrorType2.DateMultipleOfTimestamp=19]="DateMultipleOfTimestamp",ValueErrorType2[ValueErrorType2.Date=20]="Date",ValueErrorType2[ValueErrorType2.Function=21]="Function",ValueErrorType2[ValueErrorType2.IntegerExclusiveMaximum=22]="IntegerExclusiveMaximum",ValueErrorType2[ValueErrorType2.IntegerExclusiveMinimum=23]="IntegerExclusiveMinimum",ValueErrorType2[ValueErrorType2.IntegerMaximum=24]="IntegerMaximum",ValueErrorType2[ValueErrorType2.IntegerMinimum=25]="IntegerMinimum",ValueErrorType2[ValueErrorType2.IntegerMultipleOf=26]="IntegerMultipleOf",ValueErrorType2[ValueErrorType2.Integer=27]="Integer",ValueErrorType2[ValueErrorType2.IntersectUnevaluatedProperties=28]="IntersectUnevaluatedProperties",ValueErrorType2[ValueErrorType2.Intersect=29]="Intersect",ValueErrorType2[ValueErrorType2.Iterator=30]="Iterator",ValueErrorType2[ValueErrorType2.Kind=31]="Kind",ValueErrorType2[ValueErrorType2.Literal=32]="Literal",ValueErrorType2[ValueErrorType2.Never=33]="Never",ValueErrorType2[ValueErrorType2.Not=34]="Not",ValueErrorType2[ValueErrorType2.Null=35]="Null",ValueErrorType2[ValueErrorType2.NumberExclusiveMaximum=36]="NumberExclusiveMaximum",ValueErrorType2[ValueErrorType2.NumberExclusiveMinimum=37]="NumberExclusiveMinimum",ValueErrorType2[ValueErrorType2.NumberMaximum=38]="NumberMaximum",ValueErrorType2[ValueErrorType2.NumberMinimum=39]="NumberMinimum",ValueErrorType2[ValueErrorType2.NumberMultipleOf=40]="NumberMultipleOf",ValueErrorType2[ValueErrorType2.Number=41]="Number",ValueErrorType2[ValueErrorType2.ObjectAdditionalProperties=42]="ObjectAdditionalProperties",ValueErrorType2[ValueErrorType2.ObjectMaxProperties=43]="ObjectMaxProperties",ValueErrorType2[ValueErrorType2.ObjectMinProperties=44]="ObjectMinProperties",ValueErrorType2[ValueErrorType2.ObjectRequiredProperty=45]="ObjectRequiredProperty",ValueErrorType2[ValueErrorType2.Object=46]="Object",ValueErrorType2[ValueErrorType2.Promise=47]="Promise",ValueErrorType2[ValueErrorType2.RegExp=48]="RegExp",ValueErrorType2[ValueErrorType2.StringFormatUnknown=49]="StringFormatUnknown",ValueErrorType2[ValueErrorType2.StringFormat=50]="StringFormat",ValueErrorType2[ValueErrorType2.StringMaxLength=51]="StringMaxLength",ValueErrorType2[ValueErrorType2.StringMinLength=52]="StringMinLength",ValueErrorType2[ValueErrorType2.StringPattern=53]="StringPattern",ValueErrorType2[ValueErrorType2.String=54]="String",ValueErrorType2[ValueErrorType2.Symbol=55]="Symbol",ValueErrorType2[ValueErrorType2.TupleLength=56]="TupleLength",ValueErrorType2[ValueErrorType2.Tuple=57]="Tuple",ValueErrorType2[ValueErrorType2.Uint8ArrayMaxByteLength=58]="Uint8ArrayMaxByteLength",ValueErrorType2[ValueErrorType2.Uint8ArrayMinByteLength=59]="Uint8ArrayMinByteLength",ValueErrorType2[ValueErrorType2.Uint8Array=60]="Uint8Array",ValueErrorType2[ValueErrorType2.Undefined=61]="Undefined",ValueErrorType2[ValueErrorType2.Union=62]="Union",ValueErrorType2[ValueErrorType2.Void=63]="Void"})(ValueErrorType||(ValueErrorType={}));class ValueErrorsUnknownTypeError extends TypeBoxError{constructor(schema3){super("Unknown type");this.schema=schema3}}function EscapeKey(key2){return key2.replace(/~/g,"~0").replace(/\//g,"~1")}function IsDefined2(value2){return value2!==void 0}class ValueErrorIterator{constructor(iterator3){this.iterator=iterator3}[Symbol.iterator](){return this.iterator}First(){let next=this.iterator.next();return next.done?void 0:next.value}}function Create(errorType,schema3,path8,value2,errors2=[]){return{type:errorType,schema:schema3,path:path8,value:value2,message:GetErrorFunction()({errorType,path:path8,schema:schema3,value:value2,errors:errors2}),errors:errors2}}function*FromAny3(schema3,references,path8,value2){}function*FromArgument3(schema3,references,path8,value2){}function*FromArray8(schema3,references,path8,value2){if(!IsArray2(value2))return yield Create(ValueErrorType.Array,schema3,path8,value2);if(IsDefined2(schema3.minItems)&&!(value2.length>=schema3.minItems))yield Create(ValueErrorType.ArrayMinItems,schema3,path8,value2);if(IsDefined2(schema3.maxItems)&&!(value2.length<=schema3.maxItems))yield Create(ValueErrorType.ArrayMaxItems,schema3,path8,value2);for(let i=0;i<value2.length;i++)yield*Visit6(schema3.items,references,`${path8}/${i}`,value2[i]);if(schema3.uniqueItems===!0&&!function(){let set2=new Set;for(let element of value2){let hashed=Hash(element);if(set2.has(hashed))return!1;else set2.add(hashed)}return!0}())yield Create(ValueErrorType.ArrayUniqueItems,schema3,path8,value2);if(!(IsDefined2(schema3.contains)||IsDefined2(schema3.minContains)||IsDefined2(schema3.maxContains)))return;let containsSchema=IsDefined2(schema3.contains)?schema3.contains:Never(),containsCount=value2.reduce((acc,value3,index)=>Visit6(containsSchema,references,`${path8}${index}`,value3).next().done===!0?acc+1:acc,0);if(containsCount===0)yield Create(ValueErrorType.ArrayContains,schema3,path8,value2);if(IsNumber2(schema3.minContains)&&containsCount<schema3.minContains)yield Create(ValueErrorType.ArrayMinContains,schema3,path8,value2);if(IsNumber2(schema3.maxContains)&&containsCount>schema3.maxContains)yield Create(ValueErrorType.ArrayMaxContains,schema3,path8,value2)}function*FromAsyncIterator5(schema3,references,path8,value2){if(!IsAsyncIterator2(value2))yield Create(ValueErrorType.AsyncIterator,schema3,path8,value2)}function*FromBigInt3(schema3,references,path8,value2){if(!IsBigInt2(value2))return yield Create(ValueErrorType.BigInt,schema3,path8,value2);if(IsDefined2(schema3.exclusiveMaximum)&&!(value2<schema3.exclusiveMaximum))yield Create(ValueErrorType.BigIntExclusiveMaximum,schema3,path8,value2);if(IsDefined2(schema3.exclusiveMinimum)&&!(value2>schema3.exclusiveMinimum))yield Create(ValueErrorType.BigIntExclusiveMinimum,schema3,path8,value2);if(IsDefined2(schema3.maximum)&&!(value2<=schema3.maximum))yield Create(ValueErrorType.BigIntMaximum,schema3,path8,value2);if(IsDefined2(schema3.minimum)&&!(value2>=schema3.minimum))yield Create(ValueErrorType.BigIntMinimum,schema3,path8,value2);if(IsDefined2(schema3.multipleOf)&&value2%schema3.multipleOf!==BigInt(0))yield Create(ValueErrorType.BigIntMultipleOf,schema3,path8,value2)}function*FromBoolean3(schema3,references,path8,value2){if(!IsBoolean2(value2))yield Create(ValueErrorType.Boolean,schema3,path8,value2)}function*FromConstructor5(schema3,references,path8,value2){yield*Visit6(schema3.returns,references,path8,value2.prototype)}function*FromDate3(schema3,references,path8,value2){if(!IsDate2(value2))return yield Create(ValueErrorType.Date,schema3,path8,value2);if(IsDefined2(schema3.exclusiveMaximumTimestamp)&&!(value2.getTime()<schema3.exclusiveMaximumTimestamp))yield Create(ValueErrorType.DateExclusiveMaximumTimestamp,schema3,path8,value2);if(IsDefined2(schema3.exclusiveMinimumTimestamp)&&!(value2.getTime()>schema3.exclusiveMinimumTimestamp))yield Create(ValueErrorType.DateExclusiveMinimumTimestamp,schema3,path8,value2);if(IsDefined2(schema3.maximumTimestamp)&&!(value2.getTime()<=schema3.maximumTimestamp))yield Create(ValueErrorType.DateMaximumTimestamp,schema3,path8,value2);if(IsDefined2(schema3.minimumTimestamp)&&!(value2.getTime()>=schema3.minimumTimestamp))yield Create(ValueErrorType.DateMinimumTimestamp,schema3,path8,value2);if(IsDefined2(schema3.multipleOfTimestamp)&&value2.getTime()%schema3.multipleOfTimestamp!==0)yield Create(ValueErrorType.DateMultipleOfTimestamp,schema3,path8,value2)}function*FromFunction5(schema3,references,path8,value2){if(!IsFunction2(value2))yield Create(ValueErrorType.Function,schema3,path8,value2)}function*FromImport2(schema3,references,path8,value2){let definitions=globalThis.Object.values(schema3.$defs),target2=schema3.$defs[schema3.$ref];yield*Visit6(target2,[...references,...definitions],path8,value2)}function*FromInteger3(schema3,references,path8,value2){if(!IsInteger(value2))return yield Create(ValueErrorType.Integer,schema3,path8,value2);if(IsDefined2(schema3.exclusiveMaximum)&&!(value2<schema3.exclusiveMaximum))yield Create(ValueErrorType.IntegerExclusiveMaximum,schema3,path8,value2);if(IsDefined2(schema3.exclusiveMinimum)&&!(value2>schema3.exclusiveMinimum))yield Create(ValueErrorType.IntegerExclusiveMinimum,schema3,path8,value2);if(IsDefined2(schema3.maximum)&&!(value2<=schema3.maximum))yield Create(ValueErrorType.IntegerMaximum,schema3,path8,value2);if(IsDefined2(schema3.minimum)&&!(value2>=schema3.minimum))yield Create(ValueErrorType.IntegerMinimum,schema3,path8,value2);if(IsDefined2(schema3.multipleOf)&&value2%schema3.multipleOf!==0)yield Create(ValueErrorType.IntegerMultipleOf,schema3,path8,value2)}function*FromIntersect10(schema3,references,path8,value2){let hasError=!1;for(let inner of schema3.allOf)for(let error3 of Visit6(inner,references,path8,value2))hasError=!0,yield error3;if(hasError)return yield Create(ValueErrorType.Intersect,schema3,path8,value2);if(schema3.unevaluatedProperties===!1){let keyCheck=new RegExp(KeyOfPattern(schema3));for(let valueKey of Object.getOwnPropertyNames(value2))if(!keyCheck.test(valueKey))yield Create(ValueErrorType.IntersectUnevaluatedProperties,schema3,`${path8}/${valueKey}`,value2)}if(typeof schema3.unevaluatedProperties==="object"){let keyCheck=new RegExp(KeyOfPattern(schema3));for(let valueKey of Object.getOwnPropertyNames(value2))if(!keyCheck.test(valueKey)){let next=Visit6(schema3.unevaluatedProperties,references,`${path8}/${valueKey}`,value2[valueKey]).next();if(!next.done)yield next.value}}}function*FromIterator5(schema3,references,path8,value2){if(!IsIterator2(value2))yield Create(ValueErrorType.Iterator,schema3,path8,value2)}function*FromLiteral4(schema3,references,path8,value2){if(value2!==schema3.const)yield Create(ValueErrorType.Literal,schema3,path8,value2)}function*FromNever3(schema3,references,path8,value2){yield Create(ValueErrorType.Never,schema3,path8,value2)}function*FromNot3(schema3,references,path8,value2){if(Visit6(schema3.not,references,path8,value2).next().done===!0)yield Create(ValueErrorType.Not,schema3,path8,value2)}function*FromNull3(schema3,references,path8,value2){if(!IsNull2(value2))yield Create(ValueErrorType.Null,schema3,path8,value2)}function*FromNumber3(schema3,references,path8,value2){if(!TypeSystemPolicy.IsNumberLike(value2))return yield Create(ValueErrorType.Number,schema3,path8,value2);if(IsDefined2(schema3.exclusiveMaximum)&&!(value2<schema3.exclusiveMaximum))yield Create(ValueErrorType.NumberExclusiveMaximum,schema3,path8,value2);if(IsDefined2(schema3.exclusiveMinimum)&&!(value2>schema3.exclusiveMinimum))yield Create(ValueErrorType.NumberExclusiveMinimum,schema3,path8,value2);if(IsDefined2(schema3.maximum)&&!(value2<=schema3.maximum))yield Create(ValueErrorType.NumberMaximum,schema3,path8,value2);if(IsDefined2(schema3.minimum)&&!(value2>=schema3.minimum))yield Create(ValueErrorType.NumberMinimum,schema3,path8,value2);if(IsDefined2(schema3.multipleOf)&&value2%schema3.multipleOf!==0)yield Create(ValueErrorType.NumberMultipleOf,schema3,path8,value2)}function*FromObject9(schema3,references,path8,value2){if(!TypeSystemPolicy.IsObjectLike(value2))return yield Create(ValueErrorType.Object,schema3,path8,value2);if(IsDefined2(schema3.minProperties)&&!(Object.getOwnPropertyNames(value2).length>=schema3.minProperties))yield Create(ValueErrorType.ObjectMinProperties,schema3,path8,value2);if(IsDefined2(schema3.maxProperties)&&!(Object.getOwnPropertyNames(value2).length<=schema3.maxProperties))yield Create(ValueErrorType.ObjectMaxProperties,schema3,path8,value2);let requiredKeys=Array.isArray(schema3.required)?schema3.required:[],knownKeys=Object.getOwnPropertyNames(schema3.properties),unknownKeys=Object.getOwnPropertyNames(value2);for(let requiredKey of requiredKeys){if(unknownKeys.includes(requiredKey))continue;yield Create(ValueErrorType.ObjectRequiredProperty,schema3.properties[requiredKey],`${path8}/${EscapeKey(requiredKey)}`,void 0)}if(schema3.additionalProperties===!1){for(let valueKey of unknownKeys)if(!knownKeys.includes(valueKey))yield Create(ValueErrorType.ObjectAdditionalProperties,schema3,`${path8}/${EscapeKey(valueKey)}`,value2[valueKey])}if(typeof schema3.additionalProperties==="object")for(let valueKey of unknownKeys){if(knownKeys.includes(valueKey))continue;yield*Visit6(schema3.additionalProperties,references,`${path8}/${EscapeKey(valueKey)}`,value2[valueKey])}for(let knownKey of knownKeys){let property=schema3.properties[knownKey];if(schema3.required&&schema3.required.includes(knownKey)){if(yield*Visit6(property,references,`${path8}/${EscapeKey(knownKey)}`,value2[knownKey]),ExtendsUndefinedCheck(schema3)&&!(knownKey in value2))yield Create(ValueErrorType.ObjectRequiredProperty,property,`${path8}/${EscapeKey(knownKey)}`,void 0)}else if(TypeSystemPolicy.IsExactOptionalProperty(value2,knownKey))yield*Visit6(property,references,`${path8}/${EscapeKey(knownKey)}`,value2[knownKey])}}function*FromPromise5(schema3,references,path8,value2){if(!IsPromise(value2))yield Create(ValueErrorType.Promise,schema3,path8,value2)}function*FromRecord5(schema3,references,path8,value2){if(!TypeSystemPolicy.IsRecordLike(value2))return yield Create(ValueErrorType.Object,schema3,path8,value2);if(IsDefined2(schema3.minProperties)&&!(Object.getOwnPropertyNames(value2).length>=schema3.minProperties))yield Create(ValueErrorType.ObjectMinProperties,schema3,path8,value2);if(IsDefined2(schema3.maxProperties)&&!(Object.getOwnPropertyNames(value2).length<=schema3.maxProperties))yield Create(ValueErrorType.ObjectMaxProperties,schema3,path8,value2);let[patternKey,patternSchema]=Object.entries(schema3.patternProperties)[0],regex=new RegExp(patternKey);for(let[propertyKey,propertyValue]of Object.entries(value2))if(regex.test(propertyKey))yield*Visit6(patternSchema,references,`${path8}/${EscapeKey(propertyKey)}`,propertyValue);if(typeof schema3.additionalProperties==="object"){for(let[propertyKey,propertyValue]of Object.entries(value2))if(!regex.test(propertyKey))yield*Visit6(schema3.additionalProperties,references,`${path8}/${EscapeKey(propertyKey)}`,propertyValue)}if(schema3.additionalProperties===!1)for(let[propertyKey,propertyValue]of Object.entries(value2)){if(regex.test(propertyKey))continue;return yield Create(ValueErrorType.ObjectAdditionalProperties,schema3,`${path8}/${EscapeKey(propertyKey)}`,propertyValue)}}function*FromRef6(schema3,references,path8,value2){yield*Visit6(Deref(schema3,references),references,path8,value2)}function*FromRegExp3(schema3,references,path8,value2){if(!IsString2(value2))return yield Create(ValueErrorType.String,schema3,path8,value2);if(IsDefined2(schema3.minLength)&&!(value2.length>=schema3.minLength))yield Create(ValueErrorType.StringMinLength,schema3,path8,value2);if(IsDefined2(schema3.maxLength)&&!(value2.length<=schema3.maxLength))yield Create(ValueErrorType.StringMaxLength,schema3,path8,value2);if(!new RegExp(schema3.source,schema3.flags).test(value2))return yield Create(ValueErrorType.RegExp,schema3,path8,value2)}function*FromString3(schema3,references,path8,value2){if(!IsString2(value2))return yield Create(ValueErrorType.String,schema3,path8,value2);if(IsDefined2(schema3.minLength)&&!(value2.length>=schema3.minLength))yield Create(ValueErrorType.StringMinLength,schema3,path8,value2);if(IsDefined2(schema3.maxLength)&&!(value2.length<=schema3.maxLength))yield Create(ValueErrorType.StringMaxLength,schema3,path8,value2);if(IsString2(schema3.pattern)){if(!new RegExp(schema3.pattern).test(value2))yield Create(ValueErrorType.StringPattern,schema3,path8,value2)}if(IsString2(schema3.format)){if(!exports_format.Has(schema3.format))yield Create(ValueErrorType.StringFormatUnknown,schema3,path8,value2);else if(!exports_format.Get(schema3.format)(value2))yield Create(ValueErrorType.StringFormat,schema3,path8,value2)}}function*FromSymbol3(schema3,references,path8,value2){if(!IsSymbol2(value2))yield Create(ValueErrorType.Symbol,schema3,path8,value2)}function*FromTemplateLiteral5(schema3,references,path8,value2){if(!IsString2(value2))return yield Create(ValueErrorType.String,schema3,path8,value2);if(!new RegExp(schema3.pattern).test(value2))yield Create(ValueErrorType.StringPattern,schema3,path8,value2)}function*FromThis2(schema3,references,path8,value2){yield*Visit6(Deref(schema3,references),references,path8,value2)}function*FromTuple7(schema3,references,path8,value2){if(!IsArray2(value2))return yield Create(ValueErrorType.Tuple,schema3,path8,value2);if(schema3.items===void 0&&value2.length!==0)return yield Create(ValueErrorType.TupleLength,schema3,path8,value2);if(value2.length!==schema3.maxItems)return yield Create(ValueErrorType.TupleLength,schema3,path8,value2);if(!schema3.items)return;for(let i=0;i<schema3.items.length;i++)yield*Visit6(schema3.items[i],references,`${path8}/${i}`,value2[i])}function*FromUndefined3(schema3,references,path8,value2){if(!IsUndefined2(value2))yield Create(ValueErrorType.Undefined,schema3,path8,value2)}function*FromUnion12(schema3,references,path8,value2){if(Check(schema3,references,value2))return;let errors2=schema3.anyOf.map((variant)=>new ValueErrorIterator(Visit6(variant,references,path8,value2)));yield Create(ValueErrorType.Union,schema3,path8,value2,errors2)}function*FromUint8Array3(schema3,references,path8,value2){if(!IsUint8Array2(value2))return yield Create(ValueErrorType.Uint8Array,schema3,path8,value2);if(IsDefined2(schema3.maxByteLength)&&!(value2.length<=schema3.maxByteLength))yield Create(ValueErrorType.Uint8ArrayMaxByteLength,schema3,path8,value2);if(IsDefined2(schema3.minByteLength)&&!(value2.length>=schema3.minByteLength))yield Create(ValueErrorType.Uint8ArrayMinByteLength,schema3,path8,value2)}function*FromUnknown3(schema3,references,path8,value2){}function*FromVoid3(schema3,references,path8,value2){if(!TypeSystemPolicy.IsVoidLike(value2))yield Create(ValueErrorType.Void,schema3,path8,value2)}function*FromKind2(schema3,references,path8,value2){if(!exports_type2.Get(schema3[Kind])(schema3,value2))yield Create(ValueErrorType.Kind,schema3,path8,value2)}function*Visit6(schema3,references,path8,value2){let references_=IsDefined2(schema3.$id)?[...references,schema3]:references,schema_=schema3;switch(schema_[Kind]){case"Any":return yield*FromAny3(schema_,references_,path8,value2);case"Argument":return yield*FromArgument3(schema_,references_,path8,value2);case"Array":return yield*FromArray8(schema_,references_,path8,value2);case"AsyncIterator":return yield*FromAsyncIterator5(schema_,references_,path8,value2);case"BigInt":return yield*FromBigInt3(schema_,references_,path8,value2);case"Boolean":return yield*FromBoolean3(schema_,references_,path8,value2);case"Constructor":return yield*FromConstructor5(schema_,references_,path8,value2);case"Date":return yield*FromDate3(schema_,references_,path8,value2);case"Function":return yield*FromFunction5(schema_,references_,path8,value2);case"Import":return yield*FromImport2(schema_,references_,path8,value2);case"Integer":return yield*FromInteger3(schema_,references_,path8,value2);case"Intersect":return yield*FromIntersect10(schema_,references_,path8,value2);case"Iterator":return yield*FromIterator5(schema_,references_,path8,value2);case"Literal":return yield*FromLiteral4(schema_,references_,path8,value2);case"Never":return yield*FromNever3(schema_,references_,path8,value2);case"Not":return yield*FromNot3(schema_,references_,path8,value2);case"Null":return yield*FromNull3(schema_,references_,path8,value2);case"Number":return yield*FromNumber3(schema_,references_,path8,value2);case"Object":return yield*FromObject9(schema_,references_,path8,value2);case"Promise":return yield*FromPromise5(schema_,references_,path8,value2);case"Record":return yield*FromRecord5(schema_,references_,path8,value2);case"Ref":return yield*FromRef6(schema_,references_,path8,value2);case"RegExp":return yield*FromRegExp3(schema_,references_,path8,value2);case"String":return yield*FromString3(schema_,references_,path8,value2);case"Symbol":return yield*FromSymbol3(schema_,references_,path8,value2);case"TemplateLiteral":return yield*FromTemplateLiteral5(schema_,references_,path8,value2);case"This":return yield*FromThis2(schema_,references_,path8,value2);case"Tuple":return yield*FromTuple7(schema_,references_,path8,value2);case"Undefined":return yield*FromUndefined3(schema_,references_,path8,value2);case"Union":return yield*FromUnion12(schema_,references_,path8,value2);case"Uint8Array":return yield*FromUint8Array3(schema_,references_,path8,value2);case"Unknown":return yield*FromUnknown3(schema_,references_,path8,value2);case"Void":return yield*FromVoid3(schema_,references_,path8,value2);default:if(!exports_type2.Has(schema_[Kind]))throw new ValueErrorsUnknownTypeError(schema3);return yield*FromKind2(schema_,references_,path8,value2)}}function Errors(...args){let iterator3=args.length===3?Visit6(args[0],args[1],"",args[2]):Visit6(args[0],[],"",args[1]);return new ValueErrorIterator(iterator3)}init_guard();init_error();var __classPrivateFieldSet3=function(receiver,state,value2,kind,f){if(kind==="m")throw TypeError("Private method is not writable");if(kind==="a"&&!f)throw TypeError("Private accessor was defined without a setter");if(typeof state==="function"?receiver!==state||!f:!state.has(receiver))throw TypeError("Cannot write private member to an object whose class did not declare it");return kind==="a"?f.call(receiver,value2):f?f.value=value2:state.set(receiver,value2),value2},__classPrivateFieldGet3=function(receiver,state,kind,f){if(kind==="a"&&!f)throw TypeError("Private accessor was defined without a getter");if(typeof state==="function"?receiver!==state||!f:!state.has(receiver))throw TypeError("Cannot read private member from an object whose class did not declare it");return kind==="m"?f:kind==="a"?f.call(receiver):f?f.value:state.get(receiver)},_AssertError_instances,_AssertError_iterator,_AssertError_Iterator;class AssertError extends TypeBoxError{constructor(iterator3){let error3=iterator3.First();super(error3===void 0?"Invalid Value":error3.message);_AssertError_instances.add(this),_AssertError_iterator.set(this,void 0),__classPrivateFieldSet3(this,_AssertError_iterator,iterator3,"f"),this.error=error3}Errors(){return new ValueErrorIterator(__classPrivateFieldGet3(this,_AssertError_instances,"m",_AssertError_Iterator).call(this))}}_AssertError_iterator=new WeakMap,_AssertError_instances=new WeakSet,_AssertError_Iterator=function*(){if(this.error)yield this.error;yield*__classPrivateFieldGet3(this,_AssertError_iterator,"f")};function AssertValue(schema3,references,value2){if(Check(schema3,references,value2))return;throw new AssertError(Errors(schema3,references,value2))}function Assert(...args){return args.length===3?AssertValue(args[0],args[1],args[2]):AssertValue(args[0],[],args[1])}init_guard();init_error2();init_symbols2();init_guard();init_guard();function FromObject10(value2){let Acc={};for(let key2 of Object.getOwnPropertyNames(value2))Acc[key2]=Clone2(value2[key2]);for(let key2 of Object.getOwnPropertySymbols(value2))Acc[key2]=Clone2(value2[key2]);return Acc}function FromArray9(value2){return value2.map((element)=>Clone2(element))}function FromTypedArray(value2){return value2.slice()}function FromMap(value2){return new Map(Clone2([...value2.entries()]))}function FromSet(value2){return new Set(Clone2([...value2.entries()]))}function FromDate4(value2){return new Date(value2.toISOString())}function FromValue2(value2){return value2}function Clone2(value2){if(IsArray2(value2))return FromArray9(value2);if(IsDate2(value2))return FromDate4(value2);if(IsTypedArray(value2))return FromTypedArray(value2);if(IsMap(value2))return FromMap(value2);if(IsSet(value2))return FromSet(value2);if(IsObject2(value2))return FromObject10(value2);if(IsValueType(value2))return FromValue2(value2);throw Error("ValueClone: Unable to clone value")}init_template_literal2();init_registry4();init_symbols2();init_error2();class ValueCreateError extends TypeBoxError{constructor(schema3,message){super(message);this.schema=schema3}}function FromDefault(value2){return IsFunction2(value2)?value2():Clone2(value2)}function FromAny4(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else return{}}function FromArgument4(schema3,references){return{}}function FromArray10(schema3,references){if(schema3.uniqueItems===!0&&!HasPropertyKey2(schema3,"default"))throw new ValueCreateError(schema3,"Array with the uniqueItems constraint requires a default value");else if("contains"in schema3&&!HasPropertyKey2(schema3,"default"))throw new ValueCreateError(schema3,"Array with the contains constraint requires a default value");else if("default"in schema3)return FromDefault(schema3.default);else if(schema3.minItems!==void 0)return Array.from({length:schema3.minItems}).map((item)=>{return Visit7(schema3.items,references)});else return[]}function FromAsyncIterator6(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else return async function*(){}()}function FromBigInt4(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else return BigInt(0)}function FromBoolean4(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else return!1}function FromConstructor6(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else{let value2=Visit7(schema3.returns,references);if(typeof value2==="object"&&!Array.isArray(value2))return class{constructor(){for(let[key2,val]of Object.entries(value2)){let self2=this;self2[key2]=val}}};else return class{}}}function FromDate5(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else if(schema3.minimumTimestamp!==void 0)return new Date(schema3.minimumTimestamp);else return new Date}function FromFunction6(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else return()=>Visit7(schema3.returns,references)}function FromImport3(schema3,references){let definitions=globalThis.Object.values(schema3.$defs),target2=schema3.$defs[schema3.$ref];return Visit7(target2,[...references,...definitions])}function FromInteger4(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else if(schema3.minimum!==void 0)return schema3.minimum;else return 0}function FromIntersect11(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else{let value2=schema3.allOf.reduce((acc,schema4)=>{let next=Visit7(schema4,references);return typeof next==="object"?{...acc,...next}:next},{});if(!Check(schema3,references,value2))throw new ValueCreateError(schema3,"Intersect produced invalid value. Consider using a default value.");return value2}}function FromIterator6(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else return function*(){}()}function FromLiteral5(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else return schema3.const}function FromNever4(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else throw new ValueCreateError(schema3,"Never types cannot be created. Consider using a default value.")}function FromNot4(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else throw new ValueCreateError(schema3,"Not types must have a default value")}function FromNull4(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else return null}function FromNumber4(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else if(schema3.minimum!==void 0)return schema3.minimum;else return 0}function FromObject11(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else{let required3=new Set(schema3.required),Acc={};for(let[key2,subschema]of Object.entries(schema3.properties)){if(!required3.has(key2))continue;Acc[key2]=Visit7(subschema,references)}return Acc}}function FromPromise6(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else return Promise.resolve(Visit7(schema3.item,references))}function FromRecord6(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else return{}}function FromRef7(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else return Visit7(Deref(schema3,references),references)}function FromRegExp4(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else throw new ValueCreateError(schema3,"RegExp types cannot be created. Consider using a default value.")}function FromString4(schema3,references){if(schema3.pattern!==void 0)if(!HasPropertyKey2(schema3,"default"))throw new ValueCreateError(schema3,"String types with patterns must specify a default value");else return FromDefault(schema3.default);else if(schema3.format!==void 0)if(!HasPropertyKey2(schema3,"default"))throw new ValueCreateError(schema3,"String types with formats must specify a default value");else return FromDefault(schema3.default);else if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else if(schema3.minLength!==void 0)return Array.from({length:schema3.minLength}).map(()=>" ").join("");else return""}function FromSymbol4(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else if("value"in schema3)return Symbol.for(schema3.value);else return Symbol()}function FromTemplateLiteral6(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);if(!IsTemplateLiteralFinite(schema3))throw new ValueCreateError(schema3,"Can only create template literals that produce a finite variants. Consider using a default value.");return TemplateLiteralGenerate(schema3)[0]}function FromThis3(schema3,references){if(recursiveDepth++>recursiveMaxDepth)throw new ValueCreateError(schema3,"Cannot create recursive type as it appears possibly infinite. Consider using a default.");if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else return Visit7(Deref(schema3,references),references)}function FromTuple8(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);if(schema3.items===void 0)return[];else return Array.from({length:schema3.minItems}).map((_,index)=>Visit7(schema3.items[index],references))}function FromUndefined4(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else return}function FromUnion13(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else if(schema3.anyOf.length===0)throw Error("ValueCreate.Union: Cannot create Union with zero variants");else return Visit7(schema3.anyOf[0],references)}function FromUint8Array4(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else if(schema3.minByteLength!==void 0)return new Uint8Array(schema3.minByteLength);else return new Uint8Array(0)}function FromUnknown4(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else return{}}function FromVoid4(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else return}function FromKind3(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else throw Error("User defined types must specify a default value")}function Visit7(schema3,references){let references_=Pushref(schema3,references),schema_=schema3;switch(schema_[Kind]){case"Any":return FromAny4(schema_,references_);case"Argument":return FromArgument4(schema_,references_);case"Array":return FromArray10(schema_,references_);case"AsyncIterator":return FromAsyncIterator6(schema_,references_);case"BigInt":return FromBigInt4(schema_,references_);case"Boolean":return FromBoolean4(schema_,references_);case"Constructor":return FromConstructor6(schema_,references_);case"Date":return FromDate5(schema_,references_);case"Function":return FromFunction6(schema_,references_);case"Import":return FromImport3(schema_,references_);case"Integer":return FromInteger4(schema_,references_);case"Intersect":return FromIntersect11(schema_,references_);case"Iterator":return FromIterator6(schema_,references_);case"Literal":return FromLiteral5(schema_,references_);case"Never":return FromNever4(schema_,references_);case"Not":return FromNot4(schema_,references_);case"Null":return FromNull4(schema_,references_);case"Number":return FromNumber4(schema_,references_);case"Object":return FromObject11(schema_,references_);case"Promise":return FromPromise6(schema_,references_);case"Record":return FromRecord6(schema_,references_);case"Ref":return FromRef7(schema_,references_);case"RegExp":return FromRegExp4(schema_,references_);case"String":return FromString4(schema_,references_);case"Symbol":return FromSymbol4(schema_,references_);case"TemplateLiteral":return FromTemplateLiteral6(schema_,references_);case"This":return FromThis3(schema_,references_);case"Tuple":return FromTuple8(schema_,references_);case"Undefined":return FromUndefined4(schema_,references_);case"Union":return FromUnion13(schema_,references_);case"Uint8Array":return FromUint8Array4(schema_,references_);case"Unknown":return FromUnknown4(schema_,references_);case"Void":return FromVoid4(schema_,references_);default:if(!exports_type2.Has(schema_[Kind]))throw new ValueCreateError(schema_,"Unknown type");return FromKind3(schema_,references_)}}var recursiveMaxDepth=512,recursiveDepth=0;function Create2(...args){return recursiveDepth=0,args.length===2?Visit7(args[0],args[1]):Visit7(args[0],[])}class ValueCastError extends TypeBoxError{constructor(schema3,message){super(message);this.schema=schema3}}function ScoreUnion(schema3,references,value2){if(schema3[Kind]==="Object"&&typeof value2==="object"&&!IsNull2(value2)){let object3=schema3,keys=Object.getOwnPropertyNames(value2);return Object.entries(object3.properties).reduce((acc,[key2,schema4])=>{let literal3=schema4[Kind]==="Literal"&&schema4.const===value2[key2]?100:0,checks=Check(schema4,references,value2[key2])?10:0,exists=keys.includes(key2)?1:0;return acc+(literal3+checks+exists)},0)}else if(schema3[Kind]==="Union"){let scores=schema3.anyOf.map((schema4)=>Deref(schema4,references)).map((schema4)=>ScoreUnion(schema4,references,value2));return Math.max(...scores)}else return Check(schema3,references,value2)?1:0}function SelectUnion(union4,references,value2){let schemas=union4.anyOf.map((schema3)=>Deref(schema3,references)),[select,best]=[schemas[0],0];for(let schema3 of schemas){let score=ScoreUnion(schema3,references,value2);if(score>best)select=schema3,best=score}return select}function CastUnion(union4,references,value2){if("default"in union4)return typeof value2==="function"?union4.default:Clone2(union4.default);else{let schema3=SelectUnion(union4,references,value2);return Cast(schema3,references,value2)}}function DefaultClone(schema3,references,value2){return Check(schema3,references,value2)?Clone2(value2):Create2(schema3,references)}function Default(schema3,references,value2){return Check(schema3,references,value2)?value2:Create2(schema3,references)}function FromArray11(schema3,references,value2){if(Check(schema3,references,value2))return Clone2(value2);let created=IsArray2(value2)?Clone2(value2):Create2(schema3,references),minimum=IsNumber2(schema3.minItems)&&created.length<schema3.minItems?[...created,...Array.from({length:schema3.minItems-created.length},()=>null)]:created,casted=(IsNumber2(schema3.maxItems)&&minimum.length>schema3.maxItems?minimum.slice(0,schema3.maxItems):minimum).map((value3)=>Visit8(schema3.items,references,value3));if(schema3.uniqueItems!==!0)return casted;let unique=[...new Set(casted)];if(!Check(schema3,references,unique))throw new ValueCastError(schema3,"Array cast produced invalid data due to uniqueItems constraint");return unique}function FromConstructor7(schema3,references,value2){if(Check(schema3,references,value2))return Create2(schema3,references);let required3=new Set(schema3.returns.required||[]),result=function(){};for(let[key2,property]of Object.entries(schema3.returns.properties)){if(!required3.has(key2)&&value2.prototype[key2]===void 0)continue;result.prototype[key2]=Visit8(property,references,value2.prototype[key2])}return result}function FromImport4(schema3,references,value2){let definitions=globalThis.Object.values(schema3.$defs),target2=schema3.$defs[schema3.$ref];return Visit8(target2,[...references,...definitions],value2)}function IntersectAssign(correct,value2){if(IsObject2(correct)&&!IsObject2(value2)||!IsObject2(correct)&&IsObject2(value2))return correct;if(!IsObject2(correct)||!IsObject2(value2))return value2;return globalThis.Object.getOwnPropertyNames(correct).reduce((result,key2)=>{let property=key2 in value2?IntersectAssign(correct[key2],value2[key2]):correct[key2];return{...result,[key2]:property}},{})}function FromIntersect12(schema3,references,value2){if(Check(schema3,references,value2))return value2;let correct=Create2(schema3,references),assigned=IntersectAssign(correct,value2);return Check(schema3,references,assigned)?assigned:correct}function FromNever5(schema3,references,value2){throw new ValueCastError(schema3,"Never types cannot be cast")}function FromObject12(schema3,references,value2){if(Check(schema3,references,value2))return value2;if(value2===null||typeof value2!=="object")return Create2(schema3,references);let required3=new Set(schema3.required||[]),result={};for(let[key2,property]of Object.entries(schema3.properties)){if(!required3.has(key2)&&value2[key2]===void 0)continue;result[key2]=Visit8(property,references,value2[key2])}if(typeof schema3.additionalProperties==="object"){let propertyNames=Object.getOwnPropertyNames(schema3.properties);for(let propertyName of Object.getOwnPropertyNames(value2)){if(propertyNames.includes(propertyName))continue;result[propertyName]=Visit8(schema3.additionalProperties,references,value2[propertyName])}}return result}function FromRecord7(schema3,references,value2){if(Check(schema3,references,value2))return Clone2(value2);if(value2===null||typeof value2!=="object"||Array.isArray(value2)||value2 instanceof Date)return Create2(schema3,references);let subschemaPropertyName=Object.getOwnPropertyNames(schema3.patternProperties)[0],subschema=schema3.patternProperties[subschemaPropertyName],result={};for(let[propKey,propValue]of Object.entries(value2))result[propKey]=Visit8(subschema,references,propValue);return result}function FromRef8(schema3,references,value2){return Visit8(Deref(schema3,references),references,value2)}function FromThis4(schema3,references,value2){return Visit8(Deref(schema3,references),references,value2)}function FromTuple9(schema3,references,value2){if(Check(schema3,references,value2))return Clone2(value2);if(!IsArray2(value2))return Create2(schema3,references);if(schema3.items===void 0)return[];return schema3.items.map((schema4,index)=>Visit8(schema4,references,value2[index]))}function FromUnion14(schema3,references,value2){return Check(schema3,references,value2)?Clone2(value2):CastUnion(schema3,references,value2)}function Visit8(schema3,references,value2){let references_=IsString2(schema3.$id)?Pushref(schema3,references):references,schema_=schema3;switch(schema3[Kind]){case"Array":return FromArray11(schema_,references_,value2);case"Constructor":return FromConstructor7(schema_,references_,value2);case"Import":return FromImport4(schema_,references_,value2);case"Intersect":return FromIntersect12(schema_,references_,value2);case"Never":return FromNever5(schema_,references_,value2);case"Object":return FromObject12(schema_,references_,value2);case"Record":return FromRecord7(schema_,references_,value2);case"Ref":return FromRef8(schema_,references_,value2);case"This":return FromThis4(schema_,references_,value2);case"Tuple":return FromTuple9(schema_,references_,value2);case"Union":return FromUnion14(schema_,references_,value2);case"Date":case"Symbol":case"Uint8Array":return DefaultClone(schema3,references,value2);default:return Default(schema_,references_,value2)}}function Cast(...args){return args.length===3?Visit8(args[0],args[1],args[2]):Visit8(args[0],[],args[1])}init_keyof2();init_symbols2();init_guard();init_kind();function IsCheckable(schema3){return IsKind(schema3)&&schema3[Kind]!=="Unsafe"}function FromArray12(schema3,references,value2){if(!IsArray2(value2))return value2;return value2.map((value3)=>Visit9(schema3.items,references,value3))}function FromImport5(schema3,references,value2){let definitions=globalThis.Object.values(schema3.$defs),target2=schema3.$defs[schema3.$ref];return Visit9(target2,[...references,...definitions],value2)}function FromIntersect13(schema3,references,value2){let unevaluatedProperties=schema3.unevaluatedProperties,composite3=schema3.allOf.map((schema4)=>Visit9(schema4,references,Clone2(value2))).reduce((acc,value3)=>IsObject2(value3)?{...acc,...value3}:value3,{});if(!IsObject2(value2)||!IsObject2(composite3)||!IsKind(unevaluatedProperties))return composite3;let knownkeys=KeyOfPropertyKeys(schema3);for(let key2 of Object.getOwnPropertyNames(value2)){if(knownkeys.includes(key2))continue;if(Check(unevaluatedProperties,references,value2[key2]))composite3[key2]=Visit9(unevaluatedProperties,references,value2[key2])}return composite3}function FromObject13(schema3,references,value2){if(!IsObject2(value2)||IsArray2(value2))return value2;let additionalProperties=schema3.additionalProperties;for(let key2 of Object.getOwnPropertyNames(value2)){if(HasPropertyKey2(schema3.properties,key2)){value2[key2]=Visit9(schema3.properties[key2],references,value2[key2]);continue}if(IsKind(additionalProperties)&&Check(additionalProperties,references,value2[key2])){value2[key2]=Visit9(additionalProperties,references,value2[key2]);continue}delete value2[key2]}return value2}function FromRecord8(schema3,references,value2){if(!IsObject2(value2))return value2;let additionalProperties=schema3.additionalProperties,propertyKeys=Object.getOwnPropertyNames(value2),[propertyKey,propertySchema]=Object.entries(schema3.patternProperties)[0],propertyKeyTest=new RegExp(propertyKey);for(let key2 of propertyKeys){if(propertyKeyTest.test(key2)){value2[key2]=Visit9(propertySchema,references,value2[key2]);continue}if(IsKind(additionalProperties)&&Check(additionalProperties,references,value2[key2])){value2[key2]=Visit9(additionalProperties,references,value2[key2]);continue}delete value2[key2]}return value2}function FromRef9(schema3,references,value2){return Visit9(Deref(schema3,references),references,value2)}function FromThis5(schema3,references,value2){return Visit9(Deref(schema3,references),references,value2)}function FromTuple10(schema3,references,value2){if(!IsArray2(value2))return value2;if(IsUndefined2(schema3.items))return[];let length=Math.min(value2.length,schema3.items.length);for(let i=0;i<length;i++)value2[i]=Visit9(schema3.items[i],references,value2[i]);return value2.length>length?value2.slice(0,length):value2}function FromUnion15(schema3,references,value2){for(let inner of schema3.anyOf)if(IsCheckable(inner)&&Check(inner,references,value2))return Visit9(inner,references,value2);return value2}function Visit9(schema3,references,value2){let references_=IsString2(schema3.$id)?Pushref(schema3,references):references,schema_=schema3;switch(schema_[Kind]){case"Array":return FromArray12(schema_,references_,value2);case"Import":return FromImport5(schema_,references_,value2);case"Intersect":return FromIntersect13(schema_,references_,value2);case"Object":return FromObject13(schema_,references_,value2);case"Record":return FromRecord8(schema_,references_,value2);case"Ref":return FromRef9(schema_,references_,value2);case"This":return FromThis5(schema_,references_,value2);case"Tuple":return FromTuple10(schema_,references_,value2);case"Union":return FromUnion15(schema_,references_,value2);default:return value2}}function Clean(...args){return args.length===3?Visit9(args[0],args[1],args[2]):Visit9(args[0],[],args[1])}init_symbols2();init_guard();function IsStringNumeric(value2){return IsString2(value2)&&!isNaN(value2)&&!isNaN(parseFloat(value2))}function IsValueToString(value2){return IsBigInt2(value2)||IsBoolean2(value2)||IsNumber2(value2)}function IsValueTrue(value2){return value2===!0||IsNumber2(value2)&&value2===1||IsBigInt2(value2)&&value2===BigInt("1")||IsString2(value2)&&(value2.toLowerCase()==="true"||value2==="1")}function IsValueFalse(value2){return value2===!1||IsNumber2(value2)&&(value2===0||Object.is(value2,-0))||IsBigInt2(value2)&&value2===BigInt("0")||IsString2(value2)&&(value2.toLowerCase()==="false"||value2==="0"||value2==="-0")}function IsTimeStringWithTimeZone(value2){return IsString2(value2)&&/^(?:[0-2]\d:[0-5]\d:[0-5]\d|23:59:60)(?:\.\d+)?(?:z|[+-]\d\d(?::?\d\d)?)$/i.test(value2)}function IsTimeStringWithoutTimeZone(value2){return IsString2(value2)&&/^(?:[0-2]\d:[0-5]\d:[0-5]\d|23:59:60)?$/i.test(value2)}function IsDateTimeStringWithTimeZone(value2){return IsString2(value2)&&/^\d\d\d\d-[0-1]\d-[0-3]\dt(?:[0-2]\d:[0-5]\d:[0-5]\d|23:59:60)(?:\.\d+)?(?:z|[+-]\d\d(?::?\d\d)?)$/i.test(value2)}function IsDateTimeStringWithoutTimeZone(value2){return IsString2(value2)&&/^\d\d\d\d-[0-1]\d-[0-3]\dt(?:[0-2]\d:[0-5]\d:[0-5]\d|23:59:60)?$/i.test(value2)}function IsDateString(value2){return IsString2(value2)&&/^\d\d\d\d-[0-1]\d-[0-3]\d$/i.test(value2)}function TryConvertLiteralString(value2,target2){let conversion=TryConvertString(value2);return conversion===target2?conversion:value2}function TryConvertLiteralNumber(value2,target2){let conversion=TryConvertNumber(value2);return conversion===target2?conversion:value2}function TryConvertLiteralBoolean(value2,target2){let conversion=TryConvertBoolean(value2);return conversion===target2?conversion:value2}function TryConvertLiteral(schema3,value2){return IsString2(schema3.const)?TryConvertLiteralString(value2,schema3.const):IsNumber2(schema3.const)?TryConvertLiteralNumber(value2,schema3.const):IsBoolean2(schema3.const)?TryConvertLiteralBoolean(value2,schema3.const):value2}function TryConvertBoolean(value2){return IsValueTrue(value2)?!0:IsValueFalse(value2)?!1:value2}function TryConvertBigInt(value2){let truncateInteger=(value3)=>value3.split(".")[0];return IsStringNumeric(value2)?BigInt(truncateInteger(value2)):IsNumber2(value2)?BigInt(Math.trunc(value2)):IsValueFalse(value2)?BigInt(0):IsValueTrue(value2)?BigInt(1):value2}function TryConvertString(value2){return IsSymbol2(value2)&&value2.description!==void 0?value2.description.toString():IsValueToString(value2)?value2.toString():value2}function TryConvertNumber(value2){return IsStringNumeric(value2)?parseFloat(value2):IsValueTrue(value2)?1:IsValueFalse(value2)?0:value2}function TryConvertInteger(value2){return IsStringNumeric(value2)?parseInt(value2):IsNumber2(value2)?Math.trunc(value2):IsValueTrue(value2)?1:IsValueFalse(value2)?0:value2}function TryConvertNull(value2){return IsString2(value2)&&value2.toLowerCase()==="null"?null:value2}function TryConvertUndefined(value2){return IsString2(value2)&&value2==="undefined"?void 0:value2}function TryConvertDate(value2){return IsDate2(value2)?value2:IsNumber2(value2)?new Date(value2):IsValueTrue(value2)?new Date(1):IsValueFalse(value2)?new Date(0):IsStringNumeric(value2)?new Date(parseInt(value2)):IsTimeStringWithoutTimeZone(value2)?new Date(`1970-01-01T${value2}.000Z`):IsTimeStringWithTimeZone(value2)?new Date(`1970-01-01T${value2}`):IsDateTimeStringWithoutTimeZone(value2)?new Date(`${value2}.000Z`):IsDateTimeStringWithTimeZone(value2)?new Date(value2):IsDateString(value2)?new Date(`${value2}T00:00:00.000Z`):value2}function Default2(value2){return value2}function FromArray13(schema3,references,value2){return(IsArray2(value2)?value2:[value2]).map((element)=>Visit10(schema3.items,references,element))}function FromBigInt5(schema3,references,value2){return TryConvertBigInt(value2)}function FromBoolean5(schema3,references,value2){return TryConvertBoolean(value2)}function FromDate6(schema3,references,value2){return TryConvertDate(value2)}function FromImport6(schema3,references,value2){let definitions=globalThis.Object.values(schema3.$defs),target2=schema3.$defs[schema3.$ref];return Visit10(target2,[...references,...definitions],value2)}function FromInteger5(schema3,references,value2){return TryConvertInteger(value2)}function FromIntersect14(schema3,references,value2){return schema3.allOf.reduce((value3,schema4)=>Visit10(schema4,references,value3),value2)}function FromLiteral6(schema3,references,value2){return TryConvertLiteral(schema3,value2)}function FromNull5(schema3,references,value2){return TryConvertNull(value2)}function FromNumber5(schema3,references,value2){return TryConvertNumber(value2)}function FromObject14(schema3,references,value2){if(!IsObject2(value2)||IsArray2(value2))return value2;for(let propertyKey of Object.getOwnPropertyNames(schema3.properties)){if(!HasPropertyKey2(value2,propertyKey))continue;value2[propertyKey]=Visit10(schema3.properties[propertyKey],references,value2[propertyKey])}return value2}function FromRecord9(schema3,references,value2){if(!(IsObject2(value2)&&!IsArray2(value2)))return value2;let propertyKey=Object.getOwnPropertyNames(schema3.patternProperties)[0],property=schema3.patternProperties[propertyKey];for(let[propKey,propValue]of Object.entries(value2))value2[propKey]=Visit10(property,references,propValue);return value2}function FromRef10(schema3,references,value2){return Visit10(Deref(schema3,references),references,value2)}function FromString5(schema3,references,value2){return TryConvertString(value2)}function FromSymbol5(schema3,references,value2){return IsString2(value2)||IsNumber2(value2)?Symbol(value2):value2}function FromThis6(schema3,references,value2){return Visit10(Deref(schema3,references),references,value2)}function FromTuple11(schema3,references,value2){if(!(IsArray2(value2)&&!IsUndefined2(schema3.items)))return value2;return value2.map((value3,index)=>{return index<schema3.items.length?Visit10(schema3.items[index],references,value3):value3})}function FromUndefined5(schema3,references,value2){return TryConvertUndefined(value2)}function FromUnion16(schema3,references,value2){for(let subschema of schema3.anyOf)if(Check(subschema,references,value2))return value2;for(let subschema of schema3.anyOf){let converted=Visit10(subschema,references,Clone2(value2));if(!Check(subschema,references,converted))continue;return converted}return value2}function Visit10(schema3,references,value2){let references_=Pushref(schema3,references),schema_=schema3;switch(schema3[Kind]){case"Array":return FromArray13(schema_,references_,value2);case"BigInt":return FromBigInt5(schema_,references_,value2);case"Boolean":return FromBoolean5(schema_,references_,value2);case"Date":return FromDate6(schema_,references_,value2);case"Import":return FromImport6(schema_,references_,value2);case"Integer":return FromInteger5(schema_,references_,value2);case"Intersect":return FromIntersect14(schema_,references_,value2);case"Literal":return FromLiteral6(schema_,references_,value2);case"Null":return FromNull5(schema_,references_,value2);case"Number":return FromNumber5(schema_,references_,value2);case"Object":return FromObject14(schema_,references_,value2);case"Record":return FromRecord9(schema_,references_,value2);case"Ref":return FromRef10(schema_,references_,value2);case"String":return FromString5(schema_,references_,value2);case"Symbol":return FromSymbol5(schema_,references_,value2);case"This":return FromThis6(schema_,references_,value2);case"Tuple":return FromTuple11(schema_,references_,value2);case"Undefined":return FromUndefined5(schema_,references_,value2);case"Union":return FromUnion16(schema_,references_,value2);default:return Default2(value2)}}function Convert2(...args){return args.length===3?Visit10(args[0],args[1],args[2]):Visit10(args[0],[],args[1])}init_policy();init_symbols2();init_error2();init_keyof2();init_guard();init_kind();class TransformDecodeCheckError extends TypeBoxError{constructor(schema3,value2,error3){super("Unable to decode value as it does not match the expected schema");this.schema=schema3,this.value=value2,this.error=error3}}class TransformDecodeError extends TypeBoxError{constructor(schema3,path8,value2,error3){super(error3 instanceof Error?error3.message:"Unknown error");this.schema=schema3,this.path=path8,this.value=value2,this.error=error3}}function Default3(schema3,path8,value2){try{return IsTransform(schema3)?schema3[TransformKind].Decode(value2):value2}catch(error3){throw new TransformDecodeError(schema3,path8,value2,error3)}}function FromArray14(schema3,references,path8,value2){return IsArray2(value2)?Default3(schema3,path8,value2.map((value3,index)=>Visit11(schema3.items,references,`${path8}/${index}`,value3))):Default3(schema3,path8,value2)}function FromIntersect15(schema3,references,path8,value2){if(!IsObject2(value2)||IsValueType(value2))return Default3(schema3,path8,value2);let knownEntries=KeyOfPropertyEntries(schema3),knownKeys=knownEntries.map((entry)=>entry[0]),knownProperties={...value2};for(let[knownKey,knownSchema]of knownEntries)if(knownKey in knownProperties)knownProperties[knownKey]=Visit11(knownSchema,references,`${path8}/${knownKey}`,knownProperties[knownKey]);if(!IsTransform(schema3.unevaluatedProperties))return Default3(schema3,path8,knownProperties);let unknownKeys=Object.getOwnPropertyNames(knownProperties),unevaluatedProperties=schema3.unevaluatedProperties,unknownProperties={...knownProperties};for(let key2 of unknownKeys)if(!knownKeys.includes(key2))unknownProperties[key2]=Default3(unevaluatedProperties,`${path8}/${key2}`,unknownProperties[key2]);return Default3(schema3,path8,unknownProperties)}function FromImport7(schema3,references,path8,value2){let additional=globalThis.Object.values(schema3.$defs),target2=schema3.$defs[schema3.$ref],result=Visit11(target2,[...references,...additional],path8,value2);return Default3(schema3,path8,result)}function FromNot5(schema3,references,path8,value2){return Default3(schema3,path8,Visit11(schema3.not,references,path8,value2))}function FromObject15(schema3,references,path8,value2){if(!IsObject2(value2))return Default3(schema3,path8,value2);let knownKeys=KeyOfPropertyKeys(schema3),knownProperties={...value2};for(let key2 of knownKeys){if(!HasPropertyKey2(knownProperties,key2))continue;if(IsUndefined2(knownProperties[key2])&&(!IsUndefined3(schema3.properties[key2])||TypeSystemPolicy.IsExactOptionalProperty(knownProperties,key2)))continue;knownProperties[key2]=Visit11(schema3.properties[key2],references,`${path8}/${key2}`,knownProperties[key2])}if(!IsSchema(schema3.additionalProperties))return Default3(schema3,path8,knownProperties);let unknownKeys=Object.getOwnPropertyNames(knownProperties),additionalProperties=schema3.additionalProperties,unknownProperties={...knownProperties};for(let key2 of unknownKeys)if(!knownKeys.includes(key2))unknownProperties[key2]=Default3(additionalProperties,`${path8}/${key2}`,unknownProperties[key2]);return Default3(schema3,path8,unknownProperties)}function FromRecord10(schema3,references,path8,value2){if(!IsObject2(value2))return Default3(schema3,path8,value2);let pattern2=Object.getOwnPropertyNames(schema3.patternProperties)[0],knownKeys=new RegExp(pattern2),knownProperties={...value2};for(let key2 of Object.getOwnPropertyNames(value2))if(knownKeys.test(key2))knownProperties[key2]=Visit11(schema3.patternProperties[pattern2],references,`${path8}/${key2}`,knownProperties[key2]);if(!IsSchema(schema3.additionalProperties))return Default3(schema3,path8,knownProperties);let unknownKeys=Object.getOwnPropertyNames(knownProperties),additionalProperties=schema3.additionalProperties,unknownProperties={...knownProperties};for(let key2 of unknownKeys)if(!knownKeys.test(key2))unknownProperties[key2]=Default3(additionalProperties,`${path8}/${key2}`,unknownProperties[key2]);return Default3(schema3,path8,unknownProperties)}function FromRef11(schema3,references,path8,value2){let target2=Deref(schema3,references);return Default3(schema3,path8,Visit11(target2,references,path8,value2))}function FromThis7(schema3,references,path8,value2){let target2=Deref(schema3,references);return Default3(schema3,path8,Visit11(target2,references,path8,value2))}function FromTuple12(schema3,references,path8,value2){return IsArray2(value2)&&IsArray2(schema3.items)?Default3(schema3,path8,schema3.items.map((schema4,index)=>Visit11(schema4,references,`${path8}/${index}`,value2[index]))):Default3(schema3,path8,value2)}function FromUnion17(schema3,references,path8,value2){for(let subschema of schema3.anyOf){if(!Check(subschema,references,value2))continue;let decoded=Visit11(subschema,references,path8,value2);return Default3(schema3,path8,decoded)}return Default3(schema3,path8,value2)}function Visit11(schema3,references,path8,value2){let references_=Pushref(schema3,references),schema_=schema3;switch(schema3[Kind]){case"Array":return FromArray14(schema_,references_,path8,value2);case"Import":return FromImport7(schema_,references_,path8,value2);case"Intersect":return FromIntersect15(schema_,references_,path8,value2);case"Not":return FromNot5(schema_,references_,path8,value2);case"Object":return FromObject15(schema_,references_,path8,value2);case"Record":return FromRecord10(schema_,references_,path8,value2);case"Ref":return FromRef11(schema_,references_,path8,value2);case"Symbol":return Default3(schema_,path8,value2);case"This":return FromThis7(schema_,references_,path8,value2);case"Tuple":return FromTuple12(schema_,references_,path8,value2);case"Union":return FromUnion17(schema_,references_,path8,value2);default:return Default3(schema_,path8,value2)}}function TransformDecode(schema3,references,value2){return Visit11(schema3,references,"",value2)}init_policy();init_symbols2();init_error2();init_keyof2();init_guard();init_kind();class TransformEncodeCheckError extends TypeBoxError{constructor(schema3,value2,error3){super("The encoded value does not match the expected schema");this.schema=schema3,this.value=value2,this.error=error3}}class TransformEncodeError extends TypeBoxError{constructor(schema3,path8,value2,error3){super(`${error3 instanceof Error?error3.message:"Unknown error"}`);this.schema=schema3,this.path=path8,this.value=value2,this.error=error3}}function Default4(schema3,path8,value2){try{return IsTransform(schema3)?schema3[TransformKind].Encode(value2):value2}catch(error3){throw new TransformEncodeError(schema3,path8,value2,error3)}}function FromArray15(schema3,references,path8,value2){let defaulted=Default4(schema3,path8,value2);return IsArray2(defaulted)?defaulted.map((value3,index)=>Visit12(schema3.items,references,`${path8}/${index}`,value3)):defaulted}function FromImport8(schema3,references,path8,value2){let additional=globalThis.Object.values(schema3.$defs),target2=schema3.$defs[schema3.$ref],result=Default4(schema3,path8,value2);return Visit12(target2,[...references,...additional],path8,result)}function FromIntersect16(schema3,references,path8,value2){let defaulted=Default4(schema3,path8,value2);if(!IsObject2(value2)||IsValueType(value2))return defaulted;let knownEntries=KeyOfPropertyEntries(schema3),knownKeys=knownEntries.map((entry)=>entry[0]),knownProperties={...defaulted};for(let[knownKey,knownSchema]of knownEntries)if(knownKey in knownProperties)knownProperties[knownKey]=Visit12(knownSchema,references,`${path8}/${knownKey}`,knownProperties[knownKey]);if(!IsTransform(schema3.unevaluatedProperties))return knownProperties;let unknownKeys=Object.getOwnPropertyNames(knownProperties),unevaluatedProperties=schema3.unevaluatedProperties,properties={...knownProperties};for(let key2 of unknownKeys)if(!knownKeys.includes(key2))properties[key2]=Default4(unevaluatedProperties,`${path8}/${key2}`,properties[key2]);return properties}function FromNot6(schema3,references,path8,value2){return Default4(schema3.not,path8,Default4(schema3,path8,value2))}function FromObject16(schema3,references,path8,value2){let defaulted=Default4(schema3,path8,value2);if(!IsObject2(defaulted))return defaulted;let knownKeys=KeyOfPropertyKeys(schema3),knownProperties={...defaulted};for(let key2 of knownKeys){if(!HasPropertyKey2(knownProperties,key2))continue;if(IsUndefined2(knownProperties[key2])&&(!IsUndefined3(schema3.properties[key2])||TypeSystemPolicy.IsExactOptionalProperty(knownProperties,key2)))continue;knownProperties[key2]=Visit12(schema3.properties[key2],references,`${path8}/${key2}`,knownProperties[key2])}if(!IsSchema(schema3.additionalProperties))return knownProperties;let unknownKeys=Object.getOwnPropertyNames(knownProperties),additionalProperties=schema3.additionalProperties,properties={...knownProperties};for(let key2 of unknownKeys)if(!knownKeys.includes(key2))properties[key2]=Default4(additionalProperties,`${path8}/${key2}`,properties[key2]);return properties}function FromRecord11(schema3,references,path8,value2){let defaulted=Default4(schema3,path8,value2);if(!IsObject2(value2))return defaulted;let pattern2=Object.getOwnPropertyNames(schema3.patternProperties)[0],knownKeys=new RegExp(pattern2),knownProperties={...defaulted};for(let key2 of Object.getOwnPropertyNames(value2))if(knownKeys.test(key2))knownProperties[key2]=Visit12(schema3.patternProperties[pattern2],references,`${path8}/${key2}`,knownProperties[key2]);if(!IsSchema(schema3.additionalProperties))return knownProperties;let unknownKeys=Object.getOwnPropertyNames(knownProperties),additionalProperties=schema3.additionalProperties,properties={...knownProperties};for(let key2 of unknownKeys)if(!knownKeys.test(key2))properties[key2]=Default4(additionalProperties,`${path8}/${key2}`,properties[key2]);return properties}function FromRef12(schema3,references,path8,value2){let target2=Deref(schema3,references),resolved=Visit12(target2,references,path8,value2);return Default4(schema3,path8,resolved)}function FromThis8(schema3,references,path8,value2){let target2=Deref(schema3,references),resolved=Visit12(target2,references,path8,value2);return Default4(schema3,path8,resolved)}function FromTuple13(schema3,references,path8,value2){let value1=Default4(schema3,path8,value2);return IsArray2(schema3.items)?schema3.items.map((schema4,index)=>Visit12(schema4,references,`${path8}/${index}`,value1[index])):[]}function FromUnion18(schema3,references,path8,value2){for(let subschema of schema3.anyOf){if(!Check(subschema,references,value2))continue;let value1=Visit12(subschema,references,path8,value2);return Default4(schema3,path8,value1)}for(let subschema of schema3.anyOf){let value1=Visit12(subschema,references,path8,value2);if(!Check(schema3,references,value1))continue;return Default4(schema3,path8,value1)}return Default4(schema3,path8,value2)}function Visit12(schema3,references,path8,value2){let references_=Pushref(schema3,references),schema_=schema3;switch(schema3[Kind]){case"Array":return FromArray15(schema_,references_,path8,value2);case"Import":return FromImport8(schema_,references_,path8,value2);case"Intersect":return FromIntersect16(schema_,references_,path8,value2);case"Not":return FromNot6(schema_,references_,path8,value2);case"Object":return FromObject16(schema_,references_,path8,value2);case"Record":return FromRecord11(schema_,references_,path8,value2);case"Ref":return FromRef12(schema_,references_,path8,value2);case"This":return FromThis8(schema_,references_,path8,value2);case"Tuple":return FromTuple13(schema_,references_,path8,value2);case"Union":return FromUnion18(schema_,references_,path8,value2);default:return Default4(schema_,path8,value2)}}function TransformEncode(schema3,references,value2){return Visit12(schema3,references,"",value2)}init_symbols2();init_kind();init_guard();function FromArray16(schema3,references){return IsTransform(schema3)||Visit13(schema3.items,references)}function FromAsyncIterator7(schema3,references){return IsTransform(schema3)||Visit13(schema3.items,references)}function FromConstructor8(schema3,references){return IsTransform(schema3)||Visit13(schema3.returns,references)||schema3.parameters.some((schema4)=>Visit13(schema4,references))}function FromFunction7(schema3,references){return IsTransform(schema3)||Visit13(schema3.returns,references)||schema3.parameters.some((schema4)=>Visit13(schema4,references))}function FromIntersect17(schema3,references){return IsTransform(schema3)||IsTransform(schema3.unevaluatedProperties)||schema3.allOf.some((schema4)=>Visit13(schema4,references))}function FromImport9(schema3,references){let additional=globalThis.Object.getOwnPropertyNames(schema3.$defs).reduce((result,key2)=>[...result,schema3.$defs[key2]],[]),target2=schema3.$defs[schema3.$ref];return IsTransform(schema3)||Visit13(target2,[...additional,...references])}function FromIterator7(schema3,references){return IsTransform(schema3)||Visit13(schema3.items,references)}function FromNot7(schema3,references){return IsTransform(schema3)||Visit13(schema3.not,references)}function FromObject17(schema3,references){return IsTransform(schema3)||Object.values(schema3.properties).some((schema4)=>Visit13(schema4,references))||IsSchema(schema3.additionalProperties)&&Visit13(schema3.additionalProperties,references)}function FromPromise7(schema3,references){return IsTransform(schema3)||Visit13(schema3.item,references)}function FromRecord12(schema3,references){let pattern2=Object.getOwnPropertyNames(schema3.patternProperties)[0],property=schema3.patternProperties[pattern2];return IsTransform(schema3)||Visit13(property,references)||IsSchema(schema3.additionalProperties)&&IsTransform(schema3.additionalProperties)}function FromRef13(schema3,references){if(IsTransform(schema3))return!0;return Visit13(Deref(schema3,references),references)}function FromThis9(schema3,references){if(IsTransform(schema3))return!0;return Visit13(Deref(schema3,references),references)}function FromTuple14(schema3,references){return IsTransform(schema3)||!IsUndefined2(schema3.items)&&schema3.items.some((schema4)=>Visit13(schema4,references))}function FromUnion19(schema3,references){return IsTransform(schema3)||schema3.anyOf.some((schema4)=>Visit13(schema4,references))}function Visit13(schema3,references){let references_=Pushref(schema3,references),schema_=schema3;if(schema3.$id&&visited.has(schema3.$id))return!1;if(schema3.$id)visited.add(schema3.$id);switch(schema3[Kind]){case"Array":return FromArray16(schema_,references_);case"AsyncIterator":return FromAsyncIterator7(schema_,references_);case"Constructor":return FromConstructor8(schema_,references_);case"Function":return FromFunction7(schema_,references_);case"Import":return FromImport9(schema_,references_);case"Intersect":return FromIntersect17(schema_,references_);case"Iterator":return FromIterator7(schema_,references_);case"Not":return FromNot7(schema_,references_);case"Object":return FromObject17(schema_,references_);case"Promise":return FromPromise7(schema_,references_);case"Record":return FromRecord12(schema_,references_);case"Ref":return FromRef13(schema_,references_);case"This":return FromThis9(schema_,references_);case"Tuple":return FromTuple14(schema_,references_);case"Union":return FromUnion19(schema_,references_);default:return IsTransform(schema3)}}var visited=new Set;function HasTransform(schema3,references){return visited.clear(),Visit13(schema3,references)}function Decode2(...args){let[schema3,references,value2]=args.length===3?[args[0],args[1],args[2]]:[args[0],[],args[1]];if(!Check(schema3,references,value2))throw new TransformDecodeCheckError(schema3,value2,Errors(schema3,references,value2).First());return HasTransform(schema3,references)?TransformDecode(schema3,references,value2):value2}init_symbols2();init_guard();init_kind();function ValueOrDefault(schema3,value2){let defaultValue=HasPropertyKey2(schema3,"default")?schema3.default:void 0,clone2=IsFunction2(defaultValue)?defaultValue():Clone2(defaultValue);return IsUndefined2(value2)?clone2:IsObject2(value2)&&IsObject2(clone2)?Object.assign(clone2,value2):value2}function HasDefaultProperty(schema3){return IsKind(schema3)&&"default"in schema3}function FromArray17(schema3,references,value2){if(IsArray2(value2)){for(let i=0;i<value2.length;i++)value2[i]=Visit14(schema3.items,references,value2[i]);return value2}let defaulted=ValueOrDefault(schema3,value2);if(!IsArray2(defaulted))return defaulted;for(let i=0;i<defaulted.length;i++)defaulted[i]=Visit14(schema3.items,references,defaulted[i]);return defaulted}function FromDate7(schema3,references,value2){return IsDate2(value2)?value2:ValueOrDefault(schema3,value2)}function FromImport10(schema3,references,value2){let definitions=globalThis.Object.values(schema3.$defs),target2=schema3.$defs[schema3.$ref];return Visit14(target2,[...references,...definitions],value2)}function FromIntersect18(schema3,references,value2){let defaulted=ValueOrDefault(schema3,value2);return schema3.allOf.reduce((acc,schema4)=>{let next=Visit14(schema4,references,defaulted);return IsObject2(next)?{...acc,...next}:next},{})}function FromObject18(schema3,references,value2){let defaulted=ValueOrDefault(schema3,value2);if(!IsObject2(defaulted))return defaulted;let knownPropertyKeys=Object.getOwnPropertyNames(schema3.properties);for(let key2 of knownPropertyKeys){let propertyValue=Visit14(schema3.properties[key2],references,defaulted[key2]);if(IsUndefined2(propertyValue))continue;defaulted[key2]=Visit14(schema3.properties[key2],references,defaulted[key2])}if(!HasDefaultProperty(schema3.additionalProperties))return defaulted;for(let key2 of Object.getOwnPropertyNames(defaulted)){if(knownPropertyKeys.includes(key2))continue;defaulted[key2]=Visit14(schema3.additionalProperties,references,defaulted[key2])}return defaulted}function FromRecord13(schema3,references,value2){let defaulted=ValueOrDefault(schema3,value2);if(!IsObject2(defaulted))return defaulted;let additionalPropertiesSchema=schema3.additionalProperties,[propertyKeyPattern,propertySchema]=Object.entries(schema3.patternProperties)[0],knownPropertyKey=new RegExp(propertyKeyPattern);for(let key2 of Object.getOwnPropertyNames(defaulted)){if(!(knownPropertyKey.test(key2)&&HasDefaultProperty(propertySchema)))continue;defaulted[key2]=Visit14(propertySchema,references,defaulted[key2])}if(!HasDefaultProperty(additionalPropertiesSchema))return defaulted;for(let key2 of Object.getOwnPropertyNames(defaulted)){if(knownPropertyKey.test(key2))continue;defaulted[key2]=Visit14(additionalPropertiesSchema,references,defaulted[key2])}return defaulted}function FromRef14(schema3,references,value2){return Visit14(Deref(schema3,references),references,ValueOrDefault(schema3,value2))}function FromThis10(schema3,references,value2){return Visit14(Deref(schema3,references),references,value2)}function FromTuple15(schema3,references,value2){let defaulted=ValueOrDefault(schema3,value2);if(!IsArray2(defaulted)||IsUndefined2(schema3.items))return defaulted;let[items,max]=[schema3.items,Math.max(schema3.items.length,defaulted.length)];for(let i=0;i<max;i++)if(i<items.length)defaulted[i]=Visit14(items[i],references,defaulted[i]);return defaulted}function FromUnion20(schema3,references,value2){let defaulted=ValueOrDefault(schema3,value2);for(let inner of schema3.anyOf){let result=Visit14(inner,references,Clone2(defaulted));if(Check(inner,references,result))return result}return defaulted}function Visit14(schema3,references,value2){let references_=Pushref(schema3,references),schema_=schema3;switch(schema_[Kind]){case"Array":return FromArray17(schema_,references_,value2);case"Date":return FromDate7(schema_,references_,value2);case"Import":return FromImport10(schema_,references_,value2);case"Intersect":return FromIntersect18(schema_,references_,value2);case"Object":return FromObject18(schema_,references_,value2);case"Record":return FromRecord13(schema_,references_,value2);case"Ref":return FromRef14(schema_,references_,value2);case"This":return FromThis10(schema_,references_,value2);case"Tuple":return FromTuple15(schema_,references_,value2);case"Union":return FromUnion20(schema_,references_,value2);default:return ValueOrDefault(schema_,value2)}}function Default5(...args){return args.length===3?Visit14(args[0],args[1],args[2]):Visit14(args[0],[],args[1])}init_guard();init_error2();var exports_pointer={};__export(exports_pointer,{ValuePointerRootSetError:()=>ValuePointerRootSetError,ValuePointerRootDeleteError:()=>ValuePointerRootDeleteError,Set:()=>Set5,Has:()=>Has3,Get:()=>Get3,Format:()=>Format,Delete:()=>Delete5});class ValuePointerRootSetError extends TypeBoxError{constructor(value2,path8,update){super("Cannot set root value");this.value=value2,this.path=path8,this.update=update}}class ValuePointerRootDeleteError extends TypeBoxError{constructor(value2,path8){super("Cannot delete root value");this.value=value2,this.path=path8}}function Escape2(component){return component.indexOf("~")===-1?component:component.replace(/~1/g,"/").replace(/~0/g,"~")}function*Format(pointer){if(pointer==="")return;let[start,end]=[0,0];for(let i=0;i<pointer.length;i++)if(pointer.charAt(i)==="/")if(i===0)start=i+1;else end=i,yield Escape2(pointer.slice(start,end)),start=i+1;else end=i;yield Escape2(pointer.slice(start))}function Set5(value2,pointer,update){if(pointer==="")throw new ValuePointerRootSetError(value2,pointer,update);let[owner,next,key2]=[null,value2,""];for(let component of Format(pointer)){if(next[component]===void 0)next[component]={};owner=next,next=next[component],key2=component}owner[key2]=update}function Delete5(value2,pointer){if(pointer==="")throw new ValuePointerRootDeleteError(value2,pointer);let[owner,next,key2]=[null,value2,""];for(let component of Format(pointer)){if(next[component]===void 0||next[component]===null)return;owner=next,next=next[component],key2=component}if(Array.isArray(owner)){let index=parseInt(key2);owner.splice(index,1)}else delete owner[key2]}function Has3(value2,pointer){if(pointer==="")return!0;let[owner,next,key2]=[null,value2,""];for(let component of Format(pointer)){if(next[component]===void 0)return!1;owner=next,next=next[component],key2=component}return Object.getOwnPropertyNames(owner).includes(key2)}function Get3(value2,pointer){if(pointer==="")return value2;let current=value2;for(let component of Format(pointer)){if(current[component]===void 0)return;current=current[component]}return current}init_guard();function ObjectType3(left,right){if(!IsObject2(right))return!1;let leftKeys=[...Object.keys(left),...Object.getOwnPropertySymbols(left)],rightKeys=[...Object.keys(right),...Object.getOwnPropertySymbols(right)];if(leftKeys.length!==rightKeys.length)return!1;return leftKeys.every((key2)=>Equal(left[key2],right[key2]))}function DateType3(left,right){return IsDate2(right)&&left.getTime()===right.getTime()}function ArrayType3(left,right){if(!IsArray2(right)||left.length!==right.length)return!1;return left.every((value2,index)=>Equal(value2,right[index]))}function TypedArrayType(left,right){if(!IsTypedArray(right)||left.length!==right.length||Object.getPrototypeOf(left).constructor.name!==Object.getPrototypeOf(right).constructor.name)return!1;return left.every((value2,index)=>Equal(value2,right[index]))}function ValueType(left,right){return left===right}function Equal(left,right){if(IsDate2(left))return DateType3(left,right);if(IsTypedArray(left))return TypedArrayType(left,right);if(IsArray2(left))return ArrayType3(left,right);if(IsObject2(left))return ObjectType3(left,right);if(IsValueType(left))return ValueType(left,right);throw Error("ValueEquals: Unable to compare value")}init_error2();init_literal2();init_object2();init_string2();init_unknown2();init_union2();var Insert=Object2({type:Literal("insert"),path:String2(),value:Unknown()}),Update2=Object2({type:Literal("update"),path:String2(),value:Unknown()}),Delete6=Object2({type:Literal("delete"),path:String2()}),Edit=Union([Insert,Update2,Delete6]);class ValueDiffError extends TypeBoxError{constructor(value2,message){super(message);this.value=value2}}function CreateUpdate(path8,value2){return{type:"update",path:path8,value:value2}}function CreateInsert(path8,value2){return{type:"insert",path:path8,value:value2}}function CreateDelete(path8){return{type:"delete",path:path8}}function AssertDiffable(value2){if(globalThis.Object.getOwnPropertySymbols(value2).length>0)throw new ValueDiffError(value2,"Cannot diff objects with symbols")}function*ObjectType4(path8,current,next){if(AssertDiffable(current),AssertDiffable(next),!IsStandardObject(next))return yield CreateUpdate(path8,next);let currentKeys=globalThis.Object.getOwnPropertyNames(current),nextKeys=globalThis.Object.getOwnPropertyNames(next);for(let key2 of nextKeys){if(HasPropertyKey2(current,key2))continue;yield CreateInsert(`${path8}/${key2}`,next[key2])}for(let key2 of currentKeys){if(!HasPropertyKey2(next,key2))continue;if(Equal(current,next))continue;yield*Visit15(`${path8}/${key2}`,current[key2],next[key2])}for(let key2 of currentKeys){if(HasPropertyKey2(next,key2))continue;yield CreateDelete(`${path8}/${key2}`)}}function*ArrayType4(path8,current,next){if(!IsArray2(next))return yield CreateUpdate(path8,next);for(let i=0;i<Math.min(current.length,next.length);i++)yield*Visit15(`${path8}/${i}`,current[i],next[i]);for(let i=0;i<next.length;i++){if(i<current.length)continue;yield CreateInsert(`${path8}/${i}`,next[i])}for(let i=current.length-1;i>=0;i--){if(i<next.length)continue;yield CreateDelete(`${path8}/${i}`)}}function*TypedArrayType2(path8,current,next){if(!IsTypedArray(next)||current.length!==next.length||globalThis.Object.getPrototypeOf(current).constructor.name!==globalThis.Object.getPrototypeOf(next).constructor.name)return yield CreateUpdate(path8,next);for(let i=0;i<Math.min(current.length,next.length);i++)yield*Visit15(`${path8}/${i}`,current[i],next[i])}function*ValueType2(path8,current,next){if(current===next)return;yield CreateUpdate(path8,next)}function*Visit15(path8,current,next){if(IsStandardObject(current))return yield*ObjectType4(path8,current,next);if(IsArray2(current))return yield*ArrayType4(path8,current,next);if(IsTypedArray(current))return yield*TypedArrayType2(path8,current,next);if(IsValueType(current))return yield*ValueType2(path8,current,next);throw new ValueDiffError(current,"Unable to diff value")}function Diff(current,next){return[...Visit15("",current,next)]}function IsRootUpdate(edits){return edits.length>0&&edits[0].path===""&&edits[0].type==="update"}function IsIdentity(edits){return edits.length===0}function Patch(current,edits){if(IsRootUpdate(edits))return Clone2(edits[0].value);if(IsIdentity(edits))return Clone2(current);let clone2=Clone2(current);for(let edit of edits)switch(edit.type){case"insert":{exports_pointer.Set(clone2,edit.path,edit.value);break}case"update":{exports_pointer.Set(clone2,edit.path,edit.value);break}case"delete":{exports_pointer.Delete(clone2,edit.path);break}}return clone2}function Encode(...args){let[schema3,references,value2]=args.length===3?[args[0],args[1],args[2]]:[args[0],[],args[1]],encoded=HasTransform(schema3,references)?TransformEncode(schema3,references,value2):value2;if(!Check(schema3,references,encoded))throw new TransformEncodeCheckError(schema3,encoded,Errors(schema3,references,encoded).First());return encoded}init_guard();init_error2();function IsStandardObject2(value2){return IsObject2(value2)&&!IsArray2(value2)}class ValueMutateError extends TypeBoxError{constructor(message){super(message)}}function ObjectType5(root,path8,current,next){if(!IsStandardObject2(current))exports_pointer.Set(root,path8,Clone2(next));else{let currentKeys=Object.getOwnPropertyNames(current),nextKeys=Object.getOwnPropertyNames(next);for(let currentKey of currentKeys)if(!nextKeys.includes(currentKey))delete current[currentKey];for(let nextKey of nextKeys)if(!currentKeys.includes(nextKey))current[nextKey]=null;for(let nextKey of nextKeys)Visit16(root,`${path8}/${nextKey}`,current[nextKey],next[nextKey])}}function ArrayType5(root,path8,current,next){if(!IsArray2(current))exports_pointer.Set(root,path8,Clone2(next));else{for(let index=0;index<next.length;index++)Visit16(root,`${path8}/${index}`,current[index],next[index]);current.splice(next.length)}}function TypedArrayType3(root,path8,current,next){if(IsTypedArray(current)&&current.length===next.length)for(let i=0;i<current.length;i++)current[i]=next[i];else exports_pointer.Set(root,path8,Clone2(next))}function ValueType3(root,path8,current,next){if(current===next)return;exports_pointer.Set(root,path8,next)}function Visit16(root,path8,current,next){if(IsArray2(next))return ArrayType5(root,path8,current,next);if(IsTypedArray(next))return TypedArrayType3(root,path8,current,next);if(IsStandardObject2(next))return ObjectType5(root,path8,current,next);if(IsValueType(next))return ValueType3(root,path8,current,next)}function IsNonMutableValue(value2){return IsTypedArray(value2)||IsValueType(value2)}function IsMismatchedValue(current,next){return IsStandardObject2(current)&&IsArray2(next)||IsArray2(current)&&IsStandardObject2(next)}function Mutate(current,next){if(IsNonMutableValue(current)||IsNonMutableValue(next))throw new ValueMutateError("Only object and array types can be mutated at the root level");if(IsMismatchedValue(current,next))throw new ValueMutateError("Cannot assign due type mismatch of assignable values");Visit16(current,"",current,next)}init_error2();init_guard();class ParseError extends TypeBoxError{constructor(message){super(message)}}var ParseRegistry;(function(ParseRegistry2){let registry3=new Map([["Assert",(type4,references,value2)=>{return Assert(type4,references,value2),value2}],["Cast",(type4,references,value2)=>Cast(type4,references,value2)],["Clean",(type4,references,value2)=>Clean(type4,references,value2)],["Clone",(_type,_references,value2)=>Clone2(value2)],["Convert",(type4,references,value2)=>Convert2(type4,references,value2)],["Decode",(type4,references,value2)=>HasTransform(type4,references)?TransformDecode(type4,references,value2):value2],["Default",(type4,references,value2)=>Default5(type4,references,value2)],["Encode",(type4,references,value2)=>HasTransform(type4,references)?TransformEncode(type4,references,value2):value2]]);function Delete7(key2){registry3.delete(key2)}ParseRegistry2.Delete=Delete7;function Set6(key2,callback){registry3.set(key2,callback)}ParseRegistry2.Set=Set6;function Get4(key2){return registry3.get(key2)}ParseRegistry2.Get=Get4})(ParseRegistry||(ParseRegistry={}));var ParseDefault=["Clone","Clean","Default","Convert","Assert","Decode"];function ParseValue(operations,type4,references,value2){return operations.reduce((value3,operationKey)=>{let operation=ParseRegistry.Get(operationKey);if(IsUndefined2(operation))throw new ParseError(`Unable to find Parse operation '${operationKey}'`);return operation(type4,references,value3)},value2)}function Parse(...args){let[operations,schema3,references,value2]=args.length===4?[args[0],args[1],args[2],args[3]]:args.length===3?IsArray2(args[0])?[args[0],args[1],[],args[2]]:[ParseDefault,args[0],args[1],args[2]]:args.length===2?[ParseDefault,args[0],[],args[1]]:(()=>{throw new ParseError("Invalid Arguments")})();return ParseValue(operations,schema3,references,value2)}var exports_value2={};__export(exports_value2,{ValueErrorIterator:()=>ValueErrorIterator,Patch:()=>Patch,Parse:()=>Parse,Mutate:()=>Mutate,Hash:()=>Hash,Errors:()=>Errors,Equal:()=>Equal,Encode:()=>Encode,Edit:()=>Edit,Diff:()=>Diff,Default:()=>Default5,Decode:()=>Decode2,Create:()=>Create2,Convert:()=>Convert2,Clone:()=>Clone2,Clean:()=>Clean,Check:()=>Check,Cast:()=>Cast,Assert:()=>Assert});init_esm3();var EMAIL2=/^[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*@(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i,UUID2=/^(?:urn:uuid:)?[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i,DATE_TIME=/^\d\d\d\d-[0-1]\d-[0-3]\d[t\s](?:[0-2]\d:[0-5]\d:[0-5]\d|23:59:60)(?:\.\d+)?(?:z|[+-]\d\d(?::?\d\d)?)$/i,ANNOTATION_ONLY=["binary"],registered=!1;function registerStringFormats(){if(registered)return;registered=!0,exports_format.Set("email",(value2)=>EMAIL2.test(value2)),exports_format.Set("uuid",(value2)=>UUID2.test(value2)),exports_format.Set("date-time",(value2)=>DATE_TIME.test(value2));for(let name2 of ANNOTATION_ONLY)exports_format.Set(name2,()=>!0)}var REGISTERED_FORMATS=["email","uuid","date-time",...ANNOTATION_ONLY];var OPTIONAL_KIND=Symbol.for("TypeBox.Optional"),KIND=Symbol.for("TypeBox.Kind"),cleanable=new WeakMap;function honourOpenObjects(node){if(Array.isArray(node)){let changed2=!1,out2=node.map((entry)=>{let next=honourOpenObjects(entry);if(next!==entry)changed2=!0;return next});return changed2?out2:node}if(node===null||typeof node!=="object")return node;let source=node,isSchema=KIND in source,changed=!1,out={};for(let key2 of Object.keys(source)){let value2=source[key2];if(isSchema&&key2==="additionalProperties"&&value2===!0){out[key2]=Type.Any(),changed=!0;continue}let next=honourOpenObjects(value2);if(next!==value2)changed=!0;out[key2]=next}if(!changed)return node;for(let symbol3 of Object.getOwnPropertySymbols(source))out[symbol3]=source[symbol3];return out}function cleanSchemaFor(schema3){let cached=cleanable.get(schema3);if(cached)return cached;let rewritten=honourOpenObjects(schema3);return cleanable.set(schema3,rewritten),rewritten}function prepare(schema3,value2,on){if(!schema3)return value2;if(value2===void 0&&OPTIONAL_KIND in schema3)return;let prepared=value2;if(on==="query")try{prepared=exports_value2.Convert(schema3,prepared)}catch{}try{prepared=exports_value2.Default(schema3,prepared)}catch{}try{prepared=exports_value2.Clean(cleanSchemaFor(schema3),prepared)}catch{}return prepared}function sampleOf(schema3){try{return exports_value2.Create(schema3)}catch{return}}registerStringFormats();var REQUIRED_PROPERTY=45;function propertyName(path8){return path8.replace(/^\//,"").replace(/\//g,".")}function describe2(value2){if(value2===void 0)return"undefined";if(value2===null)return"null";if(typeof value2==="object")return JSON.stringify(value2);return String(value2)}function at(value2,path8){let current=value2;for(let segment of path8.split("/").filter(Boolean)){if(typeof current!=="object"||current===null)return;current=current[segment]}return current}function validate(schema3,value2,on){if(!schema3)return null;if(exports_value2.Check(schema3,value2))return null;let all=[...exports_value2.Errors(schema3,value2)],errors2=all.filter((error3)=>error3.type!==REQUIRED_PROPERTY),primary=errors2[0]??all[0],path8=primary?.path??"",message=primary?.message??"Invalid value",atRoot=path8==="";return{isSuccess:!1,success:!1,type:"validation",on,property:atRoot?"root":path8,message,summary:atRoot?message:summarise(path8,message,at(value2,path8)),expected:sampleOf(schema3),found:redact(value2),errors:errors2.map((error3)=>({...error3,value:redact(error3.value),summary:summarise(error3.path,error3.message,at(value2,error3.path))}))}}function describeExpectation(message){return message.replace(/^Expected\s+/i,"")}function redact(value2){if(value2===null)return"null";if(Array.isArray(value2))return`array(${value2.length})`;if(value2 instanceof Date)return"Date";if(typeof value2==="object"){let shape={};for(let key2 of Object.keys(value2))shape[key2]=redact(value2[key2]);return shape}if(value2===void 0)return"undefined";return typeof value2}function summarise(path8,message,found){return`Expected property '${propertyName(path8)}' to be ${describeExpectation(message)} but found: ${describe2(redact(found))}`}class RouteCollisionError extends Error{constructor(method,path8){super(`${method} ${path8} is registered twice. Two groups claiming one path is a wiring mistake, not a fallback: which handler answers would depend on registration order.`);this.name="RouteCollisionError"}}function joinPath2(prefix,path8){if(!prefix)return path8;let left=prefix.endsWith("/")?prefix.slice(0,-1):prefix;if(path8==="/"||path8==="")return left||"/";let right=path8.startsWith("/")?path8:`/${path8}`;return`${left}${right}`||"/"}function buildRoutes(groups,options={}){let table=new Map;for(let group of groups)for(let route of group.routes){let fullPath=joinPath2(group.prefix,route.path),method=route.method,byMethod=table.get(fullPath);if(!byMethod)byMethod=new Map,table.set(fullPath,byMethod);if(byMethod.has(method))throw new RouteCollisionError(method,fullPath);byMethod.set(method,{guards:[...group.guards??[],...route.guards??[]],route})}let out={},withSlashAlias=(path8)=>path8==="/"||path8.endsWith("/")?[path8]:[path8,`${path8}/`];for(let[path8,byMethod]of table){let handlers={};for(let[method,registered2]of byMethod){handlers[method]=async(request,server)=>{let set2=createResponseSet(),response;try{response=await answer(request,server,set2)}catch(error3){if(!options.onError)throw error3;let answered=await options.onError({set:set2,code:"UNKNOWN",error:error3,request});response=finalizeResponse(answered,set2)}if(options.onAfter)try{set2.status=response.status,await options.onAfter({request,set:set2})}catch(error3){console.error("[router] after-handler failed",error3)}return response};let answer=async(request,server,set2)=>{let url=new URL(request.url),params=request.params??{},query=Object.fromEntries(url.searchParams);if(options.onRequest){let early=await options.onRequest({request,set:set2,body:void 0,params,query,server});if(early!==void 0)return finalizeResponse(early,set2)}let body;try{body=await parseBody(request.clone(),registered2.route.type)}catch(error3){if(error3 instanceof BodyParseError){let bodySchema=registered2.route.body;if(bodySchema&&OPTIONAL_KIND in bodySchema)body=void 0;else return new Response(error3.message,{status:error3.status})}else throw error3}body=prepare(registered2.route.body,body,"body"),query=prepare(registered2.route.query,query,"query"),params=prepare(registered2.route.params,params,"params");for(let[target2,schema3,value2]of[["body",registered2.route.body,body],["query",registered2.route.query,query],["params",registered2.route.params,params]]){if(value2===void 0&&schema3&&OPTIONAL_KIND in schema3)continue;let failure=validate(schema3,value2,target2);if(failure){let headers=new Headers({"content-type":"application/json"});for(let[name2,value3]of Object.entries(set2.headers))if(value3!==void 0)headers.set(name2,String(value3));return new Response(JSON.stringify(failure,null,2),{status:422,headers})}}let guardContext={request,set:set2,body,params,query,server};for(let guard5 of registered2.guards){let early=await guard5(guardContext);if(early!==void 0)return finalizeResponse(early,set2)}try{let result=await registered2.route.handler({...options.context,request,params,query,body,set:set2});return finalizeResponse(result,set2)}catch(error3){if(!options.onError)throw error3;let answered=await options.onError({set:set2,code:"UNKNOWN",error:error3,request});return finalizeResponse(answered,set2)}}}for(let alias of withSlashAlias(path8))out[alias]=handlers}return out}init_websocket();var NOT_FOUND=()=>new Response("NOT_FOUND",{status:404});async function staticAsset(request,assets){if(!assets)return null;if(request.method!=="GET"&&request.method!=="HEAD")return null;let{pathname}=new URL(request.url),prefix=assets.prefix.endsWith("/")?assets.prefix.slice(0,-1):assets.prefix;if(pathname!==prefix&&!pathname.startsWith(`${prefix}/`))return null;let relative;try{relative=decodeURIComponent(pathname.slice(prefix.length))}catch{return new Response("NOT_FOUND",{status:404})}let{join:join7,resolve:resolve2,sep}=await import("path"),root=resolve2(assets.directory),target2=resolve2(join7(root,relative));if(target2!==root&&!target2.startsWith(root+sep))return new Response("NOT_FOUND",{status:404});let file=Bun.file(target2);if(!await file.exists())return null;return new Response(request.method==="HEAD"?null:file)}function serve(options){let routes=buildRoutes(options.groups,{onRequest:options.onRequest,onError:options.onError,onAfter:options.onAfter,context:options.context}),notFound=options.notFound??NOT_FOUND,socket=options.socket,server=Bun.serve({port:options.port??0,hostname:options.hostname,idleTimeout:options.idleTimeout??30,reusePort:options.reusePort??!0,...options.maxRequestBodyBytes!==void 0?{maxRequestBodySize:options.maxRequestBodyBytes}:{},routes,fetch:async(request,self2)=>{let asset=await staticAsset(request,options.staticAssets);if(asset)return asset;let set2=createResponseSet();if(options.onRequest){let url=new URL(request.url);try{let early=await options.onRequest({request,set:set2,body:void 0,params:{},query:Object.fromEntries(url.searchParams),server:self2});if(early!==void 0)return finalizeResponse(early,set2)}catch(error3){if(!options.onError)throw error3;let answered=await options.onError({set:set2,code:"UNKNOWN",error:error3,request});return finalizeResponse(answered,set2)}}if(socket){let upgraded=upgradeFor(socket,request,self2);if(upgraded)return upgraded}let missing=await notFound(request),headers=new Headers(missing.headers);for(let[name2,value2]of Object.entries(set2.headers))if(value2!==void 0&&!headers.has(name2))headers.set(name2,String(value2));let text2=await missing.text();return new Response(text2,{status:missing.status,headers})},websocket:socket?websocketHandlers(socket):void 0}),stopped=!1,runShutdown=async()=>{for(let step of options.onStop??[])try{await step()}catch(error3){console.error("[NucleusServer] shutdown step failed",error3)}},port=server.port??0,hostname=server.hostname??"localhost";return{port,hostname,url:`http://${hostname}:${port}`,stop:(closeActiveConnections=!1)=>{let stopping=Promise.resolve(server.stop(closeActiveConnections));if(stopped)return stopping;return stopped=!0,stopping.then(runShutdown)},raw:server}}function operationIdFor(method,path8){let tail2=path8.split("/").filter(Boolean).flatMap((segment)=>segment.startsWith(":")?["by",segment.slice(1)]:segment.split(/[-_]/)).filter(Boolean).map((word)=>word.charAt(0).toUpperCase()+word.slice(1)).join("");return`${method.toLowerCase()}${tail2}`}function toOpenApiPath(path8){return path8.split("/").map((segment)=>segment.startsWith(":")?`{${segment.slice(1)}}`:segment).join("/")}function pathParametersOf(path8,schema3){let declared=schema3?.properties;return path8.split("/").filter((segment)=>segment.startsWith(":")).map((segment)=>{let name2=segment.slice(1);return{name:name2,in:"path",required:!0,schema:declared?.[name2]??{type:"string"}}})}function queryParametersOf(schema3){let object3=schema3;if(!object3?.properties)return[];return Object.entries(object3.properties).map(([name2,value2])=>({name:name2,in:"query",required:object3.required?.includes(name2)??!1,schema:value2}))}function buildOpenApiDocument(groups,config={}){let info=config.documentation?.info,paths={};for(let group of groups)for(let route of group.routes){let declared=route.path==="/"?"":route.path,joined=`${group.prefix??""}${declared}`||"/",openApiPath=toOpenApiPath(joined),method=route.method.toLowerCase(),detail=route.detail,parameters4=[...pathParametersOf(joined,route.params),...queryParametersOf(route.query)],operation={operationId:operationIdFor(route.method,joined),responses:{"200":{}}};if(detail?.tags)operation.tags=detail.tags;if(detail?.summary)operation.summary=detail.summary;if(detail?.description)operation.description=detail.description;if(parameters4.length>0)operation.parameters=parameters4;if(route.body)operation.requestBody={content:{"application/json":{schema:route.body}}};if(paths[openApiPath]=paths[openApiPath]??{},!paths[openApiPath][method])paths[openApiPath][method]=operation}let document={openapi:"3.0.3",info:{title:info?.title??"Nucleus API",description:info?.description??"Auto-generated API documentation",version:info?.version??"1.0.0"},tags:config.documentation?.tags??[],paths};if(config.documentation?.servers)document.servers=config.documentation.servers;return document}function viewerHtml(documentUrl,title,description){let forHtml=(value2)=>value2.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/"/g,"&quot;");return`<!doctype html>
+`)}deliver(getEmailService(),{to:user.email,subject,html:emailHtml},"[AUTH] login notification").then((report)=>{if(report.level==="warn")logger2.warn(report.message,{userId:params.userId,trustScore,requiresApproval});else logger2.info(report.message,{userId:params.userId})})}}}if(logger2.info("[AUTH] Session saved to DB",{sessionId,userId:params.userId,isNewDevice,requiresApproval,deviceFingerprint,ipAddress:deviceInfo.ipAddress}),deviceTrustMint&&dtTable&&deviceTrustCfg?.enabled)try{let DT2=await Promise.resolve().then(() => (init_DeviceTrust(),exports_DeviceTrust)),DTStore2=await Promise.resolve().then(() => (init_store3(),exports_store)),{randomUUID:randomUUID12}=await import("crypto"),{raw,hash}=DT2.mintDeviceToken(),ttlSec=parseTimeToSeconds2(deviceTrustCfg.tokenExpiresIn??"30d");await DTStore2.insertDeviceRow(db,dtTable,{id:randomUUID12(),userId:params.userId,tokenHash:hash,status:deviceTrustMint,originSessionId:sessionId,label:deviceInfo.deviceName||`${deviceInfo.browserName||"Unknown"} on ${deviceInfo.osName||"Unknown"}`,deviceFingerprint,firstSeenIp:deviceInfo.ipAddress,expiresAt:new Date(Date.now()+ttlSec*1000)});let rawDomainDT=authentication.cookieDomain,resolvedDomainDT=rawDomainDT?process.env[rawDomainDT]??rawDomainDT:void 0,domainDT=resolvedDomainDT==="localhost"||resolvedDomainDT===".localhost"?void 0:resolvedDomainDT;deviceTokenToSet=DT2.buildDeviceTokenCookie(raw,{cookieName:deviceTrustCfg.cookieName,cookiePrefix:deviceTrustCfg.cookiePrefix,sameSite:deviceTrustCfg.sameSite,maxAgeSeconds:ttlSec,domain:domainDT,secure:!!domainDT})}catch(dtErr){logger2.warn("[AUTH] Device-trust token mint failed \u2014 continuing",{userId:params.userId,error:dtErr instanceof Error?dtErr.message:String(dtErr)})}return{requiresApproval,sessionId,deviceTokenCookie:deviceTokenToSet??void 0}},storeResetToken:async(userId,token,expiresAt,reqSchemaName)=>{let resetTokensTable=resolveTableForTenant("passwordResetTokens",reqSchemaName);if(!resetTokensTable||!db)return;await db.insert(resetTokensTable).values({userId,tokenHash:createHash5("sha256").update(token).digest("hex"),expiresAt})},getResetToken:async(token,reqSchemaName)=>{let{eq:eq69}=__require("drizzle-orm"),resetTokensTable=resolveTableForTenant("passwordResetTokens",reqSchemaName);if(!resetTokensTable||!db)return null;let tokenHash=createHash5("sha256").update(token).digest("hex"),row=(await db.select().from(resetTokensTable).where(eq69(resetTokensTable.tokenHash,tokenHash)).limit(1))[0];if(!row||row.usedAt)return null;return{userId:row.userId,expiresAt:row.expiresAt}},deleteResetToken:async(token,reqSchemaName)=>{let{eq:eq69}=__require("drizzle-orm"),resetTokensTable=resolveTableForTenant("passwordResetTokens",reqSchemaName);if(!resetTokensTable||!db)return;let tokenHash=createHash5("sha256").update(token).digest("hex");await db.delete(resetTokensTable).where(eq69(resetTokensTable.tokenHash,tokenHash))},revokeSessionInDb:async(sessionId,reason,reqSchemaName)=>{let revokeTable=resolveTableForTenant("userSessions",reqSchemaName)||resolveTableForTenant("user_sessions",reqSchemaName)||resolveTableForTenant("sessions",reqSchemaName)||sessionsTable;if(!revokeTable||!db)return;await db.update(revokeTable).set({isActive:!1,revokedAt:new Date,revokedReason:reason}).where(eq68(revokeTable.id,sessionId)),logger2.info("[AUTH] Session revoked in DB",{sessionId,reason})},sendResetEmail:async(email,token,request)=>{if(isEmailExempt(email,authentication?.emailExemptDomains))return logger2.info("[AUTH] Skipping reset email \u2014 domain exempt",{email}),{sent:!1,reason:"exempt"};let mailer=getEmailService();if(!mailer?.isAvailable())return logger2.warn("[AUTH] Cannot send reset email \u2014 no email provider configured"),{sent:!1,reason:"no_provider"};let configuredResetUrl=authentication.passwordReset?.redirectUrl||"http://localhost:3000/reset-password",resetUrl=request?buildEmailActionLink({request,configuredUrl:configuredResetUrl,path:extractConfiguredPath(configuredResetUrl,"/reset-password"),query:{token},allowedOrigins:trustedAppOrigins()}):`${configuredResetUrl}?token=${token}`,result=await mailer.sendEmail({to:email,subject:"Password Reset Request",html:`<p>Click the link to reset your password:</p><a href="${resetUrl}">${resetUrl}</a>`});if(result?.success===!1){let refused=result.rejected;return{sent:!1,reason:Array.isArray(refused)&&refused.length>0?"rejected":"error",detail:result.error}}return{sent:!0}},storeMagicToken:async(params,reqSchemaName)=>{let magicTokensTable=resolveTableForTenant("magicLinkTokens",reqSchemaName);if(!magicTokensTable||!db)return;await db.insert(magicTokensTable).values({userId:params.userId,email:params.email,tokenHash:params.tokenHash,expiresAt:params.expiresAt})},getMagicToken:async(tokenHash,reqSchemaName)=>{let{eq:eq69}=__require("drizzle-orm"),magicTokensTable=resolveTableForTenant("magicLinkTokens",reqSchemaName);if(!magicTokensTable||!db)return null;let row=(await db.select().from(magicTokensTable).where(eq69(magicTokensTable.tokenHash,tokenHash)).limit(1))[0];if(!row||row.usedAt)return null;return{userId:row.userId,email:row.email,tokenHash:row.tokenHash,expiresAt:row.expiresAt}},deleteMagicToken:async(tokenHash,reqSchemaName)=>{let{eq:eq69}=__require("drizzle-orm"),magicTokensTable=resolveTableForTenant("magicLinkTokens",reqSchemaName);if(!magicTokensTable||!db)return;await db.delete(magicTokensTable).where(eq69(magicTokensTable.tokenHash,tokenHash))}}}),logger2.info("[AUTH] Routes registered")}}if(resolvedOptions.storage?.enabled&&resolvedOptions.storage?.cdn?.enabled){let{createCdnRoutes:createCdnRoutes2,mergeCdnConfig:mergeCdnConfig2,mergeStorageConfig:mergeStorageConfig2}=(init_storage2(),__toCommonJS(exports_storage)),cdnConfig=mergeCdnConfig2(resolvedOptions.storage.cdn),storageConfig=mergeStorageConfig2(resolvedOptions.storage),filesTable=schemaTables.files;if(useRoutes(plugin,createCdnRoutes2({cdn:cdnConfig,storagePath:storageConfig.basePath,logger:logger2,getStorageProvider:()=>storageProvider,buildStorageProvider,authorizeFile:db?async({id,request,schemaName:reqSchemaName})=>{let tables=schemaTables;if(reqSchemaName&&tenantRegistry){let ctx=tenantRegistry.getSchemaContext(reqSchemaName);if(ctx?.schemaTables)tables=ctx.schemaTables}return await checkAttachmentFileAccess({db,schemaTables:tables,fileId:id,userId:request.headers.get("x-user-id")})!=="denied"}:void 0,getFileRecord:filesTable&&db?async(id,reqSchemaName)=>{let tbl=filesTable;if(reqSchemaName&&tenantRegistry){let ctx=tenantRegistry.getSchemaContext(reqSchemaName);if(ctx?.schemaTables.files)tbl=ctx.schemaTables.files}let t=tbl,result=await db.select().from(t).where(eq68(t.id,id)).limit(1);if(result.length===0)return null;let record3=result[0];return{id:record3.id,name:record3.name,path:record3.path,mime_type:record3.mimeType||record3.mime_type,original_name:record3.originalName||record3.original_name}}:void 0})),logger2.info(`[Storage] CDN routes enabled at ${cdnConfig.basePath}`),filesTable&&db){let{createResumableRoutes:createResumableRoutes2}=(init_resumable(),__toCommonJS(exports_resumable)),resumable=createResumableRoutes2({basePath:storageConfig.basePath,storage:storageConfig,logger:logger2,getUserId:(request)=>request.headers.get("x-user-id"),canUpload:(request)=>{if(resolvedOptions.authorization?.enabled===!1)return!0;return checkAuthorizationFromJWT({userClaims:decodeHeaderList(request.headers.get("x-user-claims")),userRoles:decodeHeaderList(request.headers.get("x-user-roles")),claimScopes:decodeClaimScopesHeader(request.headers.get("x-user-claim-scopes")),method:"POST",entity:"files",logger:logger2,requireClaimSpecificity:resolvedOptions.authorization?.requireClaimSpecificity}).authorized},register:async(input)=>{let nodePath=__require("path"),{rename:rename6}=__require("fs/promises"),{randomUUID:randomUUID12}=__require("crypto"),id=randomUUID12(),extension2=nodePath.extname(input.originalName),storedName=`${id}${extension2}`,destination=nodePath.join(storageConfig.basePath,storedName);try{await rename6(input.partPath,destination)}catch(error3){return logger2.error("[Storage] A finished upload could not be moved into place",{error:error3}),null}let uploaded={id,name:storedName,originalName:input.originalName,path:storageConfig.basePath,mimeType:input.mimeType,size:input.size,createdAt:new Date},{buildFileRecordPayload:buildFileRecordPayload2,scheduleUploadMediaProcessing:scheduleUploadMediaProcessing2}=(init_storage2(),__toCommonJS(exports_storage)),t=filesTable,payload={...buildFileRecordPayload2(uploaded,input.userId),type:input.type},row=(await db.insert(t).values(payload).returning())[0];if(!row?.id)return null;return scheduleUploadMediaProcessing2([uploaded],{storagePath:storageConfig.basePath,media:{transform:mergeTransformConfig(resolvedOptions.storage?.cdn?.transform),video:mergeVideoConfig(resolvedOptions.storage?.cdn?.video),pdf:mergePdfConfig(resolvedOptions.storage?.cdn?.pdf)},logger:logger2}),{id:String(row.id)}}});useRoutes(plugin,resumable.plugin),setInterval(()=>{resumable.sweep(Date.now()).then((removed)=>{if(removed>0)logger2.info(`[Storage] Reclaimed ${removed} abandoned upload(s)`)}).catch(()=>{})},3600000).unref?.(),logger2.info("[Storage] Resumable uploads enabled at /uploads")}}if(resolvedOptions.notification?.enabled&&db){let notificationConfig=resolvedOptions.notification;if(notificationConfig.endpoints?.enabled!==!1){warnOnEntityBasePathCollision("Notification",notificationConfig.endpoints?.basePath||"/notifications",resolvedOptions.entities,logger2);let{routes:notificationRoutes}=createNotificationRoutes({db,schemaTables,config:notificationConfig,logger:logger2,getEmailService,tenantRegistry});useRoutes(plugin,notificationRoutes),logger2.info(`[Notification] Routes registered at ${notificationConfig.endpoints?.basePath||"/notifications"}`)}}if(resolvedOptions.verification?.enabled&&db){let{routes:verificationRoutes}=createVerificationRoutes({db,schemaTables,config:resolvedOptions.verification,notificationConfig:resolvedOptions.notification,logger:logger2,getEmailService,tenantRegistry});useRoutes(plugin,verificationRoutes)}if(resolvedOptions.backup?.enabled&&db){let{createBackupRoutes:createBackupRoutes2}=(init_backup(),__toCommonJS(exports_backup)),{routes:backupRoutes}=createBackupRoutes2({db,logger:logger2,config:{enabled:!0,basePath:resolvedOptions.backup.basePath||"/admin/backup",storagePath:resolvedOptions.backup.storagePath||"./backups",format:resolvedOptions.backup.format||"json",maxBackups:resolvedOptions.backup.maxBackups||50,allowRestore:resolvedOptions.backup.allowRestore??!0,excludeTables:resolvedOptions.backup.excludeTables||["audit_logs","backup_logs"],encryptionKey:resolvedOptions.backup.encryptionKey?process.env[resolvedOptions.backup.encryptionKey]||resolvedOptions.backup.encryptionKey:void 0,schedule:{enabled:resolvedOptions.backup.schedule?.enabled??!1,cron:resolvedOptions.backup.schedule?.cron||"0 2 * * *",retentionDays:resolvedOptions.backup.schedule?.retentionDays||30,timeZone:resolvedOptions.backup.schedule?.timeZone}},schemaTables,schemaName:targetSchemaName,getTenantRegistry:()=>tenantRegistry,lock:getRedisManager()});useRoutes(plugin,backupRoutes),logger2.info("[Backup] Routes registered",{basePath:resolvedOptions.backup.basePath||"/admin/backup",scheduleEnabled:resolvedOptions.backup.schedule?.enabled??!1})}if(resolvedOptions.authorization?.endpointDiscovery?.enabled&&db&&resolvedOptions.authentication?.mode!=="consumer"){let{createAuthorizationDiscoveryRoutes:createAuthorizationDiscoveryRoutes2}=(init_authorization(),__toCommonJS(exports_authorization));useRoutes(plugin,createAuthorizationDiscoveryRoutes2({db,schemaTables,logger:logger2,discovery:resolvedOptions.authorization.endpointDiscovery,readState:async(key2)=>{let rm3=getRedisManager();if(!rm3)return null;let res=await rm3.read(key2);return res?.success?res.data:null}})),logger2.info("[Authorization] Endpoint-discovery routes registered",{discover:"/authorization/discover",manifest:"/authorization/route-manifest"})}let pubsubClientManager=null;if(resolvedOptions.pubsub?.enabled){let redis=getRedisManager();if(redis){let pubsubConfig=resolvedOptions.pubsub,{routes:pubsubRoutes,socket:pubsubSocket,clientManager}=createPubSubRoutes({redis,logger:logger2,basePath:pubsubConfig.basePath||"/subs",wsPath:pubsubConfig.wsPath||"/api/events/subscribe",pubsubName:pubsubConfig.pubsubName||"pubsub-redis",maxClientsPerUser:pubsubConfig.maxClientsPerUser??10,maxTopicsPerClient:pubsubConfig.maxTopicsPerClient??DEFAULT_MAX_TOPICS_PER_CLIENT,wsIdleTimeout:pubsubConfig.wsIdleTimeout??120,ack:{enabled:pubsubConfig.ack?.enabled??!0,ttlSeconds:pubsubConfig.ack?.ttlSeconds??300,maxRetries:pubsubConfig.ack?.maxRetries??3,retryIntervalMs:pubsubConfig.ack?.retryIntervalMs??5000},presence:{enabled:pubsubConfig.presence?.enabled??!0,debounceMs:pubsubConfig.presence?.debounceMs??5000},cleanupIntervalMs:pubsubConfig.cleanupIntervalMs??60000,daprApiToken:pubsubConfig.daprApiToken,getLiveMonitoringService:()=>liveMonitoringService,authenticate:envResolved.accessTokenSecret?createHandshakeAuthenticator({accessTokenSecret:envResolved.accessTokenSecret,tokenNames,issuer:authentication?.accessToken?.issuer,audience:authentication?.accessToken?.audience,requireLiveSession:authentication?.mode!=="consumer",db,resolveSessionsTable:(tenant)=>{let tables=schemaTables;if(tenant&&tenantRegistry){let ctx=tenantRegistry.getSchemaContext(tenant);if(ctx?.schemaTables)tables=ctx.schemaTables}return tables?.userSessions??null},logger:logger2}):void 0});useRoutes(plugin,pubsubRoutes),recordSocket(pubsubSocket),recordAdapterStep((app)=>{mountWebSocketRoute(app,pubsubSocket)}),pubsubClientManager=clientManager,logger2.info("[PubSub] Enabled",{basePath:pubsubConfig.basePath||"/subs",wsPath:pubsubConfig.wsPath||"/api/events/subscribe"})}else logger2.warn("[PubSub] pubsub is enabled but Redis is not configured. Disabling PubSub.")}if(resolvedOptions.chat?.enabled&&db){let chatConfig=mergeChatConfig(resolvedOptions.chat),chatStorageConfig=mergeStorageConfig(resolvedOptions.storage),attachmentsAvailable=resolvedOptions.storage?.enabled===!0&&resolvedOptions.storage?.cdn?.enabled===!0&&chatConfig.attachments.enabled,cdnBasePath=resolvedOptions.storage?.cdn?.basePath||"/cdn",cdnMedia={transform:mergeTransformConfig(resolvedOptions.storage?.cdn?.transform),video:mergeVideoConfig(resolvedOptions.storage?.cdn?.video),pdf:mergePdfConfig(resolvedOptions.storage?.cdn?.pdf)},{routes:chatRoutes}=createChatRoutes({db,schemaTables,config:chatConfig,logger:logger2,broadcaster:pubsubClientManager,tenantRegistry,storageConfig:chatStorageConfig,attachmentsAvailable,cdnBasePath,cdnMedia});useRoutes(plugin,chatRoutes),logger2.info("[Chat] Enabled",{basePath:chatConfig.basePath,attachmentsAvailable,realtime:pubsubClientManager!==null})}if(resolvedOptions.payment?.enabled&&db){let{createPaymentService:createPaymentService2}=(init_Payment(),__toCommonJS(exports_Payment)),{createPaymentRoutes:createPaymentRoutes2}=(init_payment(),__toCommonJS(exports_payment)),paymentService=createPaymentService2(resolvedOptions);if(paymentService){let paymentConfig=resolvedOptions.payment,marketplaceServices=null;if(paymentConfig?.marketplace?.enabled){let{createMarketplaceServices:createMarketplaceServices2}=(init_Payment(),__toCommonJS(exports_Payment));marketplaceServices=createMarketplaceServices2({options:resolvedOptions,logger:logger2,getDb:()=>db,provider:paymentService.providerInstance,schemaTables})}let paymentRoutes=createPaymentRoutes2({provider:paymentService.providerInstance,webhookSecret:paymentService.webhookSecret,getPayoutService:()=>marketplaceServices?.payoutService??null,basePath:paymentConfig?.basePath||"/payment",defaultCurrency:paymentConfig?.defaultCurrency||"TRY",defaultLocale:paymentConfig?.defaultLocale||"tr",successRedirectUrl:paymentConfig?.successRedirectUrl||"/payment/success",failedRedirectUrl:paymentConfig?.failedRedirectUrl||"/payment/failed",errorRedirectUrl:paymentConfig?.errorRedirectUrl||"/payment/error",callbackUrl:paymentConfig?.callbackUrl,savedMethodsEnabled:paymentConfig?.savedMethodsEnabled??!0,threeDSecureEnabled:paymentConfig?.threeDSecureEnabled??!0,subMerchantsEnabled:paymentConfig?.subMerchantsEnabled??!1,transactionsTable:schemaTables.paymentTransactions??schemaTables.payment_transactions,methodsTable:schemaTables.paymentMethods??schemaTables.payment_methods,webhookLogsTable:schemaTables.paymentWebhookLogs??schemaTables.payment_webhook_logs,subMerchantsTable:schemaTables.paymentSubMerchants??schemaTables.payment_sub_merchants,commissionSplitsTable:schemaTables.paymentCommissionSplits??schemaTables.payment_commission_splits,productsTable:schemaTables.paymentProducts??schemaTables.payment_products,pricesTable:schemaTables.paymentPrices??schemaTables.payment_prices,customersTable:schemaTables.paymentCustomers??schemaTables.payment_customers,subscriptionsTable:schemaTables.paymentSubscriptions??schemaTables.payment_subscriptions,invoicesTable:schemaTables.paymentInvoices??schemaTables.payment_invoices,db,logger:logger2});if(useRoutes(plugin,paymentRoutes),logger2.info("[Payment] Routes registered",{basePath:paymentConfig?.basePath||"/payment",provider:paymentService.provider}),marketplaceServices){let{createMarketplaceRoutes:createMarketplaceRoutes2}=(init_marketplace(),__toCommonJS(exports_marketplace)),services=marketplaceServices;createMarketplaceRoutes2(plugin,{getMarketplaceService:()=>services.marketplaceService,getPayoutService:()=>services.payoutService,basePath:paymentConfig?.basePath||"/payment",logger:logger2}),logger2.info("[Payment] Marketplace routes registered",{basePath:`${paymentConfig?.basePath||"/payment"}/marketplace`})}}}let cohortConfig=authentication?.cohorts;if(cohortConfig?.enabled!==!1&&!isConsumerMode&&db){let cohortBasePath=cohortConfig?.basePath||"/auth/admin/cohorts",resolveTable=(key2,fallback)=>schemaTables[key2]??(fallback?schemaTables[fallback]:null)??null,resolvedCohortsTable=resolveTable("userCohorts","user_cohorts");if(!resolvedCohortsTable)logger2.warn("[Cohort] user_cohorts table not found in schema \u2014 cohort routes will be inactive. Re-generate schema with nucleus-core >= 0.9.120");if(useRoutes(plugin,createCohortRoutes({db,logger:logger2,cohortsTable:resolvedCohortsTable,usersTable:resolveTable("users"),sessionsTable:resolveTable("userSessions","user_sessions"),rolesTable:resolveTable("roles"),userRolesTable:resolveTable("userRoles","user_roles"),profilesTable:resolveTable("profiles"),basePath:cohortBasePath,get defaultRole(){return resolvedOptions.authentication?.defaultRole},get defaultRoles(){return resolvedOptions.authentication?.defaultRoles},emailExemptDomains:authentication?.emailExemptDomains,passwordPolicy:authentication?.passwordPolicy})),resolvedCohortsTable)logger2.info("[Cohort] Routes registered",{basePath:cohortBasePath})}if(resolvedOptions.configManagement?.enabled){let configBasePath=resolvedOptions.configManagement.basePath||"/nucleus/config";useRoutes(plugin,createConfigRoutes({logger:logger2,resolvedOptions,configFilePath,basePath:configBasePath,db,schemaTables,getRedis:()=>{let redis=getRedisManager();if(!redis)return null;return{read:async(key2)=>{let r=await redis.read(key2);return{success:r.success,data:r.success?r.data:null}},create:async(key2,value2)=>{return{success:(await redis.create(key2,value2)).success}}}},onConfigUpdate:(section,_newValue)=>{logger2.info(`[ConfigManagement] Section "${section}" updated in-memory`,{section})}})),logger2.info(`[ConfigManagement] Routes enabled at ${configBasePath}`)}if(resolvedOptions.secrets?.enabled){let secretsBasePath=resolvedOptions.secrets.basePath||"/secrets";warnOnEntityBasePathCollision("Secrets",secretsBasePath,resolvedOptions.entities,logger2),useRoutes(plugin,createSecretsRoutes({logger:logger2,basePath:secretsBasePath,db,schemaTables,resolvedOptions,getService:()=>secretsService,getEmailService,getStorageProvider:()=>storageProvider,buildStorageProvider,adminRoles:resolvedOptions.secrets.adminRoles})),logger2.info(`[Secrets] Routes enabled at ${secretsBasePath}`)}if(resolvedOptions.integrations?.enabled){let integrationsBasePath=resolvedOptions.integrations.basePath||"/integrations";warnOnEntityBasePathCollision("Integrations",integrationsBasePath,resolvedOptions.entities,logger2),useRoutes(plugin,createIntegrationRoutes({logger:logger2,basePath:integrationsBasePath,db,schemaTables,resolvedOptions,getEncryptionKey:()=>resolveMasterKey(resolvedOptions.secrets?.encryptionKey)??null,getLockStore:()=>getRedisManager(),publish:(topic,payload)=>pubsubClientManager?.broadcastEvent(topic,payload),adminRoles:resolvedOptions.integrations.adminRoles}))}recordBootStep(()=>{let assignments=resolvedOptions.authorization?.seed?.roleClaimAssignments;if(!assignments?.length)return;let ownership=[];for(let entity of resolvedOptions.entities??[]){let table=entity.table_name;if(!table)continue;for(let column of entity.columns??[]){let hasDefault=column.default!==void 0||!!column.defaultRaw||!!column.generatedAlwaysAs;if(column.notNull&&!column.nullable&&!hasDefault)ownership.push({table,column:column.name})}}for(let line of describeUnstamped(findUnstampedOwnership(assignments,ownership)))logger2.warn(line)}),recordBootStep((app)=>{let requiredBody=requiredBodyCeiling({storageEnabled:resolvedOptions.storage?.enabled,maxFileSizeBytes:resolvedOptions.storage?.maxFileSizeBytes,maxFiles:resolvedOptions.storage?.formData?.maxFiles}),complaint=bodyCeilingComplaint({configured:app?.config?.serve?.maxRequestBodySize,required:requiredBody});if(complaint)logger2.error(`[Storage] ${complaint}`);else if(requiredBody!==null){let configuredCeiling=app?.config?.serve?.maxRequestBodySize,mb2=(bytes)=>`${Math.round(bytes/1048576)} MB`;logger2.info(`[Storage] Uploads are configured up to ${mb2(requiredBody)}, and the server accepts ${configuredCeiling?mb2(configuredCeiling):"Bun's default"}.`)}let memoryComplaint=memoryCeilingComplaint({required:requiredBody,cgroupLimit:readCgroupLimitBytes()});if(memoryComplaint)logger2.error(`[Storage] ${memoryComplaint}`);let memoryAdvice=readRuntimeMemoryAdvice();if(memoryAdvice){let mib=(bytes)=>`${Math.round(bytes/1024/1024)} MiB`;logger2.warn(`[Runtime] The JS engine sizes its heap for ${mib(memoryAdvice.hostTotal)} but this container is capped at ${mib(memoryAdvice.cgroupLimit)} \u2014 it feels no memory `+"pressure and may grow past the limit and be OOM-killed. Raising the container memory limit delays this; no runtime option we have measured prevents it.")}let port=Number(process.env.PORT)||3000,appId=resolvedOptions.appId||"nucleus",mode=resolvedOptions.mode||"production";console.log(""),console.log(`  \x1B[32m\uD83D\uDE80 ${appId}\x1B[0m \x1B[90mv${Date.now()}\x1B[0m`),console.log(`  \x1B[36m\u279C\x1B[0m  Local:   \x1B[36mhttp://localhost:${port}\x1B[0m`),console.log(`  \x1B[36m\u279C\x1B[0m  Mode:    \x1B[33m${mode}\x1B[0m`),console.log("")});let shuttingDown=!1,drainResources=async(trigger)=>{if(shuttingDown)return;shuttingDown=!0,logger2.info(`[Shutdown] ${trigger} \u2014 draining resources`);try{await lifecycleRecorder?.recordStop(trigger)}catch{}try{liveMonitoringService?.stop(),monitoringService?.stop(),secretsService?.stop(),storageProvider?.close()}catch(err){logger2.warn("[Shutdown] failed stopping monitoring",{error:err instanceof Error?err.message:String(err)})}try{let redisClient=getRedisManager()?.getDirectClient?.();if(redisClient)await redisClient.quit()}catch(err){logger2.warn("[Shutdown] failed closing Redis",{error:err instanceof Error?err.message:String(err)})}try{for(let timer of backgroundIntervals)clearInterval(timer);backgroundIntervals.length=0}catch(err){logger2.warn("[Shutdown] failed clearing background intervals",{error:err instanceof Error?err.message:String(err)})}try{let{destroyAckCleanup:destroyAckCleanup2}=await Promise.resolve().then(() => (init_ack_manager(),exports_ack_manager));destroyAckCleanup2()}catch{}try{if(dbPool)await dbPool.end()}catch(err){logger2.warn("[Shutdown] failed draining DB pool",{error:err instanceof Error?err.message:String(err)})}logger2.info("[Shutdown] complete")};if(recordShutdownStep(async()=>{await drainResources("server stop")}),resolvedOptions.gracefulShutdown!==!1){let onSignal=(signal)=>{drainResources(signal).finally(()=>process.exit(0))};process.once("SIGTERM",()=>onSignal("SIGTERM")),process.once("SIGINT",()=>onSignal("SIGINT"))}return recordAdapterStep((app)=>{for(let step of getRecordedBootSteps())app.onStart(step);for(let step of getRecordedShutdownSteps())app.onStop(step)}),lastMountedSocket=getRecordedSocket(),lastStaticAssets=getRecordedStaticAssets(),lastBootSteps=getRecordedBootSteps(),lastShutdownSteps=getRecordedShutdownSteps(),lastMountedGroups=resolveOverrides(endRouteRecording(),logger2),lastAuthMiddleware=authMiddleware,lastErrorHandler=errorResponder,lastAfterHandler=afterHandler,plugin}init_response();class BodyParseError extends Error{status=400;constructor(){super("Bad Request");this.name="BodyParseError"}}function looksStructured(value2){return value2.startsWith("{")||value2.startsWith("[")}function assignPath(target2,key2,value2){let steps=key2.replace(/\[(\w*)\]/g,".$1").split(".").filter((step)=>step!=="");if(steps.length<=1){mergeInto(target2,key2,value2);return}let cursor=target2;for(let index=0;index<steps.length-1;index++){let step=steps[index],next=steps[index+1],wanted=/^\d+$/.test(next)?[]:{},holder2=cursor;if(typeof holder2[step]!=="object"||holder2[step]===null)holder2[step]=wanted;cursor=holder2[step]}let last=steps[steps.length-1];if(Array.isArray(cursor))cursor[Number(last)]=value2;else mergeInto(cursor,last,value2)}function mergeInto(target2,key2,value2){if(key2 in target2){let existing=target2[key2];target2[key2]=Array.isArray(existing)?[...existing,value2]:[existing,value2];return}target2[key2]=value2}function fromFormData(form){let out={};for(let[key2,value2]of form.entries()){let parsed=value2;if(typeof value2==="string"&&looksStructured(value2))try{parsed=JSON.parse(value2)}catch{parsed=value2}assignPath(out,key2,parsed)}return out}async function parseBody(request,declared){let contentType=request.headers.get("content-type");if(!contentType&&!declared)return;let kind=(contentType?.includes("multipart/form-data")?"formdata":contentType?.includes("application/x-www-form-urlencoded")?"urlencoded":contentType?.includes("application/json")?"json":contentType?.startsWith("text/")?"text":contentType?.includes("application/octet-stream")?"binary":void 0)??declared;if(!kind)return;if(kind==="formdata")try{return fromFormData(await request.formData())}catch{throw new BodyParseError}if(kind==="urlencoded"){let params=new URLSearchParams(await request.text()),out={};for(let[key2,value2]of params)if(key2 in out){let existing=out[key2];out[key2]=Array.isArray(existing)?[...existing,value2]:[existing,value2]}else out[key2]=value2;return out}if(kind==="binary")return await request.arrayBuffer();if(kind==="text")return await request.text();let raw=await request.text();if(raw===""&&!request.body)return;try{return JSON.parse(raw)}catch{throw new BodyParseError}}init_response();init_esm3();init_keyof2();init_registry4();init_extends_undefined();init_symbols2();function DefaultErrorFunction(error3){switch(error3.errorType){case ValueErrorType.ArrayContains:return"Expected array to contain at least one matching value";case ValueErrorType.ArrayMaxContains:return`Expected array to contain no more than ${error3.schema.maxContains} matching values`;case ValueErrorType.ArrayMinContains:return`Expected array to contain at least ${error3.schema.minContains} matching values`;case ValueErrorType.ArrayMaxItems:return`Expected array length to be less or equal to ${error3.schema.maxItems}`;case ValueErrorType.ArrayMinItems:return`Expected array length to be greater or equal to ${error3.schema.minItems}`;case ValueErrorType.ArrayUniqueItems:return"Expected array elements to be unique";case ValueErrorType.Array:return"Expected array";case ValueErrorType.AsyncIterator:return"Expected AsyncIterator";case ValueErrorType.BigIntExclusiveMaximum:return`Expected bigint to be less than ${error3.schema.exclusiveMaximum}`;case ValueErrorType.BigIntExclusiveMinimum:return`Expected bigint to be greater than ${error3.schema.exclusiveMinimum}`;case ValueErrorType.BigIntMaximum:return`Expected bigint to be less or equal to ${error3.schema.maximum}`;case ValueErrorType.BigIntMinimum:return`Expected bigint to be greater or equal to ${error3.schema.minimum}`;case ValueErrorType.BigIntMultipleOf:return`Expected bigint to be a multiple of ${error3.schema.multipleOf}`;case ValueErrorType.BigInt:return"Expected bigint";case ValueErrorType.Boolean:return"Expected boolean";case ValueErrorType.DateExclusiveMinimumTimestamp:return`Expected Date timestamp to be greater than ${error3.schema.exclusiveMinimumTimestamp}`;case ValueErrorType.DateExclusiveMaximumTimestamp:return`Expected Date timestamp to be less than ${error3.schema.exclusiveMaximumTimestamp}`;case ValueErrorType.DateMinimumTimestamp:return`Expected Date timestamp to be greater or equal to ${error3.schema.minimumTimestamp}`;case ValueErrorType.DateMaximumTimestamp:return`Expected Date timestamp to be less or equal to ${error3.schema.maximumTimestamp}`;case ValueErrorType.DateMultipleOfTimestamp:return`Expected Date timestamp to be a multiple of ${error3.schema.multipleOfTimestamp}`;case ValueErrorType.Date:return"Expected Date";case ValueErrorType.Function:return"Expected function";case ValueErrorType.IntegerExclusiveMaximum:return`Expected integer to be less than ${error3.schema.exclusiveMaximum}`;case ValueErrorType.IntegerExclusiveMinimum:return`Expected integer to be greater than ${error3.schema.exclusiveMinimum}`;case ValueErrorType.IntegerMaximum:return`Expected integer to be less or equal to ${error3.schema.maximum}`;case ValueErrorType.IntegerMinimum:return`Expected integer to be greater or equal to ${error3.schema.minimum}`;case ValueErrorType.IntegerMultipleOf:return`Expected integer to be a multiple of ${error3.schema.multipleOf}`;case ValueErrorType.Integer:return"Expected integer";case ValueErrorType.IntersectUnevaluatedProperties:return"Unexpected property";case ValueErrorType.Intersect:return"Expected all values to match";case ValueErrorType.Iterator:return"Expected Iterator";case ValueErrorType.Literal:return`Expected ${typeof error3.schema.const==="string"?`'${error3.schema.const}'`:error3.schema.const}`;case ValueErrorType.Never:return"Never";case ValueErrorType.Not:return"Value should not match";case ValueErrorType.Null:return"Expected null";case ValueErrorType.NumberExclusiveMaximum:return`Expected number to be less than ${error3.schema.exclusiveMaximum}`;case ValueErrorType.NumberExclusiveMinimum:return`Expected number to be greater than ${error3.schema.exclusiveMinimum}`;case ValueErrorType.NumberMaximum:return`Expected number to be less or equal to ${error3.schema.maximum}`;case ValueErrorType.NumberMinimum:return`Expected number to be greater or equal to ${error3.schema.minimum}`;case ValueErrorType.NumberMultipleOf:return`Expected number to be a multiple of ${error3.schema.multipleOf}`;case ValueErrorType.Number:return"Expected number";case ValueErrorType.Object:return"Expected object";case ValueErrorType.ObjectAdditionalProperties:return"Unexpected property";case ValueErrorType.ObjectMaxProperties:return`Expected object to have no more than ${error3.schema.maxProperties} properties`;case ValueErrorType.ObjectMinProperties:return`Expected object to have at least ${error3.schema.minProperties} properties`;case ValueErrorType.ObjectRequiredProperty:return"Expected required property";case ValueErrorType.Promise:return"Expected Promise";case ValueErrorType.RegExp:return"Expected string to match regular expression";case ValueErrorType.StringFormatUnknown:return`Unknown format '${error3.schema.format}'`;case ValueErrorType.StringFormat:return`Expected string to match '${error3.schema.format}' format`;case ValueErrorType.StringMaxLength:return`Expected string length less or equal to ${error3.schema.maxLength}`;case ValueErrorType.StringMinLength:return`Expected string length greater or equal to ${error3.schema.minLength}`;case ValueErrorType.StringPattern:return`Expected string to match '${error3.schema.pattern}'`;case ValueErrorType.String:return"Expected string";case ValueErrorType.Symbol:return"Expected symbol";case ValueErrorType.TupleLength:return`Expected tuple to have ${error3.schema.maxItems||0} elements`;case ValueErrorType.Tuple:return"Expected tuple";case ValueErrorType.Uint8ArrayMaxByteLength:return`Expected byte length less or equal to ${error3.schema.maxByteLength}`;case ValueErrorType.Uint8ArrayMinByteLength:return`Expected byte length greater or equal to ${error3.schema.minByteLength}`;case ValueErrorType.Uint8Array:return"Expected Uint8Array";case ValueErrorType.Undefined:return"Expected undefined";case ValueErrorType.Union:return"Expected union value";case ValueErrorType.Void:return"Expected void";case ValueErrorType.Kind:return`Expected kind '${error3.schema[Kind]}'`;default:return"Unknown error type"}}var errorFunction=DefaultErrorFunction;function GetErrorFunction(){return errorFunction}init_error2();init_error2();init_symbols2();class TypeDereferenceError extends TypeBoxError{constructor(schema3){super(`Unable to dereference schema with $id '${schema3.$ref}'`);this.schema=schema3}}function Resolve(schema3,references){let target2=references.find((target3)=>target3.$id===schema3.$ref);if(target2===void 0)throw new TypeDereferenceError(schema3);return Deref(target2,references)}function Pushref(schema3,references){if(!IsString2(schema3.$id)||references.some((target2)=>target2.$id===schema3.$id))return references;return references.push(schema3),references}function Deref(schema3,references){return schema3[Kind]==="This"||schema3[Kind]==="Ref"?Resolve(schema3,references):schema3}init_guard();init_error2();class ValueHashError extends TypeBoxError{constructor(value2){super("Unable to hash value");this.value=value2}}var ByteMarker;(function(ByteMarker2){ByteMarker2[ByteMarker2.Undefined=0]="Undefined",ByteMarker2[ByteMarker2.Null=1]="Null",ByteMarker2[ByteMarker2.Boolean=2]="Boolean",ByteMarker2[ByteMarker2.Number=3]="Number",ByteMarker2[ByteMarker2.String=4]="String",ByteMarker2[ByteMarker2.Object=5]="Object",ByteMarker2[ByteMarker2.Array=6]="Array",ByteMarker2[ByteMarker2.Date=7]="Date",ByteMarker2[ByteMarker2.Uint8Array=8]="Uint8Array",ByteMarker2[ByteMarker2.Symbol=9]="Symbol",ByteMarker2[ByteMarker2.BigInt=10]="BigInt"})(ByteMarker||(ByteMarker={}));var Accumulator=BigInt("14695981039346656037"),[Prime,Size]=[BigInt("1099511628211"),BigInt("18446744073709551616")],Bytes=Array.from({length:256}).map((_,i)=>BigInt(i)),F64=new Float64Array(1),F64In=new DataView(F64.buffer),F64Out=new Uint8Array(F64.buffer);function*NumberToBytes(value2){let byteCount=value2===0?1:Math.ceil(Math.floor(Math.log2(value2)+1)/8);for(let i=0;i<byteCount;i++)yield value2>>8*(byteCount-1-i)&255}function ArrayType2(value2){FNV1A64(ByteMarker.Array);for(let item of value2)Visit4(item)}function BooleanType(value2){FNV1A64(ByteMarker.Boolean),FNV1A64(value2?1:0)}function BigIntType(value2){FNV1A64(ByteMarker.BigInt),F64In.setBigInt64(0,value2);for(let byte of F64Out)FNV1A64(byte)}function DateType2(value2){FNV1A64(ByteMarker.Date),Visit4(value2.getTime())}function NullType(value2){FNV1A64(ByteMarker.Null)}function NumberType(value2){FNV1A64(ByteMarker.Number),F64In.setFloat64(0,value2);for(let byte of F64Out)FNV1A64(byte)}function ObjectType2(value2){FNV1A64(ByteMarker.Object);for(let key2 of globalThis.Object.getOwnPropertyNames(value2).sort())Visit4(key2),Visit4(value2[key2])}function StringType(value2){FNV1A64(ByteMarker.String);for(let i=0;i<value2.length;i++)for(let byte of NumberToBytes(value2.charCodeAt(i)))FNV1A64(byte)}function SymbolType(value2){FNV1A64(ByteMarker.Symbol),Visit4(value2.description)}function Uint8ArrayType2(value2){FNV1A64(ByteMarker.Uint8Array);for(let i=0;i<value2.length;i++)FNV1A64(value2[i])}function UndefinedType(value2){return FNV1A64(ByteMarker.Undefined)}function Visit4(value2){if(IsArray2(value2))return ArrayType2(value2);if(IsBoolean2(value2))return BooleanType(value2);if(IsBigInt2(value2))return BigIntType(value2);if(IsDate2(value2))return DateType2(value2);if(IsNull2(value2))return NullType(value2);if(IsNumber2(value2))return NumberType(value2);if(IsObject2(value2))return ObjectType2(value2);if(IsString2(value2))return StringType(value2);if(IsSymbol2(value2))return SymbolType(value2);if(IsUint8Array2(value2))return Uint8ArrayType2(value2);if(IsUndefined2(value2))return UndefinedType(value2);throw new ValueHashError(value2)}function FNV1A64(byte){Accumulator=Accumulator^Bytes[byte],Accumulator=Accumulator*Prime%Size}function Hash(value2){return Accumulator=BigInt("14695981039346656037"),Visit4(value2),Accumulator}init_symbols2();init_keyof2();init_extends2();init_registry4();init_error2();init_never2();init_guard();init_kind();class ValueCheckUnknownTypeError extends TypeBoxError{constructor(schema3){super("Unknown type");this.schema=schema3}}function IsAnyOrUnknown(schema3){return schema3[Kind]==="Any"||schema3[Kind]==="Unknown"}function IsDefined(value2){return value2!==void 0}function FromAny2(schema3,references,value2){return!0}function FromArgument2(schema3,references,value2){return!0}function FromArray7(schema3,references,value2){if(!IsArray2(value2))return!1;if(IsDefined(schema3.minItems)&&!(value2.length>=schema3.minItems))return!1;if(IsDefined(schema3.maxItems)&&!(value2.length<=schema3.maxItems))return!1;if(!value2.every((value3)=>Visit5(schema3.items,references,value3)))return!1;if(schema3.uniqueItems===!0&&!function(){let set2=new Set;for(let element of value2){let hashed=Hash(element);if(set2.has(hashed))return!1;else set2.add(hashed)}return!0}())return!1;if(!(IsDefined(schema3.contains)||IsNumber2(schema3.minContains)||IsNumber2(schema3.maxContains)))return!0;let containsSchema=IsDefined(schema3.contains)?schema3.contains:Never(),containsCount=value2.reduce((acc,value3)=>Visit5(containsSchema,references,value3)?acc+1:acc,0);if(containsCount===0)return!1;if(IsNumber2(schema3.minContains)&&containsCount<schema3.minContains)return!1;if(IsNumber2(schema3.maxContains)&&containsCount>schema3.maxContains)return!1;return!0}function FromAsyncIterator4(schema3,references,value2){return IsAsyncIterator2(value2)}function FromBigInt2(schema3,references,value2){if(!IsBigInt2(value2))return!1;if(IsDefined(schema3.exclusiveMaximum)&&!(value2<schema3.exclusiveMaximum))return!1;if(IsDefined(schema3.exclusiveMinimum)&&!(value2>schema3.exclusiveMinimum))return!1;if(IsDefined(schema3.maximum)&&!(value2<=schema3.maximum))return!1;if(IsDefined(schema3.minimum)&&!(value2>=schema3.minimum))return!1;if(IsDefined(schema3.multipleOf)&&value2%schema3.multipleOf!==BigInt(0))return!1;return!0}function FromBoolean2(schema3,references,value2){return IsBoolean2(value2)}function FromConstructor4(schema3,references,value2){return Visit5(schema3.returns,references,value2.prototype)}function FromDate2(schema3,references,value2){if(!IsDate2(value2))return!1;if(IsDefined(schema3.exclusiveMaximumTimestamp)&&!(value2.getTime()<schema3.exclusiveMaximumTimestamp))return!1;if(IsDefined(schema3.exclusiveMinimumTimestamp)&&!(value2.getTime()>schema3.exclusiveMinimumTimestamp))return!1;if(IsDefined(schema3.maximumTimestamp)&&!(value2.getTime()<=schema3.maximumTimestamp))return!1;if(IsDefined(schema3.minimumTimestamp)&&!(value2.getTime()>=schema3.minimumTimestamp))return!1;if(IsDefined(schema3.multipleOfTimestamp)&&value2.getTime()%schema3.multipleOfTimestamp!==0)return!1;return!0}function FromFunction4(schema3,references,value2){return IsFunction2(value2)}function FromImport(schema3,references,value2){let definitions=globalThis.Object.values(schema3.$defs),target2=schema3.$defs[schema3.$ref];return Visit5(target2,[...references,...definitions],value2)}function FromInteger2(schema3,references,value2){if(!IsInteger(value2))return!1;if(IsDefined(schema3.exclusiveMaximum)&&!(value2<schema3.exclusiveMaximum))return!1;if(IsDefined(schema3.exclusiveMinimum)&&!(value2>schema3.exclusiveMinimum))return!1;if(IsDefined(schema3.maximum)&&!(value2<=schema3.maximum))return!1;if(IsDefined(schema3.minimum)&&!(value2>=schema3.minimum))return!1;if(IsDefined(schema3.multipleOf)&&value2%schema3.multipleOf!==0)return!1;return!0}function FromIntersect9(schema3,references,value2){let check1=schema3.allOf.every((schema4)=>Visit5(schema4,references,value2));if(schema3.unevaluatedProperties===!1){let keyPattern=new RegExp(KeyOfPattern(schema3)),check2=Object.getOwnPropertyNames(value2).every((key2)=>keyPattern.test(key2));return check1&&check2}else if(IsSchema(schema3.unevaluatedProperties)){let keyCheck=new RegExp(KeyOfPattern(schema3)),check2=Object.getOwnPropertyNames(value2).every((key2)=>keyCheck.test(key2)||Visit5(schema3.unevaluatedProperties,references,value2[key2]));return check1&&check2}else return check1}function FromIterator4(schema3,references,value2){return IsIterator2(value2)}function FromLiteral3(schema3,references,value2){return value2===schema3.const}function FromNever2(schema3,references,value2){return!1}function FromNot2(schema3,references,value2){return!Visit5(schema3.not,references,value2)}function FromNull2(schema3,references,value2){return IsNull2(value2)}function FromNumber2(schema3,references,value2){if(!TypeSystemPolicy.IsNumberLike(value2))return!1;if(IsDefined(schema3.exclusiveMaximum)&&!(value2<schema3.exclusiveMaximum))return!1;if(IsDefined(schema3.exclusiveMinimum)&&!(value2>schema3.exclusiveMinimum))return!1;if(IsDefined(schema3.minimum)&&!(value2>=schema3.minimum))return!1;if(IsDefined(schema3.maximum)&&!(value2<=schema3.maximum))return!1;if(IsDefined(schema3.multipleOf)&&value2%schema3.multipleOf!==0)return!1;return!0}function FromObject8(schema3,references,value2){if(!TypeSystemPolicy.IsObjectLike(value2))return!1;if(IsDefined(schema3.minProperties)&&!(Object.getOwnPropertyNames(value2).length>=schema3.minProperties))return!1;if(IsDefined(schema3.maxProperties)&&!(Object.getOwnPropertyNames(value2).length<=schema3.maxProperties))return!1;let knownKeys=Object.getOwnPropertyNames(schema3.properties);for(let knownKey of knownKeys){let property=schema3.properties[knownKey];if(schema3.required&&schema3.required.includes(knownKey)){if(!Visit5(property,references,value2[knownKey]))return!1;if((ExtendsUndefinedCheck(property)||IsAnyOrUnknown(property))&&!(knownKey in value2))return!1}else if(TypeSystemPolicy.IsExactOptionalProperty(value2,knownKey)&&!Visit5(property,references,value2[knownKey]))return!1}if(schema3.additionalProperties===!1){let valueKeys=Object.getOwnPropertyNames(value2);if(schema3.required&&schema3.required.length===knownKeys.length&&valueKeys.length===knownKeys.length)return!0;else return valueKeys.every((valueKey)=>knownKeys.includes(valueKey))}else if(typeof schema3.additionalProperties==="object")return Object.getOwnPropertyNames(value2).every((key2)=>knownKeys.includes(key2)||Visit5(schema3.additionalProperties,references,value2[key2]));else return!0}function FromPromise4(schema3,references,value2){return IsPromise(value2)}function FromRecord4(schema3,references,value2){if(!TypeSystemPolicy.IsRecordLike(value2))return!1;if(IsDefined(schema3.minProperties)&&!(Object.getOwnPropertyNames(value2).length>=schema3.minProperties))return!1;if(IsDefined(schema3.maxProperties)&&!(Object.getOwnPropertyNames(value2).length<=schema3.maxProperties))return!1;let[patternKey,patternSchema]=Object.entries(schema3.patternProperties)[0],regex=new RegExp(patternKey),check1=Object.entries(value2).every(([key2,value3])=>{return regex.test(key2)?Visit5(patternSchema,references,value3):!0}),check2=typeof schema3.additionalProperties==="object"?Object.entries(value2).every(([key2,value3])=>{return!regex.test(key2)?Visit5(schema3.additionalProperties,references,value3):!0}):!0,check3=schema3.additionalProperties===!1?Object.getOwnPropertyNames(value2).every((key2)=>{return regex.test(key2)}):!0;return check1&&check2&&check3}function FromRef5(schema3,references,value2){return Visit5(Deref(schema3,references),references,value2)}function FromRegExp2(schema3,references,value2){let regex=new RegExp(schema3.source,schema3.flags);if(IsDefined(schema3.minLength)){if(!(value2.length>=schema3.minLength))return!1}if(IsDefined(schema3.maxLength)){if(!(value2.length<=schema3.maxLength))return!1}return regex.test(value2)}function FromString2(schema3,references,value2){if(!IsString2(value2))return!1;if(IsDefined(schema3.minLength)){if(!(value2.length>=schema3.minLength))return!1}if(IsDefined(schema3.maxLength)){if(!(value2.length<=schema3.maxLength))return!1}if(IsDefined(schema3.pattern)){if(!new RegExp(schema3.pattern).test(value2))return!1}if(IsDefined(schema3.format)){if(!exports_format.Has(schema3.format))return!1;return exports_format.Get(schema3.format)(value2)}return!0}function FromSymbol2(schema3,references,value2){return IsSymbol2(value2)}function FromTemplateLiteral4(schema3,references,value2){return IsString2(value2)&&new RegExp(schema3.pattern).test(value2)}function FromThis(schema3,references,value2){return Visit5(Deref(schema3,references),references,value2)}function FromTuple6(schema3,references,value2){if(!IsArray2(value2))return!1;if(schema3.items===void 0&&value2.length!==0)return!1;if(value2.length!==schema3.maxItems)return!1;if(!schema3.items)return!0;for(let i=0;i<schema3.items.length;i++)if(!Visit5(schema3.items[i],references,value2[i]))return!1;return!0}function FromUndefined2(schema3,references,value2){return IsUndefined2(value2)}function FromUnion11(schema3,references,value2){return schema3.anyOf.some((inner)=>Visit5(inner,references,value2))}function FromUint8Array2(schema3,references,value2){if(!IsUint8Array2(value2))return!1;if(IsDefined(schema3.maxByteLength)&&!(value2.length<=schema3.maxByteLength))return!1;if(IsDefined(schema3.minByteLength)&&!(value2.length>=schema3.minByteLength))return!1;return!0}function FromUnknown2(schema3,references,value2){return!0}function FromVoid2(schema3,references,value2){return TypeSystemPolicy.IsVoidLike(value2)}function FromKind(schema3,references,value2){if(!exports_type2.Has(schema3[Kind]))return!1;return exports_type2.Get(schema3[Kind])(schema3,value2)}function Visit5(schema3,references,value2){let references_=IsDefined(schema3.$id)?Pushref(schema3,references):references,schema_=schema3;switch(schema_[Kind]){case"Any":return FromAny2(schema_,references_,value2);case"Argument":return FromArgument2(schema_,references_,value2);case"Array":return FromArray7(schema_,references_,value2);case"AsyncIterator":return FromAsyncIterator4(schema_,references_,value2);case"BigInt":return FromBigInt2(schema_,references_,value2);case"Boolean":return FromBoolean2(schema_,references_,value2);case"Constructor":return FromConstructor4(schema_,references_,value2);case"Date":return FromDate2(schema_,references_,value2);case"Function":return FromFunction4(schema_,references_,value2);case"Import":return FromImport(schema_,references_,value2);case"Integer":return FromInteger2(schema_,references_,value2);case"Intersect":return FromIntersect9(schema_,references_,value2);case"Iterator":return FromIterator4(schema_,references_,value2);case"Literal":return FromLiteral3(schema_,references_,value2);case"Never":return FromNever2(schema_,references_,value2);case"Not":return FromNot2(schema_,references_,value2);case"Null":return FromNull2(schema_,references_,value2);case"Number":return FromNumber2(schema_,references_,value2);case"Object":return FromObject8(schema_,references_,value2);case"Promise":return FromPromise4(schema_,references_,value2);case"Record":return FromRecord4(schema_,references_,value2);case"Ref":return FromRef5(schema_,references_,value2);case"RegExp":return FromRegExp2(schema_,references_,value2);case"String":return FromString2(schema_,references_,value2);case"Symbol":return FromSymbol2(schema_,references_,value2);case"TemplateLiteral":return FromTemplateLiteral4(schema_,references_,value2);case"This":return FromThis(schema_,references_,value2);case"Tuple":return FromTuple6(schema_,references_,value2);case"Undefined":return FromUndefined2(schema_,references_,value2);case"Union":return FromUnion11(schema_,references_,value2);case"Uint8Array":return FromUint8Array2(schema_,references_,value2);case"Unknown":return FromUnknown2(schema_,references_,value2);case"Void":return FromVoid2(schema_,references_,value2);default:if(!exports_type2.Has(schema_[Kind]))throw new ValueCheckUnknownTypeError(schema_);return FromKind(schema_,references_,value2)}}function Check(...args){return args.length===3?Visit5(args[0],args[1],args[2]):Visit5(args[0],[],args[1])}init_symbols2();init_never2();init_guard();var ValueErrorType;(function(ValueErrorType2){ValueErrorType2[ValueErrorType2.ArrayContains=0]="ArrayContains",ValueErrorType2[ValueErrorType2.ArrayMaxContains=1]="ArrayMaxContains",ValueErrorType2[ValueErrorType2.ArrayMaxItems=2]="ArrayMaxItems",ValueErrorType2[ValueErrorType2.ArrayMinContains=3]="ArrayMinContains",ValueErrorType2[ValueErrorType2.ArrayMinItems=4]="ArrayMinItems",ValueErrorType2[ValueErrorType2.ArrayUniqueItems=5]="ArrayUniqueItems",ValueErrorType2[ValueErrorType2.Array=6]="Array",ValueErrorType2[ValueErrorType2.AsyncIterator=7]="AsyncIterator",ValueErrorType2[ValueErrorType2.BigIntExclusiveMaximum=8]="BigIntExclusiveMaximum",ValueErrorType2[ValueErrorType2.BigIntExclusiveMinimum=9]="BigIntExclusiveMinimum",ValueErrorType2[ValueErrorType2.BigIntMaximum=10]="BigIntMaximum",ValueErrorType2[ValueErrorType2.BigIntMinimum=11]="BigIntMinimum",ValueErrorType2[ValueErrorType2.BigIntMultipleOf=12]="BigIntMultipleOf",ValueErrorType2[ValueErrorType2.BigInt=13]="BigInt",ValueErrorType2[ValueErrorType2.Boolean=14]="Boolean",ValueErrorType2[ValueErrorType2.DateExclusiveMaximumTimestamp=15]="DateExclusiveMaximumTimestamp",ValueErrorType2[ValueErrorType2.DateExclusiveMinimumTimestamp=16]="DateExclusiveMinimumTimestamp",ValueErrorType2[ValueErrorType2.DateMaximumTimestamp=17]="DateMaximumTimestamp",ValueErrorType2[ValueErrorType2.DateMinimumTimestamp=18]="DateMinimumTimestamp",ValueErrorType2[ValueErrorType2.DateMultipleOfTimestamp=19]="DateMultipleOfTimestamp",ValueErrorType2[ValueErrorType2.Date=20]="Date",ValueErrorType2[ValueErrorType2.Function=21]="Function",ValueErrorType2[ValueErrorType2.IntegerExclusiveMaximum=22]="IntegerExclusiveMaximum",ValueErrorType2[ValueErrorType2.IntegerExclusiveMinimum=23]="IntegerExclusiveMinimum",ValueErrorType2[ValueErrorType2.IntegerMaximum=24]="IntegerMaximum",ValueErrorType2[ValueErrorType2.IntegerMinimum=25]="IntegerMinimum",ValueErrorType2[ValueErrorType2.IntegerMultipleOf=26]="IntegerMultipleOf",ValueErrorType2[ValueErrorType2.Integer=27]="Integer",ValueErrorType2[ValueErrorType2.IntersectUnevaluatedProperties=28]="IntersectUnevaluatedProperties",ValueErrorType2[ValueErrorType2.Intersect=29]="Intersect",ValueErrorType2[ValueErrorType2.Iterator=30]="Iterator",ValueErrorType2[ValueErrorType2.Kind=31]="Kind",ValueErrorType2[ValueErrorType2.Literal=32]="Literal",ValueErrorType2[ValueErrorType2.Never=33]="Never",ValueErrorType2[ValueErrorType2.Not=34]="Not",ValueErrorType2[ValueErrorType2.Null=35]="Null",ValueErrorType2[ValueErrorType2.NumberExclusiveMaximum=36]="NumberExclusiveMaximum",ValueErrorType2[ValueErrorType2.NumberExclusiveMinimum=37]="NumberExclusiveMinimum",ValueErrorType2[ValueErrorType2.NumberMaximum=38]="NumberMaximum",ValueErrorType2[ValueErrorType2.NumberMinimum=39]="NumberMinimum",ValueErrorType2[ValueErrorType2.NumberMultipleOf=40]="NumberMultipleOf",ValueErrorType2[ValueErrorType2.Number=41]="Number",ValueErrorType2[ValueErrorType2.ObjectAdditionalProperties=42]="ObjectAdditionalProperties",ValueErrorType2[ValueErrorType2.ObjectMaxProperties=43]="ObjectMaxProperties",ValueErrorType2[ValueErrorType2.ObjectMinProperties=44]="ObjectMinProperties",ValueErrorType2[ValueErrorType2.ObjectRequiredProperty=45]="ObjectRequiredProperty",ValueErrorType2[ValueErrorType2.Object=46]="Object",ValueErrorType2[ValueErrorType2.Promise=47]="Promise",ValueErrorType2[ValueErrorType2.RegExp=48]="RegExp",ValueErrorType2[ValueErrorType2.StringFormatUnknown=49]="StringFormatUnknown",ValueErrorType2[ValueErrorType2.StringFormat=50]="StringFormat",ValueErrorType2[ValueErrorType2.StringMaxLength=51]="StringMaxLength",ValueErrorType2[ValueErrorType2.StringMinLength=52]="StringMinLength",ValueErrorType2[ValueErrorType2.StringPattern=53]="StringPattern",ValueErrorType2[ValueErrorType2.String=54]="String",ValueErrorType2[ValueErrorType2.Symbol=55]="Symbol",ValueErrorType2[ValueErrorType2.TupleLength=56]="TupleLength",ValueErrorType2[ValueErrorType2.Tuple=57]="Tuple",ValueErrorType2[ValueErrorType2.Uint8ArrayMaxByteLength=58]="Uint8ArrayMaxByteLength",ValueErrorType2[ValueErrorType2.Uint8ArrayMinByteLength=59]="Uint8ArrayMinByteLength",ValueErrorType2[ValueErrorType2.Uint8Array=60]="Uint8Array",ValueErrorType2[ValueErrorType2.Undefined=61]="Undefined",ValueErrorType2[ValueErrorType2.Union=62]="Union",ValueErrorType2[ValueErrorType2.Void=63]="Void"})(ValueErrorType||(ValueErrorType={}));class ValueErrorsUnknownTypeError extends TypeBoxError{constructor(schema3){super("Unknown type");this.schema=schema3}}function EscapeKey(key2){return key2.replace(/~/g,"~0").replace(/\//g,"~1")}function IsDefined2(value2){return value2!==void 0}class ValueErrorIterator{constructor(iterator3){this.iterator=iterator3}[Symbol.iterator](){return this.iterator}First(){let next=this.iterator.next();return next.done?void 0:next.value}}function Create(errorType,schema3,path8,value2,errors2=[]){return{type:errorType,schema:schema3,path:path8,value:value2,message:GetErrorFunction()({errorType,path:path8,schema:schema3,value:value2,errors:errors2}),errors:errors2}}function*FromAny3(schema3,references,path8,value2){}function*FromArgument3(schema3,references,path8,value2){}function*FromArray8(schema3,references,path8,value2){if(!IsArray2(value2))return yield Create(ValueErrorType.Array,schema3,path8,value2);if(IsDefined2(schema3.minItems)&&!(value2.length>=schema3.minItems))yield Create(ValueErrorType.ArrayMinItems,schema3,path8,value2);if(IsDefined2(schema3.maxItems)&&!(value2.length<=schema3.maxItems))yield Create(ValueErrorType.ArrayMaxItems,schema3,path8,value2);for(let i=0;i<value2.length;i++)yield*Visit6(schema3.items,references,`${path8}/${i}`,value2[i]);if(schema3.uniqueItems===!0&&!function(){let set2=new Set;for(let element of value2){let hashed=Hash(element);if(set2.has(hashed))return!1;else set2.add(hashed)}return!0}())yield Create(ValueErrorType.ArrayUniqueItems,schema3,path8,value2);if(!(IsDefined2(schema3.contains)||IsDefined2(schema3.minContains)||IsDefined2(schema3.maxContains)))return;let containsSchema=IsDefined2(schema3.contains)?schema3.contains:Never(),containsCount=value2.reduce((acc,value3,index)=>Visit6(containsSchema,references,`${path8}${index}`,value3).next().done===!0?acc+1:acc,0);if(containsCount===0)yield Create(ValueErrorType.ArrayContains,schema3,path8,value2);if(IsNumber2(schema3.minContains)&&containsCount<schema3.minContains)yield Create(ValueErrorType.ArrayMinContains,schema3,path8,value2);if(IsNumber2(schema3.maxContains)&&containsCount>schema3.maxContains)yield Create(ValueErrorType.ArrayMaxContains,schema3,path8,value2)}function*FromAsyncIterator5(schema3,references,path8,value2){if(!IsAsyncIterator2(value2))yield Create(ValueErrorType.AsyncIterator,schema3,path8,value2)}function*FromBigInt3(schema3,references,path8,value2){if(!IsBigInt2(value2))return yield Create(ValueErrorType.BigInt,schema3,path8,value2);if(IsDefined2(schema3.exclusiveMaximum)&&!(value2<schema3.exclusiveMaximum))yield Create(ValueErrorType.BigIntExclusiveMaximum,schema3,path8,value2);if(IsDefined2(schema3.exclusiveMinimum)&&!(value2>schema3.exclusiveMinimum))yield Create(ValueErrorType.BigIntExclusiveMinimum,schema3,path8,value2);if(IsDefined2(schema3.maximum)&&!(value2<=schema3.maximum))yield Create(ValueErrorType.BigIntMaximum,schema3,path8,value2);if(IsDefined2(schema3.minimum)&&!(value2>=schema3.minimum))yield Create(ValueErrorType.BigIntMinimum,schema3,path8,value2);if(IsDefined2(schema3.multipleOf)&&value2%schema3.multipleOf!==BigInt(0))yield Create(ValueErrorType.BigIntMultipleOf,schema3,path8,value2)}function*FromBoolean3(schema3,references,path8,value2){if(!IsBoolean2(value2))yield Create(ValueErrorType.Boolean,schema3,path8,value2)}function*FromConstructor5(schema3,references,path8,value2){yield*Visit6(schema3.returns,references,path8,value2.prototype)}function*FromDate3(schema3,references,path8,value2){if(!IsDate2(value2))return yield Create(ValueErrorType.Date,schema3,path8,value2);if(IsDefined2(schema3.exclusiveMaximumTimestamp)&&!(value2.getTime()<schema3.exclusiveMaximumTimestamp))yield Create(ValueErrorType.DateExclusiveMaximumTimestamp,schema3,path8,value2);if(IsDefined2(schema3.exclusiveMinimumTimestamp)&&!(value2.getTime()>schema3.exclusiveMinimumTimestamp))yield Create(ValueErrorType.DateExclusiveMinimumTimestamp,schema3,path8,value2);if(IsDefined2(schema3.maximumTimestamp)&&!(value2.getTime()<=schema3.maximumTimestamp))yield Create(ValueErrorType.DateMaximumTimestamp,schema3,path8,value2);if(IsDefined2(schema3.minimumTimestamp)&&!(value2.getTime()>=schema3.minimumTimestamp))yield Create(ValueErrorType.DateMinimumTimestamp,schema3,path8,value2);if(IsDefined2(schema3.multipleOfTimestamp)&&value2.getTime()%schema3.multipleOfTimestamp!==0)yield Create(ValueErrorType.DateMultipleOfTimestamp,schema3,path8,value2)}function*FromFunction5(schema3,references,path8,value2){if(!IsFunction2(value2))yield Create(ValueErrorType.Function,schema3,path8,value2)}function*FromImport2(schema3,references,path8,value2){let definitions=globalThis.Object.values(schema3.$defs),target2=schema3.$defs[schema3.$ref];yield*Visit6(target2,[...references,...definitions],path8,value2)}function*FromInteger3(schema3,references,path8,value2){if(!IsInteger(value2))return yield Create(ValueErrorType.Integer,schema3,path8,value2);if(IsDefined2(schema3.exclusiveMaximum)&&!(value2<schema3.exclusiveMaximum))yield Create(ValueErrorType.IntegerExclusiveMaximum,schema3,path8,value2);if(IsDefined2(schema3.exclusiveMinimum)&&!(value2>schema3.exclusiveMinimum))yield Create(ValueErrorType.IntegerExclusiveMinimum,schema3,path8,value2);if(IsDefined2(schema3.maximum)&&!(value2<=schema3.maximum))yield Create(ValueErrorType.IntegerMaximum,schema3,path8,value2);if(IsDefined2(schema3.minimum)&&!(value2>=schema3.minimum))yield Create(ValueErrorType.IntegerMinimum,schema3,path8,value2);if(IsDefined2(schema3.multipleOf)&&value2%schema3.multipleOf!==0)yield Create(ValueErrorType.IntegerMultipleOf,schema3,path8,value2)}function*FromIntersect10(schema3,references,path8,value2){let hasError=!1;for(let inner of schema3.allOf)for(let error3 of Visit6(inner,references,path8,value2))hasError=!0,yield error3;if(hasError)return yield Create(ValueErrorType.Intersect,schema3,path8,value2);if(schema3.unevaluatedProperties===!1){let keyCheck=new RegExp(KeyOfPattern(schema3));for(let valueKey of Object.getOwnPropertyNames(value2))if(!keyCheck.test(valueKey))yield Create(ValueErrorType.IntersectUnevaluatedProperties,schema3,`${path8}/${valueKey}`,value2)}if(typeof schema3.unevaluatedProperties==="object"){let keyCheck=new RegExp(KeyOfPattern(schema3));for(let valueKey of Object.getOwnPropertyNames(value2))if(!keyCheck.test(valueKey)){let next=Visit6(schema3.unevaluatedProperties,references,`${path8}/${valueKey}`,value2[valueKey]).next();if(!next.done)yield next.value}}}function*FromIterator5(schema3,references,path8,value2){if(!IsIterator2(value2))yield Create(ValueErrorType.Iterator,schema3,path8,value2)}function*FromLiteral4(schema3,references,path8,value2){if(value2!==schema3.const)yield Create(ValueErrorType.Literal,schema3,path8,value2)}function*FromNever3(schema3,references,path8,value2){yield Create(ValueErrorType.Never,schema3,path8,value2)}function*FromNot3(schema3,references,path8,value2){if(Visit6(schema3.not,references,path8,value2).next().done===!0)yield Create(ValueErrorType.Not,schema3,path8,value2)}function*FromNull3(schema3,references,path8,value2){if(!IsNull2(value2))yield Create(ValueErrorType.Null,schema3,path8,value2)}function*FromNumber3(schema3,references,path8,value2){if(!TypeSystemPolicy.IsNumberLike(value2))return yield Create(ValueErrorType.Number,schema3,path8,value2);if(IsDefined2(schema3.exclusiveMaximum)&&!(value2<schema3.exclusiveMaximum))yield Create(ValueErrorType.NumberExclusiveMaximum,schema3,path8,value2);if(IsDefined2(schema3.exclusiveMinimum)&&!(value2>schema3.exclusiveMinimum))yield Create(ValueErrorType.NumberExclusiveMinimum,schema3,path8,value2);if(IsDefined2(schema3.maximum)&&!(value2<=schema3.maximum))yield Create(ValueErrorType.NumberMaximum,schema3,path8,value2);if(IsDefined2(schema3.minimum)&&!(value2>=schema3.minimum))yield Create(ValueErrorType.NumberMinimum,schema3,path8,value2);if(IsDefined2(schema3.multipleOf)&&value2%schema3.multipleOf!==0)yield Create(ValueErrorType.NumberMultipleOf,schema3,path8,value2)}function*FromObject9(schema3,references,path8,value2){if(!TypeSystemPolicy.IsObjectLike(value2))return yield Create(ValueErrorType.Object,schema3,path8,value2);if(IsDefined2(schema3.minProperties)&&!(Object.getOwnPropertyNames(value2).length>=schema3.minProperties))yield Create(ValueErrorType.ObjectMinProperties,schema3,path8,value2);if(IsDefined2(schema3.maxProperties)&&!(Object.getOwnPropertyNames(value2).length<=schema3.maxProperties))yield Create(ValueErrorType.ObjectMaxProperties,schema3,path8,value2);let requiredKeys=Array.isArray(schema3.required)?schema3.required:[],knownKeys=Object.getOwnPropertyNames(schema3.properties),unknownKeys=Object.getOwnPropertyNames(value2);for(let requiredKey of requiredKeys){if(unknownKeys.includes(requiredKey))continue;yield Create(ValueErrorType.ObjectRequiredProperty,schema3.properties[requiredKey],`${path8}/${EscapeKey(requiredKey)}`,void 0)}if(schema3.additionalProperties===!1){for(let valueKey of unknownKeys)if(!knownKeys.includes(valueKey))yield Create(ValueErrorType.ObjectAdditionalProperties,schema3,`${path8}/${EscapeKey(valueKey)}`,value2[valueKey])}if(typeof schema3.additionalProperties==="object")for(let valueKey of unknownKeys){if(knownKeys.includes(valueKey))continue;yield*Visit6(schema3.additionalProperties,references,`${path8}/${EscapeKey(valueKey)}`,value2[valueKey])}for(let knownKey of knownKeys){let property=schema3.properties[knownKey];if(schema3.required&&schema3.required.includes(knownKey)){if(yield*Visit6(property,references,`${path8}/${EscapeKey(knownKey)}`,value2[knownKey]),ExtendsUndefinedCheck(schema3)&&!(knownKey in value2))yield Create(ValueErrorType.ObjectRequiredProperty,property,`${path8}/${EscapeKey(knownKey)}`,void 0)}else if(TypeSystemPolicy.IsExactOptionalProperty(value2,knownKey))yield*Visit6(property,references,`${path8}/${EscapeKey(knownKey)}`,value2[knownKey])}}function*FromPromise5(schema3,references,path8,value2){if(!IsPromise(value2))yield Create(ValueErrorType.Promise,schema3,path8,value2)}function*FromRecord5(schema3,references,path8,value2){if(!TypeSystemPolicy.IsRecordLike(value2))return yield Create(ValueErrorType.Object,schema3,path8,value2);if(IsDefined2(schema3.minProperties)&&!(Object.getOwnPropertyNames(value2).length>=schema3.minProperties))yield Create(ValueErrorType.ObjectMinProperties,schema3,path8,value2);if(IsDefined2(schema3.maxProperties)&&!(Object.getOwnPropertyNames(value2).length<=schema3.maxProperties))yield Create(ValueErrorType.ObjectMaxProperties,schema3,path8,value2);let[patternKey,patternSchema]=Object.entries(schema3.patternProperties)[0],regex=new RegExp(patternKey);for(let[propertyKey,propertyValue]of Object.entries(value2))if(regex.test(propertyKey))yield*Visit6(patternSchema,references,`${path8}/${EscapeKey(propertyKey)}`,propertyValue);if(typeof schema3.additionalProperties==="object"){for(let[propertyKey,propertyValue]of Object.entries(value2))if(!regex.test(propertyKey))yield*Visit6(schema3.additionalProperties,references,`${path8}/${EscapeKey(propertyKey)}`,propertyValue)}if(schema3.additionalProperties===!1)for(let[propertyKey,propertyValue]of Object.entries(value2)){if(regex.test(propertyKey))continue;return yield Create(ValueErrorType.ObjectAdditionalProperties,schema3,`${path8}/${EscapeKey(propertyKey)}`,propertyValue)}}function*FromRef6(schema3,references,path8,value2){yield*Visit6(Deref(schema3,references),references,path8,value2)}function*FromRegExp3(schema3,references,path8,value2){if(!IsString2(value2))return yield Create(ValueErrorType.String,schema3,path8,value2);if(IsDefined2(schema3.minLength)&&!(value2.length>=schema3.minLength))yield Create(ValueErrorType.StringMinLength,schema3,path8,value2);if(IsDefined2(schema3.maxLength)&&!(value2.length<=schema3.maxLength))yield Create(ValueErrorType.StringMaxLength,schema3,path8,value2);if(!new RegExp(schema3.source,schema3.flags).test(value2))return yield Create(ValueErrorType.RegExp,schema3,path8,value2)}function*FromString3(schema3,references,path8,value2){if(!IsString2(value2))return yield Create(ValueErrorType.String,schema3,path8,value2);if(IsDefined2(schema3.minLength)&&!(value2.length>=schema3.minLength))yield Create(ValueErrorType.StringMinLength,schema3,path8,value2);if(IsDefined2(schema3.maxLength)&&!(value2.length<=schema3.maxLength))yield Create(ValueErrorType.StringMaxLength,schema3,path8,value2);if(IsString2(schema3.pattern)){if(!new RegExp(schema3.pattern).test(value2))yield Create(ValueErrorType.StringPattern,schema3,path8,value2)}if(IsString2(schema3.format)){if(!exports_format.Has(schema3.format))yield Create(ValueErrorType.StringFormatUnknown,schema3,path8,value2);else if(!exports_format.Get(schema3.format)(value2))yield Create(ValueErrorType.StringFormat,schema3,path8,value2)}}function*FromSymbol3(schema3,references,path8,value2){if(!IsSymbol2(value2))yield Create(ValueErrorType.Symbol,schema3,path8,value2)}function*FromTemplateLiteral5(schema3,references,path8,value2){if(!IsString2(value2))return yield Create(ValueErrorType.String,schema3,path8,value2);if(!new RegExp(schema3.pattern).test(value2))yield Create(ValueErrorType.StringPattern,schema3,path8,value2)}function*FromThis2(schema3,references,path8,value2){yield*Visit6(Deref(schema3,references),references,path8,value2)}function*FromTuple7(schema3,references,path8,value2){if(!IsArray2(value2))return yield Create(ValueErrorType.Tuple,schema3,path8,value2);if(schema3.items===void 0&&value2.length!==0)return yield Create(ValueErrorType.TupleLength,schema3,path8,value2);if(value2.length!==schema3.maxItems)return yield Create(ValueErrorType.TupleLength,schema3,path8,value2);if(!schema3.items)return;for(let i=0;i<schema3.items.length;i++)yield*Visit6(schema3.items[i],references,`${path8}/${i}`,value2[i])}function*FromUndefined3(schema3,references,path8,value2){if(!IsUndefined2(value2))yield Create(ValueErrorType.Undefined,schema3,path8,value2)}function*FromUnion12(schema3,references,path8,value2){if(Check(schema3,references,value2))return;let errors2=schema3.anyOf.map((variant)=>new ValueErrorIterator(Visit6(variant,references,path8,value2)));yield Create(ValueErrorType.Union,schema3,path8,value2,errors2)}function*FromUint8Array3(schema3,references,path8,value2){if(!IsUint8Array2(value2))return yield Create(ValueErrorType.Uint8Array,schema3,path8,value2);if(IsDefined2(schema3.maxByteLength)&&!(value2.length<=schema3.maxByteLength))yield Create(ValueErrorType.Uint8ArrayMaxByteLength,schema3,path8,value2);if(IsDefined2(schema3.minByteLength)&&!(value2.length>=schema3.minByteLength))yield Create(ValueErrorType.Uint8ArrayMinByteLength,schema3,path8,value2)}function*FromUnknown3(schema3,references,path8,value2){}function*FromVoid3(schema3,references,path8,value2){if(!TypeSystemPolicy.IsVoidLike(value2))yield Create(ValueErrorType.Void,schema3,path8,value2)}function*FromKind2(schema3,references,path8,value2){if(!exports_type2.Get(schema3[Kind])(schema3,value2))yield Create(ValueErrorType.Kind,schema3,path8,value2)}function*Visit6(schema3,references,path8,value2){let references_=IsDefined2(schema3.$id)?[...references,schema3]:references,schema_=schema3;switch(schema_[Kind]){case"Any":return yield*FromAny3(schema_,references_,path8,value2);case"Argument":return yield*FromArgument3(schema_,references_,path8,value2);case"Array":return yield*FromArray8(schema_,references_,path8,value2);case"AsyncIterator":return yield*FromAsyncIterator5(schema_,references_,path8,value2);case"BigInt":return yield*FromBigInt3(schema_,references_,path8,value2);case"Boolean":return yield*FromBoolean3(schema_,references_,path8,value2);case"Constructor":return yield*FromConstructor5(schema_,references_,path8,value2);case"Date":return yield*FromDate3(schema_,references_,path8,value2);case"Function":return yield*FromFunction5(schema_,references_,path8,value2);case"Import":return yield*FromImport2(schema_,references_,path8,value2);case"Integer":return yield*FromInteger3(schema_,references_,path8,value2);case"Intersect":return yield*FromIntersect10(schema_,references_,path8,value2);case"Iterator":return yield*FromIterator5(schema_,references_,path8,value2);case"Literal":return yield*FromLiteral4(schema_,references_,path8,value2);case"Never":return yield*FromNever3(schema_,references_,path8,value2);case"Not":return yield*FromNot3(schema_,references_,path8,value2);case"Null":return yield*FromNull3(schema_,references_,path8,value2);case"Number":return yield*FromNumber3(schema_,references_,path8,value2);case"Object":return yield*FromObject9(schema_,references_,path8,value2);case"Promise":return yield*FromPromise5(schema_,references_,path8,value2);case"Record":return yield*FromRecord5(schema_,references_,path8,value2);case"Ref":return yield*FromRef6(schema_,references_,path8,value2);case"RegExp":return yield*FromRegExp3(schema_,references_,path8,value2);case"String":return yield*FromString3(schema_,references_,path8,value2);case"Symbol":return yield*FromSymbol3(schema_,references_,path8,value2);case"TemplateLiteral":return yield*FromTemplateLiteral5(schema_,references_,path8,value2);case"This":return yield*FromThis2(schema_,references_,path8,value2);case"Tuple":return yield*FromTuple7(schema_,references_,path8,value2);case"Undefined":return yield*FromUndefined3(schema_,references_,path8,value2);case"Union":return yield*FromUnion12(schema_,references_,path8,value2);case"Uint8Array":return yield*FromUint8Array3(schema_,references_,path8,value2);case"Unknown":return yield*FromUnknown3(schema_,references_,path8,value2);case"Void":return yield*FromVoid3(schema_,references_,path8,value2);default:if(!exports_type2.Has(schema_[Kind]))throw new ValueErrorsUnknownTypeError(schema3);return yield*FromKind2(schema_,references_,path8,value2)}}function Errors(...args){let iterator3=args.length===3?Visit6(args[0],args[1],"",args[2]):Visit6(args[0],[],"",args[1]);return new ValueErrorIterator(iterator3)}init_guard();init_error();var __classPrivateFieldSet3=function(receiver,state,value2,kind,f){if(kind==="m")throw TypeError("Private method is not writable");if(kind==="a"&&!f)throw TypeError("Private accessor was defined without a setter");if(typeof state==="function"?receiver!==state||!f:!state.has(receiver))throw TypeError("Cannot write private member to an object whose class did not declare it");return kind==="a"?f.call(receiver,value2):f?f.value=value2:state.set(receiver,value2),value2},__classPrivateFieldGet3=function(receiver,state,kind,f){if(kind==="a"&&!f)throw TypeError("Private accessor was defined without a getter");if(typeof state==="function"?receiver!==state||!f:!state.has(receiver))throw TypeError("Cannot read private member from an object whose class did not declare it");return kind==="m"?f:kind==="a"?f.call(receiver):f?f.value:state.get(receiver)},_AssertError_instances,_AssertError_iterator,_AssertError_Iterator;class AssertError extends TypeBoxError{constructor(iterator3){let error3=iterator3.First();super(error3===void 0?"Invalid Value":error3.message);_AssertError_instances.add(this),_AssertError_iterator.set(this,void 0),__classPrivateFieldSet3(this,_AssertError_iterator,iterator3,"f"),this.error=error3}Errors(){return new ValueErrorIterator(__classPrivateFieldGet3(this,_AssertError_instances,"m",_AssertError_Iterator).call(this))}}_AssertError_iterator=new WeakMap,_AssertError_instances=new WeakSet,_AssertError_Iterator=function*(){if(this.error)yield this.error;yield*__classPrivateFieldGet3(this,_AssertError_iterator,"f")};function AssertValue(schema3,references,value2){if(Check(schema3,references,value2))return;throw new AssertError(Errors(schema3,references,value2))}function Assert(...args){return args.length===3?AssertValue(args[0],args[1],args[2]):AssertValue(args[0],[],args[1])}init_guard();init_error2();init_symbols2();init_guard();init_guard();function FromObject10(value2){let Acc={};for(let key2 of Object.getOwnPropertyNames(value2))Acc[key2]=Clone2(value2[key2]);for(let key2 of Object.getOwnPropertySymbols(value2))Acc[key2]=Clone2(value2[key2]);return Acc}function FromArray9(value2){return value2.map((element)=>Clone2(element))}function FromTypedArray(value2){return value2.slice()}function FromMap(value2){return new Map(Clone2([...value2.entries()]))}function FromSet(value2){return new Set(Clone2([...value2.entries()]))}function FromDate4(value2){return new Date(value2.toISOString())}function FromValue2(value2){return value2}function Clone2(value2){if(IsArray2(value2))return FromArray9(value2);if(IsDate2(value2))return FromDate4(value2);if(IsTypedArray(value2))return FromTypedArray(value2);if(IsMap(value2))return FromMap(value2);if(IsSet(value2))return FromSet(value2);if(IsObject2(value2))return FromObject10(value2);if(IsValueType(value2))return FromValue2(value2);throw Error("ValueClone: Unable to clone value")}init_template_literal2();init_registry4();init_symbols2();init_error2();class ValueCreateError extends TypeBoxError{constructor(schema3,message){super(message);this.schema=schema3}}function FromDefault(value2){return IsFunction2(value2)?value2():Clone2(value2)}function FromAny4(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else return{}}function FromArgument4(schema3,references){return{}}function FromArray10(schema3,references){if(schema3.uniqueItems===!0&&!HasPropertyKey2(schema3,"default"))throw new ValueCreateError(schema3,"Array with the uniqueItems constraint requires a default value");else if("contains"in schema3&&!HasPropertyKey2(schema3,"default"))throw new ValueCreateError(schema3,"Array with the contains constraint requires a default value");else if("default"in schema3)return FromDefault(schema3.default);else if(schema3.minItems!==void 0)return Array.from({length:schema3.minItems}).map((item)=>{return Visit7(schema3.items,references)});else return[]}function FromAsyncIterator6(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else return async function*(){}()}function FromBigInt4(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else return BigInt(0)}function FromBoolean4(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else return!1}function FromConstructor6(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else{let value2=Visit7(schema3.returns,references);if(typeof value2==="object"&&!Array.isArray(value2))return class{constructor(){for(let[key2,val]of Object.entries(value2)){let self2=this;self2[key2]=val}}};else return class{}}}function FromDate5(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else if(schema3.minimumTimestamp!==void 0)return new Date(schema3.minimumTimestamp);else return new Date}function FromFunction6(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else return()=>Visit7(schema3.returns,references)}function FromImport3(schema3,references){let definitions=globalThis.Object.values(schema3.$defs),target2=schema3.$defs[schema3.$ref];return Visit7(target2,[...references,...definitions])}function FromInteger4(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else if(schema3.minimum!==void 0)return schema3.minimum;else return 0}function FromIntersect11(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else{let value2=schema3.allOf.reduce((acc,schema4)=>{let next=Visit7(schema4,references);return typeof next==="object"?{...acc,...next}:next},{});if(!Check(schema3,references,value2))throw new ValueCreateError(schema3,"Intersect produced invalid value. Consider using a default value.");return value2}}function FromIterator6(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else return function*(){}()}function FromLiteral5(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else return schema3.const}function FromNever4(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else throw new ValueCreateError(schema3,"Never types cannot be created. Consider using a default value.")}function FromNot4(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else throw new ValueCreateError(schema3,"Not types must have a default value")}function FromNull4(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else return null}function FromNumber4(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else if(schema3.minimum!==void 0)return schema3.minimum;else return 0}function FromObject11(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else{let required3=new Set(schema3.required),Acc={};for(let[key2,subschema]of Object.entries(schema3.properties)){if(!required3.has(key2))continue;Acc[key2]=Visit7(subschema,references)}return Acc}}function FromPromise6(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else return Promise.resolve(Visit7(schema3.item,references))}function FromRecord6(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else return{}}function FromRef7(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else return Visit7(Deref(schema3,references),references)}function FromRegExp4(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else throw new ValueCreateError(schema3,"RegExp types cannot be created. Consider using a default value.")}function FromString4(schema3,references){if(schema3.pattern!==void 0)if(!HasPropertyKey2(schema3,"default"))throw new ValueCreateError(schema3,"String types with patterns must specify a default value");else return FromDefault(schema3.default);else if(schema3.format!==void 0)if(!HasPropertyKey2(schema3,"default"))throw new ValueCreateError(schema3,"String types with formats must specify a default value");else return FromDefault(schema3.default);else if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else if(schema3.minLength!==void 0)return Array.from({length:schema3.minLength}).map(()=>" ").join("");else return""}function FromSymbol4(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else if("value"in schema3)return Symbol.for(schema3.value);else return Symbol()}function FromTemplateLiteral6(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);if(!IsTemplateLiteralFinite(schema3))throw new ValueCreateError(schema3,"Can only create template literals that produce a finite variants. Consider using a default value.");return TemplateLiteralGenerate(schema3)[0]}function FromThis3(schema3,references){if(recursiveDepth++>recursiveMaxDepth)throw new ValueCreateError(schema3,"Cannot create recursive type as it appears possibly infinite. Consider using a default.");if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else return Visit7(Deref(schema3,references),references)}function FromTuple8(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);if(schema3.items===void 0)return[];else return Array.from({length:schema3.minItems}).map((_,index)=>Visit7(schema3.items[index],references))}function FromUndefined4(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else return}function FromUnion13(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else if(schema3.anyOf.length===0)throw Error("ValueCreate.Union: Cannot create Union with zero variants");else return Visit7(schema3.anyOf[0],references)}function FromUint8Array4(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else if(schema3.minByteLength!==void 0)return new Uint8Array(schema3.minByteLength);else return new Uint8Array(0)}function FromUnknown4(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else return{}}function FromVoid4(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else return}function FromKind3(schema3,references){if(HasPropertyKey2(schema3,"default"))return FromDefault(schema3.default);else throw Error("User defined types must specify a default value")}function Visit7(schema3,references){let references_=Pushref(schema3,references),schema_=schema3;switch(schema_[Kind]){case"Any":return FromAny4(schema_,references_);case"Argument":return FromArgument4(schema_,references_);case"Array":return FromArray10(schema_,references_);case"AsyncIterator":return FromAsyncIterator6(schema_,references_);case"BigInt":return FromBigInt4(schema_,references_);case"Boolean":return FromBoolean4(schema_,references_);case"Constructor":return FromConstructor6(schema_,references_);case"Date":return FromDate5(schema_,references_);case"Function":return FromFunction6(schema_,references_);case"Import":return FromImport3(schema_,references_);case"Integer":return FromInteger4(schema_,references_);case"Intersect":return FromIntersect11(schema_,references_);case"Iterator":return FromIterator6(schema_,references_);case"Literal":return FromLiteral5(schema_,references_);case"Never":return FromNever4(schema_,references_);case"Not":return FromNot4(schema_,references_);case"Null":return FromNull4(schema_,references_);case"Number":return FromNumber4(schema_,references_);case"Object":return FromObject11(schema_,references_);case"Promise":return FromPromise6(schema_,references_);case"Record":return FromRecord6(schema_,references_);case"Ref":return FromRef7(schema_,references_);case"RegExp":return FromRegExp4(schema_,references_);case"String":return FromString4(schema_,references_);case"Symbol":return FromSymbol4(schema_,references_);case"TemplateLiteral":return FromTemplateLiteral6(schema_,references_);case"This":return FromThis3(schema_,references_);case"Tuple":return FromTuple8(schema_,references_);case"Undefined":return FromUndefined4(schema_,references_);case"Union":return FromUnion13(schema_,references_);case"Uint8Array":return FromUint8Array4(schema_,references_);case"Unknown":return FromUnknown4(schema_,references_);case"Void":return FromVoid4(schema_,references_);default:if(!exports_type2.Has(schema_[Kind]))throw new ValueCreateError(schema_,"Unknown type");return FromKind3(schema_,references_)}}var recursiveMaxDepth=512,recursiveDepth=0;function Create2(...args){return recursiveDepth=0,args.length===2?Visit7(args[0],args[1]):Visit7(args[0],[])}class ValueCastError extends TypeBoxError{constructor(schema3,message){super(message);this.schema=schema3}}function ScoreUnion(schema3,references,value2){if(schema3[Kind]==="Object"&&typeof value2==="object"&&!IsNull2(value2)){let object3=schema3,keys=Object.getOwnPropertyNames(value2);return Object.entries(object3.properties).reduce((acc,[key2,schema4])=>{let literal3=schema4[Kind]==="Literal"&&schema4.const===value2[key2]?100:0,checks=Check(schema4,references,value2[key2])?10:0,exists=keys.includes(key2)?1:0;return acc+(literal3+checks+exists)},0)}else if(schema3[Kind]==="Union"){let scores=schema3.anyOf.map((schema4)=>Deref(schema4,references)).map((schema4)=>ScoreUnion(schema4,references,value2));return Math.max(...scores)}else return Check(schema3,references,value2)?1:0}function SelectUnion(union4,references,value2){let schemas=union4.anyOf.map((schema3)=>Deref(schema3,references)),[select,best]=[schemas[0],0];for(let schema3 of schemas){let score=ScoreUnion(schema3,references,value2);if(score>best)select=schema3,best=score}return select}function CastUnion(union4,references,value2){if("default"in union4)return typeof value2==="function"?union4.default:Clone2(union4.default);else{let schema3=SelectUnion(union4,references,value2);return Cast(schema3,references,value2)}}function DefaultClone(schema3,references,value2){return Check(schema3,references,value2)?Clone2(value2):Create2(schema3,references)}function Default(schema3,references,value2){return Check(schema3,references,value2)?value2:Create2(schema3,references)}function FromArray11(schema3,references,value2){if(Check(schema3,references,value2))return Clone2(value2);let created=IsArray2(value2)?Clone2(value2):Create2(schema3,references),minimum=IsNumber2(schema3.minItems)&&created.length<schema3.minItems?[...created,...Array.from({length:schema3.minItems-created.length},()=>null)]:created,casted=(IsNumber2(schema3.maxItems)&&minimum.length>schema3.maxItems?minimum.slice(0,schema3.maxItems):minimum).map((value3)=>Visit8(schema3.items,references,value3));if(schema3.uniqueItems!==!0)return casted;let unique=[...new Set(casted)];if(!Check(schema3,references,unique))throw new ValueCastError(schema3,"Array cast produced invalid data due to uniqueItems constraint");return unique}function FromConstructor7(schema3,references,value2){if(Check(schema3,references,value2))return Create2(schema3,references);let required3=new Set(schema3.returns.required||[]),result=function(){};for(let[key2,property]of Object.entries(schema3.returns.properties)){if(!required3.has(key2)&&value2.prototype[key2]===void 0)continue;result.prototype[key2]=Visit8(property,references,value2.prototype[key2])}return result}function FromImport4(schema3,references,value2){let definitions=globalThis.Object.values(schema3.$defs),target2=schema3.$defs[schema3.$ref];return Visit8(target2,[...references,...definitions],value2)}function IntersectAssign(correct,value2){if(IsObject2(correct)&&!IsObject2(value2)||!IsObject2(correct)&&IsObject2(value2))return correct;if(!IsObject2(correct)||!IsObject2(value2))return value2;return globalThis.Object.getOwnPropertyNames(correct).reduce((result,key2)=>{let property=key2 in value2?IntersectAssign(correct[key2],value2[key2]):correct[key2];return{...result,[key2]:property}},{})}function FromIntersect12(schema3,references,value2){if(Check(schema3,references,value2))return value2;let correct=Create2(schema3,references),assigned=IntersectAssign(correct,value2);return Check(schema3,references,assigned)?assigned:correct}function FromNever5(schema3,references,value2){throw new ValueCastError(schema3,"Never types cannot be cast")}function FromObject12(schema3,references,value2){if(Check(schema3,references,value2))return value2;if(value2===null||typeof value2!=="object")return Create2(schema3,references);let required3=new Set(schema3.required||[]),result={};for(let[key2,property]of Object.entries(schema3.properties)){if(!required3.has(key2)&&value2[key2]===void 0)continue;result[key2]=Visit8(property,references,value2[key2])}if(typeof schema3.additionalProperties==="object"){let propertyNames=Object.getOwnPropertyNames(schema3.properties);for(let propertyName of Object.getOwnPropertyNames(value2)){if(propertyNames.includes(propertyName))continue;result[propertyName]=Visit8(schema3.additionalProperties,references,value2[propertyName])}}return result}function FromRecord7(schema3,references,value2){if(Check(schema3,references,value2))return Clone2(value2);if(value2===null||typeof value2!=="object"||Array.isArray(value2)||value2 instanceof Date)return Create2(schema3,references);let subschemaPropertyName=Object.getOwnPropertyNames(schema3.patternProperties)[0],subschema=schema3.patternProperties[subschemaPropertyName],result={};for(let[propKey,propValue]of Object.entries(value2))result[propKey]=Visit8(subschema,references,propValue);return result}function FromRef8(schema3,references,value2){return Visit8(Deref(schema3,references),references,value2)}function FromThis4(schema3,references,value2){return Visit8(Deref(schema3,references),references,value2)}function FromTuple9(schema3,references,value2){if(Check(schema3,references,value2))return Clone2(value2);if(!IsArray2(value2))return Create2(schema3,references);if(schema3.items===void 0)return[];return schema3.items.map((schema4,index)=>Visit8(schema4,references,value2[index]))}function FromUnion14(schema3,references,value2){return Check(schema3,references,value2)?Clone2(value2):CastUnion(schema3,references,value2)}function Visit8(schema3,references,value2){let references_=IsString2(schema3.$id)?Pushref(schema3,references):references,schema_=schema3;switch(schema3[Kind]){case"Array":return FromArray11(schema_,references_,value2);case"Constructor":return FromConstructor7(schema_,references_,value2);case"Import":return FromImport4(schema_,references_,value2);case"Intersect":return FromIntersect12(schema_,references_,value2);case"Never":return FromNever5(schema_,references_,value2);case"Object":return FromObject12(schema_,references_,value2);case"Record":return FromRecord7(schema_,references_,value2);case"Ref":return FromRef8(schema_,references_,value2);case"This":return FromThis4(schema_,references_,value2);case"Tuple":return FromTuple9(schema_,references_,value2);case"Union":return FromUnion14(schema_,references_,value2);case"Date":case"Symbol":case"Uint8Array":return DefaultClone(schema3,references,value2);default:return Default(schema_,references_,value2)}}function Cast(...args){return args.length===3?Visit8(args[0],args[1],args[2]):Visit8(args[0],[],args[1])}init_keyof2();init_symbols2();init_guard();init_kind();function IsCheckable(schema3){return IsKind(schema3)&&schema3[Kind]!=="Unsafe"}function FromArray12(schema3,references,value2){if(!IsArray2(value2))return value2;return value2.map((value3)=>Visit9(schema3.items,references,value3))}function FromImport5(schema3,references,value2){let definitions=globalThis.Object.values(schema3.$defs),target2=schema3.$defs[schema3.$ref];return Visit9(target2,[...references,...definitions],value2)}function FromIntersect13(schema3,references,value2){let unevaluatedProperties=schema3.unevaluatedProperties,composite3=schema3.allOf.map((schema4)=>Visit9(schema4,references,Clone2(value2))).reduce((acc,value3)=>IsObject2(value3)?{...acc,...value3}:value3,{});if(!IsObject2(value2)||!IsObject2(composite3)||!IsKind(unevaluatedProperties))return composite3;let knownkeys=KeyOfPropertyKeys(schema3);for(let key2 of Object.getOwnPropertyNames(value2)){if(knownkeys.includes(key2))continue;if(Check(unevaluatedProperties,references,value2[key2]))composite3[key2]=Visit9(unevaluatedProperties,references,value2[key2])}return composite3}function FromObject13(schema3,references,value2){if(!IsObject2(value2)||IsArray2(value2))return value2;let additionalProperties=schema3.additionalProperties;for(let key2 of Object.getOwnPropertyNames(value2)){if(HasPropertyKey2(schema3.properties,key2)){value2[key2]=Visit9(schema3.properties[key2],references,value2[key2]);continue}if(IsKind(additionalProperties)&&Check(additionalProperties,references,value2[key2])){value2[key2]=Visit9(additionalProperties,references,value2[key2]);continue}delete value2[key2]}return value2}function FromRecord8(schema3,references,value2){if(!IsObject2(value2))return value2;let additionalProperties=schema3.additionalProperties,propertyKeys=Object.getOwnPropertyNames(value2),[propertyKey,propertySchema]=Object.entries(schema3.patternProperties)[0],propertyKeyTest=new RegExp(propertyKey);for(let key2 of propertyKeys){if(propertyKeyTest.test(key2)){value2[key2]=Visit9(propertySchema,references,value2[key2]);continue}if(IsKind(additionalProperties)&&Check(additionalProperties,references,value2[key2])){value2[key2]=Visit9(additionalProperties,references,value2[key2]);continue}delete value2[key2]}return value2}function FromRef9(schema3,references,value2){return Visit9(Deref(schema3,references),references,value2)}function FromThis5(schema3,references,value2){return Visit9(Deref(schema3,references),references,value2)}function FromTuple10(schema3,references,value2){if(!IsArray2(value2))return value2;if(IsUndefined2(schema3.items))return[];let length=Math.min(value2.length,schema3.items.length);for(let i=0;i<length;i++)value2[i]=Visit9(schema3.items[i],references,value2[i]);return value2.length>length?value2.slice(0,length):value2}function FromUnion15(schema3,references,value2){for(let inner of schema3.anyOf)if(IsCheckable(inner)&&Check(inner,references,value2))return Visit9(inner,references,value2);return value2}function Visit9(schema3,references,value2){let references_=IsString2(schema3.$id)?Pushref(schema3,references):references,schema_=schema3;switch(schema_[Kind]){case"Array":return FromArray12(schema_,references_,value2);case"Import":return FromImport5(schema_,references_,value2);case"Intersect":return FromIntersect13(schema_,references_,value2);case"Object":return FromObject13(schema_,references_,value2);case"Record":return FromRecord8(schema_,references_,value2);case"Ref":return FromRef9(schema_,references_,value2);case"This":return FromThis5(schema_,references_,value2);case"Tuple":return FromTuple10(schema_,references_,value2);case"Union":return FromUnion15(schema_,references_,value2);default:return value2}}function Clean(...args){return args.length===3?Visit9(args[0],args[1],args[2]):Visit9(args[0],[],args[1])}init_symbols2();init_guard();function IsStringNumeric(value2){return IsString2(value2)&&!isNaN(value2)&&!isNaN(parseFloat(value2))}function IsValueToString(value2){return IsBigInt2(value2)||IsBoolean2(value2)||IsNumber2(value2)}function IsValueTrue(value2){return value2===!0||IsNumber2(value2)&&value2===1||IsBigInt2(value2)&&value2===BigInt("1")||IsString2(value2)&&(value2.toLowerCase()==="true"||value2==="1")}function IsValueFalse(value2){return value2===!1||IsNumber2(value2)&&(value2===0||Object.is(value2,-0))||IsBigInt2(value2)&&value2===BigInt("0")||IsString2(value2)&&(value2.toLowerCase()==="false"||value2==="0"||value2==="-0")}function IsTimeStringWithTimeZone(value2){return IsString2(value2)&&/^(?:[0-2]\d:[0-5]\d:[0-5]\d|23:59:60)(?:\.\d+)?(?:z|[+-]\d\d(?::?\d\d)?)$/i.test(value2)}function IsTimeStringWithoutTimeZone(value2){return IsString2(value2)&&/^(?:[0-2]\d:[0-5]\d:[0-5]\d|23:59:60)?$/i.test(value2)}function IsDateTimeStringWithTimeZone(value2){return IsString2(value2)&&/^\d\d\d\d-[0-1]\d-[0-3]\dt(?:[0-2]\d:[0-5]\d:[0-5]\d|23:59:60)(?:\.\d+)?(?:z|[+-]\d\d(?::?\d\d)?)$/i.test(value2)}function IsDateTimeStringWithoutTimeZone(value2){return IsString2(value2)&&/^\d\d\d\d-[0-1]\d-[0-3]\dt(?:[0-2]\d:[0-5]\d:[0-5]\d|23:59:60)?$/i.test(value2)}function IsDateString(value2){return IsString2(value2)&&/^\d\d\d\d-[0-1]\d-[0-3]\d$/i.test(value2)}function TryConvertLiteralString(value2,target2){let conversion=TryConvertString(value2);return conversion===target2?conversion:value2}function TryConvertLiteralNumber(value2,target2){let conversion=TryConvertNumber(value2);return conversion===target2?conversion:value2}function TryConvertLiteralBoolean(value2,target2){let conversion=TryConvertBoolean(value2);return conversion===target2?conversion:value2}function TryConvertLiteral(schema3,value2){return IsString2(schema3.const)?TryConvertLiteralString(value2,schema3.const):IsNumber2(schema3.const)?TryConvertLiteralNumber(value2,schema3.const):IsBoolean2(schema3.const)?TryConvertLiteralBoolean(value2,schema3.const):value2}function TryConvertBoolean(value2){return IsValueTrue(value2)?!0:IsValueFalse(value2)?!1:value2}function TryConvertBigInt(value2){let truncateInteger=(value3)=>value3.split(".")[0];return IsStringNumeric(value2)?BigInt(truncateInteger(value2)):IsNumber2(value2)?BigInt(Math.trunc(value2)):IsValueFalse(value2)?BigInt(0):IsValueTrue(value2)?BigInt(1):value2}function TryConvertString(value2){return IsSymbol2(value2)&&value2.description!==void 0?value2.description.toString():IsValueToString(value2)?value2.toString():value2}function TryConvertNumber(value2){return IsStringNumeric(value2)?parseFloat(value2):IsValueTrue(value2)?1:IsValueFalse(value2)?0:value2}function TryConvertInteger(value2){return IsStringNumeric(value2)?parseInt(value2):IsNumber2(value2)?Math.trunc(value2):IsValueTrue(value2)?1:IsValueFalse(value2)?0:value2}function TryConvertNull(value2){return IsString2(value2)&&value2.toLowerCase()==="null"?null:value2}function TryConvertUndefined(value2){return IsString2(value2)&&value2==="undefined"?void 0:value2}function TryConvertDate(value2){return IsDate2(value2)?value2:IsNumber2(value2)?new Date(value2):IsValueTrue(value2)?new Date(1):IsValueFalse(value2)?new Date(0):IsStringNumeric(value2)?new Date(parseInt(value2)):IsTimeStringWithoutTimeZone(value2)?new Date(`1970-01-01T${value2}.000Z`):IsTimeStringWithTimeZone(value2)?new Date(`1970-01-01T${value2}`):IsDateTimeStringWithoutTimeZone(value2)?new Date(`${value2}.000Z`):IsDateTimeStringWithTimeZone(value2)?new Date(value2):IsDateString(value2)?new Date(`${value2}T00:00:00.000Z`):value2}function Default2(value2){return value2}function FromArray13(schema3,references,value2){return(IsArray2(value2)?value2:[value2]).map((element)=>Visit10(schema3.items,references,element))}function FromBigInt5(schema3,references,value2){return TryConvertBigInt(value2)}function FromBoolean5(schema3,references,value2){return TryConvertBoolean(value2)}function FromDate6(schema3,references,value2){return TryConvertDate(value2)}function FromImport6(schema3,references,value2){let definitions=globalThis.Object.values(schema3.$defs),target2=schema3.$defs[schema3.$ref];return Visit10(target2,[...references,...definitions],value2)}function FromInteger5(schema3,references,value2){return TryConvertInteger(value2)}function FromIntersect14(schema3,references,value2){return schema3.allOf.reduce((value3,schema4)=>Visit10(schema4,references,value3),value2)}function FromLiteral6(schema3,references,value2){return TryConvertLiteral(schema3,value2)}function FromNull5(schema3,references,value2){return TryConvertNull(value2)}function FromNumber5(schema3,references,value2){return TryConvertNumber(value2)}function FromObject14(schema3,references,value2){if(!IsObject2(value2)||IsArray2(value2))return value2;for(let propertyKey of Object.getOwnPropertyNames(schema3.properties)){if(!HasPropertyKey2(value2,propertyKey))continue;value2[propertyKey]=Visit10(schema3.properties[propertyKey],references,value2[propertyKey])}return value2}function FromRecord9(schema3,references,value2){if(!(IsObject2(value2)&&!IsArray2(value2)))return value2;let propertyKey=Object.getOwnPropertyNames(schema3.patternProperties)[0],property=schema3.patternProperties[propertyKey];for(let[propKey,propValue]of Object.entries(value2))value2[propKey]=Visit10(property,references,propValue);return value2}function FromRef10(schema3,references,value2){return Visit10(Deref(schema3,references),references,value2)}function FromString5(schema3,references,value2){return TryConvertString(value2)}function FromSymbol5(schema3,references,value2){return IsString2(value2)||IsNumber2(value2)?Symbol(value2):value2}function FromThis6(schema3,references,value2){return Visit10(Deref(schema3,references),references,value2)}function FromTuple11(schema3,references,value2){if(!(IsArray2(value2)&&!IsUndefined2(schema3.items)))return value2;return value2.map((value3,index)=>{return index<schema3.items.length?Visit10(schema3.items[index],references,value3):value3})}function FromUndefined5(schema3,references,value2){return TryConvertUndefined(value2)}function FromUnion16(schema3,references,value2){for(let subschema of schema3.anyOf)if(Check(subschema,references,value2))return value2;for(let subschema of schema3.anyOf){let converted=Visit10(subschema,references,Clone2(value2));if(!Check(subschema,references,converted))continue;return converted}return value2}function Visit10(schema3,references,value2){let references_=Pushref(schema3,references),schema_=schema3;switch(schema3[Kind]){case"Array":return FromArray13(schema_,references_,value2);case"BigInt":return FromBigInt5(schema_,references_,value2);case"Boolean":return FromBoolean5(schema_,references_,value2);case"Date":return FromDate6(schema_,references_,value2);case"Import":return FromImport6(schema_,references_,value2);case"Integer":return FromInteger5(schema_,references_,value2);case"Intersect":return FromIntersect14(schema_,references_,value2);case"Literal":return FromLiteral6(schema_,references_,value2);case"Null":return FromNull5(schema_,references_,value2);case"Number":return FromNumber5(schema_,references_,value2);case"Object":return FromObject14(schema_,references_,value2);case"Record":return FromRecord9(schema_,references_,value2);case"Ref":return FromRef10(schema_,references_,value2);case"String":return FromString5(schema_,references_,value2);case"Symbol":return FromSymbol5(schema_,references_,value2);case"This":return FromThis6(schema_,references_,value2);case"Tuple":return FromTuple11(schema_,references_,value2);case"Undefined":return FromUndefined5(schema_,references_,value2);case"Union":return FromUnion16(schema_,references_,value2);default:return Default2(value2)}}function Convert2(...args){return args.length===3?Visit10(args[0],args[1],args[2]):Visit10(args[0],[],args[1])}init_policy();init_symbols2();init_error2();init_keyof2();init_guard();init_kind();class TransformDecodeCheckError extends TypeBoxError{constructor(schema3,value2,error3){super("Unable to decode value as it does not match the expected schema");this.schema=schema3,this.value=value2,this.error=error3}}class TransformDecodeError extends TypeBoxError{constructor(schema3,path8,value2,error3){super(error3 instanceof Error?error3.message:"Unknown error");this.schema=schema3,this.path=path8,this.value=value2,this.error=error3}}function Default3(schema3,path8,value2){try{return IsTransform(schema3)?schema3[TransformKind].Decode(value2):value2}catch(error3){throw new TransformDecodeError(schema3,path8,value2,error3)}}function FromArray14(schema3,references,path8,value2){return IsArray2(value2)?Default3(schema3,path8,value2.map((value3,index)=>Visit11(schema3.items,references,`${path8}/${index}`,value3))):Default3(schema3,path8,value2)}function FromIntersect15(schema3,references,path8,value2){if(!IsObject2(value2)||IsValueType(value2))return Default3(schema3,path8,value2);let knownEntries=KeyOfPropertyEntries(schema3),knownKeys=knownEntries.map((entry)=>entry[0]),knownProperties={...value2};for(let[knownKey,knownSchema]of knownEntries)if(knownKey in knownProperties)knownProperties[knownKey]=Visit11(knownSchema,references,`${path8}/${knownKey}`,knownProperties[knownKey]);if(!IsTransform(schema3.unevaluatedProperties))return Default3(schema3,path8,knownProperties);let unknownKeys=Object.getOwnPropertyNames(knownProperties),unevaluatedProperties=schema3.unevaluatedProperties,unknownProperties={...knownProperties};for(let key2 of unknownKeys)if(!knownKeys.includes(key2))unknownProperties[key2]=Default3(unevaluatedProperties,`${path8}/${key2}`,unknownProperties[key2]);return Default3(schema3,path8,unknownProperties)}function FromImport7(schema3,references,path8,value2){let additional=globalThis.Object.values(schema3.$defs),target2=schema3.$defs[schema3.$ref],result=Visit11(target2,[...references,...additional],path8,value2);return Default3(schema3,path8,result)}function FromNot5(schema3,references,path8,value2){return Default3(schema3,path8,Visit11(schema3.not,references,path8,value2))}function FromObject15(schema3,references,path8,value2){if(!IsObject2(value2))return Default3(schema3,path8,value2);let knownKeys=KeyOfPropertyKeys(schema3),knownProperties={...value2};for(let key2 of knownKeys){if(!HasPropertyKey2(knownProperties,key2))continue;if(IsUndefined2(knownProperties[key2])&&(!IsUndefined3(schema3.properties[key2])||TypeSystemPolicy.IsExactOptionalProperty(knownProperties,key2)))continue;knownProperties[key2]=Visit11(schema3.properties[key2],references,`${path8}/${key2}`,knownProperties[key2])}if(!IsSchema(schema3.additionalProperties))return Default3(schema3,path8,knownProperties);let unknownKeys=Object.getOwnPropertyNames(knownProperties),additionalProperties=schema3.additionalProperties,unknownProperties={...knownProperties};for(let key2 of unknownKeys)if(!knownKeys.includes(key2))unknownProperties[key2]=Default3(additionalProperties,`${path8}/${key2}`,unknownProperties[key2]);return Default3(schema3,path8,unknownProperties)}function FromRecord10(schema3,references,path8,value2){if(!IsObject2(value2))return Default3(schema3,path8,value2);let pattern2=Object.getOwnPropertyNames(schema3.patternProperties)[0],knownKeys=new RegExp(pattern2),knownProperties={...value2};for(let key2 of Object.getOwnPropertyNames(value2))if(knownKeys.test(key2))knownProperties[key2]=Visit11(schema3.patternProperties[pattern2],references,`${path8}/${key2}`,knownProperties[key2]);if(!IsSchema(schema3.additionalProperties))return Default3(schema3,path8,knownProperties);let unknownKeys=Object.getOwnPropertyNames(knownProperties),additionalProperties=schema3.additionalProperties,unknownProperties={...knownProperties};for(let key2 of unknownKeys)if(!knownKeys.test(key2))unknownProperties[key2]=Default3(additionalProperties,`${path8}/${key2}`,unknownProperties[key2]);return Default3(schema3,path8,unknownProperties)}function FromRef11(schema3,references,path8,value2){let target2=Deref(schema3,references);return Default3(schema3,path8,Visit11(target2,references,path8,value2))}function FromThis7(schema3,references,path8,value2){let target2=Deref(schema3,references);return Default3(schema3,path8,Visit11(target2,references,path8,value2))}function FromTuple12(schema3,references,path8,value2){return IsArray2(value2)&&IsArray2(schema3.items)?Default3(schema3,path8,schema3.items.map((schema4,index)=>Visit11(schema4,references,`${path8}/${index}`,value2[index]))):Default3(schema3,path8,value2)}function FromUnion17(schema3,references,path8,value2){for(let subschema of schema3.anyOf){if(!Check(subschema,references,value2))continue;let decoded=Visit11(subschema,references,path8,value2);return Default3(schema3,path8,decoded)}return Default3(schema3,path8,value2)}function Visit11(schema3,references,path8,value2){let references_=Pushref(schema3,references),schema_=schema3;switch(schema3[Kind]){case"Array":return FromArray14(schema_,references_,path8,value2);case"Import":return FromImport7(schema_,references_,path8,value2);case"Intersect":return FromIntersect15(schema_,references_,path8,value2);case"Not":return FromNot5(schema_,references_,path8,value2);case"Object":return FromObject15(schema_,references_,path8,value2);case"Record":return FromRecord10(schema_,references_,path8,value2);case"Ref":return FromRef11(schema_,references_,path8,value2);case"Symbol":return Default3(schema_,path8,value2);case"This":return FromThis7(schema_,references_,path8,value2);case"Tuple":return FromTuple12(schema_,references_,path8,value2);case"Union":return FromUnion17(schema_,references_,path8,value2);default:return Default3(schema_,path8,value2)}}function TransformDecode(schema3,references,value2){return Visit11(schema3,references,"",value2)}init_policy();init_symbols2();init_error2();init_keyof2();init_guard();init_kind();class TransformEncodeCheckError extends TypeBoxError{constructor(schema3,value2,error3){super("The encoded value does not match the expected schema");this.schema=schema3,this.value=value2,this.error=error3}}class TransformEncodeError extends TypeBoxError{constructor(schema3,path8,value2,error3){super(`${error3 instanceof Error?error3.message:"Unknown error"}`);this.schema=schema3,this.path=path8,this.value=value2,this.error=error3}}function Default4(schema3,path8,value2){try{return IsTransform(schema3)?schema3[TransformKind].Encode(value2):value2}catch(error3){throw new TransformEncodeError(schema3,path8,value2,error3)}}function FromArray15(schema3,references,path8,value2){let defaulted=Default4(schema3,path8,value2);return IsArray2(defaulted)?defaulted.map((value3,index)=>Visit12(schema3.items,references,`${path8}/${index}`,value3)):defaulted}function FromImport8(schema3,references,path8,value2){let additional=globalThis.Object.values(schema3.$defs),target2=schema3.$defs[schema3.$ref],result=Default4(schema3,path8,value2);return Visit12(target2,[...references,...additional],path8,result)}function FromIntersect16(schema3,references,path8,value2){let defaulted=Default4(schema3,path8,value2);if(!IsObject2(value2)||IsValueType(value2))return defaulted;let knownEntries=KeyOfPropertyEntries(schema3),knownKeys=knownEntries.map((entry)=>entry[0]),knownProperties={...defaulted};for(let[knownKey,knownSchema]of knownEntries)if(knownKey in knownProperties)knownProperties[knownKey]=Visit12(knownSchema,references,`${path8}/${knownKey}`,knownProperties[knownKey]);if(!IsTransform(schema3.unevaluatedProperties))return knownProperties;let unknownKeys=Object.getOwnPropertyNames(knownProperties),unevaluatedProperties=schema3.unevaluatedProperties,properties={...knownProperties};for(let key2 of unknownKeys)if(!knownKeys.includes(key2))properties[key2]=Default4(unevaluatedProperties,`${path8}/${key2}`,properties[key2]);return properties}function FromNot6(schema3,references,path8,value2){return Default4(schema3.not,path8,Default4(schema3,path8,value2))}function FromObject16(schema3,references,path8,value2){let defaulted=Default4(schema3,path8,value2);if(!IsObject2(defaulted))return defaulted;let knownKeys=KeyOfPropertyKeys(schema3),knownProperties={...defaulted};for(let key2 of knownKeys){if(!HasPropertyKey2(knownProperties,key2))continue;if(IsUndefined2(knownProperties[key2])&&(!IsUndefined3(schema3.properties[key2])||TypeSystemPolicy.IsExactOptionalProperty(knownProperties,key2)))continue;knownProperties[key2]=Visit12(schema3.properties[key2],references,`${path8}/${key2}`,knownProperties[key2])}if(!IsSchema(schema3.additionalProperties))return knownProperties;let unknownKeys=Object.getOwnPropertyNames(knownProperties),additionalProperties=schema3.additionalProperties,properties={...knownProperties};for(let key2 of unknownKeys)if(!knownKeys.includes(key2))properties[key2]=Default4(additionalProperties,`${path8}/${key2}`,properties[key2]);return properties}function FromRecord11(schema3,references,path8,value2){let defaulted=Default4(schema3,path8,value2);if(!IsObject2(value2))return defaulted;let pattern2=Object.getOwnPropertyNames(schema3.patternProperties)[0],knownKeys=new RegExp(pattern2),knownProperties={...defaulted};for(let key2 of Object.getOwnPropertyNames(value2))if(knownKeys.test(key2))knownProperties[key2]=Visit12(schema3.patternProperties[pattern2],references,`${path8}/${key2}`,knownProperties[key2]);if(!IsSchema(schema3.additionalProperties))return knownProperties;let unknownKeys=Object.getOwnPropertyNames(knownProperties),additionalProperties=schema3.additionalProperties,properties={...knownProperties};for(let key2 of unknownKeys)if(!knownKeys.test(key2))properties[key2]=Default4(additionalProperties,`${path8}/${key2}`,properties[key2]);return properties}function FromRef12(schema3,references,path8,value2){let target2=Deref(schema3,references),resolved=Visit12(target2,references,path8,value2);return Default4(schema3,path8,resolved)}function FromThis8(schema3,references,path8,value2){let target2=Deref(schema3,references),resolved=Visit12(target2,references,path8,value2);return Default4(schema3,path8,resolved)}function FromTuple13(schema3,references,path8,value2){let value1=Default4(schema3,path8,value2);return IsArray2(schema3.items)?schema3.items.map((schema4,index)=>Visit12(schema4,references,`${path8}/${index}`,value1[index])):[]}function FromUnion18(schema3,references,path8,value2){for(let subschema of schema3.anyOf){if(!Check(subschema,references,value2))continue;let value1=Visit12(subschema,references,path8,value2);return Default4(schema3,path8,value1)}for(let subschema of schema3.anyOf){let value1=Visit12(subschema,references,path8,value2);if(!Check(schema3,references,value1))continue;return Default4(schema3,path8,value1)}return Default4(schema3,path8,value2)}function Visit12(schema3,references,path8,value2){let references_=Pushref(schema3,references),schema_=schema3;switch(schema3[Kind]){case"Array":return FromArray15(schema_,references_,path8,value2);case"Import":return FromImport8(schema_,references_,path8,value2);case"Intersect":return FromIntersect16(schema_,references_,path8,value2);case"Not":return FromNot6(schema_,references_,path8,value2);case"Object":return FromObject16(schema_,references_,path8,value2);case"Record":return FromRecord11(schema_,references_,path8,value2);case"Ref":return FromRef12(schema_,references_,path8,value2);case"This":return FromThis8(schema_,references_,path8,value2);case"Tuple":return FromTuple13(schema_,references_,path8,value2);case"Union":return FromUnion18(schema_,references_,path8,value2);default:return Default4(schema_,path8,value2)}}function TransformEncode(schema3,references,value2){return Visit12(schema3,references,"",value2)}init_symbols2();init_kind();init_guard();function FromArray16(schema3,references){return IsTransform(schema3)||Visit13(schema3.items,references)}function FromAsyncIterator7(schema3,references){return IsTransform(schema3)||Visit13(schema3.items,references)}function FromConstructor8(schema3,references){return IsTransform(schema3)||Visit13(schema3.returns,references)||schema3.parameters.some((schema4)=>Visit13(schema4,references))}function FromFunction7(schema3,references){return IsTransform(schema3)||Visit13(schema3.returns,references)||schema3.parameters.some((schema4)=>Visit13(schema4,references))}function FromIntersect17(schema3,references){return IsTransform(schema3)||IsTransform(schema3.unevaluatedProperties)||schema3.allOf.some((schema4)=>Visit13(schema4,references))}function FromImport9(schema3,references){let additional=globalThis.Object.getOwnPropertyNames(schema3.$defs).reduce((result,key2)=>[...result,schema3.$defs[key2]],[]),target2=schema3.$defs[schema3.$ref];return IsTransform(schema3)||Visit13(target2,[...additional,...references])}function FromIterator7(schema3,references){return IsTransform(schema3)||Visit13(schema3.items,references)}function FromNot7(schema3,references){return IsTransform(schema3)||Visit13(schema3.not,references)}function FromObject17(schema3,references){return IsTransform(schema3)||Object.values(schema3.properties).some((schema4)=>Visit13(schema4,references))||IsSchema(schema3.additionalProperties)&&Visit13(schema3.additionalProperties,references)}function FromPromise7(schema3,references){return IsTransform(schema3)||Visit13(schema3.item,references)}function FromRecord12(schema3,references){let pattern2=Object.getOwnPropertyNames(schema3.patternProperties)[0],property=schema3.patternProperties[pattern2];return IsTransform(schema3)||Visit13(property,references)||IsSchema(schema3.additionalProperties)&&IsTransform(schema3.additionalProperties)}function FromRef13(schema3,references){if(IsTransform(schema3))return!0;return Visit13(Deref(schema3,references),references)}function FromThis9(schema3,references){if(IsTransform(schema3))return!0;return Visit13(Deref(schema3,references),references)}function FromTuple14(schema3,references){return IsTransform(schema3)||!IsUndefined2(schema3.items)&&schema3.items.some((schema4)=>Visit13(schema4,references))}function FromUnion19(schema3,references){return IsTransform(schema3)||schema3.anyOf.some((schema4)=>Visit13(schema4,references))}function Visit13(schema3,references){let references_=Pushref(schema3,references),schema_=schema3;if(schema3.$id&&visited.has(schema3.$id))return!1;if(schema3.$id)visited.add(schema3.$id);switch(schema3[Kind]){case"Array":return FromArray16(schema_,references_);case"AsyncIterator":return FromAsyncIterator7(schema_,references_);case"Constructor":return FromConstructor8(schema_,references_);case"Function":return FromFunction7(schema_,references_);case"Import":return FromImport9(schema_,references_);case"Intersect":return FromIntersect17(schema_,references_);case"Iterator":return FromIterator7(schema_,references_);case"Not":return FromNot7(schema_,references_);case"Object":return FromObject17(schema_,references_);case"Promise":return FromPromise7(schema_,references_);case"Record":return FromRecord12(schema_,references_);case"Ref":return FromRef13(schema_,references_);case"This":return FromThis9(schema_,references_);case"Tuple":return FromTuple14(schema_,references_);case"Union":return FromUnion19(schema_,references_);default:return IsTransform(schema3)}}var visited=new Set;function HasTransform(schema3,references){return visited.clear(),Visit13(schema3,references)}function Decode2(...args){let[schema3,references,value2]=args.length===3?[args[0],args[1],args[2]]:[args[0],[],args[1]];if(!Check(schema3,references,value2))throw new TransformDecodeCheckError(schema3,value2,Errors(schema3,references,value2).First());return HasTransform(schema3,references)?TransformDecode(schema3,references,value2):value2}init_symbols2();init_guard();init_kind();function ValueOrDefault(schema3,value2){let defaultValue=HasPropertyKey2(schema3,"default")?schema3.default:void 0,clone2=IsFunction2(defaultValue)?defaultValue():Clone2(defaultValue);return IsUndefined2(value2)?clone2:IsObject2(value2)&&IsObject2(clone2)?Object.assign(clone2,value2):value2}function HasDefaultProperty(schema3){return IsKind(schema3)&&"default"in schema3}function FromArray17(schema3,references,value2){if(IsArray2(value2)){for(let i=0;i<value2.length;i++)value2[i]=Visit14(schema3.items,references,value2[i]);return value2}let defaulted=ValueOrDefault(schema3,value2);if(!IsArray2(defaulted))return defaulted;for(let i=0;i<defaulted.length;i++)defaulted[i]=Visit14(schema3.items,references,defaulted[i]);return defaulted}function FromDate7(schema3,references,value2){return IsDate2(value2)?value2:ValueOrDefault(schema3,value2)}function FromImport10(schema3,references,value2){let definitions=globalThis.Object.values(schema3.$defs),target2=schema3.$defs[schema3.$ref];return Visit14(target2,[...references,...definitions],value2)}function FromIntersect18(schema3,references,value2){let defaulted=ValueOrDefault(schema3,value2);return schema3.allOf.reduce((acc,schema4)=>{let next=Visit14(schema4,references,defaulted);return IsObject2(next)?{...acc,...next}:next},{})}function FromObject18(schema3,references,value2){let defaulted=ValueOrDefault(schema3,value2);if(!IsObject2(defaulted))return defaulted;let knownPropertyKeys=Object.getOwnPropertyNames(schema3.properties);for(let key2 of knownPropertyKeys){let propertyValue=Visit14(schema3.properties[key2],references,defaulted[key2]);if(IsUndefined2(propertyValue))continue;defaulted[key2]=Visit14(schema3.properties[key2],references,defaulted[key2])}if(!HasDefaultProperty(schema3.additionalProperties))return defaulted;for(let key2 of Object.getOwnPropertyNames(defaulted)){if(knownPropertyKeys.includes(key2))continue;defaulted[key2]=Visit14(schema3.additionalProperties,references,defaulted[key2])}return defaulted}function FromRecord13(schema3,references,value2){let defaulted=ValueOrDefault(schema3,value2);if(!IsObject2(defaulted))return defaulted;let additionalPropertiesSchema=schema3.additionalProperties,[propertyKeyPattern,propertySchema]=Object.entries(schema3.patternProperties)[0],knownPropertyKey=new RegExp(propertyKeyPattern);for(let key2 of Object.getOwnPropertyNames(defaulted)){if(!(knownPropertyKey.test(key2)&&HasDefaultProperty(propertySchema)))continue;defaulted[key2]=Visit14(propertySchema,references,defaulted[key2])}if(!HasDefaultProperty(additionalPropertiesSchema))return defaulted;for(let key2 of Object.getOwnPropertyNames(defaulted)){if(knownPropertyKey.test(key2))continue;defaulted[key2]=Visit14(additionalPropertiesSchema,references,defaulted[key2])}return defaulted}function FromRef14(schema3,references,value2){return Visit14(Deref(schema3,references),references,ValueOrDefault(schema3,value2))}function FromThis10(schema3,references,value2){return Visit14(Deref(schema3,references),references,value2)}function FromTuple15(schema3,references,value2){let defaulted=ValueOrDefault(schema3,value2);if(!IsArray2(defaulted)||IsUndefined2(schema3.items))return defaulted;let[items,max]=[schema3.items,Math.max(schema3.items.length,defaulted.length)];for(let i=0;i<max;i++)if(i<items.length)defaulted[i]=Visit14(items[i],references,defaulted[i]);return defaulted}function FromUnion20(schema3,references,value2){let defaulted=ValueOrDefault(schema3,value2);for(let inner of schema3.anyOf){let result=Visit14(inner,references,Clone2(defaulted));if(Check(inner,references,result))return result}return defaulted}function Visit14(schema3,references,value2){let references_=Pushref(schema3,references),schema_=schema3;switch(schema_[Kind]){case"Array":return FromArray17(schema_,references_,value2);case"Date":return FromDate7(schema_,references_,value2);case"Import":return FromImport10(schema_,references_,value2);case"Intersect":return FromIntersect18(schema_,references_,value2);case"Object":return FromObject18(schema_,references_,value2);case"Record":return FromRecord13(schema_,references_,value2);case"Ref":return FromRef14(schema_,references_,value2);case"This":return FromThis10(schema_,references_,value2);case"Tuple":return FromTuple15(schema_,references_,value2);case"Union":return FromUnion20(schema_,references_,value2);default:return ValueOrDefault(schema_,value2)}}function Default5(...args){return args.length===3?Visit14(args[0],args[1],args[2]):Visit14(args[0],[],args[1])}init_guard();init_error2();var exports_pointer={};__export(exports_pointer,{ValuePointerRootSetError:()=>ValuePointerRootSetError,ValuePointerRootDeleteError:()=>ValuePointerRootDeleteError,Set:()=>Set5,Has:()=>Has3,Get:()=>Get3,Format:()=>Format,Delete:()=>Delete5});class ValuePointerRootSetError extends TypeBoxError{constructor(value2,path8,update){super("Cannot set root value");this.value=value2,this.path=path8,this.update=update}}class ValuePointerRootDeleteError extends TypeBoxError{constructor(value2,path8){super("Cannot delete root value");this.value=value2,this.path=path8}}function Escape2(component){return component.indexOf("~")===-1?component:component.replace(/~1/g,"/").replace(/~0/g,"~")}function*Format(pointer){if(pointer==="")return;let[start,end]=[0,0];for(let i=0;i<pointer.length;i++)if(pointer.charAt(i)==="/")if(i===0)start=i+1;else end=i,yield Escape2(pointer.slice(start,end)),start=i+1;else end=i;yield Escape2(pointer.slice(start))}function Set5(value2,pointer,update){if(pointer==="")throw new ValuePointerRootSetError(value2,pointer,update);let[owner,next,key2]=[null,value2,""];for(let component of Format(pointer)){if(next[component]===void 0)next[component]={};owner=next,next=next[component],key2=component}owner[key2]=update}function Delete5(value2,pointer){if(pointer==="")throw new ValuePointerRootDeleteError(value2,pointer);let[owner,next,key2]=[null,value2,""];for(let component of Format(pointer)){if(next[component]===void 0||next[component]===null)return;owner=next,next=next[component],key2=component}if(Array.isArray(owner)){let index=parseInt(key2);owner.splice(index,1)}else delete owner[key2]}function Has3(value2,pointer){if(pointer==="")return!0;let[owner,next,key2]=[null,value2,""];for(let component of Format(pointer)){if(next[component]===void 0)return!1;owner=next,next=next[component],key2=component}return Object.getOwnPropertyNames(owner).includes(key2)}function Get3(value2,pointer){if(pointer==="")return value2;let current=value2;for(let component of Format(pointer)){if(current[component]===void 0)return;current=current[component]}return current}init_guard();function ObjectType3(left,right){if(!IsObject2(right))return!1;let leftKeys=[...Object.keys(left),...Object.getOwnPropertySymbols(left)],rightKeys=[...Object.keys(right),...Object.getOwnPropertySymbols(right)];if(leftKeys.length!==rightKeys.length)return!1;return leftKeys.every((key2)=>Equal(left[key2],right[key2]))}function DateType3(left,right){return IsDate2(right)&&left.getTime()===right.getTime()}function ArrayType3(left,right){if(!IsArray2(right)||left.length!==right.length)return!1;return left.every((value2,index)=>Equal(value2,right[index]))}function TypedArrayType(left,right){if(!IsTypedArray(right)||left.length!==right.length||Object.getPrototypeOf(left).constructor.name!==Object.getPrototypeOf(right).constructor.name)return!1;return left.every((value2,index)=>Equal(value2,right[index]))}function ValueType(left,right){return left===right}function Equal(left,right){if(IsDate2(left))return DateType3(left,right);if(IsTypedArray(left))return TypedArrayType(left,right);if(IsArray2(left))return ArrayType3(left,right);if(IsObject2(left))return ObjectType3(left,right);if(IsValueType(left))return ValueType(left,right);throw Error("ValueEquals: Unable to compare value")}init_error2();init_literal2();init_object2();init_string2();init_unknown2();init_union2();var Insert=Object2({type:Literal("insert"),path:String2(),value:Unknown()}),Update2=Object2({type:Literal("update"),path:String2(),value:Unknown()}),Delete6=Object2({type:Literal("delete"),path:String2()}),Edit=Union([Insert,Update2,Delete6]);class ValueDiffError extends TypeBoxError{constructor(value2,message){super(message);this.value=value2}}function CreateUpdate(path8,value2){return{type:"update",path:path8,value:value2}}function CreateInsert(path8,value2){return{type:"insert",path:path8,value:value2}}function CreateDelete(path8){return{type:"delete",path:path8}}function AssertDiffable(value2){if(globalThis.Object.getOwnPropertySymbols(value2).length>0)throw new ValueDiffError(value2,"Cannot diff objects with symbols")}function*ObjectType4(path8,current,next){if(AssertDiffable(current),AssertDiffable(next),!IsStandardObject(next))return yield CreateUpdate(path8,next);let currentKeys=globalThis.Object.getOwnPropertyNames(current),nextKeys=globalThis.Object.getOwnPropertyNames(next);for(let key2 of nextKeys){if(HasPropertyKey2(current,key2))continue;yield CreateInsert(`${path8}/${key2}`,next[key2])}for(let key2 of currentKeys){if(!HasPropertyKey2(next,key2))continue;if(Equal(current,next))continue;yield*Visit15(`${path8}/${key2}`,current[key2],next[key2])}for(let key2 of currentKeys){if(HasPropertyKey2(next,key2))continue;yield CreateDelete(`${path8}/${key2}`)}}function*ArrayType4(path8,current,next){if(!IsArray2(next))return yield CreateUpdate(path8,next);for(let i=0;i<Math.min(current.length,next.length);i++)yield*Visit15(`${path8}/${i}`,current[i],next[i]);for(let i=0;i<next.length;i++){if(i<current.length)continue;yield CreateInsert(`${path8}/${i}`,next[i])}for(let i=current.length-1;i>=0;i--){if(i<next.length)continue;yield CreateDelete(`${path8}/${i}`)}}function*TypedArrayType2(path8,current,next){if(!IsTypedArray(next)||current.length!==next.length||globalThis.Object.getPrototypeOf(current).constructor.name!==globalThis.Object.getPrototypeOf(next).constructor.name)return yield CreateUpdate(path8,next);for(let i=0;i<Math.min(current.length,next.length);i++)yield*Visit15(`${path8}/${i}`,current[i],next[i])}function*ValueType2(path8,current,next){if(current===next)return;yield CreateUpdate(path8,next)}function*Visit15(path8,current,next){if(IsStandardObject(current))return yield*ObjectType4(path8,current,next);if(IsArray2(current))return yield*ArrayType4(path8,current,next);if(IsTypedArray(current))return yield*TypedArrayType2(path8,current,next);if(IsValueType(current))return yield*ValueType2(path8,current,next);throw new ValueDiffError(current,"Unable to diff value")}function Diff(current,next){return[...Visit15("",current,next)]}function IsRootUpdate(edits){return edits.length>0&&edits[0].path===""&&edits[0].type==="update"}function IsIdentity(edits){return edits.length===0}function Patch(current,edits){if(IsRootUpdate(edits))return Clone2(edits[0].value);if(IsIdentity(edits))return Clone2(current);let clone2=Clone2(current);for(let edit of edits)switch(edit.type){case"insert":{exports_pointer.Set(clone2,edit.path,edit.value);break}case"update":{exports_pointer.Set(clone2,edit.path,edit.value);break}case"delete":{exports_pointer.Delete(clone2,edit.path);break}}return clone2}function Encode(...args){let[schema3,references,value2]=args.length===3?[args[0],args[1],args[2]]:[args[0],[],args[1]],encoded=HasTransform(schema3,references)?TransformEncode(schema3,references,value2):value2;if(!Check(schema3,references,encoded))throw new TransformEncodeCheckError(schema3,encoded,Errors(schema3,references,encoded).First());return encoded}init_guard();init_error2();function IsStandardObject2(value2){return IsObject2(value2)&&!IsArray2(value2)}class ValueMutateError extends TypeBoxError{constructor(message){super(message)}}function ObjectType5(root,path8,current,next){if(!IsStandardObject2(current))exports_pointer.Set(root,path8,Clone2(next));else{let currentKeys=Object.getOwnPropertyNames(current),nextKeys=Object.getOwnPropertyNames(next);for(let currentKey of currentKeys)if(!nextKeys.includes(currentKey))delete current[currentKey];for(let nextKey of nextKeys)if(!currentKeys.includes(nextKey))current[nextKey]=null;for(let nextKey of nextKeys)Visit16(root,`${path8}/${nextKey}`,current[nextKey],next[nextKey])}}function ArrayType5(root,path8,current,next){if(!IsArray2(current))exports_pointer.Set(root,path8,Clone2(next));else{for(let index=0;index<next.length;index++)Visit16(root,`${path8}/${index}`,current[index],next[index]);current.splice(next.length)}}function TypedArrayType3(root,path8,current,next){if(IsTypedArray(current)&&current.length===next.length)for(let i=0;i<current.length;i++)current[i]=next[i];else exports_pointer.Set(root,path8,Clone2(next))}function ValueType3(root,path8,current,next){if(current===next)return;exports_pointer.Set(root,path8,next)}function Visit16(root,path8,current,next){if(IsArray2(next))return ArrayType5(root,path8,current,next);if(IsTypedArray(next))return TypedArrayType3(root,path8,current,next);if(IsStandardObject2(next))return ObjectType5(root,path8,current,next);if(IsValueType(next))return ValueType3(root,path8,current,next)}function IsNonMutableValue(value2){return IsTypedArray(value2)||IsValueType(value2)}function IsMismatchedValue(current,next){return IsStandardObject2(current)&&IsArray2(next)||IsArray2(current)&&IsStandardObject2(next)}function Mutate(current,next){if(IsNonMutableValue(current)||IsNonMutableValue(next))throw new ValueMutateError("Only object and array types can be mutated at the root level");if(IsMismatchedValue(current,next))throw new ValueMutateError("Cannot assign due type mismatch of assignable values");Visit16(current,"",current,next)}init_error2();init_guard();class ParseError extends TypeBoxError{constructor(message){super(message)}}var ParseRegistry;(function(ParseRegistry2){let registry3=new Map([["Assert",(type4,references,value2)=>{return Assert(type4,references,value2),value2}],["Cast",(type4,references,value2)=>Cast(type4,references,value2)],["Clean",(type4,references,value2)=>Clean(type4,references,value2)],["Clone",(_type,_references,value2)=>Clone2(value2)],["Convert",(type4,references,value2)=>Convert2(type4,references,value2)],["Decode",(type4,references,value2)=>HasTransform(type4,references)?TransformDecode(type4,references,value2):value2],["Default",(type4,references,value2)=>Default5(type4,references,value2)],["Encode",(type4,references,value2)=>HasTransform(type4,references)?TransformEncode(type4,references,value2):value2]]);function Delete7(key2){registry3.delete(key2)}ParseRegistry2.Delete=Delete7;function Set6(key2,callback){registry3.set(key2,callback)}ParseRegistry2.Set=Set6;function Get4(key2){return registry3.get(key2)}ParseRegistry2.Get=Get4})(ParseRegistry||(ParseRegistry={}));var ParseDefault=["Clone","Clean","Default","Convert","Assert","Decode"];function ParseValue(operations,type4,references,value2){return operations.reduce((value3,operationKey)=>{let operation=ParseRegistry.Get(operationKey);if(IsUndefined2(operation))throw new ParseError(`Unable to find Parse operation '${operationKey}'`);return operation(type4,references,value3)},value2)}function Parse(...args){let[operations,schema3,references,value2]=args.length===4?[args[0],args[1],args[2],args[3]]:args.length===3?IsArray2(args[0])?[args[0],args[1],[],args[2]]:[ParseDefault,args[0],args[1],args[2]]:args.length===2?[ParseDefault,args[0],[],args[1]]:(()=>{throw new ParseError("Invalid Arguments")})();return ParseValue(operations,schema3,references,value2)}var exports_value2={};__export(exports_value2,{ValueErrorIterator:()=>ValueErrorIterator,Patch:()=>Patch,Parse:()=>Parse,Mutate:()=>Mutate,Hash:()=>Hash,Errors:()=>Errors,Equal:()=>Equal,Encode:()=>Encode,Edit:()=>Edit,Diff:()=>Diff,Default:()=>Default5,Decode:()=>Decode2,Create:()=>Create2,Convert:()=>Convert2,Clone:()=>Clone2,Clean:()=>Clean,Check:()=>Check,Cast:()=>Cast,Assert:()=>Assert});init_esm3();var EMAIL2=/^[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*@(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i,UUID2=/^(?:urn:uuid:)?[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i,DATE_TIME=/^\d\d\d\d-[0-1]\d-[0-3]\d[t\s](?:[0-2]\d:[0-5]\d:[0-5]\d|23:59:60)(?:\.\d+)?(?:z|[+-]\d\d(?::?\d\d)?)$/i,ANNOTATION_ONLY=["binary"],registered=!1;function registerStringFormats(){if(registered)return;registered=!0,exports_format.Set("email",(value2)=>EMAIL2.test(value2)),exports_format.Set("uuid",(value2)=>UUID2.test(value2)),exports_format.Set("date-time",(value2)=>DATE_TIME.test(value2));for(let name2 of ANNOTATION_ONLY)exports_format.Set(name2,()=>!0)}var REGISTERED_FORMATS=["email","uuid","date-time",...ANNOTATION_ONLY];var OPTIONAL_KIND=Symbol.for("TypeBox.Optional"),KIND=Symbol.for("TypeBox.Kind"),cleanable=new WeakMap;function honourOpenObjects(node){if(Array.isArray(node)){let changed2=!1,out2=node.map((entry)=>{let next=honourOpenObjects(entry);if(next!==entry)changed2=!0;return next});return changed2?out2:node}if(node===null||typeof node!=="object")return node;let source=node,isSchema=KIND in source,changed=!1,out={};for(let key2 of Object.keys(source)){let value2=source[key2];if(isSchema&&key2==="additionalProperties"&&value2===!0){out[key2]=Type.Any(),changed=!0;continue}let next=honourOpenObjects(value2);if(next!==value2)changed=!0;out[key2]=next}if(!changed)return node;for(let symbol3 of Object.getOwnPropertySymbols(source))out[symbol3]=source[symbol3];return out}function cleanSchemaFor(schema3){let cached=cleanable.get(schema3);if(cached)return cached;let rewritten=honourOpenObjects(schema3);return cleanable.set(schema3,rewritten),rewritten}function prepare(schema3,value2,on){if(!schema3)return value2;if(value2===void 0&&OPTIONAL_KIND in schema3)return;let prepared=value2;if(on==="query")try{prepared=exports_value2.Convert(schema3,prepared)}catch{}try{prepared=exports_value2.Default(schema3,prepared)}catch{}try{prepared=exports_value2.Clean(cleanSchemaFor(schema3),prepared)}catch{}return prepared}function sampleOf(schema3){try{return exports_value2.Create(schema3)}catch{return}}registerStringFormats();var REQUIRED_PROPERTY=45;function propertyName(path8){return path8.replace(/^\//,"").replace(/\//g,".")}function describe2(value2){if(value2===void 0)return"undefined";if(value2===null)return"null";if(typeof value2==="object")return JSON.stringify(value2);return String(value2)}function at(value2,path8){let current=value2;for(let segment of path8.split("/").filter(Boolean)){if(typeof current!=="object"||current===null)return;current=current[segment]}return current}function validate(schema3,value2,on){if(!schema3)return null;if(exports_value2.Check(schema3,value2))return null;let all=[...exports_value2.Errors(schema3,value2)],errors2=all.filter((error3)=>error3.type!==REQUIRED_PROPERTY),primary=errors2[0]??all[0],path8=primary?.path??"",message=primary?.message??"Invalid value",atRoot=path8==="";return{isSuccess:!1,success:!1,type:"validation",on,property:atRoot?"root":path8,message,summary:atRoot?message:summarise(path8,message,at(value2,path8)),expected:sampleOf(schema3),found:redact(value2),errors:errors2.map((error3)=>({...error3,value:redact(error3.value),summary:summarise(error3.path,error3.message,at(value2,error3.path))}))}}function describeExpectation(message){return message.replace(/^Expected\s+/i,"")}function redact(value2){if(value2===null)return"null";if(Array.isArray(value2))return`array(${value2.length})`;if(value2 instanceof Date)return"Date";if(typeof value2==="object"){let shape={};for(let key2 of Object.keys(value2))shape[key2]=redact(value2[key2]);return shape}if(value2===void 0)return"undefined";return typeof value2}function summarise(path8,message,found){return`Expected property '${propertyName(path8)}' to be ${describeExpectation(message)} but found: ${describe2(redact(found))}`}class RouteCollisionError extends Error{constructor(method,path8){super(`${method} ${path8} is registered twice. Two groups claiming one path is a wiring mistake, not a fallback: which handler answers would depend on registration order.`);this.name="RouteCollisionError"}}function joinPath2(prefix,path8){if(!prefix)return path8;let left=prefix.endsWith("/")?prefix.slice(0,-1):prefix;if(path8==="/"||path8==="")return left||"/";let right=path8.startsWith("/")?path8:`/${path8}`;return`${left}${right}`||"/"}function buildRoutes(groups,options={}){let table=new Map;for(let group of groups)for(let route of group.routes){let fullPath=joinPath2(group.prefix,route.path),method=route.method,byMethod=table.get(fullPath);if(!byMethod)byMethod=new Map,table.set(fullPath,byMethod);if(byMethod.has(method))throw new RouteCollisionError(method,fullPath);byMethod.set(method,{guards:[...group.guards??[],...route.guards??[]],route})}let out={},withSlashAlias=(path8)=>path8==="/"||path8.endsWith("/")?[path8]:[path8,`${path8}/`];for(let[path8,byMethod]of table){let handlers={};for(let[method,registered2]of byMethod){handlers[method]=async(request,server)=>{let set2=createResponseSet(),response;try{response=await answer(request,server,set2)}catch(error3){if(!options.onError)throw error3;let answered=await options.onError({set:set2,code:"UNKNOWN",error:error3,request});response=finalizeResponse(answered,set2)}if(options.onAfter)try{set2.status=response.status,await options.onAfter({request,set:set2})}catch(error3){console.error("[router] after-handler failed",error3)}return response};let answer=async(request,server,set2)=>{let url=new URL(request.url),params=request.params??{},query=Object.fromEntries(url.searchParams);if(options.onRequest){let early=await options.onRequest({request,set:set2,body:void 0,params,query,server});if(early!==void 0)return finalizeResponse(early,set2)}let body;try{body=await parseBody(request.clone(),registered2.route.type)}catch(error3){if(error3 instanceof BodyParseError){let bodySchema=registered2.route.body;if(bodySchema&&OPTIONAL_KIND in bodySchema)body=void 0;else return new Response(error3.message,{status:error3.status})}else throw error3}body=prepare(registered2.route.body,body,"body"),query=prepare(registered2.route.query,query,"query"),params=prepare(registered2.route.params,params,"params");for(let[target2,schema3,value2]of[["body",registered2.route.body,body],["query",registered2.route.query,query],["params",registered2.route.params,params]]){if(value2===void 0&&schema3&&OPTIONAL_KIND in schema3)continue;let failure=validate(schema3,value2,target2);if(failure){let headers=new Headers({"content-type":"application/json"});for(let[name2,value3]of Object.entries(set2.headers))if(value3!==void 0)headers.set(name2,String(value3));return new Response(JSON.stringify(failure,null,2),{status:422,headers})}}let guardContext={request,set:set2,body,params,query,server};for(let guard5 of registered2.guards){let early=await guard5(guardContext);if(early!==void 0)return finalizeResponse(early,set2)}try{let result=await registered2.route.handler({...options.context,request,params,query,body,set:set2});return finalizeResponse(result,set2)}catch(error3){if(!options.onError)throw error3;let answered=await options.onError({set:set2,code:"UNKNOWN",error:error3,request});return finalizeResponse(answered,set2)}}}for(let alias of withSlashAlias(path8))out[alias]=handlers}return out}init_websocket();var NOT_FOUND=()=>new Response("NOT_FOUND",{status:404});async function staticAsset(request,assets){if(!assets)return null;if(request.method!=="GET"&&request.method!=="HEAD")return null;let{pathname}=new URL(request.url),prefix=assets.prefix.endsWith("/")?assets.prefix.slice(0,-1):assets.prefix;if(pathname!==prefix&&!pathname.startsWith(`${prefix}/`))return null;let relative;try{relative=decodeURIComponent(pathname.slice(prefix.length))}catch{return new Response("NOT_FOUND",{status:404})}let{join:join7,resolve:resolve2,sep}=await import("path"),root=resolve2(assets.directory),target2=resolve2(join7(root,relative));if(target2!==root&&!target2.startsWith(root+sep))return new Response("NOT_FOUND",{status:404});let file=Bun.file(target2);if(!await file.exists())return null;return new Response(request.method==="HEAD"?null:file)}function serve(options){let routes=buildRoutes(options.groups,{onRequest:options.onRequest,onError:options.onError,onAfter:options.onAfter,context:options.context}),notFound=options.notFound??NOT_FOUND,socket=options.socket,server=Bun.serve({port:options.port??0,hostname:options.hostname,idleTimeout:options.idleTimeout??30,reusePort:options.reusePort??!0,...options.maxRequestBodyBytes!==void 0?{maxRequestBodySize:options.maxRequestBodyBytes}:{},routes,fetch:async(request,self2)=>{let asset=await staticAsset(request,options.staticAssets);if(asset)return asset;let set2=createResponseSet();if(options.onRequest){let url=new URL(request.url);try{let early=await options.onRequest({request,set:set2,body:void 0,params:{},query:Object.fromEntries(url.searchParams),server:self2});if(early!==void 0)return finalizeResponse(early,set2)}catch(error3){if(!options.onError)throw error3;let answered=await options.onError({set:set2,code:"UNKNOWN",error:error3,request});return finalizeResponse(answered,set2)}}if(socket){let upgraded=upgradeFor(socket,request,self2);if(upgraded)return upgraded}let missing=await notFound(request),headers=new Headers(missing.headers);for(let[name2,value2]of Object.entries(set2.headers))if(value2!==void 0&&!headers.has(name2))headers.set(name2,String(value2));let text2=await missing.text();return new Response(text2,{status:missing.status,headers})},websocket:socket?websocketHandlers(socket):void 0}),stopped=!1,runShutdown=async()=>{for(let step of options.onStop??[])try{await step()}catch(error3){console.error("[NucleusServer] shutdown step failed",error3)}},port=server.port??0,hostname=server.hostname??"localhost";return{port,hostname,url:`http://${hostname}:${port}`,stop:(closeActiveConnections=!1)=>{let stopping=Promise.resolve(server.stop(closeActiveConnections));if(stopped)return stopping;return stopped=!0,stopping.then(runShutdown)},raw:server}}function operationIdFor(method,path8){let tail2=path8.split("/").filter(Boolean).flatMap((segment)=>segment.startsWith(":")?["by",segment.slice(1)]:segment.split(/[-_]/)).filter(Boolean).map((word)=>word.charAt(0).toUpperCase()+word.slice(1)).join("");return`${method.toLowerCase()}${tail2}`}function toOpenApiPath(path8){return path8.split("/").map((segment)=>segment.startsWith(":")?`{${segment.slice(1)}}`:segment).join("/")}function pathParametersOf(path8,schema3){let declared=schema3?.properties;return path8.split("/").filter((segment)=>segment.startsWith(":")).map((segment)=>{let name2=segment.slice(1);return{name:name2,in:"path",required:!0,schema:declared?.[name2]??{type:"string"}}})}function queryParametersOf(schema3){let object3=schema3;if(!object3?.properties)return[];return Object.entries(object3.properties).map(([name2,value2])=>({name:name2,in:"query",required:object3.required?.includes(name2)??!1,schema:value2}))}function buildOpenApiDocument(groups,config={}){let info=config.documentation?.info,paths={};for(let group of groups)for(let route of group.routes){let declared=route.path==="/"?"":route.path,joined=`${group.prefix??""}${declared}`||"/",openApiPath=toOpenApiPath(joined),method=route.method.toLowerCase(),detail=route.detail,parameters4=[...pathParametersOf(joined,route.params),...queryParametersOf(route.query)],operation={operationId:operationIdFor(route.method,joined),responses:{"200":{}}};if(detail?.tags)operation.tags=detail.tags;if(detail?.summary)operation.summary=detail.summary;if(detail?.description)operation.description=detail.description;if(parameters4.length>0)operation.parameters=parameters4;if(route.body)operation.requestBody={content:{"application/json":{schema:route.body}}};if(paths[openApiPath]=paths[openApiPath]??{},!paths[openApiPath][method])paths[openApiPath][method]=operation}let document={openapi:"3.0.3",info:{title:info?.title??"Nucleus API",description:info?.description??"Auto-generated API documentation",version:info?.version??"1.0.0"},tags:config.documentation?.tags??[],paths};if(config.documentation?.servers)document.servers=config.documentation.servers;return document}function viewerHtml(documentUrl,title,description){let forHtml=(value2)=>value2.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/"/g,"&quot;");return`<!doctype html>
 <html>
   <head>
     <title>${forHtml(title)}</title>
@@ -606,4 +606,4 @@ ${content}
     <script id="api-reference" data-url="${forHtml(documentUrl)}"></script>
     <script src="https://cdn.jsdelivr.net/npm/@scalar/api-reference"></script>
   </body>
-</html>`}function chainGuards(...guards){return async(context)=>{for(let guard5 of guards){let early=await guard5(context);if(early!==void 0)return early}return}}function docsGroup(groups,config){let swagger=config.swagger;if(swagger?.enabled===!1)return null;let base=swagger?.path??"/swagger",info=swagger?.documentation?.info,title=info?.title??"Nucleus API",description=info?.description??"Auto-generated API documentation",document=buildOpenApiDocument(groups,swagger),page=viewerHtml(`${base}/json`,title,description);return{prefix:base,routes:[defineRoute({method:"GET",path:"/",detail:{summary:"API documentation",tags:["Documentation"]},handler:()=>new Response(page,{headers:{"content-type":"text/html; charset=utf8"}})}),defineRoute({method:"GET",path:"/json",detail:{summary:"OpenAPI document",tags:["Documentation"]},handler:()=>document})]}}async function createNucleusServer(options){await buildNucleus(options.config);let groups=getMountedRouteGroups();if(groups.length===0)throw Error("createNucleusServer: the plugin mounted no route groups. That is a wiring "+"fault, not an empty install \u2014 refusing to serve rather than answering 404 to everything.");let resolved=getResolvedOptions2(),rawOptions=options.config.options,securityOf=(candidate)=>typeof candidate==="object"&&candidate!==null?candidate.security?.maxRequestBodyBytes:void 0,maxRequestBodyBytes=securityOf(resolved)??securityOf(rawOptions),storageCeiling=requiredBodyCeiling({storageEnabled:resolved?.storage?.enabled,maxFileSizeBytes:resolved?.storage?.maxFileSizeBytes,maxFiles:resolved?.storage?.formData?.maxFiles}),bunBodyCeiling=bunBodyCeilingFor({storageRequired:storageCeiling,guardCeiling:maxRequestBodyBytes});for(let step of getBootSteps())await step({config:{serve:{maxRequestBodySize:bunBodyCeiling}}});let hostRoutes=options.routes??[],docs=docsGroup([...groups,...hostRoutes],options.config);return serve({groups:[...groups,...docs?[docs]:[],...hostRoutes],maxRequestBodyBytes:bunBodyCeiling,onStop:[...getShutdownSteps(),...options.onStop??[]],socket:options.socket??getMountedSocket()??void 0,staticAssets:(()=>{let directory=getMountedStaticAssets();return directory?{prefix:"/nucleus-core",directory}:void 0})(),onRequest:chainGuards(...options.onRequest?[options.onRequest]:[],createInboundGuard({maxRequestBodyBytes}),getAuthMiddleware()),onError:getErrorHandler(),onAfter:getAfterHandler()??void 0,context:(()=>{let runtime=getMountedRuntime2();return runtime?{nucleus:runtime}:void 0})(),port:options.port,hostname:options.hostname})}init_routeCollector();init_websocket();export{serve,defineWebSocketRoute,defineRoute,decodeHeaderList,createNucleusServer,collectRoutes,buildOpenApiDocument,buildNucleus};
+</html>`}function chainGuards(...guards){return async(context)=>{for(let guard5 of guards){let early=await guard5(context);if(early!==void 0)return early}return}}function docsGroup(groups,config){let swagger=config.swagger;if(swagger?.enabled===!1)return null;let base=swagger?.path??"/swagger",info=swagger?.documentation?.info,title=info?.title??"Nucleus API",description=info?.description??"Auto-generated API documentation",document=buildOpenApiDocument(groups,swagger),page=viewerHtml(`${base}/json`,title,description);return{prefix:base,routes:[defineRoute({method:"GET",path:"/",detail:{summary:"API documentation",tags:["Documentation"]},handler:()=>new Response(page,{headers:{"content-type":"text/html; charset=utf8"}})}),defineRoute({method:"GET",path:"/json",detail:{summary:"OpenAPI document",tags:["Documentation"]},handler:()=>document})]}}async function createNucleusServer(options){await buildNucleus(options.config);let groups=getMountedRouteGroups();if(groups.length===0)throw Error("createNucleusServer: the plugin mounted no route groups. That is a wiring "+"fault, not an empty install \u2014 refusing to serve rather than answering 404 to everything.");let resolved=getResolvedOptions2(),rawOptions=options.config.options,securityOf=(candidate)=>typeof candidate==="object"&&candidate!==null?candidate.security?.maxRequestBodyBytes:void 0,maxRequestBodyBytes=securityOf(resolved)??securityOf(rawOptions),storageCeiling=requiredBodyCeiling({storageEnabled:resolved?.storage?.enabled,maxFileSizeBytes:resolved?.storage?.maxFileSizeBytes,maxFiles:resolved?.storage?.formData?.maxFiles}),bunBodyCeiling=bunBodyCeilingFor({storageRequired:storageCeiling,guardCeiling:maxRequestBodyBytes});for(let step of getBootSteps())await step({config:{serve:{maxRequestBodySize:bunBodyCeiling}}});let hostRoutes=options.routes??[],resolvedSwagger=resolved?.swagger,outerSwagger=options.config.swagger,docs=docsGroup([...groups,...hostRoutes],{swagger:outerSwagger??resolvedSwagger});return serve({groups:[...groups,...docs?[docs]:[],...hostRoutes],maxRequestBodyBytes:bunBodyCeiling,onStop:[...getShutdownSteps(),...options.onStop??[]],socket:options.socket??getMountedSocket()??void 0,staticAssets:(()=>{let directory=getMountedStaticAssets();return directory?{prefix:"/nucleus-core",directory}:void 0})(),onRequest:chainGuards(...options.onRequest?[options.onRequest]:[],createInboundGuard({maxRequestBodyBytes}),getAuthMiddleware()),onError:getErrorHandler(),onAfter:getAfterHandler()??void 0,context:(()=>{let runtime=getMountedRuntime2();return runtime?{nucleus:runtime}:void 0})(),port:options.port,hostname:options.hostname})}init_routeCollector();init_websocket();export{serve,defineWebSocketRoute,defineRoute,decodeHeaderList,createNucleusServer,collectRoutes,buildOpenApiDocument,buildNucleus};