tina4-nodejs 3.13.138 → 3.13.139

package/packages/orm/dist/index.js

@@ -2612,6 +2612,8 @@ var auth_exports = {};
 __export(auth_exports, {
   Auth: () => Auth,
   JWT_LEEWAY_SECONDS: () => JWT_LEEWAY_SECONDS,
+  MIN_SECRET_BYTES: () => MIN_SECRET_BYTES,
+  NON_IDENTITY_TOKEN_TYPES: () => NON_IDENTITY_TOKEN_TYPES,
   algorithmAvailable: () => algorithmAvailable,
   authMiddleware: () => authMiddleware,
   authenticateRequest: () => authenticateRequest,
@@ -2621,7 +2623,10 @@ __export(auth_exports, {
   getPayload: () => getPayload,
   getToken: () => getToken,
   hashPassword: () => hashPassword,
+  insecureSecretMessage: () => insecureSecretMessage,
+  isIdentityPayload: () => isIdentityPayload,
   refreshToken: () => refreshToken,
+  requireBootSecret: () => requireBootSecret,
   resolveAlgorithm: () => resolveAlgorithm,
   validToken: () => validToken,
   validateApiKey: () => validateApiKey
@@ -2657,6 +2662,23 @@ async function _logWarning(message) {
 function _warnBlankSecret() {
   void _logWarning(BLANK_SECRET_WARNING);
 }
+function isIdentityPayload(payload) {
+  return payload != null && !NON_IDENTITY_TOKEN_TYPES.includes(payload.type);
+}
+function insecureSecretMessage(secret) {
+  const length = Buffer.byteLength(secret ?? "", "utf8");
+  if (length >= MIN_SECRET_BYTES) return null;
+  const what = length === 0 ? "is not set" : `is ${length} bytes`;
+  return `Auth: TINA4_SECRET ${what}; an HMAC JWT secret must be at least ${MIN_SECRET_BYTES} bytes. Generate one with \`openssl rand -hex 32\` and set TINA4_SECRET in your environment or .env.`;
+}
+function requireBootSecret() {
+  const algorithm = (process.env.TINA4_JWT_ALGORITHM ?? "").trim() || "HS256";
+  if (RSA_SIGN_ALGORITHMS.has(algorithm)) return;
+  const secret = process.env.TINA4_SECRET ?? "";
+  if (secret === "" && _isDev()) return;
+  const message = insecureSecretMessage(secret);
+  if (message) throw new Error(message);
+}
 function ensureDevSecret(cwd) {
   if (process.env.TINA4_SECRET) return null;
   if (!_isDev() || _isCi() || _isProduction()) {
@@ -2787,6 +2809,13 @@ function validToken(token, secret, algorithm) {
     const [h, p, sig] = parts;
     const header = JSON.parse(base64urlDecode(h).toString());
     if (header.alg !== resolvedAlgorithm) return null;
+    if (HMAC_DIGESTS.has(resolvedAlgorithm)) {
+      const weak = insecureSecretMessage(resolvedSecret);
+      if (weak) {
+        void _logWarning(weak);
+        return null;
+      }
+    }
     const signingInput = `${h}.${p}`;
     if (!verifySignature(signingInput, sig, resolvedSecret, resolvedAlgorithm)) {
       return null;
@@ -2818,6 +2847,8 @@ function getPayload(token) {
 function sign(input, secret, algorithm) {
   const digest = HMAC_DIGESTS.get(algorithm);
   if (digest) {
+    const weak = insecureSecretMessage(secret);
+    if (weak) throw new Error(weak);
     return base64urlEncode(createHmac(digest, secret).update(input).digest());
   }
   const rsaAlgorithm = RSA_SIGN_ALGORITHMS.get(algorithm);
@@ -2875,17 +2906,17 @@ function authMiddleware(secret, algorithm) {
       return;
     }
     const token = authHeader.slice(7);
-    if (!validToken(token, secret, algorithm)) {
+    const payload = validToken(token, secret, algorithm);
+    if (!isIdentityPayload(payload)) {
       res({ error: "Unauthorized" }, 401);
       return;
     }
-    req2.auth = getPayload(token);
+    req2.auth = payload;
     next();
   };
 }
 function refreshToken(token, expiresIn = 60) {
-  if (!validToken(token)) return null;
-  const payload = getPayload(token);
+  const payload = validToken(token);
   if (!payload) return null;
   const { iat: _iat, exp: _exp, ...claims } = payload;
   return getToken(claims, expiresIn);
@@ -2894,7 +2925,8 @@ function authenticateRequest(headers, secret, algorithm) {
   const authHeader = headers.authorization ?? headers.Authorization ?? "";
   if (!authHeader.startsWith("Bearer ")) return null;
   const token = authHeader.slice(7);
-  if (validToken(token, secret, algorithm)) return getPayload(token);
+  const payload = validToken(token, secret, algorithm);
+  if (payload) return isIdentityPayload(payload) ? payload : null;
   if (validateApiKey(token)) {
     return { _auth: "api_key" };
   }
@@ -2908,12 +2940,14 @@ function validateApiKey(provided, expected) {
   if (a.length !== b.length) return false;
   return timingSafeEqual(a, b);
 }
-var BLANK_SECRET_WARNING, HMAC_DIGESTS, RSA_SIGN_ALGORITHMS, KNOWN_ALGORITHMS, ALGORITHM_REMEDY, capabilityCache, JWT_LEEWAY_SECONDS, Auth;
+var BLANK_SECRET_WARNING, NON_IDENTITY_TOKEN_TYPES, MIN_SECRET_BYTES, HMAC_DIGESTS, RSA_SIGN_ALGORITHMS, KNOWN_ALGORITHMS, ALGORITHM_REMEDY, capabilityCache, JWT_LEEWAY_SECONDS, Auth;
 var init_auth = __esm({
   "../core/src/auth.ts"() {
     "use strict";
     init_dotenv();
     BLANK_SECRET_WARNING = "Auth: TINA4_SECRET is not set \u2014 JWT signing is insecure. Set TINA4_SECRET to a random value (e.g. `openssl rand -hex 32`) in your environment or .env before serving traffic. For LOCAL DEV, set TINA4_DEBUG=true and a per-machine secret is generated automatically into .env.local (gitignored). Seeing this warning means the run was NOT detected as dev \u2014 typically a container or CI without TINA4_DEBUG set, or TINA4_ENV=production.";
+    NON_IDENTITY_TOKEN_TYPES = ["form"];
+    MIN_SECRET_BYTES = 32;
     HMAC_DIGESTS = /* @__PURE__ */ new Map([
       ["HS256", "sha256"],
       ["HS384", "sha384"],
@@ -3296,9 +3330,9 @@ var init_cache = __esm({
         return entry.value;
       }
       async set(key, value, ttl) {
-        const expiresAt = ttl > 0 ? Date.now() + ttl * 1e3 : 0;
+        const expiresAt2 = ttl > 0 ? Date.now() + ttl * 1e3 : 0;
         this.store.delete(key);
-        this.store.set(key, { value, expiresAt });
+        this.store.set(key, { value, expiresAt: expiresAt2 });
         while (this.store.size > this.maxEntries) {
           const firstKey = this.store.keys().next().value;
           if (firstKey !== void 0) this.store.delete(firstKey);
@@ -3731,8 +3765,8 @@ ${s}\r
             const oldest = files.shift();
             if (oldest) fs.unlinkSync(path.join(this.dir, oldest.name));
           }
-          const expiresAt = ttl > 0 ? Date.now() / 1e3 + ttl : 0;
-          const entry = { key, value, expiresAt };
+          const expiresAt2 = ttl > 0 ? Date.now() / 1e3 + ttl : 0;
+          const entry = { key, value, expiresAt: expiresAt2 };
           fs.writeFileSync(this.keyPath(key), JSON.stringify(entry));
         } catch {
         }
@@ -5479,8 +5513,8 @@ function capCache(cache, maxEntries) {
 }
 function sweepExpiredCache(cache) {
   const now = Date.now();
-  for (const [key, [, expiresAt]] of cache) {
-    if (expiresAt <= now) cache.delete(key);
+  for (const [key, [, expiresAt2]] of cache) {
+    if (expiresAt2 <= now) cache.delete(key);
   }
 }
 function tokenize(source) {
@@ -6452,6 +6486,12 @@ function setFormTokenSessionId(sessionId) {
 }
 function _buildFormTokenJwt(descriptor = "") {
   const secret = process.env.TINA4_SECRET ?? "";
+  const secretBytes = Buffer.byteLength(secret, "utf8");
+  if (secretBytes < 32) {
+    throw new Error(
+      `Auth: TINA4_SECRET ${secretBytes === 0 ? "is not set" : `is ${secretBytes} bytes`}; an HMAC JWT secret must be at least 32 bytes. Generate one with \`openssl rand -hex 32\` and set TINA4_SECRET in your environment or .env.`
+    );
+  }
   const ttlMinutes = parseInt(process.env.TINA4_TOKEN_LIMIT || "60", 10);
   const header = { alg: "HS256", typ: "JWT" };
   const now = Math.floor(Date.now() / 1e3);
@@ -7993,8 +8033,8 @@ var init_engine = __esm({
         sweepExpiredCache(this.fragmentCache);
         const cached = this.fragmentCache.get(cacheKey);
         if (cached) {
-          const [htmlContent, expiresAt] = cached;
-          if (Date.now() < expiresAt) {
+          const [htmlContent, expiresAt2] = cached;
+          if (Date.now() < expiresAt2) {
             let i2 = start2 + 1;
             let depth = 0;
             while (i2 < tokens.length) {
@@ -8787,7 +8827,7 @@ function csrfBearerIsValid(req2, secret) {
   const authHeader = req2.headers.authorization ?? "";
   if (!authHeader.startsWith("Bearer ")) return false;
   const bearerToken = authHeader.slice(7).trim();
-  return Boolean(bearerToken && validToken(bearerToken, secret));
+  return Boolean(bearerToken && isIdentityPayload(validToken(bearerToken, secret)));
 }
 function csrfRequestToken(req2) {
   const query = req2.query ?? {};
@@ -9924,6 +9964,22 @@ var init_transport = __esm({
   }
 });
 
+// ../core/src/ssoIdentity.ts
+function liveSessionIdentity(stored) {
+  if (!stored || typeof stored !== "object") return null;
+  const identity = stored.identity;
+  if (!identity || typeof identity !== "object" || !identity.issuer || !identity.subject) return null;
+  const expiresAt2 = stored.expires_at ?? 0;
+  if (typeof expiresAt2 !== "number") return null;
+  if (expiresAt2 > 0 && Math.floor(Date.now() / 1e3) >= expiresAt2) return null;
+  return identity;
+}
+var init_ssoIdentity = __esm({
+  "../core/src/ssoIdentity.ts"() {
+    "use strict";
+  }
+});
+
 // ../core/src/authGate.ts
 function enforceRouteAuth(req2, res, match, isDevAdmin) {
   if (!(match.secure === true && match.noAuth !== true && !isDevAdmin)) {
@@ -9931,38 +9987,50 @@ function enforceRouteAuth(req2, res, match, isDevAdmin) {
   }
   const authHeader = req2.headers.authorization ?? "";
   const headerToken = authHeader.startsWith("Bearer ") ? authHeader.slice(7) : "";
-  let resolvedToken = "";
+  let payload = null;
   let tokenSource = "";
-  if (headerToken && validToken(headerToken)) {
-    resolvedToken = headerToken;
-    tokenSource = "header";
+  let resolvedToken = "";
+  if (headerToken) {
+    const candidate = validToken(headerToken);
+    if (isIdentityPayload(candidate)) {
+      payload = candidate;
+      tokenSource = "header";
+      resolvedToken = headerToken;
+    }
   }
-  if (!resolvedToken) {
+  if (!payload) {
     const bodyToken = req2.body?.formToken;
-    if (bodyToken && validToken(bodyToken)) {
-      resolvedToken = bodyToken;
-      tokenSource = "body";
+    if (bodyToken) {
+      const candidate = validToken(bodyToken);
+      if (isIdentityPayload(candidate)) {
+        payload = candidate;
+        tokenSource = "body";
+        resolvedToken = bodyToken;
+      }
     }
   }
-  if (!resolvedToken) {
-    const sso = req2.session?.get?.("_tina4_sso");
-    const identity = sso?.identity;
-    if (identity?.issuer && identity?.subject) {
+  if (!payload) {
+    const identity = liveSessionIdentity(req2.session?.get?.("_tina4_sso"));
+    if (identity) {
       req2.user = identity;
       return rbacForbidden(match, identity, res);
     }
     const sessionToken = req2.session?.get?.("token");
-    if (sessionToken && validToken(sessionToken)) {
-      resolvedToken = sessionToken;
-      tokenSource = "session";
+    if (sessionToken) {
+      const candidate = validToken(sessionToken);
+      if (isIdentityPayload(candidate)) {
+        payload = candidate;
+        tokenSource = "session";
+        resolvedToken = sessionToken;
+      }
     }
   }
-  if (!resolvedToken) {
+  if (!payload) {
     res.raw.writeHead(401, { "Content-Type": "application/json" });
     res.raw.end(JSON.stringify({ error: "Unauthorized" }));
     return true;
   }
-  req2.user = getPayload(resolvedToken) ?? {};
+  req2.user = payload;
   if (tokenSource === "body") {
     const fresh = refreshToken(resolvedToken);
     if (fresh) {
@@ -10012,6 +10080,7 @@ var init_authGate = __esm({
   "../core/src/authGate.ts"() {
     "use strict";
     init_auth();
+    init_ssoIdentity();
   }
 });
 
@@ -11085,8 +11154,8 @@ var init_mongoHandler = __esm({
         if (!result || result === "__EMPTY__") return null;
         try {
           const doc = JSON.parse(result);
-          const expiresAt = Number(doc?.expires_at ?? 0);
-          if (expiresAt > 0 && Date.now() / 1e3 > expiresAt) {
+          const expiresAt2 = Number(doc?.expires_at ?? 0);
+          if (expiresAt2 > 0 && Date.now() / 1e3 > expiresAt2) {
             this.destroy(sessionId);
             return null;
           }
@@ -11312,6 +11381,9 @@ parentPort.on("message", (message) => {
 
 // ../core/src/sessionHandlers/databaseHandler.ts
 import { DatabaseSync } from "node:sqlite";
+function sleepSync2(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
 function column(row, name) {
   if (name in row) return row[name];
   return row[name.toUpperCase()];
@@ -11320,7 +11392,7 @@ function schemeOf2(url) {
   const match = url.match(/^([a-zA-Z][a-zA-Z0-9+.-]*):/);
   return match ? match[1].toLowerCase() : "unknown";
 }
-var CREATE_TABLE, DatabaseSessionHandler;
+var CREATE_TABLE, CREATE_ATTEMPTS, CREATE_RETRY_DELAY_MS, DatabaseSessionHandler;
 var init_databaseHandler = __esm({
   "../core/src/sessionHandlers/databaseHandler.ts"() {
     "use strict";
@@ -11400,6 +11472,8 @@ var init_databaseHandler = __esm({
       END
     `
     };
+    CREATE_ATTEMPTS = 5;
+    CREATE_RETRY_DELAY_MS = 50;
     DatabaseSessionHandler = class {
       sqliteHandle = null;
       /** Set for SQLite. Null when this handler talks to a networked engine. */
@@ -11440,6 +11514,7 @@ var init_databaseHandler = __esm({
       get sqlite() {
         if (this.sqliteHandle === null) {
           this.sqliteHandle = new DatabaseSync(this.dbPath);
+          this.sqliteHandle.exec("PRAGMA busy_timeout = 5000");
           this.sqliteHandle.exec("PRAGMA journal_mode = WAL");
         }
         return this.sqliteHandle;
@@ -11527,15 +11602,55 @@ var init_databaseHandler = __esm({
         sqlCommandSync(this.target, sql, params);
       }
       /**
-       * Ensure the session table exists (called once on first use).
+       * Ensure the session table exists (called once on first use) - safely when
+       * several processes race to create it.
+       *
+       * Every per-engine statement above is check-then-act, so two processes can
+       * both find the table absent and both CREATE; the loser errors, and every
+       * engine spells that differently (a pg_type unique violation on PostgreSQL,
+       * Msg 2714 on SQL Server, an RDB$RELATIONS unique violation on Firebird). So
+       * a failure is judged by RE-CHECKING whether the table now exists, never by
+       * parsing the message - the rescue the Firebird note above has always
+       * assumed, and which was not here. MEASURED on the lab before it: six real
+       * processes racing lost one to five of them on PostgreSQL, SQLite and
+       * Firebird.
+       *
+       * The re-check is RETRIED because the loser can fail BEFORE the winner has
+       * committed. On MySQL, CREATE TABLE IF NOT EXISTS takes a shared metadata
+       * lock, checks, then upgrades it to exclusive; two upgrades deadlock, and when
+       * MySQL cannot back the victim off silently it answers 1213 "Deadlock found"
+       * while the winner's table is still invisible (tina4-php CI run 35972320442).
+       * Bounded, so a genuine failure (no CREATE grant) still throws. Same attempts
+       * and delays in all four frameworks.
        */
       ensureTable() {
         if (this.initialized) return;
         const ddl = CREATE_TABLE[this.engine];
-        if (this.target === null) this.sqlite.exec(ddl);
-        else sqlCommandSync(this.target, ddl, []);
+        for (let attempt = 1; ; attempt++) {
+          try {
+            if (this.target === null) this.sqlite.exec(ddl);
+            else sqlCommandSync(this.target, ddl, []);
+            break;
+          } catch (error2) {
+            if (this.tableExists()) break;
+            if (attempt >= CREATE_ATTEMPTS) throw error2;
+            sleepSync2(CREATE_RETRY_DELAY_MS * attempt);
+          }
+        }
         this.initialized = true;
       }
+      /**
+       * Whether tina4_session exists, asked the one way every engine answers alike:
+       * a query against it that returns no rows succeeds only if it is there.
+       */
+      tableExists() {
+        try {
+          this.query("SELECT 1 FROM tina4_session WHERE 1 = 0", []);
+          return true;
+        } catch {
+          return false;
+        }
+      }
       read(sessionId) {
         this.ensureTable();
         const rows = this.query(
@@ -11545,8 +11660,8 @@ var init_databaseHandler = __esm({
         const row = rows[0];
         if (!row) return null;
         const now = Date.now() / 1e3;
-        const expiresAt = Number(column(row, "expires_at") ?? 0);
-        if (expiresAt > 0 && expiresAt < now) {
+        const expiresAt2 = Number(column(row, "expires_at") ?? 0);
+        if (expiresAt2 > 0 && expiresAt2 < now) {
           this.destroy(sessionId);
           return null;
         }
@@ -11559,7 +11674,7 @@ var init_databaseHandler = __esm({
       write(sessionId, data, ttl) {
         this.ensureTable();
         const json = JSON.stringify(data);
-        const expiresAt = ttl > 0 ? Date.now() / 1e3 + ttl : 0;
+        const expiresAt2 = ttl > 0 ? Date.now() / 1e3 + ttl : 0;
         const existing = this.query(
           "SELECT session_id FROM tina4_session WHERE session_id = ?",
           [sessionId]
@@ -11567,12 +11682,12 @@ var init_databaseHandler = __esm({
         if (existing.length > 0) {
           this.exec(
             "UPDATE tina4_session SET data = ?, expires_at = ? WHERE session_id = ?",
-            [json, expiresAt, sessionId]
+            [json, expiresAt2, sessionId]
           );
         } else {
           this.exec(
             "INSERT INTO tina4_session (session_id, data, expires_at) VALUES (?, ?, ?)",
-            [sessionId, json, expiresAt]
+            [sessionId, json, expiresAt2]
           );
         }
       }
@@ -15567,7 +15682,7 @@ function envTruthy(val) {
   return ["true", "1", "yes", "on"].includes(val.trim().toLowerCase());
 }
 function isLoopback(ip) {
-  if (ip == null || ip === "") return true;
+  if (ip == null || ip === "") return false;
   let addr = ip.trim().toLowerCase();
   if (addr.startsWith("::ffff:")) addr = addr.slice(7);
   return addr === "::1" || addr === "localhost" || addr.startsWith("127.");
@@ -17158,6 +17273,7 @@ __export(graphql_exports, {
   graphqlAutoSchemaEnabled: () => graphqlAutoSchemaEnabled,
   graphqlEndpoint: () => graphqlEndpoint,
   graphqlMaxDepth: () => graphqlMaxDepth,
+  graphqlMaxNodes: () => graphqlMaxNodes,
   tokenize: () => tokenize2
 });
 function tokenize2(source) {
@@ -17197,7 +17313,12 @@ function graphqlMaxDepth() {
   const n = parseInt(raw, 10);
   return Number.isNaN(n) ? 50 : n;
 }
-var TOKEN_PATTERNS, ParseError, Parser, GraphQL, GraphQLType;
+function graphqlMaxNodes() {
+  const raw = (process.env.TINA4_GRAPHQL_MAX_NODES ?? "1000").trim();
+  const n = parseInt(raw, 10);
+  return Number.isNaN(n) ? 1e3 : n;
+}
+var TOKEN_PATTERNS, ParseError, Parser, ComplexityError, GraphQL, GraphQLType;
 var init_graphql = __esm({
   "../core/src/graphql.ts"() {
     "use strict";
@@ -17236,9 +17357,16 @@ var init_graphql = __esm({
     Parser = class {
       tokens;
       pos;
+      // F2: bound the parser's own recursion. A deeply nested query
+      // ("{a{a{a...}}}") otherwise recurses in parseSelectionSet until the call
+      // stack overflows — BEFORE the execution-time depth guard can run. Reusing
+      // TINA4_GRAPHQL_MAX_DEPTH keeps parse and execution on one bound.
+      depth = 0;
+      maxDepth;
       constructor(tokens) {
         this.tokens = tokens;
         this.pos = 0;
+        this.maxDepth = graphqlMaxDepth();
       }
       peek() {
         return this.pos < this.tokens.length ? this.tokens[this.pos] : null;
@@ -17320,6 +17448,17 @@ var init_graphql = __esm({
         };
       }
       parseSelectionSet() {
+        this.depth++;
+        if (this.maxDepth > 0 && this.depth > this.maxDepth) {
+          throw new Error(`Query exceeds maximum depth of ${this.maxDepth}`);
+        }
+        try {
+          return this.parseSelectionSetInner();
+        } finally {
+          this.depth--;
+        }
+      }
+      parseSelectionSetInner() {
         this.expect("LBRACE");
         const selections = [];
         while (!this.match("RBRACE")) {
@@ -17474,6 +17613,8 @@ var init_graphql = __esm({
         return t;
       }
     };
+    ComplexityError = class extends Error {
+    };
     GraphQL = class _GraphQL {
       types = /* @__PURE__ */ new Map();
       queries = /* @__PURE__ */ new Map();
@@ -17496,6 +17637,12 @@ var init_graphql = __esm({
        * spread / inline fragment, so circular fragments are caught too.
        */
       maxDepth = graphqlMaxDepth();
+      /**
+       * Maximum expanded selection nodes per query (from `TINA4_GRAPHQL_MAX_NODES`,
+       * default 1000; `<= 0` disables). Bounds query WIDTH — fragment bombs and
+       * alias explosions — which the depth guard does not. See {@link graphqlMaxNodes}.
+       */
+      maxNodes = graphqlMaxNodes();
       /**
        * Decorator-style resolver registration.
        *
@@ -17643,6 +17790,16 @@ var init_graphql = __esm({
           return { data: null, errors: [{ message: "No operation found" }] };
         }
         const op = operations[0];
+        if (this.maxNodes > 0) {
+          try {
+            this.assertComplexity(op.selections, fragments);
+          } catch (e) {
+            if (e instanceof ComplexityError) {
+              return { data: null, errors: [{ message: e.message }] };
+            }
+            throw e;
+          }
+        }
         const resolvers = op.operation === "query" ? this.queries : this.mutations;
         for (const vdef of op.variables) {
           if (!(vdef.name in vars) && vdef.default !== void 0) {
@@ -17668,6 +17825,36 @@ var init_graphql = __esm({
        * instead of recursing until the interpreter stack overflows. Top-level
        * starts at depth 1; `maxDepth <= 0` disables the guard.
        */
+      /**
+       * Count the expanded selection nodes, throwing {@link ComplexityError} past
+       * `maxNodes` (F2). Fragment spreads are expanded (so a fragment bomb is
+       * counted, not the small unexpanded document) and every field — including
+       * each alias — counts once. The count is capped by `maxNodes` and the walk by
+       * `maxDepth`, so a circular fragment trips the budget instead of looping and
+       * the check itself can never cost more than the budget.
+       */
+      assertComplexity(selections, fragments) {
+        const depthCap = this.maxDepth > 0 ? this.maxDepth : 1e3;
+        let count = 0;
+        const walk2 = (sels, depth) => {
+          if (depth > depthCap) return;
+          for (const sel of sels) {
+            count++;
+            if (count > this.maxNodes) {
+              throw new ComplexityError(`Query exceeds maximum complexity of ${this.maxNodes} nodes`);
+            }
+            if (sel.kind === "fragment_spread") {
+              const frag = fragments.get(sel.name);
+              if (frag) walk2(frag.selections, depth + 1);
+            } else if (sel.kind === "inline_fragment") {
+              walk2(sel.selections, depth + 1);
+            } else if (sel.kind === "field" && sel.selections) {
+              walk2(sel.selections, depth + 1);
+            }
+          }
+        };
+        walk2(selections, 1);
+      }
       async resolveSelectionsInto(selections, resolvers, parent, variables, context, fragments, target, depth) {
         const errors = [];
         if (this.maxDepth > 0 && depth > this.maxDepth) {
@@ -18870,7 +19057,8 @@ function wsAuthorized(route, headers, queryString = "", subprotocol = "") {
   const token = wsToken(headers, queryString, subprotocol);
   if (!token) return [null, false];
   const payload = validToken(token);
-  return [payload, payload !== null];
+  if (!isIdentityPayload(payload)) return [null, false];
+  return [payload, true];
 }
 function offeredBearerSubprotocol(subprotocol) {
   return subprotocol.split(",").some((p) => p.trim().toLowerCase() === "bearer");
@@ -20065,12 +20253,36 @@ var init_mongoBackend = __esm({
             }
           }
           else if (operation === "size") {
-            const count = await col.countDocuments({
-              queue: queueName,
-              status: "pending",
-            });
+            // ADR-0022 dec 7: size(status) must not answer a different question.
+            // The dead aliases count the .dead_letter store (== deadLetters().length);
+            // reserved/completed count by status; else pending. data = status.
+            const status = data || "pending";
+            let count: number;
+            if (status === "dead" || status === "failed" || status === "dead_letter") {
+              count = await col.countDocuments({ queue: queueName + ".dead_letter" });
+            } else if (status === "reserved" || status === "completed") {
+              count = await col.countDocuments({ queue: queueName, status });
+            } else {
+              count = await col.countDocuments({ queue: queueName, status: "pending" });
+            }
             process.stdout.write(String(count));
           }
+          else if (operation === "reject") {
+            // Dead-letter NOW, no retry (ADR-0023). Floor attempts at maxRetries
+            // so it reads as exhausted (parity with fail()'s dead-letter branch
+            // and size("dead")). data = JSON { id, reason, maxRetries }.
+            const info = JSON.parse(data);
+            const doc = await col.findOne({ queue: queueName, id: info.id });
+            if (doc) {
+              const attempts = Math.max((doc.attempts || 0) + 1, info.maxRetries);
+              await col.insertOne({
+                ...doc, _id: undefined, attempts,
+                status: "dead", queue: queueName + ".dead_letter", error: info.reason,
+              });
+              await col.deleteOne({ _id: doc._id, queue: queueName });
+            }
+            process.stdout.write("__OK__");
+          }
           else if (operation === "clear") {
             await col.deleteMany({ queue: queueName });
             process.stdout.write("__CLEARED__");
@@ -20306,11 +20518,20 @@ var init_mongoBackend = __esm({
           return null;
         }
       }
-      size(queue) {
-        const result = this.execSync("size", queue);
+      size(queue, status2 = "pending") {
+        const result = this.execSync("size", queue, status2);
         const num = parseInt(result, 10);
         return isNaN(num) ? 0 : num;
       }
+      /**
+       * Dead-letter a job immediately — no retry (ADR-0023 reject()). Distinct from
+       * fail(): fail() requeues until maxRetries is spent. attempts is floored at
+       * maxRetries so deadLetters()/size("dead") (which filter/scope to the
+       * dead-letter store) see it.
+       */
+      reject(queue, id, reason, maxRetries) {
+        this.execSync("reject", queue, JSON.stringify({ id, reason, maxRetries }));
+      }
       clear(queue) {
         this.execSync("clear", queue);
       }
@@ -20405,7 +20626,9 @@ function createJob(data, queue) {
       queue._failJob(job.topic, job, reason, queue.getMaxRetries());
     },
     reject(reason = "") {
-      job.fail(reason);
+      job.status = "dead";
+      job.error = reason;
+      queue._rejectJob(job.topic, job, reason, queue.getMaxRetries());
     },
     retry(delaySeconds) {
       queue._retryJob(job.topic, job, delaySeconds);
@@ -21014,6 +21237,20 @@ var init_liteBackend = __esm({
        * dead-letter file -- two spellings of the same intent that previously
        * diverged.
        */
+      /**
+       * Reject a job permanently — dead-letter it NOW, no retry (ADR-0023).
+       *
+       * Unlike failJob(), which requeues until maxRetries is spent, rejectJob()
+       * moves a known-poison job straight to the dead-letter store. attempts is
+       * floored at maxRetries so deadLetters() (attempts >= maxRetries) returns it
+       * and size("dead") agrees.
+       */
+      rejectJob(queue, job, reason, maxRetries) {
+        this.clearReservation(queue, job.id);
+        job.attempts = Math.max((job.attempts || 0) + 1, maxRetries);
+        job.error = reason;
+        this.deadLetter(queue, job, reason);
+      }
       retryJob(queue, job, delaySeconds) {
         this.clearReservation(queue, job.id);
         try {
@@ -21235,7 +21472,7 @@ var init_queue = __esm({
       size(status2 = "pending") {
         const q = this.topic;
         if (this.externalBackend) {
-          return this.externalBackend.size(q);
+          return this.externalBackend.size(q, status2);
         }
         return this.liteBackend.size(q, status2);
       }
@@ -21503,6 +21740,17 @@ var init_queue = __esm({
         }
         this.liteBackend.failJob(queue, job, error2, maxRetries, this._retryBackoff);
       }
+      /**
+       * Dead-letter a job immediately — no retry (ADR-0023 reject()). Distinct from
+       * _failJob, which retries until maxRetries is spent.
+       */
+      _rejectJob(queue, job, reason, maxRetries) {
+        if (this.externalBackend?.reject) {
+          this.externalBackend.reject(queue, job.id, reason, maxRetries);
+          return;
+        }
+        this.liteBackend.rejectJob(queue, job, reason, maxRetries);
+      }
       /**
        * Re-queue a job back to the main queue directory with incremented attempts.
        */
@@ -27214,13 +27462,20 @@ var sso_exports = {};
 __export(sso_exports, {
   SSO: () => Sso,
   Sso: () => Sso,
-  SsoError: () => SsoError
+  SsoError: () => SsoError,
+  liveSessionIdentity: () => liveSessionIdentity
 });
 import { createHash as createHash9, randomBytes as randomBytes5, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
+function expiresAt(tokens) {
+  const lifetime = Number(tokens.expires_in ?? 0);
+  return lifetime > 0 ? Math.floor(Date.now() / 1e3) + lifetime : 0;
+}
 var SsoError, Sso;
 var init_sso = __esm({
   "../core/src/sso.ts"() {
     "use strict";
+    init_ssoIdentity();
+    init_ssoIdentity();
     SsoError = class extends Error {
     };
     Sso = class _Sso {
@@ -27426,13 +27681,12 @@ var init_sso = __esm({
           access_token: tokens.access_token,
           refresh_token: tokens.refresh_token,
           id_token: tokens.id_token,
-          expires_at: Math.floor(Date.now() / 1e3) + Number(tokens.expires_in ?? 0)
+          expires_at: expiresAt(tokens)
         });
         return { identity, return_to: _Sso.safeReturn(pending.return_to) };
       }
       identity(requestOrSession) {
-        const stored = this.session(requestOrSession)?.get(_Sso.SESSION_KEY);
-        const identity = stored?.identity ?? null;
+        const identity = liveSessionIdentity(this.session(requestOrSession)?.get(_Sso.SESSION_KEY));
         if (identity && requestOrSession?.session) requestOrSession.user = identity;
         return identity;
       }
@@ -27459,7 +27713,7 @@ var init_sso = __esm({
             access_token: tokens.access_token,
             refresh_token: tokens.refresh_token ?? stored.refresh_token,
             id_token: tokens.id_token ?? stored.id_token,
-            expires_at: Math.floor(Date.now() / 1e3) + Number(tokens.expires_in ?? 0)
+            expires_at: expiresAt(tokens)
           });
           return identity;
         } catch (error2) {
@@ -27601,12 +27855,12 @@ function bannerSurfaceLines(port, opts) {
   ];
 }
 function swaggerAdvertised() {
-  const TRUTHY2 = ["true", "1", "yes", "on"];
+  const TRUTHY3 = ["true", "1", "yes", "on"];
   const raw = (process.env.TINA4_SWAGGER_ENABLED ?? "").trim().toLowerCase();
   if (raw === "") {
-    return TRUTHY2.includes((process.env.TINA4_DEBUG ?? "").trim().toLowerCase());
+    return TRUTHY3.includes((process.env.TINA4_DEBUG ?? "").trim().toLowerCase());
   }
-  return TRUTHY2.includes(raw);
+  return TRUTHY3.includes(raw);
 }
 async function autoMigrateOnStartup(migrationDir = "migrations", base = process.cwd()) {
   const dir = resolve15(base, migrationDir);
@@ -28525,8 +28779,9 @@ function wireLocaleGlobal(frondEngine, base) {
 async function startServer(config) {
   loadEnv(".env.local");
   loadEnv();
-  const { ensureDevSecret: ensureDevSecret2 } = await Promise.resolve().then(() => (init_auth(), auth_exports));
+  const { ensureDevSecret: ensureDevSecret2, requireBootSecret: requireBootSecret2 } = await Promise.resolve().then(() => (init_auth(), auth_exports));
   ensureDevSecret2();
+  requireBootSecret2();
   _checkLegacyEnvVars();
   const resolved = resolvePortAndHost(config);
   const host = resolved.host;
@@ -30722,6 +30977,178 @@ var init_service = __esm({
   }
 });
 
+// ../core/src/ssrf.ts
+import { isIP } from "node:net";
+import { lookup } from "node:dns/promises";
+function v4ToBytes(ip) {
+  const parts = ip.split(".");
+  if (parts.length !== 4) return null;
+  const bytes = new Uint8Array(4);
+  for (let i = 0; i < 4; i++) {
+    const n = Number(parts[i]);
+    if (!Number.isInteger(n) || n < 0 || n > 255 || !/^\d+$/.test(parts[i])) return null;
+    bytes[i] = n;
+  }
+  return bytes;
+}
+function v6ToBytes(input) {
+  let ip = input.split("%")[0];
+  const lastColon = ip.lastIndexOf(":");
+  const tail = ip.slice(lastColon + 1);
+  if (tail.includes(".")) {
+    const v4 = v4ToBytes(tail);
+    if (!v4) return null;
+    const hextetA = (v4[0] << 8 | v4[1]).toString(16);
+    const hextetB = (v4[2] << 8 | v4[3]).toString(16);
+    ip = ip.slice(0, lastColon + 1) + hextetA + ":" + hextetB;
+  }
+  const halves = ip.split("::");
+  if (halves.length > 2) return null;
+  const head = halves[0] ? halves[0].split(":") : [];
+  const back = halves.length === 2 ? halves[1] ? halves[1].split(":") : [] : [];
+  let groups;
+  if (halves.length === 1) {
+    if (head.length !== 8) return null;
+    groups = head;
+  } else {
+    const missing = 8 - (head.length + back.length);
+    if (missing < 0) return null;
+    groups = [...head, ...Array(missing).fill("0"), ...back];
+  }
+  if (groups.length !== 8) return null;
+  const bytes = new Uint8Array(16);
+  for (let i = 0; i < 8; i++) {
+    if (!/^[0-9a-fA-F]{1,4}$/.test(groups[i])) return null;
+    const g = parseInt(groups[i], 16);
+    bytes[i * 2] = g >> 8 & 255;
+    bytes[i * 2 + 1] = g & 255;
+  }
+  return bytes;
+}
+function ipToBytes(ip) {
+  const cleaned = ip.split("%")[0];
+  const family = isIP(cleaned);
+  if (family === 4) return v4ToBytes(cleaned);
+  if (family === 6) {
+    const bytes = v6ToBytes(cleaned);
+    if (!bytes) return null;
+    const isMapped = bytes.subarray(0, 10).every((b) => b === 0) && bytes[10] === 255 && bytes[11] === 255;
+    return isMapped ? bytes.subarray(12) : bytes;
+  }
+  return null;
+}
+function parseCidr(cidr) {
+  const [netStr, bitsStr] = cidr.split("/");
+  const net4 = ipToBytes(netStr);
+  if (!net4) return null;
+  return { net: net4, bits: Number(bitsStr) };
+}
+function inCidr(packed, cidr) {
+  if (packed.length !== cidr.net.length) return false;
+  const whole = Math.floor(cidr.bits / 8);
+  const remainder = cidr.bits % 8;
+  for (let i = 0; i < whole; i++) {
+    if (packed[i] !== cidr.net[i]) return false;
+  }
+  if (remainder === 0) return true;
+  const mask = 255 << 8 - remainder & 255;
+  return (packed[whole] & mask) === (cidr.net[whole] & mask);
+}
+function allowPrivateRequests() {
+  return TRUTHY2.has((process.env[ALLOW_PRIVATE_ENV] ?? "").trim().toLowerCase());
+}
+function isBlockedAddress(ip) {
+  const packed = ipToBytes(ip);
+  if (!packed) return true;
+  return BLOCKED.some((cidr) => inCidr(packed, cidr));
+}
+function matchesAllowList(host, port, resolved, allowHosts) {
+  const hostLower = host.toLowerCase();
+  for (const raw of allowHosts ?? []) {
+    const entry = String(raw).trim().toLowerCase();
+    if (!entry) continue;
+    if (entry === hostLower || entry === `${hostLower}:${port}`) return true;
+    if (entry.includes("/")) {
+      const cidr = parseCidr(entry);
+      if (cidr && resolved.some((ip) => {
+        const packed = ipToBytes(ip);
+        return packed !== null && inCidr(packed, cidr);
+      })) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+function logBlock(host, ip) {
+  void Promise.resolve().then(() => (init_logger(), logger_exports)).then((mod) => mod.Log?.warning?.(`SSRF guard blocked outbound request to ${host} (${ip})`)).catch(() => void 0);
+}
+async function guardUrl(url, allowHosts) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new SsrfError(`Blocked request: '${url}' is not a valid URL`);
+  }
+  const scheme = parsed.protocol.replace(/:$/, "").toLowerCase();
+  if (scheme !== "http" && scheme !== "https") {
+    throw new SsrfError(`Blocked request: URL scheme '${scheme || "(none)"}' is not http or https`);
+  }
+  const host = parsed.hostname.replace(/^\[|\]$/g, "");
+  if (!host) {
+    throw new SsrfError("Blocked request: URL has no host");
+  }
+  const port = parsed.port ? Number(parsed.port) : scheme === "https" ? 443 : 80;
+  if (allowPrivateRequests()) return;
+  let resolved;
+  try {
+    const results = await lookup(host, { all: true });
+    resolved = results.map((r) => r.address);
+  } catch {
+    throw new SsrfError(`Blocked request to ${host}: cannot resolve host`);
+  }
+  if (resolved.length === 0) {
+    throw new SsrfError(`Blocked request to ${host}: cannot resolve host`);
+  }
+  if (matchesAllowList(host, port, resolved, allowHosts)) return;
+  for (const ip of resolved) {
+    if (isBlockedAddress(ip)) {
+      logBlock(host, ip);
+      throw new SsrfError(
+        `Blocked request to private/internal address ${ip} (host ${host}): set ${ALLOW_PRIVATE_ENV}=true to allow, or pass an allow-list.`
+      );
+    }
+  }
+}
+var ALLOW_PRIVATE_ENV, TRUTHY2, SsrfError, BLOCKED_CIDRS, BLOCKED;
+var init_ssrf = __esm({
+  "../core/src/ssrf.ts"() {
+    "use strict";
+    ALLOW_PRIVATE_ENV = "TINA4_ALLOW_PRIVATE_REQUESTS";
+    TRUTHY2 = /* @__PURE__ */ new Set(["1", "true", "yes", "on"]);
+    SsrfError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "SsrfError";
+      }
+    };
+    BLOCKED_CIDRS = [
+      "0.0.0.0/8",
+      "10.0.0.0/8",
+      "127.0.0.0/8",
+      "169.254.0.0/16",
+      "172.16.0.0/12",
+      "192.168.0.0/16",
+      "100.64.0.0/10",
+      "::1/128",
+      "::/128",
+      "fc00::/7",
+      "fe80::/10"
+    ];
+    BLOCKED = BLOCKED_CIDRS.map(parseCidr).filter((c) => c !== null);
+  }
+});
+
 // ../core/src/api.ts
 import http from "node:http";
 import https from "node:https";
@@ -30878,6 +31305,7 @@ var init_api = __esm({
   "../core/src/api.ts"() {
     "use strict";
     init_version();
+    init_ssrf();
     ApiStreamError = class extends Error {
       constructor(message, status2 = null) {
         super(message);
@@ -30932,6 +31360,7 @@ var init_api = __esm({
       transportFn;
       cookiesEnabled;
       cookies;
+      allowHosts;
       /**
        * Construct an Api client.
        *
@@ -30971,6 +31400,7 @@ var init_api = __esm({
         this.transportFn = void 0;
         this.cookiesEnabled = false;
         this.cookies = {};
+        this.allowHosts = [];
         if (typeof authHeaderOrOptions === "object" && authHeaderOrOptions !== null) {
           const opts = authHeaderOrOptions;
           this.authHeader = opts.authHeader ?? "";
@@ -30980,6 +31410,7 @@ var init_api = __esm({
           this.retryBackoff = opts.retryBackoff ?? 0.5;
           this.transportFn = opts.transport;
           this.cookiesEnabled = opts.cookies ?? false;
+          this.allowHosts = opts.allowHosts ?? [];
           if (opts.bearerToken != null) {
             this.setBearerToken(opts.bearerToken);
           } else if (opts.username != null && opts.password != null) {
@@ -31293,7 +31724,12 @@ var init_api = __esm({
        * body-phase timeout is applied by the caller (streamBytes) via
        * `res.destroy()`.
        */
-      openStreamRequest(method, url, headers, data, connectSec) {
+      async openStreamRequest(method, url, headers, data, connectSec) {
+        try {
+          await guardUrl(url, this.allowHosts);
+        } catch (err) {
+          throw new ApiStreamError(err instanceof Error ? err.message : String(err), null);
+        }
         return new Promise((resolve21, reject) => {
           let parsed;
           try {
@@ -31352,10 +31788,11 @@ var init_api = __esm({
        */
       buildRequest(method, contentType, body, extraHeaders, targetUrl) {
         const headers = { "User-Agent": `Tina4/${TINA4_VERSION}`, ...this.headers };
-        if (this.authHeader) {
+        const sameOriginAsBase = targetUrl === void 0 || sameOrigin(targetUrl, this.baseUrl);
+        if (this.authHeader && sameOriginAsBase) {
           headers["Authorization"] = this.authHeader;
         }
-        if (this.cookiesEnabled) {
+        if (this.cookiesEnabled && sameOriginAsBase) {
           const cookieHeader = this.cookieHeader();
           if (cookieHeader) {
             headers["Cookie"] = cookieHeader;
@@ -31456,7 +31893,12 @@ var init_api = __esm({
        * bearer token / session cookie never leaks to a host you didn't
        * authenticate to.
        */
-      performRequest(method, url, headers, data, redirectsLeft) {
+      async performRequest(method, url, headers, data, redirectsLeft) {
+        try {
+          await guardUrl(url, this.allowHosts);
+        } catch (err) {
+          return { kind: "error", error: err instanceof Error ? err.message : String(err) };
+        }
         return new Promise((resolve21) => {
           let parsed;
           try {
@@ -34196,6 +34638,7 @@ var CURVE, RECORD_SIZE, MAX_PAYLOAD, PushError, Push;
 var init_push = __esm({
   "../core/src/push.ts"() {
     "use strict";
+    init_ssrf();
     CURVE = "prime256v1";
     RECORD_SIZE = 4096;
     MAX_PAYLOAD = RECORD_SIZE - 17;
@@ -34270,10 +34713,19 @@ var init_push = __esm({
         return { rawPublic, rawPrivate };
       }
       async deliver(endpoint, config, keys, body) {
+        try {
+          await guardUrl(endpoint.toString(), this.options.allowHosts);
+        } catch (error2) {
+          if (error2 instanceof SsrfError) throw new PushError(error2.message);
+          throw error2;
+        }
         let response;
         try {
           response = await fetch(endpoint, {
             method: "POST",
+            // A real push service answers the POST directly; a redirect from a push
+            // endpoint is not followed to a private address (ADR-0084).
+            redirect: "manual",
             headers: {
               Authorization: `vapid t=${vapidToken(endpoint.toString(), config.subject, keys.rawPrivate, keys.rawPublic)}, k=${config.publicKey}`,
               "Content-Encoding": "aes128gcm",
@@ -36360,6 +36812,7 @@ var init_testClient = __esm({
           reqHeaders["content-length"] = String(Buffer.byteLength(rawBody));
         }
         const socket = new Socket();
+        Object.defineProperty(socket, "remoteAddress", { value: "127.0.0.1" });
         const rawReq = new IncomingMessage2(socket);
         rawReq.method = method.toUpperCase();
         rawReq.url = path10;
@@ -36732,6 +37185,7 @@ var init_validator = __esm({
 var src_exports2 = {};
 __export(src_exports2, {
   AI_TOOLS: () => AI_TOOLS,
+  ALLOW_PRIVATE_ENV: () => ALLOW_PRIVATE_ENV,
   APPLICATION_FORM: () => APPLICATION_FORM,
   APPLICATION_JSON: () => APPLICATION_JSON,
   APPLICATION_OCTET: () => APPLICATION_OCTET,
@@ -36839,6 +37293,7 @@ __export(src_exports2, {
   Session: () => Session,
   Sso: () => Sso,
   SsoError: () => SsoError,
+  SsrfError: () => SsrfError,
   TAKEOVER_KILLED: () => TAKEOVER_KILLED,
   TAKEOVER_NOTHING: () => TAKEOVER_NOTHING,
   TAKEOVER_REFUSALS: () => TAKEOVER_REFUSALS,
@@ -36872,6 +37327,7 @@ __export(src_exports2, {
   addHtmlHelpers: () => addHtmlHelpers,
   algorithmAvailable: () => algorithmAvailable,
   allEnv: () => allEnv,
+  allowPrivateRequests: () => allowPrivateRequests,
   any: () => any,
   attachCsrfFromEnv: () => attachCsrfFromEnv,
   authMiddleware: () => authMiddleware,
@@ -36937,6 +37393,7 @@ __export(src_exports2, {
   graphqlAutoSchemaEnabled: () => graphqlAutoSchemaEnabled,
   graphqlEndpoint: () => graphqlEndpoint,
   graphqlMaxDepth: () => graphqlMaxDepth,
+  guardUrl: () => guardUrl,
   handle: () => handle,
   handleFeedbackTurn: () => handleFeedbackTurn,
   handleFeedbackWidgetJs: () => handleFeedbackWidgetJs,
@@ -36950,6 +37407,7 @@ __export(src_exports2, {
   installAll: () => installAll,
   installSelected: () => installSelected,
   isBannerSuppressed: () => isBannerSuppressed,
+  isBlockedAddress: () => isBlockedAddress,
   isDebugMode: () => isDebugMode,
   isDev: () => isDev,
   isInstalled: () => isInstalled,
@@ -37069,6 +37527,7 @@ var init_src2 = __esm({
     init_service();
     init_cache();
     init_api();
+    init_ssrf();
     init_context();
     init_events();
     init_devAdmin();
@@ -44910,11 +45369,11 @@ async function eagerLoadBelongsToRelation(instances, model, relatedClass, relati
   const relatedPkColumn = relatedClass.getDbColumn(relatedPk);
   const related = await eagerQueryRelated(relatedClass, relatedPkColumn, values);
   if (nested.length > 0 && related.length > 0) await relatedClass._eagerLoad(related, nested);
-  const lookup = {};
-  for (const record of related) lookup[_joinKey(record[relatedPk])] = record;
+  const lookup2 = {};
+  for (const record of related) lookup2[_joinKey(record[relatedPk])] = record;
   for (const instance of instances) {
     const value = instance[fkProp];
-    relationshipCache(instance)[relationName] = value !== void 0 && value !== null ? lookup[_joinKey(value)] ?? null : null;
+    relationshipCache(instance)[relationName] = value !== void 0 && value !== null ? lookup2[_joinKey(value)] ?? null : null;
   }
 }
 async function eagerLoadRelation(instances, model, relationName, nested) {