gemi 0.106.0 → 0.108.0

package/dist/{chunk-70e5fypb.js.map → chunk-h2hdpm70.js.map}

@@ -1,10 +1,11 @@
 {
   "version": 3,
-  "sources": ["../server/httpProd.ts", "../server/compression.ts", "../server/staticFile.ts", "../server/generateEtag.ts", "../server/modulePreloads.ts", "../client/chunkLoadRecovery.ts", "../server/staticAssetMiss.ts", "../server/unhandledError.ts", "../server/forwardedFor.ts"],
+  "sources": ["../server/httpProd.ts", "../server/compression.ts", "../server/staticFile.ts", "../vite/precompressAssets.ts", "../server/generateEtag.ts", "../server/modulePreloads.ts", "../client/chunkLoadRecovery.ts", "../server/staticAssetMiss.ts", "../server/unhandledError.ts", "../server/forwardedFor.ts"],
   "sourcesContent": [
-    "import { join, resolve, sep } from \"node:path\";\nimport { compressResponse } from \"./compression\";\nimport { listPublicFiles, staticFileResponse } from \"./staticFile\";\nimport { stat } from \"node:fs/promises\";\nimport { createStyles } from \"./styles\";\nimport { CLIENT_ENTRY_KEY, collectModulePreloads, createClientEntry } from \"./modulePreloads\";\nimport type { App } from \"../app\";\nimport { Instrumentation } from \"./types\";\nimport { printStartupBanner } from \"./banner\";\nimport { isReservedAssetPath, staticAssetMiss } from \"./staticAssetMiss\";\nimport { assetUrl, readBuiltAssetBase } from \"../config/assetBase\";\nimport { isApiPath } from \"../services/router/apiPath\";\nimport { projectRoot } from \"../support/discover\";\nimport { unhandledErrorResponse } from \"./unhandledError\";\nimport { applyForwardedTrust, parseTrustProxy } from \"./forwardedFor\";\n\n// The rule this file used to spell out itself. It moved to `projectRoot`\n// because discovery needs the same answer during `waitForBoot()`, which is\n// before `ROOT_DIR` below exists — and two spellings of \"where is the project\"\n// is how a job gets looked for in one directory and served from another.\nconst rootDir = projectRoot();\n\nconst appDir = join(rootDir, \"app\");\nconst distDir = join(rootDir, \"dist\");\n\nconst clientDir = join(distDir, \"client\");\n\n// The file in `dist/client` a static-looking pathname names, or `null` when\n// it names nothing there. The pathname is still percent-encoded, and Vite\n// writes files whose names need encoding (a public `my font.woff2`), so it is\n// decoded first. Decoding also turns `%2F` into a separator, which the URL\n// parser's own `..` normalization never saw — so the resolved path is checked\n// to still be inside `dist/client`. A malformed escape is a miss, not a 500.\nfunction clientFilePath(pathname: string): string | null {\n  let decoded: string;\n  try {\n    decoded = decodeURIComponent(pathname);\n  } catch {\n    return null;\n  }\n  const path = resolve(clientDir, \".\" + decoded.replace(\"/assets/assets\", \"/assets\"));\n  return path.startsWith(clientDir + sep) ? path : null;\n}\n\nasync function isFile(path: string) {\n  try {\n    return (await stat(path)).isFile();\n  } catch {\n    return false;\n  }\n}\n\n// `app` is built by `Server.start` (from the kernel) and passed in — same as\n// `httpDev` — so prod and dev share one construction path. What differs here is\n// that views/styles are served from the built `dist/` manifests instead of\n// Vite's dev SSR graph.\nexport async function httpProd(app: App, instrumentation: Instrumentation) {\n  const manifest = await import(`${distDir}/client/.vite/manifest.json`);\n  const serverManifest = await import(`${distDir}/server/.vite/manifest.json`);\n  // What the client build was built with, not `GEMI_ASSET_BASE` as it reads\n  // now — see `readBuiltAssetBase`. Every URL below that names a chunk goes\n  // through it, so the document links exactly what the bundle imports.\n  const assetBase = await readBuiltAssetBase(`${distDir}/client`);\n\n  process.env.ROOT_DIR = rootDir;\n  process.env.APP_DIR = appDir;\n  process.env.DIST_DIR = distDir;\n\n  const viewImportMap = {};\n  const ogMap = {};\n  const viewModules = {};\n  const cssManifest = {};\n  // Which chunks a route's views pull in, so the shell can preload the chain\n  // the client would otherwise discover one round trip at a time (#352).\n  const modulePreloadManifest: Record<string, string[]> = {};\n  const template = (viewName: string, path: string) => `\"${viewName}\": () => import(\"${path}\")`;\n  const templates = [];\n\n  for (const fileName of [\"404\", ...app.getFlatComponentTree.call(app)]) {\n    const serverFile = serverManifest[`app/views/${fileName}.tsx`];\n    if (!serverFile?.file) {\n      console.log(`Server file not found for ${fileName}`);\n      console.log(serverFile);\n      const files = Object.keys(serverManifest);\n      const path = `app/views/${fileName}.tsx`;\n      console.log(`${path} not found in server manifest`);\n      console.log(files);\n    }\n    const mod = await import(`${process.env.DIST_DIR}/server/${serverFile?.file}`);\n    viewImportMap[fileName] = mod.default;\n    ogMap[fileName] = mod.OpenGraph;\n    // The whole module, so a streaming render can put the view's\n    // `Loading`/`Error` exports into the shell it sends.\n    viewModules[fileName] = mod;\n    const clientFile = manifest[`app/views/${fileName}.tsx`];\n\n    if (clientFile?.css && clientFile?.css.length > 0) {\n      cssManifest[fileName] = clientFile?.css;\n    }\n    if (clientFile) {\n      templates.push(template(fileName, assetUrl(clientFile?.file, assetBase)));\n      modulePreloadManifest[fileName] = collectModulePreloads(\n        manifest,\n        `app/views/${fileName}.tsx`,\n        assetBase,\n      );\n    }\n  }\n\n  const loaders = `{${templates.join(\",\")}}`;\n\n  // Booted from the bootstrap script rather than through React's\n  // `bootstrapModules`, which would preload it at `fetchPriority=\"low\"` — see\n  // `clientEntry` in `ViewRouteDispatcher`.\n  const clientEntry = createClientEntry(manifest, assetBase);\n  if (!clientEntry) {\n    // Loudly, but without dying: this is boot, and an incomplete `dist/` must\n    // not cost the API routes and static assets too.\n    console.error(\n      `Client manifest has no \"${CLIENT_ENTRY_KEY}\" entry — dist/client is incomplete, so documents will render but never hydrate.`,\n    );\n  }\n\n  // Vite's manifest `css` field is a `string[]` — a client entry can emit more\n  // than one CSS chunk. Read and concatenate them all instead of interpolating\n  // the array into a single path (which only works for a one-element array).\n  const appCssFiles: string[] = manifest[\"app/client.tsx\"]?.css ?? [];\n  const appCSSContent = (\n    await Promise.all(appCssFiles.map((cssFile) => Bun.file(`${distDir}/client/${cssFile}`).text()))\n  ).join(\"\\n\");\n\n  // Which requests are answered from `dist/client` rather than the app:\n  //\n  // - `/assets` and everything under it, whatever the extension. Vite writes\n  //   fonts, GIFs, video and `?url` JSON there too, and an allowlist of\n  //   extensions always trailed the build — a `.woff2` went to the router\n  //   and paid for an SSR attempt. The router refuses routes under `/assets`\n  //   at boot, so there is no app answer to lose, and `staticAssetMiss`\n  //   turns a miss into the reload stub or a 404.\n  // - `/.well-known/*`.\n  // - Any other path that names a file the build copied out of `public/`,\n  //   whatever its extension (#583). Any other path may be an app route, so\n  //   it is static only when that exact file exists — read once here, since\n  //   the build output does not change under a running server. A view at\n  //   `/manifest` keeps its data URL (`/manifest.json`) unless the app also\n  //   ships `public/manifest.json`, and then the file wins. View data is\n  //   never a file in `dist/client`, so a client-side navigation pays for no\n  //   filesystem lookup.\n  const publicFiles = await listPublicFiles(clientDir);\n\n  async function requestHandler(req: Request) {\n    const { pathname } = new URL(req.url);\n\n    if (isApiPath(pathname)) {\n      return await handleWithApp(req, pathname);\n    }\n\n    const distPath = clientFilePath(pathname);\n    const isFileRequest =\n      isReservedAssetPath(pathname) ||\n      pathname.startsWith(\"/.well-known\") ||\n      (distPath !== null && publicFiles.has(distPath));\n\n    if (isFileRequest) {\n      // Served from here whatever the asset base is: a CDN in front of the\n      // app uses this origin as the source it fills from. A file, not merely\n      // a path that exists: `/assets` itself is `dist/client/assets`, a\n      // directory, and streaming one would answer 200 and then fail mid-body.\n      //\n      // `Bun.file(path).stream()` is lazy — a missing file only throws ENOENT\n      // once the body is streamed, which is *after* this handler has returned,\n      // with the response already committed as 200. So existence is checked\n      // here, per request, even for a path `publicFiles` lists.\n      if (!distPath || !(await isFile(distPath))) {\n        return staticAssetMiss(pathname) ?? (await handleWithApp(req, pathname));\n      }\n\n      try {\n        return staticFileResponse(req, distPath);\n      } catch (error) {\n        app.onException?.(error);\n        return new Response(\"Not found\", { status: 404 });\n      }\n    }\n\n    return await handleWithApp(req, pathname);\n  }\n\n  async function handleWithApp(req: Request, pathname: string) {\n    const handler = app.fetch.bind(app);\n\n    try {\n      const result = await handler(req);\n      if (result instanceof Response) {\n        return result;\n      } else {\n        const styles = [];\n\n        styles.push({\n          content: appCSSContent,\n        });\n\n        const getStyles = async (currentViews: string[]) => {\n          if (!currentViews) {\n            return createStyles([]);\n          }\n          for (const view of currentViews) {\n            const clientFile = manifest[`app/views/${view}.tsx`];\n            for (const cssFile of clientFile?.css ?? []) {\n              const css = Bun.file(`${process.env.DIST_DIR}/client/${cssFile}`);\n              styles.push({\n                id: cssFile,\n                content: await css.text(),\n              });\n            }\n          }\n          return createStyles(styles);\n        };\n\n        return await result({\n          getStyles,\n          clientEntry,\n          modulePreloadManifest,\n          loaders,\n          viewImportMap,\n          viewModules,\n          ogMap,\n          cssManifest,\n          assetBase,\n        });\n      }\n    } catch (err) {\n      return unhandledErrorResponse(err, pathname, app.onException);\n    }\n  }\n\n  // Compression is on unless the deployment opts out — set `GEMI_COMPRESSION=off`\n  // when a layer in front of the origin already compresses HTML and you would\n  // rather not spend origin CPU on it.\n  const compressionEnabled = (process.env.GEMI_COMPRESSION ?? \"auto\").toLowerCase() !== \"off\";\n\n  // Which `X-Forwarded-For` entries to believe — see `forwardedFor.ts`. Parsed\n  // before `Bun.serve` so a bad value fails the boot, not every request.\n  const forwardedTrust = parseTrustProxy(process.env.GEMI_TRUST_PROXY);\n\n  const server = Bun.serve({\n    maxRequestBodySize: 10 * 1024 * 1024 * 1024, // 10 GB\n    fetch: async (req, server) => {\n      // `requestIP` is null for closed/unix sockets — guard so it never\n      // throws before the request is handled.\n      applyForwardedTrust(req.headers, server.requestIP(req)?.address ?? null, forwardedTrust);\n      // The app's global middleware goes in front of the static handler as well\n      // as the router, so it can refuse `/assets/*` too.\n      const res = await instrumentation(req, (req) =>\n        app.withGlobalMiddleware(req, requestHandler, (err) =>\n          unhandledErrorResponse(err, new URL(req.url).pathname, app.onException),\n        ),\n      );\n      // Applied at the very edge, after instrumentation, so every HTML response\n      // goes through the same negotiation — including the ones an app's\n      // instrumentation produced itself. Anything that isn't HTML comes back\n      // untouched.\n      return compressionEnabled ? compressResponse(req, res) : res;\n    },\n    idleTimeout: Number(process.env.SERVER_IDLE_TIMEOUT ?? 10),\n    port: process.env.PORT || 5173,\n  });\n\n  printStartupBanner({ port: server.port, rootDir });\n\n  return server;\n}\n",
+    "import { join, resolve, sep } from \"node:path\";\nimport { compressResponse } from \"./compression\";\nimport { listPublicFiles, staticFileResponse } from \"./staticFile\";\nimport { stat } from \"node:fs/promises\";\nimport { createStyles } from \"./styles\";\nimport { CLIENT_ENTRY_KEY, collectModulePreloads, createClientEntry } from \"./modulePreloads\";\nimport type { App } from \"../app\";\nimport { Instrumentation } from \"./types\";\nimport { printStartupBanner } from \"./banner\";\nimport { isReservedAssetPath, staticAssetMiss } from \"./staticAssetMiss\";\nimport { assetUrl, readBuiltAssetBase } from \"../config/assetBase\";\nimport { isApiPath } from \"../services/router/apiPath\";\nimport { projectRoot } from \"../support/discover\";\nimport { unhandledErrorResponse } from \"./unhandledError\";\nimport { applyForwardedTrust, parseTrustProxy } from \"./forwardedFor\";\nimport { readStaticAssetsRecord } from \"../vite/precompressAssets\";\nimport type { StaticFileOptions } from \"./staticFile\";\n\n// The rule this file used to spell out itself. It moved to `projectRoot`\n// because discovery needs the same answer during `waitForBoot()`, which is\n// before `ROOT_DIR` below exists — and two spellings of \"where is the project\"\n// is how a job gets looked for in one directory and served from another.\nconst rootDir = projectRoot();\n\nconst appDir = join(rootDir, \"app\");\nconst distDir = join(rootDir, \"dist\");\n\nconst clientDir = join(distDir, \"client\");\n\n// The file in `dist/client` a static-looking pathname names, or `null` when\n// it names nothing there. The pathname is still percent-encoded, and Vite\n// writes files whose names need encoding (a public `my font.woff2`), so it is\n// decoded first. Decoding also turns `%2F` into a separator, which the URL\n// parser's own `..` normalization never saw — so the resolved path is checked\n// to still be inside `dist/client`. A malformed escape is a miss, not a 500.\nfunction clientFilePath(pathname: string): string | null {\n  let decoded: string;\n  try {\n    decoded = decodeURIComponent(pathname);\n  } catch {\n    return null;\n  }\n  const path = resolve(clientDir, \".\" + decoded.replace(\"/assets/assets\", \"/assets\"));\n  return path.startsWith(clientDir + sep) ? path : null;\n}\n\nasync function isFile(path: string) {\n  try {\n    return (await stat(path)).isFile();\n  } catch {\n    return false;\n  }\n}\n\n// `app` is built by `Server.start` (from the kernel) and passed in — same as\n// `httpDev` — so prod and dev share one construction path. What differs here is\n// that views/styles are served from the built `dist/` manifests instead of\n// Vite's dev SSR graph.\nexport async function httpProd(app: App, instrumentation: Instrumentation) {\n  const manifest = await import(`${distDir}/client/.vite/manifest.json`);\n  const serverManifest = await import(`${distDir}/server/.vite/manifest.json`);\n  // What the client build was built with, not `GEMI_ASSET_BASE` as it reads\n  // now — see `readBuiltAssetBase`. Every URL below that names a chunk goes\n  // through it, so the document links exactly what the bundle imports.\n  const assetBase = await readBuiltAssetBase(`${distDir}/client`);\n\n  process.env.ROOT_DIR = rootDir;\n  process.env.APP_DIR = appDir;\n  process.env.DIST_DIR = distDir;\n\n  const viewImportMap = {};\n  const ogMap = {};\n  const viewModules = {};\n  const cssManifest = {};\n  // Which chunks a route's views pull in, so the shell can preload the chain\n  // the client would otherwise discover one round trip at a time (#352).\n  const modulePreloadManifest: Record<string, string[]> = {};\n  const template = (viewName: string, path: string) => `\"${viewName}\": () => import(\"${path}\")`;\n  const templates = [];\n\n  for (const fileName of [\"404\", ...app.getFlatComponentTree.call(app)]) {\n    const serverFile = serverManifest[`app/views/${fileName}.tsx`];\n    if (!serverFile?.file) {\n      console.log(`Server file not found for ${fileName}`);\n      console.log(serverFile);\n      const files = Object.keys(serverManifest);\n      const path = `app/views/${fileName}.tsx`;\n      console.log(`${path} not found in server manifest`);\n      console.log(files);\n    }\n    const mod = await import(`${process.env.DIST_DIR}/server/${serverFile?.file}`);\n    viewImportMap[fileName] = mod.default;\n    ogMap[fileName] = mod.OpenGraph;\n    // The whole module, so a streaming render can put the view's\n    // `Loading`/`Error` exports into the shell it sends.\n    viewModules[fileName] = mod;\n    const clientFile = manifest[`app/views/${fileName}.tsx`];\n\n    if (clientFile?.css && clientFile?.css.length > 0) {\n      cssManifest[fileName] = clientFile?.css;\n    }\n    if (clientFile) {\n      templates.push(template(fileName, assetUrl(clientFile?.file, assetBase)));\n      modulePreloadManifest[fileName] = collectModulePreloads(\n        manifest,\n        `app/views/${fileName}.tsx`,\n        assetBase,\n      );\n    }\n  }\n\n  const loaders = `{${templates.join(\",\")}}`;\n\n  // Booted from the bootstrap script rather than through React's\n  // `bootstrapModules`, which would preload it at `fetchPriority=\"low\"` — see\n  // `clientEntry` in `ViewRouteDispatcher`.\n  const clientEntry = createClientEntry(manifest, assetBase);\n  if (!clientEntry) {\n    // Loudly, but without dying: this is boot, and an incomplete `dist/` must\n    // not cost the API routes and static assets too.\n    console.error(\n      `Client manifest has no \"${CLIENT_ENTRY_KEY}\" entry — dist/client is incomplete, so documents will render but never hydrate.`,\n    );\n  }\n\n  // Vite's manifest `css` field is a `string[]` — a client entry can emit more\n  // than one CSS chunk. Read and concatenate them all instead of interpolating\n  // the array into a single path (which only works for a one-element array).\n  const appCssFiles: string[] = manifest[\"app/client.tsx\"]?.css ?? [];\n  const appCSSContent = (\n    await Promise.all(appCssFiles.map((cssFile) => Bun.file(`${distDir}/client/${cssFile}`).text()))\n  ).join(\"\\n\");\n\n  // Which requests are answered from `dist/client` rather than the app:\n  //\n  // - `/assets` and everything under it, whatever the extension. Vite writes\n  //   fonts, GIFs, video and `?url` JSON there too, and an allowlist of\n  //   extensions always trailed the build — a `.woff2` went to the router\n  //   and paid for an SSR attempt. The router refuses routes under `/assets`\n  //   at boot, so there is no app answer to lose, and `staticAssetMiss`\n  //   turns a miss into the reload stub or a 404.\n  // - `/.well-known/*`.\n  // - Any other path that names a file the build copied out of `public/`,\n  //   whatever its extension (#583). Any other path may be an app route, so\n  //   it is static only when that exact file exists — read once here, since\n  //   the build output does not change under a running server. A view at\n  //   `/manifest` keeps its data URL (`/manifest.json`) unless the app also\n  //   ships `public/manifest.json`, and then the file wins. View data is\n  //   never a file in `dist/client`, so a client-side navigation pays for no\n  //   filesystem lookup.\n  const publicFiles = await listPublicFiles(clientDir);\n\n  // The build assets `gemi build` emitted or carried over, with the\n  // precompressed siblings it wrote for each (#789). Read once: the build\n  // output does not change under a running server. Without the record (a\n  // build made before it existed) every file is served as identity with the\n  // old cache policy.\n  const staticAssets = new Map<string, StaticFileOptions>();\n  for (const [file, encodings] of Object.entries(\n    (await readStaticAssetsRecord(clientDir))?.files ?? {},\n  )) {\n    const path = resolve(clientDir, file);\n    if (path.startsWith(clientDir + sep)) {\n      staticAssets.set(path, { immutable: true, encodings });\n    }\n  }\n\n  async function requestHandler(req: Request) {\n    const { pathname } = new URL(req.url);\n\n    if (isApiPath(pathname)) {\n      return await handleWithApp(req, pathname);\n    }\n\n    const distPath = clientFilePath(pathname);\n    const isFileRequest =\n      isReservedAssetPath(pathname) ||\n      pathname.startsWith(\"/.well-known\") ||\n      (distPath !== null && publicFiles.has(distPath));\n\n    if (isFileRequest) {\n      // Served from here whatever the asset base is: a CDN in front of the\n      // app uses this origin as the source it fills from. A file, not merely\n      // a path that exists: `/assets` itself is `dist/client/assets`, a\n      // directory, and streaming one would answer 200 and then fail mid-body.\n      //\n      // `Bun.file(path).stream()` is lazy — a missing file only throws ENOENT\n      // once the body is streamed, which is *after* this handler has returned,\n      // with the response already committed as 200. So existence is checked\n      // here, per request, even for a path `publicFiles` lists.\n      if (!distPath || !(await isFile(distPath))) {\n        return staticAssetMiss(pathname) ?? (await handleWithApp(req, pathname));\n      }\n\n      try {\n        return await staticFileResponse(req, distPath, staticAssets.get(distPath));\n      } catch (error) {\n        app.onException?.(error);\n        return new Response(\"Not found\", { status: 404 });\n      }\n    }\n\n    return await handleWithApp(req, pathname);\n  }\n\n  async function handleWithApp(req: Request, pathname: string) {\n    const handler = app.fetch.bind(app);\n\n    try {\n      const result = await handler(req);\n      if (result instanceof Response) {\n        return result;\n      } else {\n        const styles = [];\n\n        styles.push({\n          content: appCSSContent,\n        });\n\n        const getStyles = async (currentViews: string[]) => {\n          if (!currentViews) {\n            return createStyles([]);\n          }\n          for (const view of currentViews) {\n            const clientFile = manifest[`app/views/${view}.tsx`];\n            for (const cssFile of clientFile?.css ?? []) {\n              const css = Bun.file(`${process.env.DIST_DIR}/client/${cssFile}`);\n              styles.push({\n                id: cssFile,\n                content: await css.text(),\n              });\n            }\n          }\n          return createStyles(styles);\n        };\n\n        return await result({\n          getStyles,\n          clientEntry,\n          modulePreloadManifest,\n          loaders,\n          viewImportMap,\n          viewModules,\n          ogMap,\n          cssManifest,\n          assetBase,\n        });\n      }\n    } catch (err) {\n      return unhandledErrorResponse(err, pathname, app.onException);\n    }\n  }\n\n  // Compression is on unless the deployment opts out — set `GEMI_COMPRESSION=off`\n  // when a layer in front of the origin already compresses HTML and you would\n  // rather not spend origin CPU on it.\n  const compressionEnabled = (process.env.GEMI_COMPRESSION ?? \"auto\").toLowerCase() !== \"off\";\n\n  // Which `X-Forwarded-For` entries to believe — see `forwardedFor.ts`. Parsed\n  // before `Bun.serve` so a bad value fails the boot, not every request.\n  const forwardedTrust = parseTrustProxy(process.env.GEMI_TRUST_PROXY);\n\n  const server = Bun.serve({\n    maxRequestBodySize: 10 * 1024 * 1024 * 1024, // 10 GB\n    fetch: async (req, server) => {\n      // `requestIP` is null for closed/unix sockets — guard so it never\n      // throws before the request is handled.\n      applyForwardedTrust(req.headers, server.requestIP(req)?.address ?? null, forwardedTrust);\n      // The app's global middleware goes in front of the static handler as well\n      // as the router, so it can refuse `/assets/*` too.\n      const res = await instrumentation(req, (req) =>\n        app.withGlobalMiddleware(req, requestHandler, (err) =>\n          unhandledErrorResponse(err, new URL(req.url).pathname, app.onException),\n        ),\n      );\n      // Applied at the very edge, after instrumentation, so every HTML response\n      // goes through the same negotiation — including the ones an app's\n      // instrumentation produced itself. Anything that isn't HTML comes back\n      // untouched.\n      return compressionEnabled ? compressResponse(req, res) : res;\n    },\n    idleTimeout: Number(process.env.SERVER_IDLE_TIMEOUT ?? 10),\n    port: process.env.PORT || 5173,\n  });\n\n  printStartupBanner({ port: server.port, rootDir });\n\n  return server;\n}\n",
     "/**\n * Transport-level compression for SSR HTML responses.\n *\n * This lives in the runtime rather than in an app, because every gemi app\n * serves the same shape of response: a streamed `text/html` document whose\n * bulk is critical CSS, markup and the `window.__GEMI_DATA__` hydration\n * payload. Compressing it here means the win is portable across deployments —\n * it does not depend on a CDN being configured to compress on the origin's\n * behalf — and it also cuts origin→edge bandwidth, which edge compression\n * cannot.\n *\n * Compression stays strictly at the transport layer: what the client decodes\n * is byte-for-byte the HTML React rendered, so hydration is unaffected.\n *\n * Deliberately dependency-free apart from `node:zlib`/`node:stream` so it can\n * be unit tested without booting a server.\n */\n\nimport { Duplex } from \"node:stream\";\nimport { constants, createBrotliCompress, createGzip } from \"node:zlib\";\n\n/** The content codings we can produce, in the order we prefer them. */\nexport type ContentEncoding = \"br\" | \"gzip\";\n\n/**\n * Server preference, used to break q-value ties. Brotli comes first: at the\n * quality we use it is both smaller *and* no more expensive than gzip on a\n * representative SSR document (~177 kB → 28.0 kB in ~2.0 ms, versus 31.6 kB in\n * ~2.0 ms for gzip).\n */\nconst SERVER_PREFERENCE: ContentEncoding[] = [\"br\", \"gzip\"];\n\n/**\n * Below this, an encoded body plus its framing overhead is not worth the CPU.\n * Only applied when the response declares a `Content-Length` — a streamed SSR\n * response does not, and buffering one just to measure it would defeat the\n * streaming render.\n */\nconst MIN_COMPRESSIBLE_BYTES = 1024;\n\n/**\n * Brotli quality 5 (of 11). The default, 11, is meant for static assets\n * compressed once at build time — on a streamed document it costs ~175 ms,\n * two orders of magnitude more than quality 5 for ~12% more savings. Quality 5\n * is the usual choice for dynamic content.\n *\n * `LGWIN` 19 caps the window at 512 kB rather than the default 16 MB. An SSR\n * document is far smaller than that, so the ratio is unchanged, and the bound\n * matters under concurrency: the window is allocated per in-flight response.\n */\nconst BROTLI_QUALITY = 5;\nconst BROTLI_WINDOW_BITS = 19;\n\n/** zlib's default level. Level 9 costs measurably more for ~1% on HTML. */\nconst GZIP_LEVEL = 6;\n\nfunction parseQValue(raw: string | undefined): number {\n  if (raw === undefined) {\n    return 1;\n  }\n  // `q` is a fixed-point number with at most three decimals (RFC 9110 §12.4.2).\n  // Anything else is malformed; treat it as an unqualified \"acceptable\" rather\n  // than dropping the encoding, matching what tolerant servers do.\n  if (!/^\\d+(\\.\\d{0,3})?$/.test(raw.trim())) {\n    return 1;\n  }\n  const value = Number(raw.trim());\n  return Number.isFinite(value) ? Math.min(value, 1) : 1;\n}\n\n/**\n * Parses a request `Accept-Encoding` into `coding -> qvalue`.\n *\n * Returns `null` when the header is *absent*, which is distinct from an empty\n * one. RFC 9110 §12.5.3 says an absent header means any coding is acceptable,\n * but a client that cannot decode and forgets to say so is a broken page, not\n * a slow one — so we treat \"absent\" as \"identity\" and only encode when a\n * client has explicitly opted in. An empty header (`Accept-Encoding:`) is a\n * deliberate \"identity only\" and parses to an empty map.\n */\nexport function parseAcceptEncoding(header: string | null | undefined): Map<string, number> | null {\n  if (header === null || header === undefined) {\n    return null;\n  }\n\n  const accepted = new Map<string, number>();\n  for (const part of header.split(\",\")) {\n    const [rawCoding, ...params] = part.split(\";\");\n    const coding = rawCoding.trim().toLowerCase();\n    if (coding === \"\") {\n      continue;\n    }\n\n    let q = 1;\n    for (const param of params) {\n      const separator = param.indexOf(\"=\");\n      if (separator === -1) {\n        continue;\n      }\n      if (param.slice(0, separator).trim().toLowerCase() === \"q\") {\n        q = parseQValue(param.slice(separator + 1));\n        break;\n      }\n    }\n\n    accepted.set(coding, q);\n  }\n\n  return accepted;\n}\n\n/**\n * Picks the coding to use, or `null` for identity.\n *\n * A `q=0` is a refusal, `*` covers codings the client did not name, and ties\n * fall back to `available`'s order — so a plain `Accept-Encoding: gzip, br`\n * (equal q of 1) resolves to our preference rather than the client's.\n */\nexport function negotiateEncoding(\n  header: string | null | undefined,\n  available: ContentEncoding[] = SERVER_PREFERENCE,\n): ContentEncoding | null {\n  const accepted = parseAcceptEncoding(header);\n  if (!accepted) {\n    return null;\n  }\n\n  const wildcard = accepted.get(\"*\");\n  let best: ContentEncoding | null = null;\n  let bestQ = 0;\n\n  for (const coding of available) {\n    const q = accepted.get(coding) ?? wildcard ?? 0;\n    if (q > bestQ) {\n      best = coding;\n      bestQ = q;\n    }\n  }\n\n  return best;\n}\n\nfunction hasDirective(headerValue: string | null, directive: string): boolean {\n  if (!headerValue) {\n    return false;\n  }\n  // Token match, not substring: `no-transform` must not be found inside\n  // something like `x-no-transform`.\n  return headerValue\n    .split(\",\")\n    .some((token) => token.trim().toLowerCase().split(\"=\")[0].trim() === directive);\n}\n\n/**\n * Whether this response's representation is one we may encode — and therefore\n * one that varies by `Accept-Encoding`, even on the requests where we end up\n * sending identity.\n *\n * HTML only, on purpose. JSON view-data and API responses are left alone so\n * that this change cannot alter how they are produced, framed or cached;\n * widening the set is a separate decision.\n */\nexport function isCompressible(method: string, res: Response): boolean {\n  // A HEAD response carries no body to encode, and emitting `Content-Encoding`\n  // without one would describe a body the client never receives.\n  if (method === \"HEAD\") {\n    return false;\n  }\n\n  // 204/304 are bodyless; 206 is a byte range of an already-committed\n  // representation and re-encoding it would invalidate its `Content-Range`.\n  if (res.status < 200 || res.status === 204 || res.status === 206 || res.status === 304) {\n    return false;\n  }\n\n  if (res.headers.has(\"Content-Range\")) {\n    return false;\n  }\n\n  const contentType = res.headers.get(\"Content-Type\");\n  if (!contentType || !/^\\s*text\\/html\\s*(;|$)/i.test(contentType)) {\n    return false;\n  }\n\n  // Only once the status and headers have ruled a range out: on Bun 1.3.14 on\n  // Linux, reading `.body` of a Response built on a sliced Blob makes it send\n  // past the slice's end (#725), so `.body` is never touched on a non-HTML\n  // response this function hands back untouched.\n  if (!res.body) {\n    return false;\n  }\n\n  // Already encoded upstream — `identity` is the one value that means \"not\n  // encoded\" and is safe to replace.\n  const contentEncoding = res.headers.get(\"Content-Encoding\");\n  if (contentEncoding && contentEncoding.trim().toLowerCase() !== \"identity\") {\n    return false;\n  }\n\n  // RFC 9110 §5.2.2.6: `no-transform` forbids intermediaries *and* us from\n  // changing the representation's encoding.\n  if (hasDirective(res.headers.get(\"Cache-Control\"), \"no-transform\")) {\n    return false;\n  }\n\n  const contentLength = res.headers.get(\"Content-Length\");\n  if (contentLength !== null && Number(contentLength) < MIN_COMPRESSIBLE_BYTES) {\n    return false;\n  }\n\n  return true;\n}\n\n/**\n * Builds the encoder as a web `TransformStream`-shaped pair.\n *\n * Both codings are driven through `node:zlib` with an explicit per-write flush.\n * Without it the compressor holds output until its internal buffer fills,\n * which would sit on React's shell flush and turn a streamed render into a\n * buffered one — the compression win would be paid for in time to first byte.\n */\nexport function createEncoderStream(encoding: ContentEncoding) {\n  const compressor =\n    encoding === \"br\"\n      ? createBrotliCompress({\n          params: {\n            [constants.BROTLI_PARAM_QUALITY]: BROTLI_QUALITY,\n            [constants.BROTLI_PARAM_LGWIN]: BROTLI_WINDOW_BITS,\n          },\n          flush: constants.BROTLI_OPERATION_FLUSH,\n        })\n      : createGzip({ level: GZIP_LEVEL, flush: constants.Z_SYNC_FLUSH });\n\n  return Duplex.toWeb(compressor) as unknown as ReadableWritablePair<Uint8Array, Uint8Array>;\n}\n\nfunction withVaryAcceptEncoding(headers: Headers) {\n  const vary = headers.get(\"Vary\");\n  if (!vary) {\n    headers.set(\"Vary\", \"Accept-Encoding\");\n    return;\n  }\n  const tokens = vary.split(\",\").map((token) => token.trim().toLowerCase());\n  // `Vary: *` already means \"never reuse for another request\"; narrowing it\n  // would be a downgrade.\n  if (tokens.includes(\"*\") || tokens.includes(\"accept-encoding\")) {\n    return;\n  }\n  headers.append(\"Vary\", \"Accept-Encoding\");\n}\n\n/**\n * Compresses an SSR HTML response when the client asked for it.\n *\n * Non-HTML responses are returned untouched — same object, same body, so this\n * is safe to apply at the edge of the server for every request.\n *\n * HTML responses always gain `Vary: Accept-Encoding`, whether or not this\n * particular request got an encoded body: without it a shared cache could\n * serve a stored encoded variant to a client that cannot decode it.\n */\nexport function compressResponse(req: Request, res: Response): Response {\n  if (!isCompressible(req.method, res)) {\n    return res;\n  }\n\n  const headers = new Headers(res.headers);\n  withVaryAcceptEncoding(headers);\n\n  const encoding = negotiateEncoding(req.headers.get(\"Accept-Encoding\"));\n  if (!encoding) {\n    return new Response(res.body, {\n      status: res.status,\n      statusText: res.statusText,\n      headers,\n    });\n  }\n\n  let encoder: ReadableWritablePair<Uint8Array, Uint8Array>;\n  try {\n    encoder = createEncoderStream(encoding);\n  } catch {\n    // A compressor we cannot construct is not worth failing a page render\n    // over. Serve identity — with the `Vary` we already added.\n    return new Response(res.body, {\n      status: res.status,\n      statusText: res.statusText,\n      headers,\n    });\n  }\n\n  headers.set(\"Content-Encoding\", encoding);\n  // The length of the identity representation says nothing about the encoded\n  // body, and a stale one would truncate the response.\n  headers.delete(\"Content-Length\");\n\n  return new Response(res.body!.pipeThrough(encoder), {\n    status: res.status,\n    statusText: res.statusText,\n    headers,\n  });\n}\n",
-    "import { readdir, stat } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { createUnsatisfiableResponse } from \"../http/createStreamResponse\";\nimport { formatContentRange, parseRangeHeader, resolveRange } from \"../http/range\";\nimport { generateETag } from \"./generateEtag\";\n\n/**\n * Every file in `dist/client` outside `/assets`, as absolute paths — what\n * Vite copied out of `public/` (#583).\n *\n * A root-level path may be an app route, so the static handler may only take\n * one that names a file the app really ships. This used to be guessed from the\n * extension, and every extension the list missed (`.mp4` on 0.58, `.wasm`,\n * `.csv` …) was answered by the router with a rendered 404 page. The build\n * output is fixed for the life of the process, so the exact set is read once\n * at boot instead.\n *\n * `assets/` is left out because the static handler takes everything under it\n * anyway. A name starting with a dot is left out at any depth: `.vite/` is\n * build metadata (both manifests and the asset base record), and a stray\n * `.DS_Store` or `.env` copied in from `public/` is nothing a request should\n * reach. `/.well-known` is served by its own rule.\n */\nexport async function listPublicFiles(clientDir: string): Promise<Set<string>> {\n  const files = new Set<string>();\n\n  async function walk(dir: string, topLevel: boolean) {\n    let entries;\n    try {\n      entries = await readdir(dir, { withFileTypes: true });\n    } catch {\n      return;\n    }\n    for (const entry of entries) {\n      if (entry.name.startsWith(\".\")) continue;\n      if (topLevel && entry.name === \"assets\") continue;\n      const path = join(dir, entry.name);\n      let isDir = entry.isDirectory();\n      let isFile = entry.isFile();\n      if (entry.isSymbolicLink()) {\n        try {\n          const target = await stat(path);\n          isDir = target.isDirectory();\n          isFile = target.isFile();\n        } catch {\n          continue;\n        }\n      }\n      if (isFile) files.add(path);\n      // A symlinked directory is not followed: a link back up the tree would\n      // never end, and `clientFilePath` only names paths inside `dist/client`.\n      else if (isDir && !entry.isSymbolicLink()) await walk(path, false);\n    }\n  }\n\n  await walk(clientDir, true);\n  return files;\n}\n\nconst LONG_LIVED = \"public, max-age=31536000, must-revalidate\";\n\n/**\n * The response for a file in `dist/client` that is known to exist.\n *\n * Honours a single byte `Range`, so a `<video>` pointed at a public `.mp4`\n * can seek — Safari will not play one at all from a server that answers its\n * `bytes=0-1` probe with the whole file. Recent Bun releases slice a\n * file-backed 200 themselves; doing it here keeps that from depending on the\n * Bun version a deployment runs, and answers an unsatisfiable range with the\n * same 416 the `stream()` responses use.\n *\n * `Bun.file().type` is the mime lookup, and is `application/octet-stream` for\n * an extension it does not know.\n */\nexport function staticFileResponse(req: Request, path: string): Response {\n  const file = Bun.file(path);\n  const total = file.size;\n  const etag = generateETag(file.lastModified);\n\n  const headers: Record<string, string> = {\n    \"Content-Type\": file.type || \"application/octet-stream\",\n    \"Cache-Control\": LONG_LIVED,\n    \"Accept-Ranges\": \"bytes\",\n    ETag: etag,\n  };\n\n  const range = parseRangeHeader(req.headers.get(\"Range\"));\n\n  if (range) {\n    const resolved = resolveRange(range, total);\n    if (!resolved) {\n      return createUnsatisfiableResponse(total);\n    }\n    return new Response(file.slice(resolved.start, resolved.end + 1).stream(), {\n      status: 206,\n      headers: {\n        ...headers,\n        \"Content-Range\": formatContentRange(resolved.start, resolved.end, total),\n        \"Content-Length\": String(resolved.length),\n      },\n    });\n  }\n\n  return new Response(file.stream(), {\n    headers: { ...headers, \"Content-Length\": String(total) },\n  });\n}\n",
+    "import { readdir, stat } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { createUnsatisfiableResponse } from \"../http/createStreamResponse\";\nimport { formatContentRange, parseRangeHeader, resolveRange } from \"../http/range\";\nimport { SIBLING_EXTENSION } from \"../vite/precompressAssets\";\nimport { type ContentEncoding, negotiateEncoding } from \"./compression\";\nimport { generateETag } from \"./generateEtag\";\n\n/**\n * Every file in `dist/client` outside `/assets`, as absolute paths — what\n * Vite copied out of `public/` (#583).\n *\n * A root-level path may be an app route, so the static handler may only take\n * one that names a file the app really ships. This used to be guessed from the\n * extension, and every extension the list missed (`.mp4` on 0.58, `.wasm`,\n * `.csv` …) was answered by the router with a rendered 404 page. The build\n * output is fixed for the life of the process, so the exact set is read once\n * at boot instead.\n *\n * `assets/` is left out because the static handler takes everything under it\n * anyway. A name starting with a dot is left out at any depth: `.vite/` is\n * build metadata (both manifests and the asset base record), and a stray\n * `.DS_Store` or `.env` copied in from `public/` is nothing a request should\n * reach. `/.well-known` is served by its own rule.\n */\nexport async function listPublicFiles(clientDir: string): Promise<Set<string>> {\n  const files = new Set<string>();\n\n  async function walk(dir: string, topLevel: boolean) {\n    let entries;\n    try {\n      entries = await readdir(dir, { withFileTypes: true });\n    } catch {\n      return;\n    }\n    for (const entry of entries) {\n      if (entry.name.startsWith(\".\")) continue;\n      if (topLevel && entry.name === \"assets\") continue;\n      const path = join(dir, entry.name);\n      let isDir = entry.isDirectory();\n      let isFile = entry.isFile();\n      if (entry.isSymbolicLink()) {\n        try {\n          const target = await stat(path);\n          isDir = target.isDirectory();\n          isFile = target.isFile();\n        } catch {\n          continue;\n        }\n      }\n      if (isFile) files.add(path);\n      // A symlinked directory is not followed: a link back up the tree would\n      // never end, and `clientFilePath` only names paths inside `dist/client`.\n      else if (isDir && !entry.isSymbolicLink()) await walk(path, false);\n    }\n  }\n\n  await walk(clientDir, true);\n  return files;\n}\n\nconst LONG_LIVED = \"public, max-age=31536000, must-revalidate\";\n\n/**\n * A content-hashed build asset never changes under its name: a new build\n * writes a new name. So a browser or edge may keep it a year without asking\n * again (#789).\n */\nconst IMMUTABLE = \"public, max-age=31536000, immutable\";\n\nexport interface StaticFileOptions {\n  /**\n   * The file is a content-hashed build asset (it is in the build's\n   * `static-assets.json`), so it is sent as `immutable`.\n   */\n  immutable?: boolean;\n  /**\n   * The precompressed siblings the build wrote for it (`file.br`,\n   * `file.gz`), in preference order. Offering any makes the response vary by\n   * `Accept-Encoding`, so it says so even when it sends identity.\n   */\n  encodings?: ContentEncoding[];\n}\n\nasync function encodedSibling(\n  req: Request,\n  path: string,\n  encodings: ContentEncoding[],\n): Promise<{ encoding: ContentEncoding; path: string; size: number } | null> {\n  // A range is a byte range of the identity representation: an encoded\n  // variant has no stable offsets to slice, so a range request gets identity.\n  if (encodings.length === 0 || req.headers.has(\"Range\")) {\n    return null;\n  }\n  const encoding = negotiateEncoding(req.headers.get(\"Accept-Encoding\"), encodings);\n  if (!encoding) {\n    return null;\n  }\n  const siblingPath = path + SIBLING_EXTENSION[encoding];\n  try {\n    // Checked per request, like the file itself: a sibling deleted under a\n    // running server would otherwise fail mid-body after a committed 200.\n    const info = await stat(siblingPath);\n    return info.isFile() ? { encoding, path: siblingPath, size: info.size } : null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * The response for a file in `dist/client` that is known to exist.\n *\n * Honours a single byte `Range`, so a `<video>` pointed at a public `.mp4`\n * can seek — Safari will not play one at all from a server that answers its\n * `bytes=0-1` probe with the whole file. Recent Bun releases slice a\n * file-backed 200 themselves; doing it here keeps that from depending on the\n * Bun version a deployment runs, and answers an unsatisfiable range with the\n * same 416 the `stream()` responses use.\n *\n * A build asset with precompressed siblings is sent as the one\n * `Accept-Encoding` prefers (brotli, then gzip, then identity), with the\n * original's `Content-Type`. Nothing is compressed here: a file without a\n * sibling is sent as is.\n *\n * `Bun.file().type` is the mime lookup, and is `application/octet-stream` for\n * an extension it does not know.\n */\nexport async function staticFileResponse(\n  req: Request,\n  path: string,\n  options: StaticFileOptions = {},\n): Promise<Response> {\n  const file = Bun.file(path);\n  const encodings = options.encodings ?? [];\n\n  const headers: Record<string, string> = {\n    \"Content-Type\": file.type || \"application/octet-stream\",\n    \"Cache-Control\": options.immutable ? IMMUTABLE : LONG_LIVED,\n    \"Accept-Ranges\": \"bytes\",\n  };\n  if (encodings.length > 0) {\n    headers.Vary = \"Accept-Encoding\";\n  }\n\n  const sibling = await encodedSibling(req, path, encodings);\n  if (sibling) {\n    const encoded = Bun.file(sibling.path);\n    return new Response(encoded.stream(), {\n      headers: {\n        ...headers,\n        \"Content-Encoding\": sibling.encoding,\n        \"Content-Length\": String(sibling.size),\n        // A different representation, so a different validator.\n        ETag: `${generateETag(encoded.lastModified)}-${sibling.encoding}`,\n      },\n    });\n  }\n\n  const total = file.size;\n  headers.ETag = generateETag(file.lastModified);\n\n  const range = parseRangeHeader(req.headers.get(\"Range\"));\n\n  if (range) {\n    const resolved = resolveRange(range, total);\n    if (!resolved) {\n      return createUnsatisfiableResponse(total);\n    }\n    return new Response(file.slice(resolved.start, resolved.end + 1).stream(), {\n      status: 206,\n      headers: {\n        ...headers,\n        \"Content-Range\": formatContentRange(resolved.start, resolved.end, total),\n        \"Content-Length\": String(resolved.length),\n      },\n    });\n  }\n\n  return new Response(file.stream(), {\n    headers: { ...headers, \"Content-Length\": String(total) },\n  });\n}\n",
+    "import { mkdir, readFile, stat, writeFile } from \"node:fs/promises\";\nimport { availableParallelism } from \"node:os\";\nimport { dirname, join } from \"node:path\";\nimport { promisify } from \"node:util\";\nimport { brotliCompress, constants, gzip } from \"node:zlib\";\n\nimport type { ContentEncoding } from \"../server/compression\";\n\n/**\n * Build-time compression of the client bundle (#789).\n *\n * `gemi start` compresses SSR HTML per request, but a hashed chunk is the same\n * bytes for the life of a release, so compressing it per request would spend\n * origin CPU on every visitor for a result that never changes. `gemi build`\n * writes `file.br` (brotli quality 11) and `file.gz` (gzip level 9) next to\n * every compressible build asset instead, once, and the server picks one by\n * `Accept-Encoding`.\n *\n * What the build emitted (and what it carried over from earlier releases, see\n * `previousAssets.ts`) is recorded in `dist/client/.vite/static-assets.json`,\n * with the encodings each file has. The server reads it at boot: a file in the\n * record is a content-hashed build asset, so it is sent as `immutable`, and\n * only the encodings listed for it are offered. A file not in the record (one\n * copied from `public/assets/`, or anything in a build made before this\n * existed) is served as before.\n */\n\n/** Relative to `dist/client`; beside Vite's own manifest, so never served. */\nexport const STATIC_ASSETS_RECORD = \".vite/static-assets.json\";\n\n/**\n * Below this, the encoded body plus its header is not worth a second request\n * representation: a 600-byte chunk saves a few hundred bytes at most, and\n * every file with siblings adds a `stat` per request.\n */\nexport const PRECOMPRESS_MIN_BYTES = 1024;\n\n/**\n * Text-like formats that compress well. Already-compressed formats (images,\n * `woff`/`woff2`, video) are left out: brotli shaves a percent or two off\n * them at best. Source maps are left out because a page never loads one, and\n * only devtools would gain from the extra build time.\n */\nconst COMPRESSIBLE = /\\.(?:m?js|cjs|css|svg|json|webmanifest|wasm|txt|xml|ttf|otf|eot)$/i;\n\nconst TEXT = /\\.(?:m?js|cjs|css|svg|json|webmanifest|txt|xml)$/i;\nconst FONT = /\\.(?:ttf|otf|eot)$/i;\n\nexport const SIBLING_EXTENSION: Record<ContentEncoding, string> = {\n  br: \".br\",\n  gzip: \".gz\",\n};\n\n/** Server preference: brotli is ~15% smaller than gzip -9 on a JS chunk. */\nconst ENCODINGS: ContentEncoding[] = [\"br\", \"gzip\"];\n\nexport interface StaticAssetsRecord {\n  /**\n   * Path relative to `dist/client` (`assets/client-DJhrQPW5.js`) → the\n   * precompressed siblings it has, in preference order. An empty list is a\n   * build asset that is served as identity only (an image, a small file).\n   */\n  files: Record<string, ContentEncoding[]>;\n}\n\nexport interface PrecompressStats {\n  files: number;\n  identityBytes: number;\n  brBytes: number;\n  gzipBytes: number;\n}\n\nconst brotli = promisify(brotliCompress);\nconst gzipAsync = promisify(gzip);\n\nexport function isPrecompressible(file: string): boolean {\n  return COMPRESSIBLE.test(file);\n}\n\n/** `true` for `x.js.br` / `x.js.gz`: a sibling, not an asset of its own. */\nexport function isEncodedSibling(file: string): boolean {\n  return file.endsWith(\".br\") || file.endsWith(\".gz\");\n}\n\nasync function encode(encoding: ContentEncoding, file: string, input: Buffer): Promise<Buffer> {\n  if (encoding === \"gzip\") {\n    return gzipAsync(input, { level: 9 });\n  }\n  return brotli(input, {\n    params: {\n      [constants.BROTLI_PARAM_QUALITY]: constants.BROTLI_MAX_QUALITY,\n      [constants.BROTLI_PARAM_MODE]: TEXT.test(file)\n        ? constants.BROTLI_MODE_TEXT\n        : FONT.test(file)\n          ? constants.BROTLI_MODE_FONT\n          : constants.BROTLI_MODE_GENERIC,\n      [constants.BROTLI_PARAM_SIZE_HINT]: input.length,\n    },\n  });\n}\n\nasync function fileSize(path: string): Promise<number | null> {\n  try {\n    const info = await stat(path);\n    return info.isFile() ? info.size : null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Writes the `.br`/`.gz` siblings of `files` (paths relative to `clientDir`)\n * and returns the encodings each one ended up with.\n *\n * A sibling is only kept when it is smaller than the file itself; one that is\n * not would cost bytes on the wire, so the file is served as identity for\n * that encoding. With `reuseExisting`, a sibling already on disk is trusted\n * rather than rebuilt — for files carried from an earlier release, whose\n * siblings were copied with them and match by content hash.\n */\nexport async function precompressAssets(\n  clientDir: string,\n  files: Iterable<string>,\n  options: {\n    reuseExisting?: boolean;\n    minBytes?: number;\n    concurrency?: number;\n  } = {},\n): Promise<{ record: StaticAssetsRecord; stats: PrecompressStats }> {\n  const minBytes = options.minBytes ?? PRECOMPRESS_MIN_BYTES;\n  const record: StaticAssetsRecord = { files: {} };\n  const stats: PrecompressStats = {\n    files: 0,\n    identityBytes: 0,\n    brBytes: 0,\n    gzipBytes: 0,\n  };\n\n  const queue = [...new Set(files)];\n  for (const file of queue) {\n    record.files[file] = [];\n  }\n\n  async function work(file: string) {\n    if (!isPrecompressible(file)) {\n      return;\n    }\n    const path = join(clientDir, file);\n    const size = await fileSize(path);\n    if (size === null || size < minBytes) {\n      return;\n    }\n\n    let input: Buffer | null = null;\n    const available: ContentEncoding[] = [];\n    const sizes: Partial<Record<ContentEncoding, number>> = {};\n    for (const encoding of ENCODINGS) {\n      const siblingPath = path + SIBLING_EXTENSION[encoding];\n      const existing = options.reuseExisting ? await fileSize(siblingPath) : null;\n      if (existing !== null) {\n        if (existing < size) {\n          available.push(encoding);\n          sizes[encoding] = existing;\n        }\n        continue;\n      }\n      input ??= await readFile(path);\n      const output = await encode(encoding, file, input);\n      if (output.length < size) {\n        await writeFile(siblingPath, output);\n        available.push(encoding);\n        sizes[encoding] = output.length;\n      }\n    }\n\n    record.files[file] = available;\n    if (available.length > 0) {\n      stats.files += 1;\n      stats.identityBytes += size;\n      stats.brBytes += sizes.br ?? size;\n      stats.gzipBytes += sizes.gzip ?? size;\n    }\n  }\n\n  // zlib's async calls run on the libuv thread pool; a few files in flight\n  // keep it busy without reading the whole bundle into memory at once.\n  const concurrency = Math.max(1, options.concurrency ?? Math.min(8, availableParallelism()));\n  let next = 0;\n  await Promise.all(\n    Array.from({ length: Math.min(concurrency, queue.length) }, async () => {\n      while (next < queue.length) {\n        await work(queue[next++]);\n      }\n    }),\n  );\n\n  return { record, stats };\n}\n\nexport async function writeStaticAssetsRecord(clientDir: string, record: StaticAssetsRecord) {\n  const path = join(clientDir, STATIC_ASSETS_RECORD);\n  await mkdir(dirname(path), { recursive: true });\n  // Sorted, so two builds of the same tree write the same file.\n  const files = Object.fromEntries(\n    Object.entries(record.files).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)),\n  );\n  await writeFile(path, `${JSON.stringify({ files }, null, 2)}\\n`);\n}\n\n/**\n * The record a build wrote, or `null` when there is none (a build made before\n * precompression, or an incomplete `dist/`): the server then serves every file\n * as before. A malformed entry is dropped rather than trusted.\n */\nexport async function readStaticAssetsRecord(\n  clientDir: string,\n): Promise<StaticAssetsRecord | null> {\n  let raw: string;\n  try {\n    raw = await readFile(join(clientDir, STATIC_ASSETS_RECORD), \"utf8\");\n  } catch {\n    return null;\n  }\n  let files: unknown;\n  try {\n    files = JSON.parse(raw)?.files;\n  } catch {\n    return null;\n  }\n  if (!files || typeof files !== \"object\") {\n    return null;\n  }\n  const record: StaticAssetsRecord = { files: {} };\n  for (const [file, encodings] of Object.entries(files)) {\n    if (!Array.isArray(encodings)) continue;\n    record.files[file] = ENCODINGS.filter((encoding) => encodings.includes(encoding));\n  }\n  return record;\n}\n",
     "export function generateETag(lastModified: number): string {\n  // Assuming the last modified timestamp is in milliseconds\n  const lastModifiedStr = lastModified.toString();\n\n  const hasher = new Bun.CryptoHasher(\"sha1\");\n  hasher.update(lastModifiedStr);\n  const hash = hasher.digest(\"hex\");\n\n  return hash;\n}\n",
     "import { DEFAULT_ASSET_BASE, assetUrl } from \"../config/assetBase\";\n\n/** The subset of a Vite manifest entry this module reads. */\nexport interface ViteManifestChunk {\n  file: string;\n  imports?: string[];\n  dynamicImports?: string[];\n}\n\nexport type ViteManifest = Record<string, ViteManifestChunk>;\n\n/** Vite's manifest key for the module that boots hydration. */\nexport const CLIENT_ENTRY_KEY = \"app/client.tsx\";\n\n/**\n * How the shell boots hydration in production: `module` is imported from the\n * bootstrap script, `preload` is every chunk that import pulls in — see\n * `clientEntry` in `ViewRouteDispatcher` for why the entry does not go through\n * React's `bootstrapModules`.\n *\n * `undefined` when the manifest has no client entry, which means a `dist/`\n * interrupted between the server and client build passes. Degrading beats\n * throwing here: this runs at boot, so a deref would take down API routes,\n * static assets and health checks over what is only a document concern, and\n * the dispatcher already renders a shell that simply does not hydrate.\n *\n * `assetBase` is the base the client build recorded — see `readBuiltAssetBase`.\n */\nexport function createClientEntry(\n  manifest: ViteManifest,\n  assetBase: string = DEFAULT_ASSET_BASE,\n): { module: string; preload: string[] } | undefined {\n  const file = manifest[CLIENT_ENTRY_KEY]?.file;\n  if (!file) {\n    return undefined;\n  }\n  return {\n    module: assetUrl(file, assetBase),\n    preload: collectModulePreloads(manifest, CLIENT_ENTRY_KEY, assetBase),\n  };\n}\n\n/**\n * Every chunk URL that importing `entryKey` pulls in, itself first.\n *\n * The browser can only discover these one parse at a time — it learns about a\n * chunk's static imports after the chunk has arrived and been parsed — so a\n * `layout -> view -> child component` graph costs one round trip per level.\n * Handing the whole list to the shell as `modulepreload` hints turns that\n * chain into one parallel fetch (#352).\n *\n * `dynamicImports` are deliberately left out: those are the pieces the app\n * asked to load lazily, and preloading them would download code the current\n * route may never render.\n */\nexport function collectModulePreloads(\n  manifest: ViteManifest,\n  entryKey: string,\n  assetBase: string = DEFAULT_ASSET_BASE,\n): string[] {\n  const urls: string[] = [];\n  // Chunk graphs are cyclic often enough (two chunks importing each other\n  // through a shared module) that walking them without a visited set hangs.\n  const visited = new Set<string>();\n\n  const walk = (key: string) => {\n    if (visited.has(key)) return;\n    visited.add(key);\n    const chunk = manifest[key];\n    if (!chunk?.file) return;\n    urls.push(assetUrl(chunk.file, assetBase));\n    for (const imported of chunk.imports ?? []) {\n      walk(imported);\n    }\n  };\n\n  walk(entryKey);\n\n  return urls;\n}\n",
     "/**\n * Recovery from a chunk that will not load — almost always a document from an\n * earlier release asking for a chunk the server it reached no longer has\n * (#548). The page cannot continue with the module it wanted, and a full load\n * of the URL it was heading to gets it the current release's document.\n *\n * One reload, guarded: a reload that lands on the same failure (a chunk that is\n * genuinely missing, a proxy that keeps refusing it) must not become a loop. A\n * `sessionStorage` marker with a timestamp survives the reload it guards, so a\n * second failure inside the cooldown is left to the route's error boundary.\n *\n * No DOM or React import at module scope: the server's reload stub\n * (`server/staticAssetMiss.ts`) embeds the same guard as a script.\n */\n\n/** The `sessionStorage` key the guard lives under, shared with the reload stub. */\nexport const CHUNK_RELOAD_MARKER = \"gemi:chunk-reload\";\n\n/** How long after one recovery reload another is refused. */\nexport const DEFAULT_CHUNK_RELOAD_COOLDOWN_MS = 30_000;\n\n/**\n * Where the failure surfaced: a route's view chunk during a client-side\n * navigation or hydration, a `vite:preloadError` (a lazy `import()` in app\n * code, through Vite's preload helper), or an app calling\n * `recoverFromChunkLoadError` from its own error boundary.\n */\nexport type ChunkLoadErrorSource = \"navigation\" | \"hydration\" | \"preload\" | \"app\";\n\n/**\n * Why gemi will not reload, or `null` when it will:\n * - `cooldown`: it already reloaded for a chunk failure within `cooldownMs`.\n * - `offline`: `navigator.onLine` is false — a reload would only fail harder.\n * - `storage`: `sessionStorage` cannot be read or written, so the guard cannot\n *   survive the reload and the loop it prevents could not be ruled out.\n */\nexport type ChunkReloadBlock = \"cooldown\" | \"offline\" | \"storage\" | null;\n\nexport interface ChunkLoadErrorContext {\n  error: unknown;\n  /** The URL the reload goes to: the page being navigated to. */\n  url: string;\n  source: ChunkLoadErrorSource;\n  /** Why gemi will not reload, or `null` when it is about to. */\n  blocked: ChunkReloadBlock;\n}\n\nexport interface ChunkLoadRecoveryOptions {\n  /** Default 30 000 ms. */\n  cooldownMs?: number;\n  /**\n   * Called for every chunk load failure gemi sees, before it reloads — the\n   * place to report it, or to veto the reload (unsaved input, a page that\n   * would rather show its own \"a new version is available\" prompt). Return\n   * `false` to skip the reload; anything else lets gemi proceed. It is called\n   * when the reload is blocked too, with `blocked` saying why.\n   */\n  onChunkLoadError?: (context: ChunkLoadErrorContext) => boolean | void;\n}\n\nlet enabled = true;\nlet options: ChunkLoadRecoveryOptions = {};\nlet reloading = false;\n\n/**\n * Sets how gemi recovers from a failed chunk. `false` turns recovery off: the\n * failure goes to the route's error boundary as it did before. `init` calls\n * this with its `chunkLoadRecovery` option.\n */\nexport function configureChunkLoadRecovery(next: ChunkLoadRecoveryOptions | false | undefined) {\n  enabled = next !== false;\n  options = next || {};\n}\n\n/** For tests: back to the defaults, with no reload in flight. */\nexport function __resetChunkLoadRecovery() {\n  enabled = true;\n  options = {};\n  reloading = false;\n}\n\n/**\n * Whether `error` is a module that failed to load rather than one that loaded\n * and threw. Each engine words it differently:\n *\n * - Chromium: `Failed to fetch dynamically imported module: <url>`\n * - Firefox: `error loading dynamically imported module: <url>`\n * - Safari: `Importing a module script failed.`, and on iOS 16\n *   `Importing module '<specifier>' is not found.` (folio#2117)\n * - Vite's preload helper: `Unable to preload CSS for <url>`\n *\n * A view that throws while evaluating is not one of these, and reloading\n * would only hide it.\n */\nexport function isChunkLoadError(error: unknown): boolean {\n  if (!error || typeof error !== \"object\") {\n    return false;\n  }\n  const { name, message } = error as { name?: unknown; message?: unknown };\n  if (name === \"ChunkLoadError\") {\n    return true;\n  }\n  if (typeof message !== \"string\") {\n    return false;\n  }\n  return CHUNK_LOAD_MESSAGES.some((pattern) => pattern.test(message));\n}\n\nconst CHUNK_LOAD_MESSAGES = [\n  /failed to fetch dynamically imported module/i,\n  /error loading dynamically imported module/i,\n  /importing a module script failed/i,\n  /importing module .* is not found/i,\n  /unable to preload css/i,\n  /failed to load module script/i,\n];\n\n/**\n * Reloads the page onto `url` once for a chunk that failed to load, unless the\n * guard or the app's `onChunkLoadError` says not to. Returns whether a reload\n * was started.\n *\n * Errors that are not chunk failures are ignored (`false`), so an app's error\n * boundary can pass everything it catches here.\n */\nexport function recoverFromChunkLoadError(\n  error: unknown,\n  { source = \"app\", url }: { source?: ChunkLoadErrorSource; url?: string } = {},\n): boolean {\n  if (typeof window === \"undefined\" || !enabled || !isChunkLoadError(error)) {\n    return false;\n  }\n  if (reloading) {\n    // A route with several views fails once per view; the first one reloads.\n    return true;\n  }\n  const target = url ?? window.location.href;\n  const cooldownMs = options.cooldownMs ?? DEFAULT_CHUNK_RELOAD_COOLDOWN_MS;\n  const blocked = reloadBlock(cooldownMs);\n\n  if (options.onChunkLoadError?.({ error, url: target, source, blocked }) === false) {\n    return false;\n  }\n  if (blocked !== null || !markReload(target)) {\n    return false;\n  }\n\n  reloading = true;\n  if (target === window.location.href) {\n    window.location.reload();\n  } else {\n    window.location.assign(target);\n  }\n  return true;\n}\n\nfunction reloadBlock(cooldownMs: number): ChunkReloadBlock {\n  if (typeof navigator !== \"undefined\" && navigator.onLine === false) {\n    return \"offline\";\n  }\n  let raw: string | null;\n  try {\n    raw = window.sessionStorage.getItem(CHUNK_RELOAD_MARKER);\n  } catch {\n    return \"storage\";\n  }\n  const at = parseMarker(raw);\n  return at !== null && withinCooldown(Date.now() - at, cooldownMs) ? \"cooldown\" : null;\n}\n\n// A marker from the future (the clock was set back since it was written) is\n// stale rather than a cooldown that lasts until the clock catches up.\nfunction withinCooldown(elapsed: number, cooldownMs: number): boolean {\n  return elapsed >= 0 && elapsed < cooldownMs;\n}\n\nfunction parseMarker(raw: string | null): number | null {\n  if (!raw) {\n    return null;\n  }\n  try {\n    const at = JSON.parse(raw)?.at;\n    return typeof at === \"number\" ? at : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction markReload(url: string): boolean {\n  try {\n    window.sessionStorage.setItem(CHUNK_RELOAD_MARKER, JSON.stringify({ url, at: Date.now() }));\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * The same guard as a classic script body, for the module the server sends in\n * place of a chunk it does not have. It reloads once per cooldown; inside the\n * cooldown (or with no storage) it throws an error `isChunkLoadError`\n * recognises, so the importing page's own recovery and error boundary see the\n * failure instead of a module that silently has no exports.\n */\nexport function chunkReloadStubScript(\n  pathname: string,\n  cooldownMs: number = DEFAULT_CHUNK_RELOAD_COOLDOWN_MS,\n): string {\n  const key = JSON.stringify(CHUNK_RELOAD_MARKER);\n  const error = JSON.stringify(`Failed to fetch dynamically imported module: ${pathname}`);\n  return (\n    `var r=!1;try{var s=window.sessionStorage,m=JSON.parse(s.getItem(${key})||\"null\");` +\n    `var d=m?Date.now()-m.at:NaN;` +\n    `if(navigator.onLine!==!1&&!(d>=0&&d<${cooldownMs})){` +\n    `s.setItem(${key},JSON.stringify({url:window.location.href,at:Date.now()}));r=!0}}catch(e){}` +\n    `if(r)window.location.reload();else throw new Error(${error});export {}`\n  );\n}\n",
@@ -12,7 +13,7 @@
     "import { stringEraRefusal } from \"../http/Error\";\nimport { isApiPath } from \"../services/router/apiPath\";\n\n// The production server's last resort: an error nothing on the way here turned\n// into a response. Request breakers (auth, 404s, 416s) are answered by the\n// dispatchers before this, so what arrives is a genuine failure — and its\n// message and stack are for the developer, not for whoever triggered it. They\n// can carry absolute paths, dependency versions, SQL fragments and column\n// names. The dev server renders them on purpose (`httpDev.ts`); this does not.\n\nconst GENERIC_500_HTML = `<!DOCTYPE html>\n<html lang=\"en\">\n  <head>\n    <meta charset=\"UTF-8\" />\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />\n    <title>Internal Server Error</title>\n    <style>\n      body { font-family: system-ui, sans-serif; margin: 0; min-height: 100vh; display: grid; place-items: center; }\n      main { text-align: center; padding: 16px; }\n      h1 { font-size: 1.5rem; margin: 0 0 0.5rem; }\n      p { margin: 0; opacity: 0.7; }\n    </style>\n  </head>\n  <body>\n    <main>\n      <h1>Something went wrong</h1>\n      <p>Please try again later.</p>\n    </main>\n  </body>\n</html>`;\n\nexport function unhandledErrorResponse(\n  err: unknown,\n  pathname: string,\n  onException?: (error: Error) => void,\n): Response {\n  // `onException` is the report, and the default one `App` installs is a\n  // `console.error`, so logging here as well printed every failure twice\n  // (three times for `/api`, whose dispatcher logs before rethrowing). Only\n  // without a reporter does this log itself.\n  //\n  // Reported for `/api` too: an app's error tracking should see an API failure\n  // that got this far, not only a page one. `onRequestFail` is a different\n  // hook (route config, called by the dispatchers), so this is not a second\n  // report through the same channel.\n  if (!onException) {\n    console.error(err);\n  } else {\n    try {\n      // The hook is typed to receive an `Error`; a thrown string or object is\n      // wrapped so a reporter reading `.stack` or `.name` gets one.\n      onException(err instanceof Error ? err : new Error(String(err), { cause: err }));\n    } catch (reportError) {\n      // A broken reporter must not turn a 500 into a leaked stack either.\n      console.error(err);\n      console.error(reportError);\n    }\n  }\n\n  if (isApiPath(pathname)) {\n    return new Response(\n      JSON.stringify({ error: stringEraRefusal(\"server_error\", \"Internal Server Error\", 500) }),\n      {\n        status: 500,\n        headers: { \"Content-Type\": \"application/json\" },\n      },\n    );\n  }\n\n  return new Response(GENERIC_500_HTML, {\n    status: 500,\n    headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n  });\n}\n",
     "/**\n * Which `X-Forwarded-For` entries the production server believes (#8).\n *\n * `X-Forwarded-For` is written by whoever sends the request. A client talking\n * to the app directly — or through a proxy that appends to the header rather\n * than replacing it — picks any address it likes, and `clientIp` (the rate\n * limiter's default key) used to read the left-most entry, which is exactly\n * the one the client wrote. So the server decides here, once, at the edge,\n * and hands the app a single address it can rely on:\n *\n * - `none` (the default): no proxy is trusted. The header is replaced with the\n *   socket's peer address, and `X-Real-IP` is dropped.\n * - `hops` (`GEMI_TRUST_PROXY=<n>`): the `n` proxies nearest the app are\n *   trusted. Each appends the address it was reached from, so the client is\n *   the `n`-th entry from the right of `X-Forwarded-For`. Anything\n *   further left was written by someone the app does not trust and is dropped.\n * - `all` (`GEMI_TRUST_PROXY=true`): the inbound header is passed through\n *   unchanged, as before 0.88. Only sound behind a proxy that overwrites\n *   `X-Forwarded-For` (and `X-Real-IP`) rather than appending to it.\n */\nexport type ForwardedTrust =\n  | { kind: \"none\" }\n  | { kind: \"all\" }\n  | { kind: \"hops\"; hops: number };\n\nconst NONE: ForwardedTrust = { kind: \"none\" };\n\n/**\n * `GEMI_TRUST_PROXY` as a policy. Unset, empty, `false`, `off` and `0` trust\n * nothing; `true` trusts everything; a positive integer is a hop count.\n * Anything else throws, so a typo fails the boot instead of silently trusting\n * nothing (every client sharing the proxy's address) or everything.\n */\nexport function parseTrustProxy(value: string | undefined): ForwardedTrust {\n  const raw = (value ?? \"\").trim().toLowerCase();\n  if (raw === \"\" || raw === \"false\" || raw === \"off\" || raw === \"0\") {\n    return NONE;\n  }\n  if (raw === \"true\") {\n    return { kind: \"all\" };\n  }\n  if (/^[1-9]\\d*$/.test(raw)) {\n    return { kind: \"hops\", hops: Number(raw) };\n  }\n  throw new Error(\n    `GEMI_TRUST_PROXY must be \"false\", \"true\" or the number of proxies in front of the app (e.g. 1). Got ${JSON.stringify(value)}.`,\n  );\n}\n\n/**\n * Rewrites `headers` so `X-Forwarded-For` holds what `trust` says the client\n * address is. `peer` is the socket's remote address — `null` for a unix\n * socket, where the immediate hop is still counted as one proxy.\n */\nexport function applyForwardedTrust(\n  headers: Headers,\n  peer: string | null,\n  trust: ForwardedTrust,\n): void {\n  if (trust.kind === \"all\") {\n    if (!headers.get(\"x-forwarded-for\") && peer) {\n      headers.set(\"x-forwarded-for\", peer);\n    }\n    return;\n  }\n\n  // Under any other policy `X-Real-IP` is as client-written as the rest; the\n  // address the app should use is the one left in `X-Forwarded-For`.\n  headers.delete(\"x-real-ip\");\n\n  let client: string | null = peer;\n  if (trust.kind === \"hops\") {\n    const entries = (headers.get(\"x-forwarded-for\") ?? \"\")\n      .split(\",\")\n      .map((entry) => entry.trim())\n      .filter(Boolean);\n    // The chain is `entries` + `peer`; the client sits `hops` places left of\n    // its end, i.e. `entries[entries.length - hops]`. A shorter chain than\n    // expected means the request skipped a proxy, so its left-most hop is the\n    // furthest thing seen — never anything further left than that.\n    const index = entries.length - trust.hops;\n    client = index >= 0 ? entries[index]! : (entries[0] ?? peer);\n  }\n\n  if (client) {\n    headers.set(\"x-forwarded-for\", client);\n  } else {\n    headers.delete(\"x-forwarded-for\");\n  }\n}\n"
   ],
-  "mappings": ";mzBAAA,SAAS,OAAM,IAAS,QCkBxB,WAAS,UACT,cAAS,oBAAW,WAAsB,QAW1C,FAAM,HAAuC,LAAC,DAAM,AAAM,JAQpD,HAAyB,DAYzB,HAAiB,EACjB,GAAqB,GAGrB,GAAa,EAEnB,SAAS,EAAW,CAAC,EAAiC,CACpD,GAAI,IAAQ,OACV,MAAO,GAKT,GAAI,CAAC,oBAAoB,KAAK,EAAI,KAAK,CAAC,EACtC,MAAO,GAET,IAAM,EAAQ,OAAO,EAAI,KAAK,CAAC,EAC/B,OAAO,OAAO,SAAS,CAAK,EAAI,KAAK,IAAI,EAAO,CAAC,EAAI,EAahD,SAAS,EAAmB,CAAC,EAA+D,CACjG,GAAI,IAAW,MAAQ,IAAW,OAChC,OAAO,KAGT,IAAM,EAAW,IAAI,IACrB,QAAW,KAAQ,EAAO,MAAM,GAAG,EAAG,CACpC,IAAO,KAAc,GAAU,EAAK,MAAM,GAAG,EACvC,EAAS,EAAU,KAAK,EAAE,YAAY,EAC5C,GAAI,IAAW,GACb,SAGF,IAAI,EAAI,EACR,QAAW,KAAS,EAAQ,CAC1B,IAAM,EAAY,EAAM,QAAQ,GAAG,EACnC,GAAI,IAAc,GAChB,SAEF,GAAI,EAAM,MAAM,EAAG,CAAS,EAAE,KAAK,EAAE,YAAY,IAAM,IAAK,CAC1D,EAAI,GAAY,EAAM,MAAM,EAAY,CAAC,CAAC,EAC1C,OAIJ,EAAS,IAAI,EAAQ,CAAC,EAGxB,OAAO,EAUF,SAAS,EAAiB,CAC/B,EACA,EAA+B,GACP,CACxB,IAAM,EAAW,GAAoB,CAAM,EAC3C,GAAI,CAAC,EACH,OAAO,KAGT,IAAM,EAAW,EAAS,IAAI,GAAG,EAC7B,EAA+B,KAC/B,EAAQ,EAEZ,QAAW,KAAU,EAAW,CAC9B,IAAM,EAAI,EAAS,IAAI,CAAM,GAAK,GAAY,EAC9C,GAAI,EAAI,EACN,EAAO,EACP,EAAQ,EAIZ,OAAO,EAGT,SAAS,EAAY,CAAC,EAA4B,EAA4B,CAC5E,GAAI,CAAC,EACH,MAAO,GAIT,OAAO,EACJ,MAAM,GAAG,EACT,KAAK,CAAC,IAAU,EAAM,KAAK,EAAE,YAAY,EAAE,MAAM,GAAG,EAAE,GAAG,KAAK,IAAM,CAAS,EAY3E,SAAS,EAAc,CAAC,EAAgB,EAAwB,CAGrE,GAAI,IAAW,OACb,MAAO,GAKT,GAAI,EAAI,OAAS,KAAO,EAAI,SAAW,KAAO,EAAI,SAAW,KAAO,EAAI,SAAW,IACjF,MAAO,GAGT,GAAI,EAAI,QAAQ,IAAI,eAAe,EACjC,MAAO,GAGT,IAAM,EAAc,EAAI,QAAQ,IAAI,cAAc,EAClD,GAAI,CAAC,GAAe,CAAC,0BAA0B,KAAK,CAAW,EAC7D,MAAO,GAOT,GAAI,CAAC,EAAI,KACP,MAAO,GAKT,IAAM,EAAkB,EAAI,QAAQ,IAAI,kBAAkB,EAC1D,GAAI,GAAmB,EAAgB,KAAK,EAAE,YAAY,IAAM,WAC9D,MAAO,GAKT,GAAI,GAAa,EAAI,QAAQ,IAAI,eAAe,EAAG,cAAc,EAC/D,MAAO,GAGT,IAAM,EAAgB,EAAI,QAAQ,IAAI,gBAAgB,EACtD,GAAI,IAAkB,MAAQ,OAAO,CAAa,EAAI,GACpD,MAAO,GAGT,MAAO,GAWF,SAAS,EAAmB,CAAC,EAA2B,CAC7D,IAAM,EACJ,IAAa,KACT,GAAqB,CACnB,OAAQ,EACL,EAAU,sBAAuB,IACjC,EAAU,oBAAqB,EAClC,EACA,MAAO,EAAU,sBACnB,CAAC,EACD,GAAW,CAAE,MAAO,GAAY,MAAO,EAAU,YAAa,CAAC,EAErE,OAAO,GAAO,MAAM,CAAU,EAGhC,SAAS,EAAsB,CAAC,EAAkB,CAChD,IAAM,EAAO,EAAQ,IAAI,MAAM,EAC/B,GAAI,CAAC,EAAM,CACT,EAAQ,IAAI,OAAQ,iBAAiB,EACrC,OAEF,IAAM,EAAS,EAAK,MAAM,GAAG,EAAE,IAAI,CAAC,IAAU,EAAM,KAAK,EAAE,YAAY,CAAC,EAGxE,GAAI,EAAO,SAAS,GAAG,GAAK,EAAO,SAAS,iBAAiB,EAC3D,OAEF,EAAQ,OAAO,OAAQ,iBAAiB,EAanC,SAAS,CAAgB,CAAC,EAAc,EAAyB,CACtE,GAAI,CAAC,GAAe,EAAI,OAAQ,CAAG,EACjC,OAAO,EAGT,IAAM,EAAU,IAAI,QAAQ,EAAI,OAAO,EACvC,GAAuB,CAAO,EAE9B,IAAM,EAAW,GAAkB,EAAI,QAAQ,IAAI,iBAAiB,CAAC,EACrE,GAAI,CAAC,EACH,OAAO,IAAI,SAAS,EAAI,KAAM,CAC5B,OAAQ,EAAI,OACZ,WAAY,EAAI,WAChB,SACF,CAAC,EAGH,IAAI,EACJ,GAAI,CACF,EAAU,GAAoB,CAAQ,EACtC,KAAM,CAGN,OAAO,IAAI,SAAS,EAAI,KAAM,CAC5B,OAAQ,EAAI,OACZ,WAAY,EAAI,WAChB,SACF,CAAC,EAQH,OALA,EAAQ,IAAI,mBAAoB,CAAQ,EAGxC,EAAQ,OAAO,gBAAgB,EAExB,IAAI,SAAS,EAAI,KAAM,YAAY,CAAO,EAAG,CAClD,OAAQ,EAAI,OACZ,WAAY,EAAI,WAChB,SACF,CAAC,EC5SH,kBAAS,WAAS,qBAClB,eAAS,cCDF,SAAS,CAAY,CAAC,EAA8B,CAEzD,IAAM,EAAkB,EAAa,SAAS,EAExC,EAAS,IAAI,IAAI,aAAa,MAAM,EAI1C,OAHA,EAAO,OAAO,CAAe,EAChB,EAAO,OAAO,KAAK,EDiBlC,eAAsB,CAAe,CAAC,EAAyC,CAC7E,IAAM,EAAQ,IAAI,IAElB,eAAe,CAAI,CAAC,EAAa,EAAmB,CAClD,IAAI,EACJ,GAAI,CACF,EAAU,MAAM,GAAQ,EAAK,CAAE,cAAe,EAAK,CAAC,EACpD,KAAM,CACN,OAEF,QAAW,KAAS,EAAS,CAC3B,GAAI,EAAM,KAAK,WAAW,GAAG,EAAG,SAChC,GAAI,GAAY,EAAM,OAAS,SAAU,SACzC,IAAM,EAAO,GAAK,EAAK,EAAM,IAAI,EAC7B,EAAQ,EAAM,YAAY,EAC1B,EAAS,EAAM,OAAO,EAC1B,GAAI,EAAM,eAAe,EACvB,GAAI,CACF,IAAM,EAAS,MAAM,GAAK,CAAI,EAC9B,EAAQ,EAAO,YAAY,EAC3B,EAAS,EAAO,OAAO,EACvB,KAAM,CACN,SAGJ,GAAI,EAAQ,EAAM,IAAI,CAAI,EAGrB,QAAI,GAAS,CAAC,EAAM,eAAe,EAAG,MAAM,EAAK,EAAM,EAAK,GAKrE,OADA,MAAM,EAAK,EAAW,EAAI,EACnB,EAGT,IAAM,GAAa,4CAeZ,SAAS,CAAkB,CAAC,EAAc,EAAwB,CACvE,IAAM,EAAO,IAAI,KAAK,CAAI,EACpB,EAAQ,EAAK,KACb,EAAO,EAAa,EAAK,YAAY,EAErC,EAAkC,CACtC,eAAgB,EAAK,MAAQ,2BAC7B,gBAAiB,GACjB,gBAAiB,QACjB,KAAM,CACR,EAEM,EAAQ,EAAiB,EAAI,QAAQ,IAAI,OAAO,CAAC,EAEvD,GAAI,EAAO,CACT,IAAM,EAAW,EAAa,EAAO,CAAK,EAC1C,GAAI,CAAC,EACH,OAAO,EAA4B,CAAK,EAE1C,OAAO,IAAI,SAAS,EAAK,MAAM,EAAS,MAAO,EAAS,IAAM,CAAC,EAAE,OAAO,EAAG,CACzE,OAAQ,IACR,QAAS,IACJ,EACH,gBAAiB,EAAmB,EAAS,MAAO,EAAS,IAAK,CAAK,EACvE,iBAAkB,OAAO,EAAS,MAAM,CAC1C,CACF,CAAC,EAGH,OAAO,IAAI,SAAS,EAAK,OAAO,EAAG,CACjC,QAAS,IAAK,EAAS,iBAAkB,OAAO,CAAK,CAAE,CACzD,CAAC,EFtGH,eAAS,qBISF,IAAM,EAAmB,iBAgBzB,SAAS,CAAiB,CAC/B,EACA,EAAoB,EAC+B,CACnD,IAAM,EAAO,EAAS,IAAmB,KACzC,GAAI,CAAC,EACH,OAEF,MAAO,CACL,OAAQ,EAAS,EAAM,CAAS,EAChC,QAAS,EAAsB,EAAU,EAAkB,CAAS,CACtE,EAgBK,SAAS,CAAqB,CACnC,EACA,EACA,EAAoB,EACV,CACV,IAAM,EAAiB,CAAC,EAGlB,EAAU,IAAI,IAEd,EAAO,CAAC,IAAgB,CAC5B,GAAI,EAAQ,IAAI,CAAG,EAAG,OACtB,EAAQ,IAAI,CAAG,EACf,IAAM,EAAQ,EAAS,GACvB,GAAI,CAAC,GAAO,KAAM,OAClB,EAAK,KAAK,EAAS,EAAM,KAAM,CAAS,CAAC,EACzC,QAAW,KAAY,EAAM,SAAW,CAAC,EACvC,EAAK,CAAQ,GAMjB,OAFA,EAAK,CAAQ,EAEN,EC8HF,SAAS,CAAqB,CACnC,EACA,EA3L8C,MA4LtC,CACR,IAAM,EAAM,KAAK,UAhMgB,mBAgMa,EACxC,EAAQ,KAAK,UAAU,gDAAgD,GAAU,EACvF,MACE,mEAAmE,+EAE5B,iBAC1B,kIACyC,eC3M1D,IAAM,GAAc,IAAI,OAAO,IAAI,cAAkC,EAE9D,SAAS,EAAgB,CAAC,EAA2B,CAC1D,OAAO,GAAY,KAAK,CAAQ,EA2C3B,SAAS,CAAe,CAAC,EAAwC,CACtE,GAAI,GAAiB,CAAQ,EAC3B,OAAO,IAAI,SAAS,EAAsB,CAAQ,EAAG,CACnD,QAAS,CACP,eAAgB,yBAChB,gBAAiB,UACnB,CACF,CAAC,EAKH,GAAI,EAAoB,CAAQ,EAC9B,OAAO,IAAI,SAAS,YAAa,CAAE,OAAQ,GAAI,CAAC,EAOlD,OCpEF,IAAM,GAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAqBlB,SAAS,CAAsB,CACpC,EACA,EACA,EACU,CAUV,GAAI,CAAC,EACH,QAAQ,MAAM,CAAG,EAEjB,QAAI,CAGF,EAAY,aAAe,MAAQ,EAAU,MAAM,OAAO,CAAG,EAAG,CAAE,MAAO,CAAI,CAAC,CAAC,EAC/E,MAAO,EAAa,CAEpB,QAAQ,MAAM,CAAG,EACjB,QAAQ,MAAM,CAAW,EAI7B,GAAI,EAAU,CAAQ,EACpB,OAAO,IAAI,SACT,KAAK,UAAU,CAAE,MAAO,EAAiB,eAAgB,wBAAyB,GAAG,CAAE,CAAC,EACxF,CACE,OAAQ,IACR,QAAS,CAAE,eAAgB,kBAAmB,CAChD,CACF,EAGF,OAAO,IAAI,SAAS,GAAkB,CACpC,OAAQ,IACR,QAAS,CAAE,eAAgB,0BAA2B,CACxD,CAAC,EC/CH,IAAM,GAAuB,CAAE,KAAM,MAAO,EAQrC,SAAS,CAAe,CAAC,EAA2C,CACzE,IAAM,GAAO,GAAS,IAAI,KAAK,EAAE,YAAY,EAC7C,GAAI,IAAQ,IAAM,IAAQ,SAAW,IAAQ,OAAS,IAAQ,IAC5D,OAAO,GAET,GAAI,IAAQ,OACV,MAAO,CAAE,KAAM,KAAM,EAEvB,GAAI,aAAa,KAAK,CAAG,EACvB,MAAO,CAAE,KAAM,OAAQ,KAAM,OAAO,CAAG,CAAE,EAE3C,MAAU,MACR,uGAAuG,KAAK,UAAU,CAAK,IAC7H,EAQK,SAAS,CAAmB,CACjC,EACA,EACA,EACM,CACN,GAAI,EAAM,OAAS,MAAO,CACxB,GAAI,CAAC,EAAQ,IAAI,iBAAiB,GAAK,EACrC,EAAQ,IAAI,kBAAmB,CAAI,EAErC,OAKF,EAAQ,OAAO,WAAW,EAE1B,IAAI,EAAwB,EAC5B,GAAI,EAAM,OAAS,OAAQ,CACzB,IAAM,GAAW,EAAQ,IAAI,iBAAiB,GAAK,IAChD,MAAM,GAAG,EACT,IAAI,CAAC,IAAU,EAAM,KAAK,CAAC,EAC3B,OAAO,OAAO,EAKX,EAAQ,EAAQ,OAAS,EAAM,KACrC,EAAS,GAAS,EAAI,EAAQ,GAAW,EAAQ,IAAM,EAGzD,GAAI,EACF,EAAQ,IAAI,kBAAmB,CAAM,EAErC,OAAQ,OAAO,iBAAiB,ERnEpC,IAAM,EAAU,EAAY,EAEtB,GAAS,EAAK,EAAS,KAAK,EAC5B,EAAU,EAAK,EAAS,MAAM,EAE9B,EAAY,EAAK,EAAS,QAAQ,EAQxC,SAAS,EAAc,CAAC,EAAiC,CACvD,IAAI,EACJ,GAAI,CACF,EAAU,mBAAmB,CAAQ,EACrC,KAAM,CACN,OAAO,KAET,IAAM,EAAO,GAAQ,EAAW,IAAM,EAAQ,QAAQ,iBAAkB,SAAS,CAAC,EAClF,OAAO,EAAK,WAAW,EAAY,EAAG,EAAI,EAAO,KAGnD,eAAe,EAAM,CAAC,EAAc,CAClC,GAAI,CACF,OAAQ,MAAM,GAAK,CAAI,GAAG,OAAO,EACjC,KAAM,CACN,MAAO,IAQX,eAAsB,EAAQ,CAAC,EAAU,EAAkC,CACzE,IAAM,EAAW,MAAa,UAAG,gCAC3B,EAAiB,MAAa,UAAG,gCAIjC,EAAY,MAAM,EAAmB,GAAG,UAAgB,EAE9D,QAAQ,IAAI,SAAW,EACvB,QAAQ,IAAI,QAAU,GACtB,QAAQ,IAAI,SAAW,EAEvB,IAAM,EAAgB,CAAC,EACjB,EAAQ,CAAC,EACT,EAAc,CAAC,EACf,EAAc,CAAC,EAGf,EAAkD,CAAC,EACnD,EAAW,CAAC,EAAkB,IAAiB,IAAI,qBAA4B,MAC/E,EAAY,CAAC,EAEnB,QAAW,IAAY,CAAC,MAAO,GAAG,EAAI,qBAAqB,KAAK,CAAG,CAAC,EAAG,CACrE,IAAM,EAAa,EAAe,aAAa,SAC/C,GAAI,CAAC,GAAY,KAAM,CACrB,QAAQ,IAAI,6BAA6B,GAAU,EACnD,QAAQ,IAAI,CAAU,EACtB,IAAM,EAAQ,OAAO,KAAK,CAAc,EAClC,EAAO,aAAa,QAC1B,QAAQ,IAAI,GAAG,gCAAmC,EAClD,QAAQ,IAAI,CAAK,EAEnB,IAAM,EAAM,MAAa,UAAG,QAAQ,IAAI,mBAAmB,GAAY,QACvE,EAAc,GAAY,EAAI,QAC9B,EAAM,GAAY,EAAI,UAGtB,EAAY,GAAY,EACxB,IAAM,EAAa,EAAS,aAAa,SAEzC,GAAI,GAAY,KAAO,GAAY,IAAI,OAAS,EAC9C,EAAY,GAAY,GAAY,IAEtC,GAAI,EACF,EAAU,KAAK,EAAS,EAAU,EAAS,GAAY,KAAM,CAAS,CAAC,CAAC,EACxE,EAAsB,GAAY,EAChC,EACA,aAAa,QACb,CACF,EAIJ,IAAM,GAAU,IAAI,EAAU,KAAK,GAAG,KAKhC,EAAc,EAAkB,EAAU,CAAS,EACzD,GAAI,CAAC,EAGH,QAAQ,MACN,2BAA2B,wFAC7B,EAMF,IAAM,GAAwB,EAAS,mBAAmB,KAAO,CAAC,EAC5D,IACJ,MAAM,QAAQ,IAAI,GAAY,IAAI,CAAC,IAAY,IAAI,KAAK,GAAG,YAAkB,GAAS,EAAE,KAAK,CAAC,CAAC,GAC/F,KAAK;AAAA,CAAI,EAmBL,GAAc,MAAM,EAAgB,CAAS,EAEnD,eAAe,EAAc,CAAC,EAAc,CAC1C,IAAQ,YAAa,IAAI,IAAI,EAAI,GAAG,EAEpC,GAAI,EAAU,CAAQ,EACpB,OAAO,MAAM,EAAc,EAAK,CAAQ,EAG1C,IAAM,EAAW,GAAe,CAAQ,EAMxC,GAJE,EAAoB,CAAQ,GAC5B,EAAS,WAAW,cAAc,GACjC,IAAa,MAAQ,GAAY,IAAI,CAAQ,EAE7B,CAUjB,GAAI,CAAC,GAAY,CAAE,MAAM,GAAO,CAAQ,EACtC,OAAO,EAAgB,CAAQ,GAAM,MAAM,EAAc,EAAK,CAAQ,EAGxE,GAAI,CACF,OAAO,EAAmB,EAAK,CAAQ,EACvC,MAAO,EAAO,CAEd,OADA,EAAI,cAAc,CAAK,EAChB,IAAI,SAAS,YAAa,CAAE,OAAQ,GAAI,CAAC,GAIpD,OAAO,MAAM,EAAc,EAAK,CAAQ,EAG1C,eAAe,CAAa,CAAC,EAAc,EAAkB,CAC3D,IAAM,EAAU,EAAI,MAAM,KAAK,CAAG,EAElC,GAAI,CACF,IAAM,EAAS,MAAM,EAAQ,CAAG,EAChC,GAAI,aAAkB,SACpB,OAAO,EACF,KACL,IAAM,EAAS,CAAC,EAuBhB,OArBA,EAAO,KAAK,CACV,QAAS,EACX,CAAC,EAmBM,MAAM,EAAO,CAClB,UAlBgB,MAAO,IAA2B,CAClD,GAAI,CAAC,EACH,OAAO,EAAa,CAAC,CAAC,EAExB,QAAW,MAAQ,EAAc,CAC/B,IAAM,GAAa,EAAS,aAAa,UACzC,QAAW,KAAW,IAAY,KAAO,CAAC,EAAG,CAC3C,IAAM,GAAM,IAAI,KAAK,GAAG,QAAQ,IAAI,mBAAmB,GAAS,EAChE,EAAO,KAAK,CACV,GAAI,EACJ,QAAS,MAAM,GAAI,KAAK,CAC1B,CAAC,GAGL,OAAO,EAAa,CAAM,GAK1B,cACA,wBACA,WACA,gBACA,cACA,QACA,cACA,WACF,CAAC,GAEH,MAAO,EAAK,CACZ,OAAO,EAAuB,EAAK,EAAU,EAAI,WAAW,GAOhE,IAAM,IAAsB,QAAQ,IAAI,kBAAoB,QAAQ,YAAY,IAAM,MAIhF,GAAiB,EAAgB,QAAQ,IAAI,gBAAgB,EAE7D,EAAS,IAAI,MAAM,CACvB,mBAAoB,YACpB,MAAO,MAAO,EAAK,IAAW,CAG5B,EAAoB,EAAI,QAAS,EAAO,UAAU,CAAG,GAAG,SAAW,KAAM,EAAc,EAGvF,IAAM,EAAM,MAAM,EAAgB,EAAK,CAAC,IACtC,EAAI,qBAAqB,EAAK,GAAgB,CAAC,IAC7C,EAAuB,EAAK,IAAI,IAAI,EAAI,GAAG,EAAE,SAAU,EAAI,WAAW,CACxE,CACF,EAKA,OAAO,GAAqB,EAAiB,EAAK,CAAG,EAAI,GAE3D,YAAa,OAAO,QAAQ,IAAI,qBAAuB,EAAE,EACzD,KAAM,QAAQ,IAAI,MAAQ,IAC5B,CAAC,EAID,OAFA,EAAmB,CAAE,KAAM,EAAO,KAAM,SAAQ,CAAC,EAE1C",
-  "debugId": "3420B1E0F85ED7CA64756E2164756E21",
+  "mappings": ";uzBAAA,SAAS,OAAM,IAAS,QCkBxB,WAAS,UACT,cAAS,oBAAW,WAAsB,QAW1C,FAAM,HAAuC,LAAC,DAAM,AAAM,JAQpD,HAAyB,DAYzB,HAAiB,EACjB,GAAqB,GAGrB,GAAa,EAEnB,SAAS,EAAW,CAAC,EAAiC,CACpD,GAAI,IAAQ,OACV,MAAO,GAKT,GAAI,CAAC,oBAAoB,KAAK,EAAI,KAAK,CAAC,EACtC,MAAO,GAET,IAAM,EAAQ,OAAO,EAAI,KAAK,CAAC,EAC/B,OAAO,OAAO,SAAS,CAAK,EAAI,KAAK,IAAI,EAAO,CAAC,EAAI,EAahD,SAAS,EAAmB,CAAC,EAA+D,CACjG,GAAI,IAAW,MAAQ,IAAW,OAChC,OAAO,KAGT,IAAM,EAAW,IAAI,IACrB,QAAW,KAAQ,EAAO,MAAM,GAAG,EAAG,CACpC,IAAO,KAAc,GAAU,EAAK,MAAM,GAAG,EACvC,EAAS,EAAU,KAAK,EAAE,YAAY,EAC5C,GAAI,IAAW,GACb,SAGF,IAAI,EAAI,EACR,QAAW,KAAS,EAAQ,CAC1B,IAAM,EAAY,EAAM,QAAQ,GAAG,EACnC,GAAI,IAAc,GAChB,SAEF,GAAI,EAAM,MAAM,EAAG,CAAS,EAAE,KAAK,EAAE,YAAY,IAAM,IAAK,CAC1D,EAAI,GAAY,EAAM,MAAM,EAAY,CAAC,CAAC,EAC1C,OAIJ,EAAS,IAAI,EAAQ,CAAC,EAGxB,OAAO,EAUF,SAAS,CAAiB,CAC/B,EACA,EAA+B,GACP,CACxB,IAAM,EAAW,GAAoB,CAAM,EAC3C,GAAI,CAAC,EACH,OAAO,KAGT,IAAM,EAAW,EAAS,IAAI,GAAG,EAC7B,EAA+B,KAC/B,EAAQ,EAEZ,QAAW,KAAU,EAAW,CAC9B,IAAM,EAAI,EAAS,IAAI,CAAM,GAAK,GAAY,EAC9C,GAAI,EAAI,EACN,EAAO,EACP,EAAQ,EAIZ,OAAO,EAGT,SAAS,EAAY,CAAC,EAA4B,EAA4B,CAC5E,GAAI,CAAC,EACH,MAAO,GAIT,OAAO,EACJ,MAAM,GAAG,EACT,KAAK,CAAC,IAAU,EAAM,KAAK,EAAE,YAAY,EAAE,MAAM,GAAG,EAAE,GAAG,KAAK,IAAM,CAAS,EAY3E,SAAS,EAAc,CAAC,EAAgB,EAAwB,CAGrE,GAAI,IAAW,OACb,MAAO,GAKT,GAAI,EAAI,OAAS,KAAO,EAAI,SAAW,KAAO,EAAI,SAAW,KAAO,EAAI,SAAW,IACjF,MAAO,GAGT,GAAI,EAAI,QAAQ,IAAI,eAAe,EACjC,MAAO,GAGT,IAAM,EAAc,EAAI,QAAQ,IAAI,cAAc,EAClD,GAAI,CAAC,GAAe,CAAC,0BAA0B,KAAK,CAAW,EAC7D,MAAO,GAOT,GAAI,CAAC,EAAI,KACP,MAAO,GAKT,IAAM,EAAkB,EAAI,QAAQ,IAAI,kBAAkB,EAC1D,GAAI,GAAmB,EAAgB,KAAK,EAAE,YAAY,IAAM,WAC9D,MAAO,GAKT,GAAI,GAAa,EAAI,QAAQ,IAAI,eAAe,EAAG,cAAc,EAC/D,MAAO,GAGT,IAAM,EAAgB,EAAI,QAAQ,IAAI,gBAAgB,EACtD,GAAI,IAAkB,MAAQ,OAAO,CAAa,EAAI,GACpD,MAAO,GAGT,MAAO,GAWF,SAAS,EAAmB,CAAC,EAA2B,CAC7D,IAAM,EACJ,IAAa,KACT,GAAqB,CACnB,OAAQ,EACL,EAAU,sBAAuB,IACjC,EAAU,oBAAqB,EAClC,EACA,MAAO,EAAU,sBACnB,CAAC,EACD,GAAW,CAAE,MAAO,GAAY,MAAO,EAAU,YAAa,CAAC,EAErE,OAAO,GAAO,MAAM,CAAU,EAGhC,SAAS,EAAsB,CAAC,EAAkB,CAChD,IAAM,EAAO,EAAQ,IAAI,MAAM,EAC/B,GAAI,CAAC,EAAM,CACT,EAAQ,IAAI,OAAQ,iBAAiB,EACrC,OAEF,IAAM,EAAS,EAAK,MAAM,GAAG,EAAE,IAAI,CAAC,IAAU,EAAM,KAAK,EAAE,YAAY,CAAC,EAGxE,GAAI,EAAO,SAAS,GAAG,GAAK,EAAO,SAAS,iBAAiB,EAC3D,OAEF,EAAQ,OAAO,OAAQ,iBAAiB,EAanC,SAAS,CAAgB,CAAC,EAAc,EAAyB,CACtE,GAAI,CAAC,GAAe,EAAI,OAAQ,CAAG,EACjC,OAAO,EAGT,IAAM,EAAU,IAAI,QAAQ,EAAI,OAAO,EACvC,GAAuB,CAAO,EAE9B,IAAM,EAAW,EAAkB,EAAI,QAAQ,IAAI,iBAAiB,CAAC,EACrE,GAAI,CAAC,EACH,OAAO,IAAI,SAAS,EAAI,KAAM,CAC5B,OAAQ,EAAI,OACZ,WAAY,EAAI,WAChB,SACF,CAAC,EAGH,IAAI,EACJ,GAAI,CACF,EAAU,GAAoB,CAAQ,EACtC,KAAM,CAGN,OAAO,IAAI,SAAS,EAAI,KAAM,CAC5B,OAAQ,EAAI,OACZ,WAAY,EAAI,WAChB,SACF,CAAC,EAQH,OALA,EAAQ,IAAI,mBAAoB,CAAQ,EAGxC,EAAQ,OAAO,gBAAgB,EAExB,IAAI,SAAS,EAAI,KAAM,YAAY,CAAO,EAAG,CAClD,OAAQ,EAAI,OACZ,WAAY,EAAI,WAChB,SACF,CAAC,EC5SH,kBAAS,WAAS,oBAClB,eAAS,cCDT,gBAAS,eAAO,WAAU,gBAAM,qBAEhC,kBAAS,WAAS,cAClB,oBAAS,aACT,yBAAS,gBAAgB,WAAW,cAwB7B,IAAM,GAAuB,2BAoB7B,IAAM,EAAqD,CAChE,GAAI,MACJ,KAAM,KACR,EAGM,GAA+B,CAAC,KAAM,MAAM,EAkB5C,GAAS,EAAU,EAAc,EACjC,GAAY,EAAU,EAAI,EA6IhC,eAAsB,CAAsB,CAC1C,EACoC,CACpC,IAAI,EACJ,GAAI,CACF,EAAM,MAAM,GAAS,GAAK,EAAW,EAAoB,EAAG,MAAM,EAClE,KAAM,CACN,OAAO,KAET,IAAI,EACJ,GAAI,CACF,EAAQ,KAAK,MAAM,CAAG,GAAG,MACzB,KAAM,CACN,OAAO,KAET,GAAI,CAAC,GAAS,OAAO,IAAU,SAC7B,OAAO,KAET,IAAM,EAA6B,CAAE,MAAO,CAAC,CAAE,EAC/C,QAAY,EAAM,KAAc,OAAO,QAAQ,CAAK,EAAG,CACrD,GAAI,CAAC,MAAM,QAAQ,CAAS,EAAG,SAC/B,EAAO,MAAM,GAAQ,GAAU,OAAO,CAAC,IAAa,EAAU,SAAS,CAAQ,CAAC,EAElF,OAAO,EC7OF,SAAS,CAAY,CAAC,EAA8B,CAEzD,IAAM,EAAkB,EAAa,SAAS,EAExC,EAAS,IAAI,IAAI,aAAa,MAAM,EAI1C,OAHA,EAAO,OAAO,CAAe,EAChB,EAAO,OAAO,KAAK,EFmBlC,eAAsB,CAAe,CAAC,EAAyC,CAC7E,IAAM,EAAQ,IAAI,IAElB,eAAe,CAAI,CAAC,EAAa,EAAmB,CAClD,IAAI,EACJ,GAAI,CACF,EAAU,MAAM,GAAQ,EAAK,CAAE,cAAe,EAAK,CAAC,EACpD,KAAM,CACN,OAEF,QAAW,KAAS,EAAS,CAC3B,GAAI,EAAM,KAAK,WAAW,GAAG,EAAG,SAChC,GAAI,GAAY,EAAM,OAAS,SAAU,SACzC,IAAM,EAAO,GAAK,EAAK,EAAM,IAAI,EAC7B,EAAQ,EAAM,YAAY,EAC1B,EAAS,EAAM,OAAO,EAC1B,GAAI,EAAM,eAAe,EACvB,GAAI,CACF,IAAM,EAAS,MAAM,EAAK,CAAI,EAC9B,EAAQ,EAAO,YAAY,EAC3B,EAAS,EAAO,OAAO,EACvB,KAAM,CACN,SAGJ,GAAI,EAAQ,EAAM,IAAI,CAAI,EAGrB,QAAI,GAAS,CAAC,EAAM,eAAe,EAAG,MAAM,EAAK,EAAM,EAAK,GAKrE,OADA,MAAM,EAAK,EAAW,EAAI,EACnB,EAGT,IAAM,GAAa,4CAOb,GAAY,sCAgBlB,eAAe,EAAc,CAC3B,EACA,EACA,EAC2E,CAG3E,GAAI,EAAU,SAAW,GAAK,EAAI,QAAQ,IAAI,OAAO,EACnD,OAAO,KAET,IAAM,EAAW,EAAkB,EAAI,QAAQ,IAAI,iBAAiB,EAAG,CAAS,EAChF,GAAI,CAAC,EACH,OAAO,KAET,IAAM,EAAc,EAAO,EAAkB,GAC7C,GAAI,CAGF,IAAM,EAAO,MAAM,EAAK,CAAW,EACnC,OAAO,EAAK,OAAO,EAAI,CAAE,WAAU,KAAM,EAAa,KAAM,EAAK,IAAK,EAAI,KAC1E,KAAM,CACN,OAAO,MAsBX,eAAsB,CAAkB,CACtC,EACA,EACA,EAA6B,CAAC,EACX,CACnB,IAAM,EAAO,IAAI,KAAK,CAAI,EACpB,EAAY,EAAQ,WAAa,CAAC,EAElC,EAAkC,CACtC,eAAgB,EAAK,MAAQ,2BAC7B,gBAAiB,EAAQ,UAAY,GAAY,GACjD,gBAAiB,OACnB,EACA,GAAI,EAAU,OAAS,EACrB,EAAQ,KAAO,kBAGjB,IAAM,EAAU,MAAM,GAAe,EAAK,EAAM,CAAS,EACzD,GAAI,EAAS,CACX,IAAM,EAAU,IAAI,KAAK,EAAQ,IAAI,EACrC,OAAO,IAAI,SAAS,EAAQ,OAAO,EAAG,CACpC,QAAS,IACJ,EACH,mBAAoB,EAAQ,SAC5B,iBAAkB,OAAO,EAAQ,IAAI,EAErC,KAAM,GAAG,EAAa,EAAQ,YAAY,KAAK,EAAQ,UACzD,CACF,CAAC,EAGH,IAAM,EAAQ,EAAK,KACnB,EAAQ,KAAO,EAAa,EAAK,YAAY,EAE7C,IAAM,EAAQ,EAAiB,EAAI,QAAQ,IAAI,OAAO,CAAC,EAEvD,GAAI,EAAO,CACT,IAAM,EAAW,EAAa,EAAO,CAAK,EAC1C,GAAI,CAAC,EACH,OAAO,EAA4B,CAAK,EAE1C,OAAO,IAAI,SAAS,EAAK,MAAM,EAAS,MAAO,EAAS,IAAM,CAAC,EAAE,OAAO,EAAG,CACzE,OAAQ,IACR,QAAS,IACJ,EACH,gBAAiB,EAAmB,EAAS,MAAO,EAAS,IAAK,CAAK,EACvE,iBAAkB,OAAO,EAAS,MAAM,CAC1C,CACF,CAAC,EAGH,OAAO,IAAI,SAAS,EAAK,OAAO,EAAG,CACjC,QAAS,IAAK,EAAS,iBAAkB,OAAO,CAAK,CAAE,CACzD,CAAC,EFjLH,eAAS,qBKSF,IAAM,EAAmB,iBAgBzB,SAAS,CAAiB,CAC/B,EACA,EAAoB,EAC+B,CACnD,IAAM,EAAO,EAAS,IAAmB,KACzC,GAAI,CAAC,EACH,OAEF,MAAO,CACL,OAAQ,EAAS,EAAM,CAAS,EAChC,QAAS,EAAsB,EAAU,EAAkB,CAAS,CACtE,EAgBK,SAAS,CAAqB,CACnC,EACA,EACA,EAAoB,EACV,CACV,IAAM,EAAiB,CAAC,EAGlB,EAAU,IAAI,IAEd,EAAO,CAAC,IAAgB,CAC5B,GAAI,EAAQ,IAAI,CAAG,EAAG,OACtB,EAAQ,IAAI,CAAG,EACf,IAAM,EAAQ,EAAS,GACvB,GAAI,CAAC,GAAO,KAAM,OAClB,EAAK,KAAK,EAAS,EAAM,KAAM,CAAS,CAAC,EACzC,QAAW,KAAY,EAAM,SAAW,CAAC,EACvC,EAAK,CAAQ,GAMjB,OAFA,EAAK,CAAQ,EAEN,EC8HF,SAAS,CAAqB,CACnC,EACA,EA3L8C,MA4LtC,CACR,IAAM,EAAM,KAAK,UAhMgB,mBAgMa,EACxC,EAAQ,KAAK,UAAU,gDAAgD,GAAU,EACvF,MACE,mEAAmE,+EAE5B,iBAC1B,kIACyC,eC3M1D,IAAM,GAAc,IAAI,OAAO,IAAI,cAAkC,EAE9D,SAAS,EAAgB,CAAC,EAA2B,CAC1D,OAAO,GAAY,KAAK,CAAQ,EA2C3B,SAAS,CAAe,CAAC,EAAwC,CACtE,GAAI,GAAiB,CAAQ,EAC3B,OAAO,IAAI,SAAS,EAAsB,CAAQ,EAAG,CACnD,QAAS,CACP,eAAgB,yBAChB,gBAAiB,UACnB,CACF,CAAC,EAKH,GAAI,EAAoB,CAAQ,EAC9B,OAAO,IAAI,SAAS,YAAa,CAAE,OAAQ,GAAI,CAAC,EAOlD,OCpEF,IAAM,GAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAqBlB,SAAS,CAAsB,CACpC,EACA,EACA,EACU,CAUV,GAAI,CAAC,EACH,QAAQ,MAAM,CAAG,EAEjB,QAAI,CAGF,EAAY,aAAe,MAAQ,EAAU,MAAM,OAAO,CAAG,EAAG,CAAE,MAAO,CAAI,CAAC,CAAC,EAC/E,MAAO,EAAa,CAEpB,QAAQ,MAAM,CAAG,EACjB,QAAQ,MAAM,CAAW,EAI7B,GAAI,EAAU,CAAQ,EACpB,OAAO,IAAI,SACT,KAAK,UAAU,CAAE,MAAO,GAAiB,eAAgB,wBAAyB,GAAG,CAAE,CAAC,EACxF,CACE,OAAQ,IACR,QAAS,CAAE,eAAgB,kBAAmB,CAChD,CACF,EAGF,OAAO,IAAI,SAAS,GAAkB,CACpC,OAAQ,IACR,QAAS,CAAE,eAAgB,0BAA2B,CACxD,CAAC,EC/CH,IAAM,GAAuB,CAAE,KAAM,MAAO,EAQrC,SAAS,EAAe,CAAC,EAA2C,CACzE,IAAM,GAAO,GAAS,IAAI,KAAK,EAAE,YAAY,EAC7C,GAAI,IAAQ,IAAM,IAAQ,SAAW,IAAQ,OAAS,IAAQ,IAC5D,OAAO,GAET,GAAI,IAAQ,OACV,MAAO,CAAE,KAAM,KAAM,EAEvB,GAAI,aAAa,KAAK,CAAG,EACvB,MAAO,CAAE,KAAM,OAAQ,KAAM,OAAO,CAAG,CAAE,EAE3C,MAAU,MACR,uGAAuG,KAAK,UAAU,CAAK,IAC7H,EAQK,SAAS,EAAmB,CACjC,EACA,EACA,EACM,CACN,GAAI,EAAM,OAAS,MAAO,CACxB,GAAI,CAAC,EAAQ,IAAI,iBAAiB,GAAK,EACrC,EAAQ,IAAI,kBAAmB,CAAI,EAErC,OAKF,EAAQ,OAAO,WAAW,EAE1B,IAAI,EAAwB,EAC5B,GAAI,EAAM,OAAS,OAAQ,CACzB,IAAM,GAAW,EAAQ,IAAI,iBAAiB,GAAK,IAChD,MAAM,GAAG,EACT,IAAI,CAAC,IAAU,EAAM,KAAK,CAAC,EAC3B,OAAO,OAAO,EAKX,EAAQ,EAAQ,OAAS,EAAM,KACrC,EAAS,GAAS,EAAI,EAAQ,GAAW,EAAQ,IAAM,EAGzD,GAAI,EACF,EAAQ,IAAI,kBAAmB,CAAM,EAErC,OAAQ,OAAO,iBAAiB,ETjEpC,IAAM,EAAU,GAAY,EAEtB,GAAS,EAAK,EAAS,KAAK,EAC5B,EAAU,EAAK,EAAS,MAAM,EAE9B,EAAY,EAAK,EAAS,QAAQ,EAQxC,SAAS,EAAc,CAAC,EAAiC,CACvD,IAAI,EACJ,GAAI,CACF,EAAU,mBAAmB,CAAQ,EACrC,KAAM,CACN,OAAO,KAET,IAAM,EAAO,GAAQ,EAAW,IAAM,EAAQ,QAAQ,iBAAkB,SAAS,CAAC,EAClF,OAAO,EAAK,WAAW,EAAY,EAAG,EAAI,EAAO,KAGnD,eAAe,EAAM,CAAC,EAAc,CAClC,GAAI,CACF,OAAQ,MAAM,GAAK,CAAI,GAAG,OAAO,EACjC,KAAM,CACN,MAAO,IAQX,eAAsB,EAAQ,CAAC,EAAU,EAAkC,CACzE,IAAM,EAAW,MAAa,UAAG,gCAC3B,EAAiB,MAAa,UAAG,gCAIjC,EAAY,MAAM,GAAmB,GAAG,UAAgB,EAE9D,QAAQ,IAAI,SAAW,EACvB,QAAQ,IAAI,QAAU,GACtB,QAAQ,IAAI,SAAW,EAEvB,IAAM,EAAgB,CAAC,EACjB,EAAQ,CAAC,EACT,EAAc,CAAC,EACf,EAAc,CAAC,EAGf,EAAkD,CAAC,EACnD,EAAW,CAAC,EAAkB,IAAiB,IAAI,qBAA4B,MAC/E,EAAY,CAAC,EAEnB,QAAW,IAAY,CAAC,MAAO,GAAG,EAAI,qBAAqB,KAAK,CAAG,CAAC,EAAG,CACrE,IAAM,EAAa,EAAe,aAAa,SAC/C,GAAI,CAAC,GAAY,KAAM,CACrB,QAAQ,IAAI,6BAA6B,GAAU,EACnD,QAAQ,IAAI,CAAU,EACtB,IAAM,EAAQ,OAAO,KAAK,CAAc,EAClC,EAAO,aAAa,QAC1B,QAAQ,IAAI,GAAG,gCAAmC,EAClD,QAAQ,IAAI,CAAK,EAEnB,IAAM,EAAM,MAAa,UAAG,QAAQ,IAAI,mBAAmB,GAAY,QACvE,EAAc,GAAY,EAAI,QAC9B,EAAM,GAAY,EAAI,UAGtB,EAAY,GAAY,EACxB,IAAM,EAAa,EAAS,aAAa,SAEzC,GAAI,GAAY,KAAO,GAAY,IAAI,OAAS,EAC9C,EAAY,GAAY,GAAY,IAEtC,GAAI,EACF,EAAU,KAAK,EAAS,EAAU,EAAS,GAAY,KAAM,CAAS,CAAC,CAAC,EACxE,EAAsB,GAAY,EAChC,EACA,aAAa,QACb,CACF,EAIJ,IAAM,GAAU,IAAI,EAAU,KAAK,GAAG,KAKhC,EAAc,EAAkB,EAAU,CAAS,EACzD,GAAI,CAAC,EAGH,QAAQ,MACN,2BAA2B,wFAC7B,EAMF,IAAM,GAAwB,EAAS,mBAAmB,KAAO,CAAC,EAC5D,IACJ,MAAM,QAAQ,IAAI,GAAY,IAAI,CAAC,IAAY,IAAI,KAAK,GAAG,YAAkB,GAAS,EAAE,KAAK,CAAC,CAAC,GAC/F,KAAK;AAAA,CAAI,EAmBL,GAAc,MAAM,EAAgB,CAAS,EAO7C,EAAe,IAAI,IACzB,QAAY,EAAM,KAAc,OAAO,SACpC,MAAM,EAAuB,CAAS,IAAI,OAAS,CAAC,CACvD,EAAG,CACD,IAAM,EAAO,GAAQ,EAAW,CAAI,EACpC,GAAI,EAAK,WAAW,EAAY,EAAG,EACjC,EAAa,IAAI,EAAM,CAAE,UAAW,GAAM,WAAU,CAAC,EAIzD,eAAe,EAAc,CAAC,EAAc,CAC1C,IAAQ,YAAa,IAAI,IAAI,EAAI,GAAG,EAEpC,GAAI,EAAU,CAAQ,EACpB,OAAO,MAAM,EAAc,EAAK,CAAQ,EAG1C,IAAM,EAAW,GAAe,CAAQ,EAMxC,GAJE,EAAoB,CAAQ,GAC5B,EAAS,WAAW,cAAc,GACjC,IAAa,MAAQ,GAAY,IAAI,CAAQ,EAE7B,CAUjB,GAAI,CAAC,GAAY,CAAE,MAAM,GAAO,CAAQ,EACtC,OAAO,EAAgB,CAAQ,GAAM,MAAM,EAAc,EAAK,CAAQ,EAGxE,GAAI,CACF,OAAO,MAAM,EAAmB,EAAK,EAAU,EAAa,IAAI,CAAQ,CAAC,EACzE,MAAO,EAAO,CAEd,OADA,EAAI,cAAc,CAAK,EAChB,IAAI,SAAS,YAAa,CAAE,OAAQ,GAAI,CAAC,GAIpD,OAAO,MAAM,EAAc,EAAK,CAAQ,EAG1C,eAAe,CAAa,CAAC,EAAc,EAAkB,CAC3D,IAAM,EAAU,EAAI,MAAM,KAAK,CAAG,EAElC,GAAI,CACF,IAAM,EAAS,MAAM,EAAQ,CAAG,EAChC,GAAI,aAAkB,SACpB,OAAO,EACF,KACL,IAAM,EAAS,CAAC,EAuBhB,OArBA,EAAO,KAAK,CACV,QAAS,EACX,CAAC,EAmBM,MAAM,EAAO,CAClB,UAlBgB,MAAO,IAA2B,CAClD,GAAI,CAAC,EACH,OAAO,EAAa,CAAC,CAAC,EAExB,QAAW,MAAQ,EAAc,CAC/B,IAAM,GAAa,EAAS,aAAa,UACzC,QAAW,KAAW,IAAY,KAAO,CAAC,EAAG,CAC3C,IAAM,GAAM,IAAI,KAAK,GAAG,QAAQ,IAAI,mBAAmB,GAAS,EAChE,EAAO,KAAK,CACV,GAAI,EACJ,QAAS,MAAM,GAAI,KAAK,CAC1B,CAAC,GAGL,OAAO,EAAa,CAAM,GAK1B,cACA,wBACA,WACA,gBACA,cACA,QACA,cACA,WACF,CAAC,GAEH,MAAO,EAAK,CACZ,OAAO,EAAuB,EAAK,EAAU,EAAI,WAAW,GAOhE,IAAM,IAAsB,QAAQ,IAAI,kBAAoB,QAAQ,YAAY,IAAM,MAIhF,GAAiB,GAAgB,QAAQ,IAAI,gBAAgB,EAE7D,EAAS,IAAI,MAAM,CACvB,mBAAoB,YACpB,MAAO,MAAO,EAAK,IAAW,CAG5B,GAAoB,EAAI,QAAS,EAAO,UAAU,CAAG,GAAG,SAAW,KAAM,EAAc,EAGvF,IAAM,EAAM,MAAM,EAAgB,EAAK,CAAC,IACtC,EAAI,qBAAqB,EAAK,GAAgB,CAAC,IAC7C,EAAuB,EAAK,IAAI,IAAI,EAAI,GAAG,EAAE,SAAU,EAAI,WAAW,CACxE,CACF,EAKA,OAAO,GAAqB,EAAiB,EAAK,CAAG,EAAI,GAE3D,YAAa,OAAO,QAAQ,IAAI,qBAAuB,EAAE,EACzD,KAAM,QAAQ,IAAI,MAAQ,IAC5B,CAAC,EAID,OAFA,GAAmB,CAAE,KAAM,EAAO,KAAM,SAAQ,CAAC,EAE1C",
+  "debugId": "AD25CA6C252B7AF164756E2164756E21",
   "names": []
 }

package/dist/{chunk-r5pnz4nn.js → chunk-h3t4n0bn.js}

@@ -1,5 +1,5 @@
 // @bun
-import{H as F}from"./chunk-cw7qfcvt.js";import{$ as w}from"./chunk-ee92kx8s.js";import{$g as h}from"./chunk-1xzdexbq.js";var P=h((p)=>{var t=w(),l=F();function d(e){try{let o=new Set(Array.from(e.match(/([A-Z_]){3,}/g)??[]));return o.delete("CONFIG"),o.delete("CONFIG_PREFIX_SEPARATOR"),o.delete("ENV"),[...o].join(", ")}catch(o){return e}}var u=(e,o)=>async()=>{try{let r=e(process.env,o);if(r===void 0)throw Error();return r}catch(r){throw new t.CredentialsProviderError(r.message||`Not found in ENV: ${d(e.toString())}`,{logger:o?.logger})}},C=(e,{preferredFile:o="config",...r}={})=>async()=>{let n=l.getProfileName(r),{configFile:i,credentialsFile:c}=await l.loadSharedConfigFiles(r),s=c[n]||{},g=i[n]||{},m=o==="config"?{...s,...g}:{...g,...s};try{let f=e(m,o==="config"?i:c);if(f===void 0)throw Error();return f}catch(a){throw new t.CredentialsProviderError(a.message||`Not found in config files w/ profile [${n}]: ${d(e.toString())}`,{logger:r.logger})}},y=(e)=>typeof e==="function",E=(e)=>y(e)?async()=>await e():t.fromStatic(e),N=({environmentVariableSelector:e,configFileSelector:o,default:r},n={})=>{let{signingName:i,logger:c}=n,s={signingName:i,logger:c};return t.memoize(t.chain(u(e,s),C(o,n),E(r)))};p.loadConfig=N});
+import{H as F}from"./chunk-kh273hj0.js";import{$ as w}from"./chunk-8pynv9rw.js";import{rh as h}from"./chunk-3s3awh38.js";var P=h((p)=>{var t=w(),l=F();function d(e){try{let o=new Set(Array.from(e.match(/([A-Z_]){3,}/g)??[]));return o.delete("CONFIG"),o.delete("CONFIG_PREFIX_SEPARATOR"),o.delete("ENV"),[...o].join(", ")}catch(o){return e}}var u=(e,o)=>async()=>{try{let r=e(process.env,o);if(r===void 0)throw Error();return r}catch(r){throw new t.CredentialsProviderError(r.message||`Not found in ENV: ${d(e.toString())}`,{logger:o?.logger})}},C=(e,{preferredFile:o="config",...r}={})=>async()=>{let n=l.getProfileName(r),{configFile:i,credentialsFile:c}=await l.loadSharedConfigFiles(r),s=c[n]||{},g=i[n]||{},m=o==="config"?{...s,...g}:{...g,...s};try{let f=e(m,o==="config"?i:c);if(f===void 0)throw Error();return f}catch(a){throw new t.CredentialsProviderError(a.message||`Not found in config files w/ profile [${n}]: ${d(e.toString())}`,{logger:r.logger})}},y=(e)=>typeof e==="function",E=(e)=>y(e)?async()=>await e():t.fromStatic(e),N=({environmentVariableSelector:e,configFileSelector:o,default:r},n={})=>{let{signingName:i,logger:c}=n,s={signingName:i,logger:c};return t.memoize(t.chain(u(e,s),C(o,n),E(r)))};p.loadConfig=N});
 export{P as G};
 
-//# debugId=3849F9E0AB5F24A964756E2164756E21
+//# debugId=0BD32C8FA16297E864756E2164756E21

package/dist/{chunk-r5pnz4nn.js.map → chunk-h3t4n0bn.js.map}

@@ -5,6 +5,6 @@
     "'use strict';\n\nvar propertyProvider = require('@smithy/property-provider');\nvar sharedIniFileLoader = require('@smithy/shared-ini-file-loader');\n\nfunction getSelectorName(functionString) {\n    try {\n        const constants = new Set(Array.from(functionString.match(/([A-Z_]){3,}/g) ?? []));\n        constants.delete(\"CONFIG\");\n        constants.delete(\"CONFIG_PREFIX_SEPARATOR\");\n        constants.delete(\"ENV\");\n        return [...constants].join(\", \");\n    }\n    catch (e) {\n        return functionString;\n    }\n}\n\nconst fromEnv = (envVarSelector, options) => async () => {\n    try {\n        const config = envVarSelector(process.env, options);\n        if (config === undefined) {\n            throw new Error();\n        }\n        return config;\n    }\n    catch (e) {\n        throw new propertyProvider.CredentialsProviderError(e.message || `Not found in ENV: ${getSelectorName(envVarSelector.toString())}`, { logger: options?.logger });\n    }\n};\n\nconst fromSharedConfigFiles = (configSelector, { preferredFile = \"config\", ...init } = {}) => async () => {\n    const profile = sharedIniFileLoader.getProfileName(init);\n    const { configFile, credentialsFile } = await sharedIniFileLoader.loadSharedConfigFiles(init);\n    const profileFromCredentials = credentialsFile[profile] || {};\n    const profileFromConfig = configFile[profile] || {};\n    const mergedProfile = preferredFile === \"config\"\n        ? { ...profileFromCredentials, ...profileFromConfig }\n        : { ...profileFromConfig, ...profileFromCredentials };\n    try {\n        const cfgFile = preferredFile === \"config\" ? configFile : credentialsFile;\n        const configValue = configSelector(mergedProfile, cfgFile);\n        if (configValue === undefined) {\n            throw new Error();\n        }\n        return configValue;\n    }\n    catch (e) {\n        throw new propertyProvider.CredentialsProviderError(e.message || `Not found in config files w/ profile [${profile}]: ${getSelectorName(configSelector.toString())}`, { logger: init.logger });\n    }\n};\n\nconst isFunction = (func) => typeof func === \"function\";\nconst fromStatic = (defaultValue) => isFunction(defaultValue) ? async () => await defaultValue() : propertyProvider.fromStatic(defaultValue);\n\nconst loadConfig = ({ environmentVariableSelector, configFileSelector, default: defaultValue }, configuration = {}) => {\n    const { signingName, logger } = configuration;\n    const envOptions = { signingName, logger };\n    return propertyProvider.memoize(propertyProvider.chain(fromEnv(environmentVariableSelector, envOptions), fromSharedConfigFiles(configFileSelector, configuration), fromStatic(defaultValue)));\n};\n\nexports.loadConfig = loadConfig;\n"
   ],
   "mappings": ";mJAEA,FAAI,AACA,MAEJ,SAAS,CAAe,CAAC,EAAgB,CACrC,GAAI,CACA,IAAM,EAAY,IAAI,IAAI,MAAM,KAAK,EAAe,MAAM,eAAe,GAAK,CAAC,CAAC,CAAC,EAIjF,OAHA,EAAU,OAAO,QAAQ,EACzB,EAAU,OAAO,yBAAyB,EAC1C,EAAU,OAAO,KAAK,EACf,CAAC,GAAG,CAAS,EAAE,KAAK,IAAI,EAEnC,MAAO,EAAG,CACN,OAAO,GAIf,IAAM,EAAU,CAAC,EAAgB,IAAY,SAAY,CACrD,GAAI,CACA,IAAM,EAAS,EAAe,QAAQ,IAAK,CAAO,EAClD,GAAI,IAAW,OACX,MAAU,MAAM,EAEpB,OAAO,EAEX,MAAO,EAAG,CACN,MAAM,IAAI,EAAiB,yBAAyB,EAAE,SAAW,qBAAqB,EAAgB,EAAe,SAAS,CAAC,IAAK,CAAE,OAAQ,GAAS,MAAO,CAAC,IAIjK,EAAwB,CAAC,GAAkB,gBAAgB,YAAa,GAAS,CAAC,IAAM,SAAY,CACtG,IAAM,EAAU,EAAoB,eAAe,CAAI,GAC/C,aAAY,mBAAoB,MAAM,EAAoB,sBAAsB,CAAI,EACtF,EAAyB,EAAgB,IAAY,CAAC,EACtD,EAAoB,EAAW,IAAY,CAAC,EAC5C,EAAgB,IAAkB,SAClC,IAAK,KAA2B,CAAkB,EAClD,IAAK,KAAsB,CAAuB,EACxD,GAAI,CAEA,IAAM,EAAc,EAAe,EADnB,IAAkB,SAAW,EAAa,CACD,EACzD,GAAI,IAAgB,OAChB,MAAU,MAAM,EAEpB,OAAO,EAEX,MAAO,EAAG,CACN,MAAM,IAAI,EAAiB,yBAAyB,EAAE,SAAW,yCAAyC,OAAa,EAAgB,EAAe,SAAS,CAAC,IAAK,CAAE,OAAQ,EAAK,MAAO,CAAC,IAI9L,EAAa,CAAC,IAAS,OAAO,IAAS,WACvC,EAAa,CAAC,IAAiB,EAAW,CAAY,EAAI,SAAY,MAAM,EAAa,EAAI,EAAiB,WAAW,CAAY,EAErI,EAAa,EAAG,8BAA6B,qBAAoB,QAAS,GAAgB,EAAgB,CAAC,IAAM,CACnH,IAAQ,cAAa,UAAW,EAC1B,EAAa,CAAE,cAAa,QAAO,EACzC,OAAO,EAAiB,QAAQ,EAAiB,MAAM,EAAQ,EAA6B,CAAU,EAAG,EAAsB,EAAoB,CAAa,EAAG,EAAW,CAAY,CAAC,CAAC,GAGxL,aAAa",
-  "debugId": "3849F9E0AB5F24A964756E2164756E21",
+  "debugId": "0BD32C8FA16297E864756E2164756E21",
   "names": []
 }

package/dist/{chunk-zm00crsx.js → chunk-h4x7cba0.js}

@@ -1,5 +1,5 @@
 // @bun
-import{Eg as x}from"./chunk-4f7n1r02.js";function B(j){return j}function C(){return{supportedLocales:[],defaultLocale:"en-US",prefetch:{},components:{},detectLocale:()=>null,onLocaleChange:(j)=>{console.log(`Locale changed to ${j}`)},timeZone:x,detectTimeZone:()=>null}}
-export{B as dc,C as ec};
+import{Wg as x}from"./chunk-2q7m8a16.js";function B(j){return j}function C(){return{supportedLocales:[],defaultLocale:"en-US",prefetch:{},components:{},detectLocale:()=>null,onLocaleChange:(j)=>{console.log(`Locale changed to ${j}`)},timeZone:x,detectTimeZone:()=>null}}
+export{B as fc,C as gc};
 
-//# debugId=7A0FB7AD272A05D564756E2164756E21
+//# debugId=B5D490BDEEBE102764756E2164756E21

package/dist/{chunk-zm00crsx.js.map → chunk-h4x7cba0.js.map}

@@ -5,6 +5,6 @@
     "import { DEFAULT_TIME_ZONE } from \"./formatter\";\nimport type { Dictionary } from \"./Dictionary\";\nimport type { HttpRequest } from \"../http/HttpRequest\";\n\n// Config key: `translation`. Derived from `I18nServiceProvider`.\nexport interface TranslationConfig {\n  supportedLocales?: string[];\n  defaultLocale?: string;\n  /**\n   * @deprecated Only for `Dictionary.create` dictionaries. A `defineDictionary`\n   * dictionary needs no entry here — the component that reads it pulls it in,\n   * and the bundler ships only the active locale.\n   */\n  prefetch?: Record<string, Array<Dictionary<any>>>;\n  /** @deprecated Only for `Dictionary.create` dictionaries. See `prefetch`. */\n  components?: Record<string, Dictionary<any>>;\n\n  // Returning `null` falls back to gemi's own locale detection.\n  detectLocale?: (req: HttpRequest) => string | null;\n  onLocaleChange?: (locale: string) => Promise<void> | void;\n\n  /**\n   * The IANA time zone dates are formatted in by `useFormatter`,\n   * `useDictionary(...).format` and `Lang.formatter()`. Defaults to `UTC`.\n   *\n   * One zone for server and browser alike, so a server-rendered date and its\n   * hydrated copy print the same text. Override per call with\n   * `format.date(value, { timeZone })`.\n   */\n  timeZone?: string;\n  /**\n   * Resolve the zone for one request, e.g. from a cookie or the signed-in\n   * user's profile. Returning `null` (or a zone `Intl` does not know) falls back\n   * to `timeZone`. Runs on the server; the result ships with the page.\n   */\n  detectTimeZone?: (req: HttpRequest) => string | null;\n}\n\nexport function defineTranslationConfig(\n  config: TranslationConfig,\n): TranslationConfig {\n  return config;\n}\n\nexport function translationConfigDefaults(): Required<TranslationConfig> {\n  return {\n    supportedLocales: [],\n    defaultLocale: \"en-US\",\n    prefetch: {},\n    components: {},\n    detectLocale: () => null,\n    onLocaleChange: (locale) => {\n      console.log(`Locale changed to ${locale}`);\n    },\n    timeZone: DEFAULT_TIME_ZONE,\n    detectTimeZone: () => null,\n  };\n}\n"
   ],
   "mappings": ";yCAsCO,SAAS,CAAuB,CACrC,EACmB,CACnB,OAAO,EAGF,SAAS,CAAyB,EAAgC,CACvE,MAAO,CACL,iBAAkB,CAAC,EACnB,cAAe,QACf,SAAU,CAAC,EACX,WAAY,CAAC,EACb,aAAc,IAAM,KACpB,eAAgB,CAAC,IAAW,CAC1B,QAAQ,IAAI,qBAAqB,GAAQ,GAE3C,SAAU,EACV,eAAgB,IAAM,IACxB",
-  "debugId": "7A0FB7AD272A05D564756E2164756E21",
+  "debugId": "B5D490BDEEBE102764756E2164756E21",
   "names": []
 }

package/dist/{chunk-b0jpvp5t.js → chunk-h7pafjej.js}

@@ -1,5 +1,5 @@
 // @bun
-import{Ae as N,Be as S,He as K,Wd as O,Xd as Z,qe as _,ue as R,ve as W,we as F,xe as C,ye as G,ze as Y}from"./chunk-22k4b395.js";import{ah as P}from"./chunk-1xzdexbq.js";var E={};P(E,{registeredNames:()=>b,register:()=>T,has:()=>y,get:()=>A,clearRegistry:()=>x});var J=new Map;function T(q,z){J.set(q,z)}function y(q){return J.has(q)}function A(q){let z=J.get(q);if(z===void 0)throw new _(q,[...J.keys()]);return z}function b(){return[...J.keys()]}function x(){J.clear()}var w=/^\s*::\s*(?:text\s*::\s*)?(jsonb|json)\b(?!\s*\[)/i,h=/^\s*as\s+(jsonb|json)\s*\)/i,c=/\bcast\s*\(\s*$/i,f=new Set;function U(q,z){if(!z.typesParametersFromStatement)return{fragment:q,jsonParameters:f};let B=C(q),D=new Set,H;for(let X=0;X<B.length-1;X++){let $=B[X+1],Q=w.exec($);if(Q){H??=[...B],H[X+1]=`::text::${Q[1]}${$.slice(Q[0].length)}`,D.add(X);continue}let V=h.exec($);if(V&&c.test((H??B)[X]))H??=[...B],H[X+1]=` as text)::${V[1]}${$.slice(V[0].length)}`,D.add(X)}if(!H)return{fragment:q,jsonParameters:D};return{fragment:G(H,q.binders),jsonParameters:D}}function M(q,z){if(q===null||q===void 0)return null;let B=K(q);if(B==="db")return null;if(B==="json")return"null";if(B==="any")throw new Z(z,"DB",z,"Prisma.AnyNull is a filter operand \u2014 it asks for a SQL NULL *or* a JSON "+"null \u2014 so it has no single value to bind. Write the one you mean: "+"Prisma.DbNull for the column being NULL, Prisma.JsonNull for the JSON value.");if(typeof q==="string")return q;let D;try{D=JSON.stringify(q)}catch(H){throw new Z(z,"DB",z,`A parameter cast to json could not be serialised: ${H instanceof Error?H.message:String(H)}. `+"Bind text you have serialised yourself if the value is not JSON \u2014 a "+"bigint has no JSON form, and neither does a cycle.")}if(D===void 0)throw new Z(z,"DB",z,`A ${typeof q} was bound to a parameter cast to json, and has no JSON form. Bind the value it stands for.`);return D}var I=new WeakSet;function L(q){return I.add(q),q}function k(q){return typeof q==="object"&&q!==null&&I.has(q)}function t(q,...z){if(!Array.isArray(q)||!("raw"in q))throw new O("sql","DB","sql","'sql' is a tagged template \u2014 write sql`select 1`, not sql(\"select 1\"). "+"To put text that is not a value into a statement, use 'unsafeSql', and read what it says first.");let B=[];for(let D=0;D<q.length;D++)if(B.push(W(q[D])),D<z.length)B.push(j(z[D]));return L(Y(...B))}function r(q,z=", "){if(!Array.isArray(q))throw new Z("join","DB","sql",`Expected an array of fragments or values, got ${typeof q}.`);if(q.length===0)return p;let B=q.map(j);if(k(z)){let D=[];for(let H=0;H<B.length;H++){if(H>0)D.push(z);D.push(B[H])}return L(Y(...D))}return v(z),L(N(B,z))}var g=/^[\s,]*$|^\s*(?:and|or)\s*$/i;function v(q){if(typeof q==="string"&&g.test(q))return;throw new Z("join","DB","sql",typeof q==="string"?`A separator is written into the SQL text, so it may only be glue: whitespace, commas, or 'and' / 'or'. Got ${JSON.stringify(q)}. If that is deliberate, say so with `+"unsafeSql(...) \u2014 and never build one from anything that came from "+"outside the program.":`Expected a separator string or a fragment, got ${q===null?"null":typeof q}.`)}var p=L(Object.freeze({text:"",binders:Object.freeze([])}));function a(q){if(typeof q!=="string")throw new Z("unsafeSql","DB","sql",`Expected a string literal, got ${Array.isArray(q)?"an array":typeof q}. 'unsafeSql' is a plain call, not a tagged template \u2014 a template would `+"interpolate values into the SQL text, which is the one thing it must never do.");return L(W(q))}function e(q,z,B="query"){if(!k(q))throw new Z(B,"DB",B,`Expected a fragment built with 'sql', got ${q===null?"null":typeof q}. A plain string is not accepted here on purpose \u2014 it would be the one `+"path into the SQL text that nobody had to think about.");let D=U(q,z),H=S(D.fragment,z,{model:"DB",operation:B});return{text:H.text,values:R(H.binders)(void 0).map((X,$)=>D.jsonParameters.has($)?M(X,B):X===null||X===void 0?X??null:z.encodeUntyped(X))}}function j(q){if(k(q))return q;return F(()=>q)}
-export{T as Md,y as Nd,A as Od,b as Pd,E as Qd,t as Rd,r as Sd,p as Td,a as Ud,e as Vd};
+import{Ie as _,Me as R,Ne as W,Oe as F,Pe as C,Qe as G,Re as Y,Se as N,Te as S,Ze as K,me as O,ne as Z}from"./chunk-1npdp1w2.js";import{sh as P}from"./chunk-3s3awh38.js";var E={};P(E,{registeredNames:()=>b,register:()=>T,has:()=>y,get:()=>A,clearRegistry:()=>x});var J=new Map;function T(q,z){J.set(q,z)}function y(q){return J.has(q)}function A(q){let z=J.get(q);if(z===void 0)throw new _(q,[...J.keys()]);return z}function b(){return[...J.keys()]}function x(){J.clear()}var w=/^\s*::\s*(?:text\s*::\s*)?(jsonb|json)\b(?!\s*\[)/i,h=/^\s*as\s+(jsonb|json)\s*\)/i,c=/\bcast\s*\(\s*$/i,f=new Set;function U(q,z){if(!z.typesParametersFromStatement)return{fragment:q,jsonParameters:f};let B=C(q),D=new Set,H;for(let X=0;X<B.length-1;X++){let $=B[X+1],Q=w.exec($);if(Q){H??=[...B],H[X+1]=`::text::${Q[1]}${$.slice(Q[0].length)}`,D.add(X);continue}let V=h.exec($);if(V&&c.test((H??B)[X]))H??=[...B],H[X+1]=` as text)::${V[1]}${$.slice(V[0].length)}`,D.add(X)}if(!H)return{fragment:q,jsonParameters:D};return{fragment:G(H,q.binders),jsonParameters:D}}function M(q,z){if(q===null||q===void 0)return null;let B=K(q);if(B==="db")return null;if(B==="json")return"null";if(B==="any")throw new Z(z,"DB",z,"Prisma.AnyNull is a filter operand \u2014 it asks for a SQL NULL *or* a JSON "+"null \u2014 so it has no single value to bind. Write the one you mean: "+"Prisma.DbNull for the column being NULL, Prisma.JsonNull for the JSON value.");if(typeof q==="string")return q;let D;try{D=JSON.stringify(q)}catch(H){throw new Z(z,"DB",z,`A parameter cast to json could not be serialised: ${H instanceof Error?H.message:String(H)}. `+"Bind text you have serialised yourself if the value is not JSON \u2014 a "+"bigint has no JSON form, and neither does a cycle.")}if(D===void 0)throw new Z(z,"DB",z,`A ${typeof q} was bound to a parameter cast to json, and has no JSON form. Bind the value it stands for.`);return D}var I=new WeakSet;function L(q){return I.add(q),q}function k(q){return typeof q==="object"&&q!==null&&I.has(q)}function t(q,...z){if(!Array.isArray(q)||!("raw"in q))throw new O("sql","DB","sql","'sql' is a tagged template \u2014 write sql`select 1`, not sql(\"select 1\"). "+"To put text that is not a value into a statement, use 'unsafeSql', and read what it says first.");let B=[];for(let D=0;D<q.length;D++)if(B.push(W(q[D])),D<z.length)B.push(j(z[D]));return L(Y(...B))}function r(q,z=", "){if(!Array.isArray(q))throw new Z("join","DB","sql",`Expected an array of fragments or values, got ${typeof q}.`);if(q.length===0)return p;let B=q.map(j);if(k(z)){let D=[];for(let H=0;H<B.length;H++){if(H>0)D.push(z);D.push(B[H])}return L(Y(...D))}return v(z),L(N(B,z))}var g=/^[\s,]*$|^\s*(?:and|or)\s*$/i;function v(q){if(typeof q==="string"&&g.test(q))return;throw new Z("join","DB","sql",typeof q==="string"?`A separator is written into the SQL text, so it may only be glue: whitespace, commas, or 'and' / 'or'. Got ${JSON.stringify(q)}. If that is deliberate, say so with `+"unsafeSql(...) \u2014 and never build one from anything that came from "+"outside the program.":`Expected a separator string or a fragment, got ${q===null?"null":typeof q}.`)}var p=L(Object.freeze({text:"",binders:Object.freeze([])}));function a(q){if(typeof q!=="string")throw new Z("unsafeSql","DB","sql",`Expected a string literal, got ${Array.isArray(q)?"an array":typeof q}. 'unsafeSql' is a plain call, not a tagged template \u2014 a template would `+"interpolate values into the SQL text, which is the one thing it must never do.");return L(W(q))}function e(q,z,B="query"){if(!k(q))throw new Z(B,"DB",B,`Expected a fragment built with 'sql', got ${q===null?"null":typeof q}. A plain string is not accepted here on purpose \u2014 it would be the one `+"path into the SQL text that nobody had to think about.");let D=U(q,z),H=S(D.fragment,z,{model:"DB",operation:B});return{text:H.text,values:R(H.binders)(void 0).map((X,$)=>D.jsonParameters.has($)?M(X,B):X===null||X===void 0?X??null:z.encodeUntyped(X))}}function j(q){if(k(q))return q;return F(()=>q)}
+export{T as ce,y as de,A as ee,b as fe,E as ge,t as he,r as ie,p as je,a as ke,e as le};
 
-//# debugId=9F54A788CF813C0464756E2164756E21
+//# debugId=B5261BD659F545C864756E2164756E21

package/dist/{chunk-b0jpvp5t.js.map → chunk-h7pafjej.js.map}

@@ -7,6 +7,6 @@
     "import type { SqlDialect } from \"./dialect\";\nimport {\n  InvalidArgumentError,\n  UnsupportedQueryError,\n} from \"./errors\";\nimport {\n  type Fragment,\n  bindValues,\n  concat,\n  joinFragments,\n  param,\n  render,\n  sql as text,\n} from \"./compile/fragment\";\nimport { jsonTextParameter, retypeJsonParameters } from \"./json-param\";\n\n/**\n * SQL fragments as first-class values: `sql`, `join`, `empty`, and one door out.\n *\n * The ORM deliberately does not implement every SQL shape — `distinct`, cursor\n * pagination, window functions, recursive CTEs. That is the right call, but it\n * is only half a decision: the shapes it declines have to have somewhere to go,\n * and \"drop to raw SQL\" is not an answer if raw SQL cannot be *composed*.\n *\n * `DB.sql` — Bun's tagged template — covers a single self-contained statement,\n * and that is genuinely all it covers. The shape it cannot express is the common\n * one: a predicate list built conditionally, passed around as a value, and\n * interpolated into a larger statement.\n *\n * ```ts\n * const filters = []\n * if (q) filters.push(sql`name ilike ${`%${q}%`}`)\n * if (organizationId) filters.push(sql`\"organizationId\" = ${organizationId}`)\n *\n * const where = filters.length ? sql`where ${join(filters, \" and \")}` : empty\n * const rows = await DB.query(sql`select * from \"Product\" ${where} limit ${20}`)\n * ```\n *\n * ## This is the compiler's own `Fragment`, made public\n *\n * Not a parallel mechanism. `compile/fragment.ts` has held exactly this shape\n * since iteration 1 — text plus positional binders, composable, never\n * concatenating a value into the text — because that is what invariant 2 needs\n * internally. Reusing it means a public fragment binds by the same rule the\n * compiler's own SQL does, and it means the parameter ceiling, the placeholder\n * numbering and the dialect split are all already handled rather than\n * reimplemented one door down.\n *\n * **Placeholders are assigned at assembly, not at authoring.** SQLite writes\n * `?` and Postgres writes `$1`, `$2`, and a fragment does not know where in the\n * final statement it will land — so `sql` records a *position* and `render`\n * turns it into a placeholder once the whole statement exists. That is what lets\n * the same fragment be nested, reused twice in one statement, or built before\n * the dialect is even known.\n */\n\n/**\n * A composable piece of SQL. Its values are bound parameters, never text.\n *\n * Opaque on purpose: an application builds one with `sql`, combines it with\n * `join`, and hands it to `DB.query` / `DB.execute`. Reading `.text` off it is\n * not part of the contract — it holds parameter *markers* rather than the\n * dialect's placeholders, so it is not the statement that runs.\n */\nexport type SqlFragment = Fragment;\n\n/**\n * Every fragment this module has produced.\n *\n * **Identity, not shape, and the difference is a SQL injection.** `interpolate`\n * splices a fragment as text and binds everything else, so \"is this a fragment\"\n * decides whether a value reaches the statement or a parameter. Asking the\n * *shape* — a `text` string and a `binders` array — makes that decision\n * answerable by anything that can name two properties, and `{\"text\": \"…\",\n * \"binders\": []}` is two lines of JSON:\n *\n * ```ts\n * const body = await request.json()\n * await DB.query(sql`select \"email\" from \"User\" where \"email\" = ${body.email}`)\n * // body.email = { text: `'' union select \"password\" from \"User\"`, binders: [] }\n * // -> select \"email\" from \"User\" where \"email\" = '' union select \"password\" from \"User\"\n * ```\n *\n * That is the intended call site with the intended safe value, and it returned\n * the password column out of a statement selecting only `email`. The internal\n * `Fragment` never had the problem because nothing outside `compile/` could\n * construct one; making the type public is what turned \"text plus binders\" from\n * an implementation detail into a shape an attacker can name. `unsafeSql` is\n * built so that reaching for the escape hatch is a decision — a structural check\n * is a second, unmarked door beside it.\n *\n * A `WeakSet` the module owns cannot be forged: membership is granted only by\n * the constructors below. It registers the *returned* object rather than\n * stamping a property, because `concat` and `joinFragments` return fresh objects\n * — a marker property on the inputs would not survive them, and the version that\n * cannot drift is the one that brands what actually comes out.\n */\nconst FRAGMENTS = new WeakSet<object>();\n\nfunction brand(fragment: Fragment): SqlFragment {\n  FRAGMENTS.add(fragment);\n  return fragment;\n}\n\n/** Whether a value is a fragment *this module made*, so it splices rather than binds. */\nfunction isFragment(value: unknown): value is Fragment {\n  return typeof value === \"object\" && value !== null && FRAGMENTS.has(value);\n}\n\n/**\n * A SQL fragment. Every `${value}` is bound as a parameter; a `${fragment}` is\n * spliced in, carrying its own parameters with it.\n *\n * ```ts\n * sql`where \"id\" = ${id}`                       // \"id\" = $1, with id bound\n * sql`where ${sql`\"a\" = ${1}`} and ${sql`\"b\" = ${2}`}`   // nests to any depth\n * ```\n *\n * An interpolated **array** is bound as one value, not expanded — that is what\n * Postgres's `= any($1)` wants, and it is the only reading that does not depend\n * on the dialect. For a comma-separated list of placeholders, say so with\n * `join`.\n *\n * A value at a `::jsonb` cast the caller wrote is the one parameter with a type\n * behind it, and it is bound as **JSON text** so that the statement means what\n * the same statement meant under Prisma's `$executeRaw`:\n *\n * ```ts\n * sql`… set payload = payload || ${JSON.stringify(patch)}::jsonb`  // merges\n * ```\n *\n * Without that the driver would JSON-encode the string and the column would\n * hold the document as a jsonb *string* — which `||` appends as an array\n * element rather than merging. `json-param.ts` has the measurements.\n */\nexport function sql(\n  strings: TemplateStringsArray,\n  ...values: unknown[]\n): SqlFragment {\n  // A defensive check rather than a type error, because the interesting misuse\n  // is `sql(userInput)` — a plain call with a string, which would otherwise\n  // reach `strings.raw` as `undefined` and produce a fragment of `undefined`\n  // text rather than an error. It is also the shape somebody reaches for when\n  // they want the escape hatch and have not found `unsafeSql`.\n  if (!Array.isArray(strings) || !(\"raw\" in (strings as object))) {\n    throw new UnsupportedQueryError(\n      \"sql\",\n      \"DB\",\n      \"sql\",\n      `'sql' is a tagged template — write sql\\`select 1\\`, not sql(\"select 1\"). ` +\n        `To put text that is not a value into a statement, use 'unsafeSql', ` +\n        `and read what it says first.`,\n    );\n  }\n\n  const parts: Fragment[] = [];\n\n  for (let i = 0; i < strings.length; i++) {\n    parts.push(text(strings[i]));\n    if (i < values.length) parts.push(interpolate(values[i]));\n  }\n\n  return brand(concat(...parts));\n}\n\n/**\n * Fragments — or values — joined by a separator, the way `Array.join` reads.\n *\n * ```ts\n * join(filters, \" and \")            // a and b and c\n * join([sql`\"a\" asc`, sql`\"b\" desc`])   // \"a\" asc, \"b\" desc\n * join(ids)                         // $1, $2, $3 — each bound\n * ```\n *\n * An **empty list produces `empty`**, not a separator and not a syntax error, so\n * `join` composes with a list that turned out to have nothing in it. That is the\n * case a caller forgets, and it is the one that would otherwise emit `where ` and\n * fail at the database rather than here.\n *\n * ## The separator is text, so it is not a free string\n *\n * It goes between the fragments *in the statement*, which makes it the one other\n * place a string could reach the SQL — and this module's whole claim is that\n * `unsafeSql` is **the** door. So a plain-string separator has to be glue and\n * nothing else: whitespace, commas, or a boolean connective. Anything more\n * expressive is legitimate and has to say so:\n *\n * ```ts\n * join(filters, \" and \")                 // fine\n * join(parts, unsafeSql(\") and (\"))      // fine, and visibly a decision\n * join(ids, request.query.sep)           // refused\n * ```\n *\n * A **blocklist would not do**, which is why this is an allowlist. The obvious\n * one — reject quotes, semicolons and comment markers — lets this through:\n *\n *     join([1, 2], \") or 1=1 union select password from Users where 1=(1\")\n *\n * No quote, no `--`, still an injection. There is no sound way to say \"this\n * arbitrary text is safe glue\", so the rule is that glue is a small closed set\n * and everything else is a fragment somebody built on purpose.\n */\nexport function join(\n  values: readonly unknown[],\n  separator: string | SqlFragment = \", \",\n): SqlFragment {\n  if (!Array.isArray(values)) {\n    throw new InvalidArgumentError(\n      \"join\",\n      \"DB\",\n      \"sql\",\n      `Expected an array of fragments or values, got ${typeof values}.`,\n    );\n  }\n  if (values.length === 0) return empty;\n\n  const parts = values.map(interpolate);\n\n  if (isFragment(separator)) {\n    const woven: Fragment[] = [];\n    for (let i = 0; i < parts.length; i++) {\n      if (i > 0) woven.push(separator);\n      woven.push(parts[i]);\n    }\n    return brand(concat(...woven));\n  }\n\n  assertGlue(separator);\n  return brand(joinFragments(parts, separator));\n}\n\n/**\n * Whitespace and commas, or a boolean connective surrounded by whitespace.\n *\n * Deliberately small. Every separator a composed statement actually needs is in\n * here — `\", \"`, `\" and \"`, `\" or \"`, `\" \"` — and everything outside it is\n * expressive enough to change what the statement *does*, which is the property\n * that makes it a `unsafeSql` decision rather than a string argument.\n */\nconst GLUE = /^[\\s,]*$|^\\s*(?:and|or)\\s*$/i;\n\nfunction assertGlue(separator: unknown): void {\n  if (typeof separator === \"string\" && GLUE.test(separator)) return;\n\n  throw new InvalidArgumentError(\n    \"join\",\n    \"DB\",\n    \"sql\",\n    typeof separator === \"string\"\n      ? `A separator is written into the SQL text, so it may only be glue: ` +\n        `whitespace, commas, or 'and' / 'or'. Got ` +\n        `${JSON.stringify(separator)}. If that is deliberate, say so with ` +\n        `unsafeSql(...) — and never build one from anything that came from ` +\n        `outside the program.`\n      : `Expected a separator string or a fragment, got ${\n          separator === null ? \"null\" : typeof separator\n        }.`,\n  );\n}\n\n/**\n * The fragment that contributes nothing.\n *\n * The point of it is that `where ${empty}` and `where ${filter}` are the same\n * expression — a conditional predicate is a value, not a branch around the\n * statement. Frozen, because it is shared by every caller and a fragment is read\n * as immutable everywhere else.\n */\nexport const empty: SqlFragment = brand(\n  Object.freeze({ text: \"\", binders: Object.freeze([]) as [] }),\n);\n\n/**\n * **Text straight into the SQL, with no parameter around it.** The one door in\n * this ORM through which a value reaches the statement text.\n *\n * Everything else in the compiler exists to make this impossible — identifiers\n * come from the generated schema, values are bound — so reaching for it should\n * feel like reaching for it. **Never give it a value that came from a request, a\n * form, a URL, a header, a queue payload or a database row.** There is no\n * escaping here and there will not be: escaping that is \"usually right\" is worse\n * than none, because it survives review.\n *\n * ## Why it exists at all, since that is the fair question\n *\n * Plan quality can depend on *not* parameterising. A partial index declared as\n *\n * ```sql\n * create index … on \"Job\" (…) where \"name\" is distinct from 'reaper'\n * ```\n *\n * is only usable if the planner can prove the query's predicate matches the\n * index's. A bound parameter is opaque at plan time, so `where \"name\" is\n * distinct from $1` does not match — and the query falls back to a sequential\n * scan over the whole table. The constant has to be *in the text*:\n *\n * ```ts\n * const REAPER = unsafeSql(`'reaper'`)   // a literal in this file, never input\n * await DB.query(sql`\n *   select … from \"Job\" where \"name\" is distinct from ${REAPER} …\n * `)\n * ```\n *\n * A builder with no escape hatch cannot express that at any price, and the\n * workaround — hand-writing the whole statement — loses composition for every\n * other part of it.\n *\n * The same applies to the other things that cannot be parameters in SQL:\n * identifiers, a sort direction, a table name chosen from a fixed set in code.\n * All of them share the rule above — the value is written in the source file, or\n * chosen from a set written in the source file, never passed in.\n */\nexport function unsafeSql(literal: string): SqlFragment {\n  if (typeof literal !== \"string\") {\n    throw new InvalidArgumentError(\n      \"unsafeSql\",\n      \"DB\",\n      \"sql\",\n      `Expected a string literal, got ${\n        Array.isArray(literal) ? \"an array\" : typeof literal\n      }. 'unsafeSql' is a plain call, not a tagged template — a template would ` +\n        `interpolate values into the SQL text, which is the one thing it must ` +\n        `never do.`,\n    );\n  }\n  return brand(text(literal));\n}\n\n/**\n * A fragment as the statement a driver can run: the dialect's placeholders in\n * the text, and the values in the order they appear.\n *\n * Separate from the executing, and exported, because it is the half that is a\n * pure function of `(fragment, dialect)` — so a test can assert what a\n * composition emits on both dialects without a database anywhere near it, which\n * is exactly how the rest of the compiler is tested.\n *\n * `render` also applies the parameter ceiling here, which matters more for a\n * hand-built fragment than for a compiled plan: `join(ids)` over a\n * request-derived list is one placeholder per element on SQLite, and 40 000 of\n * them is a driver error rather than a clear one.\n */\nexport function renderFragment(\n  fragment: SqlFragment,\n  dialect: SqlDialect,\n  operation = \"query\",\n): { text: string; values: unknown[] } {\n  if (!isFragment(fragment)) {\n    throw new InvalidArgumentError(\n      operation,\n      \"DB\",\n      operation,\n      `Expected a fragment built with 'sql', got ${\n        fragment === null ? \"null\" : typeof fragment\n      }. A plain string is not accepted here on purpose — it would be the one ` +\n        `path into the SQL text that nobody had to think about.`,\n    );\n  }\n\n  // The one thing a raw parameter can be *told* about its type: a `::jsonb` the\n  // caller wrote onto their own placeholder. Where there is one, the parameter\n  // is retyped through `text` and its value serialised, because Bun otherwise\n  // JSON-encodes a string bound to a `jsonb` parameter and stores the document\n  // as a jsonb *string* where Prisma stored the object. See `json-param.ts` —\n  // the mechanism, the measurements, and why a string is not serialised here\n  // while `fieldParam` serialises one.\n  //\n  // The dialect is passed because this is not universal, and the reason is\n  // narrower than it looks: `::` is Postgres-only syntax, but `cast(? as json)`\n  // *parses and runs* on SQLite, where it means NUMERIC affinity — so retyping\n  // it would rewrite a working statement into `cast(? as text)::json`, which\n  // SQLite cannot parse. `typesParametersFromStatement` is false there.\n  const json = retypeJsonParameters(fragment, dialect);\n\n  const rendered = render(json.fragment, dialect, { model: \"DB\", operation });\n  return {\n    text: rendered.text,\n    // `encodeUntyped` and not `encode`: there is no field here to ask, which is\n    // the whole difference between a fragment's parameters and a compiled\n    // plan's. It normalises the two JavaScript types whose SQL form the ORM has\n    // already decided — a `Date` and a boolean — so a raw statement compares\n    // against ORM-written rows on both dialects rather than only on Postgres.\n    values: bindValues(rendered.binders)(undefined).map((value, index) =>\n      json.jsonParameters.has(index)\n        ? jsonTextParameter(value, operation)\n        : value === null || value === undefined\n          ? (value ?? null)\n          : dialect.encodeUntyped(value),\n    ),\n  };\n}\n\n/**\n * One interpolated slot: a fragment splices, anything else binds.\n *\n * The binder ignores both its arguments. A compiled plan's binders read the\n * *call's* argument tree, because one plan serves many calls; a fragment is\n * built per call and closes over the value it was given, which is the whole\n * difference between the compiler's fragments and these.\n */\nfunction interpolate(value: unknown): Fragment {\n  if (isFragment(value)) return value;\n  return param(() => value);\n}\n"
   ],
   "mappings": ";6QAeA,FAAM,EAAS,IAAI,IAEZ,SAAS,CAAQ,CAAC,EAAc,EAAsB,CAC3D,EAAO,IAAI,EAAM,CAAK,EAGjB,SAAS,CAAG,CAAC,EAAuB,CACzC,OAAO,EAAO,IAAI,CAAI,EAGjB,SAAS,CAAgB,CAAC,EAAiB,CAChD,IAAM,EAAQ,EAAO,IAAI,CAAI,EAC7B,GAAI,IAAU,OACZ,MAAM,IAAI,EAAwB,EAAM,CAAC,GAAG,EAAO,KAAK,CAAC,CAAC,EAE5D,OAAO,EAGF,SAAS,CAAe,EAAa,CAC1C,MAAO,CAAC,GAAG,EAAO,KAAK,CAAC,EAGnB,SAAS,CAAa,EAAS,CACpC,EAAO,MAAM,ECoGf,IAAM,EAAgB,qDAehB,EAAgB,8BAQhB,EAAY,mBAGZ,EAA6B,IAAI,IAYhC,SAAS,CAAoB,CAClC,EACA,EAIA,CACA,GAAI,CAAC,EAAQ,6BACX,MAAO,CAAE,WAAU,eAAgB,CAAM,EAG3C,IAAM,EAAW,EAAc,CAAQ,EACjC,EAAiB,IAAI,IACvB,EAKJ,QAAS,EAAQ,EAAG,EAAQ,EAAS,OAAS,EAAG,IAAS,CACxD,IAAM,EAAQ,EAAS,EAAQ,GAEzB,EAAW,EAAc,KAAK,CAAK,EACzC,GAAI,EAAU,CACZ,IAAc,CAAC,GAAG,CAAQ,EAC1B,EAAU,EAAQ,GAChB,WAAW,EAAS,KAAK,EAAM,MAAM,EAAS,GAAG,MAAM,IACzD,EAAe,IAAI,CAAK,EACxB,SAGF,IAAM,EAAK,EAAc,KAAK,CAAK,EAKnC,GAAI,GAAM,EAAU,MAAM,GAAa,GAAU,EAAM,EACrD,IAAc,CAAC,GAAG,CAAQ,EAC1B,EAAU,EAAQ,GAAK,cAAc,EAAG,KAAK,EAAM,MAAM,EAAG,GAAG,MAAM,IACrE,EAAe,IAAI,CAAK,EAI5B,GAAI,CAAC,EAAW,MAAO,CAAE,WAAU,gBAAe,EAClD,MAAO,CACL,SAAU,EAAkB,EAAW,EAAS,OAAO,EACvD,gBACF,EAYK,SAAS,CAAiB,CAAC,EAAgB,EAA4B,CAO5E,GAAI,IAAU,MAAQ,IAAU,OAAW,OAAO,KAKlD,IAAM,EAAW,EAAa,CAAK,EACnC,GAAI,IAAa,KAAM,OAAO,KAC9B,GAAI,IAAa,OAAQ,MAAO,OAChC,GAAI,IAAa,MACf,MAAM,IAAI,EACR,EACA,KACA,EACA,gFACE,0EACA,8EAEJ,EAMF,GAAI,OAAO,IAAU,SAAU,OAAO,EAEtC,IAAI,EACJ,GAAI,CACF,EAAO,KAAK,UAAU,CAAK,EAC3B,MAAO,EAAO,CAId,MAAM,IAAI,EACR,EACA,KACA,EACA,qDACK,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,MACxD,4EACA,oDACJ,EAMF,GAAI,IAAS,OACX,MAAM,IAAI,EACR,EACA,KACA,EACA,KAAK,OAAO,8FAEd,EAGF,OAAO,ECxMT,IAAM,EAAY,IAAI,QAEtB,SAAS,CAAK,CAAC,EAAiC,CAE9C,OADA,EAAU,IAAI,CAAQ,EACf,EAIT,SAAS,CAAU,CAAC,EAAmC,CACrD,OAAO,OAAO,IAAU,UAAY,IAAU,MAAQ,EAAU,IAAI,CAAK,EA6BpE,SAAS,CAAG,CACjB,KACG,EACU,CAMb,GAAI,CAAC,MAAM,QAAQ,CAAO,GAAK,EAAE,QAAU,GACzC,MAAM,IAAI,EACR,MACA,KACA,MACA,iFACE,iGAEJ,EAGF,IAAM,EAAoB,CAAC,EAE3B,QAAS,EAAI,EAAG,EAAI,EAAQ,OAAQ,IAElC,GADA,EAAM,KAAK,EAAK,EAAQ,EAAE,CAAC,EACvB,EAAI,EAAO,OAAQ,EAAM,KAAK,EAAY,EAAO,EAAE,CAAC,EAG1D,OAAO,EAAM,EAAO,GAAG,CAAK,CAAC,EAwCxB,SAAS,CAAI,CAClB,EACA,EAAkC,KACrB,CACb,GAAI,CAAC,MAAM,QAAQ,CAAM,EACvB,MAAM,IAAI,EACR,OACA,KACA,MACA,iDAAiD,OAAO,IAC1D,EAEF,GAAI,EAAO,SAAW,EAAG,OAAO,EAEhC,IAAM,EAAQ,EAAO,IAAI,CAAW,EAEpC,GAAI,EAAW,CAAS,EAAG,CACzB,IAAM,EAAoB,CAAC,EAC3B,QAAS,EAAI,EAAG,EAAI,EAAM,OAAQ,IAAK,CACrC,GAAI,EAAI,EAAG,EAAM,KAAK,CAAS,EAC/B,EAAM,KAAK,EAAM,EAAE,EAErB,OAAO,EAAM,EAAO,GAAG,CAAK,CAAC,EAI/B,OADA,EAAW,CAAS,EACb,EAAM,EAAc,EAAO,CAAS,CAAC,EAW9C,IAAM,EAAO,+BAEb,SAAS,CAAU,CAAC,EAA0B,CAC5C,GAAI,OAAO,IAAc,UAAY,EAAK,KAAK,CAAS,EAAG,OAE3D,MAAM,IAAI,EACR,OACA,KACA,MACA,OAAO,IAAc,SACjB,8GAEG,KAAK,UAAU,CAAS,yCAC3B,0EACA,uBACA,kDACE,IAAc,KAAO,OAAS,OAAO,IAE7C,EAWK,IAAM,EAAqB,EAChC,OAAO,OAAO,CAAE,KAAM,GAAI,QAAS,OAAO,OAAO,CAAC,CAAC,CAAQ,CAAC,CAC9D,EA0CO,SAAS,CAAS,CAAC,EAA8B,CACtD,GAAI,OAAO,IAAY,SACrB,MAAM,IAAI,EACR,YACA,KACA,MACA,kCACE,MAAM,QAAQ,CAAO,EAAI,WAAa,OAAO,iFAE7C,gFAEJ,EAEF,OAAO,EAAM,EAAK,CAAO,CAAC,EAiBrB,SAAS,CAAc,CAC5B,EACA,EACA,EAAY,QACyB,CACrC,GAAI,CAAC,EAAW,CAAQ,EACtB,MAAM,IAAI,EACR,EACA,KACA,EACA,6CACE,IAAa,KAAO,OAAS,OAAO,gFAEpC,wDACJ,EAgBF,IAAM,EAAO,EAAqB,EAAU,CAAO,EAE7C,EAAW,EAAO,EAAK,SAAU,EAAS,CAAE,MAAO,KAAM,WAAU,CAAC,EAC1E,MAAO,CACL,KAAM,EAAS,KAMf,OAAQ,EAAW,EAAS,OAAO,EAAE,MAAS,EAAE,IAAI,CAAC,EAAO,IAC1D,EAAK,eAAe,IAAI,CAAK,EACzB,EAAkB,EAAO,CAAS,EAClC,IAAU,MAAQ,IAAU,OACzB,GAAS,KACV,EAAQ,cAAc,CAAK,CACnC,CACF,EAWF,SAAS,CAAW,CAAC,EAA0B,CAC7C,GAAI,EAAW,CAAK,EAAG,OAAO,EAC9B,OAAO,EAAM,IAAM,CAAK",
-  "debugId": "9F54A788CF813C0464756E2164756E21",
+  "debugId": "B5261BD659F545C864756E2164756E21",
   "names": []
 }

package/dist/{chunk-63hvh35x.js → chunk-hdhahvd4.js}

@@ -1,4 +1,4 @@
 // @bun
-import{H as A}from"./chunk-cw7qfcvt.js";import{V as T}from"./chunk-hwc8gt4n.js";import"./chunk-q8r9mvzx.js";import{$ as y}from"./chunk-ee92kx8s.js";import{_g as r}from"./chunk-1xzdexbq.js";var u=r(A(),1);var i=r(y(),1),E=r(A(),1);import{exec as d}from"child_process";import{promisify as I}from"util";var x=r(T(),1),_=(c,n,e)=>{if(n.Version!==1)throw Error(`Profile ${c} credential_process did not return Version 1.`);if(n.AccessKeyId===void 0||n.SecretAccessKey===void 0)throw Error(`Profile ${c} credential_process returned invalid credentials.`);if(n.Expiration){let w=new Date;if(new Date(n.Expiration)<w)throw Error(`Profile ${c} credential_process returned expired credentials.`)}let s=n.AccountId;if(!s&&e?.[c]?.aws_account_id)s=e[c].aws_account_id;let t={accessKeyId:n.AccessKeyId,secretAccessKey:n.SecretAccessKey,...n.SessionToken&&{sessionToken:n.SessionToken},...n.Expiration&&{expiration:new Date(n.Expiration)},...n.CredentialScope&&{credentialScope:n.CredentialScope},...s&&{accountId:s}};return x.setCredentialFeature(t,"CREDENTIALS_PROCESS","w"),t};var K=async(c,n,e)=>{let s=n[c];if(n[c]){let t=s.credential_process;if(t!==void 0){let w=I(E.externalDataInterceptor?.getTokenRecord?.().exec??d);try{let{stdout:o}=await w(t),S;try{S=JSON.parse(o.trim())}catch{throw Error(`Profile ${c} credential_process returned invalid JSON.`)}return _(c,S,n)}catch(o){throw new i.CredentialsProviderError(o.message,{logger:e})}}else throw new i.CredentialsProviderError(`Profile ${c} did not contain credential_process.`,{logger:e})}else throw new i.CredentialsProviderError(`Profile ${c} could not be found in shared credentials file.`,{logger:e})};var R=(c={})=>async({callerClientConfig:n}={})=>{c.logger?.debug("@aws-sdk/credential-provider-process - fromProcess");let e=await u.parseKnownFiles(c);return K(u.getProfileName({profile:c.profile??n?.profile}),e,c.logger)};export{R as fromProcess};
+import{H as A}from"./chunk-kh273hj0.js";import{V as T}from"./chunk-pj2e1p07.js";import"./chunk-eytdyahy.js";import{$ as y}from"./chunk-8pynv9rw.js";import{qh as r}from"./chunk-3s3awh38.js";var u=r(A(),1);var i=r(y(),1),E=r(A(),1);import{exec as d}from"child_process";import{promisify as I}from"util";var x=r(T(),1),_=(c,n,e)=>{if(n.Version!==1)throw Error(`Profile ${c} credential_process did not return Version 1.`);if(n.AccessKeyId===void 0||n.SecretAccessKey===void 0)throw Error(`Profile ${c} credential_process returned invalid credentials.`);if(n.Expiration){let w=new Date;if(new Date(n.Expiration)<w)throw Error(`Profile ${c} credential_process returned expired credentials.`)}let s=n.AccountId;if(!s&&e?.[c]?.aws_account_id)s=e[c].aws_account_id;let t={accessKeyId:n.AccessKeyId,secretAccessKey:n.SecretAccessKey,...n.SessionToken&&{sessionToken:n.SessionToken},...n.Expiration&&{expiration:new Date(n.Expiration)},...n.CredentialScope&&{credentialScope:n.CredentialScope},...s&&{accountId:s}};return x.setCredentialFeature(t,"CREDENTIALS_PROCESS","w"),t};var K=async(c,n,e)=>{let s=n[c];if(n[c]){let t=s.credential_process;if(t!==void 0){let w=I(E.externalDataInterceptor?.getTokenRecord?.().exec??d);try{let{stdout:o}=await w(t),S;try{S=JSON.parse(o.trim())}catch{throw Error(`Profile ${c} credential_process returned invalid JSON.`)}return _(c,S,n)}catch(o){throw new i.CredentialsProviderError(o.message,{logger:e})}}else throw new i.CredentialsProviderError(`Profile ${c} did not contain credential_process.`,{logger:e})}else throw new i.CredentialsProviderError(`Profile ${c} could not be found in shared credentials file.`,{logger:e})};var R=(c={})=>async({callerClientConfig:n}={})=>{c.logger?.debug("@aws-sdk/credential-provider-process - fromProcess");let e=await u.parseKnownFiles(c);return K(u.getProfileName({profile:c.profile??n?.profile}),e,c.logger)};export{R as fromProcess};
 
-//# debugId=25B6CD4A775A55A864756E2164756E21
+//# debugId=6C647A27BFD1CB5464756E2164756E21

package/dist/{chunk-63hvh35x.js.map → chunk-hdhahvd4.js.map}

@@ -7,6 +7,6 @@
     "import { setCredentialFeature } from \"@aws-sdk/core/client\";\nexport const getValidatedProcessCredentials = (profileName, data, profiles) => {\n    if (data.Version !== 1) {\n        throw Error(`Profile ${profileName} credential_process did not return Version 1.`);\n    }\n    if (data.AccessKeyId === undefined || data.SecretAccessKey === undefined) {\n        throw Error(`Profile ${profileName} credential_process returned invalid credentials.`);\n    }\n    if (data.Expiration) {\n        const currentTime = new Date();\n        const expireTime = new Date(data.Expiration);\n        if (expireTime < currentTime) {\n            throw Error(`Profile ${profileName} credential_process returned expired credentials.`);\n        }\n    }\n    let accountId = data.AccountId;\n    if (!accountId && profiles?.[profileName]?.aws_account_id) {\n        accountId = profiles[profileName].aws_account_id;\n    }\n    const credentials = {\n        accessKeyId: data.AccessKeyId,\n        secretAccessKey: data.SecretAccessKey,\n        ...(data.SessionToken && { sessionToken: data.SessionToken }),\n        ...(data.Expiration && { expiration: new Date(data.Expiration) }),\n        ...(data.CredentialScope && { credentialScope: data.CredentialScope }),\n        ...(accountId && { accountId }),\n    };\n    setCredentialFeature(credentials, \"CREDENTIALS_PROCESS\", \"w\");\n    return credentials;\n};\n"
   ],
   "mappings": ";qNAAA,SCAA,SACA,KACA,SAAS,sBACT,oBAAS,aCHT,eACa,EAAiC,CAAC,EAAa,EAAM,IAAa,CAC3E,GAAI,EAAK,UAAY,EACjB,MAAM,MAAM,WAAW,gDAA0D,EAErF,GAAI,EAAK,cAAgB,QAAa,EAAK,kBAAoB,OAC3D,MAAM,MAAM,WAAW,oDAA8D,EAEzF,GAAI,EAAK,WAAY,CACjB,IAAM,EAAc,IAAI,KAExB,GADmB,IAAI,KAAK,EAAK,UAAU,EAC1B,EACb,MAAM,MAAM,WAAW,oDAA8D,EAG7F,IAAI,EAAY,EAAK,UACrB,GAAI,CAAC,GAAa,IAAW,IAAc,eACvC,EAAY,EAAS,GAAa,eAEtC,IAAM,EAAc,CAChB,YAAa,EAAK,YAClB,gBAAiB,EAAK,mBAClB,EAAK,cAAgB,CAAE,aAAc,EAAK,YAAa,KACvD,EAAK,YAAc,CAAE,WAAY,IAAI,KAAK,EAAK,UAAU,CAAE,KAC3D,EAAK,iBAAmB,CAAE,gBAAiB,EAAK,eAAgB,KAChE,GAAa,CAAE,WAAU,CACjC,EAEA,OADA,uBAAqB,EAAa,sBAAuB,GAAG,EACrD,GDvBJ,IAAM,EAA4B,MAAO,EAAa,EAAU,IAAW,CAC9E,IAAM,EAAU,EAAS,GACzB,GAAI,EAAS,GAAc,CACvB,IAAM,EAAoB,EAAQ,mBAClC,GAAI,IAAsB,OAAW,CACjC,IAAM,EAAc,EAAU,2BAAyB,iBAAiB,EAAE,MAAQ,CAAI,EACtF,GAAI,CACA,IAAQ,UAAW,MAAM,EAAY,CAAiB,EAClD,EACJ,GAAI,CACA,EAAO,KAAK,MAAM,EAAO,KAAK,CAAC,EAEnC,KAAM,CACF,MAAM,MAAM,WAAW,6CAAuD,EAElF,OAAO,EAA+B,EAAa,EAAM,CAAQ,EAErE,MAAO,EAAO,CACV,MAAM,IAAI,2BAAyB,EAAM,QAAS,CAAE,QAAO,CAAC,GAIhE,WAAM,IAAI,2BAAyB,WAAW,wCAAmD,CAAE,QAAO,CAAC,EAI/G,WAAM,IAAI,2BAAyB,WAAW,mDAA8D,CACxG,QACJ,CAAC,GD/BF,IAAM,EAAc,CAAC,EAAO,CAAC,IAAM,OAAS,sBAAuB,CAAC,IAAM,CAC7E,EAAK,QAAQ,MAAM,oDAAoD,EACvE,IAAM,EAAW,MAAM,kBAAgB,CAAI,EAC3C,OAAO,EAA0B,iBAAe,CAC5C,QAAS,EAAK,SAAW,GAAoB,OACjD,CAAC,EAAG,EAAU,EAAK,MAAM",
-  "debugId": "25B6CD4A775A55A864756E2164756E21",
+  "debugId": "6C647A27BFD1CB5464756E2164756E21",
   "names": []
 }

package/dist/{chunk-zytmxty5.js → chunk-hyfzw1fk.js}

@@ -3,6 +3,6 @@ class g extends Error{constructor(h,r){super(h,r);this.name="ConsoleError"}}clas
 
     export default defineCommand("my-command")
       .handle(async ({ line }) => { line("hello") })`);let i=this.byName.get(f);if(i)throw new g(`Two commands are named "${f}": ${o(i)} and ${o(r)}. A command name is how it is run, so one of `+"them could never be reached \u2014 rename one.");this.byName.set(f,r)}}get commands(){return[...this.byName.values()]}get(h){return this.byName.get(h)}suggest(h){let r=h.toLowerCase(),f=r.includes(":")?r.split(":")[0]:void 0,i=[];for(let s of this.byName.keys()){let t=s.toLowerCase();if(t.startsWith(r)||r.startsWith(t))i.push([0,s]);else if(t.includes(r)||r.includes(t))i.push([1,s]);else if(f&&t.startsWith(`${f}:`))i.push([2,s]);else if(l(t,r)<=2)i.push([3,s])}return i.sort((s,t)=>s[0]-t[0]||(s[1]<t[1]?-1:1)).slice(0,3).map(([,s])=>s)}}function o(h){return h.name?`\`${h.name}\``:"an anonymous command class"}function l(h,r){if(h===r)return 0;if(Math.abs(h.length-r.length)>2)return 99;let f=Array.from({length:r.length+1},(i,s)=>s);for(let i=1;i<=h.length;i+=1){let s=[i];for(let t=1;t<=r.length;t+=1)s[t]=Math.min(f[t]+1,s[t-1]+1,f[t-1]+(h[i-1]===r[t-1]?0:1));f=s}return f[r.length]}
-export{g as Xa,w as Ya};
+export{g as Za,w as _a};
 
-//# debugId=9F396575790A783164756E2164756E21
+//# debugId=BAE4C72311FA177264756E2164756E21

package/dist/{chunk-zytmxty5.js.map → chunk-hyfzw1fk.js.map}

@@ -6,6 +6,6 @@
     "import type { CommandClass } from \"./Command\";\nimport { ConsoleError } from \"./errors\";\n\n/**\n * The commands an application has, and the rules about what a command may be.\n *\n * A plain class, not a container service, and that is a decision rather than an\n * omission. `QueueManager` and `Scheduler` are bound and populated during boot\n * because the server needs them: a dispatch or a tick can arrive at any moment\n * after boot finishes. A command registry has exactly one consumer — `gemi run`,\n * which builds one, uses it, and exits. Making it a boot step would import every\n * file under `app/commands` into every `gemi dev`, every `gemi start` and every\n * deployed server process, on every start, for code no request will ever reach.\n * That is the cost `bin/check-models.ts` argues against at length, and there is\n * no benefit here to weigh against it.\n *\n * What the class is for is the rules below, and the `commands` getter — the same\n * seam `QueueManager.registeredJobs` and `Scheduler.jobs` exist to give a test:\n * what was actually taken, rather than what a walk would find if asked again.\n */\nexport class CommandRegistry {\n  private readonly byName = new Map<string, CommandClass>();\n\n  /**\n   * @throws ConsoleError naming the offending class for a command that cannot\n   * be run.\n   *\n   * Every refusal here is loud and immediate. There is a human at a terminal,\n   * and every one of these is a mistake in the application's own source that\n   * they are better off seeing now than after the command they meant to run\n   * silently did not exist.\n   *\n   * `ConsoleError` rather than a plain `Error` so the runner prints the message\n   * alone. These are sentences with the fix named in them, and burying one under\n   * `at new CommandRegistry (…)` plus the runner's own frames points the reader\n   * at framework code when the mistake is in their `app/commands`.\n   */\n  constructor(commands: CommandClass[]) {\n    for (const command of commands) {\n      const name = command.commandName;\n\n      if (!name || name === \"unset\") {\n        throw new ConsoleError(\n          `${describe(command)} does not declare a command name, so there is ` +\n            `no name to run it by. Commands are written with \\`defineCommand\\`:` +\n            `\\n\\n    export default defineCommand(\"my-command\")\\n` +\n            `      .handle(async ({ line }) => { line(\"hello\") })`,\n        );\n      }\n\n      const existing = this.byName.get(name);\n      if (existing) {\n        // Deliberately a hard error, where `QueueManager.useJobs` and\n        // `Scheduler.start` take the first and warn. Those two must keep a\n        // server booting, so running one of two identically-named jobs beats\n        // refusing to start at all. Here there is no boot to protect and a\n        // person is waiting: running the wrong one of two commands called\n        // `db:seed` is strictly worse than running neither and being told why.\n        throw new ConsoleError(\n          `Two commands are named \"${name}\": ${describe(existing)} and ` +\n            `${describe(command)}. A command name is how it is run, so one of ` +\n            `them could never be reached — rename one.`,\n        );\n      }\n\n      this.byName.set(name, command);\n    }\n  }\n\n  /** What was actually taken. */\n  get commands(): CommandClass[] {\n    return [...this.byName.values()];\n  }\n\n  get(name: string): CommandClass | undefined {\n    return this.byName.get(name);\n  }\n\n  /**\n   * The nearest names to something that did not match, for the \"did you mean\"\n   * line. Prefix matches first, then substring, then names sharing a namespace —\n   * `db:sed` should find `db:seed`, and a typo in a namespace is the common case.\n   */\n  suggest(name: string): string[] {\n    const needle = name.toLowerCase();\n    const namespace = needle.includes(\":\") ? needle.split(\":\")[0] : undefined;\n    const scored: Array<[number, string]> = [];\n\n    for (const candidate of this.byName.keys()) {\n      const haystack = candidate.toLowerCase();\n      if (haystack.startsWith(needle) || needle.startsWith(haystack)) {\n        scored.push([0, candidate]);\n      } else if (haystack.includes(needle) || needle.includes(haystack)) {\n        scored.push([1, candidate]);\n      } else if (namespace && haystack.startsWith(`${namespace}:`)) {\n        scored.push([2, candidate]);\n      } else if (editDistance(haystack, needle) <= 2) {\n        scored.push([3, candidate]);\n      }\n    }\n\n    return scored\n      .sort((a, b) => a[0] - b[0] || (a[1] < b[1] ? -1 : 1))\n      .slice(0, 3)\n      .map(([, candidate]) => candidate);\n  }\n}\n\nfunction describe(command: CommandClass): string {\n  return command.name ? `\\`${command.name}\\`` : \"an anonymous command class\";\n}\n\n/** Small enough that a dependency would cost more than it saves. */\nfunction editDistance(a: string, b: string): number {\n  if (a === b) return 0;\n  if (Math.abs(a.length - b.length) > 2) return 99;\n\n  let previous = Array.from({ length: b.length + 1 }, (_, index) => index);\n\n  for (let i = 1; i <= a.length; i += 1) {\n    const current = [i];\n    for (let j = 1; j <= b.length; j += 1) {\n      current[j] = Math.min(\n        previous[j]! + 1,\n        current[j - 1]! + 1,\n        previous[j - 1]! + (a[i - 1] === b[j - 1] ? 0 : 1),\n      );\n    }\n    previous = current;\n  }\n\n  return previous[b.length]!;\n}\n"
   ],
   "mappings": ";AAaO,MAAM,UAAqB,KAAM,CACtC,WAAW,CAAC,EAAiB,EAA+B,CAC1D,MAAM,EAAS,CAAO,EACtB,KAAK,KAAO,eAEhB,CCEO,MAAM,CAAgB,CACV,OAAS,IAAI,IAgB9B,WAAW,CAAC,EAA0B,CACpC,QAAW,KAAW,EAAU,CAC9B,IAAM,EAAO,EAAQ,YAErB,GAAI,CAAC,GAAQ,IAAS,QACpB,MAAM,IAAI,EACR,GAAG,EAAS,CAAO;AAAA;AAAA;AAAA,qDAIrB,EAGF,IAAM,EAAW,KAAK,OAAO,IAAI,CAAI,EACrC,GAAI,EAOF,MAAM,IAAI,EACR,2BAA2B,OAAU,EAAS,CAAQ,SACjD,EAAS,CAAO,iDACnB,gDACJ,EAGF,KAAK,OAAO,IAAI,EAAM,CAAO,MAK7B,SAAQ,EAAmB,CAC7B,MAAO,CAAC,GAAG,KAAK,OAAO,OAAO,CAAC,EAGjC,GAAG,CAAC,EAAwC,CAC1C,OAAO,KAAK,OAAO,IAAI,CAAI,EAQ7B,OAAO,CAAC,EAAwB,CAC9B,IAAM,EAAS,EAAK,YAAY,EAC1B,EAAY,EAAO,SAAS,GAAG,EAAI,EAAO,MAAM,GAAG,EAAE,GAAK,OAC1D,EAAkC,CAAC,EAEzC,QAAW,KAAa,KAAK,OAAO,KAAK,EAAG,CAC1C,IAAM,EAAW,EAAU,YAAY,EACvC,GAAI,EAAS,WAAW,CAAM,GAAK,EAAO,WAAW,CAAQ,EAC3D,EAAO,KAAK,CAAC,EAAG,CAAS,CAAC,EACrB,QAAI,EAAS,SAAS,CAAM,GAAK,EAAO,SAAS,CAAQ,EAC9D,EAAO,KAAK,CAAC,EAAG,CAAS,CAAC,EACrB,QAAI,GAAa,EAAS,WAAW,GAAG,IAAY,EACzD,EAAO,KAAK,CAAC,EAAG,CAAS,CAAC,EACrB,QAAI,EAAa,EAAU,CAAM,GAAK,EAC3C,EAAO,KAAK,CAAC,EAAG,CAAS,CAAC,EAI9B,OAAO,EACJ,KAAK,CAAC,EAAG,IAAM,EAAE,GAAK,EAAE,KAAO,EAAE,GAAK,EAAE,GAAK,GAAK,EAAE,EACpD,MAAM,EAAG,CAAC,EACV,IAAI,GAAI,KAAe,CAAS,EAEvC,CAEA,SAAS,CAAQ,CAAC,EAA+B,CAC/C,OAAO,EAAQ,KAAO,KAAK,EAAQ,SAAW,6BAIhD,SAAS,CAAY,CAAC,EAAW,EAAmB,CAClD,GAAI,IAAM,EAAG,MAAO,GACpB,GAAI,KAAK,IAAI,EAAE,OAAS,EAAE,MAAM,EAAI,EAAG,MAAO,IAE9C,IAAI,EAAW,MAAM,KAAK,CAAE,OAAQ,EAAE,OAAS,CAAE,EAAG,CAAC,EAAG,IAAU,CAAK,EAEvE,QAAS,EAAI,EAAG,GAAK,EAAE,OAAQ,GAAK,EAAG,CACrC,IAAM,EAAU,CAAC,CAAC,EAClB,QAAS,EAAI,EAAG,GAAK,EAAE,OAAQ,GAAK,EAClC,EAAQ,GAAK,KAAK,IAChB,EAAS,GAAM,EACf,EAAQ,EAAI,GAAM,EAClB,EAAS,EAAI,IAAO,EAAE,EAAI,KAAO,EAAE,EAAI,GAAK,EAAI,EAClD,EAEF,EAAW,EAGb,OAAO,EAAS,EAAE",
-  "debugId": "9F396575790A783164756E2164756E21",
+  "debugId": "BAE4C72311FA177264756E2164756E21",
   "names": []
 }

package/dist/{chunk-zmag8k0z.js → chunk-jnw73s8c.js}

@@ -1,4 +1,4 @@
 // @bun
-import{k as Nt}from"./chunk-vqvdptx4.js";import{A as Mt,B as Ut,C as wt,D as xt,E as pt,F as Xt,l as er,n as L,o as At,p as Wt,q as Yt,s as Hr,t as Lr,u as Rt,v as jt,w as ar,x as Bt,y as Jt,z as lr}from"./chunk-4p752vk2.js";import{G as Ft}from"./chunk-r5pnz4nn.js";import"./chunk-cw7qfcvt.js";import{I as Nr,J as at,L as Dt,P as He,T as M}from"./chunk-gvv2trvz.js";import{U as zt}from"./chunk-gy6d6jeg.js";import"./chunk-hwc8gt4n.js";import{Y as ut}from"./chunk-rjcmbwcc.js";import{Z as lt}from"./chunk-62cv9vjt.js";import"./chunk-q8r9mvzx.js";import"./chunk-ee92kx8s.js";import{ha as bt}from"./chunk-vh1hxm9y.js";import{$g as p}from"./chunk-1xzdexbq.js";var V=p((se)=>{Object.defineProperty(se,"__esModule",{value:!0});se.resolveHttpAuthSchemeConfig=se.defaultSigninHttpAuthSchemeProvider=se.defaultSigninHttpAuthSchemeParametersProvider=void 0;var Mr=L(),H=Nr(),Ur=async(e,r,t)=>{return{operation:(0,H.getSmithyContext)(r).operation,region:await(0,H.normalizeProvider)(e.region)()||(()=>{throw Error("expected `region` to be configured for `aws.auth#sigv4`")})()}};se.defaultSigninHttpAuthSchemeParametersProvider=Ur;function wr(e){return{schemeId:"aws.auth#sigv4",signingProperties:{name:"signin",region:e.region},propertiesExtractor:(r,t)=>({signingProperties:{config:r,context:t}})}}function xr(e){return{schemeId:"smithy.api#noAuth"}}var gr=(e)=>{let r=[];switch(e.operation){case"CreateOAuth2Token":{r.push(xr(e));break}default:r.push(wr(e))}return r};se.defaultSigninHttpAuthSchemeProvider=gr;var fr=(e)=>{let r=(0,Mr.resolveAwsSdkSigV4Config)(e);return Object.assign(r,{authSchemePreference:(0,H.normalizeProvider)(e.authSchemePreference??[])})};se.resolveHttpAuthSchemeConfig=fr});var Se=p((Ee)=>{Object.defineProperty(Ee,"__esModule",{value:!0});Ee.ruleSet=void 0;var ve="required",o="fn",n="argv",c="ref",ne=!0,ie="isSet",S="booleanEquals",I="error",E="endpoint",l="tree",N="PartitionResult",z="stringEquals",de={[ve]:!0,default:!1,type:"boolean"},ue={[ve]:!1,type:"string"},ae={[c]:"Endpoint"},A={[o]:S,[n]:[{[c]:"UseFIPS"},!0]},W={[o]:S,[n]:[{[c]:"UseDualStack"},!0]},s={},Y={[o]:"getAttr",[n]:[{[c]:N},"name"]},R={[o]:S,[n]:[{[c]:"UseFIPS"},!1]},F={[o]:S,[n]:[{[c]:"UseDualStack"},!1]},le={[o]:"getAttr",[n]:[{[c]:N},"supportsFIPS"]},pe={[o]:S,[n]:[!0,{[o]:"getAttr",[n]:[{[c]:N},"supportsDualStack"]}]},ce=[{[c]:"Region"}],hr={version:"1.0",parameters:{UseDualStack:de,UseFIPS:de,Endpoint:ue,Region:ue},rules:[{conditions:[{[o]:ie,[n]:[ae]}],rules:[{conditions:[A],error:"Invalid Configuration: FIPS and custom endpoint are not supported",type:I},{rules:[{conditions:[W],error:"Invalid Configuration: Dualstack and custom endpoint are not supported",type:I},{endpoint:{url:ae,properties:s,headers:s},type:E}],type:l}],type:l},{rules:[{conditions:[{[o]:ie,[n]:ce}],rules:[{conditions:[{[o]:"aws.partition",[n]:ce,assign:N}],rules:[{conditions:[{[o]:z,[n]:[Y,"aws"]},R,F],endpoint:{url:"https://{Region}.signin.aws.amazon.com",properties:s,headers:s},type:E},{conditions:[{[o]:z,[n]:[Y,"aws-cn"]},R,F],endpoint:{url:"https://{Region}.signin.amazonaws.cn",properties:s,headers:s},type:E},{conditions:[{[o]:z,[n]:[Y,"aws-us-gov"]},R,F],endpoint:{url:"https://{Region}.signin.amazonaws-us-gov.com",properties:s,headers:s},type:E},{conditions:[A,W],rules:[{conditions:[{[o]:S,[n]:[ne,le]},pe],rules:[{endpoint:{url:"https://signin-fips.{Region}.{PartitionResult#dualStackDnsSuffix}",properties:s,headers:s},type:E}],type:l},{error:"FIPS and DualStack are enabled, but this partition does not support one or both",type:I}],type:l},{conditions:[A,F],rules:[{conditions:[{[o]:S,[n]:[le,ne]}],rules:[{endpoint:{url:"https://signin-fips.{Region}.{PartitionResult#dnsSuffix}",properties:s,headers:s},type:E}],type:l},{error:"FIPS is enabled but this partition does not support FIPS",type:I}],type:l},{conditions:[R,W],rules:[{conditions:[pe],rules:[{endpoint:{url:"https://signin.{Region}.{PartitionResult#dualStackDnsSuffix}",properties:s,headers:s},type:E}],type:l},{error:"DualStack is enabled but this partition does not support DualStack",type:I}],type:l},{endpoint:{url:"https://signin.{Region}.{PartitionResult#dnsSuffix}",properties:s,headers:s},type:E}],type:l}],type:l},{error:"Invalid Configuration: Missing Region",type:I}],type:l}]};Ee.ruleSet=hr});var Ie=p((Pe)=>{Object.defineProperty(Pe,"__esModule",{value:!0});Pe.defaultEndpointResolver=void 0;var Vr=Lr(),j=Hr(),zr=Se(),Ar=new j.EndpointCache({size:50,params:["Endpoint","Region","UseDualStack","UseFIPS"]}),Wr=(e,r={})=>{return Ar.get(e,()=>(0,j.resolveEndpoint)(zr.ruleSet,{endpointParams:e,logger:r.logger}))};Pe.defaultEndpointResolver=Wr;j.customEndpointFunctions.aws=Vr.awsEndpointFunctions});var U=p((J)=>{Object.defineProperty(J,"__esModule",{value:!0});J.SigninServiceException=J.__ServiceException=void 0;var qe=M();Object.defineProperty(J,"__ServiceException",{enumerable:!0,get:function(){return qe.ServiceException}});class B extends qe.ServiceException{constructor(e){super(e);Object.setPrototypeOf(this,B.prototype)}}J.SigninServiceException=B});var k=p((be)=>{Object.defineProperty(be,"__esModule",{value:!0});be.ValidationException=be.TooManyRequestsError=be.InternalServerException=be.AccessDeniedException=void 0;var w=U();class X extends w.SigninServiceException{name="AccessDeniedException";$fault="client";error;constructor(e){super({name:"AccessDeniedException",$fault:"client",...e});Object.setPrototypeOf(this,X.prototype),this.error=e.error}}be.AccessDeniedException=X;class Q extends w.SigninServiceException{name="InternalServerException";$fault="server";error;constructor(e){super({name:"InternalServerException",$fault:"server",...e});Object.setPrototypeOf(this,Q.prototype),this.error=e.error}}be.InternalServerException=Q;class Z extends w.SigninServiceException{name="TooManyRequestsError";$fault="client";error;constructor(e){super({name:"TooManyRequestsError",$fault:"client",...e});Object.setPrototypeOf(this,Z.prototype),this.error=e.error}}be.TooManyRequestsError=Z;class K extends w.SigninServiceException{name="ValidationException";$fault="client";error;constructor(e){super({name:"ValidationException",$fault:"client",...e});Object.setPrototypeOf(this,K.prototype),this.error=e.error}}be.ValidationException=K});var C=p((We)=>{Object.defineProperty(We,"__esModule",{value:!0});We.CreateOAuth2Token$=We.CreateOAuth2TokenResponseBody$=We.CreateOAuth2TokenResponse$=We.CreateOAuth2TokenRequestBody$=We.CreateOAuth2TokenRequest$=We.AccessToken$=We.errorTypeRegistries=We.ValidationException$=We.TooManyRequestsError$=We.InternalServerException$=We.AccessDeniedException$=We.SigninServiceException$=void 0;var Jr="AccessDeniedException",Xr="AccessToken",Qr="CreateOAuth2Token",Zr="CreateOAuth2TokenRequest",Kr="CreateOAuth2TokenRequestBody",kr="CreateOAuth2TokenResponseBody",Tr="CreateOAuth2TokenResponse",mr="InternalServerException",Cr="RefreshToken",_r="TooManyRequestsError",et="ValidationException",Fe="accessKeyId",Ne="accessToken",T="client",Me="clientId",Ue="codeVerifier",rt="code",y="error",we="expiresIn",xe="grantType",tt="http",m="httpError",ge="idToken",d="jsonName",g="message",x="refreshToken",fe="redirectUri",Le="smithy.ts.sdk.synthetic.com.amazonaws.signin",Ge="secretAccessKey",$e="sessionToken",st="server",ot="tokenInput",nt="tokenOutput",he="tokenType",u="com.amazonaws.signin",Ve=He(),f=k(),it=U(),ze=Ve.TypeRegistry.for(Le);We.SigninServiceException$=[-3,Le,"SigninServiceException",0,[],[]];ze.registerError(We.SigninServiceException$,it.SigninServiceException);var q=Ve.TypeRegistry.for(u);We.AccessDeniedException$=[-3,u,Jr,{[y]:T},[y,g],[0,0],2];q.registerError(We.AccessDeniedException$,f.AccessDeniedException);We.InternalServerException$=[-3,u,mr,{[y]:st,[m]:500},[y,g],[0,0],2];q.registerError(We.InternalServerException$,f.InternalServerException);We.TooManyRequestsError$=[-3,u,_r,{[y]:T,[m]:429},[y,g],[0,0],2];q.registerError(We.TooManyRequestsError$,f.TooManyRequestsError);We.ValidationException$=[-3,u,et,{[y]:T,[m]:400},[y,g],[0,0],2];q.registerError(We.ValidationException$,f.ValidationException);We.errorTypeRegistries=[ze,q];var Ae=[0,u,Cr,8,0];We.AccessToken$=[3,u,Xr,8,[Fe,Ge,$e],[[0,{[d]:Fe}],[0,{[d]:Ge}],[0,{[d]:$e}]],3];We.CreateOAuth2TokenRequest$=[3,u,Zr,0,[ot],[[()=>We.CreateOAuth2TokenRequestBody$,16]],1];We.CreateOAuth2TokenRequestBody$=[3,u,Kr,0,[Me,xe,rt,fe,Ue,x],[[0,{[d]:Me}],[0,{[d]:xe}],0,[0,{[d]:fe}],[0,{[d]:Ue}],[()=>Ae,{[d]:x}]],2];We.CreateOAuth2TokenResponse$=[3,u,Tr,0,[nt],[[()=>We.CreateOAuth2TokenResponseBody$,16]],1];We.CreateOAuth2TokenResponseBody$=[3,u,kr,0,[Ne,he,we,x,ge],[[()=>We.AccessToken$,{[d]:Ne}],[0,{[d]:he}],[1,{[d]:we}],[()=>Ae,{[d]:x}],[0,{[d]:ge}]],4];We.CreateOAuth2Token$=[9,u,Qr,{[tt]:["POST","/v1/token",200]},()=>We.CreateOAuth2TokenRequest$,()=>We.CreateOAuth2TokenResponse$]});var sr=p((rr)=>{Object.defineProperty(rr,"__esModule",{value:!0});rr.getRuntimeConfig=void 0;var ct=L(),vt=pt(),Et=er(),yt=M(),St=lt(),Ce=at(),_e=ut(),Pt=V(),Ot=Ie(),It=C(),qt=(e)=>{return{apiVersion:"2023-01-01",base64Decoder:e?.base64Decoder??Ce.fromBase64,base64Encoder:e?.base64Encoder??Ce.toBase64,disableHostPrefix:e?.disableHostPrefix??!1,endpointProvider:e?.endpointProvider??Ot.defaultEndpointResolver,extensions:e?.extensions??[],httpAuthSchemeProvider:e?.httpAuthSchemeProvider??Pt.defaultSigninHttpAuthSchemeProvider,httpAuthSchemes:e?.httpAuthSchemes??[{schemeId:"aws.auth#sigv4",identityProvider:(r)=>r.getIdentityProvider("aws.auth#sigv4"),signer:new ct.AwsSdkSigV4Signer},{schemeId:"smithy.api#noAuth",identityProvider:(r)=>r.getIdentityProvider("smithy.api#noAuth")||(async()=>({})),signer:new Et.NoAuthSigner}],logger:e?.logger??new yt.NoOpLogger,protocol:e?.protocol??vt.AwsRestJsonProtocol,protocolSettings:e?.protocolSettings??{defaultNamespace:"com.amazonaws.signin",errorTypeRegistries:It.errorTypeRegistries,version:"2023-01-01",serviceTarget:"Signin"},serviceId:e?.serviceId??"Signin",urlParser:e?.urlParser??St.parseUrl,utf8Decoder:e?.utf8Decoder??_e.fromUtf8,utf8Encoder:e?.utf8Encoder??_e.toUtf8}};rr.getRuntimeConfig=qt});var vr=p((pr)=>{Object.defineProperty(pr,"__esModule",{value:!0});pr.getRuntimeConfig=void 0;var gt=bt(),ft=gt.__importDefault(Nt()),or=L(),nr=Mt(),G=ar(),Gt=Ut(),ir=lr(),P=Ft(),dr=Dt(),ur=M(),$t=wt(),ht=xt(),Ht=Rt(),Lt=sr(),Vt=(e)=>{(0,ur.emitWarningIfUnsupportedVersion)(process.version);let r=(0,ht.resolveDefaultsModeConfig)(e),t=()=>r().then(ur.loadConfigsForDefaultMode),a=(0,Lt.getRuntimeConfig)(e);(0,or.emitWarningIfUnsupportedVersion)(process.version);let i={profile:e?.profile,logger:a.logger};return{...a,...e,runtime:"node",defaultsMode:r,authSchemePreference:e?.authSchemePreference??(0,P.loadConfig)(or.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS,i),bodyLengthChecker:e?.bodyLengthChecker??$t.calculateBodyLength,defaultUserAgentProvider:e?.defaultUserAgentProvider??(0,nr.createDefaultUserAgentProvider)({serviceId:a.serviceId,clientVersion:ft.default.version}),maxAttempts:e?.maxAttempts??(0,P.loadConfig)(ir.NODE_MAX_ATTEMPT_CONFIG_OPTIONS,e),region:e?.region??(0,P.loadConfig)(G.NODE_REGION_CONFIG_OPTIONS,{...G.NODE_REGION_CONFIG_FILE_OPTIONS,...i}),requestHandler:dr.NodeHttpHandler.create(e?.requestHandler??t),retryMode:e?.retryMode??(0,P.loadConfig)({...ir.NODE_RETRY_MODE_CONFIG_OPTIONS,default:async()=>(await t()).retryMode||Ht.DEFAULT_RETRY_MODE},e),sha256:e?.sha256??Gt.Hash.bind(null,"sha256"),streamCollector:e?.streamCollector??dr.streamCollector,useDualstackEndpoint:e?.useDualstackEndpoint??(0,P.loadConfig)(G.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS,i),useFipsEndpoint:e?.useFipsEndpoint??(0,P.loadConfig)(G.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS,i),userAgentAppId:e?.userAgentAppId??(0,P.loadConfig)(nr.NODE_APP_ID_CONFIG_OPTIONS,i)}};pr.getRuntimeConfig=Vt});var vs=p((v)=>{var Er=At(),Qt=Wt(),Zt=Yt(),yr=jt(),Kt=ar(),_=er(),kt=He(),Tt=Bt(),qr=Jt(),Sr=lr(),O=M(),Pr=V(),mt=vr(),Or=Xt(),Ir=zt(),D=C(),$=k(),Ct=U(),_t=(e)=>{return Object.assign(e,{useDualstackEndpoint:e.useDualstackEndpoint??!1,useFipsEndpoint:e.useFipsEndpoint??!1,defaultSigningName:"signin"})},es={UseFIPS:{type:"builtInParams",name:"useFipsEndpoint"},Endpoint:{type:"builtInParams",name:"endpoint"},Region:{type:"builtInParams",name:"region"},UseDualStack:{type:"builtInParams",name:"useDualstackEndpoint"}},rs=(e)=>{let{httpAuthSchemes:r,httpAuthSchemeProvider:t,credentials:a}=e;return{setHttpAuthScheme(i){let b=r.findIndex((h)=>h.schemeId===i.schemeId);if(b===-1)r.push(i);else r.splice(b,1,i)},httpAuthSchemes(){return r},setHttpAuthSchemeProvider(i){t=i},httpAuthSchemeProvider(){return t},setCredentials(i){a=i},credentials(){return a}}},ts=(e)=>{return{httpAuthSchemes:e.httpAuthSchemes(),httpAuthSchemeProvider:e.httpAuthSchemeProvider(),credentials:e.credentials()}},ss=(e,r)=>{let t=Object.assign(Or.getAwsRegionExtensionConfiguration(e),O.getDefaultExtensionConfiguration(e),Ir.getHttpHandlerExtensionConfiguration(e),rs(e));return r.forEach((a)=>a.configure(t)),Object.assign(e,Or.resolveAwsRegionExtensionConfiguration(t),O.resolveDefaultRuntimeConfig(t),Ir.resolveHttpHandlerRuntimeConfig(t),ts(t))};class ee extends O.Client{config;constructor(...[e]){let r=mt.getRuntimeConfig(e||{});super(r);this.initConfig=r;let t=_t(r),a=yr.resolveUserAgentConfig(t),i=Sr.resolveRetryConfig(a),b=Kt.resolveRegionConfig(i),h=Er.resolveHostHeaderConfig(b),Dr=qr.resolveEndpointConfig(h),br=Pr.resolveHttpAuthSchemeConfig(Dr),Rr=ss(br,e?.extensions||[]);this.config=Rr,this.middlewareStack.use(kt.getSchemaSerdePlugin(this.config)),this.middlewareStack.use(yr.getUserAgentPlugin(this.config)),this.middlewareStack.use(Sr.getRetryPlugin(this.config)),this.middlewareStack.use(Tt.getContentLengthPlugin(this.config)),this.middlewareStack.use(Er.getHostHeaderPlugin(this.config)),this.middlewareStack.use(Qt.getLoggerPlugin(this.config)),this.middlewareStack.use(Zt.getRecursionDetectionPlugin(this.config)),this.middlewareStack.use(_.getHttpAuthSchemeEndpointRuleSetPlugin(this.config,{httpAuthSchemeParametersProvider:Pr.defaultSigninHttpAuthSchemeParametersProvider,identityProviderConfigProvider:async(Fr)=>new _.DefaultIdentityProviderConfig({"aws.auth#sigv4":Fr.credentials})})),this.middlewareStack.use(_.getHttpSigningPlugin(this.config))}destroy(){super.destroy()}}class re extends O.Command.classBuilder().ep(es).m(function(e,r,t,a){return[qr.getEndpointPlugin(t,e.getEndpointParameterInstructions())]}).s("Signin","CreateOAuth2Token",{}).n("SigninClient","CreateOAuth2TokenCommand").sc(D.CreateOAuth2Token$).build(){}var os={CreateOAuth2TokenCommand:re};class te extends ee{}O.createAggregatedClient(os,te);var ns={AUTHCODE_EXPIRED:"AUTHCODE_EXPIRED",INSUFFICIENT_PERMISSIONS:"INSUFFICIENT_PERMISSIONS",INVALID_REQUEST:"INVALID_REQUEST",SERVER_ERROR:"server_error",TOKEN_EXPIRED:"TOKEN_EXPIRED",USER_CREDENTIALS_CHANGED:"USER_CREDENTIALS_CHANGED"};v.$Command=O.Command;v.__Client=O.Client;v.SigninServiceException=Ct.SigninServiceException;v.CreateOAuth2TokenCommand=re;v.OAuth2ErrorCode=ns;v.Signin=te;v.SigninClient=ee;Object.prototype.hasOwnProperty.call(D,"__proto__")&&!Object.prototype.hasOwnProperty.call(v,"__proto__")&&Object.defineProperty(v,"__proto__",{enumerable:!0,value:D.__proto__});Object.keys(D).forEach(function(e){if(e!=="default"&&!Object.prototype.hasOwnProperty.call(v,e))v[e]=D[e]});Object.prototype.hasOwnProperty.call($,"__proto__")&&!Object.prototype.hasOwnProperty.call(v,"__proto__")&&Object.defineProperty(v,"__proto__",{enumerable:!0,value:$.__proto__});Object.keys($).forEach(function(e){if(e!=="default"&&!Object.prototype.hasOwnProperty.call(v,e))v[e]=$[e]})});export default vs();
+import{k as Nt}from"./chunk-xpyhmg45.js";import{A as Mt,B as Ut,C as wt,D as xt,E as pt,F as Xt,l as er,n as L,o as At,p as Wt,q as Yt,s as Hr,t as Lr,u as Rt,v as jt,w as ar,x as Bt,y as Jt,z as lr}from"./chunk-mhq2bd9c.js";import{G as Ft}from"./chunk-h3t4n0bn.js";import"./chunk-kh273hj0.js";import{I as Nr,J as at,L as Dt,P as He,T as M}from"./chunk-fq3sb3xt.js";import{U as zt}from"./chunk-661wezaf.js";import"./chunk-pj2e1p07.js";import{Y as ut}from"./chunk-00y49jcf.js";import{Z as lt}from"./chunk-wzqkdmjd.js";import"./chunk-eytdyahy.js";import"./chunk-8pynv9rw.js";import{ja as bt}from"./chunk-v52dyw0q.js";import{rh as p}from"./chunk-3s3awh38.js";var V=p((se)=>{Object.defineProperty(se,"__esModule",{value:!0});se.resolveHttpAuthSchemeConfig=se.defaultSigninHttpAuthSchemeProvider=se.defaultSigninHttpAuthSchemeParametersProvider=void 0;var Mr=L(),H=Nr(),Ur=async(e,r,t)=>{return{operation:(0,H.getSmithyContext)(r).operation,region:await(0,H.normalizeProvider)(e.region)()||(()=>{throw Error("expected `region` to be configured for `aws.auth#sigv4`")})()}};se.defaultSigninHttpAuthSchemeParametersProvider=Ur;function wr(e){return{schemeId:"aws.auth#sigv4",signingProperties:{name:"signin",region:e.region},propertiesExtractor:(r,t)=>({signingProperties:{config:r,context:t}})}}function xr(e){return{schemeId:"smithy.api#noAuth"}}var gr=(e)=>{let r=[];switch(e.operation){case"CreateOAuth2Token":{r.push(xr(e));break}default:r.push(wr(e))}return r};se.defaultSigninHttpAuthSchemeProvider=gr;var fr=(e)=>{let r=(0,Mr.resolveAwsSdkSigV4Config)(e);return Object.assign(r,{authSchemePreference:(0,H.normalizeProvider)(e.authSchemePreference??[])})};se.resolveHttpAuthSchemeConfig=fr});var Se=p((Ee)=>{Object.defineProperty(Ee,"__esModule",{value:!0});Ee.ruleSet=void 0;var ve="required",o="fn",n="argv",c="ref",ne=!0,ie="isSet",S="booleanEquals",I="error",E="endpoint",l="tree",N="PartitionResult",z="stringEquals",de={[ve]:!0,default:!1,type:"boolean"},ue={[ve]:!1,type:"string"},ae={[c]:"Endpoint"},A={[o]:S,[n]:[{[c]:"UseFIPS"},!0]},W={[o]:S,[n]:[{[c]:"UseDualStack"},!0]},s={},Y={[o]:"getAttr",[n]:[{[c]:N},"name"]},R={[o]:S,[n]:[{[c]:"UseFIPS"},!1]},F={[o]:S,[n]:[{[c]:"UseDualStack"},!1]},le={[o]:"getAttr",[n]:[{[c]:N},"supportsFIPS"]},pe={[o]:S,[n]:[!0,{[o]:"getAttr",[n]:[{[c]:N},"supportsDualStack"]}]},ce=[{[c]:"Region"}],hr={version:"1.0",parameters:{UseDualStack:de,UseFIPS:de,Endpoint:ue,Region:ue},rules:[{conditions:[{[o]:ie,[n]:[ae]}],rules:[{conditions:[A],error:"Invalid Configuration: FIPS and custom endpoint are not supported",type:I},{rules:[{conditions:[W],error:"Invalid Configuration: Dualstack and custom endpoint are not supported",type:I},{endpoint:{url:ae,properties:s,headers:s},type:E}],type:l}],type:l},{rules:[{conditions:[{[o]:ie,[n]:ce}],rules:[{conditions:[{[o]:"aws.partition",[n]:ce,assign:N}],rules:[{conditions:[{[o]:z,[n]:[Y,"aws"]},R,F],endpoint:{url:"https://{Region}.signin.aws.amazon.com",properties:s,headers:s},type:E},{conditions:[{[o]:z,[n]:[Y,"aws-cn"]},R,F],endpoint:{url:"https://{Region}.signin.amazonaws.cn",properties:s,headers:s},type:E},{conditions:[{[o]:z,[n]:[Y,"aws-us-gov"]},R,F],endpoint:{url:"https://{Region}.signin.amazonaws-us-gov.com",properties:s,headers:s},type:E},{conditions:[A,W],rules:[{conditions:[{[o]:S,[n]:[ne,le]},pe],rules:[{endpoint:{url:"https://signin-fips.{Region}.{PartitionResult#dualStackDnsSuffix}",properties:s,headers:s},type:E}],type:l},{error:"FIPS and DualStack are enabled, but this partition does not support one or both",type:I}],type:l},{conditions:[A,F],rules:[{conditions:[{[o]:S,[n]:[le,ne]}],rules:[{endpoint:{url:"https://signin-fips.{Region}.{PartitionResult#dnsSuffix}",properties:s,headers:s},type:E}],type:l},{error:"FIPS is enabled but this partition does not support FIPS",type:I}],type:l},{conditions:[R,W],rules:[{conditions:[pe],rules:[{endpoint:{url:"https://signin.{Region}.{PartitionResult#dualStackDnsSuffix}",properties:s,headers:s},type:E}],type:l},{error:"DualStack is enabled but this partition does not support DualStack",type:I}],type:l},{endpoint:{url:"https://signin.{Region}.{PartitionResult#dnsSuffix}",properties:s,headers:s},type:E}],type:l}],type:l},{error:"Invalid Configuration: Missing Region",type:I}],type:l}]};Ee.ruleSet=hr});var Ie=p((Pe)=>{Object.defineProperty(Pe,"__esModule",{value:!0});Pe.defaultEndpointResolver=void 0;var Vr=Lr(),j=Hr(),zr=Se(),Ar=new j.EndpointCache({size:50,params:["Endpoint","Region","UseDualStack","UseFIPS"]}),Wr=(e,r={})=>{return Ar.get(e,()=>(0,j.resolveEndpoint)(zr.ruleSet,{endpointParams:e,logger:r.logger}))};Pe.defaultEndpointResolver=Wr;j.customEndpointFunctions.aws=Vr.awsEndpointFunctions});var U=p((J)=>{Object.defineProperty(J,"__esModule",{value:!0});J.SigninServiceException=J.__ServiceException=void 0;var qe=M();Object.defineProperty(J,"__ServiceException",{enumerable:!0,get:function(){return qe.ServiceException}});class B extends qe.ServiceException{constructor(e){super(e);Object.setPrototypeOf(this,B.prototype)}}J.SigninServiceException=B});var k=p((be)=>{Object.defineProperty(be,"__esModule",{value:!0});be.ValidationException=be.TooManyRequestsError=be.InternalServerException=be.AccessDeniedException=void 0;var w=U();class X extends w.SigninServiceException{name="AccessDeniedException";$fault="client";error;constructor(e){super({name:"AccessDeniedException",$fault:"client",...e});Object.setPrototypeOf(this,X.prototype),this.error=e.error}}be.AccessDeniedException=X;class Q extends w.SigninServiceException{name="InternalServerException";$fault="server";error;constructor(e){super({name:"InternalServerException",$fault:"server",...e});Object.setPrototypeOf(this,Q.prototype),this.error=e.error}}be.InternalServerException=Q;class Z extends w.SigninServiceException{name="TooManyRequestsError";$fault="client";error;constructor(e){super({name:"TooManyRequestsError",$fault:"client",...e});Object.setPrototypeOf(this,Z.prototype),this.error=e.error}}be.TooManyRequestsError=Z;class K extends w.SigninServiceException{name="ValidationException";$fault="client";error;constructor(e){super({name:"ValidationException",$fault:"client",...e});Object.setPrototypeOf(this,K.prototype),this.error=e.error}}be.ValidationException=K});var C=p((We)=>{Object.defineProperty(We,"__esModule",{value:!0});We.CreateOAuth2Token$=We.CreateOAuth2TokenResponseBody$=We.CreateOAuth2TokenResponse$=We.CreateOAuth2TokenRequestBody$=We.CreateOAuth2TokenRequest$=We.AccessToken$=We.errorTypeRegistries=We.ValidationException$=We.TooManyRequestsError$=We.InternalServerException$=We.AccessDeniedException$=We.SigninServiceException$=void 0;var Jr="AccessDeniedException",Xr="AccessToken",Qr="CreateOAuth2Token",Zr="CreateOAuth2TokenRequest",Kr="CreateOAuth2TokenRequestBody",kr="CreateOAuth2TokenResponseBody",Tr="CreateOAuth2TokenResponse",mr="InternalServerException",Cr="RefreshToken",_r="TooManyRequestsError",et="ValidationException",Fe="accessKeyId",Ne="accessToken",T="client",Me="clientId",Ue="codeVerifier",rt="code",y="error",we="expiresIn",xe="grantType",tt="http",m="httpError",ge="idToken",d="jsonName",g="message",x="refreshToken",fe="redirectUri",Le="smithy.ts.sdk.synthetic.com.amazonaws.signin",Ge="secretAccessKey",$e="sessionToken",st="server",ot="tokenInput",nt="tokenOutput",he="tokenType",u="com.amazonaws.signin",Ve=He(),f=k(),it=U(),ze=Ve.TypeRegistry.for(Le);We.SigninServiceException$=[-3,Le,"SigninServiceException",0,[],[]];ze.registerError(We.SigninServiceException$,it.SigninServiceException);var q=Ve.TypeRegistry.for(u);We.AccessDeniedException$=[-3,u,Jr,{[y]:T},[y,g],[0,0],2];q.registerError(We.AccessDeniedException$,f.AccessDeniedException);We.InternalServerException$=[-3,u,mr,{[y]:st,[m]:500},[y,g],[0,0],2];q.registerError(We.InternalServerException$,f.InternalServerException);We.TooManyRequestsError$=[-3,u,_r,{[y]:T,[m]:429},[y,g],[0,0],2];q.registerError(We.TooManyRequestsError$,f.TooManyRequestsError);We.ValidationException$=[-3,u,et,{[y]:T,[m]:400},[y,g],[0,0],2];q.registerError(We.ValidationException$,f.ValidationException);We.errorTypeRegistries=[ze,q];var Ae=[0,u,Cr,8,0];We.AccessToken$=[3,u,Xr,8,[Fe,Ge,$e],[[0,{[d]:Fe}],[0,{[d]:Ge}],[0,{[d]:$e}]],3];We.CreateOAuth2TokenRequest$=[3,u,Zr,0,[ot],[[()=>We.CreateOAuth2TokenRequestBody$,16]],1];We.CreateOAuth2TokenRequestBody$=[3,u,Kr,0,[Me,xe,rt,fe,Ue,x],[[0,{[d]:Me}],[0,{[d]:xe}],0,[0,{[d]:fe}],[0,{[d]:Ue}],[()=>Ae,{[d]:x}]],2];We.CreateOAuth2TokenResponse$=[3,u,Tr,0,[nt],[[()=>We.CreateOAuth2TokenResponseBody$,16]],1];We.CreateOAuth2TokenResponseBody$=[3,u,kr,0,[Ne,he,we,x,ge],[[()=>We.AccessToken$,{[d]:Ne}],[0,{[d]:he}],[1,{[d]:we}],[()=>Ae,{[d]:x}],[0,{[d]:ge}]],4];We.CreateOAuth2Token$=[9,u,Qr,{[tt]:["POST","/v1/token",200]},()=>We.CreateOAuth2TokenRequest$,()=>We.CreateOAuth2TokenResponse$]});var sr=p((rr)=>{Object.defineProperty(rr,"__esModule",{value:!0});rr.getRuntimeConfig=void 0;var ct=L(),vt=pt(),Et=er(),yt=M(),St=lt(),Ce=at(),_e=ut(),Pt=V(),Ot=Ie(),It=C(),qt=(e)=>{return{apiVersion:"2023-01-01",base64Decoder:e?.base64Decoder??Ce.fromBase64,base64Encoder:e?.base64Encoder??Ce.toBase64,disableHostPrefix:e?.disableHostPrefix??!1,endpointProvider:e?.endpointProvider??Ot.defaultEndpointResolver,extensions:e?.extensions??[],httpAuthSchemeProvider:e?.httpAuthSchemeProvider??Pt.defaultSigninHttpAuthSchemeProvider,httpAuthSchemes:e?.httpAuthSchemes??[{schemeId:"aws.auth#sigv4",identityProvider:(r)=>r.getIdentityProvider("aws.auth#sigv4"),signer:new ct.AwsSdkSigV4Signer},{schemeId:"smithy.api#noAuth",identityProvider:(r)=>r.getIdentityProvider("smithy.api#noAuth")||(async()=>({})),signer:new Et.NoAuthSigner}],logger:e?.logger??new yt.NoOpLogger,protocol:e?.protocol??vt.AwsRestJsonProtocol,protocolSettings:e?.protocolSettings??{defaultNamespace:"com.amazonaws.signin",errorTypeRegistries:It.errorTypeRegistries,version:"2023-01-01",serviceTarget:"Signin"},serviceId:e?.serviceId??"Signin",urlParser:e?.urlParser??St.parseUrl,utf8Decoder:e?.utf8Decoder??_e.fromUtf8,utf8Encoder:e?.utf8Encoder??_e.toUtf8}};rr.getRuntimeConfig=qt});var vr=p((pr)=>{Object.defineProperty(pr,"__esModule",{value:!0});pr.getRuntimeConfig=void 0;var gt=bt(),ft=gt.__importDefault(Nt()),or=L(),nr=Mt(),G=ar(),Gt=Ut(),ir=lr(),P=Ft(),dr=Dt(),ur=M(),$t=wt(),ht=xt(),Ht=Rt(),Lt=sr(),Vt=(e)=>{(0,ur.emitWarningIfUnsupportedVersion)(process.version);let r=(0,ht.resolveDefaultsModeConfig)(e),t=()=>r().then(ur.loadConfigsForDefaultMode),a=(0,Lt.getRuntimeConfig)(e);(0,or.emitWarningIfUnsupportedVersion)(process.version);let i={profile:e?.profile,logger:a.logger};return{...a,...e,runtime:"node",defaultsMode:r,authSchemePreference:e?.authSchemePreference??(0,P.loadConfig)(or.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS,i),bodyLengthChecker:e?.bodyLengthChecker??$t.calculateBodyLength,defaultUserAgentProvider:e?.defaultUserAgentProvider??(0,nr.createDefaultUserAgentProvider)({serviceId:a.serviceId,clientVersion:ft.default.version}),maxAttempts:e?.maxAttempts??(0,P.loadConfig)(ir.NODE_MAX_ATTEMPT_CONFIG_OPTIONS,e),region:e?.region??(0,P.loadConfig)(G.NODE_REGION_CONFIG_OPTIONS,{...G.NODE_REGION_CONFIG_FILE_OPTIONS,...i}),requestHandler:dr.NodeHttpHandler.create(e?.requestHandler??t),retryMode:e?.retryMode??(0,P.loadConfig)({...ir.NODE_RETRY_MODE_CONFIG_OPTIONS,default:async()=>(await t()).retryMode||Ht.DEFAULT_RETRY_MODE},e),sha256:e?.sha256??Gt.Hash.bind(null,"sha256"),streamCollector:e?.streamCollector??dr.streamCollector,useDualstackEndpoint:e?.useDualstackEndpoint??(0,P.loadConfig)(G.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS,i),useFipsEndpoint:e?.useFipsEndpoint??(0,P.loadConfig)(G.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS,i),userAgentAppId:e?.userAgentAppId??(0,P.loadConfig)(nr.NODE_APP_ID_CONFIG_OPTIONS,i)}};pr.getRuntimeConfig=Vt});var vs=p((v)=>{var Er=At(),Qt=Wt(),Zt=Yt(),yr=jt(),Kt=ar(),_=er(),kt=He(),Tt=Bt(),qr=Jt(),Sr=lr(),O=M(),Pr=V(),mt=vr(),Or=Xt(),Ir=zt(),D=C(),$=k(),Ct=U(),_t=(e)=>{return Object.assign(e,{useDualstackEndpoint:e.useDualstackEndpoint??!1,useFipsEndpoint:e.useFipsEndpoint??!1,defaultSigningName:"signin"})},es={UseFIPS:{type:"builtInParams",name:"useFipsEndpoint"},Endpoint:{type:"builtInParams",name:"endpoint"},Region:{type:"builtInParams",name:"region"},UseDualStack:{type:"builtInParams",name:"useDualstackEndpoint"}},rs=(e)=>{let{httpAuthSchemes:r,httpAuthSchemeProvider:t,credentials:a}=e;return{setHttpAuthScheme(i){let b=r.findIndex((h)=>h.schemeId===i.schemeId);if(b===-1)r.push(i);else r.splice(b,1,i)},httpAuthSchemes(){return r},setHttpAuthSchemeProvider(i){t=i},httpAuthSchemeProvider(){return t},setCredentials(i){a=i},credentials(){return a}}},ts=(e)=>{return{httpAuthSchemes:e.httpAuthSchemes(),httpAuthSchemeProvider:e.httpAuthSchemeProvider(),credentials:e.credentials()}},ss=(e,r)=>{let t=Object.assign(Or.getAwsRegionExtensionConfiguration(e),O.getDefaultExtensionConfiguration(e),Ir.getHttpHandlerExtensionConfiguration(e),rs(e));return r.forEach((a)=>a.configure(t)),Object.assign(e,Or.resolveAwsRegionExtensionConfiguration(t),O.resolveDefaultRuntimeConfig(t),Ir.resolveHttpHandlerRuntimeConfig(t),ts(t))};class ee extends O.Client{config;constructor(...[e]){let r=mt.getRuntimeConfig(e||{});super(r);this.initConfig=r;let t=_t(r),a=yr.resolveUserAgentConfig(t),i=Sr.resolveRetryConfig(a),b=Kt.resolveRegionConfig(i),h=Er.resolveHostHeaderConfig(b),Dr=qr.resolveEndpointConfig(h),br=Pr.resolveHttpAuthSchemeConfig(Dr),Rr=ss(br,e?.extensions||[]);this.config=Rr,this.middlewareStack.use(kt.getSchemaSerdePlugin(this.config)),this.middlewareStack.use(yr.getUserAgentPlugin(this.config)),this.middlewareStack.use(Sr.getRetryPlugin(this.config)),this.middlewareStack.use(Tt.getContentLengthPlugin(this.config)),this.middlewareStack.use(Er.getHostHeaderPlugin(this.config)),this.middlewareStack.use(Qt.getLoggerPlugin(this.config)),this.middlewareStack.use(Zt.getRecursionDetectionPlugin(this.config)),this.middlewareStack.use(_.getHttpAuthSchemeEndpointRuleSetPlugin(this.config,{httpAuthSchemeParametersProvider:Pr.defaultSigninHttpAuthSchemeParametersProvider,identityProviderConfigProvider:async(Fr)=>new _.DefaultIdentityProviderConfig({"aws.auth#sigv4":Fr.credentials})})),this.middlewareStack.use(_.getHttpSigningPlugin(this.config))}destroy(){super.destroy()}}class re extends O.Command.classBuilder().ep(es).m(function(e,r,t,a){return[qr.getEndpointPlugin(t,e.getEndpointParameterInstructions())]}).s("Signin","CreateOAuth2Token",{}).n("SigninClient","CreateOAuth2TokenCommand").sc(D.CreateOAuth2Token$).build(){}var os={CreateOAuth2TokenCommand:re};class te extends ee{}O.createAggregatedClient(os,te);var ns={AUTHCODE_EXPIRED:"AUTHCODE_EXPIRED",INSUFFICIENT_PERMISSIONS:"INSUFFICIENT_PERMISSIONS",INVALID_REQUEST:"INVALID_REQUEST",SERVER_ERROR:"server_error",TOKEN_EXPIRED:"TOKEN_EXPIRED",USER_CREDENTIALS_CHANGED:"USER_CREDENTIALS_CHANGED"};v.$Command=O.Command;v.__Client=O.Client;v.SigninServiceException=Ct.SigninServiceException;v.CreateOAuth2TokenCommand=re;v.OAuth2ErrorCode=ns;v.Signin=te;v.SigninClient=ee;Object.prototype.hasOwnProperty.call(D,"__proto__")&&!Object.prototype.hasOwnProperty.call(v,"__proto__")&&Object.defineProperty(v,"__proto__",{enumerable:!0,value:D.__proto__});Object.keys(D).forEach(function(e){if(e!=="default"&&!Object.prototype.hasOwnProperty.call(v,e))v[e]=D[e]});Object.prototype.hasOwnProperty.call($,"__proto__")&&!Object.prototype.hasOwnProperty.call(v,"__proto__")&&Object.defineProperty(v,"__proto__",{enumerable:!0,value:$.__proto__});Object.keys($).forEach(function(e){if(e!=="default"&&!Object.prototype.hasOwnProperty.call(v,e))v[e]=$[e]})});export default vs();
 
-//# debugId=FABA39199756D29864756E2164756E21
+//# debugId=D1DC1D1056690D8D64756E2164756E21