gemi 0.115.0 → 0.117.0

package/dist/bun/plugin.js

@@ -1,4 +1,4 @@
 // @bun
-import{da as a}from"../chunk-e573yxpq.js";import"../chunk-gts5p6mw.js";import"../chunk-9n1hx3mq.js";import"../chunk-hdps9n52.js";import"../chunk-vw8849ys.js";export{a as gemiPlugin};
+import{ea as a}from"../chunk-e7ezmag9.js";import"../chunk-ge9xjwgq.js";import"../chunk-hr61ekcr.js";import"../chunk-x7qwx07b.js";import"../chunk-dcgvq79a.js";export{a as gemiPlugin};
 
-//# debugId=255F25075168278464756E2164756E21
+//# debugId=2B4506B393745EFE64756E2164756E21

package/dist/bun/plugin.js.map

@@ -4,6 +4,6 @@
   "sourcesContent": [
   ],
   "mappings": "",
-  "debugId": "255F25075168278464756E2164756E21",
+  "debugId": "2B4506B393745EFE64756E2164756E21",
   "names": []
 }

package/dist/bun/preload.js

@@ -1,4 +1,4 @@
 // @bun
-import{da as k}from"../chunk-e573yxpq.js";import"../chunk-gts5p6mw.js";import"../chunk-9n1hx3mq.js";import"../chunk-hdps9n52.js";import{xa as j}from"../chunk-303mprnv.js";import"../chunk-vw8849ys.js";var{plugin:q}=globalThis.Bun;q(k());var y=await j(process.cwd());for(let x of y.bun?.plugins??[])q(x);
+import{ea as k}from"../chunk-e7ezmag9.js";import"../chunk-ge9xjwgq.js";import"../chunk-hr61ekcr.js";import"../chunk-x7qwx07b.js";import{ya as j}from"../chunk-r3v2cnrj.js";import"../chunk-dcgvq79a.js";var{plugin:q}=globalThis.Bun;q(k());var y=await j(process.cwd());for(let x of y.bun?.plugins??[])q(x);
 
-//# debugId=E7ABFC04ABC989B264756E2164756E21
+//# debugId=4C9148510A2605D864756E2164756E21

package/dist/bun/preload.js.map

@@ -5,6 +5,6 @@
     "import { plugin } from \"bun\";\nimport { gemiPlugin } from \"./plugin\";\nimport { loadGemiConfig } from \"../config/load\";\n\n// Registers gemi's custom-request transform plus any Bun plugins the app\n// declares in `gemi.config.ts` as Bun *runtime* plugins. Loaded via\n// `bun --hot|--preload gemi/bun/preload app/server.ts` (see the `dev`/`start`\n// commands in `bin/gemi.ts`) so controllers/routes are transformed on import —\n// the runtime counterpart to the same plugins passed to `Bun.build` in the\n// server build. Top-level `await` here completes before app code loads.\nplugin(gemiPlugin());\n\nconst config = await loadGemiConfig(process.cwd());\nfor (const p of config.bun?.plugins ?? []) {\n  plugin(p);\n}\n"
   ],
   "mappings": ";iOAAA,wBAUA,HAAO,HAAW,JAAC,HAEnB,IAAM,EAAS,MAAM,EAAe,QAAQ,IAAI,CAAC,EACjD,QAAW,KAAK,EAAO,KAAK,SAAW,CAAC,EACtC,EAAO,CAAC",
-  "debugId": "E7ABFC04ABC989B264756E2164756E21",
+  "debugId": "4C9148510A2605D864756E2164756E21",
   "names": []
 }

package/dist/chunk-00n3gwr8.js

@@ -0,0 +1,71 @@
+// @bun
+import{Vg as R}from"./chunk-fa37qzm3.js";import{Bh as L}from"./chunk-jpetnpzn.js";import{gi as T}from"./chunk-5w6kyxsj.js";import{Gi as D}from"./chunk-076jezzg.js";class X{rows=new Map;async find(j,B){for(let G of this.rows.values())if(G.userId===j&&G.provider===B)return{...G};return null}async list(j){return[...this.rows.values()].filter((B)=>B.userId===j).map((B)=>({...B}))}async save(j,B,G){let K=await this.find(j,B),J=new Date,Q={id:K?.id??Bun.randomUUIDv7(),userId:j,provider:B,...P(G),needsReconnect:!1,revision:(K?.revision??0)+1,createdAt:K?.createdAt??J,updatedAt:J};return this.rows.set(Q.id,Q),{...Q}}async updateTokens(j,B,G){let K=this.rows.get(j);if(!K||K.revision!==B)return null;let J={...K,...P(G),needsReconnect:!1,revision:B+1,updatedAt:new Date};return this.rows.set(j,J),{...J}}async markNeedsReconnect(j){let B=this.rows.get(j);if(B)this.rows.set(j,{...B,needsReconnect:!0,updatedAt:new Date})}async delete(j){this.rows.delete(j)}}class F{encrypter;table;sql;dialect;constructor(j,B,G={}){this.encrypter=B;let K=G.table??"gemi_oauth_connections";if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(K))throw Error(`The connections table name "${K}" is not a plain identifier.`);this.table=K,this.sql=j.sql,this.dialect=j.dialect}async createTable(){for(let j of A(this.dialect,this.table))await this.sql.unsafe(j)}async find(j,B){let G=this.sql,K=await G`
+      SELECT * FROM ${this.name(G)} WHERE user_id = ${j} AND provider = ${B}
+    `;return K[0]?this.decode(K[0]):null}async list(j){let B=this.sql;return(await B`
+      SELECT * FROM ${this.name(B)} WHERE user_id = ${j} ORDER BY provider
+    `).map((K)=>this.decode(K))}async save(j,B,G){let K=this.sql,J=this.encode(G),Q=Date.now(),V=async()=>x(await K`
+          UPDATE ${this.name(K)}
+          SET provider_account_id = ${J.providerAccountId}, scopes = ${J.scopes},
+              access_token = ${J.accessToken}, refresh_token = ${J.refreshToken},
+              token_type = ${J.tokenType}, expires_at = ${J.expiresAt},
+              needs_reconnect = 0, revision = revision + 1, updated_at = ${Q}
+          WHERE user_id = ${j} AND provider = ${B}
+        `);if(await V()===0)try{await K`
+          INSERT INTO ${this.name(K)} (id, user_id, provider, provider_account_id, scopes,
+            access_token, refresh_token, token_type, expires_at, needs_reconnect, revision,
+            created_at, updated_at)
+          VALUES (${Bun.randomUUIDv7()}, ${j}, ${B}, ${J.providerAccountId},
+            ${J.scopes}, ${J.accessToken}, ${J.refreshToken}, ${J.tokenType},
+            ${J.expiresAt}, 0, 1, ${Q}, ${Q})
+        `}catch(W){if(await V()===0)throw W}let Z=await this.find(j,B);if(!Z)throw Error("The OAuth connection vanished while it was being saved.");return Z}async updateTokens(j,B,G){let K=this.sql,J=this.encode(G),Q=await K`
+      UPDATE ${this.name(K)}
+      SET provider_account_id = COALESCE(${J.providerAccountId}, provider_account_id),
+          scopes = ${J.scopes}, access_token = ${J.accessToken},
+          refresh_token = ${J.refreshToken}, token_type = ${J.tokenType},
+          expires_at = ${J.expiresAt}, needs_reconnect = 0, revision = revision + 1,
+          updated_at = ${Date.now()}
+      WHERE id = ${j} AND revision = ${B}
+    `;if(x(Q)===0)return null;let V=await K`SELECT * FROM ${this.name(K)} WHERE id = ${j}`;return V[0]?this.decode(V[0]):null}async markNeedsReconnect(j){let B=this.sql;await B`UPDATE ${this.name(B)} SET needs_reconnect = 1, updated_at = ${Date.now()} WHERE id = ${j}`}async delete(j){let B=this.sql;await B`DELETE FROM ${this.name(B)} WHERE id = ${j}`}async rotateEncryption(j={}){let B=this.sql,G=this.encrypter(),K=await B`
+      SELECT id, access_token, refresh_token, revision FROM ${this.name(B)} ORDER BY id
+    `,J=0;for(let Q of K){let V=(W)=>typeof W==="string"&&G.needsReencryption(W);if(!V(Q.access_token)&&!V(Q.refresh_token))continue;if(J+=1,j.dryRun)continue;let Z=(W)=>W===null?null:G.encrypt(G.decrypt(W));await B`
+        UPDATE ${this.name(B)}
+        SET access_token = ${Z(Q.access_token)}, refresh_token = ${Z(Q.refresh_token)},
+            revision = revision + 1
+        WHERE id = ${Q.id} AND revision = ${Number(Q.revision)}
+      `}return{scanned:K.length,rotated:J}}encode(j){let B=this.encrypter();return{providerAccountId:j.providerAccountId,scopes:j.scopes.join(" "),accessToken:B.encrypt(j.accessToken),refreshToken:j.refreshToken===null?null:B.encrypt(j.refreshToken),tokenType:j.tokenType,expiresAt:j.expiresAt===null?null:j.expiresAt.getTime()}}decode(j){let B=this.encrypter();return{id:String(j.id),userId:String(j.user_id),provider:String(j.provider),providerAccountId:j.provider_account_id===null?null:String(j.provider_account_id),scopes:String(j.scopes??"").split(" ").filter(Boolean),accessToken:B.decrypt(String(j.access_token)),refreshToken:j.refresh_token===null?null:B.decrypt(String(j.refresh_token)),tokenType:j.token_type===null?null:String(j.token_type),expiresAt:j.expires_at===null?null:new Date(Number(j.expires_at)),needsReconnect:Number(j.needs_reconnect)===1,revision:Number(j.revision),createdAt:new Date(Number(j.created_at)),updatedAt:new Date(Number(j.updated_at))}}get mysql(){return this.dialect==="mysql"||this.dialect==="mariadb"}name(j){return j.unsafe(this.mysql?`\`${this.table}\``:`"${this.table}"`)}}function P(j){return{providerAccountId:j.providerAccountId,scopes:[...j.scopes],accessToken:j.accessToken,refreshToken:j.refreshToken,tokenType:j.tokenType,expiresAt:j.expiresAt}}function x(j){let B=j;return Math.max(Number(B.count??0),Number(B.affectedRows??0))}function A(j,B){if(j==="mysql"||j==="mariadb")return[`CREATE TABLE IF NOT EXISTS \`${B}\` (
+    \`id\` VARCHAR(191) NOT NULL,
+    \`user_id\` VARCHAR(191) NOT NULL,
+    \`provider\` VARCHAR(191) NOT NULL,
+    \`provider_account_id\` VARCHAR(191) NULL,
+    \`scopes\` TEXT NOT NULL,
+    \`access_token\` TEXT NOT NULL,
+    \`refresh_token\` TEXT NULL,
+    \`token_type\` VARCHAR(191) NULL,
+    \`expires_at\` BIGINT NULL,
+    \`needs_reconnect\` INTEGER NOT NULL DEFAULT 0,
+    \`revision\` BIGINT NOT NULL DEFAULT 0,
+    \`created_at\` BIGINT NOT NULL,
+    \`updated_at\` BIGINT NOT NULL,
+
+    UNIQUE INDEX \`${B}_user_id_provider_key\`(\`user_id\`, \`provider\`),
+    PRIMARY KEY (\`id\`)
+) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci`];let G=j==="sqlite"?'"id" TEXT NOT NULL PRIMARY KEY,':'"id" TEXT NOT NULL,',K=j==="sqlite"?"":`,
+
+    CONSTRAINT "${B}_pkey" PRIMARY KEY ("id")`;return[`CREATE TABLE IF NOT EXISTS "${B}" (
+    ${G}
+    "user_id" TEXT NOT NULL,
+    "provider" TEXT NOT NULL,
+    "provider_account_id" TEXT,
+    "scopes" TEXT NOT NULL,
+    "access_token" TEXT NOT NULL,
+    "refresh_token" TEXT,
+    "token_type" TEXT,
+    "expires_at" BIGINT,
+    "needs_reconnect" INTEGER NOT NULL DEFAULT 0,
+    "revision" BIGINT NOT NULL DEFAULT 0,
+    "created_at" BIGINT NOT NULL,
+    "updated_at" BIGINT NOT NULL${K}
+)`,`CREATE UNIQUE INDEX IF NOT EXISTS "${B}_user_id_provider_key" ON "${B}"("user_id", "provider")`]}class Y extends Error{code;status;providerError;constructor(j,B,G={}){super(B,G.cause!==void 0?{cause:G.cause}:void 0);this.code=j;this.name="OAuthConnectionError",this.status=G.status,this.providerError=G.providerError}}class _ extends Y{provider;constructor(j,B={}){super("reconnect_required",`The ${j} connection needs to be reconnected: its tokens were refused and could not be refreshed.`,B);this.provider=j;this.name="OAuthReconnectRequiredError"}}class O{config;constructor(j){for(let B of["authorizeUrl","tokenUrl"])H(B,j[B]);if(j.revokeUrl!==void 0)H("revokeUrl",j.revokeUrl);if(j.apiBaseUrl===void 0||j.apiBaseUrl===null||j.apiBaseUrl==="")throw Error(`OAuthConnectionProvider: apiBaseUrl is required. Set it to the provider's API origin (e.g. apiBaseUrl: "https://api.figma.com"); connection.fetch only sends the token there.`);H("apiBaseUrl",j.apiBaseUrl),this.config={scopeSeparator:" ",clientAuth:"body",pkce:!0,authorizationParams:{},refreshLeewaySeconds:60,...j}}authorizationUrl(j){let B=new URL(this.config.authorizeUrl),G={...this.config.authorizationParams,response_type:"code",client_id:this.config.clientId,redirect_uri:j.redirectUri,scope:this.config.scopes.join(this.config.scopeSeparator),state:j.state};if(this.config.pkce)G.code_challenge=j.codeChallenge,G.code_challenge_method="S256";for(let[K,J]of Object.entries(G))B.searchParams.set(K,J);return B.toString()}exchangeCode(j){let B=new URLSearchParams({grant_type:"authorization_code",code:j.code,redirect_uri:j.redirectUri});if(this.config.pkce)B.set("code_verifier",j.codeVerifier);return this.tokenRequest(B,{scopes:this.config.scopes,refreshToken:null,phase:"exchange"})}refresh(j,B){let G=new URLSearchParams({grant_type:"refresh_token",refresh_token:j});return this.tokenRequest(G,{scopes:B,refreshToken:j,phase:"refresh"})}async revoke(j,B){if(!this.config.revokeUrl)throw new Y("revoke_unsupported","This provider has no revokeUrl configured. Use disconnect() to forget the tokens locally.");let G=new URLSearchParams({token:j,token_type_hint:B}),K;try{K=await fetch(this.config.revokeUrl,this.post(G))}catch(J){throw new Y("revoke_failed","The revocation request failed.",{cause:J})}if(!K.ok)throw new Y("revoke_failed",`The provider refused the revocation (HTTP ${K.status}).`,{status:K.status})}post(j){let B={"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"};if(this.config.clientAuth==="basic"){let G=`${encodeURIComponent(this.config.clientId)}:${encodeURIComponent(this.config.clientSecret)}`;B.Authorization=`Basic ${Buffer.from(G).toString("base64")}`}else j.set("client_id",this.config.clientId),j.set("client_secret",this.config.clientSecret);return{method:"POST",headers:B,body:j.toString(),redirect:"error"}}async tokenRequest(j,B){let G=B.phase==="exchange"?"exchange_failed":"refresh_failed",K;try{K=await fetch(this.config.tokenUrl,this.post(j))}catch(W){throw new Y(G,"The token request failed.",{cause:W})}let J=await K.json().catch(()=>({}));if(!K.ok||typeof J.access_token!=="string"||J.access_token===""){let W=typeof J.error==="string"&&/^[a-z0-9_]{1,64}$/.test(J.error)?J.error:void 0;throw new Y(G,`The token endpoint refused the ${B.phase==="exchange"?"code":"refresh token"} (HTTP ${K.status}${W?`, ${W}`:""}).`,{status:K.status,providerError:W})}let Q=Number(J.expires_in),V=typeof J.scope==="string"?J.scope:void 0,Z=J.user_id??J.account_id;return{accessToken:J.access_token,refreshToken:typeof J.refresh_token==="string"&&J.refresh_token!==""?J.refresh_token:B.refreshToken,tokenType:typeof J.token_type==="string"?J.token_type:null,expiresAt:Number.isFinite(Q)&&Q>0?new Date(Date.now()+Q*1000):null,scopes:V!==void 0?V.split(/[\s,]+/).filter(Boolean):B.scopes,providerAccountId:typeof Z==="string"||typeof Z==="number"?String(Z):null}}}function H(j,B){let G;try{G=new URL(String(B))}catch{G=void 0}if(!G||G.protocol!=="https:"&&!(G.protocol==="http:"&&U(G.hostname)))throw Error(`OAuthConnectionProvider: ${j} must be an https URL (http only for localhost), got ${JSON.stringify(B)}.`)}function U(j){return j==="localhost"||j==="127.0.0.1"||j==="[::1]"||j==="::1"}class E{options;static token="auth.connections";resolvedStore;refreshing=new Map;fakes;fakeStore;fakeRequests=[];constructor(j){this.options=j}get providers(){return this.options.providers}get store(){if(this.fakeStore)return this.fakeStore;if(!this.resolvedStore){let j=this.options.store;this.resolvedStore=typeof j==="function"?j():j??new F(D(T).connection(),()=>R())}return this.resolvedStore}provider(j){let B=this.options.providers[j];if(!B){let G=Object.keys(this.options.providers);throw new Y("unknown_provider",`No OAuth connection provider "${j}" in auth.connections`+(G.length>0?` (configured: ${G.join(", ")}).`:" (none are configured)."))}return B}async for(j,B){this.provider(B);let G=await this.store.find(z(j),B);return G?new N(this,G):null}async list(j){return(await this.store.list(z(j))).filter((G)=>(G.provider in this.options.providers)).map((G)=>new N(this,G))}async save(j,B,G){let K=this.provider(B),J=await this.store.save(z(j),B,{refreshToken:null,tokenType:null,expiresAt:null,providerAccountId:null,scopes:K.config.scopes,...G});return new N(this,J)}fake(j={}){return this.fakes=new Map(Object.entries(j)),this.fakeStore=new X,this.fakeRequests.length=0,this}restore(){this.fakes=void 0,this.fakeStore=void 0,this.fakeRequests.length=0}get faked(){return this.fakes!==void 0}async send(j,B){if(!this.fakes)return fetch(B);this.fakeRequests.push(B.clone());let G=this.fakes.get(j);if(!G)throw Error(`Connections.fake() has no handler for "${j}". Pass one: Connections.fake({ ${j}: (req) => ... }).`);return G(B)}refresh(j){let B=this.refreshing.get(j.id);if(B)return B;let G=this.withLock(j.id,()=>this.refreshOnce(j)).finally(()=>this.refreshing.delete(j.id));return this.refreshing.set(j.id,G),G}async refreshOnce(j){let B=await this.store.find(j.userId,j.provider);if(!B||B.id!==j.id)throw new _(j.provider);if(B.revision!==j.revision&&!B.needsReconnect)return B;if(B.needsReconnect)throw new _(j.provider);let G=this.provider(B.provider);if(this.faked||B.refreshToken===null){if(this.faked)return B;throw await this.store.markNeedsReconnect(B.id),new _(B.provider)}let K;try{K=await G.refresh(B.refreshToken,B.scopes)}catch(V){if(V instanceof Y&&V.status!==void 0&&V.status>=400&&V.status<500)throw await this.store.markNeedsReconnect(B.id),new _(B.provider,{cause:V,status:V.status,providerError:V.providerError});throw V}let J=await this.store.updateTokens(B.id,B.revision,K);if(J)return J;let Q=await this.store.find(B.userId,B.provider);if(!Q)throw new _(B.provider);return Q}async withLock(j,B){let G=D();if(this.faked||!G.bound(L))return B();let K=await G.make(L).run(`gemi:oauth-connection:${j}`,{ttl:30000,wait:20000},()=>B());if(!K.acquired)throw new Y("refresh_failed","Timed out waiting for another refresh of this connection to finish.");return K.value}}class N{manager;record;constructor(j,B){this.manager=j;this.record=B}get provider(){return this.record.provider}get userId(){return this.record.userId}get providerAccountId(){return this.record.providerAccountId}get scopes(){return this.record.scopes}get expiresAt(){return this.record.expiresAt}get needsReconnect(){return this.record.needsReconnect}get connectedAt(){return this.record.createdAt}hasScopes(...j){return j.every((B)=>this.record.scopes.includes(B))}async fetch(j,B={}){let G=this.resolveUrl(j),K=await this.current(),J=await this.send(G,B,K.accessToken);if(J.response.status!==401||!J.authorized||B.body instanceof ReadableStream)return J.response;await J.response.body?.cancel().catch(()=>{});let Q=await this.refreshFrom(K);return(await this.send(G,B,Q.accessToken)).response}async accessToken(){return(await this.current()).accessToken}async refresh(){await this.refreshFrom(this.record)}async revoke(){if(!this.manager.faked){let j=this.manager.provider(this.record.provider);if(this.record.refreshToken!==null)await j.revoke(this.record.refreshToken,"refresh_token");else await j.revoke(this.record.accessToken,"access_token")}await this.manager.store.delete(this.record.id)}async disconnect(){await this.manager.store.delete(this.record.id)}toJSON(){return{provider:this.provider,providerAccountId:this.providerAccountId,scopes:[...this.scopes],expiresAt:this.expiresAt,needsReconnect:this.needsReconnect,connectedAt:this.connectedAt}}[Symbol.for("nodejs.util.inspect.custom")](){return{ProviderConnection:this.toJSON()}}async current(){if(this.record.needsReconnect)throw new _(this.record.provider);let j=this.manager.provider(this.record.provider).config.refreshLeewaySeconds*1000,B=this.record.expiresAt?.getTime();if(B!==void 0&&B-Date.now()<=j)return this.refreshFrom(this.record);return this.record}async refreshFrom(j){try{this.record=await this.manager.refresh(j)}catch(B){if(B instanceof _)this.record={...this.record,needsReconnect:!0};throw B}return this.record}resolveUrl(j){let B=this.manager.provider(this.record.provider).config.apiBaseUrl,G;try{G=new URL(String(j),B)}catch{throw new Y("forbidden_url",`connection.fetch was given ${JSON.stringify(String(j))}, which is not a URL.`)}if(G.origin!==new URL(B).origin)throw new Y("forbidden_url",`connection.fetch only sends the ${this.record.provider} token to ${new URL(B).origin} (apiBaseUrl), not to ${G.origin}.`);if(G.protocol!=="https:"&&!(G.protocol==="http:"&&U(G.hostname)))throw new Y("forbidden_url",`connection.fetch only sends a token over https, not to ${G.origin}.`);return G}async send(j,B,G){let K=j,J=(B.method??"GET").toUpperCase(),Q=B.body,V=!0;if(B.redirect==="manual"||B.redirect==="error")return{response:await this.manager.send(this.record.provider,this.request(K,B,J,Q,G)),authorized:V};for(let Z=0;;Z++){let W=this.request(K,{...B,redirect:"manual"},J,Q,V?G:null),$=await this.manager.send(this.record.provider,W),M=$.headers.get("location");if(!C.has($.status)||M===null||Z>=5)return{response:$,authorized:V};await $.body?.cancel().catch(()=>{});let S=new URL(M,K);if(S.origin!==K.origin)V=!1;if($.status===303||($.status===301||$.status===302)&&J==="POST")J="GET",Q=void 0;K=S}}request(j,B,G,K,J){let Q=new Headers(B.headers);if(J===null)Q.delete("authorization");else Q.set("Authorization",`Bearer ${J}`);return new Request(j,{...B,method:G,body:K,headers:Q})}}var C=new Set([301,302,303,307,308]);function z(j){let B=typeof j==="object"&&j!==null?j.id:j;if(B===void 0||B===null||B==="")throw TypeError("An OAuth connection belongs to a user: pass the user (or its id).");return String(B)}
+export{X as Eg,F as Fg,Y as Gg,_ as Hg,O as Ig,E as Jg,N as Kg};
+
+//# debugId=BEC29388D06EAD9164756E2164756E21

package/dist/chunk-00n3gwr8.js.map

@@ -0,0 +1,13 @@
+{
+  "version": 3,
+  "sources": ["../auth/connections/ConnectionStore.ts", "../auth/connections/errors.ts", "../auth/connections/OAuthConnectionProvider.ts", "../auth/connections/ConnectionManager.ts"],
+  "sourcesContent": [
+    "import type { SQL } from \"bun\";\n\nimport type { DatabaseConnection } from \"../../database/Connection\";\nimport type { Dialect } from \"../../database/dialect\";\nimport type { Encrypter } from \"../../services/encryption/Encrypter\";\nimport type { OAuthTokenSet } from \"./OAuthConnectionProvider\";\n\n/** One stored connection, tokens decrypted. Lives only inside the framework. */\nexport interface ConnectionRecord {\n  id: string;\n  userId: string;\n  provider: string;\n  providerAccountId: string | null;\n  scopes: string[];\n  accessToken: string;\n  refreshToken: string | null;\n  tokenType: string | null;\n  expiresAt: Date | null;\n  needsReconnect: boolean;\n  /** Bumped on every token change: the compare-and-swap that serialises refreshes. */\n  revision: number;\n  createdAt: Date;\n  updatedAt: Date;\n}\n\n/** Where connections are kept. `DatabaseConnectionStore` in an app, `MemoryConnectionStore` in tests. */\nexport interface ConnectionStore {\n  find(userId: string, provider: string): Promise<ConnectionRecord | null>;\n  list(userId: string): Promise<ConnectionRecord[]>;\n  /** Stores a fresh grant, replacing any connection the user had to this provider. */\n  save(userId: string, provider: string, tokens: OAuthTokenSet): Promise<ConnectionRecord>;\n  /**\n   * Replaces the tokens of the connection at `revision`, or resolves `null`\n   * when it has moved on (another request refreshed it first) or is gone.\n   */\n  updateTokens(id: string, revision: number, tokens: OAuthTokenSet): Promise<ConnectionRecord | null>;\n  markNeedsReconnect(id: string): Promise<void>;\n  delete(id: string): Promise<void>;\n}\n\nexport class MemoryConnectionStore implements ConnectionStore {\n  private readonly rows = new Map<string, ConnectionRecord>();\n\n  async find(userId: string, provider: string) {\n    for (const row of this.rows.values()) {\n      if (row.userId === userId && row.provider === provider) return { ...row };\n    }\n    return null;\n  }\n\n  async list(userId: string) {\n    return [...this.rows.values()].filter((row) => row.userId === userId).map((row) => ({ ...row }));\n  }\n\n  async save(userId: string, provider: string, tokens: OAuthTokenSet) {\n    const existing = await this.find(userId, provider);\n    const now = new Date();\n    const row: ConnectionRecord = {\n      id: existing?.id ?? Bun.randomUUIDv7(),\n      userId,\n      provider,\n      ...fromTokens(tokens),\n      needsReconnect: false,\n      revision: (existing?.revision ?? 0) + 1,\n      createdAt: existing?.createdAt ?? now,\n      updatedAt: now,\n    };\n    this.rows.set(row.id, row);\n    return { ...row };\n  }\n\n  async updateTokens(id: string, revision: number, tokens: OAuthTokenSet) {\n    const row = this.rows.get(id);\n    if (!row || row.revision !== revision) return null;\n    const next = { ...row, ...fromTokens(tokens), needsReconnect: false, revision: revision + 1, updatedAt: new Date() };\n    this.rows.set(id, next);\n    return { ...next };\n  }\n\n  async markNeedsReconnect(id: string) {\n    const row = this.rows.get(id);\n    if (row) this.rows.set(id, { ...row, needsReconnect: true, updatedAt: new Date() });\n  }\n\n  async delete(id: string) {\n    this.rows.delete(id);\n  }\n}\n\nexport interface DatabaseConnectionStoreOptions {\n  /** Default `gemi_oauth_connections`. A plain identifier: it is spliced into every statement. */\n  table?: string;\n}\n\n/**\n * Connections in a table of the app's database, tokens encrypted with the\n * app's `Encrypter` (the keys in `app/config/encryption.ts`). Raw SQL, like\n * the queue's and the locks' tables, for SQLite, Postgres and MySQL 8 /\n * MariaDB: the table is not an ORM model, so no ORM read can return a token.\n */\nexport class DatabaseConnectionStore implements ConnectionStore {\n  readonly table: string;\n  private readonly sql: SQL;\n  private readonly dialect: Dialect;\n\n  constructor(\n    connection: Pick<DatabaseConnection, \"sql\" | \"dialect\">,\n    private readonly encrypter: () => Encrypter,\n    options: DatabaseConnectionStoreOptions = {},\n  ) {\n    const table = options.table ?? \"gemi_oauth_connections\";\n    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(table)) {\n      throw new Error(`The connections table name \"${table}\" is not a plain identifier.`);\n    }\n    this.table = table;\n    this.sql = connection.sql;\n    this.dialect = connection.dialect;\n  }\n\n  /** Creates the table if it does not exist: the DDL Prisma makes for the model in the docs. */\n  async createTable(): Promise<void> {\n    for (const statement of createConnectionTableStatements(this.dialect, this.table)) {\n      await this.sql.unsafe(statement);\n    }\n  }\n\n  async find(userId: string, provider: string) {\n    const q = this.sql;\n    const rows = (await q`\n      SELECT * FROM ${this.name(q)} WHERE user_id = ${userId} AND provider = ${provider}\n    `) as RawRow[];\n    return rows[0] ? this.decode(rows[0]) : null;\n  }\n\n  async list(userId: string) {\n    const q = this.sql;\n    const rows = (await q`\n      SELECT * FROM ${this.name(q)} WHERE user_id = ${userId} ORDER BY provider\n    `) as RawRow[];\n    return rows.map((row) => this.decode(row));\n  }\n\n  async save(userId: string, provider: string, tokens: OAuthTokenSet) {\n    const q = this.sql;\n    const values = this.encode(tokens);\n    const now = Date.now();\n\n    const update = async () =>\n      affected(\n        await q`\n          UPDATE ${this.name(q)}\n          SET provider_account_id = ${values.providerAccountId}, scopes = ${values.scopes},\n              access_token = ${values.accessToken}, refresh_token = ${values.refreshToken},\n              token_type = ${values.tokenType}, expires_at = ${values.expiresAt},\n              needs_reconnect = 0, revision = revision + 1, updated_at = ${now}\n          WHERE user_id = ${userId} AND provider = ${provider}\n        `,\n      );\n\n    if ((await update()) === 0) {\n      try {\n        await q`\n          INSERT INTO ${this.name(q)} (id, user_id, provider, provider_account_id, scopes,\n            access_token, refresh_token, token_type, expires_at, needs_reconnect, revision,\n            created_at, updated_at)\n          VALUES (${Bun.randomUUIDv7()}, ${userId}, ${provider}, ${values.providerAccountId},\n            ${values.scopes}, ${values.accessToken}, ${values.refreshToken}, ${values.tokenType},\n            ${values.expiresAt}, 0, 1, ${now}, ${now})\n        `;\n      } catch (error) {\n        // A concurrent callback for the same user and provider inserted first.\n        if ((await update()) === 0) throw error;\n      }\n    }\n\n    const saved = await this.find(userId, provider);\n    if (!saved) throw new Error(\"The OAuth connection vanished while it was being saved.\");\n    return saved;\n  }\n\n  async updateTokens(id: string, revision: number, tokens: OAuthTokenSet) {\n    const q = this.sql;\n    const values = this.encode(tokens);\n    const result = await q`\n      UPDATE ${this.name(q)}\n      SET provider_account_id = COALESCE(${values.providerAccountId}, provider_account_id),\n          scopes = ${values.scopes}, access_token = ${values.accessToken},\n          refresh_token = ${values.refreshToken}, token_type = ${values.tokenType},\n          expires_at = ${values.expiresAt}, needs_reconnect = 0, revision = revision + 1,\n          updated_at = ${Date.now()}\n      WHERE id = ${id} AND revision = ${revision}\n    `;\n    if (affected(result) === 0) return null;\n    const rows = (await q`SELECT * FROM ${this.name(q)} WHERE id = ${id}`) as RawRow[];\n    return rows[0] ? this.decode(rows[0]) : null;\n  }\n\n  async markNeedsReconnect(id: string) {\n    const q = this.sql;\n    await q`UPDATE ${this.name(q)} SET needs_reconnect = 1, updated_at = ${Date.now()} WHERE id = ${id}`;\n  }\n\n  async delete(id: string) {\n    const q = this.sql;\n    await q`DELETE FROM ${this.name(q)} WHERE id = ${id}`;\n  }\n\n  /**\n   * Re-encrypts every token still under an older key. Run by\n   * `gemi run encryption:rotate`; a token refreshed in the meantime is\n   * already current and is skipped by the revision check.\n   */\n  async rotateEncryption(options: { dryRun?: boolean } = {}): Promise<{ scanned: number; rotated: number }> {\n    const q = this.sql;\n    const encrypter = this.encrypter();\n    const rows = (await q`\n      SELECT id, access_token, refresh_token, revision FROM ${this.name(q)} ORDER BY id\n    `) as RawRow[];\n    let rotated = 0;\n    for (const row of rows) {\n      const stale = (value: string | null) => typeof value === \"string\" && encrypter.needsReencryption(value);\n      if (!stale(row.access_token) && !stale(row.refresh_token)) continue;\n      rotated += 1;\n      if (options.dryRun) continue;\n      const reseal = (value: string | null) => (value === null ? null : encrypter.encrypt(encrypter.decrypt(value)));\n      await q`\n        UPDATE ${this.name(q)}\n        SET access_token = ${reseal(row.access_token)}, refresh_token = ${reseal(row.refresh_token)},\n            revision = revision + 1\n        WHERE id = ${row.id} AND revision = ${Number(row.revision)}\n      `;\n    }\n    return { scanned: rows.length, rotated };\n  }\n\n  private encode(tokens: OAuthTokenSet) {\n    const encrypter = this.encrypter();\n    return {\n      providerAccountId: tokens.providerAccountId,\n      scopes: tokens.scopes.join(\" \"),\n      accessToken: encrypter.encrypt(tokens.accessToken),\n      refreshToken: tokens.refreshToken === null ? null : encrypter.encrypt(tokens.refreshToken),\n      tokenType: tokens.tokenType,\n      expiresAt: tokens.expiresAt === null ? null : tokens.expiresAt.getTime(),\n    };\n  }\n\n  private decode(row: RawRow): ConnectionRecord {\n    const encrypter = this.encrypter();\n    return {\n      id: String(row.id),\n      userId: String(row.user_id),\n      provider: String(row.provider),\n      providerAccountId: row.provider_account_id === null ? null : String(row.provider_account_id),\n      scopes: String(row.scopes ?? \"\").split(\" \").filter(Boolean),\n      accessToken: encrypter.decrypt(String(row.access_token)),\n      refreshToken: row.refresh_token === null ? null : encrypter.decrypt(String(row.refresh_token)),\n      tokenType: row.token_type === null ? null : String(row.token_type),\n      expiresAt: row.expires_at === null ? null : new Date(Number(row.expires_at)),\n      needsReconnect: Number(row.needs_reconnect) === 1,\n      revision: Number(row.revision),\n      createdAt: new Date(Number(row.created_at)),\n      updatedAt: new Date(Number(row.updated_at)),\n    };\n  }\n\n  private get mysql() {\n    return this.dialect === \"mysql\" || this.dialect === \"mariadb\";\n  }\n\n  private name(q: SQL) {\n    return q.unsafe(this.mysql ? `\\`${this.table}\\`` : `\"${this.table}\"`);\n  }\n}\n\ninterface RawRow {\n  id: unknown;\n  user_id: unknown;\n  provider: unknown;\n  provider_account_id: unknown;\n  scopes: unknown;\n  access_token: string;\n  refresh_token: string | null;\n  token_type: unknown;\n  expires_at: unknown;\n  needs_reconnect: unknown;\n  revision: unknown;\n  created_at: unknown;\n  updated_at: unknown;\n}\n\nfunction fromTokens(tokens: OAuthTokenSet) {\n  return {\n    providerAccountId: tokens.providerAccountId,\n    scopes: [...tokens.scopes],\n    accessToken: tokens.accessToken,\n    refreshToken: tokens.refreshToken,\n    tokenType: tokens.tokenType,\n    expiresAt: tokens.expiresAt,\n  };\n}\n\nfunction affected(result: unknown): number {\n  const counts = result as { count?: number | null; affectedRows?: number | null };\n  return Math.max(Number(counts.count ?? 0), Number(counts.affectedRows ?? 0));\n}\n\n/** The connections table, as Prisma generates it for the model in the docs, with `IF NOT EXISTS`. */\nexport function createConnectionTableStatements(dialect: Dialect, table: string): string[] {\n  if (dialect === \"mysql\" || dialect === \"mariadb\") {\n    return [\n      `CREATE TABLE IF NOT EXISTS \\`${table}\\` (\n    \\`id\\` VARCHAR(191) NOT NULL,\n    \\`user_id\\` VARCHAR(191) NOT NULL,\n    \\`provider\\` VARCHAR(191) NOT NULL,\n    \\`provider_account_id\\` VARCHAR(191) NULL,\n    \\`scopes\\` TEXT NOT NULL,\n    \\`access_token\\` TEXT NOT NULL,\n    \\`refresh_token\\` TEXT NULL,\n    \\`token_type\\` VARCHAR(191) NULL,\n    \\`expires_at\\` BIGINT NULL,\n    \\`needs_reconnect\\` INTEGER NOT NULL DEFAULT 0,\n    \\`revision\\` BIGINT NOT NULL DEFAULT 0,\n    \\`created_at\\` BIGINT NOT NULL,\n    \\`updated_at\\` BIGINT NOT NULL,\n\n    UNIQUE INDEX \\`${table}_user_id_provider_key\\`(\\`user_id\\`, \\`provider\\`),\n    PRIMARY KEY (\\`id\\`)\n) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci`,\n    ];\n  }\n  const key = dialect === \"sqlite\" ? `\"id\" TEXT NOT NULL PRIMARY KEY,` : `\"id\" TEXT NOT NULL,`;\n  const constraint =\n    dialect === \"sqlite\" ? \"\" : `,\\n\\n    CONSTRAINT \"${table}_pkey\" PRIMARY KEY (\"id\")`;\n  return [\n    `CREATE TABLE IF NOT EXISTS \"${table}\" (\n    ${key}\n    \"user_id\" TEXT NOT NULL,\n    \"provider\" TEXT NOT NULL,\n    \"provider_account_id\" TEXT,\n    \"scopes\" TEXT NOT NULL,\n    \"access_token\" TEXT NOT NULL,\n    \"refresh_token\" TEXT,\n    \"token_type\" TEXT,\n    \"expires_at\" BIGINT,\n    \"needs_reconnect\" INTEGER NOT NULL DEFAULT 0,\n    \"revision\" BIGINT NOT NULL DEFAULT 0,\n    \"created_at\" BIGINT NOT NULL,\n    \"updated_at\" BIGINT NOT NULL${constraint}\n)`,\n    `CREATE UNIQUE INDEX IF NOT EXISTS \"${table}_user_id_provider_key\" ON \"${table}\"(\"user_id\", \"provider\")`,\n  ];\n}\n",
+    "/**\n * Why an OAuth connection operation failed. Never carries a token or a token\n * endpoint's body; `providerError` is the provider's RFC 6749 error code at\n * most (`invalid_grant`).\n */\nexport type OAuthConnectionErrorCode =\n  | \"unknown_provider\"\n  | \"exchange_failed\"\n  | \"refresh_failed\"\n  | \"reconnect_required\"\n  | \"revoke_failed\"\n  | \"revoke_unsupported\"\n  | \"forbidden_url\";\n\nexport class OAuthConnectionError extends Error {\n  readonly status?: number;\n  readonly providerError?: string;\n\n  constructor(\n    readonly code: OAuthConnectionErrorCode,\n    message: string,\n    options: { cause?: unknown; status?: number; providerError?: string } = {},\n  ) {\n    super(message, options.cause !== undefined ? { cause: options.cause } : undefined);\n    this.name = \"OAuthConnectionError\";\n    this.status = options.status;\n    this.providerError = options.providerError;\n  }\n}\n\n/**\n * The connection's tokens no longer work and refreshing them failed, so the\n * user has to connect the account again (send them to\n * `/auth/connections/<provider>`). The connection is marked, so every later\n * call fails the same way without asking the provider again, until it is\n * reconnected.\n */\nexport class OAuthReconnectRequiredError extends OAuthConnectionError {\n  constructor(\n    readonly provider: string,\n    options: { cause?: unknown; status?: number; providerError?: string } = {},\n  ) {\n    super(\n      \"reconnect_required\",\n      `The ${provider} connection needs to be reconnected: its tokens were refused and could not be refreshed.`,\n      options,\n    );\n    this.name = \"OAuthReconnectRequiredError\";\n  }\n}\n",
+    "import { OAuthConnectionError } from \"./errors\";\n\nexport interface OAuthConnectionProviderConfig {\n  /** The provider's authorization endpoint: `https://www.figma.com/oauth`. */\n  authorizeUrl: string;\n  /** The token endpoint, for the code exchange and refreshes. */\n  tokenUrl: string;\n  /**\n   * The RFC 7009 revocation endpoint. Without one, `revoke()` is refused and\n   * `disconnect()` (which forgets the tokens locally) is the way to remove a\n   * connection.\n   */\n  revokeUrl?: string;\n  clientId: string;\n  clientSecret: string;\n  /** The scopes to request. */\n  scopes: string[];\n  /** How `scopes` are joined on the authorization URL. Default `\" \"` (RFC 6749). */\n  scopeSeparator?: string;\n  /**\n   * How the client authenticates to the token and revocation endpoints:\n   * `\"body\"` sends `client_id` and `client_secret` as form fields (what most\n   * providers document), `\"basic\"` sends them as HTTP Basic credentials.\n   * Default `\"body\"`.\n   */\n  clientAuth?: \"body\" | \"basic\";\n  /** Send a PKCE challenge (S256). Default `true`; turn off only for a provider that rejects it. */\n  pkce?: boolean;\n  /**\n   * Extra query parameters for the authorization URL, such as\n   * `{ access_type: \"offline\", prompt: \"consent\" }` for Google. They cannot\n   * replace `state`, the PKCE challenge, `redirect_uri`, `client_id` or `scope`.\n   */\n  authorizationParams?: Record<string, string>;\n  /**\n   * The callback URL registered with the provider. Default\n   * `${HOST_NAME}/auth/connections/<name>/callback` (the request's origin when\n   * `HOST_NAME` is unset).\n   */\n  redirectUri?: string;\n  /**\n   * Where the provider's API lives: `https://api.figma.com`. Required:\n   * `connection.fetch` takes paths relative to it and **refuses any other\n   * origin**, so the user's token only ever goes to the provider's API host,\n   * even for a URL that came from user input.\n   */\n  apiBaseUrl: string;\n  /** Refresh this many seconds before the access token expires. Default 60. */\n  refreshLeewaySeconds?: number;\n}\n\n/** What a token endpoint answered, normalised. */\nexport interface OAuthTokenSet {\n  accessToken: string;\n  refreshToken: string | null;\n  tokenType: string | null;\n  /** Absent when the provider did not say (`expires_in` missing). */\n  expiresAt: Date | null;\n  /** The scopes granted, when the provider says; otherwise the ones requested. */\n  scopes: string[];\n  /** The provider's id for the account, when the token response carries one (Figma's `user_id`). */\n  providerAccountId: string | null;\n}\n\n/**\n * A provider an app can connect a user's account to, to call its API on the\n * user's behalf — as opposed to `OAuthProvider`, which signs the user in.\n * Configured under `auth.connections`:\n *\n * ```ts\n * connections: {\n *   figma: new OAuthConnectionProvider({\n *     authorizeUrl: \"https://www.figma.com/oauth\",\n *     tokenUrl: \"https://api.figma.com/v1/oauth/token\",\n *     clientId: process.env.FIGMA_CLIENT_ID!,\n *     clientSecret: process.env.FIGMA_CLIENT_SECRET!,\n *     scopes: [\"file_content:read\"],\n *     apiBaseUrl: \"https://api.figma.com\",\n *   }),\n * }\n * ```\n */\nexport class OAuthConnectionProvider {\n  readonly config: Required<\n    Omit<OAuthConnectionProviderConfig, \"revokeUrl\" | \"redirectUri\">\n  > &\n    Pick<OAuthConnectionProviderConfig, \"revokeUrl\" | \"redirectUri\">;\n\n  constructor(config: OAuthConnectionProviderConfig) {\n    for (const key of [\"authorizeUrl\", \"tokenUrl\"] as const) {\n      assertHttpUrl(key, config[key]);\n    }\n    if (config.revokeUrl !== undefined) assertHttpUrl(\"revokeUrl\", config.revokeUrl);\n    // Required (not just recommended): it is what keeps `connection.fetch`\n    // from sending the user's token anywhere but the provider's API host. A\n    // missing one (`process.env.X` unset, or plain JS) fails the boot, when\n    // the auth config is loaded, rather than the first `fetch`.\n    if (config.apiBaseUrl === undefined || config.apiBaseUrl === null || config.apiBaseUrl === \"\") {\n      throw new Error(\n        \"OAuthConnectionProvider: apiBaseUrl is required. Set it to the provider's API origin \" +\n          '(e.g. apiBaseUrl: \"https://api.figma.com\"); connection.fetch only sends the token there.',\n      );\n    }\n    assertHttpUrl(\"apiBaseUrl\", config.apiBaseUrl);\n    this.config = {\n      scopeSeparator: \" \",\n      clientAuth: \"body\",\n      pkce: true,\n      authorizationParams: {},\n      refreshLeewaySeconds: 60,\n      ...config,\n    };\n  }\n\n  /** The URL to send the browser to. */\n  authorizationUrl(args: { state: string; codeChallenge: string; redirectUri: string }): string {\n    const url = new URL(this.config.authorizeUrl);\n    const params: Record<string, string> = {\n      ...this.config.authorizationParams,\n      response_type: \"code\",\n      client_id: this.config.clientId,\n      redirect_uri: args.redirectUri,\n      scope: this.config.scopes.join(this.config.scopeSeparator),\n      state: args.state,\n    };\n    if (this.config.pkce) {\n      params.code_challenge = args.codeChallenge;\n      params.code_challenge_method = \"S256\";\n    }\n    for (const [key, value] of Object.entries(params)) url.searchParams.set(key, value);\n    return url.toString();\n  }\n\n  /** Exchanges an authorization code for tokens. */\n  exchangeCode(args: { code: string; codeVerifier: string; redirectUri: string }): Promise<OAuthTokenSet> {\n    const body = new URLSearchParams({\n      grant_type: \"authorization_code\",\n      code: args.code,\n      redirect_uri: args.redirectUri,\n    });\n    if (this.config.pkce) body.set(\"code_verifier\", args.codeVerifier);\n    return this.tokenRequest(body, { scopes: this.config.scopes, refreshToken: null, phase: \"exchange\" });\n  }\n\n  /**\n   * Spends `refreshToken` for a new access token. A provider that does not\n   * rotate refresh tokens answers without one, and the old one is kept.\n   */\n  refresh(refreshToken: string, scopes: string[]): Promise<OAuthTokenSet> {\n    const body = new URLSearchParams({ grant_type: \"refresh_token\", refresh_token: refreshToken });\n    return this.tokenRequest(body, { scopes, refreshToken, phase: \"refresh\" });\n  }\n\n  /** Revokes `token` at the provider (RFC 7009). */\n  async revoke(token: string, hint: \"refresh_token\" | \"access_token\"): Promise<void> {\n    if (!this.config.revokeUrl) {\n      throw new OAuthConnectionError(\n        \"revoke_unsupported\",\n        \"This provider has no revokeUrl configured. Use disconnect() to forget the tokens locally.\",\n      );\n    }\n    const body = new URLSearchParams({ token, token_type_hint: hint });\n    let response: Response;\n    try {\n      response = await fetch(this.config.revokeUrl, this.post(body));\n    } catch (cause) {\n      throw new OAuthConnectionError(\"revoke_failed\", \"The revocation request failed.\", { cause });\n    }\n    // RFC 7009: 200 whether or not the token was still valid.\n    if (!response.ok) {\n      throw new OAuthConnectionError(\n        \"revoke_failed\",\n        `The provider refused the revocation (HTTP ${response.status}).`,\n        { status: response.status },\n      );\n    }\n  }\n\n  private post(body: URLSearchParams): RequestInit {\n    const headers: Record<string, string> = {\n      \"Content-Type\": \"application/x-www-form-urlencoded\",\n      // GitHub answers form-encoded unless asked for JSON.\n      Accept: \"application/json\",\n    };\n    if (this.config.clientAuth === \"basic\") {\n      const credentials = `${encodeURIComponent(this.config.clientId)}:${encodeURIComponent(this.config.clientSecret)}`;\n      headers.Authorization = `Basic ${Buffer.from(credentials).toString(\"base64\")}`;\n    } else {\n      body.set(\"client_id\", this.config.clientId);\n      body.set(\"client_secret\", this.config.clientSecret);\n    }\n    return { method: \"POST\", headers, body: body.toString(), redirect: \"error\" };\n  }\n\n  private async tokenRequest(\n    body: URLSearchParams,\n    previous: { scopes: string[]; refreshToken: string | null; phase: \"exchange\" | \"refresh\" },\n  ): Promise<OAuthTokenSet> {\n    const failure = previous.phase === \"exchange\" ? \"exchange_failed\" : \"refresh_failed\";\n    let response: Response;\n    try {\n      response = await fetch(this.config.tokenUrl, this.post(body));\n    } catch (cause) {\n      throw new OAuthConnectionError(failure, \"The token request failed.\", { cause });\n    }\n\n    const payload = (await response.json().catch(() => ({}))) as Record<string, unknown>;\n    if (!response.ok || typeof payload.access_token !== \"string\" || payload.access_token === \"\") {\n      // Only the provider's error code, never the body: it can echo the grant.\n      const code = typeof payload.error === \"string\" && /^[a-z0-9_]{1,64}$/.test(payload.error) ? payload.error : undefined;\n      throw new OAuthConnectionError(\n        failure,\n        `The token endpoint refused the ${previous.phase === \"exchange\" ? \"code\" : \"refresh token\"} ` +\n          `(HTTP ${response.status}${code ? `, ${code}` : \"\"}).`,\n        { status: response.status, providerError: code },\n      );\n    }\n\n    const expiresIn = Number(payload.expires_in);\n    const scope = typeof payload.scope === \"string\" ? payload.scope : undefined;\n    const accountId = payload.user_id ?? payload.account_id;\n    return {\n      accessToken: payload.access_token,\n      refreshToken:\n        typeof payload.refresh_token === \"string\" && payload.refresh_token !== \"\"\n          ? payload.refresh_token\n          : previous.refreshToken,\n      tokenType: typeof payload.token_type === \"string\" ? payload.token_type : null,\n      expiresAt: Number.isFinite(expiresIn) && expiresIn > 0 ? new Date(Date.now() + expiresIn * 1000) : null,\n      scopes: scope !== undefined ? scope.split(/[\\s,]+/).filter(Boolean) : previous.scopes,\n      providerAccountId:\n        typeof accountId === \"string\" || typeof accountId === \"number\" ? String(accountId) : null,\n    };\n  }\n}\n\nfunction assertHttpUrl(key: string, value: unknown): void {\n  let url: URL | undefined;\n  try {\n    url = new URL(String(value));\n  } catch {\n    url = undefined;\n  }\n  if (!url || (url.protocol !== \"https:\" && !(url.protocol === \"http:\" && isLoopback(url.hostname)))) {\n    throw new Error(\n      `OAuthConnectionProvider: ${key} must be an https URL (http only for localhost), got ${JSON.stringify(value)}.`,\n    );\n  }\n}\n\nexport function isLoopback(hostname: string): boolean {\n  return hostname === \"localhost\" || hostname === \"127.0.0.1\" || hostname === \"[::1]\" || hostname === \"::1\";\n}\n",
+    "import { DatabaseManager } from \"../../database/DatabaseManager\";\nimport { app } from \"../../foundation/app\";\nimport { currentEncrypter } from \"../../orm/encryption\";\nimport { LockManager } from \"../../services/lock/LockManager\";\nimport {\n  type ConnectionRecord,\n  type ConnectionStore,\n  DatabaseConnectionStore,\n  MemoryConnectionStore,\n} from \"./ConnectionStore\";\nimport { OAuthConnectionError, OAuthReconnectRequiredError } from \"./errors\";\nimport { type OAuthConnectionProvider, type OAuthTokenSet, isLoopback } from \"./OAuthConnectionProvider\";\n\n/** A user, as far as a connection is concerned: anything with an `id`. */\nexport type ConnectionOwner = { id: string | number } | string | number;\n\n/** What `Connections.fake` answers an API request with. */\nexport type FakeConnectionHandler = (request: Request) => Response | Promise<Response>;\n\nexport interface ConnectionManagerOptions {\n  providers: Record<string, OAuthConnectionProvider>;\n  /** Default: a `DatabaseConnectionStore` on the default database connection. */\n  store?: ConnectionStore | (() => ConnectionStore);\n}\n\n/**\n * The OAuth connections a user has made, and the one place their tokens are\n * read, refreshed and spent. Reached through the `Connections` facade.\n */\nexport class ConnectionManager {\n  static token = \"auth.connections\";\n\n  private resolvedStore: ConnectionStore | undefined;\n  private readonly refreshing = new Map<string, Promise<ConnectionRecord>>();\n  private fakes: Map<string, FakeConnectionHandler> | undefined;\n  private fakeStore: MemoryConnectionStore | undefined;\n  readonly fakeRequests: Request[] = [];\n\n  constructor(private readonly options: ConnectionManagerOptions) {}\n\n  get providers(): Record<string, OAuthConnectionProvider> {\n    return this.options.providers;\n  }\n\n  /** The store connections are kept in. */\n  get store(): ConnectionStore {\n    if (this.fakeStore) return this.fakeStore;\n    if (!this.resolvedStore) {\n      const configured = this.options.store;\n      this.resolvedStore =\n        typeof configured === \"function\"\n          ? configured()\n          : (configured ??\n            new DatabaseConnectionStore(app(DatabaseManager).connection(), () => currentEncrypter()));\n    }\n    return this.resolvedStore;\n  }\n\n  provider(name: string): OAuthConnectionProvider {\n    const provider = this.options.providers[name];\n    if (!provider) {\n      const known = Object.keys(this.options.providers);\n      throw new OAuthConnectionError(\n        \"unknown_provider\",\n        `No OAuth connection provider \"${name}\" in auth.connections` +\n          (known.length > 0 ? ` (configured: ${known.join(\", \")}).` : \" (none are configured).\"),\n      );\n    }\n    return provider;\n  }\n\n  /** The user's connection to `provider`, or `null` when they have not connected it. */\n  async for(user: ConnectionOwner, provider: string): Promise<ProviderConnection | null> {\n    this.provider(provider);\n    const record = await this.store.find(ownerId(user), provider);\n    return record ? new ProviderConnection(this, record) : null;\n  }\n\n  /** Every connection the user has. */\n  async list(user: ConnectionOwner): Promise<ProviderConnection[]> {\n    const records = await this.store.list(ownerId(user));\n    return records\n      .filter((record) => record.provider in this.options.providers)\n      .map((record) => new ProviderConnection(this, record));\n  }\n\n  /**\n   * Stores tokens for the user, replacing any earlier connection to the same\n   * provider. The connect callback calls this; call it yourself for tokens\n   * obtained some other way.\n   */\n  async save(\n    user: ConnectionOwner,\n    provider: string,\n    tokens: Partial<OAuthTokenSet> & { accessToken: string },\n  ): Promise<ProviderConnection> {\n    const config = this.provider(provider);\n    const record = await this.store.save(ownerId(user), provider, {\n      refreshToken: null,\n      tokenType: null,\n      expiresAt: null,\n      providerAccountId: null,\n      scopes: config.config.scopes,\n      ...tokens,\n    });\n    return new ProviderConnection(this, record);\n  }\n\n  // --- testing ---------------------------------------------------------------\n\n  /**\n   * Fakes every provider's API: connections live in memory, `fetch` answers\n   * through `handlers[provider]` (recorded in `fakeRequests`), and nothing\n   * reaches a token or revocation endpoint. Returns `this` so a test can\n   * `save` a connection to start from.\n   */\n  fake(handlers: Record<string, FakeConnectionHandler> = {}): this {\n    this.fakes = new Map(Object.entries(handlers));\n    this.fakeStore = new MemoryConnectionStore();\n    this.fakeRequests.length = 0;\n    return this;\n  }\n\n  /** Undoes `fake`. */\n  restore(): void {\n    this.fakes = undefined;\n    this.fakeStore = undefined;\n    this.fakeRequests.length = 0;\n  }\n\n  get faked(): boolean {\n    return this.fakes !== undefined;\n  }\n\n  // --- internals, for ProviderConnection ---------------------------------------\n\n  /** @internal */\n  async send(provider: string, request: Request): Promise<Response> {\n    if (!this.fakes) return fetch(request);\n    this.fakeRequests.push(request.clone());\n    const handler = this.fakes.get(provider);\n    if (!handler) {\n      throw new Error(`Connections.fake() has no handler for \"${provider}\". Pass one: Connections.fake({ ${provider}: (req) => ... }).`);\n    }\n    return handler(request);\n  }\n\n  /**\n   * A record whose access token is not the one at `staleRevision`: refreshed\n   * by this call, or by whoever refreshed it first. Serialised per connection\n   * in this process (concurrent callers share one refresh) and, through the\n   * app's lock store, across processes — a rotating refresh token must be\n   * spent exactly once.\n   *\n   * @internal\n   */\n  refresh(record: ConnectionRecord): Promise<ConnectionRecord> {\n    const inFlight = this.refreshing.get(record.id);\n    if (inFlight) return inFlight;\n    const task = this.withLock(record.id, () => this.refreshOnce(record)).finally(() =>\n      this.refreshing.delete(record.id),\n    );\n    this.refreshing.set(record.id, task);\n    return task;\n  }\n\n  private async refreshOnce(seen: ConnectionRecord): Promise<ConnectionRecord> {\n    // Re-read under the lock: another process may have refreshed already.\n    const current = await this.store.find(seen.userId, seen.provider);\n    if (!current || current.id !== seen.id) {\n      throw new OAuthReconnectRequiredError(seen.provider);\n    }\n    if (current.revision !== seen.revision && !current.needsReconnect) return current;\n    if (current.needsReconnect) throw new OAuthReconnectRequiredError(seen.provider);\n\n    const provider = this.provider(current.provider);\n    if (this.faked || current.refreshToken === null) {\n      if (this.faked) return current;\n      await this.store.markNeedsReconnect(current.id);\n      throw new OAuthReconnectRequiredError(current.provider);\n    }\n\n    let tokens: OAuthTokenSet;\n    try {\n      tokens = await provider.refresh(current.refreshToken, current.scopes);\n    } catch (error) {\n      // A refusal from the token endpoint is final: the grant is gone. A\n      // network error or a 5xx is not, and leaves the connection alone.\n      if (error instanceof OAuthConnectionError && error.status !== undefined && error.status >= 400 && error.status < 500) {\n        await this.store.markNeedsReconnect(current.id);\n        throw new OAuthReconnectRequiredError(current.provider, {\n          cause: error,\n          status: error.status,\n          providerError: error.providerError,\n        });\n      }\n      throw error;\n    }\n\n    const updated = await this.store.updateTokens(current.id, current.revision, tokens);\n    if (updated) return updated;\n    // Someone else wrote first (only possible without a shared lock store).\n    const winner = await this.store.find(current.userId, current.provider);\n    if (!winner) throw new OAuthReconnectRequiredError(current.provider);\n    return winner;\n  }\n\n  private async withLock<T>(id: string, fn: () => Promise<T>): Promise<T> {\n    const application = app();\n    if (this.faked || !application.bound(LockManager)) return fn();\n    const result = await application\n      .make(LockManager)\n      .run(`gemi:oauth-connection:${id}`, { ttl: 30_000, wait: 20_000 }, () => fn());\n    if (!result.acquired) {\n      throw new OAuthConnectionError(\n        \"refresh_failed\",\n        \"Timed out waiting for another refresh of this connection to finish.\",\n      );\n    }\n    return result.value as T;\n  }\n}\n\n/**\n * One user's connection to one provider. Never exposes a token as a property,\n * and serialises (`toJSON`, `console.log`) without them.\n */\nexport class ProviderConnection {\n  constructor(\n    private readonly manager: ConnectionManager,\n    private record: ConnectionRecord,\n  ) {}\n\n  get provider(): string {\n    return this.record.provider;\n  }\n  get userId(): string {\n    return this.record.userId;\n  }\n  get providerAccountId(): string | null {\n    return this.record.providerAccountId;\n  }\n  /** The scopes the provider granted. */\n  get scopes(): readonly string[] {\n    return this.record.scopes;\n  }\n  get expiresAt(): Date | null {\n    return this.record.expiresAt;\n  }\n  /** A refresh was refused: the user has to connect again. */\n  get needsReconnect(): boolean {\n    return this.record.needsReconnect;\n  }\n  get connectedAt(): Date {\n    return this.record.createdAt;\n  }\n\n  /** Whether every one of `scopes` was granted. */\n  hasScopes(...scopes: string[]): boolean {\n    return scopes.every((scope) => this.record.scopes.includes(scope));\n  }\n\n  /**\n   * `fetch`, as the user: adds `Authorization: Bearer <token>`, refreshes the\n   * token first when it is about to expire, and after a 401 refreshes and\n   * retries once. A refresh the provider refuses marks the connection and\n   * throws `OAuthReconnectRequiredError`.\n   *\n   * A path is resolved against the provider's `apiBaseUrl`, and a URL on any\n   * other origin is refused (`OAuthConnectionError`,\n   * `forbidden_url`), so the token only ever goes to the provider. Redirects\n   * are followed by hand: the token is dropped on one that leaves the origin.\n   * A streamed request body cannot be sent twice, so a 401 for one is\n   * returned rather than retried.\n   */\n  async fetch(input: string | URL, init: RequestInit = {}): Promise<Response> {\n    const url = this.resolveUrl(input);\n    const record = await this.current();\n    const first = await this.send(url, init, record.accessToken);\n    // Retry only a 401 for the token itself, not one from where a redirect\n    // led after the token was dropped.\n    if (first.response.status !== 401 || !first.authorized || init.body instanceof ReadableStream) {\n      return first.response;\n    }\n\n    await first.response.body?.cancel().catch(() => {});\n    const refreshed = await this.refreshFrom(record);\n    return (await this.send(url, init, refreshed.accessToken)).response;\n  }\n\n  /**\n   * A valid access token, refreshed first if it is about to expire — for an\n   * SDK that wants the token itself. Prefer `fetch`, which also retries a 401.\n   */\n  async accessToken(): Promise<string> {\n    return (await this.current()).accessToken;\n  }\n\n  /** Refreshes now, whatever the expiry says. */\n  async refresh(): Promise<void> {\n    await this.refreshFrom(this.record);\n  }\n\n  /**\n   * Revokes the grant at the provider (the refresh token when there is one,\n   * which ends the whole grant, else the access token) and deletes the\n   * connection. If the provider refuses, nothing is deleted and\n   * `OAuthConnectionError` (`revoke_failed`) is thrown — call `disconnect()`\n   * to forget the tokens anyway. A provider without a `revokeUrl` throws\n   * `revoke_unsupported`; use `disconnect()`.\n   */\n  async revoke(): Promise<void> {\n    if (!this.manager.faked) {\n      const provider = this.manager.provider(this.record.provider);\n      if (this.record.refreshToken !== null) {\n        await provider.revoke(this.record.refreshToken, \"refresh_token\");\n      } else {\n        await provider.revoke(this.record.accessToken, \"access_token\");\n      }\n    }\n    await this.manager.store.delete(this.record.id);\n  }\n\n  /** Forgets the tokens locally without telling the provider. */\n  async disconnect(): Promise<void> {\n    await this.manager.store.delete(this.record.id);\n  }\n\n  toJSON() {\n    return {\n      provider: this.provider,\n      providerAccountId: this.providerAccountId,\n      scopes: [...this.scopes],\n      expiresAt: this.expiresAt,\n      needsReconnect: this.needsReconnect,\n      connectedAt: this.connectedAt,\n    };\n  }\n\n  [Symbol.for(\"nodejs.util.inspect.custom\")]() {\n    return { ProviderConnection: this.toJSON() };\n  }\n\n  private async current(): Promise<ConnectionRecord> {\n    if (this.record.needsReconnect) throw new OAuthReconnectRequiredError(this.record.provider);\n    const leeway = this.manager.provider(this.record.provider).config.refreshLeewaySeconds * 1000;\n    const expiresAt = this.record.expiresAt?.getTime();\n    if (expiresAt !== undefined && expiresAt - Date.now() <= leeway) {\n      return this.refreshFrom(this.record);\n    }\n    return this.record;\n  }\n\n  private async refreshFrom(record: ConnectionRecord): Promise<ConnectionRecord> {\n    try {\n      this.record = await this.manager.refresh(record);\n    } catch (error) {\n      if (error instanceof OAuthReconnectRequiredError) {\n        this.record = { ...this.record, needsReconnect: true };\n      }\n      throw error;\n    }\n    return this.record;\n  }\n\n  private resolveUrl(input: string | URL): URL {\n    const base = this.manager.provider(this.record.provider).config.apiBaseUrl;\n    let url: URL;\n    try {\n      url = new URL(String(input), base);\n    } catch {\n      throw new OAuthConnectionError(\n        \"forbidden_url\",\n        `connection.fetch was given ${JSON.stringify(String(input))}, which is not a URL.`,\n      );\n    }\n    if (url.origin !== new URL(base).origin) {\n      throw new OAuthConnectionError(\n        \"forbidden_url\",\n        `connection.fetch only sends the ${this.record.provider} token to ${new URL(base).origin} ` +\n          `(apiBaseUrl), not to ${url.origin}.`,\n      );\n    }\n    if (url.protocol !== \"https:\" && !(url.protocol === \"http:\" && isLoopback(url.hostname))) {\n      throw new OAuthConnectionError(\n        \"forbidden_url\",\n        `connection.fetch only sends a token over https, not to ${url.origin}.`,\n      );\n    }\n    return url;\n  }\n\n  private async send(url: URL, init: RequestInit, token: string): Promise<{ response: Response; authorized: boolean }> {\n    let target = url;\n    let method = (init.method ?? \"GET\").toUpperCase();\n    let body = init.body;\n    let authorized = true;\n\n    // Followed by hand (unless the caller asked for \"manual\" or \"error\"), so\n    // the token never follows a redirect to another origin.\n    if (init.redirect === \"manual\" || init.redirect === \"error\") {\n      const response = await this.manager.send(this.record.provider, this.request(target, init, method, body, token));\n      return { response, authorized };\n    }\n\n    for (let hop = 0; ; hop++) {\n      const request = this.request(target, { ...init, redirect: \"manual\" }, method, body, authorized ? token : null);\n      const response = await this.manager.send(this.record.provider, request);\n      const location = response.headers.get(\"location\");\n      if (!REDIRECTS.has(response.status) || location === null || hop >= 5) return { response, authorized };\n\n      await response.body?.cancel().catch(() => {});\n      const next = new URL(location, target);\n      if (next.origin !== target.origin) authorized = false;\n      if (response.status === 303 || ((response.status === 301 || response.status === 302) && method === \"POST\")) {\n        method = \"GET\";\n        body = undefined;\n      }\n      target = next;\n    }\n  }\n\n  private request(url: URL, init: RequestInit, method: string, body: RequestInit[\"body\"], token: string | null): Request {\n    const headers = new Headers(init.headers);\n    if (token === null) headers.delete(\"authorization\");\n    else headers.set(\"Authorization\", `Bearer ${token}`);\n    return new Request(url, { ...init, method, body, headers });\n  }\n}\n\nconst REDIRECTS = new Set([301, 302, 303, 307, 308]);\n\nfunction ownerId(user: ConnectionOwner): string {\n  const id = typeof user === \"object\" && user !== null ? user.id : user;\n  if (id === undefined || id === null || id === \"\") {\n    throw new TypeError(\"An OAuth connection belongs to a user: pass the user (or its id).\");\n  }\n  return String(id);\n}\n"
+  ],
+  "mappings": ";sLAwCO,AAAM,LAAiD,LAC3C,KAAO,IAAI,SAEtB,KAAI,CAAC,EAAgB,EAAkB,CAC3C,QAAW,KAAO,KAAK,KAAK,OAAO,EACjC,GAAI,EAAI,SAAW,GAAU,EAAI,WAAa,EAAU,MAAO,IAAK,CAAI,EAE1E,OAAO,UAGH,KAAI,CAAC,EAAgB,CACzB,MAAO,CAAC,GAAG,KAAK,KAAK,OAAO,CAAC,EAAE,OAAO,CAAC,IAAQ,EAAI,SAAW,CAAM,EAAE,IAAI,CAAC,KAAS,IAAK,CAAI,EAAE,OAG3F,KAAI,CAAC,EAAgB,EAAkB,EAAuB,CAClE,IAAM,EAAW,MAAM,KAAK,KAAK,EAAQ,CAAQ,EAC3C,EAAM,IAAI,KACV,EAAwB,CAC5B,GAAI,GAAU,IAAM,IAAI,aAAa,EACrC,SACA,cACG,EAAW,CAAM,EACpB,eAAgB,GAChB,UAAW,GAAU,UAAY,GAAK,EACtC,UAAW,GAAU,WAAa,EAClC,UAAW,CACb,EAEA,OADA,KAAK,KAAK,IAAI,EAAI,GAAI,CAAG,EAClB,IAAK,CAAI,OAGZ,aAAY,CAAC,EAAY,EAAkB,EAAuB,CACtE,IAAM,EAAM,KAAK,KAAK,IAAI,CAAE,EAC5B,GAAI,CAAC,GAAO,EAAI,WAAa,EAAU,OAAO,KAC9C,IAAM,EAAO,IAAK,KAAQ,EAAW,CAAM,EAAG,eAAgB,GAAO,SAAU,EAAW,EAAG,UAAW,IAAI,IAAO,EAEnH,OADA,KAAK,KAAK,IAAI,EAAI,CAAI,EACf,IAAK,CAAK,OAGb,mBAAkB,CAAC,EAAY,CACnC,IAAM,EAAM,KAAK,KAAK,IAAI,CAAE,EAC5B,GAAI,EAAK,KAAK,KAAK,IAAI,EAAI,IAAK,EAAK,eAAgB,GAAM,UAAW,IAAI,IAAO,CAAC,OAG9E,OAAM,CAAC,EAAY,CACvB,KAAK,KAAK,OAAO,CAAE,EAEvB,CAaO,MAAM,CAAmD,CAO3C,UANV,MACQ,IACA,QAEjB,WAAW,CACT,EACiB,EACjB,EAA0C,CAAC,EAC3C,CAFiB,iBAGjB,IAAM,EAAQ,EAAQ,OAAS,yBAC/B,GAAI,CAAC,2BAA2B,KAAK,CAAK,EACxC,MAAU,MAAM,+BAA+B,+BAAmC,EAEpF,KAAK,MAAQ,EACb,KAAK,IAAM,EAAW,IACtB,KAAK,QAAU,EAAW,aAItB,YAAW,EAAkB,CACjC,QAAW,KAAa,EAAgC,KAAK,QAAS,KAAK,KAAK,EAC9E,MAAM,KAAK,IAAI,OAAO,CAAS,OAI7B,KAAI,CAAC,EAAgB,EAAkB,CAC3C,IAAM,EAAI,KAAK,IACT,EAAQ,KAAM;AAAA,sBACF,KAAK,KAAK,CAAC,qBAAqB,oBAAyB;AAAA,MAE3E,OAAO,EAAK,GAAK,KAAK,OAAO,EAAK,EAAE,EAAI,UAGpC,KAAI,CAAC,EAAgB,CACzB,IAAM,EAAI,KAAK,IAIf,OAHc,KAAM;AAAA,sBACF,KAAK,KAAK,CAAC,qBAAqB;AAAA,OAEtC,IAAI,CAAC,IAAQ,KAAK,OAAO,CAAG,CAAC,OAGrC,KAAI,CAAC,EAAgB,EAAkB,EAAuB,CAClE,IAAM,EAAI,KAAK,IACT,EAAS,KAAK,OAAO,CAAM,EAC3B,EAAM,KAAK,IAAI,EAEf,EAAS,SACb,EACE,KAAM;AAAA,mBACK,KAAK,KAAK,CAAC;AAAA,sCACQ,EAAO,+BAA+B,EAAO;AAAA,+BACpD,EAAO,gCAAgC,EAAO;AAAA,6BAChD,EAAO,2BAA2B,EAAO;AAAA,2EACK;AAAA,4BAC/C,oBAAyB;AAAA,SAE/C,EAEF,GAAK,MAAM,EAAO,IAAO,EACvB,GAAI,CACF,KAAM;AAAA,wBACU,KAAK,KAAK,CAAC;AAAA;AAAA;AAAA,oBAGf,IAAI,aAAa,MAAM,MAAW,MAAa,EAAO;AAAA,cAC5D,EAAO,WAAW,EAAO,gBAAgB,EAAO,iBAAiB,EAAO;AAAA,cACxE,EAAO,oBAAoB,MAAQ;AAAA,UAEzC,MAAO,EAAO,CAEd,GAAK,MAAM,EAAO,IAAO,EAAG,MAAM,EAItC,IAAM,EAAQ,MAAM,KAAK,KAAK,EAAQ,CAAQ,EAC9C,GAAI,CAAC,EAAO,MAAU,MAAM,yDAAyD,EACrF,OAAO,OAGH,aAAY,CAAC,EAAY,EAAkB,EAAuB,CACtE,IAAM,EAAI,KAAK,IACT,EAAS,KAAK,OAAO,CAAM,EAC3B,EAAS,KAAM;AAAA,eACV,KAAK,KAAK,CAAC;AAAA,2CACiB,EAAO;AAAA,qBAC7B,EAAO,0BAA0B,EAAO;AAAA,4BACjC,EAAO,8BAA8B,EAAO;AAAA,yBAC/C,EAAO;AAAA,yBACP,KAAK,IAAI;AAAA,mBACf,oBAAqB;AAAA,MAEpC,GAAI,EAAS,CAAM,IAAM,EAAG,OAAO,KACnC,IAAM,EAAQ,KAAM,mBAAkB,KAAK,KAAK,CAAC,gBAAgB,IACjE,OAAO,EAAK,GAAK,KAAK,OAAO,EAAK,EAAE,EAAI,UAGpC,mBAAkB,CAAC,EAAY,CACnC,IAAM,EAAI,KAAK,IACf,KAAM,YAAW,KAAK,KAAK,CAAC,2CAA2C,KAAK,IAAI,gBAAgB,SAG5F,OAAM,CAAC,EAAY,CACvB,IAAM,EAAI,KAAK,IACf,KAAM,iBAAgB,KAAK,KAAK,CAAC,gBAAgB,SAQ7C,iBAAgB,CAAC,EAAgC,CAAC,EAAkD,CACxG,IAAM,EAAI,KAAK,IACT,EAAY,KAAK,UAAU,EAC3B,EAAQ,KAAM;AAAA,8DACsC,KAAK,KAAK,CAAC;AAAA,MAEjE,EAAU,EACd,QAAW,KAAO,EAAM,CACtB,IAAM,EAAQ,CAAC,IAAyB,OAAO,IAAU,UAAY,EAAU,kBAAkB,CAAK,EACtG,GAAI,CAAC,EAAM,EAAI,YAAY,GAAK,CAAC,EAAM,EAAI,aAAa,EAAG,SAE3D,GADA,GAAW,EACP,EAAQ,OAAQ,SACpB,IAAM,EAAS,CAAC,IAA0B,IAAU,KAAO,KAAO,EAAU,QAAQ,EAAU,QAAQ,CAAK,CAAC,EAC5G,KAAM;AAAA,iBACK,KAAK,KAAK,CAAC;AAAA,6BACC,EAAO,EAAI,YAAY,sBAAsB,EAAO,EAAI,aAAa;AAAA;AAAA,qBAE7E,EAAI,qBAAqB,OAAO,EAAI,QAAQ;AAAA,QAG7D,MAAO,CAAE,QAAS,EAAK,OAAQ,SAAQ,EAGjC,MAAM,CAAC,EAAuB,CACpC,IAAM,EAAY,KAAK,UAAU,EACjC,MAAO,CACL,kBAAmB,EAAO,kBAC1B,OAAQ,EAAO,OAAO,KAAK,GAAG,EAC9B,YAAa,EAAU,QAAQ,EAAO,WAAW,EACjD,aAAc,EAAO,eAAiB,KAAO,KAAO,EAAU,QAAQ,EAAO,YAAY,EACzF,UAAW,EAAO,UAClB,UAAW,EAAO,YAAc,KAAO,KAAO,EAAO,UAAU,QAAQ,CACzE,EAGM,MAAM,CAAC,EAA+B,CAC5C,IAAM,EAAY,KAAK,UAAU,EACjC,MAAO,CACL,GAAI,OAAO,EAAI,EAAE,EACjB,OAAQ,OAAO,EAAI,OAAO,EAC1B,SAAU,OAAO,EAAI,QAAQ,EAC7B,kBAAmB,EAAI,sBAAwB,KAAO,KAAO,OAAO,EAAI,mBAAmB,EAC3F,OAAQ,OAAO,EAAI,QAAU,EAAE,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO,EAC1D,YAAa,EAAU,QAAQ,OAAO,EAAI,YAAY,CAAC,EACvD,aAAc,EAAI,gBAAkB,KAAO,KAAO,EAAU,QAAQ,OAAO,EAAI,aAAa,CAAC,EAC7F,UAAW,EAAI,aAAe,KAAO,KAAO,OAAO,EAAI,UAAU,EACjE,UAAW,EAAI,aAAe,KAAO,KAAO,IAAI,KAAK,OAAO,EAAI,UAAU,CAAC,EAC3E,eAAgB,OAAO,EAAI,eAAe,IAAM,EAChD,SAAU,OAAO,EAAI,QAAQ,EAC7B,UAAW,IAAI,KAAK,OAAO,EAAI,UAAU,CAAC,EAC1C,UAAW,IAAI,KAAK,OAAO,EAAI,UAAU,CAAC,CAC5C,KAGU,MAAK,EAAG,CAClB,OAAO,KAAK,UAAY,SAAW,KAAK,UAAY,UAG9C,IAAI,CAAC,EAAQ,CACnB,OAAO,EAAE,OAAO,KAAK,MAAQ,KAAK,KAAK,UAAY,IAAI,KAAK,QAAQ,EAExE,CAkBA,SAAS,CAAU,CAAC,EAAuB,CACzC,MAAO,CACL,kBAAmB,EAAO,kBAC1B,OAAQ,CAAC,GAAG,EAAO,MAAM,EACzB,YAAa,EAAO,YACpB,aAAc,EAAO,aACrB,UAAW,EAAO,UAClB,UAAW,EAAO,SACpB,EAGF,SAAS,CAAQ,CAAC,EAAyB,CACzC,IAAM,EAAS,EACf,OAAO,KAAK,IAAI,OAAO,EAAO,OAAS,CAAC,EAAG,OAAO,EAAO,cAAgB,CAAC,CAAC,EAItE,SAAS,CAA+B,CAAC,EAAkB,EAAyB,CACzF,GAAI,IAAY,SAAW,IAAY,UACrC,MAAO,CACL,gCAAgC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qBAejB;AAAA;AAAA,2DAGjB,EAEF,IAAM,EAAM,IAAY,SAAW,kCAAoC,sBACjE,EACJ,IAAY,SAAW,GAAK;AAAA;AAAA,kBAAwB,6BACtD,MAAO,CACL,+BAA+B;AAAA,MAC7B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kCAY4B;AAAA,GAE9B,sCAAsC,+BAAmC,2BAC3E,ECjVK,MAAM,UAA6B,KAAM,CAKnC,KAJF,OACA,cAET,WAAW,CACA,EACT,EACA,EAAwE,CAAC,EACzE,CACA,MAAM,EAAS,EAAQ,QAAU,OAAY,CAAE,MAAO,EAAQ,KAAM,EAAI,MAAS,EAJxE,YAKT,KAAK,KAAO,uBACZ,KAAK,OAAS,EAAQ,OACtB,KAAK,cAAgB,EAAQ,cAEjC,CASO,MAAM,UAAoC,CAAqB,CAEzD,SADX,WAAW,CACA,EACT,EAAwE,CAAC,EACzE,CACA,MACE,qBACA,OAAO,4FACP,CACF,EAPS,gBAQT,KAAK,KAAO,8BAEhB,CCiCO,MAAM,CAAwB,CAC1B,OAKT,WAAW,CAAC,EAAuC,CACjD,QAAW,IAAO,CAAC,eAAgB,UAAU,EAC3C,EAAc,EAAK,EAAO,EAAI,EAEhC,GAAI,EAAO,YAAc,OAAW,EAAc,YAAa,EAAO,SAAS,EAK/E,GAAI,EAAO,aAAe,QAAa,EAAO,aAAe,MAAQ,EAAO,aAAe,GACzF,MAAU,MACR,+KAEF,EAEF,EAAc,aAAc,EAAO,UAAU,EAC7C,KAAK,OAAS,CACZ,eAAgB,IAChB,WAAY,OACZ,KAAM,GACN,oBAAqB,CAAC,EACtB,qBAAsB,MACnB,CACL,EAIF,gBAAgB,CAAC,EAA6E,CAC5F,IAAM,EAAM,IAAI,IAAI,KAAK,OAAO,YAAY,EACtC,EAAiC,IAClC,KAAK,OAAO,oBACf,cAAe,OACf,UAAW,KAAK,OAAO,SACvB,aAAc,EAAK,YACnB,MAAO,KAAK,OAAO,OAAO,KAAK,KAAK,OAAO,cAAc,EACzD,MAAO,EAAK,KACd,EACA,GAAI,KAAK,OAAO,KACd,EAAO,eAAiB,EAAK,cAC7B,EAAO,sBAAwB,OAEjC,QAAY,EAAK,KAAU,OAAO,QAAQ,CAAM,EAAG,EAAI,aAAa,IAAI,EAAK,CAAK,EAClF,OAAO,EAAI,SAAS,EAItB,YAAY,CAAC,EAA2F,CACtG,IAAM,EAAO,IAAI,gBAAgB,CAC/B,WAAY,qBACZ,KAAM,EAAK,KACX,aAAc,EAAK,WACrB,CAAC,EACD,GAAI,KAAK,OAAO,KAAM,EAAK,IAAI,gBAAiB,EAAK,YAAY,EACjE,OAAO,KAAK,aAAa,EAAM,CAAE,OAAQ,KAAK,OAAO,OAAQ,aAAc,KAAM,MAAO,UAAW,CAAC,EAOtG,OAAO,CAAC,EAAsB,EAA0C,CACtE,IAAM,EAAO,IAAI,gBAAgB,CAAE,WAAY,gBAAiB,cAAe,CAAa,CAAC,EAC7F,OAAO,KAAK,aAAa,EAAM,CAAE,SAAQ,eAAc,MAAO,SAAU,CAAC,OAIrE,OAAM,CAAC,EAAe,EAAuD,CACjF,GAAI,CAAC,KAAK,OAAO,UACf,MAAM,IAAI,EACR,qBACA,2FACF,EAEF,IAAM,EAAO,IAAI,gBAAgB,CAAE,QAAO,gBAAiB,CAAK,CAAC,EAC7D,EACJ,GAAI,CACF,EAAW,MAAM,MAAM,KAAK,OAAO,UAAW,KAAK,KAAK,CAAI,CAAC,EAC7D,MAAO,EAAO,CACd,MAAM,IAAI,EAAqB,gBAAiB,iCAAkC,CAAE,OAAM,CAAC,EAG7F,GAAI,CAAC,EAAS,GACZ,MAAM,IAAI,EACR,gBACA,6CAA6C,EAAS,WACtD,CAAE,OAAQ,EAAS,MAAO,CAC5B,EAII,IAAI,CAAC,EAAoC,CAC/C,IAAM,EAAkC,CACtC,eAAgB,oCAEhB,OAAQ,kBACV,EACA,GAAI,KAAK,OAAO,aAAe,QAAS,CACtC,IAAM,EAAc,GAAG,mBAAmB,KAAK,OAAO,QAAQ,KAAK,mBAAmB,KAAK,OAAO,YAAY,IAC9G,EAAQ,cAAgB,SAAS,OAAO,KAAK,CAAW,EAAE,SAAS,QAAQ,IAE3E,OAAK,IAAI,YAAa,KAAK,OAAO,QAAQ,EAC1C,EAAK,IAAI,gBAAiB,KAAK,OAAO,YAAY,EAEpD,MAAO,CAAE,OAAQ,OAAQ,UAAS,KAAM,EAAK,SAAS,EAAG,SAAU,OAAQ,OAG/D,aAAY,CACxB,EACA,EACwB,CACxB,IAAM,EAAU,EAAS,QAAU,WAAa,kBAAoB,iBAChE,EACJ,GAAI,CACF,EAAW,MAAM,MAAM,KAAK,OAAO,SAAU,KAAK,KAAK,CAAI,CAAC,EAC5D,MAAO,EAAO,CACd,MAAM,IAAI,EAAqB,EAAS,4BAA6B,CAAE,OAAM,CAAC,EAGhF,IAAM,EAAW,MAAM,EAAS,KAAK,EAAE,MAAM,KAAO,CAAC,EAAE,EACvD,GAAI,CAAC,EAAS,IAAM,OAAO,EAAQ,eAAiB,UAAY,EAAQ,eAAiB,GAAI,CAE3F,IAAM,EAAO,OAAO,EAAQ,QAAU,UAAY,oBAAoB,KAAK,EAAQ,KAAK,EAAI,EAAQ,MAAQ,OAC5G,MAAM,IAAI,EACR,EACA,kCAAkC,EAAS,QAAU,WAAa,OAAS,yBAChE,EAAS,SAAS,EAAO,KAAK,IAAS,OAClD,CAAE,OAAQ,EAAS,OAAQ,cAAe,CAAK,CACjD,EAGF,IAAM,EAAY,OAAO,EAAQ,UAAU,EACrC,EAAQ,OAAO,EAAQ,QAAU,SAAW,EAAQ,MAAQ,OAC5D,EAAY,EAAQ,SAAW,EAAQ,WAC7C,MAAO,CACL,YAAa,EAAQ,aACrB,aACE,OAAO,EAAQ,gBAAkB,UAAY,EAAQ,gBAAkB,GACnE,EAAQ,cACR,EAAS,aACf,UAAW,OAAO,EAAQ,aAAe,SAAW,EAAQ,WAAa,KACzE,UAAW,OAAO,SAAS,CAAS,GAAK,EAAY,EAAI,IAAI,KAAK,KAAK,IAAI,EAAI,EAAY,IAAI,EAAI,KACnG,OAAQ,IAAU,OAAY,EAAM,MAAM,QAAQ,EAAE,OAAO,OAAO,EAAI,EAAS,OAC/E,kBACE,OAAO,IAAc,UAAY,OAAO,IAAc,SAAW,OAAO,CAAS,EAAI,IACzF,EAEJ,CAEA,SAAS,CAAa,CAAC,EAAa,EAAsB,CACxD,IAAI,EACJ,GAAI,CACF,EAAM,IAAI,IAAI,OAAO,CAAK,CAAC,EAC3B,KAAM,CACN,EAAM,OAER,GAAI,CAAC,GAAQ,EAAI,WAAa,UAAY,EAAE,EAAI,WAAa,SAAW,EAAW,EAAI,QAAQ,GAC7F,MAAU,MACR,4BAA4B,yDAA2D,KAAK,UAAU,CAAK,IAC7G,EAIG,SAAS,CAAU,CAAC,EAA2B,CACpD,OAAO,IAAa,aAAe,IAAa,aAAe,IAAa,SAAW,IAAa,MC9N/F,MAAM,CAAkB,CASA,cARtB,OAAQ,mBAEP,cACS,WAAa,IAAI,IAC1B,MACA,UACC,aAA0B,CAAC,EAEpC,WAAW,CAAkB,EAAmC,CAAnC,kBAEzB,UAAS,EAA4C,CACvD,OAAO,KAAK,QAAQ,aAIlB,MAAK,EAAoB,CAC3B,GAAI,KAAK,UAAW,OAAO,KAAK,UAChC,GAAI,CAAC,KAAK,cAAe,CACvB,IAAM,EAAa,KAAK,QAAQ,MAChC,KAAK,cACH,OAAO,IAAe,WAClB,EAAW,EACV,GACD,IAAI,EAAwB,EAAI,CAAe,EAAE,WAAW,EAAG,IAAM,EAAiB,CAAC,EAE/F,OAAO,KAAK,cAGd,QAAQ,CAAC,EAAuC,CAC9C,IAAM,EAAW,KAAK,QAAQ,UAAU,GACxC,GAAI,CAAC,EAAU,CACb,IAAM,EAAQ,OAAO,KAAK,KAAK,QAAQ,SAAS,EAChD,MAAM,IAAI,EACR,mBACA,iCAAiC,0BAC9B,EAAM,OAAS,EAAI,iBAAiB,EAAM,KAAK,IAAI,MAAQ,0BAChE,EAEF,OAAO,OAIH,IAAG,CAAC,EAAuB,EAAsD,CACrF,KAAK,SAAS,CAAQ,EACtB,IAAM,EAAS,MAAM,KAAK,MAAM,KAAK,EAAQ,CAAI,EAAG,CAAQ,EAC5D,OAAO,EAAS,IAAI,EAAmB,KAAM,CAAM,EAAI,UAInD,KAAI,CAAC,EAAsD,CAE/D,OADgB,MAAM,KAAK,MAAM,KAAK,EAAQ,CAAI,CAAC,GAEhD,OAAO,CAAC,KAAW,EAAO,YAAY,KAAK,QAAQ,UAAS,EAC5D,IAAI,CAAC,IAAW,IAAI,EAAmB,KAAM,CAAM,CAAC,OAQnD,KAAI,CACR,EACA,EACA,EAC6B,CAC7B,IAAM,EAAS,KAAK,SAAS,CAAQ,EAC/B,EAAS,MAAM,KAAK,MAAM,KAAK,EAAQ,CAAI,EAAG,EAAU,CAC5D,aAAc,KACd,UAAW,KACX,UAAW,KACX,kBAAmB,KACnB,OAAQ,EAAO,OAAO,UACnB,CACL,CAAC,EACD,OAAO,IAAI,EAAmB,KAAM,CAAM,EAW5C,IAAI,CAAC,EAAkD,CAAC,EAAS,CAI/D,OAHA,KAAK,MAAQ,IAAI,IAAI,OAAO,QAAQ,CAAQ,CAAC,EAC7C,KAAK,UAAY,IAAI,EACrB,KAAK,aAAa,OAAS,EACpB,KAIT,OAAO,EAAS,CACd,KAAK,MAAQ,OACb,KAAK,UAAY,OACjB,KAAK,aAAa,OAAS,KAGzB,MAAK,EAAY,CACnB,OAAO,KAAK,QAAU,YAMlB,KAAI,CAAC,EAAkB,EAAqC,CAChE,GAAI,CAAC,KAAK,MAAO,OAAO,MAAM,CAAO,EACrC,KAAK,aAAa,KAAK,EAAQ,MAAM,CAAC,EACtC,IAAM,EAAU,KAAK,MAAM,IAAI,CAAQ,EACvC,GAAI,CAAC,EACH,MAAU,MAAM,0CAA0C,oCAA2C,qBAA4B,EAEnI,OAAO,EAAQ,CAAO,EAYxB,OAAO,CAAC,EAAqD,CAC3D,IAAM,EAAW,KAAK,WAAW,IAAI,EAAO,EAAE,EAC9C,GAAI,EAAU,OAAO,EACrB,IAAM,EAAO,KAAK,SAAS,EAAO,GAAI,IAAM,KAAK,YAAY,CAAM,CAAC,EAAE,QAAQ,IAC5E,KAAK,WAAW,OAAO,EAAO,EAAE,CAClC,EAEA,OADA,KAAK,WAAW,IAAI,EAAO,GAAI,CAAI,EAC5B,OAGK,YAAW,CAAC,EAAmD,CAE3E,IAAM,EAAU,MAAM,KAAK,MAAM,KAAK,EAAK,OAAQ,EAAK,QAAQ,EAChE,GAAI,CAAC,GAAW,EAAQ,KAAO,EAAK,GAClC,MAAM,IAAI,EAA4B,EAAK,QAAQ,EAErD,GAAI,EAAQ,WAAa,EAAK,UAAY,CAAC,EAAQ,eAAgB,OAAO,EAC1E,GAAI,EAAQ,eAAgB,MAAM,IAAI,EAA4B,EAAK,QAAQ,EAE/E,IAAM,EAAW,KAAK,SAAS,EAAQ,QAAQ,EAC/C,GAAI,KAAK,OAAS,EAAQ,eAAiB,KAAM,CAC/C,GAAI,KAAK,MAAO,OAAO,EAEvB,MADA,MAAM,KAAK,MAAM,mBAAmB,EAAQ,EAAE,EACxC,IAAI,EAA4B,EAAQ,QAAQ,EAGxD,IAAI,EACJ,GAAI,CACF,EAAS,MAAM,EAAS,QAAQ,EAAQ,aAAc,EAAQ,MAAM,EACpE,MAAO,EAAO,CAGd,GAAI,aAAiB,GAAwB,EAAM,SAAW,QAAa,EAAM,QAAU,KAAO,EAAM,OAAS,IAE/G,MADA,MAAM,KAAK,MAAM,mBAAmB,EAAQ,EAAE,EACxC,IAAI,EAA4B,EAAQ,SAAU,CACtD,MAAO,EACP,OAAQ,EAAM,OACd,cAAe,EAAM,aACvB,CAAC,EAEH,MAAM,EAGR,IAAM,EAAU,MAAM,KAAK,MAAM,aAAa,EAAQ,GAAI,EAAQ,SAAU,CAAM,EAClF,GAAI,EAAS,OAAO,EAEpB,IAAM,EAAS,MAAM,KAAK,MAAM,KAAK,EAAQ,OAAQ,EAAQ,QAAQ,EACrE,GAAI,CAAC,EAAQ,MAAM,IAAI,EAA4B,EAAQ,QAAQ,EACnE,OAAO,OAGK,SAAW,CAAC,EAAY,EAAkC,CACtE,IAAM,EAAc,EAAI,EACxB,GAAI,KAAK,OAAS,CAAC,EAAY,MAAM,CAAW,EAAG,OAAO,EAAG,EAC7D,IAAM,EAAS,MAAM,EAClB,KAAK,CAAW,EAChB,IAAI,yBAAyB,IAAM,CAAE,IAAK,MAAQ,KAAM,KAAO,EAAG,IAAM,EAAG,CAAC,EAC/E,GAAI,CAAC,EAAO,SACV,MAAM,IAAI,EACR,iBACA,qEACF,EAEF,OAAO,EAAO,MAElB,CAMO,MAAM,CAAmB,CAEX,QACT,OAFV,WAAW,CACQ,EACT,EACR,CAFiB,eACT,iBAGN,SAAQ,EAAW,CACrB,OAAO,KAAK,OAAO,YAEjB,OAAM,EAAW,CACnB,OAAO,KAAK,OAAO,UAEjB,kBAAiB,EAAkB,CACrC,OAAO,KAAK,OAAO,qBAGjB,OAAM,EAAsB,CAC9B,OAAO,KAAK,OAAO,UAEjB,UAAS,EAAgB,CAC3B,OAAO,KAAK,OAAO,aAGjB,eAAc,EAAY,CAC5B,OAAO,KAAK,OAAO,kBAEjB,YAAW,EAAS,CACtB,OAAO,KAAK,OAAO,UAIrB,SAAS,IAAI,EAA2B,CACtC,OAAO,EAAO,MAAM,CAAC,IAAU,KAAK,OAAO,OAAO,SAAS,CAAK,CAAC,OAgB7D,MAAK,CAAC,EAAqB,EAAoB,CAAC,EAAsB,CAC1E,IAAM,EAAM,KAAK,WAAW,CAAK,EAC3B,EAAS,MAAM,KAAK,QAAQ,EAC5B,EAAQ,MAAM,KAAK,KAAK,EAAK,EAAM,EAAO,WAAW,EAG3D,GAAI,EAAM,SAAS,SAAW,KAAO,CAAC,EAAM,YAAc,EAAK,gBAAgB,eAC7E,OAAO,EAAM,SAGf,MAAM,EAAM,SAAS,MAAM,OAAO,EAAE,MAAM,IAAM,EAAE,EAClD,IAAM,EAAY,MAAM,KAAK,YAAY,CAAM,EAC/C,OAAQ,MAAM,KAAK,KAAK,EAAK,EAAM,EAAU,WAAW,GAAG,cAOvD,YAAW,EAAoB,CACnC,OAAQ,MAAM,KAAK,QAAQ,GAAG,iBAI1B,QAAO,EAAkB,CAC7B,MAAM,KAAK,YAAY,KAAK,MAAM,OAW9B,OAAM,EAAkB,CAC5B,GAAI,CAAC,KAAK,QAAQ,MAAO,CACvB,IAAM,EAAW,KAAK,QAAQ,SAAS,KAAK,OAAO,QAAQ,EAC3D,GAAI,KAAK,OAAO,eAAiB,KAC/B,MAAM,EAAS,OAAO,KAAK,OAAO,aAAc,eAAe,EAE/D,WAAM,EAAS,OAAO,KAAK,OAAO,YAAa,cAAc,EAGjE,MAAM,KAAK,QAAQ,MAAM,OAAO,KAAK,OAAO,EAAE,OAI1C,WAAU,EAAkB,CAChC,MAAM,KAAK,QAAQ,MAAM,OAAO,KAAK,OAAO,EAAE,EAGhD,MAAM,EAAG,CACP,MAAO,CACL,SAAU,KAAK,SACf,kBAAmB,KAAK,kBACxB,OAAQ,CAAC,GAAG,KAAK,MAAM,EACvB,UAAW,KAAK,UAChB,eAAgB,KAAK,eACrB,YAAa,KAAK,WACpB,GAGD,OAAO,IAAI,4BAA4B,EAAE,EAAG,CAC3C,MAAO,CAAE,mBAAoB,KAAK,OAAO,CAAE,OAG/B,QAAO,EAA8B,CACjD,GAAI,KAAK,OAAO,eAAgB,MAAM,IAAI,EAA4B,KAAK,OAAO,QAAQ,EAC1F,IAAM,EAAS,KAAK,QAAQ,SAAS,KAAK,OAAO,QAAQ,EAAE,OAAO,qBAAuB,KACnF,EAAY,KAAK,OAAO,WAAW,QAAQ,EACjD,GAAI,IAAc,QAAa,EAAY,KAAK,IAAI,GAAK,EACvD,OAAO,KAAK,YAAY,KAAK,MAAM,EAErC,OAAO,KAAK,YAGA,YAAW,CAAC,EAAqD,CAC7E,GAAI,CACF,KAAK,OAAS,MAAM,KAAK,QAAQ,QAAQ,CAAM,EAC/C,MAAO,EAAO,CACd,GAAI,aAAiB,EACnB,KAAK,OAAS,IAAK,KAAK,OAAQ,eAAgB,EAAK,EAEvD,MAAM,EAER,OAAO,KAAK,OAGN,UAAU,CAAC,EAA0B,CAC3C,IAAM,EAAO,KAAK,QAAQ,SAAS,KAAK,OAAO,QAAQ,EAAE,OAAO,WAC5D,EACJ,GAAI,CACF,EAAM,IAAI,IAAI,OAAO,CAAK,EAAG,CAAI,EACjC,KAAM,CACN,MAAM,IAAI,EACR,gBACA,8BAA8B,KAAK,UAAU,OAAO,CAAK,CAAC,wBAC5D,EAEF,GAAI,EAAI,SAAW,IAAI,IAAI,CAAI,EAAE,OAC/B,MAAM,IAAI,EACR,gBACA,mCAAmC,KAAK,OAAO,qBAAqB,IAAI,IAAI,CAAI,EAAE,+BACxD,EAAI,SAChC,EAEF,GAAI,EAAI,WAAa,UAAY,EAAE,EAAI,WAAa,SAAW,EAAW,EAAI,QAAQ,GACpF,MAAM,IAAI,EACR,gBACA,0DAA0D,EAAI,SAChE,EAEF,OAAO,OAGK,KAAI,CAAC,EAAU,EAAmB,EAAqE,CACnH,IAAI,EAAS,EACT,GAAU,EAAK,QAAU,OAAO,YAAY,EAC5C,EAAO,EAAK,KACZ,EAAa,GAIjB,GAAI,EAAK,WAAa,UAAY,EAAK,WAAa,QAElD,MAAO,CAAE,SADQ,MAAM,KAAK,QAAQ,KAAK,KAAK,OAAO,SAAU,KAAK,QAAQ,EAAQ,EAAM,EAAQ,EAAM,CAAK,CAAC,EAC3F,YAAW,EAGhC,QAAS,EAAM,GAAK,IAAO,CACzB,IAAM,EAAU,KAAK,QAAQ,EAAQ,IAAK,EAAM,SAAU,QAAS,EAAG,EAAQ,EAAM,EAAa,EAAQ,IAAI,EACvG,EAAW,MAAM,KAAK,QAAQ,KAAK,KAAK,OAAO,SAAU,CAAO,EAChE,EAAW,EAAS,QAAQ,IAAI,UAAU,EAChD,GAAI,CAAC,EAAU,IAAI,EAAS,MAAM,GAAK,IAAa,MAAQ,GAAO,EAAG,MAAO,CAAE,WAAU,YAAW,EAEpG,MAAM,EAAS,MAAM,OAAO,EAAE,MAAM,IAAM,EAAE,EAC5C,IAAM,EAAO,IAAI,IAAI,EAAU,CAAM,EACrC,GAAI,EAAK,SAAW,EAAO,OAAQ,EAAa,GAChD,GAAI,EAAS,SAAW,MAAS,EAAS,SAAW,KAAO,EAAS,SAAW,MAAQ,IAAW,OACjG,EAAS,MACT,EAAO,OAET,EAAS,GAIL,OAAO,CAAC,EAAU,EAAmB,EAAgB,EAA2B,EAA+B,CACrH,IAAM,EAAU,IAAI,QAAQ,EAAK,OAAO,EACxC,GAAI,IAAU,KAAM,EAAQ,OAAO,eAAe,EAC7C,OAAQ,IAAI,gBAAiB,UAAU,GAAO,EACnD,OAAO,IAAI,QAAQ,EAAK,IAAK,EAAM,SAAQ,OAAM,SAAQ,CAAC,EAE9D,CAEA,IAAM,EAAY,IAAI,IAAI,CAAC,IAAK,IAAK,IAAK,IAAK,GAAG,CAAC,EAEnD,SAAS,CAAO,CAAC,EAA+B,CAC9C,IAAM,EAAK,OAAO,IAAS,UAAY,IAAS,KAAO,EAAK,GAAK,EACjE,GAAI,IAAO,QAAa,IAAO,MAAQ,IAAO,GAC5C,MAAU,UAAU,mEAAmE,EAEzF,OAAO,OAAO,CAAE",
+  "debugId": "BEC29388D06EAD9164756E2164756E21",
+  "names": []
+}

package/dist/{chunk-t4yh4nf9.js → chunk-076jezzg.js}

@@ -1,5 +1,5 @@
 // @bun
-import{di as B}from"./chunk-1vzks22y.js";function $(z){return z.split(".")}class Y{static token="config";items;constructor(z={}){this.items=z}has(z){let F=this.items;for(let E of $(z)){if(F===null||typeof F!=="object"||!(E in F))return!1;F=F[E]}return!0}get(z,F){let E=this.items;for(let G of $(z)){if(E===null||typeof E!=="object"||!(G in E))return F;E=E[G]}return E===void 0?F:E}getMany(z){let F=Array.isArray(z)?z.map((G)=>[G,void 0]):Object.entries(z),E={};for(let[G,H]of F)E[G]=this.get(G,H);return E}set(z,F){let E=typeof z==="string"?[[z,F]]:Object.entries(z);for(let[G,H]of E){let U=$(G),Z=U.pop(),J=this.items;for(let Q of U){let W=J[Q];if(W===null||typeof W!=="object")J[Q]={};J=J[Q]}J[Z]=H}}prepend(z,F){let E=this.get(z,[]);E.unshift(F),this.set(z,E)}push(z,F){let E=this.get(z,[]);E.push(F),this.set(z,E)}merge(z){for(let[F,E]of Object.entries(z)){let G=this.items[F];if(G!==null&&typeof G==="object"&&!Array.isArray(G)&&E!==null&&typeof E==="object"&&!Array.isArray(E))this.items[F]={...G,...E};else this.items[F]=E}}all(){return this.items}}var j=Symbol.for("gemi.foundation.Application");class X extends B{[j]=!0;static isApplication(z){return typeof z==="object"&&z!==null&&j in z}config;providers=[];booted=!1;constructor(z=new Y){super();this.config=z,this.instance(Y,z)}static currentInstance;static getInstance(){return X.currentInstance}static setInstance(z){return X.currentInstance=z,z}register(z){let F=this.providers.find((G)=>G instanceof z);if(F)return F;let E=new z(this);return E.register(),this.providers.push(E),E}registerMany(z){for(let F of z)this.register(F)}getProviders(){return[...this.providers]}isBooted(){return this.booted}async boot(){if(this.booted)return;for(let z of this.providers)await z.boot();this.booted=!0}shutdown(z={}){return this.shutdownPromise??=this.shutdownProviders(z.timeoutMs??5000),this.shutdownPromise}shutdownPromise;async shutdownProviders(z){let F={failed:[],timedOut:[]};if(z<=0){if(this.providers.length>0)console.log(`[gemi] Skipping ${this.providers.length} provider shutdown hook(s): no time is budgeted for them.`);return F}let E=Date.now()+z;for(let G of[...this.providers].reverse()){let H=G.constructor.name,U=E-Date.now();if(U<=0){console.error(`[gemi] ${H}.shutdown() skipped: the provider shutdown deadline had passed.`),F.timedOut.push(H);continue}let Z,J=await Promise.race([Promise.resolve().then(()=>G.shutdown({timeoutMs:U})).then((Q)=>Q?.abandoned?"abandoned":"done",(Q)=>{return console.error(`[gemi] ${H}.shutdown() failed:`,Q),"failed"}),new Promise((Q)=>{Z=setTimeout(()=>Q("timeout"),U)})]);if(clearTimeout(Z),J==="failed")F.failed.push(H);if(J==="abandoned")F.timedOut.push(H);if(J==="timeout")console.error(`[gemi] ${H}.shutdown() did not finish within the provider shutdown deadline; moving on.`),F.timedOut.push(H)}return F}flush(){super.flush(),this.instance(Y,this.config),this.providers=[],this.booted=!1,this.shutdownPromise=void 0}}import{AsyncLocalStorage as K}from"async_hooks";var D=new K;function I(z){let F=D.getStore(),E=X.isApplication(F)?F:X.getInstance();if(!E)throw Error("No Application instance is available. Boot a Kernel before resolving services.");return z?E.make(z):E}
-export{D as _h,Y as $h,X as ai,I as bi};
+import{Ii as B}from"./chunk-wk1tp1f1.js";function $(z){return z.split(".")}class Y{static token="config";items;constructor(z={}){this.items=z}has(z){let F=this.items;for(let E of $(z)){if(F===null||typeof F!=="object"||!(E in F))return!1;F=F[E]}return!0}get(z,F){let E=this.items;for(let G of $(z)){if(E===null||typeof E!=="object"||!(G in E))return F;E=E[G]}return E===void 0?F:E}getMany(z){let F=Array.isArray(z)?z.map((G)=>[G,void 0]):Object.entries(z),E={};for(let[G,H]of F)E[G]=this.get(G,H);return E}set(z,F){let E=typeof z==="string"?[[z,F]]:Object.entries(z);for(let[G,H]of E){let U=$(G),Z=U.pop(),J=this.items;for(let Q of U){let W=J[Q];if(W===null||typeof W!=="object")J[Q]={};J=J[Q]}J[Z]=H}}prepend(z,F){let E=this.get(z,[]);E.unshift(F),this.set(z,E)}push(z,F){let E=this.get(z,[]);E.push(F),this.set(z,E)}merge(z){for(let[F,E]of Object.entries(z)){let G=this.items[F];if(G!==null&&typeof G==="object"&&!Array.isArray(G)&&E!==null&&typeof E==="object"&&!Array.isArray(E))this.items[F]={...G,...E};else this.items[F]=E}}all(){return this.items}}var j=Symbol.for("gemi.foundation.Application");class X extends B{[j]=!0;static isApplication(z){return typeof z==="object"&&z!==null&&j in z}config;providers=[];booted=!1;constructor(z=new Y){super();this.config=z,this.instance(Y,z)}static currentInstance;static getInstance(){return X.currentInstance}static setInstance(z){return X.currentInstance=z,z}register(z){let F=this.providers.find((G)=>G instanceof z);if(F)return F;let E=new z(this);return E.register(),this.providers.push(E),E}registerMany(z){for(let F of z)this.register(F)}getProviders(){return[...this.providers]}isBooted(){return this.booted}async boot(){if(this.booted)return;for(let z of this.providers)await z.boot();this.booted=!0}shutdown(z={}){return this.shutdownPromise??=this.shutdownProviders(z.timeoutMs??5000),this.shutdownPromise}shutdownPromise;async shutdownProviders(z){let F={failed:[],timedOut:[]};if(z<=0){if(this.providers.length>0)console.log(`[gemi] Skipping ${this.providers.length} provider shutdown hook(s): no time is budgeted for them.`);return F}let E=Date.now()+z;for(let G of[...this.providers].reverse()){let H=G.constructor.name,U=E-Date.now();if(U<=0){console.error(`[gemi] ${H}.shutdown() skipped: the provider shutdown deadline had passed.`),F.timedOut.push(H);continue}let Z,J=await Promise.race([Promise.resolve().then(()=>G.shutdown({timeoutMs:U})).then((Q)=>Q?.abandoned?"abandoned":"done",(Q)=>{return console.error(`[gemi] ${H}.shutdown() failed:`,Q),"failed"}),new Promise((Q)=>{Z=setTimeout(()=>Q("timeout"),U)})]);if(clearTimeout(Z),J==="failed")F.failed.push(H);if(J==="abandoned")F.timedOut.push(H);if(J==="timeout")console.error(`[gemi] ${H}.shutdown() did not finish within the provider shutdown deadline; moving on.`),F.timedOut.push(H)}return F}flush(){super.flush(),this.instance(Y,this.config),this.providers=[],this.booted=!1,this.shutdownPromise=void 0}}import{AsyncLocalStorage as K}from"async_hooks";var D=new K;function I(z){let F=D.getStore(),E=X.isApplication(F)?F:X.getInstance();if(!E)throw Error("No Application instance is available. Boot a Kernel before resolving services.");return z?E.make(z):E}
+export{D as Di,Y as Ei,X as Fi,I as Gi};
 
-//# debugId=D54DFD494A23092264756E2164756E21
+//# debugId=35C54F1C6EC4C09C64756E2164756E21

package/dist/{chunk-t4yh4nf9.js.map → chunk-076jezzg.js.map}

@@ -8,6 +8,6 @@
     "import type { ServiceToken } from \"../container/Container\";\nimport { kernelContext } from \"../kernel/context\";\nimport { Application } from \"./Application\";\n\n/**\n * Resolves the Application for the current async context. Reads the kernel\n * AsyncLocalStorage — there is exactly one ALS in the framework, and\n * `Kernel.run()` stores the Application in it, so this is the primary path for\n * anything running inside a request or a cron tick.\n *\n * The static instance (Laravel's `Container::setInstance`, set by\n * `Kernel.boot()`) is the fallback for code that runs outside any `run()`\n * scope — build-time tooling, module top level, a stray `setTimeout`.\n */\nexport function app(): Application;\nexport function app<T>(token: ServiceToken<T>): T;\nexport function app<T>(token?: ServiceToken<T>): Application | T {\n  const store = kernelContext.getStore();\n  const instance = Application.isApplication(store)\n    ? store\n    : Application.getInstance();\n\n  if (!instance) {\n    throw new Error(\n      \"No Application instance is available. Boot a Kernel before resolving services.\",\n    );\n  }\n\n  return token ? instance.make(token) : instance;\n}\n"
   ],
   "mappings": ";yCAOA,SAAS,CAAQ,CAAC,EAAuB,CACvC,OAAO,EAAI,MAAM,GAAG,EAGf,MAAM,CAAW,OAGf,OAAQ,SAEP,MAER,WAAW,CAAC,EAAqB,CAAC,EAAG,CACnC,KAAK,MAAQ,EAGf,GAAG,CAAC,EAAsB,CACxB,IAAI,EAAc,KAAK,MACvB,QAAW,KAAW,EAAS,CAAG,EAAG,CACnC,GAAI,IAAW,MAAQ,OAAO,IAAW,UAAY,EAAE,KAAW,GAChE,MAAO,GAET,EAAS,EAAO,GAElB,MAAO,GAGT,GAAY,CAAC,EAAa,EAAqB,CAC7C,IAAI,EAAc,KAAK,MACvB,QAAW,KAAW,EAAS,CAAG,EAAG,CACnC,GAAI,IAAW,MAAQ,OAAO,IAAW,UAAY,EAAE,KAAW,GAChE,OAAO,EAET,EAAS,EAAO,GAElB,OAAO,IAAW,OAAa,EAAsB,EAKvD,OAAO,CAAC,EAA2D,CACjE,IAAM,EAAgC,MAAM,QAAQ,CAAI,EACpD,EAAK,IAAI,CAAC,IAAuB,CAAC,EAAK,MAAS,CAAC,EACjD,OAAO,QAAQ,CAAI,EAEjB,EAA8B,CAAC,EACrC,QAAY,EAAK,KAAiB,EAChC,EAAO,GAAO,KAAK,IAAI,EAAK,CAAY,EAE1C,OAAO,EAGT,GAAG,CAAC,EAAmC,EAAmB,CACxD,IAAM,EACJ,OAAO,IAAQ,SAAW,CAAC,CAAC,EAAK,CAAK,CAAC,EAAI,OAAO,QAAQ,CAAG,EAE/D,QAAY,EAAM,KAAS,EAAS,CAClC,IAAM,EAAQ,EAAS,CAAI,EACrB,EAAO,EAAM,IAAI,EAEnB,EAAc,KAAK,MACvB,QAAW,KAAW,EAAO,CAC3B,IAAM,EAAO,EAAO,GACpB,GAAI,IAAS,MAAQ,OAAO,IAAS,SACnC,EAAO,GAAW,CAAC,EAErB,EAAS,EAAO,GAGlB,EAAO,GAAQ,GAKnB,OAAO,CAAC,EAAa,EAAkB,CACrC,IAAM,EAAQ,KAAK,IAAW,EAAK,CAAC,CAAC,EACrC,EAAM,QAAQ,CAAK,EACnB,KAAK,IAAI,EAAK,CAAK,EAIrB,IAAI,CAAC,EAAa,EAAkB,CAClC,IAAM,EAAQ,KAAK,IAAW,EAAK,CAAC,CAAC,EACrC,EAAM,KAAK,CAAK,EAChB,KAAK,IAAI,EAAK,CAAK,EAKrB,KAAK,CAAC,EAA0B,CAC9B,QAAY,EAAK,KAAU,OAAO,QAAQ,CAAK,EAAG,CAChD,IAAM,EAAU,KAAK,MAAM,GAC3B,GACE,IAAY,MACZ,OAAO,IAAY,UACnB,CAAC,MAAM,QAAQ,CAAO,GACtB,IAAU,MACV,OAAO,IAAU,UACjB,CAAC,MAAM,QAAQ,CAAK,EAEpB,KAAK,MAAM,GAAO,IAAK,KAAY,CAAM,EAEzC,UAAK,MAAM,GAAO,GAKxB,GAAG,EAAgB,CACjB,OAAO,KAAK,MAEhB,CC7FA,IAAM,EAAoB,OAAO,IAAI,6BAA6B,EAE3D,MAAM,UAAoB,CAAU,EAC/B,GAAqB,SAExB,cAAa,CAAC,EAAsC,CACzD,OACE,OAAO,IAAU,UAAY,IAAU,MAAQ,KAAqB,EAQ/D,OAED,UAA+B,CAAC,EAChC,OAAS,GAEjB,WAAW,CAAC,EAAqB,IAAI,EAAc,CACjD,MAAM,EACN,KAAK,OAAS,EACd,KAAK,SAAS,EAAY,CAAM,QAGnB,uBAER,YAAW,EAA4B,CAC5C,OAAO,EAAY,sBAGd,YAAW,CAAC,EAA8B,CAE/C,OADA,EAAY,gBAAkB,EACvB,EAQT,QAAQ,CAAC,EAAuD,CAC9D,IAAM,EAAW,KAAK,UAAU,KAAK,CAAC,IAAM,aAAa,CAAQ,EACjE,GAAI,EACF,OAAO,EAGT,IAAM,EAAW,IAAI,EAAS,IAAI,EAGlC,OAFA,EAAS,SAAS,EAClB,KAAK,UAAU,KAAK,CAAQ,EACrB,EAGT,YAAY,CAAC,EAAyC,CACpD,QAAW,KAAY,EACrB,KAAK,SAAS,CAAQ,EAI1B,YAAY,EAAsB,CAChC,MAAO,CAAC,GAAG,KAAK,SAAS,EAG3B,QAAQ,EAAY,CAClB,OAAO,KAAK,YAOR,KAAI,EAAkB,CAC1B,GAAI,KAAK,OACP,OAEF,QAAW,KAAY,KAAK,UAC1B,MAAM,EAAS,KAAK,EAEtB,KAAK,OAAS,GA4BhB,QAAQ,CAAC,EAAkC,CAAC,EAA4B,CAEtE,OADA,KAAK,kBAAoB,KAAK,kBAAkB,EAAQ,WAAa,IAAK,EACnE,KAAK,gBAGN,qBAEM,kBAAiB,CAAC,EAA4C,CAC1E,IAAM,EAAyB,CAAE,OAAQ,CAAC,EAAG,SAAU,CAAC,CAAE,EAS1D,GAAI,GAAa,EAAG,CAClB,GAAI,KAAK,UAAU,OAAS,EAC1B,QAAQ,IACN,mBAAmB,KAAK,UAAU,iEACpC,EAEF,OAAO,EAGT,IAAM,EAAW,KAAK,IAAI,EAAI,EAE9B,QAAW,IAAY,CAAC,GAAG,KAAK,SAAS,EAAE,QAAQ,EAAG,CACpD,IAAM,EAAO,EAAS,YAAY,KAC5B,EAAY,EAAW,KAAK,IAAI,EACtC,GAAI,GAAa,EAAG,CAClB,QAAQ,MACN,UAAU,kEACZ,EACA,EAAO,SAAS,KAAK,CAAI,EACzB,SAGF,IAAI,EACE,EAAU,MAAM,QAAQ,KAAK,CAGjC,QAAQ,QAAQ,EAIb,KAAK,IAAM,EAAS,SAAS,CAAE,UAAW,CAAU,CAAC,CAAC,EACtD,KACC,CAAC,IACE,GAAgD,UAC5C,YACA,OACP,CAAC,IAAmB,CAElB,OADA,QAAQ,MAAM,UAAU,uBAA2B,CAAK,EACjD,SAEX,EACF,IAAI,QAAmB,CAAC,IAAY,CAClC,EAAQ,WAAW,IAAM,EAAQ,SAAS,EAAG,CAAS,EACvD,CACH,CAAC,EAGD,GAFA,aAAa,CAAK,EAEd,IAAY,SAAU,EAAO,OAAO,KAAK,CAAI,EAGjD,GAAI,IAAY,YAAa,EAAO,SAAS,KAAK,CAAI,EACtD,GAAI,IAAY,UACd,QAAQ,MACN,UAAU,+EACZ,EACA,EAAO,SAAS,KAAK,CAAI,EAI7B,OAAO,EAGT,KAAK,EAAG,CACN,MAAM,MAAM,EACZ,KAAK,SAAS,EAAY,KAAK,MAAM,EACrC,KAAK,UAAY,CAAC,EAClB,KAAK,OAAS,GACd,KAAK,gBAAkB,OAE3B,CCxNA,4BAAS,oBA4CF,IAAM,EAAgB,IAAI,EC5B1B,SAAS,CAAM,CAAC,EAA0C,CAC/D,IAAM,EAAQ,EAAc,SAAS,EAC/B,EAAW,EAAY,cAAc,CAAK,EAC5C,EACA,EAAY,YAAY,EAE5B,GAAI,CAAC,EACH,MAAU,MACR,gFACF,EAGF,OAAO,EAAQ,EAAS,KAAK,CAAK,EAAI",
-  "debugId": "D54DFD494A23092264756E2164756E21",
+  "debugId": "35C54F1C6EC4C09C64756E2164756E21",
   "names": []
 }

package/dist/{chunk-qjhw8nje.js → chunk-077rea02.js}

@@ -1,5 +1,5 @@
 // @bun
-import"./chunk-vw8849ys.js";import Eu from"os";import Au from"fs";var Wl=new Map,hh=new Map,nh=Symbol("OriginError"),Dl={};class fl extends Promise{constructor(l,n,u,c,w={}){let E,t;super((_,B)=>{E=_,t=B});this.tagged=Array.isArray(l.raw),this.strings=l,this.args=n,this.handler=u,this.canceller=c,this.options=w,this.state=null,this.statement=null,this.resolve=(_)=>(this.active=!1,E(_)),this.reject=(_)=>(this.active=!1,t(_)),this.active=!1,this.cancelled=null,this.executed=!1,this.signature="",this[nh]=this.handler.debug?Error():this.tagged&&vn(this.strings)}get origin(){return(this.handler.debug?this[nh].stack:this.tagged&&hh.has(this.strings)?hh.get(this.strings):hh.set(this.strings,this[nh].stack).get(this.strings))||""}static get[Symbol.species](){return Promise}cancel(){return this.canceller&&(this.canceller(this),this.canceller=null)}simple(){return this.options.simple=!0,this.options.prepare=!1,this}async readable(){return this.simple(),this.streaming=!0,this}async writable(){return this.simple(),this.streaming=!0,this}cursor(l=1,n){if(this.options.simple=!1,typeof l==="function")n=l,l=1;if(this.cursorRows=l,typeof n==="function")return this.cursorFn=n,this;let u;return{[Symbol.asyncIterator]:()=>({next:()=>{if(this.executed&&!this.active)return{done:!0};u&&u();let c=new Promise((w,E)=>{this.cursorFn=(t)=>{return w({value:t,done:!1}),new Promise((_)=>u=_)},this.resolve=()=>(this.active=!1,w({done:!0})),this.reject=(t)=>(this.active=!1,E(t))});return this.execute(),c},return(){return u&&u(Dl),{done:!0}}})}}describe(){return this.options.simple=!1,this.onlyDescribe=this.options.prepare=!0,this}stream(){throw Error(".stream has been renamed to .forEach")}forEach(l){return this.forEachFn=l,this.handle(),this}raw(){return this.isRaw=!0,this}values(){return this.isRaw="values",this}async handle(){!this.executed&&(this.executed=!0)&&await 1&&this.handler(this)}execute(){return this.handle(),this}then(){return this.handle(),super.then.apply(this,arguments)}catch(){return this.handle(),super.catch.apply(this,arguments)}finally(){return this.handle(),super.finally.apply(this,arguments)}}function vn(l){if(Wl.has(l))return Wl.get(l);let n=Error.stackTraceLimit;return Error.stackTraceLimit=4,Wl.set(l,Error()),Error.stackTraceLimit=n,Wl.get(l)}class Yl extends Error{constructor(l){super(l.message);this.name=this.constructor.name,Object.assign(this,l)}}var K={connection:Th,postgres:Xh,generic:Ch,notSupported:Zh};function Th(l,n,u){let{host:c,port:w}=u||n,E=Object.assign(Error("write "+l+" "+(n.path||c+":"+w)),{code:l,errno:l,address:n.path||c},n.path?{}:{port:w});return Error.captureStackTrace(E,Th),E}function Xh(l){let n=new Yl(l);return Error.captureStackTrace(n,Xh),n}function Ch(l,n){let u=Object.assign(Error(l+": "+n),{code:l});return Error.captureStackTrace(u,Ch),u}function Zh(l){let n=Object.assign(Error(l+" (B) is not supported"),{code:"MESSAGE_NOT_SUPPORTED",name:l});return Error.captureStackTrace(n,Zh),n}var mn={string:{to:25,from:null,serialize:(l)=>""+l},number:{to:0,from:[21,23,26,700,701],serialize:(l)=>""+l,parse:(l)=>+l},json:{to:114,from:[114,3802],serialize:(l)=>JSON.stringify(l),parse:(l)=>JSON.parse(l)},boolean:{to:16,from:16,serialize:(l)=>l===!0?"t":"f",parse:(l)=>l==="t"},date:{to:1184,from:[1082,1114,1184],serialize:(l)=>(l instanceof Date?l:new Date(l)).toISOString(),parse:(l)=>new Date(l)},bytea:{to:17,from:17,serialize:(l)=>"\\x"+Buffer.from(l).toString("hex"),parse:(l)=>Buffer.from(l.slice(2),"hex")}};class ml{then(){uh()}catch(){uh()}finally(){uh()}}class il extends ml{constructor(l){super();this.value=el(l)}}class wl extends ml{constructor(l,n,u){super();this.value=l,this.type=n,this.array=u}}class bl extends ml{constructor(l,n){super();this.first=l,this.rest=n}build(l,n,u,c){let w=bn.map(([E,t])=>({fn:t,i:l.search(E)})).sort((E,t)=>E.i-t.i).pop();return w.i===-1?_h(this.first,c):w.fn(this.first,this.rest,n,u,c)}}function al(l,n,u,c){let w=l instanceof wl?l.value:l;if(w===void 0){if(l instanceof wl?l.value=c.transform.undefined:w=l=c.transform.undefined,w===void 0)throw K.generic("UNDEFINED_VALUE","Undefined values are not allowed")}return"$"+u.push(l instanceof wl?(n.push(l.value),l.array?l.array[l.type||vl(l.value)]||l.type||ih(l.value):l.type):(n.push(l),vl(l)))}var Hh=Qh(mn);function th(l,n,u,c,w,E){for(let t=1;t<l.strings.length;t++)n+=wh(n,u,c,w,E)+l.strings[t],u=l.args[t];return n}function wh(l,n,u,c,w){return n instanceof bl?n.build(l,u,c,w):n instanceof fl?ch(n,u,c,w):n instanceof il?n.value:n&&n[0]instanceof fl?n.reduce((E,t)=>E+" "+ch(t,u,c,w),""):al(n,u,c,w)}function ch(l,n,u,c){return l.fragment=!0,th(l,l.strings[0],l.args[0],n,u,c)}function zh(l,n,u,c,w){return l.map((E)=>"("+c.map((t)=>wh("values",E[t],n,u,w)).join(",")+")").join(",")}function Fh(l,n,u,c,w){let E=Array.isArray(l[0]),t=n.length?n.flat():Object.keys(E?l[0]:l);return zh(E?l:[l],u,c,t,w)}function Kl(l,n,u,c,w){if(typeof l==="string"&&(l=[l].concat(n)),Array.isArray(l))return _h(l,w);let E;return(n.length?n.flat():Object.keys(l)).map((_)=>{return E=l[_],(E instanceof fl?ch(E,u,c,w):E instanceof il?E.value:al(E,u,c,w))+" as "+el(w.transform.column.to?w.transform.column.to(_):_)}).join(",")}var bn=Object.entries({values:Fh,in:(...l)=>{let n=Fh(...l);return n==="()"?"(null)":n},select:Kl,as:Kl,returning:Kl,"\\(":Kl,update(l,n,u,c,w){return(n.length?n.flat():Object.keys(l)).map((E)=>el(w.transform.column.to?w.transform.column.to(E):E)+"="+wh("values",l[E],u,c,w))},insert(l,n,u,c,w){let E=n.length?n.flat():Object.keys(Array.isArray(l)?l[0]:l);return"("+_h(E,w)+")values"+zh(Array.isArray(l)?l:[l],u,c,E,w)}}).map(([l,n])=>[new RegExp("((?:^|[\\s(])"+l+"(?:$|[\\s(]))(?![\\s\\S]*\\1)","i"),n]);function uh(){throw K.generic("NOT_TAGGED_CALL","Query not called as a tagged template literal")}var{serializers:an,parsers:en}=Hh;function ih(l){if(Array.isArray(l))return ih(l[0]);return typeof l==="string"?1009:0}var Jh=function(l){let n=Qh(l||{});return{serializers:Object.assign({},an,n.serializers),parsers:Object.assign({},en,n.parsers)}};function Qh(l){return Object.keys(l).reduce((n,u)=>{if(l[u].from&&[].concat(l[u].from).forEach((c)=>n.parsers[c]=l[u].parse),l[u].serialize)n.serializers[l[u].to]=l[u].serialize,l[u].from&&[].concat(l[u].from).forEach((c)=>n.serializers[c]=l[u].serialize);return n},{parsers:{},serializers:{}})}function _h(l,{transform:{column:n}}){return l.map((u)=>el(n.to?n.to(u):u)).join(",")}var el=function(n){return'"'+n.replace(/"/g,'""').replace(/\./g,'"."')+'"'},vl=function l(n){return n instanceof wl?n.type:n instanceof Date?1184:n instanceof Uint8Array?17:n===!0||n===!1?16:typeof n==="bigint"?20:Array.isArray(n)?l(n[0]):0},kn=/\\/g,on=/"/g;function pn(l){return l.replace(kn,"\\\\").replace(on,"\\\"")}var Vh=function l(n,u,c,w){if(Array.isArray(n)===!1)return n;if(!n.length)return"{}";let E=n[0],t=w===1020?";":",";if(Array.isArray(E)&&!E.type)return"{"+n.map((_)=>l(_,u,c,w)).join(t)+"}";return"{"+n.map((_)=>{if(_===void 0){if(_=c.transform.undefined,_===void 0)throw K.generic("UNDEFINED_VALUE","Undefined values are not allowed")}return _===null?"null":'"'+pn(u?u(_.type?_.value:_):""+_)+'"'}).join(t)+"}"},fh={i:0,char:null,str:"",quoted:!1,last:0},Wh=function(n,u,c){return fh.i=fh.last=0,Kh(fh,n,u,c)};function Kh(l,n,u,c){let w=[],E=c===1020?";":",";for(;l.i<n.length;l.i++){if(l.char=n[l.i],l.quoted)if(l.char==="\\")l.str+=n[++l.i];else if(l.char==='"')w.push(u?u(l.str):l.str),l.str="",l.quoted=n[l.i+1]==='"',l.last=l.i+2;else l.str+=l.char;else if(l.char==='"')l.quoted=!0;else if(l.char==="{")l.last=++l.i,w.push(Kh(l,n,u,c));else if(l.char==="}"){l.quoted=!1,l.last<l.i&&w.push(u?u(n.slice(l.last,l.i)):n.slice(l.last,l.i)),l.last=l.i+1;break}else if(l.char===E&&l.p!=="}"&&l.p!=='"')w.push(u?u(n.slice(l.last,l.i)):n.slice(l.last,l.i)),l.last=l.i+1;l.p=l.char}return l.last<l.i&&w.push(u?u(n.slice(l.last,l.i+1)):n.slice(l.last,l.i+1)),w}var Sl=(l)=>{let n=l[0];for(let u=1;u<l.length;u++)n+=l[u]==="_"?l[++u].toUpperCase():l[u];return n},Gl=(l)=>{let n=l[0].toUpperCase();for(let u=1;u<l.length;u++)n+=l[u]==="_"?l[++u].toUpperCase():l[u];return n},jl=(l)=>l.replace(/_/g,"-"),Fl=(l)=>l.replace(/([A-Z])/g,"_$1").toLowerCase(),Hl=(l)=>(l.slice(0,1)+l.slice(1).replace(/([A-Z])/g,"_$1")).toLowerCase(),zl=(l)=>l.replace(/-/g,"_");function Oh(l){return function n(u,c){return typeof u==="object"&&u!==null&&(c.type===114||c.type===3802)?Array.isArray(u)?u.map((w)=>n(w,c)):Object.entries(u).reduce((w,[E,t])=>Object.assign(w,{[l(E)]:n(t,c)}),{}):u}}Sl.column={from:Sl};Sl.value={from:Oh(Sl)};Fl.column={to:Fl};var Eh={...Sl};Eh.column.to=Fl;Gl.column={from:Gl};Gl.value={from:Oh(Gl)};Hl.column={to:Hl};var Ah={...Gl};Ah.column.to=Hl;jl.column={from:jl};jl.value={from:Oh(jl)};zl.column={to:zl};var Uh={...jl};Uh.column.to=zl;import vh from"net";import qn from"tls";import Jl from"crypto";import $h from"stream";import{performance as mh}from"perf_hooks";class Ml extends Array{constructor(){super();Object.defineProperties(this,{count:{value:null,writable:!0},state:{value:null,writable:!0},command:{value:null,writable:!0},columns:{value:null,writable:!0},statement:{value:null,writable:!0}})}static get[Symbol.species](){return Array}}var hl=yn;function yn(l=[]){let n=l.slice(),u=0;return{get length(){return n.length-u},remove:(c)=>{let w=n.indexOf(c);return w===-1?null:(n.splice(w,1),c)},push:(c)=>(n.push(c),c),shift:()=>{let c=n[u++];if(u===n.length)u=0,n=[];else n[u-1]=void 0;return c}}}var p=Buffer.allocUnsafe(256),rn="BCcDdEFfHPpQSX".split("").reduce((l,n)=>{let u=n.charCodeAt(0);return l[n]=()=>{return p[0]=u,R.i=5,R},l},{}),R=Object.assign(sn,rn,{N:String.fromCharCode(0),i:0,inc(l){return R.i+=l,R},str(l){let n=Buffer.byteLength(l);return kl(n),R.i+=p.write(l,R.i,n,"utf8"),R},i16(l){return kl(2),p.writeUInt16BE(l,R.i),R.i+=2,R},i32(l,n){if(n||n===0)return p.writeUInt32BE(l,n),R;return kl(4),p.writeUInt32BE(l,R.i),R.i+=4,R},z(l){return kl(l),p.fill(0,R.i,R.i+l),R.i+=l,R},raw(l){return p=Buffer.concat([p.subarray(0,R.i),l]),R.i=p.length,R},end(l=1){p.writeUInt32BE(R.i-l,l);let n=p.subarray(0,R.i);return R.i=0,p=Buffer.allocUnsafe(256),n}}),$=R;function kl(l){if(p.length-R.i<l){let n=p,u=n.length;p=Buffer.allocUnsafe(u+(u>>1)+l),n.copy(p)}}function sn(){return R.i=0,R}var Bh=eh,xn=1,Bl=$().S().end(),bh=$().H().end(),lu=$().i32(8).i32(80877103).end(8),hu=Buffer.concat([$().E().str($.N).i32(0).end(),Bl]),nu=$().D().str("S").str($.N).end(),Rl=()=>{},uu=new Set(["FetchPreparedStatement","RevalidateCachedQuery","transformAssignedExpr"]),fu={83:"severity_local",86:"severity",67:"code",77:"message",68:"detail",72:"hint",80:"position",112:"internal_position",113:"internal_query",87:"where",115:"schema_name",116:"table_name",99:"column_name",100:"data type_name",110:"constraint_name",70:"file",76:"line",82:"routine"};function eh(l,n={},{onopen:u=Rl,onend:c=Rl,onclose:w=Rl}={}){let{sslnegotiation:E,ssl:t,max:_,user:B,host:Q,port:T,database:Y,parsers:j,transform:M,onnotice:H,onnotify:I,onparameter:b,max_pipeline:Z,keep_alive:cl,backoff:nl,target_session_attrs:x}=l,d=hl(),Ul=xn++,_l={pid:null,secret:null},Pl=gh(xl,l.idle_timeout),Il=gh(xl,l.max_lifetime),L=gh(xh,l.connect_timeout),U=null,Ol,q=null,N=new Ml,y=Buffer.alloc(0),dl=l.fetch_types,El={},O={},S=Math.random().toString(36).slice(2),F=1,v=0,V=0,G=0,D=0,i=0,J=0,m=0,r=null,X=null,Al=!1,tl=null,$l=null,e=null,z=null,C=null,ll=null,Ql=null,sl=null,A=null,Tl=null,k={queue:n.closed,idleTimer:Pl,connect(h){e=h,Lh()},terminate:Zl,execute:Xl,cancel:yh,end:xl,count:0,id:Ul};return n.closed&&n.closed.push(k),k;async function ph(){let h;try{h=l.socket?await Promise.resolve(l.socket(l)):new vh.Socket}catch(f){Nl(f);return}return h.on("error",Nl),h.on("close",Nh),h.on("drain",Ph),h}async function yh({pid:h,secret:f},g,P){try{Ol=$().i32(16).i32(80877102).i32(h).i32(f).end(16),await dh(),U.once("error",P),U.once("close",g)}catch(W){P(W)}}function Xl(h){if(Al)return Cl(h,K.connection("CONNECTION_DESTROYED",l));if(C)return Cl(h,K.generic("COPY_IN_PROGRESS","You cannot execute queries during copy"));if(h.cancelled)return;try{return h.state=_l,A?d.push(h):(A=h,A.active=!0),qh(h),a(rh(h))&&!h.describeFirst&&!h.cursorFn&&d.length<Z&&(!h.options.onexecute||h.options.onexecute(k))}catch(f){return d.length===0&&a(Bl),ul(f),!0}}function rh(h){if(h.parameters.length>=65534)throw K.generic("MAX_PARAMETERS_EXCEEDED","Max number of parameters (65534) exceeded");return h.options.simple?$().Q().str(h.statement.string+$.N).end():h.describeFirst?Buffer.concat([Gh(h),bh]):h.prepare?h.prepared?Vl(h):Buffer.concat([Gh(h),Vl(h)]):sh(h)}function Gh(h){return Buffer.concat([Yh(h.statement.string,h.parameters,h.statement.types,h.statement.name),Vn("S",h.statement.name)])}function Vl(h){return Buffer.concat([Qn(h.parameters,h.statement.types,h.statement.name,h.cursorName),h.cursorFn?Rh("",h.cursorRows):hu])}function sh(h){return Buffer.concat([Yh(h.statement.string,h.parameters,h.statement.types),nu,Vl(h)])}function qh(h){let f=[],g=[],P=th(h,h.strings[0],h.args[0],f,g,l);!h.tagged&&h.args.forEach((W)=>al(W,f,g,l)),h.prepare=l.prepare&&("prepare"in h.options?h.options.prepare:!0),h.string=P,h.signature=h.prepare&&g+P,h.onlyDescribe&&delete O[h.signature],h.parameters=h.parameters||f,h.prepared=h.prepare&&h.signature in O,h.describeFirst=h.onlyDescribe||f.length&&!h.prepared,h.statement=h.prepared?O[h.signature]:{string:P,types:g,name:h.prepare?S+F++:""},typeof l.debug==="function"&&l.debug(Ul,P,f,g)}function a(h,f){if(ll=ll?Buffer.concat([ll,h]):Buffer.from(h),f||ll.length>=1024)return jh(f);return X===null&&(X=setImmediate(jh)),!0}function jh(h){let f=U.write(ll,h);return X!==null&&clearImmediate(X),ll=X=null,f}function xh(){ul(K.connection("CONNECT_TIMEOUT",l,U)),U.destroy()}async function Mh(){if(E!=="direct"){if(a(lu),!await new Promise((g)=>U.once("data",(P)=>g(P[0]===83)))&&t==="prefer")return Ll()}let h={socket:U,servername:vh.isIP(U.host)?void 0:U.host};if(E==="direct")h.ALPNProtocols=["postgresql"];if(t==="require"||t==="allow"||t==="prefer")h.rejectUnauthorized=!1;else if(typeof t==="object")Object.assign(h,t);U.removeAllListeners(),U=qn.connect(h),U.on("secureConnect",Ll),U.on("error",Nl),U.on("close",Nh),U.on("drain",Ph)}function Ph(){!A&&u(k)}function ql(h){if(tl){if(tl.push(h),V-=h.length,V>0)return}y=tl?Buffer.concat(tl,i-V):y.length===0?h:Buffer.concat([y,h],y.length+h.length);while(y.length>4){if(i=y.readUInt32BE(1),i>=y.length){V=i-y.length,tl=[y];break}try{ln(y.subarray(0,i+1))}catch(f){A&&(A.cursorFn||A.describeFirst)&&a(Bl),ul(f)}y=y.subarray(i+1),V=0,tl=null}}async function dh(){if(Al=!1,El={},U||(U=await ph()),!U)return;if(L.start(),l.socket)return t?Mh():Ll();if(U.on("connect",t?Mh:Ll),l.path)return U.connect(l.path);U.ssl=t,U.connect(T[G],Q[G]),U.host=Q[G],U.port=T[G],G=(G+1)%T.length}function Lh(){setTimeout(dh,v?Math.max(0,v+J-mh.now()):0)}function Ll(){try{O={},dl=l.fetch_types,S=Math.random().toString(36).slice(2),F=1,Il.start(),U.on("data",ql),cl&&U.setKeepAlive&&U.setKeepAlive(!0,1000*cl);let h=Kn();a(h)}catch(h){Nl(h)}}function Nl(h){if(k.queue===n.connecting&&l.host[D+1])return;ul(h);while(d.length)Cl(d.shift(),h)}function ul(h){C&&(C.destroy(h),C=null),A&&Cl(A,h),e&&(Cl(e,h),e=null)}function Cl(h,f){if(h.reserve)return h.reject(f);if(!f||typeof f!=="object")f=Error(f);"query"in f||"parameters"in f||Object.defineProperties(f,{stack:{value:f.stack+h.origin.replace(/.*\n/,`
+import"./chunk-dcgvq79a.js";import Eu from"os";import Au from"fs";var Wl=new Map,hh=new Map,nh=Symbol("OriginError"),Dl={};class fl extends Promise{constructor(l,n,u,c,w={}){let E,t;super((_,B)=>{E=_,t=B});this.tagged=Array.isArray(l.raw),this.strings=l,this.args=n,this.handler=u,this.canceller=c,this.options=w,this.state=null,this.statement=null,this.resolve=(_)=>(this.active=!1,E(_)),this.reject=(_)=>(this.active=!1,t(_)),this.active=!1,this.cancelled=null,this.executed=!1,this.signature="",this[nh]=this.handler.debug?Error():this.tagged&&vn(this.strings)}get origin(){return(this.handler.debug?this[nh].stack:this.tagged&&hh.has(this.strings)?hh.get(this.strings):hh.set(this.strings,this[nh].stack).get(this.strings))||""}static get[Symbol.species](){return Promise}cancel(){return this.canceller&&(this.canceller(this),this.canceller=null)}simple(){return this.options.simple=!0,this.options.prepare=!1,this}async readable(){return this.simple(),this.streaming=!0,this}async writable(){return this.simple(),this.streaming=!0,this}cursor(l=1,n){if(this.options.simple=!1,typeof l==="function")n=l,l=1;if(this.cursorRows=l,typeof n==="function")return this.cursorFn=n,this;let u;return{[Symbol.asyncIterator]:()=>({next:()=>{if(this.executed&&!this.active)return{done:!0};u&&u();let c=new Promise((w,E)=>{this.cursorFn=(t)=>{return w({value:t,done:!1}),new Promise((_)=>u=_)},this.resolve=()=>(this.active=!1,w({done:!0})),this.reject=(t)=>(this.active=!1,E(t))});return this.execute(),c},return(){return u&&u(Dl),{done:!0}}})}}describe(){return this.options.simple=!1,this.onlyDescribe=this.options.prepare=!0,this}stream(){throw Error(".stream has been renamed to .forEach")}forEach(l){return this.forEachFn=l,this.handle(),this}raw(){return this.isRaw=!0,this}values(){return this.isRaw="values",this}async handle(){!this.executed&&(this.executed=!0)&&await 1&&this.handler(this)}execute(){return this.handle(),this}then(){return this.handle(),super.then.apply(this,arguments)}catch(){return this.handle(),super.catch.apply(this,arguments)}finally(){return this.handle(),super.finally.apply(this,arguments)}}function vn(l){if(Wl.has(l))return Wl.get(l);let n=Error.stackTraceLimit;return Error.stackTraceLimit=4,Wl.set(l,Error()),Error.stackTraceLimit=n,Wl.get(l)}class Yl extends Error{constructor(l){super(l.message);this.name=this.constructor.name,Object.assign(this,l)}}var K={connection:Th,postgres:Xh,generic:Ch,notSupported:Zh};function Th(l,n,u){let{host:c,port:w}=u||n,E=Object.assign(Error("write "+l+" "+(n.path||c+":"+w)),{code:l,errno:l,address:n.path||c},n.path?{}:{port:w});return Error.captureStackTrace(E,Th),E}function Xh(l){let n=new Yl(l);return Error.captureStackTrace(n,Xh),n}function Ch(l,n){let u=Object.assign(Error(l+": "+n),{code:l});return Error.captureStackTrace(u,Ch),u}function Zh(l){let n=Object.assign(Error(l+" (B) is not supported"),{code:"MESSAGE_NOT_SUPPORTED",name:l});return Error.captureStackTrace(n,Zh),n}var mn={string:{to:25,from:null,serialize:(l)=>""+l},number:{to:0,from:[21,23,26,700,701],serialize:(l)=>""+l,parse:(l)=>+l},json:{to:114,from:[114,3802],serialize:(l)=>JSON.stringify(l),parse:(l)=>JSON.parse(l)},boolean:{to:16,from:16,serialize:(l)=>l===!0?"t":"f",parse:(l)=>l==="t"},date:{to:1184,from:[1082,1114,1184],serialize:(l)=>(l instanceof Date?l:new Date(l)).toISOString(),parse:(l)=>new Date(l)},bytea:{to:17,from:17,serialize:(l)=>"\\x"+Buffer.from(l).toString("hex"),parse:(l)=>Buffer.from(l.slice(2),"hex")}};class ml{then(){uh()}catch(){uh()}finally(){uh()}}class il extends ml{constructor(l){super();this.value=el(l)}}class wl extends ml{constructor(l,n,u){super();this.value=l,this.type=n,this.array=u}}class bl extends ml{constructor(l,n){super();this.first=l,this.rest=n}build(l,n,u,c){let w=bn.map(([E,t])=>({fn:t,i:l.search(E)})).sort((E,t)=>E.i-t.i).pop();return w.i===-1?_h(this.first,c):w.fn(this.first,this.rest,n,u,c)}}function al(l,n,u,c){let w=l instanceof wl?l.value:l;if(w===void 0){if(l instanceof wl?l.value=c.transform.undefined:w=l=c.transform.undefined,w===void 0)throw K.generic("UNDEFINED_VALUE","Undefined values are not allowed")}return"$"+u.push(l instanceof wl?(n.push(l.value),l.array?l.array[l.type||vl(l.value)]||l.type||ih(l.value):l.type):(n.push(l),vl(l)))}var Hh=Qh(mn);function th(l,n,u,c,w,E){for(let t=1;t<l.strings.length;t++)n+=wh(n,u,c,w,E)+l.strings[t],u=l.args[t];return n}function wh(l,n,u,c,w){return n instanceof bl?n.build(l,u,c,w):n instanceof fl?ch(n,u,c,w):n instanceof il?n.value:n&&n[0]instanceof fl?n.reduce((E,t)=>E+" "+ch(t,u,c,w),""):al(n,u,c,w)}function ch(l,n,u,c){return l.fragment=!0,th(l,l.strings[0],l.args[0],n,u,c)}function zh(l,n,u,c,w){return l.map((E)=>"("+c.map((t)=>wh("values",E[t],n,u,w)).join(",")+")").join(",")}function Fh(l,n,u,c,w){let E=Array.isArray(l[0]),t=n.length?n.flat():Object.keys(E?l[0]:l);return zh(E?l:[l],u,c,t,w)}function Kl(l,n,u,c,w){if(typeof l==="string"&&(l=[l].concat(n)),Array.isArray(l))return _h(l,w);let E;return(n.length?n.flat():Object.keys(l)).map((_)=>{return E=l[_],(E instanceof fl?ch(E,u,c,w):E instanceof il?E.value:al(E,u,c,w))+" as "+el(w.transform.column.to?w.transform.column.to(_):_)}).join(",")}var bn=Object.entries({values:Fh,in:(...l)=>{let n=Fh(...l);return n==="()"?"(null)":n},select:Kl,as:Kl,returning:Kl,"\\(":Kl,update(l,n,u,c,w){return(n.length?n.flat():Object.keys(l)).map((E)=>el(w.transform.column.to?w.transform.column.to(E):E)+"="+wh("values",l[E],u,c,w))},insert(l,n,u,c,w){let E=n.length?n.flat():Object.keys(Array.isArray(l)?l[0]:l);return"("+_h(E,w)+")values"+zh(Array.isArray(l)?l:[l],u,c,E,w)}}).map(([l,n])=>[new RegExp("((?:^|[\\s(])"+l+"(?:$|[\\s(]))(?![\\s\\S]*\\1)","i"),n]);function uh(){throw K.generic("NOT_TAGGED_CALL","Query not called as a tagged template literal")}var{serializers:an,parsers:en}=Hh;function ih(l){if(Array.isArray(l))return ih(l[0]);return typeof l==="string"?1009:0}var Jh=function(l){let n=Qh(l||{});return{serializers:Object.assign({},an,n.serializers),parsers:Object.assign({},en,n.parsers)}};function Qh(l){return Object.keys(l).reduce((n,u)=>{if(l[u].from&&[].concat(l[u].from).forEach((c)=>n.parsers[c]=l[u].parse),l[u].serialize)n.serializers[l[u].to]=l[u].serialize,l[u].from&&[].concat(l[u].from).forEach((c)=>n.serializers[c]=l[u].serialize);return n},{parsers:{},serializers:{}})}function _h(l,{transform:{column:n}}){return l.map((u)=>el(n.to?n.to(u):u)).join(",")}var el=function(n){return'"'+n.replace(/"/g,'""').replace(/\./g,'"."')+'"'},vl=function l(n){return n instanceof wl?n.type:n instanceof Date?1184:n instanceof Uint8Array?17:n===!0||n===!1?16:typeof n==="bigint"?20:Array.isArray(n)?l(n[0]):0},kn=/\\/g,on=/"/g;function pn(l){return l.replace(kn,"\\\\").replace(on,"\\\"")}var Vh=function l(n,u,c,w){if(Array.isArray(n)===!1)return n;if(!n.length)return"{}";let E=n[0],t=w===1020?";":",";if(Array.isArray(E)&&!E.type)return"{"+n.map((_)=>l(_,u,c,w)).join(t)+"}";return"{"+n.map((_)=>{if(_===void 0){if(_=c.transform.undefined,_===void 0)throw K.generic("UNDEFINED_VALUE","Undefined values are not allowed")}return _===null?"null":'"'+pn(u?u(_.type?_.value:_):""+_)+'"'}).join(t)+"}"},fh={i:0,char:null,str:"",quoted:!1,last:0},Wh=function(n,u,c){return fh.i=fh.last=0,Kh(fh,n,u,c)};function Kh(l,n,u,c){let w=[],E=c===1020?";":",";for(;l.i<n.length;l.i++){if(l.char=n[l.i],l.quoted)if(l.char==="\\")l.str+=n[++l.i];else if(l.char==='"')w.push(u?u(l.str):l.str),l.str="",l.quoted=n[l.i+1]==='"',l.last=l.i+2;else l.str+=l.char;else if(l.char==='"')l.quoted=!0;else if(l.char==="{")l.last=++l.i,w.push(Kh(l,n,u,c));else if(l.char==="}"){l.quoted=!1,l.last<l.i&&w.push(u?u(n.slice(l.last,l.i)):n.slice(l.last,l.i)),l.last=l.i+1;break}else if(l.char===E&&l.p!=="}"&&l.p!=='"')w.push(u?u(n.slice(l.last,l.i)):n.slice(l.last,l.i)),l.last=l.i+1;l.p=l.char}return l.last<l.i&&w.push(u?u(n.slice(l.last,l.i+1)):n.slice(l.last,l.i+1)),w}var Sl=(l)=>{let n=l[0];for(let u=1;u<l.length;u++)n+=l[u]==="_"?l[++u].toUpperCase():l[u];return n},Gl=(l)=>{let n=l[0].toUpperCase();for(let u=1;u<l.length;u++)n+=l[u]==="_"?l[++u].toUpperCase():l[u];return n},jl=(l)=>l.replace(/_/g,"-"),Fl=(l)=>l.replace(/([A-Z])/g,"_$1").toLowerCase(),Hl=(l)=>(l.slice(0,1)+l.slice(1).replace(/([A-Z])/g,"_$1")).toLowerCase(),zl=(l)=>l.replace(/-/g,"_");function Oh(l){return function n(u,c){return typeof u==="object"&&u!==null&&(c.type===114||c.type===3802)?Array.isArray(u)?u.map((w)=>n(w,c)):Object.entries(u).reduce((w,[E,t])=>Object.assign(w,{[l(E)]:n(t,c)}),{}):u}}Sl.column={from:Sl};Sl.value={from:Oh(Sl)};Fl.column={to:Fl};var Eh={...Sl};Eh.column.to=Fl;Gl.column={from:Gl};Gl.value={from:Oh(Gl)};Hl.column={to:Hl};var Ah={...Gl};Ah.column.to=Hl;jl.column={from:jl};jl.value={from:Oh(jl)};zl.column={to:zl};var Uh={...jl};Uh.column.to=zl;import vh from"net";import qn from"tls";import Jl from"crypto";import $h from"stream";import{performance as mh}from"perf_hooks";class Ml extends Array{constructor(){super();Object.defineProperties(this,{count:{value:null,writable:!0},state:{value:null,writable:!0},command:{value:null,writable:!0},columns:{value:null,writable:!0},statement:{value:null,writable:!0}})}static get[Symbol.species](){return Array}}var hl=yn;function yn(l=[]){let n=l.slice(),u=0;return{get length(){return n.length-u},remove:(c)=>{let w=n.indexOf(c);return w===-1?null:(n.splice(w,1),c)},push:(c)=>(n.push(c),c),shift:()=>{let c=n[u++];if(u===n.length)u=0,n=[];else n[u-1]=void 0;return c}}}var p=Buffer.allocUnsafe(256),rn="BCcDdEFfHPpQSX".split("").reduce((l,n)=>{let u=n.charCodeAt(0);return l[n]=()=>{return p[0]=u,R.i=5,R},l},{}),R=Object.assign(sn,rn,{N:String.fromCharCode(0),i:0,inc(l){return R.i+=l,R},str(l){let n=Buffer.byteLength(l);return kl(n),R.i+=p.write(l,R.i,n,"utf8"),R},i16(l){return kl(2),p.writeUInt16BE(l,R.i),R.i+=2,R},i32(l,n){if(n||n===0)return p.writeUInt32BE(l,n),R;return kl(4),p.writeUInt32BE(l,R.i),R.i+=4,R},z(l){return kl(l),p.fill(0,R.i,R.i+l),R.i+=l,R},raw(l){return p=Buffer.concat([p.subarray(0,R.i),l]),R.i=p.length,R},end(l=1){p.writeUInt32BE(R.i-l,l);let n=p.subarray(0,R.i);return R.i=0,p=Buffer.allocUnsafe(256),n}}),$=R;function kl(l){if(p.length-R.i<l){let n=p,u=n.length;p=Buffer.allocUnsafe(u+(u>>1)+l),n.copy(p)}}function sn(){return R.i=0,R}var Bh=eh,xn=1,Bl=$().S().end(),bh=$().H().end(),lu=$().i32(8).i32(80877103).end(8),hu=Buffer.concat([$().E().str($.N).i32(0).end(),Bl]),nu=$().D().str("S").str($.N).end(),Rl=()=>{},uu=new Set(["FetchPreparedStatement","RevalidateCachedQuery","transformAssignedExpr"]),fu={83:"severity_local",86:"severity",67:"code",77:"message",68:"detail",72:"hint",80:"position",112:"internal_position",113:"internal_query",87:"where",115:"schema_name",116:"table_name",99:"column_name",100:"data type_name",110:"constraint_name",70:"file",76:"line",82:"routine"};function eh(l,n={},{onopen:u=Rl,onend:c=Rl,onclose:w=Rl}={}){let{sslnegotiation:E,ssl:t,max:_,user:B,host:Q,port:T,database:Y,parsers:j,transform:M,onnotice:H,onnotify:I,onparameter:b,max_pipeline:Z,keep_alive:cl,backoff:nl,target_session_attrs:x}=l,d=hl(),Ul=xn++,_l={pid:null,secret:null},Pl=gh(xl,l.idle_timeout),Il=gh(xl,l.max_lifetime),L=gh(xh,l.connect_timeout),U=null,Ol,q=null,N=new Ml,y=Buffer.alloc(0),dl=l.fetch_types,El={},O={},S=Math.random().toString(36).slice(2),F=1,v=0,V=0,G=0,D=0,i=0,J=0,m=0,r=null,X=null,Al=!1,tl=null,$l=null,e=null,z=null,C=null,ll=null,Ql=null,sl=null,A=null,Tl=null,k={queue:n.closed,idleTimer:Pl,connect(h){e=h,Lh()},terminate:Zl,execute:Xl,cancel:yh,end:xl,count:0,id:Ul};return n.closed&&n.closed.push(k),k;async function ph(){let h;try{h=l.socket?await Promise.resolve(l.socket(l)):new vh.Socket}catch(f){Nl(f);return}return h.on("error",Nl),h.on("close",Nh),h.on("drain",Ph),h}async function yh({pid:h,secret:f},g,P){try{Ol=$().i32(16).i32(80877102).i32(h).i32(f).end(16),await dh(),U.once("error",P),U.once("close",g)}catch(W){P(W)}}function Xl(h){if(Al)return Cl(h,K.connection("CONNECTION_DESTROYED",l));if(C)return Cl(h,K.generic("COPY_IN_PROGRESS","You cannot execute queries during copy"));if(h.cancelled)return;try{return h.state=_l,A?d.push(h):(A=h,A.active=!0),qh(h),a(rh(h))&&!h.describeFirst&&!h.cursorFn&&d.length<Z&&(!h.options.onexecute||h.options.onexecute(k))}catch(f){return d.length===0&&a(Bl),ul(f),!0}}function rh(h){if(h.parameters.length>=65534)throw K.generic("MAX_PARAMETERS_EXCEEDED","Max number of parameters (65534) exceeded");return h.options.simple?$().Q().str(h.statement.string+$.N).end():h.describeFirst?Buffer.concat([Gh(h),bh]):h.prepare?h.prepared?Vl(h):Buffer.concat([Gh(h),Vl(h)]):sh(h)}function Gh(h){return Buffer.concat([Yh(h.statement.string,h.parameters,h.statement.types,h.statement.name),Vn("S",h.statement.name)])}function Vl(h){return Buffer.concat([Qn(h.parameters,h.statement.types,h.statement.name,h.cursorName),h.cursorFn?Rh("",h.cursorRows):hu])}function sh(h){return Buffer.concat([Yh(h.statement.string,h.parameters,h.statement.types),nu,Vl(h)])}function qh(h){let f=[],g=[],P=th(h,h.strings[0],h.args[0],f,g,l);!h.tagged&&h.args.forEach((W)=>al(W,f,g,l)),h.prepare=l.prepare&&("prepare"in h.options?h.options.prepare:!0),h.string=P,h.signature=h.prepare&&g+P,h.onlyDescribe&&delete O[h.signature],h.parameters=h.parameters||f,h.prepared=h.prepare&&h.signature in O,h.describeFirst=h.onlyDescribe||f.length&&!h.prepared,h.statement=h.prepared?O[h.signature]:{string:P,types:g,name:h.prepare?S+F++:""},typeof l.debug==="function"&&l.debug(Ul,P,f,g)}function a(h,f){if(ll=ll?Buffer.concat([ll,h]):Buffer.from(h),f||ll.length>=1024)return jh(f);return X===null&&(X=setImmediate(jh)),!0}function jh(h){let f=U.write(ll,h);return X!==null&&clearImmediate(X),ll=X=null,f}function xh(){ul(K.connection("CONNECT_TIMEOUT",l,U)),U.destroy()}async function Mh(){if(E!=="direct"){if(a(lu),!await new Promise((g)=>U.once("data",(P)=>g(P[0]===83)))&&t==="prefer")return Ll()}let h={socket:U,servername:vh.isIP(U.host)?void 0:U.host};if(E==="direct")h.ALPNProtocols=["postgresql"];if(t==="require"||t==="allow"||t==="prefer")h.rejectUnauthorized=!1;else if(typeof t==="object")Object.assign(h,t);U.removeAllListeners(),U=qn.connect(h),U.on("secureConnect",Ll),U.on("error",Nl),U.on("close",Nh),U.on("drain",Ph)}function Ph(){!A&&u(k)}function ql(h){if(tl){if(tl.push(h),V-=h.length,V>0)return}y=tl?Buffer.concat(tl,i-V):y.length===0?h:Buffer.concat([y,h],y.length+h.length);while(y.length>4){if(i=y.readUInt32BE(1),i>=y.length){V=i-y.length,tl=[y];break}try{ln(y.subarray(0,i+1))}catch(f){A&&(A.cursorFn||A.describeFirst)&&a(Bl),ul(f)}y=y.subarray(i+1),V=0,tl=null}}async function dh(){if(Al=!1,El={},U||(U=await ph()),!U)return;if(L.start(),l.socket)return t?Mh():Ll();if(U.on("connect",t?Mh:Ll),l.path)return U.connect(l.path);U.ssl=t,U.connect(T[G],Q[G]),U.host=Q[G],U.port=T[G],G=(G+1)%T.length}function Lh(){setTimeout(dh,v?Math.max(0,v+J-mh.now()):0)}function Ll(){try{O={},dl=l.fetch_types,S=Math.random().toString(36).slice(2),F=1,Il.start(),U.on("data",ql),cl&&U.setKeepAlive&&U.setKeepAlive(!0,1000*cl);let h=Kn();a(h)}catch(h){Nl(h)}}function Nl(h){if(k.queue===n.connecting&&l.host[D+1])return;ul(h);while(d.length)Cl(d.shift(),h)}function ul(h){C&&(C.destroy(h),C=null),A&&Cl(A,h),e&&(Cl(e,h),e=null)}function Cl(h,f){if(h.reserve)return h.reject(f);if(!f||typeof f!=="object")f=Error(f);"query"in f||"parameters"in f||Object.defineProperties(f,{stack:{value:f.stack+h.origin.replace(/.*\n/,`
 `),enumerable:l.debug},query:{value:h.string,enumerable:l.debug},parameters:{value:h.parameters,enumerable:l.debug},args:{value:h.args,enumerable:l.debug},types:{value:h.statement&&h.statement.types,enumerable:l.debug}}),h.reject(f)}function xl(){return z||(!k.reserved&&c(k),!k.reserved&&!e&&!A&&d.length===0?(Zl(),new Promise((h)=>U&&U.readyState!=="closed"?U.once("close",h):h())):z=new Promise((h)=>Ql=h))}function Zl(){if(Al=!0,C||A||e||d.length)Nl(K.connection("CONNECTION_DESTROYED",l));if(clearImmediate(X),U)U.removeListener("data",ql),U.removeListener("connect",Ll),U.readyState==="open"&&U.end($().X().end());Ql&&(Ql(),z=Ql=null)}async function Nh(h){if(y=Buffer.alloc(0),V=0,tl=null,clearImmediate(X),U.removeListener("data",ql),U.removeListener("connect",Ll),Pl.cancel(),Il.cancel(),L.cancel(),U.removeAllListeners(),U=null,e)return Lh();!h&&(A||d.length)&&Nl(K.connection("CONNECTION_CLOSED",l,U)),v=mh.now(),h&&l.shared.retries++,J=(typeof nl==="function"?nl(l.shared.retries):nl)*1000,w(k,K.connection("CONNECTION_CLOSED",l,U))}function ln(h,f=h[0]){(f===68?hn:f===100?Tn:f===65?dn:f===83?nn:f===90?un:f===67?fn:f===50?Dh:f===49?cn:f===116?tn:f===84?wn:f===82?_n:f===110?gn:f===75?Bn:f===69?Mn:f===115?Ln:f===51?Nn:f===71?Dn:f===78?Cn:f===72?Yn:f===99?Xn:f===73?Zn:f===86?Fn:f===118?Hn:f===87?Rn:zn)(h)}function hn(h){let f=7,g,P,W,o=A.isRaw?Array(A.statement.columns.length):{};for(let s=0;s<A.statement.columns.length;s++)P=A.statement.columns[s],g=h.readInt32BE(f),f+=4,W=g===-1?null:A.isRaw===!0?h.subarray(f,f+=g):P.parser===void 0?h.toString("utf8",f,f+=g):P.parser.array===!0?P.parser(h.toString("utf8",f+1,f+=g)):P.parser(h.toString("utf8",f,f+=g)),A.isRaw?o[s]=A.isRaw===!0?W:M.value.from?M.value.from(W,P):W:o[P.name]=M.value.from?M.value.from(W,P):W;A.forEachFn?A.forEachFn(M.row.from?M.row.from(o):o,N):N[m++]=M.row.from?M.row.from(o):o}function nn(h){let[f,g]=h.toString("utf8",5,h.length-1).split($.N);if(El[f]=g,l.parameters[f]!==g)l.parameters[f]=g,b&&b(f,g)}function un(h){if(A)if(q)A.retried?ul(A.retried):A.prepared&&uu.has(q.routine)?Pn(A,q):ul(q);else A.resolve($l||N);else if(q)ul(q);if(A=$l=q=null,N=new Ml,L.cancel(),e){if(x){if(!El.in_hot_standby||!El.default_transaction_read_only)return jn();else if(Gn(x,El))return Zl()}if(dl)return e.reserve&&(e=null),In();e&&!e.reserve&&Xl(e),l.shared.retries=D=0,e=null;return}while(d.length&&(A=d.shift())&&(A.active=!0,A.cancelled))eh(l).cancel(A.state,A.cancelled.resolve,A.cancelled.reject);if(A)return;k.reserved?!k.reserved.release&&h[5]===73?z?Zl():(k.reserved=null,u(k)):k.reserved():z?Zl():u(k)}function fn(h){m=0;for(let f=h.length-1;f>0;f--){if(h[f]===32&&h[f+1]<58&&N.count===null)N.count=+h.toString("utf8",f+1,h.length-1);if(h[f-1]>=65){N.command=h.toString("utf8",5,f),N.state=_l;break}}if(Tl&&(Tl(),Tl=null),N.command==="BEGIN"&&_!==1&&!k.reserved)return ul(K.generic("UNSAFE_TRANSACTION","Only use sql.begin, sql.reserved or max: 1"));if(A.options.simple)return Dh();if(A.cursorFn)N.count&&A.cursorFn(N),a(Bl)}function cn(){A.parsing=!1}function Dh(){!N.statement&&(N.statement=A.statement),N.columns=A.statement.columns}function tn(h){let f=h.readUInt16BE(5);for(let g=0;g<f;++g)!A.statement.types[g]&&(A.statement.types[g]=h.readUInt32BE(7+g*4));A.prepare&&(O[A.signature]=A.statement),A.describeFirst&&!A.onlyDescribe&&(a(Vl(A)),A.describeFirst=!1)}function wn(h){if(N.command)$l=$l||[N],$l.push(N=new Ml),N.count=null,A.statement.columns=null;let f=h.readUInt16BE(5),g=7,P;A.statement.columns=Array(f);for(let W=0;W<f;++W){P=g;while(h[g++]!==0);let o=h.readUInt32BE(g),s=h.readUInt16BE(g+4),gl=h.readUInt32BE(g+6);A.statement.columns[W]={name:M.column.from?M.column.from(h.toString("utf8",P,g-1)):h.toString("utf8",P,g-1),parser:j[gl],table:o,number:s,type:gl},g+=18}if(N.statement=A.statement,A.onlyDescribe)return A.resolve(A.statement),a(Bl)}async function _n(h,f=h.readUInt32BE(5)){(f===3?On:f===5?En:f===10?An:f===11?Un:f===12?$n:f!==0?Jn:Rl)(h,f)}async function On(){let h=await lh();a($().p().str(h).z(1).end())}async function En(h){let f="md5"+await ah(Buffer.concat([Buffer.from(await ah(await lh()+B)),h.subarray(9)]));a($().p().str(f).z(1).end())}async function An(){sl=(await Jl.randomBytes(18)).toString("base64"),$().p().str("SCRAM-SHA-256"+$.N);let h=$.i;a($.inc(4).str("n,,n=*,r="+sl).i32($.i-h-4,h).end())}async function Un(h){let f=h.toString("utf8",9).split(",").reduce((s,gl)=>(s[gl[0]]=gl.slice(2),s),{}),g=await Jl.pbkdf2Sync(await lh(),Buffer.from(f.s,"base64"),parseInt(f.i),32,"sha256"),P=await pl(g,"Client Key"),W="n=*,r="+sl+",r="+f.r+",s="+f.s+",i="+f.i+",c=biws,r="+f.r;r=(await pl(await pl(g,"Server Key"),W)).toString("base64");let o="c=biws,r="+f.r+",p="+tu(P,Buffer.from(await pl(await cu(P),W))).toString("base64");a($().p().str(o).end())}function $n(h){if(h.toString("utf8",9).split($.N,1)[0].slice(2)===r)return;ul(K.generic("SASL_SIGNATURE_MISMATCH","The server did not return the correct signature")),U.destroy()}function lh(){return Promise.resolve(typeof l.pass==="function"?l.pass():l.pass)}function gn(){if(N.statement=A.statement,N.statement.columns=[],A.onlyDescribe)return A.resolve(A.statement),a(Bl)}function Bn(h){_l.pid=h.readUInt32BE(5),_l.secret=h.readUInt32BE(9)}async function In(){dl=!1,(await new fl([`
       select b.oid, b.typarray
       from pg_catalog.pg_type a

package/dist/{chunk-0av6xvm6.js → chunk-1ckha5dt.js}

@@ -1,9 +1,9 @@
 // @bun
-import{We as O,Xe as E,Ye as k}from"./chunk-whtzggn6.js";import{ef as T,of as R,qf as i,rf as C,sf as M,tf as Xz}from"./chunk-hytt9qyj.js";import{Wg as l}from"./chunk-9b4erdy2.js";import{nh as a}from"./chunk-1myhm0g3.js";var $z=["every","none","some"],Vz=["is","isNot"];function g(z){return z==="many"?$z:Vz}function h(z,J){let W=Object.keys(z);return W.length>0&&W.every((Z)=>J.includes(Z))}var m="_count";function y(z){return Object.keys(z.relations).filter((J)=>z.relations[J]?.kind==="many").sort()}function N(z,J,W,Z){let X={model:z,operation:J,hasUser:W!=null};return Object.defineProperty(X,"user",{enumerable:!0,get(){if(W==null&&!Z)throw new R(z,J,"no-user");return W}}),X}class n{}class Qz extends n{}var qz=new Set(["findMany","findFirst","findFirstOrThrow","findUnique","findUniqueOrThrow","count","aggregate","groupBy","update","updateMany","delete","deleteMany"]),Yz=new Set(["create","createMany","upsert"]),jz=new Set(["update","updateMany","upsert"]),Lz=new Set(["update","updateMany"]),Kz=new Set(["create","createMany"]),p=new WeakMap;function Gz(z,J,W){if(typeof z!=="function")return z;let Z=p.get(z);if(Z!==void 0)return Z;let X;try{X=new z}catch($){throw new M(b(J),W,"constructor-threw",`${f(z)}, and constructing it threw:
+import{Dg as l}from"./chunk-x84as3vy.js";import{Lg as O,Mg as E,Ng as k}from"./chunk-fa37qzm3.js";import{ah as T,kh as R,mh as i,nh as C,oh as M,ph as Xz}from"./chunk-ntxsdchf.js";import{Rh as a}from"./chunk-t65074mw.js";var $z=["every","none","some"],Vz=["is","isNot"];function g(z){return z==="many"?$z:Vz}function h(z,J){let W=Object.keys(z);return W.length>0&&W.every((Z)=>J.includes(Z))}var m="_count";function y(z){return Object.keys(z.relations).filter((J)=>z.relations[J]?.kind==="many").sort()}function N(z,J,W,Z){let X={model:z,operation:J,hasUser:W!=null};return Object.defineProperty(X,"user",{enumerable:!0,get(){if(W==null&&!Z)throw new R(z,J,"no-user");return W}}),X}class n{}class Qz extends n{}var qz=new Set(["findMany","findFirst","findFirstOrThrow","findUnique","findUniqueOrThrow","count","aggregate","groupBy","update","updateMany","delete","deleteMany"]),Yz=new Set(["create","createMany","upsert"]),jz=new Set(["update","updateMany","upsert"]),Lz=new Set(["update","updateMany"]),Kz=new Set(["create","createMany"]),p=new WeakMap;function Gz(z,J,W){if(typeof z!=="function")return z;let Z=p.get(z);if(Z!==void 0)return Z;let X;try{X=new z}catch($){throw new M(b(J),W,"constructor-threw",`${f(z)}, and constructing it threw:
 
     ${$?.message??String($)}`,H,void 0,{cause:$})}return t(X,J,W),p.set(z,X),X}function S(z,J){return z.map((W,Z)=>Gz(W,J,Z))}var H=["before","scope","onCreate","onUpdate","redact"];var u=new WeakSet;function s(z,J){if(u.has(J))return;for(let W=0;W<J.length;W++)Uz(J[W],z,W);u.add(J)}function Uz(z,J,W){let Z=b(J),X=typeof z;if(z===null||Array.isArray(z)||X!=="object"&&X!=="function")throw new M(Z,W,"not-a-policy",o(z),H);if(X==="function"){if(!Mz(z))throw new M(Z,W,"not-constructable",f(z),H);return}t(z,J,W)}function t(z,J,W){let Z=b(J),X=0,$=[];for(let Y of H){let q=z[Y];if(q===void 0||q===null){if(Y in z)$.push(Y);continue}if(typeof q!=="function")throw new M(Z,W,"hook-not-callable",`'${Y}' that is ${o(q)} rather than a function`,H);X++}if(X>0)return;if($.length>0)throw new M(Z,W,"no-hooks",`It writes ${$.map((Y)=>`'${Y}'`).join(", ")} down and leaves ${$.length===1?"it":"them"} unset, which reads as `+"absent \u2014 so nothing is left to run.",H);let V=Fz(z),Q=Iz(V);throw new M(Z,W,"no-hooks",V.length===0?"It is empty.":`It spells ${Hz(V)}.`+(V.length===1&&V[0]==="default"?" A lone 'default' is a module namespace rather than the policy "+"inside it \u2014 put `entry.default` in the array, or import the "+"policy by name.":""),H,Q)}function Hz(z){let J=z.slice(0,8).map((W)=>`'${W}'`);return z.length>J.length?`${J.join(", ")} and ${z.length-J.length} more`:J.join(", ")}function Mz(z){try{return Reflect.construct(Bz,[],z),!0}catch{return!1}}var Bz=function(){};function Fz(z){let J=new Set,W=z;while(W!==null&&W!==Object.prototype){for(let Z of Object.getOwnPropertyNames(W))if(Z!=="constructor")J.add(Z);W=Object.getPrototypeOf(W)}return[...J]}function Iz(z){let J,W=2;for(let Z of z)for(let X of H){let $=Tz(Z.toLowerCase(),X.toLowerCase());if($<W)W=$,J={key:Z,hook:X}}return J}function Tz(z,J){if(z===J)return 0;let W=Array.from({length:J.length+1},(Z,X)=>X);for(let Z=1;Z<=z.length;Z++){let X=W[0];W[0]=Z;for(let $=1;$<=J.length;$++){let V=W[$];W[$]=Math.min(W[$]+1,W[$-1]+1,X+(z[Z-1]===J[$-1]?0:1)),X=V}}return W[J.length]}function o(z){if(z===null)return"null";if(z===void 0)return"undefined";if(typeof z==="string")return`the string ${JSON.stringify(z)}`;if(typeof z==="function")return f(z);if(Array.isArray(z))return"an array";if(typeof z==="object")return"an object";return`the ${typeof z} ${String(z)}`}function f(z){return z.name?`the function \`${z.name}\``:"an anonymous function"}function _(z){let J,W,Z,X=z;while(X&&X!==Function.prototype){if(Object.hasOwn(X,"$policy"))throw Error(`${X.name??"This model"} declares \`$policy\`, which is now \`$policies\` and takes a list. The old `+"name is not read, so this model is currently unpolicied \u2014 every "+"scope, onCreate and redact on it is being skipped.");if(Object.hasOwn(X,"$policies")&&X.$policies){let $=X.$policies;if($.length>0){let V=X;if(s(V,$),W===void 0&&J===void 0)W=$,Z=V;else J??=S(W,Z),W=void 0,J.unshift(...S($,V))}}X=Object.getPrototypeOf(X)}if(J!==void 0)return J;if(W===void 0)return Nz;return W.some(($)=>typeof $==="function")?S(W,Z):W}function r(z){let J=z;while(J&&J!==Function.prototype){if(Object.hasOwn(J,"$policies")&&J.$policies){let W=J.$policies;if(W.length>0)s(J,W)}J=Object.getPrototypeOf(J)}}function b(z){return z?.name??"This model"}var Nz=Object.freeze([]);function D(z,J,W,Z=[]){if(z.length===0)return W;let X=W,$;for(let V of z)if(V.before){if(V.before(J)===!1)throw new R(J.model,J.operation)}for(let V of z){if(!V.scope)continue;if(Kz.has(J.operation)){Sz(V,J);continue}let Q=V.scope(J);if(Q===void 0||Q===null)continue;if(Rz(J),Lz.has(J.operation)&&!V.onUpdate){let Y=Pz(Q);if(Y.length>0)($??=[]).push(...Y)}X=_z(X,Q)}if(Yz.has(J.operation)){for(let V of z)if(V.onCreate)X=Dz(X,J,V)}if(jz.has(J.operation)){for(let V of z)if(V.onUpdate)X=Az(X,J,V)}if($!==void 0)Cz($,J,X,Z);return X}function _z(z,J){let W=z?.where;if(W===void 0||W===null)return{...z,where:J};if(typeof W!=="object"||Array.isArray(W))return{...z,where:{AND:[W,J]}};let Z=W.AND,X=Z===void 0||Z===null?[]:Array.isArray(Z)?Z:[Z];return{...z,where:{...W,AND:[...X,J]}}}function Dz(z,J,W){let Z=(X)=>W.onCreate(J,{...X});if(J.operation==="createMany"){let X=z?.data;return{...z,data:Array.isArray(X)?X.map(Z):Z(X)}}if(J.operation==="upsert")return{...z,create:Z(z?.create)};return{...z,data:Z(z?.data)}}function Az(z,J,W){let Z=J.operation==="upsert"?"update":"data",X=z?.[Z];if(X===void 0||X===null)return z;return{...z,[Z]:W.onUpdate(J,{...X})}}function Cz(z,J,W,Z=[]){let X=W?.data;if(typeof X!=="object"||X===null)return;let $=z.filter((V)=>(V in X)&&!Z.includes(V));if($.length===0)return;throw new i(J.model,J.operation,[...new Set($)])}function Pz(z){if(typeof z!=="object"||z===null||Array.isArray(z))return[];let J=[];for(let W of Object.keys(z)){if(W==="AND"||W==="OR"||W==="NOT")continue;J.push(W)}return J}function Sz(z,J){if(z.onCreate)return;throw new T(J.operation,J.model,J.operation,`${J.model} has a policy that scopes reads but no 'onCreate', and ${J.operation} has no where clause for a scope to narrow. As written the policy would confine reads to the caller and let an insert name any value it likes. Add an onCreate that sets the scoped `+"column \u2014 or, if unscoped creates are intended, say so with an onCreate "+"that returns its data unchanged.")}function Rz(z){if(qz.has(z.operation))return;throw new T(z.operation,z.model,z.operation,`${z.model} has a policy with a scope, and ${z.operation} cannot carry one: its where clause compiles to an 'on conflict' target, which is a key rather than a filter. Running it would write outside the scope.
 
 Two ways out. Use update and create separately, which both scope `+"normally \u2014 or leave the conflict key out of 'create', which Model.upsert "+"runs as a scoped read and a scoped write inside one transaction. The refusal is about 'on conflict' specifically, not about upsert.")}function dz(z,J,W){if(z.length===0)return;let Z=z.filter((X)=>X.redact);if(Z.length===0)return;for(let X of fz(W))for(let $ of Z)$.redact(J,X)}function fz(z){if(Array.isArray(z))return z;if(z===null||z===void 0)return[];if(typeof z!=="object")return[];return[z]}function lz(z,J,W){for(let Z of W){let X=z.fields[Z];if(X&&!X.nullable)throw new T(`redact.${Z}`,z.name,"redact",`'${Z}' is not nullable, so setting it to null would contradict `+"the generated type \u2014 which still says the field is there. Make the "+"field optional in schema.prisma, omit it with 'select' instead, or delete the key yourself if a runtime-only guarantee is enough.");if(Z in J)J[Z]=null}}function iz(){let z=a();if(z)return z.user;return bz()?.user??null}function bz(){try{return l.getStore()}catch{return}}var e=Symbol("gemi.orm.policiesAppliedByCaller");function az(z){return{...z,[e]:!0}}function nz(z){return typeof z==="object"&&z!==null&&z[e]===!0}var zz=Symbol("gemi.orm.columnsWrittenByTheOrm");function sz(z,J){return{...z,[zz]:J}}function tz(z){if(typeof z!=="object"||z===null)return c;let J=z[zz];return Array.isArray(J)?J:c}var c=[],Jz=Symbol("gemi.orm.operationTheRowIsReturnedFor");function oz(z,J){return{...z,[Jz]:J}}function rz(z){if(typeof z!=="object"||z===null)return;let J=z[Jz];return typeof J==="string"?J:void 0}var A="findMany";function Oz(z,J,W,Z,X){if(J===void 0||J===null)return J;if(typeof J!=="object")return J;let $=J;for(let Y of["include","select"]){let q=J[Y];if(typeof q!=="object"||q===null||Array.isArray(q))continue;let j;for(let L of Object.keys(q)){if(L===m){let w=Ez(z,q[L],W,Z,X);if(w!==q[L])j??={...q},j[L]=w;continue}let G=z.relations[L];if(!G)continue;let K=q[L];if(K===void 0||K===!1)continue;let U=X(G.model);if(!U)continue;let F=K===!0?{}:K;if(typeof F!=="object"||Array.isArray(F))continue;let x=Oz(U.schema,F,W,Z,X),v=!Z&&U.policies.length>0?D(U.policies,N(U.schema.name,A,W,Z),x):x;if(v!==F)j??={...q},j[L]=v}if(j)$={...$,[Y]:j}}let V=Wz(z,$.orderBy,W,Z,X);if(V!==$.orderBy)$={...$,orderBy:V};let Q=I(z,$.where,W,Z,X);if(Q!==$.where)$={...$,where:Q};return $}function Wz(z,J,W,Z,X){if(Z)return J;if(typeof J!=="object"||J===null)return J;if(Array.isArray(J)){let Q=!1,Y=J.map((q)=>{let j=Wz(z,q,W,Z,X);if(j!==q)Q=!0;return j});return Q?Y:J}let $,V=J;for(let Q of Object.keys(V)){let Y=z.relations[Q];if(!Y)continue;let q=V[Q];if(typeof q!=="object"||q===null||Array.isArray(q))continue;let j=X(Y.model);if(!j||j.policies.length===0)continue;let L=D(j.policies,N(j.schema.name,A,W,Z),q);if(L!==q)$??={...V},$[Q]=L}return $??J}function Ez(z,J,W,Z,X){if(Z)return J;let $=J===!0;if(!$&&(typeof J!=="object"||J===null||Array.isArray(J)))return J;let V=$?Object.fromEntries(y(z).map((q)=>[q,!0])):J.select;if(typeof V!=="object"||V===null||Array.isArray(V))return J;let Q,Y=V;for(let q of Object.keys(Y)){let j=Y[q];if(j===void 0||j===!1)continue;let L=z.relations[q];if(!L)continue;let G=X(L.model);if(!G||G.policies.length===0)continue;let K=j===!0?{}:j;if(typeof K!=="object"||Array.isArray(K))continue;let U=D(G.policies,N(G.schema.name,A,W,Z),K);if(U!==K)Q??={...Y},Q[q]=U}if(!Q)return J;return $?{select:Q}:{...J,select:Q}}function I(z,J,W,Z,X){if(typeof J!=="object"||J===null)return J;if(Array.isArray(J)){let Q=!1,Y=J.map((q)=>{let j=I(z,q,W,Z,X);if(j!==q)Q=!0;return j});return Q?Y:J}let $,V=J;for(let Q of Object.keys(V)){let Y=V[Q];if(Y===void 0)continue;if(Q==="AND"||Q==="OR"||Q==="NOT"){let L=I(z,Y,W,Z,X);if(L!==Y)$??={...V},$[Q]=L;continue}let q=z.relations[Q];if(!q)continue;let j=kz(q,Y,W,Z,X);if(j!==Y)$??={...V},$[Q]=j}return $??J}function kz(z,J,W,Z,X){if(typeof J!=="object"||J===null||Array.isArray(J))return J;let $=X(z.model);if(!$)return J;let V=g(z.kind),Q=!h(J,V),Y=Q?[["is",J]]:Object.entries(J),q;for(let[j,L]of Y){if(L===null||L===void 0)continue;let G=I($.schema,L,W,Z,X),K=!Z&&$.policies.length>0?D($.policies,N($.schema.name,A,W,Z),{where:G}).where:G,U=j==="every"?xz(G,K):K;if(U!==L)q??=Q?{}:{...J},q[j]=U}if(!q)return J;return q}function xz(z,J){if(J===z)return z;let W=d(z),X=d(J).slice(W.length);if(X.length===0)return z;return{OR:[{NOT:X.length===1?X[0]:{AND:X}},z]}}function d(z){if(typeof z!=="object"||z===null)return[];let J=z.AND;if(J===void 0)return[];return Array.isArray(J)?J:[J]}function vz(...z){let[J]=wz(...z);if(J!==void 0)throw J}function wz(...z){let J=[];for(let W of z)for(let Z of Object.values(W)){let X=Zz(Z);if(X===null)continue;r(X);let $=X.$schema.name,V=E($)?k($):void 0;if(V===void 0||V===X)continue;let Q=_(X),Y=_(V),q=Q.length!==Y.length||Q.some((j,L)=>j!==Y[L]);if(P(V,X)||P(X,V)){let j=P(X,V)?V:X,L=j===V?X:V;if(_(j).length===0){if(V===L)continue;if(!q)continue;J.push(new C($,B(V),B(X),Q.length>0?"queried":"registered"));continue}if(q)J.push(new C($,B(j),B(L),"narrowing"));continue}if(!q)continue;J.push(new C($,B(V),B(X),Q.length>0?"queried":"registered"))}return J}function XJ(...z){let J=new Map;for(let Z of z){let X=new Map;for(let $ of new Set(Object.values(Z))){let V=Zz($);if(V===null)continue;let Q=V.$schema.name,Y=X.get(Q);if(Y===void 0)X.set(Q,[V]);else Y.push(V)}for(let[$,V]of X)J.set($,gz($,V))}let W=[...J.keys()].filter((Z)=>E(Z)).map((Z)=>[Z,k(Z)]);for(let[Z,X]of J)O(Z,X);try{vz(...z)}catch(Z){for(let[X,$]of W)O(X,$);throw Z}}function gz(z,J){if(J.length===1)return J[0];let W=J.filter(($)=>!hz($)),Z=W.length>0?W:J;if(Z.length===1)return Z[0];let X=Z.filter(($)=>Z.every((V)=>V===$||P(V,$)));if(X.length===1)return X[0];throw new Xz(z,Z.map(($)=>B($)))}function hz(z){if("$generated"in z)return Object.hasOwn(z,"$generated")&&z.$generated===!0;return Object.hasOwn(z,"$schema")}function P(z,J){let W=Object.getPrototypeOf(z);while(W!==null&&W!==Function.prototype){if(W===J)return!0;W=Object.getPrototypeOf(W)}return!1}function B(z){return z?.name??String(z)}function Zz(z){if(typeof z!=="function")return null;let J=z.$schema;if(J===void 0||typeof J.name!=="string")return null;return z}
-export{g as Ja,h as Ka,m as La,y as Ma,N as Na,n as Oa,Qz as Pa,_ as Qa,D as Ra,dz as Sa,lz as Ta,iz as Ua,az as Va,nz as Wa,sz as Xa,tz as Ya,oz as Za,rz as _a,A as $a,Oz as ab,vz as bb,wz as cb,XJ as db};
+export{g as Ka,h as La,m as Ma,y as Na,N as Oa,n as Pa,Qz as Qa,_ as Ra,D as Sa,dz as Ta,lz as Ua,iz as Va,az as Wa,nz as Xa,sz as Ya,tz as Za,oz as _a,rz as $a,A as ab,Oz as bb,vz as cb,wz as db,XJ as eb};
 
-//# debugId=9E1064785367A20264756E2164756E21
+//# debugId=3980486A5E87621664756E2164756E21

package/dist/{chunk-0av6xvm6.js.map → chunk-1ckha5dt.js.map}

@@ -7,6 +7,6 @@
     "import {\n  AmbiguousModelRegistrationError,\n  UnregisteredPolicyClassError,\n} from \"./errors\";\nimport { assertPolicyShapes, policiesFor } from \"./policy\";\nimport * as registry from \"./registry\";\nimport type { ModelSchema } from \"./schema\";\n\n/** A model class, as much of one as anything below `Model.ts` can name. */\ntype ModelClass = object & { $schema: ModelSchema };\n\n/**\n * Checks that every policied model class an application defines is the one the\n * registry resolves its name to — **ahead of any query**, rather than when one\n * happens to be run.\n *\n * ### Why this exists\n *\n * `Model.$exec` already refuses a query whose class carries policies the\n * registered class does not (`UnregisteredPolicyClassError`). That guard closed\n * the two shapes found in #51, and it is the right check, but it can only fire\n * on a class somebody actually queries **at the root**. Its condition begins\n * `registered !== this`, and there is a case where that is false and the leak is\n * real:\n *\n *     export class Membership extends MembershipModel {\n *       static $policies = [{ scope: (ctx) => ({ orgId: ctx.user.orgId }) }]\n *     }\n *     // ...and no `register(\"Membership\", Membership)`\n *\n * If nothing ever calls `Membership.findMany()` — because memberships are only\n * ever read through `include: { memberships: true }` — then the include resolves\n * the name to the *generated base*, `this` **is** that base, the comparison\n * never runs, and rows come back unscoped with no error. Not a policy chain that\n * fails to diverge: a check that is never reached.\n *\n * A model reached only through includes is usually a membership or a pivot,\n * which is exactly the kind that carries a tenant scope. So the residual runs\n * the wrong way: the guard is weakest where the data is most sensitive.\n *\n * ### What this does about it\n *\n * The same rule, triggered differently. Instead of waiting for a root query,\n * it takes the modules where an application's model classes live and applies the\n * divergence comparison to every one of them:\n *\n *     import * as models from \"@/app/models\"\n *     assertPoliciesRegistered(models)\n *\n * Reading a class out of a module namespace is what makes the unqueried case\n * visible — the class exists and is exported whether or not anything queries it.\n *\n * `registerModels` runs this after registering, and `Kernel.models` runs\n * `registerModels` at boot, so an application that declares its model modules\n * gets it without asking. This is the same check for modules the Kernel does\n * not own — a test over a package's models, a script that boots nothing.\n *\n * It can only see modules it is handed, which is the residual either way: a\n * policied class in a file no barrel re-exports is invisible to it.\n * `gemi check models` closes that by handing it the files instead of the\n * barrel — see `auditModelRegistrations`, which is the same rule without the\n * throw.\n */\nexport function assertPoliciesRegistered(\n  ...modules: Array<Record<string, unknown>>\n): void {\n  const [first] = auditModelRegistrations(...modules);\n  if (first !== undefined) throw first;\n}\n\n/**\n * Every problem `assertPoliciesRegistered` would report, as values rather than\n * as a throw — in the order it would have reported them, so the first element is\n * exactly what that function throws.\n *\n * ### Why the rule needed a second caller\n *\n * A throw is the right shape at boot: the first policied class that does not own\n * its name is a reason not to start, and the rest of the list is noise nobody\n * reads before fixing the first one.\n *\n * It is the wrong shape for a checker. `gemi check models` walks\n * `app/models/**` and audits each file, so it wants *all* of them, and it wants\n * to sort them — a policied class the Kernel never sees is a leak to report,\n * while a policied view deliberately kept out of the declared modules is the\n * arrangement the error for that case actually recommends, and reporting it\n * would be telling an author to undo what the framework told them to do.\n * `UnregisteredPolicyClassError.carries` is what separates the two, and it can\n * only be read off an error somebody is holding.\n *\n * Errors rather than a plain finding type, because the message is the useful\n * part and it is already written once, in the error. Constructing them is not\n * free — a stack per finding — and it is a check somebody runs, not a request\n * path.\n */\nexport function auditModelRegistrations(\n  ...modules: Array<Record<string, unknown>>\n): UnregisteredPolicyClassError[] {\n  const problems: UnregisteredPolicyClassError[] = [];\n\n  for (const module of modules) {\n    for (const exported of Object.values(module)) {\n      const model = asModelClass(exported);\n      if (model === null) continue;\n\n      // #321's boot-time half, run **before** the early return below and for\n      // every class rather than only the diverging ones. Left below the return,\n      // the two commonest arrangements were never checked at all — a class that\n      // already owns its name, and one whose name nothing else claims — so a\n      // `{ scopes: … }` typo registered, reported green, and read unscoped.\n      //\n      // `assertPolicyShapes` and not `policiesFor`, and the difference is the\n      // point: this walk checks the entries and constructs nothing. Resolving\n      // here instead is one line and would additionally catch a policy class\n      // whose constructor throws — at the price of constructing every policy\n      // class in the application at `registerModels` time, ahead of whatever\n      // config or container the constructor reaches for. A guard against a\n      // policy that does nothing must not become the reason a working\n      // application stops booting, so the cases that need an instance are left\n      // to `policiesFor`, which is reached below, on the first query, and by\n      // `Model.$exec`.\n      assertPolicyShapes(model);\n\n      const name = model.$schema.name;\n      const registered = registry.has(name)\n        ? (registry.get<unknown>(name) as object)\n        : undefined;\n\n      // Nothing registered under the name at all. The generated `index.ts`\n      // registers every model, so reaching this means it was never imported —\n      // a different mistake, and one the first query reports clearly through\n      // `ModelNotRegisteredError`. Not this function's business.\n      if (registered === undefined || registered === model) continue;\n\n      const ours = policiesFor(model);\n      const theirs = policiesFor(registered);\n      const diverges =\n        ours.length !== theirs.length ||\n        ours.some((policy, index) => policy !== theirs[index]);\n\n      // The two classes are on one prototype chain — a base and something\n      // extending it — which is the arrangement almost every application has,\n      // and the one this audit used to get wrong in both directions.\n      //\n      // `policiesFor` accumulates upwards, so a descendant's chain always\n      // contains its ancestor's. What separates the two shapes is therefore\n      // whether the **ancestor** carries anything of its own.\n      if (descendsFrom(registered, model) || descendsFrom(model, registered)) {\n        const ancestor = descendsFrom(model, registered) ? registered : model;\n        const descendant = ancestor === registered ? model : registered;\n\n        if (policiesFor(ancestor).length === 0) {\n          // The ancestor contributes nothing, so the descendant is the first\n          // class to carry a policy: it is not a view over the model, it *is*\n          // the model. A generated base is the usual ancestor here, and a\n          // hand-written intermediate behaves the same way.\n          //\n          // Registered already? Then this is the correct arrangement, and it\n          // has to be skipped rather than reported — it used not to be, and\n          // that is why the documented\n          //\n          //     assertPoliciesRegistered(generated, models)\n          //\n          // threw the moment an application wrote its first policy: it walked\n          // the generated namespace, found `UserModel` diverging from the\n          // registered `User`, and refused the thing it exists to protect.\n          // Being reachable through a base is not the bug; querying through one\n          // is, and that is a property of a call site rather than of a module's\n          // export list, so `Model.$exec` keeps that direction.\n          if (registered === descendant) continue;\n\n          // Neither class carries anything, so which one owns the name changes\n          // no query's scope. An unregistered plain subclass is not a mistake.\n          if (!diverges) continue;\n\n          // Not registered, and it has policies: #316 itself. The policied\n          // class is not the one the name resolves to, so every nested read\n          // runs the ancestor and skips it.\n          problems.push(\n            new UnregisteredPolicyClassError(\n              name,\n              nameOf(registered),\n              nameOf(model),\n              ours.length > 0 ? \"queried\" : \"registered\",\n            ),\n          );\n          continue;\n        }\n\n        // The ancestor carries policies of its own, so it is a registered model\n        // in good standing and the descendant is narrowing it. The registry\n        // holds one class per name: registering the view applies its narrowing\n        // to every nested read, and leaving the ancestor registered skips the\n        // view's policies entirely. Both are silent, so neither is chosen.\n        if (diverges) {\n          problems.push(\n            new UnregisteredPolicyClassError(\n              name,\n              nameOf(ancestor),\n              nameOf(descendant),\n              \"narrowing\",\n            ),\n          );\n        }\n\n        // Same chain, same policies — a plain typed view. Nothing to report.\n        continue;\n      }\n\n      if (!diverges) continue;\n\n      // Unrelated classes claiming one name. Whichever is registered, the\n      // other's policies are simply not in effect.\n      problems.push(\n        new UnregisteredPolicyClassError(\n          name,\n          nameOf(registered),\n          nameOf(model),\n          ours.length > 0 ? \"queried\" : \"registered\",\n        ),\n      );\n    }\n  }\n\n  return problems;\n}\n\n/**\n * Registers every model class the given modules export, under the name each\n * one's schema carries, and then audits the result.\n *\n * ### The line this exists to delete\n *\n * `register(\"User\", User)` next to every subclass is a correct instruction and\n * a bad mechanism, because forgetting it is invisible. A relation read resolves\n * its target by name, so an unregistered policied subclass leaves the generated\n * base owning the name and every nested `include` of that model comes back\n * unscoped — no error, no warning, and an authorization hole in the direction\n * nobody checks. `assertPoliciesRegistered` turns that into a loud failure, but\n * only for someone who remembered to run it.\n *\n * Deriving the registration from the module removes the mistake instead of\n * reporting it. The name is not a string an author repeats; it is\n * `$schema.name`, which the generator wrote and the subclass inherits:\n *\n *     import * as generated from \"./generated\"\n *     import * as models from \"./models\"\n *\n *     registerModels(generated, models)\n *\n * Later modules win, so the application's classes replace the generated bases\n * they extend. `register` still exists and still works — this is what an\n * application calls once instead of writing it thirteen times.\n *\n * ### What it still cannot see\n *\n * Modules it is handed. A policied class in a file nothing imports is invisible\n * to this exactly as it is to `assertPoliciesRegistered`, and closing *that*\n * would take the framework enumerating the filesystem at boot. Handing it a\n * barrel is the whole discipline: one file to add a model to, and the audit\n * covers everything in it.\n *\n * `Kernel.models` is that call, wired at boot, so an application declares its\n * model modules the way it already declares config slices and providers.\n */\nexport function registerModels(\n  ...modules: Array<Record<string, unknown>>\n): void {\n  // Elected into a local map first, and only committed once the audit passes.\n  //\n  // The registry is process-wide and outlives the throw. Registering as we went\n  // meant a refused call left the arrangement it had just refused installed —\n  // `registerModels({Ours}, {Theirs})` threw, and `\"User\"` resolved to `Theirs`\n  // afterwards, which is the leaking mapping the audit exists to reject. A\n  // server whose boot dies never notices; a dev server that catches and keeps\n  // serving, or a test harness that continues past the error, serves the rest\n  // of the process from it.\n  const staged = new Map<string, ModelClass>();\n\n  for (const module of modules) {\n    const candidates = new Map<string, ModelClass[]>();\n\n    // Deduped by identity first: `export { User }` alongside a default export\n    // is the same class under two keys, not two classes competing for a name.\n    for (const exported of new Set(Object.values(module))) {\n      const model = asModelClass(exported);\n      if (model === null) continue;\n\n      const name = model.$schema.name;\n      const existing = candidates.get(name);\n      if (existing === undefined) candidates.set(name, [model]);\n      else existing.push(model);\n    }\n\n    // Later modules win, which is what lets an application's classes replace\n    // the generated bases they extend.\n    for (const [name, classes] of candidates) {\n      staged.set(name, elect(name, classes));\n    }\n  }\n\n  // What the registry said before, so a failed audit can put it back. `register`\n  // has no inverse, so a name that was previously *absent* cannot be made\n  // absent again — it is left pointing at what this call elected. That is the\n  // one residue, and it is the harmless direction: the alternative to a wrong\n  // registration under a name nothing claimed is `ModelNotRegisteredError`, and\n  // the class elected here is the one this module set would have used anyway.\n  const previous = [...staged.keys()]\n    .filter((name) => registry.has(name))\n    .map((name) => [name, registry.get<unknown>(name)] as const);\n\n  for (const [name, model] of staged) registry.register(name, model);\n\n  try {\n    assertPoliciesRegistered(...modules);\n  } catch (error) {\n    for (const [name, model] of previous) registry.register(name, model);\n    throw error;\n  }\n}\n\n/**\n * Which of several classes claiming one name in one module gets it.\n *\n * Two shapes put more than one candidate in a namespace, and they want opposite\n * answers, so neither \"most derived\" nor \"least derived\" is the rule on its\n * own:\n *\n *     export * from \"./generated\"      // UserModel, and\n *     export class User extends UserModel { static $policies = [...] }\n *\n * wants the subclass — electing the base here *is* the leak, in the one file an\n * author most plausibly writes it in. While\n *\n *     export class User extends UserModel { static $policies = [...] }\n *     export class AdminUser extends User {}\n *\n * wants `User`. `AdminUser` is a typed view over the same rows; it inherits the\n * policies either way, so registering it changes nothing when it adds none and\n * silently applies its own narrowing to every nested read when it does.\n *\n * What separates them is which class the *generator* wrote. It emits\n * `static $schema = schema.User` on the base, and a subclass inherits that\n * property rather than declaring one — so an own `$schema` is the mark of a\n * generated base, and it is a fact about the classes rather than about the\n * order somebody exported them in. Application classes are preferred over\n * bases; among application classes the least derived wins, for the reason\n * `AdminUser` gives.\n *\n * When that leaves no single answer the candidates are unrelated classes with a\n * genuine claim each, and there is nothing left to infer. That case is refused\n * rather than guessed at: `register` says which, in the application's own\n * words.\n */\nfunction elect(name: string, classes: ModelClass[]): ModelClass {\n  if (classes.length === 1) return classes[0]!;\n\n  const written = classes.filter((candidate) => !isGeneratedBase(candidate));\n  const eligible = written.length > 0 ? written : classes;\n\n  if (eligible.length === 1) return eligible[0]!;\n\n  const roots = eligible.filter((candidate) =>\n    eligible.every(\n      (other) => other === candidate || descendsFrom(other, candidate),\n    ),\n  );\n\n  if (roots.length === 1) return roots[0]!;\n\n  throw new AmbiguousModelRegistrationError(\n    name,\n    eligible.map((candidate) => nameOf(candidate)),\n  );\n}\n\n/**\n * Whether the generator wrote this class, rather than an application extending\n * one it wrote.\n *\n * The generator marks its own output — `static $generated = true` on each\n * emitted base, and on nothing else — so for artifacts that carry the mark this\n * is a fact the generator stated rather than a property of how it happens to be\n * written. A subclass *inherits* the mark and does not own it, which is what\n * makes own-vs-inherited the whole test.\n *\n * ### The fallback, and why it is second\n *\n * `$schema` is also declared on the emitted base and inherited below it, so\n * owning *that* used to answer the same question, and it answered it wrongly for\n * one shape (#318): a subclass that redeclares `static $schema` — pointing at a\n * modified schema object, or by copy-paste — read as a base, every candidate\n * looked generated, and the least derived won. That did not pass quietly, since\n * `assertPoliciesRegistered` runs immediately after `elect` and refuses a\n * policied class that lost its name. But loud-and-wrong is still wrong, and the\n * silent half — a subclass with statics and row methods but no policies, whose\n * methods then never run inside a nested read — had nothing to refuse.\n *\n * The inference survives as the fallback for artifacts generated *before* the\n * mark existed, where it is the only signal there is. `\"$generated\" in candidate`\n * is what separates the two worlds: it walks the prototype chain, so it is true\n * for a marked base and for everything under it, and false for every class in an\n * app whose `app/models/generated` predates 0.51. Asking `Object.hasOwn` first\n * and falling back on `false` would send a subclass of a *marked* base back into\n * the inference — which is exactly the case the mark was added to fix.\n *\n * `registration.test.ts` in the template asserts the contract against real\n * generator output, because this is the one place a generator change could\n * quietly invalidate an assumption made here.\n */\nfunction isGeneratedBase(candidate: ModelClass): boolean {\n  // Owning the mark, not merely having it — and owning it set to `true`. The\n  // declared type is `?: true`, so TypeScript already refuses `false`; reading\n  // the value anyway is what makes `static $generated = false` mean the thing\n  // it plainly says in an app with no typechecking between it and here.\n  if (\"$generated\" in candidate) {\n    return (\n      Object.hasOwn(candidate, \"$generated\") &&\n      (candidate as { $generated?: unknown }).$generated === true\n    );\n  }\n\n  return Object.hasOwn(candidate, \"$schema\");\n}\n\n/**\n * Whether `derived` has `base` in its static prototype chain — the `extends`\n * relation between two classes, walked on the constructor side because that is\n * where `$schema` and `$policies` live.\n */\nfunction descendsFrom(derived: unknown, base: unknown): boolean {\n  let current = Object.getPrototypeOf(derived);\n\n  while (current !== null && current !== Function.prototype) {\n    if (current === base) return true;\n    current = Object.getPrototypeOf(current);\n  }\n\n  return false;\n}\n\nfunction nameOf(value: unknown): string {\n  return (value as { name?: string })?.name ?? String(value);\n}\n\n/**\n * A model class, structurally.\n *\n * Structural rather than `instanceof Model` on purpose: this module sits below\n * `Model.ts` in the import graph, and importing it here to answer a question\n * about shape would put a cycle between the registry, the policy hook and the\n * model base for no gain. `$schema` carrying a `name` is what every operation\n * already relies on.\n *\n * A module namespace holds anything the author exported — types erase, but\n * constants, helpers and re-exported values do not — so everything that is not\n * a model class is skipped rather than treated as an error.\n */\nfunction asModelClass(value: unknown): ModelClass | null {\n  if (typeof value !== \"function\") return null;\n\n  const schema = (value as { $schema?: ModelSchema }).$schema;\n  if (schema === undefined || typeof schema.name !== \"string\") return null;\n\n  return value as unknown as ModelClass;\n}\n"
   ],
   "mappings": ";+OAyBA,FAAM,HAAwB,LAAC,QAAS,OAAQ,MAAM,EAChD,GAAuB,CAAC,KAAM,OAAO,EAsBpC,SAAS,CAAuB,CACrC,EACmB,CACnB,OAAO,IAAS,OAAS,GAAwB,GAgB5C,SAAS,CAAc,CAC5B,EACA,EACS,CACT,IAAM,EAAO,OAAO,KAAK,CAAK,EAC9B,OAAO,EAAK,OAAS,GAAK,EAAK,MAAM,CAAC,IAAQ,EAAU,SAAS,CAAG,CAAC,EAYhE,IAAM,EAAY,SAqBlB,SAAS,CAAkB,CAAC,EAEtB,CACX,OAAO,OAAO,KAAK,EAAO,SAAS,EAChC,OAAO,CAAC,IAAS,EAAO,UAAU,IAAO,OAAS,MAAM,EACxD,KAAK,EClBH,SAAS,CAAa,CAC3B,EACA,EACA,EACA,EACe,CASf,IAAM,EAAU,CAAE,QAAO,YAAW,QAAS,GAAQ,IAAK,EAiB1D,OAVA,OAAO,eAAe,EAAS,OAAQ,CACrC,WAAY,GACZ,GAAG,EAAG,CACJ,GAAI,GAAQ,MAAQ,CAAC,EACnB,MAAM,IAAI,EAAkB,EAAO,EAAW,SAAS,EAEzD,OAAO,EAEX,CAAC,EAEM,EAyHF,MAAe,CAAgD,CAAC,CAahE,MAAe,WAIZ,CAA8B,CAOxC,CAyBA,IAAM,GAAW,IAAI,IAAY,CAC/B,WACA,YACA,mBACA,aACA,oBACA,QAIA,YAMA,UACA,SACA,aACA,SACA,YACF,CAAC,EAGK,GAAW,IAAI,IAAY,CAAC,SAAU,aAAc,QAAQ,CAAC,EAQ7D,GAAW,IAAI,IAAY,CAAC,SAAU,aAAc,QAAQ,CAAC,EAM7D,GAAW,IAAI,IAAY,CAAC,SAAU,YAAY,CAAC,EAQnD,GAAY,IAAI,IAAY,CAAC,SAAU,YAAY,CAAC,EAoBpD,EAAe,IAAI,QAmBzB,SAAS,EAAY,CACnB,EACA,EACA,EACa,CACb,GAAI,OAAO,IAAU,WAAY,OAAO,EAExC,IAAM,EAAW,EAAa,IAAI,CAAK,EACvC,GAAI,IAAa,OAAW,OAAO,EAEnC,IAAI,EACJ,GAAI,CACF,EAAO,IAAK,EACZ,MAAO,EAAO,CACd,MAAM,IAAI,EACR,EAAY,CAAK,EACjB,EACA,oBACA,GAAG,EAAiB,CAAK;AAAA;AAAA,MACnB,GAAiB,SAAW,OAAO,CAAK,IAC9C,EACA,OACA,CAAE,OAAM,CACV,EAMF,OAHA,EAAsB,EAAiC,EAAO,CAAK,EAEnE,EAAa,IAAI,EAAO,CAAI,EACrB,EAIT,SAAS,CAAY,CACnB,EACA,EACe,CACf,OAAO,EAAQ,IAAI,CAAC,EAAO,IAAU,GAAa,EAAO,EAAO,CAAK,CAAC,EA4BxE,IAAM,EAAmB,CACvB,SACA,QACA,WACA,WACA,QACF,EAuCA,IAAM,EAAiB,IAAI,QAmB3B,SAAS,CAAmB,CAC1B,EACA,EACM,CACN,GAAI,EAAe,IAAI,CAAO,EAAG,OAEjC,QAAS,EAAQ,EAAG,EAAQ,EAAQ,OAAQ,IAC1C,GAAkB,EAAQ,GAAuB,EAAO,CAAK,EAG/D,EAAe,IAAI,CAAO,EAmB5B,SAAS,EAAiB,CACxB,EACA,EACA,EACM,CACN,IAAM,EAAQ,EAAY,CAAK,EACzB,EAAO,OAAO,EAMpB,GACE,IAAU,MACV,MAAM,QAAQ,CAAK,GAClB,IAAS,UAAY,IAAS,WAE/B,MAAM,IAAI,EACR,EACA,EACA,eACA,EAAc,CAAK,EACnB,CACF,EAGF,GAAI,IAAS,WAAY,CACvB,GAAI,CAAC,GAAgB,CAAiB,EACpC,MAAM,IAAI,EACR,EACA,EACA,oBACA,EAAiB,CAAiB,EAClC,CACF,EAIF,OAGF,EAAsB,EAAkC,EAAO,CAAK,EAWtE,SAAS,CAAqB,CAC5B,EACA,EACA,EACM,CACN,IAAM,EAAQ,EAAY,CAAK,EAC3B,EAAW,EAGT,EAAkB,CAAC,EAEzB,QAAW,KAAQ,EAAkB,CACnC,IAAM,EAAQ,EAAO,GAIrB,GAAI,IAAU,QAAa,IAAU,KAAM,CACzC,GAAI,KAAQ,EAAQ,EAAM,KAAK,CAAI,EACnC,SAGF,GAAI,OAAO,IAAU,WACnB,MAAM,IAAI,EACR,EACA,EACA,oBACA,IAAI,cAAiB,EAAc,CAAK,2BACxC,CACF,EAGF,IAGF,GAAI,EAAW,EAAG,OAElB,GAAI,EAAM,OAAS,EACjB,MAAM,IAAI,EACR,EACA,EACA,WACA,aAAa,EAAM,IAAI,CAAC,IAAS,IAAI,IAAO,EAAE,KAAK,IAAI,qBAC3C,EAAM,SAAW,EAAI,KAAO,gCACtC,2CACF,CACF,EAGF,IAAM,EAAU,GAAY,CAAM,EAC5B,EAAO,GAAY,CAAO,EAEhC,MAAM,IAAI,EACR,EACA,EACA,WACA,EAAQ,SAAW,EACf,eACA,aAAa,GAAS,CAAO,MAK1B,EAAQ,SAAW,GAAK,EAAQ,KAAO,UACpC,kEACA,oEACA,kBACA,IACV,EACA,CACF,EAUF,SAAS,EAAQ,CAAC,EAAiC,CACjD,IAAM,EAAQ,EAAK,MAAM,EAAG,CAAC,EAAE,IAAI,CAAC,IAAQ,IAAI,IAAM,EACtD,OAAO,EAAK,OAAS,EAAM,OACvB,GAAG,EAAM,KAAK,IAAI,SAAS,EAAK,OAAS,EAAM,cAC/C,EAAM,KAAK,IAAI,EAqBrB,SAAS,EAAe,CAAC,EAA0B,CACjD,GAAI,CAEF,OADA,QAAQ,UAAU,GAAM,CAAC,EAAG,CAA0B,EAC/C,GACP,KAAM,CACN,MAAO,IAKX,IAAM,GAAO,QAAS,EAAG,GAQzB,SAAS,EAAW,CAAC,EAA0B,CAC7C,IAAM,EAAO,IAAI,IAEb,EAAyB,EAC7B,MAAO,IAAY,MAAQ,IAAY,OAAO,UAAW,CACvD,QAAW,KAAO,OAAO,oBAAoB,CAAO,EAClD,GAAI,IAAQ,cAAe,EAAK,IAAI,CAAG,EAEzC,EAAU,OAAO,eAAe,CAAO,EAGzC,MAAO,CAAC,GAAG,CAAI,EAuBjB,SAAS,EAAW,CAClB,EAC2C,CAC3C,IAAI,EACA,EAAe,EAEnB,QAAW,KAAO,EAChB,QAAW,KAAQ,EAAkB,CACnC,IAAM,EAAW,GAAa,EAAI,YAAY,EAAG,EAAK,YAAY,CAAC,EACnE,GAAI,EAAW,EACb,EAAe,EACf,EAAO,CAAE,MAAK,MAAK,EAKzB,OAAO,EAIT,SAAS,EAAY,CAAC,EAAW,EAAmB,CAClD,GAAI,IAAM,EAAG,MAAO,GAEpB,IAAI,EAAM,MAAM,KAAK,CAAE,OAAQ,EAAE,OAAS,CAAE,EAAG,CAAC,EAAQ,IAAU,CAAK,EAEvE,QAAS,EAAI,EAAG,GAAK,EAAE,OAAQ,IAAK,CAClC,IAAI,EAAW,EAAI,GACnB,EAAI,GAAK,EAET,QAAS,EAAI,EAAG,GAAK,EAAE,OAAQ,IAAK,CAClC,IAAM,EAAO,EAAI,GACjB,EAAI,GAAK,KAAK,IACZ,EAAI,GAAM,EACV,EAAI,EAAI,GAAM,EACd,GAAY,EAAE,EAAI,KAAO,EAAE,EAAI,GAAK,EAAI,EAC1C,EACA,EAAW,GAIf,OAAO,EAAI,EAAE,QAQf,SAAS,CAAa,CAAC,EAAwB,CAC7C,GAAI,IAAU,KAAM,MAAO,OAC3B,GAAI,IAAU,OAAW,MAAO,YAChC,GAAI,OAAO,IAAU,SAAU,MAAO,cAAc,KAAK,UAAU,CAAK,IACxE,GAAI,OAAO,IAAU,WAAY,OAAO,EAAiB,CAAK,EAC9D,GAAI,MAAM,QAAQ,CAAK,EAAG,MAAO,WACjC,GAAI,OAAO,IAAU,SAAU,MAAO,YACtC,MAAO,OAAO,OAAO,KAAS,OAAO,CAAK,IAG5C,SAAS,CAAgB,CAAC,EAAyB,CACjD,OAAO,EAAM,KAAO,kBAAkB,EAAM,SAAW,wBAyBlD,SAAS,CAAW,CAAC,EAAwC,CAClE,IAAI,EACA,EAGA,EAEA,EAAU,EACd,MAAO,GAAW,IAAY,SAAS,UAAW,CAWhD,GAAI,OAAO,OAAO,EAAS,SAAS,EAClC,MAAU,MACR,GAAI,EAA8B,MAAQ,2FAExC,wEACA,oDACJ,EAGF,GAAI,OAAO,OAAO,EAAS,WAAW,GAAK,EAAQ,UAAW,CAC5D,IAAM,EAAQ,EAAQ,UACtB,GAAI,EAAM,OAAS,EAAG,CAOpB,IAAM,EAAQ,EAGd,GAFA,EAAoB,EAAO,CAAK,EAE5B,IAAS,QAAa,IAAU,OAKlC,EAAO,EACP,EAAY,EAKZ,SAAU,EAAa,EAAgC,CAAS,EAChE,EAAO,OACP,EAAM,QAAQ,GAAG,EAAa,EAAO,CAAK,CAAC,GAIjD,EAAU,OAAO,eAAe,CAAO,EAGzC,GAAI,IAAU,OAAW,OAAO,EAChC,GAAI,IAAS,OAAW,OAAO,GAK/B,OAAO,EAAK,KAAK,CAAC,IAAU,OAAO,IAAU,UAAU,EACnD,EAAa,EAAM,CAAS,EAC3B,EAuBA,SAAS,CAAkB,CAAC,EAAsB,CACvD,IAAI,EAAU,EAEd,MAAO,GAAW,IAAY,SAAS,UAAW,CAKhD,GAAI,OAAO,OAAO,EAAS,WAAW,GAAK,EAAQ,UAAW,CAC5D,IAAM,EAAQ,EAAQ,UACtB,GAAI,EAAM,OAAS,EAAG,EAAoB,EAAS,CAAK,EAE1D,EAAU,OAAO,eAAe,CAAO,GAI3C,SAAS,CAAW,CAAC,EAAwB,CAC3C,OAAQ,GAA6B,MAAQ,aAG/C,IAAM,GAAgC,OAAO,OAAO,CAAC,CAAC,EAS/C,SAAS,CAAa,CAC3B,EACA,EACA,EAKA,EAAiC,CAAC,EAC7B,CACL,GAAI,EAAS,SAAW,EAAG,OAAO,EAElC,IAAI,EAAM,EAON,EAEJ,QAAW,KAAU,EACnB,GAAI,EAAO,QAET,GADgB,EAAO,OAAO,CAAO,IACrB,GACd,MAAM,IAAI,EAAkB,EAAQ,MAAO,EAAQ,SAAS,EAKlE,QAAW,KAAU,EAAU,CAC7B,GAAI,CAAC,EAAO,MAAO,SAOnB,GAAI,GAAU,IAAI,EAAQ,SAAS,EAAG,CACpC,GAAoB,EAAQ,CAAO,EACnC,SAGF,IAAM,EAAQ,EAAO,MAAM,CAAO,EAClC,GAAI,IAAU,QAAa,IAAU,KAAM,SAO3C,GALA,GAAe,CAAO,EAKlB,GAAS,IAAI,EAAQ,SAAS,GAAK,CAAC,EAAO,SAAU,CACvD,IAAM,EAAQ,GAAiB,CAAK,EACpC,GAAI,EAAM,OAAS,GAAI,IAAc,CAAC,GAAG,KAAK,GAAG,CAAK,EAGxD,EAAM,GAAU,EAAK,CAAK,EAG5B,GAAI,GAAS,IAAI,EAAQ,SAAS,GAChC,QAAW,KAAU,EACnB,GAAI,EAAO,SAAU,EAAM,GAAY,EAAK,EAAS,CAAM,EAI/D,GAAI,GAAS,IAAI,EAAQ,SAAS,GAChC,QAAW,KAAU,EACnB,GAAI,EAAO,SAAU,EAAM,GAAY,EAAK,EAAS,CAAM,EAsB/D,GAAI,IAAc,OAChB,GAAoB,EAAW,EAAS,EAAK,CAAW,EAG1D,OAAO,EAyBT,SAAS,EAAS,CAAC,EAAW,EAAqB,CACjD,IAAM,EAAQ,GAAM,MAEpB,GAAI,IAAU,QAAa,IAAU,KACnC,MAAO,IAAK,EAAM,MAAO,CAAM,EAGjC,GAAI,OAAO,IAAU,UAAY,MAAM,QAAQ,CAAK,EAClD,MAAO,IAAK,EAAM,MAAO,CAAE,IAAK,CAAC,EAAO,CAAK,CAAE,CAAE,EAInD,IAAM,EAAW,EAAM,IACjB,EACJ,IAAa,QAAa,IAAa,KACnC,CAAC,EACD,MAAM,QAAQ,CAAQ,EACpB,EACA,CAAC,CAAQ,EAEjB,MAAO,IAAK,EAAM,MAAO,IAAK,EAAO,IAAK,CAAC,GAAG,EAAS,CAAK,CAAE,CAAE,EAIlE,SAAS,EAAW,CAAC,EAAW,EAAwB,EAA0B,CAQhF,IAAM,EAAM,CAAC,IAAc,EAAO,SAAU,EAAS,IAAK,CAAK,CAAC,EAEhE,GAAI,EAAQ,YAAc,aAAc,CACtC,IAAM,EAAO,GAAM,KACnB,MAAO,IACF,EACH,KAAM,MAAM,QAAQ,CAAI,EAAI,EAAK,IAAI,CAAG,EAAI,EAAI,CAAI,CACtD,EAGF,GAAI,EAAQ,YAAc,SAGxB,MAAO,IAAK,EAAM,OAAQ,EAAI,GAAM,MAAM,CAAE,EAG9C,MAAO,IAAK,EAAM,KAAM,EAAI,GAAM,IAAI,CAAE,EAU1C,SAAS,EAAW,CAClB,EACA,EACA,EACK,CACL,IAAM,EAAM,EAAQ,YAAc,SAAW,SAAW,OAClD,EAAU,IAAO,GAIvB,GAAI,IAAY,QAAa,IAAY,KAAM,OAAO,EAEtD,MAAO,IAAK,GAAO,GAAM,EAAO,SAAU,EAAS,IAAK,CAAQ,CAAC,CAAE,EAgBrE,SAAS,EAAmB,CAC1B,EACA,EACA,EAgBA,EAAiC,CAAC,EAC5B,CACN,IAAM,EAAO,GAAM,KACnB,GAAI,OAAO,IAAS,UAAY,IAAS,KAAM,OAE/C,IAAM,EAAW,EAAU,OACzB,CAAC,KAAU,KAAS,IAAQ,CAAC,EAAY,SAAS,CAAK,CACzD,EACA,GAAI,EAAS,SAAW,EAAG,OAE3B,MAAM,IAAI,EAAiB,EAAQ,MAAO,EAAQ,UAAW,CAC3D,GAAG,IAAI,IAAI,CAAQ,CACrB,CAAC,EAYH,SAAS,EAAgB,CAAC,EAA0B,CAClD,GAAI,OAAO,IAAU,UAAY,IAAU,MAAQ,MAAM,QAAQ,CAAK,EACpE,MAAO,CAAC,EAGV,IAAM,EAAkB,CAAC,EACzB,QAAW,KAAO,OAAO,KAAK,CAAgC,EAAG,CAC/D,GAAI,IAAQ,OAAS,IAAQ,MAAQ,IAAQ,MAAO,SACpD,EAAM,KAAK,CAAG,EAEhB,OAAO,EAqBT,SAAS,EAAmB,CAC1B,EACA,EACM,CACN,GAAI,EAAO,SAAU,OAErB,MAAM,IAAI,EACR,EAAQ,UACR,EAAQ,MACR,EAAQ,UACR,GAAG,EAAQ,+DACN,EAAQ,gMAGX,+EACA,kCACJ,EAaF,SAAS,EAAc,CAAC,EAA8B,CACpD,GAAI,GAAS,IAAI,EAAQ,SAAS,EAAG,OAErC,MAAM,IAAI,EACR,EAAQ,UACR,EAAQ,MACR,EAAQ,UACR,GAAG,EAAQ,wCAAwC,EAAQ;AAAA;AAAA,mEAKzD,iFACA,qIAEJ,EAYK,SAAS,EAAc,CAC5B,EACA,EACA,EACM,CACN,GAAI,EAAS,SAAW,EAAG,OAE3B,IAAM,EAAY,EAAS,OAAO,CAAC,IAAW,EAAO,MAAM,EAC3D,GAAI,EAAU,SAAW,EAAG,OAE5B,QAAW,KAAO,GAAO,CAAM,EAC7B,QAAW,KAAU,EAAW,EAAO,OAAQ,EAAS,CAAG,EAI/D,SAAS,EAAM,CAAC,EAAwB,CACtC,GAAI,MAAM,QAAQ,CAAM,EAAG,OAAO,EAClC,GAAI,IAAW,MAAQ,IAAW,OAAW,MAAO,CAAC,EACrD,GAAI,OAAO,IAAW,SAAU,MAAO,CAAC,EACxC,MAAO,CAAC,CAAM,EAgBT,SAAS,EAAc,CAC5B,EACA,EACA,EACM,CACN,QAAW,KAAQ,EAAQ,CACzB,IAAM,EAAQ,EAAO,OAAO,GAE5B,GAAI,GAAS,CAAC,EAAM,SAClB,MAAM,IAAI,EACR,UAAU,IACV,EAAO,KACP,SACA,IAAI,8DACF,2EACA,mIAEJ,EAGF,GAAI,KAAQ,EAAK,EAAI,GAAQ,MA0B1B,SAAS,EAAW,EAAY,CAIrC,IAAM,EAAQ,EAAa,EAC3B,GAAI,EAAO,OAAO,EAAM,KAKxB,OAAO,GAAa,GAAG,MAAQ,KAGjC,SAAS,EAAY,EAAmC,CACtD,GAAI,CACF,OAAO,EAAe,SAAS,EAC/B,KAAM,CAIN,QAiBJ,IAAM,EAAa,OAAO,kCAAkC,EAErD,SAAS,EAAa,CAAC,EAAqC,CACjE,MAAO,IAAK,GAAU,GAAa,EAAK,EAGnC,SAAS,EAAW,CAAC,EAA2B,CACrD,OACE,OAAO,IAAY,UACnB,IAAY,MACX,EAAoC,KAAgB,GAyBzD,IAAM,GAAe,OAAO,iCAAiC,EAEtD,SAAS,EAAe,CAC7B,EACA,EACQ,CACR,MAAO,IAAK,GAAU,IAAe,CAAO,EAGvC,SAAS,EAAiB,CAAC,EAAqC,CACrE,GAAI,OAAO,IAAY,UAAY,IAAY,KAAM,OAAO,EAC5D,IAAM,EAAU,EAAoC,IACpD,OAAO,MAAM,QAAQ,CAAM,EAAK,EAAsB,EAGxD,IAAM,EAAkC,CAAC,EAwDnC,GAAc,OAAO,uCAAuC,EAE3D,SAAS,EAAc,CAC5B,EACA,EACQ,CACR,MAAO,IAAK,GAAU,IAAc,CAAU,EAGzC,SAAS,EAAU,CAAC,EAAyC,CAClE,GAAI,OAAO,IAAY,UAAY,IAAY,KAAM,OACrD,IAAM,EAAa,EAAoC,IACvD,OAAO,OAAO,IAAc,SAAY,EAA0B,OAiC7D,IAAM,EAAyB,WA+D/B,SAAS,EAAmB,CACjC,EAGA,EACA,EACA,EACA,EACK,CACL,GAAI,IAAS,QAAa,IAAS,KAAM,OAAO,EAChD,GAAI,OAAO,IAAS,SAAU,OAAO,EAErC,IAAI,EAAM,EAEV,QAAW,IAAa,CAAC,UAAW,QAAQ,EAAY,CACtD,IAAM,EAAO,EAAK,GAClB,GAAI,OAAO,IAAS,UAAY,IAAS,MAAQ,MAAM,QAAQ,CAAI,EACjE,SAGF,IAAI,EAEJ,QAAW,KAAO,OAAO,KAAK,CAAI,EAAG,CAMnC,GAAI,IAAQ,EAAW,CACrB,IAAM,EAAe,GACnB,EACC,EAAiC,GAClC,EACA,EACA,CACF,EACA,GAAI,IAAkB,EAAiC,GACrD,IAAc,IAAM,CAAiC,EACrD,EAAU,GAAO,EAEnB,SAGF,IAAM,EAAW,EAAO,UAAU,GAClC,GAAI,CAAC,EAAU,SAEf,IAAM,EAAQ,EAAiC,GAC/C,GAAI,IAAS,QAAa,IAAS,GAAO,SAE1C,IAAM,EAAS,EAAO,EAAS,KAAK,EAGpC,GAAI,CAAC,EAAQ,SAOb,IAAM,EAAW,IAAS,GAAO,CAAC,EAAI,EACtC,GAAI,OAAO,IAAa,UAAY,MAAM,QAAQ,CAAQ,EAAG,SAI7D,IAAM,EAAS,GACb,EAAO,OACP,EACA,EACA,EACA,CACF,EAIM,EACJ,CAAC,GAAU,EAAO,SAAS,OAAS,EAChC,EACE,EAAO,SACP,EAAc,EAAO,OAAO,KAAM,EAAa,EAAM,CAAM,EAC3D,CACF,EACA,EAIN,GAAI,IAAW,EACb,IAAc,IAAM,CAAiC,EACrD,EAAU,GAAO,EAIrB,GAAI,EAAW,EAAM,IAAK,GAAM,GAAY,CAAU,EAOxD,IAAM,EAAU,GACd,EACA,EAAI,QACJ,EACA,EACA,CACF,EACA,GAAI,IAAY,EAAI,QAAS,EAAM,IAAK,EAAK,QAAS,CAAQ,EAK9D,IAAM,EAAW,EACf,EACA,EAAI,MACJ,EACA,EACA,CACF,EACA,GAAI,IAAa,EAAI,MAAO,EAAM,IAAK,EAAK,MAAO,CAAS,EAE5D,OAAO,EAoBT,SAAS,EAAsB,CAC7B,EACA,EACA,EACA,EACA,EACS,CACT,GAAI,EAAQ,OAAO,EACnB,GAAI,OAAO,IAAY,UAAY,IAAY,KAAM,OAAO,EAE5D,GAAI,MAAM,QAAQ,CAAO,EAAG,CAC1B,IAAI,EAAU,GACR,EAAM,EAAQ,IAAI,CAAC,IAAU,CACjC,IAAM,EAAS,GACb,EACA,EACA,EACA,EACA,CACF,EACA,GAAI,IAAW,EAAO,EAAU,GAChC,OAAO,EACR,EACD,OAAO,EAAU,EAAM,EAGzB,IAAI,EACE,EAAS,EAEf,QAAW,KAAO,OAAO,KAAK,CAAM,EAAG,CACrC,IAAM,EAAW,EAAO,UAAU,GAClC,GAAI,CAAC,EAAU,SAEf,IAAM,EAAO,EAAO,GACpB,GAAI,OAAO,IAAS,UAAY,IAAS,MAAQ,MAAM,QAAQ,CAAI,EAEjE,SAGF,IAAM,EAAS,EAAO,EAAS,KAAK,EACpC,GAAI,CAAC,GAAU,EAAO,SAAS,SAAW,EAAG,SAE7C,IAAM,EAAS,EACb,EAAO,SACP,EAAc,EAAO,OAAO,KAAM,EAAa,EAAM,CAAM,EAC3D,CACF,EAEA,GAAI,IAAW,EACb,IAAc,IAAK,CAAO,EAC1B,EAAU,GAAO,EAIrB,OAAO,GAAa,EAUtB,SAAS,EAAW,CAClB,EACA,EACA,EACA,EACA,EACS,CACT,GAAI,EAAQ,OAAO,EAkBnB,IAAM,EAAY,IAAS,GAE3B,GACE,CAAC,IACA,OAAO,IAAS,UAAY,IAAS,MAAQ,MAAM,QAAQ,CAAI,GAEhE,OAAO,EAGT,IAAM,EAAY,EACd,OAAO,YAAY,EAAmB,CAAM,EAAE,IAAI,CAAC,IAAS,CAAC,EAAM,EAAI,CAAC,CAAC,EACxE,EAAiC,OAEtC,GACE,OAAO,IAAc,UACrB,IAAc,MACd,MAAM,QAAQ,CAAS,EAGvB,OAAO,EAGT,IAAI,EACE,EAAS,EAEf,QAAW,KAAO,OAAO,KAAK,CAAM,EAAG,CACrC,IAAM,EAAQ,EAAO,GACrB,GAAI,IAAU,QAAa,IAAU,GAAO,SAE5C,IAAM,EAAW,EAAO,UAAU,GAClC,GAAI,CAAC,EAAU,SAEf,IAAM,EAAS,EAAO,EAAS,KAAK,EACpC,GAAI,CAAC,GAAU,EAAO,SAAS,SAAW,EAAG,SAE7C,IAAM,EAAW,IAAU,GAAO,CAAC,EAAI,EACvC,GAAI,OAAO,IAAa,UAAY,MAAM,QAAQ,CAAQ,EAAG,SAE7D,IAAM,EAAS,EACb,EAAO,SACP,EAAc,EAAO,OAAO,KAAM,EAAa,EAAM,CAAM,EAC3D,CACF,EAEA,GAAI,IAAW,EACb,IAAc,IAAK,CAAO,EAC1B,EAAU,GAAO,EAIrB,GAAI,CAAC,EAAW,OAAO,EAKvB,OAAO,EACH,CAAE,OAAQ,CAAU,EACpB,IAAM,EAAkC,OAAQ,CAAU,EAgBhE,SAAS,CAAoB,CAC3B,EACA,EACA,EACA,EACA,EACS,CACT,GAAI,OAAO,IAAU,UAAY,IAAU,KAAM,OAAO,EAExD,GAAI,MAAM,QAAQ,CAAK,EAAG,CACxB,IAAI,EAAU,GACR,EAAM,EAAM,IAAI,CAAC,IAAU,CAC/B,IAAM,EAAS,EACb,EACA,EACA,EACA,EACA,CACF,EACA,GAAI,IAAW,EAAO,EAAU,GAChC,OAAO,EACR,EACD,OAAO,EAAU,EAAM,EAGzB,IAAI,EACE,EAAS,EAEf,QAAW,KAAO,OAAO,KAAK,CAAM,EAAG,CACrC,IAAM,EAAQ,EAAO,GACrB,GAAI,IAAU,OAAW,SAIzB,GAAI,IAAQ,OAAS,IAAQ,MAAQ,IAAQ,MAAO,CAClD,IAAM,EAAS,EACb,EACA,EACA,EACA,EACA,CACF,EACA,GAAI,IAAW,EACb,IAAc,IAAK,CAAO,EAC1B,EAAU,GAAO,EAEnB,SAGF,IAAM,EAAW,EAAO,UAAU,GAClC,GAAI,CAAC,EAAU,SAEf,IAAM,EAAS,GACb,EACA,EACA,EACA,EACA,CACF,EACA,GAAI,IAAW,EACb,IAAc,IAAK,CAAO,EAC1B,EAAU,GAAO,EAIrB,OAAO,GAAa,EAItB,SAAS,EAAiB,CACxB,EACA,EACA,EACA,EACA,EACS,CACT,GAAI,OAAO,IAAU,UAAY,IAAU,MAAQ,MAAM,QAAQ,CAAK,EAKpE,OAAO,EAGT,IAAM,EAAS,EAAO,EAAS,KAAK,EACpC,GAAI,CAAC,EAAQ,OAAO,EAEpB,IAAM,EAAY,EAAwB,EAAS,IAAI,EACjD,EAAY,CAAC,EAAe,EAAO,CAAS,EAC5C,EAAoC,EACtC,CAAC,CAAC,KAAM,CAAK,CAAC,EACd,OAAO,QAAQ,CAAgC,EAE/C,EAEJ,QAAY,EAAU,KAAa,EAAS,CAC1C,GAAI,IAAa,MAAQ,IAAa,OAAW,SAIjD,IAAM,EAAS,EACb,EAAO,OACP,EACA,EACA,EACA,CACF,EAEM,EACJ,CAAC,GAAU,EAAO,SAAS,OAAS,EAChC,EACE,EAAO,SACP,EAAc,EAAO,OAAO,KAAM,EAAa,EAAM,CAAM,EAC3D,CAAE,MAAO,CAAO,CAClB,EAAE,MACF,EAEA,EAAQ,IAAa,QAAU,GAAe,EAAQ,CAAK,EAAI,EAErE,GAAI,IAAU,EACZ,IAAc,EACV,CAAC,EACD,IAAM,CAAkC,EAC5C,EAAU,GAAY,EAI1B,GAAI,CAAC,EAAW,OAAO,EAGvB,OAAO,EAkCT,SAAS,EAAc,CAAC,EAAgB,EAA0B,CAChE,GAAI,IAAW,EAAO,OAAO,EAK7B,IAAM,EAAS,EAAW,CAAK,EAEzB,EADQ,EAAW,CAAM,EACX,MAAM,EAAO,MAAM,EACvC,GAAI,EAAM,SAAW,EAAG,OAAO,EAK/B,MAAO,CAAE,GAAI,CAAC,CAAE,IAFd,EAAM,SAAW,EAAI,EAAM,GAAK,CAAE,IAAK,CAAM,CAEd,EAAG,CAAK,CAAE,EAG7C,SAAS,CAAU,CAAC,EAA2B,CAC7C,GAAI,OAAO,IAAU,UAAY,IAAU,KAAM,MAAO,CAAC,EACzD,IAAM,EAAS,EAAkC,IACjD,GAAI,IAAU,OAAW,MAAO,CAAC,EACjC,OAAO,MAAM,QAAQ,CAAK,EAAI,EAAQ,CAAC,CAAK,ECr/DvC,SAAS,EAAwB,IACnC,EACG,CACN,IAAO,GAAS,GAAwB,GAAG,CAAO,EAClD,GAAI,IAAU,OAAW,MAAM,EA4B1B,SAAS,EAAuB,IAClC,EAC6B,CAChC,IAAM,EAA2C,CAAC,EAElD,QAAW,KAAU,EACnB,QAAW,KAAY,OAAO,OAAO,CAAM,EAAG,CAC5C,IAAM,EAAQ,GAAa,CAAQ,EACnC,GAAI,IAAU,KAAM,SAkBpB,EAAmB,CAAK,EAExB,IAAM,EAAO,EAAM,QAAQ,KACrB,EAAsB,EAAI,CAAI,EACtB,EAAa,CAAI,EAC3B,OAMJ,GAAI,IAAe,QAAa,IAAe,EAAO,SAEtD,IAAM,EAAO,EAAY,CAAK,EACxB,EAAS,EAAY,CAAU,EAC/B,EACJ,EAAK,SAAW,EAAO,QACvB,EAAK,KAAK,CAAC,EAAQ,IAAU,IAAW,EAAO,EAAM,EASvD,GAAI,EAAa,EAAY,CAAK,GAAK,EAAa,EAAO,CAAU,EAAG,CACtE,IAAM,EAAW,EAAa,EAAO,CAAU,EAAI,EAAa,EAC1D,EAAa,IAAa,EAAa,EAAQ,EAErD,GAAI,EAAY,CAAQ,EAAE,SAAW,EAAG,CAkBtC,GAAI,IAAe,EAAY,SAI/B,GAAI,CAAC,EAAU,SAKf,EAAS,KACP,IAAI,EACF,EACA,EAAO,CAAU,EACjB,EAAO,CAAK,EACZ,EAAK,OAAS,EAAI,UAAY,YAChC,CACF,EACA,SAQF,GAAI,EACF,EAAS,KACP,IAAI,EACF,EACA,EAAO,CAAQ,EACf,EAAO,CAAU,EACjB,WACF,CACF,EAIF,SAGF,GAAI,CAAC,EAAU,SAIf,EAAS,KACP,IAAI,EACF,EACA,EAAO,CAAU,EACjB,EAAO,CAAK,EACZ,EAAK,OAAS,EAAI,UAAY,YAChC,CACF,EAIJ,OAAO,EAyCF,SAAS,EAAc,IACzB,EACG,CAUN,IAAM,EAAS,IAAI,IAEnB,QAAW,KAAU,EAAS,CAC5B,IAAM,EAAa,IAAI,IAIvB,QAAW,KAAY,IAAI,IAAI,OAAO,OAAO,CAAM,CAAC,EAAG,CACrD,IAAM,EAAQ,GAAa,CAAQ,EACnC,GAAI,IAAU,KAAM,SAEpB,IAAM,EAAO,EAAM,QAAQ,KACrB,EAAW,EAAW,IAAI,CAAI,EACpC,GAAI,IAAa,OAAW,EAAW,IAAI,EAAM,CAAC,CAAK,CAAC,EACnD,OAAS,KAAK,CAAK,EAK1B,QAAY,EAAM,KAAY,EAC5B,EAAO,IAAI,EAAM,GAAM,EAAM,CAAO,CAAC,EAUzC,IAAM,EAAW,CAAC,GAAG,EAAO,KAAK,CAAC,EAC/B,OAAO,CAAC,IAAkB,EAAI,CAAI,CAAC,EACnC,IAAI,CAAC,IAAS,CAAC,EAAe,EAAa,CAAI,CAAC,CAAU,EAE7D,QAAY,EAAM,KAAU,EAAiB,EAAS,EAAM,CAAK,EAEjE,GAAI,CACF,GAAyB,GAAG,CAAO,EACnC,MAAO,EAAO,CACd,QAAY,EAAM,KAAU,EAAmB,EAAS,EAAM,CAAK,EACnE,MAAM,GAqCV,SAAS,EAAK,CAAC,EAAc,EAAmC,CAC9D,GAAI,EAAQ,SAAW,EAAG,OAAO,EAAQ,GAEzC,IAAM,EAAU,EAAQ,OAAO,CAAC,IAAc,CAAC,GAAgB,CAAS,CAAC,EACnE,EAAW,EAAQ,OAAS,EAAI,EAAU,EAEhD,GAAI,EAAS,SAAW,EAAG,OAAO,EAAS,GAE3C,IAAM,EAAQ,EAAS,OAAO,CAAC,IAC7B,EAAS,MACP,CAAC,IAAU,IAAU,GAAa,EAAa,EAAO,CAAS,CACjE,CACF,EAEA,GAAI,EAAM,SAAW,EAAG,OAAO,EAAM,GAErC,MAAM,IAAI,GACR,EACA,EAAS,IAAI,CAAC,IAAc,EAAO,CAAS,CAAC,CAC/C,EAqCF,SAAS,EAAe,CAAC,EAAgC,CAKvD,GAAI,eAAgB,EAClB,OACE,OAAO,OAAO,EAAW,YAAY,GACpC,EAAuC,aAAe,GAI3D,OAAO,OAAO,OAAO,EAAW,SAAS,EAQ3C,SAAS,CAAY,CAAC,EAAkB,EAAwB,CAC9D,IAAI,EAAU,OAAO,eAAe,CAAO,EAE3C,MAAO,IAAY,MAAQ,IAAY,SAAS,UAAW,CACzD,GAAI,IAAY,EAAM,MAAO,GAC7B,EAAU,OAAO,eAAe,CAAO,EAGzC,MAAO,GAGT,SAAS,CAAM,CAAC,EAAwB,CACtC,OAAQ,GAA6B,MAAQ,OAAO,CAAK,EAgB3D,SAAS,EAAY,CAAC,EAAmC,CACvD,GAAI,OAAO,IAAU,WAAY,OAAO,KAExC,IAAM,EAAU,EAAoC,QACpD,GAAI,IAAW,QAAa,OAAO,EAAO,OAAS,SAAU,OAAO,KAEpE,OAAO",
-  "debugId": "9E1064785367A20264756E2164756E21",
+  "debugId": "3980486A5E87621664756E2164756E21",
   "names": []
 }