gemi 0.116.0 → 0.118.0

package/dist/{chunk-15c2vgaf.js → chunk-1m3hvy3q.js}

@@ -1,5 +1,5 @@
 // @bun
 function H(z){if(z===401)return"authentication";if(z===403)return"permission";if(z===404)return"not_found";if(z===416)return"range_not_satisfiable";if(z===429)return"rate_limit";if(z>=500)return"server_error";return"form_error"}var N="GEMI_REQUEST_BREAKER_ERROR";class J extends Error{static legacyStringPayload=!1;kind=N;payload;constructor(z,C={}){super(z);let D=C.status??400;this.payload={api:{status:D,data:{error:L(C.kind??H(D),z??"",D)},...C.headers?{headers:C.headers}:{}},view:{status:D}}}}function L(z,C,D){return{kind:z,message:C,status:D}}function X(z,C,D){return J.legacyStringPayload?C:L(z,C,D)}
-export{H as Pg,N as Qg,J as Rg,L as Sg,X as Tg};
+export{H as Hg,N as Ig,J as Jg,L as Kg,X as Lg};
 
-//# debugId=C7445875786BD2A464756E2164756E21
+//# debugId=D41AE9FD1FE5E3FC64756E2164756E21

package/dist/{chunk-15c2vgaf.js.map → chunk-1m3hvy3q.js.map}

@@ -6,6 +6,6 @@
     "import { refusalKindForStatus, type Refusal, type RefusalKind } from \"./refusal\";\n\nexport const GEMI_REQUEST_BREAKER_ERROR = \"GEMI_REQUEST_BREAKER_ERROR\";\n\nexport type RequestBreakerOptions = {\n  /** The answer's status. 400 when absent. */\n  status?: number;\n  /**\n   * What the client's guards classify it as. Absent, it follows from\n   * `status`: 401 `authentication`, 403 `permission`, 404 `not_found`, 429\n   * `rate_limit`, 5xx `server_error`, any other status `form_error`.\n   */\n  kind?: Exclude<RefusalKind, \"validation_error\">;\n  /** Extra headers for the API answer. */\n  headers?: Record<string, string>;\n};\n\nexport class RequestBreakerError extends Error {\n  /**\n   * Answer the refusals that were bare strings before 0.88 — authentication,\n   * authorization, permission, CSRF and a 500 — with that string again,\n   * instead of `{ kind, message, status }`.\n   *\n   * For a shipped native client that reads `body.error` as a string and cannot\n   * be rolled forward in the same deploy as the server. Set it once at boot,\n   * and remove the line when the clients read `body.error.message`:\n   *\n   * ```ts\n   * RequestBreakerError.legacyStringPayload = true;\n   * ```\n   *\n   * gemi's own web client reads either shape. Refusals that were already\n   * objects (404, 429, a policy 403) stay objects.\n   */\n  static legacyStringPayload = false;\n\n  public kind = GEMI_REQUEST_BREAKER_ERROR;\n  public payload: {\n    api: Record<string, any>;\n    view: Record<string, any>;\n    /**\n     * What a `.json` view navigation answers, when that differs from `api`.\n     * Absent, it gets `api` — right for most breakers, but not for one that\n     * must be a 401 to an API client and a redirect to the client router.\n     */\n    viewData?: Record<string, any>;\n  };\n\n  /**\n   * A refusal that answers `{ error: { kind, message, status } }` with\n   * `status`, so the client's guards classify it without a payload of your\n   * own. A subclass that sets `payload` itself replaces this.\n   *\n   * ```ts\n   * throw new RequestBreakerError(\"This slug is taken\", { status: 409 });\n   * // → 409 { error: { kind: \"form_error\", message: \"This slug is taken\", status: 409 } }\n   * ```\n   */\n  constructor(message?: string, options: RequestBreakerOptions = {}) {\n    super(message);\n    const status = options.status ?? 400;\n    this.payload = {\n      api: {\n        status,\n        data: {\n          error: refusal(options.kind ?? refusalKindForStatus(status), message ?? \"\", status),\n        },\n        ...(options.headers ? { headers: options.headers } : {}),\n      },\n      view: { status },\n    };\n  }\n}\n\n/** A refusal's `error` field. */\nexport function refusal<K extends Exclude<RefusalKind, \"validation_error\">>(\n  kind: K,\n  message: string,\n  status: number,\n): Refusal<K> {\n  return { kind, message, status };\n}\n\n/**\n * A refusal that was a bare string before 0.88: the object, or the string\n * under `RequestBreakerError.legacyStringPayload`.\n *\n * @internal\n */\nexport function stringEraRefusal<K extends Exclude<RefusalKind, \"validation_error\">>(\n  kind: K,\n  message: string,\n  status: number,\n): Refusal<K> | string {\n  return RequestBreakerError.legacyStringPayload ? message : refusal(kind, message, status);\n}\n"
   ],
   "mappings": ";AAqDO,SAAS,CAAoB,CAAC,EAA0D,CAC7F,GAAI,IAAW,IAAK,MAAO,iBAC3B,GAAI,IAAW,IAAK,MAAO,aAC3B,GAAI,IAAW,IAAK,MAAO,YAC3B,GAAI,IAAW,IAAK,MAAO,wBAC3B,GAAI,IAAW,IAAK,MAAO,aAC3B,GAAI,GAAU,IAAK,MAAO,eAC1B,MAAO,aC1DF,IAAM,EAA6B,6BAenC,MAAM,UAA4B,KAAM,OAiBtC,qBAAsB,GAEtB,KAAO,EACP,QAqBP,WAAW,CAAC,EAAkB,EAAiC,CAAC,EAAG,CACjE,MAAM,CAAO,EACb,IAAM,EAAS,EAAQ,QAAU,IACjC,KAAK,QAAU,CACb,IAAK,CACH,SACA,KAAM,CACJ,MAAO,EAAQ,EAAQ,MAAQ,EAAqB,CAAM,EAAG,GAAW,GAAI,CAAM,CACpF,KACI,EAAQ,QAAU,CAAE,QAAS,EAAQ,OAAQ,EAAI,CAAC,CACxD,EACA,KAAM,CAAE,QAAO,CACjB,EAEJ,CAGO,SAAS,CAA2D,CACzE,EACA,EACA,EACY,CACZ,MAAO,CAAE,OAAM,UAAS,QAAO,EAS1B,SAAS,CAAoE,CAClF,EACA,EACA,EACqB,CACrB,OAAO,EAAoB,oBAAsB,EAAU,EAAQ,EAAM,EAAS,CAAM",
-  "debugId": "C7445875786BD2A464756E2164756E21",
+  "debugId": "D41AE9FD1FE5E3FC64756E2164756E21",
   "names": []
 }

package/dist/{chunk-6cx8ncd4.js → chunk-1z1rj2zq.js}

@@ -1,9 +1,9 @@
 // @bun
-import{We as O,Xe as E,Ye as k}from"./chunk-whtzggn6.js";import{ef as T,of as R,qf as i,rf as C,sf as M,tf as Xz}from"./chunk-hytt9qyj.js";import{Wg as l}from"./chunk-49nyyjfe.js";import{nh as a}from"./chunk-1myhm0g3.js";var $z=["every","none","some"],Vz=["is","isNot"];function g(z){return z==="many"?$z:Vz}function h(z,J){let W=Object.keys(z);return W.length>0&&W.every((Z)=>J.includes(Z))}var m="_count";function y(z){return Object.keys(z.relations).filter((J)=>z.relations[J]?.kind==="many").sort()}function N(z,J,W,Z){let X={model:z,operation:J,hasUser:W!=null};return Object.defineProperty(X,"user",{enumerable:!0,get(){if(W==null&&!Z)throw new R(z,J,"no-user");return W}}),X}class n{}class Qz extends n{}var qz=new Set(["findMany","findFirst","findFirstOrThrow","findUnique","findUniqueOrThrow","count","aggregate","groupBy","update","updateMany","delete","deleteMany"]),Yz=new Set(["create","createMany","upsert"]),jz=new Set(["update","updateMany","upsert"]),Lz=new Set(["update","updateMany"]),Kz=new Set(["create","createMany"]),p=new WeakMap;function Gz(z,J,W){if(typeof z!=="function")return z;let Z=p.get(z);if(Z!==void 0)return Z;let X;try{X=new z}catch($){throw new M(b(J),W,"constructor-threw",`${f(z)}, and constructing it threw:
+import{Og as l}from"./chunk-490sbcma.js";import{Wg as O,Xg as E,Yg as k}from"./chunk-y09r0wsw.js";import{Ah as Xz,lh as T,vh as R,xh as i,yh as C,zh as M}from"./chunk-9pkj7sk6.js";import{ai as a}from"./chunk-kkte8nze.js";var $z=["every","none","some"],Vz=["is","isNot"];function g(z){return z==="many"?$z:Vz}function h(z,J){let W=Object.keys(z);return W.length>0&&W.every((Z)=>J.includes(Z))}var m="_count";function y(z){return Object.keys(z.relations).filter((J)=>z.relations[J]?.kind==="many").sort()}function N(z,J,W,Z){let X={model:z,operation:J,hasUser:W!=null};return Object.defineProperty(X,"user",{enumerable:!0,get(){if(W==null&&!Z)throw new R(z,J,"no-user");return W}}),X}class n{}class Qz extends n{}var qz=new Set(["findMany","findFirst","findFirstOrThrow","findUnique","findUniqueOrThrow","count","aggregate","groupBy","update","updateMany","delete","deleteMany"]),Yz=new Set(["create","createMany","upsert"]),jz=new Set(["update","updateMany","upsert"]),Lz=new Set(["update","updateMany"]),Kz=new Set(["create","createMany"]),p=new WeakMap;function Gz(z,J,W){if(typeof z!=="function")return z;let Z=p.get(z);if(Z!==void 0)return Z;let X;try{X=new z}catch($){throw new M(b(J),W,"constructor-threw",`${f(z)}, and constructing it threw:
 
     ${$?.message??String($)}`,H,void 0,{cause:$})}return t(X,J,W),p.set(z,X),X}function S(z,J){return z.map((W,Z)=>Gz(W,J,Z))}var H=["before","scope","onCreate","onUpdate","redact"];var u=new WeakSet;function s(z,J){if(u.has(J))return;for(let W=0;W<J.length;W++)Uz(J[W],z,W);u.add(J)}function Uz(z,J,W){let Z=b(J),X=typeof z;if(z===null||Array.isArray(z)||X!=="object"&&X!=="function")throw new M(Z,W,"not-a-policy",o(z),H);if(X==="function"){if(!Mz(z))throw new M(Z,W,"not-constructable",f(z),H);return}t(z,J,W)}function t(z,J,W){let Z=b(J),X=0,$=[];for(let Y of H){let q=z[Y];if(q===void 0||q===null){if(Y in z)$.push(Y);continue}if(typeof q!=="function")throw new M(Z,W,"hook-not-callable",`'${Y}' that is ${o(q)} rather than a function`,H);X++}if(X>0)return;if($.length>0)throw new M(Z,W,"no-hooks",`It writes ${$.map((Y)=>`'${Y}'`).join(", ")} down and leaves ${$.length===1?"it":"them"} unset, which reads as `+"absent \u2014 so nothing is left to run.",H);let V=Fz(z),Q=Iz(V);throw new M(Z,W,"no-hooks",V.length===0?"It is empty.":`It spells ${Hz(V)}.`+(V.length===1&&V[0]==="default"?" A lone 'default' is a module namespace rather than the policy "+"inside it \u2014 put `entry.default` in the array, or import the "+"policy by name.":""),H,Q)}function Hz(z){let J=z.slice(0,8).map((W)=>`'${W}'`);return z.length>J.length?`${J.join(", ")} and ${z.length-J.length} more`:J.join(", ")}function Mz(z){try{return Reflect.construct(Bz,[],z),!0}catch{return!1}}var Bz=function(){};function Fz(z){let J=new Set,W=z;while(W!==null&&W!==Object.prototype){for(let Z of Object.getOwnPropertyNames(W))if(Z!=="constructor")J.add(Z);W=Object.getPrototypeOf(W)}return[...J]}function Iz(z){let J,W=2;for(let Z of z)for(let X of H){let $=Tz(Z.toLowerCase(),X.toLowerCase());if($<W)W=$,J={key:Z,hook:X}}return J}function Tz(z,J){if(z===J)return 0;let W=Array.from({length:J.length+1},(Z,X)=>X);for(let Z=1;Z<=z.length;Z++){let X=W[0];W[0]=Z;for(let $=1;$<=J.length;$++){let V=W[$];W[$]=Math.min(W[$]+1,W[$-1]+1,X+(z[Z-1]===J[$-1]?0:1)),X=V}}return W[J.length]}function o(z){if(z===null)return"null";if(z===void 0)return"undefined";if(typeof z==="string")return`the string ${JSON.stringify(z)}`;if(typeof z==="function")return f(z);if(Array.isArray(z))return"an array";if(typeof z==="object")return"an object";return`the ${typeof z} ${String(z)}`}function f(z){return z.name?`the function \`${z.name}\``:"an anonymous function"}function _(z){let J,W,Z,X=z;while(X&&X!==Function.prototype){if(Object.hasOwn(X,"$policy"))throw Error(`${X.name??"This model"} declares \`$policy\`, which is now \`$policies\` and takes a list. The old `+"name is not read, so this model is currently unpolicied \u2014 every "+"scope, onCreate and redact on it is being skipped.");if(Object.hasOwn(X,"$policies")&&X.$policies){let $=X.$policies;if($.length>0){let V=X;if(s(V,$),W===void 0&&J===void 0)W=$,Z=V;else J??=S(W,Z),W=void 0,J.unshift(...S($,V))}}X=Object.getPrototypeOf(X)}if(J!==void 0)return J;if(W===void 0)return Nz;return W.some(($)=>typeof $==="function")?S(W,Z):W}function r(z){let J=z;while(J&&J!==Function.prototype){if(Object.hasOwn(J,"$policies")&&J.$policies){let W=J.$policies;if(W.length>0)s(J,W)}J=Object.getPrototypeOf(J)}}function b(z){return z?.name??"This model"}var Nz=Object.freeze([]);function D(z,J,W,Z=[]){if(z.length===0)return W;let X=W,$;for(let V of z)if(V.before){if(V.before(J)===!1)throw new R(J.model,J.operation)}for(let V of z){if(!V.scope)continue;if(Kz.has(J.operation)){Sz(V,J);continue}let Q=V.scope(J);if(Q===void 0||Q===null)continue;if(Rz(J),Lz.has(J.operation)&&!V.onUpdate){let Y=Pz(Q);if(Y.length>0)($??=[]).push(...Y)}X=_z(X,Q)}if(Yz.has(J.operation)){for(let V of z)if(V.onCreate)X=Dz(X,J,V)}if(jz.has(J.operation)){for(let V of z)if(V.onUpdate)X=Az(X,J,V)}if($!==void 0)Cz($,J,X,Z);return X}function _z(z,J){let W=z?.where;if(W===void 0||W===null)return{...z,where:J};if(typeof W!=="object"||Array.isArray(W))return{...z,where:{AND:[W,J]}};let Z=W.AND,X=Z===void 0||Z===null?[]:Array.isArray(Z)?Z:[Z];return{...z,where:{...W,AND:[...X,J]}}}function Dz(z,J,W){let Z=(X)=>W.onCreate(J,{...X});if(J.operation==="createMany"){let X=z?.data;return{...z,data:Array.isArray(X)?X.map(Z):Z(X)}}if(J.operation==="upsert")return{...z,create:Z(z?.create)};return{...z,data:Z(z?.data)}}function Az(z,J,W){let Z=J.operation==="upsert"?"update":"data",X=z?.[Z];if(X===void 0||X===null)return z;return{...z,[Z]:W.onUpdate(J,{...X})}}function Cz(z,J,W,Z=[]){let X=W?.data;if(typeof X!=="object"||X===null)return;let $=z.filter((V)=>(V in X)&&!Z.includes(V));if($.length===0)return;throw new i(J.model,J.operation,[...new Set($)])}function Pz(z){if(typeof z!=="object"||z===null||Array.isArray(z))return[];let J=[];for(let W of Object.keys(z)){if(W==="AND"||W==="OR"||W==="NOT")continue;J.push(W)}return J}function Sz(z,J){if(z.onCreate)return;throw new T(J.operation,J.model,J.operation,`${J.model} has a policy that scopes reads but no 'onCreate', and ${J.operation} has no where clause for a scope to narrow. As written the policy would confine reads to the caller and let an insert name any value it likes. Add an onCreate that sets the scoped `+"column \u2014 or, if unscoped creates are intended, say so with an onCreate "+"that returns its data unchanged.")}function Rz(z){if(qz.has(z.operation))return;throw new T(z.operation,z.model,z.operation,`${z.model} has a policy with a scope, and ${z.operation} cannot carry one: its where clause compiles to an 'on conflict' target, which is a key rather than a filter. Running it would write outside the scope.
 
 Two ways out. Use update and create separately, which both scope `+"normally \u2014 or leave the conflict key out of 'create', which Model.upsert "+"runs as a scoped read and a scoped write inside one transaction. The refusal is about 'on conflict' specifically, not about upsert.")}function dz(z,J,W){if(z.length===0)return;let Z=z.filter((X)=>X.redact);if(Z.length===0)return;for(let X of fz(W))for(let $ of Z)$.redact(J,X)}function fz(z){if(Array.isArray(z))return z;if(z===null||z===void 0)return[];if(typeof z!=="object")return[];return[z]}function lz(z,J,W){for(let Z of W){let X=z.fields[Z];if(X&&!X.nullable)throw new T(`redact.${Z}`,z.name,"redact",`'${Z}' is not nullable, so setting it to null would contradict `+"the generated type \u2014 which still says the field is there. Make the "+"field optional in schema.prisma, omit it with 'select' instead, or delete the key yourself if a runtime-only guarantee is enough.");if(Z in J)J[Z]=null}}function iz(){let z=a();if(z)return z.user;return bz()?.user??null}function bz(){try{return l.getStore()}catch{return}}var e=Symbol("gemi.orm.policiesAppliedByCaller");function az(z){return{...z,[e]:!0}}function nz(z){return typeof z==="object"&&z!==null&&z[e]===!0}var zz=Symbol("gemi.orm.columnsWrittenByTheOrm");function sz(z,J){return{...z,[zz]:J}}function tz(z){if(typeof z!=="object"||z===null)return c;let J=z[zz];return Array.isArray(J)?J:c}var c=[],Jz=Symbol("gemi.orm.operationTheRowIsReturnedFor");function oz(z,J){return{...z,[Jz]:J}}function rz(z){if(typeof z!=="object"||z===null)return;let J=z[Jz];return typeof J==="string"?J:void 0}var A="findMany";function Oz(z,J,W,Z,X){if(J===void 0||J===null)return J;if(typeof J!=="object")return J;let $=J;for(let Y of["include","select"]){let q=J[Y];if(typeof q!=="object"||q===null||Array.isArray(q))continue;let j;for(let L of Object.keys(q)){if(L===m){let w=Ez(z,q[L],W,Z,X);if(w!==q[L])j??={...q},j[L]=w;continue}let G=z.relations[L];if(!G)continue;let K=q[L];if(K===void 0||K===!1)continue;let U=X(G.model);if(!U)continue;let F=K===!0?{}:K;if(typeof F!=="object"||Array.isArray(F))continue;let x=Oz(U.schema,F,W,Z,X),v=!Z&&U.policies.length>0?D(U.policies,N(U.schema.name,A,W,Z),x):x;if(v!==F)j??={...q},j[L]=v}if(j)$={...$,[Y]:j}}let V=Wz(z,$.orderBy,W,Z,X);if(V!==$.orderBy)$={...$,orderBy:V};let Q=I(z,$.where,W,Z,X);if(Q!==$.where)$={...$,where:Q};return $}function Wz(z,J,W,Z,X){if(Z)return J;if(typeof J!=="object"||J===null)return J;if(Array.isArray(J)){let Q=!1,Y=J.map((q)=>{let j=Wz(z,q,W,Z,X);if(j!==q)Q=!0;return j});return Q?Y:J}let $,V=J;for(let Q of Object.keys(V)){let Y=z.relations[Q];if(!Y)continue;let q=V[Q];if(typeof q!=="object"||q===null||Array.isArray(q))continue;let j=X(Y.model);if(!j||j.policies.length===0)continue;let L=D(j.policies,N(j.schema.name,A,W,Z),q);if(L!==q)$??={...V},$[Q]=L}return $??J}function Ez(z,J,W,Z,X){if(Z)return J;let $=J===!0;if(!$&&(typeof J!=="object"||J===null||Array.isArray(J)))return J;let V=$?Object.fromEntries(y(z).map((q)=>[q,!0])):J.select;if(typeof V!=="object"||V===null||Array.isArray(V))return J;let Q,Y=V;for(let q of Object.keys(Y)){let j=Y[q];if(j===void 0||j===!1)continue;let L=z.relations[q];if(!L)continue;let G=X(L.model);if(!G||G.policies.length===0)continue;let K=j===!0?{}:j;if(typeof K!=="object"||Array.isArray(K))continue;let U=D(G.policies,N(G.schema.name,A,W,Z),K);if(U!==K)Q??={...Y},Q[q]=U}if(!Q)return J;return $?{select:Q}:{...J,select:Q}}function I(z,J,W,Z,X){if(typeof J!=="object"||J===null)return J;if(Array.isArray(J)){let Q=!1,Y=J.map((q)=>{let j=I(z,q,W,Z,X);if(j!==q)Q=!0;return j});return Q?Y:J}let $,V=J;for(let Q of Object.keys(V)){let Y=V[Q];if(Y===void 0)continue;if(Q==="AND"||Q==="OR"||Q==="NOT"){let L=I(z,Y,W,Z,X);if(L!==Y)$??={...V},$[Q]=L;continue}let q=z.relations[Q];if(!q)continue;let j=kz(q,Y,W,Z,X);if(j!==Y)$??={...V},$[Q]=j}return $??J}function kz(z,J,W,Z,X){if(typeof J!=="object"||J===null||Array.isArray(J))return J;let $=X(z.model);if(!$)return J;let V=g(z.kind),Q=!h(J,V),Y=Q?[["is",J]]:Object.entries(J),q;for(let[j,L]of Y){if(L===null||L===void 0)continue;let G=I($.schema,L,W,Z,X),K=!Z&&$.policies.length>0?D($.policies,N($.schema.name,A,W,Z),{where:G}).where:G,U=j==="every"?xz(G,K):K;if(U!==L)q??=Q?{}:{...J},q[j]=U}if(!q)return J;return q}function xz(z,J){if(J===z)return z;let W=d(z),X=d(J).slice(W.length);if(X.length===0)return z;return{OR:[{NOT:X.length===1?X[0]:{AND:X}},z]}}function d(z){if(typeof z!=="object"||z===null)return[];let J=z.AND;if(J===void 0)return[];return Array.isArray(J)?J:[J]}function vz(...z){let[J]=wz(...z);if(J!==void 0)throw J}function wz(...z){let J=[];for(let W of z)for(let Z of Object.values(W)){let X=Zz(Z);if(X===null)continue;r(X);let $=X.$schema.name,V=E($)?k($):void 0;if(V===void 0||V===X)continue;let Q=_(X),Y=_(V),q=Q.length!==Y.length||Q.some((j,L)=>j!==Y[L]);if(P(V,X)||P(X,V)){let j=P(X,V)?V:X,L=j===V?X:V;if(_(j).length===0){if(V===L)continue;if(!q)continue;J.push(new C($,B(V),B(X),Q.length>0?"queried":"registered"));continue}if(q)J.push(new C($,B(j),B(L),"narrowing"));continue}if(!q)continue;J.push(new C($,B(V),B(X),Q.length>0?"queried":"registered"))}return J}function XJ(...z){let J=new Map;for(let Z of z){let X=new Map;for(let $ of new Set(Object.values(Z))){let V=Zz($);if(V===null)continue;let Q=V.$schema.name,Y=X.get(Q);if(Y===void 0)X.set(Q,[V]);else Y.push(V)}for(let[$,V]of X)J.set($,gz($,V))}let W=[...J.keys()].filter((Z)=>E(Z)).map((Z)=>[Z,k(Z)]);for(let[Z,X]of J)O(Z,X);try{vz(...z)}catch(Z){for(let[X,$]of W)O(X,$);throw Z}}function gz(z,J){if(J.length===1)return J[0];let W=J.filter(($)=>!hz($)),Z=W.length>0?W:J;if(Z.length===1)return Z[0];let X=Z.filter(($)=>Z.every((V)=>V===$||P(V,$)));if(X.length===1)return X[0];throw new Xz(z,Z.map(($)=>B($)))}function hz(z){if("$generated"in z)return Object.hasOwn(z,"$generated")&&z.$generated===!0;return Object.hasOwn(z,"$schema")}function P(z,J){let W=Object.getPrototypeOf(z);while(W!==null&&W!==Function.prototype){if(W===J)return!0;W=Object.getPrototypeOf(W)}return!1}function B(z){return z?.name??String(z)}function Zz(z){if(typeof z!=="function")return null;let J=z.$schema;if(J===void 0||typeof J.name!=="string")return null;return z}
-export{g as Ja,h as Ka,m as La,y as Ma,N as Na,n as Oa,Qz as Pa,_ as Qa,D as Ra,dz as Sa,lz as Ta,iz as Ua,az as Va,nz as Wa,sz as Xa,tz as Ya,oz as Za,rz as _a,A as $a,Oz as ab,vz as bb,wz as cb,XJ as db};
+export{g as Ka,h as La,m as Ma,y as Na,N as Oa,n as Pa,Qz as Qa,_ as Ra,D as Sa,dz as Ta,lz as Ua,iz as Va,az as Wa,nz as Xa,sz as Ya,tz as Za,oz as _a,rz as $a,A as ab,Oz as bb,vz as cb,wz as db,XJ as eb};
 
-//# debugId=9E1064785367A20264756E2164756E21
+//# debugId=27714BA5B46A3B8264756E2164756E21

package/dist/{chunk-6cx8ncd4.js.map → chunk-1z1rj2zq.js.map}

@@ -7,6 +7,6 @@
     "import {\n  AmbiguousModelRegistrationError,\n  UnregisteredPolicyClassError,\n} from \"./errors\";\nimport { assertPolicyShapes, policiesFor } from \"./policy\";\nimport * as registry from \"./registry\";\nimport type { ModelSchema } from \"./schema\";\n\n/** A model class, as much of one as anything below `Model.ts` can name. */\ntype ModelClass = object & { $schema: ModelSchema };\n\n/**\n * Checks that every policied model class an application defines is the one the\n * registry resolves its name to — **ahead of any query**, rather than when one\n * happens to be run.\n *\n * ### Why this exists\n *\n * `Model.$exec` already refuses a query whose class carries policies the\n * registered class does not (`UnregisteredPolicyClassError`). That guard closed\n * the two shapes found in #51, and it is the right check, but it can only fire\n * on a class somebody actually queries **at the root**. Its condition begins\n * `registered !== this`, and there is a case where that is false and the leak is\n * real:\n *\n *     export class Membership extends MembershipModel {\n *       static $policies = [{ scope: (ctx) => ({ orgId: ctx.user.orgId }) }]\n *     }\n *     // ...and no `register(\"Membership\", Membership)`\n *\n * If nothing ever calls `Membership.findMany()` — because memberships are only\n * ever read through `include: { memberships: true }` — then the include resolves\n * the name to the *generated base*, `this` **is** that base, the comparison\n * never runs, and rows come back unscoped with no error. Not a policy chain that\n * fails to diverge: a check that is never reached.\n *\n * A model reached only through includes is usually a membership or a pivot,\n * which is exactly the kind that carries a tenant scope. So the residual runs\n * the wrong way: the guard is weakest where the data is most sensitive.\n *\n * ### What this does about it\n *\n * The same rule, triggered differently. Instead of waiting for a root query,\n * it takes the modules where an application's model classes live and applies the\n * divergence comparison to every one of them:\n *\n *     import * as models from \"@/app/models\"\n *     assertPoliciesRegistered(models)\n *\n * Reading a class out of a module namespace is what makes the unqueried case\n * visible — the class exists and is exported whether or not anything queries it.\n *\n * `registerModels` runs this after registering, and `Kernel.models` runs\n * `registerModels` at boot, so an application that declares its model modules\n * gets it without asking. This is the same check for modules the Kernel does\n * not own — a test over a package's models, a script that boots nothing.\n *\n * It can only see modules it is handed, which is the residual either way: a\n * policied class in a file no barrel re-exports is invisible to it.\n * `gemi check models` closes that by handing it the files instead of the\n * barrel — see `auditModelRegistrations`, which is the same rule without the\n * throw.\n */\nexport function assertPoliciesRegistered(\n  ...modules: Array<Record<string, unknown>>\n): void {\n  const [first] = auditModelRegistrations(...modules);\n  if (first !== undefined) throw first;\n}\n\n/**\n * Every problem `assertPoliciesRegistered` would report, as values rather than\n * as a throw — in the order it would have reported them, so the first element is\n * exactly what that function throws.\n *\n * ### Why the rule needed a second caller\n *\n * A throw is the right shape at boot: the first policied class that does not own\n * its name is a reason not to start, and the rest of the list is noise nobody\n * reads before fixing the first one.\n *\n * It is the wrong shape for a checker. `gemi check models` walks\n * `app/models/**` and audits each file, so it wants *all* of them, and it wants\n * to sort them — a policied class the Kernel never sees is a leak to report,\n * while a policied view deliberately kept out of the declared modules is the\n * arrangement the error for that case actually recommends, and reporting it\n * would be telling an author to undo what the framework told them to do.\n * `UnregisteredPolicyClassError.carries` is what separates the two, and it can\n * only be read off an error somebody is holding.\n *\n * Errors rather than a plain finding type, because the message is the useful\n * part and it is already written once, in the error. Constructing them is not\n * free — a stack per finding — and it is a check somebody runs, not a request\n * path.\n */\nexport function auditModelRegistrations(\n  ...modules: Array<Record<string, unknown>>\n): UnregisteredPolicyClassError[] {\n  const problems: UnregisteredPolicyClassError[] = [];\n\n  for (const module of modules) {\n    for (const exported of Object.values(module)) {\n      const model = asModelClass(exported);\n      if (model === null) continue;\n\n      // #321's boot-time half, run **before** the early return below and for\n      // every class rather than only the diverging ones. Left below the return,\n      // the two commonest arrangements were never checked at all — a class that\n      // already owns its name, and one whose name nothing else claims — so a\n      // `{ scopes: … }` typo registered, reported green, and read unscoped.\n      //\n      // `assertPolicyShapes` and not `policiesFor`, and the difference is the\n      // point: this walk checks the entries and constructs nothing. Resolving\n      // here instead is one line and would additionally catch a policy class\n      // whose constructor throws — at the price of constructing every policy\n      // class in the application at `registerModels` time, ahead of whatever\n      // config or container the constructor reaches for. A guard against a\n      // policy that does nothing must not become the reason a working\n      // application stops booting, so the cases that need an instance are left\n      // to `policiesFor`, which is reached below, on the first query, and by\n      // `Model.$exec`.\n      assertPolicyShapes(model);\n\n      const name = model.$schema.name;\n      const registered = registry.has(name)\n        ? (registry.get<unknown>(name) as object)\n        : undefined;\n\n      // Nothing registered under the name at all. The generated `index.ts`\n      // registers every model, so reaching this means it was never imported —\n      // a different mistake, and one the first query reports clearly through\n      // `ModelNotRegisteredError`. Not this function's business.\n      if (registered === undefined || registered === model) continue;\n\n      const ours = policiesFor(model);\n      const theirs = policiesFor(registered);\n      const diverges =\n        ours.length !== theirs.length ||\n        ours.some((policy, index) => policy !== theirs[index]);\n\n      // The two classes are on one prototype chain — a base and something\n      // extending it — which is the arrangement almost every application has,\n      // and the one this audit used to get wrong in both directions.\n      //\n      // `policiesFor` accumulates upwards, so a descendant's chain always\n      // contains its ancestor's. What separates the two shapes is therefore\n      // whether the **ancestor** carries anything of its own.\n      if (descendsFrom(registered, model) || descendsFrom(model, registered)) {\n        const ancestor = descendsFrom(model, registered) ? registered : model;\n        const descendant = ancestor === registered ? model : registered;\n\n        if (policiesFor(ancestor).length === 0) {\n          // The ancestor contributes nothing, so the descendant is the first\n          // class to carry a policy: it is not a view over the model, it *is*\n          // the model. A generated base is the usual ancestor here, and a\n          // hand-written intermediate behaves the same way.\n          //\n          // Registered already? Then this is the correct arrangement, and it\n          // has to be skipped rather than reported — it used not to be, and\n          // that is why the documented\n          //\n          //     assertPoliciesRegistered(generated, models)\n          //\n          // threw the moment an application wrote its first policy: it walked\n          // the generated namespace, found `UserModel` diverging from the\n          // registered `User`, and refused the thing it exists to protect.\n          // Being reachable through a base is not the bug; querying through one\n          // is, and that is a property of a call site rather than of a module's\n          // export list, so `Model.$exec` keeps that direction.\n          if (registered === descendant) continue;\n\n          // Neither class carries anything, so which one owns the name changes\n          // no query's scope. An unregistered plain subclass is not a mistake.\n          if (!diverges) continue;\n\n          // Not registered, and it has policies: #316 itself. The policied\n          // class is not the one the name resolves to, so every nested read\n          // runs the ancestor and skips it.\n          problems.push(\n            new UnregisteredPolicyClassError(\n              name,\n              nameOf(registered),\n              nameOf(model),\n              ours.length > 0 ? \"queried\" : \"registered\",\n            ),\n          );\n          continue;\n        }\n\n        // The ancestor carries policies of its own, so it is a registered model\n        // in good standing and the descendant is narrowing it. The registry\n        // holds one class per name: registering the view applies its narrowing\n        // to every nested read, and leaving the ancestor registered skips the\n        // view's policies entirely. Both are silent, so neither is chosen.\n        if (diverges) {\n          problems.push(\n            new UnregisteredPolicyClassError(\n              name,\n              nameOf(ancestor),\n              nameOf(descendant),\n              \"narrowing\",\n            ),\n          );\n        }\n\n        // Same chain, same policies — a plain typed view. Nothing to report.\n        continue;\n      }\n\n      if (!diverges) continue;\n\n      // Unrelated classes claiming one name. Whichever is registered, the\n      // other's policies are simply not in effect.\n      problems.push(\n        new UnregisteredPolicyClassError(\n          name,\n          nameOf(registered),\n          nameOf(model),\n          ours.length > 0 ? \"queried\" : \"registered\",\n        ),\n      );\n    }\n  }\n\n  return problems;\n}\n\n/**\n * Registers every model class the given modules export, under the name each\n * one's schema carries, and then audits the result.\n *\n * ### The line this exists to delete\n *\n * `register(\"User\", User)` next to every subclass is a correct instruction and\n * a bad mechanism, because forgetting it is invisible. A relation read resolves\n * its target by name, so an unregistered policied subclass leaves the generated\n * base owning the name and every nested `include` of that model comes back\n * unscoped — no error, no warning, and an authorization hole in the direction\n * nobody checks. `assertPoliciesRegistered` turns that into a loud failure, but\n * only for someone who remembered to run it.\n *\n * Deriving the registration from the module removes the mistake instead of\n * reporting it. The name is not a string an author repeats; it is\n * `$schema.name`, which the generator wrote and the subclass inherits:\n *\n *     import * as generated from \"./generated\"\n *     import * as models from \"./models\"\n *\n *     registerModels(generated, models)\n *\n * Later modules win, so the application's classes replace the generated bases\n * they extend. `register` still exists and still works — this is what an\n * application calls once instead of writing it thirteen times.\n *\n * ### What it still cannot see\n *\n * Modules it is handed. A policied class in a file nothing imports is invisible\n * to this exactly as it is to `assertPoliciesRegistered`, and closing *that*\n * would take the framework enumerating the filesystem at boot. Handing it a\n * barrel is the whole discipline: one file to add a model to, and the audit\n * covers everything in it.\n *\n * `Kernel.models` is that call, wired at boot, so an application declares its\n * model modules the way it already declares config slices and providers.\n */\nexport function registerModels(\n  ...modules: Array<Record<string, unknown>>\n): void {\n  // Elected into a local map first, and only committed once the audit passes.\n  //\n  // The registry is process-wide and outlives the throw. Registering as we went\n  // meant a refused call left the arrangement it had just refused installed —\n  // `registerModels({Ours}, {Theirs})` threw, and `\"User\"` resolved to `Theirs`\n  // afterwards, which is the leaking mapping the audit exists to reject. A\n  // server whose boot dies never notices; a dev server that catches and keeps\n  // serving, or a test harness that continues past the error, serves the rest\n  // of the process from it.\n  const staged = new Map<string, ModelClass>();\n\n  for (const module of modules) {\n    const candidates = new Map<string, ModelClass[]>();\n\n    // Deduped by identity first: `export { User }` alongside a default export\n    // is the same class under two keys, not two classes competing for a name.\n    for (const exported of new Set(Object.values(module))) {\n      const model = asModelClass(exported);\n      if (model === null) continue;\n\n      const name = model.$schema.name;\n      const existing = candidates.get(name);\n      if (existing === undefined) candidates.set(name, [model]);\n      else existing.push(model);\n    }\n\n    // Later modules win, which is what lets an application's classes replace\n    // the generated bases they extend.\n    for (const [name, classes] of candidates) {\n      staged.set(name, elect(name, classes));\n    }\n  }\n\n  // What the registry said before, so a failed audit can put it back. `register`\n  // has no inverse, so a name that was previously *absent* cannot be made\n  // absent again — it is left pointing at what this call elected. That is the\n  // one residue, and it is the harmless direction: the alternative to a wrong\n  // registration under a name nothing claimed is `ModelNotRegisteredError`, and\n  // the class elected here is the one this module set would have used anyway.\n  const previous = [...staged.keys()]\n    .filter((name) => registry.has(name))\n    .map((name) => [name, registry.get<unknown>(name)] as const);\n\n  for (const [name, model] of staged) registry.register(name, model);\n\n  try {\n    assertPoliciesRegistered(...modules);\n  } catch (error) {\n    for (const [name, model] of previous) registry.register(name, model);\n    throw error;\n  }\n}\n\n/**\n * Which of several classes claiming one name in one module gets it.\n *\n * Two shapes put more than one candidate in a namespace, and they want opposite\n * answers, so neither \"most derived\" nor \"least derived\" is the rule on its\n * own:\n *\n *     export * from \"./generated\"      // UserModel, and\n *     export class User extends UserModel { static $policies = [...] }\n *\n * wants the subclass — electing the base here *is* the leak, in the one file an\n * author most plausibly writes it in. While\n *\n *     export class User extends UserModel { static $policies = [...] }\n *     export class AdminUser extends User {}\n *\n * wants `User`. `AdminUser` is a typed view over the same rows; it inherits the\n * policies either way, so registering it changes nothing when it adds none and\n * silently applies its own narrowing to every nested read when it does.\n *\n * What separates them is which class the *generator* wrote. It emits\n * `static $schema = schema.User` on the base, and a subclass inherits that\n * property rather than declaring one — so an own `$schema` is the mark of a\n * generated base, and it is a fact about the classes rather than about the\n * order somebody exported them in. Application classes are preferred over\n * bases; among application classes the least derived wins, for the reason\n * `AdminUser` gives.\n *\n * When that leaves no single answer the candidates are unrelated classes with a\n * genuine claim each, and there is nothing left to infer. That case is refused\n * rather than guessed at: `register` says which, in the application's own\n * words.\n */\nfunction elect(name: string, classes: ModelClass[]): ModelClass {\n  if (classes.length === 1) return classes[0]!;\n\n  const written = classes.filter((candidate) => !isGeneratedBase(candidate));\n  const eligible = written.length > 0 ? written : classes;\n\n  if (eligible.length === 1) return eligible[0]!;\n\n  const roots = eligible.filter((candidate) =>\n    eligible.every(\n      (other) => other === candidate || descendsFrom(other, candidate),\n    ),\n  );\n\n  if (roots.length === 1) return roots[0]!;\n\n  throw new AmbiguousModelRegistrationError(\n    name,\n    eligible.map((candidate) => nameOf(candidate)),\n  );\n}\n\n/**\n * Whether the generator wrote this class, rather than an application extending\n * one it wrote.\n *\n * The generator marks its own output — `static $generated = true` on each\n * emitted base, and on nothing else — so for artifacts that carry the mark this\n * is a fact the generator stated rather than a property of how it happens to be\n * written. A subclass *inherits* the mark and does not own it, which is what\n * makes own-vs-inherited the whole test.\n *\n * ### The fallback, and why it is second\n *\n * `$schema` is also declared on the emitted base and inherited below it, so\n * owning *that* used to answer the same question, and it answered it wrongly for\n * one shape (#318): a subclass that redeclares `static $schema` — pointing at a\n * modified schema object, or by copy-paste — read as a base, every candidate\n * looked generated, and the least derived won. That did not pass quietly, since\n * `assertPoliciesRegistered` runs immediately after `elect` and refuses a\n * policied class that lost its name. But loud-and-wrong is still wrong, and the\n * silent half — a subclass with statics and row methods but no policies, whose\n * methods then never run inside a nested read — had nothing to refuse.\n *\n * The inference survives as the fallback for artifacts generated *before* the\n * mark existed, where it is the only signal there is. `\"$generated\" in candidate`\n * is what separates the two worlds: it walks the prototype chain, so it is true\n * for a marked base and for everything under it, and false for every class in an\n * app whose `app/models/generated` predates 0.51. Asking `Object.hasOwn` first\n * and falling back on `false` would send a subclass of a *marked* base back into\n * the inference — which is exactly the case the mark was added to fix.\n *\n * `registration.test.ts` in the template asserts the contract against real\n * generator output, because this is the one place a generator change could\n * quietly invalidate an assumption made here.\n */\nfunction isGeneratedBase(candidate: ModelClass): boolean {\n  // Owning the mark, not merely having it — and owning it set to `true`. The\n  // declared type is `?: true`, so TypeScript already refuses `false`; reading\n  // the value anyway is what makes `static $generated = false` mean the thing\n  // it plainly says in an app with no typechecking between it and here.\n  if (\"$generated\" in candidate) {\n    return (\n      Object.hasOwn(candidate, \"$generated\") &&\n      (candidate as { $generated?: unknown }).$generated === true\n    );\n  }\n\n  return Object.hasOwn(candidate, \"$schema\");\n}\n\n/**\n * Whether `derived` has `base` in its static prototype chain — the `extends`\n * relation between two classes, walked on the constructor side because that is\n * where `$schema` and `$policies` live.\n */\nfunction descendsFrom(derived: unknown, base: unknown): boolean {\n  let current = Object.getPrototypeOf(derived);\n\n  while (current !== null && current !== Function.prototype) {\n    if (current === base) return true;\n    current = Object.getPrototypeOf(current);\n  }\n\n  return false;\n}\n\nfunction nameOf(value: unknown): string {\n  return (value as { name?: string })?.name ?? String(value);\n}\n\n/**\n * A model class, structurally.\n *\n * Structural rather than `instanceof Model` on purpose: this module sits below\n * `Model.ts` in the import graph, and importing it here to answer a question\n * about shape would put a cycle between the registry, the policy hook and the\n * model base for no gain. `$schema` carrying a `name` is what every operation\n * already relies on.\n *\n * A module namespace holds anything the author exported — types erase, but\n * constants, helpers and re-exported values do not — so everything that is not\n * a model class is skipped rather than treated as an error.\n */\nfunction asModelClass(value: unknown): ModelClass | null {\n  if (typeof value !== \"function\") return null;\n\n  const schema = (value as { $schema?: ModelSchema }).$schema;\n  if (schema === undefined || typeof schema.name !== \"string\") return null;\n\n  return value as unknown as ModelClass;\n}\n"
   ],
   "mappings": ";+OAyBA,FAAM,HAAwB,LAAC,QAAS,OAAQ,MAAM,EAChD,GAAuB,CAAC,KAAM,OAAO,EAsBpC,SAAS,CAAuB,CACrC,EACmB,CACnB,OAAO,IAAS,OAAS,GAAwB,GAgB5C,SAAS,CAAc,CAC5B,EACA,EACS,CACT,IAAM,EAAO,OAAO,KAAK,CAAK,EAC9B,OAAO,EAAK,OAAS,GAAK,EAAK,MAAM,CAAC,IAAQ,EAAU,SAAS,CAAG,CAAC,EAYhE,IAAM,EAAY,SAqBlB,SAAS,CAAkB,CAAC,EAEtB,CACX,OAAO,OAAO,KAAK,EAAO,SAAS,EAChC,OAAO,CAAC,IAAS,EAAO,UAAU,IAAO,OAAS,MAAM,EACxD,KAAK,EClBH,SAAS,CAAa,CAC3B,EACA,EACA,EACA,EACe,CASf,IAAM,EAAU,CAAE,QAAO,YAAW,QAAS,GAAQ,IAAK,EAiB1D,OAVA,OAAO,eAAe,EAAS,OAAQ,CACrC,WAAY,GACZ,GAAG,EAAG,CACJ,GAAI,GAAQ,MAAQ,CAAC,EACnB,MAAM,IAAI,EAAkB,EAAO,EAAW,SAAS,EAEzD,OAAO,EAEX,CAAC,EAEM,EAyHF,MAAe,CAAgD,CAAC,CAahE,MAAe,WAIZ,CAA8B,CAOxC,CAyBA,IAAM,GAAW,IAAI,IAAY,CAC/B,WACA,YACA,mBACA,aACA,oBACA,QAIA,YAMA,UACA,SACA,aACA,SACA,YACF,CAAC,EAGK,GAAW,IAAI,IAAY,CAAC,SAAU,aAAc,QAAQ,CAAC,EAQ7D,GAAW,IAAI,IAAY,CAAC,SAAU,aAAc,QAAQ,CAAC,EAM7D,GAAW,IAAI,IAAY,CAAC,SAAU,YAAY,CAAC,EAQnD,GAAY,IAAI,IAAY,CAAC,SAAU,YAAY,CAAC,EAoBpD,EAAe,IAAI,QAmBzB,SAAS,EAAY,CACnB,EACA,EACA,EACa,CACb,GAAI,OAAO,IAAU,WAAY,OAAO,EAExC,IAAM,EAAW,EAAa,IAAI,CAAK,EACvC,GAAI,IAAa,OAAW,OAAO,EAEnC,IAAI,EACJ,GAAI,CACF,EAAO,IAAK,EACZ,MAAO,EAAO,CACd,MAAM,IAAI,EACR,EAAY,CAAK,EACjB,EACA,oBACA,GAAG,EAAiB,CAAK;AAAA;AAAA,MACnB,GAAiB,SAAW,OAAO,CAAK,IAC9C,EACA,OACA,CAAE,OAAM,CACV,EAMF,OAHA,EAAsB,EAAiC,EAAO,CAAK,EAEnE,EAAa,IAAI,EAAO,CAAI,EACrB,EAIT,SAAS,CAAY,CACnB,EACA,EACe,CACf,OAAO,EAAQ,IAAI,CAAC,EAAO,IAAU,GAAa,EAAO,EAAO,CAAK,CAAC,EA4BxE,IAAM,EAAmB,CACvB,SACA,QACA,WACA,WACA,QACF,EAuCA,IAAM,EAAiB,IAAI,QAmB3B,SAAS,CAAmB,CAC1B,EACA,EACM,CACN,GAAI,EAAe,IAAI,CAAO,EAAG,OAEjC,QAAS,EAAQ,EAAG,EAAQ,EAAQ,OAAQ,IAC1C,GAAkB,EAAQ,GAAuB,EAAO,CAAK,EAG/D,EAAe,IAAI,CAAO,EAmB5B,SAAS,EAAiB,CACxB,EACA,EACA,EACM,CACN,IAAM,EAAQ,EAAY,CAAK,EACzB,EAAO,OAAO,EAMpB,GACE,IAAU,MACV,MAAM,QAAQ,CAAK,GAClB,IAAS,UAAY,IAAS,WAE/B,MAAM,IAAI,EACR,EACA,EACA,eACA,EAAc,CAAK,EACnB,CACF,EAGF,GAAI,IAAS,WAAY,CACvB,GAAI,CAAC,GAAgB,CAAiB,EACpC,MAAM,IAAI,EACR,EACA,EACA,oBACA,EAAiB,CAAiB,EAClC,CACF,EAIF,OAGF,EAAsB,EAAkC,EAAO,CAAK,EAWtE,SAAS,CAAqB,CAC5B,EACA,EACA,EACM,CACN,IAAM,EAAQ,EAAY,CAAK,EAC3B,EAAW,EAGT,EAAkB,CAAC,EAEzB,QAAW,KAAQ,EAAkB,CACnC,IAAM,EAAQ,EAAO,GAIrB,GAAI,IAAU,QAAa,IAAU,KAAM,CACzC,GAAI,KAAQ,EAAQ,EAAM,KAAK,CAAI,EACnC,SAGF,GAAI,OAAO,IAAU,WACnB,MAAM,IAAI,EACR,EACA,EACA,oBACA,IAAI,cAAiB,EAAc,CAAK,2BACxC,CACF,EAGF,IAGF,GAAI,EAAW,EAAG,OAElB,GAAI,EAAM,OAAS,EACjB,MAAM,IAAI,EACR,EACA,EACA,WACA,aAAa,EAAM,IAAI,CAAC,IAAS,IAAI,IAAO,EAAE,KAAK,IAAI,qBAC3C,EAAM,SAAW,EAAI,KAAO,gCACtC,2CACF,CACF,EAGF,IAAM,EAAU,GAAY,CAAM,EAC5B,EAAO,GAAY,CAAO,EAEhC,MAAM,IAAI,EACR,EACA,EACA,WACA,EAAQ,SAAW,EACf,eACA,aAAa,GAAS,CAAO,MAK1B,EAAQ,SAAW,GAAK,EAAQ,KAAO,UACpC,kEACA,oEACA,kBACA,IACV,EACA,CACF,EAUF,SAAS,EAAQ,CAAC,EAAiC,CACjD,IAAM,EAAQ,EAAK,MAAM,EAAG,CAAC,EAAE,IAAI,CAAC,IAAQ,IAAI,IAAM,EACtD,OAAO,EAAK,OAAS,EAAM,OACvB,GAAG,EAAM,KAAK,IAAI,SAAS,EAAK,OAAS,EAAM,cAC/C,EAAM,KAAK,IAAI,EAqBrB,SAAS,EAAe,CAAC,EAA0B,CACjD,GAAI,CAEF,OADA,QAAQ,UAAU,GAAM,CAAC,EAAG,CAA0B,EAC/C,GACP,KAAM,CACN,MAAO,IAKX,IAAM,GAAO,QAAS,EAAG,GAQzB,SAAS,EAAW,CAAC,EAA0B,CAC7C,IAAM,EAAO,IAAI,IAEb,EAAyB,EAC7B,MAAO,IAAY,MAAQ,IAAY,OAAO,UAAW,CACvD,QAAW,KAAO,OAAO,oBAAoB,CAAO,EAClD,GAAI,IAAQ,cAAe,EAAK,IAAI,CAAG,EAEzC,EAAU,OAAO,eAAe,CAAO,EAGzC,MAAO,CAAC,GAAG,CAAI,EAuBjB,SAAS,EAAW,CAClB,EAC2C,CAC3C,IAAI,EACA,EAAe,EAEnB,QAAW,KAAO,EAChB,QAAW,KAAQ,EAAkB,CACnC,IAAM,EAAW,GAAa,EAAI,YAAY,EAAG,EAAK,YAAY,CAAC,EACnE,GAAI,EAAW,EACb,EAAe,EACf,EAAO,CAAE,MAAK,MAAK,EAKzB,OAAO,EAIT,SAAS,EAAY,CAAC,EAAW,EAAmB,CAClD,GAAI,IAAM,EAAG,MAAO,GAEpB,IAAI,EAAM,MAAM,KAAK,CAAE,OAAQ,EAAE,OAAS,CAAE,EAAG,CAAC,EAAQ,IAAU,CAAK,EAEvE,QAAS,EAAI,EAAG,GAAK,EAAE,OAAQ,IAAK,CAClC,IAAI,EAAW,EAAI,GACnB,EAAI,GAAK,EAET,QAAS,EAAI,EAAG,GAAK,EAAE,OAAQ,IAAK,CAClC,IAAM,EAAO,EAAI,GACjB,EAAI,GAAK,KAAK,IACZ,EAAI,GAAM,EACV,EAAI,EAAI,GAAM,EACd,GAAY,EAAE,EAAI,KAAO,EAAE,EAAI,GAAK,EAAI,EAC1C,EACA,EAAW,GAIf,OAAO,EAAI,EAAE,QAQf,SAAS,CAAa,CAAC,EAAwB,CAC7C,GAAI,IAAU,KAAM,MAAO,OAC3B,GAAI,IAAU,OAAW,MAAO,YAChC,GAAI,OAAO,IAAU,SAAU,MAAO,cAAc,KAAK,UAAU,CAAK,IACxE,GAAI,OAAO,IAAU,WAAY,OAAO,EAAiB,CAAK,EAC9D,GAAI,MAAM,QAAQ,CAAK,EAAG,MAAO,WACjC,GAAI,OAAO,IAAU,SAAU,MAAO,YACtC,MAAO,OAAO,OAAO,KAAS,OAAO,CAAK,IAG5C,SAAS,CAAgB,CAAC,EAAyB,CACjD,OAAO,EAAM,KAAO,kBAAkB,EAAM,SAAW,wBAyBlD,SAAS,CAAW,CAAC,EAAwC,CAClE,IAAI,EACA,EAGA,EAEA,EAAU,EACd,MAAO,GAAW,IAAY,SAAS,UAAW,CAWhD,GAAI,OAAO,OAAO,EAAS,SAAS,EAClC,MAAU,MACR,GAAI,EAA8B,MAAQ,2FAExC,wEACA,oDACJ,EAGF,GAAI,OAAO,OAAO,EAAS,WAAW,GAAK,EAAQ,UAAW,CAC5D,IAAM,EAAQ,EAAQ,UACtB,GAAI,EAAM,OAAS,EAAG,CAOpB,IAAM,EAAQ,EAGd,GAFA,EAAoB,EAAO,CAAK,EAE5B,IAAS,QAAa,IAAU,OAKlC,EAAO,EACP,EAAY,EAKZ,SAAU,EAAa,EAAgC,CAAS,EAChE,EAAO,OACP,EAAM,QAAQ,GAAG,EAAa,EAAO,CAAK,CAAC,GAIjD,EAAU,OAAO,eAAe,CAAO,EAGzC,GAAI,IAAU,OAAW,OAAO,EAChC,GAAI,IAAS,OAAW,OAAO,GAK/B,OAAO,EAAK,KAAK,CAAC,IAAU,OAAO,IAAU,UAAU,EACnD,EAAa,EAAM,CAAS,EAC3B,EAuBA,SAAS,CAAkB,CAAC,EAAsB,CACvD,IAAI,EAAU,EAEd,MAAO,GAAW,IAAY,SAAS,UAAW,CAKhD,GAAI,OAAO,OAAO,EAAS,WAAW,GAAK,EAAQ,UAAW,CAC5D,IAAM,EAAQ,EAAQ,UACtB,GAAI,EAAM,OAAS,EAAG,EAAoB,EAAS,CAAK,EAE1D,EAAU,OAAO,eAAe,CAAO,GAI3C,SAAS,CAAW,CAAC,EAAwB,CAC3C,OAAQ,GAA6B,MAAQ,aAG/C,IAAM,GAAgC,OAAO,OAAO,CAAC,CAAC,EAS/C,SAAS,CAAa,CAC3B,EACA,EACA,EAKA,EAAiC,CAAC,EAC7B,CACL,GAAI,EAAS,SAAW,EAAG,OAAO,EAElC,IAAI,EAAM,EAON,EAEJ,QAAW,KAAU,EACnB,GAAI,EAAO,QAET,GADgB,EAAO,OAAO,CAAO,IACrB,GACd,MAAM,IAAI,EAAkB,EAAQ,MAAO,EAAQ,SAAS,EAKlE,QAAW,KAAU,EAAU,CAC7B,GAAI,CAAC,EAAO,MAAO,SAOnB,GAAI,GAAU,IAAI,EAAQ,SAAS,EAAG,CACpC,GAAoB,EAAQ,CAAO,EACnC,SAGF,IAAM,EAAQ,EAAO,MAAM,CAAO,EAClC,GAAI,IAAU,QAAa,IAAU,KAAM,SAO3C,GALA,GAAe,CAAO,EAKlB,GAAS,IAAI,EAAQ,SAAS,GAAK,CAAC,EAAO,SAAU,CACvD,IAAM,EAAQ,GAAiB,CAAK,EACpC,GAAI,EAAM,OAAS,GAAI,IAAc,CAAC,GAAG,KAAK,GAAG,CAAK,EAGxD,EAAM,GAAU,EAAK,CAAK,EAG5B,GAAI,GAAS,IAAI,EAAQ,SAAS,GAChC,QAAW,KAAU,EACnB,GAAI,EAAO,SAAU,EAAM,GAAY,EAAK,EAAS,CAAM,EAI/D,GAAI,GAAS,IAAI,EAAQ,SAAS,GAChC,QAAW,KAAU,EACnB,GAAI,EAAO,SAAU,EAAM,GAAY,EAAK,EAAS,CAAM,EAsB/D,GAAI,IAAc,OAChB,GAAoB,EAAW,EAAS,EAAK,CAAW,EAG1D,OAAO,EAyBT,SAAS,EAAS,CAAC,EAAW,EAAqB,CACjD,IAAM,EAAQ,GAAM,MAEpB,GAAI,IAAU,QAAa,IAAU,KACnC,MAAO,IAAK,EAAM,MAAO,CAAM,EAGjC,GAAI,OAAO,IAAU,UAAY,MAAM,QAAQ,CAAK,EAClD,MAAO,IAAK,EAAM,MAAO,CAAE,IAAK,CAAC,EAAO,CAAK,CAAE,CAAE,EAInD,IAAM,EAAW,EAAM,IACjB,EACJ,IAAa,QAAa,IAAa,KACnC,CAAC,EACD,MAAM,QAAQ,CAAQ,EACpB,EACA,CAAC,CAAQ,EAEjB,MAAO,IAAK,EAAM,MAAO,IAAK,EAAO,IAAK,CAAC,GAAG,EAAS,CAAK,CAAE,CAAE,EAIlE,SAAS,EAAW,CAAC,EAAW,EAAwB,EAA0B,CAQhF,IAAM,EAAM,CAAC,IAAc,EAAO,SAAU,EAAS,IAAK,CAAK,CAAC,EAEhE,GAAI,EAAQ,YAAc,aAAc,CACtC,IAAM,EAAO,GAAM,KACnB,MAAO,IACF,EACH,KAAM,MAAM,QAAQ,CAAI,EAAI,EAAK,IAAI,CAAG,EAAI,EAAI,CAAI,CACtD,EAGF,GAAI,EAAQ,YAAc,SAGxB,MAAO,IAAK,EAAM,OAAQ,EAAI,GAAM,MAAM,CAAE,EAG9C,MAAO,IAAK,EAAM,KAAM,EAAI,GAAM,IAAI,CAAE,EAU1C,SAAS,EAAW,CAClB,EACA,EACA,EACK,CACL,IAAM,EAAM,EAAQ,YAAc,SAAW,SAAW,OAClD,EAAU,IAAO,GAIvB,GAAI,IAAY,QAAa,IAAY,KAAM,OAAO,EAEtD,MAAO,IAAK,GAAO,GAAM,EAAO,SAAU,EAAS,IAAK,CAAQ,CAAC,CAAE,EAgBrE,SAAS,EAAmB,CAC1B,EACA,EACA,EAgBA,EAAiC,CAAC,EAC5B,CACN,IAAM,EAAO,GAAM,KACnB,GAAI,OAAO,IAAS,UAAY,IAAS,KAAM,OAE/C,IAAM,EAAW,EAAU,OACzB,CAAC,KAAU,KAAS,IAAQ,CAAC,EAAY,SAAS,CAAK,CACzD,EACA,GAAI,EAAS,SAAW,EAAG,OAE3B,MAAM,IAAI,EAAiB,EAAQ,MAAO,EAAQ,UAAW,CAC3D,GAAG,IAAI,IAAI,CAAQ,CACrB,CAAC,EAYH,SAAS,EAAgB,CAAC,EAA0B,CAClD,GAAI,OAAO,IAAU,UAAY,IAAU,MAAQ,MAAM,QAAQ,CAAK,EACpE,MAAO,CAAC,EAGV,IAAM,EAAkB,CAAC,EACzB,QAAW,KAAO,OAAO,KAAK,CAAgC,EAAG,CAC/D,GAAI,IAAQ,OAAS,IAAQ,MAAQ,IAAQ,MAAO,SACpD,EAAM,KAAK,CAAG,EAEhB,OAAO,EAqBT,SAAS,EAAmB,CAC1B,EACA,EACM,CACN,GAAI,EAAO,SAAU,OAErB,MAAM,IAAI,EACR,EAAQ,UACR,EAAQ,MACR,EAAQ,UACR,GAAG,EAAQ,+DACN,EAAQ,gMAGX,+EACA,kCACJ,EAaF,SAAS,EAAc,CAAC,EAA8B,CACpD,GAAI,GAAS,IAAI,EAAQ,SAAS,EAAG,OAErC,MAAM,IAAI,EACR,EAAQ,UACR,EAAQ,MACR,EAAQ,UACR,GAAG,EAAQ,wCAAwC,EAAQ;AAAA;AAAA,mEAKzD,iFACA,qIAEJ,EAYK,SAAS,EAAc,CAC5B,EACA,EACA,EACM,CACN,GAAI,EAAS,SAAW,EAAG,OAE3B,IAAM,EAAY,EAAS,OAAO,CAAC,IAAW,EAAO,MAAM,EAC3D,GAAI,EAAU,SAAW,EAAG,OAE5B,QAAW,KAAO,GAAO,CAAM,EAC7B,QAAW,KAAU,EAAW,EAAO,OAAQ,EAAS,CAAG,EAI/D,SAAS,EAAM,CAAC,EAAwB,CACtC,GAAI,MAAM,QAAQ,CAAM,EAAG,OAAO,EAClC,GAAI,IAAW,MAAQ,IAAW,OAAW,MAAO,CAAC,EACrD,GAAI,OAAO,IAAW,SAAU,MAAO,CAAC,EACxC,MAAO,CAAC,CAAM,EAgBT,SAAS,EAAc,CAC5B,EACA,EACA,EACM,CACN,QAAW,KAAQ,EAAQ,CACzB,IAAM,EAAQ,EAAO,OAAO,GAE5B,GAAI,GAAS,CAAC,EAAM,SAClB,MAAM,IAAI,EACR,UAAU,IACV,EAAO,KACP,SACA,IAAI,8DACF,2EACA,mIAEJ,EAGF,GAAI,KAAQ,EAAK,EAAI,GAAQ,MA0B1B,SAAS,EAAW,EAAY,CAIrC,IAAM,EAAQ,EAAa,EAC3B,GAAI,EAAO,OAAO,EAAM,KAKxB,OAAO,GAAa,GAAG,MAAQ,KAGjC,SAAS,EAAY,EAAmC,CACtD,GAAI,CACF,OAAO,EAAe,SAAS,EAC/B,KAAM,CAIN,QAiBJ,IAAM,EAAa,OAAO,kCAAkC,EAErD,SAAS,EAAa,CAAC,EAAqC,CACjE,MAAO,IAAK,GAAU,GAAa,EAAK,EAGnC,SAAS,EAAW,CAAC,EAA2B,CACrD,OACE,OAAO,IAAY,UACnB,IAAY,MACX,EAAoC,KAAgB,GAyBzD,IAAM,GAAe,OAAO,iCAAiC,EAEtD,SAAS,EAAe,CAC7B,EACA,EACQ,CACR,MAAO,IAAK,GAAU,IAAe,CAAO,EAGvC,SAAS,EAAiB,CAAC,EAAqC,CACrE,GAAI,OAAO,IAAY,UAAY,IAAY,KAAM,OAAO,EAC5D,IAAM,EAAU,EAAoC,IACpD,OAAO,MAAM,QAAQ,CAAM,EAAK,EAAsB,EAGxD,IAAM,EAAkC,CAAC,EAwDnC,GAAc,OAAO,uCAAuC,EAE3D,SAAS,EAAc,CAC5B,EACA,EACQ,CACR,MAAO,IAAK,GAAU,IAAc,CAAU,EAGzC,SAAS,EAAU,CAAC,EAAyC,CAClE,GAAI,OAAO,IAAY,UAAY,IAAY,KAAM,OACrD,IAAM,EAAa,EAAoC,IACvD,OAAO,OAAO,IAAc,SAAY,EAA0B,OAiC7D,IAAM,EAAyB,WA+D/B,SAAS,EAAmB,CACjC,EAGA,EACA,EACA,EACA,EACK,CACL,GAAI,IAAS,QAAa,IAAS,KAAM,OAAO,EAChD,GAAI,OAAO,IAAS,SAAU,OAAO,EAErC,IAAI,EAAM,EAEV,QAAW,IAAa,CAAC,UAAW,QAAQ,EAAY,CACtD,IAAM,EAAO,EAAK,GAClB,GAAI,OAAO,IAAS,UAAY,IAAS,MAAQ,MAAM,QAAQ,CAAI,EACjE,SAGF,IAAI,EAEJ,QAAW,KAAO,OAAO,KAAK,CAAI,EAAG,CAMnC,GAAI,IAAQ,EAAW,CACrB,IAAM,EAAe,GACnB,EACC,EAAiC,GAClC,EACA,EACA,CACF,EACA,GAAI,IAAkB,EAAiC,GACrD,IAAc,IAAM,CAAiC,EACrD,EAAU,GAAO,EAEnB,SAGF,IAAM,EAAW,EAAO,UAAU,GAClC,GAAI,CAAC,EAAU,SAEf,IAAM,EAAQ,EAAiC,GAC/C,GAAI,IAAS,QAAa,IAAS,GAAO,SAE1C,IAAM,EAAS,EAAO,EAAS,KAAK,EAGpC,GAAI,CAAC,EAAQ,SAOb,IAAM,EAAW,IAAS,GAAO,CAAC,EAAI,EACtC,GAAI,OAAO,IAAa,UAAY,MAAM,QAAQ,CAAQ,EAAG,SAI7D,IAAM,EAAS,GACb,EAAO,OACP,EACA,EACA,EACA,CACF,EAIM,EACJ,CAAC,GAAU,EAAO,SAAS,OAAS,EAChC,EACE,EAAO,SACP,EAAc,EAAO,OAAO,KAAM,EAAa,EAAM,CAAM,EAC3D,CACF,EACA,EAIN,GAAI,IAAW,EACb,IAAc,IAAM,CAAiC,EACrD,EAAU,GAAO,EAIrB,GAAI,EAAW,EAAM,IAAK,GAAM,GAAY,CAAU,EAOxD,IAAM,EAAU,GACd,EACA,EAAI,QACJ,EACA,EACA,CACF,EACA,GAAI,IAAY,EAAI,QAAS,EAAM,IAAK,EAAK,QAAS,CAAQ,EAK9D,IAAM,EAAW,EACf,EACA,EAAI,MACJ,EACA,EACA,CACF,EACA,GAAI,IAAa,EAAI,MAAO,EAAM,IAAK,EAAK,MAAO,CAAS,EAE5D,OAAO,EAoBT,SAAS,EAAsB,CAC7B,EACA,EACA,EACA,EACA,EACS,CACT,GAAI,EAAQ,OAAO,EACnB,GAAI,OAAO,IAAY,UAAY,IAAY,KAAM,OAAO,EAE5D,GAAI,MAAM,QAAQ,CAAO,EAAG,CAC1B,IAAI,EAAU,GACR,EAAM,EAAQ,IAAI,CAAC,IAAU,CACjC,IAAM,EAAS,GACb,EACA,EACA,EACA,EACA,CACF,EACA,GAAI,IAAW,EAAO,EAAU,GAChC,OAAO,EACR,EACD,OAAO,EAAU,EAAM,EAGzB,IAAI,EACE,EAAS,EAEf,QAAW,KAAO,OAAO,KAAK,CAAM,EAAG,CACrC,IAAM,EAAW,EAAO,UAAU,GAClC,GAAI,CAAC,EAAU,SAEf,IAAM,EAAO,EAAO,GACpB,GAAI,OAAO,IAAS,UAAY,IAAS,MAAQ,MAAM,QAAQ,CAAI,EAEjE,SAGF,IAAM,EAAS,EAAO,EAAS,KAAK,EACpC,GAAI,CAAC,GAAU,EAAO,SAAS,SAAW,EAAG,SAE7C,IAAM,EAAS,EACb,EAAO,SACP,EAAc,EAAO,OAAO,KAAM,EAAa,EAAM,CAAM,EAC3D,CACF,EAEA,GAAI,IAAW,EACb,IAAc,IAAK,CAAO,EAC1B,EAAU,GAAO,EAIrB,OAAO,GAAa,EAUtB,SAAS,EAAW,CAClB,EACA,EACA,EACA,EACA,EACS,CACT,GAAI,EAAQ,OAAO,EAkBnB,IAAM,EAAY,IAAS,GAE3B,GACE,CAAC,IACA,OAAO,IAAS,UAAY,IAAS,MAAQ,MAAM,QAAQ,CAAI,GAEhE,OAAO,EAGT,IAAM,EAAY,EACd,OAAO,YAAY,EAAmB,CAAM,EAAE,IAAI,CAAC,IAAS,CAAC,EAAM,EAAI,CAAC,CAAC,EACxE,EAAiC,OAEtC,GACE,OAAO,IAAc,UACrB,IAAc,MACd,MAAM,QAAQ,CAAS,EAGvB,OAAO,EAGT,IAAI,EACE,EAAS,EAEf,QAAW,KAAO,OAAO,KAAK,CAAM,EAAG,CACrC,IAAM,EAAQ,EAAO,GACrB,GAAI,IAAU,QAAa,IAAU,GAAO,SAE5C,IAAM,EAAW,EAAO,UAAU,GAClC,GAAI,CAAC,EAAU,SAEf,IAAM,EAAS,EAAO,EAAS,KAAK,EACpC,GAAI,CAAC,GAAU,EAAO,SAAS,SAAW,EAAG,SAE7C,IAAM,EAAW,IAAU,GAAO,CAAC,EAAI,EACvC,GAAI,OAAO,IAAa,UAAY,MAAM,QAAQ,CAAQ,EAAG,SAE7D,IAAM,EAAS,EACb,EAAO,SACP,EAAc,EAAO,OAAO,KAAM,EAAa,EAAM,CAAM,EAC3D,CACF,EAEA,GAAI,IAAW,EACb,IAAc,IAAK,CAAO,EAC1B,EAAU,GAAO,EAIrB,GAAI,CAAC,EAAW,OAAO,EAKvB,OAAO,EACH,CAAE,OAAQ,CAAU,EACpB,IAAM,EAAkC,OAAQ,CAAU,EAgBhE,SAAS,CAAoB,CAC3B,EACA,EACA,EACA,EACA,EACS,CACT,GAAI,OAAO,IAAU,UAAY,IAAU,KAAM,OAAO,EAExD,GAAI,MAAM,QAAQ,CAAK,EAAG,CACxB,IAAI,EAAU,GACR,EAAM,EAAM,IAAI,CAAC,IAAU,CAC/B,IAAM,EAAS,EACb,EACA,EACA,EACA,EACA,CACF,EACA,GAAI,IAAW,EAAO,EAAU,GAChC,OAAO,EACR,EACD,OAAO,EAAU,EAAM,EAGzB,IAAI,EACE,EAAS,EAEf,QAAW,KAAO,OAAO,KAAK,CAAM,EAAG,CACrC,IAAM,EAAQ,EAAO,GACrB,GAAI,IAAU,OAAW,SAIzB,GAAI,IAAQ,OAAS,IAAQ,MAAQ,IAAQ,MAAO,CAClD,IAAM,EAAS,EACb,EACA,EACA,EACA,EACA,CACF,EACA,GAAI,IAAW,EACb,IAAc,IAAK,CAAO,EAC1B,EAAU,GAAO,EAEnB,SAGF,IAAM,EAAW,EAAO,UAAU,GAClC,GAAI,CAAC,EAAU,SAEf,IAAM,EAAS,GACb,EACA,EACA,EACA,EACA,CACF,EACA,GAAI,IAAW,EACb,IAAc,IAAK,CAAO,EAC1B,EAAU,GAAO,EAIrB,OAAO,GAAa,EAItB,SAAS,EAAiB,CACxB,EACA,EACA,EACA,EACA,EACS,CACT,GAAI,OAAO,IAAU,UAAY,IAAU,MAAQ,MAAM,QAAQ,CAAK,EAKpE,OAAO,EAGT,IAAM,EAAS,EAAO,EAAS,KAAK,EACpC,GAAI,CAAC,EAAQ,OAAO,EAEpB,IAAM,EAAY,EAAwB,EAAS,IAAI,EACjD,EAAY,CAAC,EAAe,EAAO,CAAS,EAC5C,EAAoC,EACtC,CAAC,CAAC,KAAM,CAAK,CAAC,EACd,OAAO,QAAQ,CAAgC,EAE/C,EAEJ,QAAY,EAAU,KAAa,EAAS,CAC1C,GAAI,IAAa,MAAQ,IAAa,OAAW,SAIjD,IAAM,EAAS,EACb,EAAO,OACP,EACA,EACA,EACA,CACF,EAEM,EACJ,CAAC,GAAU,EAAO,SAAS,OAAS,EAChC,EACE,EAAO,SACP,EAAc,EAAO,OAAO,KAAM,EAAa,EAAM,CAAM,EAC3D,CAAE,MAAO,CAAO,CAClB,EAAE,MACF,EAEA,EAAQ,IAAa,QAAU,GAAe,EAAQ,CAAK,EAAI,EAErE,GAAI,IAAU,EACZ,IAAc,EACV,CAAC,EACD,IAAM,CAAkC,EAC5C,EAAU,GAAY,EAI1B,GAAI,CAAC,EAAW,OAAO,EAGvB,OAAO,EAkCT,SAAS,EAAc,CAAC,EAAgB,EAA0B,CAChE,GAAI,IAAW,EAAO,OAAO,EAK7B,IAAM,EAAS,EAAW,CAAK,EAEzB,EADQ,EAAW,CAAM,EACX,MAAM,EAAO,MAAM,EACvC,GAAI,EAAM,SAAW,EAAG,OAAO,EAK/B,MAAO,CAAE,GAAI,CAAC,CAAE,IAFd,EAAM,SAAW,EAAI,EAAM,GAAK,CAAE,IAAK,CAAM,CAEd,EAAG,CAAK,CAAE,EAG7C,SAAS,CAAU,CAAC,EAA2B,CAC7C,GAAI,OAAO,IAAU,UAAY,IAAU,KAAM,MAAO,CAAC,EACzD,IAAM,EAAS,EAAkC,IACjD,GAAI,IAAU,OAAW,MAAO,CAAC,EACjC,OAAO,MAAM,QAAQ,CAAK,EAAI,EAAQ,CAAC,CAAK,ECr/DvC,SAAS,EAAwB,IACnC,EACG,CACN,IAAO,GAAS,GAAwB,GAAG,CAAO,EAClD,GAAI,IAAU,OAAW,MAAM,EA4B1B,SAAS,EAAuB,IAClC,EAC6B,CAChC,IAAM,EAA2C,CAAC,EAElD,QAAW,KAAU,EACnB,QAAW,KAAY,OAAO,OAAO,CAAM,EAAG,CAC5C,IAAM,EAAQ,GAAa,CAAQ,EACnC,GAAI,IAAU,KAAM,SAkBpB,EAAmB,CAAK,EAExB,IAAM,EAAO,EAAM,QAAQ,KACrB,EAAsB,EAAI,CAAI,EACtB,EAAa,CAAI,EAC3B,OAMJ,GAAI,IAAe,QAAa,IAAe,EAAO,SAEtD,IAAM,EAAO,EAAY,CAAK,EACxB,EAAS,EAAY,CAAU,EAC/B,EACJ,EAAK,SAAW,EAAO,QACvB,EAAK,KAAK,CAAC,EAAQ,IAAU,IAAW,EAAO,EAAM,EASvD,GAAI,EAAa,EAAY,CAAK,GAAK,EAAa,EAAO,CAAU,EAAG,CACtE,IAAM,EAAW,EAAa,EAAO,CAAU,EAAI,EAAa,EAC1D,EAAa,IAAa,EAAa,EAAQ,EAErD,GAAI,EAAY,CAAQ,EAAE,SAAW,EAAG,CAkBtC,GAAI,IAAe,EAAY,SAI/B,GAAI,CAAC,EAAU,SAKf,EAAS,KACP,IAAI,EACF,EACA,EAAO,CAAU,EACjB,EAAO,CAAK,EACZ,EAAK,OAAS,EAAI,UAAY,YAChC,CACF,EACA,SAQF,GAAI,EACF,EAAS,KACP,IAAI,EACF,EACA,EAAO,CAAQ,EACf,EAAO,CAAU,EACjB,WACF,CACF,EAIF,SAGF,GAAI,CAAC,EAAU,SAIf,EAAS,KACP,IAAI,EACF,EACA,EAAO,CAAU,EACjB,EAAO,CAAK,EACZ,EAAK,OAAS,EAAI,UAAY,YAChC,CACF,EAIJ,OAAO,EAyCF,SAAS,EAAc,IACzB,EACG,CAUN,IAAM,EAAS,IAAI,IAEnB,QAAW,KAAU,EAAS,CAC5B,IAAM,EAAa,IAAI,IAIvB,QAAW,KAAY,IAAI,IAAI,OAAO,OAAO,CAAM,CAAC,EAAG,CACrD,IAAM,EAAQ,GAAa,CAAQ,EACnC,GAAI,IAAU,KAAM,SAEpB,IAAM,EAAO,EAAM,QAAQ,KACrB,EAAW,EAAW,IAAI,CAAI,EACpC,GAAI,IAAa,OAAW,EAAW,IAAI,EAAM,CAAC,CAAK,CAAC,EACnD,OAAS,KAAK,CAAK,EAK1B,QAAY,EAAM,KAAY,EAC5B,EAAO,IAAI,EAAM,GAAM,EAAM,CAAO,CAAC,EAUzC,IAAM,EAAW,CAAC,GAAG,EAAO,KAAK,CAAC,EAC/B,OAAO,CAAC,IAAkB,EAAI,CAAI,CAAC,EACnC,IAAI,CAAC,IAAS,CAAC,EAAe,EAAa,CAAI,CAAC,CAAU,EAE7D,QAAY,EAAM,KAAU,EAAiB,EAAS,EAAM,CAAK,EAEjE,GAAI,CACF,GAAyB,GAAG,CAAO,EACnC,MAAO,EAAO,CACd,QAAY,EAAM,KAAU,EAAmB,EAAS,EAAM,CAAK,EACnE,MAAM,GAqCV,SAAS,EAAK,CAAC,EAAc,EAAmC,CAC9D,GAAI,EAAQ,SAAW,EAAG,OAAO,EAAQ,GAEzC,IAAM,EAAU,EAAQ,OAAO,CAAC,IAAc,CAAC,GAAgB,CAAS,CAAC,EACnE,EAAW,EAAQ,OAAS,EAAI,EAAU,EAEhD,GAAI,EAAS,SAAW,EAAG,OAAO,EAAS,GAE3C,IAAM,EAAQ,EAAS,OAAO,CAAC,IAC7B,EAAS,MACP,CAAC,IAAU,IAAU,GAAa,EAAa,EAAO,CAAS,CACjE,CACF,EAEA,GAAI,EAAM,SAAW,EAAG,OAAO,EAAM,GAErC,MAAM,IAAI,GACR,EACA,EAAS,IAAI,CAAC,IAAc,EAAO,CAAS,CAAC,CAC/C,EAqCF,SAAS,EAAe,CAAC,EAAgC,CAKvD,GAAI,eAAgB,EAClB,OACE,OAAO,OAAO,EAAW,YAAY,GACpC,EAAuC,aAAe,GAI3D,OAAO,OAAO,OAAO,EAAW,SAAS,EAQ3C,SAAS,CAAY,CAAC,EAAkB,EAAwB,CAC9D,IAAI,EAAU,OAAO,eAAe,CAAO,EAE3C,MAAO,IAAY,MAAQ,IAAY,SAAS,UAAW,CACzD,GAAI,IAAY,EAAM,MAAO,GAC7B,EAAU,OAAO,eAAe,CAAO,EAGzC,MAAO,GAGT,SAAS,CAAM,CAAC,EAAwB,CACtC,OAAQ,GAA6B,MAAQ,OAAO,CAAK,EAgB3D,SAAS,EAAY,CAAC,EAAmC,CACvD,GAAI,OAAO,IAAU,WAAY,OAAO,KAExC,IAAM,EAAU,EAAoC,QACpD,GAAI,IAAW,QAAa,OAAO,EAAO,OAAS,SAAU,OAAO,KAEpE,OAAO",
-  "debugId": "9E1064785367A20264756E2164756E21",
+  "debugId": "27714BA5B46A3B8264756E2164756E21",
   "names": []
 }

package/dist/{chunk-5stgtwqw.js → chunk-2bja99cq.js}

@@ -1,6 +1,6 @@
 // @bun
 import{watch as K,existsSync as L,readFileSync as M}from"fs";import{join as O}from"path";function P(G){let A={};for(let C of G.split(`
 `)){let z=C.trim();if(!z||z.startsWith("#"))continue;let B=z.startsWith("export ")?z.slice(7).trim():z,I=B.indexOf("=");if(I===-1)continue;let J=B.slice(0,I).trim();if(!J)continue;let H=B.slice(I+1).trim();if(H.length>=2&&(H.startsWith('"')&&H.endsWith('"')||H.startsWith("'")&&H.endsWith("'")))H=H.slice(1,-1);A[J]=H}return A}function Q(G){let A=Bun.env.NODE_ENV,C=[".env"];if(A)C.push(`.env.${A}`);if(A!=="test"){if(C.push(".env.local"),A)C.push(`.env.${A}.local`)}return C.map((z)=>O(G,z))}function R(G){let A={};for(let z of Q(G))if(L(z))Object.assign(A,P(M(z,"utf8")));let C=[];for(let[z,B]of Object.entries(A))if(process.env[z]!==B)process.env[z]=B,C.push(z);return C}function V(G=process.cwd()){if(globalThis.__gemiEnvWatcher)return;let A;globalThis.__gemiEnvWatcher=K(G,(C,z)=>{if(!z||!String(z).startsWith(".env"))return;clearTimeout(A),A=setTimeout(()=>{try{let B=R(G);if(B.length)console.log(`[gemi] .env reloaded: ${B.join(", ")}`)}catch(B){console.error("[gemi] failed to reload .env:",B)}},50)})}
-export{Q as Fa,V as Ga};
+export{Q as Ga,V as Ha};
 
-//# debugId=5FD06B83FD70863964756E2164756E21
+//# debugId=B160D754446BE26F64756E2164756E21

package/dist/{chunk-5stgtwqw.js.map → chunk-2bja99cq.js.map}

@@ -5,6 +5,6 @@
     "import { watch, existsSync, readFileSync, type FSWatcher } from \"node:fs\";\nimport { join } from \"node:path\";\n\ndeclare global {\n  // A single directory watcher, kept on globalThis so `bun --hot` reloads (which\n  // re-run `Server.start`) don't stack duplicate watchers.\n  var __gemiEnvWatcher: FSWatcher | undefined;\n}\n\n// Minimal `.env` parser: `KEY=VALUE` lines, `#` comments, an optional leading\n// `export`, and surrounding single/double quotes stripped. Multi-line values and\n// `${VAR}` interpolation are intentionally not handled (uncommon subset).\nfunction parseEnv(content: string): Record<string, string> {\n  const out: Record<string, string> = {};\n  for (const raw of content.split(\"\\n\")) {\n    const line = raw.trim();\n    if (!line || line.startsWith(\"#\")) continue;\n    const body = line.startsWith(\"export \") ? line.slice(7).trim() : line;\n    const eq = body.indexOf(\"=\");\n    if (eq === -1) continue;\n    const key = body.slice(0, eq).trim();\n    if (!key) continue;\n    let value = body.slice(eq + 1).trim();\n    if (\n      value.length >= 2 &&\n      ((value.startsWith('\"') && value.endsWith('\"')) ||\n        (value.startsWith(\"'\") && value.endsWith(\"'\")))\n    ) {\n      value = value.slice(1, -1);\n    }\n    out[key] = value;\n  }\n  return out;\n}\n\n// The `.env` files Bun loads, in increasing precedence (later overrides earlier).\n// `.env.local` is skipped for `NODE_ENV=test`, matching Bun/dotenv conventions.\nexport function envFiles(rootDir: string): string[] {\n  const nodeEnv = process.env.NODE_ENV;\n  const names = [\".env\"];\n  if (nodeEnv) names.push(`.env.${nodeEnv}`);\n  if (nodeEnv !== \"test\") {\n    names.push(\".env.local\");\n    if (nodeEnv) names.push(`.env.${nodeEnv}.local`);\n  }\n  return names.map((name) => join(rootDir, name));\n}\n\n// Re-read the env files and apply them to `process.env`. Only adds/updates keys\n// (a value edit is the common case); a key removed from the file keeps its last\n// value until the next full restart, so we never clobber the real OS environment.\nfunction applyEnv(rootDir: string): string[] {\n  const merged: Record<string, string> = {};\n  for (const file of envFiles(rootDir)) {\n    if (existsSync(file)) {\n      Object.assign(merged, parseEnv(readFileSync(file, \"utf8\")));\n    }\n  }\n  const changed: string[] = [];\n  for (const [key, value] of Object.entries(merged)) {\n    if (process.env[key] !== value) {\n      process.env[key] = value;\n      changed.push(key);\n    }\n  }\n  return changed;\n}\n\n// Watch the project's `.env` files and re-apply them to `process.env` on change,\n// so edits take effect without restarting the dev server. Bun loads `.env` only\n// at startup and does not reload it (even under `--hot`), so this fills that gap.\n// Dev only — called from `Server.start()`'s dev branch, not in production.\n// Idempotent: keeps a single watcher across `bun --hot` reloads.\n//\n// Note: this updates `process.env`, so config read at request time picks up the\n// new value immediately; values a service reads once at boot (e.g. a client\n// constructed from an env var) are cached and won't change until that code\n// re-runs (a hot reload in dev, a restart in prod).\nexport function watchEnv(rootDir: string = process.cwd()) {\n  if (globalThis.__gemiEnvWatcher) return;\n\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  globalThis.__gemiEnvWatcher = watch(rootDir, (_event, filename) => {\n    // Non-recursive: only direct children of `rootDir`. Filter to `.env*`.\n    if (!filename || !String(filename).startsWith(\".env\")) return;\n    clearTimeout(timer);\n    timer = setTimeout(() => {\n      try {\n        const changed = applyEnv(rootDir);\n        if (changed.length) {\n          console.log(`[gemi] .env reloaded: ${changed.join(\", \")}`);\n        }\n      } catch (error) {\n        console.error(\"[gemi] failed to reload .env:\", error);\n      }\n    }, 50);\n  });\n}\n"
   ],
   "mappings": ";AAAA,gBAAS,gBAAO,kBAAY,WAC5B,eAAS,aAWT,SAAS,CAAQ,CAAC,EAAyC,CACzD,IAAM,EAA8B,CAAC,EACrC,QAAW,KAAO,EAAQ,MAAM;AAAA,CAAI,EAAG,CACrC,IAAM,EAAO,EAAI,KAAK,EACtB,GAAI,CAAC,GAAQ,EAAK,WAAW,GAAG,EAAG,SACnC,IAAM,EAAO,EAAK,WAAW,SAAS,EAAI,EAAK,MAAM,CAAC,EAAE,KAAK,EAAI,EAC3D,EAAK,EAAK,QAAQ,GAAG,EAC3B,GAAI,IAAO,GAAI,SACf,IAAM,EAAM,EAAK,MAAM,EAAG,CAAE,EAAE,KAAK,EACnC,GAAI,CAAC,EAAK,SACV,IAAI,EAAQ,EAAK,MAAM,EAAK,CAAC,EAAE,KAAK,EACpC,GACE,EAAM,QAAU,IACd,EAAM,WAAW,GAAG,GAAK,EAAM,SAAS,GAAG,GAC1C,EAAM,WAAW,GAAG,GAAK,EAAM,SAAS,GAAG,GAE9C,EAAQ,EAAM,MAAM,EAAG,EAAE,EAE3B,EAAI,GAAO,EAEb,OAAO,EAKF,SAAS,CAAQ,CAAC,EAA2B,CAClD,IAAM,EAAU,iBACV,EAAQ,CAAC,MAAM,EACrB,GAAI,EAAS,EAAM,KAAK,QAAQ,GAAS,EACzC,GAAI,IAAY,QAEd,GADA,EAAM,KAAK,YAAY,EACnB,EAAS,EAAM,KAAK,QAAQ,SAAe,EAEjD,OAAO,EAAM,IAAI,CAAC,IAAS,EAAK,EAAS,CAAI,CAAC,EAMhD,SAAS,CAAQ,CAAC,EAA2B,CAC3C,IAAM,EAAiC,CAAC,EACxC,QAAW,KAAQ,EAAS,CAAO,EACjC,GAAI,EAAW,CAAI,EACjB,OAAO,OAAO,EAAQ,EAAS,EAAa,EAAM,MAAM,CAAC,CAAC,EAG9D,IAAM,EAAoB,CAAC,EAC3B,QAAY,EAAK,KAAU,OAAO,QAAQ,CAAM,EAC9C,GAAI,QAAQ,IAAI,KAAS,EACvB,QAAQ,IAAI,GAAO,EACnB,EAAQ,KAAK,CAAG,EAGpB,OAAO,EAaF,SAAS,CAAQ,CAAC,EAAkB,QAAQ,IAAI,EAAG,CACxD,GAAI,WAAW,iBAAkB,OAEjC,IAAI,EACJ,WAAW,iBAAmB,EAAM,EAAS,CAAC,EAAQ,IAAa,CAEjE,GAAI,CAAC,GAAY,CAAC,OAAO,CAAQ,EAAE,WAAW,MAAM,EAAG,OACvD,aAAa,CAAK,EAClB,EAAQ,WAAW,IAAM,CACvB,GAAI,CACF,IAAM,EAAU,EAAS,CAAO,EAChC,GAAI,EAAQ,OACV,QAAQ,IAAI,yBAAyB,EAAQ,KAAK,IAAI,GAAG,EAE3D,MAAO,EAAO,CACd,QAAQ,MAAM,gCAAiC,CAAK,IAErD,EAAE,EACN",
-  "debugId": "5FD06B83FD70863964756E2164756E21",
+  "debugId": "B160D754446BE26F64756E2164756E21",
   "names": []
 }

package/dist/{chunk-n672d4g8.js → chunk-30xxc6r7.js}

@@ -1,5 +1,5 @@
 // @bun
 class B{app;constructor(z){this.app=z}register(){}boot(){}shutdown(z){}}
-export{B as Lc};
+export{B as Yc};
 
-//# debugId=19EDA806C63FE2D764756E2164756E21
+//# debugId=DBAD9399BC25435864756E2164756E21

package/dist/{chunk-n672d4g8.js.map → chunk-30xxc6r7.js.map}

@@ -5,6 +5,6 @@
     "import type { Application } from \"../foundation/Application\";\n\n/**\n * What a provider's `shutdown()` may resolve: nothing, or whether it\n * abandoned work at the deadline. See `ServiceProvider` below.\n */\nexport type ProviderShutdownResult = void | { abandoned: boolean };\n\n/**\n * Every hook defaults to a no-op. `register()` binds services into the\n * container and must not resolve any of them; `boot()` runs after every\n * provider has registered, so it may resolve freely.\n *\n * `shutdown()` runs once when a production server is told to stop (`SIGTERM`\n * or `SIGINT`), after it has stopped accepting requests and the in-flight ones\n * have finished or run out of grace — so nothing a request needs is torn down\n * under it. Providers shut down in reverse registration order, so one\n * registered after another may still use it. Each is awaited, but under a\n * shared deadline (`GEMI_SHUTDOWN_PROVIDER_TIMEOUT`): one that overruns is\n * abandoned and the next begins, and one that throws is logged and does not\n * stop the rest. See `Application.shutdown`.\n *\n * Under `gemi dev` it also runs on every `bun --hot` reload, for the\n * application the reload replaced, once the new one is serving and the old\n * one's requests have finished (see `server/devReload.ts`). A hook that closes\n * something kept on `globalThis` across reloads would close it for the new\n * application too.\n *\n * `timeoutMs` is what is left of that shared deadline when this provider is\n * reached. A provider that waits for something — jobs finishing, a queue\n * draining — should bound its own wait by a little less than this, so that it\n * is still the one to report what it gave up on. Ignoring it is fine; the\n * provider is then simply abandoned at the deadline, with only a generic line\n * from `Application` to say so.\n *\n * A provider that bounds its own wait and gives up on work it was waiting for\n * resolves `{ abandoned: true }`. `Application` then reports it in `timedOut`\n * as if it had overrun, and the process exits `1` — the work was cut off just\n * the same, and an orchestrator or a log alert has to be able to see that from\n * the exit code. The provider names what it abandoned in its own log line.\n */\nexport abstract class ServiceProvider {\n  constructor(protected app: Application) {}\n\n  register(): void {}\n\n  boot(): void | Promise<void> {}\n\n  shutdown(options?: {\n    timeoutMs: number;\n  }): ProviderShutdownResult | Promise<ProviderShutdownResult> {}\n}\n"
   ],
   "mappings": ";AAyCO,MAAe,CAAgB,CACd,IAAtB,WAAW,CAAW,EAAkB,CAAlB,WAEtB,QAAQ,EAAS,EAEjB,IAAI,EAAyB,EAE7B,QAAQ,CAAC,EAEoD,EAC/D",
-  "debugId": "19EDA806C63FE2D764756E2164756E21",
+  "debugId": "DBAD9399BC25435864756E2164756E21",
   "names": []
 }

package/dist/{chunk-qjhw8nje.js → chunk-33s2xqv1.js}

@@ -1,5 +1,5 @@
 // @bun
-import"./chunk-vw8849ys.js";import Eu from"os";import Au from"fs";var Wl=new Map,hh=new Map,nh=Symbol("OriginError"),Dl={};class fl extends Promise{constructor(l,n,u,c,w={}){let E,t;super((_,B)=>{E=_,t=B});this.tagged=Array.isArray(l.raw),this.strings=l,this.args=n,this.handler=u,this.canceller=c,this.options=w,this.state=null,this.statement=null,this.resolve=(_)=>(this.active=!1,E(_)),this.reject=(_)=>(this.active=!1,t(_)),this.active=!1,this.cancelled=null,this.executed=!1,this.signature="",this[nh]=this.handler.debug?Error():this.tagged&&vn(this.strings)}get origin(){return(this.handler.debug?this[nh].stack:this.tagged&&hh.has(this.strings)?hh.get(this.strings):hh.set(this.strings,this[nh].stack).get(this.strings))||""}static get[Symbol.species](){return Promise}cancel(){return this.canceller&&(this.canceller(this),this.canceller=null)}simple(){return this.options.simple=!0,this.options.prepare=!1,this}async readable(){return this.simple(),this.streaming=!0,this}async writable(){return this.simple(),this.streaming=!0,this}cursor(l=1,n){if(this.options.simple=!1,typeof l==="function")n=l,l=1;if(this.cursorRows=l,typeof n==="function")return this.cursorFn=n,this;let u;return{[Symbol.asyncIterator]:()=>({next:()=>{if(this.executed&&!this.active)return{done:!0};u&&u();let c=new Promise((w,E)=>{this.cursorFn=(t)=>{return w({value:t,done:!1}),new Promise((_)=>u=_)},this.resolve=()=>(this.active=!1,w({done:!0})),this.reject=(t)=>(this.active=!1,E(t))});return this.execute(),c},return(){return u&&u(Dl),{done:!0}}})}}describe(){return this.options.simple=!1,this.onlyDescribe=this.options.prepare=!0,this}stream(){throw Error(".stream has been renamed to .forEach")}forEach(l){return this.forEachFn=l,this.handle(),this}raw(){return this.isRaw=!0,this}values(){return this.isRaw="values",this}async handle(){!this.executed&&(this.executed=!0)&&await 1&&this.handler(this)}execute(){return this.handle(),this}then(){return this.handle(),super.then.apply(this,arguments)}catch(){return this.handle(),super.catch.apply(this,arguments)}finally(){return this.handle(),super.finally.apply(this,arguments)}}function vn(l){if(Wl.has(l))return Wl.get(l);let n=Error.stackTraceLimit;return Error.stackTraceLimit=4,Wl.set(l,Error()),Error.stackTraceLimit=n,Wl.get(l)}class Yl extends Error{constructor(l){super(l.message);this.name=this.constructor.name,Object.assign(this,l)}}var K={connection:Th,postgres:Xh,generic:Ch,notSupported:Zh};function Th(l,n,u){let{host:c,port:w}=u||n,E=Object.assign(Error("write "+l+" "+(n.path||c+":"+w)),{code:l,errno:l,address:n.path||c},n.path?{}:{port:w});return Error.captureStackTrace(E,Th),E}function Xh(l){let n=new Yl(l);return Error.captureStackTrace(n,Xh),n}function Ch(l,n){let u=Object.assign(Error(l+": "+n),{code:l});return Error.captureStackTrace(u,Ch),u}function Zh(l){let n=Object.assign(Error(l+" (B) is not supported"),{code:"MESSAGE_NOT_SUPPORTED",name:l});return Error.captureStackTrace(n,Zh),n}var mn={string:{to:25,from:null,serialize:(l)=>""+l},number:{to:0,from:[21,23,26,700,701],serialize:(l)=>""+l,parse:(l)=>+l},json:{to:114,from:[114,3802],serialize:(l)=>JSON.stringify(l),parse:(l)=>JSON.parse(l)},boolean:{to:16,from:16,serialize:(l)=>l===!0?"t":"f",parse:(l)=>l==="t"},date:{to:1184,from:[1082,1114,1184],serialize:(l)=>(l instanceof Date?l:new Date(l)).toISOString(),parse:(l)=>new Date(l)},bytea:{to:17,from:17,serialize:(l)=>"\\x"+Buffer.from(l).toString("hex"),parse:(l)=>Buffer.from(l.slice(2),"hex")}};class ml{then(){uh()}catch(){uh()}finally(){uh()}}class il extends ml{constructor(l){super();this.value=el(l)}}class wl extends ml{constructor(l,n,u){super();this.value=l,this.type=n,this.array=u}}class bl extends ml{constructor(l,n){super();this.first=l,this.rest=n}build(l,n,u,c){let w=bn.map(([E,t])=>({fn:t,i:l.search(E)})).sort((E,t)=>E.i-t.i).pop();return w.i===-1?_h(this.first,c):w.fn(this.first,this.rest,n,u,c)}}function al(l,n,u,c){let w=l instanceof wl?l.value:l;if(w===void 0){if(l instanceof wl?l.value=c.transform.undefined:w=l=c.transform.undefined,w===void 0)throw K.generic("UNDEFINED_VALUE","Undefined values are not allowed")}return"$"+u.push(l instanceof wl?(n.push(l.value),l.array?l.array[l.type||vl(l.value)]||l.type||ih(l.value):l.type):(n.push(l),vl(l)))}var Hh=Qh(mn);function th(l,n,u,c,w,E){for(let t=1;t<l.strings.length;t++)n+=wh(n,u,c,w,E)+l.strings[t],u=l.args[t];return n}function wh(l,n,u,c,w){return n instanceof bl?n.build(l,u,c,w):n instanceof fl?ch(n,u,c,w):n instanceof il?n.value:n&&n[0]instanceof fl?n.reduce((E,t)=>E+" "+ch(t,u,c,w),""):al(n,u,c,w)}function ch(l,n,u,c){return l.fragment=!0,th(l,l.strings[0],l.args[0],n,u,c)}function zh(l,n,u,c,w){return l.map((E)=>"("+c.map((t)=>wh("values",E[t],n,u,w)).join(",")+")").join(",")}function Fh(l,n,u,c,w){let E=Array.isArray(l[0]),t=n.length?n.flat():Object.keys(E?l[0]:l);return zh(E?l:[l],u,c,t,w)}function Kl(l,n,u,c,w){if(typeof l==="string"&&(l=[l].concat(n)),Array.isArray(l))return _h(l,w);let E;return(n.length?n.flat():Object.keys(l)).map((_)=>{return E=l[_],(E instanceof fl?ch(E,u,c,w):E instanceof il?E.value:al(E,u,c,w))+" as "+el(w.transform.column.to?w.transform.column.to(_):_)}).join(",")}var bn=Object.entries({values:Fh,in:(...l)=>{let n=Fh(...l);return n==="()"?"(null)":n},select:Kl,as:Kl,returning:Kl,"\\(":Kl,update(l,n,u,c,w){return(n.length?n.flat():Object.keys(l)).map((E)=>el(w.transform.column.to?w.transform.column.to(E):E)+"="+wh("values",l[E],u,c,w))},insert(l,n,u,c,w){let E=n.length?n.flat():Object.keys(Array.isArray(l)?l[0]:l);return"("+_h(E,w)+")values"+zh(Array.isArray(l)?l:[l],u,c,E,w)}}).map(([l,n])=>[new RegExp("((?:^|[\\s(])"+l+"(?:$|[\\s(]))(?![\\s\\S]*\\1)","i"),n]);function uh(){throw K.generic("NOT_TAGGED_CALL","Query not called as a tagged template literal")}var{serializers:an,parsers:en}=Hh;function ih(l){if(Array.isArray(l))return ih(l[0]);return typeof l==="string"?1009:0}var Jh=function(l){let n=Qh(l||{});return{serializers:Object.assign({},an,n.serializers),parsers:Object.assign({},en,n.parsers)}};function Qh(l){return Object.keys(l).reduce((n,u)=>{if(l[u].from&&[].concat(l[u].from).forEach((c)=>n.parsers[c]=l[u].parse),l[u].serialize)n.serializers[l[u].to]=l[u].serialize,l[u].from&&[].concat(l[u].from).forEach((c)=>n.serializers[c]=l[u].serialize);return n},{parsers:{},serializers:{}})}function _h(l,{transform:{column:n}}){return l.map((u)=>el(n.to?n.to(u):u)).join(",")}var el=function(n){return'"'+n.replace(/"/g,'""').replace(/\./g,'"."')+'"'},vl=function l(n){return n instanceof wl?n.type:n instanceof Date?1184:n instanceof Uint8Array?17:n===!0||n===!1?16:typeof n==="bigint"?20:Array.isArray(n)?l(n[0]):0},kn=/\\/g,on=/"/g;function pn(l){return l.replace(kn,"\\\\").replace(on,"\\\"")}var Vh=function l(n,u,c,w){if(Array.isArray(n)===!1)return n;if(!n.length)return"{}";let E=n[0],t=w===1020?";":",";if(Array.isArray(E)&&!E.type)return"{"+n.map((_)=>l(_,u,c,w)).join(t)+"}";return"{"+n.map((_)=>{if(_===void 0){if(_=c.transform.undefined,_===void 0)throw K.generic("UNDEFINED_VALUE","Undefined values are not allowed")}return _===null?"null":'"'+pn(u?u(_.type?_.value:_):""+_)+'"'}).join(t)+"}"},fh={i:0,char:null,str:"",quoted:!1,last:0},Wh=function(n,u,c){return fh.i=fh.last=0,Kh(fh,n,u,c)};function Kh(l,n,u,c){let w=[],E=c===1020?";":",";for(;l.i<n.length;l.i++){if(l.char=n[l.i],l.quoted)if(l.char==="\\")l.str+=n[++l.i];else if(l.char==='"')w.push(u?u(l.str):l.str),l.str="",l.quoted=n[l.i+1]==='"',l.last=l.i+2;else l.str+=l.char;else if(l.char==='"')l.quoted=!0;else if(l.char==="{")l.last=++l.i,w.push(Kh(l,n,u,c));else if(l.char==="}"){l.quoted=!1,l.last<l.i&&w.push(u?u(n.slice(l.last,l.i)):n.slice(l.last,l.i)),l.last=l.i+1;break}else if(l.char===E&&l.p!=="}"&&l.p!=='"')w.push(u?u(n.slice(l.last,l.i)):n.slice(l.last,l.i)),l.last=l.i+1;l.p=l.char}return l.last<l.i&&w.push(u?u(n.slice(l.last,l.i+1)):n.slice(l.last,l.i+1)),w}var Sl=(l)=>{let n=l[0];for(let u=1;u<l.length;u++)n+=l[u]==="_"?l[++u].toUpperCase():l[u];return n},Gl=(l)=>{let n=l[0].toUpperCase();for(let u=1;u<l.length;u++)n+=l[u]==="_"?l[++u].toUpperCase():l[u];return n},jl=(l)=>l.replace(/_/g,"-"),Fl=(l)=>l.replace(/([A-Z])/g,"_$1").toLowerCase(),Hl=(l)=>(l.slice(0,1)+l.slice(1).replace(/([A-Z])/g,"_$1")).toLowerCase(),zl=(l)=>l.replace(/-/g,"_");function Oh(l){return function n(u,c){return typeof u==="object"&&u!==null&&(c.type===114||c.type===3802)?Array.isArray(u)?u.map((w)=>n(w,c)):Object.entries(u).reduce((w,[E,t])=>Object.assign(w,{[l(E)]:n(t,c)}),{}):u}}Sl.column={from:Sl};Sl.value={from:Oh(Sl)};Fl.column={to:Fl};var Eh={...Sl};Eh.column.to=Fl;Gl.column={from:Gl};Gl.value={from:Oh(Gl)};Hl.column={to:Hl};var Ah={...Gl};Ah.column.to=Hl;jl.column={from:jl};jl.value={from:Oh(jl)};zl.column={to:zl};var Uh={...jl};Uh.column.to=zl;import vh from"net";import qn from"tls";import Jl from"crypto";import $h from"stream";import{performance as mh}from"perf_hooks";class Ml extends Array{constructor(){super();Object.defineProperties(this,{count:{value:null,writable:!0},state:{value:null,writable:!0},command:{value:null,writable:!0},columns:{value:null,writable:!0},statement:{value:null,writable:!0}})}static get[Symbol.species](){return Array}}var hl=yn;function yn(l=[]){let n=l.slice(),u=0;return{get length(){return n.length-u},remove:(c)=>{let w=n.indexOf(c);return w===-1?null:(n.splice(w,1),c)},push:(c)=>(n.push(c),c),shift:()=>{let c=n[u++];if(u===n.length)u=0,n=[];else n[u-1]=void 0;return c}}}var p=Buffer.allocUnsafe(256),rn="BCcDdEFfHPpQSX".split("").reduce((l,n)=>{let u=n.charCodeAt(0);return l[n]=()=>{return p[0]=u,R.i=5,R},l},{}),R=Object.assign(sn,rn,{N:String.fromCharCode(0),i:0,inc(l){return R.i+=l,R},str(l){let n=Buffer.byteLength(l);return kl(n),R.i+=p.write(l,R.i,n,"utf8"),R},i16(l){return kl(2),p.writeUInt16BE(l,R.i),R.i+=2,R},i32(l,n){if(n||n===0)return p.writeUInt32BE(l,n),R;return kl(4),p.writeUInt32BE(l,R.i),R.i+=4,R},z(l){return kl(l),p.fill(0,R.i,R.i+l),R.i+=l,R},raw(l){return p=Buffer.concat([p.subarray(0,R.i),l]),R.i=p.length,R},end(l=1){p.writeUInt32BE(R.i-l,l);let n=p.subarray(0,R.i);return R.i=0,p=Buffer.allocUnsafe(256),n}}),$=R;function kl(l){if(p.length-R.i<l){let n=p,u=n.length;p=Buffer.allocUnsafe(u+(u>>1)+l),n.copy(p)}}function sn(){return R.i=0,R}var Bh=eh,xn=1,Bl=$().S().end(),bh=$().H().end(),lu=$().i32(8).i32(80877103).end(8),hu=Buffer.concat([$().E().str($.N).i32(0).end(),Bl]),nu=$().D().str("S").str($.N).end(),Rl=()=>{},uu=new Set(["FetchPreparedStatement","RevalidateCachedQuery","transformAssignedExpr"]),fu={83:"severity_local",86:"severity",67:"code",77:"message",68:"detail",72:"hint",80:"position",112:"internal_position",113:"internal_query",87:"where",115:"schema_name",116:"table_name",99:"column_name",100:"data type_name",110:"constraint_name",70:"file",76:"line",82:"routine"};function eh(l,n={},{onopen:u=Rl,onend:c=Rl,onclose:w=Rl}={}){let{sslnegotiation:E,ssl:t,max:_,user:B,host:Q,port:T,database:Y,parsers:j,transform:M,onnotice:H,onnotify:I,onparameter:b,max_pipeline:Z,keep_alive:cl,backoff:nl,target_session_attrs:x}=l,d=hl(),Ul=xn++,_l={pid:null,secret:null},Pl=gh(xl,l.idle_timeout),Il=gh(xl,l.max_lifetime),L=gh(xh,l.connect_timeout),U=null,Ol,q=null,N=new Ml,y=Buffer.alloc(0),dl=l.fetch_types,El={},O={},S=Math.random().toString(36).slice(2),F=1,v=0,V=0,G=0,D=0,i=0,J=0,m=0,r=null,X=null,Al=!1,tl=null,$l=null,e=null,z=null,C=null,ll=null,Ql=null,sl=null,A=null,Tl=null,k={queue:n.closed,idleTimer:Pl,connect(h){e=h,Lh()},terminate:Zl,execute:Xl,cancel:yh,end:xl,count:0,id:Ul};return n.closed&&n.closed.push(k),k;async function ph(){let h;try{h=l.socket?await Promise.resolve(l.socket(l)):new vh.Socket}catch(f){Nl(f);return}return h.on("error",Nl),h.on("close",Nh),h.on("drain",Ph),h}async function yh({pid:h,secret:f},g,P){try{Ol=$().i32(16).i32(80877102).i32(h).i32(f).end(16),await dh(),U.once("error",P),U.once("close",g)}catch(W){P(W)}}function Xl(h){if(Al)return Cl(h,K.connection("CONNECTION_DESTROYED",l));if(C)return Cl(h,K.generic("COPY_IN_PROGRESS","You cannot execute queries during copy"));if(h.cancelled)return;try{return h.state=_l,A?d.push(h):(A=h,A.active=!0),qh(h),a(rh(h))&&!h.describeFirst&&!h.cursorFn&&d.length<Z&&(!h.options.onexecute||h.options.onexecute(k))}catch(f){return d.length===0&&a(Bl),ul(f),!0}}function rh(h){if(h.parameters.length>=65534)throw K.generic("MAX_PARAMETERS_EXCEEDED","Max number of parameters (65534) exceeded");return h.options.simple?$().Q().str(h.statement.string+$.N).end():h.describeFirst?Buffer.concat([Gh(h),bh]):h.prepare?h.prepared?Vl(h):Buffer.concat([Gh(h),Vl(h)]):sh(h)}function Gh(h){return Buffer.concat([Yh(h.statement.string,h.parameters,h.statement.types,h.statement.name),Vn("S",h.statement.name)])}function Vl(h){return Buffer.concat([Qn(h.parameters,h.statement.types,h.statement.name,h.cursorName),h.cursorFn?Rh("",h.cursorRows):hu])}function sh(h){return Buffer.concat([Yh(h.statement.string,h.parameters,h.statement.types),nu,Vl(h)])}function qh(h){let f=[],g=[],P=th(h,h.strings[0],h.args[0],f,g,l);!h.tagged&&h.args.forEach((W)=>al(W,f,g,l)),h.prepare=l.prepare&&("prepare"in h.options?h.options.prepare:!0),h.string=P,h.signature=h.prepare&&g+P,h.onlyDescribe&&delete O[h.signature],h.parameters=h.parameters||f,h.prepared=h.prepare&&h.signature in O,h.describeFirst=h.onlyDescribe||f.length&&!h.prepared,h.statement=h.prepared?O[h.signature]:{string:P,types:g,name:h.prepare?S+F++:""},typeof l.debug==="function"&&l.debug(Ul,P,f,g)}function a(h,f){if(ll=ll?Buffer.concat([ll,h]):Buffer.from(h),f||ll.length>=1024)return jh(f);return X===null&&(X=setImmediate(jh)),!0}function jh(h){let f=U.write(ll,h);return X!==null&&clearImmediate(X),ll=X=null,f}function xh(){ul(K.connection("CONNECT_TIMEOUT",l,U)),U.destroy()}async function Mh(){if(E!=="direct"){if(a(lu),!await new Promise((g)=>U.once("data",(P)=>g(P[0]===83)))&&t==="prefer")return Ll()}let h={socket:U,servername:vh.isIP(U.host)?void 0:U.host};if(E==="direct")h.ALPNProtocols=["postgresql"];if(t==="require"||t==="allow"||t==="prefer")h.rejectUnauthorized=!1;else if(typeof t==="object")Object.assign(h,t);U.removeAllListeners(),U=qn.connect(h),U.on("secureConnect",Ll),U.on("error",Nl),U.on("close",Nh),U.on("drain",Ph)}function Ph(){!A&&u(k)}function ql(h){if(tl){if(tl.push(h),V-=h.length,V>0)return}y=tl?Buffer.concat(tl,i-V):y.length===0?h:Buffer.concat([y,h],y.length+h.length);while(y.length>4){if(i=y.readUInt32BE(1),i>=y.length){V=i-y.length,tl=[y];break}try{ln(y.subarray(0,i+1))}catch(f){A&&(A.cursorFn||A.describeFirst)&&a(Bl),ul(f)}y=y.subarray(i+1),V=0,tl=null}}async function dh(){if(Al=!1,El={},U||(U=await ph()),!U)return;if(L.start(),l.socket)return t?Mh():Ll();if(U.on("connect",t?Mh:Ll),l.path)return U.connect(l.path);U.ssl=t,U.connect(T[G],Q[G]),U.host=Q[G],U.port=T[G],G=(G+1)%T.length}function Lh(){setTimeout(dh,v?Math.max(0,v+J-mh.now()):0)}function Ll(){try{O={},dl=l.fetch_types,S=Math.random().toString(36).slice(2),F=1,Il.start(),U.on("data",ql),cl&&U.setKeepAlive&&U.setKeepAlive(!0,1000*cl);let h=Kn();a(h)}catch(h){Nl(h)}}function Nl(h){if(k.queue===n.connecting&&l.host[D+1])return;ul(h);while(d.length)Cl(d.shift(),h)}function ul(h){C&&(C.destroy(h),C=null),A&&Cl(A,h),e&&(Cl(e,h),e=null)}function Cl(h,f){if(h.reserve)return h.reject(f);if(!f||typeof f!=="object")f=Error(f);"query"in f||"parameters"in f||Object.defineProperties(f,{stack:{value:f.stack+h.origin.replace(/.*\n/,`
+import"./chunk-hm9cjxy2.js";import Eu from"os";import Au from"fs";var Wl=new Map,hh=new Map,nh=Symbol("OriginError"),Dl={};class fl extends Promise{constructor(l,n,u,c,w={}){let E,t;super((_,B)=>{E=_,t=B});this.tagged=Array.isArray(l.raw),this.strings=l,this.args=n,this.handler=u,this.canceller=c,this.options=w,this.state=null,this.statement=null,this.resolve=(_)=>(this.active=!1,E(_)),this.reject=(_)=>(this.active=!1,t(_)),this.active=!1,this.cancelled=null,this.executed=!1,this.signature="",this[nh]=this.handler.debug?Error():this.tagged&&vn(this.strings)}get origin(){return(this.handler.debug?this[nh].stack:this.tagged&&hh.has(this.strings)?hh.get(this.strings):hh.set(this.strings,this[nh].stack).get(this.strings))||""}static get[Symbol.species](){return Promise}cancel(){return this.canceller&&(this.canceller(this),this.canceller=null)}simple(){return this.options.simple=!0,this.options.prepare=!1,this}async readable(){return this.simple(),this.streaming=!0,this}async writable(){return this.simple(),this.streaming=!0,this}cursor(l=1,n){if(this.options.simple=!1,typeof l==="function")n=l,l=1;if(this.cursorRows=l,typeof n==="function")return this.cursorFn=n,this;let u;return{[Symbol.asyncIterator]:()=>({next:()=>{if(this.executed&&!this.active)return{done:!0};u&&u();let c=new Promise((w,E)=>{this.cursorFn=(t)=>{return w({value:t,done:!1}),new Promise((_)=>u=_)},this.resolve=()=>(this.active=!1,w({done:!0})),this.reject=(t)=>(this.active=!1,E(t))});return this.execute(),c},return(){return u&&u(Dl),{done:!0}}})}}describe(){return this.options.simple=!1,this.onlyDescribe=this.options.prepare=!0,this}stream(){throw Error(".stream has been renamed to .forEach")}forEach(l){return this.forEachFn=l,this.handle(),this}raw(){return this.isRaw=!0,this}values(){return this.isRaw="values",this}async handle(){!this.executed&&(this.executed=!0)&&await 1&&this.handler(this)}execute(){return this.handle(),this}then(){return this.handle(),super.then.apply(this,arguments)}catch(){return this.handle(),super.catch.apply(this,arguments)}finally(){return this.handle(),super.finally.apply(this,arguments)}}function vn(l){if(Wl.has(l))return Wl.get(l);let n=Error.stackTraceLimit;return Error.stackTraceLimit=4,Wl.set(l,Error()),Error.stackTraceLimit=n,Wl.get(l)}class Yl extends Error{constructor(l){super(l.message);this.name=this.constructor.name,Object.assign(this,l)}}var K={connection:Th,postgres:Xh,generic:Ch,notSupported:Zh};function Th(l,n,u){let{host:c,port:w}=u||n,E=Object.assign(Error("write "+l+" "+(n.path||c+":"+w)),{code:l,errno:l,address:n.path||c},n.path?{}:{port:w});return Error.captureStackTrace(E,Th),E}function Xh(l){let n=new Yl(l);return Error.captureStackTrace(n,Xh),n}function Ch(l,n){let u=Object.assign(Error(l+": "+n),{code:l});return Error.captureStackTrace(u,Ch),u}function Zh(l){let n=Object.assign(Error(l+" (B) is not supported"),{code:"MESSAGE_NOT_SUPPORTED",name:l});return Error.captureStackTrace(n,Zh),n}var mn={string:{to:25,from:null,serialize:(l)=>""+l},number:{to:0,from:[21,23,26,700,701],serialize:(l)=>""+l,parse:(l)=>+l},json:{to:114,from:[114,3802],serialize:(l)=>JSON.stringify(l),parse:(l)=>JSON.parse(l)},boolean:{to:16,from:16,serialize:(l)=>l===!0?"t":"f",parse:(l)=>l==="t"},date:{to:1184,from:[1082,1114,1184],serialize:(l)=>(l instanceof Date?l:new Date(l)).toISOString(),parse:(l)=>new Date(l)},bytea:{to:17,from:17,serialize:(l)=>"\\x"+Buffer.from(l).toString("hex"),parse:(l)=>Buffer.from(l.slice(2),"hex")}};class ml{then(){uh()}catch(){uh()}finally(){uh()}}class il extends ml{constructor(l){super();this.value=el(l)}}class wl extends ml{constructor(l,n,u){super();this.value=l,this.type=n,this.array=u}}class bl extends ml{constructor(l,n){super();this.first=l,this.rest=n}build(l,n,u,c){let w=bn.map(([E,t])=>({fn:t,i:l.search(E)})).sort((E,t)=>E.i-t.i).pop();return w.i===-1?_h(this.first,c):w.fn(this.first,this.rest,n,u,c)}}function al(l,n,u,c){let w=l instanceof wl?l.value:l;if(w===void 0){if(l instanceof wl?l.value=c.transform.undefined:w=l=c.transform.undefined,w===void 0)throw K.generic("UNDEFINED_VALUE","Undefined values are not allowed")}return"$"+u.push(l instanceof wl?(n.push(l.value),l.array?l.array[l.type||vl(l.value)]||l.type||ih(l.value):l.type):(n.push(l),vl(l)))}var Hh=Qh(mn);function th(l,n,u,c,w,E){for(let t=1;t<l.strings.length;t++)n+=wh(n,u,c,w,E)+l.strings[t],u=l.args[t];return n}function wh(l,n,u,c,w){return n instanceof bl?n.build(l,u,c,w):n instanceof fl?ch(n,u,c,w):n instanceof il?n.value:n&&n[0]instanceof fl?n.reduce((E,t)=>E+" "+ch(t,u,c,w),""):al(n,u,c,w)}function ch(l,n,u,c){return l.fragment=!0,th(l,l.strings[0],l.args[0],n,u,c)}function zh(l,n,u,c,w){return l.map((E)=>"("+c.map((t)=>wh("values",E[t],n,u,w)).join(",")+")").join(",")}function Fh(l,n,u,c,w){let E=Array.isArray(l[0]),t=n.length?n.flat():Object.keys(E?l[0]:l);return zh(E?l:[l],u,c,t,w)}function Kl(l,n,u,c,w){if(typeof l==="string"&&(l=[l].concat(n)),Array.isArray(l))return _h(l,w);let E;return(n.length?n.flat():Object.keys(l)).map((_)=>{return E=l[_],(E instanceof fl?ch(E,u,c,w):E instanceof il?E.value:al(E,u,c,w))+" as "+el(w.transform.column.to?w.transform.column.to(_):_)}).join(",")}var bn=Object.entries({values:Fh,in:(...l)=>{let n=Fh(...l);return n==="()"?"(null)":n},select:Kl,as:Kl,returning:Kl,"\\(":Kl,update(l,n,u,c,w){return(n.length?n.flat():Object.keys(l)).map((E)=>el(w.transform.column.to?w.transform.column.to(E):E)+"="+wh("values",l[E],u,c,w))},insert(l,n,u,c,w){let E=n.length?n.flat():Object.keys(Array.isArray(l)?l[0]:l);return"("+_h(E,w)+")values"+zh(Array.isArray(l)?l:[l],u,c,E,w)}}).map(([l,n])=>[new RegExp("((?:^|[\\s(])"+l+"(?:$|[\\s(]))(?![\\s\\S]*\\1)","i"),n]);function uh(){throw K.generic("NOT_TAGGED_CALL","Query not called as a tagged template literal")}var{serializers:an,parsers:en}=Hh;function ih(l){if(Array.isArray(l))return ih(l[0]);return typeof l==="string"?1009:0}var Jh=function(l){let n=Qh(l||{});return{serializers:Object.assign({},an,n.serializers),parsers:Object.assign({},en,n.parsers)}};function Qh(l){return Object.keys(l).reduce((n,u)=>{if(l[u].from&&[].concat(l[u].from).forEach((c)=>n.parsers[c]=l[u].parse),l[u].serialize)n.serializers[l[u].to]=l[u].serialize,l[u].from&&[].concat(l[u].from).forEach((c)=>n.serializers[c]=l[u].serialize);return n},{parsers:{},serializers:{}})}function _h(l,{transform:{column:n}}){return l.map((u)=>el(n.to?n.to(u):u)).join(",")}var el=function(n){return'"'+n.replace(/"/g,'""').replace(/\./g,'"."')+'"'},vl=function l(n){return n instanceof wl?n.type:n instanceof Date?1184:n instanceof Uint8Array?17:n===!0||n===!1?16:typeof n==="bigint"?20:Array.isArray(n)?l(n[0]):0},kn=/\\/g,on=/"/g;function pn(l){return l.replace(kn,"\\\\").replace(on,"\\\"")}var Vh=function l(n,u,c,w){if(Array.isArray(n)===!1)return n;if(!n.length)return"{}";let E=n[0],t=w===1020?";":",";if(Array.isArray(E)&&!E.type)return"{"+n.map((_)=>l(_,u,c,w)).join(t)+"}";return"{"+n.map((_)=>{if(_===void 0){if(_=c.transform.undefined,_===void 0)throw K.generic("UNDEFINED_VALUE","Undefined values are not allowed")}return _===null?"null":'"'+pn(u?u(_.type?_.value:_):""+_)+'"'}).join(t)+"}"},fh={i:0,char:null,str:"",quoted:!1,last:0},Wh=function(n,u,c){return fh.i=fh.last=0,Kh(fh,n,u,c)};function Kh(l,n,u,c){let w=[],E=c===1020?";":",";for(;l.i<n.length;l.i++){if(l.char=n[l.i],l.quoted)if(l.char==="\\")l.str+=n[++l.i];else if(l.char==='"')w.push(u?u(l.str):l.str),l.str="",l.quoted=n[l.i+1]==='"',l.last=l.i+2;else l.str+=l.char;else if(l.char==='"')l.quoted=!0;else if(l.char==="{")l.last=++l.i,w.push(Kh(l,n,u,c));else if(l.char==="}"){l.quoted=!1,l.last<l.i&&w.push(u?u(n.slice(l.last,l.i)):n.slice(l.last,l.i)),l.last=l.i+1;break}else if(l.char===E&&l.p!=="}"&&l.p!=='"')w.push(u?u(n.slice(l.last,l.i)):n.slice(l.last,l.i)),l.last=l.i+1;l.p=l.char}return l.last<l.i&&w.push(u?u(n.slice(l.last,l.i+1)):n.slice(l.last,l.i+1)),w}var Sl=(l)=>{let n=l[0];for(let u=1;u<l.length;u++)n+=l[u]==="_"?l[++u].toUpperCase():l[u];return n},Gl=(l)=>{let n=l[0].toUpperCase();for(let u=1;u<l.length;u++)n+=l[u]==="_"?l[++u].toUpperCase():l[u];return n},jl=(l)=>l.replace(/_/g,"-"),Fl=(l)=>l.replace(/([A-Z])/g,"_$1").toLowerCase(),Hl=(l)=>(l.slice(0,1)+l.slice(1).replace(/([A-Z])/g,"_$1")).toLowerCase(),zl=(l)=>l.replace(/-/g,"_");function Oh(l){return function n(u,c){return typeof u==="object"&&u!==null&&(c.type===114||c.type===3802)?Array.isArray(u)?u.map((w)=>n(w,c)):Object.entries(u).reduce((w,[E,t])=>Object.assign(w,{[l(E)]:n(t,c)}),{}):u}}Sl.column={from:Sl};Sl.value={from:Oh(Sl)};Fl.column={to:Fl};var Eh={...Sl};Eh.column.to=Fl;Gl.column={from:Gl};Gl.value={from:Oh(Gl)};Hl.column={to:Hl};var Ah={...Gl};Ah.column.to=Hl;jl.column={from:jl};jl.value={from:Oh(jl)};zl.column={to:zl};var Uh={...jl};Uh.column.to=zl;import vh from"net";import qn from"tls";import Jl from"crypto";import $h from"stream";import{performance as mh}from"perf_hooks";class Ml extends Array{constructor(){super();Object.defineProperties(this,{count:{value:null,writable:!0},state:{value:null,writable:!0},command:{value:null,writable:!0},columns:{value:null,writable:!0},statement:{value:null,writable:!0}})}static get[Symbol.species](){return Array}}var hl=yn;function yn(l=[]){let n=l.slice(),u=0;return{get length(){return n.length-u},remove:(c)=>{let w=n.indexOf(c);return w===-1?null:(n.splice(w,1),c)},push:(c)=>(n.push(c),c),shift:()=>{let c=n[u++];if(u===n.length)u=0,n=[];else n[u-1]=void 0;return c}}}var p=Buffer.allocUnsafe(256),rn="BCcDdEFfHPpQSX".split("").reduce((l,n)=>{let u=n.charCodeAt(0);return l[n]=()=>{return p[0]=u,R.i=5,R},l},{}),R=Object.assign(sn,rn,{N:String.fromCharCode(0),i:0,inc(l){return R.i+=l,R},str(l){let n=Buffer.byteLength(l);return kl(n),R.i+=p.write(l,R.i,n,"utf8"),R},i16(l){return kl(2),p.writeUInt16BE(l,R.i),R.i+=2,R},i32(l,n){if(n||n===0)return p.writeUInt32BE(l,n),R;return kl(4),p.writeUInt32BE(l,R.i),R.i+=4,R},z(l){return kl(l),p.fill(0,R.i,R.i+l),R.i+=l,R},raw(l){return p=Buffer.concat([p.subarray(0,R.i),l]),R.i=p.length,R},end(l=1){p.writeUInt32BE(R.i-l,l);let n=p.subarray(0,R.i);return R.i=0,p=Buffer.allocUnsafe(256),n}}),$=R;function kl(l){if(p.length-R.i<l){let n=p,u=n.length;p=Buffer.allocUnsafe(u+(u>>1)+l),n.copy(p)}}function sn(){return R.i=0,R}var Bh=eh,xn=1,Bl=$().S().end(),bh=$().H().end(),lu=$().i32(8).i32(80877103).end(8),hu=Buffer.concat([$().E().str($.N).i32(0).end(),Bl]),nu=$().D().str("S").str($.N).end(),Rl=()=>{},uu=new Set(["FetchPreparedStatement","RevalidateCachedQuery","transformAssignedExpr"]),fu={83:"severity_local",86:"severity",67:"code",77:"message",68:"detail",72:"hint",80:"position",112:"internal_position",113:"internal_query",87:"where",115:"schema_name",116:"table_name",99:"column_name",100:"data type_name",110:"constraint_name",70:"file",76:"line",82:"routine"};function eh(l,n={},{onopen:u=Rl,onend:c=Rl,onclose:w=Rl}={}){let{sslnegotiation:E,ssl:t,max:_,user:B,host:Q,port:T,database:Y,parsers:j,transform:M,onnotice:H,onnotify:I,onparameter:b,max_pipeline:Z,keep_alive:cl,backoff:nl,target_session_attrs:x}=l,d=hl(),Ul=xn++,_l={pid:null,secret:null},Pl=gh(xl,l.idle_timeout),Il=gh(xl,l.max_lifetime),L=gh(xh,l.connect_timeout),U=null,Ol,q=null,N=new Ml,y=Buffer.alloc(0),dl=l.fetch_types,El={},O={},S=Math.random().toString(36).slice(2),F=1,v=0,V=0,G=0,D=0,i=0,J=0,m=0,r=null,X=null,Al=!1,tl=null,$l=null,e=null,z=null,C=null,ll=null,Ql=null,sl=null,A=null,Tl=null,k={queue:n.closed,idleTimer:Pl,connect(h){e=h,Lh()},terminate:Zl,execute:Xl,cancel:yh,end:xl,count:0,id:Ul};return n.closed&&n.closed.push(k),k;async function ph(){let h;try{h=l.socket?await Promise.resolve(l.socket(l)):new vh.Socket}catch(f){Nl(f);return}return h.on("error",Nl),h.on("close",Nh),h.on("drain",Ph),h}async function yh({pid:h,secret:f},g,P){try{Ol=$().i32(16).i32(80877102).i32(h).i32(f).end(16),await dh(),U.once("error",P),U.once("close",g)}catch(W){P(W)}}function Xl(h){if(Al)return Cl(h,K.connection("CONNECTION_DESTROYED",l));if(C)return Cl(h,K.generic("COPY_IN_PROGRESS","You cannot execute queries during copy"));if(h.cancelled)return;try{return h.state=_l,A?d.push(h):(A=h,A.active=!0),qh(h),a(rh(h))&&!h.describeFirst&&!h.cursorFn&&d.length<Z&&(!h.options.onexecute||h.options.onexecute(k))}catch(f){return d.length===0&&a(Bl),ul(f),!0}}function rh(h){if(h.parameters.length>=65534)throw K.generic("MAX_PARAMETERS_EXCEEDED","Max number of parameters (65534) exceeded");return h.options.simple?$().Q().str(h.statement.string+$.N).end():h.describeFirst?Buffer.concat([Gh(h),bh]):h.prepare?h.prepared?Vl(h):Buffer.concat([Gh(h),Vl(h)]):sh(h)}function Gh(h){return Buffer.concat([Yh(h.statement.string,h.parameters,h.statement.types,h.statement.name),Vn("S",h.statement.name)])}function Vl(h){return Buffer.concat([Qn(h.parameters,h.statement.types,h.statement.name,h.cursorName),h.cursorFn?Rh("",h.cursorRows):hu])}function sh(h){return Buffer.concat([Yh(h.statement.string,h.parameters,h.statement.types),nu,Vl(h)])}function qh(h){let f=[],g=[],P=th(h,h.strings[0],h.args[0],f,g,l);!h.tagged&&h.args.forEach((W)=>al(W,f,g,l)),h.prepare=l.prepare&&("prepare"in h.options?h.options.prepare:!0),h.string=P,h.signature=h.prepare&&g+P,h.onlyDescribe&&delete O[h.signature],h.parameters=h.parameters||f,h.prepared=h.prepare&&h.signature in O,h.describeFirst=h.onlyDescribe||f.length&&!h.prepared,h.statement=h.prepared?O[h.signature]:{string:P,types:g,name:h.prepare?S+F++:""},typeof l.debug==="function"&&l.debug(Ul,P,f,g)}function a(h,f){if(ll=ll?Buffer.concat([ll,h]):Buffer.from(h),f||ll.length>=1024)return jh(f);return X===null&&(X=setImmediate(jh)),!0}function jh(h){let f=U.write(ll,h);return X!==null&&clearImmediate(X),ll=X=null,f}function xh(){ul(K.connection("CONNECT_TIMEOUT",l,U)),U.destroy()}async function Mh(){if(E!=="direct"){if(a(lu),!await new Promise((g)=>U.once("data",(P)=>g(P[0]===83)))&&t==="prefer")return Ll()}let h={socket:U,servername:vh.isIP(U.host)?void 0:U.host};if(E==="direct")h.ALPNProtocols=["postgresql"];if(t==="require"||t==="allow"||t==="prefer")h.rejectUnauthorized=!1;else if(typeof t==="object")Object.assign(h,t);U.removeAllListeners(),U=qn.connect(h),U.on("secureConnect",Ll),U.on("error",Nl),U.on("close",Nh),U.on("drain",Ph)}function Ph(){!A&&u(k)}function ql(h){if(tl){if(tl.push(h),V-=h.length,V>0)return}y=tl?Buffer.concat(tl,i-V):y.length===0?h:Buffer.concat([y,h],y.length+h.length);while(y.length>4){if(i=y.readUInt32BE(1),i>=y.length){V=i-y.length,tl=[y];break}try{ln(y.subarray(0,i+1))}catch(f){A&&(A.cursorFn||A.describeFirst)&&a(Bl),ul(f)}y=y.subarray(i+1),V=0,tl=null}}async function dh(){if(Al=!1,El={},U||(U=await ph()),!U)return;if(L.start(),l.socket)return t?Mh():Ll();if(U.on("connect",t?Mh:Ll),l.path)return U.connect(l.path);U.ssl=t,U.connect(T[G],Q[G]),U.host=Q[G],U.port=T[G],G=(G+1)%T.length}function Lh(){setTimeout(dh,v?Math.max(0,v+J-mh.now()):0)}function Ll(){try{O={},dl=l.fetch_types,S=Math.random().toString(36).slice(2),F=1,Il.start(),U.on("data",ql),cl&&U.setKeepAlive&&U.setKeepAlive(!0,1000*cl);let h=Kn();a(h)}catch(h){Nl(h)}}function Nl(h){if(k.queue===n.connecting&&l.host[D+1])return;ul(h);while(d.length)Cl(d.shift(),h)}function ul(h){C&&(C.destroy(h),C=null),A&&Cl(A,h),e&&(Cl(e,h),e=null)}function Cl(h,f){if(h.reserve)return h.reject(f);if(!f||typeof f!=="object")f=Error(f);"query"in f||"parameters"in f||Object.defineProperties(f,{stack:{value:f.stack+h.origin.replace(/.*\n/,`
 `),enumerable:l.debug},query:{value:h.string,enumerable:l.debug},parameters:{value:h.parameters,enumerable:l.debug},args:{value:h.args,enumerable:l.debug},types:{value:h.statement&&h.statement.types,enumerable:l.debug}}),h.reject(f)}function xl(){return z||(!k.reserved&&c(k),!k.reserved&&!e&&!A&&d.length===0?(Zl(),new Promise((h)=>U&&U.readyState!=="closed"?U.once("close",h):h())):z=new Promise((h)=>Ql=h))}function Zl(){if(Al=!0,C||A||e||d.length)Nl(K.connection("CONNECTION_DESTROYED",l));if(clearImmediate(X),U)U.removeListener("data",ql),U.removeListener("connect",Ll),U.readyState==="open"&&U.end($().X().end());Ql&&(Ql(),z=Ql=null)}async function Nh(h){if(y=Buffer.alloc(0),V=0,tl=null,clearImmediate(X),U.removeListener("data",ql),U.removeListener("connect",Ll),Pl.cancel(),Il.cancel(),L.cancel(),U.removeAllListeners(),U=null,e)return Lh();!h&&(A||d.length)&&Nl(K.connection("CONNECTION_CLOSED",l,U)),v=mh.now(),h&&l.shared.retries++,J=(typeof nl==="function"?nl(l.shared.retries):nl)*1000,w(k,K.connection("CONNECTION_CLOSED",l,U))}function ln(h,f=h[0]){(f===68?hn:f===100?Tn:f===65?dn:f===83?nn:f===90?un:f===67?fn:f===50?Dh:f===49?cn:f===116?tn:f===84?wn:f===82?_n:f===110?gn:f===75?Bn:f===69?Mn:f===115?Ln:f===51?Nn:f===71?Dn:f===78?Cn:f===72?Yn:f===99?Xn:f===73?Zn:f===86?Fn:f===118?Hn:f===87?Rn:zn)(h)}function hn(h){let f=7,g,P,W,o=A.isRaw?Array(A.statement.columns.length):{};for(let s=0;s<A.statement.columns.length;s++)P=A.statement.columns[s],g=h.readInt32BE(f),f+=4,W=g===-1?null:A.isRaw===!0?h.subarray(f,f+=g):P.parser===void 0?h.toString("utf8",f,f+=g):P.parser.array===!0?P.parser(h.toString("utf8",f+1,f+=g)):P.parser(h.toString("utf8",f,f+=g)),A.isRaw?o[s]=A.isRaw===!0?W:M.value.from?M.value.from(W,P):W:o[P.name]=M.value.from?M.value.from(W,P):W;A.forEachFn?A.forEachFn(M.row.from?M.row.from(o):o,N):N[m++]=M.row.from?M.row.from(o):o}function nn(h){let[f,g]=h.toString("utf8",5,h.length-1).split($.N);if(El[f]=g,l.parameters[f]!==g)l.parameters[f]=g,b&&b(f,g)}function un(h){if(A)if(q)A.retried?ul(A.retried):A.prepared&&uu.has(q.routine)?Pn(A,q):ul(q);else A.resolve($l||N);else if(q)ul(q);if(A=$l=q=null,N=new Ml,L.cancel(),e){if(x){if(!El.in_hot_standby||!El.default_transaction_read_only)return jn();else if(Gn(x,El))return Zl()}if(dl)return e.reserve&&(e=null),In();e&&!e.reserve&&Xl(e),l.shared.retries=D=0,e=null;return}while(d.length&&(A=d.shift())&&(A.active=!0,A.cancelled))eh(l).cancel(A.state,A.cancelled.resolve,A.cancelled.reject);if(A)return;k.reserved?!k.reserved.release&&h[5]===73?z?Zl():(k.reserved=null,u(k)):k.reserved():z?Zl():u(k)}function fn(h){m=0;for(let f=h.length-1;f>0;f--){if(h[f]===32&&h[f+1]<58&&N.count===null)N.count=+h.toString("utf8",f+1,h.length-1);if(h[f-1]>=65){N.command=h.toString("utf8",5,f),N.state=_l;break}}if(Tl&&(Tl(),Tl=null),N.command==="BEGIN"&&_!==1&&!k.reserved)return ul(K.generic("UNSAFE_TRANSACTION","Only use sql.begin, sql.reserved or max: 1"));if(A.options.simple)return Dh();if(A.cursorFn)N.count&&A.cursorFn(N),a(Bl)}function cn(){A.parsing=!1}function Dh(){!N.statement&&(N.statement=A.statement),N.columns=A.statement.columns}function tn(h){let f=h.readUInt16BE(5);for(let g=0;g<f;++g)!A.statement.types[g]&&(A.statement.types[g]=h.readUInt32BE(7+g*4));A.prepare&&(O[A.signature]=A.statement),A.describeFirst&&!A.onlyDescribe&&(a(Vl(A)),A.describeFirst=!1)}function wn(h){if(N.command)$l=$l||[N],$l.push(N=new Ml),N.count=null,A.statement.columns=null;let f=h.readUInt16BE(5),g=7,P;A.statement.columns=Array(f);for(let W=0;W<f;++W){P=g;while(h[g++]!==0);let o=h.readUInt32BE(g),s=h.readUInt16BE(g+4),gl=h.readUInt32BE(g+6);A.statement.columns[W]={name:M.column.from?M.column.from(h.toString("utf8",P,g-1)):h.toString("utf8",P,g-1),parser:j[gl],table:o,number:s,type:gl},g+=18}if(N.statement=A.statement,A.onlyDescribe)return A.resolve(A.statement),a(Bl)}async function _n(h,f=h.readUInt32BE(5)){(f===3?On:f===5?En:f===10?An:f===11?Un:f===12?$n:f!==0?Jn:Rl)(h,f)}async function On(){let h=await lh();a($().p().str(h).z(1).end())}async function En(h){let f="md5"+await ah(Buffer.concat([Buffer.from(await ah(await lh()+B)),h.subarray(9)]));a($().p().str(f).z(1).end())}async function An(){sl=(await Jl.randomBytes(18)).toString("base64"),$().p().str("SCRAM-SHA-256"+$.N);let h=$.i;a($.inc(4).str("n,,n=*,r="+sl).i32($.i-h-4,h).end())}async function Un(h){let f=h.toString("utf8",9).split(",").reduce((s,gl)=>(s[gl[0]]=gl.slice(2),s),{}),g=await Jl.pbkdf2Sync(await lh(),Buffer.from(f.s,"base64"),parseInt(f.i),32,"sha256"),P=await pl(g,"Client Key"),W="n=*,r="+sl+",r="+f.r+",s="+f.s+",i="+f.i+",c=biws,r="+f.r;r=(await pl(await pl(g,"Server Key"),W)).toString("base64");let o="c=biws,r="+f.r+",p="+tu(P,Buffer.from(await pl(await cu(P),W))).toString("base64");a($().p().str(o).end())}function $n(h){if(h.toString("utf8",9).split($.N,1)[0].slice(2)===r)return;ul(K.generic("SASL_SIGNATURE_MISMATCH","The server did not return the correct signature")),U.destroy()}function lh(){return Promise.resolve(typeof l.pass==="function"?l.pass():l.pass)}function gn(){if(N.statement=A.statement,N.statement.columns=[],A.onlyDescribe)return A.resolve(A.statement),a(Bl)}function Bn(h){_l.pid=h.readUInt32BE(5),_l.secret=h.readUInt32BE(9)}async function In(){dl=!1,(await new fl([`
       select b.oid, b.typarray
       from pg_catalog.pg_type a

package/dist/{chunk-4088szy9.js → chunk-39kyz4k6.js}

@@ -1,5 +1,5 @@
 // @bun
-import{Kg as M}from"./chunk-pn8v6fj2.js";import{bi as P}from"./chunk-t4yh4nf9.js";class C{spent=new Map;sweepAt=1024;async consume(J,Q){return this.consumeSync(J,Q)}consumeSync(J,Q,Z=Date.now()){if(this.spent.size>=this.sweepAt)this.sweep(Z);let W=this.spent.get(J);if(W!==void 0&&W>Z)return!1;return this.spent.set(J,Q),!0}get size(){return this.spent.size}sweep(J){for(let[Q,Z]of this.spent)if(Z<=J)this.spent.delete(Q);this.sweepAt=Math.max(1024,this.spent.size*2)}}class N{injectedClient;prefix;constructor(J={}){this.injectedClient=J.client,this.prefix=J.prefix??"gemi:ai:nonce"}async consume(J,Q){let Z=Math.max(1,Math.ceil(Q-Date.now()));return await this.client.send("SET",[`${this.prefix}:${J}`,"1","PX",String(Z),"NX"])==="OK"}get client(){if(this.injectedClient)return this.injectedClient;let J=P(),Q=J.bound(M)?J.make(M).client:void 0;if(!Q)throw Error("RedisNonceStore could not reach the Redis client. Register RedisServiceProvider on your application, or pass a client: new RedisNonceStore({ client }).");return Q}}var S=new C;class D extends Error{retryable;constructor(J,Q={}){super(J,Q.cause!==void 0?{cause:Q.cause}:void 0);this.name="ToolError",this.retryable=Q.retryable??!0}}var u={provider_error:"The model provider returned an error.",rate_limited:"The model provider is rate limiting requests. Try again shortly.",context_length_exceeded:"The conversation is too long for the model.",content_filtered:"The model provider's content filter blocked this request.",invalid_tool_input:"The model provider rejected the request.",tool_error:"A tool failed.",unknown:"The run failed unexpectedly."};function V(J,Q){if(Q.source==="tool"){if(Q.cause instanceof D)return J;return{...J,message:`The tool "${Q.toolName}" failed with an unexpected error.`}}let Z=u[J.code];return Z===void 0?J:{...J,message:Z}}function e(J,Q,Z,W){let $;try{$=(J??V)(Q,Z)}catch(X){W(X),$=V(Q,Z)}return{code:$.code,message:$.message,...$.toolCallId!==void 0?{toolCallId:$.toolCallId}:{},retryable:$.retryable}}var L=new WeakMap;function JJ(J,Q){if(J!==Q)L.set(J,Q)}function QJ(J){return L.get(J)??J}import{createHmac as E,hkdfSync as m,randomBytes as k,timingSafeEqual as d}from"crypto";var z="agt2",j="agt1",O=[z,j],G=86400000,p=Date.now()+G;function f(J){return J<=p}var v="gemi.ai.pending-call.v1",I="gemi.ai.nested-run.v1",l="gemi.ai.execution-receipt.v1",t="gemi.ai.signing",b=new Map;function H(J,Q){let Z=K(Q),W=`${J}\x00${Z}`,$=b.get(W);if(!$){if($=Buffer.from(m("sha256",Z,t,J,32)),b.size>64)b.clear();b.set(W,$)}return $}function K(J){let Q=J??process.env.SECRET;if(!Q)throw Error("Signing a pending tool call needs an app secret. Set SECRET in the environment.");return Q}function q(J){if(J===null||typeof J!=="object")return JSON.stringify(J)??"null";if(Array.isArray(J))return`[${J.map(q).join(",")}]`;let Q=J;return`{${Object.keys(Q).filter((W)=>Q[W]!==void 0).sort().map((W)=>`${JSON.stringify(W)}:${q(Q[W])}`).join(",")}}`}function c(J){return J.map((Q)=>`${Q.length}:${Q}`).join("")}function B(J,Q){return E("sha256",J).update(c(Q)).digest()}function x(J,Q){let Z=Buffer.from(J.split(".")[4],"base64url");return Z.length===Q.length&&d(Z,Q)}function U(J){return q(J??null)}function R(J,Q,Z){return[z,J.runId,J.toolCallId,J.name,J.kind,Q,String(Z),q(J.input),q(J.path??[]),U(J.subject)]}function n(J,Q,Z){let W=[j,J.runId,J.toolCallId,J.name,J.kind,Q,String(Z),q(J.input)];if(J.path&&J.path.length>0)W.push(q(J.path));return W}var T=(J)=>Buffer.from(J,"utf8").toString("base64url"),o=(J)=>Buffer.from(J,"base64url").toString("utf8");function qJ(J,Q={}){let Z=H(v,Q.secret),$=(Q.now??Date.now())+(Q.ttlMs??G),X=k(12).toString("base64url"),h=B(Z,R(J,X,$)).toString("base64url");return[z,T(J.runId),X,$.toString(36),h].join(".")}function a(J){return Y(J,O)}function Y(J,Q){let Z=J.split(".");if(Z.length!==5||!Q.includes(Z[0]))return null;let W=Number.parseInt(Z[3],36);if(!Number.isFinite(W))return null;try{return{runId:o(Z[1]),nonce:Z[2],expiresAt:W,version:Z[0]}}catch{return null}}function XJ(J,Q,Z={}){let W=Y(J,O);if(!W)return{ok:!1,reason:"malformed"};if(W.version===j&&!f(W.expiresAt))return{ok:!1,reason:"forged"};let $=W.version===j?B(K(Z.secret),n(Q,W.nonce,W.expiresAt)):B(H(v,Z.secret),R(Q,W.nonce,W.expiresAt));if(!x(J,$))return{ok:!1,reason:"forged"};if((Z.now??Date.now())>W.expiresAt)return{ok:!1,reason:"expired"};return{ok:!0,runId:W.runId,nonce:W.nonce,expiresAt:W.expiresAt}}var F="agn2",w="agn1",A=[F,w];function _(J,Q,Z){return[...y(J,Q,Z,F),U(J.subject)]}function y(J,Q,Z,W=w){return[W,J.runId,q(J.path),J.nestedRunId,Q,String(Z),q([...J.open].sort()),q(J.input)]}function BJ(J,Q={}){let Z=H(I,Q.secret),$=(Q.now??Date.now())+(Q.ttlMs??G),X=k(12).toString("base64url"),h=B(Z,_(J,X,$)).toString("base64url");return[F,T(J.runId),X,$.toString(36),h].join(".")}function HJ(J,Q,Z={}){let W=Y(J,A);if(!W)return{ok:!1,reason:"malformed"};if(W.version===w&&!f(W.expiresAt))return{ok:!1,reason:"forged"};let $={...Q,runId:W.runId},X=W.version===w?B(K(Z.secret),y($,W.nonce,W.expiresAt)):B(H(I,Z.secret),_($,W.nonce,W.expiresAt));if(!x(J,X))return{ok:!1,reason:"forged"};if((Z.now??Date.now())>W.expiresAt)return{ok:!1,reason:"expired"};return{ok:!0,runId:W.runId,nonce:W.nonce,expiresAt:W.expiresAt}}function bJ(J,Q,Z={}){let W=H(l,Z.secret);return B(W,[J,Q.runId,Q.toolCallId,Q.name,Q.kind,q(Q.input),q(Q.path??[]),U(Q.subject)]).toString("base64url")}function jJ(J,Q){return g(Q,a(J))}function wJ(J,Q){return g(Q,Y(J,A))}async function g(J,Q){if(!Q)return!1;return J.consume(Q.nonce,Q.expiresAt)}
-export{C as Sb,N as Tb,S as Ub,H as Vb,q as Wb,qJ as Xb,a as Yb,XJ as Zb,BJ as _b,HJ as $b,bJ as ac,jJ as bc,wJ as cc,D as dc,V as ec,e as fc,JJ as gc,QJ as hc};
+import{Cg as M}from"./chunk-3zxfd7pn.js";import{Ri as P}from"./chunk-g5ppst76.js";class C{spent=new Map;sweepAt=1024;async consume(J,Q){return this.consumeSync(J,Q)}consumeSync(J,Q,Z=Date.now()){if(this.spent.size>=this.sweepAt)this.sweep(Z);let W=this.spent.get(J);if(W!==void 0&&W>Z)return!1;return this.spent.set(J,Q),!0}get size(){return this.spent.size}sweep(J){for(let[Q,Z]of this.spent)if(Z<=J)this.spent.delete(Q);this.sweepAt=Math.max(1024,this.spent.size*2)}}class N{injectedClient;prefix;constructor(J={}){this.injectedClient=J.client,this.prefix=J.prefix??"gemi:ai:nonce"}async consume(J,Q){let Z=Math.max(1,Math.ceil(Q-Date.now()));return await this.client.send("SET",[`${this.prefix}:${J}`,"1","PX",String(Z),"NX"])==="OK"}get client(){if(this.injectedClient)return this.injectedClient;let J=P(),Q=J.bound(M)?J.make(M).client:void 0;if(!Q)throw Error("RedisNonceStore could not reach the Redis client. Register RedisServiceProvider on your application, or pass a client: new RedisNonceStore({ client }).");return Q}}var S=new C;class D extends Error{retryable;constructor(J,Q={}){super(J,Q.cause!==void 0?{cause:Q.cause}:void 0);this.name="ToolError",this.retryable=Q.retryable??!0}}var u={provider_error:"The model provider returned an error.",rate_limited:"The model provider is rate limiting requests. Try again shortly.",context_length_exceeded:"The conversation is too long for the model.",content_filtered:"The model provider's content filter blocked this request.",invalid_tool_input:"The model provider rejected the request.",tool_error:"A tool failed.",unknown:"The run failed unexpectedly."};function V(J,Q){if(Q.source==="tool"){if(Q.cause instanceof D)return J;return{...J,message:`The tool "${Q.toolName}" failed with an unexpected error.`}}let Z=u[J.code];return Z===void 0?J:{...J,message:Z}}function e(J,Q,Z,W){let $;try{$=(J??V)(Q,Z)}catch(X){W(X),$=V(Q,Z)}return{code:$.code,message:$.message,...$.toolCallId!==void 0?{toolCallId:$.toolCallId}:{},retryable:$.retryable}}var L=new WeakMap;function JJ(J,Q){if(J!==Q)L.set(J,Q)}function QJ(J){return L.get(J)??J}import{createHmac as E,hkdfSync as m,randomBytes as k,timingSafeEqual as d}from"crypto";var z="agt2",j="agt1",O=[z,j],G=86400000,p=Date.now()+G;function f(J){return J<=p}var v="gemi.ai.pending-call.v1",I="gemi.ai.nested-run.v1",l="gemi.ai.execution-receipt.v1",t="gemi.ai.signing",b=new Map;function H(J,Q){let Z=K(Q),W=`${J}\x00${Z}`,$=b.get(W);if(!$){if($=Buffer.from(m("sha256",Z,t,J,32)),b.size>64)b.clear();b.set(W,$)}return $}function K(J){let Q=J??process.env.SECRET;if(!Q)throw Error("Signing a pending tool call needs an app secret. Set SECRET in the environment.");return Q}function q(J){if(J===null||typeof J!=="object")return JSON.stringify(J)??"null";if(Array.isArray(J))return`[${J.map(q).join(",")}]`;let Q=J;return`{${Object.keys(Q).filter((W)=>Q[W]!==void 0).sort().map((W)=>`${JSON.stringify(W)}:${q(Q[W])}`).join(",")}}`}function c(J){return J.map((Q)=>`${Q.length}:${Q}`).join("")}function B(J,Q){return E("sha256",J).update(c(Q)).digest()}function x(J,Q){let Z=Buffer.from(J.split(".")[4],"base64url");return Z.length===Q.length&&d(Z,Q)}function U(J){return q(J??null)}function R(J,Q,Z){return[z,J.runId,J.toolCallId,J.name,J.kind,Q,String(Z),q(J.input),q(J.path??[]),U(J.subject)]}function n(J,Q,Z){let W=[j,J.runId,J.toolCallId,J.name,J.kind,Q,String(Z),q(J.input)];if(J.path&&J.path.length>0)W.push(q(J.path));return W}var T=(J)=>Buffer.from(J,"utf8").toString("base64url"),o=(J)=>Buffer.from(J,"base64url").toString("utf8");function qJ(J,Q={}){let Z=H(v,Q.secret),$=(Q.now??Date.now())+(Q.ttlMs??G),X=k(12).toString("base64url"),h=B(Z,R(J,X,$)).toString("base64url");return[z,T(J.runId),X,$.toString(36),h].join(".")}function a(J){return Y(J,O)}function Y(J,Q){let Z=J.split(".");if(Z.length!==5||!Q.includes(Z[0]))return null;let W=Number.parseInt(Z[3],36);if(!Number.isFinite(W))return null;try{return{runId:o(Z[1]),nonce:Z[2],expiresAt:W,version:Z[0]}}catch{return null}}function XJ(J,Q,Z={}){let W=Y(J,O);if(!W)return{ok:!1,reason:"malformed"};if(W.version===j&&!f(W.expiresAt))return{ok:!1,reason:"forged"};let $=W.version===j?B(K(Z.secret),n(Q,W.nonce,W.expiresAt)):B(H(v,Z.secret),R(Q,W.nonce,W.expiresAt));if(!x(J,$))return{ok:!1,reason:"forged"};if((Z.now??Date.now())>W.expiresAt)return{ok:!1,reason:"expired"};return{ok:!0,runId:W.runId,nonce:W.nonce,expiresAt:W.expiresAt}}var F="agn2",w="agn1",A=[F,w];function _(J,Q,Z){return[...y(J,Q,Z,F),U(J.subject)]}function y(J,Q,Z,W=w){return[W,J.runId,q(J.path),J.nestedRunId,Q,String(Z),q([...J.open].sort()),q(J.input)]}function BJ(J,Q={}){let Z=H(I,Q.secret),$=(Q.now??Date.now())+(Q.ttlMs??G),X=k(12).toString("base64url"),h=B(Z,_(J,X,$)).toString("base64url");return[F,T(J.runId),X,$.toString(36),h].join(".")}function HJ(J,Q,Z={}){let W=Y(J,A);if(!W)return{ok:!1,reason:"malformed"};if(W.version===w&&!f(W.expiresAt))return{ok:!1,reason:"forged"};let $={...Q,runId:W.runId},X=W.version===w?B(K(Z.secret),y($,W.nonce,W.expiresAt)):B(H(I,Z.secret),_($,W.nonce,W.expiresAt));if(!x(J,X))return{ok:!1,reason:"forged"};if((Z.now??Date.now())>W.expiresAt)return{ok:!1,reason:"expired"};return{ok:!0,runId:W.runId,nonce:W.nonce,expiresAt:W.expiresAt}}function bJ(J,Q,Z={}){let W=H(l,Z.secret);return B(W,[J,Q.runId,Q.toolCallId,Q.name,Q.kind,q(Q.input),q(Q.path??[]),U(Q.subject)]).toString("base64url")}function jJ(J,Q){return g(Q,a(J))}function wJ(J,Q){return g(Q,Y(J,A))}async function g(J,Q){if(!Q)return!1;return J.consume(Q.nonce,Q.expiresAt)}
+export{C as Ub,N as Vb,S as Wb,H as Xb,q as Yb,qJ as Zb,a as _b,XJ as $b,BJ as ac,HJ as bc,bJ as cc,jJ as dc,wJ as ec,D as fc,V as gc,e as hc,JJ as ic,QJ as jc};
 
-//# debugId=9F5261FBB47F185564756E2164756E21
+//# debugId=50FECCE9F573BC6B64756E2164756E21

package/dist/{chunk-4088szy9.js.map → chunk-39kyz4k6.js.map}

@@ -7,6 +7,6 @@
     "import { createHmac, hkdfSync, randomBytes, timingSafeEqual } from \"crypto\";\nimport { defaultNonceStore, type NonceStore } from \"./store/Nonces\";\n\n/**\n * Signing for pending tool calls.\n *\n * A pending call travels through the browser and comes back — in stateless mode\n * the whole history does — so the server cannot trust that what it gets back is\n * what it sent. Without a signature the client asserts not just *that* a call\n * was approved but *what* was approved, and nothing would stop it from\n * returning `approve: true` against an input it rewrote on the way. Signing is\n * what makes the round trip safe, and it is why approvals need no server-side\n * storage at all.\n *\n * What is signed, and what deliberately is not:\n *\n *   signed — `runId`, `toolCallId`, the tool `name`, the `kind` of pending call\n *            and a canonical serialization of the input, plus a nonce, an\n *            expiry, and — for a call a sub-agent asked — the `path` of\n *            tool-call ids it is nested under.\n *   not    — the client's answer. `approve: true` / `approve: false` and a\n *            question's output are the *point* of asking; a client that flips\n *            its own answer has refused, not forged. What the signature buys is\n *            that the answer is bound to the call the server actually made,\n *            with the input the server actually saw.\n *\n * A verified token is not yet an answer the server may act on: it says the\n * question was asked, not that it is still open. `consumePendingCall` at the\n * bottom of this file spends the nonce, which is what makes an approval\n * single-use — see the note there for what that guarantee is worth.\n *\n * `kind` is in there for a specific attack: an `approval`-kind call is one the\n * *server* runs, so a client that reused its signature on the \"here is the\n * output\" arm of `ClientToolResult` would be fabricating a server tool's result\n * rather than approving it. Binding the kind makes that a forgery instead of a\n * shape the caller has to remember to check.\n *\n * Keys and principals (#447). Neither token kind is MACed with `SECRET`\n * itself: each is keyed with its own HKDF-derived key (`purposeKey` below), so\n * a MAC minted for one purpose — a pending call, a parked-run record, or\n * anything else in the app keyed off `SECRET` (CSRF, sessions) — is never a\n * MAC for another. And each binds the `subject`, the principal the run was\n * started for (`AgentController.runOwner`), so a token minted while user A was\n * asked cannot be answered by user B, even with A's history in hand.\n */\n\n/** Everything the signature commits to. */\nexport type PendingCallClaims = {\n  runId: string;\n  toolCallId: string;\n  name: string;\n  kind: \"approval\" | \"question\" | \"client\";\n  input: unknown;\n  /**\n   * The chain of tool-call ids the call is nested under, outermost first.\n   * Absent — or empty, which means the same thing — for a top-level call.\n   *\n   * A sub-agent's question reaches the user through its parent's pending list,\n   * so `toolCallId` stops being an address on its own: two sub-runs under two\n   * different tools can each hold a call the outer run never made. Binding the\n   * path is what stops a token minted for a call nested under tool call X from\n   * being replayed as a top-level call, or as one nested under Y.\n   */\n  path?: string[];\n  /**\n   * Who the question was asked of: the run's owner (`AgentController.runOwner`,\n   * `user:<id>` by default). `null` or absent is nobody in particular — an\n   * anonymous run — and the two are the same claim. A token minted for one\n   * subject fails verification for any other, `null` included, so an approval\n   * cannot be carried from one user's session to another's.\n   */\n  subject?: string | null;\n};\n\nexport type SignOptions = {\n  /** Overrides `process.env.SECRET`. Exists for tests; apps use the app key. */\n  secret?: string;\n  /**\n   * Default 24 hours. An approval waits on a human, and humans go to lunch —\n   * a short expiry turns \"I approved it after standup\" into an unexplained\n   * failure. Long enough to survive a working day, short enough that a token\n   * lifted from a log is not useful next month.\n   */\n  ttlMs?: number;\n  /** Injected clock, so the expiry path is testable without waiting. */\n  now?: number;\n};\n\nexport type VerifyOptions = {\n  secret?: string;\n  now?: number;\n};\n\n/**\n * A discriminated result rather than a boolean, because the two failures are\n * different events: `expired` is a sentence to show the user, `forged` is worth\n * logging and possibly alerting on. Collapsing them loses the only signal that\n * says someone is probing.\n */\nexport type VerifyResult =\n  | { ok: true; runId: string; nonce: string; expiresAt: number }\n  | { ok: false; reason: \"malformed\" | \"expired\" | \"forged\" };\n\n/**\n * `agt2` is minted; `agt1` is still verified. A v1 token was MACed with the raw\n * `SECRET` and binds no subject — it is accepted so that a question asked\n * before the upgrade can still be answered after it, and it stops mattering on\n * its own when the last one expires (`DEFAULT_TTL_MS` after the deploy). Drop\n * `LEGACY_VERSION` from the accepted set once that window is long past.\n */\nconst VERSION = \"agt2\";\nconst LEGACY_VERSION = \"agt1\";\nconst PENDING_VERSIONS = [VERSION, LEGACY_VERSION];\nconst DEFAULT_TTL_MS = 24 * 60 * 60 * 1000;\n\n/**\n * The latest expiry a legacy token may claim. Every v1 token this process can\n * legitimately see was minted by an earlier deploy with the default TTL, so it\n * expires no later than one TTL after this module loaded. Bounding it here\n * means a v1 token — MACed with the raw `SECRET`, the key this change exists to\n * stop relying on — cannot be forged with a far-future expiry, and that after\n * one TTL of uptime no v1 token verifies at all.\n */\nconst LEGACY_ACCEPTED_UNTIL = Date.now() + DEFAULT_TTL_MS;\n\nfunction legacyExpiryOk(expiresAt: number): boolean {\n  return expiresAt <= LEGACY_ACCEPTED_UNTIL;\n}\n\n/**\n * HKDF `info` labels, one per thing a key signs. Changing a label is a key\n * rotation for that purpose alone.\n */\nconst PENDING_CALL_PURPOSE = \"gemi.ai.pending-call.v1\";\nconst NESTED_RUN_PURPOSE = \"gemi.ai.nested-run.v1\";\nconst EXECUTION_RECEIPT_PURPOSE = \"gemi.ai.execution-receipt.v1\";\nconst HKDF_SALT = \"gemi.ai.signing\";\n\nconst derivedKeys = new Map<string, Buffer>();\n\n/**\n * A key for one purpose, derived from the app secret with HKDF-SHA256.\n *\n * `SECRET` is also what CSRF tokens and sessions are keyed with. Using it as\n * the HMAC key here would make every one of those a potential oracle for the\n * others; HKDF with a purpose label gives each its own independent key, so a\n * weakness or leak in one use cannot be turned against another — including\n * the two token kinds in this file against each other.\n *\n * Memoized per (purpose, secret): verification is on the request path and the\n * derivation is pure. The map is bounded by the number of purposes times the\n * secrets a process ever sees, which is one outside of tests.\n */\nexport function purposeKey(purpose: string, override?: string): Buffer {\n  const secret = secretKey(override);\n  const cacheKey = `${purpose}\\u0000${secret}`;\n  let key = derivedKeys.get(cacheKey);\n  if (!key) {\n    key = Buffer.from(hkdfSync(\"sha256\", secret, HKDF_SALT, purpose, 32));\n    if (derivedKeys.size > 64) derivedKeys.clear();\n    derivedKeys.set(cacheKey, key);\n  }\n  return key;\n}\n\nfunction secretKey(override?: string): string {\n  const secret = override ?? process.env.SECRET;\n  if (!secret) {\n    // Refusing is the only safe answer. A fallback constant would make every\n    // approval in every deployment forgeable by anyone who read this file, and\n    // it would do it silently — the feature would appear to work.\n    throw new Error(\n      \"Signing a pending tool call needs an app secret. Set SECRET in the environment.\",\n    );\n  }\n  return secret;\n}\n\n/**\n * Serializes a value so that the same value always produces the same string.\n *\n * `JSON.stringify` is not enough: it preserves insertion order, so an input\n * that made a round trip through a client — parsed and re-serialized, with the\n * keys in whatever order the parser produced — would hash differently and a\n * legitimate approval would come back looking forged. Keys are sorted,\n * `undefined` members are dropped (they do not survive JSON anyway), and arrays\n * keep their order because in an array order *is* the value.\n */\nexport function canonicalize(value: unknown): string {\n  if (value === null || typeof value !== \"object\") {\n    return JSON.stringify(value) ?? \"null\";\n  }\n  if (Array.isArray(value)) {\n    return `[${value.map(canonicalize).join(\",\")}]`;\n  }\n  const record = value as Record<string, unknown>;\n  const keys = Object.keys(record)\n    .filter((key) => record[key] !== undefined)\n    .sort();\n  return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalize(record[key])}`).join(\",\")}}`;\n}\n\n/**\n * Length-prefixed rather than delimiter-joined. A separator is a place for two\n * different claim sets to hash the same — `runId: \"a\", toolCallId: \"b|c\"` and\n * `runId: \"a|b\", toolCallId: \"c\"` — and while neither field contains the\n * separator today, that is a property of the id generator, not of this code.\n */\nfunction payload(fields: string[]): string {\n  return fields.map((field) => `${field.length}:${field}`).join(\"\");\n}\n\nfunction mac(key: string | Buffer, fields: string[]): Buffer {\n  return createHmac(\"sha256\", key).update(payload(fields)).digest();\n}\n\nfunction macMatches(signature: string, expected: Buffer): boolean {\n  const presented = Buffer.from(signature.split(\".\")[4], \"base64url\");\n  // `timingSafeEqual` throws on a length mismatch, and a wrong length is\n  // already a public fact about the token — nothing is leaked by checking it\n  // first, and everything is leaked by comparing the bytes with `===`.\n  return presented.length === expected.length && timingSafeEqual(presented, expected);\n}\n\n/** The principal as a field: absent and `null` are the same claim. */\nfunction subjectField(subject: string | null | undefined): string {\n  return canonicalize(subject ?? null);\n}\n\n/**\n * The v2 claim set. Fixed-length: the path is always present (`[]` at the top\n * level) and so is the subject, so there is no optional field to reason about.\n */\nfunction claimFields(claims: PendingCallClaims, nonce: string, expiresAt: number): string[] {\n  return [\n    VERSION,\n    claims.runId,\n    claims.toolCallId,\n    claims.name,\n    claims.kind,\n    nonce,\n    String(expiresAt),\n    canonicalize(claims.input),\n    canonicalize(claims.path ?? []),\n    subjectField(claims.subject),\n  ];\n}\n\n/**\n * The v1 claim set, kept only to verify tokens minted before #447.\n *\n * The path is appended, and only when there is one.\n *\n * Byte-identical output for a call with no path is the whole requirement here:\n * every approval already in flight was minted from the eight fields below, and\n * a ninth field carrying `\"[]\"` or `\"undefined\"` would invalidate all of them\n * on deploy — the user who clicked Approve before the release would be told\n * their answer was forged. So an absent path adds nothing at all, and an empty\n * array is treated as absent because it says the same thing.\n *\n * `payload` is length-prefixed, so appending a field cannot collide with a\n * longer value in the one before it; that is why this can be an append rather\n * than a new version tag.\n */\nfunction legacyClaimFields(claims: PendingCallClaims, nonce: string, expiresAt: number): string[] {\n  const fields = [\n    LEGACY_VERSION,\n    claims.runId,\n    claims.toolCallId,\n    claims.name,\n    claims.kind,\n    nonce,\n    String(expiresAt),\n    canonicalize(claims.input),\n  ];\n  if (claims.path && claims.path.length > 0) {\n    fields.push(canonicalize(claims.path));\n  }\n  return fields;\n}\n\nconst encode = (value: string) => Buffer.from(value, \"utf8\").toString(\"base64url\");\nconst decode = (value: string) => Buffer.from(value, \"base64url\").toString(\"utf8\");\n\n/** `agt2.<runId>.<nonce>.<expiry>.<mac>`, all base64url or base36. */\nexport function signPendingCall(claims: PendingCallClaims, options: SignOptions = {}): string {\n  const key = purposeKey(PENDING_CALL_PURPOSE, options.secret);\n  const now = options.now ?? Date.now();\n  const expiresAt = now + (options.ttlMs ?? DEFAULT_TTL_MS);\n  const nonce = randomBytes(12).toString(\"base64url\");\n  const signature = mac(key, claimFields(claims, nonce, expiresAt)).toString(\"base64url\");\n  return [VERSION, encode(claims.runId), nonce, expiresAt.toString(36), signature].join(\".\");\n}\n\n/**\n * The metadata a signature carries in the clear.\n *\n * `Agent` needs the issuing `runId` before it can verify anything: the call was\n * signed under the run that made it, and the turn answering it is a *new* run\n * with a new id. Reading it out of the token is safe because the token's own\n * MAC covers it — a client that edits the runId here fails verification, so\n * this is \"which run does this claim to belong to\", not \"which run does the\n * client say it belongs to\".\n */\nexport function readSignature(\n  signature: string,\n): { runId: string; nonce: string; expiresAt: number } | null {\n  return readToken(signature, PENDING_VERSIONS);\n}\n\n/**\n * The version tag is checked here and nowhere else, which is what keeps the\n * two token kinds apart: a parked-run record presented where a pending call's\n * signature is expected fails as malformed before its MAC is even looked at,\n * and the other way round. Their claim sets are different lengths and would\n * not collide anyway, but a tag makes that a rule rather than an accident of\n * the field count.\n */\nfunction readToken(\n  signature: string,\n  versions: readonly string[],\n): { runId: string; nonce: string; expiresAt: number; version: string } | null {\n  const parts = signature.split(\".\");\n  if (parts.length !== 5 || !versions.includes(parts[0])) {\n    return null;\n  }\n  const expiresAt = Number.parseInt(parts[3], 36);\n  if (!Number.isFinite(expiresAt)) {\n    return null;\n  }\n  try {\n    return { runId: decode(parts[1]), nonce: parts[2], expiresAt, version: parts[0] };\n  } catch {\n    return null;\n  }\n}\n\nexport function verifyPendingCall(\n  signature: string,\n  claims: PendingCallClaims,\n  options: VerifyOptions = {},\n): VerifyResult {\n  const parsed = readToken(signature, PENDING_VERSIONS);\n  if (!parsed) {\n    return { ok: false, reason: \"malformed\" };\n  }\n\n  if (parsed.version === LEGACY_VERSION && !legacyExpiryOk(parsed.expiresAt)) {\n    return { ok: false, reason: \"forged\" };\n  }\n  const expected =\n    parsed.version === LEGACY_VERSION\n      ? // Raw secret, no subject: see `LEGACY_VERSION`.\n        mac(secretKey(options.secret), legacyClaimFields(claims, parsed.nonce, parsed.expiresAt))\n      : mac(\n          purposeKey(PENDING_CALL_PURPOSE, options.secret),\n          claimFields(claims, parsed.nonce, parsed.expiresAt),\n        );\n  if (!macMatches(signature, expected)) {\n    return { ok: false, reason: \"forged\" };\n  }\n\n  // Expiry is checked *after* the MAC on purpose: only a genuine token can be\n  // \"expired\". Reporting a forgery as expired would tell the UI to say \"your\n  // approval timed out\" to someone who was tampering.\n  if ((options.now ?? Date.now()) > parsed.expiresAt) {\n    return { ok: false, reason: \"expired\" };\n  }\n\n  return { ok: true, runId: parsed.runId, nonce: parsed.nonce, expiresAt: parsed.expiresAt };\n}\n\n// --- parked sub-runs -----------------------------------------------------\n\n/**\n * What a parked sub-run's record is signed over.\n *\n * `ToolCallPart.nested` is the parent's own record of where a sub-run stopped,\n * and in stateless mode it makes the same trip through the browser a pending\n * call does. The next turn *runs a tool* on the strength of that record — the\n * tool is re-entered because the record says a sub-run under it is waiting on\n * the question being answered — so an unsigned record lets the client choose\n * which tools run, with what input, before any answer is verified. A MAC over\n * what the server actually recorded is what makes the record safe to carry.\n *\n * Only a parked record is signed, because only a parked record executes\n * anything: a finished sub-run is replayed out of its transcript and spends\n * nothing, and a client that forges one has fed its own tool a made-up answer,\n * which a client-carried history already allows everywhere.\n *\n * Deliberately not signed: the transcript. The sub-run resumes from messages\n * the client carried, exactly as the parent does in stateless mode, and the\n * same argument applies — what the signature pins is that the server parked\n * *here*, on *these* calls, with *this* input, and not what was said on the\n * way.\n */\nexport type NestedRunClaims = {\n  /** The root run's id, the one every pending call of the tree is minted under. */\n  runId: string;\n  /**\n   * Tool-call ids from the root down to and including the call the record\n   * hangs off. A sub-run's id is not an address on its own for the same reason\n   * a nested call's is not: two sub-runs under two different tools can carry\n   * the same one.\n   */\n  path: string[];\n  /** The sub-run's own id, so a record cannot be moved between sub-runs. */\n  nestedRunId: string;\n  /** The tool calls the sub-run is waiting on: every call left open in its transcript. */\n  open: string[];\n  /**\n   * The input the tool that parked was running on, as the transcript carries\n   * it. Re-entry runs the tool body with the input the history holds, and the\n   * history is the client's — so a record that pinned where the sub-run parked\n   * but not what its tool was given would let the client keep the run and\n   * rewrite the arguments to anything the schema accepts. The same bargain a\n   * pending call makes: the input executed is the input signed.\n   */\n  input: unknown;\n  /** The run's owner, as on `PendingCallClaims.subject`: a record parked for\n   *  one principal does not re-enter a tool for another. */\n  subject?: string | null;\n};\n\n/** `agn2` is minted; `agn1` (raw secret, no subject) is still verified. See\n *  `LEGACY_VERSION`. */\nconst NESTED_VERSION = \"agn2\";\nconst LEGACY_NESTED_VERSION = \"agn1\";\nconst NESTED_VERSIONS = [NESTED_VERSION, LEGACY_NESTED_VERSION];\n\nfunction nestedFields(claims: NestedRunClaims, nonce: string, expiresAt: number): string[] {\n  return [\n    ...legacyNestedFields(claims, nonce, expiresAt, NESTED_VERSION),\n    subjectField(claims.subject),\n  ];\n}\n\nfunction legacyNestedFields(\n  claims: NestedRunClaims,\n  nonce: string,\n  expiresAt: number,\n  version = LEGACY_NESTED_VERSION,\n): string[] {\n  return [\n    version,\n    claims.runId,\n    canonicalize(claims.path),\n    claims.nestedRunId,\n    nonce,\n    String(expiresAt),\n    // A set, so it is sorted: the ids are read back out of a transcript the\n    // client re-serialized, and message order is not part of the claim.\n    canonicalize([...claims.open].sort()),\n    canonicalize(claims.input),\n  ];\n}\n\n/**\n * Same shape as a pending call's token, so the same reader serves both — nonce\n * included, and the nonce is spent, by `consumeNestedRun` below. A verified\n * record is permission to run the tool it hangs off, and the tool body runs\n * before the sub-run gets to look at the answer's own nonce; a record that\n * could be presented twice would run the body twice before anything refused\n * the replay. Every park mints a fresh record, so spending one costs a\n * legitimate re-park nothing.\n */\nexport function signNestedRun(claims: NestedRunClaims, options: SignOptions = {}): string {\n  const key = purposeKey(NESTED_RUN_PURPOSE, options.secret);\n  const now = options.now ?? Date.now();\n  const expiresAt = now + (options.ttlMs ?? DEFAULT_TTL_MS);\n  const nonce = randomBytes(12).toString(\"base64url\");\n  const signature = mac(key, nestedFields(claims, nonce, expiresAt)).toString(\"base64url\");\n  return [NESTED_VERSION, encode(claims.runId), nonce, expiresAt.toString(36), signature].join(\".\");\n}\n\n/**\n * The run that verifies a record is never the run that minted it — the turn\n * answering a question is a new run with a new id — so the minting run's id is\n * read out of the token rather than asked of the caller, which has no other\n * source for it. The MAC covers it, so a client that edits the id in the clear\n * fails here rather than being believed.\n */\nexport function verifyNestedRun(\n  signature: string,\n  claims: Omit<NestedRunClaims, \"runId\">,\n  options: VerifyOptions = {},\n): VerifyResult {\n  const parsed = readToken(signature, NESTED_VERSIONS);\n  if (!parsed) {\n    return { ok: false, reason: \"malformed\" };\n  }\n\n  if (parsed.version === LEGACY_NESTED_VERSION && !legacyExpiryOk(parsed.expiresAt)) {\n    return { ok: false, reason: \"forged\" };\n  }\n  const full = { ...claims, runId: parsed.runId };\n  const expected =\n    parsed.version === LEGACY_NESTED_VERSION\n      ? mac(secretKey(options.secret), legacyNestedFields(full, parsed.nonce, parsed.expiresAt))\n      : mac(\n          purposeKey(NESTED_RUN_PURPOSE, options.secret),\n          nestedFields(full, parsed.nonce, parsed.expiresAt),\n        );\n  if (!macMatches(signature, expected)) {\n    return { ok: false, reason: \"forged\" };\n  }\n\n  // A parked record outlives its usefulness with the answers it exists to\n  // deliver: those expire on the pending call's TTL, and a record older than\n  // that can route nothing that would still verify.\n  if ((options.now ?? Date.now()) > parsed.expiresAt) {\n    return { ok: false, reason: \"expired\" };\n  }\n\n  return { ok: true, runId: parsed.runId, nonce: parsed.nonce, expiresAt: parsed.expiresAt };\n}\n\n// --- single use ----------------------------------------------------------\n\n/**\n * Spending a nonce.\n *\n * The MAC makes a token unforgeable; it does not make it single-use. Without\n * this a captured signature approves the same call again every time it is\n * presented, because a token that carries its own `runId` is a token that\n * asserts its own binding — which is no binding at all. Verifying tells you the\n * server once asked this exact question; spending the nonce is what says nobody\n * has answered it yet.\n *\n * Where spent nonces live is a `NonceStore` (`store/Nonces.ts`, #445). The\n * default is the process-wide `MemoryNonceStore`, which is exact for one\n * instance; an app with several instances gives the agent a shared store\n * (`RedisNonceStore`, or a table) so a rewound history cannot be replayed once\n * against each of them. The store's `consume` is insert-if-absent, so two\n * instances answering at once cannot both win.\n *\n * The other guard is the app's own message store: once a call has a result\n * next to it, the call is no longer open and the answer has nothing to attach\n * to. This is what stands in for that in stateless mode, where the history the\n * client returns can be rewound to before the result existed.\n */\n\n/**\n * The id an approved call's execution receipt is kept under (#458).\n *\n * Deterministic in the call the signature covers — the issuing run, the tool\n * call id, the tool, its canonical input, the nesting path and the subject —\n * and in nothing else, so every presentation of one approval, on any instance,\n * names the same receipt. Not in the nonce or expiry: those identify one\n * *token*, and a receipt identifies the *execution* it authorizes.\n *\n * An HMAC under its own HKDF-derived key rather than a plain hash, so an id in\n * a shared store is neither a MAC for anything else nor something a client can\n * compute to probe the store for another user's calls.\n */\nexport function executionReceiptId(\n  agent: string,\n  claims: PendingCallClaims,\n  options: { secret?: string } = {},\n): string {\n  const key = purposeKey(EXECUTION_RECEIPT_PURPOSE, options.secret);\n  return mac(key, [\n    agent,\n    claims.runId,\n    claims.toolCallId,\n    claims.name,\n    claims.kind,\n    canonicalize(claims.input),\n    canonicalize(claims.path ?? []),\n    subjectField(claims.subject),\n  ]).toString(\"base64url\");\n}\n\n/**\n * Spends a signature's nonce in `store`. `false` means it was already spent —\n * the answer is a replay and must not be acted on — or the token is malformed.\n * A store that throws rejects; the caller refuses the answer.\n *\n * Separate from `verifyPendingCall` rather than folded into it, because verify\n * is a pure question a caller may want to ask twice (logging a forgery, say)\n * and this one is a state change that must happen exactly once per answer.\n */\nexport function spendPendingCall(signature: string, store: NonceStore): Promise<boolean> {\n  return spendIn(store, readSignature(signature));\n}\n\n/**\n * Spends a parked-run record's nonce, on the same store and the same terms.\n * `false` means the record has already re-entered its tool once — the turn is\n * a replay of a history from before the answer was delivered, and the body\n * must not run again on it.\n */\nexport function spendNestedRun(signature: string, store: NonceStore): Promise<boolean> {\n  return spendIn(store, readToken(signature, NESTED_VERSIONS));\n}\n\nasync function spendIn(\n  store: NonceStore,\n  parsed: { nonce: string; expiresAt: number } | null,\n): Promise<boolean> {\n  if (!parsed) return false;\n  return store.consume(parsed.nonce, parsed.expiresAt);\n}\n\n/** `spendPendingCall` on the process-wide default store, synchronously.\n *  `now` is injectable for tests. */\nexport function consumePendingCall(signature: string, options: VerifyOptions = {}): boolean {\n  const parsed = readSignature(signature);\n  return parsed\n    ? defaultNonceStore.consumeSync(parsed.nonce, parsed.expiresAt, options.now)\n    : false;\n}\n\n/** `spendNestedRun` on the process-wide default store, synchronously. */\nexport function consumeNestedRun(signature: string, options: VerifyOptions = {}): boolean {\n  const parsed = readToken(signature, NESTED_VERSIONS);\n  return parsed\n    ? defaultNonceStore.consumeSync(parsed.nonce, parsed.expiresAt, options.now)\n    : false;\n}\n"
   ],
   "mappings": ";wFA0DO,AAAM,CAAuC,CACjC,MAAQ,IAAI,IAGrB,QAAU,UAEZ,QAAO,CAAC,EAAe,EAAqC,CAChE,OAAO,KAAK,YAAY,EAAO,CAAS,EAO1C,WAAW,CAAC,EAAe,EAAmB,EAAM,KAAK,IAAI,EAAY,CACvE,GAAI,KAAK,MAAM,MAAQ,KAAK,QAAS,KAAK,MAAM,CAAG,EACnD,IAAM,EAAa,KAAK,MAAM,IAAI,CAAK,EAGvC,GAAI,IAAe,QAAa,EAAa,EAAK,MAAO,GAEzD,OADA,KAAK,MAAM,IAAI,EAAO,CAAS,EACxB,MAGL,KAAI,EAAW,CACjB,OAAO,KAAK,MAAM,KAGZ,KAAK,CAAC,EAAa,CACzB,QAAY,EAAO,KAAc,KAAK,MACpC,GAAI,GAAa,EAAK,KAAK,MAAM,OAAO,CAAK,EAE/C,KAAK,QAAU,KAAK,IAAI,KAAM,KAAK,MAAM,KAAO,CAAC,EAErD,CAmCO,MAAM,CAAsC,CAChC,eACA,OAEjB,WAAW,CAAC,EAAkC,CAAC,EAAG,CAChD,KAAK,eAAiB,EAAQ,OAC9B,KAAK,OAAS,EAAQ,QAAU,qBAG5B,QAAO,CAAC,EAAe,EAAqC,CAGhE,IAAM,EAAM,KAAK,IAAI,EAAG,KAAK,KAAK,EAAY,KAAK,IAAI,CAAC,CAAC,EASzD,OARc,MAAM,KAAK,OAAO,KAAK,MAAO,CAC1C,GAAG,KAAK,UAAU,IAClB,IACA,KACA,OAAO,CAAG,EACV,IACF,CAAC,IAEgB,QAGP,OAAM,EAAqB,CACrC,GAAI,KAAK,eAAgB,OAAO,KAAK,eACrC,IAAM,EAAY,EAAI,EAChB,EAAS,EAAU,MAAM,CAAY,EACvC,EAAU,KAAK,CAAY,EAAE,OAC7B,OACJ,GAAI,CAAC,EACH,MAAU,MACR,yJACF,EAEF,OAAO,EAEX,CAGO,IAAM,EAAoB,IAAI,ECvJ9B,MAAM,UAAkB,KAAM,CAE1B,UAET,WAAW,CAAC,EAAiB,EAAoD,CAAC,EAAG,CACnF,MAAM,EAAS,EAAQ,QAAU,OAAY,CAAE,MAAO,EAAQ,KAAM,EAAI,MAAS,EACjF,KAAK,KAAO,YACZ,KAAK,UAAY,EAAQ,WAAa,GAE1C,CAoCA,IAAM,EAAgE,CACpE,eAAgB,wCAChB,aAAc,mEACd,wBAAyB,8CACzB,iBAAkB,4DAClB,mBAAoB,2CACpB,WAAY,iBACZ,QAAS,8BACX,EAWO,SAAS,CAAW,CAAC,EAAmB,EAAsC,CACnF,GAAI,EAAK,SAAW,OAAQ,CAC1B,GAAI,EAAK,iBAAiB,EAAW,OAAO,EAC5C,MAAO,IACF,EACH,QAAS,aAAa,EAAK,4CAC7B,EAEF,IAAM,EAAU,EAAqB,EAAM,MAC3C,OAAO,IAAY,OAAY,EAAQ,IAAK,EAAO,QAAS,CAAQ,EAS/D,SAAS,CAAc,CAC5B,EACA,EACA,EACA,EACY,CACZ,IAAI,EACJ,GAAI,CACF,GAAO,GAAY,GAAa,EAAO,CAAI,EAC3C,MAAO,EAAK,CACZ,EAAU,CAAG,EACb,EAAM,EAAY,EAAO,CAAI,EAE/B,MAAO,CACL,KAAM,EAAI,KACV,QAAS,EAAI,WACT,EAAI,aAAe,OAAY,CAAE,WAAY,EAAI,UAAW,EAAI,CAAC,EACrE,UAAW,EAAI,SACjB,EASF,IAAM,EAAa,IAAI,QAEhB,SAAS,EAAkB,CAAC,EAAsB,EAA4B,CACnF,GAAI,IAAa,EAAU,EAAW,IAAI,EAAU,CAAQ,EAIvD,SAAS,EAAe,CAAC,EAA+B,CAC7D,OAAO,EAAW,IAAI,CAAK,GAAK,ECrIlC,qBAAS,cAAY,iBAAU,qBAAa,eA8G5C,IAAM,EAAU,OACV,EAAiB,OACjB,EAAmB,CAAC,EAAS,CAAc,EAC3C,EAAiB,SAUjB,EAAwB,KAAK,IAAI,EAAI,EAE3C,SAAS,CAAc,CAAC,EAA4B,CAClD,OAAO,GAAa,EAOtB,IAAM,EAAuB,0BACvB,EAAqB,wBACrB,EAA4B,+BAC5B,EAAY,kBAEZ,EAAc,IAAI,IAejB,SAAS,CAAU,CAAC,EAAiB,EAA2B,CACrE,IAAM,EAAS,EAAU,CAAQ,EAC3B,EAAW,GAAG,QAAgB,IAChC,EAAM,EAAY,IAAI,CAAQ,EAClC,GAAI,CAAC,EAAK,CAER,GADA,EAAM,OAAO,KAAK,EAAS,SAAU,EAAQ,EAAW,EAAS,EAAE,CAAC,EAChE,EAAY,KAAO,GAAI,EAAY,MAAM,EAC7C,EAAY,IAAI,EAAU,CAAG,EAE/B,OAAO,EAGT,SAAS,CAAS,CAAC,EAA2B,CAC5C,IAAM,EAAS,GAAY,QAAQ,IAAI,OACvC,GAAI,CAAC,EAIH,MAAU,MACR,iFACF,EAEF,OAAO,EAaF,SAAS,CAAY,CAAC,EAAwB,CACnD,GAAI,IAAU,MAAQ,OAAO,IAAU,SACrC,OAAO,KAAK,UAAU,CAAK,GAAK,OAElC,GAAI,MAAM,QAAQ,CAAK,EACrB,MAAO,IAAI,EAAM,IAAI,CAAY,EAAE,KAAK,GAAG,KAE7C,IAAM,EAAS,EAIf,MAAO,IAHM,OAAO,KAAK,CAAM,EAC5B,OAAO,CAAC,IAAQ,EAAO,KAAS,MAAS,EACzC,KAAK,EACQ,IAAI,CAAC,IAAQ,GAAG,KAAK,UAAU,CAAG,KAAK,EAAa,EAAO,EAAI,GAAG,EAAE,KAAK,GAAG,KAS9F,SAAS,CAAO,CAAC,EAA0B,CACzC,OAAO,EAAO,IAAI,CAAC,IAAU,GAAG,EAAM,UAAU,GAAO,EAAE,KAAK,EAAE,EAGlE,SAAS,CAAG,CAAC,EAAsB,EAA0B,CAC3D,OAAO,EAAW,SAAU,CAAG,EAAE,OAAO,EAAQ,CAAM,CAAC,EAAE,OAAO,EAGlE,SAAS,CAAU,CAAC,EAAmB,EAA2B,CAChE,IAAM,EAAY,OAAO,KAAK,EAAU,MAAM,GAAG,EAAE,GAAI,WAAW,EAIlE,OAAO,EAAU,SAAW,EAAS,QAAU,EAAgB,EAAW,CAAQ,EAIpF,SAAS,CAAY,CAAC,EAA4C,CAChE,OAAO,EAAa,GAAW,IAAI,EAOrC,SAAS,CAAW,CAAC,EAA2B,EAAe,EAA6B,CAC1F,MAAO,CACL,EACA,EAAO,MACP,EAAO,WACP,EAAO,KACP,EAAO,KACP,EACA,OAAO,CAAS,EAChB,EAAa,EAAO,KAAK,EACzB,EAAa,EAAO,MAAQ,CAAC,CAAC,EAC9B,EAAa,EAAO,OAAO,CAC7B,EAmBF,SAAS,CAAiB,CAAC,EAA2B,EAAe,EAA6B,CAChG,IAAM,EAAS,CACb,EACA,EAAO,MACP,EAAO,WACP,EAAO,KACP,EAAO,KACP,EACA,OAAO,CAAS,EAChB,EAAa,EAAO,KAAK,CAC3B,EACA,GAAI,EAAO,MAAQ,EAAO,KAAK,OAAS,EACtC,EAAO,KAAK,EAAa,EAAO,IAAI,CAAC,EAEvC,OAAO,EAGT,IAAM,EAAS,CAAC,IAAkB,OAAO,KAAK,EAAO,MAAM,EAAE,SAAS,WAAW,EAC3E,EAAS,CAAC,IAAkB,OAAO,KAAK,EAAO,WAAW,EAAE,SAAS,MAAM,EAG1E,SAAS,EAAe,CAAC,EAA2B,EAAuB,CAAC,EAAW,CAC5F,IAAM,EAAM,EAAW,EAAsB,EAAQ,MAAM,EAErD,GADM,EAAQ,KAAO,KAAK,IAAI,IACX,EAAQ,OAAS,GACpC,EAAQ,EAAY,EAAE,EAAE,SAAS,WAAW,EAC5C,EAAY,EAAI,EAAK,EAAY,EAAQ,EAAO,CAAS,CAAC,EAAE,SAAS,WAAW,EACtF,MAAO,CAAC,EAAS,EAAO,EAAO,KAAK,EAAG,EAAO,EAAU,SAAS,EAAE,EAAG,CAAS,EAAE,KAAK,GAAG,EAapF,SAAS,CAAa,CAC3B,EAC4D,CAC5D,OAAO,EAAU,EAAW,CAAgB,EAW9C,SAAS,CAAS,CAChB,EACA,EAC6E,CAC7E,IAAM,EAAQ,EAAU,MAAM,GAAG,EACjC,GAAI,EAAM,SAAW,GAAK,CAAC,EAAS,SAAS,EAAM,EAAE,EACnD,OAAO,KAET,IAAM,EAAY,OAAO,SAAS,EAAM,GAAI,EAAE,EAC9C,GAAI,CAAC,OAAO,SAAS,CAAS,EAC5B,OAAO,KAET,GAAI,CACF,MAAO,CAAE,MAAO,EAAO,EAAM,EAAE,EAAG,MAAO,EAAM,GAAI,YAAW,QAAS,EAAM,EAAG,EAChF,KAAM,CACN,OAAO,MAIJ,SAAS,EAAiB,CAC/B,EACA,EACA,EAAyB,CAAC,EACZ,CACd,IAAM,EAAS,EAAU,EAAW,CAAgB,EACpD,GAAI,CAAC,EACH,MAAO,CAAE,GAAI,GAAO,OAAQ,WAAY,EAG1C,GAAI,EAAO,UAAY,GAAkB,CAAC,EAAe,EAAO,SAAS,EACvE,MAAO,CAAE,GAAI,GAAO,OAAQ,QAAS,EAEvC,IAAM,EACJ,EAAO,UAAY,EAEf,EAAI,EAAU,EAAQ,MAAM,EAAG,EAAkB,EAAQ,EAAO,MAAO,EAAO,SAAS,CAAC,EACxF,EACE,EAAW,EAAsB,EAAQ,MAAM,EAC/C,EAAY,EAAQ,EAAO,MAAO,EAAO,SAAS,CACpD,EACN,GAAI,CAAC,EAAW,EAAW,CAAQ,EACjC,MAAO,CAAE,GAAI,GAAO,OAAQ,QAAS,EAMvC,IAAK,EAAQ,KAAO,KAAK,IAAI,GAAK,EAAO,UACvC,MAAO,CAAE,GAAI,GAAO,OAAQ,SAAU,EAGxC,MAAO,CAAE,GAAI,GAAM,MAAO,EAAO,MAAO,MAAO,EAAO,MAAO,UAAW,EAAO,SAAU,EAyD3F,IAAM,EAAiB,OACjB,EAAwB,OACxB,EAAkB,CAAC,EAAgB,CAAqB,EAE9D,SAAS,CAAY,CAAC,EAAyB,EAAe,EAA6B,CACzF,MAAO,CACL,GAAG,EAAmB,EAAQ,EAAO,EAAW,CAAc,EAC9D,EAAa,EAAO,OAAO,CAC7B,EAGF,SAAS,CAAkB,CACzB,EACA,EACA,EACA,EAAU,EACA,CACV,MAAO,CACL,EACA,EAAO,MACP,EAAa,EAAO,IAAI,EACxB,EAAO,YACP,EACA,OAAO,CAAS,EAGhB,EAAa,CAAC,GAAG,EAAO,IAAI,EAAE,KAAK,CAAC,EACpC,EAAa,EAAO,KAAK,CAC3B,EAYK,SAAS,EAAa,CAAC,EAAyB,EAAuB,CAAC,EAAW,CACxF,IAAM,EAAM,EAAW,EAAoB,EAAQ,MAAM,EAEnD,GADM,EAAQ,KAAO,KAAK,IAAI,IACX,EAAQ,OAAS,GACpC,EAAQ,EAAY,EAAE,EAAE,SAAS,WAAW,EAC5C,EAAY,EAAI,EAAK,EAAa,EAAQ,EAAO,CAAS,CAAC,EAAE,SAAS,WAAW,EACvF,MAAO,CAAC,EAAgB,EAAO,EAAO,KAAK,EAAG,EAAO,EAAU,SAAS,EAAE,EAAG,CAAS,EAAE,KAAK,GAAG,EAU3F,SAAS,EAAe,CAC7B,EACA,EACA,EAAyB,CAAC,EACZ,CACd,IAAM,EAAS,EAAU,EAAW,CAAe,EACnD,GAAI,CAAC,EACH,MAAO,CAAE,GAAI,GAAO,OAAQ,WAAY,EAG1C,GAAI,EAAO,UAAY,GAAyB,CAAC,EAAe,EAAO,SAAS,EAC9E,MAAO,CAAE,GAAI,GAAO,OAAQ,QAAS,EAEvC,IAAM,EAAO,IAAK,EAAQ,MAAO,EAAO,KAAM,EACxC,EACJ,EAAO,UAAY,EACf,EAAI,EAAU,EAAQ,MAAM,EAAG,EAAmB,EAAM,EAAO,MAAO,EAAO,SAAS,CAAC,EACvF,EACE,EAAW,EAAoB,EAAQ,MAAM,EAC7C,EAAa,EAAM,EAAO,MAAO,EAAO,SAAS,CACnD,EACN,GAAI,CAAC,EAAW,EAAW,CAAQ,EACjC,MAAO,CAAE,GAAI,GAAO,OAAQ,QAAS,EAMvC,IAAK,EAAQ,KAAO,KAAK,IAAI,GAAK,EAAO,UACvC,MAAO,CAAE,GAAI,GAAO,OAAQ,SAAU,EAGxC,MAAO,CAAE,GAAI,GAAM,MAAO,EAAO,MAAO,MAAO,EAAO,MAAO,UAAW,EAAO,SAAU,EAyCpF,SAAS,EAAkB,CAChC,EACA,EACA,EAA+B,CAAC,EACxB,CACR,IAAM,EAAM,EAAW,EAA2B,EAAQ,MAAM,EAChE,OAAO,EAAI,EAAK,CACd,EACA,EAAO,MACP,EAAO,WACP,EAAO,KACP,EAAO,KACP,EAAa,EAAO,KAAK,EACzB,EAAa,EAAO,MAAQ,CAAC,CAAC,EAC9B,EAAa,EAAO,OAAO,CAC7B,CAAC,EAAE,SAAS,WAAW,EAYlB,SAAS,EAAgB,CAAC,EAAmB,EAAqC,CACvF,OAAO,EAAQ,EAAO,EAAc,CAAS,CAAC,EASzC,SAAS,EAAc,CAAC,EAAmB,EAAqC,CACrF,OAAO,EAAQ,EAAO,EAAU,EAAW,CAAe,CAAC,EAG7D,eAAe,CAAO,CACpB,EACA,EACkB,CAClB,GAAI,CAAC,EAAQ,MAAO,GACpB,OAAO,EAAM,QAAQ,EAAO,MAAO,EAAO,SAAS",
-  "debugId": "9F5261FBB47F185564756E2164756E21",
+  "debugId": "50FECCE9F573BC6B64756E2164756E21",
   "names": []
 }

package/dist/chunk-3nf95j9e.js

@@ -0,0 +1,5 @@
+// @bun
+import{Xc as o}from"./chunk-tzdenj0n.js";import{Yc as i}from"./chunk-30xxc6r7.js";import{Nh as t}from"./chunk-gqfqnv3f.js";import{Ni as r}from"./chunk-z759yah5.js";class n extends i{register(){this.app.singleton(r,()=>new r(t(o(),this.app.config.get("translation",{}))))}}
+export{n as fb};
+
+//# debugId=87B0CFB72984AA3C64756E2164756E21

package/dist/{chunk-1q9kd20m.js.map → chunk-3nf95j9e.js.map}

@@ -5,6 +5,6 @@
     "import { ServiceProvider } from \"../support/ServiceProvider\";\nimport { withDefaults } from \"../support/withDefaults\";\nimport { Translator } from \"./Translator\";\nimport { translationConfigDefaults, type TranslationConfig } from \"./config\";\n\nexport class TranslationServiceProvider extends ServiceProvider {\n  register() {\n    this.app.singleton(\n      Translator,\n      () =>\n        new Translator(\n          withDefaults(\n            translationConfigDefaults(),\n            this.app.config.get<TranslationConfig>(\"translation\", {}),\n          ),\n        ),\n    );\n  }\n}\n"
   ],
   "mappings": ";sLAKO,AAAM,IAAmC,LAAgB,CAC9D,QAAQ,EAAG,CACT,KAAK,IAAI,UACP,EACA,IACE,IAAI,EACF,EACE,EAA0B,EAC1B,KAAK,IAAI,OAAO,IAAuB,cAAe,CAAC,CAAC,CAC1D,CACF,CACJ,EAEJ",
-  "debugId": "C32FA7347CB1EE1064756E2164756E21",
+  "debugId": "87B0CFB72984AA3C64756E2164756E21",
   "names": []
 }