gemi 0.117.0 → 0.119.0

package/dist/{chunk-qhw0hej0.js → chunk-x6v2zex2.js}

@@ -1,4 +1,4 @@
 // @bun
-import{h as Tr}from"./chunk-hvgmqt6z.js";import{A as Dr,B as ur,C as Hr,i as je,k as C,l as wr,m as fr,n as jr,p as It,q as Tt,r as qr,s as mr,t as We,u as zr,v as kr,w as Qe,x as Pr,y as Nr,z as br}from"./chunk-yhp6bvhj.js";import{D as lt,E as pr,G as vr,K as Te,O as q}from"./chunk-hvpn18bb.js";import{P as gr}from"./chunk-wgb79ysr.js";import"./chunk-yfwrbfnw.js";import{X as ir}from"./chunk-cytss9mb.js";import{Y as Ir}from"./chunk-fnwbbmnk.js";import{Z as ar}from"./chunk-1zzd39qg.js";import"./chunk-wzzrz612.js";import"./chunk-j1453bn1.js";import"./chunk-s4f56035.js";import{la as Or}from"./chunk-x7qwx07b.js";import{Vi as us,Wi as u}from"./chunk-dcgvq79a.js";var G=u((Y)=>{Object.defineProperty(Y,"__esModule",{value:!0});Y.resolveHttpAuthSchemeConfig=Y.defaultSSOHttpAuthSchemeProvider=Y.defaultSSOHttpAuthSchemeParametersProvider=void 0;var _t=C(),U=lt(),Et=async(e,t,r)=>{return{operation:(0,U.getSmithyContext)(t).operation,region:await(0,U.normalizeProvider)(e.region)()||(()=>{throw Error("expected `region` to be configured for `aws.auth#sigv4`")})()}};Y.defaultSSOHttpAuthSchemeParametersProvider=Et;function Rt(e){return{schemeId:"aws.auth#sigv4",signingProperties:{name:"awsssoportal",region:e.region},propertiesExtractor:(t,r)=>({signingProperties:{config:t,context:r}})}}function yt(e){return{schemeId:"smithy.api#noAuth"}}var St=(e)=>{let t=[];switch(e.operation){case"GetRoleCredentials":{t.push(yt(e));break}default:t.push(Rt(e))}return t};Y.defaultSSOHttpAuthSchemeProvider=St;var xt=(e)=>{let t=(0,_t.resolveAwsSdkSigV4Config)(e);return Object.assign(t,{authSchemePreference:(0,U.normalizeProvider)(e.authSchemePreference??[])})};Y.resolveHttpAuthSchemeConfig=xt});var Ee=u((le)=>{Object.defineProperty(le,"__esModule",{value:!0});le.ruleSet=void 0;var ae="required",n="fn",i="argv",y="ref",X=!0,Z="isSet",S="booleanEquals",E="error",R="endpoint",c="tree",A="PartitionResult",g="getAttr",ee={[ae]:!1,type:"string"},te={[ae]:!0,default:!1,type:"boolean"},re={[y]:"Endpoint"},ue={[n]:S,[i]:[{[y]:"UseFIPS"},!0]},ce={[n]:S,[i]:[{[y]:"UseDualStack"},!0]},o={},se={[n]:g,[i]:[{[y]:A},"supportsFIPS"]},de={[y]:A},oe={[n]:S,[i]:[!0,{[n]:g,[i]:[de,"supportsDualStack"]}]},ne=[ue],ie=[ce],pe=[{[y]:"Region"}],qt={version:"1.0",parameters:{Region:ee,UseDualStack:te,UseFIPS:te,Endpoint:ee},rules:[{conditions:[{[n]:Z,[i]:[re]}],rules:[{conditions:ne,error:"Invalid Configuration: FIPS and custom endpoint are not supported",type:E},{conditions:ie,error:"Invalid Configuration: Dualstack and custom endpoint are not supported",type:E},{endpoint:{url:re,properties:o,headers:o},type:R}],type:c},{conditions:[{[n]:Z,[i]:pe}],rules:[{conditions:[{[n]:"aws.partition",[i]:pe,assign:A}],rules:[{conditions:[ue,ce],rules:[{conditions:[{[n]:S,[i]:[X,se]},oe],rules:[{endpoint:{url:"https://portal.sso-fips.{Region}.{PartitionResult#dualStackDnsSuffix}",properties:o,headers:o},type:R}],type:c},{error:"FIPS and DualStack are enabled, but this partition does not support one or both",type:E}],type:c},{conditions:ne,rules:[{conditions:[{[n]:S,[i]:[se,X]}],rules:[{conditions:[{[n]:"stringEquals",[i]:[{[n]:g,[i]:[de,"name"]},"aws-us-gov"]}],endpoint:{url:"https://portal.sso.{Region}.amazonaws.com",properties:o,headers:o},type:R},{endpoint:{url:"https://portal.sso-fips.{Region}.{PartitionResult#dnsSuffix}",properties:o,headers:o},type:R}],type:c},{error:"FIPS is enabled but this partition does not support FIPS",type:E}],type:c},{conditions:ie,rules:[{conditions:[oe],rules:[{endpoint:{url:"https://portal.sso.{Region}.{PartitionResult#dualStackDnsSuffix}",properties:o,headers:o},type:R}],type:c},{error:"DualStack is enabled but this partition does not support DualStack",type:E}],type:c},{endpoint:{url:"https://portal.sso.{Region}.{PartitionResult#dnsSuffix}",properties:o,headers:o},type:R}],type:c}],type:c},{error:"Invalid Configuration: Missing Region",type:E}]};le.ruleSet=qt});var Se=u((Re)=>{Object.defineProperty(Re,"__esModule",{value:!0});Re.defaultEndpointResolver=void 0;var Pt=Tt(),w=It(),Nt=Ee(),bt=new w.EndpointCache({size:50,params:["Endpoint","Region","UseDualStack","UseFIPS"]}),Dt=(e,t={})=>{return bt.get(e,()=>(0,w.resolveEndpoint)(Nt.ruleSet,{endpointParams:e,logger:t.logger}))};Re.defaultEndpointResolver=Dt;w.customEndpointFunctions.aws=Pt.awsEndpointFunctions});var I=u((j)=>{Object.defineProperty(j,"__esModule",{value:!0});j.SSOServiceException=j.__ServiceException=void 0;var xe=q();Object.defineProperty(j,"__ServiceException",{enumerable:!0,get:function(){return xe.ServiceException}});class f extends xe.ServiceException{constructor(e){super(e);Object.setPrototypeOf(this,f.prototype)}}j.SSOServiceException=f});var K=u((Oe)=>{Object.defineProperty(Oe,"__esModule",{value:!0});Oe.UnauthorizedException=Oe.TooManyRequestsException=Oe.ResourceNotFoundException=Oe.InvalidRequestException=void 0;var T=I();class m extends T.SSOServiceException{name="InvalidRequestException";$fault="client";constructor(e){super({name:"InvalidRequestException",$fault:"client",...e});Object.setPrototypeOf(this,m.prototype)}}Oe.InvalidRequestException=m;class z extends T.SSOServiceException{name="ResourceNotFoundException";$fault="client";constructor(e){super({name:"ResourceNotFoundException",$fault:"client",...e});Object.setPrototypeOf(this,z.prototype)}}Oe.ResourceNotFoundException=z;class k extends T.SSOServiceException{name="TooManyRequestsException";$fault="client";constructor(e){super({name:"TooManyRequestsException",$fault:"client",...e});Object.setPrototypeOf(this,k.prototype)}}Oe.TooManyRequestsException=k;class H extends T.SSOServiceException{name="UnauthorizedException";$fault="client";constructor(e){super({name:"UnauthorizedException",$fault:"client",...e});Object.setPrototypeOf(this,H.prototype)}}Oe.UnauthorizedException=H});var L=u((De)=>{Object.defineProperty(De,"__esModule",{value:!0});De.GetRoleCredentials$=De.RoleCredentials$=De.GetRoleCredentialsResponse$=De.GetRoleCredentialsRequest$=De.errorTypeRegistries=De.UnauthorizedException$=De.TooManyRequestsException$=De.ResourceNotFoundException$=De.InvalidRequestException$=De.SSOServiceException$=void 0;var Mt="AccessTokenType",Ut="GetRoleCredentials",Ct="GetRoleCredentialsRequest",Gt="GetRoleCredentialsResponse",At="InvalidRequestException",gt="RoleCredentials",wt="ResourceNotFoundException",ft="SecretAccessKeyType",jt="SessionTokenType",mt="TooManyRequestsException",zt="UnauthorizedException",kt="accountId",Ht="accessKeyId",Kt="accessToken",Lt="account_id",P="client",N="error",Vt="expiration",Bt="http",b="httpError",Wt="httpHeader",Ie="httpQuery",D="message",Qt="roleCredentials",Yt="roleName",Jt="role_name",Pe="smithy.ts.sdk.synthetic.com.amazonaws.sso",Xt="secretAccessKey",Zt="sessionToken",er="x-amz-sso_bearer_token",p="com.amazonaws.sso",Ne=Te(),$=K(),tr=I(),be=Ne.TypeRegistry.for(Pe);De.SSOServiceException$=[-3,Pe,"SSOServiceException",0,[],[]];be.registerError(De.SSOServiceException$,tr.SSOServiceException);var x=Ne.TypeRegistry.for(p);De.InvalidRequestException$=[-3,p,At,{[N]:P,[b]:400},[D],[0]];x.registerError(De.InvalidRequestException$,$.InvalidRequestException);De.ResourceNotFoundException$=[-3,p,wt,{[N]:P,[b]:404},[D],[0]];x.registerError(De.ResourceNotFoundException$,$.ResourceNotFoundException);De.TooManyRequestsException$=[-3,p,mt,{[N]:P,[b]:429},[D],[0]];x.registerError(De.TooManyRequestsException$,$.TooManyRequestsException);De.UnauthorizedException$=[-3,p,zt,{[N]:P,[b]:401},[D],[0]];x.registerError(De.UnauthorizedException$,$.UnauthorizedException);De.errorTypeRegistries=[be,x];var rr=[0,p,Mt,8,0],sr=[0,p,ft,8,0],or=[0,p,jt,8,0];De.GetRoleCredentialsRequest$=[3,p,Ct,0,[Yt,kt,Kt],[[0,{[Ie]:Jt}],[0,{[Ie]:Lt}],[()=>rr,{[Wt]:er}]],3];De.GetRoleCredentialsResponse$=[3,p,Gt,0,[Qt],[[()=>De.RoleCredentials$,0]]];De.RoleCredentials$=[3,p,gt,0,[Ht,Xt,Zt,Vt],[0,[()=>sr,0],[()=>or,0],1]];De.GetRoleCredentials$=[9,p,Ut,{[Bt]:["GET","/federation/credentials",200]},()=>De.GetRoleCredentialsRequest$,()=>De.GetRoleCredentialsResponse$]});var ke=u((me)=>{Object.defineProperty(me,"__esModule",{value:!0});me.getRuntimeConfig=void 0;var cr=C(),dr=ur(),lr=je(),_r=q(),Er=ar(),we=pr(),fe=ir(),Rr=G(),yr=Se(),Sr=L(),xr=(e)=>{return{apiVersion:"2019-06-10",base64Decoder:e?.base64Decoder??we.fromBase64,base64Encoder:e?.base64Encoder??we.toBase64,disableHostPrefix:e?.disableHostPrefix??!1,endpointProvider:e?.endpointProvider??yr.defaultEndpointResolver,extensions:e?.extensions??[],httpAuthSchemeProvider:e?.httpAuthSchemeProvider??Rr.defaultSSOHttpAuthSchemeProvider,httpAuthSchemes:e?.httpAuthSchemes??[{schemeId:"aws.auth#sigv4",identityProvider:(t)=>t.getIdentityProvider("aws.auth#sigv4"),signer:new cr.AwsSdkSigV4Signer},{schemeId:"smithy.api#noAuth",identityProvider:(t)=>t.getIdentityProvider("smithy.api#noAuth")||(async()=>({})),signer:new lr.NoAuthSigner}],logger:e?.logger??new _r.NoOpLogger,protocol:e?.protocol??dr.AwsRestJsonProtocol,protocolSettings:e?.protocolSettings??{defaultNamespace:"com.amazonaws.sso",errorTypeRegistries:Sr.errorTypeRegistries,version:"2019-06-10",serviceTarget:"SWBPortalService"},serviceId:e?.serviceId??"SSO",urlParser:e?.urlParser??Er.parseUrl,utf8Decoder:e?.utf8Decoder??fe.fromUtf8,utf8Encoder:e?.utf8Encoder??fe.toUtf8}};me.getRuntimeConfig=xr});var Xe=u((Ye)=>{Object.defineProperty(Ye,"__esModule",{value:!0});Ye.getRuntimeConfig=void 0;var $r=Or(),Fr=$r.__importDefault(Tr()),He=C(),Ke=Pr(),F=We(),hr=Nr(),Le=Qe(),l=Ir(),Ve=vr(),Be=q(),Mr=br(),Ur=Dr(),Cr=qr(),Gr=ke(),Ar=(e)=>{(0,Be.emitWarningIfUnsupportedVersion)(process.version);let t=(0,Ur.resolveDefaultsModeConfig)(e),r=()=>t().then(Be.loadConfigsForDefaultMode),a=(0,Gr.getRuntimeConfig)(e);(0,He.emitWarningIfUnsupportedVersion)(process.version);let s={profile:e?.profile,logger:a.logger};return{...a,...e,runtime:"node",defaultsMode:t,authSchemePreference:e?.authSchemePreference??(0,l.loadConfig)(He.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS,s),bodyLengthChecker:e?.bodyLengthChecker??Mr.calculateBodyLength,defaultUserAgentProvider:e?.defaultUserAgentProvider??(0,Ke.createDefaultUserAgentProvider)({serviceId:a.serviceId,clientVersion:Fr.default.version}),maxAttempts:e?.maxAttempts??(0,l.loadConfig)(Le.NODE_MAX_ATTEMPT_CONFIG_OPTIONS,e),region:e?.region??(0,l.loadConfig)(F.NODE_REGION_CONFIG_OPTIONS,{...F.NODE_REGION_CONFIG_FILE_OPTIONS,...s}),requestHandler:Ve.NodeHttpHandler.create(e?.requestHandler??r),retryMode:e?.retryMode??(0,l.loadConfig)({...Le.NODE_RETRY_MODE_CONFIG_OPTIONS,default:async()=>(await r()).retryMode||Cr.DEFAULT_RETRY_MODE},e),sha256:e?.sha256??hr.Hash.bind(null,"sha256"),streamCollector:e?.streamCollector??Ve.streamCollector,useDualstackEndpoint:e?.useDualstackEndpoint??(0,l.loadConfig)(F.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS,s),useFipsEndpoint:e?.useFipsEndpoint??(0,l.loadConfig)(F.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS,s),userAgentAppId:e?.userAgentAppId??(0,l.loadConfig)(Ke.NODE_APP_ID_CONFIG_OPTIONS,s)}};Ye.getRuntimeConfig=Ar});var it=u((d)=>{var Ze=wr(),Kr=fr(),Lr=jr(),et=mr(),Vr=We(),V=je(),Br=Te(),Wr=zr(),nt=kr(),tt=Qe(),_=q(),rt=G(),Qr=Xe(),st=Hr(),ot=gr(),v=L(),h=K(),Yr=I(),Jr=(e)=>{return Object.assign(e,{useDualstackEndpoint:e.useDualstackEndpoint??!1,useFipsEndpoint:e.useFipsEndpoint??!1,defaultSigningName:"awsssoportal"})},Xr={UseFIPS:{type:"builtInParams",name:"useFipsEndpoint"},Endpoint:{type:"builtInParams",name:"endpoint"},Region:{type:"builtInParams",name:"region"},UseDualStack:{type:"builtInParams",name:"useDualstackEndpoint"}},Zr=(e)=>{let{httpAuthSchemes:t,httpAuthSchemeProvider:r,credentials:a}=e;return{setHttpAuthScheme(s){let O=t.findIndex((M)=>M.schemeId===s.schemeId);if(O===-1)t.push(s);else t.splice(O,1,s)},httpAuthSchemes(){return t},setHttpAuthSchemeProvider(s){r=s},httpAuthSchemeProvider(){return r},setCredentials(s){a=s},credentials(){return a}}},es=(e)=>{return{httpAuthSchemes:e.httpAuthSchemes(),httpAuthSchemeProvider:e.httpAuthSchemeProvider(),credentials:e.credentials()}},ts=(e,t)=>{let r=Object.assign(st.getAwsRegionExtensionConfiguration(e),_.getDefaultExtensionConfiguration(e),ot.getHttpHandlerExtensionConfiguration(e),Zr(e));return t.forEach((a)=>a.configure(r)),Object.assign(e,st.resolveAwsRegionExtensionConfiguration(r),_.resolveDefaultRuntimeConfig(r),ot.resolveHttpHandlerRuntimeConfig(r),es(r))};class B extends _.Client{config;constructor(...[e]){let t=Qr.getRuntimeConfig(e||{});super(t);this.initConfig=t;let r=Jr(t),a=et.resolveUserAgentConfig(r),s=tt.resolveRetryConfig(a),O=Vr.resolveRegionConfig(s),M=Ze.resolveHostHeaderConfig(O),at=nt.resolveEndpointConfig(M),ut=rt.resolveHttpAuthSchemeConfig(at),ct=ts(ut,e?.extensions||[]);this.config=ct,this.middlewareStack.use(Br.getSchemaSerdePlugin(this.config)),this.middlewareStack.use(et.getUserAgentPlugin(this.config)),this.middlewareStack.use(tt.getRetryPlugin(this.config)),this.middlewareStack.use(Wr.getContentLengthPlugin(this.config)),this.middlewareStack.use(Ze.getHostHeaderPlugin(this.config)),this.middlewareStack.use(Kr.getLoggerPlugin(this.config)),this.middlewareStack.use(Lr.getRecursionDetectionPlugin(this.config)),this.middlewareStack.use(V.getHttpAuthSchemeEndpointRuleSetPlugin(this.config,{httpAuthSchemeParametersProvider:rt.defaultSSOHttpAuthSchemeParametersProvider,identityProviderConfigProvider:async(dt)=>new V.DefaultIdentityProviderConfig({"aws.auth#sigv4":dt.credentials})})),this.middlewareStack.use(V.getHttpSigningPlugin(this.config))}destroy(){super.destroy()}}class W extends _.Command.classBuilder().ep(Xr).m(function(e,t,r,a){return[nt.getEndpointPlugin(r,e.getEndpointParameterInstructions())]}).s("SWBPortalService","GetRoleCredentials",{}).n("SSOClient","GetRoleCredentialsCommand").sc(v.GetRoleCredentials$).build(){}var rs={GetRoleCredentialsCommand:W};class Q extends B{}_.createAggregatedClient(rs,Q);d.$Command=_.Command;d.__Client=_.Client;d.SSOServiceException=Yr.SSOServiceException;d.GetRoleCredentialsCommand=W;d.SSO=Q;d.SSOClient=B;Object.prototype.hasOwnProperty.call(v,"__proto__")&&!Object.prototype.hasOwnProperty.call(d,"__proto__")&&Object.defineProperty(d,"__proto__",{enumerable:!0,value:v.__proto__});Object.keys(v).forEach(function(e){if(e!=="default"&&!Object.prototype.hasOwnProperty.call(d,e))d[e]=v[e]});Object.prototype.hasOwnProperty.call(h,"__proto__")&&!Object.prototype.hasOwnProperty.call(d,"__proto__")&&Object.defineProperty(d,"__proto__",{enumerable:!0,value:h.__proto__});Object.keys(h).forEach(function(e){if(e!=="default"&&!Object.prototype.hasOwnProperty.call(d,e))d[e]=h[e]})});var pt=us(it(),1);var export_SSOClient=pt.SSOClient;var export_GetRoleCredentialsCommand=pt.GetRoleCredentialsCommand;export{export_SSOClient as SSOClient,export_GetRoleCredentialsCommand as GetRoleCredentialsCommand};
+import{h as Tr}from"./chunk-pvz90a49.js";import{A as Dr,B as ur,C as Hr,i as je,k as C,l as wr,m as fr,n as jr,p as It,q as Tt,r as qr,s as mr,t as We,u as zr,v as kr,w as Qe,x as Pr,y as Nr,z as br}from"./chunk-76p0rf4d.js";import{D as lt,E as pr,G as vr,K as Te,O as q}from"./chunk-bgwtdbfw.js";import{P as gr}from"./chunk-qf4bmee9.js";import"./chunk-xfw8zyvn.js";import{X as ir}from"./chunk-sce5jes2.js";import{Y as Ir}from"./chunk-hzepfrzy.js";import{Z as ar}from"./chunk-sn04cyw0.js";import"./chunk-5ses4tcz.js";import"./chunk-5cgq9c43.js";import"./chunk-q290tgza.js";import{la as Or}from"./chunk-m4kmetpb.js";import{ej as us,fj as u}from"./chunk-hm9cjxy2.js";var G=u((Y)=>{Object.defineProperty(Y,"__esModule",{value:!0});Y.resolveHttpAuthSchemeConfig=Y.defaultSSOHttpAuthSchemeProvider=Y.defaultSSOHttpAuthSchemeParametersProvider=void 0;var _t=C(),U=lt(),Et=async(e,t,r)=>{return{operation:(0,U.getSmithyContext)(t).operation,region:await(0,U.normalizeProvider)(e.region)()||(()=>{throw Error("expected `region` to be configured for `aws.auth#sigv4`")})()}};Y.defaultSSOHttpAuthSchemeParametersProvider=Et;function Rt(e){return{schemeId:"aws.auth#sigv4",signingProperties:{name:"awsssoportal",region:e.region},propertiesExtractor:(t,r)=>({signingProperties:{config:t,context:r}})}}function yt(e){return{schemeId:"smithy.api#noAuth"}}var St=(e)=>{let t=[];switch(e.operation){case"GetRoleCredentials":{t.push(yt(e));break}default:t.push(Rt(e))}return t};Y.defaultSSOHttpAuthSchemeProvider=St;var xt=(e)=>{let t=(0,_t.resolveAwsSdkSigV4Config)(e);return Object.assign(t,{authSchemePreference:(0,U.normalizeProvider)(e.authSchemePreference??[])})};Y.resolveHttpAuthSchemeConfig=xt});var Ee=u((le)=>{Object.defineProperty(le,"__esModule",{value:!0});le.ruleSet=void 0;var ae="required",n="fn",i="argv",y="ref",X=!0,Z="isSet",S="booleanEquals",E="error",R="endpoint",c="tree",A="PartitionResult",g="getAttr",ee={[ae]:!1,type:"string"},te={[ae]:!0,default:!1,type:"boolean"},re={[y]:"Endpoint"},ue={[n]:S,[i]:[{[y]:"UseFIPS"},!0]},ce={[n]:S,[i]:[{[y]:"UseDualStack"},!0]},o={},se={[n]:g,[i]:[{[y]:A},"supportsFIPS"]},de={[y]:A},oe={[n]:S,[i]:[!0,{[n]:g,[i]:[de,"supportsDualStack"]}]},ne=[ue],ie=[ce],pe=[{[y]:"Region"}],qt={version:"1.0",parameters:{Region:ee,UseDualStack:te,UseFIPS:te,Endpoint:ee},rules:[{conditions:[{[n]:Z,[i]:[re]}],rules:[{conditions:ne,error:"Invalid Configuration: FIPS and custom endpoint are not supported",type:E},{conditions:ie,error:"Invalid Configuration: Dualstack and custom endpoint are not supported",type:E},{endpoint:{url:re,properties:o,headers:o},type:R}],type:c},{conditions:[{[n]:Z,[i]:pe}],rules:[{conditions:[{[n]:"aws.partition",[i]:pe,assign:A}],rules:[{conditions:[ue,ce],rules:[{conditions:[{[n]:S,[i]:[X,se]},oe],rules:[{endpoint:{url:"https://portal.sso-fips.{Region}.{PartitionResult#dualStackDnsSuffix}",properties:o,headers:o},type:R}],type:c},{error:"FIPS and DualStack are enabled, but this partition does not support one or both",type:E}],type:c},{conditions:ne,rules:[{conditions:[{[n]:S,[i]:[se,X]}],rules:[{conditions:[{[n]:"stringEquals",[i]:[{[n]:g,[i]:[de,"name"]},"aws-us-gov"]}],endpoint:{url:"https://portal.sso.{Region}.amazonaws.com",properties:o,headers:o},type:R},{endpoint:{url:"https://portal.sso-fips.{Region}.{PartitionResult#dnsSuffix}",properties:o,headers:o},type:R}],type:c},{error:"FIPS is enabled but this partition does not support FIPS",type:E}],type:c},{conditions:ie,rules:[{conditions:[oe],rules:[{endpoint:{url:"https://portal.sso.{Region}.{PartitionResult#dualStackDnsSuffix}",properties:o,headers:o},type:R}],type:c},{error:"DualStack is enabled but this partition does not support DualStack",type:E}],type:c},{endpoint:{url:"https://portal.sso.{Region}.{PartitionResult#dnsSuffix}",properties:o,headers:o},type:R}],type:c}],type:c},{error:"Invalid Configuration: Missing Region",type:E}]};le.ruleSet=qt});var Se=u((Re)=>{Object.defineProperty(Re,"__esModule",{value:!0});Re.defaultEndpointResolver=void 0;var Pt=Tt(),w=It(),Nt=Ee(),bt=new w.EndpointCache({size:50,params:["Endpoint","Region","UseDualStack","UseFIPS"]}),Dt=(e,t={})=>{return bt.get(e,()=>(0,w.resolveEndpoint)(Nt.ruleSet,{endpointParams:e,logger:t.logger}))};Re.defaultEndpointResolver=Dt;w.customEndpointFunctions.aws=Pt.awsEndpointFunctions});var I=u((j)=>{Object.defineProperty(j,"__esModule",{value:!0});j.SSOServiceException=j.__ServiceException=void 0;var xe=q();Object.defineProperty(j,"__ServiceException",{enumerable:!0,get:function(){return xe.ServiceException}});class f extends xe.ServiceException{constructor(e){super(e);Object.setPrototypeOf(this,f.prototype)}}j.SSOServiceException=f});var K=u((Oe)=>{Object.defineProperty(Oe,"__esModule",{value:!0});Oe.UnauthorizedException=Oe.TooManyRequestsException=Oe.ResourceNotFoundException=Oe.InvalidRequestException=void 0;var T=I();class m extends T.SSOServiceException{name="InvalidRequestException";$fault="client";constructor(e){super({name:"InvalidRequestException",$fault:"client",...e});Object.setPrototypeOf(this,m.prototype)}}Oe.InvalidRequestException=m;class z extends T.SSOServiceException{name="ResourceNotFoundException";$fault="client";constructor(e){super({name:"ResourceNotFoundException",$fault:"client",...e});Object.setPrototypeOf(this,z.prototype)}}Oe.ResourceNotFoundException=z;class k extends T.SSOServiceException{name="TooManyRequestsException";$fault="client";constructor(e){super({name:"TooManyRequestsException",$fault:"client",...e});Object.setPrototypeOf(this,k.prototype)}}Oe.TooManyRequestsException=k;class H extends T.SSOServiceException{name="UnauthorizedException";$fault="client";constructor(e){super({name:"UnauthorizedException",$fault:"client",...e});Object.setPrototypeOf(this,H.prototype)}}Oe.UnauthorizedException=H});var L=u((De)=>{Object.defineProperty(De,"__esModule",{value:!0});De.GetRoleCredentials$=De.RoleCredentials$=De.GetRoleCredentialsResponse$=De.GetRoleCredentialsRequest$=De.errorTypeRegistries=De.UnauthorizedException$=De.TooManyRequestsException$=De.ResourceNotFoundException$=De.InvalidRequestException$=De.SSOServiceException$=void 0;var Mt="AccessTokenType",Ut="GetRoleCredentials",Ct="GetRoleCredentialsRequest",Gt="GetRoleCredentialsResponse",At="InvalidRequestException",gt="RoleCredentials",wt="ResourceNotFoundException",ft="SecretAccessKeyType",jt="SessionTokenType",mt="TooManyRequestsException",zt="UnauthorizedException",kt="accountId",Ht="accessKeyId",Kt="accessToken",Lt="account_id",P="client",N="error",Vt="expiration",Bt="http",b="httpError",Wt="httpHeader",Ie="httpQuery",D="message",Qt="roleCredentials",Yt="roleName",Jt="role_name",Pe="smithy.ts.sdk.synthetic.com.amazonaws.sso",Xt="secretAccessKey",Zt="sessionToken",er="x-amz-sso_bearer_token",p="com.amazonaws.sso",Ne=Te(),$=K(),tr=I(),be=Ne.TypeRegistry.for(Pe);De.SSOServiceException$=[-3,Pe,"SSOServiceException",0,[],[]];be.registerError(De.SSOServiceException$,tr.SSOServiceException);var x=Ne.TypeRegistry.for(p);De.InvalidRequestException$=[-3,p,At,{[N]:P,[b]:400},[D],[0]];x.registerError(De.InvalidRequestException$,$.InvalidRequestException);De.ResourceNotFoundException$=[-3,p,wt,{[N]:P,[b]:404},[D],[0]];x.registerError(De.ResourceNotFoundException$,$.ResourceNotFoundException);De.TooManyRequestsException$=[-3,p,mt,{[N]:P,[b]:429},[D],[0]];x.registerError(De.TooManyRequestsException$,$.TooManyRequestsException);De.UnauthorizedException$=[-3,p,zt,{[N]:P,[b]:401},[D],[0]];x.registerError(De.UnauthorizedException$,$.UnauthorizedException);De.errorTypeRegistries=[be,x];var rr=[0,p,Mt,8,0],sr=[0,p,ft,8,0],or=[0,p,jt,8,0];De.GetRoleCredentialsRequest$=[3,p,Ct,0,[Yt,kt,Kt],[[0,{[Ie]:Jt}],[0,{[Ie]:Lt}],[()=>rr,{[Wt]:er}]],3];De.GetRoleCredentialsResponse$=[3,p,Gt,0,[Qt],[[()=>De.RoleCredentials$,0]]];De.RoleCredentials$=[3,p,gt,0,[Ht,Xt,Zt,Vt],[0,[()=>sr,0],[()=>or,0],1]];De.GetRoleCredentials$=[9,p,Ut,{[Bt]:["GET","/federation/credentials",200]},()=>De.GetRoleCredentialsRequest$,()=>De.GetRoleCredentialsResponse$]});var ke=u((me)=>{Object.defineProperty(me,"__esModule",{value:!0});me.getRuntimeConfig=void 0;var cr=C(),dr=ur(),lr=je(),_r=q(),Er=ar(),we=pr(),fe=ir(),Rr=G(),yr=Se(),Sr=L(),xr=(e)=>{return{apiVersion:"2019-06-10",base64Decoder:e?.base64Decoder??we.fromBase64,base64Encoder:e?.base64Encoder??we.toBase64,disableHostPrefix:e?.disableHostPrefix??!1,endpointProvider:e?.endpointProvider??yr.defaultEndpointResolver,extensions:e?.extensions??[],httpAuthSchemeProvider:e?.httpAuthSchemeProvider??Rr.defaultSSOHttpAuthSchemeProvider,httpAuthSchemes:e?.httpAuthSchemes??[{schemeId:"aws.auth#sigv4",identityProvider:(t)=>t.getIdentityProvider("aws.auth#sigv4"),signer:new cr.AwsSdkSigV4Signer},{schemeId:"smithy.api#noAuth",identityProvider:(t)=>t.getIdentityProvider("smithy.api#noAuth")||(async()=>({})),signer:new lr.NoAuthSigner}],logger:e?.logger??new _r.NoOpLogger,protocol:e?.protocol??dr.AwsRestJsonProtocol,protocolSettings:e?.protocolSettings??{defaultNamespace:"com.amazonaws.sso",errorTypeRegistries:Sr.errorTypeRegistries,version:"2019-06-10",serviceTarget:"SWBPortalService"},serviceId:e?.serviceId??"SSO",urlParser:e?.urlParser??Er.parseUrl,utf8Decoder:e?.utf8Decoder??fe.fromUtf8,utf8Encoder:e?.utf8Encoder??fe.toUtf8}};me.getRuntimeConfig=xr});var Xe=u((Ye)=>{Object.defineProperty(Ye,"__esModule",{value:!0});Ye.getRuntimeConfig=void 0;var $r=Or(),Fr=$r.__importDefault(Tr()),He=C(),Ke=Pr(),F=We(),hr=Nr(),Le=Qe(),l=Ir(),Ve=vr(),Be=q(),Mr=br(),Ur=Dr(),Cr=qr(),Gr=ke(),Ar=(e)=>{(0,Be.emitWarningIfUnsupportedVersion)(process.version);let t=(0,Ur.resolveDefaultsModeConfig)(e),r=()=>t().then(Be.loadConfigsForDefaultMode),a=(0,Gr.getRuntimeConfig)(e);(0,He.emitWarningIfUnsupportedVersion)(process.version);let s={profile:e?.profile,logger:a.logger};return{...a,...e,runtime:"node",defaultsMode:t,authSchemePreference:e?.authSchemePreference??(0,l.loadConfig)(He.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS,s),bodyLengthChecker:e?.bodyLengthChecker??Mr.calculateBodyLength,defaultUserAgentProvider:e?.defaultUserAgentProvider??(0,Ke.createDefaultUserAgentProvider)({serviceId:a.serviceId,clientVersion:Fr.default.version}),maxAttempts:e?.maxAttempts??(0,l.loadConfig)(Le.NODE_MAX_ATTEMPT_CONFIG_OPTIONS,e),region:e?.region??(0,l.loadConfig)(F.NODE_REGION_CONFIG_OPTIONS,{...F.NODE_REGION_CONFIG_FILE_OPTIONS,...s}),requestHandler:Ve.NodeHttpHandler.create(e?.requestHandler??r),retryMode:e?.retryMode??(0,l.loadConfig)({...Le.NODE_RETRY_MODE_CONFIG_OPTIONS,default:async()=>(await r()).retryMode||Cr.DEFAULT_RETRY_MODE},e),sha256:e?.sha256??hr.Hash.bind(null,"sha256"),streamCollector:e?.streamCollector??Ve.streamCollector,useDualstackEndpoint:e?.useDualstackEndpoint??(0,l.loadConfig)(F.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS,s),useFipsEndpoint:e?.useFipsEndpoint??(0,l.loadConfig)(F.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS,s),userAgentAppId:e?.userAgentAppId??(0,l.loadConfig)(Ke.NODE_APP_ID_CONFIG_OPTIONS,s)}};Ye.getRuntimeConfig=Ar});var it=u((d)=>{var Ze=wr(),Kr=fr(),Lr=jr(),et=mr(),Vr=We(),V=je(),Br=Te(),Wr=zr(),nt=kr(),tt=Qe(),_=q(),rt=G(),Qr=Xe(),st=Hr(),ot=gr(),v=L(),h=K(),Yr=I(),Jr=(e)=>{return Object.assign(e,{useDualstackEndpoint:e.useDualstackEndpoint??!1,useFipsEndpoint:e.useFipsEndpoint??!1,defaultSigningName:"awsssoportal"})},Xr={UseFIPS:{type:"builtInParams",name:"useFipsEndpoint"},Endpoint:{type:"builtInParams",name:"endpoint"},Region:{type:"builtInParams",name:"region"},UseDualStack:{type:"builtInParams",name:"useDualstackEndpoint"}},Zr=(e)=>{let{httpAuthSchemes:t,httpAuthSchemeProvider:r,credentials:a}=e;return{setHttpAuthScheme(s){let O=t.findIndex((M)=>M.schemeId===s.schemeId);if(O===-1)t.push(s);else t.splice(O,1,s)},httpAuthSchemes(){return t},setHttpAuthSchemeProvider(s){r=s},httpAuthSchemeProvider(){return r},setCredentials(s){a=s},credentials(){return a}}},es=(e)=>{return{httpAuthSchemes:e.httpAuthSchemes(),httpAuthSchemeProvider:e.httpAuthSchemeProvider(),credentials:e.credentials()}},ts=(e,t)=>{let r=Object.assign(st.getAwsRegionExtensionConfiguration(e),_.getDefaultExtensionConfiguration(e),ot.getHttpHandlerExtensionConfiguration(e),Zr(e));return t.forEach((a)=>a.configure(r)),Object.assign(e,st.resolveAwsRegionExtensionConfiguration(r),_.resolveDefaultRuntimeConfig(r),ot.resolveHttpHandlerRuntimeConfig(r),es(r))};class B extends _.Client{config;constructor(...[e]){let t=Qr.getRuntimeConfig(e||{});super(t);this.initConfig=t;let r=Jr(t),a=et.resolveUserAgentConfig(r),s=tt.resolveRetryConfig(a),O=Vr.resolveRegionConfig(s),M=Ze.resolveHostHeaderConfig(O),at=nt.resolveEndpointConfig(M),ut=rt.resolveHttpAuthSchemeConfig(at),ct=ts(ut,e?.extensions||[]);this.config=ct,this.middlewareStack.use(Br.getSchemaSerdePlugin(this.config)),this.middlewareStack.use(et.getUserAgentPlugin(this.config)),this.middlewareStack.use(tt.getRetryPlugin(this.config)),this.middlewareStack.use(Wr.getContentLengthPlugin(this.config)),this.middlewareStack.use(Ze.getHostHeaderPlugin(this.config)),this.middlewareStack.use(Kr.getLoggerPlugin(this.config)),this.middlewareStack.use(Lr.getRecursionDetectionPlugin(this.config)),this.middlewareStack.use(V.getHttpAuthSchemeEndpointRuleSetPlugin(this.config,{httpAuthSchemeParametersProvider:rt.defaultSSOHttpAuthSchemeParametersProvider,identityProviderConfigProvider:async(dt)=>new V.DefaultIdentityProviderConfig({"aws.auth#sigv4":dt.credentials})})),this.middlewareStack.use(V.getHttpSigningPlugin(this.config))}destroy(){super.destroy()}}class W extends _.Command.classBuilder().ep(Xr).m(function(e,t,r,a){return[nt.getEndpointPlugin(r,e.getEndpointParameterInstructions())]}).s("SWBPortalService","GetRoleCredentials",{}).n("SSOClient","GetRoleCredentialsCommand").sc(v.GetRoleCredentials$).build(){}var rs={GetRoleCredentialsCommand:W};class Q extends B{}_.createAggregatedClient(rs,Q);d.$Command=_.Command;d.__Client=_.Client;d.SSOServiceException=Yr.SSOServiceException;d.GetRoleCredentialsCommand=W;d.SSO=Q;d.SSOClient=B;Object.prototype.hasOwnProperty.call(v,"__proto__")&&!Object.prototype.hasOwnProperty.call(d,"__proto__")&&Object.defineProperty(d,"__proto__",{enumerable:!0,value:v.__proto__});Object.keys(v).forEach(function(e){if(e!=="default"&&!Object.prototype.hasOwnProperty.call(d,e))d[e]=v[e]});Object.prototype.hasOwnProperty.call(h,"__proto__")&&!Object.prototype.hasOwnProperty.call(d,"__proto__")&&Object.defineProperty(d,"__proto__",{enumerable:!0,value:h.__proto__});Object.keys(h).forEach(function(e){if(e!=="default"&&!Object.prototype.hasOwnProperty.call(d,e))d[e]=h[e]})});var pt=us(it(),1);var export_SSOClient=pt.SSOClient;var export_GetRoleCredentialsCommand=pt.GetRoleCredentialsCommand;export{export_SSOClient as SSOClient,export_GetRoleCredentialsCommand as GetRoleCredentialsCommand};
 
-//# debugId=699B975C083D617E64756E2164756E21
+//# debugId=A7A2FD45323C514864756E2164756E21

package/dist/{chunk-qhw0hej0.js.map → chunk-x6v2zex2.js.map}

@@ -14,6 +14,6 @@
     "import { GetRoleCredentialsCommand, SSOClient } from \"@aws-sdk/nested-clients/sso\";\nexport { GetRoleCredentialsCommand, SSOClient };\n"
   ],
   "mappings": ";+uBACA,CAAO,SAAe,JAAS,OAAc,LAAE,AAAO,JAAK,LAAC,JACpD,wBAAsC,6BAA2C,uCAAkD,OAC3I,IAAM,OACA,OACA,GAA6C,MAAO,EAAQ,EAAS,IAAU,CACjF,MAAO,CACH,WAAY,EAAG,EAAkB,kBAAkB,CAAO,EAAE,UAC5D,OAAS,MAAO,EAAG,EAAkB,mBAAmB,EAAO,MAAM,EAAE,IAClE,IAAM,CACH,MAAU,MAAM,yDAAyD,IAC1E,CACX,GAEI,6CAA6C,GACrD,SAAS,EAAgC,CAAC,EAAgB,CACtD,MAAO,CACH,SAAU,iBACV,kBAAmB,CACf,KAAM,eACN,OAAQ,EAAe,MAC3B,EACA,oBAAqB,CAAC,EAAQ,KAAa,CACvC,kBAAmB,CACf,SACA,SACJ,CACJ,EACJ,EAEJ,SAAS,EAAmC,CAAC,EAAgB,CACzD,MAAO,CACH,SAAU,mBACd,EAEJ,IAAM,GAAmC,CAAC,IAAmB,CACzD,IAAM,EAAU,CAAC,EACjB,OAAQ,EAAe,eACd,qBAAsB,CACvB,EAAQ,KAAK,GAAoC,CAAc,CAAC,EAChE,KACJ,SAEI,EAAQ,KAAK,GAAiC,CAAc,CAAC,EAGrE,OAAO,GAEH,mCAAmC,GAC3C,IAAM,GAA8B,CAAC,IAAW,CAC5C,IAAM,GAAY,EAAG,GAAO,0BAA0B,CAAM,EAC5D,OAAO,OAAO,OAAO,EAAU,CAC3B,sBAAuB,EAAG,EAAkB,mBAAmB,EAAO,sBAAwB,CAAC,CAAC,CACpG,CAAC,GAEG,8BAA8B,qBCtDtC,OAAO,eAAe,GAAS,aAAc,CAAE,MAAO,EAAK,CAAC,EACpD,WAAe,OACvB,IAAM,GAAI,WAAY,EAAI,KAAM,EAAI,OAAQ,EAAI,MAC1C,EAAI,GAAM,EAAI,QAAS,EAAI,gBAAiB,EAAI,QAAS,EAAI,WAAY,EAAI,OAAQ,EAAI,kBAAmB,EAAI,UAAW,GAAI,EAAG,IAAI,GAAO,KAAM,QAAS,EAAG,GAAI,EAAG,IAAI,GAAM,QAAS,GAAO,KAAM,SAAU,EAAG,GAAI,EAAG,GAAI,UAAW,EAAG,GAAI,EAAG,GAAI,GAAI,GAAI,CAAC,EAAG,GAAI,SAAU,EAAG,EAAI,CAAE,EAAG,GAAI,EAAG,GAAI,GAAI,GAAI,CAAC,EAAG,GAAI,cAAe,EAAG,EAAI,CAAE,EAAG,EAAI,CAAC,EAAG,GAAI,EAAG,GAAI,GAAI,GAAI,CAAC,EAAG,GAAI,CAAE,EAAG,cAAc,CAAE,EAAG,GAAI,EAAG,GAAI,CAAE,EAAG,GAAI,EAAG,GAAI,GAAI,GAAI,CAAC,GAAM,EAAG,GAAI,GAAI,GAAI,CAAC,GAAG,mBAAmB,CAAE,CAAC,CAAE,EAAG,GAAI,CAAC,EAAC,EAAG,GAAI,CAAC,EAAC,EAAG,GAAI,CAAC,EAAG,GAAI,QAAS,CAAC,EAC9gB,GAAQ,CACV,QAAS,MACT,WAAY,CAAE,OAAQ,GAAG,aAAc,GAAG,QAAS,GAAG,SAAU,EAAE,EAClE,MAAO,CACH,CACI,WAAY,CAAC,EAAG,GAAI,GAAI,GAAI,CAAC,EAAC,CAAE,CAAC,EACjC,MAAO,CACH,CAAE,WAAY,GAAG,MAAO,oEAAqE,KAAM,CAAE,EACrG,CAAE,WAAY,GAAG,MAAO,yEAA0E,KAAM,CAAE,EAC1G,CAAE,SAAU,CAAE,IAAK,GAAG,WAAY,EAAG,QAAS,CAAE,EAAG,KAAM,CAAE,CAC/D,EACA,KAAM,CACV,EACA,CACI,WAAY,CAAC,EAAG,GAAI,GAAI,GAAI,EAAE,CAAC,EAC/B,MAAO,CACH,CACI,WAAY,CAAC,EAAG,GAAI,iBAAkB,GAAI,GAAG,OAAQ,CAAE,CAAC,EACxD,MAAO,CACH,CACI,WAAY,CAAC,GAAG,EAAC,EACjB,MAAO,CACH,CACI,WAAY,CAAC,EAAG,GAAI,GAAI,GAAI,CAAC,EAAG,EAAC,CAAE,EAAG,EAAC,EACvC,MAAO,CACH,CACI,SAAU,CACN,IAAK,wEACL,WAAY,EACZ,QAAS,CACb,EACA,KAAM,CACV,CACJ,EACA,KAAM,CACV,EACA,CAAE,MAAO,kFAAmF,KAAM,CAAE,CACxG,EACA,KAAM,CACV,EACA,CACI,WAAY,GACZ,MAAO,CACH,CACI,WAAY,CAAC,EAAG,GAAI,GAAI,GAAI,CAAC,GAAG,CAAC,CAAE,CAAC,EACpC,MAAO,CACH,CACI,WAAY,CAAC,EAAG,GAAI,gBAAiB,GAAI,CAAC,EAAG,GAAI,GAAI,GAAI,CAAC,GAAG,MAAM,CAAE,EAAG,YAAY,CAAE,CAAC,EACvF,SAAU,CAAE,IAAK,4CAA6C,WAAY,EAAG,QAAS,CAAE,EACxF,KAAM,CACV,EACA,CACI,SAAU,CACN,IAAK,+DACL,WAAY,EACZ,QAAS,CACb,EACA,KAAM,CACV,CACJ,EACA,KAAM,CACV,EACA,CAAE,MAAO,2DAA4D,KAAM,CAAE,CACjF,EACA,KAAM,CACV,EACA,CACI,WAAY,GACZ,MAAO,CACH,CACI,WAAY,CAAC,EAAC,EACd,MAAO,CACH,CACI,SAAU,CACN,IAAK,mEACL,WAAY,EACZ,QAAS,CACb,EACA,KAAM,CACV,CACJ,EACA,KAAM,CACV,EACA,CAAE,MAAO,qEAAsE,KAAM,CAAE,CAC3F,EACA,KAAM,CACV,EACA,CACI,SAAU,CAAE,IAAK,0DAA2D,WAAY,EAAG,QAAS,CAAE,EACtG,KAAM,CACV,CACJ,EACA,KAAM,CACV,CACJ,EACA,KAAM,CACV,EACA,CAAE,MAAO,wCAAyC,KAAM,CAAE,CAC9D,CACJ,EACQ,WAAU,qBCxGlB,OAAO,eAAe,GAAS,aAAc,CAAE,MAAO,EAAK,CAAC,EACpD,2BAA+B,OACvC,IAAM,QACA,OACA,QACA,GAAQ,IAAI,EAAiB,cAAc,CAC7C,KAAM,GACN,OAAQ,CAAC,WAAY,SAAU,eAAgB,SAAS,CAC5D,CAAC,EACK,GAA0B,CAAC,EAAgB,EAAU,CAAC,IAAM,CAC9D,OAAO,GAAM,IAAI,EAAgB,KAAO,EAAG,EAAiB,iBAAiB,GAAU,QAAS,CAC5F,eAAgB,EAChB,OAAQ,EAAQ,MACpB,CAAC,CAAC,GAEE,2BAA0B,GAClC,EAAiB,wBAAwB,IAAM,GAAiB,qCChBhE,OAAO,eAAe,EAAS,aAAc,CAAE,MAAO,EAAK,CAAC,EACpD,sBAA8B,qBAA0B,OAChE,IAAM,OACN,OAAO,eAAe,EAAS,qBAAsB,CAAE,WAAY,GAAM,IAAK,QAAS,EAAG,CAAE,OAAO,GAAgB,iBAAoB,CAAC,EACxI,MAAM,UAA4B,GAAgB,gBAAiB,CAC/D,WAAW,CAAC,EAAS,CACjB,MAAM,CAAO,EACb,OAAO,eAAe,KAAM,EAAoB,SAAS,EAEjE,CACQ,sBAAsB,mBCV9B,OAAO,eAAe,GAAS,aAAc,CAAE,MAAO,EAAK,CAAC,EACpD,yBAAgC,4BAAmC,6BAAoC,2BAA+B,OAC9I,IAAM,MACN,MAAM,UAAgC,EAAsB,mBAAoB,CAC5E,KAAO,0BACP,OAAS,SACT,WAAW,CAAC,EAAM,CACd,MAAM,CACF,KAAM,0BACN,OAAQ,YACL,CACP,CAAC,EACD,OAAO,eAAe,KAAM,EAAwB,SAAS,EAErE,CACQ,2BAA0B,EAClC,MAAM,UAAkC,EAAsB,mBAAoB,CAC9E,KAAO,4BACP,OAAS,SACT,WAAW,CAAC,EAAM,CACd,MAAM,CACF,KAAM,4BACN,OAAQ,YACL,CACP,CAAC,EACD,OAAO,eAAe,KAAM,EAA0B,SAAS,EAEvE,CACQ,6BAA4B,EACpC,MAAM,UAAiC,EAAsB,mBAAoB,CAC7E,KAAO,2BACP,OAAS,SACT,WAAW,CAAC,EAAM,CACd,MAAM,CACF,KAAM,2BACN,OAAQ,YACL,CACP,CAAC,EACD,OAAO,eAAe,KAAM,EAAyB,SAAS,EAEtE,CACQ,4BAA2B,EACnC,MAAM,UAA8B,EAAsB,mBAAoB,CAC1E,KAAO,wBACP,OAAS,SACT,WAAW,CAAC,EAAM,CACd,MAAM,CACF,KAAM,wBACN,OAAQ,YACL,CACP,CAAC,EACD,OAAO,eAAe,KAAM,EAAsB,SAAS,EAEnE,CACQ,yBAAwB,mBCtDhC,OAAO,eAAe,GAAS,aAAc,CAAE,MAAO,EAAK,CAAC,EACpD,uBAA8B,oBAA2B,+BAAsC,8BAAqC,uBAA8B,0BAAiC,6BAAoC,8BAAqC,4BAAmC,wBAA4B,OACnV,IAAM,GAAO,kBACP,GAAO,qBACP,GAAQ,4BACR,GAAS,6BACT,GAAO,0BACP,GAAM,kBACN,GAAQ,4BACR,GAAQ,sBACR,GAAO,mBACP,GAAQ,2BACR,GAAM,wBACN,GAAM,YACN,GAAO,cACP,GAAM,cACN,GAAM,aACN,EAAK,SACL,EAAK,QACL,GAAM,aACN,GAAK,OACL,EAAM,YACN,GAAM,aACN,GAAM,YACN,EAAK,UACL,GAAM,kBACN,GAAM,WACN,GAAM,YACN,GAAK,4CACL,GAAO,kBACP,GAAM,eACN,GAAS,yBACT,EAAK,oBACL,QACA,MACA,OACA,GAAc,GAAS,aAAa,IAAI,EAAE,EACxC,wBAAuB,CAAC,GAAI,GAAI,sBAAuB,EAAG,CAAC,EAAG,CAAC,CAAC,EACxE,GAAY,cAAsB,wBAAsB,GAAsB,mBAAmB,EACjG,IAAM,EAAc,GAAS,aAAa,IAAI,CAAE,EACxC,4BAA2B,CAAC,GAAI,EAAI,GAAM,EAAG,GAAK,GAAK,GAAM,GAAI,EAAG,CAAC,CAAE,EAAG,CAAC,CAAC,CAAC,EACrF,EAAY,cAAsB,4BAA0B,EAAS,uBAAuB,EACpF,8BAA6B,CAAC,GAAI,EAAI,GAAO,EAAG,GAAK,GAAK,GAAM,GAAI,EAAG,CAAC,CAAE,EAAG,CAAC,CAAC,CAAC,EACxF,EAAY,cAAsB,8BAA4B,EAAS,yBAAyB,EACxF,6BAA4B,CAAC,GAAI,EAAI,GAAO,EAAG,GAAK,GAAK,GAAM,GAAI,EAAG,CAAC,CAAE,EAAG,CAAC,CAAC,CAAC,EACvF,EAAY,cAAsB,6BAA2B,EAAS,wBAAwB,EACtF,0BAAyB,CAAC,GAAI,EAAI,GAAK,EAAG,GAAK,GAAK,GAAM,GAAI,EAAG,CAAC,CAAE,EAAG,CAAC,CAAC,CAAC,EAClF,EAAY,cAAsB,0BAAwB,EAAS,qBAAqB,EAChF,uBAAsB,CAAC,GAAa,CAAW,EACvD,IAAI,GAAkB,CAAC,EAAG,EAAI,GAAM,EAAG,CAAC,EACpC,GAAsB,CAAC,EAAG,EAAI,GAAO,EAAG,CAAC,EACzC,GAAmB,CAAC,EAAG,EAAI,GAAM,EAAG,CAAC,EACjC,8BAA6B,CACjC,EACA,EACA,GACA,EACA,CAAC,GAAK,GAAK,EAAG,EACd,CACI,CAAC,EAAG,EAAG,IAAM,EAAI,CAAC,EAClB,CAAC,EAAG,EAAG,IAAM,EAAI,CAAC,EAClB,CAAC,IAAM,GAAiB,EAAG,IAAM,EAAO,CAAC,CAC7C,EACA,CACJ,EACQ,+BAA8B,CAClC,EACA,EACA,GACA,EACA,CAAC,EAAG,EACJ,CAAC,CAAC,IAAc,oBAAkB,CAAC,CAAC,CACxC,EACQ,oBAAmB,CACvB,EACA,EACA,GACA,EACA,CAAC,GAAM,GAAM,GAAK,EAAG,EACrB,CAAC,EAAG,CAAC,IAAM,GAAqB,CAAC,EAAG,CAAC,IAAM,GAAkB,CAAC,EAAG,CAAC,CACtE,EACQ,uBAAsB,CAC1B,EACA,EACA,GACA,EAAG,IAAK,CAAC,MAAO,0BAA2B,GAAG,CAAE,EAChD,IAAc,8BACd,IAAc,8BAClB,oBCxFA,OAAO,eAAe,GAAS,aAAc,CAAE,MAAO,EAAK,CAAC,EACpD,oBAAwB,OAChC,IAAM,OACA,QACA,QACA,OACA,QACA,QACA,QACA,OACA,QACA,OACA,GAAmB,CAAC,IAAW,CACjC,MAAO,CACH,WAAY,aACZ,cAAe,GAAQ,eAAiB,GAAc,WACtD,cAAe,GAAQ,eAAiB,GAAc,SACtD,kBAAmB,GAAQ,mBAAqB,GAChD,iBAAkB,GAAQ,kBAAoB,GAAmB,wBACjE,WAAY,GAAQ,YAAc,CAAC,EACnC,uBAAwB,GAAQ,wBAA0B,GAAyB,iCACnF,gBAAiB,GAAQ,iBAAmB,CACxC,CACI,SAAU,iBACV,iBAAkB,CAAC,IAAQ,EAAI,oBAAoB,gBAAgB,EACnE,OAAQ,IAAI,GAAO,iBACvB,EACA,CACI,SAAU,oBACV,iBAAkB,CAAC,IAAQ,EAAI,oBAAoB,mBAAmB,IAAM,UAAa,CAAC,IAC1F,OAAQ,IAAI,GAAO,YACvB,CACJ,EACA,OAAQ,GAAQ,QAAU,IAAI,GAAgB,WAC9C,SAAU,GAAQ,UAAY,GAAY,oBAC1C,iBAAkB,GAAQ,kBAAoB,CAC1C,iBAAkB,oBAClB,oBAAqB,GAAY,oBACjC,QAAS,aACT,cAAe,kBACnB,EACA,UAAW,GAAQ,WAAa,MAChC,UAAW,GAAQ,WAAa,GAAa,SAC7C,YAAa,GAAQ,aAAe,GAAY,SAChD,YAAa,GAAQ,aAAe,GAAY,MACpD,GAEI,oBAAmB,qBC/C3B,OAAO,eAAe,GAAS,aAAc,CAAE,MAAO,EAAK,CAAC,EACpD,oBAAwB,OAChC,IAAM,QACA,GAAiB,GAAQ,oBAAgD,EACzE,OACA,QACA,OACA,QACA,QACA,OACA,QACA,OACA,QACA,QACA,QACA,QACA,GAAmB,CAAC,IAAW,EAChC,EAAG,GAAgB,iCAAiC,QAAQ,OAAO,EACpE,IAAM,GAAgB,EAAG,GAA0B,2BAA2B,CAAM,EAC9E,EAAwB,IAAM,EAAa,EAAE,KAAK,GAAgB,yBAAyB,EAC3F,GAAsB,EAAG,GAAuB,kBAAkB,CAAM,GAC7E,EAAG,GAAO,iCAAiC,QAAQ,OAAO,EAC3D,IAAM,EAAe,CACjB,QAAS,GAAQ,QACjB,OAAQ,EAAmB,MAC/B,EACA,MAAO,IACA,KACA,EACH,QAAS,OACT,eACA,qBAAsB,GAAQ,uBAAyB,EAAG,EAAuB,YAAY,GAAO,oCAAqC,CAAY,EACrJ,kBAAmB,GAAQ,mBAAqB,GAAwB,oBACxE,yBAA0B,GAAQ,2BAC7B,EAAG,GAAuB,gCAAgC,CAAE,UAAW,EAAmB,UAAW,cAAe,GAAe,QAAQ,OAAQ,CAAC,EACzJ,YAAa,GAAQ,cAAgB,EAAG,EAAuB,YAAY,GAAmB,gCAAiC,CAAM,EACrI,OAAQ,GAAQ,SACX,EAAG,EAAuB,YAAY,EAAkB,2BAA4B,IAAK,EAAkB,mCAAoC,CAAa,CAAC,EAClK,eAAgB,GAAoB,gBAAgB,OAAO,GAAQ,gBAAkB,CAAqB,EAC1G,UAAW,GAAQ,YACd,EAAG,EAAuB,YAAY,IAChC,GAAmB,+BACtB,QAAS,UAAa,MAAM,EAAsB,GAAG,WAAa,GAAa,kBACnF,EAAG,CAAM,EACb,OAAQ,GAAQ,QAAU,GAAY,KAAK,KAAK,KAAM,QAAQ,EAC9D,gBAAiB,GAAQ,iBAAmB,GAAoB,gBAChE,qBAAsB,GAAQ,uBAAyB,EAAG,EAAuB,YAAY,EAAkB,2CAA4C,CAAY,EACvK,gBAAiB,GAAQ,kBAAoB,EAAG,EAAuB,YAAY,EAAkB,sCAAuC,CAAY,EACxJ,eAAgB,GAAQ,iBAAmB,EAAG,EAAuB,YAAY,GAAuB,2BAA4B,CAAY,CACpJ,GAEI,oBAAmB,oBClD3B,IAAI,QACA,QACA,QACA,QACA,QACA,OACA,QACA,QACA,QACA,QACA,MACA,OACA,QACA,QACA,QACA,MACA,MACA,OAEE,GAAkC,CAAC,IAAY,CACjD,OAAO,OAAO,OAAO,EAAS,CAC1B,qBAAsB,EAAQ,sBAAwB,GACtD,gBAAiB,EAAQ,iBAAmB,GAC5C,mBAAoB,cACxB,CAAC,GAEC,GAAe,CACjB,QAAS,CAAE,KAAM,gBAAiB,KAAM,iBAAkB,EAC1D,SAAU,CAAE,KAAM,gBAAiB,KAAM,UAAW,EACpD,OAAQ,CAAE,KAAM,gBAAiB,KAAM,QAAS,EAChD,aAAc,CAAE,KAAM,gBAAiB,KAAM,sBAAuB,CACxE,EAEM,GAAoC,CAAC,IAAkB,CACzD,IAAuC,gBAAjC,EACsC,uBAAxC,EAC6B,YAA7B,GAD0B,EAE9B,MAAO,CACH,iBAAiB,CAAC,EAAgB,CAC9B,IAAM,EAAQ,EAAiB,UAAU,CAAC,IAAW,EAAO,WAAa,EAAe,QAAQ,EAChG,GAAI,IAAU,GACV,EAAiB,KAAK,CAAc,EAGpC,OAAiB,OAAO,EAAO,EAAG,CAAc,GAGxD,eAAe,EAAG,CACd,OAAO,GAEX,yBAAyB,CAAC,EAAwB,CAC9C,EAA0B,GAE9B,sBAAsB,EAAG,CACrB,OAAO,GAEX,cAAc,CAAC,EAAa,CACxB,EAAe,GAEnB,WAAW,EAAG,CACV,OAAO,EAEf,GAEE,GAA+B,CAAC,IAAW,CAC7C,MAAO,CACH,gBAAiB,EAAO,gBAAgB,EACxC,uBAAwB,EAAO,uBAAuB,EACtD,YAAa,EAAO,YAAY,CACpC,GAGE,GAA2B,CAAC,EAAe,IAAe,CAC5D,IAAM,EAAyB,OAAO,OAAO,GAAqB,mCAAmC,CAAa,EAAG,EAAa,iCAAiC,CAAa,EAAG,GAAa,qCAAqC,CAAa,EAAG,GAAkC,CAAa,CAAC,EAErS,OADA,EAAW,QAAQ,CAAC,IAAc,EAAU,UAAU,CAAsB,CAAC,EACtE,OAAO,OAAO,EAAe,GAAqB,uCAAuC,CAAsB,EAAG,EAAa,4BAA4B,CAAsB,EAAG,GAAa,gCAAgC,CAAsB,EAAG,GAA6B,CAAsB,CAAC,GAGzT,MAAM,UAAkB,EAAa,MAAO,CACxC,OACA,WAAW,KAAK,GAAgB,CAC5B,IAAM,EAAY,GAAc,iBAAiB,GAAiB,CAAC,CAAC,EACpE,MAAM,CAAS,EACf,KAAK,WAAa,EAClB,IAAM,EAAY,GAAgC,CAAS,EACrD,EAAY,GAAoB,uBAAuB,CAAS,EAChE,EAAY,GAAgB,mBAAmB,CAAS,EACxD,EAAY,GAAe,oBAAoB,CAAS,EACxD,EAAY,GAAqB,wBAAwB,CAAS,EAClE,GAAY,GAAmB,sBAAsB,CAAS,EAC9D,GAAY,GAAuB,4BAA4B,EAAS,EACxE,GAAY,GAAyB,GAAW,GAAe,YAAc,CAAC,CAAC,EACrF,KAAK,OAAS,GACd,KAAK,gBAAgB,IAAI,GAAO,qBAAqB,KAAK,MAAM,CAAC,EACjE,KAAK,gBAAgB,IAAI,GAAoB,mBAAmB,KAAK,MAAM,CAAC,EAC5E,KAAK,gBAAgB,IAAI,GAAgB,eAAe,KAAK,MAAM,CAAC,EACpE,KAAK,gBAAgB,IAAI,GAAwB,uBAAuB,KAAK,MAAM,CAAC,EACpF,KAAK,gBAAgB,IAAI,GAAqB,oBAAoB,KAAK,MAAM,CAAC,EAC9E,KAAK,gBAAgB,IAAI,GAAiB,gBAAgB,KAAK,MAAM,CAAC,EACtE,KAAK,gBAAgB,IAAI,GAA6B,4BAA4B,KAAK,MAAM,CAAC,EAC9F,KAAK,gBAAgB,IAAI,EAAK,uCAAuC,KAAK,OAAQ,CAC9E,iCAAkC,GAAuB,2CACzD,+BAAgC,MAAO,KAAW,IAAI,EAAK,8BAA8B,CACrF,iBAAkB,GAAO,WAC7B,CAAC,CACL,CAAC,CAAC,EACF,KAAK,gBAAgB,IAAI,EAAK,qBAAqB,KAAK,MAAM,CAAC,EAEnE,OAAO,EAAG,CACN,MAAM,QAAQ,EAEtB,CAEA,MAAM,UAAkC,EAAa,QAChD,aAAa,EACb,GAAG,EAAY,EACf,EAAE,QAAS,CAAC,EAAS,EAAI,EAAQ,EAAG,CACrC,MAAO,CAAC,GAAmB,kBAAkB,EAAQ,EAAQ,iCAAiC,CAAC,CAAC,EACnG,EACI,EAAE,mBAAoB,qBAAsB,CAAC,CAAC,EAC9C,EAAE,YAAa,2BAA2B,EAC1C,GAAG,EAAU,mBAAmB,EAChC,MAAM,CAAE,CACb,CAEA,IAAM,GAAW,CACb,2BACJ,EACA,MAAM,UAAY,CAAU,CAC5B,CACA,EAAa,uBAAuB,GAAU,CAAG,EAEzC,WAAW,EAAa,QACxB,WAAW,EAAa,OACxB,sBAAsB,GAAoB,oBAC1C,4BAA4B,EAC5B,MAAM,EACN,YAAY,EACpB,OAAO,UAAU,eAAe,KAAK,EAAW,WAAW,GACvD,CAAC,OAAO,UAAU,eAAe,KAAK,EAAS,WAAW,GAC1D,OAAO,eAAe,EAAS,YAAa,CACxC,WAAY,GACZ,MAAO,EAAU,SACrB,CAAC,EAEL,OAAO,KAAK,CAAS,EAAE,QAAQ,QAAS,CAAC,EAAG,CACxC,GAAI,IAAM,WAAa,CAAC,OAAO,UAAU,eAAe,KAAK,EAAS,CAAC,EAAG,EAAQ,GAAK,EAAU,GACpG,EACD,OAAO,UAAU,eAAe,KAAK,EAAQ,WAAW,GACpD,CAAC,OAAO,UAAU,eAAe,KAAK,EAAS,WAAW,GAC1D,OAAO,eAAe,EAAS,YAAa,CACxC,WAAY,GACZ,MAAO,EAAO,SAClB,CAAC,EAEL,OAAO,KAAK,CAAM,EAAE,QAAQ,QAAS,CAAC,EAAG,CACrC,GAAI,IAAM,WAAa,CAAC,OAAO,UAAU,eAAe,KAAK,EAAS,CAAC,EAAG,EAAQ,GAAK,EAAO,GACjG,IC/JD",
-  "debugId": "699B975C083D617E64756E2164756E21",
+  "debugId": "A7A2FD45323C514864756E2164756E21",
   "names": []
 }

package/dist/{chunk-yfwrbfnw.js → chunk-xfw8zyvn.js}

@@ -1,5 +1,5 @@
 // @bun
-import{Wi as n}from"./chunk-dcgvq79a.js";var w=n((p)=>{var r={warningEmitted:!1},a=(e)=>{if(e&&!r.warningEmitted&&parseInt(e.substring(1,e.indexOf(".")))<20)r.warningEmitted=!0,process.emitWarning(`NodeDeprecationWarning: The AWS SDK for JavaScript (v3) will
+import{fj as n}from"./chunk-hm9cjxy2.js";var w=n((p)=>{var r={warningEmitted:!1},a=(e)=>{if(e&&!r.warningEmitted&&parseInt(e.substring(1,e.indexOf(".")))<20)r.warningEmitted=!0,process.emitWarning(`NodeDeprecationWarning: The AWS SDK for JavaScript (v3) will
 no longer support Node.js ${e} in January 2026.
 
 To continue receiving updates to AWS services, bug fixes, and security
@@ -8,4 +8,4 @@ updates please upgrade to a supported Node.js LTS version.
 More information can be found at: https://a.co/c895JFp`)};function o(e,t,s){if(!e.$source)e.$source={};return e.$source[t]=s,e}function u(e,t,s){if(!e.__aws_sdk_context)e.__aws_sdk_context={features:{}};else if(!e.__aws_sdk_context.features)e.__aws_sdk_context.features={};e.__aws_sdk_context.features[t]=s}function i(e,t,s){if(!e.$source)e.$source={};return e.$source[t]=s,e}p.emitWarningIfUnsupportedVersion=a;p.setCredentialFeature=o;p.setFeature=u;p.setTokenFeature=i;p.state=r});
 export{w as Q};
 
-//# debugId=0AFD92BC87DC7AA164756E2164756E21
+//# debugId=F8E5E1BCAD8798BE64756E2164756E21

package/dist/{chunk-yfwrbfnw.js.map → chunk-xfw8zyvn.js.map}

@@ -5,6 +5,6 @@
     "'use strict';\n\nconst state = {\n    warningEmitted: false,\n};\nconst emitWarningIfUnsupportedVersion = (version) => {\n    if (version && !state.warningEmitted && parseInt(version.substring(1, version.indexOf(\".\"))) < 20) {\n        state.warningEmitted = true;\n        process.emitWarning(`NodeDeprecationWarning: The AWS SDK for JavaScript (v3) will\nno longer support Node.js ${version} in January 2026.\n\nTo continue receiving updates to AWS services, bug fixes, and security\nupdates please upgrade to a supported Node.js LTS version.\n\nMore information can be found at: https://a.co/c895JFp`);\n    }\n};\n\nfunction setCredentialFeature(credentials, feature, value) {\n    if (!credentials.$source) {\n        credentials.$source = {};\n    }\n    credentials.$source[feature] = value;\n    return credentials;\n}\n\nfunction setFeature(context, feature, value) {\n    if (!context.__aws_sdk_context) {\n        context.__aws_sdk_context = {\n            features: {},\n        };\n    }\n    else if (!context.__aws_sdk_context.features) {\n        context.__aws_sdk_context.features = {};\n    }\n    context.__aws_sdk_context.features[feature] = value;\n}\n\nfunction setTokenFeature(token, feature, value) {\n    if (!token.$source) {\n        token.$source = {};\n    }\n    token.$source[feature] = value;\n    return token;\n}\n\nexports.emitWarningIfUnsupportedVersion = emitWarningIfUnsupportedVersion;\nexports.setCredentialFeature = setCredentialFeature;\nexports.setFeature = setFeature;\nexports.setTokenFeature = setTokenFeature;\nexports.state = state;\n"
   ],
   "mappings": ";uDAEA,IAAM,EAAQ,CACV,eAAgB,EACpB,EACM,EAAkC,CAAC,IAAY,CACjD,GAAI,GAAW,CAAC,EAAM,gBAAkB,SAAS,EAAQ,UAAU,EAAG,EAAQ,QAAQ,GAAG,CAAC,CAAC,EAAI,GAC3F,EAAM,eAAiB,GACvB,QAAQ,YAAY;AAAA,4BACA;AAAA;AAAA;AAAA;AAAA;AAAA,uDAK2B,GAIvD,SAAS,CAAoB,CAAC,EAAa,EAAS,EAAO,CACvD,GAAI,CAAC,EAAY,QACb,EAAY,QAAU,CAAC,EAG3B,OADA,EAAY,QAAQ,GAAW,EACxB,EAGX,SAAS,CAAU,CAAC,EAAS,EAAS,EAAO,CACzC,GAAI,CAAC,EAAQ,kBACT,EAAQ,kBAAoB,CACxB,SAAU,CAAC,CACf,EAEC,QAAI,CAAC,EAAQ,kBAAkB,SAChC,EAAQ,kBAAkB,SAAW,CAAC,EAE1C,EAAQ,kBAAkB,SAAS,GAAW,EAGlD,SAAS,CAAe,CAAC,EAAO,EAAS,EAAO,CAC5C,GAAI,CAAC,EAAM,QACP,EAAM,QAAU,CAAC,EAGrB,OADA,EAAM,QAAQ,GAAW,EAClB,EAGH,kCAAkC,EAClC,uBAAuB,EACvB,aAAa,EACb,kBAAkB,EAClB,QAAQ",
-  "debugId": "0AFD92BC87DC7AA164756E2164756E21",
+  "debugId": "F8E5E1BCAD8798BE64756E2164756E21",
   "names": []
 }

package/dist/{chunk-sksmnjkn.js → chunk-xtzn0qfh.js}

@@ -1,6 +1,6 @@
 // @bun
-import{Nc as G}from"./chunk-n9jyjp4a.js";import{lf as F}from"./chunk-g2wncay4.js";import{Ch as E}from"./chunk-dz99g58c.js";import{Vh as B,gi as x}from"./chunk-5w6kyxsj.js";class J extends G{register(){this.app.singleton(x,()=>{let j=new x(E(B(),this.app.config.get("database",{})));return K(j),j})}async shutdown(){if(!this.app.resolved(x))return;await this.app.make(x).close()}}function K(j){if(Bun.env.NODE_ENV!=="development")return;for(let z of j.connectionNames){let A=j.connection(z);if(F(A.dialect))continue;let H=z===j.name?"DATABASE_URL":`The "${z}" database connection`;console.warn(`[gemi] ${H} points at ${A.dialect}, which the gemi ORM `+"does not implement \u2014 only sqlite and postgres are. The connection "+`works, so raw SQL through DB.query / DB.sql and transactions are fine, but every model operation will raise UnsupportedDialectError.
+import{Yc as G}from"./chunk-30xxc6r7.js";import{wf as F}from"./chunk-eke2frrm.js";import{Nh as E}from"./chunk-gqfqnv3f.js";import{ei as B,ri as x}from"./chunk-hr1r3g0d.js";class J extends G{register(){this.app.singleton(x,()=>{let j=new x(E(B(),this.app.config.get("database",{})));return K(j),j})}async shutdown(){if(!this.app.resolved(x))return;await this.app.make(x).close()}}function K(j){if(Bun.env.NODE_ENV!=="development")return;for(let z of j.connectionNames){let A=j.connection(z);if(F(A.dialect))continue;let H=z===j.name?"DATABASE_URL":`The "${z}" database connection`;console.warn(`[gemi] ${H} points at ${A.dialect}, which the gemi ORM `+"does not implement \u2014 only sqlite and postgres are. The connection "+`works, so raw SQL through DB.query / DB.sql and transactions are fine, but every model operation will raise UnsupportedDialectError.
 (development only)`)}}
 export{J as Ja};
 
-//# debugId=76D4D95FD98D01D964756E2164756E21
+//# debugId=DB2873890436A75B64756E2164756E21

package/dist/{chunk-sksmnjkn.js.map → chunk-xtzn0qfh.js.map}

@@ -5,6 +5,6 @@
     "import { ormSupports } from \"../orm/dialect\";\nimport { ServiceProvider } from \"../support/ServiceProvider\";\nimport { withDefaults } from \"../support/withDefaults\";\nimport { databaseConfigDefaults, type DatabaseConfig } from \"./config\";\nimport { DatabaseManager } from \"./DatabaseManager\";\n\nexport class DatabaseServiceProvider extends ServiceProvider {\n  register() {\n    this.app.singleton(\n      DatabaseManager,\n      () => {\n        const database = new DatabaseManager(\n          withDefaults(\n            databaseConfigDefaults(),\n            this.app.config.get<DatabaseConfig>(\"database\", {}),\n          ),\n        );\n\n        warnIfOrmUnavailable(database);\n        return database;\n      },\n    );\n  }\n\n  /**\n   * Closes every connection's pool. Registered early, so it runs late: after\n   * the queue and the scheduler have waited for their jobs, which still need\n   * it. Bun's `close()` lets a query already sent finish.\n   *\n   * On the way out of a production server this only tidies up before the\n   * exit. Under `gemi dev` it is the whole point: a `bun --hot` reload boots\n   * a new application with a new pool, and the replaced one's is closed here\n   * rather than left holding its connections for the life of the process\n   * (#652).\n   */\n  async shutdown() {\n    // Resolving the manager now would open a pool only to close it.\n    if (!this.app.resolved(DatabaseManager)) return;\n    await this.app.make(DatabaseManager).close();\n  }\n}\n\n/**\n * Say it at boot, not on the first model query.\n *\n * `DatabaseManager` connects to MySQL and MariaDB without complaint — Bun's\n * client speaks them — and the ORM's compiler has no dialect for either. So a\n * deploy pointed at one starts, passes a health check, serves whatever does not\n * touch a model, and raises `UnsupportedDialectError` on the first `findMany`.\n * That is the latest and most expensive moment to learn it.\n *\n * A **warning rather than a throw**, deliberately: raw SQL through `DB.query`\n * and `DB.sql` genuinely works on those dialects, and so do transactions.\n * Refusing to construct the manager would break code that is correct today to\n * pre-empt an error the ORM already raises clearly. The supported set is a\n * property of the query compiler, not of the connection.\n *\n * Development only, for the same reason the slow-transaction warning is: it is\n * a diagnostic aimed at whoever is choosing the database, and it should not\n * add noise to a production log every time the container starts.\n */\nfunction warnIfOrmUnavailable(database: DatabaseManager): void {\n  if (process.env.NODE_ENV !== \"development\") return;\n\n  // Every connection, not only the default one. A named connection is a whole\n  // pool an application will run model queries on — `Model.on(\"analytics\")` —\n  // so it can be pointed at MySQL exactly as the default can, and warning about\n  // only one of them would make the check pass while the query that raises is\n  // on the other.\n  for (const name of database.connectionNames) {\n    const connection = database.connection(name);\n    if (ormSupports(connection.dialect)) continue;\n\n    const source =\n      name === database.name\n        ? \"DATABASE_URL\"\n        : `The \"${name}\" database connection`;\n\n    console.warn(\n      `[gemi] ${source} points at ${connection.dialect}, which the gemi ORM ` +\n        `does not implement — only sqlite and postgres are. The connection ` +\n        `works, so raw SQL through DB.query / DB.sql and transactions are ` +\n        `fine, but every model operation will raise ` +\n        `UnsupportedDialectError.\\n(development only)`,\n    );\n  }\n}\n"
   ],
   "mappings": ";8LAMO,AAAM,IAAgC,LAAgB,CAC3D,QAAQ,EAAG,CACT,KAAK,IAAI,UACP,EACA,IAAM,CACJ,IAAM,EAAW,IAAI,EACnB,EACE,EAAuB,EACvB,KAAK,IAAI,OAAO,IAAoB,WAAY,CAAC,CAAC,CACpD,CACF,EAGA,OADA,EAAqB,CAAQ,EACtB,EAEX,OAcI,SAAQ,EAAG,CAEf,GAAI,CAAC,KAAK,IAAI,SAAS,CAAe,EAAG,OACzC,MAAM,KAAK,IAAI,KAAK,CAAe,EAAE,MAAM,EAE/C,CAqBA,SAAS,CAAoB,CAAC,EAAiC,CAC7D,GAAI,mBAAyB,cAAe,OAO5C,QAAW,KAAQ,EAAS,gBAAiB,CAC3C,IAAM,EAAa,EAAS,WAAW,CAAI,EAC3C,GAAI,EAAY,EAAW,OAAO,EAAG,SAErC,IAAM,EACJ,IAAS,EAAS,KACd,eACA,QAAQ,yBAEd,QAAQ,KACN,UAAU,eAAoB,EAAW,+BACvC,0EACA;AAAA,mBAGJ",
-  "debugId": "76D4D95FD98D01D964756E2164756E21",
+  "debugId": "DB2873890436A75B64756E2164756E21",
   "names": []
 }

package/dist/{chunk-jpetnpzn.js → chunk-xx3zvc3g.js}

@@ -1,5 +1,5 @@
 // @bun
 class J extends Error{lock;token;constructor(x,y,B="its lease ran out or another holder took it"){super(`Lost the lock "${x}" (token ${y}): ${B}.`);this.lock=x;this.token=y;this.name="LockLostError"}}var Q=60000,V=100,X=(x)=>new Promise((y)=>setTimeout(y,x));class O{store;name;owner;token;ttl;lost;controller=new AbortController;deadline;expiryTimer;renewTimer;done=!1;constructor(x,y,B,z,C,G){this.store=x;this.name=y;this.owner=B;this.token=z;this.ttl=C;this.lost=this.controller.signal,this.deadline=G+C,this.armExpiry()}get expired(){return this.lost.aborted||performance.now()>=this.deadline}async extend(x=this.ttl){if(this.lost.aborted)return!1;let y=performance.now();if(!await this.store.extend(this.name,this.owner,this.token,x))return this.markLost(),!1;if(this.done)return!0;return this.deadline=Math.max(this.deadline,y+x),this.armExpiry(),!0}async isHeld(){if(this.lost.aborted)return!1;let x=await this.store.held(this.name,this.owner,this.token);if(!x)this.markLost();return x}async fence(x){if(this.lost.aborted)throw new J(this.name,this.token);try{return await this.store.fence(this.name,this.owner,this.token,x)}catch(y){if(y instanceof J)this.markLost();throw y}}async release(){if(this.stop(),this.lost.aborted)return!1;return this.store.release(this.name,this.owner,this.token)}startRenewing(){if(this.renewTimer||this.done)return;this.renewTimer=setInterval(()=>{this.extend().catch((x)=>{console.error(`[gemi] Could not renew the lock "${this.name}".`,x)})},Math.max(1,Math.floor(this.ttl/3))),this.renewTimer.unref?.()}markLost(x){if(this.stop(),!this.lost.aborted)this.controller.abort(new J(this.name,this.token,x))}stop(){this.done=!0,clearInterval(this.renewTimer),clearTimeout(this.expiryTimer),this.renewTimer=void 0,this.expiryTimer=void 0}armExpiry(){clearTimeout(this.expiryTimer),this.expiryTimer=setTimeout(()=>this.markLost("its lease ran out before it was renewed"),Math.max(0,this.deadline-performance.now())),this.expiryTimer.unref?.()}}class Y{store;static token="locks";constructor(x){this.store=x}async acquire(x,y={}){let B=y.ttl??Q;if(!(B>0))throw Error(`A lock's ttl must be a positive number of milliseconds; got ${B}.`);let z=Bun.randomUUIDv7(),C=performance.now()+Math.max(0,y.wait??0);for(;;){let G=performance.now(),K=await this.store.acquire(x,z,B);if(K!==null){let N=new O(this.store,x,z,K,B,G);if(y.renew)N.startRenewing();return N}let M=C-performance.now();if(M<=0)return null;await X(Math.min(V,M))}}async run(x,y,B){let z=await this.acquire(x,{...y,renew:y.renew??!0});if(!z)return{acquired:!1};let C;try{C=await B(z)}catch(G){throw await z.release().catch(()=>{}),G}if(z.expired)throw z.markLost(),z.lost.reason;return await z.release(),{acquired:!0,value:C}}}
-export{J as zh,O as Ah,Y as Bh};
+export{J as Kh,O as Lh,Y as Mh};
 
-//# debugId=FBB0004432ECCEB664756E2164756E21
+//# debugId=30EA8B58DA2E59FE64756E2164756E21

package/dist/{chunk-jpetnpzn.js.map → chunk-xx3zvc3g.js.map}

@@ -6,6 +6,6 @@
     "import { LockLostError, type LockStore } from \"./LockStore\";\n\nexport type AcquireOptions = {\n  /** The lease, in milliseconds. Default one minute. */\n  ttl?: number;\n  /**\n   * How long to keep trying when the lock is held, in milliseconds. Default\n   * `0`: one try.\n   */\n  wait?: number;\n  /**\n   * Renew the lease every third of `ttl` until the lock is released. Default\n   * `true` for `run`, `false` for `acquire`, whose caller may never release.\n   */\n  renew?: boolean;\n};\n\nexport type LockRunResult<T> = { acquired: true; value: T } | { acquired: false };\n\nconst DEFAULT_TTL = 60_000;\nconst WAIT_STEP = 100;\n\nconst sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));\n\n/**\n * One hold on a lock, from a successful `acquire` until `release` or the end\n * of its lease.\n *\n * `token` is the fencing token: it grows with each new holder of the name, so\n * a write that records it can be refused when an older holder tries to make\n * it late. `fence` does that refusal for writes to the application's own\n * database.\n *\n * `lost` aborts when the hold is known to be gone: a renewal found another\n * holder, or the lease ran out by this process's clock without a successful\n * renewal. The local deadline is measured from just before each request that\n * set the lease, so it always falls before the store's own expiry.\n */\nexport class HeldLock {\n  readonly lost: AbortSignal;\n  private readonly controller = new AbortController();\n  private deadline: number;\n  private expiryTimer: ReturnType<typeof setTimeout> | undefined;\n  private renewTimer: ReturnType<typeof setInterval> | undefined;\n  private done = false;\n\n  constructor(\n    private readonly store: LockStore,\n    readonly name: string,\n    readonly owner: string,\n    readonly token: number,\n    readonly ttl: number,\n    requestedAt: number,\n  ) {\n    this.lost = this.controller.signal;\n    this.deadline = requestedAt + ttl;\n    this.armExpiry();\n  }\n\n  /** Whether the lease has run out by this process's clock, or the hold was lost. */\n  get expired(): boolean {\n    return this.lost.aborted || performance.now() >= this.deadline;\n  }\n\n  /** Renews the lease. `false`, and `lost` aborted, when the hold was already gone. */\n  async extend(ttl = this.ttl): Promise<boolean> {\n    if (this.lost.aborted) return false;\n    const requestedAt = performance.now();\n    const ok = await this.store.extend(this.name, this.owner, this.token, ttl);\n    if (!ok) {\n      this.markLost();\n      return false;\n    }\n    if (this.done) return true;\n    this.deadline = Math.max(this.deadline, requestedAt + ttl);\n    this.armExpiry();\n    return true;\n  }\n\n  /** Asks the store whether this hold is still current. */\n  async isHeld(): Promise<boolean> {\n    if (this.lost.aborted) return false;\n    const held = await this.store.held(this.name, this.owner, this.token);\n    if (!held) this.markLost();\n    return held;\n  }\n\n  /**\n   * Runs `fn` only while this hold is current, and keeps the lock from\n   * changing hands until it settles; rejects with `LockLostError` otherwise.\n   * On the database store `fn` runs in a transaction on the store's\n   * connection, so ORM writes inside it commit only if the hold was current.\n   */\n  async fence<T>(fn: () => Promise<T>): Promise<T> {\n    if (this.lost.aborted) throw new LockLostError(this.name, this.token);\n    try {\n      return await this.store.fence(this.name, this.owner, this.token, fn);\n    } catch (error) {\n      if (error instanceof LockLostError) this.markLost();\n      throw error;\n    }\n  }\n\n  /** Ends the hold. `false` when it had already been lost. */\n  async release(): Promise<boolean> {\n    this.stop();\n    if (this.lost.aborted) return false;\n    return this.store.release(this.name, this.owner, this.token);\n  }\n\n  /** Renews every third of the lease until `release`. */\n  startRenewing() {\n    if (this.renewTimer || this.done) return;\n    this.renewTimer = setInterval(\n      () => {\n        this.extend().catch((error) => {\n          // Not lost yet: the local deadline still decides, so a store that\n          // comes back within the lease keeps the hold.\n          console.error(`[gemi] Could not renew the lock \"${this.name}\".`, error);\n        });\n      },\n      Math.max(1, Math.floor(this.ttl / 3)),\n    );\n    this.renewTimer.unref?.();\n  }\n\n  /** @internal Marks the hold as gone and stops every timer. */\n  markLost(detail?: string) {\n    this.stop();\n    if (!this.lost.aborted) {\n      this.controller.abort(new LockLostError(this.name, this.token, detail));\n    }\n  }\n\n  private stop() {\n    this.done = true;\n    clearInterval(this.renewTimer);\n    clearTimeout(this.expiryTimer);\n    this.renewTimer = undefined;\n    this.expiryTimer = undefined;\n  }\n\n  private armExpiry() {\n    clearTimeout(this.expiryTimer);\n    this.expiryTimer = setTimeout(\n      () => this.markLost(\"its lease ran out before it was renewed\"),\n      Math.max(0, this.deadline - performance.now()),\n    );\n    this.expiryTimer.unref?.();\n  }\n}\n\n/**\n * Named locks with leases and fencing tokens, over a `LockStore`. The queue\n * builds one over its own storage (`app(QueueManager).locks`), so with the\n * database driver the locks hold across every process sharing the database.\n * The `Lock` facade fronts it.\n */\nexport class LockManager {\n  static token = \"locks\";\n\n  constructor(readonly store: LockStore) {}\n\n  /** Takes the lock, or resolves `null` if it is held (after `wait`, when given). */\n  async acquire(name: string, options: AcquireOptions = {}): Promise<HeldLock | null> {\n    const ttl = options.ttl ?? DEFAULT_TTL;\n    if (!(ttl > 0))\n      throw new Error(`A lock's ttl must be a positive number of milliseconds; got ${ttl}.`);\n    const owner = Bun.randomUUIDv7();\n    const giveUpAt = performance.now() + Math.max(0, options.wait ?? 0);\n    for (;;) {\n      const requestedAt = performance.now();\n      const token = await this.store.acquire(name, owner, ttl);\n      if (token !== null) {\n        const lock = new HeldLock(this.store, name, owner, token, ttl, requestedAt);\n        if (options.renew) lock.startRenewing();\n        return lock;\n      }\n      const left = giveUpAt - performance.now();\n      if (left <= 0) return null;\n      await sleep(Math.min(WAIT_STEP, left));\n    }\n  }\n\n  /**\n   * Runs `fn` while holding the lock, renewing the lease as it runs, and\n   * releases it after. `{ acquired: false }` when the lock was held.\n   *\n   * If the hold is lost while `fn` runs, `lock.lost` aborts, and once `fn`\n   * settles this rejects with `LockLostError` instead of resolving: the caller\n   * must not treat work done without the lock as done under it.\n   */\n  async run<T>(\n    name: string,\n    options: AcquireOptions,\n    fn: (lock: HeldLock) => Promise<T> | T,\n  ): Promise<LockRunResult<T>> {\n    const lock = await this.acquire(name, { ...options, renew: options.renew ?? true });\n    if (!lock) return { acquired: false };\n\n    let value: T;\n    try {\n      value = await fn(lock);\n    } catch (error) {\n      await lock.release().catch(() => {});\n      throw error;\n    }\n    if (lock.expired) {\n      lock.markLost();\n      throw lock.lost.reason as LockLostError;\n    }\n    await lock.release();\n    return { acquired: true, value };\n  }\n}\n"
   ],
   "mappings": ";AAwFO,MAAM,UAAsB,KAAM,CAE5B,KACA,MAFX,WAAW,CACA,EACA,EACT,EAAS,8CACT,CACA,MAAM,kBAAkB,aAAgB,OAAW,IAAS,EAJnD,YACA,aAIT,KAAK,KAAO,gBAEhB,CC9EA,IAAM,EAAc,MACd,EAAY,IAEZ,EAAQ,CAAC,IAAe,IAAI,QAAQ,CAAC,IAAY,WAAW,EAAS,CAAE,CAAC,EAgBvE,MAAM,CAAS,CASD,MACR,KACA,MACA,MACA,IAZF,KACQ,WAAa,IAAI,gBAC1B,SACA,YACA,WACA,KAAO,GAEf,WAAW,CACQ,EACR,EACA,EACA,EACA,EACT,EACA,CANiB,aACR,YACA,aACA,aACA,WAGT,KAAK,KAAO,KAAK,WAAW,OAC5B,KAAK,SAAW,EAAc,EAC9B,KAAK,UAAU,KAIb,QAAO,EAAY,CACrB,OAAO,KAAK,KAAK,SAAW,YAAY,IAAI,GAAK,KAAK,cAIlD,OAAM,CAAC,EAAM,KAAK,IAAuB,CAC7C,GAAI,KAAK,KAAK,QAAS,MAAO,GAC9B,IAAM,EAAc,YAAY,IAAI,EAEpC,GAAI,CADO,MAAM,KAAK,MAAM,OAAO,KAAK,KAAM,KAAK,MAAO,KAAK,MAAO,CAAG,EAGvE,OADA,KAAK,SAAS,EACP,GAET,GAAI,KAAK,KAAM,MAAO,GAGtB,OAFA,KAAK,SAAW,KAAK,IAAI,KAAK,SAAU,EAAc,CAAG,EACzD,KAAK,UAAU,EACR,QAIH,OAAM,EAAqB,CAC/B,GAAI,KAAK,KAAK,QAAS,MAAO,GAC9B,IAAM,EAAO,MAAM,KAAK,MAAM,KAAK,KAAK,KAAM,KAAK,MAAO,KAAK,KAAK,EACpE,GAAI,CAAC,EAAM,KAAK,SAAS,EACzB,OAAO,OASH,MAAQ,CAAC,EAAkC,CAC/C,GAAI,KAAK,KAAK,QAAS,MAAM,IAAI,EAAc,KAAK,KAAM,KAAK,KAAK,EACpE,GAAI,CACF,OAAO,MAAM,KAAK,MAAM,MAAM,KAAK,KAAM,KAAK,MAAO,KAAK,MAAO,CAAE,EACnE,MAAO,EAAO,CACd,GAAI,aAAiB,EAAe,KAAK,SAAS,EAClD,MAAM,QAKJ,QAAO,EAAqB,CAEhC,GADA,KAAK,KAAK,EACN,KAAK,KAAK,QAAS,MAAO,GAC9B,OAAO,KAAK,MAAM,QAAQ,KAAK,KAAM,KAAK,MAAO,KAAK,KAAK,EAI7D,aAAa,EAAG,CACd,GAAI,KAAK,YAAc,KAAK,KAAM,OAClC,KAAK,WAAa,YAChB,IAAM,CACJ,KAAK,OAAO,EAAE,MAAM,CAAC,IAAU,CAG7B,QAAQ,MAAM,oCAAoC,KAAK,SAAU,CAAK,EACvE,GAEH,KAAK,IAAI,EAAG,KAAK,MAAM,KAAK,IAAM,CAAC,CAAC,CACtC,EACA,KAAK,WAAW,QAAQ,EAI1B,QAAQ,CAAC,EAAiB,CAExB,GADA,KAAK,KAAK,EACN,CAAC,KAAK,KAAK,QACb,KAAK,WAAW,MAAM,IAAI,EAAc,KAAK,KAAM,KAAK,MAAO,CAAM,CAAC,EAIlE,IAAI,EAAG,CACb,KAAK,KAAO,GACZ,cAAc,KAAK,UAAU,EAC7B,aAAa,KAAK,WAAW,EAC7B,KAAK,WAAa,OAClB,KAAK,YAAc,OAGb,SAAS,EAAG,CAClB,aAAa,KAAK,WAAW,EAC7B,KAAK,YAAc,WACjB,IAAM,KAAK,SAAS,yCAAyC,EAC7D,KAAK,IAAI,EAAG,KAAK,SAAW,YAAY,IAAI,CAAC,CAC/C,EACA,KAAK,YAAY,QAAQ,EAE7B,CAQO,MAAM,CAAY,CAGF,YAFd,OAAQ,QAEf,WAAW,CAAU,EAAkB,CAAlB,kBAGf,QAAO,CAAC,EAAc,EAA0B,CAAC,EAA6B,CAClF,IAAM,EAAM,EAAQ,KAAO,EAC3B,GAAI,EAAE,EAAM,GACV,MAAU,MAAM,+DAA+D,IAAM,EACvF,IAAM,EAAQ,IAAI,aAAa,EACzB,EAAW,YAAY,IAAI,EAAI,KAAK,IAAI,EAAG,EAAQ,MAAQ,CAAC,EAClE,OAAS,CACP,IAAM,EAAc,YAAY,IAAI,EAC9B,EAAQ,MAAM,KAAK,MAAM,QAAQ,EAAM,EAAO,CAAG,EACvD,GAAI,IAAU,KAAM,CAClB,IAAM,EAAO,IAAI,EAAS,KAAK,MAAO,EAAM,EAAO,EAAO,EAAK,CAAW,EAC1E,GAAI,EAAQ,MAAO,EAAK,cAAc,EACtC,OAAO,EAET,IAAM,EAAO,EAAW,YAAY,IAAI,EACxC,GAAI,GAAQ,EAAG,OAAO,KACtB,MAAM,EAAM,KAAK,IAAI,EAAW,CAAI,CAAC,QAYnC,IAAM,CACV,EACA,EACA,EAC2B,CAC3B,IAAM,EAAO,MAAM,KAAK,QAAQ,EAAM,IAAK,EAAS,MAAO,EAAQ,OAAS,EAAK,CAAC,EAClF,GAAI,CAAC,EAAM,MAAO,CAAE,SAAU,EAAM,EAEpC,IAAI,EACJ,GAAI,CACF,EAAQ,MAAM,EAAG,CAAI,EACrB,MAAO,EAAO,CAEd,MADA,MAAM,EAAK,QAAQ,EAAE,MAAM,IAAM,EAAE,EAC7B,EAER,GAAI,EAAK,QAEP,MADA,EAAK,SAAS,EACR,EAAK,KAAK,OAGlB,OADA,MAAM,EAAK,QAAQ,EACZ,CAAE,SAAU,GAAM,OAAM,EAEnC",
-  "debugId": "FBB0004432ECCEB664756E2164756E21",
+  "debugId": "30EA8B58DA2E59FE64756E2164756E21",
   "names": []
 }

package/dist/chunk-xx7necqt.js

@@ -0,0 +1,71 @@
+// @bun
+import{eh as R}from"./chunk-y09r0wsw.js";import{Mh as L}from"./chunk-xx3zvc3g.js";import{ri as T}from"./chunk-hr1r3g0d.js";import{Ri as F}from"./chunk-g5ppst76.js";class N{rows=new Map;async find(j,B){for(let G of this.rows.values())if(G.userId===j&&G.provider===B)return{...G};return null}async list(j){return[...this.rows.values()].filter((B)=>B.userId===j).map((B)=>({...B}))}async save(j,B,G){let Q=await this.find(j,B),K=new Date,V={id:Q?.id??Bun.randomUUIDv7(),userId:j,provider:B,...S(G),needsReconnect:!1,revision:(Q?.revision??0)+1,createdAt:Q?.createdAt??K,updatedAt:K};return this.rows.set(V.id,V),{...V}}async updateTokens(j,B,G){let Q=this.rows.get(j);if(!Q||Q.revision!==B)return null;let K={...Q,...S(G),needsReconnect:!1,revision:B+1,updatedAt:new Date};return this.rows.set(j,K),{...K}}async markNeedsReconnect(j){let B=this.rows.get(j);if(B)this.rows.set(j,{...B,needsReconnect:!0,updatedAt:new Date})}async delete(j){this.rows.delete(j)}}class H{encrypter;table;sql;dialect;constructor(j,B,G={}){this.encrypter=B;let Q=G.table??"gemi_oauth_connections";if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(Q))throw Error(`The connections table name "${Q}" is not a plain identifier.`);this.table=Q,this.sql=j.sql,this.dialect=j.dialect}async createTable(){for(let j of A(this.dialect,this.table))await this.sql.unsafe(j)}async find(j,B){let G=this.sql,Q=await G`
+      SELECT * FROM ${this.name(G)} WHERE user_id = ${j} AND provider = ${B}
+    `;return Q[0]?this.decode(Q[0]):null}async list(j){let B=this.sql;return(await B`
+      SELECT * FROM ${this.name(B)} WHERE user_id = ${j} ORDER BY provider
+    `).map((Q)=>this.decode(Q))}async save(j,B,G){let Q=this.sql,K=this.encode(G),V=Date.now(),W=async()=>x(await Q`
+          UPDATE ${this.name(Q)}
+          SET provider_account_id = ${K.providerAccountId}, scopes = ${K.scopes},
+              access_token = ${K.accessToken}, refresh_token = ${K.refreshToken},
+              token_type = ${K.tokenType}, expires_at = ${K.expiresAt},
+              needs_reconnect = 0, revision = revision + 1, updated_at = ${V}
+          WHERE user_id = ${j} AND provider = ${B}
+        `);if(await W()===0)try{await Q`
+          INSERT INTO ${this.name(Q)} (id, user_id, provider, provider_account_id, scopes,
+            access_token, refresh_token, token_type, expires_at, needs_reconnect, revision,
+            created_at, updated_at)
+          VALUES (${Bun.randomUUIDv7()}, ${j}, ${B}, ${K.providerAccountId},
+            ${K.scopes}, ${K.accessToken}, ${K.refreshToken}, ${K.tokenType},
+            ${K.expiresAt}, 0, 1, ${V}, ${V})
+        `}catch(Y){if(await W()===0)throw Y}let _=await this.find(j,B);if(!_)throw Error("The OAuth connection vanished while it was being saved.");return _}async updateTokens(j,B,G){let Q=this.sql,K=this.encode(G),V=await Q`
+      UPDATE ${this.name(Q)}
+      SET provider_account_id = COALESCE(${K.providerAccountId}, provider_account_id),
+          scopes = ${K.scopes}, access_token = ${K.accessToken},
+          refresh_token = ${K.refreshToken}, token_type = ${K.tokenType},
+          expires_at = ${K.expiresAt}, needs_reconnect = 0, revision = revision + 1,
+          updated_at = ${Date.now()}
+      WHERE id = ${j} AND revision = ${B}
+    `;if(x(V)===0)return null;let W=await Q`SELECT * FROM ${this.name(Q)} WHERE id = ${j}`;return W[0]?this.decode(W[0]):null}async markNeedsReconnect(j){let B=this.sql;await B`UPDATE ${this.name(B)} SET needs_reconnect = 1, updated_at = ${Date.now()} WHERE id = ${j}`}async delete(j){let B=this.sql;await B`DELETE FROM ${this.name(B)} WHERE id = ${j}`}async rotateEncryption(j={}){let B=this.sql,G=this.encrypter(),Q=await B`
+      SELECT id, access_token, refresh_token, revision FROM ${this.name(B)} ORDER BY id
+    `,K=0;for(let V of Q){let W=(Y)=>typeof Y==="string"&&G.needsReencryption(Y);if(!W(V.access_token)&&!W(V.refresh_token))continue;if(K+=1,j.dryRun)continue;let _=(Y)=>Y===null?null:G.encrypt(G.decrypt(Y));await B`
+        UPDATE ${this.name(B)}
+        SET access_token = ${_(V.access_token)}, refresh_token = ${_(V.refresh_token)},
+            revision = revision + 1
+        WHERE id = ${V.id} AND revision = ${Number(V.revision)}
+      `}return{scanned:Q.length,rotated:K}}encode(j){let B=this.encrypter();return{providerAccountId:j.providerAccountId,scopes:j.scopes.join(" "),accessToken:B.encrypt(j.accessToken),refreshToken:j.refreshToken===null?null:B.encrypt(j.refreshToken),tokenType:j.tokenType,expiresAt:j.expiresAt===null?null:j.expiresAt.getTime()}}decode(j){let B=this.encrypter();return{id:String(j.id),userId:String(j.user_id),provider:String(j.provider),providerAccountId:j.provider_account_id===null?null:String(j.provider_account_id),scopes:String(j.scopes??"").split(" ").filter(Boolean),accessToken:B.decrypt(String(j.access_token)),refreshToken:j.refresh_token===null?null:B.decrypt(String(j.refresh_token)),tokenType:j.token_type===null?null:String(j.token_type),expiresAt:j.expires_at===null?null:new Date(Number(j.expires_at)),needsReconnect:Number(j.needs_reconnect)===1,revision:Number(j.revision),createdAt:new Date(Number(j.created_at)),updatedAt:new Date(Number(j.updated_at))}}get mysql(){return this.dialect==="mysql"||this.dialect==="mariadb"}name(j){return j.unsafe(this.mysql?`\`${this.table}\``:`"${this.table}"`)}}function S(j){return{providerAccountId:j.providerAccountId,scopes:[...j.scopes],accessToken:j.accessToken,refreshToken:j.refreshToken,tokenType:j.tokenType,expiresAt:j.expiresAt}}function x(j){let B=j;return Math.max(Number(B.count??0),Number(B.affectedRows??0))}function A(j,B){if(j==="mysql"||j==="mariadb")return[`CREATE TABLE IF NOT EXISTS \`${B}\` (
+    \`id\` VARCHAR(191) NOT NULL,
+    \`user_id\` VARCHAR(191) NOT NULL,
+    \`provider\` VARCHAR(191) NOT NULL,
+    \`provider_account_id\` VARCHAR(191) NULL,
+    \`scopes\` TEXT NOT NULL,
+    \`access_token\` TEXT NOT NULL,
+    \`refresh_token\` TEXT NULL,
+    \`token_type\` VARCHAR(191) NULL,
+    \`expires_at\` BIGINT NULL,
+    \`needs_reconnect\` INTEGER NOT NULL DEFAULT 0,
+    \`revision\` BIGINT NOT NULL DEFAULT 0,
+    \`created_at\` BIGINT NOT NULL,
+    \`updated_at\` BIGINT NOT NULL,
+
+    UNIQUE INDEX \`${B}_user_id_provider_key\`(\`user_id\`, \`provider\`),
+    PRIMARY KEY (\`id\`)
+) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci`];let G=j==="sqlite"?'"id" TEXT NOT NULL PRIMARY KEY,':'"id" TEXT NOT NULL,',Q=j==="sqlite"?"":`,
+
+    CONSTRAINT "${B}_pkey" PRIMARY KEY ("id")`;return[`CREATE TABLE IF NOT EXISTS "${B}" (
+    ${G}
+    "user_id" TEXT NOT NULL,
+    "provider" TEXT NOT NULL,
+    "provider_account_id" TEXT,
+    "scopes" TEXT NOT NULL,
+    "access_token" TEXT NOT NULL,
+    "refresh_token" TEXT,
+    "token_type" TEXT,
+    "expires_at" BIGINT,
+    "needs_reconnect" INTEGER NOT NULL DEFAULT 0,
+    "revision" BIGINT NOT NULL DEFAULT 0,
+    "created_at" BIGINT NOT NULL,
+    "updated_at" BIGINT NOT NULL${Q}
+)`,`CREATE UNIQUE INDEX IF NOT EXISTS "${B}_user_id_provider_key" ON "${B}"("user_id", "provider")`]}class Z extends Error{code;status;providerError;constructor(j,B,G={}){super(B,G.cause!==void 0?{cause:G.cause}:void 0);this.code=j;this.name="OAuthConnectionError",this.status=G.status,this.providerError=G.providerError}}class $ extends Z{provider;constructor(j,B={}){super("reconnect_required",`The ${j} connection needs to be reconnected: its tokens were refused and could not be refreshed.`,B);this.provider=j;this.name="OAuthReconnectRequiredError"}}class O{config;constructor(j){for(let B of["authorizeUrl","tokenUrl"])U(B,j[B]);if(j.revokeUrl!==void 0)U("revokeUrl",j.revokeUrl);if(j.apiBaseUrl===void 0||j.apiBaseUrl===null||j.apiBaseUrl==="")throw Error(`OAuthConnectionProvider: apiBaseUrl is required. Set it to the provider's API origin (e.g. apiBaseUrl: "https://api.figma.com"); connection.fetch only sends the token there.`);U("apiBaseUrl",j.apiBaseUrl),this.config={scopeSeparator:" ",clientAuth:"body",pkce:!0,authorizationParams:{},refreshLeewaySeconds:60,...j}}authorizationUrl(j){let B=new URL(this.config.authorizeUrl),G={...this.config.authorizationParams,response_type:"code",client_id:this.config.clientId,redirect_uri:j.redirectUri,scope:this.config.scopes.join(this.config.scopeSeparator),state:j.state};if(this.config.pkce)G.code_challenge=j.codeChallenge,G.code_challenge_method="S256";for(let[Q,K]of Object.entries(G))B.searchParams.set(Q,K);return B.toString()}exchangeCode(j){let B=new URLSearchParams({grant_type:"authorization_code",code:j.code,redirect_uri:j.redirectUri});if(this.config.pkce)B.set("code_verifier",j.codeVerifier);return this.tokenRequest(B,{scopes:this.config.scopes,refreshToken:null,phase:"exchange"})}refresh(j,B){let G=new URLSearchParams({grant_type:"refresh_token",refresh_token:j});return this.tokenRequest(G,{scopes:B,refreshToken:j,phase:"refresh"})}async revoke(j,B){if(!this.config.revokeUrl)throw new Z("revoke_unsupported","This provider has no revokeUrl configured. Use disconnect() to forget the tokens locally.");let G=new URLSearchParams({token:j,token_type_hint:B}),Q;try{Q=await fetch(this.config.revokeUrl,this.post(G))}catch(K){throw new Z("revoke_failed","The revocation request failed.",{cause:K})}if(!Q.ok)throw new Z("revoke_failed",`The provider refused the revocation (HTTP ${Q.status}).`,{status:Q.status})}post(j){let B={"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"};if(this.config.clientAuth==="basic"){let G=`${encodeURIComponent(this.config.clientId)}:${encodeURIComponent(this.config.clientSecret)}`;B.Authorization=`Basic ${Buffer.from(G).toString("base64")}`}else j.set("client_id",this.config.clientId),j.set("client_secret",this.config.clientSecret);return{method:"POST",headers:B,body:j.toString(),redirect:"error"}}async tokenRequest(j,B){let G=B.phase==="exchange"?"exchange_failed":"refresh_failed",Q;try{Q=await fetch(this.config.tokenUrl,this.post(j))}catch(Y){throw new Z(G,"The token request failed.",{cause:Y})}let K=await Q.json().catch(()=>({}));if(!Q.ok||typeof K.access_token!=="string"||K.access_token===""){let Y=typeof K.error==="string"&&/^[a-z0-9_]{1,64}$/.test(K.error)?K.error:void 0;throw new Z(G,`The token endpoint refused the ${B.phase==="exchange"?"code":"refresh token"} (HTTP ${Q.status}${Y?`, ${Y}`:""}).`,{status:Q.status,providerError:Y})}let V=Number(K.expires_in),W=typeof K.scope==="string"?K.scope:void 0,_=K.user_id_string??K.user_id??K.account_id;return{accessToken:K.access_token,refreshToken:typeof K.refresh_token==="string"&&K.refresh_token!==""?K.refresh_token:B.refreshToken,tokenType:typeof K.token_type==="string"?K.token_type:null,expiresAt:Number.isFinite(V)&&V>0?new Date(Date.now()+V*1000):null,scopes:W!==void 0?W.split(/[\s,]+/).filter(Boolean):B.scopes,providerAccountId:typeof _==="string"||typeof _==="number"?String(_):null}}}function U(j,B){let G;try{G=new URL(String(B))}catch{G=void 0}if(!G||G.protocol!=="https:"&&!(G.protocol==="http:"&&z(G.hostname)))throw Error(`OAuthConnectionProvider: ${j} must be an https URL (http only for localhost), got ${JSON.stringify(B)}.`)}function z(j){return j==="localhost"||j==="127.0.0.1"||j==="[::1]"||j==="::1"}class E{options;static token="auth.connections";resolvedStore;refreshing=new Map;fakes;fakeStore;fakeRequests=[];constructor(j){this.options=j}get providers(){return this.options.providers}get store(){if(this.fakeStore)return this.fakeStore;if(!this.resolvedStore){let j=this.options.store;this.resolvedStore=typeof j==="function"?j():j??new H(F(T).connection(),()=>R())}return this.resolvedStore}provider(j){let B=this.options.providers[j];if(!B){let G=Object.keys(this.options.providers);throw new Z("unknown_provider",`No OAuth connection provider "${j}" in auth.connections`+(G.length>0?` (configured: ${G.join(", ")}).`:" (none are configured)."))}return B}async for(j,B){this.provider(B);let G=await this.store.find(D(j),B);return G?new X(this,G):null}async list(j){return(await this.store.list(D(j))).filter((G)=>(G.provider in this.options.providers)).map((G)=>new X(this,G))}async save(j,B,G){let Q=this.provider(B),K=await this.store.save(D(j),B,{refreshToken:null,tokenType:null,expiresAt:null,providerAccountId:null,scopes:Q.config.scopes,...G});return new X(this,K)}fake(j={}){return this.fakes=new Map(Object.entries(j)),this.fakeStore=new N,this.fakeRequests.length=0,this}restore(){this.fakes=void 0,this.fakeStore=void 0,this.fakeRequests.length=0}get faked(){return this.fakes!==void 0}async send(j,B){if(!this.fakes)return fetch(B);this.fakeRequests.push(B.clone());let G=this.fakes.get(j);if(!G)throw Error(`Connections.fake() has no handler for "${j}". Pass one: Connections.fake({ ${j}: (req) => ... }).`);return G(B)}refresh(j){let B=this.refreshing.get(j.id);if(B)return B;let G=this.withLock(j.id,()=>this.refreshOnce(j)).finally(()=>this.refreshing.delete(j.id));return this.refreshing.set(j.id,G),G}async refreshOnce(j){let B=await this.store.find(j.userId,j.provider);if(!B||B.id!==j.id)throw new $(j.provider);if(B.revision!==j.revision&&!B.needsReconnect)return B;if(B.needsReconnect)throw new $(j.provider);let G=this.provider(B.provider);if(this.faked||B.refreshToken===null){if(this.faked)return B;throw await this.store.markNeedsReconnect(B.id),new $(B.provider)}let Q;try{Q=await G.refresh(B.refreshToken,B.scopes)}catch(W){if(W instanceof Z&&W.status!==void 0&&W.status>=400&&W.status<500)throw await this.store.markNeedsReconnect(B.id),new $(B.provider,{cause:W,status:W.status,providerError:W.providerError});throw W}let K=await this.store.updateTokens(B.id,B.revision,Q);if(K)return K;let V=await this.store.find(B.userId,B.provider);if(!V)throw new $(B.provider);return V}async withLock(j,B){let G=F();if(this.faked||!G.bound(L))return B();let Q=await G.make(L).run(`gemi:oauth-connection:${j}`,{ttl:30000,wait:20000},()=>B());if(!Q.acquired)throw new Z("refresh_failed","Timed out waiting for another refresh of this connection to finish.");return Q.value}}class X{manager;record;constructor(j,B){this.manager=j;this.record=B}get provider(){return this.record.provider}get userId(){return this.record.userId}get providerAccountId(){return this.record.providerAccountId}get scopes(){return this.record.scopes}get expiresAt(){return this.record.expiresAt}get needsReconnect(){return this.record.needsReconnect}get connectedAt(){return this.record.createdAt}hasScopes(...j){return j.every((B)=>this.record.scopes.includes(B))}async fetch(j,B={}){let G=this.resolveUrl(j),Q=await this.current(),K=await this.send(G,B,Q.accessToken);if(K.response.status!==401||!K.authorized||B.body instanceof ReadableStream)return K.response;await K.response.body?.cancel().catch(()=>{});let V=await this.refreshFrom(Q);return(await this.send(G,B,V.accessToken)).response}async accessToken(){return(await this.current()).accessToken}async refresh(){await this.refreshFrom(this.record)}async revoke(){if(!this.manager.faked){let j=this.manager.provider(this.record.provider);if(this.record.refreshToken!==null)await j.revoke(this.record.refreshToken,"refresh_token");else await j.revoke(this.record.accessToken,"access_token")}await this.manager.store.delete(this.record.id)}async disconnect(){await this.manager.store.delete(this.record.id)}toJSON(){return{provider:this.provider,providerAccountId:this.providerAccountId,scopes:[...this.scopes],expiresAt:this.expiresAt,needsReconnect:this.needsReconnect,connectedAt:this.connectedAt}}[Symbol.for("nodejs.util.inspect.custom")](){return{ProviderConnection:this.toJSON()}}async current(){if(this.record.needsReconnect)throw new $(this.record.provider);let j=this.manager.provider(this.record.provider).config.refreshLeewaySeconds*1000,B=this.record.expiresAt?.getTime();if(B!==void 0&&B-Date.now()<=j)return this.refreshFrom(this.record);return this.record}async refreshFrom(j){try{this.record=await this.manager.refresh(j)}catch(B){if(B instanceof $)this.record={...this.record,needsReconnect:!0};throw B}return this.record}resolveUrl(j){let B=this.manager.provider(this.record.provider).config.apiBaseUrl,G;try{G=new URL(String(j),B)}catch{throw new Z("forbidden_url",`connection.fetch was given ${JSON.stringify(String(j))}, which is not a URL.`)}if(G.origin!==new URL(B).origin)throw new Z("forbidden_url",`connection.fetch only sends the ${this.record.provider} token to ${new URL(B).origin} (apiBaseUrl), not to ${G.origin}.`);if(G.protocol!=="https:"&&!(G.protocol==="http:"&&z(G.hostname)))throw new Z("forbidden_url",`connection.fetch only sends a token over https, not to ${G.origin}.`);return G}async send(j,B,G){let Q=j,K=(B.method??"GET").toUpperCase(),V=B.body,W=!0;if(B.redirect==="manual"||B.redirect==="error")return{response:await this.manager.send(this.record.provider,this.request(Q,B,K,V,G)),authorized:W};for(let _=0;;_++){let Y=this.request(Q,{...B,redirect:"manual"},K,V,W?G:null),J=await this.manager.send(this.record.provider,Y),M=J.headers.get("location");if(!C.has(J.status)||M===null||_>=5)return{response:J,authorized:W};await J.body?.cancel().catch(()=>{});let P=new URL(M,Q);if(P.origin!==Q.origin)W=!1;if(J.status===303||(J.status===301||J.status===302)&&K==="POST")K="GET",V=void 0;Q=P}}request(j,B,G,Q,K){let V=new Headers(B.headers);if(K===null)V.delete("authorization");else V.set("Authorization",`Bearer ${K}`);return new Request(j,{...B,method:G,body:Q,headers:V})}}var C=new Set([301,302,303,307,308]);function D(j){let B=typeof j==="object"&&j!==null?j.id:j;if(B===void 0||B===null||B==="")throw TypeError("An OAuth connection belongs to a user: pass the user (or its id).");return String(B)}
+export{N as Pg,H as Qg,Z as Rg,$ as Sg,O as Tg,E as Ug,X as Vg};
+
+//# debugId=95988480893BA2D664756E2164756E21

package/dist/{chunk-00n3gwr8.js.map → chunk-xx7necqt.js.map}

@@ -4,10 +4,10 @@
   "sourcesContent": [
     "import type { SQL } from \"bun\";\n\nimport type { DatabaseConnection } from \"../../database/Connection\";\nimport type { Dialect } from \"../../database/dialect\";\nimport type { Encrypter } from \"../../services/encryption/Encrypter\";\nimport type { OAuthTokenSet } from \"./OAuthConnectionProvider\";\n\n/** One stored connection, tokens decrypted. Lives only inside the framework. */\nexport interface ConnectionRecord {\n  id: string;\n  userId: string;\n  provider: string;\n  providerAccountId: string | null;\n  scopes: string[];\n  accessToken: string;\n  refreshToken: string | null;\n  tokenType: string | null;\n  expiresAt: Date | null;\n  needsReconnect: boolean;\n  /** Bumped on every token change: the compare-and-swap that serialises refreshes. */\n  revision: number;\n  createdAt: Date;\n  updatedAt: Date;\n}\n\n/** Where connections are kept. `DatabaseConnectionStore` in an app, `MemoryConnectionStore` in tests. */\nexport interface ConnectionStore {\n  find(userId: string, provider: string): Promise<ConnectionRecord | null>;\n  list(userId: string): Promise<ConnectionRecord[]>;\n  /** Stores a fresh grant, replacing any connection the user had to this provider. */\n  save(userId: string, provider: string, tokens: OAuthTokenSet): Promise<ConnectionRecord>;\n  /**\n   * Replaces the tokens of the connection at `revision`, or resolves `null`\n   * when it has moved on (another request refreshed it first) or is gone.\n   */\n  updateTokens(id: string, revision: number, tokens: OAuthTokenSet): Promise<ConnectionRecord | null>;\n  markNeedsReconnect(id: string): Promise<void>;\n  delete(id: string): Promise<void>;\n}\n\nexport class MemoryConnectionStore implements ConnectionStore {\n  private readonly rows = new Map<string, ConnectionRecord>();\n\n  async find(userId: string, provider: string) {\n    for (const row of this.rows.values()) {\n      if (row.userId === userId && row.provider === provider) return { ...row };\n    }\n    return null;\n  }\n\n  async list(userId: string) {\n    return [...this.rows.values()].filter((row) => row.userId === userId).map((row) => ({ ...row }));\n  }\n\n  async save(userId: string, provider: string, tokens: OAuthTokenSet) {\n    const existing = await this.find(userId, provider);\n    const now = new Date();\n    const row: ConnectionRecord = {\n      id: existing?.id ?? Bun.randomUUIDv7(),\n      userId,\n      provider,\n      ...fromTokens(tokens),\n      needsReconnect: false,\n      revision: (existing?.revision ?? 0) + 1,\n      createdAt: existing?.createdAt ?? now,\n      updatedAt: now,\n    };\n    this.rows.set(row.id, row);\n    return { ...row };\n  }\n\n  async updateTokens(id: string, revision: number, tokens: OAuthTokenSet) {\n    const row = this.rows.get(id);\n    if (!row || row.revision !== revision) return null;\n    const next = { ...row, ...fromTokens(tokens), needsReconnect: false, revision: revision + 1, updatedAt: new Date() };\n    this.rows.set(id, next);\n    return { ...next };\n  }\n\n  async markNeedsReconnect(id: string) {\n    const row = this.rows.get(id);\n    if (row) this.rows.set(id, { ...row, needsReconnect: true, updatedAt: new Date() });\n  }\n\n  async delete(id: string) {\n    this.rows.delete(id);\n  }\n}\n\nexport interface DatabaseConnectionStoreOptions {\n  /** Default `gemi_oauth_connections`. A plain identifier: it is spliced into every statement. */\n  table?: string;\n}\n\n/**\n * Connections in a table of the app's database, tokens encrypted with the\n * app's `Encrypter` (the keys in `app/config/encryption.ts`). Raw SQL, like\n * the queue's and the locks' tables, for SQLite, Postgres and MySQL 8 /\n * MariaDB: the table is not an ORM model, so no ORM read can return a token.\n */\nexport class DatabaseConnectionStore implements ConnectionStore {\n  readonly table: string;\n  private readonly sql: SQL;\n  private readonly dialect: Dialect;\n\n  constructor(\n    connection: Pick<DatabaseConnection, \"sql\" | \"dialect\">,\n    private readonly encrypter: () => Encrypter,\n    options: DatabaseConnectionStoreOptions = {},\n  ) {\n    const table = options.table ?? \"gemi_oauth_connections\";\n    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(table)) {\n      throw new Error(`The connections table name \"${table}\" is not a plain identifier.`);\n    }\n    this.table = table;\n    this.sql = connection.sql;\n    this.dialect = connection.dialect;\n  }\n\n  /** Creates the table if it does not exist: the DDL Prisma makes for the model in the docs. */\n  async createTable(): Promise<void> {\n    for (const statement of createConnectionTableStatements(this.dialect, this.table)) {\n      await this.sql.unsafe(statement);\n    }\n  }\n\n  async find(userId: string, provider: string) {\n    const q = this.sql;\n    const rows = (await q`\n      SELECT * FROM ${this.name(q)} WHERE user_id = ${userId} AND provider = ${provider}\n    `) as RawRow[];\n    return rows[0] ? this.decode(rows[0]) : null;\n  }\n\n  async list(userId: string) {\n    const q = this.sql;\n    const rows = (await q`\n      SELECT * FROM ${this.name(q)} WHERE user_id = ${userId} ORDER BY provider\n    `) as RawRow[];\n    return rows.map((row) => this.decode(row));\n  }\n\n  async save(userId: string, provider: string, tokens: OAuthTokenSet) {\n    const q = this.sql;\n    const values = this.encode(tokens);\n    const now = Date.now();\n\n    const update = async () =>\n      affected(\n        await q`\n          UPDATE ${this.name(q)}\n          SET provider_account_id = ${values.providerAccountId}, scopes = ${values.scopes},\n              access_token = ${values.accessToken}, refresh_token = ${values.refreshToken},\n              token_type = ${values.tokenType}, expires_at = ${values.expiresAt},\n              needs_reconnect = 0, revision = revision + 1, updated_at = ${now}\n          WHERE user_id = ${userId} AND provider = ${provider}\n        `,\n      );\n\n    if ((await update()) === 0) {\n      try {\n        await q`\n          INSERT INTO ${this.name(q)} (id, user_id, provider, provider_account_id, scopes,\n            access_token, refresh_token, token_type, expires_at, needs_reconnect, revision,\n            created_at, updated_at)\n          VALUES (${Bun.randomUUIDv7()}, ${userId}, ${provider}, ${values.providerAccountId},\n            ${values.scopes}, ${values.accessToken}, ${values.refreshToken}, ${values.tokenType},\n            ${values.expiresAt}, 0, 1, ${now}, ${now})\n        `;\n      } catch (error) {\n        // A concurrent callback for the same user and provider inserted first.\n        if ((await update()) === 0) throw error;\n      }\n    }\n\n    const saved = await this.find(userId, provider);\n    if (!saved) throw new Error(\"The OAuth connection vanished while it was being saved.\");\n    return saved;\n  }\n\n  async updateTokens(id: string, revision: number, tokens: OAuthTokenSet) {\n    const q = this.sql;\n    const values = this.encode(tokens);\n    const result = await q`\n      UPDATE ${this.name(q)}\n      SET provider_account_id = COALESCE(${values.providerAccountId}, provider_account_id),\n          scopes = ${values.scopes}, access_token = ${values.accessToken},\n          refresh_token = ${values.refreshToken}, token_type = ${values.tokenType},\n          expires_at = ${values.expiresAt}, needs_reconnect = 0, revision = revision + 1,\n          updated_at = ${Date.now()}\n      WHERE id = ${id} AND revision = ${revision}\n    `;\n    if (affected(result) === 0) return null;\n    const rows = (await q`SELECT * FROM ${this.name(q)} WHERE id = ${id}`) as RawRow[];\n    return rows[0] ? this.decode(rows[0]) : null;\n  }\n\n  async markNeedsReconnect(id: string) {\n    const q = this.sql;\n    await q`UPDATE ${this.name(q)} SET needs_reconnect = 1, updated_at = ${Date.now()} WHERE id = ${id}`;\n  }\n\n  async delete(id: string) {\n    const q = this.sql;\n    await q`DELETE FROM ${this.name(q)} WHERE id = ${id}`;\n  }\n\n  /**\n   * Re-encrypts every token still under an older key. Run by\n   * `gemi run encryption:rotate`; a token refreshed in the meantime is\n   * already current and is skipped by the revision check.\n   */\n  async rotateEncryption(options: { dryRun?: boolean } = {}): Promise<{ scanned: number; rotated: number }> {\n    const q = this.sql;\n    const encrypter = this.encrypter();\n    const rows = (await q`\n      SELECT id, access_token, refresh_token, revision FROM ${this.name(q)} ORDER BY id\n    `) as RawRow[];\n    let rotated = 0;\n    for (const row of rows) {\n      const stale = (value: string | null) => typeof value === \"string\" && encrypter.needsReencryption(value);\n      if (!stale(row.access_token) && !stale(row.refresh_token)) continue;\n      rotated += 1;\n      if (options.dryRun) continue;\n      const reseal = (value: string | null) => (value === null ? null : encrypter.encrypt(encrypter.decrypt(value)));\n      await q`\n        UPDATE ${this.name(q)}\n        SET access_token = ${reseal(row.access_token)}, refresh_token = ${reseal(row.refresh_token)},\n            revision = revision + 1\n        WHERE id = ${row.id} AND revision = ${Number(row.revision)}\n      `;\n    }\n    return { scanned: rows.length, rotated };\n  }\n\n  private encode(tokens: OAuthTokenSet) {\n    const encrypter = this.encrypter();\n    return {\n      providerAccountId: tokens.providerAccountId,\n      scopes: tokens.scopes.join(\" \"),\n      accessToken: encrypter.encrypt(tokens.accessToken),\n      refreshToken: tokens.refreshToken === null ? null : encrypter.encrypt(tokens.refreshToken),\n      tokenType: tokens.tokenType,\n      expiresAt: tokens.expiresAt === null ? null : tokens.expiresAt.getTime(),\n    };\n  }\n\n  private decode(row: RawRow): ConnectionRecord {\n    const encrypter = this.encrypter();\n    return {\n      id: String(row.id),\n      userId: String(row.user_id),\n      provider: String(row.provider),\n      providerAccountId: row.provider_account_id === null ? null : String(row.provider_account_id),\n      scopes: String(row.scopes ?? \"\").split(\" \").filter(Boolean),\n      accessToken: encrypter.decrypt(String(row.access_token)),\n      refreshToken: row.refresh_token === null ? null : encrypter.decrypt(String(row.refresh_token)),\n      tokenType: row.token_type === null ? null : String(row.token_type),\n      expiresAt: row.expires_at === null ? null : new Date(Number(row.expires_at)),\n      needsReconnect: Number(row.needs_reconnect) === 1,\n      revision: Number(row.revision),\n      createdAt: new Date(Number(row.created_at)),\n      updatedAt: new Date(Number(row.updated_at)),\n    };\n  }\n\n  private get mysql() {\n    return this.dialect === \"mysql\" || this.dialect === \"mariadb\";\n  }\n\n  private name(q: SQL) {\n    return q.unsafe(this.mysql ? `\\`${this.table}\\`` : `\"${this.table}\"`);\n  }\n}\n\ninterface RawRow {\n  id: unknown;\n  user_id: unknown;\n  provider: unknown;\n  provider_account_id: unknown;\n  scopes: unknown;\n  access_token: string;\n  refresh_token: string | null;\n  token_type: unknown;\n  expires_at: unknown;\n  needs_reconnect: unknown;\n  revision: unknown;\n  created_at: unknown;\n  updated_at: unknown;\n}\n\nfunction fromTokens(tokens: OAuthTokenSet) {\n  return {\n    providerAccountId: tokens.providerAccountId,\n    scopes: [...tokens.scopes],\n    accessToken: tokens.accessToken,\n    refreshToken: tokens.refreshToken,\n    tokenType: tokens.tokenType,\n    expiresAt: tokens.expiresAt,\n  };\n}\n\nfunction affected(result: unknown): number {\n  const counts = result as { count?: number | null; affectedRows?: number | null };\n  return Math.max(Number(counts.count ?? 0), Number(counts.affectedRows ?? 0));\n}\n\n/** The connections table, as Prisma generates it for the model in the docs, with `IF NOT EXISTS`. */\nexport function createConnectionTableStatements(dialect: Dialect, table: string): string[] {\n  if (dialect === \"mysql\" || dialect === \"mariadb\") {\n    return [\n      `CREATE TABLE IF NOT EXISTS \\`${table}\\` (\n    \\`id\\` VARCHAR(191) NOT NULL,\n    \\`user_id\\` VARCHAR(191) NOT NULL,\n    \\`provider\\` VARCHAR(191) NOT NULL,\n    \\`provider_account_id\\` VARCHAR(191) NULL,\n    \\`scopes\\` TEXT NOT NULL,\n    \\`access_token\\` TEXT NOT NULL,\n    \\`refresh_token\\` TEXT NULL,\n    \\`token_type\\` VARCHAR(191) NULL,\n    \\`expires_at\\` BIGINT NULL,\n    \\`needs_reconnect\\` INTEGER NOT NULL DEFAULT 0,\n    \\`revision\\` BIGINT NOT NULL DEFAULT 0,\n    \\`created_at\\` BIGINT NOT NULL,\n    \\`updated_at\\` BIGINT NOT NULL,\n\n    UNIQUE INDEX \\`${table}_user_id_provider_key\\`(\\`user_id\\`, \\`provider\\`),\n    PRIMARY KEY (\\`id\\`)\n) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci`,\n    ];\n  }\n  const key = dialect === \"sqlite\" ? `\"id\" TEXT NOT NULL PRIMARY KEY,` : `\"id\" TEXT NOT NULL,`;\n  const constraint =\n    dialect === \"sqlite\" ? \"\" : `,\\n\\n    CONSTRAINT \"${table}_pkey\" PRIMARY KEY (\"id\")`;\n  return [\n    `CREATE TABLE IF NOT EXISTS \"${table}\" (\n    ${key}\n    \"user_id\" TEXT NOT NULL,\n    \"provider\" TEXT NOT NULL,\n    \"provider_account_id\" TEXT,\n    \"scopes\" TEXT NOT NULL,\n    \"access_token\" TEXT NOT NULL,\n    \"refresh_token\" TEXT,\n    \"token_type\" TEXT,\n    \"expires_at\" BIGINT,\n    \"needs_reconnect\" INTEGER NOT NULL DEFAULT 0,\n    \"revision\" BIGINT NOT NULL DEFAULT 0,\n    \"created_at\" BIGINT NOT NULL,\n    \"updated_at\" BIGINT NOT NULL${constraint}\n)`,\n    `CREATE UNIQUE INDEX IF NOT EXISTS \"${table}_user_id_provider_key\" ON \"${table}\"(\"user_id\", \"provider\")`,\n  ];\n}\n",
     "/**\n * Why an OAuth connection operation failed. Never carries a token or a token\n * endpoint's body; `providerError` is the provider's RFC 6749 error code at\n * most (`invalid_grant`).\n */\nexport type OAuthConnectionErrorCode =\n  | \"unknown_provider\"\n  | \"exchange_failed\"\n  | \"refresh_failed\"\n  | \"reconnect_required\"\n  | \"revoke_failed\"\n  | \"revoke_unsupported\"\n  | \"forbidden_url\";\n\nexport class OAuthConnectionError extends Error {\n  readonly status?: number;\n  readonly providerError?: string;\n\n  constructor(\n    readonly code: OAuthConnectionErrorCode,\n    message: string,\n    options: { cause?: unknown; status?: number; providerError?: string } = {},\n  ) {\n    super(message, options.cause !== undefined ? { cause: options.cause } : undefined);\n    this.name = \"OAuthConnectionError\";\n    this.status = options.status;\n    this.providerError = options.providerError;\n  }\n}\n\n/**\n * The connection's tokens no longer work and refreshing them failed, so the\n * user has to connect the account again (send them to\n * `/auth/connections/<provider>`). The connection is marked, so every later\n * call fails the same way without asking the provider again, until it is\n * reconnected.\n */\nexport class OAuthReconnectRequiredError extends OAuthConnectionError {\n  constructor(\n    readonly provider: string,\n    options: { cause?: unknown; status?: number; providerError?: string } = {},\n  ) {\n    super(\n      \"reconnect_required\",\n      `The ${provider} connection needs to be reconnected: its tokens were refused and could not be refreshed.`,\n      options,\n    );\n    this.name = \"OAuthReconnectRequiredError\";\n  }\n}\n",
-    "import { OAuthConnectionError } from \"./errors\";\n\nexport interface OAuthConnectionProviderConfig {\n  /** The provider's authorization endpoint: `https://www.figma.com/oauth`. */\n  authorizeUrl: string;\n  /** The token endpoint, for the code exchange and refreshes. */\n  tokenUrl: string;\n  /**\n   * The RFC 7009 revocation endpoint. Without one, `revoke()` is refused and\n   * `disconnect()` (which forgets the tokens locally) is the way to remove a\n   * connection.\n   */\n  revokeUrl?: string;\n  clientId: string;\n  clientSecret: string;\n  /** The scopes to request. */\n  scopes: string[];\n  /** How `scopes` are joined on the authorization URL. Default `\" \"` (RFC 6749). */\n  scopeSeparator?: string;\n  /**\n   * How the client authenticates to the token and revocation endpoints:\n   * `\"body\"` sends `client_id` and `client_secret` as form fields (what most\n   * providers document), `\"basic\"` sends them as HTTP Basic credentials.\n   * Default `\"body\"`.\n   */\n  clientAuth?: \"body\" | \"basic\";\n  /** Send a PKCE challenge (S256). Default `true`; turn off only for a provider that rejects it. */\n  pkce?: boolean;\n  /**\n   * Extra query parameters for the authorization URL, such as\n   * `{ access_type: \"offline\", prompt: \"consent\" }` for Google. They cannot\n   * replace `state`, the PKCE challenge, `redirect_uri`, `client_id` or `scope`.\n   */\n  authorizationParams?: Record<string, string>;\n  /**\n   * The callback URL registered with the provider. Default\n   * `${HOST_NAME}/auth/connections/<name>/callback` (the request's origin when\n   * `HOST_NAME` is unset).\n   */\n  redirectUri?: string;\n  /**\n   * Where the provider's API lives: `https://api.figma.com`. Required:\n   * `connection.fetch` takes paths relative to it and **refuses any other\n   * origin**, so the user's token only ever goes to the provider's API host,\n   * even for a URL that came from user input.\n   */\n  apiBaseUrl: string;\n  /** Refresh this many seconds before the access token expires. Default 60. */\n  refreshLeewaySeconds?: number;\n}\n\n/** What a token endpoint answered, normalised. */\nexport interface OAuthTokenSet {\n  accessToken: string;\n  refreshToken: string | null;\n  tokenType: string | null;\n  /** Absent when the provider did not say (`expires_in` missing). */\n  expiresAt: Date | null;\n  /** The scopes granted, when the provider says; otherwise the ones requested. */\n  scopes: string[];\n  /** The provider's id for the account, when the token response carries one (Figma's `user_id`). */\n  providerAccountId: string | null;\n}\n\n/**\n * A provider an app can connect a user's account to, to call its API on the\n * user's behalf — as opposed to `OAuthProvider`, which signs the user in.\n * Configured under `auth.connections`:\n *\n * ```ts\n * connections: {\n *   figma: new OAuthConnectionProvider({\n *     authorizeUrl: \"https://www.figma.com/oauth\",\n *     tokenUrl: \"https://api.figma.com/v1/oauth/token\",\n *     clientId: process.env.FIGMA_CLIENT_ID!,\n *     clientSecret: process.env.FIGMA_CLIENT_SECRET!,\n *     scopes: [\"file_content:read\"],\n *     apiBaseUrl: \"https://api.figma.com\",\n *   }),\n * }\n * ```\n */\nexport class OAuthConnectionProvider {\n  readonly config: Required<\n    Omit<OAuthConnectionProviderConfig, \"revokeUrl\" | \"redirectUri\">\n  > &\n    Pick<OAuthConnectionProviderConfig, \"revokeUrl\" | \"redirectUri\">;\n\n  constructor(config: OAuthConnectionProviderConfig) {\n    for (const key of [\"authorizeUrl\", \"tokenUrl\"] as const) {\n      assertHttpUrl(key, config[key]);\n    }\n    if (config.revokeUrl !== undefined) assertHttpUrl(\"revokeUrl\", config.revokeUrl);\n    // Required (not just recommended): it is what keeps `connection.fetch`\n    // from sending the user's token anywhere but the provider's API host. A\n    // missing one (`process.env.X` unset, or plain JS) fails the boot, when\n    // the auth config is loaded, rather than the first `fetch`.\n    if (config.apiBaseUrl === undefined || config.apiBaseUrl === null || config.apiBaseUrl === \"\") {\n      throw new Error(\n        \"OAuthConnectionProvider: apiBaseUrl is required. Set it to the provider's API origin \" +\n          '(e.g. apiBaseUrl: \"https://api.figma.com\"); connection.fetch only sends the token there.',\n      );\n    }\n    assertHttpUrl(\"apiBaseUrl\", config.apiBaseUrl);\n    this.config = {\n      scopeSeparator: \" \",\n      clientAuth: \"body\",\n      pkce: true,\n      authorizationParams: {},\n      refreshLeewaySeconds: 60,\n      ...config,\n    };\n  }\n\n  /** The URL to send the browser to. */\n  authorizationUrl(args: { state: string; codeChallenge: string; redirectUri: string }): string {\n    const url = new URL(this.config.authorizeUrl);\n    const params: Record<string, string> = {\n      ...this.config.authorizationParams,\n      response_type: \"code\",\n      client_id: this.config.clientId,\n      redirect_uri: args.redirectUri,\n      scope: this.config.scopes.join(this.config.scopeSeparator),\n      state: args.state,\n    };\n    if (this.config.pkce) {\n      params.code_challenge = args.codeChallenge;\n      params.code_challenge_method = \"S256\";\n    }\n    for (const [key, value] of Object.entries(params)) url.searchParams.set(key, value);\n    return url.toString();\n  }\n\n  /** Exchanges an authorization code for tokens. */\n  exchangeCode(args: { code: string; codeVerifier: string; redirectUri: string }): Promise<OAuthTokenSet> {\n    const body = new URLSearchParams({\n      grant_type: \"authorization_code\",\n      code: args.code,\n      redirect_uri: args.redirectUri,\n    });\n    if (this.config.pkce) body.set(\"code_verifier\", args.codeVerifier);\n    return this.tokenRequest(body, { scopes: this.config.scopes, refreshToken: null, phase: \"exchange\" });\n  }\n\n  /**\n   * Spends `refreshToken` for a new access token. A provider that does not\n   * rotate refresh tokens answers without one, and the old one is kept.\n   */\n  refresh(refreshToken: string, scopes: string[]): Promise<OAuthTokenSet> {\n    const body = new URLSearchParams({ grant_type: \"refresh_token\", refresh_token: refreshToken });\n    return this.tokenRequest(body, { scopes, refreshToken, phase: \"refresh\" });\n  }\n\n  /** Revokes `token` at the provider (RFC 7009). */\n  async revoke(token: string, hint: \"refresh_token\" | \"access_token\"): Promise<void> {\n    if (!this.config.revokeUrl) {\n      throw new OAuthConnectionError(\n        \"revoke_unsupported\",\n        \"This provider has no revokeUrl configured. Use disconnect() to forget the tokens locally.\",\n      );\n    }\n    const body = new URLSearchParams({ token, token_type_hint: hint });\n    let response: Response;\n    try {\n      response = await fetch(this.config.revokeUrl, this.post(body));\n    } catch (cause) {\n      throw new OAuthConnectionError(\"revoke_failed\", \"The revocation request failed.\", { cause });\n    }\n    // RFC 7009: 200 whether or not the token was still valid.\n    if (!response.ok) {\n      throw new OAuthConnectionError(\n        \"revoke_failed\",\n        `The provider refused the revocation (HTTP ${response.status}).`,\n        { status: response.status },\n      );\n    }\n  }\n\n  private post(body: URLSearchParams): RequestInit {\n    const headers: Record<string, string> = {\n      \"Content-Type\": \"application/x-www-form-urlencoded\",\n      // GitHub answers form-encoded unless asked for JSON.\n      Accept: \"application/json\",\n    };\n    if (this.config.clientAuth === \"basic\") {\n      const credentials = `${encodeURIComponent(this.config.clientId)}:${encodeURIComponent(this.config.clientSecret)}`;\n      headers.Authorization = `Basic ${Buffer.from(credentials).toString(\"base64\")}`;\n    } else {\n      body.set(\"client_id\", this.config.clientId);\n      body.set(\"client_secret\", this.config.clientSecret);\n    }\n    return { method: \"POST\", headers, body: body.toString(), redirect: \"error\" };\n  }\n\n  private async tokenRequest(\n    body: URLSearchParams,\n    previous: { scopes: string[]; refreshToken: string | null; phase: \"exchange\" | \"refresh\" },\n  ): Promise<OAuthTokenSet> {\n    const failure = previous.phase === \"exchange\" ? \"exchange_failed\" : \"refresh_failed\";\n    let response: Response;\n    try {\n      response = await fetch(this.config.tokenUrl, this.post(body));\n    } catch (cause) {\n      throw new OAuthConnectionError(failure, \"The token request failed.\", { cause });\n    }\n\n    const payload = (await response.json().catch(() => ({}))) as Record<string, unknown>;\n    if (!response.ok || typeof payload.access_token !== \"string\" || payload.access_token === \"\") {\n      // Only the provider's error code, never the body: it can echo the grant.\n      const code = typeof payload.error === \"string\" && /^[a-z0-9_]{1,64}$/.test(payload.error) ? payload.error : undefined;\n      throw new OAuthConnectionError(\n        failure,\n        `The token endpoint refused the ${previous.phase === \"exchange\" ? \"code\" : \"refresh token\"} ` +\n          `(HTTP ${response.status}${code ? `, ${code}` : \"\"}).`,\n        { status: response.status, providerError: code },\n      );\n    }\n\n    const expiresIn = Number(payload.expires_in);\n    const scope = typeof payload.scope === \"string\" ? payload.scope : undefined;\n    const accountId = payload.user_id ?? payload.account_id;\n    return {\n      accessToken: payload.access_token,\n      refreshToken:\n        typeof payload.refresh_token === \"string\" && payload.refresh_token !== \"\"\n          ? payload.refresh_token\n          : previous.refreshToken,\n      tokenType: typeof payload.token_type === \"string\" ? payload.token_type : null,\n      expiresAt: Number.isFinite(expiresIn) && expiresIn > 0 ? new Date(Date.now() + expiresIn * 1000) : null,\n      scopes: scope !== undefined ? scope.split(/[\\s,]+/).filter(Boolean) : previous.scopes,\n      providerAccountId:\n        typeof accountId === \"string\" || typeof accountId === \"number\" ? String(accountId) : null,\n    };\n  }\n}\n\nfunction assertHttpUrl(key: string, value: unknown): void {\n  let url: URL | undefined;\n  try {\n    url = new URL(String(value));\n  } catch {\n    url = undefined;\n  }\n  if (!url || (url.protocol !== \"https:\" && !(url.protocol === \"http:\" && isLoopback(url.hostname)))) {\n    throw new Error(\n      `OAuthConnectionProvider: ${key} must be an https URL (http only for localhost), got ${JSON.stringify(value)}.`,\n    );\n  }\n}\n\nexport function isLoopback(hostname: string): boolean {\n  return hostname === \"localhost\" || hostname === \"127.0.0.1\" || hostname === \"[::1]\" || hostname === \"::1\";\n}\n",
+    "import { OAuthConnectionError } from \"./errors\";\n\nexport interface OAuthConnectionProviderConfig {\n  /** The provider's authorization endpoint: `https://www.figma.com/oauth`. */\n  authorizeUrl: string;\n  /** The token endpoint, for the code exchange and refreshes. */\n  tokenUrl: string;\n  /**\n   * The RFC 7009 revocation endpoint. Without one, `revoke()` is refused and\n   * `disconnect()` (which forgets the tokens locally) is the way to remove a\n   * connection.\n   */\n  revokeUrl?: string;\n  clientId: string;\n  clientSecret: string;\n  /** The scopes to request. */\n  scopes: string[];\n  /** How `scopes` are joined on the authorization URL. Default `\" \"` (RFC 6749). */\n  scopeSeparator?: string;\n  /**\n   * How the client authenticates to the token and revocation endpoints:\n   * `\"body\"` sends `client_id` and `client_secret` as form fields (what most\n   * providers document), `\"basic\"` sends them as HTTP Basic credentials.\n   * Default `\"body\"`.\n   */\n  clientAuth?: \"body\" | \"basic\";\n  /** Send a PKCE challenge (S256). Default `true`; turn off only for a provider that rejects it. */\n  pkce?: boolean;\n  /**\n   * Extra query parameters for the authorization URL, such as\n   * `{ access_type: \"offline\", prompt: \"consent\" }` for Google. They cannot\n   * replace `state`, the PKCE challenge, `redirect_uri`, `client_id` or `scope`.\n   */\n  authorizationParams?: Record<string, string>;\n  /**\n   * The callback URL registered with the provider. Default\n   * `${HOST_NAME}/auth/connections/<name>/callback` (the request's origin when\n   * `HOST_NAME` is unset).\n   */\n  redirectUri?: string;\n  /**\n   * Where the provider's API lives: `https://api.figma.com`. Required:\n   * `connection.fetch` takes paths relative to it and **refuses any other\n   * origin**, so the user's token only ever goes to the provider's API host,\n   * even for a URL that came from user input.\n   */\n  apiBaseUrl: string;\n  /** Refresh this many seconds before the access token expires. Default 60. */\n  refreshLeewaySeconds?: number;\n}\n\n/** What a token endpoint answered, normalised. */\nexport interface OAuthTokenSet {\n  accessToken: string;\n  refreshToken: string | null;\n  tokenType: string | null;\n  /** Absent when the provider did not say (`expires_in` missing). */\n  expiresAt: Date | null;\n  /** The scopes granted, when the provider says; otherwise the ones requested. */\n  scopes: string[];\n  /**\n   * The provider's id for the account, when the token response carries one\n   * (Figma's `user_id_string`; `user_id` or `account_id` otherwise).\n   */\n  providerAccountId: string | null;\n}\n\n/**\n * A provider an app can connect a user's account to, to call its API on the\n * user's behalf — as opposed to `OAuthProvider`, which signs the user in.\n * Configured under `auth.connections`:\n *\n * ```ts\n * connections: {\n *   figma: new OAuthConnectionProvider({\n *     authorizeUrl: \"https://www.figma.com/oauth\",\n *     tokenUrl: \"https://api.figma.com/v1/oauth/token\",\n *     clientId: process.env.FIGMA_CLIENT_ID!,\n *     clientSecret: process.env.FIGMA_CLIENT_SECRET!,\n *     scopes: [\"file_content:read\"],\n *     apiBaseUrl: \"https://api.figma.com\",\n *   }),\n * }\n * ```\n */\nexport class OAuthConnectionProvider {\n  readonly config: Required<\n    Omit<OAuthConnectionProviderConfig, \"revokeUrl\" | \"redirectUri\">\n  > &\n    Pick<OAuthConnectionProviderConfig, \"revokeUrl\" | \"redirectUri\">;\n\n  constructor(config: OAuthConnectionProviderConfig) {\n    for (const key of [\"authorizeUrl\", \"tokenUrl\"] as const) {\n      assertHttpUrl(key, config[key]);\n    }\n    if (config.revokeUrl !== undefined) assertHttpUrl(\"revokeUrl\", config.revokeUrl);\n    // Required (not just recommended): it is what keeps `connection.fetch`\n    // from sending the user's token anywhere but the provider's API host. A\n    // missing one (`process.env.X` unset, or plain JS) fails the boot, when\n    // the auth config is loaded, rather than the first `fetch`.\n    if (config.apiBaseUrl === undefined || config.apiBaseUrl === null || config.apiBaseUrl === \"\") {\n      throw new Error(\n        \"OAuthConnectionProvider: apiBaseUrl is required. Set it to the provider's API origin \" +\n          '(e.g. apiBaseUrl: \"https://api.figma.com\"); connection.fetch only sends the token there.',\n      );\n    }\n    assertHttpUrl(\"apiBaseUrl\", config.apiBaseUrl);\n    this.config = {\n      scopeSeparator: \" \",\n      clientAuth: \"body\",\n      pkce: true,\n      authorizationParams: {},\n      refreshLeewaySeconds: 60,\n      ...config,\n    };\n  }\n\n  /** The URL to send the browser to. */\n  authorizationUrl(args: { state: string; codeChallenge: string; redirectUri: string }): string {\n    const url = new URL(this.config.authorizeUrl);\n    const params: Record<string, string> = {\n      ...this.config.authorizationParams,\n      response_type: \"code\",\n      client_id: this.config.clientId,\n      redirect_uri: args.redirectUri,\n      scope: this.config.scopes.join(this.config.scopeSeparator),\n      state: args.state,\n    };\n    if (this.config.pkce) {\n      params.code_challenge = args.codeChallenge;\n      params.code_challenge_method = \"S256\";\n    }\n    for (const [key, value] of Object.entries(params)) url.searchParams.set(key, value);\n    return url.toString();\n  }\n\n  /** Exchanges an authorization code for tokens. */\n  exchangeCode(args: { code: string; codeVerifier: string; redirectUri: string }): Promise<OAuthTokenSet> {\n    const body = new URLSearchParams({\n      grant_type: \"authorization_code\",\n      code: args.code,\n      redirect_uri: args.redirectUri,\n    });\n    if (this.config.pkce) body.set(\"code_verifier\", args.codeVerifier);\n    return this.tokenRequest(body, { scopes: this.config.scopes, refreshToken: null, phase: \"exchange\" });\n  }\n\n  /**\n   * Spends `refreshToken` for a new access token. A provider that does not\n   * rotate refresh tokens answers without one, and the old one is kept.\n   */\n  refresh(refreshToken: string, scopes: string[]): Promise<OAuthTokenSet> {\n    const body = new URLSearchParams({ grant_type: \"refresh_token\", refresh_token: refreshToken });\n    return this.tokenRequest(body, { scopes, refreshToken, phase: \"refresh\" });\n  }\n\n  /** Revokes `token` at the provider (RFC 7009). */\n  async revoke(token: string, hint: \"refresh_token\" | \"access_token\"): Promise<void> {\n    if (!this.config.revokeUrl) {\n      throw new OAuthConnectionError(\n        \"revoke_unsupported\",\n        \"This provider has no revokeUrl configured. Use disconnect() to forget the tokens locally.\",\n      );\n    }\n    const body = new URLSearchParams({ token, token_type_hint: hint });\n    let response: Response;\n    try {\n      response = await fetch(this.config.revokeUrl, this.post(body));\n    } catch (cause) {\n      throw new OAuthConnectionError(\"revoke_failed\", \"The revocation request failed.\", { cause });\n    }\n    // RFC 7009: 200 whether or not the token was still valid.\n    if (!response.ok) {\n      throw new OAuthConnectionError(\n        \"revoke_failed\",\n        `The provider refused the revocation (HTTP ${response.status}).`,\n        { status: response.status },\n      );\n    }\n  }\n\n  private post(body: URLSearchParams): RequestInit {\n    const headers: Record<string, string> = {\n      \"Content-Type\": \"application/x-www-form-urlencoded\",\n      // GitHub answers form-encoded unless asked for JSON.\n      Accept: \"application/json\",\n    };\n    if (this.config.clientAuth === \"basic\") {\n      const credentials = `${encodeURIComponent(this.config.clientId)}:${encodeURIComponent(this.config.clientSecret)}`;\n      headers.Authorization = `Basic ${Buffer.from(credentials).toString(\"base64\")}`;\n    } else {\n      body.set(\"client_id\", this.config.clientId);\n      body.set(\"client_secret\", this.config.clientSecret);\n    }\n    return { method: \"POST\", headers, body: body.toString(), redirect: \"error\" };\n  }\n\n  private async tokenRequest(\n    body: URLSearchParams,\n    previous: { scopes: string[]; refreshToken: string | null; phase: \"exchange\" | \"refresh\" },\n  ): Promise<OAuthTokenSet> {\n    const failure = previous.phase === \"exchange\" ? \"exchange_failed\" : \"refresh_failed\";\n    let response: Response;\n    try {\n      response = await fetch(this.config.tokenUrl, this.post(body));\n    } catch (cause) {\n      throw new OAuthConnectionError(failure, \"The token request failed.\", { cause });\n    }\n\n    const payload = (await response.json().catch(() => ({}))) as Record<string, unknown>;\n    if (!response.ok || typeof payload.access_token !== \"string\" || payload.access_token === \"\") {\n      // Only the provider's error code, never the body: it can echo the grant.\n      const code = typeof payload.error === \"string\" && /^[a-z0-9_]{1,64}$/.test(payload.error) ? payload.error : undefined;\n      throw new OAuthConnectionError(\n        failure,\n        `The token endpoint refused the ${previous.phase === \"exchange\" ? \"code\" : \"refresh token\"} ` +\n          `(HTTP ${response.status}${code ? `, ${code}` : \"\"}).`,\n        { status: response.status, providerError: code },\n      );\n    }\n\n    const expiresIn = Number(payload.expires_in);\n    const scope = typeof payload.scope === \"string\" ? payload.scope : undefined;\n    // Figma's `user_id_string` before its deprecated numeric `user_id`, which\n    // JSON parsing has already rounded: Figma's ids do not fit a double.\n    const accountId = payload.user_id_string ?? payload.user_id ?? payload.account_id;\n    return {\n      accessToken: payload.access_token,\n      refreshToken:\n        typeof payload.refresh_token === \"string\" && payload.refresh_token !== \"\"\n          ? payload.refresh_token\n          : previous.refreshToken,\n      tokenType: typeof payload.token_type === \"string\" ? payload.token_type : null,\n      expiresAt: Number.isFinite(expiresIn) && expiresIn > 0 ? new Date(Date.now() + expiresIn * 1000) : null,\n      scopes: scope !== undefined ? scope.split(/[\\s,]+/).filter(Boolean) : previous.scopes,\n      providerAccountId:\n        typeof accountId === \"string\" || typeof accountId === \"number\" ? String(accountId) : null,\n    };\n  }\n}\n\nfunction assertHttpUrl(key: string, value: unknown): void {\n  let url: URL | undefined;\n  try {\n    url = new URL(String(value));\n  } catch {\n    url = undefined;\n  }\n  if (!url || (url.protocol !== \"https:\" && !(url.protocol === \"http:\" && isLoopback(url.hostname)))) {\n    throw new Error(\n      `OAuthConnectionProvider: ${key} must be an https URL (http only for localhost), got ${JSON.stringify(value)}.`,\n    );\n  }\n}\n\nexport function isLoopback(hostname: string): boolean {\n  return hostname === \"localhost\" || hostname === \"127.0.0.1\" || hostname === \"[::1]\" || hostname === \"::1\";\n}\n",
     "import { DatabaseManager } from \"../../database/DatabaseManager\";\nimport { app } from \"../../foundation/app\";\nimport { currentEncrypter } from \"../../orm/encryption\";\nimport { LockManager } from \"../../services/lock/LockManager\";\nimport {\n  type ConnectionRecord,\n  type ConnectionStore,\n  DatabaseConnectionStore,\n  MemoryConnectionStore,\n} from \"./ConnectionStore\";\nimport { OAuthConnectionError, OAuthReconnectRequiredError } from \"./errors\";\nimport { type OAuthConnectionProvider, type OAuthTokenSet, isLoopback } from \"./OAuthConnectionProvider\";\n\n/** A user, as far as a connection is concerned: anything with an `id`. */\nexport type ConnectionOwner = { id: string | number } | string | number;\n\n/** What `Connections.fake` answers an API request with. */\nexport type FakeConnectionHandler = (request: Request) => Response | Promise<Response>;\n\nexport interface ConnectionManagerOptions {\n  providers: Record<string, OAuthConnectionProvider>;\n  /** Default: a `DatabaseConnectionStore` on the default database connection. */\n  store?: ConnectionStore | (() => ConnectionStore);\n}\n\n/**\n * The OAuth connections a user has made, and the one place their tokens are\n * read, refreshed and spent. Reached through the `Connections` facade.\n */\nexport class ConnectionManager {\n  static token = \"auth.connections\";\n\n  private resolvedStore: ConnectionStore | undefined;\n  private readonly refreshing = new Map<string, Promise<ConnectionRecord>>();\n  private fakes: Map<string, FakeConnectionHandler> | undefined;\n  private fakeStore: MemoryConnectionStore | undefined;\n  readonly fakeRequests: Request[] = [];\n\n  constructor(private readonly options: ConnectionManagerOptions) {}\n\n  get providers(): Record<string, OAuthConnectionProvider> {\n    return this.options.providers;\n  }\n\n  /** The store connections are kept in. */\n  get store(): ConnectionStore {\n    if (this.fakeStore) return this.fakeStore;\n    if (!this.resolvedStore) {\n      const configured = this.options.store;\n      this.resolvedStore =\n        typeof configured === \"function\"\n          ? configured()\n          : (configured ??\n            new DatabaseConnectionStore(app(DatabaseManager).connection(), () => currentEncrypter()));\n    }\n    return this.resolvedStore;\n  }\n\n  provider(name: string): OAuthConnectionProvider {\n    const provider = this.options.providers[name];\n    if (!provider) {\n      const known = Object.keys(this.options.providers);\n      throw new OAuthConnectionError(\n        \"unknown_provider\",\n        `No OAuth connection provider \"${name}\" in auth.connections` +\n          (known.length > 0 ? ` (configured: ${known.join(\", \")}).` : \" (none are configured).\"),\n      );\n    }\n    return provider;\n  }\n\n  /** The user's connection to `provider`, or `null` when they have not connected it. */\n  async for(user: ConnectionOwner, provider: string): Promise<ProviderConnection | null> {\n    this.provider(provider);\n    const record = await this.store.find(ownerId(user), provider);\n    return record ? new ProviderConnection(this, record) : null;\n  }\n\n  /** Every connection the user has. */\n  async list(user: ConnectionOwner): Promise<ProviderConnection[]> {\n    const records = await this.store.list(ownerId(user));\n    return records\n      .filter((record) => record.provider in this.options.providers)\n      .map((record) => new ProviderConnection(this, record));\n  }\n\n  /**\n   * Stores tokens for the user, replacing any earlier connection to the same\n   * provider. The connect callback calls this; call it yourself for tokens\n   * obtained some other way.\n   */\n  async save(\n    user: ConnectionOwner,\n    provider: string,\n    tokens: Partial<OAuthTokenSet> & { accessToken: string },\n  ): Promise<ProviderConnection> {\n    const config = this.provider(provider);\n    const record = await this.store.save(ownerId(user), provider, {\n      refreshToken: null,\n      tokenType: null,\n      expiresAt: null,\n      providerAccountId: null,\n      scopes: config.config.scopes,\n      ...tokens,\n    });\n    return new ProviderConnection(this, record);\n  }\n\n  // --- testing ---------------------------------------------------------------\n\n  /**\n   * Fakes every provider's API: connections live in memory, `fetch` answers\n   * through `handlers[provider]` (recorded in `fakeRequests`), and nothing\n   * reaches a token or revocation endpoint. Returns `this` so a test can\n   * `save` a connection to start from.\n   */\n  fake(handlers: Record<string, FakeConnectionHandler> = {}): this {\n    this.fakes = new Map(Object.entries(handlers));\n    this.fakeStore = new MemoryConnectionStore();\n    this.fakeRequests.length = 0;\n    return this;\n  }\n\n  /** Undoes `fake`. */\n  restore(): void {\n    this.fakes = undefined;\n    this.fakeStore = undefined;\n    this.fakeRequests.length = 0;\n  }\n\n  get faked(): boolean {\n    return this.fakes !== undefined;\n  }\n\n  // --- internals, for ProviderConnection ---------------------------------------\n\n  /** @internal */\n  async send(provider: string, request: Request): Promise<Response> {\n    if (!this.fakes) return fetch(request);\n    this.fakeRequests.push(request.clone());\n    const handler = this.fakes.get(provider);\n    if (!handler) {\n      throw new Error(`Connections.fake() has no handler for \"${provider}\". Pass one: Connections.fake({ ${provider}: (req) => ... }).`);\n    }\n    return handler(request);\n  }\n\n  /**\n   * A record whose access token is not the one at `staleRevision`: refreshed\n   * by this call, or by whoever refreshed it first. Serialised per connection\n   * in this process (concurrent callers share one refresh) and, through the\n   * app's lock store, across processes — a rotating refresh token must be\n   * spent exactly once.\n   *\n   * @internal\n   */\n  refresh(record: ConnectionRecord): Promise<ConnectionRecord> {\n    const inFlight = this.refreshing.get(record.id);\n    if (inFlight) return inFlight;\n    const task = this.withLock(record.id, () => this.refreshOnce(record)).finally(() =>\n      this.refreshing.delete(record.id),\n    );\n    this.refreshing.set(record.id, task);\n    return task;\n  }\n\n  private async refreshOnce(seen: ConnectionRecord): Promise<ConnectionRecord> {\n    // Re-read under the lock: another process may have refreshed already.\n    const current = await this.store.find(seen.userId, seen.provider);\n    if (!current || current.id !== seen.id) {\n      throw new OAuthReconnectRequiredError(seen.provider);\n    }\n    if (current.revision !== seen.revision && !current.needsReconnect) return current;\n    if (current.needsReconnect) throw new OAuthReconnectRequiredError(seen.provider);\n\n    const provider = this.provider(current.provider);\n    if (this.faked || current.refreshToken === null) {\n      if (this.faked) return current;\n      await this.store.markNeedsReconnect(current.id);\n      throw new OAuthReconnectRequiredError(current.provider);\n    }\n\n    let tokens: OAuthTokenSet;\n    try {\n      tokens = await provider.refresh(current.refreshToken, current.scopes);\n    } catch (error) {\n      // A refusal from the token endpoint is final: the grant is gone. A\n      // network error or a 5xx is not, and leaves the connection alone.\n      if (error instanceof OAuthConnectionError && error.status !== undefined && error.status >= 400 && error.status < 500) {\n        await this.store.markNeedsReconnect(current.id);\n        throw new OAuthReconnectRequiredError(current.provider, {\n          cause: error,\n          status: error.status,\n          providerError: error.providerError,\n        });\n      }\n      throw error;\n    }\n\n    const updated = await this.store.updateTokens(current.id, current.revision, tokens);\n    if (updated) return updated;\n    // Someone else wrote first (only possible without a shared lock store).\n    const winner = await this.store.find(current.userId, current.provider);\n    if (!winner) throw new OAuthReconnectRequiredError(current.provider);\n    return winner;\n  }\n\n  private async withLock<T>(id: string, fn: () => Promise<T>): Promise<T> {\n    const application = app();\n    if (this.faked || !application.bound(LockManager)) return fn();\n    const result = await application\n      .make(LockManager)\n      .run(`gemi:oauth-connection:${id}`, { ttl: 30_000, wait: 20_000 }, () => fn());\n    if (!result.acquired) {\n      throw new OAuthConnectionError(\n        \"refresh_failed\",\n        \"Timed out waiting for another refresh of this connection to finish.\",\n      );\n    }\n    return result.value as T;\n  }\n}\n\n/**\n * One user's connection to one provider. Never exposes a token as a property,\n * and serialises (`toJSON`, `console.log`) without them.\n */\nexport class ProviderConnection {\n  constructor(\n    private readonly manager: ConnectionManager,\n    private record: ConnectionRecord,\n  ) {}\n\n  get provider(): string {\n    return this.record.provider;\n  }\n  get userId(): string {\n    return this.record.userId;\n  }\n  get providerAccountId(): string | null {\n    return this.record.providerAccountId;\n  }\n  /** The scopes the provider granted. */\n  get scopes(): readonly string[] {\n    return this.record.scopes;\n  }\n  get expiresAt(): Date | null {\n    return this.record.expiresAt;\n  }\n  /** A refresh was refused: the user has to connect again. */\n  get needsReconnect(): boolean {\n    return this.record.needsReconnect;\n  }\n  get connectedAt(): Date {\n    return this.record.createdAt;\n  }\n\n  /** Whether every one of `scopes` was granted. */\n  hasScopes(...scopes: string[]): boolean {\n    return scopes.every((scope) => this.record.scopes.includes(scope));\n  }\n\n  /**\n   * `fetch`, as the user: adds `Authorization: Bearer <token>`, refreshes the\n   * token first when it is about to expire, and after a 401 refreshes and\n   * retries once. A refresh the provider refuses marks the connection and\n   * throws `OAuthReconnectRequiredError`.\n   *\n   * A path is resolved against the provider's `apiBaseUrl`, and a URL on any\n   * other origin is refused (`OAuthConnectionError`,\n   * `forbidden_url`), so the token only ever goes to the provider. Redirects\n   * are followed by hand: the token is dropped on one that leaves the origin.\n   * A streamed request body cannot be sent twice, so a 401 for one is\n   * returned rather than retried.\n   */\n  async fetch(input: string | URL, init: RequestInit = {}): Promise<Response> {\n    const url = this.resolveUrl(input);\n    const record = await this.current();\n    const first = await this.send(url, init, record.accessToken);\n    // Retry only a 401 for the token itself, not one from where a redirect\n    // led after the token was dropped.\n    if (first.response.status !== 401 || !first.authorized || init.body instanceof ReadableStream) {\n      return first.response;\n    }\n\n    await first.response.body?.cancel().catch(() => {});\n    const refreshed = await this.refreshFrom(record);\n    return (await this.send(url, init, refreshed.accessToken)).response;\n  }\n\n  /**\n   * A valid access token, refreshed first if it is about to expire — for an\n   * SDK that wants the token itself. Prefer `fetch`, which also retries a 401.\n   */\n  async accessToken(): Promise<string> {\n    return (await this.current()).accessToken;\n  }\n\n  /** Refreshes now, whatever the expiry says. */\n  async refresh(): Promise<void> {\n    await this.refreshFrom(this.record);\n  }\n\n  /**\n   * Revokes the grant at the provider (the refresh token when there is one,\n   * which ends the whole grant, else the access token) and deletes the\n   * connection. If the provider refuses, nothing is deleted and\n   * `OAuthConnectionError` (`revoke_failed`) is thrown — call `disconnect()`\n   * to forget the tokens anyway. A provider without a `revokeUrl` throws\n   * `revoke_unsupported`; use `disconnect()`.\n   */\n  async revoke(): Promise<void> {\n    if (!this.manager.faked) {\n      const provider = this.manager.provider(this.record.provider);\n      if (this.record.refreshToken !== null) {\n        await provider.revoke(this.record.refreshToken, \"refresh_token\");\n      } else {\n        await provider.revoke(this.record.accessToken, \"access_token\");\n      }\n    }\n    await this.manager.store.delete(this.record.id);\n  }\n\n  /** Forgets the tokens locally without telling the provider. */\n  async disconnect(): Promise<void> {\n    await this.manager.store.delete(this.record.id);\n  }\n\n  toJSON() {\n    return {\n      provider: this.provider,\n      providerAccountId: this.providerAccountId,\n      scopes: [...this.scopes],\n      expiresAt: this.expiresAt,\n      needsReconnect: this.needsReconnect,\n      connectedAt: this.connectedAt,\n    };\n  }\n\n  [Symbol.for(\"nodejs.util.inspect.custom\")]() {\n    return { ProviderConnection: this.toJSON() };\n  }\n\n  private async current(): Promise<ConnectionRecord> {\n    if (this.record.needsReconnect) throw new OAuthReconnectRequiredError(this.record.provider);\n    const leeway = this.manager.provider(this.record.provider).config.refreshLeewaySeconds * 1000;\n    const expiresAt = this.record.expiresAt?.getTime();\n    if (expiresAt !== undefined && expiresAt - Date.now() <= leeway) {\n      return this.refreshFrom(this.record);\n    }\n    return this.record;\n  }\n\n  private async refreshFrom(record: ConnectionRecord): Promise<ConnectionRecord> {\n    try {\n      this.record = await this.manager.refresh(record);\n    } catch (error) {\n      if (error instanceof OAuthReconnectRequiredError) {\n        this.record = { ...this.record, needsReconnect: true };\n      }\n      throw error;\n    }\n    return this.record;\n  }\n\n  private resolveUrl(input: string | URL): URL {\n    const base = this.manager.provider(this.record.provider).config.apiBaseUrl;\n    let url: URL;\n    try {\n      url = new URL(String(input), base);\n    } catch {\n      throw new OAuthConnectionError(\n        \"forbidden_url\",\n        `connection.fetch was given ${JSON.stringify(String(input))}, which is not a URL.`,\n      );\n    }\n    if (url.origin !== new URL(base).origin) {\n      throw new OAuthConnectionError(\n        \"forbidden_url\",\n        `connection.fetch only sends the ${this.record.provider} token to ${new URL(base).origin} ` +\n          `(apiBaseUrl), not to ${url.origin}.`,\n      );\n    }\n    if (url.protocol !== \"https:\" && !(url.protocol === \"http:\" && isLoopback(url.hostname))) {\n      throw new OAuthConnectionError(\n        \"forbidden_url\",\n        `connection.fetch only sends a token over https, not to ${url.origin}.`,\n      );\n    }\n    return url;\n  }\n\n  private async send(url: URL, init: RequestInit, token: string): Promise<{ response: Response; authorized: boolean }> {\n    let target = url;\n    let method = (init.method ?? \"GET\").toUpperCase();\n    let body = init.body;\n    let authorized = true;\n\n    // Followed by hand (unless the caller asked for \"manual\" or \"error\"), so\n    // the token never follows a redirect to another origin.\n    if (init.redirect === \"manual\" || init.redirect === \"error\") {\n      const response = await this.manager.send(this.record.provider, this.request(target, init, method, body, token));\n      return { response, authorized };\n    }\n\n    for (let hop = 0; ; hop++) {\n      const request = this.request(target, { ...init, redirect: \"manual\" }, method, body, authorized ? token : null);\n      const response = await this.manager.send(this.record.provider, request);\n      const location = response.headers.get(\"location\");\n      if (!REDIRECTS.has(response.status) || location === null || hop >= 5) return { response, authorized };\n\n      await response.body?.cancel().catch(() => {});\n      const next = new URL(location, target);\n      if (next.origin !== target.origin) authorized = false;\n      if (response.status === 303 || ((response.status === 301 || response.status === 302) && method === \"POST\")) {\n        method = \"GET\";\n        body = undefined;\n      }\n      target = next;\n    }\n  }\n\n  private request(url: URL, init: RequestInit, method: string, body: RequestInit[\"body\"], token: string | null): Request {\n    const headers = new Headers(init.headers);\n    if (token === null) headers.delete(\"authorization\");\n    else headers.set(\"Authorization\", `Bearer ${token}`);\n    return new Request(url, { ...init, method, body, headers });\n  }\n}\n\nconst REDIRECTS = new Set([301, 302, 303, 307, 308]);\n\nfunction ownerId(user: ConnectionOwner): string {\n  const id = typeof user === \"object\" && user !== null ? user.id : user;\n  if (id === undefined || id === null || id === \"\") {\n    throw new TypeError(\"An OAuth connection belongs to a user: pass the user (or its id).\");\n  }\n  return String(id);\n}\n"
   ],
-  "mappings": ";sLAwCO,AAAM,LAAiD,LAC3C,KAAO,IAAI,SAEtB,KAAI,CAAC,EAAgB,EAAkB,CAC3C,QAAW,KAAO,KAAK,KAAK,OAAO,EACjC,GAAI,EAAI,SAAW,GAAU,EAAI,WAAa,EAAU,MAAO,IAAK,CAAI,EAE1E,OAAO,UAGH,KAAI,CAAC,EAAgB,CACzB,MAAO,CAAC,GAAG,KAAK,KAAK,OAAO,CAAC,EAAE,OAAO,CAAC,IAAQ,EAAI,SAAW,CAAM,EAAE,IAAI,CAAC,KAAS,IAAK,CAAI,EAAE,OAG3F,KAAI,CAAC,EAAgB,EAAkB,EAAuB,CAClE,IAAM,EAAW,MAAM,KAAK,KAAK,EAAQ,CAAQ,EAC3C,EAAM,IAAI,KACV,EAAwB,CAC5B,GAAI,GAAU,IAAM,IAAI,aAAa,EACrC,SACA,cACG,EAAW,CAAM,EACpB,eAAgB,GAChB,UAAW,GAAU,UAAY,GAAK,EACtC,UAAW,GAAU,WAAa,EAClC,UAAW,CACb,EAEA,OADA,KAAK,KAAK,IAAI,EAAI,GAAI,CAAG,EAClB,IAAK,CAAI,OAGZ,aAAY,CAAC,EAAY,EAAkB,EAAuB,CACtE,IAAM,EAAM,KAAK,KAAK,IAAI,CAAE,EAC5B,GAAI,CAAC,GAAO,EAAI,WAAa,EAAU,OAAO,KAC9C,IAAM,EAAO,IAAK,KAAQ,EAAW,CAAM,EAAG,eAAgB,GAAO,SAAU,EAAW,EAAG,UAAW,IAAI,IAAO,EAEnH,OADA,KAAK,KAAK,IAAI,EAAI,CAAI,EACf,IAAK,CAAK,OAGb,mBAAkB,CAAC,EAAY,CACnC,IAAM,EAAM,KAAK,KAAK,IAAI,CAAE,EAC5B,GAAI,EAAK,KAAK,KAAK,IAAI,EAAI,IAAK,EAAK,eAAgB,GAAM,UAAW,IAAI,IAAO,CAAC,OAG9E,OAAM,CAAC,EAAY,CACvB,KAAK,KAAK,OAAO,CAAE,EAEvB,CAaO,MAAM,CAAmD,CAO3C,UANV,MACQ,IACA,QAEjB,WAAW,CACT,EACiB,EACjB,EAA0C,CAAC,EAC3C,CAFiB,iBAGjB,IAAM,EAAQ,EAAQ,OAAS,yBAC/B,GAAI,CAAC,2BAA2B,KAAK,CAAK,EACxC,MAAU,MAAM,+BAA+B,+BAAmC,EAEpF,KAAK,MAAQ,EACb,KAAK,IAAM,EAAW,IACtB,KAAK,QAAU,EAAW,aAItB,YAAW,EAAkB,CACjC,QAAW,KAAa,EAAgC,KAAK,QAAS,KAAK,KAAK,EAC9E,MAAM,KAAK,IAAI,OAAO,CAAS,OAI7B,KAAI,CAAC,EAAgB,EAAkB,CAC3C,IAAM,EAAI,KAAK,IACT,EAAQ,KAAM;AAAA,sBACF,KAAK,KAAK,CAAC,qBAAqB,oBAAyB;AAAA,MAE3E,OAAO,EAAK,GAAK,KAAK,OAAO,EAAK,EAAE,EAAI,UAGpC,KAAI,CAAC,EAAgB,CACzB,IAAM,EAAI,KAAK,IAIf,OAHc,KAAM;AAAA,sBACF,KAAK,KAAK,CAAC,qBAAqB;AAAA,OAEtC,IAAI,CAAC,IAAQ,KAAK,OAAO,CAAG,CAAC,OAGrC,KAAI,CAAC,EAAgB,EAAkB,EAAuB,CAClE,IAAM,EAAI,KAAK,IACT,EAAS,KAAK,OAAO,CAAM,EAC3B,EAAM,KAAK,IAAI,EAEf,EAAS,SACb,EACE,KAAM;AAAA,mBACK,KAAK,KAAK,CAAC;AAAA,sCACQ,EAAO,+BAA+B,EAAO;AAAA,+BACpD,EAAO,gCAAgC,EAAO;AAAA,6BAChD,EAAO,2BAA2B,EAAO;AAAA,2EACK;AAAA,4BAC/C,oBAAyB;AAAA,SAE/C,EAEF,GAAK,MAAM,EAAO,IAAO,EACvB,GAAI,CACF,KAAM;AAAA,wBACU,KAAK,KAAK,CAAC;AAAA;AAAA;AAAA,oBAGf,IAAI,aAAa,MAAM,MAAW,MAAa,EAAO;AAAA,cAC5D,EAAO,WAAW,EAAO,gBAAgB,EAAO,iBAAiB,EAAO;AAAA,cACxE,EAAO,oBAAoB,MAAQ;AAAA,UAEzC,MAAO,EAAO,CAEd,GAAK,MAAM,EAAO,IAAO,EAAG,MAAM,EAItC,IAAM,EAAQ,MAAM,KAAK,KAAK,EAAQ,CAAQ,EAC9C,GAAI,CAAC,EAAO,MAAU,MAAM,yDAAyD,EACrF,OAAO,OAGH,aAAY,CAAC,EAAY,EAAkB,EAAuB,CACtE,IAAM,EAAI,KAAK,IACT,EAAS,KAAK,OAAO,CAAM,EAC3B,EAAS,KAAM;AAAA,eACV,KAAK,KAAK,CAAC;AAAA,2CACiB,EAAO;AAAA,qBAC7B,EAAO,0BAA0B,EAAO;AAAA,4BACjC,EAAO,8BAA8B,EAAO;AAAA,yBAC/C,EAAO;AAAA,yBACP,KAAK,IAAI;AAAA,mBACf,oBAAqB;AAAA,MAEpC,GAAI,EAAS,CAAM,IAAM,EAAG,OAAO,KACnC,IAAM,EAAQ,KAAM,mBAAkB,KAAK,KAAK,CAAC,gBAAgB,IACjE,OAAO,EAAK,GAAK,KAAK,OAAO,EAAK,EAAE,EAAI,UAGpC,mBAAkB,CAAC,EAAY,CACnC,IAAM,EAAI,KAAK,IACf,KAAM,YAAW,KAAK,KAAK,CAAC,2CAA2C,KAAK,IAAI,gBAAgB,SAG5F,OAAM,CAAC,EAAY,CACvB,IAAM,EAAI,KAAK,IACf,KAAM,iBAAgB,KAAK,KAAK,CAAC,gBAAgB,SAQ7C,iBAAgB,CAAC,EAAgC,CAAC,EAAkD,CACxG,IAAM,EAAI,KAAK,IACT,EAAY,KAAK,UAAU,EAC3B,EAAQ,KAAM;AAAA,8DACsC,KAAK,KAAK,CAAC;AAAA,MAEjE,EAAU,EACd,QAAW,KAAO,EAAM,CACtB,IAAM,EAAQ,CAAC,IAAyB,OAAO,IAAU,UAAY,EAAU,kBAAkB,CAAK,EACtG,GAAI,CAAC,EAAM,EAAI,YAAY,GAAK,CAAC,EAAM,EAAI,aAAa,EAAG,SAE3D,GADA,GAAW,EACP,EAAQ,OAAQ,SACpB,IAAM,EAAS,CAAC,IAA0B,IAAU,KAAO,KAAO,EAAU,QAAQ,EAAU,QAAQ,CAAK,CAAC,EAC5G,KAAM;AAAA,iBACK,KAAK,KAAK,CAAC;AAAA,6BACC,EAAO,EAAI,YAAY,sBAAsB,EAAO,EAAI,aAAa;AAAA;AAAA,qBAE7E,EAAI,qBAAqB,OAAO,EAAI,QAAQ;AAAA,QAG7D,MAAO,CAAE,QAAS,EAAK,OAAQ,SAAQ,EAGjC,MAAM,CAAC,EAAuB,CACpC,IAAM,EAAY,KAAK,UAAU,EACjC,MAAO,CACL,kBAAmB,EAAO,kBAC1B,OAAQ,EAAO,OAAO,KAAK,GAAG,EAC9B,YAAa,EAAU,QAAQ,EAAO,WAAW,EACjD,aAAc,EAAO,eAAiB,KAAO,KAAO,EAAU,QAAQ,EAAO,YAAY,EACzF,UAAW,EAAO,UAClB,UAAW,EAAO,YAAc,KAAO,KAAO,EAAO,UAAU,QAAQ,CACzE,EAGM,MAAM,CAAC,EAA+B,CAC5C,IAAM,EAAY,KAAK,UAAU,EACjC,MAAO,CACL,GAAI,OAAO,EAAI,EAAE,EACjB,OAAQ,OAAO,EAAI,OAAO,EAC1B,SAAU,OAAO,EAAI,QAAQ,EAC7B,kBAAmB,EAAI,sBAAwB,KAAO,KAAO,OAAO,EAAI,mBAAmB,EAC3F,OAAQ,OAAO,EAAI,QAAU,EAAE,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO,EAC1D,YAAa,EAAU,QAAQ,OAAO,EAAI,YAAY,CAAC,EACvD,aAAc,EAAI,gBAAkB,KAAO,KAAO,EAAU,QAAQ,OAAO,EAAI,aAAa,CAAC,EAC7F,UAAW,EAAI,aAAe,KAAO,KAAO,OAAO,EAAI,UAAU,EACjE,UAAW,EAAI,aAAe,KAAO,KAAO,IAAI,KAAK,OAAO,EAAI,UAAU,CAAC,EAC3E,eAAgB,OAAO,EAAI,eAAe,IAAM,EAChD,SAAU,OAAO,EAAI,QAAQ,EAC7B,UAAW,IAAI,KAAK,OAAO,EAAI,UAAU,CAAC,EAC1C,UAAW,IAAI,KAAK,OAAO,EAAI,UAAU,CAAC,CAC5C,KAGU,MAAK,EAAG,CAClB,OAAO,KAAK,UAAY,SAAW,KAAK,UAAY,UAG9C,IAAI,CAAC,EAAQ,CACnB,OAAO,EAAE,OAAO,KAAK,MAAQ,KAAK,KAAK,UAAY,IAAI,KAAK,QAAQ,EAExE,CAkBA,SAAS,CAAU,CAAC,EAAuB,CACzC,MAAO,CACL,kBAAmB,EAAO,kBAC1B,OAAQ,CAAC,GAAG,EAAO,MAAM,EACzB,YAAa,EAAO,YACpB,aAAc,EAAO,aACrB,UAAW,EAAO,UAClB,UAAW,EAAO,SACpB,EAGF,SAAS,CAAQ,CAAC,EAAyB,CACzC,IAAM,EAAS,EACf,OAAO,KAAK,IAAI,OAAO,EAAO,OAAS,CAAC,EAAG,OAAO,EAAO,cAAgB,CAAC,CAAC,EAItE,SAAS,CAA+B,CAAC,EAAkB,EAAyB,CACzF,GAAI,IAAY,SAAW,IAAY,UACrC,MAAO,CACL,gCAAgC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qBAejB;AAAA;AAAA,2DAGjB,EAEF,IAAM,EAAM,IAAY,SAAW,kCAAoC,sBACjE,EACJ,IAAY,SAAW,GAAK;AAAA;AAAA,kBAAwB,6BACtD,MAAO,CACL,+BAA+B;AAAA,MAC7B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kCAY4B;AAAA,GAE9B,sCAAsC,+BAAmC,2BAC3E,ECjVK,MAAM,UAA6B,KAAM,CAKnC,KAJF,OACA,cAET,WAAW,CACA,EACT,EACA,EAAwE,CAAC,EACzE,CACA,MAAM,EAAS,EAAQ,QAAU,OAAY,CAAE,MAAO,EAAQ,KAAM,EAAI,MAAS,EAJxE,YAKT,KAAK,KAAO,uBACZ,KAAK,OAAS,EAAQ,OACtB,KAAK,cAAgB,EAAQ,cAEjC,CASO,MAAM,UAAoC,CAAqB,CAEzD,SADX,WAAW,CACA,EACT,EAAwE,CAAC,EACzE,CACA,MACE,qBACA,OAAO,4FACP,CACF,EAPS,gBAQT,KAAK,KAAO,8BAEhB,CCiCO,MAAM,CAAwB,CAC1B,OAKT,WAAW,CAAC,EAAuC,CACjD,QAAW,IAAO,CAAC,eAAgB,UAAU,EAC3C,EAAc,EAAK,EAAO,EAAI,EAEhC,GAAI,EAAO,YAAc,OAAW,EAAc,YAAa,EAAO,SAAS,EAK/E,GAAI,EAAO,aAAe,QAAa,EAAO,aAAe,MAAQ,EAAO,aAAe,GACzF,MAAU,MACR,+KAEF,EAEF,EAAc,aAAc,EAAO,UAAU,EAC7C,KAAK,OAAS,CACZ,eAAgB,IAChB,WAAY,OACZ,KAAM,GACN,oBAAqB,CAAC,EACtB,qBAAsB,MACnB,CACL,EAIF,gBAAgB,CAAC,EAA6E,CAC5F,IAAM,EAAM,IAAI,IAAI,KAAK,OAAO,YAAY,EACtC,EAAiC,IAClC,KAAK,OAAO,oBACf,cAAe,OACf,UAAW,KAAK,OAAO,SACvB,aAAc,EAAK,YACnB,MAAO,KAAK,OAAO,OAAO,KAAK,KAAK,OAAO,cAAc,EACzD,MAAO,EAAK,KACd,EACA,GAAI,KAAK,OAAO,KACd,EAAO,eAAiB,EAAK,cAC7B,EAAO,sBAAwB,OAEjC,QAAY,EAAK,KAAU,OAAO,QAAQ,CAAM,EAAG,EAAI,aAAa,IAAI,EAAK,CAAK,EAClF,OAAO,EAAI,SAAS,EAItB,YAAY,CAAC,EAA2F,CACtG,IAAM,EAAO,IAAI,gBAAgB,CAC/B,WAAY,qBACZ,KAAM,EAAK,KACX,aAAc,EAAK,WACrB,CAAC,EACD,GAAI,KAAK,OAAO,KAAM,EAAK,IAAI,gBAAiB,EAAK,YAAY,EACjE,OAAO,KAAK,aAAa,EAAM,CAAE,OAAQ,KAAK,OAAO,OAAQ,aAAc,KAAM,MAAO,UAAW,CAAC,EAOtG,OAAO,CAAC,EAAsB,EAA0C,CACtE,IAAM,EAAO,IAAI,gBAAgB,CAAE,WAAY,gBAAiB,cAAe,CAAa,CAAC,EAC7F,OAAO,KAAK,aAAa,EAAM,CAAE,SAAQ,eAAc,MAAO,SAAU,CAAC,OAIrE,OAAM,CAAC,EAAe,EAAuD,CACjF,GAAI,CAAC,KAAK,OAAO,UACf,MAAM,IAAI,EACR,qBACA,2FACF,EAEF,IAAM,EAAO,IAAI,gBAAgB,CAAE,QAAO,gBAAiB,CAAK,CAAC,EAC7D,EACJ,GAAI,CACF,EAAW,MAAM,MAAM,KAAK,OAAO,UAAW,KAAK,KAAK,CAAI,CAAC,EAC7D,MAAO,EAAO,CACd,MAAM,IAAI,EAAqB,gBAAiB,iCAAkC,CAAE,OAAM,CAAC,EAG7F,GAAI,CAAC,EAAS,GACZ,MAAM,IAAI,EACR,gBACA,6CAA6C,EAAS,WACtD,CAAE,OAAQ,EAAS,MAAO,CAC5B,EAII,IAAI,CAAC,EAAoC,CAC/C,IAAM,EAAkC,CACtC,eAAgB,oCAEhB,OAAQ,kBACV,EACA,GAAI,KAAK,OAAO,aAAe,QAAS,CACtC,IAAM,EAAc,GAAG,mBAAmB,KAAK,OAAO,QAAQ,KAAK,mBAAmB,KAAK,OAAO,YAAY,IAC9G,EAAQ,cAAgB,SAAS,OAAO,KAAK,CAAW,EAAE,SAAS,QAAQ,IAE3E,OAAK,IAAI,YAAa,KAAK,OAAO,QAAQ,EAC1C,EAAK,IAAI,gBAAiB,KAAK,OAAO,YAAY,EAEpD,MAAO,CAAE,OAAQ,OAAQ,UAAS,KAAM,EAAK,SAAS,EAAG,SAAU,OAAQ,OAG/D,aAAY,CACxB,EACA,EACwB,CACxB,IAAM,EAAU,EAAS,QAAU,WAAa,kBAAoB,iBAChE,EACJ,GAAI,CACF,EAAW,MAAM,MAAM,KAAK,OAAO,SAAU,KAAK,KAAK,CAAI,CAAC,EAC5D,MAAO,EAAO,CACd,MAAM,IAAI,EAAqB,EAAS,4BAA6B,CAAE,OAAM,CAAC,EAGhF,IAAM,EAAW,MAAM,EAAS,KAAK,EAAE,MAAM,KAAO,CAAC,EAAE,EACvD,GAAI,CAAC,EAAS,IAAM,OAAO,EAAQ,eAAiB,UAAY,EAAQ,eAAiB,GAAI,CAE3F,IAAM,EAAO,OAAO,EAAQ,QAAU,UAAY,oBAAoB,KAAK,EAAQ,KAAK,EAAI,EAAQ,MAAQ,OAC5G,MAAM,IAAI,EACR,EACA,kCAAkC,EAAS,QAAU,WAAa,OAAS,yBAChE,EAAS,SAAS,EAAO,KAAK,IAAS,OAClD,CAAE,OAAQ,EAAS,OAAQ,cAAe,CAAK,CACjD,EAGF,IAAM,EAAY,OAAO,EAAQ,UAAU,EACrC,EAAQ,OAAO,EAAQ,QAAU,SAAW,EAAQ,MAAQ,OAC5D,EAAY,EAAQ,SAAW,EAAQ,WAC7C,MAAO,CACL,YAAa,EAAQ,aACrB,aACE,OAAO,EAAQ,gBAAkB,UAAY,EAAQ,gBAAkB,GACnE,EAAQ,cACR,EAAS,aACf,UAAW,OAAO,EAAQ,aAAe,SAAW,EAAQ,WAAa,KACzE,UAAW,OAAO,SAAS,CAAS,GAAK,EAAY,EAAI,IAAI,KAAK,KAAK,IAAI,EAAI,EAAY,IAAI,EAAI,KACnG,OAAQ,IAAU,OAAY,EAAM,MAAM,QAAQ,EAAE,OAAO,OAAO,EAAI,EAAS,OAC/E,kBACE,OAAO,IAAc,UAAY,OAAO,IAAc,SAAW,OAAO,CAAS,EAAI,IACzF,EAEJ,CAEA,SAAS,CAAa,CAAC,EAAa,EAAsB,CACxD,IAAI,EACJ,GAAI,CACF,EAAM,IAAI,IAAI,OAAO,CAAK,CAAC,EAC3B,KAAM,CACN,EAAM,OAER,GAAI,CAAC,GAAQ,EAAI,WAAa,UAAY,EAAE,EAAI,WAAa,SAAW,EAAW,EAAI,QAAQ,GAC7F,MAAU,MACR,4BAA4B,yDAA2D,KAAK,UAAU,CAAK,IAC7G,EAIG,SAAS,CAAU,CAAC,EAA2B,CACpD,OAAO,IAAa,aAAe,IAAa,aAAe,IAAa,SAAW,IAAa,MC9N/F,MAAM,CAAkB,CASA,cARtB,OAAQ,mBAEP,cACS,WAAa,IAAI,IAC1B,MACA,UACC,aAA0B,CAAC,EAEpC,WAAW,CAAkB,EAAmC,CAAnC,kBAEzB,UAAS,EAA4C,CACvD,OAAO,KAAK,QAAQ,aAIlB,MAAK,EAAoB,CAC3B,GAAI,KAAK,UAAW,OAAO,KAAK,UAChC,GAAI,CAAC,KAAK,cAAe,CACvB,IAAM,EAAa,KAAK,QAAQ,MAChC,KAAK,cACH,OAAO,IAAe,WAClB,EAAW,EACV,GACD,IAAI,EAAwB,EAAI,CAAe,EAAE,WAAW,EAAG,IAAM,EAAiB,CAAC,EAE/F,OAAO,KAAK,cAGd,QAAQ,CAAC,EAAuC,CAC9C,IAAM,EAAW,KAAK,QAAQ,UAAU,GACxC,GAAI,CAAC,EAAU,CACb,IAAM,EAAQ,OAAO,KAAK,KAAK,QAAQ,SAAS,EAChD,MAAM,IAAI,EACR,mBACA,iCAAiC,0BAC9B,EAAM,OAAS,EAAI,iBAAiB,EAAM,KAAK,IAAI,MAAQ,0BAChE,EAEF,OAAO,OAIH,IAAG,CAAC,EAAuB,EAAsD,CACrF,KAAK,SAAS,CAAQ,EACtB,IAAM,EAAS,MAAM,KAAK,MAAM,KAAK,EAAQ,CAAI,EAAG,CAAQ,EAC5D,OAAO,EAAS,IAAI,EAAmB,KAAM,CAAM,EAAI,UAInD,KAAI,CAAC,EAAsD,CAE/D,OADgB,MAAM,KAAK,MAAM,KAAK,EAAQ,CAAI,CAAC,GAEhD,OAAO,CAAC,KAAW,EAAO,YAAY,KAAK,QAAQ,UAAS,EAC5D,IAAI,CAAC,IAAW,IAAI,EAAmB,KAAM,CAAM,CAAC,OAQnD,KAAI,CACR,EACA,EACA,EAC6B,CAC7B,IAAM,EAAS,KAAK,SAAS,CAAQ,EAC/B,EAAS,MAAM,KAAK,MAAM,KAAK,EAAQ,CAAI,EAAG,EAAU,CAC5D,aAAc,KACd,UAAW,KACX,UAAW,KACX,kBAAmB,KACnB,OAAQ,EAAO,OAAO,UACnB,CACL,CAAC,EACD,OAAO,IAAI,EAAmB,KAAM,CAAM,EAW5C,IAAI,CAAC,EAAkD,CAAC,EAAS,CAI/D,OAHA,KAAK,MAAQ,IAAI,IAAI,OAAO,QAAQ,CAAQ,CAAC,EAC7C,KAAK,UAAY,IAAI,EACrB,KAAK,aAAa,OAAS,EACpB,KAIT,OAAO,EAAS,CACd,KAAK,MAAQ,OACb,KAAK,UAAY,OACjB,KAAK,aAAa,OAAS,KAGzB,MAAK,EAAY,CACnB,OAAO,KAAK,QAAU,YAMlB,KAAI,CAAC,EAAkB,EAAqC,CAChE,GAAI,CAAC,KAAK,MAAO,OAAO,MAAM,CAAO,EACrC,KAAK,aAAa,KAAK,EAAQ,MAAM,CAAC,EACtC,IAAM,EAAU,KAAK,MAAM,IAAI,CAAQ,EACvC,GAAI,CAAC,EACH,MAAU,MAAM,0CAA0C,oCAA2C,qBAA4B,EAEnI,OAAO,EAAQ,CAAO,EAYxB,OAAO,CAAC,EAAqD,CAC3D,IAAM,EAAW,KAAK,WAAW,IAAI,EAAO,EAAE,EAC9C,GAAI,EAAU,OAAO,EACrB,IAAM,EAAO,KAAK,SAAS,EAAO,GAAI,IAAM,KAAK,YAAY,CAAM,CAAC,EAAE,QAAQ,IAC5E,KAAK,WAAW,OAAO,EAAO,EAAE,CAClC,EAEA,OADA,KAAK,WAAW,IAAI,EAAO,GAAI,CAAI,EAC5B,OAGK,YAAW,CAAC,EAAmD,CAE3E,IAAM,EAAU,MAAM,KAAK,MAAM,KAAK,EAAK,OAAQ,EAAK,QAAQ,EAChE,GAAI,CAAC,GAAW,EAAQ,KAAO,EAAK,GAClC,MAAM,IAAI,EAA4B,EAAK,QAAQ,EAErD,GAAI,EAAQ,WAAa,EAAK,UAAY,CAAC,EAAQ,eAAgB,OAAO,EAC1E,GAAI,EAAQ,eAAgB,MAAM,IAAI,EAA4B,EAAK,QAAQ,EAE/E,IAAM,EAAW,KAAK,SAAS,EAAQ,QAAQ,EAC/C,GAAI,KAAK,OAAS,EAAQ,eAAiB,KAAM,CAC/C,GAAI,KAAK,MAAO,OAAO,EAEvB,MADA,MAAM,KAAK,MAAM,mBAAmB,EAAQ,EAAE,EACxC,IAAI,EAA4B,EAAQ,QAAQ,EAGxD,IAAI,EACJ,GAAI,CACF,EAAS,MAAM,EAAS,QAAQ,EAAQ,aAAc,EAAQ,MAAM,EACpE,MAAO,EAAO,CAGd,GAAI,aAAiB,GAAwB,EAAM,SAAW,QAAa,EAAM,QAAU,KAAO,EAAM,OAAS,IAE/G,MADA,MAAM,KAAK,MAAM,mBAAmB,EAAQ,EAAE,EACxC,IAAI,EAA4B,EAAQ,SAAU,CACtD,MAAO,EACP,OAAQ,EAAM,OACd,cAAe,EAAM,aACvB,CAAC,EAEH,MAAM,EAGR,IAAM,EAAU,MAAM,KAAK,MAAM,aAAa,EAAQ,GAAI,EAAQ,SAAU,CAAM,EAClF,GAAI,EAAS,OAAO,EAEpB,IAAM,EAAS,MAAM,KAAK,MAAM,KAAK,EAAQ,OAAQ,EAAQ,QAAQ,EACrE,GAAI,CAAC,EAAQ,MAAM,IAAI,EAA4B,EAAQ,QAAQ,EACnE,OAAO,OAGK,SAAW,CAAC,EAAY,EAAkC,CACtE,IAAM,EAAc,EAAI,EACxB,GAAI,KAAK,OAAS,CAAC,EAAY,MAAM,CAAW,EAAG,OAAO,EAAG,EAC7D,IAAM,EAAS,MAAM,EAClB,KAAK,CAAW,EAChB,IAAI,yBAAyB,IAAM,CAAE,IAAK,MAAQ,KAAM,KAAO,EAAG,IAAM,EAAG,CAAC,EAC/E,GAAI,CAAC,EAAO,SACV,MAAM,IAAI,EACR,iBACA,qEACF,EAEF,OAAO,EAAO,MAElB,CAMO,MAAM,CAAmB,CAEX,QACT,OAFV,WAAW,CACQ,EACT,EACR,CAFiB,eACT,iBAGN,SAAQ,EAAW,CACrB,OAAO,KAAK,OAAO,YAEjB,OAAM,EAAW,CACnB,OAAO,KAAK,OAAO,UAEjB,kBAAiB,EAAkB,CACrC,OAAO,KAAK,OAAO,qBAGjB,OAAM,EAAsB,CAC9B,OAAO,KAAK,OAAO,UAEjB,UAAS,EAAgB,CAC3B,OAAO,KAAK,OAAO,aAGjB,eAAc,EAAY,CAC5B,OAAO,KAAK,OAAO,kBAEjB,YAAW,EAAS,CACtB,OAAO,KAAK,OAAO,UAIrB,SAAS,IAAI,EAA2B,CACtC,OAAO,EAAO,MAAM,CAAC,IAAU,KAAK,OAAO,OAAO,SAAS,CAAK,CAAC,OAgB7D,MAAK,CAAC,EAAqB,EAAoB,CAAC,EAAsB,CAC1E,IAAM,EAAM,KAAK,WAAW,CAAK,EAC3B,EAAS,MAAM,KAAK,QAAQ,EAC5B,EAAQ,MAAM,KAAK,KAAK,EAAK,EAAM,EAAO,WAAW,EAG3D,GAAI,EAAM,SAAS,SAAW,KAAO,CAAC,EAAM,YAAc,EAAK,gBAAgB,eAC7E,OAAO,EAAM,SAGf,MAAM,EAAM,SAAS,MAAM,OAAO,EAAE,MAAM,IAAM,EAAE,EAClD,IAAM,EAAY,MAAM,KAAK,YAAY,CAAM,EAC/C,OAAQ,MAAM,KAAK,KAAK,EAAK,EAAM,EAAU,WAAW,GAAG,cAOvD,YAAW,EAAoB,CACnC,OAAQ,MAAM,KAAK,QAAQ,GAAG,iBAI1B,QAAO,EAAkB,CAC7B,MAAM,KAAK,YAAY,KAAK,MAAM,OAW9B,OAAM,EAAkB,CAC5B,GAAI,CAAC,KAAK,QAAQ,MAAO,CACvB,IAAM,EAAW,KAAK,QAAQ,SAAS,KAAK,OAAO,QAAQ,EAC3D,GAAI,KAAK,OAAO,eAAiB,KAC/B,MAAM,EAAS,OAAO,KAAK,OAAO,aAAc,eAAe,EAE/D,WAAM,EAAS,OAAO,KAAK,OAAO,YAAa,cAAc,EAGjE,MAAM,KAAK,QAAQ,MAAM,OAAO,KAAK,OAAO,EAAE,OAI1C,WAAU,EAAkB,CAChC,MAAM,KAAK,QAAQ,MAAM,OAAO,KAAK,OAAO,EAAE,EAGhD,MAAM,EAAG,CACP,MAAO,CACL,SAAU,KAAK,SACf,kBAAmB,KAAK,kBACxB,OAAQ,CAAC,GAAG,KAAK,MAAM,EACvB,UAAW,KAAK,UAChB,eAAgB,KAAK,eACrB,YAAa,KAAK,WACpB,GAGD,OAAO,IAAI,4BAA4B,EAAE,EAAG,CAC3C,MAAO,CAAE,mBAAoB,KAAK,OAAO,CAAE,OAG/B,QAAO,EAA8B,CACjD,GAAI,KAAK,OAAO,eAAgB,MAAM,IAAI,EAA4B,KAAK,OAAO,QAAQ,EAC1F,IAAM,EAAS,KAAK,QAAQ,SAAS,KAAK,OAAO,QAAQ,EAAE,OAAO,qBAAuB,KACnF,EAAY,KAAK,OAAO,WAAW,QAAQ,EACjD,GAAI,IAAc,QAAa,EAAY,KAAK,IAAI,GAAK,EACvD,OAAO,KAAK,YAAY,KAAK,MAAM,EAErC,OAAO,KAAK,YAGA,YAAW,CAAC,EAAqD,CAC7E,GAAI,CACF,KAAK,OAAS,MAAM,KAAK,QAAQ,QAAQ,CAAM,EAC/C,MAAO,EAAO,CACd,GAAI,aAAiB,EACnB,KAAK,OAAS,IAAK,KAAK,OAAQ,eAAgB,EAAK,EAEvD,MAAM,EAER,OAAO,KAAK,OAGN,UAAU,CAAC,EAA0B,CAC3C,IAAM,EAAO,KAAK,QAAQ,SAAS,KAAK,OAAO,QAAQ,EAAE,OAAO,WAC5D,EACJ,GAAI,CACF,EAAM,IAAI,IAAI,OAAO,CAAK,EAAG,CAAI,EACjC,KAAM,CACN,MAAM,IAAI,EACR,gBACA,8BAA8B,KAAK,UAAU,OAAO,CAAK,CAAC,wBAC5D,EAEF,GAAI,EAAI,SAAW,IAAI,IAAI,CAAI,EAAE,OAC/B,MAAM,IAAI,EACR,gBACA,mCAAmC,KAAK,OAAO,qBAAqB,IAAI,IAAI,CAAI,EAAE,+BACxD,EAAI,SAChC,EAEF,GAAI,EAAI,WAAa,UAAY,EAAE,EAAI,WAAa,SAAW,EAAW,EAAI,QAAQ,GACpF,MAAM,IAAI,EACR,gBACA,0DAA0D,EAAI,SAChE,EAEF,OAAO,OAGK,KAAI,CAAC,EAAU,EAAmB,EAAqE,CACnH,IAAI,EAAS,EACT,GAAU,EAAK,QAAU,OAAO,YAAY,EAC5C,EAAO,EAAK,KACZ,EAAa,GAIjB,GAAI,EAAK,WAAa,UAAY,EAAK,WAAa,QAElD,MAAO,CAAE,SADQ,MAAM,KAAK,QAAQ,KAAK,KAAK,OAAO,SAAU,KAAK,QAAQ,EAAQ,EAAM,EAAQ,EAAM,CAAK,CAAC,EAC3F,YAAW,EAGhC,QAAS,EAAM,GAAK,IAAO,CACzB,IAAM,EAAU,KAAK,QAAQ,EAAQ,IAAK,EAAM,SAAU,QAAS,EAAG,EAAQ,EAAM,EAAa,EAAQ,IAAI,EACvG,EAAW,MAAM,KAAK,QAAQ,KAAK,KAAK,OAAO,SAAU,CAAO,EAChE,EAAW,EAAS,QAAQ,IAAI,UAAU,EAChD,GAAI,CAAC,EAAU,IAAI,EAAS,MAAM,GAAK,IAAa,MAAQ,GAAO,EAAG,MAAO,CAAE,WAAU,YAAW,EAEpG,MAAM,EAAS,MAAM,OAAO,EAAE,MAAM,IAAM,EAAE,EAC5C,IAAM,EAAO,IAAI,IAAI,EAAU,CAAM,EACrC,GAAI,EAAK,SAAW,EAAO,OAAQ,EAAa,GAChD,GAAI,EAAS,SAAW,MAAS,EAAS,SAAW,KAAO,EAAS,SAAW,MAAQ,IAAW,OACjG,EAAS,MACT,EAAO,OAET,EAAS,GAIL,OAAO,CAAC,EAAU,EAAmB,EAAgB,EAA2B,EAA+B,CACrH,IAAM,EAAU,IAAI,QAAQ,EAAK,OAAO,EACxC,GAAI,IAAU,KAAM,EAAQ,OAAO,eAAe,EAC7C,OAAQ,IAAI,gBAAiB,UAAU,GAAO,EACnD,OAAO,IAAI,QAAQ,EAAK,IAAK,EAAM,SAAQ,OAAM,SAAQ,CAAC,EAE9D,CAEA,IAAM,EAAY,IAAI,IAAI,CAAC,IAAK,IAAK,IAAK,IAAK,GAAG,CAAC,EAEnD,SAAS,CAAO,CAAC,EAA+B,CAC9C,IAAM,EAAK,OAAO,IAAS,UAAY,IAAS,KAAO,EAAK,GAAK,EACjE,GAAI,IAAO,QAAa,IAAO,MAAQ,IAAO,GAC5C,MAAU,UAAU,mEAAmE,EAEzF,OAAO,OAAO,CAAE",
-  "debugId": "BEC29388D06EAD9164756E2164756E21",
+  "mappings": ";sLAwCO,AAAM,LAAiD,LAC3C,KAAO,IAAI,SAEtB,KAAI,CAAC,EAAgB,EAAkB,CAC3C,QAAW,KAAO,KAAK,KAAK,OAAO,EACjC,GAAI,EAAI,SAAW,GAAU,EAAI,WAAa,EAAU,MAAO,IAAK,CAAI,EAE1E,OAAO,UAGH,KAAI,CAAC,EAAgB,CACzB,MAAO,CAAC,GAAG,KAAK,KAAK,OAAO,CAAC,EAAE,OAAO,CAAC,IAAQ,EAAI,SAAW,CAAM,EAAE,IAAI,CAAC,KAAS,IAAK,CAAI,EAAE,OAG3F,KAAI,CAAC,EAAgB,EAAkB,EAAuB,CAClE,IAAM,EAAW,MAAM,KAAK,KAAK,EAAQ,CAAQ,EAC3C,EAAM,IAAI,KACV,EAAwB,CAC5B,GAAI,GAAU,IAAM,IAAI,aAAa,EACrC,SACA,cACG,EAAW,CAAM,EACpB,eAAgB,GAChB,UAAW,GAAU,UAAY,GAAK,EACtC,UAAW,GAAU,WAAa,EAClC,UAAW,CACb,EAEA,OADA,KAAK,KAAK,IAAI,EAAI,GAAI,CAAG,EAClB,IAAK,CAAI,OAGZ,aAAY,CAAC,EAAY,EAAkB,EAAuB,CACtE,IAAM,EAAM,KAAK,KAAK,IAAI,CAAE,EAC5B,GAAI,CAAC,GAAO,EAAI,WAAa,EAAU,OAAO,KAC9C,IAAM,EAAO,IAAK,KAAQ,EAAW,CAAM,EAAG,eAAgB,GAAO,SAAU,EAAW,EAAG,UAAW,IAAI,IAAO,EAEnH,OADA,KAAK,KAAK,IAAI,EAAI,CAAI,EACf,IAAK,CAAK,OAGb,mBAAkB,CAAC,EAAY,CACnC,IAAM,EAAM,KAAK,KAAK,IAAI,CAAE,EAC5B,GAAI,EAAK,KAAK,KAAK,IAAI,EAAI,IAAK,EAAK,eAAgB,GAAM,UAAW,IAAI,IAAO,CAAC,OAG9E,OAAM,CAAC,EAAY,CACvB,KAAK,KAAK,OAAO,CAAE,EAEvB,CAaO,MAAM,CAAmD,CAO3C,UANV,MACQ,IACA,QAEjB,WAAW,CACT,EACiB,EACjB,EAA0C,CAAC,EAC3C,CAFiB,iBAGjB,IAAM,EAAQ,EAAQ,OAAS,yBAC/B,GAAI,CAAC,2BAA2B,KAAK,CAAK,EACxC,MAAU,MAAM,+BAA+B,+BAAmC,EAEpF,KAAK,MAAQ,EACb,KAAK,IAAM,EAAW,IACtB,KAAK,QAAU,EAAW,aAItB,YAAW,EAAkB,CACjC,QAAW,KAAa,EAAgC,KAAK,QAAS,KAAK,KAAK,EAC9E,MAAM,KAAK,IAAI,OAAO,CAAS,OAI7B,KAAI,CAAC,EAAgB,EAAkB,CAC3C,IAAM,EAAI,KAAK,IACT,EAAQ,KAAM;AAAA,sBACF,KAAK,KAAK,CAAC,qBAAqB,oBAAyB;AAAA,MAE3E,OAAO,EAAK,GAAK,KAAK,OAAO,EAAK,EAAE,EAAI,UAGpC,KAAI,CAAC,EAAgB,CACzB,IAAM,EAAI,KAAK,IAIf,OAHc,KAAM;AAAA,sBACF,KAAK,KAAK,CAAC,qBAAqB;AAAA,OAEtC,IAAI,CAAC,IAAQ,KAAK,OAAO,CAAG,CAAC,OAGrC,KAAI,CAAC,EAAgB,EAAkB,EAAuB,CAClE,IAAM,EAAI,KAAK,IACT,EAAS,KAAK,OAAO,CAAM,EAC3B,EAAM,KAAK,IAAI,EAEf,EAAS,SACb,EACE,KAAM;AAAA,mBACK,KAAK,KAAK,CAAC;AAAA,sCACQ,EAAO,+BAA+B,EAAO;AAAA,+BACpD,EAAO,gCAAgC,EAAO;AAAA,6BAChD,EAAO,2BAA2B,EAAO;AAAA,2EACK;AAAA,4BAC/C,oBAAyB;AAAA,SAE/C,EAEF,GAAK,MAAM,EAAO,IAAO,EACvB,GAAI,CACF,KAAM;AAAA,wBACU,KAAK,KAAK,CAAC;AAAA;AAAA;AAAA,oBAGf,IAAI,aAAa,MAAM,MAAW,MAAa,EAAO;AAAA,cAC5D,EAAO,WAAW,EAAO,gBAAgB,EAAO,iBAAiB,EAAO;AAAA,cACxE,EAAO,oBAAoB,MAAQ;AAAA,UAEzC,MAAO,EAAO,CAEd,GAAK,MAAM,EAAO,IAAO,EAAG,MAAM,EAItC,IAAM,EAAQ,MAAM,KAAK,KAAK,EAAQ,CAAQ,EAC9C,GAAI,CAAC,EAAO,MAAU,MAAM,yDAAyD,EACrF,OAAO,OAGH,aAAY,CAAC,EAAY,EAAkB,EAAuB,CACtE,IAAM,EAAI,KAAK,IACT,EAAS,KAAK,OAAO,CAAM,EAC3B,EAAS,KAAM;AAAA,eACV,KAAK,KAAK,CAAC;AAAA,2CACiB,EAAO;AAAA,qBAC7B,EAAO,0BAA0B,EAAO;AAAA,4BACjC,EAAO,8BAA8B,EAAO;AAAA,yBAC/C,EAAO;AAAA,yBACP,KAAK,IAAI;AAAA,mBACf,oBAAqB;AAAA,MAEpC,GAAI,EAAS,CAAM,IAAM,EAAG,OAAO,KACnC,IAAM,EAAQ,KAAM,mBAAkB,KAAK,KAAK,CAAC,gBAAgB,IACjE,OAAO,EAAK,GAAK,KAAK,OAAO,EAAK,EAAE,EAAI,UAGpC,mBAAkB,CAAC,EAAY,CACnC,IAAM,EAAI,KAAK,IACf,KAAM,YAAW,KAAK,KAAK,CAAC,2CAA2C,KAAK,IAAI,gBAAgB,SAG5F,OAAM,CAAC,EAAY,CACvB,IAAM,EAAI,KAAK,IACf,KAAM,iBAAgB,KAAK,KAAK,CAAC,gBAAgB,SAQ7C,iBAAgB,CAAC,EAAgC,CAAC,EAAkD,CACxG,IAAM,EAAI,KAAK,IACT,EAAY,KAAK,UAAU,EAC3B,EAAQ,KAAM;AAAA,8DACsC,KAAK,KAAK,CAAC;AAAA,MAEjE,EAAU,EACd,QAAW,KAAO,EAAM,CACtB,IAAM,EAAQ,CAAC,IAAyB,OAAO,IAAU,UAAY,EAAU,kBAAkB,CAAK,EACtG,GAAI,CAAC,EAAM,EAAI,YAAY,GAAK,CAAC,EAAM,EAAI,aAAa,EAAG,SAE3D,GADA,GAAW,EACP,EAAQ,OAAQ,SACpB,IAAM,EAAS,CAAC,IAA0B,IAAU,KAAO,KAAO,EAAU,QAAQ,EAAU,QAAQ,CAAK,CAAC,EAC5G,KAAM;AAAA,iBACK,KAAK,KAAK,CAAC;AAAA,6BACC,EAAO,EAAI,YAAY,sBAAsB,EAAO,EAAI,aAAa;AAAA;AAAA,qBAE7E,EAAI,qBAAqB,OAAO,EAAI,QAAQ;AAAA,QAG7D,MAAO,CAAE,QAAS,EAAK,OAAQ,SAAQ,EAGjC,MAAM,CAAC,EAAuB,CACpC,IAAM,EAAY,KAAK,UAAU,EACjC,MAAO,CACL,kBAAmB,EAAO,kBAC1B,OAAQ,EAAO,OAAO,KAAK,GAAG,EAC9B,YAAa,EAAU,QAAQ,EAAO,WAAW,EACjD,aAAc,EAAO,eAAiB,KAAO,KAAO,EAAU,QAAQ,EAAO,YAAY,EACzF,UAAW,EAAO,UAClB,UAAW,EAAO,YAAc,KAAO,KAAO,EAAO,UAAU,QAAQ,CACzE,EAGM,MAAM,CAAC,EAA+B,CAC5C,IAAM,EAAY,KAAK,UAAU,EACjC,MAAO,CACL,GAAI,OAAO,EAAI,EAAE,EACjB,OAAQ,OAAO,EAAI,OAAO,EAC1B,SAAU,OAAO,EAAI,QAAQ,EAC7B,kBAAmB,EAAI,sBAAwB,KAAO,KAAO,OAAO,EAAI,mBAAmB,EAC3F,OAAQ,OAAO,EAAI,QAAU,EAAE,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO,EAC1D,YAAa,EAAU,QAAQ,OAAO,EAAI,YAAY,CAAC,EACvD,aAAc,EAAI,gBAAkB,KAAO,KAAO,EAAU,QAAQ,OAAO,EAAI,aAAa,CAAC,EAC7F,UAAW,EAAI,aAAe,KAAO,KAAO,OAAO,EAAI,UAAU,EACjE,UAAW,EAAI,aAAe,KAAO,KAAO,IAAI,KAAK,OAAO,EAAI,UAAU,CAAC,EAC3E,eAAgB,OAAO,EAAI,eAAe,IAAM,EAChD,SAAU,OAAO,EAAI,QAAQ,EAC7B,UAAW,IAAI,KAAK,OAAO,EAAI,UAAU,CAAC,EAC1C,UAAW,IAAI,KAAK,OAAO,EAAI,UAAU,CAAC,CAC5C,KAGU,MAAK,EAAG,CAClB,OAAO,KAAK,UAAY,SAAW,KAAK,UAAY,UAG9C,IAAI,CAAC,EAAQ,CACnB,OAAO,EAAE,OAAO,KAAK,MAAQ,KAAK,KAAK,UAAY,IAAI,KAAK,QAAQ,EAExE,CAkBA,SAAS,CAAU,CAAC,EAAuB,CACzC,MAAO,CACL,kBAAmB,EAAO,kBAC1B,OAAQ,CAAC,GAAG,EAAO,MAAM,EACzB,YAAa,EAAO,YACpB,aAAc,EAAO,aACrB,UAAW,EAAO,UAClB,UAAW,EAAO,SACpB,EAGF,SAAS,CAAQ,CAAC,EAAyB,CACzC,IAAM,EAAS,EACf,OAAO,KAAK,IAAI,OAAO,EAAO,OAAS,CAAC,EAAG,OAAO,EAAO,cAAgB,CAAC,CAAC,EAItE,SAAS,CAA+B,CAAC,EAAkB,EAAyB,CACzF,GAAI,IAAY,SAAW,IAAY,UACrC,MAAO,CACL,gCAAgC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qBAejB;AAAA;AAAA,2DAGjB,EAEF,IAAM,EAAM,IAAY,SAAW,kCAAoC,sBACjE,EACJ,IAAY,SAAW,GAAK;AAAA;AAAA,kBAAwB,6BACtD,MAAO,CACL,+BAA+B;AAAA,MAC7B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kCAY4B;AAAA,GAE9B,sCAAsC,+BAAmC,2BAC3E,ECjVK,MAAM,UAA6B,KAAM,CAKnC,KAJF,OACA,cAET,WAAW,CACA,EACT,EACA,EAAwE,CAAC,EACzE,CACA,MAAM,EAAS,EAAQ,QAAU,OAAY,CAAE,MAAO,EAAQ,KAAM,EAAI,MAAS,EAJxE,YAKT,KAAK,KAAO,uBACZ,KAAK,OAAS,EAAQ,OACtB,KAAK,cAAgB,EAAQ,cAEjC,CASO,MAAM,UAAoC,CAAqB,CAEzD,SADX,WAAW,CACA,EACT,EAAwE,CAAC,EACzE,CACA,MACE,qBACA,OAAO,4FACP,CACF,EAPS,gBAQT,KAAK,KAAO,8BAEhB,CCoCO,MAAM,CAAwB,CAC1B,OAKT,WAAW,CAAC,EAAuC,CACjD,QAAW,IAAO,CAAC,eAAgB,UAAU,EAC3C,EAAc,EAAK,EAAO,EAAI,EAEhC,GAAI,EAAO,YAAc,OAAW,EAAc,YAAa,EAAO,SAAS,EAK/E,GAAI,EAAO,aAAe,QAAa,EAAO,aAAe,MAAQ,EAAO,aAAe,GACzF,MAAU,MACR,+KAEF,EAEF,EAAc,aAAc,EAAO,UAAU,EAC7C,KAAK,OAAS,CACZ,eAAgB,IAChB,WAAY,OACZ,KAAM,GACN,oBAAqB,CAAC,EACtB,qBAAsB,MACnB,CACL,EAIF,gBAAgB,CAAC,EAA6E,CAC5F,IAAM,EAAM,IAAI,IAAI,KAAK,OAAO,YAAY,EACtC,EAAiC,IAClC,KAAK,OAAO,oBACf,cAAe,OACf,UAAW,KAAK,OAAO,SACvB,aAAc,EAAK,YACnB,MAAO,KAAK,OAAO,OAAO,KAAK,KAAK,OAAO,cAAc,EACzD,MAAO,EAAK,KACd,EACA,GAAI,KAAK,OAAO,KACd,EAAO,eAAiB,EAAK,cAC7B,EAAO,sBAAwB,OAEjC,QAAY,EAAK,KAAU,OAAO,QAAQ,CAAM,EAAG,EAAI,aAAa,IAAI,EAAK,CAAK,EAClF,OAAO,EAAI,SAAS,EAItB,YAAY,CAAC,EAA2F,CACtG,IAAM,EAAO,IAAI,gBAAgB,CAC/B,WAAY,qBACZ,KAAM,EAAK,KACX,aAAc,EAAK,WACrB,CAAC,EACD,GAAI,KAAK,OAAO,KAAM,EAAK,IAAI,gBAAiB,EAAK,YAAY,EACjE,OAAO,KAAK,aAAa,EAAM,CAAE,OAAQ,KAAK,OAAO,OAAQ,aAAc,KAAM,MAAO,UAAW,CAAC,EAOtG,OAAO,CAAC,EAAsB,EAA0C,CACtE,IAAM,EAAO,IAAI,gBAAgB,CAAE,WAAY,gBAAiB,cAAe,CAAa,CAAC,EAC7F,OAAO,KAAK,aAAa,EAAM,CAAE,SAAQ,eAAc,MAAO,SAAU,CAAC,OAIrE,OAAM,CAAC,EAAe,EAAuD,CACjF,GAAI,CAAC,KAAK,OAAO,UACf,MAAM,IAAI,EACR,qBACA,2FACF,EAEF,IAAM,EAAO,IAAI,gBAAgB,CAAE,QAAO,gBAAiB,CAAK,CAAC,EAC7D,EACJ,GAAI,CACF,EAAW,MAAM,MAAM,KAAK,OAAO,UAAW,KAAK,KAAK,CAAI,CAAC,EAC7D,MAAO,EAAO,CACd,MAAM,IAAI,EAAqB,gBAAiB,iCAAkC,CAAE,OAAM,CAAC,EAG7F,GAAI,CAAC,EAAS,GACZ,MAAM,IAAI,EACR,gBACA,6CAA6C,EAAS,WACtD,CAAE,OAAQ,EAAS,MAAO,CAC5B,EAII,IAAI,CAAC,EAAoC,CAC/C,IAAM,EAAkC,CACtC,eAAgB,oCAEhB,OAAQ,kBACV,EACA,GAAI,KAAK,OAAO,aAAe,QAAS,CACtC,IAAM,EAAc,GAAG,mBAAmB,KAAK,OAAO,QAAQ,KAAK,mBAAmB,KAAK,OAAO,YAAY,IAC9G,EAAQ,cAAgB,SAAS,OAAO,KAAK,CAAW,EAAE,SAAS,QAAQ,IAE3E,OAAK,IAAI,YAAa,KAAK,OAAO,QAAQ,EAC1C,EAAK,IAAI,gBAAiB,KAAK,OAAO,YAAY,EAEpD,MAAO,CAAE,OAAQ,OAAQ,UAAS,KAAM,EAAK,SAAS,EAAG,SAAU,OAAQ,OAG/D,aAAY,CACxB,EACA,EACwB,CACxB,IAAM,EAAU,EAAS,QAAU,WAAa,kBAAoB,iBAChE,EACJ,GAAI,CACF,EAAW,MAAM,MAAM,KAAK,OAAO,SAAU,KAAK,KAAK,CAAI,CAAC,EAC5D,MAAO,EAAO,CACd,MAAM,IAAI,EAAqB,EAAS,4BAA6B,CAAE,OAAM,CAAC,EAGhF,IAAM,EAAW,MAAM,EAAS,KAAK,EAAE,MAAM,KAAO,CAAC,EAAE,EACvD,GAAI,CAAC,EAAS,IAAM,OAAO,EAAQ,eAAiB,UAAY,EAAQ,eAAiB,GAAI,CAE3F,IAAM,EAAO,OAAO,EAAQ,QAAU,UAAY,oBAAoB,KAAK,EAAQ,KAAK,EAAI,EAAQ,MAAQ,OAC5G,MAAM,IAAI,EACR,EACA,kCAAkC,EAAS,QAAU,WAAa,OAAS,yBAChE,EAAS,SAAS,EAAO,KAAK,IAAS,OAClD,CAAE,OAAQ,EAAS,OAAQ,cAAe,CAAK,CACjD,EAGF,IAAM,EAAY,OAAO,EAAQ,UAAU,EACrC,EAAQ,OAAO,EAAQ,QAAU,SAAW,EAAQ,MAAQ,OAG5D,EAAY,EAAQ,gBAAkB,EAAQ,SAAW,EAAQ,WACvE,MAAO,CACL,YAAa,EAAQ,aACrB,aACE,OAAO,EAAQ,gBAAkB,UAAY,EAAQ,gBAAkB,GACnE,EAAQ,cACR,EAAS,aACf,UAAW,OAAO,EAAQ,aAAe,SAAW,EAAQ,WAAa,KACzE,UAAW,OAAO,SAAS,CAAS,GAAK,EAAY,EAAI,IAAI,KAAK,KAAK,IAAI,EAAI,EAAY,IAAI,EAAI,KACnG,OAAQ,IAAU,OAAY,EAAM,MAAM,QAAQ,EAAE,OAAO,OAAO,EAAI,EAAS,OAC/E,kBACE,OAAO,IAAc,UAAY,OAAO,IAAc,SAAW,OAAO,CAAS,EAAI,IACzF,EAEJ,CAEA,SAAS,CAAa,CAAC,EAAa,EAAsB,CACxD,IAAI,EACJ,GAAI,CACF,EAAM,IAAI,IAAI,OAAO,CAAK,CAAC,EAC3B,KAAM,CACN,EAAM,OAER,GAAI,CAAC,GAAQ,EAAI,WAAa,UAAY,EAAE,EAAI,WAAa,SAAW,EAAW,EAAI,QAAQ,GAC7F,MAAU,MACR,4BAA4B,yDAA2D,KAAK,UAAU,CAAK,IAC7G,EAIG,SAAS,CAAU,CAAC,EAA2B,CACpD,OAAO,IAAa,aAAe,IAAa,aAAe,IAAa,SAAW,IAAa,MCnO/F,MAAM,CAAkB,CASA,cARtB,OAAQ,mBAEP,cACS,WAAa,IAAI,IAC1B,MACA,UACC,aAA0B,CAAC,EAEpC,WAAW,CAAkB,EAAmC,CAAnC,kBAEzB,UAAS,EAA4C,CACvD,OAAO,KAAK,QAAQ,aAIlB,MAAK,EAAoB,CAC3B,GAAI,KAAK,UAAW,OAAO,KAAK,UAChC,GAAI,CAAC,KAAK,cAAe,CACvB,IAAM,EAAa,KAAK,QAAQ,MAChC,KAAK,cACH,OAAO,IAAe,WAClB,EAAW,EACV,GACD,IAAI,EAAwB,EAAI,CAAe,EAAE,WAAW,EAAG,IAAM,EAAiB,CAAC,EAE/F,OAAO,KAAK,cAGd,QAAQ,CAAC,EAAuC,CAC9C,IAAM,EAAW,KAAK,QAAQ,UAAU,GACxC,GAAI,CAAC,EAAU,CACb,IAAM,EAAQ,OAAO,KAAK,KAAK,QAAQ,SAAS,EAChD,MAAM,IAAI,EACR,mBACA,iCAAiC,0BAC9B,EAAM,OAAS,EAAI,iBAAiB,EAAM,KAAK,IAAI,MAAQ,0BAChE,EAEF,OAAO,OAIH,IAAG,CAAC,EAAuB,EAAsD,CACrF,KAAK,SAAS,CAAQ,EACtB,IAAM,EAAS,MAAM,KAAK,MAAM,KAAK,EAAQ,CAAI,EAAG,CAAQ,EAC5D,OAAO,EAAS,IAAI,EAAmB,KAAM,CAAM,EAAI,UAInD,KAAI,CAAC,EAAsD,CAE/D,OADgB,MAAM,KAAK,MAAM,KAAK,EAAQ,CAAI,CAAC,GAEhD,OAAO,CAAC,KAAW,EAAO,YAAY,KAAK,QAAQ,UAAS,EAC5D,IAAI,CAAC,IAAW,IAAI,EAAmB,KAAM,CAAM,CAAC,OAQnD,KAAI,CACR,EACA,EACA,EAC6B,CAC7B,IAAM,EAAS,KAAK,SAAS,CAAQ,EAC/B,EAAS,MAAM,KAAK,MAAM,KAAK,EAAQ,CAAI,EAAG,EAAU,CAC5D,aAAc,KACd,UAAW,KACX,UAAW,KACX,kBAAmB,KACnB,OAAQ,EAAO,OAAO,UACnB,CACL,CAAC,EACD,OAAO,IAAI,EAAmB,KAAM,CAAM,EAW5C,IAAI,CAAC,EAAkD,CAAC,EAAS,CAI/D,OAHA,KAAK,MAAQ,IAAI,IAAI,OAAO,QAAQ,CAAQ,CAAC,EAC7C,KAAK,UAAY,IAAI,EACrB,KAAK,aAAa,OAAS,EACpB,KAIT,OAAO,EAAS,CACd,KAAK,MAAQ,OACb,KAAK,UAAY,OACjB,KAAK,aAAa,OAAS,KAGzB,MAAK,EAAY,CACnB,OAAO,KAAK,QAAU,YAMlB,KAAI,CAAC,EAAkB,EAAqC,CAChE,GAAI,CAAC,KAAK,MAAO,OAAO,MAAM,CAAO,EACrC,KAAK,aAAa,KAAK,EAAQ,MAAM,CAAC,EACtC,IAAM,EAAU,KAAK,MAAM,IAAI,CAAQ,EACvC,GAAI,CAAC,EACH,MAAU,MAAM,0CAA0C,oCAA2C,qBAA4B,EAEnI,OAAO,EAAQ,CAAO,EAYxB,OAAO,CAAC,EAAqD,CAC3D,IAAM,EAAW,KAAK,WAAW,IAAI,EAAO,EAAE,EAC9C,GAAI,EAAU,OAAO,EACrB,IAAM,EAAO,KAAK,SAAS,EAAO,GAAI,IAAM,KAAK,YAAY,CAAM,CAAC,EAAE,QAAQ,IAC5E,KAAK,WAAW,OAAO,EAAO,EAAE,CAClC,EAEA,OADA,KAAK,WAAW,IAAI,EAAO,GAAI,CAAI,EAC5B,OAGK,YAAW,CAAC,EAAmD,CAE3E,IAAM,EAAU,MAAM,KAAK,MAAM,KAAK,EAAK,OAAQ,EAAK,QAAQ,EAChE,GAAI,CAAC,GAAW,EAAQ,KAAO,EAAK,GAClC,MAAM,IAAI,EAA4B,EAAK,QAAQ,EAErD,GAAI,EAAQ,WAAa,EAAK,UAAY,CAAC,EAAQ,eAAgB,OAAO,EAC1E,GAAI,EAAQ,eAAgB,MAAM,IAAI,EAA4B,EAAK,QAAQ,EAE/E,IAAM,EAAW,KAAK,SAAS,EAAQ,QAAQ,EAC/C,GAAI,KAAK,OAAS,EAAQ,eAAiB,KAAM,CAC/C,GAAI,KAAK,MAAO,OAAO,EAEvB,MADA,MAAM,KAAK,MAAM,mBAAmB,EAAQ,EAAE,EACxC,IAAI,EAA4B,EAAQ,QAAQ,EAGxD,IAAI,EACJ,GAAI,CACF,EAAS,MAAM,EAAS,QAAQ,EAAQ,aAAc,EAAQ,MAAM,EACpE,MAAO,EAAO,CAGd,GAAI,aAAiB,GAAwB,EAAM,SAAW,QAAa,EAAM,QAAU,KAAO,EAAM,OAAS,IAE/G,MADA,MAAM,KAAK,MAAM,mBAAmB,EAAQ,EAAE,EACxC,IAAI,EAA4B,EAAQ,SAAU,CACtD,MAAO,EACP,OAAQ,EAAM,OACd,cAAe,EAAM,aACvB,CAAC,EAEH,MAAM,EAGR,IAAM,EAAU,MAAM,KAAK,MAAM,aAAa,EAAQ,GAAI,EAAQ,SAAU,CAAM,EAClF,GAAI,EAAS,OAAO,EAEpB,IAAM,EAAS,MAAM,KAAK,MAAM,KAAK,EAAQ,OAAQ,EAAQ,QAAQ,EACrE,GAAI,CAAC,EAAQ,MAAM,IAAI,EAA4B,EAAQ,QAAQ,EACnE,OAAO,OAGK,SAAW,CAAC,EAAY,EAAkC,CACtE,IAAM,EAAc,EAAI,EACxB,GAAI,KAAK,OAAS,CAAC,EAAY,MAAM,CAAW,EAAG,OAAO,EAAG,EAC7D,IAAM,EAAS,MAAM,EAClB,KAAK,CAAW,EAChB,IAAI,yBAAyB,IAAM,CAAE,IAAK,MAAQ,KAAM,KAAO,EAAG,IAAM,EAAG,CAAC,EAC/E,GAAI,CAAC,EAAO,SACV,MAAM,IAAI,EACR,iBACA,qEACF,EAEF,OAAO,EAAO,MAElB,CAMO,MAAM,CAAmB,CAEX,QACT,OAFV,WAAW,CACQ,EACT,EACR,CAFiB,eACT,iBAGN,SAAQ,EAAW,CACrB,OAAO,KAAK,OAAO,YAEjB,OAAM,EAAW,CACnB,OAAO,KAAK,OAAO,UAEjB,kBAAiB,EAAkB,CACrC,OAAO,KAAK,OAAO,qBAGjB,OAAM,EAAsB,CAC9B,OAAO,KAAK,OAAO,UAEjB,UAAS,EAAgB,CAC3B,OAAO,KAAK,OAAO,aAGjB,eAAc,EAAY,CAC5B,OAAO,KAAK,OAAO,kBAEjB,YAAW,EAAS,CACtB,OAAO,KAAK,OAAO,UAIrB,SAAS,IAAI,EAA2B,CACtC,OAAO,EAAO,MAAM,CAAC,IAAU,KAAK,OAAO,OAAO,SAAS,CAAK,CAAC,OAgB7D,MAAK,CAAC,EAAqB,EAAoB,CAAC,EAAsB,CAC1E,IAAM,EAAM,KAAK,WAAW,CAAK,EAC3B,EAAS,MAAM,KAAK,QAAQ,EAC5B,EAAQ,MAAM,KAAK,KAAK,EAAK,EAAM,EAAO,WAAW,EAG3D,GAAI,EAAM,SAAS,SAAW,KAAO,CAAC,EAAM,YAAc,EAAK,gBAAgB,eAC7E,OAAO,EAAM,SAGf,MAAM,EAAM,SAAS,MAAM,OAAO,EAAE,MAAM,IAAM,EAAE,EAClD,IAAM,EAAY,MAAM,KAAK,YAAY,CAAM,EAC/C,OAAQ,MAAM,KAAK,KAAK,EAAK,EAAM,EAAU,WAAW,GAAG,cAOvD,YAAW,EAAoB,CACnC,OAAQ,MAAM,KAAK,QAAQ,GAAG,iBAI1B,QAAO,EAAkB,CAC7B,MAAM,KAAK,YAAY,KAAK,MAAM,OAW9B,OAAM,EAAkB,CAC5B,GAAI,CAAC,KAAK,QAAQ,MAAO,CACvB,IAAM,EAAW,KAAK,QAAQ,SAAS,KAAK,OAAO,QAAQ,EAC3D,GAAI,KAAK,OAAO,eAAiB,KAC/B,MAAM,EAAS,OAAO,KAAK,OAAO,aAAc,eAAe,EAE/D,WAAM,EAAS,OAAO,KAAK,OAAO,YAAa,cAAc,EAGjE,MAAM,KAAK,QAAQ,MAAM,OAAO,KAAK,OAAO,EAAE,OAI1C,WAAU,EAAkB,CAChC,MAAM,KAAK,QAAQ,MAAM,OAAO,KAAK,OAAO,EAAE,EAGhD,MAAM,EAAG,CACP,MAAO,CACL,SAAU,KAAK,SACf,kBAAmB,KAAK,kBACxB,OAAQ,CAAC,GAAG,KAAK,MAAM,EACvB,UAAW,KAAK,UAChB,eAAgB,KAAK,eACrB,YAAa,KAAK,WACpB,GAGD,OAAO,IAAI,4BAA4B,EAAE,EAAG,CAC3C,MAAO,CAAE,mBAAoB,KAAK,OAAO,CAAE,OAG/B,QAAO,EAA8B,CACjD,GAAI,KAAK,OAAO,eAAgB,MAAM,IAAI,EAA4B,KAAK,OAAO,QAAQ,EAC1F,IAAM,EAAS,KAAK,QAAQ,SAAS,KAAK,OAAO,QAAQ,EAAE,OAAO,qBAAuB,KACnF,EAAY,KAAK,OAAO,WAAW,QAAQ,EACjD,GAAI,IAAc,QAAa,EAAY,KAAK,IAAI,GAAK,EACvD,OAAO,KAAK,YAAY,KAAK,MAAM,EAErC,OAAO,KAAK,YAGA,YAAW,CAAC,EAAqD,CAC7E,GAAI,CACF,KAAK,OAAS,MAAM,KAAK,QAAQ,QAAQ,CAAM,EAC/C,MAAO,EAAO,CACd,GAAI,aAAiB,EACnB,KAAK,OAAS,IAAK,KAAK,OAAQ,eAAgB,EAAK,EAEvD,MAAM,EAER,OAAO,KAAK,OAGN,UAAU,CAAC,EAA0B,CAC3C,IAAM,EAAO,KAAK,QAAQ,SAAS,KAAK,OAAO,QAAQ,EAAE,OAAO,WAC5D,EACJ,GAAI,CACF,EAAM,IAAI,IAAI,OAAO,CAAK,EAAG,CAAI,EACjC,KAAM,CACN,MAAM,IAAI,EACR,gBACA,8BAA8B,KAAK,UAAU,OAAO,CAAK,CAAC,wBAC5D,EAEF,GAAI,EAAI,SAAW,IAAI,IAAI,CAAI,EAAE,OAC/B,MAAM,IAAI,EACR,gBACA,mCAAmC,KAAK,OAAO,qBAAqB,IAAI,IAAI,CAAI,EAAE,+BACxD,EAAI,SAChC,EAEF,GAAI,EAAI,WAAa,UAAY,EAAE,EAAI,WAAa,SAAW,EAAW,EAAI,QAAQ,GACpF,MAAM,IAAI,EACR,gBACA,0DAA0D,EAAI,SAChE,EAEF,OAAO,OAGK,KAAI,CAAC,EAAU,EAAmB,EAAqE,CACnH,IAAI,EAAS,EACT,GAAU,EAAK,QAAU,OAAO,YAAY,EAC5C,EAAO,EAAK,KACZ,EAAa,GAIjB,GAAI,EAAK,WAAa,UAAY,EAAK,WAAa,QAElD,MAAO,CAAE,SADQ,MAAM,KAAK,QAAQ,KAAK,KAAK,OAAO,SAAU,KAAK,QAAQ,EAAQ,EAAM,EAAQ,EAAM,CAAK,CAAC,EAC3F,YAAW,EAGhC,QAAS,EAAM,GAAK,IAAO,CACzB,IAAM,EAAU,KAAK,QAAQ,EAAQ,IAAK,EAAM,SAAU,QAAS,EAAG,EAAQ,EAAM,EAAa,EAAQ,IAAI,EACvG,EAAW,MAAM,KAAK,QAAQ,KAAK,KAAK,OAAO,SAAU,CAAO,EAChE,EAAW,EAAS,QAAQ,IAAI,UAAU,EAChD,GAAI,CAAC,EAAU,IAAI,EAAS,MAAM,GAAK,IAAa,MAAQ,GAAO,EAAG,MAAO,CAAE,WAAU,YAAW,EAEpG,MAAM,EAAS,MAAM,OAAO,EAAE,MAAM,IAAM,EAAE,EAC5C,IAAM,EAAO,IAAI,IAAI,EAAU,CAAM,EACrC,GAAI,EAAK,SAAW,EAAO,OAAQ,EAAa,GAChD,GAAI,EAAS,SAAW,MAAS,EAAS,SAAW,KAAO,EAAS,SAAW,MAAQ,IAAW,OACjG,EAAS,MACT,EAAO,OAET,EAAS,GAIL,OAAO,CAAC,EAAU,EAAmB,EAAgB,EAA2B,EAA+B,CACrH,IAAM,EAAU,IAAI,QAAQ,EAAK,OAAO,EACxC,GAAI,IAAU,KAAM,EAAQ,OAAO,eAAe,EAC7C,OAAQ,IAAI,gBAAiB,UAAU,GAAO,EACnD,OAAO,IAAI,QAAQ,EAAK,IAAK,EAAM,SAAQ,OAAM,SAAQ,CAAC,EAE9D,CAEA,IAAM,EAAY,IAAI,IAAI,CAAC,IAAK,IAAK,IAAK,IAAK,GAAG,CAAC,EAEnD,SAAS,CAAO,CAAC,EAA+B,CAC9C,IAAM,EAAK,OAAO,IAAS,UAAY,IAAS,KAAO,EAAK,GAAK,EACjE,GAAI,IAAO,QAAa,IAAO,MAAQ,IAAO,GAC5C,MAAU,UAAU,mEAAmE,EAEzF,OAAO,OAAO,CAAE",
+  "debugId": "95988480893BA2D664756E2164756E21",
   "names": []
 }