gemi 0.119.0 → 0.119.2

package/dist/{chunk-gqfqnv3f.js → chunk-c8vttyem.js}

@@ -1,5 +1,5 @@
 // @bun
 function a(i,e){let n={...i};if(!e)return n;for(let t of Object.keys(e))if(e[t]!==void 0)n[t]=e[t];return n}
-export{a as Nh};
+export{a as Ph};
 
-//# debugId=643119A89788403364756E2164756E21
+//# debugId=979803ED19342D4F64756E2164756E21

package/dist/{chunk-gqfqnv3f.js.map → chunk-c8vttyem.js.map}

@@ -5,6 +5,6 @@
     "/**\n * Shallow-merges an app config slice over the framework defaults, ignoring keys\n * whose value is `undefined`.\n *\n * A plain `{ ...defaults, ...config }` lets an explicit `undefined` win — a\n * `defineMailConfig({ headers: undefined })`, or any optional property the app\n * spread in from another object, would erase the default and hand the service a\n * missing dependency. Omitting a key and setting it to `undefined` mean the\n * same thing for a config slice, so both fall back to the default here.\n */\nexport function withDefaults<T extends object>(\n  defaults: Required<T>,\n  config: Partial<T> | undefined,\n): Required<T>;\nexport function withDefaults<D extends object, C extends object>(\n  defaults: D,\n  config: C | undefined,\n): D & C;\nexport function withDefaults(\n  defaults: Record<string, any>,\n  config: Record<string, any> | undefined,\n) {\n  const merged: Record<string, any> = { ...defaults };\n  if (!config) {\n    return merged;\n  }\n  for (const key of Object.keys(config)) {\n    if (config[key] !== undefined) {\n      merged[key] = config[key];\n    }\n  }\n  return merged;\n}\n"
   ],
   "mappings": ";AAkBO,SAAS,CAAY,CAC1B,EACA,EACA,CACA,IAAM,EAA8B,IAAK,CAAS,EAClD,GAAI,CAAC,EACH,OAAO,EAET,QAAW,KAAO,OAAO,KAAK,CAAM,EAClC,GAAI,EAAO,KAAS,OAClB,EAAO,GAAO,EAAO,GAGzB,OAAO",
-  "debugId": "643119A89788403364756E2164756E21",
+  "debugId": "979803ED19342D4F64756E2164756E21",
   "names": []
 }

package/dist/{chunk-xx7necqt.js → chunk-ct1vwaw7.js}

@@ -1,5 +1,5 @@
 // @bun
-import{eh as R}from"./chunk-y09r0wsw.js";import{Mh as L}from"./chunk-xx3zvc3g.js";import{ri as T}from"./chunk-hr1r3g0d.js";import{Ri as F}from"./chunk-g5ppst76.js";class N{rows=new Map;async find(j,B){for(let G of this.rows.values())if(G.userId===j&&G.provider===B)return{...G};return null}async list(j){return[...this.rows.values()].filter((B)=>B.userId===j).map((B)=>({...B}))}async save(j,B,G){let Q=await this.find(j,B),K=new Date,V={id:Q?.id??Bun.randomUUIDv7(),userId:j,provider:B,...S(G),needsReconnect:!1,revision:(Q?.revision??0)+1,createdAt:Q?.createdAt??K,updatedAt:K};return this.rows.set(V.id,V),{...V}}async updateTokens(j,B,G){let Q=this.rows.get(j);if(!Q||Q.revision!==B)return null;let K={...Q,...S(G),needsReconnect:!1,revision:B+1,updatedAt:new Date};return this.rows.set(j,K),{...K}}async markNeedsReconnect(j){let B=this.rows.get(j);if(B)this.rows.set(j,{...B,needsReconnect:!0,updatedAt:new Date})}async delete(j){this.rows.delete(j)}}class H{encrypter;table;sql;dialect;constructor(j,B,G={}){this.encrypter=B;let Q=G.table??"gemi_oauth_connections";if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(Q))throw Error(`The connections table name "${Q}" is not a plain identifier.`);this.table=Q,this.sql=j.sql,this.dialect=j.dialect}async createTable(){for(let j of A(this.dialect,this.table))await this.sql.unsafe(j)}async find(j,B){let G=this.sql,Q=await G`
+import{gh as R}from"./chunk-6pqbsc5y.js";import{Oh as L}from"./chunk-q6a30w8w.js";import{ti as T}from"./chunk-fmea4sak.js";import{Ti as F}from"./chunk-zb8zzf5x.js";class N{rows=new Map;async find(j,B){for(let G of this.rows.values())if(G.userId===j&&G.provider===B)return{...G};return null}async list(j){return[...this.rows.values()].filter((B)=>B.userId===j).map((B)=>({...B}))}async save(j,B,G){let Q=await this.find(j,B),K=new Date,V={id:Q?.id??Bun.randomUUIDv7(),userId:j,provider:B,...S(G),needsReconnect:!1,revision:(Q?.revision??0)+1,createdAt:Q?.createdAt??K,updatedAt:K};return this.rows.set(V.id,V),{...V}}async updateTokens(j,B,G){let Q=this.rows.get(j);if(!Q||Q.revision!==B)return null;let K={...Q,...S(G),needsReconnect:!1,revision:B+1,updatedAt:new Date};return this.rows.set(j,K),{...K}}async markNeedsReconnect(j){let B=this.rows.get(j);if(B)this.rows.set(j,{...B,needsReconnect:!0,updatedAt:new Date})}async delete(j){this.rows.delete(j)}}class H{encrypter;table;sql;dialect;constructor(j,B,G={}){this.encrypter=B;let Q=G.table??"gemi_oauth_connections";if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(Q))throw Error(`The connections table name "${Q}" is not a plain identifier.`);this.table=Q,this.sql=j.sql,this.dialect=j.dialect}async createTable(){for(let j of A(this.dialect,this.table))await this.sql.unsafe(j)}async find(j,B){let G=this.sql,Q=await G`
       SELECT * FROM ${this.name(G)} WHERE user_id = ${j} AND provider = ${B}
     `;return Q[0]?this.decode(Q[0]):null}async list(j){let B=this.sql;return(await B`
       SELECT * FROM ${this.name(B)} WHERE user_id = ${j} ORDER BY provider
@@ -66,6 +66,6 @@ import{eh as R}from"./chunk-y09r0wsw.js";import{Mh as L}from"./chunk-xx3zvc3g.js
     "created_at" BIGINT NOT NULL,
     "updated_at" BIGINT NOT NULL${Q}
 )`,`CREATE UNIQUE INDEX IF NOT EXISTS "${B}_user_id_provider_key" ON "${B}"("user_id", "provider")`]}class Z extends Error{code;status;providerError;constructor(j,B,G={}){super(B,G.cause!==void 0?{cause:G.cause}:void 0);this.code=j;this.name="OAuthConnectionError",this.status=G.status,this.providerError=G.providerError}}class $ extends Z{provider;constructor(j,B={}){super("reconnect_required",`The ${j} connection needs to be reconnected: its tokens were refused and could not be refreshed.`,B);this.provider=j;this.name="OAuthReconnectRequiredError"}}class O{config;constructor(j){for(let B of["authorizeUrl","tokenUrl"])U(B,j[B]);if(j.revokeUrl!==void 0)U("revokeUrl",j.revokeUrl);if(j.apiBaseUrl===void 0||j.apiBaseUrl===null||j.apiBaseUrl==="")throw Error(`OAuthConnectionProvider: apiBaseUrl is required. Set it to the provider's API origin (e.g. apiBaseUrl: "https://api.figma.com"); connection.fetch only sends the token there.`);U("apiBaseUrl",j.apiBaseUrl),this.config={scopeSeparator:" ",clientAuth:"body",pkce:!0,authorizationParams:{},refreshLeewaySeconds:60,...j}}authorizationUrl(j){let B=new URL(this.config.authorizeUrl),G={...this.config.authorizationParams,response_type:"code",client_id:this.config.clientId,redirect_uri:j.redirectUri,scope:this.config.scopes.join(this.config.scopeSeparator),state:j.state};if(this.config.pkce)G.code_challenge=j.codeChallenge,G.code_challenge_method="S256";for(let[Q,K]of Object.entries(G))B.searchParams.set(Q,K);return B.toString()}exchangeCode(j){let B=new URLSearchParams({grant_type:"authorization_code",code:j.code,redirect_uri:j.redirectUri});if(this.config.pkce)B.set("code_verifier",j.codeVerifier);return this.tokenRequest(B,{scopes:this.config.scopes,refreshToken:null,phase:"exchange"})}refresh(j,B){let G=new URLSearchParams({grant_type:"refresh_token",refresh_token:j});return this.tokenRequest(G,{scopes:B,refreshToken:j,phase:"refresh"})}async revoke(j,B){if(!this.config.revokeUrl)throw new Z("revoke_unsupported","This provider has no revokeUrl configured. Use disconnect() to forget the tokens locally.");let G=new URLSearchParams({token:j,token_type_hint:B}),Q;try{Q=await fetch(this.config.revokeUrl,this.post(G))}catch(K){throw new Z("revoke_failed","The revocation request failed.",{cause:K})}if(!Q.ok)throw new Z("revoke_failed",`The provider refused the revocation (HTTP ${Q.status}).`,{status:Q.status})}post(j){let B={"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"};if(this.config.clientAuth==="basic"){let G=`${encodeURIComponent(this.config.clientId)}:${encodeURIComponent(this.config.clientSecret)}`;B.Authorization=`Basic ${Buffer.from(G).toString("base64")}`}else j.set("client_id",this.config.clientId),j.set("client_secret",this.config.clientSecret);return{method:"POST",headers:B,body:j.toString(),redirect:"error"}}async tokenRequest(j,B){let G=B.phase==="exchange"?"exchange_failed":"refresh_failed",Q;try{Q=await fetch(this.config.tokenUrl,this.post(j))}catch(Y){throw new Z(G,"The token request failed.",{cause:Y})}let K=await Q.json().catch(()=>({}));if(!Q.ok||typeof K.access_token!=="string"||K.access_token===""){let Y=typeof K.error==="string"&&/^[a-z0-9_]{1,64}$/.test(K.error)?K.error:void 0;throw new Z(G,`The token endpoint refused the ${B.phase==="exchange"?"code":"refresh token"} (HTTP ${Q.status}${Y?`, ${Y}`:""}).`,{status:Q.status,providerError:Y})}let V=Number(K.expires_in),W=typeof K.scope==="string"?K.scope:void 0,_=K.user_id_string??K.user_id??K.account_id;return{accessToken:K.access_token,refreshToken:typeof K.refresh_token==="string"&&K.refresh_token!==""?K.refresh_token:B.refreshToken,tokenType:typeof K.token_type==="string"?K.token_type:null,expiresAt:Number.isFinite(V)&&V>0?new Date(Date.now()+V*1000):null,scopes:W!==void 0?W.split(/[\s,]+/).filter(Boolean):B.scopes,providerAccountId:typeof _==="string"||typeof _==="number"?String(_):null}}}function U(j,B){let G;try{G=new URL(String(B))}catch{G=void 0}if(!G||G.protocol!=="https:"&&!(G.protocol==="http:"&&z(G.hostname)))throw Error(`OAuthConnectionProvider: ${j} must be an https URL (http only for localhost), got ${JSON.stringify(B)}.`)}function z(j){return j==="localhost"||j==="127.0.0.1"||j==="[::1]"||j==="::1"}class E{options;static token="auth.connections";resolvedStore;refreshing=new Map;fakes;fakeStore;fakeRequests=[];constructor(j){this.options=j}get providers(){return this.options.providers}get store(){if(this.fakeStore)return this.fakeStore;if(!this.resolvedStore){let j=this.options.store;this.resolvedStore=typeof j==="function"?j():j??new H(F(T).connection(),()=>R())}return this.resolvedStore}provider(j){let B=this.options.providers[j];if(!B){let G=Object.keys(this.options.providers);throw new Z("unknown_provider",`No OAuth connection provider "${j}" in auth.connections`+(G.length>0?` (configured: ${G.join(", ")}).`:" (none are configured)."))}return B}async for(j,B){this.provider(B);let G=await this.store.find(D(j),B);return G?new X(this,G):null}async list(j){return(await this.store.list(D(j))).filter((G)=>(G.provider in this.options.providers)).map((G)=>new X(this,G))}async save(j,B,G){let Q=this.provider(B),K=await this.store.save(D(j),B,{refreshToken:null,tokenType:null,expiresAt:null,providerAccountId:null,scopes:Q.config.scopes,...G});return new X(this,K)}fake(j={}){return this.fakes=new Map(Object.entries(j)),this.fakeStore=new N,this.fakeRequests.length=0,this}restore(){this.fakes=void 0,this.fakeStore=void 0,this.fakeRequests.length=0}get faked(){return this.fakes!==void 0}async send(j,B){if(!this.fakes)return fetch(B);this.fakeRequests.push(B.clone());let G=this.fakes.get(j);if(!G)throw Error(`Connections.fake() has no handler for "${j}". Pass one: Connections.fake({ ${j}: (req) => ... }).`);return G(B)}refresh(j){let B=this.refreshing.get(j.id);if(B)return B;let G=this.withLock(j.id,()=>this.refreshOnce(j)).finally(()=>this.refreshing.delete(j.id));return this.refreshing.set(j.id,G),G}async refreshOnce(j){let B=await this.store.find(j.userId,j.provider);if(!B||B.id!==j.id)throw new $(j.provider);if(B.revision!==j.revision&&!B.needsReconnect)return B;if(B.needsReconnect)throw new $(j.provider);let G=this.provider(B.provider);if(this.faked||B.refreshToken===null){if(this.faked)return B;throw await this.store.markNeedsReconnect(B.id),new $(B.provider)}let Q;try{Q=await G.refresh(B.refreshToken,B.scopes)}catch(W){if(W instanceof Z&&W.status!==void 0&&W.status>=400&&W.status<500)throw await this.store.markNeedsReconnect(B.id),new $(B.provider,{cause:W,status:W.status,providerError:W.providerError});throw W}let K=await this.store.updateTokens(B.id,B.revision,Q);if(K)return K;let V=await this.store.find(B.userId,B.provider);if(!V)throw new $(B.provider);return V}async withLock(j,B){let G=F();if(this.faked||!G.bound(L))return B();let Q=await G.make(L).run(`gemi:oauth-connection:${j}`,{ttl:30000,wait:20000},()=>B());if(!Q.acquired)throw new Z("refresh_failed","Timed out waiting for another refresh of this connection to finish.");return Q.value}}class X{manager;record;constructor(j,B){this.manager=j;this.record=B}get provider(){return this.record.provider}get userId(){return this.record.userId}get providerAccountId(){return this.record.providerAccountId}get scopes(){return this.record.scopes}get expiresAt(){return this.record.expiresAt}get needsReconnect(){return this.record.needsReconnect}get connectedAt(){return this.record.createdAt}hasScopes(...j){return j.every((B)=>this.record.scopes.includes(B))}async fetch(j,B={}){let G=this.resolveUrl(j),Q=await this.current(),K=await this.send(G,B,Q.accessToken);if(K.response.status!==401||!K.authorized||B.body instanceof ReadableStream)return K.response;await K.response.body?.cancel().catch(()=>{});let V=await this.refreshFrom(Q);return(await this.send(G,B,V.accessToken)).response}async accessToken(){return(await this.current()).accessToken}async refresh(){await this.refreshFrom(this.record)}async revoke(){if(!this.manager.faked){let j=this.manager.provider(this.record.provider);if(this.record.refreshToken!==null)await j.revoke(this.record.refreshToken,"refresh_token");else await j.revoke(this.record.accessToken,"access_token")}await this.manager.store.delete(this.record.id)}async disconnect(){await this.manager.store.delete(this.record.id)}toJSON(){return{provider:this.provider,providerAccountId:this.providerAccountId,scopes:[...this.scopes],expiresAt:this.expiresAt,needsReconnect:this.needsReconnect,connectedAt:this.connectedAt}}[Symbol.for("nodejs.util.inspect.custom")](){return{ProviderConnection:this.toJSON()}}async current(){if(this.record.needsReconnect)throw new $(this.record.provider);let j=this.manager.provider(this.record.provider).config.refreshLeewaySeconds*1000,B=this.record.expiresAt?.getTime();if(B!==void 0&&B-Date.now()<=j)return this.refreshFrom(this.record);return this.record}async refreshFrom(j){try{this.record=await this.manager.refresh(j)}catch(B){if(B instanceof $)this.record={...this.record,needsReconnect:!0};throw B}return this.record}resolveUrl(j){let B=this.manager.provider(this.record.provider).config.apiBaseUrl,G;try{G=new URL(String(j),B)}catch{throw new Z("forbidden_url",`connection.fetch was given ${JSON.stringify(String(j))}, which is not a URL.`)}if(G.origin!==new URL(B).origin)throw new Z("forbidden_url",`connection.fetch only sends the ${this.record.provider} token to ${new URL(B).origin} (apiBaseUrl), not to ${G.origin}.`);if(G.protocol!=="https:"&&!(G.protocol==="http:"&&z(G.hostname)))throw new Z("forbidden_url",`connection.fetch only sends a token over https, not to ${G.origin}.`);return G}async send(j,B,G){let Q=j,K=(B.method??"GET").toUpperCase(),V=B.body,W=!0;if(B.redirect==="manual"||B.redirect==="error")return{response:await this.manager.send(this.record.provider,this.request(Q,B,K,V,G)),authorized:W};for(let _=0;;_++){let Y=this.request(Q,{...B,redirect:"manual"},K,V,W?G:null),J=await this.manager.send(this.record.provider,Y),M=J.headers.get("location");if(!C.has(J.status)||M===null||_>=5)return{response:J,authorized:W};await J.body?.cancel().catch(()=>{});let P=new URL(M,Q);if(P.origin!==Q.origin)W=!1;if(J.status===303||(J.status===301||J.status===302)&&K==="POST")K="GET",V=void 0;Q=P}}request(j,B,G,Q,K){let V=new Headers(B.headers);if(K===null)V.delete("authorization");else V.set("Authorization",`Bearer ${K}`);return new Request(j,{...B,method:G,body:Q,headers:V})}}var C=new Set([301,302,303,307,308]);function D(j){let B=typeof j==="object"&&j!==null?j.id:j;if(B===void 0||B===null||B==="")throw TypeError("An OAuth connection belongs to a user: pass the user (or its id).");return String(B)}
-export{N as Pg,H as Qg,Z as Rg,$ as Sg,O as Tg,E as Ug,X as Vg};
+export{N as Rg,H as Sg,Z as Tg,$ as Ug,O as Vg,E as Wg,X as Xg};
 
-//# debugId=95988480893BA2D664756E2164756E21
+//# debugId=8235325ABF40DA7464756E2164756E21

package/dist/{chunk-xx7necqt.js.map → chunk-ct1vwaw7.js.map}

@@ -8,6 +8,6 @@
     "import { DatabaseManager } from \"../../database/DatabaseManager\";\nimport { app } from \"../../foundation/app\";\nimport { currentEncrypter } from \"../../orm/encryption\";\nimport { LockManager } from \"../../services/lock/LockManager\";\nimport {\n  type ConnectionRecord,\n  type ConnectionStore,\n  DatabaseConnectionStore,\n  MemoryConnectionStore,\n} from \"./ConnectionStore\";\nimport { OAuthConnectionError, OAuthReconnectRequiredError } from \"./errors\";\nimport { type OAuthConnectionProvider, type OAuthTokenSet, isLoopback } from \"./OAuthConnectionProvider\";\n\n/** A user, as far as a connection is concerned: anything with an `id`. */\nexport type ConnectionOwner = { id: string | number } | string | number;\n\n/** What `Connections.fake` answers an API request with. */\nexport type FakeConnectionHandler = (request: Request) => Response | Promise<Response>;\n\nexport interface ConnectionManagerOptions {\n  providers: Record<string, OAuthConnectionProvider>;\n  /** Default: a `DatabaseConnectionStore` on the default database connection. */\n  store?: ConnectionStore | (() => ConnectionStore);\n}\n\n/**\n * The OAuth connections a user has made, and the one place their tokens are\n * read, refreshed and spent. Reached through the `Connections` facade.\n */\nexport class ConnectionManager {\n  static token = \"auth.connections\";\n\n  private resolvedStore: ConnectionStore | undefined;\n  private readonly refreshing = new Map<string, Promise<ConnectionRecord>>();\n  private fakes: Map<string, FakeConnectionHandler> | undefined;\n  private fakeStore: MemoryConnectionStore | undefined;\n  readonly fakeRequests: Request[] = [];\n\n  constructor(private readonly options: ConnectionManagerOptions) {}\n\n  get providers(): Record<string, OAuthConnectionProvider> {\n    return this.options.providers;\n  }\n\n  /** The store connections are kept in. */\n  get store(): ConnectionStore {\n    if (this.fakeStore) return this.fakeStore;\n    if (!this.resolvedStore) {\n      const configured = this.options.store;\n      this.resolvedStore =\n        typeof configured === \"function\"\n          ? configured()\n          : (configured ??\n            new DatabaseConnectionStore(app(DatabaseManager).connection(), () => currentEncrypter()));\n    }\n    return this.resolvedStore;\n  }\n\n  provider(name: string): OAuthConnectionProvider {\n    const provider = this.options.providers[name];\n    if (!provider) {\n      const known = Object.keys(this.options.providers);\n      throw new OAuthConnectionError(\n        \"unknown_provider\",\n        `No OAuth connection provider \"${name}\" in auth.connections` +\n          (known.length > 0 ? ` (configured: ${known.join(\", \")}).` : \" (none are configured).\"),\n      );\n    }\n    return provider;\n  }\n\n  /** The user's connection to `provider`, or `null` when they have not connected it. */\n  async for(user: ConnectionOwner, provider: string): Promise<ProviderConnection | null> {\n    this.provider(provider);\n    const record = await this.store.find(ownerId(user), provider);\n    return record ? new ProviderConnection(this, record) : null;\n  }\n\n  /** Every connection the user has. */\n  async list(user: ConnectionOwner): Promise<ProviderConnection[]> {\n    const records = await this.store.list(ownerId(user));\n    return records\n      .filter((record) => record.provider in this.options.providers)\n      .map((record) => new ProviderConnection(this, record));\n  }\n\n  /**\n   * Stores tokens for the user, replacing any earlier connection to the same\n   * provider. The connect callback calls this; call it yourself for tokens\n   * obtained some other way.\n   */\n  async save(\n    user: ConnectionOwner,\n    provider: string,\n    tokens: Partial<OAuthTokenSet> & { accessToken: string },\n  ): Promise<ProviderConnection> {\n    const config = this.provider(provider);\n    const record = await this.store.save(ownerId(user), provider, {\n      refreshToken: null,\n      tokenType: null,\n      expiresAt: null,\n      providerAccountId: null,\n      scopes: config.config.scopes,\n      ...tokens,\n    });\n    return new ProviderConnection(this, record);\n  }\n\n  // --- testing ---------------------------------------------------------------\n\n  /**\n   * Fakes every provider's API: connections live in memory, `fetch` answers\n   * through `handlers[provider]` (recorded in `fakeRequests`), and nothing\n   * reaches a token or revocation endpoint. Returns `this` so a test can\n   * `save` a connection to start from.\n   */\n  fake(handlers: Record<string, FakeConnectionHandler> = {}): this {\n    this.fakes = new Map(Object.entries(handlers));\n    this.fakeStore = new MemoryConnectionStore();\n    this.fakeRequests.length = 0;\n    return this;\n  }\n\n  /** Undoes `fake`. */\n  restore(): void {\n    this.fakes = undefined;\n    this.fakeStore = undefined;\n    this.fakeRequests.length = 0;\n  }\n\n  get faked(): boolean {\n    return this.fakes !== undefined;\n  }\n\n  // --- internals, for ProviderConnection ---------------------------------------\n\n  /** @internal */\n  async send(provider: string, request: Request): Promise<Response> {\n    if (!this.fakes) return fetch(request);\n    this.fakeRequests.push(request.clone());\n    const handler = this.fakes.get(provider);\n    if (!handler) {\n      throw new Error(`Connections.fake() has no handler for \"${provider}\". Pass one: Connections.fake({ ${provider}: (req) => ... }).`);\n    }\n    return handler(request);\n  }\n\n  /**\n   * A record whose access token is not the one at `staleRevision`: refreshed\n   * by this call, or by whoever refreshed it first. Serialised per connection\n   * in this process (concurrent callers share one refresh) and, through the\n   * app's lock store, across processes — a rotating refresh token must be\n   * spent exactly once.\n   *\n   * @internal\n   */\n  refresh(record: ConnectionRecord): Promise<ConnectionRecord> {\n    const inFlight = this.refreshing.get(record.id);\n    if (inFlight) return inFlight;\n    const task = this.withLock(record.id, () => this.refreshOnce(record)).finally(() =>\n      this.refreshing.delete(record.id),\n    );\n    this.refreshing.set(record.id, task);\n    return task;\n  }\n\n  private async refreshOnce(seen: ConnectionRecord): Promise<ConnectionRecord> {\n    // Re-read under the lock: another process may have refreshed already.\n    const current = await this.store.find(seen.userId, seen.provider);\n    if (!current || current.id !== seen.id) {\n      throw new OAuthReconnectRequiredError(seen.provider);\n    }\n    if (current.revision !== seen.revision && !current.needsReconnect) return current;\n    if (current.needsReconnect) throw new OAuthReconnectRequiredError(seen.provider);\n\n    const provider = this.provider(current.provider);\n    if (this.faked || current.refreshToken === null) {\n      if (this.faked) return current;\n      await this.store.markNeedsReconnect(current.id);\n      throw new OAuthReconnectRequiredError(current.provider);\n    }\n\n    let tokens: OAuthTokenSet;\n    try {\n      tokens = await provider.refresh(current.refreshToken, current.scopes);\n    } catch (error) {\n      // A refusal from the token endpoint is final: the grant is gone. A\n      // network error or a 5xx is not, and leaves the connection alone.\n      if (error instanceof OAuthConnectionError && error.status !== undefined && error.status >= 400 && error.status < 500) {\n        await this.store.markNeedsReconnect(current.id);\n        throw new OAuthReconnectRequiredError(current.provider, {\n          cause: error,\n          status: error.status,\n          providerError: error.providerError,\n        });\n      }\n      throw error;\n    }\n\n    const updated = await this.store.updateTokens(current.id, current.revision, tokens);\n    if (updated) return updated;\n    // Someone else wrote first (only possible without a shared lock store).\n    const winner = await this.store.find(current.userId, current.provider);\n    if (!winner) throw new OAuthReconnectRequiredError(current.provider);\n    return winner;\n  }\n\n  private async withLock<T>(id: string, fn: () => Promise<T>): Promise<T> {\n    const application = app();\n    if (this.faked || !application.bound(LockManager)) return fn();\n    const result = await application\n      .make(LockManager)\n      .run(`gemi:oauth-connection:${id}`, { ttl: 30_000, wait: 20_000 }, () => fn());\n    if (!result.acquired) {\n      throw new OAuthConnectionError(\n        \"refresh_failed\",\n        \"Timed out waiting for another refresh of this connection to finish.\",\n      );\n    }\n    return result.value as T;\n  }\n}\n\n/**\n * One user's connection to one provider. Never exposes a token as a property,\n * and serialises (`toJSON`, `console.log`) without them.\n */\nexport class ProviderConnection {\n  constructor(\n    private readonly manager: ConnectionManager,\n    private record: ConnectionRecord,\n  ) {}\n\n  get provider(): string {\n    return this.record.provider;\n  }\n  get userId(): string {\n    return this.record.userId;\n  }\n  get providerAccountId(): string | null {\n    return this.record.providerAccountId;\n  }\n  /** The scopes the provider granted. */\n  get scopes(): readonly string[] {\n    return this.record.scopes;\n  }\n  get expiresAt(): Date | null {\n    return this.record.expiresAt;\n  }\n  /** A refresh was refused: the user has to connect again. */\n  get needsReconnect(): boolean {\n    return this.record.needsReconnect;\n  }\n  get connectedAt(): Date {\n    return this.record.createdAt;\n  }\n\n  /** Whether every one of `scopes` was granted. */\n  hasScopes(...scopes: string[]): boolean {\n    return scopes.every((scope) => this.record.scopes.includes(scope));\n  }\n\n  /**\n   * `fetch`, as the user: adds `Authorization: Bearer <token>`, refreshes the\n   * token first when it is about to expire, and after a 401 refreshes and\n   * retries once. A refresh the provider refuses marks the connection and\n   * throws `OAuthReconnectRequiredError`.\n   *\n   * A path is resolved against the provider's `apiBaseUrl`, and a URL on any\n   * other origin is refused (`OAuthConnectionError`,\n   * `forbidden_url`), so the token only ever goes to the provider. Redirects\n   * are followed by hand: the token is dropped on one that leaves the origin.\n   * A streamed request body cannot be sent twice, so a 401 for one is\n   * returned rather than retried.\n   */\n  async fetch(input: string | URL, init: RequestInit = {}): Promise<Response> {\n    const url = this.resolveUrl(input);\n    const record = await this.current();\n    const first = await this.send(url, init, record.accessToken);\n    // Retry only a 401 for the token itself, not one from where a redirect\n    // led after the token was dropped.\n    if (first.response.status !== 401 || !first.authorized || init.body instanceof ReadableStream) {\n      return first.response;\n    }\n\n    await first.response.body?.cancel().catch(() => {});\n    const refreshed = await this.refreshFrom(record);\n    return (await this.send(url, init, refreshed.accessToken)).response;\n  }\n\n  /**\n   * A valid access token, refreshed first if it is about to expire — for an\n   * SDK that wants the token itself. Prefer `fetch`, which also retries a 401.\n   */\n  async accessToken(): Promise<string> {\n    return (await this.current()).accessToken;\n  }\n\n  /** Refreshes now, whatever the expiry says. */\n  async refresh(): Promise<void> {\n    await this.refreshFrom(this.record);\n  }\n\n  /**\n   * Revokes the grant at the provider (the refresh token when there is one,\n   * which ends the whole grant, else the access token) and deletes the\n   * connection. If the provider refuses, nothing is deleted and\n   * `OAuthConnectionError` (`revoke_failed`) is thrown — call `disconnect()`\n   * to forget the tokens anyway. A provider without a `revokeUrl` throws\n   * `revoke_unsupported`; use `disconnect()`.\n   */\n  async revoke(): Promise<void> {\n    if (!this.manager.faked) {\n      const provider = this.manager.provider(this.record.provider);\n      if (this.record.refreshToken !== null) {\n        await provider.revoke(this.record.refreshToken, \"refresh_token\");\n      } else {\n        await provider.revoke(this.record.accessToken, \"access_token\");\n      }\n    }\n    await this.manager.store.delete(this.record.id);\n  }\n\n  /** Forgets the tokens locally without telling the provider. */\n  async disconnect(): Promise<void> {\n    await this.manager.store.delete(this.record.id);\n  }\n\n  toJSON() {\n    return {\n      provider: this.provider,\n      providerAccountId: this.providerAccountId,\n      scopes: [...this.scopes],\n      expiresAt: this.expiresAt,\n      needsReconnect: this.needsReconnect,\n      connectedAt: this.connectedAt,\n    };\n  }\n\n  [Symbol.for(\"nodejs.util.inspect.custom\")]() {\n    return { ProviderConnection: this.toJSON() };\n  }\n\n  private async current(): Promise<ConnectionRecord> {\n    if (this.record.needsReconnect) throw new OAuthReconnectRequiredError(this.record.provider);\n    const leeway = this.manager.provider(this.record.provider).config.refreshLeewaySeconds * 1000;\n    const expiresAt = this.record.expiresAt?.getTime();\n    if (expiresAt !== undefined && expiresAt - Date.now() <= leeway) {\n      return this.refreshFrom(this.record);\n    }\n    return this.record;\n  }\n\n  private async refreshFrom(record: ConnectionRecord): Promise<ConnectionRecord> {\n    try {\n      this.record = await this.manager.refresh(record);\n    } catch (error) {\n      if (error instanceof OAuthReconnectRequiredError) {\n        this.record = { ...this.record, needsReconnect: true };\n      }\n      throw error;\n    }\n    return this.record;\n  }\n\n  private resolveUrl(input: string | URL): URL {\n    const base = this.manager.provider(this.record.provider).config.apiBaseUrl;\n    let url: URL;\n    try {\n      url = new URL(String(input), base);\n    } catch {\n      throw new OAuthConnectionError(\n        \"forbidden_url\",\n        `connection.fetch was given ${JSON.stringify(String(input))}, which is not a URL.`,\n      );\n    }\n    if (url.origin !== new URL(base).origin) {\n      throw new OAuthConnectionError(\n        \"forbidden_url\",\n        `connection.fetch only sends the ${this.record.provider} token to ${new URL(base).origin} ` +\n          `(apiBaseUrl), not to ${url.origin}.`,\n      );\n    }\n    if (url.protocol !== \"https:\" && !(url.protocol === \"http:\" && isLoopback(url.hostname))) {\n      throw new OAuthConnectionError(\n        \"forbidden_url\",\n        `connection.fetch only sends a token over https, not to ${url.origin}.`,\n      );\n    }\n    return url;\n  }\n\n  private async send(url: URL, init: RequestInit, token: string): Promise<{ response: Response; authorized: boolean }> {\n    let target = url;\n    let method = (init.method ?? \"GET\").toUpperCase();\n    let body = init.body;\n    let authorized = true;\n\n    // Followed by hand (unless the caller asked for \"manual\" or \"error\"), so\n    // the token never follows a redirect to another origin.\n    if (init.redirect === \"manual\" || init.redirect === \"error\") {\n      const response = await this.manager.send(this.record.provider, this.request(target, init, method, body, token));\n      return { response, authorized };\n    }\n\n    for (let hop = 0; ; hop++) {\n      const request = this.request(target, { ...init, redirect: \"manual\" }, method, body, authorized ? token : null);\n      const response = await this.manager.send(this.record.provider, request);\n      const location = response.headers.get(\"location\");\n      if (!REDIRECTS.has(response.status) || location === null || hop >= 5) return { response, authorized };\n\n      await response.body?.cancel().catch(() => {});\n      const next = new URL(location, target);\n      if (next.origin !== target.origin) authorized = false;\n      if (response.status === 303 || ((response.status === 301 || response.status === 302) && method === \"POST\")) {\n        method = \"GET\";\n        body = undefined;\n      }\n      target = next;\n    }\n  }\n\n  private request(url: URL, init: RequestInit, method: string, body: RequestInit[\"body\"], token: string | null): Request {\n    const headers = new Headers(init.headers);\n    if (token === null) headers.delete(\"authorization\");\n    else headers.set(\"Authorization\", `Bearer ${token}`);\n    return new Request(url, { ...init, method, body, headers });\n  }\n}\n\nconst REDIRECTS = new Set([301, 302, 303, 307, 308]);\n\nfunction ownerId(user: ConnectionOwner): string {\n  const id = typeof user === \"object\" && user !== null ? user.id : user;\n  if (id === undefined || id === null || id === \"\") {\n    throw new TypeError(\"An OAuth connection belongs to a user: pass the user (or its id).\");\n  }\n  return String(id);\n}\n"
   ],
   "mappings": ";sLAwCO,AAAM,LAAiD,LAC3C,KAAO,IAAI,SAEtB,KAAI,CAAC,EAAgB,EAAkB,CAC3C,QAAW,KAAO,KAAK,KAAK,OAAO,EACjC,GAAI,EAAI,SAAW,GAAU,EAAI,WAAa,EAAU,MAAO,IAAK,CAAI,EAE1E,OAAO,UAGH,KAAI,CAAC,EAAgB,CACzB,MAAO,CAAC,GAAG,KAAK,KAAK,OAAO,CAAC,EAAE,OAAO,CAAC,IAAQ,EAAI,SAAW,CAAM,EAAE,IAAI,CAAC,KAAS,IAAK,CAAI,EAAE,OAG3F,KAAI,CAAC,EAAgB,EAAkB,EAAuB,CAClE,IAAM,EAAW,MAAM,KAAK,KAAK,EAAQ,CAAQ,EAC3C,EAAM,IAAI,KACV,EAAwB,CAC5B,GAAI,GAAU,IAAM,IAAI,aAAa,EACrC,SACA,cACG,EAAW,CAAM,EACpB,eAAgB,GAChB,UAAW,GAAU,UAAY,GAAK,EACtC,UAAW,GAAU,WAAa,EAClC,UAAW,CACb,EAEA,OADA,KAAK,KAAK,IAAI,EAAI,GAAI,CAAG,EAClB,IAAK,CAAI,OAGZ,aAAY,CAAC,EAAY,EAAkB,EAAuB,CACtE,IAAM,EAAM,KAAK,KAAK,IAAI,CAAE,EAC5B,GAAI,CAAC,GAAO,EAAI,WAAa,EAAU,OAAO,KAC9C,IAAM,EAAO,IAAK,KAAQ,EAAW,CAAM,EAAG,eAAgB,GAAO,SAAU,EAAW,EAAG,UAAW,IAAI,IAAO,EAEnH,OADA,KAAK,KAAK,IAAI,EAAI,CAAI,EACf,IAAK,CAAK,OAGb,mBAAkB,CAAC,EAAY,CACnC,IAAM,EAAM,KAAK,KAAK,IAAI,CAAE,EAC5B,GAAI,EAAK,KAAK,KAAK,IAAI,EAAI,IAAK,EAAK,eAAgB,GAAM,UAAW,IAAI,IAAO,CAAC,OAG9E,OAAM,CAAC,EAAY,CACvB,KAAK,KAAK,OAAO,CAAE,EAEvB,CAaO,MAAM,CAAmD,CAO3C,UANV,MACQ,IACA,QAEjB,WAAW,CACT,EACiB,EACjB,EAA0C,CAAC,EAC3C,CAFiB,iBAGjB,IAAM,EAAQ,EAAQ,OAAS,yBAC/B,GAAI,CAAC,2BAA2B,KAAK,CAAK,EACxC,MAAU,MAAM,+BAA+B,+BAAmC,EAEpF,KAAK,MAAQ,EACb,KAAK,IAAM,EAAW,IACtB,KAAK,QAAU,EAAW,aAItB,YAAW,EAAkB,CACjC,QAAW,KAAa,EAAgC,KAAK,QAAS,KAAK,KAAK,EAC9E,MAAM,KAAK,IAAI,OAAO,CAAS,OAI7B,KAAI,CAAC,EAAgB,EAAkB,CAC3C,IAAM,EAAI,KAAK,IACT,EAAQ,KAAM;AAAA,sBACF,KAAK,KAAK,CAAC,qBAAqB,oBAAyB;AAAA,MAE3E,OAAO,EAAK,GAAK,KAAK,OAAO,EAAK,EAAE,EAAI,UAGpC,KAAI,CAAC,EAAgB,CACzB,IAAM,EAAI,KAAK,IAIf,OAHc,KAAM;AAAA,sBACF,KAAK,KAAK,CAAC,qBAAqB;AAAA,OAEtC,IAAI,CAAC,IAAQ,KAAK,OAAO,CAAG,CAAC,OAGrC,KAAI,CAAC,EAAgB,EAAkB,EAAuB,CAClE,IAAM,EAAI,KAAK,IACT,EAAS,KAAK,OAAO,CAAM,EAC3B,EAAM,KAAK,IAAI,EAEf,EAAS,SACb,EACE,KAAM;AAAA,mBACK,KAAK,KAAK,CAAC;AAAA,sCACQ,EAAO,+BAA+B,EAAO;AAAA,+BACpD,EAAO,gCAAgC,EAAO;AAAA,6BAChD,EAAO,2BAA2B,EAAO;AAAA,2EACK;AAAA,4BAC/C,oBAAyB;AAAA,SAE/C,EAEF,GAAK,MAAM,EAAO,IAAO,EACvB,GAAI,CACF,KAAM;AAAA,wBACU,KAAK,KAAK,CAAC;AAAA;AAAA;AAAA,oBAGf,IAAI,aAAa,MAAM,MAAW,MAAa,EAAO;AAAA,cAC5D,EAAO,WAAW,EAAO,gBAAgB,EAAO,iBAAiB,EAAO;AAAA,cACxE,EAAO,oBAAoB,MAAQ;AAAA,UAEzC,MAAO,EAAO,CAEd,GAAK,MAAM,EAAO,IAAO,EAAG,MAAM,EAItC,IAAM,EAAQ,MAAM,KAAK,KAAK,EAAQ,CAAQ,EAC9C,GAAI,CAAC,EAAO,MAAU,MAAM,yDAAyD,EACrF,OAAO,OAGH,aAAY,CAAC,EAAY,EAAkB,EAAuB,CACtE,IAAM,EAAI,KAAK,IACT,EAAS,KAAK,OAAO,CAAM,EAC3B,EAAS,KAAM;AAAA,eACV,KAAK,KAAK,CAAC;AAAA,2CACiB,EAAO;AAAA,qBAC7B,EAAO,0BAA0B,EAAO;AAAA,4BACjC,EAAO,8BAA8B,EAAO;AAAA,yBAC/C,EAAO;AAAA,yBACP,KAAK,IAAI;AAAA,mBACf,oBAAqB;AAAA,MAEpC,GAAI,EAAS,CAAM,IAAM,EAAG,OAAO,KACnC,IAAM,EAAQ,KAAM,mBAAkB,KAAK,KAAK,CAAC,gBAAgB,IACjE,OAAO,EAAK,GAAK,KAAK,OAAO,EAAK,EAAE,EAAI,UAGpC,mBAAkB,CAAC,EAAY,CACnC,IAAM,EAAI,KAAK,IACf,KAAM,YAAW,KAAK,KAAK,CAAC,2CAA2C,KAAK,IAAI,gBAAgB,SAG5F,OAAM,CAAC,EAAY,CACvB,IAAM,EAAI,KAAK,IACf,KAAM,iBAAgB,KAAK,KAAK,CAAC,gBAAgB,SAQ7C,iBAAgB,CAAC,EAAgC,CAAC,EAAkD,CACxG,IAAM,EAAI,KAAK,IACT,EAAY,KAAK,UAAU,EAC3B,EAAQ,KAAM;AAAA,8DACsC,KAAK,KAAK,CAAC;AAAA,MAEjE,EAAU,EACd,QAAW,KAAO,EAAM,CACtB,IAAM,EAAQ,CAAC,IAAyB,OAAO,IAAU,UAAY,EAAU,kBAAkB,CAAK,EACtG,GAAI,CAAC,EAAM,EAAI,YAAY,GAAK,CAAC,EAAM,EAAI,aAAa,EAAG,SAE3D,GADA,GAAW,EACP,EAAQ,OAAQ,SACpB,IAAM,EAAS,CAAC,IAA0B,IAAU,KAAO,KAAO,EAAU,QAAQ,EAAU,QAAQ,CAAK,CAAC,EAC5G,KAAM;AAAA,iBACK,KAAK,KAAK,CAAC;AAAA,6BACC,EAAO,EAAI,YAAY,sBAAsB,EAAO,EAAI,aAAa;AAAA;AAAA,qBAE7E,EAAI,qBAAqB,OAAO,EAAI,QAAQ;AAAA,QAG7D,MAAO,CAAE,QAAS,EAAK,OAAQ,SAAQ,EAGjC,MAAM,CAAC,EAAuB,CACpC,IAAM,EAAY,KAAK,UAAU,EACjC,MAAO,CACL,kBAAmB,EAAO,kBAC1B,OAAQ,EAAO,OAAO,KAAK,GAAG,EAC9B,YAAa,EAAU,QAAQ,EAAO,WAAW,EACjD,aAAc,EAAO,eAAiB,KAAO,KAAO,EAAU,QAAQ,EAAO,YAAY,EACzF,UAAW,EAAO,UAClB,UAAW,EAAO,YAAc,KAAO,KAAO,EAAO,UAAU,QAAQ,CACzE,EAGM,MAAM,CAAC,EAA+B,CAC5C,IAAM,EAAY,KAAK,UAAU,EACjC,MAAO,CACL,GAAI,OAAO,EAAI,EAAE,EACjB,OAAQ,OAAO,EAAI,OAAO,EAC1B,SAAU,OAAO,EAAI,QAAQ,EAC7B,kBAAmB,EAAI,sBAAwB,KAAO,KAAO,OAAO,EAAI,mBAAmB,EAC3F,OAAQ,OAAO,EAAI,QAAU,EAAE,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO,EAC1D,YAAa,EAAU,QAAQ,OAAO,EAAI,YAAY,CAAC,EACvD,aAAc,EAAI,gBAAkB,KAAO,KAAO,EAAU,QAAQ,OAAO,EAAI,aAAa,CAAC,EAC7F,UAAW,EAAI,aAAe,KAAO,KAAO,OAAO,EAAI,UAAU,EACjE,UAAW,EAAI,aAAe,KAAO,KAAO,IAAI,KAAK,OAAO,EAAI,UAAU,CAAC,EAC3E,eAAgB,OAAO,EAAI,eAAe,IAAM,EAChD,SAAU,OAAO,EAAI,QAAQ,EAC7B,UAAW,IAAI,KAAK,OAAO,EAAI,UAAU,CAAC,EAC1C,UAAW,IAAI,KAAK,OAAO,EAAI,UAAU,CAAC,CAC5C,KAGU,MAAK,EAAG,CAClB,OAAO,KAAK,UAAY,SAAW,KAAK,UAAY,UAG9C,IAAI,CAAC,EAAQ,CACnB,OAAO,EAAE,OAAO,KAAK,MAAQ,KAAK,KAAK,UAAY,IAAI,KAAK,QAAQ,EAExE,CAkBA,SAAS,CAAU,CAAC,EAAuB,CACzC,MAAO,CACL,kBAAmB,EAAO,kBAC1B,OAAQ,CAAC,GAAG,EAAO,MAAM,EACzB,YAAa,EAAO,YACpB,aAAc,EAAO,aACrB,UAAW,EAAO,UAClB,UAAW,EAAO,SACpB,EAGF,SAAS,CAAQ,CAAC,EAAyB,CACzC,IAAM,EAAS,EACf,OAAO,KAAK,IAAI,OAAO,EAAO,OAAS,CAAC,EAAG,OAAO,EAAO,cAAgB,CAAC,CAAC,EAItE,SAAS,CAA+B,CAAC,EAAkB,EAAyB,CACzF,GAAI,IAAY,SAAW,IAAY,UACrC,MAAO,CACL,gCAAgC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qBAejB;AAAA;AAAA,2DAGjB,EAEF,IAAM,EAAM,IAAY,SAAW,kCAAoC,sBACjE,EACJ,IAAY,SAAW,GAAK;AAAA;AAAA,kBAAwB,6BACtD,MAAO,CACL,+BAA+B;AAAA,MAC7B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kCAY4B;AAAA,GAE9B,sCAAsC,+BAAmC,2BAC3E,ECjVK,MAAM,UAA6B,KAAM,CAKnC,KAJF,OACA,cAET,WAAW,CACA,EACT,EACA,EAAwE,CAAC,EACzE,CACA,MAAM,EAAS,EAAQ,QAAU,OAAY,CAAE,MAAO,EAAQ,KAAM,EAAI,MAAS,EAJxE,YAKT,KAAK,KAAO,uBACZ,KAAK,OAAS,EAAQ,OACtB,KAAK,cAAgB,EAAQ,cAEjC,CASO,MAAM,UAAoC,CAAqB,CAEzD,SADX,WAAW,CACA,EACT,EAAwE,CAAC,EACzE,CACA,MACE,qBACA,OAAO,4FACP,CACF,EAPS,gBAQT,KAAK,KAAO,8BAEhB,CCoCO,MAAM,CAAwB,CAC1B,OAKT,WAAW,CAAC,EAAuC,CACjD,QAAW,IAAO,CAAC,eAAgB,UAAU,EAC3C,EAAc,EAAK,EAAO,EAAI,EAEhC,GAAI,EAAO,YAAc,OAAW,EAAc,YAAa,EAAO,SAAS,EAK/E,GAAI,EAAO,aAAe,QAAa,EAAO,aAAe,MAAQ,EAAO,aAAe,GACzF,MAAU,MACR,+KAEF,EAEF,EAAc,aAAc,EAAO,UAAU,EAC7C,KAAK,OAAS,CACZ,eAAgB,IAChB,WAAY,OACZ,KAAM,GACN,oBAAqB,CAAC,EACtB,qBAAsB,MACnB,CACL,EAIF,gBAAgB,CAAC,EAA6E,CAC5F,IAAM,EAAM,IAAI,IAAI,KAAK,OAAO,YAAY,EACtC,EAAiC,IAClC,KAAK,OAAO,oBACf,cAAe,OACf,UAAW,KAAK,OAAO,SACvB,aAAc,EAAK,YACnB,MAAO,KAAK,OAAO,OAAO,KAAK,KAAK,OAAO,cAAc,EACzD,MAAO,EAAK,KACd,EACA,GAAI,KAAK,OAAO,KACd,EAAO,eAAiB,EAAK,cAC7B,EAAO,sBAAwB,OAEjC,QAAY,EAAK,KAAU,OAAO,QAAQ,CAAM,EAAG,EAAI,aAAa,IAAI,EAAK,CAAK,EAClF,OAAO,EAAI,SAAS,EAItB,YAAY,CAAC,EAA2F,CACtG,IAAM,EAAO,IAAI,gBAAgB,CAC/B,WAAY,qBACZ,KAAM,EAAK,KACX,aAAc,EAAK,WACrB,CAAC,EACD,GAAI,KAAK,OAAO,KAAM,EAAK,IAAI,gBAAiB,EAAK,YAAY,EACjE,OAAO,KAAK,aAAa,EAAM,CAAE,OAAQ,KAAK,OAAO,OAAQ,aAAc,KAAM,MAAO,UAAW,CAAC,EAOtG,OAAO,CAAC,EAAsB,EAA0C,CACtE,IAAM,EAAO,IAAI,gBAAgB,CAAE,WAAY,gBAAiB,cAAe,CAAa,CAAC,EAC7F,OAAO,KAAK,aAAa,EAAM,CAAE,SAAQ,eAAc,MAAO,SAAU,CAAC,OAIrE,OAAM,CAAC,EAAe,EAAuD,CACjF,GAAI,CAAC,KAAK,OAAO,UACf,MAAM,IAAI,EACR,qBACA,2FACF,EAEF,IAAM,EAAO,IAAI,gBAAgB,CAAE,QAAO,gBAAiB,CAAK,CAAC,EAC7D,EACJ,GAAI,CACF,EAAW,MAAM,MAAM,KAAK,OAAO,UAAW,KAAK,KAAK,CAAI,CAAC,EAC7D,MAAO,EAAO,CACd,MAAM,IAAI,EAAqB,gBAAiB,iCAAkC,CAAE,OAAM,CAAC,EAG7F,GAAI,CAAC,EAAS,GACZ,MAAM,IAAI,EACR,gBACA,6CAA6C,EAAS,WACtD,CAAE,OAAQ,EAAS,MAAO,CAC5B,EAII,IAAI,CAAC,EAAoC,CAC/C,IAAM,EAAkC,CACtC,eAAgB,oCAEhB,OAAQ,kBACV,EACA,GAAI,KAAK,OAAO,aAAe,QAAS,CACtC,IAAM,EAAc,GAAG,mBAAmB,KAAK,OAAO,QAAQ,KAAK,mBAAmB,KAAK,OAAO,YAAY,IAC9G,EAAQ,cAAgB,SAAS,OAAO,KAAK,CAAW,EAAE,SAAS,QAAQ,IAE3E,OAAK,IAAI,YAAa,KAAK,OAAO,QAAQ,EAC1C,EAAK,IAAI,gBAAiB,KAAK,OAAO,YAAY,EAEpD,MAAO,CAAE,OAAQ,OAAQ,UAAS,KAAM,EAAK,SAAS,EAAG,SAAU,OAAQ,OAG/D,aAAY,CACxB,EACA,EACwB,CACxB,IAAM,EAAU,EAAS,QAAU,WAAa,kBAAoB,iBAChE,EACJ,GAAI,CACF,EAAW,MAAM,MAAM,KAAK,OAAO,SAAU,KAAK,KAAK,CAAI,CAAC,EAC5D,MAAO,EAAO,CACd,MAAM,IAAI,EAAqB,EAAS,4BAA6B,CAAE,OAAM,CAAC,EAGhF,IAAM,EAAW,MAAM,EAAS,KAAK,EAAE,MAAM,KAAO,CAAC,EAAE,EACvD,GAAI,CAAC,EAAS,IAAM,OAAO,EAAQ,eAAiB,UAAY,EAAQ,eAAiB,GAAI,CAE3F,IAAM,EAAO,OAAO,EAAQ,QAAU,UAAY,oBAAoB,KAAK,EAAQ,KAAK,EAAI,EAAQ,MAAQ,OAC5G,MAAM,IAAI,EACR,EACA,kCAAkC,EAAS,QAAU,WAAa,OAAS,yBAChE,EAAS,SAAS,EAAO,KAAK,IAAS,OAClD,CAAE,OAAQ,EAAS,OAAQ,cAAe,CAAK,CACjD,EAGF,IAAM,EAAY,OAAO,EAAQ,UAAU,EACrC,EAAQ,OAAO,EAAQ,QAAU,SAAW,EAAQ,MAAQ,OAG5D,EAAY,EAAQ,gBAAkB,EAAQ,SAAW,EAAQ,WACvE,MAAO,CACL,YAAa,EAAQ,aACrB,aACE,OAAO,EAAQ,gBAAkB,UAAY,EAAQ,gBAAkB,GACnE,EAAQ,cACR,EAAS,aACf,UAAW,OAAO,EAAQ,aAAe,SAAW,EAAQ,WAAa,KACzE,UAAW,OAAO,SAAS,CAAS,GAAK,EAAY,EAAI,IAAI,KAAK,KAAK,IAAI,EAAI,EAAY,IAAI,EAAI,KACnG,OAAQ,IAAU,OAAY,EAAM,MAAM,QAAQ,EAAE,OAAO,OAAO,EAAI,EAAS,OAC/E,kBACE,OAAO,IAAc,UAAY,OAAO,IAAc,SAAW,OAAO,CAAS,EAAI,IACzF,EAEJ,CAEA,SAAS,CAAa,CAAC,EAAa,EAAsB,CACxD,IAAI,EACJ,GAAI,CACF,EAAM,IAAI,IAAI,OAAO,CAAK,CAAC,EAC3B,KAAM,CACN,EAAM,OAER,GAAI,CAAC,GAAQ,EAAI,WAAa,UAAY,EAAE,EAAI,WAAa,SAAW,EAAW,EAAI,QAAQ,GAC7F,MAAU,MACR,4BAA4B,yDAA2D,KAAK,UAAU,CAAK,IAC7G,EAIG,SAAS,CAAU,CAAC,EAA2B,CACpD,OAAO,IAAa,aAAe,IAAa,aAAe,IAAa,SAAW,IAAa,MCnO/F,MAAM,CAAkB,CASA,cARtB,OAAQ,mBAEP,cACS,WAAa,IAAI,IAC1B,MACA,UACC,aAA0B,CAAC,EAEpC,WAAW,CAAkB,EAAmC,CAAnC,kBAEzB,UAAS,EAA4C,CACvD,OAAO,KAAK,QAAQ,aAIlB,MAAK,EAAoB,CAC3B,GAAI,KAAK,UAAW,OAAO,KAAK,UAChC,GAAI,CAAC,KAAK,cAAe,CACvB,IAAM,EAAa,KAAK,QAAQ,MAChC,KAAK,cACH,OAAO,IAAe,WAClB,EAAW,EACV,GACD,IAAI,EAAwB,EAAI,CAAe,EAAE,WAAW,EAAG,IAAM,EAAiB,CAAC,EAE/F,OAAO,KAAK,cAGd,QAAQ,CAAC,EAAuC,CAC9C,IAAM,EAAW,KAAK,QAAQ,UAAU,GACxC,GAAI,CAAC,EAAU,CACb,IAAM,EAAQ,OAAO,KAAK,KAAK,QAAQ,SAAS,EAChD,MAAM,IAAI,EACR,mBACA,iCAAiC,0BAC9B,EAAM,OAAS,EAAI,iBAAiB,EAAM,KAAK,IAAI,MAAQ,0BAChE,EAEF,OAAO,OAIH,IAAG,CAAC,EAAuB,EAAsD,CACrF,KAAK,SAAS,CAAQ,EACtB,IAAM,EAAS,MAAM,KAAK,MAAM,KAAK,EAAQ,CAAI,EAAG,CAAQ,EAC5D,OAAO,EAAS,IAAI,EAAmB,KAAM,CAAM,EAAI,UAInD,KAAI,CAAC,EAAsD,CAE/D,OADgB,MAAM,KAAK,MAAM,KAAK,EAAQ,CAAI,CAAC,GAEhD,OAAO,CAAC,KAAW,EAAO,YAAY,KAAK,QAAQ,UAAS,EAC5D,IAAI,CAAC,IAAW,IAAI,EAAmB,KAAM,CAAM,CAAC,OAQnD,KAAI,CACR,EACA,EACA,EAC6B,CAC7B,IAAM,EAAS,KAAK,SAAS,CAAQ,EAC/B,EAAS,MAAM,KAAK,MAAM,KAAK,EAAQ,CAAI,EAAG,EAAU,CAC5D,aAAc,KACd,UAAW,KACX,UAAW,KACX,kBAAmB,KACnB,OAAQ,EAAO,OAAO,UACnB,CACL,CAAC,EACD,OAAO,IAAI,EAAmB,KAAM,CAAM,EAW5C,IAAI,CAAC,EAAkD,CAAC,EAAS,CAI/D,OAHA,KAAK,MAAQ,IAAI,IAAI,OAAO,QAAQ,CAAQ,CAAC,EAC7C,KAAK,UAAY,IAAI,EACrB,KAAK,aAAa,OAAS,EACpB,KAIT,OAAO,EAAS,CACd,KAAK,MAAQ,OACb,KAAK,UAAY,OACjB,KAAK,aAAa,OAAS,KAGzB,MAAK,EAAY,CACnB,OAAO,KAAK,QAAU,YAMlB,KAAI,CAAC,EAAkB,EAAqC,CAChE,GAAI,CAAC,KAAK,MAAO,OAAO,MAAM,CAAO,EACrC,KAAK,aAAa,KAAK,EAAQ,MAAM,CAAC,EACtC,IAAM,EAAU,KAAK,MAAM,IAAI,CAAQ,EACvC,GAAI,CAAC,EACH,MAAU,MAAM,0CAA0C,oCAA2C,qBAA4B,EAEnI,OAAO,EAAQ,CAAO,EAYxB,OAAO,CAAC,EAAqD,CAC3D,IAAM,EAAW,KAAK,WAAW,IAAI,EAAO,EAAE,EAC9C,GAAI,EAAU,OAAO,EACrB,IAAM,EAAO,KAAK,SAAS,EAAO,GAAI,IAAM,KAAK,YAAY,CAAM,CAAC,EAAE,QAAQ,IAC5E,KAAK,WAAW,OAAO,EAAO,EAAE,CAClC,EAEA,OADA,KAAK,WAAW,IAAI,EAAO,GAAI,CAAI,EAC5B,OAGK,YAAW,CAAC,EAAmD,CAE3E,IAAM,EAAU,MAAM,KAAK,MAAM,KAAK,EAAK,OAAQ,EAAK,QAAQ,EAChE,GAAI,CAAC,GAAW,EAAQ,KAAO,EAAK,GAClC,MAAM,IAAI,EAA4B,EAAK,QAAQ,EAErD,GAAI,EAAQ,WAAa,EAAK,UAAY,CAAC,EAAQ,eAAgB,OAAO,EAC1E,GAAI,EAAQ,eAAgB,MAAM,IAAI,EAA4B,EAAK,QAAQ,EAE/E,IAAM,EAAW,KAAK,SAAS,EAAQ,QAAQ,EAC/C,GAAI,KAAK,OAAS,EAAQ,eAAiB,KAAM,CAC/C,GAAI,KAAK,MAAO,OAAO,EAEvB,MADA,MAAM,KAAK,MAAM,mBAAmB,EAAQ,EAAE,EACxC,IAAI,EAA4B,EAAQ,QAAQ,EAGxD,IAAI,EACJ,GAAI,CACF,EAAS,MAAM,EAAS,QAAQ,EAAQ,aAAc,EAAQ,MAAM,EACpE,MAAO,EAAO,CAGd,GAAI,aAAiB,GAAwB,EAAM,SAAW,QAAa,EAAM,QAAU,KAAO,EAAM,OAAS,IAE/G,MADA,MAAM,KAAK,MAAM,mBAAmB,EAAQ,EAAE,EACxC,IAAI,EAA4B,EAAQ,SAAU,CACtD,MAAO,EACP,OAAQ,EAAM,OACd,cAAe,EAAM,aACvB,CAAC,EAEH,MAAM,EAGR,IAAM,EAAU,MAAM,KAAK,MAAM,aAAa,EAAQ,GAAI,EAAQ,SAAU,CAAM,EAClF,GAAI,EAAS,OAAO,EAEpB,IAAM,EAAS,MAAM,KAAK,MAAM,KAAK,EAAQ,OAAQ,EAAQ,QAAQ,EACrE,GAAI,CAAC,EAAQ,MAAM,IAAI,EAA4B,EAAQ,QAAQ,EACnE,OAAO,OAGK,SAAW,CAAC,EAAY,EAAkC,CACtE,IAAM,EAAc,EAAI,EACxB,GAAI,KAAK,OAAS,CAAC,EAAY,MAAM,CAAW,EAAG,OAAO,EAAG,EAC7D,IAAM,EAAS,MAAM,EAClB,KAAK,CAAW,EAChB,IAAI,yBAAyB,IAAM,CAAE,IAAK,MAAQ,KAAM,KAAO,EAAG,IAAM,EAAG,CAAC,EAC/E,GAAI,CAAC,EAAO,SACV,MAAM,IAAI,EACR,iBACA,qEACF,EAEF,OAAO,EAAO,MAElB,CAMO,MAAM,CAAmB,CAEX,QACT,OAFV,WAAW,CACQ,EACT,EACR,CAFiB,eACT,iBAGN,SAAQ,EAAW,CACrB,OAAO,KAAK,OAAO,YAEjB,OAAM,EAAW,CACnB,OAAO,KAAK,OAAO,UAEjB,kBAAiB,EAAkB,CACrC,OAAO,KAAK,OAAO,qBAGjB,OAAM,EAAsB,CAC9B,OAAO,KAAK,OAAO,UAEjB,UAAS,EAAgB,CAC3B,OAAO,KAAK,OAAO,aAGjB,eAAc,EAAY,CAC5B,OAAO,KAAK,OAAO,kBAEjB,YAAW,EAAS,CACtB,OAAO,KAAK,OAAO,UAIrB,SAAS,IAAI,EAA2B,CACtC,OAAO,EAAO,MAAM,CAAC,IAAU,KAAK,OAAO,OAAO,SAAS,CAAK,CAAC,OAgB7D,MAAK,CAAC,EAAqB,EAAoB,CAAC,EAAsB,CAC1E,IAAM,EAAM,KAAK,WAAW,CAAK,EAC3B,EAAS,MAAM,KAAK,QAAQ,EAC5B,EAAQ,MAAM,KAAK,KAAK,EAAK,EAAM,EAAO,WAAW,EAG3D,GAAI,EAAM,SAAS,SAAW,KAAO,CAAC,EAAM,YAAc,EAAK,gBAAgB,eAC7E,OAAO,EAAM,SAGf,MAAM,EAAM,SAAS,MAAM,OAAO,EAAE,MAAM,IAAM,EAAE,EAClD,IAAM,EAAY,MAAM,KAAK,YAAY,CAAM,EAC/C,OAAQ,MAAM,KAAK,KAAK,EAAK,EAAM,EAAU,WAAW,GAAG,cAOvD,YAAW,EAAoB,CACnC,OAAQ,MAAM,KAAK,QAAQ,GAAG,iBAI1B,QAAO,EAAkB,CAC7B,MAAM,KAAK,YAAY,KAAK,MAAM,OAW9B,OAAM,EAAkB,CAC5B,GAAI,CAAC,KAAK,QAAQ,MAAO,CACvB,IAAM,EAAW,KAAK,QAAQ,SAAS,KAAK,OAAO,QAAQ,EAC3D,GAAI,KAAK,OAAO,eAAiB,KAC/B,MAAM,EAAS,OAAO,KAAK,OAAO,aAAc,eAAe,EAE/D,WAAM,EAAS,OAAO,KAAK,OAAO,YAAa,cAAc,EAGjE,MAAM,KAAK,QAAQ,MAAM,OAAO,KAAK,OAAO,EAAE,OAI1C,WAAU,EAAkB,CAChC,MAAM,KAAK,QAAQ,MAAM,OAAO,KAAK,OAAO,EAAE,EAGhD,MAAM,EAAG,CACP,MAAO,CACL,SAAU,KAAK,SACf,kBAAmB,KAAK,kBACxB,OAAQ,CAAC,GAAG,KAAK,MAAM,EACvB,UAAW,KAAK,UAChB,eAAgB,KAAK,eACrB,YAAa,KAAK,WACpB,GAGD,OAAO,IAAI,4BAA4B,EAAE,EAAG,CAC3C,MAAO,CAAE,mBAAoB,KAAK,OAAO,CAAE,OAG/B,QAAO,EAA8B,CACjD,GAAI,KAAK,OAAO,eAAgB,MAAM,IAAI,EAA4B,KAAK,OAAO,QAAQ,EAC1F,IAAM,EAAS,KAAK,QAAQ,SAAS,KAAK,OAAO,QAAQ,EAAE,OAAO,qBAAuB,KACnF,EAAY,KAAK,OAAO,WAAW,QAAQ,EACjD,GAAI,IAAc,QAAa,EAAY,KAAK,IAAI,GAAK,EACvD,OAAO,KAAK,YAAY,KAAK,MAAM,EAErC,OAAO,KAAK,YAGA,YAAW,CAAC,EAAqD,CAC7E,GAAI,CACF,KAAK,OAAS,MAAM,KAAK,QAAQ,QAAQ,CAAM,EAC/C,MAAO,EAAO,CACd,GAAI,aAAiB,EACnB,KAAK,OAAS,IAAK,KAAK,OAAQ,eAAgB,EAAK,EAEvD,MAAM,EAER,OAAO,KAAK,OAGN,UAAU,CAAC,EAA0B,CAC3C,IAAM,EAAO,KAAK,QAAQ,SAAS,KAAK,OAAO,QAAQ,EAAE,OAAO,WAC5D,EACJ,GAAI,CACF,EAAM,IAAI,IAAI,OAAO,CAAK,EAAG,CAAI,EACjC,KAAM,CACN,MAAM,IAAI,EACR,gBACA,8BAA8B,KAAK,UAAU,OAAO,CAAK,CAAC,wBAC5D,EAEF,GAAI,EAAI,SAAW,IAAI,IAAI,CAAI,EAAE,OAC/B,MAAM,IAAI,EACR,gBACA,mCAAmC,KAAK,OAAO,qBAAqB,IAAI,IAAI,CAAI,EAAE,+BACxD,EAAI,SAChC,EAEF,GAAI,EAAI,WAAa,UAAY,EAAE,EAAI,WAAa,SAAW,EAAW,EAAI,QAAQ,GACpF,MAAM,IAAI,EACR,gBACA,0DAA0D,EAAI,SAChE,EAEF,OAAO,OAGK,KAAI,CAAC,EAAU,EAAmB,EAAqE,CACnH,IAAI,EAAS,EACT,GAAU,EAAK,QAAU,OAAO,YAAY,EAC5C,EAAO,EAAK,KACZ,EAAa,GAIjB,GAAI,EAAK,WAAa,UAAY,EAAK,WAAa,QAElD,MAAO,CAAE,SADQ,MAAM,KAAK,QAAQ,KAAK,KAAK,OAAO,SAAU,KAAK,QAAQ,EAAQ,EAAM,EAAQ,EAAM,CAAK,CAAC,EAC3F,YAAW,EAGhC,QAAS,EAAM,GAAK,IAAO,CACzB,IAAM,EAAU,KAAK,QAAQ,EAAQ,IAAK,EAAM,SAAU,QAAS,EAAG,EAAQ,EAAM,EAAa,EAAQ,IAAI,EACvG,EAAW,MAAM,KAAK,QAAQ,KAAK,KAAK,OAAO,SAAU,CAAO,EAChE,EAAW,EAAS,QAAQ,IAAI,UAAU,EAChD,GAAI,CAAC,EAAU,IAAI,EAAS,MAAM,GAAK,IAAa,MAAQ,GAAO,EAAG,MAAO,CAAE,WAAU,YAAW,EAEpG,MAAM,EAAS,MAAM,OAAO,EAAE,MAAM,IAAM,EAAE,EAC5C,IAAM,EAAO,IAAI,IAAI,EAAU,CAAM,EACrC,GAAI,EAAK,SAAW,EAAO,OAAQ,EAAa,GAChD,GAAI,EAAS,SAAW,MAAS,EAAS,SAAW,KAAO,EAAS,SAAW,MAAQ,IAAW,OACjG,EAAS,MACT,EAAO,OAET,EAAS,GAIL,OAAO,CAAC,EAAU,EAAmB,EAAgB,EAA2B,EAA+B,CACrH,IAAM,EAAU,IAAI,QAAQ,EAAK,OAAO,EACxC,GAAI,IAAU,KAAM,EAAQ,OAAO,eAAe,EAC7C,OAAQ,IAAI,gBAAiB,UAAU,GAAO,EACnD,OAAO,IAAI,QAAQ,EAAK,IAAK,EAAM,SAAQ,OAAM,SAAQ,CAAC,EAE9D,CAEA,IAAM,EAAY,IAAI,IAAI,CAAC,IAAK,IAAK,IAAK,IAAK,GAAG,CAAC,EAEnD,SAAS,CAAO,CAAC,EAA+B,CAC9C,IAAM,EAAK,OAAO,IAAS,UAAY,IAAS,KAAO,EAAK,GAAK,EACjE,GAAI,IAAO,QAAa,IAAO,MAAQ,IAAO,GAC5C,MAAU,UAAU,mEAAmE,EAEzF,OAAO,OAAO,CAAE",
-  "debugId": "95988480893BA2D664756E2164756E21",
+  "debugId": "8235325ABF40DA7464756E2164756E21",
   "names": []
 }