gemi 0.124.0 → 0.125.0

package/dist/{chunk-y434jc1c.js → chunk-p6jbmcrg.js}

@@ -1,4 +1,4 @@
 // @bun
-import{P as ue}from"./chunk-mrswc6qw.js";import{Q as w}from"./chunk-fn2qfwgx.js";import{_}from"./chunk-b5afy6k9.js";import"./chunk-121p4g9j.js";import{aa as l}from"./chunk-kzsjyvvc.js";import{Jj as o,Nj as d}from"./chunk-17dndh5z.js";var g=o(_(),1);var ie=o(l(),1);var O=o(w(),1),R=o(l(),1),J=o(_(),1);var j=o(w(),1),E=o(l(),1),U=(e,s,t)=>{let n={EcsContainer:async(r)=>{let{fromHttp:a}=await import("./chunk-2affxmkn.js"),{fromContainerMetadata:c}=await import("./chunk-7gfdts60.js");return t?.debug("@aws-sdk/credential-provider-ini - credential_source is EcsContainer"),async()=>E.chain(a(r??{}),c(r))().then(L)},Ec2InstanceMetadata:async(r)=>{t?.debug("@aws-sdk/credential-provider-ini - credential_source is Ec2InstanceMetadata");let{fromInstanceMetadata:a}=await import("./chunk-7gfdts60.js");return async()=>a(r)().then(L)},Environment:async(r)=>{t?.debug("@aws-sdk/credential-provider-ini - credential_source is Environment");let{fromEnv:a}=await import("./chunk-j7v7dft7.js");return async()=>a(r)().then(L)}};if(e in n)return n[e];else throw new E.CredentialsProviderError(`Unsupported credential source in profile ${s}. Got ${e}, expected EcsContainer or Ec2InstanceMetadata or Environment.`,{logger:t})},L=(e)=>j.setCredentialFeature(e,"CREDENTIALS_PROFILE_NAMED_PROVIDER","p");var N=(e,{profile:s="default",logger:t}={})=>{return Boolean(e)&&typeof e==="object"&&typeof e.role_arn==="string"&&["undefined","string"].indexOf(typeof e.role_session_name)>-1&&["undefined","string"].indexOf(typeof e.external_id)>-1&&["undefined","string"].indexOf(typeof e.mfa_serial)>-1&&(he(e,{profile:s,logger:t})||ye(e,{profile:s,logger:t}))},he=(e,{profile:s,logger:t})=>{let n=typeof e.source_profile==="string"&&typeof e.credential_source>"u";if(n)t?.debug?.(`    ${s} isAssumeRoleWithSourceProfile source_profile=${e.source_profile}`);return n},ye=(e,{profile:s,logger:t})=>{let n=typeof e.credential_source==="string"&&typeof e.source_profile>"u";if(n)t?.debug?.(`    ${s} isCredentialSourceProfile credential_source=${e.credential_source}`);return n},v=async(e,s,t,n,r={},a)=>{t.logger?.debug("@aws-sdk/credential-provider-ini - resolveAssumeRoleCredentials (STS)");let c=s[e],{source_profile:h,region:I}=c;if(!t.roleAssumer){let{getDefaultRoleAssumer:i}=await import("./chunk-qdj8ek8z.js").then((m)=>o(m.default,1));t.roleAssumer=i({...t.clientConfig,credentialProviderLogger:t.logger,parentClientConfig:{...n,...t?.parentClientConfig,region:I??t?.parentClientConfig?.region??n?.region}},t.clientPlugins)}if(h&&h in r)throw new R.CredentialsProviderError(`Detected a cycle attempting to resolve credentials for profile ${J.getProfileName(t)}. Profiles visited: `+Object.keys(r).join(", "),{logger:t.logger});t.logger?.debug(`@aws-sdk/credential-provider-ini - finding credential resolver using ${h?`source_profile=[${h}]`:`profile=[${e}]`}`);let T=h?a(h,s,t,n,{...r,[h]:!0},G(s[h]??{})):(await U(c.credential_source,e,t.logger)(t))();if(G(c))return T.then((i)=>O.setCredentialFeature(i,"CREDENTIALS_PROFILE_SOURCE_PROFILE","o"));else{let i={RoleArn:c.role_arn,RoleSessionName:c.role_session_name||`aws-sdk-js-${Date.now()}`,ExternalId:c.external_id,DurationSeconds:parseInt(c.duration_seconds||"3600",10)},{mfa_serial:u}=c;if(u){if(!t.mfaCodeProvider)throw new R.CredentialsProviderError(`Profile ${e} requires multi-factor authentication, but no MFA code callback was provided.`,{logger:t.logger,tryNextLink:!1});i.SerialNumber=u,i.TokenCode=await t.mfaCodeProvider(u)}let y=await T;return t.roleAssumer(y,i).then((m)=>O.setCredentialFeature(m,"CREDENTIALS_PROFILE_SOURCE_PROFILE","o"))}},G=(e)=>{return!e.role_arn&&!!e.credential_source};var V=o(w(),1);var C=o(w(),1),X=o(l(),1),K=o(_(),1);var k=o(l(),1),W=o(ue(),1),z=o(_(),1);import{createHash as de,createPrivateKey as we,createPublicKey as ke,sign as me}from"crypto";import{promises as D}from"fs";import{homedir as fe}from"os";import{dirname as Ie,join as Y}from"path";class b{profileData;init;callerClientConfig;static REFRESH_THRESHOLD=300000;constructor(e,s,t){this.profileData=e,this.init=s,this.callerClientConfig=t}async loadCredentials(){let e=await this.loadToken();if(!e)throw new k.CredentialsProviderError(`Failed to load a token for session ${this.loginSession}, please re-authenticate using aws login`,{tryNextLink:!1,logger:this.logger});let s=e.accessToken,t=Date.now();if(new Date(s.expiresAt).getTime()-t<=b.REFRESH_THRESHOLD)return this.refresh(e);return{accessKeyId:s.accessKeyId,secretAccessKey:s.secretAccessKey,sessionToken:s.sessionToken,accountId:s.accountId,expiration:new Date(s.expiresAt)}}get logger(){return this.init?.logger}get loginSession(){return this.profileData.login_session}async refresh(e){let{SigninClient:s,CreateOAuth2TokenCommand:t}=await import("./chunk-34fkx6kb.js").then((m)=>o(m.default,1)),{logger:n,userAgentAppId:r}=this.callerClientConfig??{},c=((i)=>{return i?.metadata?.handlerProtocol==="h2"})(this.callerClientConfig?.requestHandler)?void 0:this.callerClientConfig?.requestHandler,h=this.profileData.region??await this.callerClientConfig?.region?.()??process.env.AWS_REGION,I=new s({credentials:{accessKeyId:"",secretAccessKey:""},region:h,requestHandler:c,logger:n,userAgentAppId:r,...this.init?.clientConfig});this.createDPoPInterceptor(I.middlewareStack);let T={tokenInput:{clientId:e.clientId,refreshToken:e.refreshToken,grantType:"refresh_token"}};try{let i=await I.send(new t(T)),{accessKeyId:u,secretAccessKey:y,sessionToken:m}=i.tokenOutput?.accessToken??{},{refreshToken:x,expiresIn:H}=i.tokenOutput??{};if(!u||!y||!m||!x)throw new k.CredentialsProviderError("Token refresh response missing required fields",{logger:this.logger,tryNextLink:!1});let A=(H??900)*1000,f=new Date(Date.now()+A),q={...e,accessToken:{...e.accessToken,accessKeyId:u,secretAccessKey:y,sessionToken:m,expiresAt:f.toISOString()},refreshToken:x};await this.saveToken(q);let S=q.accessToken;return{accessKeyId:S.accessKeyId,secretAccessKey:S.secretAccessKey,sessionToken:S.sessionToken,accountId:S.accountId,expiration:f}}catch(i){if(i.name==="AccessDeniedException"){let u=i.error,y;switch(u){case"TOKEN_EXPIRED":y="Your session has expired. Please reauthenticate.";break;case"USER_CREDENTIALS_CHANGED":y="Unable to refresh credentials because of a change in your password. Please reauthenticate with your new password.";break;case"INSUFFICIENT_PERMISSIONS":y="Unable to refresh credentials due to insufficient permissions. You may be missing permission for the 'CreateOAuth2Token' action.";break;default:y=`Failed to refresh token: ${String(i)}. Please re-authenticate using \`aws login\``}throw new k.CredentialsProviderError(y,{logger:this.logger,tryNextLink:!1})}throw new k.CredentialsProviderError(`Failed to refresh token: ${String(i)}. Please re-authenticate using aws login`,{logger:this.logger})}}async loadToken(){let e=this.getTokenFilePath();try{let s;try{s=await z.readFile(e,{ignoreCache:this.init?.ignoreCache})}catch{s=await D.readFile(e,"utf8")}let t=JSON.parse(s),n=["accessToken","clientId","refreshToken","dpopKey"].filter((r)=>!t[r]);if(!t.accessToken?.accountId)n.push("accountId");if(n.length>0)throw new k.CredentialsProviderError(`Token validation failed, missing fields: ${n.join(", ")}`,{logger:this.logger,tryNextLink:!1});return t}catch(s){throw new k.CredentialsProviderError(`Failed to load token from ${e}: ${String(s)}`,{logger:this.logger,tryNextLink:!1})}}async saveToken(e){let s=this.getTokenFilePath(),t=Ie(s);try{await D.mkdir(t,{recursive:!0})}catch(n){}await D.writeFile(s,JSON.stringify(e,null,2),"utf8")}getTokenFilePath(){let e=process.env.AWS_LOGIN_CACHE_DIRECTORY??Y(fe(),".aws","login","cache"),s=Buffer.from(this.loginSession,"utf8"),t=de("sha256").update(s).digest("hex");return Y(e,`${t}.json`)}derToRawSignature(e){let s=2;if(e[s]!==2)throw Error("Invalid DER signature");s++;let t=e[s++],n=e.subarray(s,s+t);if(s+=t,e[s]!==2)throw Error("Invalid DER signature");s++;let r=e[s++],a=e.subarray(s,s+r);n=n[0]===0?n.subarray(1):n,a=a[0]===0?a.subarray(1):a;let c=Buffer.concat([Buffer.alloc(32-n.length),n]),h=Buffer.concat([Buffer.alloc(32-a.length),a]);return Buffer.concat([c,h])}createDPoPInterceptor(e){e.add((s)=>async(t)=>{if(W.HttpRequest.isInstance(t.request)){let n=t.request,r=`${n.protocol}//${n.hostname}${n.port?`:${n.port}`:""}${n.path}`,a=await this.generateDpop(n.method,r);n.headers={...n.headers,DPoP:a}}return s(t)},{step:"finalizeRequest",name:"dpopInterceptor",override:!0})}async generateDpop(e="POST",s){let t=await this.loadToken();try{let n=we({key:t.dpopKey,format:"pem",type:"sec1"}),a=ke(n).export({format:"der",type:"spki"}),c=-1;for(let f=0;f<a.length;f++)if(a[f]===4){c=f;break}let h=a.slice(c+1,c+33),I=a.slice(c+33,c+65),T={alg:"ES256",typ:"dpop+jwt",jwk:{kty:"EC",crv:"P-256",x:h.toString("base64url"),y:I.toString("base64url")}},i={jti:crypto.randomUUID(),htm:e,htu:s,iat:Math.floor(Date.now()/1000)},u=Buffer.from(JSON.stringify(T)).toString("base64url"),y=Buffer.from(JSON.stringify(i)).toString("base64url"),m=`${u}.${y}`,x=me("sha256",Buffer.from(m),n),A=this.derToRawSignature(x).toString("base64url");return`${m}.${A}`}catch(n){throw new k.CredentialsProviderError(`Failed to generate Dpop proof: ${n instanceof Error?n.message:String(n)}`,{logger:this.logger,tryNextLink:!1})}}}var Q=(e)=>async({callerClientConfig:s}={})=>{e?.logger?.debug?.("@aws-sdk/credential-providers - fromLoginCredentials");let t=await K.parseKnownFiles(e||{}),n=K.getProfileName({profile:e?.profile??s?.profile}),r=t[n];if(!r?.login_session)throw new X.CredentialsProviderError(`Profile ${n} does not contain login_session.`,{tryNextLink:!0,logger:e?.logger});let c=await new b(r,e,s).loadCredentials();return C.setCredentialFeature(c,"CREDENTIALS_LOGIN","AD")};var Z=(e)=>{return Boolean(e&&e.login_session)},M=async(e,s,t)=>{let n=await Q({...s,profile:e})({callerClientConfig:t});return V.setCredentialFeature(n,"CREDENTIALS_PROFILE_LOGIN","AC")};var p=o(w(),1),ee=(e)=>Boolean(e)&&typeof e==="object"&&typeof e.credential_process==="string",te=async(e,s)=>import("./chunk-4drnyymm.js").then(({fromProcess:t})=>t({...e,profile:s})().then((n)=>p.setCredentialFeature(n,"CREDENTIALS_PROFILE_PROCESS","v")));var $=o(w(),1),se=async(e,s,t={},n)=>{let{fromSSO:r}=await import("./chunk-jys8y39p.js");return r({profile:e,logger:t.logger,parentClientConfig:t.parentClientConfig,clientConfig:t.clientConfig})({callerClientConfig:n}).then((a)=>{if(s.sso_session)return $.setCredentialFeature(a,"CREDENTIALS_PROFILE_SSO","r");else return $.setCredentialFeature(a,"CREDENTIALS_PROFILE_SSO_LEGACY","t")})},ne=(e)=>e&&(typeof e.sso_start_url==="string"||typeof e.sso_account_id==="string"||typeof e.sso_session==="string"||typeof e.sso_region==="string"||typeof e.sso_role_name==="string");var ce=o(w(),1),P=(e)=>Boolean(e)&&typeof e==="object"&&typeof e.aws_access_key_id==="string"&&typeof e.aws_secret_access_key==="string"&&["undefined","string"].indexOf(typeof e.aws_session_token)>-1&&["undefined","string"].indexOf(typeof e.aws_account_id)>-1,F=async(e,s)=>{s?.logger?.debug("@aws-sdk/credential-provider-ini - resolveStaticCredentials");let t={accessKeyId:e.aws_access_key_id,secretAccessKey:e.aws_secret_access_key,sessionToken:e.aws_session_token,...e.aws_credential_scope&&{credentialScope:e.aws_credential_scope},...e.aws_account_id&&{accountId:e.aws_account_id}};return ce.setCredentialFeature(t,"CREDENTIALS_PROFILE","n")};var re=o(w(),1),ae=(e)=>Boolean(e)&&typeof e==="object"&&typeof e.web_identity_token_file==="string"&&typeof e.role_arn==="string"&&["undefined","string"].indexOf(typeof e.role_session_name)>-1,oe=async(e,s,t)=>import("./chunk-zsfwcdqn.js").then(({fromTokenFile:n})=>n({webIdentityTokenFile:e.web_identity_token_file,roleArn:e.role_arn,roleSessionName:e.role_session_name,roleAssumerWithWebIdentity:s.roleAssumerWithWebIdentity,logger:s.logger,parentClientConfig:s.parentClientConfig})({callerClientConfig:t}).then((r)=>re.setCredentialFeature(r,"CREDENTIALS_PROFILE_STS_WEB_ID_TOKEN","q")));var B=async(e,s,t,n,r={},a=!1)=>{let c=s[e];if(Object.keys(r).length>0&&P(c))return F(c,t);if(a||N(c,{profile:e,logger:t.logger}))return v(e,s,t,n,r,B);if(P(c))return F(c,t);if(ae(c))return oe(c,t,n);if(ee(c))return te(t,e);if(ne(c))return await se(e,c,t,n);if(Z(c))return M(e,t,n);throw new ie.CredentialsProviderError(`Could not resolve credentials using profile: [${e}] in configuration/credentials file(s).`,{logger:t.logger})};var Ne=(e={})=>async({callerClientConfig:s}={})=>{e.logger?.debug("@aws-sdk/credential-provider-ini - fromIni");let t=await g.parseKnownFiles(e);return B(g.getProfileName({profile:e.profile??s?.profile}),t,e,s)};export{Ne as fromIni};
+import{P as ue}from"./chunk-1mxb44n9.js";import{Q as w}from"./chunk-6vz75swk.js";import{_}from"./chunk-knq4ack4.js";import"./chunk-m7pghdcy.js";import{aa as l}from"./chunk-7zj6bk9a.js";import{Dk as o,Hk as d}from"./chunk-hxn0s3zh.js";var g=o(_(),1);var ie=o(l(),1);var O=o(w(),1),R=o(l(),1),J=o(_(),1);var j=o(w(),1),E=o(l(),1),U=(e,s,t)=>{let n={EcsContainer:async(r)=>{let{fromHttp:a}=await import("./chunk-p5df4pn7.js"),{fromContainerMetadata:c}=await import("./chunk-eq5svwca.js");return t?.debug("@aws-sdk/credential-provider-ini - credential_source is EcsContainer"),async()=>E.chain(a(r??{}),c(r))().then(L)},Ec2InstanceMetadata:async(r)=>{t?.debug("@aws-sdk/credential-provider-ini - credential_source is Ec2InstanceMetadata");let{fromInstanceMetadata:a}=await import("./chunk-eq5svwca.js");return async()=>a(r)().then(L)},Environment:async(r)=>{t?.debug("@aws-sdk/credential-provider-ini - credential_source is Environment");let{fromEnv:a}=await import("./chunk-s4semb89.js");return async()=>a(r)().then(L)}};if(e in n)return n[e];else throw new E.CredentialsProviderError(`Unsupported credential source in profile ${s}. Got ${e}, expected EcsContainer or Ec2InstanceMetadata or Environment.`,{logger:t})},L=(e)=>j.setCredentialFeature(e,"CREDENTIALS_PROFILE_NAMED_PROVIDER","p");var N=(e,{profile:s="default",logger:t}={})=>{return Boolean(e)&&typeof e==="object"&&typeof e.role_arn==="string"&&["undefined","string"].indexOf(typeof e.role_session_name)>-1&&["undefined","string"].indexOf(typeof e.external_id)>-1&&["undefined","string"].indexOf(typeof e.mfa_serial)>-1&&(he(e,{profile:s,logger:t})||ye(e,{profile:s,logger:t}))},he=(e,{profile:s,logger:t})=>{let n=typeof e.source_profile==="string"&&typeof e.credential_source>"u";if(n)t?.debug?.(`    ${s} isAssumeRoleWithSourceProfile source_profile=${e.source_profile}`);return n},ye=(e,{profile:s,logger:t})=>{let n=typeof e.credential_source==="string"&&typeof e.source_profile>"u";if(n)t?.debug?.(`    ${s} isCredentialSourceProfile credential_source=${e.credential_source}`);return n},v=async(e,s,t,n,r={},a)=>{t.logger?.debug("@aws-sdk/credential-provider-ini - resolveAssumeRoleCredentials (STS)");let c=s[e],{source_profile:h,region:I}=c;if(!t.roleAssumer){let{getDefaultRoleAssumer:i}=await import("./chunk-bny9s44t.js").then((m)=>o(m.default,1));t.roleAssumer=i({...t.clientConfig,credentialProviderLogger:t.logger,parentClientConfig:{...n,...t?.parentClientConfig,region:I??t?.parentClientConfig?.region??n?.region}},t.clientPlugins)}if(h&&h in r)throw new R.CredentialsProviderError(`Detected a cycle attempting to resolve credentials for profile ${J.getProfileName(t)}. Profiles visited: `+Object.keys(r).join(", "),{logger:t.logger});t.logger?.debug(`@aws-sdk/credential-provider-ini - finding credential resolver using ${h?`source_profile=[${h}]`:`profile=[${e}]`}`);let T=h?a(h,s,t,n,{...r,[h]:!0},G(s[h]??{})):(await U(c.credential_source,e,t.logger)(t))();if(G(c))return T.then((i)=>O.setCredentialFeature(i,"CREDENTIALS_PROFILE_SOURCE_PROFILE","o"));else{let i={RoleArn:c.role_arn,RoleSessionName:c.role_session_name||`aws-sdk-js-${Date.now()}`,ExternalId:c.external_id,DurationSeconds:parseInt(c.duration_seconds||"3600",10)},{mfa_serial:u}=c;if(u){if(!t.mfaCodeProvider)throw new R.CredentialsProviderError(`Profile ${e} requires multi-factor authentication, but no MFA code callback was provided.`,{logger:t.logger,tryNextLink:!1});i.SerialNumber=u,i.TokenCode=await t.mfaCodeProvider(u)}let y=await T;return t.roleAssumer(y,i).then((m)=>O.setCredentialFeature(m,"CREDENTIALS_PROFILE_SOURCE_PROFILE","o"))}},G=(e)=>{return!e.role_arn&&!!e.credential_source};var V=o(w(),1);var C=o(w(),1),X=o(l(),1),K=o(_(),1);var k=o(l(),1),W=o(ue(),1),z=o(_(),1);import{createHash as de,createPrivateKey as we,createPublicKey as ke,sign as me}from"crypto";import{promises as D}from"fs";import{homedir as fe}from"os";import{dirname as Ie,join as Y}from"path";class b{profileData;init;callerClientConfig;static REFRESH_THRESHOLD=300000;constructor(e,s,t){this.profileData=e,this.init=s,this.callerClientConfig=t}async loadCredentials(){let e=await this.loadToken();if(!e)throw new k.CredentialsProviderError(`Failed to load a token for session ${this.loginSession}, please re-authenticate using aws login`,{tryNextLink:!1,logger:this.logger});let s=e.accessToken,t=Date.now();if(new Date(s.expiresAt).getTime()-t<=b.REFRESH_THRESHOLD)return this.refresh(e);return{accessKeyId:s.accessKeyId,secretAccessKey:s.secretAccessKey,sessionToken:s.sessionToken,accountId:s.accountId,expiration:new Date(s.expiresAt)}}get logger(){return this.init?.logger}get loginSession(){return this.profileData.login_session}async refresh(e){let{SigninClient:s,CreateOAuth2TokenCommand:t}=await import("./chunk-n3z83qhq.js").then((m)=>o(m.default,1)),{logger:n,userAgentAppId:r}=this.callerClientConfig??{},c=((i)=>{return i?.metadata?.handlerProtocol==="h2"})(this.callerClientConfig?.requestHandler)?void 0:this.callerClientConfig?.requestHandler,h=this.profileData.region??await this.callerClientConfig?.region?.()??process.env.AWS_REGION,I=new s({credentials:{accessKeyId:"",secretAccessKey:""},region:h,requestHandler:c,logger:n,userAgentAppId:r,...this.init?.clientConfig});this.createDPoPInterceptor(I.middlewareStack);let T={tokenInput:{clientId:e.clientId,refreshToken:e.refreshToken,grantType:"refresh_token"}};try{let i=await I.send(new t(T)),{accessKeyId:u,secretAccessKey:y,sessionToken:m}=i.tokenOutput?.accessToken??{},{refreshToken:x,expiresIn:H}=i.tokenOutput??{};if(!u||!y||!m||!x)throw new k.CredentialsProviderError("Token refresh response missing required fields",{logger:this.logger,tryNextLink:!1});let A=(H??900)*1000,f=new Date(Date.now()+A),q={...e,accessToken:{...e.accessToken,accessKeyId:u,secretAccessKey:y,sessionToken:m,expiresAt:f.toISOString()},refreshToken:x};await this.saveToken(q);let S=q.accessToken;return{accessKeyId:S.accessKeyId,secretAccessKey:S.secretAccessKey,sessionToken:S.sessionToken,accountId:S.accountId,expiration:f}}catch(i){if(i.name==="AccessDeniedException"){let u=i.error,y;switch(u){case"TOKEN_EXPIRED":y="Your session has expired. Please reauthenticate.";break;case"USER_CREDENTIALS_CHANGED":y="Unable to refresh credentials because of a change in your password. Please reauthenticate with your new password.";break;case"INSUFFICIENT_PERMISSIONS":y="Unable to refresh credentials due to insufficient permissions. You may be missing permission for the 'CreateOAuth2Token' action.";break;default:y=`Failed to refresh token: ${String(i)}. Please re-authenticate using \`aws login\``}throw new k.CredentialsProviderError(y,{logger:this.logger,tryNextLink:!1})}throw new k.CredentialsProviderError(`Failed to refresh token: ${String(i)}. Please re-authenticate using aws login`,{logger:this.logger})}}async loadToken(){let e=this.getTokenFilePath();try{let s;try{s=await z.readFile(e,{ignoreCache:this.init?.ignoreCache})}catch{s=await D.readFile(e,"utf8")}let t=JSON.parse(s),n=["accessToken","clientId","refreshToken","dpopKey"].filter((r)=>!t[r]);if(!t.accessToken?.accountId)n.push("accountId");if(n.length>0)throw new k.CredentialsProviderError(`Token validation failed, missing fields: ${n.join(", ")}`,{logger:this.logger,tryNextLink:!1});return t}catch(s){throw new k.CredentialsProviderError(`Failed to load token from ${e}: ${String(s)}`,{logger:this.logger,tryNextLink:!1})}}async saveToken(e){let s=this.getTokenFilePath(),t=Ie(s);try{await D.mkdir(t,{recursive:!0})}catch(n){}await D.writeFile(s,JSON.stringify(e,null,2),"utf8")}getTokenFilePath(){let e=process.env.AWS_LOGIN_CACHE_DIRECTORY??Y(fe(),".aws","login","cache"),s=Buffer.from(this.loginSession,"utf8"),t=de("sha256").update(s).digest("hex");return Y(e,`${t}.json`)}derToRawSignature(e){let s=2;if(e[s]!==2)throw Error("Invalid DER signature");s++;let t=e[s++],n=e.subarray(s,s+t);if(s+=t,e[s]!==2)throw Error("Invalid DER signature");s++;let r=e[s++],a=e.subarray(s,s+r);n=n[0]===0?n.subarray(1):n,a=a[0]===0?a.subarray(1):a;let c=Buffer.concat([Buffer.alloc(32-n.length),n]),h=Buffer.concat([Buffer.alloc(32-a.length),a]);return Buffer.concat([c,h])}createDPoPInterceptor(e){e.add((s)=>async(t)=>{if(W.HttpRequest.isInstance(t.request)){let n=t.request,r=`${n.protocol}//${n.hostname}${n.port?`:${n.port}`:""}${n.path}`,a=await this.generateDpop(n.method,r);n.headers={...n.headers,DPoP:a}}return s(t)},{step:"finalizeRequest",name:"dpopInterceptor",override:!0})}async generateDpop(e="POST",s){let t=await this.loadToken();try{let n=we({key:t.dpopKey,format:"pem",type:"sec1"}),a=ke(n).export({format:"der",type:"spki"}),c=-1;for(let f=0;f<a.length;f++)if(a[f]===4){c=f;break}let h=a.slice(c+1,c+33),I=a.slice(c+33,c+65),T={alg:"ES256",typ:"dpop+jwt",jwk:{kty:"EC",crv:"P-256",x:h.toString("base64url"),y:I.toString("base64url")}},i={jti:crypto.randomUUID(),htm:e,htu:s,iat:Math.floor(Date.now()/1000)},u=Buffer.from(JSON.stringify(T)).toString("base64url"),y=Buffer.from(JSON.stringify(i)).toString("base64url"),m=`${u}.${y}`,x=me("sha256",Buffer.from(m),n),A=this.derToRawSignature(x).toString("base64url");return`${m}.${A}`}catch(n){throw new k.CredentialsProviderError(`Failed to generate Dpop proof: ${n instanceof Error?n.message:String(n)}`,{logger:this.logger,tryNextLink:!1})}}}var Q=(e)=>async({callerClientConfig:s}={})=>{e?.logger?.debug?.("@aws-sdk/credential-providers - fromLoginCredentials");let t=await K.parseKnownFiles(e||{}),n=K.getProfileName({profile:e?.profile??s?.profile}),r=t[n];if(!r?.login_session)throw new X.CredentialsProviderError(`Profile ${n} does not contain login_session.`,{tryNextLink:!0,logger:e?.logger});let c=await new b(r,e,s).loadCredentials();return C.setCredentialFeature(c,"CREDENTIALS_LOGIN","AD")};var Z=(e)=>{return Boolean(e&&e.login_session)},M=async(e,s,t)=>{let n=await Q({...s,profile:e})({callerClientConfig:t});return V.setCredentialFeature(n,"CREDENTIALS_PROFILE_LOGIN","AC")};var p=o(w(),1),ee=(e)=>Boolean(e)&&typeof e==="object"&&typeof e.credential_process==="string",te=async(e,s)=>import("./chunk-stn0a56e.js").then(({fromProcess:t})=>t({...e,profile:s})().then((n)=>p.setCredentialFeature(n,"CREDENTIALS_PROFILE_PROCESS","v")));var $=o(w(),1),se=async(e,s,t={},n)=>{let{fromSSO:r}=await import("./chunk-q6ah4yjg.js");return r({profile:e,logger:t.logger,parentClientConfig:t.parentClientConfig,clientConfig:t.clientConfig})({callerClientConfig:n}).then((a)=>{if(s.sso_session)return $.setCredentialFeature(a,"CREDENTIALS_PROFILE_SSO","r");else return $.setCredentialFeature(a,"CREDENTIALS_PROFILE_SSO_LEGACY","t")})},ne=(e)=>e&&(typeof e.sso_start_url==="string"||typeof e.sso_account_id==="string"||typeof e.sso_session==="string"||typeof e.sso_region==="string"||typeof e.sso_role_name==="string");var ce=o(w(),1),P=(e)=>Boolean(e)&&typeof e==="object"&&typeof e.aws_access_key_id==="string"&&typeof e.aws_secret_access_key==="string"&&["undefined","string"].indexOf(typeof e.aws_session_token)>-1&&["undefined","string"].indexOf(typeof e.aws_account_id)>-1,F=async(e,s)=>{s?.logger?.debug("@aws-sdk/credential-provider-ini - resolveStaticCredentials");let t={accessKeyId:e.aws_access_key_id,secretAccessKey:e.aws_secret_access_key,sessionToken:e.aws_session_token,...e.aws_credential_scope&&{credentialScope:e.aws_credential_scope},...e.aws_account_id&&{accountId:e.aws_account_id}};return ce.setCredentialFeature(t,"CREDENTIALS_PROFILE","n")};var re=o(w(),1),ae=(e)=>Boolean(e)&&typeof e==="object"&&typeof e.web_identity_token_file==="string"&&typeof e.role_arn==="string"&&["undefined","string"].indexOf(typeof e.role_session_name)>-1,oe=async(e,s,t)=>import("./chunk-g52fcwca.js").then(({fromTokenFile:n})=>n({webIdentityTokenFile:e.web_identity_token_file,roleArn:e.role_arn,roleSessionName:e.role_session_name,roleAssumerWithWebIdentity:s.roleAssumerWithWebIdentity,logger:s.logger,parentClientConfig:s.parentClientConfig})({callerClientConfig:t}).then((r)=>re.setCredentialFeature(r,"CREDENTIALS_PROFILE_STS_WEB_ID_TOKEN","q")));var B=async(e,s,t,n,r={},a=!1)=>{let c=s[e];if(Object.keys(r).length>0&&P(c))return F(c,t);if(a||N(c,{profile:e,logger:t.logger}))return v(e,s,t,n,r,B);if(P(c))return F(c,t);if(ae(c))return oe(c,t,n);if(ee(c))return te(t,e);if(ne(c))return await se(e,c,t,n);if(Z(c))return M(e,t,n);throw new ie.CredentialsProviderError(`Could not resolve credentials using profile: [${e}] in configuration/credentials file(s).`,{logger:t.logger})};var Ne=(e={})=>async({callerClientConfig:s}={})=>{e.logger?.debug("@aws-sdk/credential-provider-ini - fromIni");let t=await g.parseKnownFiles(e);return B(g.getProfileName({profile:e.profile??s?.profile}),t,e,s)};export{Ne as fromIni};
 
-//# debugId=B8ED3A50FF05B62464756E2164756E21
+//# debugId=8ECA2AB85BBCE01A64756E2164756E21

package/dist/{chunk-y434jc1c.js.map → chunk-p6jbmcrg.js.map}

@@ -15,6 +15,6 @@
     "import { setCredentialFeature } from \"@aws-sdk/core/client\";\nexport const isWebIdentityProfile = (arg) => Boolean(arg) &&\n    typeof arg === \"object\" &&\n    typeof arg.web_identity_token_file === \"string\" &&\n    typeof arg.role_arn === \"string\" &&\n    [\"undefined\", \"string\"].indexOf(typeof arg.role_session_name) > -1;\nexport const resolveWebIdentityCredentials = async (profile, options, callerClientConfig) => import(\"@aws-sdk/credential-provider-web-identity\").then(({ fromTokenFile }) => fromTokenFile({\n    webIdentityTokenFile: profile.web_identity_token_file,\n    roleArn: profile.role_arn,\n    roleSessionName: profile.role_session_name,\n    roleAssumerWithWebIdentity: options.roleAssumerWithWebIdentity,\n    logger: options.logger,\n    parentClientConfig: options.parentClientConfig,\n})({\n    callerClientConfig,\n}).then((creds) => setCredentialFeature(creds, \"CREDENTIALS_PROFILE_STS_WEB_ID_TOKEN\", \"q\")));\n"
   ],
   "mappings": ";wQAAA,SCAA,UCAA,SACA,KACA,KCFA,eACA,WACa,EAA0B,CAAC,EAAkB,EAAa,IAAW,CAC9E,IAAM,EAAqB,CACvB,aAAc,MAAO,IAAY,CAC7B,IAAQ,YAAa,KAAa,gCAC1B,yBAA0B,KAAa,+BAE/C,OADA,GAAQ,MAAM,sEAAsE,EAC7E,SAAY,QAAM,EAAS,GAAW,CAAC,CAAC,EAAG,EAAsB,CAAO,CAAC,EAAE,EAAE,KAAK,CAAgB,GAE7G,oBAAqB,MAAO,IAAY,CACpC,GAAQ,MAAM,6EAA6E,EAC3F,IAAQ,wBAAyB,KAAa,+BAC9C,MAAO,UAAY,EAAqB,CAAO,EAAE,EAAE,KAAK,CAAgB,GAE5E,YAAa,MAAO,IAAY,CAC5B,GAAQ,MAAM,qEAAqE,EACnF,IAAQ,WAAY,KAAa,+BACjC,MAAO,UAAY,EAAQ,CAAO,EAAE,EAAE,KAAK,CAAgB,EAEnE,EACA,GAAI,KAAoB,EACpB,OAAO,EAAmB,GAG1B,WAAM,IAAI,2BAAyB,4CAA4C,UAAoB,kEAC/B,CAAE,QAAO,CAAC,GAGhF,EAAmB,CAAC,IAAU,uBAAqB,EAAO,qCAAsC,GAAG,EDzBlG,IAAM,EAAsB,CAAC,GAAO,UAAU,UAAW,UAAW,CAAC,IAAM,CAC9E,OAAQ,QAAQ,CAAG,GACf,OAAO,IAAQ,UACf,OAAO,EAAI,WAAa,UACxB,CAAC,YAAa,QAAQ,EAAE,QAAQ,OAAO,EAAI,iBAAiB,EAAI,IAChE,CAAC,YAAa,QAAQ,EAAE,QAAQ,OAAO,EAAI,WAAW,EAAI,IAC1D,CAAC,YAAa,QAAQ,EAAE,QAAQ,OAAO,EAAI,UAAU,EAAI,KACxD,GAA8B,EAAK,CAAE,UAAS,QAAO,CAAC,GAAK,GAA0B,EAAK,CAAE,UAAS,QAAO,CAAC,IAEhH,GAAgC,CAAC,GAAO,UAAS,YAAa,CAChE,IAAM,EAAoB,OAAO,EAAI,iBAAmB,UAAY,OAAO,EAAI,kBAAsB,IACrG,GAAI,EACA,GAAQ,QAAQ,OAAO,kDAAwD,EAAI,gBAAgB,EAEvG,OAAO,GAEL,GAA4B,CAAC,GAAO,UAAS,YAAa,CAC5D,IAAM,EAAsB,OAAO,EAAI,oBAAsB,UAAY,OAAO,EAAI,eAAmB,IACvG,GAAI,EACA,GAAQ,QAAQ,OAAO,iDAAuD,EAAI,mBAAmB,EAEzG,OAAO,GAEE,EAA+B,MAAO,EAAa,EAAU,EAAS,EAAoB,EAAkB,CAAC,EAAG,IAAuB,CAChJ,EAAQ,QAAQ,MAAM,uEAAuE,EAC7F,IAAM,EAAc,EAAS,IACrB,iBAAgB,UAAW,EACnC,GAAI,CAAC,EAAQ,YAAa,CACtB,IAAQ,yBAA0B,KAAa,yDAC/C,EAAQ,YAAc,EAAsB,IACrC,EAAQ,aACX,yBAA0B,EAAQ,OAClC,mBAAoB,IACb,KACA,GAAS,mBACZ,OAAQ,GAAU,GAAS,oBAAoB,QAAU,GAAoB,MACjF,CACJ,EAAG,EAAQ,aAAa,EAE5B,GAAI,GAAkB,KAAkB,EACpC,MAAM,IAAI,2BAAyB,kEAC3B,iBAAe,CAAO,wBAC1B,OAAO,KAAK,CAAe,EAAE,KAAK,IAAI,EAAG,CAAE,OAAQ,EAAQ,MAAO,CAAC,EAE3E,EAAQ,QAAQ,MAAM,wEAAwE,EAAiB,mBAAmB,KAAoB,YAAY,MAAgB,EAClL,IAAM,EAAsB,EACtB,EAAmB,EAAgB,EAAU,EAAS,EAAoB,IACrE,GACF,GAAiB,EACtB,EAAG,EAAiC,EAAS,IAAmB,CAAC,CAAC,CAAC,GAChE,MAAM,EAAwB,EAAY,kBAAmB,EAAa,EAAQ,MAAM,EAAE,CAAO,GAAG,EAC3G,GAAI,EAAiC,CAAW,EAC5C,OAAO,EAAoB,KAAK,CAAC,IAAU,uBAAqB,EAAO,qCAAsC,GAAG,CAAC,EAEhH,KACD,IAAM,EAAS,CACX,QAAS,EAAY,SACrB,gBAAiB,EAAY,mBAAqB,cAAc,KAAK,IAAI,IACzE,WAAY,EAAY,YACxB,gBAAiB,SAAS,EAAY,kBAAoB,OAAQ,EAAE,CACxE,GACQ,cAAe,EACvB,GAAI,EAAY,CACZ,GAAI,CAAC,EAAQ,gBACT,MAAM,IAAI,2BAAyB,WAAW,iFAA4F,CAAE,OAAQ,EAAQ,OAAQ,YAAa,EAAM,CAAC,EAE5L,EAAO,aAAe,EACtB,EAAO,UAAY,MAAM,EAAQ,gBAAgB,CAAU,EAE/D,IAAM,EAAc,MAAM,EAC1B,OAAO,EAAQ,YAAY,EAAa,CAAM,EAAE,KAAK,CAAC,IAAU,uBAAqB,EAAO,qCAAsC,GAAG,CAAC,IAGxI,EAAmC,CAAC,IAAY,CAClD,MAAO,CAAC,EAAQ,UAAY,CAAC,CAAC,EAAQ,mBE9E1C,eCAA,eACA,WACA,WCFA,eACA,YACA,WACA,qBAAS,uBAAY,sBAAkB,WAAiB,gBACxD,mBAAS,WACT,kBAAS,YACT,kBAAS,WAAS,aACX,MAAM,CAAwB,CACjC,YACA,KACA,yBACO,mBAAoB,OAC3B,WAAW,CAAC,EAAa,EAAM,EAAoB,CAC/C,KAAK,YAAc,EACnB,KAAK,KAAO,EACZ,KAAK,mBAAqB,OAExB,gBAAe,EAAG,CACpB,IAAM,EAAQ,MAAM,KAAK,UAAU,EACnC,GAAI,CAAC,EACD,MAAM,IAAI,2BAAyB,sCAAsC,KAAK,uDAAwD,CAAE,YAAa,GAAO,OAAQ,KAAK,MAAO,CAAC,EAErL,IAAM,EAAc,EAAM,YACpB,EAAM,KAAK,IAAI,EAGrB,GAFmB,IAAI,KAAK,EAAY,SAAS,EAAE,QAAQ,EACtB,GACd,EAAwB,kBAC3C,OAAO,KAAK,QAAQ,CAAK,EAE7B,MAAO,CACH,YAAa,EAAY,YACzB,gBAAiB,EAAY,gBAC7B,aAAc,EAAY,aAC1B,UAAW,EAAY,UACvB,WAAY,IAAI,KAAK,EAAY,SAAS,CAC9C,KAEA,OAAM,EAAG,CACT,OAAO,KAAK,MAAM,UAElB,aAAY,EAAG,CACf,OAAO,KAAK,YAAY,mBAEtB,QAAO,CAAC,EAAO,CACjB,IAAQ,eAAc,4BAA6B,KAAa,0DACxD,SAAQ,kBAAmB,KAAK,oBAAsB,CAAC,EAIzD,GAHO,CAAC,IAAmB,CAC7B,OAAO,GAAgB,UAAU,kBAAoB,OAE7B,KAAK,oBAAoB,cAAc,EAC7D,OACA,KAAK,oBAAoB,eACzB,EAAS,KAAK,YAAY,QAAW,MAAM,KAAK,oBAAoB,SAAS,GAAM,QAAQ,IAAI,WAC/F,EAAS,IAAI,EAAa,CAC5B,YAAa,CACT,YAAa,GACb,gBAAiB,EACrB,EACA,SACA,iBACA,SACA,oBACG,KAAK,MAAM,YAClB,CAAC,EACD,KAAK,sBAAsB,EAAO,eAAe,EACjD,IAAM,EAAe,CACjB,WAAY,CACR,SAAU,EAAM,SAChB,aAAc,EAAM,aACpB,UAAW,eACf,CACJ,EACA,GAAI,CACA,IAAM,EAAW,MAAM,EAAO,KAAK,IAAI,EAAyB,CAAY,CAAC,GACrE,cAAa,kBAAiB,gBAAiB,EAAS,aAAa,aAAe,CAAC,GACrF,eAAc,aAAc,EAAS,aAAe,CAAC,EAC7D,GAAI,CAAC,GAAe,CAAC,GAAmB,CAAC,GAAgB,CAAC,EACtD,MAAM,IAAI,2BAAyB,iDAAkD,CACjF,OAAQ,KAAK,OACb,YAAa,EACjB,CAAC,EAEL,IAAM,GAAe,GAAa,KAAO,KACnC,EAAa,IAAI,KAAK,KAAK,IAAI,EAAI,CAAW,EAC9C,EAAe,IACd,EACH,YAAa,IACN,EAAM,YACT,YAAa,EACb,gBAAiB,EACjB,aAAc,EACd,UAAW,EAAW,YAAY,CACtC,EACA,aAAc,CAClB,EACA,MAAM,KAAK,UAAU,CAAY,EACjC,IAAM,EAAiB,EAAa,YACpC,MAAO,CACH,YAAa,EAAe,YAC5B,gBAAiB,EAAe,gBAChC,aAAc,EAAe,aAC7B,UAAW,EAAe,UAC1B,YACJ,EAEJ,MAAO,EAAO,CACV,GAAI,EAAM,OAAS,wBAAyB,CACxC,IAAM,EAAY,EAAM,MACpB,EACJ,OAAQ,OACC,gBACD,EAAU,mDACV,UACC,2BACD,EACI,oHACJ,UACC,2BACD,EACI,mIACJ,cAEA,EAAU,4BAA4B,OAAO,CAAK,gDAE1D,MAAM,IAAI,2BAAyB,EAAS,CAAE,OAAQ,KAAK,OAAQ,YAAa,EAAM,CAAC,EAE3F,MAAM,IAAI,2BAAyB,4BAA4B,OAAO,CAAK,4CAA6C,CAAE,OAAQ,KAAK,MAAO,CAAC,QAGjJ,UAAS,EAAG,CACd,IAAM,EAAgB,KAAK,iBAAiB,EAC5C,GAAI,CACA,IAAI,EACJ,GAAI,CACA,EAAY,MAAM,WAAS,EAAe,CAAE,YAAa,KAAK,MAAM,WAAY,CAAC,EAErF,KAAM,CACF,EAAY,MAAM,EAAG,SAAS,EAAe,MAAM,EAEvD,IAAM,EAAQ,KAAK,MAAM,CAAS,EAC5B,EAAgB,CAAC,cAAe,WAAY,eAAgB,SAAS,EAAE,OAAO,CAAC,IAAM,CAAC,EAAM,EAAE,EACpG,GAAI,CAAC,EAAM,aAAa,UACpB,EAAc,KAAK,WAAW,EAElC,GAAI,EAAc,OAAS,EACvB,MAAM,IAAI,2BAAyB,4CAA4C,EAAc,KAAK,IAAI,IAAK,CACvG,OAAQ,KAAK,OACb,YAAa,EACjB,CAAC,EAEL,OAAO,EAEX,MAAO,EAAO,CACV,MAAM,IAAI,2BAAyB,6BAA6B,MAAkB,OAAO,CAAK,IAAK,CAC/F,OAAQ,KAAK,OACb,YAAa,EACjB,CAAC,QAGH,UAAS,CAAC,EAAO,CACnB,IAAM,EAAgB,KAAK,iBAAiB,EACtC,EAAY,GAAQ,CAAa,EACvC,GAAI,CACA,MAAM,EAAG,MAAM,EAAW,CAAE,UAAW,EAAK,CAAC,EAEjD,MAAO,EAAO,EAEd,MAAM,EAAG,UAAU,EAAe,KAAK,UAAU,EAAO,KAAM,CAAC,EAAG,MAAM,EAE5E,gBAAgB,EAAG,CACf,IAAM,EAAY,QAAQ,IAAI,2BAA6B,EAAK,GAAQ,EAAG,OAAQ,QAAS,OAAO,EAC7F,EAAoB,OAAO,KAAK,KAAK,aAAc,MAAM,EACzD,EAAqB,GAAW,QAAQ,EAAE,OAAO,CAAiB,EAAE,OAAO,KAAK,EACtF,OAAO,EAAK,EAAW,GAAG,QAAyB,EAEvD,iBAAiB,CAAC,EAAc,CAC5B,IAAI,EAAS,EACb,GAAI,EAAa,KAAY,EACzB,MAAU,MAAM,uBAAuB,EAE3C,IACA,IAAM,EAAU,EAAa,KACzB,EAAI,EAAa,SAAS,EAAQ,EAAS,CAAO,EAEtD,GADA,GAAU,EACN,EAAa,KAAY,EACzB,MAAU,MAAM,uBAAuB,EAE3C,IACA,IAAM,EAAU,EAAa,KACzB,EAAI,EAAa,SAAS,EAAQ,EAAS,CAAO,EACtD,EAAI,EAAE,KAAO,EAAO,EAAE,SAAS,CAAC,EAAI,EACpC,EAAI,EAAE,KAAO,EAAO,EAAE,SAAS,CAAC,EAAI,EACpC,IAAM,EAAU,OAAO,OAAO,CAAC,OAAO,MAAM,GAAK,EAAE,MAAM,EAAG,CAAC,CAAC,EACxD,EAAU,OAAO,OAAO,CAAC,OAAO,MAAM,GAAK,EAAE,MAAM,EAAG,CAAC,CAAC,EAC9D,OAAO,OAAO,OAAO,CAAC,EAAS,CAAO,CAAC,EAE3C,qBAAqB,CAAC,EAAiB,CACnC,EAAgB,IAAI,CAAC,IAAS,MAAO,IAAS,CAC1C,GAAI,cAAY,WAAW,EAAK,OAAO,EAAG,CACtC,IAAM,EAAU,EAAK,QACf,EAAiB,GAAG,EAAQ,aAAa,EAAQ,WAAW,EAAQ,KAAO,IAAI,EAAQ,OAAS,KAAK,EAAQ,OAC7G,EAAO,MAAM,KAAK,aAAa,EAAQ,OAAQ,CAAc,EACnE,EAAQ,QAAU,IACX,EAAQ,QACX,KAAM,CACV,EAEJ,OAAO,EAAK,CAAI,GACjB,CACC,KAAM,kBACN,KAAM,kBACN,SAAU,EACd,CAAC,OAEC,aAAY,CAAC,EAAS,OAAQ,EAAU,CAC1C,IAAM,EAAQ,MAAM,KAAK,UAAU,EACnC,GAAI,CACA,IAAM,EAAa,GAAiB,CAChC,IAAK,EAAM,QACX,OAAQ,MACR,KAAM,MACV,CAAC,EAEK,EADY,GAAgB,CAAU,EAChB,OAAO,CAAE,OAAQ,MAAO,KAAM,MAAO,CAAC,EAC9D,EAAa,GACjB,QAAS,EAAI,EAAG,EAAI,EAAU,OAAQ,IAClC,GAAI,EAAU,KAAO,EAAM,CACvB,EAAa,EACb,MAGR,IAAM,EAAI,EAAU,MAAM,EAAa,EAAG,EAAa,EAAE,EACnD,EAAI,EAAU,MAAM,EAAa,GAAI,EAAa,EAAE,EACpD,EAAS,CACX,IAAK,QACL,IAAK,WACL,IAAK,CACD,IAAK,KACL,IAAK,QACL,EAAG,EAAE,SAAS,WAAW,EACzB,EAAG,EAAE,SAAS,WAAW,CAC7B,CACJ,EACM,EAAU,CACZ,IAAK,OAAO,WAAW,EACvB,IAAK,EACL,IAAK,EACL,IAAK,KAAK,MAAM,KAAK,IAAI,EAAI,IAAI,CACrC,EACM,EAAY,OAAO,KAAK,KAAK,UAAU,CAAM,CAAC,EAAE,SAAS,WAAW,EACpE,EAAa,OAAO,KAAK,KAAK,UAAU,CAAO,CAAC,EAAE,SAAS,WAAW,EACtE,EAAU,GAAG,KAAa,IAC1B,EAAgB,GAAK,SAAU,OAAO,KAAK,CAAO,EAAG,CAAU,EAE/D,EADe,KAAK,kBAAkB,CAAa,EACvB,SAAS,WAAW,EACtD,MAAO,GAAG,KAAW,IAEzB,MAAO,EAAO,CACV,MAAM,IAAI,2BAAyB,kCAAkC,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,IAAK,CAAE,OAAQ,KAAK,OAAQ,YAAa,EAAM,CAAC,GAGtL,CDjQO,IAAM,EAAuB,CAAC,IAAS,OAAS,sBAAuB,CAAC,IAAM,CACjF,GAAM,QAAQ,QAAQ,sDAAsD,EAC5E,IAAM,EAAW,MAAM,kBAAgB,GAAQ,CAAC,CAAC,EAC3C,EAAc,iBAAe,CAC/B,QAAS,GAAM,SAAW,GAAoB,OAClD,CAAC,EACK,EAAU,EAAS,GACzB,GAAI,CAAC,GAAS,cACV,MAAM,IAAI,2BAAyB,WAAW,oCAA+C,CACzF,YAAa,GACb,OAAQ,GAAM,MAClB,CAAC,EAGL,IAAM,EAAc,MADJ,IAAI,EAAwB,EAAS,EAAM,CAAkB,EAC3C,gBAAgB,EAClD,OAAO,uBAAqB,EAAa,oBAAqB,IAAI,GDjB/D,IAAM,EAAiB,CAAC,IAAS,CACpC,OAAO,QAAQ,GAAQ,EAAK,aAAa,GAEhC,EAA0B,MAAO,EAAa,EAAS,IAAuB,CACvF,IAAM,EAAc,MAAM,EAAqB,IACxC,EACH,QAAS,CACb,CAAC,EAAE,CAAE,oBAAmB,CAAC,EACzB,OAAO,uBAAqB,EAAa,4BAA6B,IAAI,GGV9E,eACa,GAAmB,CAAC,IAAQ,QAAQ,CAAG,GAAK,OAAO,IAAQ,UAAY,OAAO,EAAI,qBAAuB,SACzG,GAA4B,MAAO,EAAS,IAAmB,8BAAwC,KAAK,EAAG,iBAAkB,EAAY,IACnJ,EACH,SACJ,CAAC,EAAE,EAAE,KAAK,CAAC,IAAU,uBAAqB,EAAO,8BAA+B,GAAG,CAAC,CAAC,ECLrF,eACa,GAAwB,MAAO,EAAS,EAAa,EAAU,CAAC,EAAG,IAAuB,CACnG,IAAQ,WAAY,KAAa,+BACjC,OAAO,EAAQ,CACX,UACA,OAAQ,EAAQ,OAChB,mBAAoB,EAAQ,mBAC5B,aAAc,EAAQ,YAC1B,CAAC,EAAE,CACC,oBACJ,CAAC,EAAE,KAAK,CAAC,IAAU,CACf,GAAI,EAAY,YACZ,OAAO,uBAAqB,EAAO,0BAA2B,GAAG,EAGjE,YAAO,uBAAqB,EAAO,iCAAkC,GAAG,EAE/E,GAEQ,GAAe,CAAC,IAAQ,IAChC,OAAO,EAAI,gBAAkB,UAC1B,OAAO,EAAI,iBAAmB,UAC9B,OAAO,EAAI,cAAgB,UAC3B,OAAO,EAAI,aAAe,UAC1B,OAAO,EAAI,gBAAkB,UCxBrC,gBACa,EAAuB,CAAC,IAAQ,QAAQ,CAAG,GACpD,OAAO,IAAQ,UACf,OAAO,EAAI,oBAAsB,UACjC,OAAO,EAAI,wBAA0B,UACrC,CAAC,YAAa,QAAQ,EAAE,QAAQ,OAAO,EAAI,iBAAiB,EAAI,IAChE,CAAC,YAAa,QAAQ,EAAE,QAAQ,OAAO,EAAI,cAAc,EAAI,GACpD,EAA2B,MAAO,EAAS,IAAY,CAChE,GAAS,QAAQ,MAAM,6DAA6D,EACpF,IAAM,EAAc,CAChB,YAAa,EAAQ,kBACrB,gBAAiB,EAAQ,sBACzB,aAAc,EAAQ,qBAClB,EAAQ,sBAAwB,CAAE,gBAAiB,EAAQ,oBAAqB,KAChF,EAAQ,gBAAkB,CAAE,UAAW,EAAQ,cAAe,CACtE,EACA,OAAO,wBAAqB,EAAa,sBAAuB,GAAG,GChBvE,gBACa,GAAuB,CAAC,IAAQ,QAAQ,CAAG,GACpD,OAAO,IAAQ,UACf,OAAO,EAAI,0BAA4B,UACvC,OAAO,EAAI,WAAa,UACxB,CAAC,YAAa,QAAQ,EAAE,QAAQ,OAAO,EAAI,iBAAiB,EAAI,GACvD,GAAgC,MAAO,EAAS,EAAS,IAA8B,8BAA6C,KAAK,EAAG,mBAAoB,EAAc,CACvL,qBAAsB,EAAQ,wBAC9B,QAAS,EAAQ,SACjB,gBAAiB,EAAQ,kBACzB,2BAA4B,EAAQ,2BACpC,OAAQ,EAAQ,OAChB,mBAAoB,EAAQ,kBAChC,CAAC,EAAE,CACC,oBACJ,CAAC,EAAE,KAAK,CAAC,IAAU,wBAAqB,EAAO,uCAAwC,GAAG,CAAC,CAAC,ETRrF,IAAM,EAAqB,MAAO,EAAa,EAAU,EAAS,EAAoB,EAAkB,CAAC,EAAG,EAA4B,KAAU,CACrJ,IAAM,EAAO,EAAS,GACtB,GAAI,OAAO,KAAK,CAAe,EAAE,OAAS,GAAK,EAAqB,CAAI,EACpE,OAAO,EAAyB,EAAM,CAAO,EAEjD,GAAI,GAA6B,EAAoB,EAAM,CAAE,QAAS,EAAa,OAAQ,EAAQ,MAAO,CAAC,EACvG,OAAO,EAA6B,EAAa,EAAU,EAAS,EAAoB,EAAiB,CAAkB,EAE/H,GAAI,EAAqB,CAAI,EACzB,OAAO,EAAyB,EAAM,CAAO,EAEjD,GAAI,GAAqB,CAAI,EACzB,OAAO,GAA8B,EAAM,EAAS,CAAkB,EAE1E,GAAI,GAAiB,CAAI,EACrB,OAAO,GAA0B,EAAS,CAAW,EAEzD,GAAI,GAAa,CAAI,EACjB,OAAO,MAAM,GAAsB,EAAa,EAAM,EAAS,CAAkB,EAErF,GAAI,EAAe,CAAI,EACnB,OAAO,EAAwB,EAAa,EAAS,CAAkB,EAE3E,MAAM,IAAI,4BAAyB,iDAAiD,2CAAsD,CAAE,OAAQ,EAAQ,MAAO,CAAC,GD5BjK,IAAM,GAAU,CAAC,EAAO,CAAC,IAAM,OAAS,sBAAuB,CAAC,IAAM,CACzE,EAAK,QAAQ,MAAM,4CAA4C,EAC/D,IAAM,EAAW,MAAM,kBAAgB,CAAI,EAC3C,OAAO,EAAmB,iBAAe,CACrC,QAAS,EAAK,SAAW,GAAoB,OACjD,CAAC,EAAG,EAAU,EAAM,CAAkB",
-  "debugId": "B8ED3A50FF05B62464756E2164756E21",
+  "debugId": "8ECA2AB85BBCE01A64756E2164756E21",
   "names": []
 }

package/dist/{chunk-jctb7v53.js → chunk-p7mvp5nf.js}

@@ -1,4 +1,4 @@
 // @bun
-import{Hj as J}from"./chunk-z5jydj5r.js";class L{kernel;onException;constructor(f){this.kernel=new f.kernel,this.kernel.boot.call(this.kernel),this.onException=f.onException??((A)=>{console.error("Unhandled exception in App:",A)})}async waitForBoot(){await this.kernel.waitForBoot()}getComponentTree(){return this.kernel.viewRoutes().componentTree}getFlatComponentTree(){let f=new Set;for(let A of this.kernel.domains().viewDispatchers())for(let C of A.flatComponentTree)f.add(C);return Array.from(f)}devAllowedHosts(){let f=this.kernel.domains();if(!f.resolver)return[];return f.acceptsCustomDomains?!0:[`.${f.resolver.root}`]}sockets(){return this.kernel.sockets.call(this.kernel)}getRouteManifest(){return this.kernel.viewRoutes().routeManifest}globallyGated=new WeakMap;async withGlobalMiddleware(f,A,C){let z;try{z=await this.kernel.run.call(this.kernel,()=>this.kernel.globalMiddleware(f))}catch(F){return await C(F)}if(z.refusal)return z.refusal;return this.globallyGated.set(f,z.carried),z.apply(await A(f))}async fetch(f){let A=new URL(f.url);return this.kernel.run.call(this.kernel,async()=>{let C=this.globallyGated.has(f),z=C?null:await this.kernel.globalMiddleware(f),F=C?this.globallyGated.get(f):z.carried;if(z?.refusal)return z.refusal;let H=this.kernel.mcpHttp();if(H){let B=await H.handle(f);if(B)return z?z.apply(B):B}let I=this.kernel.domains(),D=await I.ask(f)??await I.route(f);if(D instanceof Response)return z?z.apply(D):D;if(!D){let B=new Response("Unknown host",{status:404});return z?z.apply(B):B}let G=J(A.pathname)?await D.api.handleApiRequest(f,F):await D.view.handleViewRequest(f,F);if(!z)return G;if(typeof G==="function"){let B=G;return async(...M)=>z.apply(await B(...M))}return z.apply(G)})}dispatchJob(f,A){return this.kernel.run.bind(this.kernel)(()=>{return this.kernel.queue().dispatchJob(f,A)})}shutdown(f){return this.kernel.shutdown(f)}destroy(){this.kernel.destroy()}clone(){return Object.assign(Object.create(Object.getPrototypeOf(this)),this)}}export{L as Da};
+import{Bk as J}from"./chunk-xfvegbxn.js";class L{kernel;onException;constructor(f){this.kernel=new f.kernel,this.kernel.boot.call(this.kernel),this.onException=f.onException??((A)=>{console.error("Unhandled exception in App:",A)})}async waitForBoot(){await this.kernel.waitForBoot()}getComponentTree(){return this.kernel.viewRoutes().componentTree}getFlatComponentTree(){let f=new Set;for(let A of this.kernel.domains().viewDispatchers())for(let C of A.flatComponentTree)f.add(C);return Array.from(f)}devAllowedHosts(){let f=this.kernel.domains();if(!f.resolver)return[];return f.acceptsCustomDomains?!0:[`.${f.resolver.root}`]}sockets(){return this.kernel.sockets.call(this.kernel)}getRouteManifest(){return this.kernel.viewRoutes().routeManifest}globallyGated=new WeakMap;async withGlobalMiddleware(f,A,C){let z;try{z=await this.kernel.run.call(this.kernel,()=>this.kernel.globalMiddleware(f))}catch(F){return await C(F)}if(z.refusal)return z.refusal;return this.globallyGated.set(f,z.carried),z.apply(await A(f))}async fetch(f){let A=new URL(f.url);return this.kernel.run.call(this.kernel,async()=>{let C=this.globallyGated.has(f),z=C?null:await this.kernel.globalMiddleware(f),F=C?this.globallyGated.get(f):z.carried;if(z?.refusal)return z.refusal;let H=this.kernel.mcpHttp();if(H){let B=await H.handle(f);if(B)return z?z.apply(B):B}let I=this.kernel.domains(),D=await I.ask(f)??await I.route(f);if(D instanceof Response)return z?z.apply(D):D;if(!D){let B=new Response("Unknown host",{status:404});return z?z.apply(B):B}let G=J(A.pathname)?await D.api.handleApiRequest(f,F):await D.view.handleViewRequest(f,F);if(!z)return G;if(typeof G==="function"){let B=G;return async(...M)=>z.apply(await B(...M))}return z.apply(G)})}dispatchJob(f,A){return this.kernel.run.bind(this.kernel)(()=>{return this.kernel.queue().dispatchJob(f,A)})}shutdown(f){return this.kernel.shutdown(f)}destroy(){this.kernel.destroy()}clone(){return Object.assign(Object.create(Object.getPrototypeOf(this)),this)}}export{L as Da};
 
-//# debugId=9D2F072A5F2276B664756E2164756E21
+//# debugId=53C91B0427828DFF64756E2164756E21

package/dist/{chunk-jctb7v53.js.map → chunk-p7mvp5nf.js.map}

@@ -5,6 +5,6 @@
     "import type { Kernel } from \"../kernel\";\nimport type { CarriedContext } from \"../http/requestContext\";\nimport { isApiPath } from \"../services/router/apiPath\";\nimport type { SocketHub } from \"../services/broadcast/SocketHub\";\n\n/** What the servers use of the broadcast `SocketHub`. */\nexport type SocketTransport = Pick<\n  SocketHub,\n  \"matches\" | \"upgrade\" | \"websocket\" | \"socketOptions\" | \"start\" | \"shutdown\"\n>;\n\ninterface AppParams {\n  kernel: new () => Kernel;\n  onException?: (error: Error) => void;\n}\n\nexport class App {\n  private kernel: Kernel;\n  public onException?: (error: Error) => void;\n\n  constructor(params: AppParams) {\n    this.kernel = new params.kernel();\n    this.kernel.boot.call(this.kernel);\n    this.onException =\n      params.onException ??\n      ((error: Error) => {\n        console.error(\"Unhandled exception in App:\", error);\n      });\n  }\n\n  // Every service this class touches is resolved through a `this.kernel.*`\n  // accessor rather than by importing the service class and calling `app()`\n  // here. That is deliberate: the built bin (`dist/bin/gemi.js`) bundles its own\n  // copy of gemi, while the app's Kernel is loaded from source and resolves\n  // `gemi/*` to the source modules — so the two copies have *different*\n  // `kernelContext` AsyncLocalStorage instances and different `Application`\n  // class objects. A method call on the Kernel executes in the app's copy and\n  // reads the app's container; a resolution attempted here would not. Service\n  // *tokens* still cross the boundary safely (they are plain strings), which is\n  // why `kernel.resolve()` works from either side.\n  public async waitForBoot() {\n    await this.kernel.waitForBoot();\n  }\n\n  public getComponentTree() {\n    return this.kernel.viewRoutes().componentTree;\n  }\n\n  // Every host group's views, not just the root's: the servers load these\n  // modules up front, and a view only an `admin.` group routes to still has\n  // to be among them.\n  public getFlatComponentTree() {\n    const views = new Set<string>();\n    for (const dispatcher of this.kernel.domains().viewDispatchers()) {\n      for (const view of dispatcher.flatComponentTree) {\n        views.add(view);\n      }\n    }\n    return Array.from(views);\n  }\n\n  /**\n   * The hosts the dev server's Vite may answer: the `route.domains` root and\n   * its subdomains, or any host when custom domains are on, since those are\n   * only known to the app's resolver.\n   */\n  public devAllowedHosts(): true | string[] {\n    const domains = this.kernel.domains();\n    if (!domains.resolver) {\n      return [];\n    }\n    return domains.acceptsCustomDomains ? true : [`.${domains.resolver.root}`];\n  }\n\n  /**\n   * The broadcast WebSocket endpoint the servers wire into `Bun.serve`, or\n   * `null` when the app has no `route.channels`. Typed structurally: the hub\n   * belongs to the app's copy of gemi (see the note above).\n   */\n  public sockets(): SocketTransport | null {\n    return this.kernel.sockets.call(this.kernel);\n  }\n\n  public getRouteManifest() {\n    return this.kernel.viewRoutes().routeManifest;\n  }\n\n  // Requests `withGlobalMiddleware` already ran the global middleware for, so\n  // `fetch` inside it does not run the list a second time, and can still hand\n  // the route what the list carried. Keyed by the Request object: the servers\n  // hand `fetch` the same one they gated.\n  private globallyGated = new WeakMap<Request, CarriedContext | null>();\n\n  /**\n   * Runs the `global` middleware list, then `next` — what the servers put in\n   * front of everything they serve, so the list covers static files, which\n   * never reach `fetch`, as well as routes. A refusal is answered without\n   * calling `next`. A global middleware that throws something other than a\n   * break is answered by `onError` rather than by `next`, since a gate that\n   * failed must not let a static file through.\n   */\n  public async withGlobalMiddleware(\n    req: Request,\n    next: (req: Request) => Promise<Response>,\n    onError: (err: unknown) => Response | Promise<Response>,\n  ): Promise<Response> {\n    let outcome: Awaited<ReturnType<Kernel[\"globalMiddleware\"]>>;\n    try {\n      outcome = await this.kernel.run.call(this.kernel, () => this.kernel.globalMiddleware(req));\n    } catch (err) {\n      return await onError(err);\n    }\n    if (outcome.refusal) {\n      return outcome.refusal;\n    }\n    this.globallyGated.set(req, outcome.carried);\n    return outcome.apply(await next(req));\n  }\n\n  public async fetch(req: Request): Promise<Response> {\n    const url = new URL(req.url);\n    return this.kernel.run.call(this.kernel, async () => {\n      // Run here too for a caller that is not one of the servers, a test or an\n      // app's own `Bun.serve`, so the list is not skipped by calling `fetch`.\n      const gated = this.globallyGated.has(req);\n      const outcome = gated ? null : await this.kernel.globalMiddleware(req);\n      const carried = gated ? this.globallyGated.get(req) : outcome.carried;\n      if (outcome?.refusal) {\n        return outcome.refusal;\n      }\n      // The MCP endpoint, and its OAuth endpoints, on the host it is\n      // configured for. Ahead of routing, so no route can shadow it, and after\n      // the global middleware, which covers it as it covers everything.\n      const mcp = this.kernel.mcpHttp();\n      if (mcp) {\n        const answered = await mcp.handle(req);\n        if (answered) {\n          return outcome ? outcome.apply(answered) : answered;\n        }\n      }\n      const domains = this.kernel.domains();\n      const dispatchers = (await domains.ask(req)) ?? (await domains.route(req));\n      if (dispatchers instanceof Response) {\n        return outcome ? outcome.apply(dispatchers) : dispatchers;\n      }\n      if (!dispatchers) {\n        const unknown = new Response(\"Unknown host\", { status: 404 });\n        return outcome ? outcome.apply(unknown) : unknown;\n      }\n      const result = isApiPath(url.pathname)\n        ? await dispatchers.api.handleApiRequest(req, carried)\n        : await dispatchers.view.handleViewRequest(req, carried);\n      if (!outcome) {\n        return result;\n      }\n      // A document comes back as a render function the server calls with its\n      // manifests, and the Response only exists once it has.\n      if (typeof result === \"function\") {\n        const render = result as (...args: any[]) => Promise<Response>;\n        return (async (...args: any[]) => outcome.apply(await render(...args))) as any;\n      }\n      return outcome.apply(result);\n    });\n  }\n\n  public dispatchJob(jobName: string, args: string) {\n    const kernelRun = this.kernel.run.bind(this.kernel);\n    return kernelRun(() => {\n      return this.kernel.queue().dispatchJob(jobName, args);\n    });\n  }\n\n  /** Every provider's `shutdown()`; see `Kernel.shutdown`. */\n  public shutdown(options?: { timeoutMs?: number }) {\n    return this.kernel.shutdown(options);\n  }\n\n  public destroy() {\n    this.kernel.destroy();\n  }\n\n  public clone() {\n    return Object.assign(Object.create(Object.getPrototypeOf(this)), this);\n  }\n}\n\nexport type FetchHandler = InstanceType<typeof App>[\"fetch\"];\n"
   ],
   "mappings": ";yCAgBO,MAAM,CAAI,CACP,OACD,YAEP,WAAW,CAAC,EAAmB,CAC7B,KAAK,OAAS,IAAI,EAAO,OACzB,KAAK,OAAO,KAAK,KAAK,KAAK,MAAM,EACjC,KAAK,YACH,EAAO,cACN,CAAC,IAAiB,CACjB,QAAQ,MAAM,8BAA+B,CAAK,SAc3C,YAAW,EAAG,CACzB,MAAM,KAAK,OAAO,YAAY,EAGzB,gBAAgB,EAAG,CACxB,OAAO,KAAK,OAAO,WAAW,EAAE,cAM3B,oBAAoB,EAAG,CAC5B,IAAM,EAAQ,IAAI,IAClB,QAAW,KAAc,KAAK,OAAO,QAAQ,EAAE,gBAAgB,EAC7D,QAAW,KAAQ,EAAW,kBAC5B,EAAM,IAAI,CAAI,EAGlB,OAAO,MAAM,KAAK,CAAK,EAQlB,eAAe,EAAoB,CACxC,IAAM,EAAU,KAAK,OAAO,QAAQ,EACpC,GAAI,CAAC,EAAQ,SACX,MAAO,CAAC,EAEV,OAAO,EAAQ,qBAAuB,GAAO,CAAC,IAAI,EAAQ,SAAS,MAAM,EAQpE,OAAO,EAA2B,CACvC,OAAO,KAAK,OAAO,QAAQ,KAAK,KAAK,MAAM,EAGtC,gBAAgB,EAAG,CACxB,OAAO,KAAK,OAAO,WAAW,EAAE,cAO1B,cAAgB,IAAI,aAUf,qBAAoB,CAC/B,EACA,EACA,EACmB,CACnB,IAAI,EACJ,GAAI,CACF,EAAU,MAAM,KAAK,OAAO,IAAI,KAAK,KAAK,OAAQ,IAAM,KAAK,OAAO,iBAAiB,CAAG,CAAC,EACzF,MAAO,EAAK,CACZ,OAAO,MAAM,EAAQ,CAAG,EAE1B,GAAI,EAAQ,QACV,OAAO,EAAQ,QAGjB,OADA,KAAK,cAAc,IAAI,EAAK,EAAQ,OAAO,EACpC,EAAQ,MAAM,MAAM,EAAK,CAAG,CAAC,OAGzB,MAAK,CAAC,EAAiC,CAClD,IAAM,EAAM,IAAI,IAAI,EAAI,GAAG,EAC3B,OAAO,KAAK,OAAO,IAAI,KAAK,KAAK,OAAQ,SAAY,CAGnD,IAAM,EAAQ,KAAK,cAAc,IAAI,CAAG,EAClC,EAAU,EAAQ,KAAO,MAAM,KAAK,OAAO,iBAAiB,CAAG,EAC/D,EAAU,EAAQ,KAAK,cAAc,IAAI,CAAG,EAAI,EAAQ,QAC9D,GAAI,GAAS,QACX,OAAO,EAAQ,QAKjB,IAAM,EAAM,KAAK,OAAO,QAAQ,EAChC,GAAI,EAAK,CACP,IAAM,EAAW,MAAM,EAAI,OAAO,CAAG,EACrC,GAAI,EACF,OAAO,EAAU,EAAQ,MAAM,CAAQ,EAAI,EAG/C,IAAM,EAAU,KAAK,OAAO,QAAQ,EAC9B,EAAe,MAAM,EAAQ,IAAI,CAAG,GAAO,MAAM,EAAQ,MAAM,CAAG,EACxE,GAAI,aAAuB,SACzB,OAAO,EAAU,EAAQ,MAAM,CAAW,EAAI,EAEhD,GAAI,CAAC,EAAa,CAChB,IAAM,EAAU,IAAI,SAAS,eAAgB,CAAE,OAAQ,GAAI,CAAC,EAC5D,OAAO,EAAU,EAAQ,MAAM,CAAO,EAAI,EAE5C,IAAM,EAAS,EAAU,EAAI,QAAQ,EACjC,MAAM,EAAY,IAAI,iBAAiB,EAAK,CAAO,EACnD,MAAM,EAAY,KAAK,kBAAkB,EAAK,CAAO,EACzD,GAAI,CAAC,EACH,OAAO,EAIT,GAAI,OAAO,IAAW,WAAY,CAChC,IAAM,EAAS,EACf,MAAQ,UAAU,IAAgB,EAAQ,MAAM,MAAM,EAAO,GAAG,CAAI,CAAC,EAEvE,OAAO,EAAQ,MAAM,CAAM,EAC5B,EAGI,WAAW,CAAC,EAAiB,EAAc,CAEhD,OADkB,KAAK,OAAO,IAAI,KAAK,KAAK,MAAM,EACjC,IAAM,CACrB,OAAO,KAAK,OAAO,MAAM,EAAE,YAAY,EAAS,CAAI,EACrD,EAII,QAAQ,CAAC,EAAkC,CAChD,OAAO,KAAK,OAAO,SAAS,CAAO,EAG9B,OAAO,EAAG,CACf,KAAK,OAAO,QAAQ,EAGf,KAAK,EAAG,CACb,OAAO,OAAO,OAAO,OAAO,OAAO,OAAO,eAAe,IAAI,CAAC,EAAG,IAAI,EAEzE",
-  "debugId": "9D2F072A5F2276B664756E2164756E21",
+  "debugId": "53C91B0427828DFF64756E2164756E21",
   "names": []
 }

package/dist/{chunk-jys8y39p.js → chunk-q6ah4yjg.js}

@@ -1,5 +1,5 @@
 // @bun
-import{Q as ne}from"./chunk-fn2qfwgx.js";import{_ as C}from"./chunk-b5afy6k9.js";import"./chunk-121p4g9j.js";import{aa as _}from"./chunk-kzsjyvvc.js";import{Jj as c,Nj as F}from"./chunk-17dndh5z.js";var x=c(_(),1),T=c(C(),1);var q=(e)=>e&&(typeof e.sso_start_url==="string"||typeof e.sso_account_id==="string"||typeof e.sso_session==="string"||typeof e.sso_region==="string"||typeof e.sso_role_name==="string");var D=c(ne(),1);var u=c(_(),1),m=c(C(),1);var W=300000,h="To refresh this SSO session run 'aws sso login' with the corresponding profile.";var j=async(e,o={},r)=>{let{SSOOIDCClient:t}=await import("./chunk-v2ggafz1.js").then((m)=>c(m.default,1)),n=(f)=>o.clientConfig?.[f]??o.parentClientConfig?.[f]??r?.[f];return new t(Object.assign({},o.clientConfig??{},{region:e??o.clientConfig?.region,logger:n("logger"),userAgentAppId:n("userAgentAppId")}))};var X=async(e,o,r={},t)=>{let{CreateTokenCommand:n}=await import("./chunk-v2ggafz1.js").then((m)=>c(m.default,1));return(await j(o,r,t)).send(new n({clientId:e.clientId,clientSecret:e.clientSecret,refreshToken:e.refreshToken,grantType:"refresh_token"}))};var z=c(_(),1);var P=(e)=>{if(e.expiration&&e.expiration.getTime()<Date.now())throw new z.TokenProviderError(`Token is expired. ${h}`,!1)};var J=c(_(),1);var g=(e,o,r=!1)=>{if(typeof o>"u")throw new J.TokenProviderError(`Value not present for '${e}' in SSO Token${r?". Cannot refresh":""}. ${h}`,!1)};var V=c(C(),1);import{promises as re}from"fs";var{writeFile:te}=re,Y=(e,o)=>{let r=V.getSSOTokenFilepath(e),t=JSON.stringify(o,null,2);return te(r,t)};var B=new Date(0),Q=(e={})=>async({callerClientConfig:o}={})=>{e.logger?.debug("@aws-sdk/token-providers - fromSso");let r=await m.parseKnownFiles(e),t=m.getProfileName({profile:e.profile??o?.profile}),n=r[t];if(!n)throw new u.TokenProviderError(`Profile '${t}' could not be found in shared credentials file.`,!1);else if(!n.sso_session)throw new u.TokenProviderError(`Profile '${t}' is missing required property 'sso_session'.`);let a=n.sso_session,p=(await m.loadSsoSessionData(e))[a];if(!p)throw new u.TokenProviderError(`Sso session '${a}' could not be found in shared credentials file.`,!1);for(let i of["sso_start_url","sso_region"])if(!p[i])throw new u.TokenProviderError(`Sso session '${a}' is missing required property '${i}'.`,!1);let{sso_start_url:S,sso_region:I}=p,s;try{s=await m.getSSOTokenFromFile(a)}catch(i){throw new u.TokenProviderError(`The SSO session token associated with profile=${t} was not found or is invalid. ${h}`,!1)}g("accessToken",s.accessToken),g("expiresAt",s.expiresAt);let{accessToken:y,expiresAt:E}=s,l={token:y,expiration:new Date(E)};if(l.expiration.getTime()-Date.now()>W)return l;if(Date.now()-B.getTime()<30000)return P(l),l;g("clientId",s.clientId,!0),g("clientSecret",s.clientSecret,!0),g("refreshToken",s.refreshToken,!0);try{B.setTime(Date.now());let i=await X(s,I,e,o);g("accessToken",i.accessToken),g("expiresIn",i.expiresIn);let O=new Date(Date.now()+i.expiresIn*1000);try{await Y(a,{...s,accessToken:i.accessToken,expiresAt:O.toISOString(),refreshToken:i.refreshToken})}catch(R){}return{token:i.accessToken,expiration:O}}catch(i){return P(l),l}};var k=c(_(),1),Z=c(C(),1),A=!1,$=async({ssoStartUrl:e,ssoSession:o,ssoAccountId:r,ssoRegion:t,ssoRoleName:n,ssoClient:a,clientConfig:f,parentClientConfig:p,callerClientConfig:S,profile:I,filepath:s,configFilepath:y,ignoreCache:E,logger:l})=>{let i,O="To refresh this SSO session run aws sso login with the corresponding profile.";if(o)try{let w=await Q({profile:I,filepath:s,configFilepath:y,ignoreCache:E})();i={accessToken:w.token,expiresAt:new Date(w.expiration).toISOString()}}catch(w){throw new k.CredentialsProviderError(w.message,{tryNextLink:A,logger:l})}else try{i=await Z.getSSOTokenFromFile(e)}catch(w){throw new k.CredentialsProviderError("The SSO session associated with this profile is invalid. To refresh this SSO session run aws sso login with the corresponding profile.",{tryNextLink:A,logger:l})}if(new Date(i.expiresAt).getTime()-Date.now()<=0)throw new k.CredentialsProviderError("The SSO session associated with this profile has expired. To refresh this SSO session run aws sso login with the corresponding profile.",{tryNextLink:A,logger:l});let{accessToken:R}=i,{SSOClient:d,GetRoleCredentialsCommand:N}=await import("./chunk-8m2htvjn.js"),se=a||new d(Object.assign({},f??{},{logger:f?.logger??S?.logger??p?.logger,region:f?.region??t,userAgentAppId:f?.userAgentAppId??S?.userAgentAppId??p?.userAgentAppId})),L;try{L=await se.send(new N({accountId:r,roleName:n,accessToken:R}))}catch(w){throw new k.CredentialsProviderError(w,{tryNextLink:A,logger:l})}let{roleCredentials:{accessKeyId:M,secretAccessKey:G,sessionToken:K,expiration:b,credentialScope:H,accountId:U}={}}=L;if(!M||!G||!K||!b)throw new k.CredentialsProviderError("SSO returns an invalid temporary credential.",{tryNextLink:A,logger:l});let v={accessKeyId:M,secretAccessKey:G,sessionToken:K,expiration:new Date(b),...H&&{credentialScope:H},...U&&{accountId:U}};if(o)D.setCredentialFeature(v,"CREDENTIALS_SSO","s");else D.setCredentialFeature(v,"CREDENTIALS_SSO_LEGACY","u");return v};var ee=c(_(),1),oe=(e,o)=>{let{sso_start_url:r,sso_account_id:t,sso_region:n,sso_role_name:a}=e;if(!r||!t||!n||!a)throw new ee.CredentialsProviderError(`Profile is configured with invalid SSO credentials. Required parameters "sso_account_id", "sso_region", "sso_role_name", "sso_start_url". Got ${Object.keys(e).join(", ")}
+import{Q as ne}from"./chunk-6vz75swk.js";import{_ as C}from"./chunk-knq4ack4.js";import"./chunk-m7pghdcy.js";import{aa as _}from"./chunk-7zj6bk9a.js";import{Dk as c,Hk as F}from"./chunk-hxn0s3zh.js";var x=c(_(),1),T=c(C(),1);var q=(e)=>e&&(typeof e.sso_start_url==="string"||typeof e.sso_account_id==="string"||typeof e.sso_session==="string"||typeof e.sso_region==="string"||typeof e.sso_role_name==="string");var D=c(ne(),1);var u=c(_(),1),m=c(C(),1);var W=300000,h="To refresh this SSO session run 'aws sso login' with the corresponding profile.";var j=async(e,o={},r)=>{let{SSOOIDCClient:t}=await import("./chunk-ey1xrbaz.js").then((m)=>c(m.default,1)),n=(f)=>o.clientConfig?.[f]??o.parentClientConfig?.[f]??r?.[f];return new t(Object.assign({},o.clientConfig??{},{region:e??o.clientConfig?.region,logger:n("logger"),userAgentAppId:n("userAgentAppId")}))};var X=async(e,o,r={},t)=>{let{CreateTokenCommand:n}=await import("./chunk-ey1xrbaz.js").then((m)=>c(m.default,1));return(await j(o,r,t)).send(new n({clientId:e.clientId,clientSecret:e.clientSecret,refreshToken:e.refreshToken,grantType:"refresh_token"}))};var z=c(_(),1);var P=(e)=>{if(e.expiration&&e.expiration.getTime()<Date.now())throw new z.TokenProviderError(`Token is expired. ${h}`,!1)};var J=c(_(),1);var g=(e,o,r=!1)=>{if(typeof o>"u")throw new J.TokenProviderError(`Value not present for '${e}' in SSO Token${r?". Cannot refresh":""}. ${h}`,!1)};var V=c(C(),1);import{promises as re}from"fs";var{writeFile:te}=re,Y=(e,o)=>{let r=V.getSSOTokenFilepath(e),t=JSON.stringify(o,null,2);return te(r,t)};var B=new Date(0),Q=(e={})=>async({callerClientConfig:o}={})=>{e.logger?.debug("@aws-sdk/token-providers - fromSso");let r=await m.parseKnownFiles(e),t=m.getProfileName({profile:e.profile??o?.profile}),n=r[t];if(!n)throw new u.TokenProviderError(`Profile '${t}' could not be found in shared credentials file.`,!1);else if(!n.sso_session)throw new u.TokenProviderError(`Profile '${t}' is missing required property 'sso_session'.`);let a=n.sso_session,p=(await m.loadSsoSessionData(e))[a];if(!p)throw new u.TokenProviderError(`Sso session '${a}' could not be found in shared credentials file.`,!1);for(let i of["sso_start_url","sso_region"])if(!p[i])throw new u.TokenProviderError(`Sso session '${a}' is missing required property '${i}'.`,!1);let{sso_start_url:S,sso_region:I}=p,s;try{s=await m.getSSOTokenFromFile(a)}catch(i){throw new u.TokenProviderError(`The SSO session token associated with profile=${t} was not found or is invalid. ${h}`,!1)}g("accessToken",s.accessToken),g("expiresAt",s.expiresAt);let{accessToken:y,expiresAt:E}=s,l={token:y,expiration:new Date(E)};if(l.expiration.getTime()-Date.now()>W)return l;if(Date.now()-B.getTime()<30000)return P(l),l;g("clientId",s.clientId,!0),g("clientSecret",s.clientSecret,!0),g("refreshToken",s.refreshToken,!0);try{B.setTime(Date.now());let i=await X(s,I,e,o);g("accessToken",i.accessToken),g("expiresIn",i.expiresIn);let O=new Date(Date.now()+i.expiresIn*1000);try{await Y(a,{...s,accessToken:i.accessToken,expiresAt:O.toISOString(),refreshToken:i.refreshToken})}catch(R){}return{token:i.accessToken,expiration:O}}catch(i){return P(l),l}};var k=c(_(),1),Z=c(C(),1),A=!1,$=async({ssoStartUrl:e,ssoSession:o,ssoAccountId:r,ssoRegion:t,ssoRoleName:n,ssoClient:a,clientConfig:f,parentClientConfig:p,callerClientConfig:S,profile:I,filepath:s,configFilepath:y,ignoreCache:E,logger:l})=>{let i,O="To refresh this SSO session run aws sso login with the corresponding profile.";if(o)try{let w=await Q({profile:I,filepath:s,configFilepath:y,ignoreCache:E})();i={accessToken:w.token,expiresAt:new Date(w.expiration).toISOString()}}catch(w){throw new k.CredentialsProviderError(w.message,{tryNextLink:A,logger:l})}else try{i=await Z.getSSOTokenFromFile(e)}catch(w){throw new k.CredentialsProviderError("The SSO session associated with this profile is invalid. To refresh this SSO session run aws sso login with the corresponding profile.",{tryNextLink:A,logger:l})}if(new Date(i.expiresAt).getTime()-Date.now()<=0)throw new k.CredentialsProviderError("The SSO session associated with this profile has expired. To refresh this SSO session run aws sso login with the corresponding profile.",{tryNextLink:A,logger:l});let{accessToken:R}=i,{SSOClient:d,GetRoleCredentialsCommand:N}=await import("./chunk-hzen9gh4.js"),se=a||new d(Object.assign({},f??{},{logger:f?.logger??S?.logger??p?.logger,region:f?.region??t,userAgentAppId:f?.userAgentAppId??S?.userAgentAppId??p?.userAgentAppId})),L;try{L=await se.send(new N({accountId:r,roleName:n,accessToken:R}))}catch(w){throw new k.CredentialsProviderError(w,{tryNextLink:A,logger:l})}let{roleCredentials:{accessKeyId:M,secretAccessKey:G,sessionToken:K,expiration:b,credentialScope:H,accountId:U}={}}=L;if(!M||!G||!K||!b)throw new k.CredentialsProviderError("SSO returns an invalid temporary credential.",{tryNextLink:A,logger:l});let v={accessKeyId:M,secretAccessKey:G,sessionToken:K,expiration:new Date(b),...H&&{credentialScope:H},...U&&{accountId:U}};if(o)D.setCredentialFeature(v,"CREDENTIALS_SSO","s");else D.setCredentialFeature(v,"CREDENTIALS_SSO_LEGACY","u");return v};var ee=c(_(),1),oe=(e,o)=>{let{sso_start_url:r,sso_account_id:t,sso_region:n,sso_role_name:a}=e;if(!r||!t||!n||!a)throw new ee.CredentialsProviderError(`Profile is configured with invalid SSO credentials. Required parameters "sso_account_id", "sso_region", "sso_role_name", "sso_start_url". Got ${Object.keys(e).join(", ")}
 Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html`,{tryNextLink:!1,logger:o});return e};var Ce=(e={})=>async({callerClientConfig:o}={})=>{e.logger?.debug("@aws-sdk/credential-provider-sso - fromSSO");let{ssoStartUrl:r,ssoAccountId:t,ssoRegion:n,ssoRoleName:a,ssoSession:f}=e,{ssoClient:p}=e,S=T.getProfileName({profile:e.profile??o?.profile});if(!r&&!t&&!n&&!a&&!f){let s=(await T.parseKnownFiles(e))[S];if(!s)throw new x.CredentialsProviderError(`Profile ${S} was not found.`,{logger:e.logger});if(!q(s))throw new x.CredentialsProviderError(`Profile ${S} is not configured with SSO credentials.`,{logger:e.logger});if(s?.sso_session){let d=(await T.loadSsoSessionData(e))[s.sso_session],N=` configurations in profile ${S} and sso-session ${s.sso_session}`;if(n&&n!==d.sso_region)throw new x.CredentialsProviderError("Conflicting SSO region"+N,{tryNextLink:!1,logger:e.logger});if(r&&r!==d.sso_start_url)throw new x.CredentialsProviderError("Conflicting SSO start_url"+N,{tryNextLink:!1,logger:e.logger});s.sso_region=d.sso_region,s.sso_start_url=d.sso_start_url}let{sso_start_url:y,sso_account_id:E,sso_region:l,sso_role_name:i,sso_session:O}=oe(s,e.logger);return $({ssoStartUrl:y,ssoSession:O,ssoAccountId:E,ssoRegion:l,ssoRoleName:i,ssoClient:p,clientConfig:e.clientConfig,parentClientConfig:e.parentClientConfig,callerClientConfig:e.callerClientConfig,profile:S,filepath:e.filepath,configFilepath:e.configFilepath,ignoreCache:e.ignoreCache,logger:e.logger})}else if(!r||!t||!n||!a)throw new x.CredentialsProviderError('Incomplete configuration. The fromSSO() argument hash must include "ssoStartUrl", "ssoAccountId", "ssoRegion", "ssoRoleName"',{tryNextLink:!1,logger:e.logger});else return $({ssoStartUrl:r,ssoSession:f,ssoAccountId:t,ssoRegion:n,ssoRoleName:a,ssoClient:p,clientConfig:e.clientConfig,parentClientConfig:e.parentClientConfig,callerClientConfig:e.callerClientConfig,profile:S,filepath:e.filepath,configFilepath:e.configFilepath,ignoreCache:e.ignoreCache,logger:e.logger})};export{oe as validateSsoProfile,q as isSsoProfile,Ce as fromSSO};
 
-//# debugId=BBB530E6EFEC9F4F64756E2164756E21
+//# debugId=1D86C09A11E8C8CE64756E2164756E21

package/dist/{chunk-jys8y39p.js.map → chunk-q6ah4yjg.js.map}

@@ -15,6 +15,6 @@
     "import { CredentialsProviderError } from \"@smithy/property-provider\";\nexport const validateSsoProfile = (profile, logger) => {\n    const { sso_start_url, sso_account_id, sso_region, sso_role_name } = profile;\n    if (!sso_start_url || !sso_account_id || !sso_region || !sso_role_name) {\n        throw new CredentialsProviderError(`Profile is configured with invalid SSO credentials. Required parameters \"sso_account_id\", ` +\n            `\"sso_region\", \"sso_role_name\", \"sso_start_url\". Got ${Object.keys(profile).join(\", \")}\\nReference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html`, { tryNextLink: false, logger });\n    }\n    return profile;\n};\n"
   ],
   "mappings": ";+NAAA,SACA,KCDO,FAAM,JAAe,CAAC,IAAQ,IAChC,OAAO,EAAI,gBAAkB,UAC1B,OAAO,EAAI,iBAAmB,UAC9B,OAAO,EAAI,cAAgB,UAC3B,OAAO,EAAI,aAAe,UAC1B,OAAO,EAAI,gBAAkB,UCLrC,gBCAA,eACA,WCDO,IAAM,EAAmB,OACnB,EAAkB,kFCDxB,IAAM,EAAmB,MAAO,EAAW,EAAO,CAAC,EAAG,IAAuB,CAChF,IAAQ,iBAAkB,KAAa,yDACjC,EAAW,CAAC,IAAS,EAAK,eAAe,IAAS,EAAK,qBAAqB,IAAS,IAAqB,GAMhH,OALsB,IAAI,EAAc,OAAO,OAAO,CAAC,EAAG,EAAK,cAAgB,CAAC,EAAG,CAC/E,OAAQ,GAAa,EAAK,cAAc,OACxC,OAAQ,EAAS,QAAQ,EACzB,eAAgB,EAAS,gBAAgB,CAC7C,CAAC,CAAC,GCNC,IAAM,EAAqB,MAAO,EAAU,EAAW,EAAO,CAAC,EAAG,IAAuB,CAC5F,IAAQ,sBAAuB,KAAa,yDAE5C,OADsB,MAAM,EAAiB,EAAW,EAAM,CAAkB,GAC3D,KAAK,IAAI,EAAmB,CAC7C,SAAU,EAAS,SACnB,aAAc,EAAS,aACvB,aAAc,EAAS,aACvB,UAAW,eACf,CAAC,CAAC,GCTN,eAEO,IAAM,EAAsB,CAAC,IAAU,CAC1C,GAAI,EAAM,YAAc,EAAM,WAAW,QAAQ,EAAI,KAAK,IAAI,EAC1D,MAAM,IAAI,qBAAmB,qBAAqB,IAAmB,EAAK,GCJlF,eAEO,IAAM,EAAmB,CAAC,EAAK,EAAO,EAAa,KAAU,CAChE,GAAI,OAAO,EAAU,IACjB,MAAM,IAAI,qBAAmB,0BAA0B,kBAAoB,EAAa,mBAAqB,OAAO,IAAmB,EAAK,GCJpJ,eACA,mBAAS,YACT,IAAQ,cAAc,GACT,EAAsB,CAAC,EAAI,IAAa,CACjD,IAAM,EAAgB,sBAAoB,CAAE,EACtC,EAAc,KAAK,UAAU,EAAU,KAAM,CAAC,EACpD,OAAO,GAAU,EAAe,CAAW,GNC/C,IAAM,EAAyB,IAAI,KAAK,CAAC,EAC5B,EAAU,CAAC,EAAO,CAAC,IAAM,OAAS,sBAAuB,CAAC,IAAM,CACzE,EAAK,QAAQ,MAAM,oCAAoC,EACvD,IAAM,EAAW,MAAM,kBAAgB,CAAI,EACrC,EAAc,iBAAe,CAC/B,QAAS,EAAK,SAAW,GAAoB,OACjD,CAAC,EACK,EAAU,EAAS,GACzB,GAAI,CAAC,EACD,MAAM,IAAI,qBAAmB,YAAY,oDAA+D,EAAK,EAE5G,QAAI,CAAC,EAAQ,YACd,MAAM,IAAI,qBAAmB,YAAY,gDAA0D,EAEvG,IAAM,EAAiB,EAAQ,YAEzB,GADc,MAAM,qBAAmB,CAAI,GAClB,GAC/B,GAAI,CAAC,EACD,MAAM,IAAI,qBAAmB,gBAAgB,oDAAkE,EAAK,EAExH,QAAW,IAAyB,CAAC,gBAAiB,YAAY,EAC9D,GAAI,CAAC,EAAW,GACZ,MAAM,IAAI,qBAAmB,gBAAgB,oCAAiD,MAA2B,EAAK,EAGtI,IAA+B,cAAzB,EACuB,WAAvB,GAAY,EACd,EACJ,GAAI,CACA,EAAW,MAAM,sBAAoB,CAAc,EAEvD,MAAO,EAAG,CACN,MAAM,IAAI,qBAAmB,iDAAiD,kCAA4C,IAAmB,EAAK,EAEtJ,EAAiB,cAAe,EAAS,WAAW,EACpD,EAAiB,YAAa,EAAS,SAAS,EAChD,IAAQ,cAAa,aAAc,EAC7B,EAAgB,CAAE,MAAO,EAAa,WAAY,IAAI,KAAK,CAAS,CAAE,EAC5E,GAAI,EAAc,WAAW,QAAQ,EAAI,KAAK,IAAI,EAAI,EAClD,OAAO,EAEX,GAAI,KAAK,IAAI,EAAI,EAAuB,QAAQ,EAAI,MAEhD,OADA,EAAoB,CAAa,EAC1B,EAEX,EAAiB,WAAY,EAAS,SAAU,EAAI,EACpD,EAAiB,eAAgB,EAAS,aAAc,EAAI,EAC5D,EAAiB,eAAgB,EAAS,aAAc,EAAI,EAC5D,GAAI,CACA,EAAuB,QAAQ,KAAK,IAAI,CAAC,EACzC,IAAM,EAAkB,MAAM,EAAmB,EAAU,EAAW,EAAM,CAAkB,EAC9F,EAAiB,cAAe,EAAgB,WAAW,EAC3D,EAAiB,YAAa,EAAgB,SAAS,EACvD,IAAM,EAAqB,IAAI,KAAK,KAAK,IAAI,EAAI,EAAgB,UAAY,IAAI,EACjF,GAAI,CACA,MAAM,EAAoB,EAAgB,IACnC,EACH,YAAa,EAAgB,YAC7B,UAAW,EAAmB,YAAY,EAC1C,aAAc,EAAgB,YAClC,CAAC,EAEL,MAAO,EAAO,EAEd,MAAO,CACH,MAAO,EAAgB,YACvB,WAAY,CAChB,EAEJ,MAAO,EAAO,CAEV,OADA,EAAoB,CAAa,EAC1B,ID5Ef,eACA,WACM,EAA+B,GACxB,EAAwB,OAAS,cAAa,aAAY,eAAc,YAAW,cAAa,YAAW,eAAc,qBAAoB,qBAAoB,UAAS,WAAU,iBAAgB,cAAa,YAAc,CACxO,IAAI,EACE,EAAiB,gFACvB,GAAI,EACA,GAAI,CACA,IAAM,EAAS,MAAM,EAAoB,CACrC,UACA,WACA,iBACA,aACJ,CAAC,EAAE,EACH,EAAQ,CACJ,YAAa,EAAO,MACpB,UAAW,IAAI,KAAK,EAAO,UAAU,EAAE,YAAY,CACvD,EAEJ,MAAO,EAAG,CACN,MAAM,IAAI,2BAAyB,EAAE,QAAS,CAC1C,YAAa,EACb,QACJ,CAAC,EAIL,QAAI,CACA,EAAQ,MAAM,sBAAoB,CAAW,EAEjD,MAAO,EAAG,CACN,MAAM,IAAI,2BAAyB,yIAA8E,CAC7G,YAAa,EACb,QACJ,CAAC,EAGT,GAAI,IAAI,KAAK,EAAM,SAAS,EAAE,QAAQ,EAAI,KAAK,IAAI,GAAK,EACpD,MAAM,IAAI,2BAAyB,0IAA+E,CAC9G,YAAa,EACb,QACJ,CAAC,EAEL,IAAQ,eAAgB,GAChB,YAAW,6BAA8B,KAAa,+BACxD,GAAM,GACR,IAAI,EAAU,OAAO,OAAO,CAAC,EAAG,GAAgB,CAAC,EAAG,CAChD,OAAQ,GAAc,QAAU,GAAoB,QAAU,GAAoB,OAClF,OAAQ,GAAc,QAAU,EAChC,eAAgB,GAAc,gBAAkB,GAAoB,gBAAkB,GAAoB,cAC9G,CAAC,CAAC,EACF,EACJ,GAAI,CACA,EAAU,MAAM,GAAI,KAAK,IAAI,EAA0B,CACnD,UAAW,EACX,SAAU,EACV,aACJ,CAAC,CAAC,EAEN,MAAO,EAAG,CACN,MAAM,IAAI,2BAAyB,EAAG,CAClC,YAAa,EACb,QACJ,CAAC,EAEL,IAAQ,iBAAmB,cAAa,kBAAiB,eAAc,aAAY,kBAAiB,aAAc,CAAC,GAAO,EAC1H,GAAI,CAAC,GAAe,CAAC,GAAmB,CAAC,GAAgB,CAAC,EACtD,MAAM,IAAI,2BAAyB,+CAAgD,CAC/E,YAAa,EACb,QACJ,CAAC,EAEL,IAAM,EAAc,CAChB,cACA,kBACA,eACA,WAAY,IAAI,KAAK,CAAU,KAC3B,GAAmB,CAAE,iBAAgB,KACrC,GAAa,CAAE,WAAU,CACjC,EACA,GAAI,EACA,uBAAqB,EAAa,kBAAmB,GAAG,EAGxD,4BAAqB,EAAa,yBAA0B,GAAG,EAEnE,OAAO,GQxFX,gBACa,GAAqB,CAAC,EAAS,IAAW,CACnD,IAAQ,gBAAe,iBAAgB,aAAY,iBAAkB,EACrE,GAAI,CAAC,GAAiB,CAAC,GAAkB,CAAC,GAAc,CAAC,EACrD,MAAM,IAAI,4BAAyB,iJACwB,OAAO,KAAK,CAAO,EAAE,KAAK,IAAI;AAAA,oFAAyF,CAAE,YAAa,GAAO,QAAO,CAAC,EAEpN,OAAO,GVFJ,IAAM,GAAU,CAAC,EAAO,CAAC,IAAM,OAAS,sBAAuB,CAAC,IAAM,CACzE,EAAK,QAAQ,MAAM,4CAA4C,EAC/D,IAAQ,cAAa,eAAc,YAAW,cAAa,cAAe,GAClE,aAAc,EAChB,EAAc,iBAAe,CAC/B,QAAS,EAAK,SAAW,GAAoB,OACjD,CAAC,EACD,GAAI,CAAC,GAAe,CAAC,GAAgB,CAAC,GAAa,CAAC,GAAe,CAAC,EAAY,CAE5E,IAAM,GADW,MAAM,kBAAgB,CAAI,GAClB,GACzB,GAAI,CAAC,EACD,MAAM,IAAI,2BAAyB,WAAW,mBAA8B,CAAE,OAAQ,EAAK,MAAO,CAAC,EAEvG,GAAI,CAAC,EAAa,CAAO,EACrB,MAAM,IAAI,2BAAyB,WAAW,4CAAuD,CACjG,OAAQ,EAAK,MACjB,CAAC,EAEL,GAAI,GAAS,YAAa,CAEtB,IAAM,GADc,MAAM,qBAAmB,CAAI,GACrB,EAAQ,aAC9B,EAAc,8BAA8B,qBAA+B,EAAQ,cACzF,GAAI,GAAa,IAAc,EAAQ,WACnC,MAAM,IAAI,2BAAyB,yBAA2B,EAAa,CACvE,YAAa,GACb,OAAQ,EAAK,MACjB,CAAC,EAEL,GAAI,GAAe,IAAgB,EAAQ,cACvC,MAAM,IAAI,2BAAyB,4BAA8B,EAAa,CAC1E,YAAa,GACb,OAAQ,EAAK,MACjB,CAAC,EAEL,EAAQ,WAAa,EAAQ,WAC7B,EAAQ,cAAgB,EAAQ,cAEpC,IAAQ,gBAAe,iBAAgB,aAAY,gBAAe,eAAgB,GAAmB,EAAS,EAAK,MAAM,EACzH,OAAO,EAAsB,CACzB,YAAa,EACb,WAAY,EACZ,aAAc,EACd,UAAW,EACX,YAAa,EACb,UAAW,EACX,aAAc,EAAK,aACnB,mBAAoB,EAAK,mBACzB,mBAAoB,EAAK,mBACzB,QAAS,EACT,SAAU,EAAK,SACf,eAAgB,EAAK,eACrB,YAAa,EAAK,YAClB,OAAQ,EAAK,MACjB,CAAC,EAEA,QAAI,CAAC,GAAe,CAAC,GAAgB,CAAC,GAAa,CAAC,EACrD,MAAM,IAAI,2BAAyB,+HAC8B,CAAE,YAAa,GAAO,OAAQ,EAAK,MAAO,CAAC,EAG5G,YAAO,EAAsB,CACzB,cACA,aACA,eACA,YACA,cACA,YACA,aAAc,EAAK,aACnB,mBAAoB,EAAK,mBACzB,mBAAoB,EAAK,mBACzB,QAAS,EACT,SAAU,EAAK,SACf,eAAgB,EAAK,eACrB,YAAa,EAAK,YAClB,OAAQ,EAAK,MACjB,CAAC",
-  "debugId": "BBB530E6EFEC9F4F64756E2164756E21",
+  "debugId": "1D86C09A11E8C8CE64756E2164756E21",
   "names": []
 }

package/dist/{chunk-pmyh33v5.js → chunk-r923001x.js}

@@ -1,9 +1,9 @@
 // @bun
-import{kh as l}from"./chunk-kc924zjz.js";import{sh as O,th as E,uh as k}from"./chunk-2n4490pk.js";import{Jh as T,Th as R,Vh as i,Wh as C,Xh as M,Yh as Xz}from"./chunk-96a1459v.js";import{zi as a}from"./chunk-qycwjzsv.js";var $z=["every","none","some"],Vz=["is","isNot"];function g(z){return z==="many"?$z:Vz}function h(z,J){let W=Object.keys(z);return W.length>0&&W.every((Z)=>J.includes(Z))}var m="_count";function y(z){return Object.keys(z.relations).filter((J)=>z.relations[J]?.kind==="many").sort()}function N(z,J,W,Z){let X={model:z,operation:J,hasUser:W!=null};return Object.defineProperty(X,"user",{enumerable:!0,get(){if(W==null&&!Z)throw new R(z,J,"no-user");return W}}),X}class n{}class Qz extends n{}var qz=new Set(["findMany","findFirst","findFirstOrThrow","findUnique","findUniqueOrThrow","count","aggregate","groupBy","update","updateMany","delete","deleteMany"]),Yz=new Set(["create","createMany","upsert"]),jz=new Set(["update","updateMany","upsert"]),Lz=new Set(["update","updateMany"]),Kz=new Set(["create","createMany"]),p=new WeakMap;function Gz(z,J,W){if(typeof z!=="function")return z;let Z=p.get(z);if(Z!==void 0)return Z;let X;try{X=new z}catch($){throw new M(b(J),W,"constructor-threw",`${f(z)}, and constructing it threw:
+import{di as l}from"./chunk-tabsxzg9.js";import{li as O,mi as E,ni as k}from"./chunk-y9f2see3.js";import{Ci as T,Mi as R,Oi as i,Pi as C,Qi as M,Ri as Xz}from"./chunk-ap3g6rbw.js";import{sj as a}from"./chunk-vhvvjaj3.js";var $z=["every","none","some"],Vz=["is","isNot"];function g(z){return z==="many"?$z:Vz}function h(z,J){let W=Object.keys(z);return W.length>0&&W.every((Z)=>J.includes(Z))}var m="_count";function y(z){return Object.keys(z.relations).filter((J)=>z.relations[J]?.kind==="many").sort()}function N(z,J,W,Z){let X={model:z,operation:J,hasUser:W!=null};return Object.defineProperty(X,"user",{enumerable:!0,get(){if(W==null&&!Z)throw new R(z,J,"no-user");return W}}),X}class n{}class Qz extends n{}var qz=new Set(["findMany","findFirst","findFirstOrThrow","findUnique","findUniqueOrThrow","count","aggregate","groupBy","update","updateMany","delete","deleteMany"]),Yz=new Set(["create","createMany","upsert"]),jz=new Set(["update","updateMany","upsert"]),Lz=new Set(["update","updateMany"]),Kz=new Set(["create","createMany"]),p=new WeakMap;function Gz(z,J,W){if(typeof z!=="function")return z;let Z=p.get(z);if(Z!==void 0)return Z;let X;try{X=new z}catch($){throw new M(b(J),W,"constructor-threw",`${f(z)}, and constructing it threw:
 
     ${$?.message??String($)}`,H,void 0,{cause:$})}return t(X,J,W),p.set(z,X),X}function S(z,J){return z.map((W,Z)=>Gz(W,J,Z))}var H=["before","scope","onCreate","onUpdate","redact"];var u=new WeakSet;function s(z,J){if(u.has(J))return;for(let W=0;W<J.length;W++)Uz(J[W],z,W);u.add(J)}function Uz(z,J,W){let Z=b(J),X=typeof z;if(z===null||Array.isArray(z)||X!=="object"&&X!=="function")throw new M(Z,W,"not-a-policy",o(z),H);if(X==="function"){if(!Mz(z))throw new M(Z,W,"not-constructable",f(z),H);return}t(z,J,W)}function t(z,J,W){let Z=b(J),X=0,$=[];for(let Y of H){let q=z[Y];if(q===void 0||q===null){if(Y in z)$.push(Y);continue}if(typeof q!=="function")throw new M(Z,W,"hook-not-callable",`'${Y}' that is ${o(q)} rather than a function`,H);X++}if(X>0)return;if($.length>0)throw new M(Z,W,"no-hooks",`It writes ${$.map((Y)=>`'${Y}'`).join(", ")} down and leaves ${$.length===1?"it":"them"} unset, which reads as `+"absent \u2014 so nothing is left to run.",H);let V=Fz(z),Q=Iz(V);throw new M(Z,W,"no-hooks",V.length===0?"It is empty.":`It spells ${Hz(V)}.`+(V.length===1&&V[0]==="default"?" A lone 'default' is a module namespace rather than the policy "+"inside it \u2014 put `entry.default` in the array, or import the "+"policy by name.":""),H,Q)}function Hz(z){let J=z.slice(0,8).map((W)=>`'${W}'`);return z.length>J.length?`${J.join(", ")} and ${z.length-J.length} more`:J.join(", ")}function Mz(z){try{return Reflect.construct(Bz,[],z),!0}catch{return!1}}var Bz=function(){};function Fz(z){let J=new Set,W=z;while(W!==null&&W!==Object.prototype){for(let Z of Object.getOwnPropertyNames(W))if(Z!=="constructor")J.add(Z);W=Object.getPrototypeOf(W)}return[...J]}function Iz(z){let J,W=2;for(let Z of z)for(let X of H){let $=Tz(Z.toLowerCase(),X.toLowerCase());if($<W)W=$,J={key:Z,hook:X}}return J}function Tz(z,J){if(z===J)return 0;let W=Array.from({length:J.length+1},(Z,X)=>X);for(let Z=1;Z<=z.length;Z++){let X=W[0];W[0]=Z;for(let $=1;$<=J.length;$++){let V=W[$];W[$]=Math.min(W[$]+1,W[$-1]+1,X+(z[Z-1]===J[$-1]?0:1)),X=V}}return W[J.length]}function o(z){if(z===null)return"null";if(z===void 0)return"undefined";if(typeof z==="string")return`the string ${JSON.stringify(z)}`;if(typeof z==="function")return f(z);if(Array.isArray(z))return"an array";if(typeof z==="object")return"an object";return`the ${typeof z} ${String(z)}`}function f(z){return z.name?`the function \`${z.name}\``:"an anonymous function"}function _(z){let J,W,Z,X=z;while(X&&X!==Function.prototype){if(Object.hasOwn(X,"$policy"))throw Error(`${X.name??"This model"} declares \`$policy\`, which is now \`$policies\` and takes a list. The old `+"name is not read, so this model is currently unpolicied \u2014 every "+"scope, onCreate and redact on it is being skipped.");if(Object.hasOwn(X,"$policies")&&X.$policies){let $=X.$policies;if($.length>0){let V=X;if(s(V,$),W===void 0&&J===void 0)W=$,Z=V;else J??=S(W,Z),W=void 0,J.unshift(...S($,V))}}X=Object.getPrototypeOf(X)}if(J!==void 0)return J;if(W===void 0)return Nz;return W.some(($)=>typeof $==="function")?S(W,Z):W}function r(z){let J=z;while(J&&J!==Function.prototype){if(Object.hasOwn(J,"$policies")&&J.$policies){let W=J.$policies;if(W.length>0)s(J,W)}J=Object.getPrototypeOf(J)}}function b(z){return z?.name??"This model"}var Nz=Object.freeze([]);function D(z,J,W,Z=[]){if(z.length===0)return W;let X=W,$;for(let V of z)if(V.before){if(V.before(J)===!1)throw new R(J.model,J.operation)}for(let V of z){if(!V.scope)continue;if(Kz.has(J.operation)){Sz(V,J);continue}let Q=V.scope(J);if(Q===void 0||Q===null)continue;if(Rz(J),Lz.has(J.operation)&&!V.onUpdate){let Y=Pz(Q);if(Y.length>0)($??=[]).push(...Y)}X=_z(X,Q)}if(Yz.has(J.operation)){for(let V of z)if(V.onCreate)X=Dz(X,J,V)}if(jz.has(J.operation)){for(let V of z)if(V.onUpdate)X=Az(X,J,V)}if($!==void 0)Cz($,J,X,Z);return X}function _z(z,J){let W=z?.where;if(W===void 0||W===null)return{...z,where:J};if(typeof W!=="object"||Array.isArray(W))return{...z,where:{AND:[W,J]}};let Z=W.AND,X=Z===void 0||Z===null?[]:Array.isArray(Z)?Z:[Z];return{...z,where:{...W,AND:[...X,J]}}}function Dz(z,J,W){let Z=(X)=>W.onCreate(J,{...X});if(J.operation==="createMany"){let X=z?.data;return{...z,data:Array.isArray(X)?X.map(Z):Z(X)}}if(J.operation==="upsert")return{...z,create:Z(z?.create)};return{...z,data:Z(z?.data)}}function Az(z,J,W){let Z=J.operation==="upsert"?"update":"data",X=z?.[Z];if(X===void 0||X===null)return z;return{...z,[Z]:W.onUpdate(J,{...X})}}function Cz(z,J,W,Z=[]){let X=W?.data;if(typeof X!=="object"||X===null)return;let $=z.filter((V)=>(V in X)&&!Z.includes(V));if($.length===0)return;throw new i(J.model,J.operation,[...new Set($)])}function Pz(z){if(typeof z!=="object"||z===null||Array.isArray(z))return[];let J=[];for(let W of Object.keys(z)){if(W==="AND"||W==="OR"||W==="NOT")continue;J.push(W)}return J}function Sz(z,J){if(z.onCreate)return;throw new T(J.operation,J.model,J.operation,`${J.model} has a policy that scopes reads but no 'onCreate', and ${J.operation} has no where clause for a scope to narrow. As written the policy would confine reads to the caller and let an insert name any value it likes. Add an onCreate that sets the scoped `+"column \u2014 or, if unscoped creates are intended, say so with an onCreate "+"that returns its data unchanged.")}function Rz(z){if(qz.has(z.operation))return;throw new T(z.operation,z.model,z.operation,`${z.model} has a policy with a scope, and ${z.operation} cannot carry one: its where clause compiles to an 'on conflict' target, which is a key rather than a filter. Running it would write outside the scope.
 
 Two ways out. Use update and create separately, which both scope `+"normally \u2014 or leave the conflict key out of 'create', which Model.upsert "+"runs as a scoped read and a scoped write inside one transaction. The refusal is about 'on conflict' specifically, not about upsert.")}function dz(z,J,W){if(z.length===0)return;let Z=z.filter((X)=>X.redact);if(Z.length===0)return;for(let X of fz(W))for(let $ of Z)$.redact(J,X)}function fz(z){if(Array.isArray(z))return z;if(z===null||z===void 0)return[];if(typeof z!=="object")return[];return[z]}function lz(z,J,W){for(let Z of W){let X=z.fields[Z];if(X&&!X.nullable)throw new T(`redact.${Z}`,z.name,"redact",`'${Z}' is not nullable, so setting it to null would contradict `+"the generated type \u2014 which still says the field is there. Make the "+"field optional in schema.prisma, omit it with 'select' instead, or delete the key yourself if a runtime-only guarantee is enough.");if(Z in J)J[Z]=null}}function iz(){let z=a();if(z)return z.user;return bz()?.user??null}function bz(){try{return l.getStore()}catch{return}}var e=Symbol("gemi.orm.policiesAppliedByCaller");function az(z){return{...z,[e]:!0}}function nz(z){return typeof z==="object"&&z!==null&&z[e]===!0}var zz=Symbol("gemi.orm.columnsWrittenByTheOrm");function sz(z,J){return{...z,[zz]:J}}function tz(z){if(typeof z!=="object"||z===null)return c;let J=z[zz];return Array.isArray(J)?J:c}var c=[],Jz=Symbol("gemi.orm.operationTheRowIsReturnedFor");function oz(z,J){return{...z,[Jz]:J}}function rz(z){if(typeof z!=="object"||z===null)return;let J=z[Jz];return typeof J==="string"?J:void 0}var A="findMany";function Oz(z,J,W,Z,X){if(J===void 0||J===null)return J;if(typeof J!=="object")return J;let $=J;for(let Y of["include","select"]){let q=J[Y];if(typeof q!=="object"||q===null||Array.isArray(q))continue;let j;for(let L of Object.keys(q)){if(L===m){let w=Ez(z,q[L],W,Z,X);if(w!==q[L])j??={...q},j[L]=w;continue}let G=z.relations[L];if(!G)continue;let K=q[L];if(K===void 0||K===!1)continue;let U=X(G.model);if(!U)continue;let F=K===!0?{}:K;if(typeof F!=="object"||Array.isArray(F))continue;let x=Oz(U.schema,F,W,Z,X),v=!Z&&U.policies.length>0?D(U.policies,N(U.schema.name,A,W,Z),x):x;if(v!==F)j??={...q},j[L]=v}if(j)$={...$,[Y]:j}}let V=Wz(z,$.orderBy,W,Z,X);if(V!==$.orderBy)$={...$,orderBy:V};let Q=I(z,$.where,W,Z,X);if(Q!==$.where)$={...$,where:Q};return $}function Wz(z,J,W,Z,X){if(Z)return J;if(typeof J!=="object"||J===null)return J;if(Array.isArray(J)){let Q=!1,Y=J.map((q)=>{let j=Wz(z,q,W,Z,X);if(j!==q)Q=!0;return j});return Q?Y:J}let $,V=J;for(let Q of Object.keys(V)){let Y=z.relations[Q];if(!Y)continue;let q=V[Q];if(typeof q!=="object"||q===null||Array.isArray(q))continue;let j=X(Y.model);if(!j||j.policies.length===0)continue;let L=D(j.policies,N(j.schema.name,A,W,Z),q);if(L!==q)$??={...V},$[Q]=L}return $??J}function Ez(z,J,W,Z,X){if(Z)return J;let $=J===!0;if(!$&&(typeof J!=="object"||J===null||Array.isArray(J)))return J;let V=$?Object.fromEntries(y(z).map((q)=>[q,!0])):J.select;if(typeof V!=="object"||V===null||Array.isArray(V))return J;let Q,Y=V;for(let q of Object.keys(Y)){let j=Y[q];if(j===void 0||j===!1)continue;let L=z.relations[q];if(!L)continue;let G=X(L.model);if(!G||G.policies.length===0)continue;let K=j===!0?{}:j;if(typeof K!=="object"||Array.isArray(K))continue;let U=D(G.policies,N(G.schema.name,A,W,Z),K);if(U!==K)Q??={...Y},Q[q]=U}if(!Q)return J;return $?{select:Q}:{...J,select:Q}}function I(z,J,W,Z,X){if(typeof J!=="object"||J===null)return J;if(Array.isArray(J)){let Q=!1,Y=J.map((q)=>{let j=I(z,q,W,Z,X);if(j!==q)Q=!0;return j});return Q?Y:J}let $,V=J;for(let Q of Object.keys(V)){let Y=V[Q];if(Y===void 0)continue;if(Q==="AND"||Q==="OR"||Q==="NOT"){let L=I(z,Y,W,Z,X);if(L!==Y)$??={...V},$[Q]=L;continue}let q=z.relations[Q];if(!q)continue;let j=kz(q,Y,W,Z,X);if(j!==Y)$??={...V},$[Q]=j}return $??J}function kz(z,J,W,Z,X){if(typeof J!=="object"||J===null||Array.isArray(J))return J;let $=X(z.model);if(!$)return J;let V=g(z.kind),Q=!h(J,V),Y=Q?[["is",J]]:Object.entries(J),q;for(let[j,L]of Y){if(L===null||L===void 0)continue;let G=I($.schema,L,W,Z,X),K=!Z&&$.policies.length>0?D($.policies,N($.schema.name,A,W,Z),{where:G}).where:G,U=j==="every"?xz(G,K):K;if(U!==L)q??=Q?{}:{...J},q[j]=U}if(!q)return J;return q}function xz(z,J){if(J===z)return z;let W=d(z),X=d(J).slice(W.length);if(X.length===0)return z;return{OR:[{NOT:X.length===1?X[0]:{AND:X}},z]}}function d(z){if(typeof z!=="object"||z===null)return[];let J=z.AND;if(J===void 0)return[];return Array.isArray(J)?J:[J]}function vz(...z){let[J]=wz(...z);if(J!==void 0)throw J}function wz(...z){let J=[];for(let W of z)for(let Z of Object.values(W)){let X=Zz(Z);if(X===null)continue;r(X);let $=X.$schema.name,V=E($)?k($):void 0;if(V===void 0||V===X)continue;let Q=_(X),Y=_(V),q=Q.length!==Y.length||Q.some((j,L)=>j!==Y[L]);if(P(V,X)||P(X,V)){let j=P(X,V)?V:X,L=j===V?X:V;if(_(j).length===0){if(V===L)continue;if(!q)continue;J.push(new C($,B(V),B(X),Q.length>0?"queried":"registered"));continue}if(q)J.push(new C($,B(j),B(L),"narrowing"));continue}if(!q)continue;J.push(new C($,B(V),B(X),Q.length>0?"queried":"registered"))}return J}function XJ(...z){let J=new Map;for(let Z of z){let X=new Map;for(let $ of new Set(Object.values(Z))){let V=Zz($);if(V===null)continue;let Q=V.$schema.name,Y=X.get(Q);if(Y===void 0)X.set(Q,[V]);else Y.push(V)}for(let[$,V]of X)J.set($,gz($,V))}let W=[...J.keys()].filter((Z)=>E(Z)).map((Z)=>[Z,k(Z)]);for(let[Z,X]of J)O(Z,X);try{vz(...z)}catch(Z){for(let[X,$]of W)O(X,$);throw Z}}function gz(z,J){if(J.length===1)return J[0];let W=J.filter(($)=>!hz($)),Z=W.length>0?W:J;if(Z.length===1)return Z[0];let X=Z.filter(($)=>Z.every((V)=>V===$||P(V,$)));if(X.length===1)return X[0];throw new Xz(z,Z.map(($)=>B($)))}function hz(z){if("$generated"in z)return Object.hasOwn(z,"$generated")&&z.$generated===!0;return Object.hasOwn(z,"$schema")}function P(z,J){let W=Object.getPrototypeOf(z);while(W!==null&&W!==Function.prototype){if(W===J)return!0;W=Object.getPrototypeOf(W)}return!1}function B(z){return z?.name??String(z)}function Zz(z){if(typeof z!=="function")return null;let J=z.$schema;if(J===void 0||typeof J.name!=="string")return null;return z}
 export{g as Fa,h as Ga,m as Ha,y as Ia,N as Ja,n as Ka,Qz as La,_ as Ma,D as Na,dz as Oa,lz as Pa,iz as Qa,az as Ra,nz as Sa,sz as Ta,tz as Ua,oz as Va,rz as Wa,A as Xa,Oz as Ya,vz as Za,wz as _a,XJ as $a};
 
-//# debugId=28893FF1809EB86564756E2164756E21
+//# debugId=574261BAD0CAA36E64756E2164756E21

package/dist/{chunk-pmyh33v5.js.map → chunk-r923001x.js.map}

@@ -7,6 +7,6 @@
     "import {\n  AmbiguousModelRegistrationError,\n  UnregisteredPolicyClassError,\n} from \"./errors\";\nimport { assertPolicyShapes, policiesFor } from \"./policy\";\nimport * as registry from \"./registry\";\nimport type { ModelSchema } from \"./schema\";\n\n/** A model class, as much of one as anything below `Model.ts` can name. */\ntype ModelClass = object & { $schema: ModelSchema };\n\n/**\n * Checks that every policied model class an application defines is the one the\n * registry resolves its name to — **ahead of any query**, rather than when one\n * happens to be run.\n *\n * ### Why this exists\n *\n * `Model.$exec` already refuses a query whose class carries policies the\n * registered class does not (`UnregisteredPolicyClassError`). That guard closed\n * the two shapes found in #51, and it is the right check, but it can only fire\n * on a class somebody actually queries **at the root**. Its condition begins\n * `registered !== this`, and there is a case where that is false and the leak is\n * real:\n *\n *     export class Membership extends MembershipModel {\n *       static $policies = [{ scope: (ctx) => ({ orgId: ctx.user.orgId }) }]\n *     }\n *     // ...and no `register(\"Membership\", Membership)`\n *\n * If nothing ever calls `Membership.findMany()` — because memberships are only\n * ever read through `include: { memberships: true }` — then the include resolves\n * the name to the *generated base*, `this` **is** that base, the comparison\n * never runs, and rows come back unscoped with no error. Not a policy chain that\n * fails to diverge: a check that is never reached.\n *\n * A model reached only through includes is usually a membership or a pivot,\n * which is exactly the kind that carries a tenant scope. So the residual runs\n * the wrong way: the guard is weakest where the data is most sensitive.\n *\n * ### What this does about it\n *\n * The same rule, triggered differently. Instead of waiting for a root query,\n * it takes the modules where an application's model classes live and applies the\n * divergence comparison to every one of them:\n *\n *     import * as models from \"@/app/models\"\n *     assertPoliciesRegistered(models)\n *\n * Reading a class out of a module namespace is what makes the unqueried case\n * visible — the class exists and is exported whether or not anything queries it.\n *\n * `registerModels` runs this after registering, and `Kernel.models` runs\n * `registerModels` at boot, so an application that declares its model modules\n * gets it without asking. This is the same check for modules the Kernel does\n * not own — a test over a package's models, a script that boots nothing.\n *\n * It can only see modules it is handed, which is the residual either way: a\n * policied class in a file no barrel re-exports is invisible to it.\n * `gemi check models` closes that by handing it the files instead of the\n * barrel — see `auditModelRegistrations`, which is the same rule without the\n * throw.\n */\nexport function assertPoliciesRegistered(\n  ...modules: Array<Record<string, unknown>>\n): void {\n  const [first] = auditModelRegistrations(...modules);\n  if (first !== undefined) throw first;\n}\n\n/**\n * Every problem `assertPoliciesRegistered` would report, as values rather than\n * as a throw — in the order it would have reported them, so the first element is\n * exactly what that function throws.\n *\n * ### Why the rule needed a second caller\n *\n * A throw is the right shape at boot: the first policied class that does not own\n * its name is a reason not to start, and the rest of the list is noise nobody\n * reads before fixing the first one.\n *\n * It is the wrong shape for a checker. `gemi check models` walks\n * `app/models/**` and audits each file, so it wants *all* of them, and it wants\n * to sort them — a policied class the Kernel never sees is a leak to report,\n * while a policied view deliberately kept out of the declared modules is the\n * arrangement the error for that case actually recommends, and reporting it\n * would be telling an author to undo what the framework told them to do.\n * `UnregisteredPolicyClassError.carries` is what separates the two, and it can\n * only be read off an error somebody is holding.\n *\n * Errors rather than a plain finding type, because the message is the useful\n * part and it is already written once, in the error. Constructing them is not\n * free — a stack per finding — and it is a check somebody runs, not a request\n * path.\n */\nexport function auditModelRegistrations(\n  ...modules: Array<Record<string, unknown>>\n): UnregisteredPolicyClassError[] {\n  const problems: UnregisteredPolicyClassError[] = [];\n\n  for (const module of modules) {\n    for (const exported of Object.values(module)) {\n      const model = asModelClass(exported);\n      if (model === null) continue;\n\n      // #321's boot-time half, run **before** the early return below and for\n      // every class rather than only the diverging ones. Left below the return,\n      // the two commonest arrangements were never checked at all — a class that\n      // already owns its name, and one whose name nothing else claims — so a\n      // `{ scopes: … }` typo registered, reported green, and read unscoped.\n      //\n      // `assertPolicyShapes` and not `policiesFor`, and the difference is the\n      // point: this walk checks the entries and constructs nothing. Resolving\n      // here instead is one line and would additionally catch a policy class\n      // whose constructor throws — at the price of constructing every policy\n      // class in the application at `registerModels` time, ahead of whatever\n      // config or container the constructor reaches for. A guard against a\n      // policy that does nothing must not become the reason a working\n      // application stops booting, so the cases that need an instance are left\n      // to `policiesFor`, which is reached below, on the first query, and by\n      // `Model.$exec`.\n      assertPolicyShapes(model);\n\n      const name = model.$schema.name;\n      const registered = registry.has(name)\n        ? (registry.get<unknown>(name) as object)\n        : undefined;\n\n      // Nothing registered under the name at all. The generated `index.ts`\n      // registers every model, so reaching this means it was never imported —\n      // a different mistake, and one the first query reports clearly through\n      // `ModelNotRegisteredError`. Not this function's business.\n      if (registered === undefined || registered === model) continue;\n\n      const ours = policiesFor(model);\n      const theirs = policiesFor(registered);\n      const diverges =\n        ours.length !== theirs.length ||\n        ours.some((policy, index) => policy !== theirs[index]);\n\n      // The two classes are on one prototype chain — a base and something\n      // extending it — which is the arrangement almost every application has,\n      // and the one this audit used to get wrong in both directions.\n      //\n      // `policiesFor` accumulates upwards, so a descendant's chain always\n      // contains its ancestor's. What separates the two shapes is therefore\n      // whether the **ancestor** carries anything of its own.\n      if (descendsFrom(registered, model) || descendsFrom(model, registered)) {\n        const ancestor = descendsFrom(model, registered) ? registered : model;\n        const descendant = ancestor === registered ? model : registered;\n\n        if (policiesFor(ancestor).length === 0) {\n          // The ancestor contributes nothing, so the descendant is the first\n          // class to carry a policy: it is not a view over the model, it *is*\n          // the model. A generated base is the usual ancestor here, and a\n          // hand-written intermediate behaves the same way.\n          //\n          // Registered already? Then this is the correct arrangement, and it\n          // has to be skipped rather than reported — it used not to be, and\n          // that is why the documented\n          //\n          //     assertPoliciesRegistered(generated, models)\n          //\n          // threw the moment an application wrote its first policy: it walked\n          // the generated namespace, found `UserModel` diverging from the\n          // registered `User`, and refused the thing it exists to protect.\n          // Being reachable through a base is not the bug; querying through one\n          // is, and that is a property of a call site rather than of a module's\n          // export list, so `Model.$exec` keeps that direction.\n          if (registered === descendant) continue;\n\n          // Neither class carries anything, so which one owns the name changes\n          // no query's scope. An unregistered plain subclass is not a mistake.\n          if (!diverges) continue;\n\n          // Not registered, and it has policies: #316 itself. The policied\n          // class is not the one the name resolves to, so every nested read\n          // runs the ancestor and skips it.\n          problems.push(\n            new UnregisteredPolicyClassError(\n              name,\n              nameOf(registered),\n              nameOf(model),\n              ours.length > 0 ? \"queried\" : \"registered\",\n            ),\n          );\n          continue;\n        }\n\n        // The ancestor carries policies of its own, so it is a registered model\n        // in good standing and the descendant is narrowing it. The registry\n        // holds one class per name: registering the view applies its narrowing\n        // to every nested read, and leaving the ancestor registered skips the\n        // view's policies entirely. Both are silent, so neither is chosen.\n        if (diverges) {\n          problems.push(\n            new UnregisteredPolicyClassError(\n              name,\n              nameOf(ancestor),\n              nameOf(descendant),\n              \"narrowing\",\n            ),\n          );\n        }\n\n        // Same chain, same policies — a plain typed view. Nothing to report.\n        continue;\n      }\n\n      if (!diverges) continue;\n\n      // Unrelated classes claiming one name. Whichever is registered, the\n      // other's policies are simply not in effect.\n      problems.push(\n        new UnregisteredPolicyClassError(\n          name,\n          nameOf(registered),\n          nameOf(model),\n          ours.length > 0 ? \"queried\" : \"registered\",\n        ),\n      );\n    }\n  }\n\n  return problems;\n}\n\n/**\n * Registers every model class the given modules export, under the name each\n * one's schema carries, and then audits the result.\n *\n * ### The line this exists to delete\n *\n * `register(\"User\", User)` next to every subclass is a correct instruction and\n * a bad mechanism, because forgetting it is invisible. A relation read resolves\n * its target by name, so an unregistered policied subclass leaves the generated\n * base owning the name and every nested `include` of that model comes back\n * unscoped — no error, no warning, and an authorization hole in the direction\n * nobody checks. `assertPoliciesRegistered` turns that into a loud failure, but\n * only for someone who remembered to run it.\n *\n * Deriving the registration from the module removes the mistake instead of\n * reporting it. The name is not a string an author repeats; it is\n * `$schema.name`, which the generator wrote and the subclass inherits:\n *\n *     import * as generated from \"./generated\"\n *     import * as models from \"./models\"\n *\n *     registerModels(generated, models)\n *\n * Later modules win, so the application's classes replace the generated bases\n * they extend. `register` still exists and still works — this is what an\n * application calls once instead of writing it thirteen times.\n *\n * ### What it still cannot see\n *\n * Modules it is handed. A policied class in a file nothing imports is invisible\n * to this exactly as it is to `assertPoliciesRegistered`, and closing *that*\n * would take the framework enumerating the filesystem at boot. Handing it a\n * barrel is the whole discipline: one file to add a model to, and the audit\n * covers everything in it.\n *\n * `Kernel.models` is that call, wired at boot, so an application declares its\n * model modules the way it already declares config slices and providers.\n */\nexport function registerModels(\n  ...modules: Array<Record<string, unknown>>\n): void {\n  // Elected into a local map first, and only committed once the audit passes.\n  //\n  // The registry is process-wide and outlives the throw. Registering as we went\n  // meant a refused call left the arrangement it had just refused installed —\n  // `registerModels({Ours}, {Theirs})` threw, and `\"User\"` resolved to `Theirs`\n  // afterwards, which is the leaking mapping the audit exists to reject. A\n  // server whose boot dies never notices; a dev server that catches and keeps\n  // serving, or a test harness that continues past the error, serves the rest\n  // of the process from it.\n  const staged = new Map<string, ModelClass>();\n\n  for (const module of modules) {\n    const candidates = new Map<string, ModelClass[]>();\n\n    // Deduped by identity first: `export { User }` alongside a default export\n    // is the same class under two keys, not two classes competing for a name.\n    for (const exported of new Set(Object.values(module))) {\n      const model = asModelClass(exported);\n      if (model === null) continue;\n\n      const name = model.$schema.name;\n      const existing = candidates.get(name);\n      if (existing === undefined) candidates.set(name, [model]);\n      else existing.push(model);\n    }\n\n    // Later modules win, which is what lets an application's classes replace\n    // the generated bases they extend.\n    for (const [name, classes] of candidates) {\n      staged.set(name, elect(name, classes));\n    }\n  }\n\n  // What the registry said before, so a failed audit can put it back. `register`\n  // has no inverse, so a name that was previously *absent* cannot be made\n  // absent again — it is left pointing at what this call elected. That is the\n  // one residue, and it is the harmless direction: the alternative to a wrong\n  // registration under a name nothing claimed is `ModelNotRegisteredError`, and\n  // the class elected here is the one this module set would have used anyway.\n  const previous = [...staged.keys()]\n    .filter((name) => registry.has(name))\n    .map((name) => [name, registry.get<unknown>(name)] as const);\n\n  for (const [name, model] of staged) registry.register(name, model);\n\n  try {\n    assertPoliciesRegistered(...modules);\n  } catch (error) {\n    for (const [name, model] of previous) registry.register(name, model);\n    throw error;\n  }\n}\n\n/**\n * Which of several classes claiming one name in one module gets it.\n *\n * Two shapes put more than one candidate in a namespace, and they want opposite\n * answers, so neither \"most derived\" nor \"least derived\" is the rule on its\n * own:\n *\n *     export * from \"./generated\"      // UserModel, and\n *     export class User extends UserModel { static $policies = [...] }\n *\n * wants the subclass — electing the base here *is* the leak, in the one file an\n * author most plausibly writes it in. While\n *\n *     export class User extends UserModel { static $policies = [...] }\n *     export class AdminUser extends User {}\n *\n * wants `User`. `AdminUser` is a typed view over the same rows; it inherits the\n * policies either way, so registering it changes nothing when it adds none and\n * silently applies its own narrowing to every nested read when it does.\n *\n * What separates them is which class the *generator* wrote. It emits\n * `static $schema = schema.User` on the base, and a subclass inherits that\n * property rather than declaring one — so an own `$schema` is the mark of a\n * generated base, and it is a fact about the classes rather than about the\n * order somebody exported them in. Application classes are preferred over\n * bases; among application classes the least derived wins, for the reason\n * `AdminUser` gives.\n *\n * When that leaves no single answer the candidates are unrelated classes with a\n * genuine claim each, and there is nothing left to infer. That case is refused\n * rather than guessed at: `register` says which, in the application's own\n * words.\n */\nfunction elect(name: string, classes: ModelClass[]): ModelClass {\n  if (classes.length === 1) return classes[0]!;\n\n  const written = classes.filter((candidate) => !isGeneratedBase(candidate));\n  const eligible = written.length > 0 ? written : classes;\n\n  if (eligible.length === 1) return eligible[0]!;\n\n  const roots = eligible.filter((candidate) =>\n    eligible.every(\n      (other) => other === candidate || descendsFrom(other, candidate),\n    ),\n  );\n\n  if (roots.length === 1) return roots[0]!;\n\n  throw new AmbiguousModelRegistrationError(\n    name,\n    eligible.map((candidate) => nameOf(candidate)),\n  );\n}\n\n/**\n * Whether the generator wrote this class, rather than an application extending\n * one it wrote.\n *\n * The generator marks its own output — `static $generated = true` on each\n * emitted base, and on nothing else — so for artifacts that carry the mark this\n * is a fact the generator stated rather than a property of how it happens to be\n * written. A subclass *inherits* the mark and does not own it, which is what\n * makes own-vs-inherited the whole test.\n *\n * ### The fallback, and why it is second\n *\n * `$schema` is also declared on the emitted base and inherited below it, so\n * owning *that* used to answer the same question, and it answered it wrongly for\n * one shape (#318): a subclass that redeclares `static $schema` — pointing at a\n * modified schema object, or by copy-paste — read as a base, every candidate\n * looked generated, and the least derived won. That did not pass quietly, since\n * `assertPoliciesRegistered` runs immediately after `elect` and refuses a\n * policied class that lost its name. But loud-and-wrong is still wrong, and the\n * silent half — a subclass with statics and row methods but no policies, whose\n * methods then never run inside a nested read — had nothing to refuse.\n *\n * The inference survives as the fallback for artifacts generated *before* the\n * mark existed, where it is the only signal there is. `\"$generated\" in candidate`\n * is what separates the two worlds: it walks the prototype chain, so it is true\n * for a marked base and for everything under it, and false for every class in an\n * app whose `app/models/generated` predates 0.51. Asking `Object.hasOwn` first\n * and falling back on `false` would send a subclass of a *marked* base back into\n * the inference — which is exactly the case the mark was added to fix.\n *\n * `registration.test.ts` in the template asserts the contract against real\n * generator output, because this is the one place a generator change could\n * quietly invalidate an assumption made here.\n */\nfunction isGeneratedBase(candidate: ModelClass): boolean {\n  // Owning the mark, not merely having it — and owning it set to `true`. The\n  // declared type is `?: true`, so TypeScript already refuses `false`; reading\n  // the value anyway is what makes `static $generated = false` mean the thing\n  // it plainly says in an app with no typechecking between it and here.\n  if (\"$generated\" in candidate) {\n    return (\n      Object.hasOwn(candidate, \"$generated\") &&\n      (candidate as { $generated?: unknown }).$generated === true\n    );\n  }\n\n  return Object.hasOwn(candidate, \"$schema\");\n}\n\n/**\n * Whether `derived` has `base` in its static prototype chain — the `extends`\n * relation between two classes, walked on the constructor side because that is\n * where `$schema` and `$policies` live.\n */\nfunction descendsFrom(derived: unknown, base: unknown): boolean {\n  let current = Object.getPrototypeOf(derived);\n\n  while (current !== null && current !== Function.prototype) {\n    if (current === base) return true;\n    current = Object.getPrototypeOf(current);\n  }\n\n  return false;\n}\n\nfunction nameOf(value: unknown): string {\n  return (value as { name?: string })?.name ?? String(value);\n}\n\n/**\n * A model class, structurally.\n *\n * Structural rather than `instanceof Model` on purpose: this module sits below\n * `Model.ts` in the import graph, and importing it here to answer a question\n * about shape would put a cycle between the registry, the policy hook and the\n * model base for no gain. `$schema` carrying a `name` is what every operation\n * already relies on.\n *\n * A module namespace holds anything the author exported — types erase, but\n * constants, helpers and re-exported values do not — so everything that is not\n * a model class is skipped rather than treated as an error.\n */\nfunction asModelClass(value: unknown): ModelClass | null {\n  if (typeof value !== \"function\") return null;\n\n  const schema = (value as { $schema?: ModelSchema }).$schema;\n  if (schema === undefined || typeof schema.name !== \"string\") return null;\n\n  return value as unknown as ModelClass;\n}\n"
   ],
   "mappings": ";+OAyBA,FAAM,HAAwB,LAAC,QAAS,OAAQ,MAAM,EAChD,GAAuB,CAAC,KAAM,OAAO,EAsBpC,SAAS,CAAuB,CACrC,EACmB,CACnB,OAAO,IAAS,OAAS,GAAwB,GAgB5C,SAAS,CAAc,CAC5B,EACA,EACS,CACT,IAAM,EAAO,OAAO,KAAK,CAAK,EAC9B,OAAO,EAAK,OAAS,GAAK,EAAK,MAAM,CAAC,IAAQ,EAAU,SAAS,CAAG,CAAC,EAYhE,IAAM,EAAY,SAqBlB,SAAS,CAAkB,CAAC,EAEtB,CACX,OAAO,OAAO,KAAK,EAAO,SAAS,EAChC,OAAO,CAAC,IAAS,EAAO,UAAU,IAAO,OAAS,MAAM,EACxD,KAAK,EClBH,SAAS,CAAa,CAC3B,EACA,EACA,EACA,EACe,CASf,IAAM,EAAU,CAAE,QAAO,YAAW,QAAS,GAAQ,IAAK,EAiB1D,OAVA,OAAO,eAAe,EAAS,OAAQ,CACrC,WAAY,GACZ,GAAG,EAAG,CACJ,GAAI,GAAQ,MAAQ,CAAC,EACnB,MAAM,IAAI,EAAkB,EAAO,EAAW,SAAS,EAEzD,OAAO,EAEX,CAAC,EAEM,EAyHF,MAAe,CAAgD,CAAC,CAahE,MAAe,WAIZ,CAA8B,CAOxC,CAyBA,IAAM,GAAW,IAAI,IAAY,CAC/B,WACA,YACA,mBACA,aACA,oBACA,QAIA,YAMA,UACA,SACA,aACA,SACA,YACF,CAAC,EAGK,GAAW,IAAI,IAAY,CAAC,SAAU,aAAc,QAAQ,CAAC,EAQ7D,GAAW,IAAI,IAAY,CAAC,SAAU,aAAc,QAAQ,CAAC,EAM7D,GAAW,IAAI,IAAY,CAAC,SAAU,YAAY,CAAC,EAQnD,GAAY,IAAI,IAAY,CAAC,SAAU,YAAY,CAAC,EAoBpD,EAAe,IAAI,QAmBzB,SAAS,EAAY,CACnB,EACA,EACA,EACa,CACb,GAAI,OAAO,IAAU,WAAY,OAAO,EAExC,IAAM,EAAW,EAAa,IAAI,CAAK,EACvC,GAAI,IAAa,OAAW,OAAO,EAEnC,IAAI,EACJ,GAAI,CACF,EAAO,IAAK,EACZ,MAAO,EAAO,CACd,MAAM,IAAI,EACR,EAAY,CAAK,EACjB,EACA,oBACA,GAAG,EAAiB,CAAK;AAAA;AAAA,MACnB,GAAiB,SAAW,OAAO,CAAK,IAC9C,EACA,OACA,CAAE,OAAM,CACV,EAMF,OAHA,EAAsB,EAAiC,EAAO,CAAK,EAEnE,EAAa,IAAI,EAAO,CAAI,EACrB,EAIT,SAAS,CAAY,CACnB,EACA,EACe,CACf,OAAO,EAAQ,IAAI,CAAC,EAAO,IAAU,GAAa,EAAO,EAAO,CAAK,CAAC,EA4BxE,IAAM,EAAmB,CACvB,SACA,QACA,WACA,WACA,QACF,EAuCA,IAAM,EAAiB,IAAI,QAmB3B,SAAS,CAAmB,CAC1B,EACA,EACM,CACN,GAAI,EAAe,IAAI,CAAO,EAAG,OAEjC,QAAS,EAAQ,EAAG,EAAQ,EAAQ,OAAQ,IAC1C,GAAkB,EAAQ,GAAuB,EAAO,CAAK,EAG/D,EAAe,IAAI,CAAO,EAmB5B,SAAS,EAAiB,CACxB,EACA,EACA,EACM,CACN,IAAM,EAAQ,EAAY,CAAK,EACzB,EAAO,OAAO,EAMpB,GACE,IAAU,MACV,MAAM,QAAQ,CAAK,GAClB,IAAS,UAAY,IAAS,WAE/B,MAAM,IAAI,EACR,EACA,EACA,eACA,EAAc,CAAK,EACnB,CACF,EAGF,GAAI,IAAS,WAAY,CACvB,GAAI,CAAC,GAAgB,CAAiB,EACpC,MAAM,IAAI,EACR,EACA,EACA,oBACA,EAAiB,CAAiB,EAClC,CACF,EAIF,OAGF,EAAsB,EAAkC,EAAO,CAAK,EAWtE,SAAS,CAAqB,CAC5B,EACA,EACA,EACM,CACN,IAAM,EAAQ,EAAY,CAAK,EAC3B,EAAW,EAGT,EAAkB,CAAC,EAEzB,QAAW,KAAQ,EAAkB,CACnC,IAAM,EAAQ,EAAO,GAIrB,GAAI,IAAU,QAAa,IAAU,KAAM,CACzC,GAAI,KAAQ,EAAQ,EAAM,KAAK,CAAI,EACnC,SAGF,GAAI,OAAO,IAAU,WACnB,MAAM,IAAI,EACR,EACA,EACA,oBACA,IAAI,cAAiB,EAAc,CAAK,2BACxC,CACF,EAGF,IAGF,GAAI,EAAW,EAAG,OAElB,GAAI,EAAM,OAAS,EACjB,MAAM,IAAI,EACR,EACA,EACA,WACA,aAAa,EAAM,IAAI,CAAC,IAAS,IAAI,IAAO,EAAE,KAAK,IAAI,qBAC3C,EAAM,SAAW,EAAI,KAAO,gCACtC,2CACF,CACF,EAGF,IAAM,EAAU,GAAY,CAAM,EAC5B,EAAO,GAAY,CAAO,EAEhC,MAAM,IAAI,EACR,EACA,EACA,WACA,EAAQ,SAAW,EACf,eACA,aAAa,GAAS,CAAO,MAK1B,EAAQ,SAAW,GAAK,EAAQ,KAAO,UACpC,kEACA,oEACA,kBACA,IACV,EACA,CACF,EAUF,SAAS,EAAQ,CAAC,EAAiC,CACjD,IAAM,EAAQ,EAAK,MAAM,EAAG,CAAC,EAAE,IAAI,CAAC,IAAQ,IAAI,IAAM,EACtD,OAAO,EAAK,OAAS,EAAM,OACvB,GAAG,EAAM,KAAK,IAAI,SAAS,EAAK,OAAS,EAAM,cAC/C,EAAM,KAAK,IAAI,EAqBrB,SAAS,EAAe,CAAC,EAA0B,CACjD,GAAI,CAEF,OADA,QAAQ,UAAU,GAAM,CAAC,EAAG,CAA0B,EAC/C,GACP,KAAM,CACN,MAAO,IAKX,IAAM,GAAO,QAAS,EAAG,GAQzB,SAAS,EAAW,CAAC,EAA0B,CAC7C,IAAM,EAAO,IAAI,IAEb,EAAyB,EAC7B,MAAO,IAAY,MAAQ,IAAY,OAAO,UAAW,CACvD,QAAW,KAAO,OAAO,oBAAoB,CAAO,EAClD,GAAI,IAAQ,cAAe,EAAK,IAAI,CAAG,EAEzC,EAAU,OAAO,eAAe,CAAO,EAGzC,MAAO,CAAC,GAAG,CAAI,EAuBjB,SAAS,EAAW,CAClB,EAC2C,CAC3C,IAAI,EACA,EAAe,EAEnB,QAAW,KAAO,EAChB,QAAW,KAAQ,EAAkB,CACnC,IAAM,EAAW,GAAa,EAAI,YAAY,EAAG,EAAK,YAAY,CAAC,EACnE,GAAI,EAAW,EACb,EAAe,EACf,EAAO,CAAE,MAAK,MAAK,EAKzB,OAAO,EAIT,SAAS,EAAY,CAAC,EAAW,EAAmB,CAClD,GAAI,IAAM,EAAG,MAAO,GAEpB,IAAI,EAAM,MAAM,KAAK,CAAE,OAAQ,EAAE,OAAS,CAAE,EAAG,CAAC,EAAQ,IAAU,CAAK,EAEvE,QAAS,EAAI,EAAG,GAAK,EAAE,OAAQ,IAAK,CAClC,IAAI,EAAW,EAAI,GACnB,EAAI,GAAK,EAET,QAAS,EAAI,EAAG,GAAK,EAAE,OAAQ,IAAK,CAClC,IAAM,EAAO,EAAI,GACjB,EAAI,GAAK,KAAK,IACZ,EAAI,GAAM,EACV,EAAI,EAAI,GAAM,EACd,GAAY,EAAE,EAAI,KAAO,EAAE,EAAI,GAAK,EAAI,EAC1C,EACA,EAAW,GAIf,OAAO,EAAI,EAAE,QAQf,SAAS,CAAa,CAAC,EAAwB,CAC7C,GAAI,IAAU,KAAM,MAAO,OAC3B,GAAI,IAAU,OAAW,MAAO,YAChC,GAAI,OAAO,IAAU,SAAU,MAAO,cAAc,KAAK,UAAU,CAAK,IACxE,GAAI,OAAO,IAAU,WAAY,OAAO,EAAiB,CAAK,EAC9D,GAAI,MAAM,QAAQ,CAAK,EAAG,MAAO,WACjC,GAAI,OAAO,IAAU,SAAU,MAAO,YACtC,MAAO,OAAO,OAAO,KAAS,OAAO,CAAK,IAG5C,SAAS,CAAgB,CAAC,EAAyB,CACjD,OAAO,EAAM,KAAO,kBAAkB,EAAM,SAAW,wBAyBlD,SAAS,CAAW,CAAC,EAAwC,CAClE,IAAI,EACA,EAGA,EAEA,EAAU,EACd,MAAO,GAAW,IAAY,SAAS,UAAW,CAWhD,GAAI,OAAO,OAAO,EAAS,SAAS,EAClC,MAAU,MACR,GAAI,EAA8B,MAAQ,2FAExC,wEACA,oDACJ,EAGF,GAAI,OAAO,OAAO,EAAS,WAAW,GAAK,EAAQ,UAAW,CAC5D,IAAM,EAAQ,EAAQ,UACtB,GAAI,EAAM,OAAS,EAAG,CAOpB,IAAM,EAAQ,EAGd,GAFA,EAAoB,EAAO,CAAK,EAE5B,IAAS,QAAa,IAAU,OAKlC,EAAO,EACP,EAAY,EAKZ,SAAU,EAAa,EAAgC,CAAS,EAChE,EAAO,OACP,EAAM,QAAQ,GAAG,EAAa,EAAO,CAAK,CAAC,GAIjD,EAAU,OAAO,eAAe,CAAO,EAGzC,GAAI,IAAU,OAAW,OAAO,EAChC,GAAI,IAAS,OAAW,OAAO,GAK/B,OAAO,EAAK,KAAK,CAAC,IAAU,OAAO,IAAU,UAAU,EACnD,EAAa,EAAM,CAAS,EAC3B,EAuBA,SAAS,CAAkB,CAAC,EAAsB,CACvD,IAAI,EAAU,EAEd,MAAO,GAAW,IAAY,SAAS,UAAW,CAKhD,GAAI,OAAO,OAAO,EAAS,WAAW,GAAK,EAAQ,UAAW,CAC5D,IAAM,EAAQ,EAAQ,UACtB,GAAI,EAAM,OAAS,EAAG,EAAoB,EAAS,CAAK,EAE1D,EAAU,OAAO,eAAe,CAAO,GAI3C,SAAS,CAAW,CAAC,EAAwB,CAC3C,OAAQ,GAA6B,MAAQ,aAG/C,IAAM,GAAgC,OAAO,OAAO,CAAC,CAAC,EAS/C,SAAS,CAAa,CAC3B,EACA,EACA,EAKA,EAAiC,CAAC,EAC7B,CACL,GAAI,EAAS,SAAW,EAAG,OAAO,EAElC,IAAI,EAAM,EAON,EAEJ,QAAW,KAAU,EACnB,GAAI,EAAO,QAET,GADgB,EAAO,OAAO,CAAO,IACrB,GACd,MAAM,IAAI,EAAkB,EAAQ,MAAO,EAAQ,SAAS,EAKlE,QAAW,KAAU,EAAU,CAC7B,GAAI,CAAC,EAAO,MAAO,SAOnB,GAAI,GAAU,IAAI,EAAQ,SAAS,EAAG,CACpC,GAAoB,EAAQ,CAAO,EACnC,SAGF,IAAM,EAAQ,EAAO,MAAM,CAAO,EAClC,GAAI,IAAU,QAAa,IAAU,KAAM,SAO3C,GALA,GAAe,CAAO,EAKlB,GAAS,IAAI,EAAQ,SAAS,GAAK,CAAC,EAAO,SAAU,CACvD,IAAM,EAAQ,GAAiB,CAAK,EACpC,GAAI,EAAM,OAAS,GAAI,IAAc,CAAC,GAAG,KAAK,GAAG,CAAK,EAGxD,EAAM,GAAU,EAAK,CAAK,EAG5B,GAAI,GAAS,IAAI,EAAQ,SAAS,GAChC,QAAW,KAAU,EACnB,GAAI,EAAO,SAAU,EAAM,GAAY,EAAK,EAAS,CAAM,EAI/D,GAAI,GAAS,IAAI,EAAQ,SAAS,GAChC,QAAW,KAAU,EACnB,GAAI,EAAO,SAAU,EAAM,GAAY,EAAK,EAAS,CAAM,EAsB/D,GAAI,IAAc,OAChB,GAAoB,EAAW,EAAS,EAAK,CAAW,EAG1D,OAAO,EAyBT,SAAS,EAAS,CAAC,EAAW,EAAqB,CACjD,IAAM,EAAQ,GAAM,MAEpB,GAAI,IAAU,QAAa,IAAU,KACnC,MAAO,IAAK,EAAM,MAAO,CAAM,EAGjC,GAAI,OAAO,IAAU,UAAY,MAAM,QAAQ,CAAK,EAClD,MAAO,IAAK,EAAM,MAAO,CAAE,IAAK,CAAC,EAAO,CAAK,CAAE,CAAE,EAInD,IAAM,EAAW,EAAM,IACjB,EACJ,IAAa,QAAa,IAAa,KACnC,CAAC,EACD,MAAM,QAAQ,CAAQ,EACpB,EACA,CAAC,CAAQ,EAEjB,MAAO,IAAK,EAAM,MAAO,IAAK,EAAO,IAAK,CAAC,GAAG,EAAS,CAAK,CAAE,CAAE,EAIlE,SAAS,EAAW,CAAC,EAAW,EAAwB,EAA0B,CAQhF,IAAM,EAAM,CAAC,IAAc,EAAO,SAAU,EAAS,IAAK,CAAK,CAAC,EAEhE,GAAI,EAAQ,YAAc,aAAc,CACtC,IAAM,EAAO,GAAM,KACnB,MAAO,IACF,EACH,KAAM,MAAM,QAAQ,CAAI,EAAI,EAAK,IAAI,CAAG,EAAI,EAAI,CAAI,CACtD,EAGF,GAAI,EAAQ,YAAc,SAGxB,MAAO,IAAK,EAAM,OAAQ,EAAI,GAAM,MAAM,CAAE,EAG9C,MAAO,IAAK,EAAM,KAAM,EAAI,GAAM,IAAI,CAAE,EAU1C,SAAS,EAAW,CAClB,EACA,EACA,EACK,CACL,IAAM,EAAM,EAAQ,YAAc,SAAW,SAAW,OAClD,EAAU,IAAO,GAIvB,GAAI,IAAY,QAAa,IAAY,KAAM,OAAO,EAEtD,MAAO,IAAK,GAAO,GAAM,EAAO,SAAU,EAAS,IAAK,CAAQ,CAAC,CAAE,EAgBrE,SAAS,EAAmB,CAC1B,EACA,EACA,EAgBA,EAAiC,CAAC,EAC5B,CACN,IAAM,EAAO,GAAM,KACnB,GAAI,OAAO,IAAS,UAAY,IAAS,KAAM,OAE/C,IAAM,EAAW,EAAU,OACzB,CAAC,KAAU,KAAS,IAAQ,CAAC,EAAY,SAAS,CAAK,CACzD,EACA,GAAI,EAAS,SAAW,EAAG,OAE3B,MAAM,IAAI,EAAiB,EAAQ,MAAO,EAAQ,UAAW,CAC3D,GAAG,IAAI,IAAI,CAAQ,CACrB,CAAC,EAYH,SAAS,EAAgB,CAAC,EAA0B,CAClD,GAAI,OAAO,IAAU,UAAY,IAAU,MAAQ,MAAM,QAAQ,CAAK,EACpE,MAAO,CAAC,EAGV,IAAM,EAAkB,CAAC,EACzB,QAAW,KAAO,OAAO,KAAK,CAAgC,EAAG,CAC/D,GAAI,IAAQ,OAAS,IAAQ,MAAQ,IAAQ,MAAO,SACpD,EAAM,KAAK,CAAG,EAEhB,OAAO,EAqBT,SAAS,EAAmB,CAC1B,EACA,EACM,CACN,GAAI,EAAO,SAAU,OAErB,MAAM,IAAI,EACR,EAAQ,UACR,EAAQ,MACR,EAAQ,UACR,GAAG,EAAQ,+DACN,EAAQ,gMAGX,+EACA,kCACJ,EAaF,SAAS,EAAc,CAAC,EAA8B,CACpD,GAAI,GAAS,IAAI,EAAQ,SAAS,EAAG,OAErC,MAAM,IAAI,EACR,EAAQ,UACR,EAAQ,MACR,EAAQ,UACR,GAAG,EAAQ,wCAAwC,EAAQ;AAAA;AAAA,mEAKzD,iFACA,qIAEJ,EAYK,SAAS,EAAc,CAC5B,EACA,EACA,EACM,CACN,GAAI,EAAS,SAAW,EAAG,OAE3B,IAAM,EAAY,EAAS,OAAO,CAAC,IAAW,EAAO,MAAM,EAC3D,GAAI,EAAU,SAAW,EAAG,OAE5B,QAAW,KAAO,GAAO,CAAM,EAC7B,QAAW,KAAU,EAAW,EAAO,OAAQ,EAAS,CAAG,EAI/D,SAAS,EAAM,CAAC,EAAwB,CACtC,GAAI,MAAM,QAAQ,CAAM,EAAG,OAAO,EAClC,GAAI,IAAW,MAAQ,IAAW,OAAW,MAAO,CAAC,EACrD,GAAI,OAAO,IAAW,SAAU,MAAO,CAAC,EACxC,MAAO,CAAC,CAAM,EAgBT,SAAS,EAAc,CAC5B,EACA,EACA,EACM,CACN,QAAW,KAAQ,EAAQ,CACzB,IAAM,EAAQ,EAAO,OAAO,GAE5B,GAAI,GAAS,CAAC,EAAM,SAClB,MAAM,IAAI,EACR,UAAU,IACV,EAAO,KACP,SACA,IAAI,8DACF,2EACA,mIAEJ,EAGF,GAAI,KAAQ,EAAK,EAAI,GAAQ,MA0B1B,SAAS,EAAW,EAAY,CAIrC,IAAM,EAAQ,EAAa,EAC3B,GAAI,EAAO,OAAO,EAAM,KAKxB,OAAO,GAAa,GAAG,MAAQ,KAGjC,SAAS,EAAY,EAAmC,CACtD,GAAI,CACF,OAAO,EAAe,SAAS,EAC/B,KAAM,CAIN,QAiBJ,IAAM,EAAa,OAAO,kCAAkC,EAErD,SAAS,EAAa,CAAC,EAAqC,CACjE,MAAO,IAAK,GAAU,GAAa,EAAK,EAGnC,SAAS,EAAW,CAAC,EAA2B,CACrD,OACE,OAAO,IAAY,UACnB,IAAY,MACX,EAAoC,KAAgB,GAyBzD,IAAM,GAAe,OAAO,iCAAiC,EAEtD,SAAS,EAAe,CAC7B,EACA,EACQ,CACR,MAAO,IAAK,GAAU,IAAe,CAAO,EAGvC,SAAS,EAAiB,CAAC,EAAqC,CACrE,GAAI,OAAO,IAAY,UAAY,IAAY,KAAM,OAAO,EAC5D,IAAM,EAAU,EAAoC,IACpD,OAAO,MAAM,QAAQ,CAAM,EAAK,EAAsB,EAGxD,IAAM,EAAkC,CAAC,EAwDnC,GAAc,OAAO,uCAAuC,EAE3D,SAAS,EAAc,CAC5B,EACA,EACQ,CACR,MAAO,IAAK,GAAU,IAAc,CAAU,EAGzC,SAAS,EAAU,CAAC,EAAyC,CAClE,GAAI,OAAO,IAAY,UAAY,IAAY,KAAM,OACrD,IAAM,EAAa,EAAoC,IACvD,OAAO,OAAO,IAAc,SAAY,EAA0B,OAiC7D,IAAM,EAAyB,WA+D/B,SAAS,EAAmB,CACjC,EAGA,EACA,EACA,EACA,EACK,CACL,GAAI,IAAS,QAAa,IAAS,KAAM,OAAO,EAChD,GAAI,OAAO,IAAS,SAAU,OAAO,EAErC,IAAI,EAAM,EAEV,QAAW,IAAa,CAAC,UAAW,QAAQ,EAAY,CACtD,IAAM,EAAO,EAAK,GAClB,GAAI,OAAO,IAAS,UAAY,IAAS,MAAQ,MAAM,QAAQ,CAAI,EACjE,SAGF,IAAI,EAEJ,QAAW,KAAO,OAAO,KAAK,CAAI,EAAG,CAMnC,GAAI,IAAQ,EAAW,CACrB,IAAM,EAAe,GACnB,EACC,EAAiC,GAClC,EACA,EACA,CACF,EACA,GAAI,IAAkB,EAAiC,GACrD,IAAc,IAAM,CAAiC,EACrD,EAAU,GAAO,EAEnB,SAGF,IAAM,EAAW,EAAO,UAAU,GAClC,GAAI,CAAC,EAAU,SAEf,IAAM,EAAQ,EAAiC,GAC/C,GAAI,IAAS,QAAa,IAAS,GAAO,SAE1C,IAAM,EAAS,EAAO,EAAS,KAAK,EAGpC,GAAI,CAAC,EAAQ,SAOb,IAAM,EAAW,IAAS,GAAO,CAAC,EAAI,EACtC,GAAI,OAAO,IAAa,UAAY,MAAM,QAAQ,CAAQ,EAAG,SAI7D,IAAM,EAAS,GACb,EAAO,OACP,EACA,EACA,EACA,CACF,EAIM,EACJ,CAAC,GAAU,EAAO,SAAS,OAAS,EAChC,EACE,EAAO,SACP,EAAc,EAAO,OAAO,KAAM,EAAa,EAAM,CAAM,EAC3D,CACF,EACA,EAIN,GAAI,IAAW,EACb,IAAc,IAAM,CAAiC,EACrD,EAAU,GAAO,EAIrB,GAAI,EAAW,EAAM,IAAK,GAAM,GAAY,CAAU,EAOxD,IAAM,EAAU,GACd,EACA,EAAI,QACJ,EACA,EACA,CACF,EACA,GAAI,IAAY,EAAI,QAAS,EAAM,IAAK,EAAK,QAAS,CAAQ,EAK9D,IAAM,EAAW,EACf,EACA,EAAI,MACJ,EACA,EACA,CACF,EACA,GAAI,IAAa,EAAI,MAAO,EAAM,IAAK,EAAK,MAAO,CAAS,EAE5D,OAAO,EAoBT,SAAS,EAAsB,CAC7B,EACA,EACA,EACA,EACA,EACS,CACT,GAAI,EAAQ,OAAO,EACnB,GAAI,OAAO,IAAY,UAAY,IAAY,KAAM,OAAO,EAE5D,GAAI,MAAM,QAAQ,CAAO,EAAG,CAC1B,IAAI,EAAU,GACR,EAAM,EAAQ,IAAI,CAAC,IAAU,CACjC,IAAM,EAAS,GACb,EACA,EACA,EACA,EACA,CACF,EACA,GAAI,IAAW,EAAO,EAAU,GAChC,OAAO,EACR,EACD,OAAO,EAAU,EAAM,EAGzB,IAAI,EACE,EAAS,EAEf,QAAW,KAAO,OAAO,KAAK,CAAM,EAAG,CACrC,IAAM,EAAW,EAAO,UAAU,GAClC,GAAI,CAAC,EAAU,SAEf,IAAM,EAAO,EAAO,GACpB,GAAI,OAAO,IAAS,UAAY,IAAS,MAAQ,MAAM,QAAQ,CAAI,EAEjE,SAGF,IAAM,EAAS,EAAO,EAAS,KAAK,EACpC,GAAI,CAAC,GAAU,EAAO,SAAS,SAAW,EAAG,SAE7C,IAAM,EAAS,EACb,EAAO,SACP,EAAc,EAAO,OAAO,KAAM,EAAa,EAAM,CAAM,EAC3D,CACF,EAEA,GAAI,IAAW,EACb,IAAc,IAAK,CAAO,EAC1B,EAAU,GAAO,EAIrB,OAAO,GAAa,EAUtB,SAAS,EAAW,CAClB,EACA,EACA,EACA,EACA,EACS,CACT,GAAI,EAAQ,OAAO,EAkBnB,IAAM,EAAY,IAAS,GAE3B,GACE,CAAC,IACA,OAAO,IAAS,UAAY,IAAS,MAAQ,MAAM,QAAQ,CAAI,GAEhE,OAAO,EAGT,IAAM,EAAY,EACd,OAAO,YAAY,EAAmB,CAAM,EAAE,IAAI,CAAC,IAAS,CAAC,EAAM,EAAI,CAAC,CAAC,EACxE,EAAiC,OAEtC,GACE,OAAO,IAAc,UACrB,IAAc,MACd,MAAM,QAAQ,CAAS,EAGvB,OAAO,EAGT,IAAI,EACE,EAAS,EAEf,QAAW,KAAO,OAAO,KAAK,CAAM,EAAG,CACrC,IAAM,EAAQ,EAAO,GACrB,GAAI,IAAU,QAAa,IAAU,GAAO,SAE5C,IAAM,EAAW,EAAO,UAAU,GAClC,GAAI,CAAC,EAAU,SAEf,IAAM,EAAS,EAAO,EAAS,KAAK,EACpC,GAAI,CAAC,GAAU,EAAO,SAAS,SAAW,EAAG,SAE7C,IAAM,EAAW,IAAU,GAAO,CAAC,EAAI,EACvC,GAAI,OAAO,IAAa,UAAY,MAAM,QAAQ,CAAQ,EAAG,SAE7D,IAAM,EAAS,EACb,EAAO,SACP,EAAc,EAAO,OAAO,KAAM,EAAa,EAAM,CAAM,EAC3D,CACF,EAEA,GAAI,IAAW,EACb,IAAc,IAAK,CAAO,EAC1B,EAAU,GAAO,EAIrB,GAAI,CAAC,EAAW,OAAO,EAKvB,OAAO,EACH,CAAE,OAAQ,CAAU,EACpB,IAAM,EAAkC,OAAQ,CAAU,EAgBhE,SAAS,CAAoB,CAC3B,EACA,EACA,EACA,EACA,EACS,CACT,GAAI,OAAO,IAAU,UAAY,IAAU,KAAM,OAAO,EAExD,GAAI,MAAM,QAAQ,CAAK,EAAG,CACxB,IAAI,EAAU,GACR,EAAM,EAAM,IAAI,CAAC,IAAU,CAC/B,IAAM,EAAS,EACb,EACA,EACA,EACA,EACA,CACF,EACA,GAAI,IAAW,EAAO,EAAU,GAChC,OAAO,EACR,EACD,OAAO,EAAU,EAAM,EAGzB,IAAI,EACE,EAAS,EAEf,QAAW,KAAO,OAAO,KAAK,CAAM,EAAG,CACrC,IAAM,EAAQ,EAAO,GACrB,GAAI,IAAU,OAAW,SAIzB,GAAI,IAAQ,OAAS,IAAQ,MAAQ,IAAQ,MAAO,CAClD,IAAM,EAAS,EACb,EACA,EACA,EACA,EACA,CACF,EACA,GAAI,IAAW,EACb,IAAc,IAAK,CAAO,EAC1B,EAAU,GAAO,EAEnB,SAGF,IAAM,EAAW,EAAO,UAAU,GAClC,GAAI,CAAC,EAAU,SAEf,IAAM,EAAS,GACb,EACA,EACA,EACA,EACA,CACF,EACA,GAAI,IAAW,EACb,IAAc,IAAK,CAAO,EAC1B,EAAU,GAAO,EAIrB,OAAO,GAAa,EAItB,SAAS,EAAiB,CACxB,EACA,EACA,EACA,EACA,EACS,CACT,GAAI,OAAO,IAAU,UAAY,IAAU,MAAQ,MAAM,QAAQ,CAAK,EAKpE,OAAO,EAGT,IAAM,EAAS,EAAO,EAAS,KAAK,EACpC,GAAI,CAAC,EAAQ,OAAO,EAEpB,IAAM,EAAY,EAAwB,EAAS,IAAI,EACjD,EAAY,CAAC,EAAe,EAAO,CAAS,EAC5C,EAAoC,EACtC,CAAC,CAAC,KAAM,CAAK,CAAC,EACd,OAAO,QAAQ,CAAgC,EAE/C,EAEJ,QAAY,EAAU,KAAa,EAAS,CAC1C,GAAI,IAAa,MAAQ,IAAa,OAAW,SAIjD,IAAM,EAAS,EACb,EAAO,OACP,EACA,EACA,EACA,CACF,EAEM,EACJ,CAAC,GAAU,EAAO,SAAS,OAAS,EAChC,EACE,EAAO,SACP,EAAc,EAAO,OAAO,KAAM,EAAa,EAAM,CAAM,EAC3D,CAAE,MAAO,CAAO,CAClB,EAAE,MACF,EAEA,EAAQ,IAAa,QAAU,GAAe,EAAQ,CAAK,EAAI,EAErE,GAAI,IAAU,EACZ,IAAc,EACV,CAAC,EACD,IAAM,CAAkC,EAC5C,EAAU,GAAY,EAI1B,GAAI,CAAC,EAAW,OAAO,EAGvB,OAAO,EAkCT,SAAS,EAAc,CAAC,EAAgB,EAA0B,CAChE,GAAI,IAAW,EAAO,OAAO,EAK7B,IAAM,EAAS,EAAW,CAAK,EAEzB,EADQ,EAAW,CAAM,EACX,MAAM,EAAO,MAAM,EACvC,GAAI,EAAM,SAAW,EAAG,OAAO,EAK/B,MAAO,CAAE,GAAI,CAAC,CAAE,IAFd,EAAM,SAAW,EAAI,EAAM,GAAK,CAAE,IAAK,CAAM,CAEd,EAAG,CAAK,CAAE,EAG7C,SAAS,CAAU,CAAC,EAA2B,CAC7C,GAAI,OAAO,IAAU,UAAY,IAAU,KAAM,MAAO,CAAC,EACzD,IAAM,EAAS,EAAkC,IACjD,GAAI,IAAU,OAAW,MAAO,CAAC,EACjC,OAAO,MAAM,QAAQ,CAAK,EAAI,EAAQ,CAAC,CAAK,ECr/DvC,SAAS,EAAwB,IACnC,EACG,CACN,IAAO,GAAS,GAAwB,GAAG,CAAO,EAClD,GAAI,IAAU,OAAW,MAAM,EA4B1B,SAAS,EAAuB,IAClC,EAC6B,CAChC,IAAM,EAA2C,CAAC,EAElD,QAAW,KAAU,EACnB,QAAW,KAAY,OAAO,OAAO,CAAM,EAAG,CAC5C,IAAM,EAAQ,GAAa,CAAQ,EACnC,GAAI,IAAU,KAAM,SAkBpB,EAAmB,CAAK,EAExB,IAAM,EAAO,EAAM,QAAQ,KACrB,EAAsB,EAAI,CAAI,EACtB,EAAa,CAAI,EAC3B,OAMJ,GAAI,IAAe,QAAa,IAAe,EAAO,SAEtD,IAAM,EAAO,EAAY,CAAK,EACxB,EAAS,EAAY,CAAU,EAC/B,EACJ,EAAK,SAAW,EAAO,QACvB,EAAK,KAAK,CAAC,EAAQ,IAAU,IAAW,EAAO,EAAM,EASvD,GAAI,EAAa,EAAY,CAAK,GAAK,EAAa,EAAO,CAAU,EAAG,CACtE,IAAM,EAAW,EAAa,EAAO,CAAU,EAAI,EAAa,EAC1D,EAAa,IAAa,EAAa,EAAQ,EAErD,GAAI,EAAY,CAAQ,EAAE,SAAW,EAAG,CAkBtC,GAAI,IAAe,EAAY,SAI/B,GAAI,CAAC,EAAU,SAKf,EAAS,KACP,IAAI,EACF,EACA,EAAO,CAAU,EACjB,EAAO,CAAK,EACZ,EAAK,OAAS,EAAI,UAAY,YAChC,CACF,EACA,SAQF,GAAI,EACF,EAAS,KACP,IAAI,EACF,EACA,EAAO,CAAQ,EACf,EAAO,CAAU,EACjB,WACF,CACF,EAIF,SAGF,GAAI,CAAC,EAAU,SAIf,EAAS,KACP,IAAI,EACF,EACA,EAAO,CAAU,EACjB,EAAO,CAAK,EACZ,EAAK,OAAS,EAAI,UAAY,YAChC,CACF,EAIJ,OAAO,EAyCF,SAAS,EAAc,IACzB,EACG,CAUN,IAAM,EAAS,IAAI,IAEnB,QAAW,KAAU,EAAS,CAC5B,IAAM,EAAa,IAAI,IAIvB,QAAW,KAAY,IAAI,IAAI,OAAO,OAAO,CAAM,CAAC,EAAG,CACrD,IAAM,EAAQ,GAAa,CAAQ,EACnC,GAAI,IAAU,KAAM,SAEpB,IAAM,EAAO,EAAM,QAAQ,KACrB,EAAW,EAAW,IAAI,CAAI,EACpC,GAAI,IAAa,OAAW,EAAW,IAAI,EAAM,CAAC,CAAK,CAAC,EACnD,OAAS,KAAK,CAAK,EAK1B,QAAY,EAAM,KAAY,EAC5B,EAAO,IAAI,EAAM,GAAM,EAAM,CAAO,CAAC,EAUzC,IAAM,EAAW,CAAC,GAAG,EAAO,KAAK,CAAC,EAC/B,OAAO,CAAC,IAAkB,EAAI,CAAI,CAAC,EACnC,IAAI,CAAC,IAAS,CAAC,EAAe,EAAa,CAAI,CAAC,CAAU,EAE7D,QAAY,EAAM,KAAU,EAAiB,EAAS,EAAM,CAAK,EAEjE,GAAI,CACF,GAAyB,GAAG,CAAO,EACnC,MAAO,EAAO,CACd,QAAY,EAAM,KAAU,EAAmB,EAAS,EAAM,CAAK,EACnE,MAAM,GAqCV,SAAS,EAAK,CAAC,EAAc,EAAmC,CAC9D,GAAI,EAAQ,SAAW,EAAG,OAAO,EAAQ,GAEzC,IAAM,EAAU,EAAQ,OAAO,CAAC,IAAc,CAAC,GAAgB,CAAS,CAAC,EACnE,EAAW,EAAQ,OAAS,EAAI,EAAU,EAEhD,GAAI,EAAS,SAAW,EAAG,OAAO,EAAS,GAE3C,IAAM,EAAQ,EAAS,OAAO,CAAC,IAC7B,EAAS,MACP,CAAC,IAAU,IAAU,GAAa,EAAa,EAAO,CAAS,CACjE,CACF,EAEA,GAAI,EAAM,SAAW,EAAG,OAAO,EAAM,GAErC,MAAM,IAAI,GACR,EACA,EAAS,IAAI,CAAC,IAAc,EAAO,CAAS,CAAC,CAC/C,EAqCF,SAAS,EAAe,CAAC,EAAgC,CAKvD,GAAI,eAAgB,EAClB,OACE,OAAO,OAAO,EAAW,YAAY,GACpC,EAAuC,aAAe,GAI3D,OAAO,OAAO,OAAO,EAAW,SAAS,EAQ3C,SAAS,CAAY,CAAC,EAAkB,EAAwB,CAC9D,IAAI,EAAU,OAAO,eAAe,CAAO,EAE3C,MAAO,IAAY,MAAQ,IAAY,SAAS,UAAW,CACzD,GAAI,IAAY,EAAM,MAAO,GAC7B,EAAU,OAAO,eAAe,CAAO,EAGzC,MAAO,GAGT,SAAS,CAAM,CAAC,EAAwB,CACtC,OAAQ,GAA6B,MAAQ,OAAO,CAAK,EAgB3D,SAAS,EAAY,CAAC,EAAmC,CACvD,GAAI,OAAO,IAAU,WAAY,OAAO,KAExC,IAAM,EAAU,EAAoC,QACpD,GAAI,IAAW,QAAa,OAAO,EAAO,OAAS,SAAU,OAAO,KAEpE,OAAO",
-  "debugId": "28893FF1809EB86564756E2164756E21",
+  "debugId": "574261BAD0CAA36E64756E2164756E21",
   "names": []
 }

package/dist/{chunk-mqtfaqx5.js → chunk-rany5zgk.js}

@@ -1,5 +1,5 @@
 // @bun
 class J extends Error{lock;token;constructor(x,y,B="its lease ran out or another holder took it"){super(`Lost the lock "${x}" (token ${y}): ${B}.`);this.lock=x;this.token=y;this.name="LockLostError"}}var Q=60000,V=100,X=(x)=>new Promise((y)=>setTimeout(y,x));class O{store;name;owner;token;ttl;lost;controller=new AbortController;deadline;expiryTimer;renewTimer;done=!1;constructor(x,y,B,z,C,G){this.store=x;this.name=y;this.owner=B;this.token=z;this.ttl=C;this.lost=this.controller.signal,this.deadline=G+C,this.armExpiry()}get expired(){return this.lost.aborted||performance.now()>=this.deadline}async extend(x=this.ttl){if(this.lost.aborted)return!1;let y=performance.now();if(!await this.store.extend(this.name,this.owner,this.token,x))return this.markLost(),!1;if(this.done)return!0;return this.deadline=Math.max(this.deadline,y+x),this.armExpiry(),!0}async isHeld(){if(this.lost.aborted)return!1;let x=await this.store.held(this.name,this.owner,this.token);if(!x)this.markLost();return x}async fence(x){if(this.lost.aborted)throw new J(this.name,this.token);try{return await this.store.fence(this.name,this.owner,this.token,x)}catch(y){if(y instanceof J)this.markLost();throw y}}async release(){if(this.stop(),this.lost.aborted)return!1;return this.store.release(this.name,this.owner,this.token)}startRenewing(){if(this.renewTimer||this.done)return;this.renewTimer=setInterval(()=>{this.extend().catch((x)=>{console.error(`[gemi] Could not renew the lock "${this.name}".`,x)})},Math.max(1,Math.floor(this.ttl/3))),this.renewTimer.unref?.()}markLost(x){if(this.stop(),!this.lost.aborted)this.controller.abort(new J(this.name,this.token,x))}stop(){this.done=!0,clearInterval(this.renewTimer),clearTimeout(this.expiryTimer),this.renewTimer=void 0,this.expiryTimer=void 0}armExpiry(){clearTimeout(this.expiryTimer),this.expiryTimer=setTimeout(()=>this.markLost("its lease ran out before it was renewed"),Math.max(0,this.deadline-performance.now())),this.expiryTimer.unref?.()}}class Y{store;static token="locks";constructor(x){this.store=x}async acquire(x,y={}){let B=y.ttl??Q;if(!(B>0))throw Error(`A lock's ttl must be a positive number of milliseconds; got ${B}.`);let z=Bun.randomUUIDv7(),C=performance.now()+Math.max(0,y.wait??0);for(;;){let G=performance.now(),K=await this.store.acquire(x,z,B);if(K!==null){let N=new O(this.store,x,z,K,B,G);if(y.renew)N.startRenewing();return N}let M=C-performance.now();if(M<=0)return null;await X(Math.min(V,M))}}async run(x,y,B){let z=await this.acquire(x,{...y,renew:y.renew??!0});if(!z)return{acquired:!1};let C;try{C=await B(z)}catch(G){throw await z.release().catch(()=>{}),G}if(z.expired)throw z.markLost(),z.lost.reason;return await z.release(),{acquired:!0,value:C}}}
-export{J as hi,O as ii,Y as ji};
+export{J as aj,O as bj,Y as cj};
 
-//# debugId=A31CB51860241F3D64756E2164756E21
+//# debugId=E437643C207FA06F64756E2164756E21

package/dist/{chunk-mqtfaqx5.js.map → chunk-rany5zgk.js.map}

@@ -6,6 +6,6 @@
     "import { LockLostError, type LockStore } from \"./LockStore\";\n\nexport type AcquireOptions = {\n  /** The lease, in milliseconds. Default one minute. */\n  ttl?: number;\n  /**\n   * How long to keep trying when the lock is held, in milliseconds. Default\n   * `0`: one try.\n   */\n  wait?: number;\n  /**\n   * Renew the lease every third of `ttl` until the lock is released. Default\n   * `true` for `run`, `false` for `acquire`, whose caller may never release.\n   */\n  renew?: boolean;\n};\n\nexport type LockRunResult<T> = { acquired: true; value: T } | { acquired: false };\n\nconst DEFAULT_TTL = 60_000;\nconst WAIT_STEP = 100;\n\nconst sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));\n\n/**\n * One hold on a lock, from a successful `acquire` until `release` or the end\n * of its lease.\n *\n * `token` is the fencing token: it grows with each new holder of the name, so\n * a write that records it can be refused when an older holder tries to make\n * it late. `fence` does that refusal for writes to the application's own\n * database.\n *\n * `lost` aborts when the hold is known to be gone: a renewal found another\n * holder, or the lease ran out by this process's clock without a successful\n * renewal. The local deadline is measured from just before each request that\n * set the lease, so it always falls before the store's own expiry.\n */\nexport class HeldLock {\n  readonly lost: AbortSignal;\n  private readonly controller = new AbortController();\n  private deadline: number;\n  private expiryTimer: ReturnType<typeof setTimeout> | undefined;\n  private renewTimer: ReturnType<typeof setInterval> | undefined;\n  private done = false;\n\n  constructor(\n    private readonly store: LockStore,\n    readonly name: string,\n    readonly owner: string,\n    readonly token: number,\n    readonly ttl: number,\n    requestedAt: number,\n  ) {\n    this.lost = this.controller.signal;\n    this.deadline = requestedAt + ttl;\n    this.armExpiry();\n  }\n\n  /** Whether the lease has run out by this process's clock, or the hold was lost. */\n  get expired(): boolean {\n    return this.lost.aborted || performance.now() >= this.deadline;\n  }\n\n  /** Renews the lease. `false`, and `lost` aborted, when the hold was already gone. */\n  async extend(ttl = this.ttl): Promise<boolean> {\n    if (this.lost.aborted) return false;\n    const requestedAt = performance.now();\n    const ok = await this.store.extend(this.name, this.owner, this.token, ttl);\n    if (!ok) {\n      this.markLost();\n      return false;\n    }\n    if (this.done) return true;\n    this.deadline = Math.max(this.deadline, requestedAt + ttl);\n    this.armExpiry();\n    return true;\n  }\n\n  /** Asks the store whether this hold is still current. */\n  async isHeld(): Promise<boolean> {\n    if (this.lost.aborted) return false;\n    const held = await this.store.held(this.name, this.owner, this.token);\n    if (!held) this.markLost();\n    return held;\n  }\n\n  /**\n   * Runs `fn` only while this hold is current, and keeps the lock from\n   * changing hands until it settles; rejects with `LockLostError` otherwise.\n   * On the database store `fn` runs in a transaction on the store's\n   * connection, so ORM writes inside it commit only if the hold was current.\n   */\n  async fence<T>(fn: () => Promise<T>): Promise<T> {\n    if (this.lost.aborted) throw new LockLostError(this.name, this.token);\n    try {\n      return await this.store.fence(this.name, this.owner, this.token, fn);\n    } catch (error) {\n      if (error instanceof LockLostError) this.markLost();\n      throw error;\n    }\n  }\n\n  /** Ends the hold. `false` when it had already been lost. */\n  async release(): Promise<boolean> {\n    this.stop();\n    if (this.lost.aborted) return false;\n    return this.store.release(this.name, this.owner, this.token);\n  }\n\n  /** Renews every third of the lease until `release`. */\n  startRenewing() {\n    if (this.renewTimer || this.done) return;\n    this.renewTimer = setInterval(\n      () => {\n        this.extend().catch((error) => {\n          // Not lost yet: the local deadline still decides, so a store that\n          // comes back within the lease keeps the hold.\n          console.error(`[gemi] Could not renew the lock \"${this.name}\".`, error);\n        });\n      },\n      Math.max(1, Math.floor(this.ttl / 3)),\n    );\n    this.renewTimer.unref?.();\n  }\n\n  /** @internal Marks the hold as gone and stops every timer. */\n  markLost(detail?: string) {\n    this.stop();\n    if (!this.lost.aborted) {\n      this.controller.abort(new LockLostError(this.name, this.token, detail));\n    }\n  }\n\n  private stop() {\n    this.done = true;\n    clearInterval(this.renewTimer);\n    clearTimeout(this.expiryTimer);\n    this.renewTimer = undefined;\n    this.expiryTimer = undefined;\n  }\n\n  private armExpiry() {\n    clearTimeout(this.expiryTimer);\n    this.expiryTimer = setTimeout(\n      () => this.markLost(\"its lease ran out before it was renewed\"),\n      Math.max(0, this.deadline - performance.now()),\n    );\n    this.expiryTimer.unref?.();\n  }\n}\n\n/**\n * Named locks with leases and fencing tokens, over a `LockStore`. The queue\n * builds one over its own storage (`app(QueueManager).locks`), so with the\n * database driver the locks hold across every process sharing the database.\n * The `Lock` facade fronts it.\n */\nexport class LockManager {\n  static token = \"locks\";\n\n  constructor(readonly store: LockStore) {}\n\n  /** Takes the lock, or resolves `null` if it is held (after `wait`, when given). */\n  async acquire(name: string, options: AcquireOptions = {}): Promise<HeldLock | null> {\n    const ttl = options.ttl ?? DEFAULT_TTL;\n    if (!(ttl > 0))\n      throw new Error(`A lock's ttl must be a positive number of milliseconds; got ${ttl}.`);\n    const owner = Bun.randomUUIDv7();\n    const giveUpAt = performance.now() + Math.max(0, options.wait ?? 0);\n    for (;;) {\n      const requestedAt = performance.now();\n      const token = await this.store.acquire(name, owner, ttl);\n      if (token !== null) {\n        const lock = new HeldLock(this.store, name, owner, token, ttl, requestedAt);\n        if (options.renew) lock.startRenewing();\n        return lock;\n      }\n      const left = giveUpAt - performance.now();\n      if (left <= 0) return null;\n      await sleep(Math.min(WAIT_STEP, left));\n    }\n  }\n\n  /**\n   * Runs `fn` while holding the lock, renewing the lease as it runs, and\n   * releases it after. `{ acquired: false }` when the lock was held.\n   *\n   * If the hold is lost while `fn` runs, `lock.lost` aborts, and once `fn`\n   * settles this rejects with `LockLostError` instead of resolving: the caller\n   * must not treat work done without the lock as done under it.\n   */\n  async run<T>(\n    name: string,\n    options: AcquireOptions,\n    fn: (lock: HeldLock) => Promise<T> | T,\n  ): Promise<LockRunResult<T>> {\n    const lock = await this.acquire(name, { ...options, renew: options.renew ?? true });\n    if (!lock) return { acquired: false };\n\n    let value: T;\n    try {\n      value = await fn(lock);\n    } catch (error) {\n      await lock.release().catch(() => {});\n      throw error;\n    }\n    if (lock.expired) {\n      lock.markLost();\n      throw lock.lost.reason as LockLostError;\n    }\n    await lock.release();\n    return { acquired: true, value };\n  }\n}\n"
   ],
   "mappings": ";AAwFO,MAAM,UAAsB,KAAM,CAE5B,KACA,MAFX,WAAW,CACA,EACA,EACT,EAAS,8CACT,CACA,MAAM,kBAAkB,aAAgB,OAAW,IAAS,EAJnD,YACA,aAIT,KAAK,KAAO,gBAEhB,CC9EA,IAAM,EAAc,MACd,EAAY,IAEZ,EAAQ,CAAC,IAAe,IAAI,QAAQ,CAAC,IAAY,WAAW,EAAS,CAAE,CAAC,EAgBvE,MAAM,CAAS,CASD,MACR,KACA,MACA,MACA,IAZF,KACQ,WAAa,IAAI,gBAC1B,SACA,YACA,WACA,KAAO,GAEf,WAAW,CACQ,EACR,EACA,EACA,EACA,EACT,EACA,CANiB,aACR,YACA,aACA,aACA,WAGT,KAAK,KAAO,KAAK,WAAW,OAC5B,KAAK,SAAW,EAAc,EAC9B,KAAK,UAAU,KAIb,QAAO,EAAY,CACrB,OAAO,KAAK,KAAK,SAAW,YAAY,IAAI,GAAK,KAAK,cAIlD,OAAM,CAAC,EAAM,KAAK,IAAuB,CAC7C,GAAI,KAAK,KAAK,QAAS,MAAO,GAC9B,IAAM,EAAc,YAAY,IAAI,EAEpC,GAAI,CADO,MAAM,KAAK,MAAM,OAAO,KAAK,KAAM,KAAK,MAAO,KAAK,MAAO,CAAG,EAGvE,OADA,KAAK,SAAS,EACP,GAET,GAAI,KAAK,KAAM,MAAO,GAGtB,OAFA,KAAK,SAAW,KAAK,IAAI,KAAK,SAAU,EAAc,CAAG,EACzD,KAAK,UAAU,EACR,QAIH,OAAM,EAAqB,CAC/B,GAAI,KAAK,KAAK,QAAS,MAAO,GAC9B,IAAM,EAAO,MAAM,KAAK,MAAM,KAAK,KAAK,KAAM,KAAK,MAAO,KAAK,KAAK,EACpE,GAAI,CAAC,EAAM,KAAK,SAAS,EACzB,OAAO,OASH,MAAQ,CAAC,EAAkC,CAC/C,GAAI,KAAK,KAAK,QAAS,MAAM,IAAI,EAAc,KAAK,KAAM,KAAK,KAAK,EACpE,GAAI,CACF,OAAO,MAAM,KAAK,MAAM,MAAM,KAAK,KAAM,KAAK,MAAO,KAAK,MAAO,CAAE,EACnE,MAAO,EAAO,CACd,GAAI,aAAiB,EAAe,KAAK,SAAS,EAClD,MAAM,QAKJ,QAAO,EAAqB,CAEhC,GADA,KAAK,KAAK,EACN,KAAK,KAAK,QAAS,MAAO,GAC9B,OAAO,KAAK,MAAM,QAAQ,KAAK,KAAM,KAAK,MAAO,KAAK,KAAK,EAI7D,aAAa,EAAG,CACd,GAAI,KAAK,YAAc,KAAK,KAAM,OAClC,KAAK,WAAa,YAChB,IAAM,CACJ,KAAK,OAAO,EAAE,MAAM,CAAC,IAAU,CAG7B,QAAQ,MAAM,oCAAoC,KAAK,SAAU,CAAK,EACvE,GAEH,KAAK,IAAI,EAAG,KAAK,MAAM,KAAK,IAAM,CAAC,CAAC,CACtC,EACA,KAAK,WAAW,QAAQ,EAI1B,QAAQ,CAAC,EAAiB,CAExB,GADA,KAAK,KAAK,EACN,CAAC,KAAK,KAAK,QACb,KAAK,WAAW,MAAM,IAAI,EAAc,KAAK,KAAM,KAAK,MAAO,CAAM,CAAC,EAIlE,IAAI,EAAG,CACb,KAAK,KAAO,GACZ,cAAc,KAAK,UAAU,EAC7B,aAAa,KAAK,WAAW,EAC7B,KAAK,WAAa,OAClB,KAAK,YAAc,OAGb,SAAS,EAAG,CAClB,aAAa,KAAK,WAAW,EAC7B,KAAK,YAAc,WACjB,IAAM,KAAK,SAAS,yCAAyC,EAC7D,KAAK,IAAI,EAAG,KAAK,SAAW,YAAY,IAAI,CAAC,CAC/C,EACA,KAAK,YAAY,QAAQ,EAE7B,CAQO,MAAM,CAAY,CAGF,YAFd,OAAQ,QAEf,WAAW,CAAU,EAAkB,CAAlB,kBAGf,QAAO,CAAC,EAAc,EAA0B,CAAC,EAA6B,CAClF,IAAM,EAAM,EAAQ,KAAO,EAC3B,GAAI,EAAE,EAAM,GACV,MAAU,MAAM,+DAA+D,IAAM,EACvF,IAAM,EAAQ,IAAI,aAAa,EACzB,EAAW,YAAY,IAAI,EAAI,KAAK,IAAI,EAAG,EAAQ,MAAQ,CAAC,EAClE,OAAS,CACP,IAAM,EAAc,YAAY,IAAI,EAC9B,EAAQ,MAAM,KAAK,MAAM,QAAQ,EAAM,EAAO,CAAG,EACvD,GAAI,IAAU,KAAM,CAClB,IAAM,EAAO,IAAI,EAAS,KAAK,MAAO,EAAM,EAAO,EAAO,EAAK,CAAW,EAC1E,GAAI,EAAQ,MAAO,EAAK,cAAc,EACtC,OAAO,EAET,IAAM,EAAO,EAAW,YAAY,IAAI,EACxC,GAAI,GAAQ,EAAG,OAAO,KACtB,MAAM,EAAM,KAAK,IAAI,EAAW,CAAI,CAAC,QAYnC,IAAM,CACV,EACA,EACA,EAC2B,CAC3B,IAAM,EAAO,MAAM,KAAK,QAAQ,EAAM,IAAK,EAAS,MAAO,EAAQ,OAAS,EAAK,CAAC,EAClF,GAAI,CAAC,EAAM,MAAO,CAAE,SAAU,EAAM,EAEpC,IAAI,EACJ,GAAI,CACF,EAAQ,MAAM,EAAG,CAAI,EACrB,MAAO,EAAO,CAEd,MADA,MAAM,EAAK,QAAQ,EAAE,MAAM,IAAM,EAAE,EAC7B,EAER,GAAI,EAAK,QAEP,MADA,EAAK,SAAS,EACR,EAAK,KAAK,OAGlB,OADA,MAAM,EAAK,QAAQ,EACZ,CAAE,SAAU,GAAM,OAAM,EAEnC",
-  "debugId": "A31CB51860241F3D64756E2164756E21",
+  "debugId": "E437643C207FA06F64756E2164756E21",
   "names": []
 }

package/dist/{chunk-30xxc6r7.js → chunk-rmgkc3a2.js}

@@ -1,5 +1,5 @@
 // @bun
 class B{app;constructor(z){this.app=z}register(){}boot(){}shutdown(z){}}
-export{B as Yc};
+export{B as Ld};
 
-//# debugId=DBAD9399BC25435864756E2164756E21
+//# debugId=F1DD17D48F923AB564756E2164756E21

package/dist/{chunk-30xxc6r7.js.map → chunk-rmgkc3a2.js.map}

@@ -5,6 +5,6 @@
     "import type { Application } from \"../foundation/Application\";\n\n/**\n * What a provider's `shutdown()` may resolve: nothing, or whether it\n * abandoned work at the deadline. See `ServiceProvider` below.\n */\nexport type ProviderShutdownResult = void | { abandoned: boolean };\n\n/**\n * Every hook defaults to a no-op. `register()` binds services into the\n * container and must not resolve any of them; `boot()` runs after every\n * provider has registered, so it may resolve freely.\n *\n * `shutdown()` runs once when a production server is told to stop (`SIGTERM`\n * or `SIGINT`), after it has stopped accepting requests and the in-flight ones\n * have finished or run out of grace — so nothing a request needs is torn down\n * under it. Providers shut down in reverse registration order, so one\n * registered after another may still use it. Each is awaited, but under a\n * shared deadline (`GEMI_SHUTDOWN_PROVIDER_TIMEOUT`): one that overruns is\n * abandoned and the next begins, and one that throws is logged and does not\n * stop the rest. See `Application.shutdown`.\n *\n * Under `gemi dev` it also runs on every `bun --hot` reload, for the\n * application the reload replaced, once the new one is serving and the old\n * one's requests have finished (see `server/devReload.ts`). A hook that closes\n * something kept on `globalThis` across reloads would close it for the new\n * application too.\n *\n * `timeoutMs` is what is left of that shared deadline when this provider is\n * reached. A provider that waits for something — jobs finishing, a queue\n * draining — should bound its own wait by a little less than this, so that it\n * is still the one to report what it gave up on. Ignoring it is fine; the\n * provider is then simply abandoned at the deadline, with only a generic line\n * from `Application` to say so.\n *\n * A provider that bounds its own wait and gives up on work it was waiting for\n * resolves `{ abandoned: true }`. `Application` then reports it in `timedOut`\n * as if it had overrun, and the process exits `1` — the work was cut off just\n * the same, and an orchestrator or a log alert has to be able to see that from\n * the exit code. The provider names what it abandoned in its own log line.\n */\nexport abstract class ServiceProvider {\n  constructor(protected app: Application) {}\n\n  register(): void {}\n\n  boot(): void | Promise<void> {}\n\n  shutdown(options?: {\n    timeoutMs: number;\n  }): ProviderShutdownResult | Promise<ProviderShutdownResult> {}\n}\n"
   ],
   "mappings": ";AAyCO,MAAe,CAAgB,CACd,IAAtB,WAAW,CAAW,EAAkB,CAAlB,WAEtB,QAAQ,EAAS,EAEjB,IAAI,EAAyB,EAE7B,QAAQ,CAAC,EAEoD,EAC/D",
-  "debugId": "DBAD9399BC25435864756E2164756E21",
+  "debugId": "F1DD17D48F923AB564756E2164756E21",
   "names": []
 }

package/dist/{chunk-v8v5qfnh.js → chunk-rvspb96n.js}

@@ -1,5 +1,5 @@
 // @bun
-import{Ch as O}from"./chunk-2n4490pk.js";import{ji as S}from"./chunk-mqtfaqx5.js";import{Qi as E}from"./chunk-mvkz22p4.js";import{oj as U}from"./chunk-rpyczdta.js";class F{rows=new Map;async find(j,G){for(let Q of this.rows.values())if(Q.userId===j&&Q.provider===G)return{...Q};return null}async list(j){return[...this.rows.values()].filter((G)=>G.userId===j).map((G)=>({...G}))}async save(j,G,Q){let V=await this.find(j,G),W=new Date,Y={id:V?.id??Bun.randomUUIDv7(),userId:j,provider:G,...P(Q),needsReconnect:!1,revision:(V?.revision??0)+1,createdAt:V?.createdAt??W,updatedAt:W};return this.rows.set(Y.id,Y),{...Y}}async updateTokens(j,G,Q){let V=this.rows.get(j);if(!V||V.revision!==G)return null;let W=P(Q);W.providerAccountId??=V.providerAccountId;let Y={...V,...W,needsReconnect:!1,revision:G+1,updatedAt:new Date};return this.rows.set(j,Y),{...Y}}async markNeedsReconnect(j){let G=this.rows.get(j);if(G)this.rows.set(j,{...G,needsReconnect:!0,updatedAt:new Date})}async delete(j){this.rows.delete(j)}}class L{encrypter;table;sql;dialect;constructor(j,G,Q={}){this.encrypter=G;let V=Q.table??"gemi_oauth_connections";if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(V))throw Error(`The connections table name "${V}" is not a plain identifier.`);this.table=V,this.sql=j.sql,this.dialect=j.dialect}async createTable(){for(let j of q(this.dialect,this.table))await this.sql.unsafe(j)}async find(j,G){let Q=this.sql,V=await Q`
+import{vi as O}from"./chunk-y9f2see3.js";import{cj as S}from"./chunk-rany5zgk.js";import{Jj as E}from"./chunk-npbf06c1.js";import{hk as U}from"./chunk-6gwxvmjv.js";class F{rows=new Map;async find(j,G){for(let Q of this.rows.values())if(Q.userId===j&&Q.provider===G)return{...Q};return null}async list(j){return[...this.rows.values()].filter((G)=>G.userId===j).map((G)=>({...G}))}async save(j,G,Q){let V=await this.find(j,G),W=new Date,Y={id:V?.id??Bun.randomUUIDv7(),userId:j,provider:G,...P(Q),needsReconnect:!1,revision:(V?.revision??0)+1,createdAt:V?.createdAt??W,updatedAt:W};return this.rows.set(Y.id,Y),{...Y}}async updateTokens(j,G,Q){let V=this.rows.get(j);if(!V||V.revision!==G)return null;let W=P(Q);W.providerAccountId??=V.providerAccountId;let Y={...V,...W,needsReconnect:!1,revision:G+1,updatedAt:new Date};return this.rows.set(j,Y),{...Y}}async markNeedsReconnect(j){let G=this.rows.get(j);if(G)this.rows.set(j,{...G,needsReconnect:!0,updatedAt:new Date})}async delete(j){this.rows.delete(j)}}class L{encrypter;table;sql;dialect;constructor(j,G,Q={}){this.encrypter=G;let V=Q.table??"gemi_oauth_connections";if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(V))throw Error(`The connections table name "${V}" is not a plain identifier.`);this.table=V,this.sql=j.sql,this.dialect=j.dialect}async createTable(){for(let j of q(this.dialect,this.table))await this.sql.unsafe(j)}async find(j,G){let Q=this.sql,V=await Q`
       SELECT * FROM ${this.name(Q)} WHERE user_id = ${j} AND provider = ${G}
     `;return V[0]?this.decode(V[0]):null}async list(j){let G=this.sql;return(await G`
       SELECT * FROM ${this.name(G)} WHERE user_id = ${j} ORDER BY provider
@@ -66,6 +66,6 @@ import{Ch as O}from"./chunk-2n4490pk.js";import{ji as S}from"./chunk-mqtfaqx5.js
     "created_at" BIGINT NOT NULL,
     "updated_at" BIGINT NOT NULL${V}
 )`,`CREATE UNIQUE INDEX IF NOT EXISTS "${G}_user_id_provider_key" ON "${G}"("user_id", "provider")`]}class X extends Error{code;status;providerError;constructor(j,G,Q={}){super(G,Q.cause!==void 0?{cause:Q.cause}:void 0);this.code=j;this.name="OAuthConnectionError",this.status=Q.status,this.providerError=Q.providerError}}class K extends X{provider;constructor(j,G={}){super("reconnect_required",`The ${j} connection needs to be reconnected: its tokens were refused and could not be refreshed.`,G);this.provider=j;this.name="OAuthReconnectRequiredError"}}class C{config;constructor(j){for(let G of["authorizeUrl","tokenUrl"])_(G,j[G]);for(let G of["refreshUrl","revokeUrl"])if(j[G]!==void 0)_(G,j[G]);if(j.apiBaseUrl===void 0||j.apiBaseUrl===null||j.apiBaseUrl==="")throw Error(`OAuthConnectionProvider: apiBaseUrl is required. Set it to the provider's API origin (e.g. apiBaseUrl: "https://api.figma.com"); connection.fetch only sends the token there.`);_("apiBaseUrl",j.apiBaseUrl),this.config={scopeSeparator:" ",clientAuth:"body",pkce:!0,authorizationParams:{},refreshLeewaySeconds:60,multiple:!1,tokenPlacement:"header",...j,refreshGrantType:j.refreshGrantType??"refresh_token"}}async isTokenRejected(j){let G=this.config.isTokenRejected;if(!G)return j.status===401;return await G(j)}authorizationUrl(j){let G=new URL(this.config.authorizeUrl),Q={...this.config.authorizationParams,response_type:"code",client_id:this.config.clientId,redirect_uri:j.redirectUri,scope:this.config.scopes.join(this.config.scopeSeparator),state:j.state};if(this.config.pkce)Q.code_challenge=j.codeChallenge,Q.code_challenge_method="S256";for(let[V,W]of Object.entries(Q))G.searchParams.set(V,W);return G.toString()}exchangeCode(j){let G=new URLSearchParams({grant_type:"authorization_code",code:j.code,redirect_uri:j.redirectUri});if(this.config.pkce)G.set("code_verifier",j.codeVerifier);return this.tokenRequest(this.config.tokenUrl,G,{scopes:this.config.scopes,refreshToken:null,phase:"exchange"})}refresh(j,G){let Q=new URLSearchParams,V=this.config.refreshGrantType;if(V!==!1&&V!=="")Q.set("grant_type",V);return Q.set("refresh_token",j),this.tokenRequest(this.config.refreshUrl??this.config.tokenUrl,Q,{scopes:G,refreshToken:j,phase:"refresh"})}async revoke(j,G){if(!this.config.revokeUrl)throw new X("revoke_unsupported","This provider has no revokeUrl configured. Use disconnect() to forget the tokens locally.");let Q=new URLSearchParams({token:j,token_type_hint:G}),V;try{V=await fetch(this.config.revokeUrl,this.post(Q))}catch(W){throw new X("revoke_failed","The revocation request failed.",{cause:W})}if(!V.ok)throw new X("revoke_failed",`The provider refused the revocation (HTTP ${V.status}).`,{status:V.status})}post(j){let G={"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"};if(this.config.clientAuth==="basic"){let Q=`${encodeURIComponent(this.config.clientId)}:${encodeURIComponent(this.config.clientSecret)}`;G.Authorization=`Basic ${Buffer.from(Q).toString("base64")}`}else j.set("client_id",this.config.clientId),j.set("client_secret",this.config.clientSecret);return{method:"POST",headers:G,body:j.toString(),redirect:"error"}}async tokenRequest(j,G,Q){let V=Q.phase==="exchange"?"exchange_failed":"refresh_failed",W;try{W=await fetch(j,this.post(G))}catch($){throw new X(V,"The token request failed.",{cause:$})}let Y=await W.json().catch(()=>({}));if(!W.ok||typeof Y.access_token!=="string"||Y.access_token===""){let $=typeof Y.error==="string"&&/^[a-z0-9_]{1,64}$/.test(Y.error)?Y.error:void 0;throw new X(V,`The token endpoint refused the ${Q.phase==="exchange"?"code":"refresh token"} (HTTP ${W.status}${$?`, ${$}`:""}).`,{status:W.status,providerError:$})}let Z=Number(Y.expires_in),B=typeof Y.scope==="string"?Y.scope:void 0,J=Y.user_id_string??Y.user_id??Y.account_id;return{accessToken:Y.access_token,refreshToken:typeof Y.refresh_token==="string"&&Y.refresh_token!==""?Y.refresh_token:Q.refreshToken,tokenType:typeof Y.token_type==="string"?Y.token_type:null,expiresAt:Number.isFinite(Z)&&Z>0?new Date(Date.now()+Z*1000):null,scopes:B!==void 0?B.split(/[\s,]+/).filter(Boolean):Q.scopes,providerAccountId:typeof J==="string"||typeof J==="number"?String(J):null}}}function _(j,G){let Q;try{Q=new URL(String(G))}catch{Q=void 0}if(!Q||Q.protocol!=="https:"&&!(Q.protocol==="http:"&&M(Q.hostname)))throw Error(`OAuthConnectionProvider: ${j} must be an https URL (http only for localhost), got ${JSON.stringify(G)}.`)}function M(j){return j==="localhost"||j==="127.0.0.1"||j==="[::1]"||j==="::1"}class A{options;static token="auth.connections";resolvedStore;refreshing=new Map;fakes;fakeStore;fakeRequests=[];constructor(j){this.options=j;for(let[G,Q]of Object.entries(j.providers)){if(!Q.config.multiple)continue;let V=Object.keys(j.providers).find((W)=>W.startsWith(`${G}${D}`));if(G.includes(D)||V)throw Error(`auth.connections: "${V??G}" cannot be used alongside the multiple-account provider "${G}" ("${D}" separates a provider from an account id in the store).`)}}get providers(){return this.options.providers}get store(){if(this.fakeStore)return this.fakeStore;if(!this.resolvedStore){let j=this.options.store;this.resolvedStore=typeof j==="function"?j():j??new L(U(E).connection(),()=>O())}return this.resolvedStore}provider(j){let G=this.options.providers[j];if(!G){let Q=Object.keys(this.options.providers);throw new X("unknown_provider",`No OAuth connection provider "${j}" in auth.connections`+(Q.length>0?` (configured: ${Q.join(", ")}).`:" (none are configured)."))}return G}async for(j,G,Q){let V=this.provider(G),W=N(j);if(!V.config.multiple){let Z=await this.store.find(W,G);if(!Z||Q!==void 0&&Z.providerAccountId!==Q)return null;return new z(this,Z)}if(Q!==void 0){let Z=await this.store.find(W,T(G,Q))??await this.store.find(W,G);return Z&&Z.providerAccountId===Q?new z(this,Z):null}let[Y]=(await this.list(j,G)).sort((Z,B)=>B.connectedAt.getTime()-Z.connectedAt.getTime());return Y??null}async list(j,G){if(G!==void 0)this.provider(G);return(await this.store.list(N(j))).filter((V)=>{let W=this.providerName(V.provider);return W!==null&&(G===void 0||W===G)}).map((V)=>new z(this,V))}async save(j,G,Q){let V=this.provider(G),W=N(j),{profile:Y,...Z}=Q,B={refreshToken:null,tokenType:null,expiresAt:null,providerAccountId:null,scopes:V.config.scopes,...Z};if(!V.config.multiple)return new z(this,await this.store.save(W,G,B));let J=B.providerAccountId;if(typeof J!=="string"||J==="")throw new X("missing_account_id",`"${G}" allows several accounts per user, so a connection needs the provider's account id (providerAccountId), and the token exchange did not supply one.`);let $=await this.store.save(W,T(G,J),B),H=await this.store.find(W,G);if(H&&H.providerAccountId===J)await this.store.delete(H.id);return new z(this,$)}providerName(j){let G=this.options.providers;if(Object.hasOwn(G,j))return j;let Q=j.indexOf(D);if(Q<=0)return null;let V=j.slice(0,Q);return Object.hasOwn(G,V)&&G[V].config.multiple?V:null}fake(j={}){return this.fakes=new Map(Object.entries(j)),this.fakeStore=new F,this.fakeRequests.length=0,this}restore(){this.fakes=void 0,this.fakeStore=void 0,this.fakeRequests.length=0}get faked(){return this.fakes!==void 0}async send(j,G){if(!this.fakes)return fetch(G);this.fakeRequests.push(G.clone());let Q=this.fakes.get(j);if(!Q)throw Error(`Connections.fake() has no handler for "${j}". Pass one: Connections.fake({ ${j}: (req) => ... }).`);return Q(G)}refresh(j,G="requested"){let Q=this.refreshing.get(j.id);if(Q)return Q;let V=this.withLock(j.id,()=>this.refreshOnce(j,G)).finally(()=>this.refreshing.delete(j.id));return this.refreshing.set(j.id,V),V}async refreshOnce(j,G){let Q=this.providerName(j.provider)??j.provider,V=await this.store.find(j.userId,j.provider);if(!V||V.id!==j.id)throw new K(Q);if(V.revision!==j.revision&&!V.needsReconnect)return V;if(V.needsReconnect)throw new K(Q);let W=this.provider(Q);if(this.faked)return V;let Y=W.config.refreshStrategy;if(!Y&&V.refreshToken===null)throw await this.store.markNeedsReconnect(V.id),new K(Q);let Z;try{Z=Y?await Y({accessToken:V.accessToken,refreshToken:V.refreshToken,scopes:[...V.scopes],expiresAt:V.expiresAt,issuedAt:V.updatedAt,reason:G,providerAccountId:V.providerAccountId}):await W.refresh(V.refreshToken,V.scopes)}catch($){if($ instanceof X&&$.status!==void 0&&$.status>=400&&$.status<500&&$.providerError!=="invalid_client")throw await this.store.markNeedsReconnect(V.id),new K(Q,{cause:$,status:$.status,providerError:$.providerError});throw $}if(Z===null)return V;let B=await this.store.updateTokens(V.id,V.revision,Z);if(B)return B;let J=await this.store.find(V.userId,V.provider);if(!J)throw new K(Q);return J}async withLock(j,G){let Q=U();if(this.faked||!Q.bound(S))return G();let V=await Q.make(S).run(`gemi:oauth-connection:${j}`,{ttl:30000,wait:20000},()=>G());if(!V.acquired)throw new X("refresh_failed","Timed out waiting for another refresh of this connection to finish.");return V.value}}class z{manager;record;constructor(j,G){this.manager=j;this.record=G}get provider(){return this.manager.providerName(this.record.provider)??this.record.provider}get userId(){return this.record.userId}get providerAccountId(){return this.record.providerAccountId}get scopes(){return this.record.scopes}get expiresAt(){return this.record.expiresAt}get needsReconnect(){return this.record.needsReconnect}get connectedAt(){return this.record.createdAt}get status(){if(this.record.needsReconnect)return"needs_reconnect";let j=this.record.expiresAt?.getTime();if(this.record.refreshToken===null&&j!==void 0&&j<=Date.now())return"needs_reconnect";return"connected"}hasScopes(...j){return j.every((G)=>this.record.scopes.includes(G))}async fetch(j,G={}){let Q=this.resolveUrl(j),V=await this.current(),W=await this.send(Q,G,V.accessToken);if(!W.authorized||G.body instanceof ReadableStream)return W.response;if(!await this.manager.provider(this.provider).isTokenRejected(W.response))return W.response;await W.response.body?.cancel().catch(()=>{});let Z=await this.refreshFrom(V,"rejected");return(await this.send(Q,G,Z.accessToken)).response}async accessToken(){return(await this.current()).accessToken}async refresh(){await this.refreshFrom(this.record)}async revoke(){if(!this.manager.faked){let j=this.manager.provider(this.provider);if(this.record.refreshToken!==null)await j.revoke(this.record.refreshToken,"refresh_token");else await j.revoke(this.record.accessToken,"access_token")}await this.manager.store.delete(this.record.id)}async disconnect(){await this.manager.store.delete(this.record.id)}toJSON(){return{provider:this.provider,providerAccountId:this.providerAccountId,scopes:[...this.scopes],expiresAt:this.expiresAt,needsReconnect:this.needsReconnect,status:this.status,connectedAt:this.connectedAt}}[Symbol.for("nodejs.util.inspect.custom")](){return{ProviderConnection:this.toJSON()}}async current(){if(this.record.needsReconnect)throw new K(this.provider);let j=this.manager.provider(this.provider).config.refreshLeewaySeconds*1000,G=this.record.expiresAt?.getTime();if(G!==void 0&&G-Date.now()<=j)return this.refreshFrom(this.record,"expiring");return this.record}async refreshFrom(j,G="requested"){try{this.record=await this.manager.refresh(j,G)}catch(Q){if(Q instanceof K)this.record={...this.record,needsReconnect:!0};throw Q}return this.record}resolveUrl(j){let G=this.manager.provider(this.provider).config.apiBaseUrl,Q;try{Q=new URL(String(j),G)}catch{throw new X("forbidden_url",`connection.fetch was given ${JSON.stringify(String(j))}, which is not a URL.`)}if(Q.origin!==new URL(G).origin)throw new X("forbidden_url",`connection.fetch only sends the ${this.provider} token to ${new URL(G).origin} (apiBaseUrl), not to ${Q.origin}.`);if(Q.protocol!=="https:"&&!(Q.protocol==="http:"&&M(Q.hostname)))throw new X("forbidden_url",`connection.fetch only sends a token over https, not to ${Q.origin}.`);return Q}async send(j,G,Q){let V=j,W=(G.method??"GET").toUpperCase(),Y=G.body,Z=!0;if(G.redirect==="manual"||G.redirect==="error")return{response:await this.manager.send(this.provider,this.request(V,G,W,Y,Q)),authorized:Z};for(let B=0;;B++){let J=this.request(V,{...G,redirect:"manual"},W,Y,Z?Q:null),$=await this.manager.send(this.provider,J),H=$.headers.get("location");if(!b.has($.status)||H===null||B>=5)return{response:$,authorized:Z};await $.body?.cancel().catch(()=>{});let x=new URL(H,V);if(x.origin!==V.origin)Z=!1;if($.status===303||($.status===301||$.status===302)&&W==="POST")W="GET",Y=void 0;V=x}}request(j,G,Q,V,W){let Y=new Headers(G.headers),Z=new URL(j),B=this.manager.provider(this.provider).config.tokenPlacement;if(W===null)Y.delete("authorization");else if(B==="query")Z.searchParams.set("access_token",W);else Y.set("Authorization",`Bearer ${W}`);return new Request(Z,{...G,method:Q,body:V,headers:Y})}}var b=new Set([301,302,303,307,308]),D=":";function T(j,G){return`${j}${D}${G}`}function N(j){let G=typeof j==="object"&&j!==null?j.id:j;if(G===void 0||G===null||G==="")throw TypeError("An OAuth connection belongs to a user: pass the user (or its id).");return String(G)}
-export{F as lh,L as mh,X as nh,K as oh,C as ph,A as qh,z as rh};
+export{F as ei,L as fi,X as gi,K as hi,C as ii,A as ji,z as ki};
 
-//# debugId=1C262533876AC6C464756E2164756E21
+//# debugId=38A8DEECB767A5F064756E2164756E21