gemi 0.141.0 → 0.143.0

package/dist/{chunk-e9eh5k8a.js → chunk-9tgcmx4h.js}

@@ -1,4 +1,4 @@
 // @bun
-import{P as ue}from"./chunk-x4g0r9d3.js";import{Q as w}from"./chunk-yxhg3wjf.js";import{_}from"./chunk-gp4s95kn.js";import"./chunk-me6mmvbq.js";import{aa as l}from"./chunk-jrvg80jw.js";import{nl as o,rl as d}from"./chunk-tbhtx2t0.js";var g=o(_(),1);var ie=o(l(),1);var O=o(w(),1),R=o(l(),1),J=o(_(),1);var j=o(w(),1),E=o(l(),1),U=(e,s,t)=>{let n={EcsContainer:async(r)=>{let{fromHttp:a}=await import("./chunk-dje31gme.js"),{fromContainerMetadata:c}=await import("./chunk-tghh8r2q.js");return t?.debug("@aws-sdk/credential-provider-ini - credential_source is EcsContainer"),async()=>E.chain(a(r??{}),c(r))().then(L)},Ec2InstanceMetadata:async(r)=>{t?.debug("@aws-sdk/credential-provider-ini - credential_source is Ec2InstanceMetadata");let{fromInstanceMetadata:a}=await import("./chunk-tghh8r2q.js");return async()=>a(r)().then(L)},Environment:async(r)=>{t?.debug("@aws-sdk/credential-provider-ini - credential_source is Environment");let{fromEnv:a}=await import("./chunk-3wpxqcw7.js");return async()=>a(r)().then(L)}};if(e in n)return n[e];else throw new E.CredentialsProviderError(`Unsupported credential source in profile ${s}. Got ${e}, expected EcsContainer or Ec2InstanceMetadata or Environment.`,{logger:t})},L=(e)=>j.setCredentialFeature(e,"CREDENTIALS_PROFILE_NAMED_PROVIDER","p");var N=(e,{profile:s="default",logger:t}={})=>{return Boolean(e)&&typeof e==="object"&&typeof e.role_arn==="string"&&["undefined","string"].indexOf(typeof e.role_session_name)>-1&&["undefined","string"].indexOf(typeof e.external_id)>-1&&["undefined","string"].indexOf(typeof e.mfa_serial)>-1&&(he(e,{profile:s,logger:t})||ye(e,{profile:s,logger:t}))},he=(e,{profile:s,logger:t})=>{let n=typeof e.source_profile==="string"&&typeof e.credential_source>"u";if(n)t?.debug?.(`    ${s} isAssumeRoleWithSourceProfile source_profile=${e.source_profile}`);return n},ye=(e,{profile:s,logger:t})=>{let n=typeof e.credential_source==="string"&&typeof e.source_profile>"u";if(n)t?.debug?.(`    ${s} isCredentialSourceProfile credential_source=${e.credential_source}`);return n},v=async(e,s,t,n,r={},a)=>{t.logger?.debug("@aws-sdk/credential-provider-ini - resolveAssumeRoleCredentials (STS)");let c=s[e],{source_profile:h,region:I}=c;if(!t.roleAssumer){let{getDefaultRoleAssumer:i}=await import("./chunk-j9hf1jyd.js").then((m)=>o(m.default,1));t.roleAssumer=i({...t.clientConfig,credentialProviderLogger:t.logger,parentClientConfig:{...n,...t?.parentClientConfig,region:I??t?.parentClientConfig?.region??n?.region}},t.clientPlugins)}if(h&&h in r)throw new R.CredentialsProviderError(`Detected a cycle attempting to resolve credentials for profile ${J.getProfileName(t)}. Profiles visited: `+Object.keys(r).join(", "),{logger:t.logger});t.logger?.debug(`@aws-sdk/credential-provider-ini - finding credential resolver using ${h?`source_profile=[${h}]`:`profile=[${e}]`}`);let T=h?a(h,s,t,n,{...r,[h]:!0},G(s[h]??{})):(await U(c.credential_source,e,t.logger)(t))();if(G(c))return T.then((i)=>O.setCredentialFeature(i,"CREDENTIALS_PROFILE_SOURCE_PROFILE","o"));else{let i={RoleArn:c.role_arn,RoleSessionName:c.role_session_name||`aws-sdk-js-${Date.now()}`,ExternalId:c.external_id,DurationSeconds:parseInt(c.duration_seconds||"3600",10)},{mfa_serial:u}=c;if(u){if(!t.mfaCodeProvider)throw new R.CredentialsProviderError(`Profile ${e} requires multi-factor authentication, but no MFA code callback was provided.`,{logger:t.logger,tryNextLink:!1});i.SerialNumber=u,i.TokenCode=await t.mfaCodeProvider(u)}let y=await T;return t.roleAssumer(y,i).then((m)=>O.setCredentialFeature(m,"CREDENTIALS_PROFILE_SOURCE_PROFILE","o"))}},G=(e)=>{return!e.role_arn&&!!e.credential_source};var V=o(w(),1);var C=o(w(),1),X=o(l(),1),K=o(_(),1);var k=o(l(),1),W=o(ue(),1),z=o(_(),1);import{createHash as de,createPrivateKey as we,createPublicKey as ke,sign as me}from"crypto";import{promises as D}from"fs";import{homedir as fe}from"os";import{dirname as Ie,join as Y}from"path";class b{profileData;init;callerClientConfig;static REFRESH_THRESHOLD=300000;constructor(e,s,t){this.profileData=e,this.init=s,this.callerClientConfig=t}async loadCredentials(){let e=await this.loadToken();if(!e)throw new k.CredentialsProviderError(`Failed to load a token for session ${this.loginSession}, please re-authenticate using aws login`,{tryNextLink:!1,logger:this.logger});let s=e.accessToken,t=Date.now();if(new Date(s.expiresAt).getTime()-t<=b.REFRESH_THRESHOLD)return this.refresh(e);return{accessKeyId:s.accessKeyId,secretAccessKey:s.secretAccessKey,sessionToken:s.sessionToken,accountId:s.accountId,expiration:new Date(s.expiresAt)}}get logger(){return this.init?.logger}get loginSession(){return this.profileData.login_session}async refresh(e){let{SigninClient:s,CreateOAuth2TokenCommand:t}=await import("./chunk-b9d021hx.js").then((m)=>o(m.default,1)),{logger:n,userAgentAppId:r}=this.callerClientConfig??{},c=((i)=>{return i?.metadata?.handlerProtocol==="h2"})(this.callerClientConfig?.requestHandler)?void 0:this.callerClientConfig?.requestHandler,h=this.profileData.region??await this.callerClientConfig?.region?.()??process.env.AWS_REGION,I=new s({credentials:{accessKeyId:"",secretAccessKey:""},region:h,requestHandler:c,logger:n,userAgentAppId:r,...this.init?.clientConfig});this.createDPoPInterceptor(I.middlewareStack);let T={tokenInput:{clientId:e.clientId,refreshToken:e.refreshToken,grantType:"refresh_token"}};try{let i=await I.send(new t(T)),{accessKeyId:u,secretAccessKey:y,sessionToken:m}=i.tokenOutput?.accessToken??{},{refreshToken:x,expiresIn:H}=i.tokenOutput??{};if(!u||!y||!m||!x)throw new k.CredentialsProviderError("Token refresh response missing required fields",{logger:this.logger,tryNextLink:!1});let A=(H??900)*1000,f=new Date(Date.now()+A),q={...e,accessToken:{...e.accessToken,accessKeyId:u,secretAccessKey:y,sessionToken:m,expiresAt:f.toISOString()},refreshToken:x};await this.saveToken(q);let S=q.accessToken;return{accessKeyId:S.accessKeyId,secretAccessKey:S.secretAccessKey,sessionToken:S.sessionToken,accountId:S.accountId,expiration:f}}catch(i){if(i.name==="AccessDeniedException"){let u=i.error,y;switch(u){case"TOKEN_EXPIRED":y="Your session has expired. Please reauthenticate.";break;case"USER_CREDENTIALS_CHANGED":y="Unable to refresh credentials because of a change in your password. Please reauthenticate with your new password.";break;case"INSUFFICIENT_PERMISSIONS":y="Unable to refresh credentials due to insufficient permissions. You may be missing permission for the 'CreateOAuth2Token' action.";break;default:y=`Failed to refresh token: ${String(i)}. Please re-authenticate using \`aws login\``}throw new k.CredentialsProviderError(y,{logger:this.logger,tryNextLink:!1})}throw new k.CredentialsProviderError(`Failed to refresh token: ${String(i)}. Please re-authenticate using aws login`,{logger:this.logger})}}async loadToken(){let e=this.getTokenFilePath();try{let s;try{s=await z.readFile(e,{ignoreCache:this.init?.ignoreCache})}catch{s=await D.readFile(e,"utf8")}let t=JSON.parse(s),n=["accessToken","clientId","refreshToken","dpopKey"].filter((r)=>!t[r]);if(!t.accessToken?.accountId)n.push("accountId");if(n.length>0)throw new k.CredentialsProviderError(`Token validation failed, missing fields: ${n.join(", ")}`,{logger:this.logger,tryNextLink:!1});return t}catch(s){throw new k.CredentialsProviderError(`Failed to load token from ${e}: ${String(s)}`,{logger:this.logger,tryNextLink:!1})}}async saveToken(e){let s=this.getTokenFilePath(),t=Ie(s);try{await D.mkdir(t,{recursive:!0})}catch(n){}await D.writeFile(s,JSON.stringify(e,null,2),"utf8")}getTokenFilePath(){let e=process.env.AWS_LOGIN_CACHE_DIRECTORY??Y(fe(),".aws","login","cache"),s=Buffer.from(this.loginSession,"utf8"),t=de("sha256").update(s).digest("hex");return Y(e,`${t}.json`)}derToRawSignature(e){let s=2;if(e[s]!==2)throw Error("Invalid DER signature");s++;let t=e[s++],n=e.subarray(s,s+t);if(s+=t,e[s]!==2)throw Error("Invalid DER signature");s++;let r=e[s++],a=e.subarray(s,s+r);n=n[0]===0?n.subarray(1):n,a=a[0]===0?a.subarray(1):a;let c=Buffer.concat([Buffer.alloc(32-n.length),n]),h=Buffer.concat([Buffer.alloc(32-a.length),a]);return Buffer.concat([c,h])}createDPoPInterceptor(e){e.add((s)=>async(t)=>{if(W.HttpRequest.isInstance(t.request)){let n=t.request,r=`${n.protocol}//${n.hostname}${n.port?`:${n.port}`:""}${n.path}`,a=await this.generateDpop(n.method,r);n.headers={...n.headers,DPoP:a}}return s(t)},{step:"finalizeRequest",name:"dpopInterceptor",override:!0})}async generateDpop(e="POST",s){let t=await this.loadToken();try{let n=we({key:t.dpopKey,format:"pem",type:"sec1"}),a=ke(n).export({format:"der",type:"spki"}),c=-1;for(let f=0;f<a.length;f++)if(a[f]===4){c=f;break}let h=a.slice(c+1,c+33),I=a.slice(c+33,c+65),T={alg:"ES256",typ:"dpop+jwt",jwk:{kty:"EC",crv:"P-256",x:h.toString("base64url"),y:I.toString("base64url")}},i={jti:crypto.randomUUID(),htm:e,htu:s,iat:Math.floor(Date.now()/1000)},u=Buffer.from(JSON.stringify(T)).toString("base64url"),y=Buffer.from(JSON.stringify(i)).toString("base64url"),m=`${u}.${y}`,x=me("sha256",Buffer.from(m),n),A=this.derToRawSignature(x).toString("base64url");return`${m}.${A}`}catch(n){throw new k.CredentialsProviderError(`Failed to generate Dpop proof: ${n instanceof Error?n.message:String(n)}`,{logger:this.logger,tryNextLink:!1})}}}var Q=(e)=>async({callerClientConfig:s}={})=>{e?.logger?.debug?.("@aws-sdk/credential-providers - fromLoginCredentials");let t=await K.parseKnownFiles(e||{}),n=K.getProfileName({profile:e?.profile??s?.profile}),r=t[n];if(!r?.login_session)throw new X.CredentialsProviderError(`Profile ${n} does not contain login_session.`,{tryNextLink:!0,logger:e?.logger});let c=await new b(r,e,s).loadCredentials();return C.setCredentialFeature(c,"CREDENTIALS_LOGIN","AD")};var Z=(e)=>{return Boolean(e&&e.login_session)},M=async(e,s,t)=>{let n=await Q({...s,profile:e})({callerClientConfig:t});return V.setCredentialFeature(n,"CREDENTIALS_PROFILE_LOGIN","AC")};var p=o(w(),1),ee=(e)=>Boolean(e)&&typeof e==="object"&&typeof e.credential_process==="string",te=async(e,s)=>import("./chunk-6qydm38w.js").then(({fromProcess:t})=>t({...e,profile:s})().then((n)=>p.setCredentialFeature(n,"CREDENTIALS_PROFILE_PROCESS","v")));var $=o(w(),1),se=async(e,s,t={},n)=>{let{fromSSO:r}=await import("./chunk-p131vmpy.js");return r({profile:e,logger:t.logger,parentClientConfig:t.parentClientConfig,clientConfig:t.clientConfig})({callerClientConfig:n}).then((a)=>{if(s.sso_session)return $.setCredentialFeature(a,"CREDENTIALS_PROFILE_SSO","r");else return $.setCredentialFeature(a,"CREDENTIALS_PROFILE_SSO_LEGACY","t")})},ne=(e)=>e&&(typeof e.sso_start_url==="string"||typeof e.sso_account_id==="string"||typeof e.sso_session==="string"||typeof e.sso_region==="string"||typeof e.sso_role_name==="string");var ce=o(w(),1),P=(e)=>Boolean(e)&&typeof e==="object"&&typeof e.aws_access_key_id==="string"&&typeof e.aws_secret_access_key==="string"&&["undefined","string"].indexOf(typeof e.aws_session_token)>-1&&["undefined","string"].indexOf(typeof e.aws_account_id)>-1,F=async(e,s)=>{s?.logger?.debug("@aws-sdk/credential-provider-ini - resolveStaticCredentials");let t={accessKeyId:e.aws_access_key_id,secretAccessKey:e.aws_secret_access_key,sessionToken:e.aws_session_token,...e.aws_credential_scope&&{credentialScope:e.aws_credential_scope},...e.aws_account_id&&{accountId:e.aws_account_id}};return ce.setCredentialFeature(t,"CREDENTIALS_PROFILE","n")};var re=o(w(),1),ae=(e)=>Boolean(e)&&typeof e==="object"&&typeof e.web_identity_token_file==="string"&&typeof e.role_arn==="string"&&["undefined","string"].indexOf(typeof e.role_session_name)>-1,oe=async(e,s,t)=>import("./chunk-pfgbkhmm.js").then(({fromTokenFile:n})=>n({webIdentityTokenFile:e.web_identity_token_file,roleArn:e.role_arn,roleSessionName:e.role_session_name,roleAssumerWithWebIdentity:s.roleAssumerWithWebIdentity,logger:s.logger,parentClientConfig:s.parentClientConfig})({callerClientConfig:t}).then((r)=>re.setCredentialFeature(r,"CREDENTIALS_PROFILE_STS_WEB_ID_TOKEN","q")));var B=async(e,s,t,n,r={},a=!1)=>{let c=s[e];if(Object.keys(r).length>0&&P(c))return F(c,t);if(a||N(c,{profile:e,logger:t.logger}))return v(e,s,t,n,r,B);if(P(c))return F(c,t);if(ae(c))return oe(c,t,n);if(ee(c))return te(t,e);if(ne(c))return await se(e,c,t,n);if(Z(c))return M(e,t,n);throw new ie.CredentialsProviderError(`Could not resolve credentials using profile: [${e}] in configuration/credentials file(s).`,{logger:t.logger})};var Ne=(e={})=>async({callerClientConfig:s}={})=>{e.logger?.debug("@aws-sdk/credential-provider-ini - fromIni");let t=await g.parseKnownFiles(e);return B(g.getProfileName({profile:e.profile??s?.profile}),t,e,s)};export{Ne as fromIni};
+import{P as ue}from"./chunk-1w5dnkd1.js";import{Q as w}from"./chunk-m70hn4eg.js";import{_}from"./chunk-9dkpv8ev.js";import"./chunk-8ky8cmde.js";import{aa as l}from"./chunk-mkw35cz7.js";import{rl as o,vl as d}from"./chunk-t2nsn0r2.js";var g=o(_(),1);var ie=o(l(),1);var O=o(w(),1),R=o(l(),1),J=o(_(),1);var j=o(w(),1),E=o(l(),1),U=(e,s,t)=>{let n={EcsContainer:async(r)=>{let{fromHttp:a}=await import("./chunk-sa6a0wy1.js"),{fromContainerMetadata:c}=await import("./chunk-2ra5skyk.js");return t?.debug("@aws-sdk/credential-provider-ini - credential_source is EcsContainer"),async()=>E.chain(a(r??{}),c(r))().then(L)},Ec2InstanceMetadata:async(r)=>{t?.debug("@aws-sdk/credential-provider-ini - credential_source is Ec2InstanceMetadata");let{fromInstanceMetadata:a}=await import("./chunk-2ra5skyk.js");return async()=>a(r)().then(L)},Environment:async(r)=>{t?.debug("@aws-sdk/credential-provider-ini - credential_source is Environment");let{fromEnv:a}=await import("./chunk-1x9ghjpt.js");return async()=>a(r)().then(L)}};if(e in n)return n[e];else throw new E.CredentialsProviderError(`Unsupported credential source in profile ${s}. Got ${e}, expected EcsContainer or Ec2InstanceMetadata or Environment.`,{logger:t})},L=(e)=>j.setCredentialFeature(e,"CREDENTIALS_PROFILE_NAMED_PROVIDER","p");var N=(e,{profile:s="default",logger:t}={})=>{return Boolean(e)&&typeof e==="object"&&typeof e.role_arn==="string"&&["undefined","string"].indexOf(typeof e.role_session_name)>-1&&["undefined","string"].indexOf(typeof e.external_id)>-1&&["undefined","string"].indexOf(typeof e.mfa_serial)>-1&&(he(e,{profile:s,logger:t})||ye(e,{profile:s,logger:t}))},he=(e,{profile:s,logger:t})=>{let n=typeof e.source_profile==="string"&&typeof e.credential_source>"u";if(n)t?.debug?.(`    ${s} isAssumeRoleWithSourceProfile source_profile=${e.source_profile}`);return n},ye=(e,{profile:s,logger:t})=>{let n=typeof e.credential_source==="string"&&typeof e.source_profile>"u";if(n)t?.debug?.(`    ${s} isCredentialSourceProfile credential_source=${e.credential_source}`);return n},v=async(e,s,t,n,r={},a)=>{t.logger?.debug("@aws-sdk/credential-provider-ini - resolveAssumeRoleCredentials (STS)");let c=s[e],{source_profile:h,region:I}=c;if(!t.roleAssumer){let{getDefaultRoleAssumer:i}=await import("./chunk-83cvkhzn.js").then((m)=>o(m.default,1));t.roleAssumer=i({...t.clientConfig,credentialProviderLogger:t.logger,parentClientConfig:{...n,...t?.parentClientConfig,region:I??t?.parentClientConfig?.region??n?.region}},t.clientPlugins)}if(h&&h in r)throw new R.CredentialsProviderError(`Detected a cycle attempting to resolve credentials for profile ${J.getProfileName(t)}. Profiles visited: `+Object.keys(r).join(", "),{logger:t.logger});t.logger?.debug(`@aws-sdk/credential-provider-ini - finding credential resolver using ${h?`source_profile=[${h}]`:`profile=[${e}]`}`);let T=h?a(h,s,t,n,{...r,[h]:!0},G(s[h]??{})):(await U(c.credential_source,e,t.logger)(t))();if(G(c))return T.then((i)=>O.setCredentialFeature(i,"CREDENTIALS_PROFILE_SOURCE_PROFILE","o"));else{let i={RoleArn:c.role_arn,RoleSessionName:c.role_session_name||`aws-sdk-js-${Date.now()}`,ExternalId:c.external_id,DurationSeconds:parseInt(c.duration_seconds||"3600",10)},{mfa_serial:u}=c;if(u){if(!t.mfaCodeProvider)throw new R.CredentialsProviderError(`Profile ${e} requires multi-factor authentication, but no MFA code callback was provided.`,{logger:t.logger,tryNextLink:!1});i.SerialNumber=u,i.TokenCode=await t.mfaCodeProvider(u)}let y=await T;return t.roleAssumer(y,i).then((m)=>O.setCredentialFeature(m,"CREDENTIALS_PROFILE_SOURCE_PROFILE","o"))}},G=(e)=>{return!e.role_arn&&!!e.credential_source};var V=o(w(),1);var C=o(w(),1),X=o(l(),1),K=o(_(),1);var k=o(l(),1),W=o(ue(),1),z=o(_(),1);import{createHash as de,createPrivateKey as we,createPublicKey as ke,sign as me}from"crypto";import{promises as D}from"fs";import{homedir as fe}from"os";import{dirname as Ie,join as Y}from"path";class b{profileData;init;callerClientConfig;static REFRESH_THRESHOLD=300000;constructor(e,s,t){this.profileData=e,this.init=s,this.callerClientConfig=t}async loadCredentials(){let e=await this.loadToken();if(!e)throw new k.CredentialsProviderError(`Failed to load a token for session ${this.loginSession}, please re-authenticate using aws login`,{tryNextLink:!1,logger:this.logger});let s=e.accessToken,t=Date.now();if(new Date(s.expiresAt).getTime()-t<=b.REFRESH_THRESHOLD)return this.refresh(e);return{accessKeyId:s.accessKeyId,secretAccessKey:s.secretAccessKey,sessionToken:s.sessionToken,accountId:s.accountId,expiration:new Date(s.expiresAt)}}get logger(){return this.init?.logger}get loginSession(){return this.profileData.login_session}async refresh(e){let{SigninClient:s,CreateOAuth2TokenCommand:t}=await import("./chunk-78bfmwp0.js").then((m)=>o(m.default,1)),{logger:n,userAgentAppId:r}=this.callerClientConfig??{},c=((i)=>{return i?.metadata?.handlerProtocol==="h2"})(this.callerClientConfig?.requestHandler)?void 0:this.callerClientConfig?.requestHandler,h=this.profileData.region??await this.callerClientConfig?.region?.()??process.env.AWS_REGION,I=new s({credentials:{accessKeyId:"",secretAccessKey:""},region:h,requestHandler:c,logger:n,userAgentAppId:r,...this.init?.clientConfig});this.createDPoPInterceptor(I.middlewareStack);let T={tokenInput:{clientId:e.clientId,refreshToken:e.refreshToken,grantType:"refresh_token"}};try{let i=await I.send(new t(T)),{accessKeyId:u,secretAccessKey:y,sessionToken:m}=i.tokenOutput?.accessToken??{},{refreshToken:x,expiresIn:H}=i.tokenOutput??{};if(!u||!y||!m||!x)throw new k.CredentialsProviderError("Token refresh response missing required fields",{logger:this.logger,tryNextLink:!1});let A=(H??900)*1000,f=new Date(Date.now()+A),q={...e,accessToken:{...e.accessToken,accessKeyId:u,secretAccessKey:y,sessionToken:m,expiresAt:f.toISOString()},refreshToken:x};await this.saveToken(q);let S=q.accessToken;return{accessKeyId:S.accessKeyId,secretAccessKey:S.secretAccessKey,sessionToken:S.sessionToken,accountId:S.accountId,expiration:f}}catch(i){if(i.name==="AccessDeniedException"){let u=i.error,y;switch(u){case"TOKEN_EXPIRED":y="Your session has expired. Please reauthenticate.";break;case"USER_CREDENTIALS_CHANGED":y="Unable to refresh credentials because of a change in your password. Please reauthenticate with your new password.";break;case"INSUFFICIENT_PERMISSIONS":y="Unable to refresh credentials due to insufficient permissions. You may be missing permission for the 'CreateOAuth2Token' action.";break;default:y=`Failed to refresh token: ${String(i)}. Please re-authenticate using \`aws login\``}throw new k.CredentialsProviderError(y,{logger:this.logger,tryNextLink:!1})}throw new k.CredentialsProviderError(`Failed to refresh token: ${String(i)}. Please re-authenticate using aws login`,{logger:this.logger})}}async loadToken(){let e=this.getTokenFilePath();try{let s;try{s=await z.readFile(e,{ignoreCache:this.init?.ignoreCache})}catch{s=await D.readFile(e,"utf8")}let t=JSON.parse(s),n=["accessToken","clientId","refreshToken","dpopKey"].filter((r)=>!t[r]);if(!t.accessToken?.accountId)n.push("accountId");if(n.length>0)throw new k.CredentialsProviderError(`Token validation failed, missing fields: ${n.join(", ")}`,{logger:this.logger,tryNextLink:!1});return t}catch(s){throw new k.CredentialsProviderError(`Failed to load token from ${e}: ${String(s)}`,{logger:this.logger,tryNextLink:!1})}}async saveToken(e){let s=this.getTokenFilePath(),t=Ie(s);try{await D.mkdir(t,{recursive:!0})}catch(n){}await D.writeFile(s,JSON.stringify(e,null,2),"utf8")}getTokenFilePath(){let e=process.env.AWS_LOGIN_CACHE_DIRECTORY??Y(fe(),".aws","login","cache"),s=Buffer.from(this.loginSession,"utf8"),t=de("sha256").update(s).digest("hex");return Y(e,`${t}.json`)}derToRawSignature(e){let s=2;if(e[s]!==2)throw Error("Invalid DER signature");s++;let t=e[s++],n=e.subarray(s,s+t);if(s+=t,e[s]!==2)throw Error("Invalid DER signature");s++;let r=e[s++],a=e.subarray(s,s+r);n=n[0]===0?n.subarray(1):n,a=a[0]===0?a.subarray(1):a;let c=Buffer.concat([Buffer.alloc(32-n.length),n]),h=Buffer.concat([Buffer.alloc(32-a.length),a]);return Buffer.concat([c,h])}createDPoPInterceptor(e){e.add((s)=>async(t)=>{if(W.HttpRequest.isInstance(t.request)){let n=t.request,r=`${n.protocol}//${n.hostname}${n.port?`:${n.port}`:""}${n.path}`,a=await this.generateDpop(n.method,r);n.headers={...n.headers,DPoP:a}}return s(t)},{step:"finalizeRequest",name:"dpopInterceptor",override:!0})}async generateDpop(e="POST",s){let t=await this.loadToken();try{let n=we({key:t.dpopKey,format:"pem",type:"sec1"}),a=ke(n).export({format:"der",type:"spki"}),c=-1;for(let f=0;f<a.length;f++)if(a[f]===4){c=f;break}let h=a.slice(c+1,c+33),I=a.slice(c+33,c+65),T={alg:"ES256",typ:"dpop+jwt",jwk:{kty:"EC",crv:"P-256",x:h.toString("base64url"),y:I.toString("base64url")}},i={jti:crypto.randomUUID(),htm:e,htu:s,iat:Math.floor(Date.now()/1000)},u=Buffer.from(JSON.stringify(T)).toString("base64url"),y=Buffer.from(JSON.stringify(i)).toString("base64url"),m=`${u}.${y}`,x=me("sha256",Buffer.from(m),n),A=this.derToRawSignature(x).toString("base64url");return`${m}.${A}`}catch(n){throw new k.CredentialsProviderError(`Failed to generate Dpop proof: ${n instanceof Error?n.message:String(n)}`,{logger:this.logger,tryNextLink:!1})}}}var Q=(e)=>async({callerClientConfig:s}={})=>{e?.logger?.debug?.("@aws-sdk/credential-providers - fromLoginCredentials");let t=await K.parseKnownFiles(e||{}),n=K.getProfileName({profile:e?.profile??s?.profile}),r=t[n];if(!r?.login_session)throw new X.CredentialsProviderError(`Profile ${n} does not contain login_session.`,{tryNextLink:!0,logger:e?.logger});let c=await new b(r,e,s).loadCredentials();return C.setCredentialFeature(c,"CREDENTIALS_LOGIN","AD")};var Z=(e)=>{return Boolean(e&&e.login_session)},M=async(e,s,t)=>{let n=await Q({...s,profile:e})({callerClientConfig:t});return V.setCredentialFeature(n,"CREDENTIALS_PROFILE_LOGIN","AC")};var p=o(w(),1),ee=(e)=>Boolean(e)&&typeof e==="object"&&typeof e.credential_process==="string",te=async(e,s)=>import("./chunk-f5qdyw45.js").then(({fromProcess:t})=>t({...e,profile:s})().then((n)=>p.setCredentialFeature(n,"CREDENTIALS_PROFILE_PROCESS","v")));var $=o(w(),1),se=async(e,s,t={},n)=>{let{fromSSO:r}=await import("./chunk-63q7ycwt.js");return r({profile:e,logger:t.logger,parentClientConfig:t.parentClientConfig,clientConfig:t.clientConfig})({callerClientConfig:n}).then((a)=>{if(s.sso_session)return $.setCredentialFeature(a,"CREDENTIALS_PROFILE_SSO","r");else return $.setCredentialFeature(a,"CREDENTIALS_PROFILE_SSO_LEGACY","t")})},ne=(e)=>e&&(typeof e.sso_start_url==="string"||typeof e.sso_account_id==="string"||typeof e.sso_session==="string"||typeof e.sso_region==="string"||typeof e.sso_role_name==="string");var ce=o(w(),1),P=(e)=>Boolean(e)&&typeof e==="object"&&typeof e.aws_access_key_id==="string"&&typeof e.aws_secret_access_key==="string"&&["undefined","string"].indexOf(typeof e.aws_session_token)>-1&&["undefined","string"].indexOf(typeof e.aws_account_id)>-1,F=async(e,s)=>{s?.logger?.debug("@aws-sdk/credential-provider-ini - resolveStaticCredentials");let t={accessKeyId:e.aws_access_key_id,secretAccessKey:e.aws_secret_access_key,sessionToken:e.aws_session_token,...e.aws_credential_scope&&{credentialScope:e.aws_credential_scope},...e.aws_account_id&&{accountId:e.aws_account_id}};return ce.setCredentialFeature(t,"CREDENTIALS_PROFILE","n")};var re=o(w(),1),ae=(e)=>Boolean(e)&&typeof e==="object"&&typeof e.web_identity_token_file==="string"&&typeof e.role_arn==="string"&&["undefined","string"].indexOf(typeof e.role_session_name)>-1,oe=async(e,s,t)=>import("./chunk-rezmtdyt.js").then(({fromTokenFile:n})=>n({webIdentityTokenFile:e.web_identity_token_file,roleArn:e.role_arn,roleSessionName:e.role_session_name,roleAssumerWithWebIdentity:s.roleAssumerWithWebIdentity,logger:s.logger,parentClientConfig:s.parentClientConfig})({callerClientConfig:t}).then((r)=>re.setCredentialFeature(r,"CREDENTIALS_PROFILE_STS_WEB_ID_TOKEN","q")));var B=async(e,s,t,n,r={},a=!1)=>{let c=s[e];if(Object.keys(r).length>0&&P(c))return F(c,t);if(a||N(c,{profile:e,logger:t.logger}))return v(e,s,t,n,r,B);if(P(c))return F(c,t);if(ae(c))return oe(c,t,n);if(ee(c))return te(t,e);if(ne(c))return await se(e,c,t,n);if(Z(c))return M(e,t,n);throw new ie.CredentialsProviderError(`Could not resolve credentials using profile: [${e}] in configuration/credentials file(s).`,{logger:t.logger})};var Ne=(e={})=>async({callerClientConfig:s}={})=>{e.logger?.debug("@aws-sdk/credential-provider-ini - fromIni");let t=await g.parseKnownFiles(e);return B(g.getProfileName({profile:e.profile??s?.profile}),t,e,s)};export{Ne as fromIni};
 
-//# debugId=63D8E3A4E412161E64756E2164756E21
+//# debugId=A0B6993784687DCC64756E2164756E21

package/dist/{chunk-e9eh5k8a.js.map → chunk-9tgcmx4h.js.map}

@@ -15,6 +15,6 @@
     "import { setCredentialFeature } from \"@aws-sdk/core/client\";\nexport const isWebIdentityProfile = (arg) => Boolean(arg) &&\n    typeof arg === \"object\" &&\n    typeof arg.web_identity_token_file === \"string\" &&\n    typeof arg.role_arn === \"string\" &&\n    [\"undefined\", \"string\"].indexOf(typeof arg.role_session_name) > -1;\nexport const resolveWebIdentityCredentials = async (profile, options, callerClientConfig) => import(\"@aws-sdk/credential-provider-web-identity\").then(({ fromTokenFile }) => fromTokenFile({\n    webIdentityTokenFile: profile.web_identity_token_file,\n    roleArn: profile.role_arn,\n    roleSessionName: profile.role_session_name,\n    roleAssumerWithWebIdentity: options.roleAssumerWithWebIdentity,\n    logger: options.logger,\n    parentClientConfig: options.parentClientConfig,\n})({\n    callerClientConfig,\n}).then((creds) => setCredentialFeature(creds, \"CREDENTIALS_PROFILE_STS_WEB_ID_TOKEN\", \"q\")));\n"
   ],
   "mappings": ";wQAAA,SCAA,UCAA,SACA,KACA,KCFA,eACA,WACa,EAA0B,CAAC,EAAkB,EAAa,IAAW,CAC9E,IAAM,EAAqB,CACvB,aAAc,MAAO,IAAY,CAC7B,IAAQ,YAAa,KAAa,gCAC1B,yBAA0B,KAAa,+BAE/C,OADA,GAAQ,MAAM,sEAAsE,EAC7E,SAAY,QAAM,EAAS,GAAW,CAAC,CAAC,EAAG,EAAsB,CAAO,CAAC,EAAE,EAAE,KAAK,CAAgB,GAE7G,oBAAqB,MAAO,IAAY,CACpC,GAAQ,MAAM,6EAA6E,EAC3F,IAAQ,wBAAyB,KAAa,+BAC9C,MAAO,UAAY,EAAqB,CAAO,EAAE,EAAE,KAAK,CAAgB,GAE5E,YAAa,MAAO,IAAY,CAC5B,GAAQ,MAAM,qEAAqE,EACnF,IAAQ,WAAY,KAAa,+BACjC,MAAO,UAAY,EAAQ,CAAO,EAAE,EAAE,KAAK,CAAgB,EAEnE,EACA,GAAI,KAAoB,EACpB,OAAO,EAAmB,GAG1B,WAAM,IAAI,2BAAyB,4CAA4C,UAAoB,kEAC/B,CAAE,QAAO,CAAC,GAGhF,EAAmB,CAAC,IAAU,uBAAqB,EAAO,qCAAsC,GAAG,EDzBlG,IAAM,EAAsB,CAAC,GAAO,UAAU,UAAW,UAAW,CAAC,IAAM,CAC9E,OAAQ,QAAQ,CAAG,GACf,OAAO,IAAQ,UACf,OAAO,EAAI,WAAa,UACxB,CAAC,YAAa,QAAQ,EAAE,QAAQ,OAAO,EAAI,iBAAiB,EAAI,IAChE,CAAC,YAAa,QAAQ,EAAE,QAAQ,OAAO,EAAI,WAAW,EAAI,IAC1D,CAAC,YAAa,QAAQ,EAAE,QAAQ,OAAO,EAAI,UAAU,EAAI,KACxD,GAA8B,EAAK,CAAE,UAAS,QAAO,CAAC,GAAK,GAA0B,EAAK,CAAE,UAAS,QAAO,CAAC,IAEhH,GAAgC,CAAC,GAAO,UAAS,YAAa,CAChE,IAAM,EAAoB,OAAO,EAAI,iBAAmB,UAAY,OAAO,EAAI,kBAAsB,IACrG,GAAI,EACA,GAAQ,QAAQ,OAAO,kDAAwD,EAAI,gBAAgB,EAEvG,OAAO,GAEL,GAA4B,CAAC,GAAO,UAAS,YAAa,CAC5D,IAAM,EAAsB,OAAO,EAAI,oBAAsB,UAAY,OAAO,EAAI,eAAmB,IACvG,GAAI,EACA,GAAQ,QAAQ,OAAO,iDAAuD,EAAI,mBAAmB,EAEzG,OAAO,GAEE,EAA+B,MAAO,EAAa,EAAU,EAAS,EAAoB,EAAkB,CAAC,EAAG,IAAuB,CAChJ,EAAQ,QAAQ,MAAM,uEAAuE,EAC7F,IAAM,EAAc,EAAS,IACrB,iBAAgB,UAAW,EACnC,GAAI,CAAC,EAAQ,YAAa,CACtB,IAAQ,yBAA0B,KAAa,yDAC/C,EAAQ,YAAc,EAAsB,IACrC,EAAQ,aACX,yBAA0B,EAAQ,OAClC,mBAAoB,IACb,KACA,GAAS,mBACZ,OAAQ,GAAU,GAAS,oBAAoB,QAAU,GAAoB,MACjF,CACJ,EAAG,EAAQ,aAAa,EAE5B,GAAI,GAAkB,KAAkB,EACpC,MAAM,IAAI,2BAAyB,kEAC3B,iBAAe,CAAO,wBAC1B,OAAO,KAAK,CAAe,EAAE,KAAK,IAAI,EAAG,CAAE,OAAQ,EAAQ,MAAO,CAAC,EAE3E,EAAQ,QAAQ,MAAM,wEAAwE,EAAiB,mBAAmB,KAAoB,YAAY,MAAgB,EAClL,IAAM,EAAsB,EACtB,EAAmB,EAAgB,EAAU,EAAS,EAAoB,IACrE,GACF,GAAiB,EACtB,EAAG,EAAiC,EAAS,IAAmB,CAAC,CAAC,CAAC,GAChE,MAAM,EAAwB,EAAY,kBAAmB,EAAa,EAAQ,MAAM,EAAE,CAAO,GAAG,EAC3G,GAAI,EAAiC,CAAW,EAC5C,OAAO,EAAoB,KAAK,CAAC,IAAU,uBAAqB,EAAO,qCAAsC,GAAG,CAAC,EAEhH,KACD,IAAM,EAAS,CACX,QAAS,EAAY,SACrB,gBAAiB,EAAY,mBAAqB,cAAc,KAAK,IAAI,IACzE,WAAY,EAAY,YACxB,gBAAiB,SAAS,EAAY,kBAAoB,OAAQ,EAAE,CACxE,GACQ,cAAe,EACvB,GAAI,EAAY,CACZ,GAAI,CAAC,EAAQ,gBACT,MAAM,IAAI,2BAAyB,WAAW,iFAA4F,CAAE,OAAQ,EAAQ,OAAQ,YAAa,EAAM,CAAC,EAE5L,EAAO,aAAe,EACtB,EAAO,UAAY,MAAM,EAAQ,gBAAgB,CAAU,EAE/D,IAAM,EAAc,MAAM,EAC1B,OAAO,EAAQ,YAAY,EAAa,CAAM,EAAE,KAAK,CAAC,IAAU,uBAAqB,EAAO,qCAAsC,GAAG,CAAC,IAGxI,EAAmC,CAAC,IAAY,CAClD,MAAO,CAAC,EAAQ,UAAY,CAAC,CAAC,EAAQ,mBE9E1C,eCAA,eACA,WACA,WCFA,eACA,YACA,WACA,qBAAS,uBAAY,sBAAkB,WAAiB,gBACxD,mBAAS,WACT,kBAAS,YACT,kBAAS,WAAS,aACX,MAAM,CAAwB,CACjC,YACA,KACA,yBACO,mBAAoB,OAC3B,WAAW,CAAC,EAAa,EAAM,EAAoB,CAC/C,KAAK,YAAc,EACnB,KAAK,KAAO,EACZ,KAAK,mBAAqB,OAExB,gBAAe,EAAG,CACpB,IAAM,EAAQ,MAAM,KAAK,UAAU,EACnC,GAAI,CAAC,EACD,MAAM,IAAI,2BAAyB,sCAAsC,KAAK,uDAAwD,CAAE,YAAa,GAAO,OAAQ,KAAK,MAAO,CAAC,EAErL,IAAM,EAAc,EAAM,YACpB,EAAM,KAAK,IAAI,EAGrB,GAFmB,IAAI,KAAK,EAAY,SAAS,EAAE,QAAQ,EACtB,GACd,EAAwB,kBAC3C,OAAO,KAAK,QAAQ,CAAK,EAE7B,MAAO,CACH,YAAa,EAAY,YACzB,gBAAiB,EAAY,gBAC7B,aAAc,EAAY,aAC1B,UAAW,EAAY,UACvB,WAAY,IAAI,KAAK,EAAY,SAAS,CAC9C,KAEA,OAAM,EAAG,CACT,OAAO,KAAK,MAAM,UAElB,aAAY,EAAG,CACf,OAAO,KAAK,YAAY,mBAEtB,QAAO,CAAC,EAAO,CACjB,IAAQ,eAAc,4BAA6B,KAAa,0DACxD,SAAQ,kBAAmB,KAAK,oBAAsB,CAAC,EAIzD,GAHO,CAAC,IAAmB,CAC7B,OAAO,GAAgB,UAAU,kBAAoB,OAE7B,KAAK,oBAAoB,cAAc,EAC7D,OACA,KAAK,oBAAoB,eACzB,EAAS,KAAK,YAAY,QAAW,MAAM,KAAK,oBAAoB,SAAS,GAAM,QAAQ,IAAI,WAC/F,EAAS,IAAI,EAAa,CAC5B,YAAa,CACT,YAAa,GACb,gBAAiB,EACrB,EACA,SACA,iBACA,SACA,oBACG,KAAK,MAAM,YAClB,CAAC,EACD,KAAK,sBAAsB,EAAO,eAAe,EACjD,IAAM,EAAe,CACjB,WAAY,CACR,SAAU,EAAM,SAChB,aAAc,EAAM,aACpB,UAAW,eACf,CACJ,EACA,GAAI,CACA,IAAM,EAAW,MAAM,EAAO,KAAK,IAAI,EAAyB,CAAY,CAAC,GACrE,cAAa,kBAAiB,gBAAiB,EAAS,aAAa,aAAe,CAAC,GACrF,eAAc,aAAc,EAAS,aAAe,CAAC,EAC7D,GAAI,CAAC,GAAe,CAAC,GAAmB,CAAC,GAAgB,CAAC,EACtD,MAAM,IAAI,2BAAyB,iDAAkD,CACjF,OAAQ,KAAK,OACb,YAAa,EACjB,CAAC,EAEL,IAAM,GAAe,GAAa,KAAO,KACnC,EAAa,IAAI,KAAK,KAAK,IAAI,EAAI,CAAW,EAC9C,EAAe,IACd,EACH,YAAa,IACN,EAAM,YACT,YAAa,EACb,gBAAiB,EACjB,aAAc,EACd,UAAW,EAAW,YAAY,CACtC,EACA,aAAc,CAClB,EACA,MAAM,KAAK,UAAU,CAAY,EACjC,IAAM,EAAiB,EAAa,YACpC,MAAO,CACH,YAAa,EAAe,YAC5B,gBAAiB,EAAe,gBAChC,aAAc,EAAe,aAC7B,UAAW,EAAe,UAC1B,YACJ,EAEJ,MAAO,EAAO,CACV,GAAI,EAAM,OAAS,wBAAyB,CACxC,IAAM,EAAY,EAAM,MACpB,EACJ,OAAQ,OACC,gBACD,EAAU,mDACV,UACC,2BACD,EACI,oHACJ,UACC,2BACD,EACI,mIACJ,cAEA,EAAU,4BAA4B,OAAO,CAAK,gDAE1D,MAAM,IAAI,2BAAyB,EAAS,CAAE,OAAQ,KAAK,OAAQ,YAAa,EAAM,CAAC,EAE3F,MAAM,IAAI,2BAAyB,4BAA4B,OAAO,CAAK,4CAA6C,CAAE,OAAQ,KAAK,MAAO,CAAC,QAGjJ,UAAS,EAAG,CACd,IAAM,EAAgB,KAAK,iBAAiB,EAC5C,GAAI,CACA,IAAI,EACJ,GAAI,CACA,EAAY,MAAM,WAAS,EAAe,CAAE,YAAa,KAAK,MAAM,WAAY,CAAC,EAErF,KAAM,CACF,EAAY,MAAM,EAAG,SAAS,EAAe,MAAM,EAEvD,IAAM,EAAQ,KAAK,MAAM,CAAS,EAC5B,EAAgB,CAAC,cAAe,WAAY,eAAgB,SAAS,EAAE,OAAO,CAAC,IAAM,CAAC,EAAM,EAAE,EACpG,GAAI,CAAC,EAAM,aAAa,UACpB,EAAc,KAAK,WAAW,EAElC,GAAI,EAAc,OAAS,EACvB,MAAM,IAAI,2BAAyB,4CAA4C,EAAc,KAAK,IAAI,IAAK,CACvG,OAAQ,KAAK,OACb,YAAa,EACjB,CAAC,EAEL,OAAO,EAEX,MAAO,EAAO,CACV,MAAM,IAAI,2BAAyB,6BAA6B,MAAkB,OAAO,CAAK,IAAK,CAC/F,OAAQ,KAAK,OACb,YAAa,EACjB,CAAC,QAGH,UAAS,CAAC,EAAO,CACnB,IAAM,EAAgB,KAAK,iBAAiB,EACtC,EAAY,GAAQ,CAAa,EACvC,GAAI,CACA,MAAM,EAAG,MAAM,EAAW,CAAE,UAAW,EAAK,CAAC,EAEjD,MAAO,EAAO,EAEd,MAAM,EAAG,UAAU,EAAe,KAAK,UAAU,EAAO,KAAM,CAAC,EAAG,MAAM,EAE5E,gBAAgB,EAAG,CACf,IAAM,EAAY,QAAQ,IAAI,2BAA6B,EAAK,GAAQ,EAAG,OAAQ,QAAS,OAAO,EAC7F,EAAoB,OAAO,KAAK,KAAK,aAAc,MAAM,EACzD,EAAqB,GAAW,QAAQ,EAAE,OAAO,CAAiB,EAAE,OAAO,KAAK,EACtF,OAAO,EAAK,EAAW,GAAG,QAAyB,EAEvD,iBAAiB,CAAC,EAAc,CAC5B,IAAI,EAAS,EACb,GAAI,EAAa,KAAY,EACzB,MAAU,MAAM,uBAAuB,EAE3C,IACA,IAAM,EAAU,EAAa,KACzB,EAAI,EAAa,SAAS,EAAQ,EAAS,CAAO,EAEtD,GADA,GAAU,EACN,EAAa,KAAY,EACzB,MAAU,MAAM,uBAAuB,EAE3C,IACA,IAAM,EAAU,EAAa,KACzB,EAAI,EAAa,SAAS,EAAQ,EAAS,CAAO,EACtD,EAAI,EAAE,KAAO,EAAO,EAAE,SAAS,CAAC,EAAI,EACpC,EAAI,EAAE,KAAO,EAAO,EAAE,SAAS,CAAC,EAAI,EACpC,IAAM,EAAU,OAAO,OAAO,CAAC,OAAO,MAAM,GAAK,EAAE,MAAM,EAAG,CAAC,CAAC,EACxD,EAAU,OAAO,OAAO,CAAC,OAAO,MAAM,GAAK,EAAE,MAAM,EAAG,CAAC,CAAC,EAC9D,OAAO,OAAO,OAAO,CAAC,EAAS,CAAO,CAAC,EAE3C,qBAAqB,CAAC,EAAiB,CACnC,EAAgB,IAAI,CAAC,IAAS,MAAO,IAAS,CAC1C,GAAI,cAAY,WAAW,EAAK,OAAO,EAAG,CACtC,IAAM,EAAU,EAAK,QACf,EAAiB,GAAG,EAAQ,aAAa,EAAQ,WAAW,EAAQ,KAAO,IAAI,EAAQ,OAAS,KAAK,EAAQ,OAC7G,EAAO,MAAM,KAAK,aAAa,EAAQ,OAAQ,CAAc,EACnE,EAAQ,QAAU,IACX,EAAQ,QACX,KAAM,CACV,EAEJ,OAAO,EAAK,CAAI,GACjB,CACC,KAAM,kBACN,KAAM,kBACN,SAAU,EACd,CAAC,OAEC,aAAY,CAAC,EAAS,OAAQ,EAAU,CAC1C,IAAM,EAAQ,MAAM,KAAK,UAAU,EACnC,GAAI,CACA,IAAM,EAAa,GAAiB,CAChC,IAAK,EAAM,QACX,OAAQ,MACR,KAAM,MACV,CAAC,EAEK,EADY,GAAgB,CAAU,EAChB,OAAO,CAAE,OAAQ,MAAO,KAAM,MAAO,CAAC,EAC9D,EAAa,GACjB,QAAS,EAAI,EAAG,EAAI,EAAU,OAAQ,IAClC,GAAI,EAAU,KAAO,EAAM,CACvB,EAAa,EACb,MAGR,IAAM,EAAI,EAAU,MAAM,EAAa,EAAG,EAAa,EAAE,EACnD,EAAI,EAAU,MAAM,EAAa,GAAI,EAAa,EAAE,EACpD,EAAS,CACX,IAAK,QACL,IAAK,WACL,IAAK,CACD,IAAK,KACL,IAAK,QACL,EAAG,EAAE,SAAS,WAAW,EACzB,EAAG,EAAE,SAAS,WAAW,CAC7B,CACJ,EACM,EAAU,CACZ,IAAK,OAAO,WAAW,EACvB,IAAK,EACL,IAAK,EACL,IAAK,KAAK,MAAM,KAAK,IAAI,EAAI,IAAI,CACrC,EACM,EAAY,OAAO,KAAK,KAAK,UAAU,CAAM,CAAC,EAAE,SAAS,WAAW,EACpE,EAAa,OAAO,KAAK,KAAK,UAAU,CAAO,CAAC,EAAE,SAAS,WAAW,EACtE,EAAU,GAAG,KAAa,IAC1B,EAAgB,GAAK,SAAU,OAAO,KAAK,CAAO,EAAG,CAAU,EAE/D,EADe,KAAK,kBAAkB,CAAa,EACvB,SAAS,WAAW,EACtD,MAAO,GAAG,KAAW,IAEzB,MAAO,EAAO,CACV,MAAM,IAAI,2BAAyB,kCAAkC,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,IAAK,CAAE,OAAQ,KAAK,OAAQ,YAAa,EAAM,CAAC,GAGtL,CDjQO,IAAM,EAAuB,CAAC,IAAS,OAAS,sBAAuB,CAAC,IAAM,CACjF,GAAM,QAAQ,QAAQ,sDAAsD,EAC5E,IAAM,EAAW,MAAM,kBAAgB,GAAQ,CAAC,CAAC,EAC3C,EAAc,iBAAe,CAC/B,QAAS,GAAM,SAAW,GAAoB,OAClD,CAAC,EACK,EAAU,EAAS,GACzB,GAAI,CAAC,GAAS,cACV,MAAM,IAAI,2BAAyB,WAAW,oCAA+C,CACzF,YAAa,GACb,OAAQ,GAAM,MAClB,CAAC,EAGL,IAAM,EAAc,MADJ,IAAI,EAAwB,EAAS,EAAM,CAAkB,EAC3C,gBAAgB,EAClD,OAAO,uBAAqB,EAAa,oBAAqB,IAAI,GDjB/D,IAAM,EAAiB,CAAC,IAAS,CACpC,OAAO,QAAQ,GAAQ,EAAK,aAAa,GAEhC,EAA0B,MAAO,EAAa,EAAS,IAAuB,CACvF,IAAM,EAAc,MAAM,EAAqB,IACxC,EACH,QAAS,CACb,CAAC,EAAE,CAAE,oBAAmB,CAAC,EACzB,OAAO,uBAAqB,EAAa,4BAA6B,IAAI,GGV9E,eACa,GAAmB,CAAC,IAAQ,QAAQ,CAAG,GAAK,OAAO,IAAQ,UAAY,OAAO,EAAI,qBAAuB,SACzG,GAA4B,MAAO,EAAS,IAAmB,8BAAwC,KAAK,EAAG,iBAAkB,EAAY,IACnJ,EACH,SACJ,CAAC,EAAE,EAAE,KAAK,CAAC,IAAU,uBAAqB,EAAO,8BAA+B,GAAG,CAAC,CAAC,ECLrF,eACa,GAAwB,MAAO,EAAS,EAAa,EAAU,CAAC,EAAG,IAAuB,CACnG,IAAQ,WAAY,KAAa,+BACjC,OAAO,EAAQ,CACX,UACA,OAAQ,EAAQ,OAChB,mBAAoB,EAAQ,mBAC5B,aAAc,EAAQ,YAC1B,CAAC,EAAE,CACC,oBACJ,CAAC,EAAE,KAAK,CAAC,IAAU,CACf,GAAI,EAAY,YACZ,OAAO,uBAAqB,EAAO,0BAA2B,GAAG,EAGjE,YAAO,uBAAqB,EAAO,iCAAkC,GAAG,EAE/E,GAEQ,GAAe,CAAC,IAAQ,IAChC,OAAO,EAAI,gBAAkB,UAC1B,OAAO,EAAI,iBAAmB,UAC9B,OAAO,EAAI,cAAgB,UAC3B,OAAO,EAAI,aAAe,UAC1B,OAAO,EAAI,gBAAkB,UCxBrC,gBACa,EAAuB,CAAC,IAAQ,QAAQ,CAAG,GACpD,OAAO,IAAQ,UACf,OAAO,EAAI,oBAAsB,UACjC,OAAO,EAAI,wBAA0B,UACrC,CAAC,YAAa,QAAQ,EAAE,QAAQ,OAAO,EAAI,iBAAiB,EAAI,IAChE,CAAC,YAAa,QAAQ,EAAE,QAAQ,OAAO,EAAI,cAAc,EAAI,GACpD,EAA2B,MAAO,EAAS,IAAY,CAChE,GAAS,QAAQ,MAAM,6DAA6D,EACpF,IAAM,EAAc,CAChB,YAAa,EAAQ,kBACrB,gBAAiB,EAAQ,sBACzB,aAAc,EAAQ,qBAClB,EAAQ,sBAAwB,CAAE,gBAAiB,EAAQ,oBAAqB,KAChF,EAAQ,gBAAkB,CAAE,UAAW,EAAQ,cAAe,CACtE,EACA,OAAO,wBAAqB,EAAa,sBAAuB,GAAG,GChBvE,gBACa,GAAuB,CAAC,IAAQ,QAAQ,CAAG,GACpD,OAAO,IAAQ,UACf,OAAO,EAAI,0BAA4B,UACvC,OAAO,EAAI,WAAa,UACxB,CAAC,YAAa,QAAQ,EAAE,QAAQ,OAAO,EAAI,iBAAiB,EAAI,GACvD,GAAgC,MAAO,EAAS,EAAS,IAA8B,8BAA6C,KAAK,EAAG,mBAAoB,EAAc,CACvL,qBAAsB,EAAQ,wBAC9B,QAAS,EAAQ,SACjB,gBAAiB,EAAQ,kBACzB,2BAA4B,EAAQ,2BACpC,OAAQ,EAAQ,OAChB,mBAAoB,EAAQ,kBAChC,CAAC,EAAE,CACC,oBACJ,CAAC,EAAE,KAAK,CAAC,IAAU,wBAAqB,EAAO,uCAAwC,GAAG,CAAC,CAAC,ETRrF,IAAM,EAAqB,MAAO,EAAa,EAAU,EAAS,EAAoB,EAAkB,CAAC,EAAG,EAA4B,KAAU,CACrJ,IAAM,EAAO,EAAS,GACtB,GAAI,OAAO,KAAK,CAAe,EAAE,OAAS,GAAK,EAAqB,CAAI,EACpE,OAAO,EAAyB,EAAM,CAAO,EAEjD,GAAI,GAA6B,EAAoB,EAAM,CAAE,QAAS,EAAa,OAAQ,EAAQ,MAAO,CAAC,EACvG,OAAO,EAA6B,EAAa,EAAU,EAAS,EAAoB,EAAiB,CAAkB,EAE/H,GAAI,EAAqB,CAAI,EACzB,OAAO,EAAyB,EAAM,CAAO,EAEjD,GAAI,GAAqB,CAAI,EACzB,OAAO,GAA8B,EAAM,EAAS,CAAkB,EAE1E,GAAI,GAAiB,CAAI,EACrB,OAAO,GAA0B,EAAS,CAAW,EAEzD,GAAI,GAAa,CAAI,EACjB,OAAO,MAAM,GAAsB,EAAa,EAAM,EAAS,CAAkB,EAErF,GAAI,EAAe,CAAI,EACnB,OAAO,EAAwB,EAAa,EAAS,CAAkB,EAE3E,MAAM,IAAI,4BAAyB,iDAAiD,2CAAsD,CAAE,OAAQ,EAAQ,MAAO,CAAC,GD5BjK,IAAM,GAAU,CAAC,EAAO,CAAC,IAAM,OAAS,sBAAuB,CAAC,IAAM,CACzE,EAAK,QAAQ,MAAM,4CAA4C,EAC/D,IAAM,EAAW,MAAM,kBAAgB,CAAI,EAC3C,OAAO,EAAmB,iBAAe,CACrC,QAAS,EAAK,SAAW,GAAoB,OACjD,CAAC,EAAG,EAAU,EAAM,CAAkB",
-  "debugId": "63D8E3A4E412161E64756E2164756E21",
+  "debugId": "A0B6993784687DCC64756E2164756E21",
   "names": []
 }

package/dist/{chunk-23mcs80p.js → chunk-9xzg05xg.js}

@@ -1,5 +1,5 @@
 // @bun
-import{Hj as k,mj as g,nj as m}from"./chunk-e9xbdgb2.js";import{Tk as p}from"./chunk-kddgfct7.js";import{pl as n}from"./chunk-tbhtx2t0.js";var b={};n(b,{registeredNames:()=>x,register:()=>i,has:()=>S,get:()=>_,clearRegistry:()=>a});var M=new Map;function i(q,z){M.set(q,z)}function S(q){return M.has(q)}function _(q){let z=M.get(q);if(z===void 0)throw new k(q,[...M.keys()]);return z}function x(){return[...M.keys()]}function a(){M.clear()}import{createCipheriv as r,createDecipheriv as e,randomBytes as qq}from"crypto";class Y{static token="encrypter";keys=new Map;currentId;constructor(q={}){for(let[z,J]of Object.entries(q.keys??{})){if(!u.test(z))throw new U(`Encryption key id "${z}" is not valid. Use 1-32 letters, digits, "_" or "-": the id is written into every encrypted value.`);this.keys.set(z,zq(z,J))}if(q.current!==void 0){if(!this.keys.has(q.current))throw new U(`encryption.current is "${q.current}", but encryption.keys has no key by that id (${I(this.keys)}).`);this.currentId=q.current}else if(this.keys.size===1)this.currentId=[...this.keys.keys()][0];else if(this.keys.size>1)throw new U(`encryption.keys has ${this.keys.size} keys (${I(this.keys)}) and no encryption.current to say which one encrypts new values.`)}get configured(){return this.currentId!==void 0}get currentKeyId(){return this.requireCurrent()}encrypt(q){if(typeof q!=="string")throw TypeError(`Encrypter.encrypt takes a string, got ${Jq(q)}. Serialise other values first (JSON.stringify).`);let z=this.requireCurrent(),J=this.keys.get(z),Q=`${j}:${z}`,Z=qq(y),$=r(E,J,Z);$.setAAD(Buffer.from(Q));let X=Buffer.concat([$.update(q,"utf8"),$.final(),$.getAuthTag()]);return`${Q}:${Z.toString("base64url")}:${X.toString("base64url")}`}decrypt(q){let z=D(q);if(!z)throw new N("malformed","The value is not an encrypted envelope.");if(!this.configured)this.requireCurrent();let J=this.keys.get(z.keyId);if(!J)throw new N("unknown_key",`The value was encrypted with key "${z.keyId}", which is not in encryption.keys (${I(this.keys)}). Keep a key configured until encryption:rotate has re-encrypted the values written with it.`);try{let Q=e(E,J,z.iv);return Q.setAAD(Buffer.from(`${j}:${z.keyId}`)),Q.setAuthTag(z.tag),Buffer.concat([Q.update(z.ciphertext),Q.final()]).toString("utf8")}catch{throw new N("invalid",`The value did not authenticate under key "${z.keyId}": it was altered, or encrypted with a different key under the same id.`)}}isEncrypted(q){return D(q)!==null}keyIdOf(q){return D(q)?.keyId??null}needsReencryption(q){return this.keyIdOf(q)!==this.requireCurrent()}requireCurrent(){if(this.currentId===void 0)throw new U("No encryption key is configured. Add app/config/encryption.ts (defineEncryptionConfig({ keys: { k1: process.env.APP_ENCRYPTION_KEY } })) and list it as `encryption` in your Kernel's config. Generate a key with `openssl rand -base64 32`.");return this.currentId}}class U extends Error{constructor(q){super(q);this.name="EncryptionKeyError"}}class N extends Error{reason;column;constructor(q,z){super(z);this.reason=q;this.name="DecryptionError"}}var j="v1",E="aes-256-gcm",f=32,y=12,A=16,u=/^[A-Za-z0-9_-]{1,32}$/,v=/^[A-Za-z0-9_-]+$/;function zq(q,z){if(typeof z!=="string"||z.trim()==="")throw new U(`Encryption key "${q}" is empty. Is the environment variable it reads set?`);let J=z.trim().replace(/^base64:/,""),Q=/^[A-Za-z0-9+/=_-]+$/.test(J)?Buffer.from(J,"base64"):Buffer.alloc(0);if(Q.length!==f)throw new U(`Encryption key "${q}" is not ${f} bytes of base64 (it decodes to ${Q.length}). Generate one with \`openssl rand -base64 32\`.`);return Q}function D(q){if(typeof q!=="string")return null;let z=q.split(":");if(z.length!==4||z[0]!==j)return null;let[,J,Q,Z]=z;if(!u.test(J)||!v.test(Q)||!v.test(Z))return null;let $=Buffer.from(Q,"base64url"),X=Buffer.from(Z,"base64url");if($.length!==y||X.length<A)return null;return{keyId:J,iv:$,ciphertext:X.subarray(0,X.length-A),tag:X.subarray(X.length-A)}}function I(q){return q.size===0?"none configured":[...q.keys()].map((z)=>`"${z}"`).join(", ")}function Jq(q){return q===null?"null":Array.isArray(q)?"an array":`a ${typeof q}`}var h=new WeakMap;function T(q){let z=h.get(q);if(z===void 0)z=Object.values(q.fields).filter((J)=>J.encrypted===!0).map((J)=>J.name),h.set(q,z);return z}function Mq(){let q=new Set,z=[];for(let J of x()){let Q=O(J);if(!Q||q.has(Q.name))continue;q.add(Q.name);for(let Z of T(Q))z.push(`${Q.name}.${Z}`)}return z}function c(){let q=p();if(!q.bound(Y))throw new U("Encrypted columns need an Encrypter, and none is bound in this application. A booted Kernel binds one from the `encryption` config slice; a hand-built Application can bind its own: `application.instance(Encrypter, new Encrypter({ keys: { k1: key } }))`.");return q.make(Y)}var l=Symbol("gemi.orm.encryptedColumnsRaw");function Nq(q){return{...q,[l]:!0}}function Vq(q){return typeof q==="object"&&q!==null&&q[l]===!0}function Lq(q,z,J){if(!P(J))return;let Q={model:q.name,operation:z};d(q,J,Q,0);for(let Z of["by","_min","_max","_avg","_sum"])if(J[Z]!==void 0)o(q,J[Z],Z,Q);if(J.having!==void 0)B(q,J.having,Q)}var w=64;function d(q,z,J,Q){if(Q>w)return;if(z.where!==void 0)W(q,z.where,"where",J,Q);if(z.cursor!==void 0)W(q,z.cursor,"cursor",J,Q);if(z.orderBy!==void 0)K(q,z.orderBy,J,Q);if(z.distinct!==void 0)o(q,z.distinct,"distinct",J);for(let Z of[z.include,z.select]){if(!P(Z))continue;for(let[$,X]of Object.entries(Z)){if(!P(X))continue;if($==="_count"){if(!P(X.select))continue;for(let[G,F]of Object.entries(X.select)){let H=R(q,G);if(H&&P(F)&&F.where!==void 0)W(H,F.where,"where",J,Q+1)}continue}let C=R(q,$);if(C)d(C,X,J,Q+1)}}}var Qq=["some","every","none","is","isNot"];function W(q,z,J,Q,Z){if(Z>w)return;if(Array.isArray(z)){for(let $ of z)W(q,$,J,Q,Z);return}if(!P(z))return;for(let[$,X]of Object.entries(z)){if(X===void 0)continue;if($==="AND"||$==="OR"||$==="NOT"){W(q,X,J,Q,Z);continue}let C=q.fields[$];if(C){if(C.encrypted===!0&&!t(X))L(q,$,J,Q);continue}let G=R(q,$);if(G){if(!P(X))continue;let F=Object.keys(X).filter((H)=>Qq.includes(H));if(F.length>0)for(let H of F)W(G,X[H],J,Q,Z+1);else W(G,X,J,Q,Z+1);continue}if(P(X)){for(let F of Object.keys(X))if(q.fields[F]?.encrypted===!0)L(q,F,J,Q)}}}function K(q,z,J,Q){if(Q>w)return;if(Array.isArray(z)){for(let Z of z)K(q,Z,J,Q);return}if(!P(z))return;for(let[Z,$]of Object.entries(z)){if(q.fields[Z]?.encrypted===!0)L(q,Z,"orderBy",J);let X=R(q,Z);if(X&&P($)&&!("_count"in $))K(X,$,J,Q+1)}}function o(q,z,J,Q){let Z=typeof z==="string"?[z]:Array.isArray(z)?z.filter(($)=>typeof $==="string"):P(z)?Object.keys(z).filter(($)=>z[$]):[];for(let $ of Z)if(q.fields[$]?.encrypted===!0)L(q,$,J,Q)}function B(q,z,J){if(Array.isArray(z)){for(let Q of z)B(q,Q,J);return}if(!P(z))return;for(let[Q,Z]of Object.entries(z)){if(Q==="AND"||Q==="OR"||Q==="NOT"){B(q,Z,J);continue}if(q.fields[Q]?.encrypted===!0&&!t(Z))L(q,Q,"having",J)}}function t(q){if(q===null)return!0;if(!P(q))return!1;let z=Object.entries(q).filter(([,J])=>J!==void 0);return z.length>0&&z.every(([J,Q])=>(J==="equals"||J==="not")&&Q===null)}function L(q,z,J,Q){throw new m(J,Q.model,Q.operation,`${q.name}.${z} is an encrypted column: each write stores a different random ciphertext, so the database cannot compare, sort or group by it. Only null checks work on it ({ ${z}: null } or { ${z}: { not: null } }). To look a row up by a secret, store a keyed hash of it in a separate column and filter on that.`)}function Yq(q,z,J){let Q=T(q);if(Q.length===0||!P(J))return J;let Z={model:q.name,operation:z},$,X=(F)=>($??=c()).encrypt(F),C=J,G=(F,H)=>{if(H===C[F])return;if(C===J)C={...J};C[F]=H};switch(z){case"create":case"update":case"updateMany":G("data",V(Q,J.data,X,Z));break;case"createMany":G("data",Array.isArray(J.data)?Zq(J.data,(F)=>V(Q,F,X,Z)):V(Q,J.data,X,Z));break;case"upsert":G("create",V(Q,J.create,X,Z)),G("update",V(Q,J.update,X,Z));break}return C}function V(q,z,J,Q){if(!P(z))return z;let Z;for(let $ of q){if(!($ in z))continue;let X=z[$],C=s($,X,J,Q);if(C!==X)(Z??={...z})[$]=C}return Z??z}function s(q,z,J,Q){if(z===void 0||z===null)return z;if(typeof z==="string")return J(z);if(P(z)&&Object.keys(z).length===1&&"set"in z){let Z=z.set;return Z===null||Z===void 0?z:{set:s(q,Z,J,Q)}}throw new g("data",Q.model,Q.operation,`${Q.model}.${q} is an encrypted column and takes a string or null (or { set: string | null }); got ${Cq(z)}.`)}function Zq(q,z){let J;return q.forEach((Q,Z)=>{let $=z(Q);if($!==Q)(J??=[...q])[Z]=$}),J??q}function $q(q,z){let J=T(q);if(J.length===0||z.length===0)return;let Q;for(let Z of z){if(!P(Z))continue;for(let $ of J){let X=Z[$];if(typeof X!=="string")continue;Q??=c();try{Z[$]=Q.decrypt(X)}catch(C){if(C instanceof N)C.column={model:q.name,field:$},C.message=`Could not decrypt ${q.name}.${$}: ${C.message}`;throw C}}}}function Xq(q,z){let J=O(q.model),Q=[];for(let Z of z){if(!P(Z))continue;let $=Z[q.as];if(Array.isArray($))Q.push(...$);else if(P($))Q.push($)}if(Q.length===0)return;if(J)$q(J,Q);for(let Z of q.folded??[])Xq(Z,Q)}function O(q){if(!S(q))return;return _(q).$schema}function R(q,z){let J=q.relations[z];return J?O(J.model):void 0}function P(q){return typeof q==="object"&&q!==null&&!Array.isArray(q)&&!(q instanceof Date)}function Cq(q){if(Array.isArray(q))return"an array";if(q instanceof Date)return"a Date";return`a ${typeof q}`}
-export{i as Wi,S as Xi,_ as Yi,x as Zi,b as _i,Y as $i,U as aj,N as bj,T as cj,Mq as dj,c as ej,Nq as fj,Vq as gj,Lq as hj,Yq as ij,$q as jj,Xq as kj};
+import{Lj as k,qj as g,rj as m}from"./chunk-a37shxb1.js";import{Xk as p}from"./chunk-1ed75a7b.js";import{tl as n}from"./chunk-t2nsn0r2.js";var b={};n(b,{registeredNames:()=>x,register:()=>i,has:()=>S,get:()=>_,clearRegistry:()=>a});var M=new Map;function i(q,z){M.set(q,z)}function S(q){return M.has(q)}function _(q){let z=M.get(q);if(z===void 0)throw new k(q,[...M.keys()]);return z}function x(){return[...M.keys()]}function a(){M.clear()}import{createCipheriv as r,createDecipheriv as e,randomBytes as qq}from"crypto";class Y{static token="encrypter";keys=new Map;currentId;constructor(q={}){for(let[z,J]of Object.entries(q.keys??{})){if(!u.test(z))throw new U(`Encryption key id "${z}" is not valid. Use 1-32 letters, digits, "_" or "-": the id is written into every encrypted value.`);this.keys.set(z,zq(z,J))}if(q.current!==void 0){if(!this.keys.has(q.current))throw new U(`encryption.current is "${q.current}", but encryption.keys has no key by that id (${I(this.keys)}).`);this.currentId=q.current}else if(this.keys.size===1)this.currentId=[...this.keys.keys()][0];else if(this.keys.size>1)throw new U(`encryption.keys has ${this.keys.size} keys (${I(this.keys)}) and no encryption.current to say which one encrypts new values.`)}get configured(){return this.currentId!==void 0}get currentKeyId(){return this.requireCurrent()}encrypt(q){if(typeof q!=="string")throw TypeError(`Encrypter.encrypt takes a string, got ${Jq(q)}. Serialise other values first (JSON.stringify).`);let z=this.requireCurrent(),J=this.keys.get(z),Q=`${j}:${z}`,Z=qq(y),$=r(E,J,Z);$.setAAD(Buffer.from(Q));let X=Buffer.concat([$.update(q,"utf8"),$.final(),$.getAuthTag()]);return`${Q}:${Z.toString("base64url")}:${X.toString("base64url")}`}decrypt(q){let z=D(q);if(!z)throw new N("malformed","The value is not an encrypted envelope.");if(!this.configured)this.requireCurrent();let J=this.keys.get(z.keyId);if(!J)throw new N("unknown_key",`The value was encrypted with key "${z.keyId}", which is not in encryption.keys (${I(this.keys)}). Keep a key configured until encryption:rotate has re-encrypted the values written with it.`);try{let Q=e(E,J,z.iv);return Q.setAAD(Buffer.from(`${j}:${z.keyId}`)),Q.setAuthTag(z.tag),Buffer.concat([Q.update(z.ciphertext),Q.final()]).toString("utf8")}catch{throw new N("invalid",`The value did not authenticate under key "${z.keyId}": it was altered, or encrypted with a different key under the same id.`)}}isEncrypted(q){return D(q)!==null}keyIdOf(q){return D(q)?.keyId??null}needsReencryption(q){return this.keyIdOf(q)!==this.requireCurrent()}requireCurrent(){if(this.currentId===void 0)throw new U("No encryption key is configured. Add app/config/encryption.ts (defineEncryptionConfig({ keys: { k1: process.env.APP_ENCRYPTION_KEY } })) and list it as `encryption` in your Kernel's config. Generate a key with `openssl rand -base64 32`.");return this.currentId}}class U extends Error{constructor(q){super(q);this.name="EncryptionKeyError"}}class N extends Error{reason;column;constructor(q,z){super(z);this.reason=q;this.name="DecryptionError"}}var j="v1",E="aes-256-gcm",f=32,y=12,A=16,u=/^[A-Za-z0-9_-]{1,32}$/,v=/^[A-Za-z0-9_-]+$/;function zq(q,z){if(typeof z!=="string"||z.trim()==="")throw new U(`Encryption key "${q}" is empty. Is the environment variable it reads set?`);let J=z.trim().replace(/^base64:/,""),Q=/^[A-Za-z0-9+/=_-]+$/.test(J)?Buffer.from(J,"base64"):Buffer.alloc(0);if(Q.length!==f)throw new U(`Encryption key "${q}" is not ${f} bytes of base64 (it decodes to ${Q.length}). Generate one with \`openssl rand -base64 32\`.`);return Q}function D(q){if(typeof q!=="string")return null;let z=q.split(":");if(z.length!==4||z[0]!==j)return null;let[,J,Q,Z]=z;if(!u.test(J)||!v.test(Q)||!v.test(Z))return null;let $=Buffer.from(Q,"base64url"),X=Buffer.from(Z,"base64url");if($.length!==y||X.length<A)return null;return{keyId:J,iv:$,ciphertext:X.subarray(0,X.length-A),tag:X.subarray(X.length-A)}}function I(q){return q.size===0?"none configured":[...q.keys()].map((z)=>`"${z}"`).join(", ")}function Jq(q){return q===null?"null":Array.isArray(q)?"an array":`a ${typeof q}`}var h=new WeakMap;function T(q){let z=h.get(q);if(z===void 0)z=Object.values(q.fields).filter((J)=>J.encrypted===!0).map((J)=>J.name),h.set(q,z);return z}function Mq(){let q=new Set,z=[];for(let J of x()){let Q=O(J);if(!Q||q.has(Q.name))continue;q.add(Q.name);for(let Z of T(Q))z.push(`${Q.name}.${Z}`)}return z}function c(){let q=p();if(!q.bound(Y))throw new U("Encrypted columns need an Encrypter, and none is bound in this application. A booted Kernel binds one from the `encryption` config slice; a hand-built Application can bind its own: `application.instance(Encrypter, new Encrypter({ keys: { k1: key } }))`.");return q.make(Y)}var l=Symbol("gemi.orm.encryptedColumnsRaw");function Nq(q){return{...q,[l]:!0}}function Vq(q){return typeof q==="object"&&q!==null&&q[l]===!0}function Lq(q,z,J){if(!P(J))return;let Q={model:q.name,operation:z};d(q,J,Q,0);for(let Z of["by","_min","_max","_avg","_sum"])if(J[Z]!==void 0)o(q,J[Z],Z,Q);if(J.having!==void 0)B(q,J.having,Q)}var w=64;function d(q,z,J,Q){if(Q>w)return;if(z.where!==void 0)W(q,z.where,"where",J,Q);if(z.cursor!==void 0)W(q,z.cursor,"cursor",J,Q);if(z.orderBy!==void 0)K(q,z.orderBy,J,Q);if(z.distinct!==void 0)o(q,z.distinct,"distinct",J);for(let Z of[z.include,z.select]){if(!P(Z))continue;for(let[$,X]of Object.entries(Z)){if(!P(X))continue;if($==="_count"){if(!P(X.select))continue;for(let[G,F]of Object.entries(X.select)){let H=R(q,G);if(H&&P(F)&&F.where!==void 0)W(H,F.where,"where",J,Q+1)}continue}let C=R(q,$);if(C)d(C,X,J,Q+1)}}}var Qq=["some","every","none","is","isNot"];function W(q,z,J,Q,Z){if(Z>w)return;if(Array.isArray(z)){for(let $ of z)W(q,$,J,Q,Z);return}if(!P(z))return;for(let[$,X]of Object.entries(z)){if(X===void 0)continue;if($==="AND"||$==="OR"||$==="NOT"){W(q,X,J,Q,Z);continue}let C=q.fields[$];if(C){if(C.encrypted===!0&&!t(X))L(q,$,J,Q);continue}let G=R(q,$);if(G){if(!P(X))continue;let F=Object.keys(X).filter((H)=>Qq.includes(H));if(F.length>0)for(let H of F)W(G,X[H],J,Q,Z+1);else W(G,X,J,Q,Z+1);continue}if(P(X)){for(let F of Object.keys(X))if(q.fields[F]?.encrypted===!0)L(q,F,J,Q)}}}function K(q,z,J,Q){if(Q>w)return;if(Array.isArray(z)){for(let Z of z)K(q,Z,J,Q);return}if(!P(z))return;for(let[Z,$]of Object.entries(z)){if(q.fields[Z]?.encrypted===!0)L(q,Z,"orderBy",J);let X=R(q,Z);if(X&&P($)&&!("_count"in $))K(X,$,J,Q+1)}}function o(q,z,J,Q){let Z=typeof z==="string"?[z]:Array.isArray(z)?z.filter(($)=>typeof $==="string"):P(z)?Object.keys(z).filter(($)=>z[$]):[];for(let $ of Z)if(q.fields[$]?.encrypted===!0)L(q,$,J,Q)}function B(q,z,J){if(Array.isArray(z)){for(let Q of z)B(q,Q,J);return}if(!P(z))return;for(let[Q,Z]of Object.entries(z)){if(Q==="AND"||Q==="OR"||Q==="NOT"){B(q,Z,J);continue}if(q.fields[Q]?.encrypted===!0&&!t(Z))L(q,Q,"having",J)}}function t(q){if(q===null)return!0;if(!P(q))return!1;let z=Object.entries(q).filter(([,J])=>J!==void 0);return z.length>0&&z.every(([J,Q])=>(J==="equals"||J==="not")&&Q===null)}function L(q,z,J,Q){throw new m(J,Q.model,Q.operation,`${q.name}.${z} is an encrypted column: each write stores a different random ciphertext, so the database cannot compare, sort or group by it. Only null checks work on it ({ ${z}: null } or { ${z}: { not: null } }). To look a row up by a secret, store a keyed hash of it in a separate column and filter on that.`)}function Yq(q,z,J){let Q=T(q);if(Q.length===0||!P(J))return J;let Z={model:q.name,operation:z},$,X=(F)=>($??=c()).encrypt(F),C=J,G=(F,H)=>{if(H===C[F])return;if(C===J)C={...J};C[F]=H};switch(z){case"create":case"update":case"updateMany":G("data",V(Q,J.data,X,Z));break;case"createMany":G("data",Array.isArray(J.data)?Zq(J.data,(F)=>V(Q,F,X,Z)):V(Q,J.data,X,Z));break;case"upsert":G("create",V(Q,J.create,X,Z)),G("update",V(Q,J.update,X,Z));break}return C}function V(q,z,J,Q){if(!P(z))return z;let Z;for(let $ of q){if(!($ in z))continue;let X=z[$],C=s($,X,J,Q);if(C!==X)(Z??={...z})[$]=C}return Z??z}function s(q,z,J,Q){if(z===void 0||z===null)return z;if(typeof z==="string")return J(z);if(P(z)&&Object.keys(z).length===1&&"set"in z){let Z=z.set;return Z===null||Z===void 0?z:{set:s(q,Z,J,Q)}}throw new g("data",Q.model,Q.operation,`${Q.model}.${q} is an encrypted column and takes a string or null (or { set: string | null }); got ${Cq(z)}.`)}function Zq(q,z){let J;return q.forEach((Q,Z)=>{let $=z(Q);if($!==Q)(J??=[...q])[Z]=$}),J??q}function $q(q,z){let J=T(q);if(J.length===0||z.length===0)return;let Q;for(let Z of z){if(!P(Z))continue;for(let $ of J){let X=Z[$];if(typeof X!=="string")continue;Q??=c();try{Z[$]=Q.decrypt(X)}catch(C){if(C instanceof N)C.column={model:q.name,field:$},C.message=`Could not decrypt ${q.name}.${$}: ${C.message}`;throw C}}}}function Xq(q,z){let J=O(q.model),Q=[];for(let Z of z){if(!P(Z))continue;let $=Z[q.as];if(Array.isArray($))Q.push(...$);else if(P($))Q.push($)}if(Q.length===0)return;if(J)$q(J,Q);for(let Z of q.folded??[])Xq(Z,Q)}function O(q){if(!S(q))return;return _(q).$schema}function R(q,z){let J=q.relations[z];return J?O(J.model):void 0}function P(q){return typeof q==="object"&&q!==null&&!Array.isArray(q)&&!(q instanceof Date)}function Cq(q){if(Array.isArray(q))return"an array";if(q instanceof Date)return"a Date";return`a ${typeof q}`}
+export{i as _i,S as $i,_ as aj,x as bj,b as cj,Y as dj,U as ej,N as fj,T as gj,Mq as hj,c as ij,Nq as jj,Vq as kj,Lq as lj,Yq as mj,$q as nj,Xq as oj};
 
-//# debugId=7B54FE4E8E87DFDD64756E2164756E21
+//# debugId=3788A0337833F48964756E2164756E21

package/dist/{chunk-23mcs80p.js.map → chunk-9xzg05xg.js.map}

@@ -7,6 +7,6 @@
     "import { app } from \"../foundation/app\";\nimport {\n  DecryptionError,\n  Encrypter,\n  EncryptionKeyError,\n} from \"../services/encryption/Encrypter\";\nimport { InvalidArgumentError, UnsupportedByDesignError } from \"./errors\";\nimport * as registry from \"./registry\";\nimport type { ModelSchema } from \"./schema\";\n\n/**\n * Encrypted columns: a `String` field marked `/// @gemi.encrypted` in the\n * Prisma schema is stored as an `Encrypter` envelope and read back as the\n * plaintext.\n *\n * Applied in `Model.$exec`, per model, at the two places a value crosses the\n * boundary:\n *\n * - **Writes** encrypt the model's *own* columns in `data` (and an upsert's\n *   `create` / `update`). A nested write into a related model is not touched\n *   here: every nested write runs through the related model's own `$exec`,\n *   which encrypts its own columns, so encrypting it here as well would\n *   encrypt it twice.\n * - **Reads** decrypt the model's own rows after shaping. A batched `include`\n *   comes back through the child's `$exec` and is already decrypted; a folded\n *   (lateral) one never enters it, so the parent decrypts those rows on the\n *   child's behalf (`decryptFolded`) — the same split `redactFolded` handles\n *   for policies.\n *\n * The schema, not the model class, says which columns are encrypted. That is\n * deliberate: a column that is encrypted when written through `FigmaConnection`\n * and plaintext when written through `FigmaConnectionModel` is not encrypted\n * at rest. The generated base, the subclass and every `Model.on(...)` variant\n * share one `$schema`, so none of them can write the column in the clear.\n *\n * A filter, sort or grouping on an encrypted column is refused: every write\n * stores a different random ciphertext, so the database cannot compare it to\n * anything. A null check is the exception, because a NULL column is stored as\n * NULL.\n */\n\nconst fieldsBySchema = new WeakMap<ModelSchema, readonly string[]>();\n\n/** The schema's encrypted fields, in declaration order. Empty for most models. */\nexport function encryptedFields(schema: ModelSchema): readonly string[] {\n  let fields = fieldsBySchema.get(schema);\n  if (fields === undefined) {\n    fields = Object.values(schema.fields)\n      .filter((field) => field.encrypted === true)\n      .map((field) => field.name);\n    fieldsBySchema.set(schema, fields);\n  }\n  return fields;\n}\n\n/** `Model.field` for every encrypted column of every registered model. */\nexport function encryptedColumnsInRegistry(): string[] {\n  const seen = new Set<string>();\n  const columns: string[] = [];\n  for (const name of registry.registeredNames()) {\n    const schema = schemaOf(name);\n    if (!schema || seen.has(schema.name)) continue;\n    seen.add(schema.name);\n    for (const field of encryptedFields(schema)) columns.push(`${schema.name}.${field}`);\n  }\n  return columns;\n}\n\n/**\n * The application's `Encrypter`. An application booted without the\n * framework's providers (a test harness that binds only the database) gets a\n * typed error naming the fix rather than a container error.\n */\nexport function currentEncrypter(): Encrypter {\n  const application = app();\n  if (!application.bound(Encrypter)) {\n    throw new EncryptionKeyError(\n      \"Encrypted columns need an Encrypter, and none is bound in this \" +\n        \"application. A booted Kernel binds one from the `encryption` config \" +\n        \"slice; a hand-built Application can bind its own: \" +\n        \"`application.instance(Encrypter, new Encrypter({ keys: { k1: key } }))`.\",\n    );\n  }\n  return application.make(Encrypter);\n}\n\n// --- the internal raw mode ---------------------------------------------------\n\n/**\n * Marks an `$exec` call as reading and writing encrypted columns *as stored*:\n * no decryption of results, no encryption of `data`, and filters on encrypted\n * columns allowed (compared against the envelope). Used by `encryption:rotate`\n * to compare-and-swap one envelope for another. A module-private symbol, like\n * the other `$exec` markers, so an application cannot set it.\n */\nconst RAW = Symbol(\"gemi.orm.encryptedColumnsRaw\");\n\nexport function markEncryptionRaw<T extends object>(options: T): T {\n  return { ...options, [RAW]: true };\n}\n\nexport function isEncryptionRaw(options: unknown): boolean {\n  return (\n    typeof options === \"object\" &&\n    options !== null &&\n    (options as Record<symbol, unknown>)[RAW] === true\n  );\n}\n\n// --- refusing filters --------------------------------------------------------\n\ninterface Origin {\n  model: string;\n  operation: string;\n}\n\n/**\n * Refuses any argument that would make the database compare, sort or group an\n * encrypted column: `where` (including relation filters into other models),\n * `orderBy`, `distinct`, `cursor`, `groupBy`'s `by` and `having`, the\n * `_min` / `_max` aggregates, and the same arguments nested inside an\n * `include` or `select`.\n *\n * Walked whether or not this model has encrypted columns, because a relation\n * filter or an include reaches other models'.\n */\nexport function assertNoEncryptedFilters(schema: ModelSchema, op: string, args: unknown): void {\n  if (!isObject(args)) return;\n  const origin: Origin = { model: schema.name, operation: op };\n  readArgs(schema, args, origin, 0);\n  for (const key of [\"by\", \"_min\", \"_max\", \"_avg\", \"_sum\"]) {\n    if (args[key] !== undefined) fieldList(schema, args[key], key, origin);\n  }\n  if (args.having !== undefined) having(schema, args.having, origin);\n}\n\n/** Generous: relation depth is bounded by `MAX_RELATION_DEPTH` long before this. */\nconst MAX_WALK_DEPTH = 64;\n\nfunction readArgs(schema: ModelSchema, args: Record<string, any>, origin: Origin, depth: number) {\n  if (depth > MAX_WALK_DEPTH) return;\n  if (args.where !== undefined) where(schema, args.where, \"where\", origin, depth);\n  if (args.cursor !== undefined) where(schema, args.cursor, \"cursor\", origin, depth);\n  if (args.orderBy !== undefined) orderBy(schema, args.orderBy, origin, depth);\n  if (args.distinct !== undefined) fieldList(schema, args.distinct, \"distinct\", origin);\n\n  for (const projection of [args.include, args.select]) {\n    if (!isObject(projection)) continue;\n    for (const [key, value] of Object.entries(projection)) {\n      if (!isObject(value)) continue;\n      if (key === \"_count\") {\n        if (!isObject(value.select)) continue;\n        for (const [name, count] of Object.entries(value.select)) {\n          const target = relationTarget(schema, name);\n          if (target && isObject(count) && count.where !== undefined) {\n            where(target, count.where, \"where\", origin, depth + 1);\n          }\n        }\n        continue;\n      }\n      const target = relationTarget(schema, key);\n      if (target) readArgs(target, value, origin, depth + 1);\n    }\n  }\n}\n\nconst RELATION_FILTERS = [\"some\", \"every\", \"none\", \"is\", \"isNot\"];\n\nfunction where(\n  schema: ModelSchema,\n  node: unknown,\n  argument: string,\n  origin: Origin,\n  depth: number,\n): void {\n  if (depth > MAX_WALK_DEPTH) return;\n  if (Array.isArray(node)) {\n    for (const item of node) where(schema, item, argument, origin, depth);\n    return;\n  }\n  if (!isObject(node)) return;\n\n  for (const [key, value] of Object.entries(node)) {\n    if (value === undefined) continue;\n\n    if (key === \"AND\" || key === \"OR\" || key === \"NOT\") {\n      where(schema, value, argument, origin, depth);\n      continue;\n    }\n\n    const field = schema.fields[key];\n    if (field) {\n      if (field.encrypted === true && !isNullCheck(value)) {\n        refuse(schema, key, argument, origin);\n      }\n      continue;\n    }\n\n    const target = relationTarget(schema, key);\n    if (target) {\n      if (!isObject(value)) continue;\n      const filters = Object.keys(value).filter((name) => RELATION_FILTERS.includes(name));\n      if (filters.length > 0) {\n        for (const name of filters) where(target, value[name], argument, origin, depth + 1);\n      } else {\n        where(target, value, argument, origin, depth + 1);\n      }\n      continue;\n    }\n\n    // A compound unique key — `provider_providerId: { provider, providerId }`.\n    if (isObject(value)) {\n      for (const name of Object.keys(value)) {\n        if (schema.fields[name]?.encrypted === true) refuse(schema, name, argument, origin);\n      }\n    }\n  }\n}\n\nfunction orderBy(schema: ModelSchema, node: unknown, origin: Origin, depth: number): void {\n  if (depth > MAX_WALK_DEPTH) return;\n  if (Array.isArray(node)) {\n    for (const item of node) orderBy(schema, item, origin, depth);\n    return;\n  }\n  if (!isObject(node)) return;\n  for (const [key, value] of Object.entries(node)) {\n    if (schema.fields[key]?.encrypted === true) refuse(schema, key, \"orderBy\", origin);\n    const target = relationTarget(schema, key);\n    if (target && isObject(value) && !(\"_count\" in value)) {\n      orderBy(target, value, origin, depth + 1);\n    }\n  }\n}\n\n/** `distinct`, `by`, and the `_min` / `_max` / `_avg` / `_sum` selections. */\nfunction fieldList(schema: ModelSchema, node: unknown, argument: string, origin: Origin): void {\n  const names =\n    typeof node === \"string\"\n      ? [node]\n      : Array.isArray(node)\n        ? node.filter((name): name is string => typeof name === \"string\")\n        : isObject(node)\n          ? Object.keys(node).filter((name) => node[name])\n          : [];\n  for (const name of names) {\n    if (schema.fields[name]?.encrypted === true) refuse(schema, name, argument, origin);\n  }\n}\n\nfunction having(schema: ModelSchema, node: unknown, origin: Origin): void {\n  if (Array.isArray(node)) {\n    for (const item of node) having(schema, item, origin);\n    return;\n  }\n  if (!isObject(node)) return;\n  for (const [key, value] of Object.entries(node)) {\n    if (key === \"AND\" || key === \"OR\" || key === \"NOT\") {\n      having(schema, value, origin);\n      continue;\n    }\n    if (schema.fields[key]?.encrypted === true && !isNullCheck(value)) {\n      refuse(schema, key, \"having\", origin);\n    }\n  }\n}\n\n/** `null`, `{ equals: null }`, `{ not: null }` — the only comparisons a ciphertext supports. */\nfunction isNullCheck(value: unknown): boolean {\n  if (value === null) return true;\n  if (!isObject(value)) return false;\n  const entries = Object.entries(value).filter(([, operand]) => operand !== undefined);\n  return (\n    entries.length > 0 &&\n    entries.every(([operator, operand]) => (operator === \"equals\" || operator === \"not\") && operand === null)\n  );\n}\n\nfunction refuse(schema: ModelSchema, field: string, argument: string, origin: Origin): never {\n  throw new UnsupportedByDesignError(\n    argument,\n    origin.model,\n    origin.operation,\n    `${schema.name}.${field} is an encrypted column: each write stores a ` +\n      `different random ciphertext, so the database cannot compare, sort or ` +\n      `group by it. Only null checks work on it ({ ${field}: null } or ` +\n      `{ ${field}: { not: null } }). To look a row up by a secret, store a ` +\n      `keyed hash of it in a separate column and filter on that.`,\n  );\n}\n\n// --- writes ------------------------------------------------------------------\n\n/**\n * `args` with this model's encrypted columns encrypted, or `args` itself when\n * there is nothing to encrypt. Never mutates the caller's objects: the same\n * `data` may be reused for a second call.\n *\n * Only `data` (and an upsert's `create` / `update`) at this level. Nested\n * relation writes are left as they are; see the note at the top of the file.\n */\nexport function encryptWriteArgs(schema: ModelSchema, op: string, args: any): any {\n  const fields = encryptedFields(schema);\n  if (fields.length === 0 || !isObject(args)) return args;\n\n  const origin: Origin = { model: schema.name, operation: op };\n  let encrypter: Encrypter | undefined;\n  const encrypt = (value: string) => (encrypter ??= currentEncrypter()).encrypt(value);\n\n  let next = args;\n  const replace = (key: string, value: unknown) => {\n    if (value === next[key]) return;\n    if (next === args) next = { ...args };\n    next[key] = value;\n  };\n\n  switch (op) {\n    case \"create\":\n    case \"update\":\n    case \"updateMany\":\n      replace(\"data\", encryptData(fields, args.data, encrypt, origin));\n      break;\n    case \"createMany\":\n      replace(\n        \"data\",\n        Array.isArray(args.data)\n          ? mapIfChanged(args.data, (row) => encryptData(fields, row, encrypt, origin))\n          : encryptData(fields, args.data, encrypt, origin),\n      );\n      break;\n    case \"upsert\":\n      replace(\"create\", encryptData(fields, args.create, encrypt, origin));\n      replace(\"update\", encryptData(fields, args.update, encrypt, origin));\n      break;\n  }\n  return next;\n}\n\nfunction encryptData(\n  fields: readonly string[],\n  data: unknown,\n  encrypt: (value: string) => string,\n  origin: Origin,\n): unknown {\n  if (!isObject(data)) return data;\n  let copy: Record<string, unknown> | undefined;\n  for (const name of fields) {\n    if (!(name in data)) continue;\n    const value = data[name];\n    const next = encryptValue(name, value, encrypt, origin);\n    if (next !== value) (copy ??= { ...data })[name] = next;\n  }\n  return copy ?? data;\n}\n\nfunction encryptValue(\n  field: string,\n  value: unknown,\n  encrypt: (value: string) => string,\n  origin: Origin,\n): unknown {\n  if (value === undefined || value === null) return value;\n  if (typeof value === \"string\") return encrypt(value);\n  // Prisma's `{ set: value }` spelling of a scalar update.\n  if (isObject(value) && Object.keys(value).length === 1 && \"set\" in value) {\n    const set = value.set;\n    return set === null || set === undefined ? value : { set: encryptValue(field, set, encrypt, origin) };\n  }\n  throw new InvalidArgumentError(\n    \"data\",\n    origin.model,\n    origin.operation,\n    `${origin.model}.${field} is an encrypted column and takes a string or ` +\n      `null (or { set: string | null }); got ${describe(value)}.`,\n  );\n}\n\nfunction mapIfChanged<T>(items: T[], fn: (item: T) => T): T[] {\n  let copy: T[] | undefined;\n  items.forEach((item, index) => {\n    const next = fn(item);\n    if (next !== item) (copy ??= [...items])[index] = next;\n  });\n  return copy ?? items;\n}\n\n// --- reads -------------------------------------------------------------------\n\n/**\n * Decrypts this model's encrypted columns on `rows`, in place. A value that\n * does not decrypt raises `DecryptionError` naming the column — a ciphertext\n * is never handed back as if it were the value.\n */\nexport function decryptRows(schema: ModelSchema, rows: readonly unknown[]): void {\n  const fields = encryptedFields(schema);\n  if (fields.length === 0 || rows.length === 0) return;\n\n  let encrypter: Encrypter | undefined;\n  for (const row of rows) {\n    if (!isObject(row)) continue;\n    for (const field of fields) {\n      const value = row[field];\n      if (typeof value !== \"string\") continue;\n      encrypter ??= currentEncrypter();\n      try {\n        row[field] = encrypter.decrypt(value);\n      } catch (error) {\n        if (error instanceof DecryptionError) {\n          error.column = { model: schema.name, field };\n          error.message = `Could not decrypt ${schema.name}.${field}: ${error.message}`;\n        }\n        throw error;\n      }\n    }\n  }\n}\n\n/**\n * Decrypts the rows a strategy folded into the parent's statement, which never\n * passed through their own model's `$exec`. Recursive, because the fold is.\n */\nexport function decryptFolded(\n  relation: { as: string; model: string; folded?: readonly { as: string; model: string; folded?: readonly unknown[] }[] },\n  parents: readonly unknown[],\n): void {\n  const schema = schemaOf(relation.model);\n  const rows: unknown[] = [];\n  for (const parent of parents) {\n    if (!isObject(parent)) continue;\n    const value = parent[relation.as];\n    if (Array.isArray(value)) rows.push(...value);\n    else if (isObject(value)) rows.push(value);\n  }\n  if (rows.length === 0) return;\n  if (schema) decryptRows(schema, rows);\n  for (const child of relation.folded ?? []) {\n    decryptFolded(child as Parameters<typeof decryptFolded>[0], rows);\n  }\n}\n\n// --- helpers -----------------------------------------------------------------\n\nfunction schemaOf(model: string): ModelSchema | undefined {\n  if (!registry.has(model)) return undefined;\n  return registry.get<{ $schema?: ModelSchema }>(model).$schema;\n}\n\nfunction relationTarget(schema: ModelSchema, name: string): ModelSchema | undefined {\n  const relation = schema.relations[name];\n  return relation ? schemaOf(relation.model) : undefined;\n}\n\nfunction isObject(value: unknown): value is Record<string, any> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value) && !(value instanceof Date);\n}\n\nfunction describe(value: unknown): string {\n  if (Array.isArray(value)) return \"an array\";\n  if (value instanceof Date) return \"a Date\";\n  return `a ${typeof value}`;\n}\n"
   ],
   "mappings": ";oPAeA,FAAM,JAAS,IAAI,IAEZ,SAAS,CAAQ,CAAC,EAAc,EAAsB,CAC3D,EAAO,IAAI,EAAM,CAAK,EAGjB,SAAS,CAAG,CAAC,EAAuB,CACzC,OAAO,EAAO,IAAI,CAAI,EAGjB,SAAS,CAAgB,CAAC,EAAiB,CAChD,IAAM,EAAQ,EAAO,IAAI,CAAI,EAC7B,GAAI,IAAU,OACZ,MAAM,IAAI,EAAwB,EAAM,CAAC,GAAG,EAAO,KAAK,CAAC,CAAC,EAE5D,OAAO,EAGF,SAAS,CAAe,EAAa,CAC1C,MAAO,CAAC,GAAG,EAAO,KAAK,CAAC,EAGnB,SAAS,CAAa,EAAS,CACpC,EAAO,MAAM,ECtCf,yBAAS,sBAAgB,iBAAkB,gBA2BpC,MAAM,CAAU,OACd,OAAQ,YAEE,KAAO,IAAI,IACX,UAOjB,WAAW,CAAC,EAA2B,CAAC,EAAG,CACzC,QAAY,EAAI,KAAU,OAAO,QAAQ,EAAO,MAAQ,CAAC,CAAC,EAAG,CAC3D,GAAI,CAAC,EAAO,KAAK,CAAE,EACjB,MAAM,IAAI,EACR,sBAAsB,sGAExB,EAEF,KAAK,KAAK,IAAI,EAAI,GAAS,EAAI,CAAK,CAAC,EAGvC,GAAI,EAAO,UAAY,OAAW,CAChC,GAAI,CAAC,KAAK,KAAK,IAAI,EAAO,OAAO,EAC/B,MAAM,IAAI,EACR,0BAA0B,EAAO,wDACT,EAAY,KAAK,IAAI,KAC/C,EAEF,KAAK,UAAY,EAAO,QACnB,QAAI,KAAK,KAAK,OAAS,EAC5B,KAAK,UAAY,CAAC,GAAG,KAAK,KAAK,KAAK,CAAC,EAAE,GAClC,QAAI,KAAK,KAAK,KAAO,EAC1B,MAAM,IAAI,EACR,uBAAuB,KAAK,KAAK,cAAc,EAAY,KAAK,IAAI,oEAEtE,KAKA,WAAU,EAAY,CACxB,OAAO,KAAK,YAAc,UAIxB,aAAY,EAAW,CACzB,OAAO,KAAK,eAAe,EAI7B,OAAO,CAAC,EAA2B,CACjC,GAAI,OAAO,IAAc,SACvB,MAAU,UACR,yCAAyC,GAAc,CAAS,mDAElE,EAEF,IAAM,EAAK,KAAK,eAAe,EACzB,EAAM,KAAK,KAAK,IAAI,CAAE,EACtB,EAAS,GAAG,KAAW,IACvB,EAAK,GAAY,CAAQ,EACzB,EAAS,EAAe,EAAW,EAAK,CAAE,EAChD,EAAO,OAAO,OAAO,KAAK,CAAM,CAAC,EACjC,IAAM,EAAO,OAAO,OAAO,CAAC,EAAO,OAAO,EAAW,MAAM,EAAG,EAAO,MAAM,EAAG,EAAO,WAAW,CAAC,CAAC,EAClG,MAAO,GAAG,KAAU,EAAG,SAAS,WAAW,KAAK,EAAK,SAAS,WAAW,IAW3E,OAAO,CAAC,EAA0B,CAChC,IAAM,EAAS,EAAc,CAAQ,EACrC,GAAI,CAAC,EACH,MAAM,IAAI,EAAgB,YAAa,yCAAyC,EAElF,GAAI,CAAC,KAAK,WAAY,KAAK,eAAe,EAC1C,IAAM,EAAM,KAAK,KAAK,IAAI,EAAO,KAAK,EACtC,GAAI,CAAC,EACH,MAAM,IAAI,EACR,cACA,qCAAqC,EAAO,4CACtB,EAAY,KAAK,IAAI,gGAE7C,EAEF,GAAI,CACF,IAAM,EAAW,EAAiB,EAAW,EAAK,EAAO,EAAE,EAG3D,OAFA,EAAS,OAAO,OAAO,KAAK,GAAG,KAAW,EAAO,OAAO,CAAC,EACzD,EAAS,WAAW,EAAO,GAAG,EACvB,OAAO,OAAO,CAAC,EAAS,OAAO,EAAO,UAAU,EAAG,EAAS,MAAM,CAAC,CAAC,EAAE,SAAS,MAAM,EAC5F,KAAM,CACN,MAAM,IAAI,EACR,UACA,6CAA6C,EAAO,8EAEtD,GAKJ,WAAW,CAAC,EAAiC,CAC3C,OAAO,EAAc,CAAK,IAAM,KAIlC,OAAO,CAAC,EAA+B,CACrC,OAAO,EAAc,CAAK,GAAG,OAAS,KASxC,iBAAiB,CAAC,EAAwB,CACxC,OAAO,KAAK,QAAQ,CAAK,IAAM,KAAK,eAAe,EAG7C,cAAc,EAAW,CAC/B,GAAI,KAAK,YAAc,OACrB,MAAM,IAAI,EACR,8OAIF,EAEF,OAAO,KAAK,UAEhB,CAOO,MAAM,UAA2B,KAAM,CAC5C,WAAW,CAAC,EAAiB,CAC3B,MAAM,CAAO,EACb,KAAK,KAAO,qBAEhB,CAQO,MAAM,UAAwB,KAAM,CAKvB,OAHlB,OAEA,WAAW,CACO,EAChB,EACA,CACA,MAAM,CAAO,EAHG,cAIhB,KAAK,KAAO,kBAEhB,CAEA,IAAM,EAAU,KACV,EAAY,cACZ,EAAY,GACZ,EAAW,GACX,EAAY,GACZ,EAAS,wBACT,EAAY,mBAElB,SAAS,EAAQ,CAAC,EAAY,EAAmC,CAC/D,GAAI,OAAO,IAAU,UAAY,EAAM,KAAK,IAAM,GAChD,MAAM,IAAI,EACR,mBAAmB,wDACrB,EAEF,IAAM,EAAO,EAAM,KAAK,EAAE,QAAQ,WAAY,EAAE,EAC1C,EAAQ,sBAAsB,KAAK,CAAI,EAAI,OAAO,KAAK,EAAM,QAAQ,EAAI,OAAO,MAAM,CAAC,EAC7F,GAAI,EAAM,SAAW,EACnB,MAAM,IAAI,EACR,mBAAmB,aAAc,oCACb,EAAM,yDAE5B,EAEF,OAAO,EAUT,SAAS,CAAa,CAAC,EAAiC,CACtD,GAAI,OAAO,IAAU,SAAU,OAAO,KACtC,IAAM,EAAQ,EAAM,MAAM,GAAG,EAC7B,GAAI,EAAM,SAAW,GAAK,EAAM,KAAO,EAAS,OAAO,KACvD,KAAS,EAAO,EAAI,GAAQ,EAC5B,GAAI,CAAC,EAAO,KAAK,CAAK,GAAK,CAAC,EAAU,KAAK,CAAE,GAAK,CAAC,EAAU,KAAK,CAAI,EAAG,OAAO,KAChF,IAAM,EAAU,OAAO,KAAK,EAAI,WAAW,EACrC,EAAY,OAAO,KAAK,EAAM,WAAW,EAC/C,GAAI,EAAQ,SAAW,GAAY,EAAU,OAAS,EAAW,OAAO,KACxE,MAAO,CACL,QACA,GAAI,EACJ,WAAY,EAAU,SAAS,EAAG,EAAU,OAAS,CAAS,EAC9D,IAAK,EAAU,SAAS,EAAU,OAAS,CAAS,CACtD,EAGF,SAAS,CAAW,CAAC,EAAoC,CACvD,OAAO,EAAK,OAAS,EAAI,kBAAoB,CAAC,GAAG,EAAK,KAAK,CAAC,EAAE,IAAI,CAAC,IAAO,IAAI,IAAK,EAAE,KAAK,IAAI,EAGhG,SAAS,EAAa,CAAC,EAAwB,CAC7C,OAAO,IAAU,KAAO,OAAS,MAAM,QAAQ,CAAK,EAAI,WAAa,KAAK,OAAO,IClNnF,IAAM,EAAiB,IAAI,QAGpB,SAAS,CAAe,CAAC,EAAwC,CACtE,IAAI,EAAS,EAAe,IAAI,CAAM,EACtC,GAAI,IAAW,OACb,EAAS,OAAO,OAAO,EAAO,MAAM,EACjC,OAAO,CAAC,IAAU,EAAM,YAAc,EAAI,EAC1C,IAAI,CAAC,IAAU,EAAM,IAAI,EAC5B,EAAe,IAAI,EAAQ,CAAM,EAEnC,OAAO,EAIF,SAAS,EAA0B,EAAa,CACrD,IAAM,EAAO,IAAI,IACX,EAAoB,CAAC,EAC3B,QAAW,KAAiB,EAAgB,EAAG,CAC7C,IAAM,EAAS,EAAS,CAAI,EAC5B,GAAI,CAAC,GAAU,EAAK,IAAI,EAAO,IAAI,EAAG,SACtC,EAAK,IAAI,EAAO,IAAI,EACpB,QAAW,KAAS,EAAgB,CAAM,EAAG,EAAQ,KAAK,GAAG,EAAO,QAAQ,GAAO,EAErF,OAAO,EAQF,SAAS,CAAgB,EAAc,CAC5C,IAAM,EAAc,EAAI,EACxB,GAAI,CAAC,EAAY,MAAM,CAAS,EAC9B,MAAM,IAAI,EACR,+PAIF,EAEF,OAAO,EAAY,KAAK,CAAS,EAYnC,IAAM,EAAM,OAAO,8BAA8B,EAE1C,SAAS,EAAmC,CAAC,EAAe,CACjE,MAAO,IAAK,GAAU,GAAM,EAAK,EAG5B,SAAS,EAAe,CAAC,EAA2B,CACzD,OACE,OAAO,IAAY,UACnB,IAAY,MACX,EAAoC,KAAS,GAqB3C,SAAS,EAAwB,CAAC,EAAqB,EAAY,EAAqB,CAC7F,GAAI,CAAC,EAAS,CAAI,EAAG,OACrB,IAAM,EAAiB,CAAE,MAAO,EAAO,KAAM,UAAW,CAAG,EAC3D,EAAS,EAAQ,EAAM,EAAQ,CAAC,EAChC,QAAW,IAAO,CAAC,KAAM,OAAQ,OAAQ,OAAQ,MAAM,EACrD,GAAI,EAAK,KAAS,OAAW,EAAU,EAAQ,EAAK,GAAM,EAAK,CAAM,EAEvE,GAAI,EAAK,SAAW,OAAW,EAAO,EAAQ,EAAK,OAAQ,CAAM,EAInE,IAAM,EAAiB,GAEvB,SAAS,CAAQ,CAAC,EAAqB,EAA2B,EAAgB,EAAe,CAC/F,GAAI,EAAQ,EAAgB,OAC5B,GAAI,EAAK,QAAU,OAAW,EAAM,EAAQ,EAAK,MAAO,QAAS,EAAQ,CAAK,EAC9E,GAAI,EAAK,SAAW,OAAW,EAAM,EAAQ,EAAK,OAAQ,SAAU,EAAQ,CAAK,EACjF,GAAI,EAAK,UAAY,OAAW,EAAQ,EAAQ,EAAK,QAAS,EAAQ,CAAK,EAC3E,GAAI,EAAK,WAAa,OAAW,EAAU,EAAQ,EAAK,SAAU,WAAY,CAAM,EAEpF,QAAW,IAAc,CAAC,EAAK,QAAS,EAAK,MAAM,EAAG,CACpD,GAAI,CAAC,EAAS,CAAU,EAAG,SAC3B,QAAY,EAAK,KAAU,OAAO,QAAQ,CAAU,EAAG,CACrD,GAAI,CAAC,EAAS,CAAK,EAAG,SACtB,GAAI,IAAQ,SAAU,CACpB,GAAI,CAAC,EAAS,EAAM,MAAM,EAAG,SAC7B,QAAY,EAAM,KAAU,OAAO,QAAQ,EAAM,MAAM,EAAG,CACxD,IAAM,EAAS,EAAe,EAAQ,CAAI,EAC1C,GAAI,GAAU,EAAS,CAAK,GAAK,EAAM,QAAU,OAC/C,EAAM,EAAQ,EAAM,MAAO,QAAS,EAAQ,EAAQ,CAAC,EAGzD,SAEF,IAAM,EAAS,EAAe,EAAQ,CAAG,EACzC,GAAI,EAAQ,EAAS,EAAQ,EAAO,EAAQ,EAAQ,CAAC,IAK3D,IAAM,GAAmB,CAAC,OAAQ,QAAS,OAAQ,KAAM,OAAO,EAEhE,SAAS,CAAK,CACZ,EACA,EACA,EACA,EACA,EACM,CACN,GAAI,EAAQ,EAAgB,OAC5B,GAAI,MAAM,QAAQ,CAAI,EAAG,CACvB,QAAW,KAAQ,EAAM,EAAM,EAAQ,EAAM,EAAU,EAAQ,CAAK,EACpE,OAEF,GAAI,CAAC,EAAS,CAAI,EAAG,OAErB,QAAY,EAAK,KAAU,OAAO,QAAQ,CAAI,EAAG,CAC/C,GAAI,IAAU,OAAW,SAEzB,GAAI,IAAQ,OAAS,IAAQ,MAAQ,IAAQ,MAAO,CAClD,EAAM,EAAQ,EAAO,EAAU,EAAQ,CAAK,EAC5C,SAGF,IAAM,EAAQ,EAAO,OAAO,GAC5B,GAAI,EAAO,CACT,GAAI,EAAM,YAAc,IAAQ,CAAC,EAAY,CAAK,EAChD,EAAO,EAAQ,EAAK,EAAU,CAAM,EAEtC,SAGF,IAAM,EAAS,EAAe,EAAQ,CAAG,EACzC,GAAI,EAAQ,CACV,GAAI,CAAC,EAAS,CAAK,EAAG,SACtB,IAAM,EAAU,OAAO,KAAK,CAAK,EAAE,OAAO,CAAC,IAAS,GAAiB,SAAS,CAAI,CAAC,EACnF,GAAI,EAAQ,OAAS,EACnB,QAAW,KAAQ,EAAS,EAAM,EAAQ,EAAM,GAAO,EAAU,EAAQ,EAAQ,CAAC,EAElF,OAAM,EAAQ,EAAO,EAAU,EAAQ,EAAQ,CAAC,EAElD,SAIF,GAAI,EAAS,CAAK,GAChB,QAAW,KAAQ,OAAO,KAAK,CAAK,EAClC,GAAI,EAAO,OAAO,IAAO,YAAc,GAAM,EAAO,EAAQ,EAAM,EAAU,CAAM,IAM1F,SAAS,CAAO,CAAC,EAAqB,EAAe,EAAgB,EAAqB,CACxF,GAAI,EAAQ,EAAgB,OAC5B,GAAI,MAAM,QAAQ,CAAI,EAAG,CACvB,QAAW,KAAQ,EAAM,EAAQ,EAAQ,EAAM,EAAQ,CAAK,EAC5D,OAEF,GAAI,CAAC,EAAS,CAAI,EAAG,OACrB,QAAY,EAAK,KAAU,OAAO,QAAQ,CAAI,EAAG,CAC/C,GAAI,EAAO,OAAO,IAAM,YAAc,GAAM,EAAO,EAAQ,EAAK,UAAW,CAAM,EACjF,IAAM,EAAS,EAAe,EAAQ,CAAG,EACzC,GAAI,GAAU,EAAS,CAAK,GAAK,EAAE,WAAY,GAC7C,EAAQ,EAAQ,EAAO,EAAQ,EAAQ,CAAC,GAM9C,SAAS,CAAS,CAAC,EAAqB,EAAe,EAAkB,EAAsB,CAC7F,IAAM,EACJ,OAAO,IAAS,SACZ,CAAC,CAAI,EACL,MAAM,QAAQ,CAAI,EAChB,EAAK,OAAO,CAAC,IAAyB,OAAO,IAAS,QAAQ,EAC9D,EAAS,CAAI,EACX,OAAO,KAAK,CAAI,EAAE,OAAO,CAAC,IAAS,EAAK,EAAK,EAC7C,CAAC,EACX,QAAW,KAAQ,EACjB,GAAI,EAAO,OAAO,IAAO,YAAc,GAAM,EAAO,EAAQ,EAAM,EAAU,CAAM,EAItF,SAAS,CAAM,CAAC,EAAqB,EAAe,EAAsB,CACxE,GAAI,MAAM,QAAQ,CAAI,EAAG,CACvB,QAAW,KAAQ,EAAM,EAAO,EAAQ,EAAM,CAAM,EACpD,OAEF,GAAI,CAAC,EAAS,CAAI,EAAG,OACrB,QAAY,EAAK,KAAU,OAAO,QAAQ,CAAI,EAAG,CAC/C,GAAI,IAAQ,OAAS,IAAQ,MAAQ,IAAQ,MAAO,CAClD,EAAO,EAAQ,EAAO,CAAM,EAC5B,SAEF,GAAI,EAAO,OAAO,IAAM,YAAc,IAAQ,CAAC,EAAY,CAAK,EAC9D,EAAO,EAAQ,EAAK,SAAU,CAAM,GAM1C,SAAS,CAAW,CAAC,EAAyB,CAC5C,GAAI,IAAU,KAAM,MAAO,GAC3B,GAAI,CAAC,EAAS,CAAK,EAAG,MAAO,GAC7B,IAAM,EAAU,OAAO,QAAQ,CAAK,EAAE,OAAO,GAAI,KAAa,IAAY,MAAS,EACnF,OACE,EAAQ,OAAS,GACjB,EAAQ,MAAM,EAAE,EAAU,MAAc,IAAa,UAAY,IAAa,QAAU,IAAY,IAAI,EAI5G,SAAS,CAAM,CAAC,EAAqB,EAAe,EAAkB,EAAuB,CAC3F,MAAM,IAAI,EACR,EACA,EAAO,MACP,EAAO,UACP,GAAG,EAAO,QAAQ,kKAE+B,kBAC1C,sHAET,EAaK,SAAS,EAAgB,CAAC,EAAqB,EAAY,EAAgB,CAChF,IAAM,EAAS,EAAgB,CAAM,EACrC,GAAI,EAAO,SAAW,GAAK,CAAC,EAAS,CAAI,EAAG,OAAO,EAEnD,IAAM,EAAiB,CAAE,MAAO,EAAO,KAAM,UAAW,CAAG,EACvD,EACE,EAAU,CAAC,KAAmB,IAAc,EAAiB,GAAG,QAAQ,CAAK,EAE/E,EAAO,EACL,EAAU,CAAC,EAAa,IAAmB,CAC/C,GAAI,IAAU,EAAK,GAAM,OACzB,GAAI,IAAS,EAAM,EAAO,IAAK,CAAK,EACpC,EAAK,GAAO,GAGd,OAAQ,OACD,aACA,aACA,aACH,EAAQ,OAAQ,EAAY,EAAQ,EAAK,KAAM,EAAS,CAAM,CAAC,EAC/D,UACG,aACH,EACE,OACA,MAAM,QAAQ,EAAK,IAAI,EACnB,GAAa,EAAK,KAAM,CAAC,IAAQ,EAAY,EAAQ,EAAK,EAAS,CAAM,CAAC,EAC1E,EAAY,EAAQ,EAAK,KAAM,EAAS,CAAM,CACpD,EACA,UACG,SACH,EAAQ,SAAU,EAAY,EAAQ,EAAK,OAAQ,EAAS,CAAM,CAAC,EACnE,EAAQ,SAAU,EAAY,EAAQ,EAAK,OAAQ,EAAS,CAAM,CAAC,EACnE,MAEJ,OAAO,EAGT,SAAS,CAAW,CAClB,EACA,EACA,EACA,EACS,CACT,GAAI,CAAC,EAAS,CAAI,EAAG,OAAO,EAC5B,IAAI,EACJ,QAAW,KAAQ,EAAQ,CACzB,GAAI,EAAE,KAAQ,GAAO,SACrB,IAAM,EAAQ,EAAK,GACb,EAAO,EAAa,EAAM,EAAO,EAAS,CAAM,EACtD,GAAI,IAAS,GAAQ,IAAS,IAAK,CAAK,GAAG,GAAQ,EAErD,OAAO,GAAQ,EAGjB,SAAS,CAAY,CACnB,EACA,EACA,EACA,EACS,CACT,GAAI,IAAU,QAAa,IAAU,KAAM,OAAO,EAClD,GAAI,OAAO,IAAU,SAAU,OAAO,EAAQ,CAAK,EAEnD,GAAI,EAAS,CAAK,GAAK,OAAO,KAAK,CAAK,EAAE,SAAW,GAAK,QAAS,EAAO,CACxE,IAAM,EAAM,EAAM,IAClB,OAAO,IAAQ,MAAQ,IAAQ,OAAY,EAAQ,CAAE,IAAK,EAAa,EAAO,EAAK,EAAS,CAAM,CAAE,EAEtG,MAAM,IAAI,EACR,OACA,EAAO,MACP,EAAO,UACP,GAAG,EAAO,SAAS,wFACwB,GAAS,CAAK,IAC3D,EAGF,SAAS,EAAe,CAAC,EAAY,EAAyB,CAC5D,IAAI,EAKJ,OAJA,EAAM,QAAQ,CAAC,EAAM,IAAU,CAC7B,IAAM,EAAO,EAAG,CAAI,EACpB,GAAI,IAAS,GAAO,IAAS,CAAC,GAAG,CAAK,GAAG,GAAS,EACnD,EACM,GAAQ,EAUV,SAAS,EAAW,CAAC,EAAqB,EAAgC,CAC/E,IAAM,EAAS,EAAgB,CAAM,EACrC,GAAI,EAAO,SAAW,GAAK,EAAK,SAAW,EAAG,OAE9C,IAAI,EACJ,QAAW,KAAO,EAAM,CACtB,GAAI,CAAC,EAAS,CAAG,EAAG,SACpB,QAAW,KAAS,EAAQ,CAC1B,IAAM,EAAQ,EAAI,GAClB,GAAI,OAAO,IAAU,SAAU,SAC/B,IAAc,EAAiB,EAC/B,GAAI,CACF,EAAI,GAAS,EAAU,QAAQ,CAAK,EACpC,MAAO,EAAO,CACd,GAAI,aAAiB,EACnB,EAAM,OAAS,CAAE,MAAO,EAAO,KAAM,OAAM,EAC3C,EAAM,QAAU,qBAAqB,EAAO,QAAQ,MAAU,EAAM,UAEtE,MAAM,KAUP,SAAS,EAAa,CAC3B,EACA,EACM,CACN,IAAM,EAAS,EAAS,EAAS,KAAK,EAChC,EAAkB,CAAC,EACzB,QAAW,KAAU,EAAS,CAC5B,GAAI,CAAC,EAAS,CAAM,EAAG,SACvB,IAAM,EAAQ,EAAO,EAAS,IAC9B,GAAI,MAAM,QAAQ,CAAK,EAAG,EAAK,KAAK,GAAG,CAAK,EACvC,QAAI,EAAS,CAAK,EAAG,EAAK,KAAK,CAAK,EAE3C,GAAI,EAAK,SAAW,EAAG,OACvB,GAAI,EAAQ,GAAY,EAAQ,CAAI,EACpC,QAAW,KAAS,EAAS,QAAU,CAAC,EACtC,GAAc,EAA8C,CAAI,EAMpE,SAAS,CAAQ,CAAC,EAAwC,CACxD,GAAI,CAAU,EAAI,CAAK,EAAG,OAC1B,OAAgB,EAA+B,CAAK,EAAE,QAGxD,SAAS,CAAc,CAAC,EAAqB,EAAuC,CAClF,IAAM,EAAW,EAAO,UAAU,GAClC,OAAO,EAAW,EAAS,EAAS,KAAK,EAAI,OAG/C,SAAS,CAAQ,CAAC,EAA8C,CAC9D,OAAO,OAAO,IAAU,UAAY,IAAU,MAAQ,CAAC,MAAM,QAAQ,CAAK,GAAK,EAAE,aAAiB,MAGpG,SAAS,EAAQ,CAAC,EAAwB,CACxC,GAAI,MAAM,QAAQ,CAAK,EAAG,MAAO,WACjC,GAAI,aAAiB,KAAM,MAAO,SAClC,MAAO,KAAK,OAAO",
-  "debugId": "7B54FE4E8E87DFDD64756E2164756E21",
+  "debugId": "3788A0337833F48964756E2164756E21",
   "names": []
 }

package/dist/{chunk-e9xbdgb2.js → chunk-a37shxb1.js}

@@ -45,6 +45,6 @@ Say which, and registerModels will leave it alone:
     register("${j}", ${z[0]})
 
 A class that is only a typed view over the same rows belongs in a module you do not hand to registerModels.`);this.model=j;this.candidates=z;this.name="AmbiguousModelRegistrationError"}}class C extends Error{model;operation;required;limit;dialect;constructor(j,z,B,G,H,I){super(`${j}.${z} would bind ${B} parameters, and the '${H}' driver accepts at most ${G} in one statement. ${I}`+(z==="createMany"?" A createMany over the ceiling is normally split across statements inside one transaction, so reaching this means splitting cannot help: a single row binds more than the driver accepts.":" Splitting is not something this operation can do for you \u2014 one "+"statement has to carry one answer. Narrow the query."));this.model=j;this.operation=z;this.required=B;this.limit=G;this.dialect=H;this.name="ParameterLimitError"}}class D extends Error{model;operation;field;constructor(j,z,B){super(`${j}.${z} is missing a value for '${B}', which is required and has no default.`);this.model=j;this.operation=z;this.field=B;this.name="MissingRequiredValueError"}}class F extends Error{relation;model;constructor(j,z,B){super(`'${j}' is not a relation on model ${z}. `+(B.length>0?`Known relations: ${B.join(", ")}.`:`${z} declares no relations.`));this.relation=j;this.model=z;this.name="UnknownRelationError"}}class b extends Error{model;limit;constructor(j,z){super(`The include tree nests more than ${z} relations deep (at model ${j}). Deeply nested includes are legal, so this is a guard against a generated or malformed argument tree rather than a limit on `+"modelling \u2014 every level costs at least one query.");this.model=j;this.limit=z;this.name="RelationDepthExceededError"}}class P extends Error{model;relation;target;constructor(j,z,B,G){super(`${j}.${z} points at model '${B}', which nothing has registered. The generated artifact and the registry disagree: re-run \`prisma generate\`, and check that app/models/generated/index.ts is imported. `+(G.length>0?`Registered models: ${G.join(", ")}.`:"Nothing is registered at all."));this.model=j;this.relation=z;this.target=B;this.name="UnregisteredRelationTargetError"}}class R extends Error{model;relation;constructor(j,z,B){super(`Cannot resolve how ${j}.${z} joins: ${B} This means `+"app/models/generated is stale or hand-edited \u2014 re-run "+"`prisma generate`.");this.model=j;this.relation=z;this.name="MalformedRelationError"}}class v extends Error{constructor(j,z){super(`No model is registered under the name '${j}'. `+(z.length>0?`Registered models: ${z.join(", ")}.`:"Nothing is registered \u2014 is app/models/generated/index.ts imported?"));this.name="ModelNotRegisteredError"}}class N extends Error{constructor(j){super(`${j} has no $schema. Model subclasses must extend a generated base class from app/models/generated/models.ts.`);this.name="MissingModelSchemaError"}}class Q extends Error{model;operation;constructor(j,z){super(`${j}.${z} was given 'lock' outside a transaction. A row lock lasts until the transaction that took it ends, so outside one it is released as soon as the row is read and protects nothing. Run the read and the writes it guards inside Model.transaction(async () => { ... }).`);this.model=j;this.operation=z;this.name="LockOutsideTransactionError"}}
-export{K as lj,Z as mj,_ as nj,$ as oj,L as pj,M as qj,U as rj,V as sj,y as tj,O as uj,W as vj,E as wj,S as xj,T as yj,x as zj,A as Aj,C as Bj,D as Cj,F as Dj,b as Ej,P as Fj,R as Gj,v as Hj,N as Ij,Q as Jj};
+export{K as pj,Z as qj,_ as rj,$ as sj,L as tj,M as uj,U as vj,V as wj,y as xj,O as yj,W as zj,E as Aj,S as Bj,T as Cj,x as Dj,A as Ej,C as Fj,D as Gj,F as Hj,b as Ij,P as Jj,R as Kj,v as Lj,N as Mj,Q as Nj};
 
-//# debugId=17ABF8609633A14164756E2164756E21
+//# debugId=07129A59B2555A6264756E2164756E21

package/dist/{chunk-e9xbdgb2.js.map → chunk-a37shxb1.js.map}

@@ -5,6 +5,6 @@
     "/**\n * Thrown when the compiler is handed an argument it does not implement yet.\n *\n * Every public operation accepts the full Prisma argument type from iteration 1\n * — signatures are final, capability grows underneath them. The price of that is\n * that anything unimplemented has to fail loudly: silently dropping a `take: 10`\n * and returning the whole table is the worst failure mode this ORM has.\n */\nexport class UnsupportedQueryError extends Error {\n  constructor(\n    public readonly argument: string,\n    public readonly model: string,\n    public readonly operation: string,\n    /**\n     * What cannot work, and what to do instead.\n     *\n     * **Required**, which is the second half of #61 — the first being the\n     * `UnsupportedByDesignError` split beside this. It was optional, and the\n     * refusals that omitted it were the highest-traffic ones: an argument the\n     * operation does not accept, on the path a typo takes. Those said only\n     * *that* something was refused, to the reader least likely to know why.\n     *\n     * Required rather than conventionally-supplied for the reason five other\n     * parameters here are — `render`'s `origin`, `changedFields`' `schema`,\n     * `RelationExecutor.exec`'s `preScoped`, `resolveLink`'s `operation`,\n     * `assertPageArgument`'s reported name: where omitting an argument produces\n     * a *worse* result rather than an error, `tsc` is the only thing that keeps\n     * a convention. Ninety-five of a hundred call sites already passed one; the\n     * five that did not are exactly the ones nobody revisited.\n     *\n     * `UnknownFieldError` and `UnknownRelationError` set the standard this\n     * meets: both enumerate the valid names rather than only rejecting the\n     * invalid one.\n     */\n    detail: string,\n  ) {\n    super(\n      `gemi ORM does not support '${argument}' yet (${model}.${operation}). ` +\n        detail,\n    );\n    this.name = \"UnsupportedQueryError\";\n  }\n}\n\n/**\n * An argument the ORM has **decided not to implement**, as opposed to one it has\n * not implemented yet.\n *\n * The distinction is the whole point, and it is a distinction a caller can act\n * on: \"yet\" means wait for a release, \"will not\" means change the code. Sharing\n * one error for both meant `docs/orm.md` could list `omit` under *Not in scope*\n * while the runtime said \"yet\" — a contradiction a reader has no way to\n * resolve, and the one #68 exists to end.\n *\n * A subclass rather than a sibling, so `catch (e) { if (e instanceof\n * UnsupportedQueryError) … }` keeps working for callers that do not care which\n * kind it is.\n */\n/**\n * An argument the ORM **does** implement, given a value it cannot mean.\n *\n * The third category, and the one that made \"yet\" wrong four separate times —\n * #82, #88, #100 and #101 each corrected it at their own call site before #61\n * was found to own the problem. The taxonomy the three classes now draw:\n *\n *   not implemented yet     UnsupportedQueryError      wait for a release\n *   decided against         UnsupportedByDesignError   change the call  (#78)\n *   implemented, bad value  InvalidArgumentError       fix the value\n *\n * `take: \"-2\"` is the clearest case. `take` is implemented; `\"-2\"` is not a\n * take. Telling that caller the ORM \"does not support 'take' yet\" is wrong on\n * both halves — it does, and there is nothing to wait for — and it sends them\n * to a changelog when the fix is one character in their own code.\n *\n * **Extends `UnsupportedQueryError`**, so every existing `catch` and every test\n * asserting the base class keeps working. That is the same choice\n * `UnsupportedByDesignError` made, and it is what lets a taxonomy be added to a\n * shipped ORM without a breaking change: the specific classes are for the\n * reader, the base class is for the handler.\n *\n * **Where the taxonomy stops, and why it stops there.** An argument that is not\n * in the grammar at all keeps the base class and its \"yet\" — `{ nope: 1 }`\n * reports \"does not support 'nope' yet\". That is right for half of what reaches\n * that path and wrong for the other half: the same check refuses a typo and a\n * real Prisma argument this ORM has genuinely not implemented, and nothing at\n * that point can tell them apart. Splitting it would mean carrying Prisma's\n * full argument grammar per operation, which is a large amount of duplicated\n * schema for a small gain.\n *\n * What makes it tolerable is the sentence after it. Since #61's other half made\n * `detail` mandatory, that refusal always continues *\"findMany takes include,\n * omit, orderBy, select, skip, take, where\"* — so a caller who typed `nope`\n * learns it is not coming from the very next clause, without the class having\n * to know. Recorded here rather than left to be re-derived, because \"the third\n * class did not cover this one\" is the obvious first reading and it is not the\n * interesting part.\n */\nexport class InvalidArgumentError extends UnsupportedQueryError {\n  constructor(\n    argument: string,\n    model: string,\n    operation: string,\n    /** What is wrong with the value, and what a good one looks like. */\n    reason: string,\n  ) {\n    super(argument, model, operation, reason);\n    this.name = \"InvalidArgumentError\";\n    this.message = `Invalid '${argument}' (${model}.${operation}). ${reason}`;\n  }\n}\n\nexport class UnsupportedByDesignError extends UnsupportedQueryError {\n  constructor(\n    argument: string,\n    model: string,\n    operation: string,\n    /** What to use instead. Required — see #61: a refusal owes the caller a next step. */\n    reason: string,\n  ) {\n    super(argument, model, operation, reason);\n    this.name = \"UnsupportedByDesignError\";\n    this.message =\n      `gemi ORM does not implement '${argument}' (${model}.${operation}), ` +\n      `and this is a decision rather than a gap. ${reason}`;\n  }\n}\n\n/**\n * Thrown when an argument names something that is not a field on the model. A\n * `where` key with no matching field is an error, never a passthrough — that is\n * the rule that keeps user input out of the identifier positions in the SQL.\n */\nexport class UnknownFieldError extends Error {\n  constructor(\n    public readonly field: string,\n    public readonly model: string,\n    known: string[],\n  ) {\n    super(\n      `'${field}' is not a field on model ${model}. ` +\n        `Known fields: ${known.join(\", \")}.`,\n    );\n    this.name = \"UnknownFieldError\";\n  }\n}\n\n/**\n * Thrown when a column holds something the generated schema says it cannot —\n * an unparseable timestamp, a fractional value in a `BigInt` column, malformed\n * JSON. Every dialect needs it, which is why it lives here rather than beside\n * one of them.\n *\n * It exists so those cases fail rather than decode into a plausible wrong\n * value: `new Date(\"nonsense\")` is an `Invalid Date`, not an error, and it\n * would travel a long way before anyone noticed.\n */\nexport class DecodeError extends Error {\n  constructor(\n    public readonly field: { column: string; type: string },\n    public readonly value: unknown,\n  ) {\n    super(\n      `Could not decode the value ${JSON.stringify(String(value))} from column ` +\n        `'${field.column}' as ${field.type}. The column's contents do not match ` +\n        `the Prisma schema — was it written by something other than Prisma or ` +\n        `the gemi ORM?`,\n    );\n    this.name = \"DecodeError\";\n  }\n}\n\n/**\n * Thrown by the `*OrThrow` operations when the query matched nothing. Prisma\n * raises `NotFoundError` / `P2025` for the same case; the differential harness\n * compares the fact of throwing, not the error type.\n */\nexport class RecordNotFoundError extends Error {\n  constructor(\n    public readonly model: string,\n    public readonly operation: string,\n  ) {\n    super(`No ${model} found (${model}.${operation}).`);\n    this.name = \"RecordNotFoundError\";\n  }\n}\n\n/**\n * The dispatchers' test for a lookup that matched nothing and should be\n * answered with a 404.\n *\n * Matches the name as well as the class for the reason `isPolicyDeniedError`\n * and `isUniqueConstraintError` do: `instanceof` compares against *this*\n * module instance's class object, so a second copy of `gemi/orm` — two\n * versions in one dependency tree, a linked package beside a bundled one —\n * throws an error this would not recognise, and the request would go back to\n * being a 500 carrying the model's name in its body.\n *\n * The name is the identity here, so an application error that calls itself\n * `RecordNotFoundError` is deliberately matched too. That is the same bargain\n * the other two predicates make, and the failure it trades against — a 500\n * where a 404 was meant — is the worse one.\n */\nexport function isRecordNotFoundError(error: unknown): error is RecordNotFoundError {\n  if (error instanceof RecordNotFoundError) return true;\n\n  return (\n    typeof error === \"object\" &&\n    error !== null &&\n    (error as { name?: unknown }).name === \"RecordNotFoundError\"\n  );\n}\n\n/**\n * Thrown when a write violates a unique constraint.\n *\n * DECISION — gemi defines its own error rather than mirroring Prisma's codes.\n *\n * Prisma raises `PrismaClientKnownRequestError` with code `P2002` and\n * `meta.target` holding the field names. Mirroring that would ease a migration\n * for code already branching on `P2002`.\n *\n * **The premise this note used to rest on was wrong, and the conclusion is\n * unchanged.** It said \"nothing in this repository does (checked)\", which was\n * true of *this* repository and was never the question — the code that branches\n * on `P2002` lives in the applications the ORM is for. The first real port\n * measured four such guards, every one of them in concurrency-recovery code\n * (catch the collision, re-read, retry), and every one of them silently dead the\n * moment the write moved onto gemi: the `catch` still ran, the condition was\n * false, the recovery did not happen. Nor was the repository itself clean —\n * `templates/saas-starter/app/models/differential.ts:621` branches on `P2002`\n * today, and did when this was written.\n *\n * What the premise was doing was answering \"would anyone notice?\", and the\n * answer is that four people noticed at once. The decision never depended on it.\n * Carrying a `P` code implies the rest of the taxonomy is implemented too:\n * `P2003`, `P2025`, and the fifty others an application might reasonably then\n * expect to catch. Claiming a compatibility surface we have not built is worse\n * than asking the call sites that need it to catch a gemi error instead —\n * *especially* when the code in question is a retry loop, because a\n * compatibility surface that covers `P2002` and not `P2034` fails in exactly\n * the same silent way, one layer further in.\n *\n * A porter reaches for `isUniqueConstraintError` below. `UPGRADE.md` carries\n * the temporary `|| error.code === \"P2002\"` bridge, for a codebase halfway\n * through the move, with the marker that says when to delete it; it is\n * deliberately not exported, because a Prisma code in gemi's permanent surface\n * is the thing this note declined.\n *\n * What the contract does promise is the part that matters: the error is typed,\n * catchable, and names the fields — as *field* names, the way Prisma's\n * `meta.target` does, not as the database columns the driver reported.\n */\nexport class UniqueConstraintError extends Error {\n  constructor(\n    public readonly model: string,\n    public readonly operation: string,\n    /** Field names, mapped back through the schema from the driver's columns. */\n    public readonly fields: string[],\n    /** The constraint's own name, when the dialect reports one. */\n    public readonly constraint?: string,\n    options?: { cause?: unknown },\n  ) {\n    super(\n      `Unique constraint violated on ${model}.${operation}` +\n        (fields.length > 0 ? ` for ${fields.join(\", \")}` : \"\") +\n        (constraint ? ` (constraint '${constraint}')` : \"\") +\n        `. A ${model} with those values already exists.`,\n      options,\n    );\n    this.name = \"UniqueConstraintError\";\n  }\n}\n\n/**\n * The guard to write in a retry-on-collision `catch`, which is where a\n * `code === \"P2002\"` test almost always was:\n *\n *     try {\n *       return await Invite.create({ data: { token } })\n *     } catch (error) {\n *       if (!isUniqueConstraintError(error)) throw error\n *       return await Invite.findUniqueOrThrow({ where: { token } })\n *     }\n *\n * **Why this is worth shipping rather than telling people to write\n * `instanceof`**, which is the obvious objection and the reason it nearly was\n * not shipped. The second half of the test is the whole of it:\n *\n *     error instanceof UniqueConstraintError   ||   error.name === \"UniqueConstraintError\"\n *\n * `instanceof` compares against *this module instance's* class object, so it is\n * false across a duplicate copy of `gemi/orm` — two versions in one dependency\n * tree, a bundled build alongside a linked one, a monorepo package resolving\n * its own. The error is the right error, thrown by the right code, and the\n * guard silently does not fire. That is not a hypothetical: duck-typing rather\n * than importing the class is precisely what the ported application had already\n * done for Prisma's error, for precisely this reason, and shipping a predicate\n * that only does `instanceof` would hand it back the same trap under a new\n * name.\n *\n * So the name is load-bearing rather than a convenience: it is the identity\n * that survives module duplication, which is why every error in this file sets\n * `this.name` explicitly instead of relying on the class name surviving\n * minification.\n *\n * **The narrowing is a claim, and this is what it rests on.** The name branch\n * asserts `UniqueConstraintError` on the strength of a string — a second copy\n * of this module really does carry `model`, `operation` and `fields`, so the\n * claim holds for the case it exists for. An unrelated object named\n * `\"UniqueConstraintError\"` would defeat it, and that is not something that\n * happens by accident.\n *\n * **It deliberately does not match `code === \"P2002\"`.** See the DECISION\n * above: the temporary bridge for a half-ported codebase is in `UPGRADE.md`,\n * where it can carry a delete-me marker, rather than in gemi's permanent\n * surface, where it would have neither.\n */\nexport function isUniqueConstraintError(\n  error: unknown,\n): error is UniqueConstraintError {\n  if (error instanceof UniqueConstraintError) return true;\n\n  return (\n    typeof error === \"object\" &&\n    error !== null &&\n    (error as { name?: unknown }).name === \"UniqueConstraintError\"\n  );\n}\n\n/**\n * Thrown when a write needs `RETURNING` and the dialect has none.\n *\n * Unreachable on SQLite and Postgres, which both support it. It exists so that\n * the MySQL / MariaDB path is a named gap rather than a wrong answer: the\n * fallback there is `lastInsertRowid` plus a re-select, which is a different\n * statement shape and is not implemented.\n */\nexport class ReturningUnsupportedError extends Error {\n  constructor(\n    public readonly model: string,\n    public readonly operation: string,\n    public readonly dialect: string,\n  ) {\n    super(\n      `${model}.${operation} needs RETURNING to report its result, and the ` +\n        `'${dialect}' dialect does not support it. The fallback — ` +\n        `lastInsertRowid plus a re-select — is not implemented.`,\n    );\n    this.name = \"ReturningUnsupportedError\";\n  }\n}\n\n/**\n * Thrown when a policy denies an operation.\n *\n * Two ways to get here, and the message distinguishes them because the fixes\n * are different: a policy's `before` returned false, or the model is policied\n * and there is no user in scope at all.\n *\n * The second is the deny-by-default rule, and it is the reason this error is\n * loud. A cron tick or a queue worker reading a policied model has no user, and\n * the alternative — treating \"no user\" as \"no policy\" — means the dangerous\n * case is the silent one: a request whose auth middleware was misconfigured\n * would read every tenant's rows rather than failing. So unscoped access is\n * always a decision written at the call site, through `Model.asSystem`.\n */\nexport class PolicyDeniedError extends Error {\n  constructor(\n    public readonly model: string,\n    public readonly operation: string,\n    public readonly reason: \"denied\" | \"no-user\" = \"denied\",\n  ) {\n    super(\n      reason === \"no-user\"\n        ? `${model}.${operation} is governed by a policy and there is no user ` +\n            `in scope. If this is a cron tick, a queue worker or a script, say ` +\n            `so at the call site: Model.asSystem(() => ...). Policies are ` +\n            `never skipped just because a user failed to turn up.`\n        : `${model}.${operation} was denied by ${model}'s policy.`,\n    );\n    this.name = \"PolicyDeniedError\";\n  }\n}\n\n/**\n * The api dispatcher's test for a denial it should answer with a 403. It\n * matches the name as well as the class for the reason\n * `isUniqueConstraintError` does: a second copy of `gemi/orm` throws an error\n * that is not `instanceof` this class, and a denial that failed the test would\n * go back to being a 500 that carries the policy's message.\n */\nexport function isPolicyDeniedError(error: unknown): error is PolicyDeniedError {\n  if (error instanceof PolicyDeniedError) return true;\n\n  return (\n    typeof error === \"object\" &&\n    error !== null &&\n    (error as { name?: unknown }).name === \"PolicyDeniedError\"\n  );\n}\n\n/**\n * Thrown when an `update` writes to a column its own policy's `scope` selects on,\n * and the policy has no `onUpdate` saying what that should mean.\n *\n * The shape it catches:\n *\n *     scope: (ctx) => ({ organizationId: ctx.user.organizationId })\n *     // ...and then\n *     User.update({ where: { id }, data: { organizationId: 999 } })\n *\n * The scope did its job — only rows in the caller's own tenant could be selected\n * — and the statement still hands one of them to another tenant. Afterwards the\n * row is outside the scope, so it cannot be read back and cannot be put right by\n * the same caller: a one-way door rather than a visible failure. The usual way in\n * is not malice but mass assignment, a handler forwarding request fields into\n * `data`.\n *\n * This is `assertCreateCovered`'s question asked of the other write. There it is\n * \"you scoped reads but never said what an insert means\"; here it is \"you scoped\n * reads but never said whether an update may move a row out\". Both are answered\n * by writing the hook, including when the answer is \"allow it\" —\n * `onUpdate: (_ctx, data) => data` is a complete and legitimate answer, and\n * saying it out loud is the point.\n *\n * **What it cannot see.** The scope-owned columns are read off the top level of\n * the fragment the policy returned, so `{ organizationId: 7 }` is understood and\n * `{ OR: [...] }` is not — a scope built from combinators is not attributed to\n * any column and an update through it is not checked. Narrowing that would mean\n * either interpreting arbitrary `where` grammar or refusing every update on such\n * a model, and neither is worth it: the guard is a rail on the common shape, not\n * a proof.\n */\nexport class ScopeEscapeError extends Error {\n  constructor(\n    public readonly model: string,\n    public readonly operation: string,\n    public readonly fields: readonly string[],\n  ) {\n    const named = fields.map((field) => `'${field}'`).join(\", \");\n    super(\n      `${model}.${operation} writes ${named}, which ${model}'s policy also ` +\n        `scopes on — so this update can move a row outside the scope that ` +\n        `selected it, where the caller can no longer read or repair it.\\n\\n` +\n        `Add an onUpdate to that policy. It may reassert the column ` +\n        `(data => ({ ...data, ${fields[0]}: ctx.user.${fields[0]} })), reject ` +\n        `the write, or allow it explicitly with (_ctx, data) => data — all ` +\n        `three are fine, and the point is that the policy says which.`,\n    );\n    this.name = \"ScopeEscapeError\";\n  }\n}\n\n/**\n * Thrown when a model class carries policies but is not the class the registry\n * resolves its name to.\n *\n * This exists because of a cross-tenant leak that shipped past review. The\n * generated `index.ts` registers the *generated* base — `register(\"Account\",\n * AccountModel)` — while an application authors its policy on a subclass:\n *\n *     export class Account extends AccountModel {\n *       static $policies = [{ scope: (ctx) => ({ organizationId: … }) }]\n *     }\n *\n * A root query goes through `Account`, so `policiesFor(this)` finds the policy\n * and the scope applies. A **nested** relation read resolves through the\n * registry, gets `AccountModel`, and walks a prototype chain the policy is not\n * on — so `User.findMany({ include: { accounts: true } })` returned every\n * tenant's accounts. Root queries scoped, nested reads unscoped: exactly the\n * Prisma behaviour policies exist to fix, and silent.\n *\n * Raised at the first query through the unregistered class, naming the one-line\n * fix, because the alternative is data crossing a tenant boundary with nothing\n * to notice it.\n *\n * It fires on a divergence in the resolved policy *chain*, not merely on the two\n * classes differing. A plain subclass that adds no policy of its own inherits\n * the same policy objects in the same order, so a nested read resolving to its\n * parent applies exactly what the root query applied — no divergence, nothing\n * to refuse. An earlier version compared class identity and rejected\n * `class AdminUser extends User {}` for policies it had not written.\n */\nexport class UnregisteredPolicyClassError extends Error {\n  constructor(\n    public readonly model: string,\n    /**\n     * Under `carries: \"narrowing\"` this is the *ancestor* — the class the model\n     * belongs to — rather than whatever the registry currently holds. The two\n     * classes are on one prototype chain there, and which of them is registered\n     * is the thing in question, so naming them by their relationship is what\n     * makes the message readable.\n     */\n    public readonly registered: string,\n    /** Under `carries: \"narrowing\"`, the descendant: the view that narrows. */\n    public readonly queried: string,\n    /**\n     * Which side carries the policies that would be skipped, and therefore what\n     * the author should do about it. Three, because they need three different\n     * answers: a missing registration, a query through the wrong class, and a\n     * view that should not be competing for the name at all.\n     */\n    public readonly carries: \"queried\" | \"registered\" | \"narrowing\" = \"queried\",\n  ) {\n    super(\n      carries === \"narrowing\"\n        ? `${queried} extends ${registered}, which owns the model '${model}', ` +\n            `and carries policies of its own on top of it. A class that ` +\n            `narrows an existing model is a view, and the registry holds one ` +\n            `class per name — so registering ${queried} would apply its ` +\n            `narrowing to every nested read of ${model}, and leaving ` +\n            `${registered} registered would skip ${queried}'s policies ` +\n            `entirely. Neither is a thing to choose for you.\\n\\n` +\n            `Keep the view out of the modules you hand to Kernel.models, and ` +\n            `query it directly where you want it:\\n\\n` +\n            `    ${queried}.findMany(…)   // narrowed, at the call site\\n\\n` +\n            `If it is not a view but the model itself, move the policies onto ` +\n            `${registered} — the class the model's name resolves to — and ` +\n            `${queried} inherits them everywhere.\\n`\n        : carries === \"queried\"\n          ? `${queried} carries policies but the registry resolves '${model}' to ` +\n            `${registered}. Nested relation reads go through the registry, so ` +\n            `they would run on ${registered} and skip every policy on ` +\n            `${queried} — scoped at the root, unscoped inside an include. ` +\n            `Register the class that carries the policy:\\n\\n` +\n            `    import { register } from \"gemi/orm\"\\n` +\n            `    export class ${queried} extends ${registered} { … }\\n` +\n            `    register(\"${model}\", ${queried})\\n`\n          : `This query goes through ${queried}, but the registry resolves ` +\n            `'${model}' to ${registered}, which carries policies ${queried} ` +\n            `does not. Nested relation reads would be scoped and this query is ` +\n            `not — the same policy applying to some queries and not others. ` +\n            `Query ${registered} instead:\\n\\n` +\n            `    ${registered}.findMany(…)\\n\\n` +\n            `If skipping policies is intended, say so at the call site — that ` +\n            `is what Model.asSystem() is for, and it is the only way to do it ` +\n            `that a reader can see.\\n`,\n    );\n    this.name = \"UnregisteredPolicyClassError\";\n  }\n}\n\n/**\n * Thrown when a `$policies` array holds something that is not a usable policy.\n *\n * Every case it covers is refused today — by `tsc`, at the class declaration,\n * with `TS2417`, because `Model` declares `static $policies?: readonly\n * PolicyEntry[]` and `ModelPolicy`'s members are all optional, so a typo'd key\n * trips weak-type detection. This is therefore a guard on the paths that import\n * user code *without* having type-checked it: `registerModels` at boot, and\n * `gemi check models`, whose whole job is to find mistakes in a file somebody is\n * still writing.\n *\n * Two failures, and the second is the one that matters.\n *\n * **A function the ORM cannot get a policy out of.** `resolveEntry` instantiates\n * every function entry with no arguments, and there are two ways that goes\n * wrong. A factory nobody called — `softDeletes` rather than\n * `softDeletes({ field })` — is not constructable at all and reached `new entry`\n * to produce `TypeError: function is not a constructor`. A class that *is*\n * constructable and whose constructor wants an argument gets through that check\n * and dies inside its own body instead, with\n * `TypeError: undefined is not an object (evaluating 'opts.field')`. Both are\n * loud and neither named the model, the index or the file, which on a 79-model\n * app leaves the first question unanswered; the second is the case that survived\n * a first pass at this error, because \"constructable\" is a fact about\n * `[[Construct]]` and says nothing about what the constructor then does.\n *\n * **An entry with no recognised hook.** `{ scopes: … }` and\n * `{ default: { scope: … } }` were accepted in silence: `applyPolicies`\n * dispatches on `before` / `scope` / `onCreate` / `onUpdate` and\n * `applyRedaction` on `redact`, so an entry spelling none of them contributes\n * nothing. The model then carries a visible `$policies` array, passes\n * `gemi check models` as correctly registered, and **reads unscoped** — the same\n * written-believed-not-in-effect shape `UnregisteredPolicyClassError` exists\n * for, arriving through a typo instead of through the registry.\n *\n * The line between *empty but valid* and *malformed* is drawn at \"would this\n * ever run\": an entry with at least one recognised hook that is callable is\n * accepted whatever else it carries, because a factory's return value and a\n * policy class routinely hold configuration and helpers beside the hooks, and\n * refusing unknown *extra* keys would reject code that works. An entry with no\n * callable hook at all is refused, `{}` included — it is indistinguishable from\n * a policy that was meant to do something, and a conditional policy belongs in\n * the array rather than in the entry.\n */\nexport class InvalidPolicyEntryError extends Error {\n  constructor(\n    /**\n     * The class whose **own** `$policies` array holds the entry — the class the\n     * author wrote the array on, which is not necessarily the model being\n     * queried when the array is on a base.\n     */\n    public readonly model: string,\n    /** The entry's index in that array. */\n    public readonly index: number,\n    public readonly reason:\n      | \"not-a-policy\"\n      | \"not-constructable\"\n      | \"constructor-threw\"\n      | \"no-hooks\"\n      | \"hook-not-callable\",\n    /** What was found in the entry's place, rendered for a human. */\n    public readonly found: string,\n    /**\n     * The hook names the runtime dispatches on, supplied by `policy.ts` so the\n     * list lives beside the code that reads it rather than being restated here.\n     */\n    hooks: readonly string[],\n    /**\n     * A key the entry actually spells and the hook it is within one edit of.\n     *\n     * **The pair, not the hook alone.** An unattributed \"Did you mean `scope`?\"\n     * after a list of five keys does not say which of them was read as a\n     * misspelling, so a reader who can see that none of them are has no way to\n     * dismiss it — and this error is about an authorization rule that is not in\n     * effect, where a suggestion followed wrongly costs a rename of something\n     * that was never the problem.\n     */\n    public readonly suggestion?: { key: string; hook: string },\n    options?: { cause?: unknown },\n  ) {\n    const where = `${model}.$policies[${index}]`;\n    const named =\n      hooks.length > 1\n        ? `${hooks.slice(0, -1).join(\", \")} or ${hooks[hooks.length - 1]}`\n        : (hooks[0] ?? \"\");\n\n    super(\n      reason === \"not-a-policy\"\n        ? `${where} is ${found}, which is not a policy. An entry is either a ` +\n            `policy object — { scope, onCreate, … } — or a class the ORM ` +\n            `constructs with no arguments.\\n\\n` +\n            `A policy that only sometimes applies belongs in the array rather ` +\n            `than in the entry:\\n\\n` +\n            `    static $policies = [...(multiTenant ? [tenantScope] : [])]\\n`\n        : reason === \"not-constructable\"\n          ? `${where} is ${found}, and a function entry is instantiated with ` +\n            `no arguments — so an arrow function, a plain function, or a ` +\n            `factory that was never called cannot be one.\\n\\n` +\n            `If it is a factory, call it:\\n\\n` +\n            `    static $policies = [softDeletes({ field: \"deletedAt\" })]\\n`\n          : reason === \"constructor-threw\"\n            ? `${where} is ${found}\\n\\n` +\n              `A class entry is constructed with no arguments. If this one ` +\n              `needs some, construct it yourself and put the instance in the ` +\n              `array:\\n\\n` +\n              `    static $policies = [new TenantPolicy({ field: \"orgId\" })]\\n\\n` +\n              `If the constructor reaches for something that is not ready yet, ` +\n              `note that it runs on the first query through this model, not at ` +\n              `boot.\\n`\n            : reason === \"hook-not-callable\"\n              ? `${where} has a ${found}, and every hook is called — so this ` +\n                `would throw on the first query that reached it rather than ` +\n                `doing whatever it was meant to do. Give it a function, or ` +\n                `leave the key out.\\n`\n              : `${where} has none of ${named}, so it would never run. The ` +\n                `model carries a visible $policies array and nothing in it ` +\n                `applies to any query — which for a scope means the model ` +\n                `reads unscoped. ${found}` +\n                (suggestion\n                  ? ` Is '${suggestion.key}' meant to be \\`${suggestion.hook}\\`?`\n                  : \"\") +\n                `\\n`,\n      options,\n    );\n    this.name = \"InvalidPolicyEntryError\";\n  }\n}\n\n/**\n * Thrown when `registerModels` finds two unrelated classes in one module both\n * claiming the same model name.\n *\n * Deriving registration from a module namespace works because the candidates\n * are normally a chain — a generated base, the application's subclass, perhaps\n * a typed view over it — and a chain has a least element to elect. Two classes\n * that extend the same base without extending each other do not: both were\n * written for this model, and only the author knows which one nested reads\n * should run.\n *\n * Refused rather than guessed at, because both guesses are silent. Picking\n * either would scope every `include` of the model by one class's policies while\n * the other's code keeps reading as though its own applied.\n *\n * **\"In one module\" is the exact scope, and the asymmetry is deliberate.**\n * Election happens per module, so two unrelated claims split across *different*\n * modules never meet inside one — the later import simply wins. What catches\n * that is the audit at the end of `registerModels` rather than this error, and\n * only when the two diverge in policies. Two unrelated *unpolicied* claims on\n * one name resolve by import order and nothing reports it, which is tolerable\n * for the same reason it is invisible: with no policies on either, the choice\n * changes no query's scope.\n */\nexport class AmbiguousModelRegistrationError extends Error {\n  constructor(\n    public readonly model: string,\n    public readonly candidates: readonly string[],\n  ) {\n    const named = candidates.map((candidate) => `'${candidate}'`).join(\", \");\n    super(\n      `Two classes in one module claim the model '${model}' — ${named} — and ` +\n        `neither extends the other, so there is no way to tell which one ` +\n        `nested relation reads should run.\\n\\n` +\n        `Say which, and registerModels will leave it alone:\\n\\n` +\n        `    import { register } from \"gemi/orm\"\\n` +\n        `    register(\"${model}\", ${candidates[0]})\\n\\n` +\n        `A class that is only a typed view over the same rows belongs in a ` +\n        `module you do not hand to registerModels.`,\n    );\n    this.name = \"AmbiguousModelRegistrationError\";\n  }\n}\n\n/**\n * Thrown when a statement would bind more parameters than the driver's wire\n * protocol can carry.\n *\n * Three shapes reach it, all of them scaling with the caller's *data* rather\n * than with the query's shape: `createMany` at `rows × columns`, an `in` list on\n * SQLite (one placeholder per element, and such a list is routinely\n * request-derived), and a to-many `include` on SQLite, which batches an `in`\n * over the parent keys. Both limits are hard and low enough to hit with an\n * ordinary import — Postgres counts parameters in an int16 (65535), SQLite\n * defaults `SQLITE_MAX_VARIABLE_NUMBER` to 32766. Postgres escapes the last two\n * either way: `= any($1)` is one parameter however long the array.\n *\n * Prisma chunks the insert automatically. Doing that here means several\n * statements, which without a transaction is a partially-applied `createMany`\n * on failure — so it waits for iteration 5, and until then this is a named gap\n * rather than a driver error naming neither the model nor the cause. Same\n * treatment as `ReturningUnsupportedError`, for the same reason.\n */\nexport class ParameterLimitError extends Error {\n  constructor(\n    public readonly model: string,\n    public readonly operation: string,\n    public readonly required: number,\n    public readonly limit: number,\n    public readonly dialect: string,\n    detail: string,\n  ) {\n    super(\n      `${model}.${operation} would bind ${required} parameters, and the ` +\n        `'${dialect}' driver accepts at most ${limit} in one statement. ` +\n        `${detail}` +\n        (operation === \"createMany\"\n          ? ` A createMany over the ceiling is normally split across statements ` +\n            `inside one transaction, so reaching this means splitting cannot ` +\n            `help: a single row binds more than the driver accepts.`\n          : ` Splitting is not something this operation can do for you — one ` +\n            `statement has to carry one answer. Narrow the query.`),\n    );\n    this.name = \"ParameterLimitError\";\n  }\n}\n\n/**\n * Thrown when a write omits a column that has no value to fall back on: not\n * supplied, no client-side default, no database default, and not nullable.\n *\n * Raised in the compiler rather than left to the database so the message names\n * the field and the model, instead of surfacing as `NOT NULL constraint failed`\n * with a column name and no context.\n */\nexport class MissingRequiredValueError extends Error {\n  constructor(\n    public readonly model: string,\n    public readonly operation: string,\n    public readonly field: string,\n  ) {\n    super(\n      `${model}.${operation} is missing a value for '${field}', which is ` +\n        `required and has no default.`,\n    );\n    this.name = \"MissingRequiredValueError\";\n  }\n}\n\n/**\n * Thrown when an `include` — or a relation-shaped key inside a `select` — names\n * something the model does not declare as a relation.\n */\nexport class UnknownRelationError extends Error {\n  constructor(\n    public readonly relation: string,\n    public readonly model: string,\n    known: string[],\n  ) {\n    super(\n      `'${relation}' is not a relation on model ${model}. ` +\n        (known.length > 0\n          ? `Known relations: ${known.join(\", \")}.`\n          : `${model} declares no relations.`),\n    );\n    this.name = \"UnknownRelationError\";\n  }\n}\n\n/**\n * Thrown when an include tree nests deeper than the guard allows.\n *\n * A cyclic include is legal and finite — `user -> accounts -> user` terminates\n * because the caller wrote a finite tree. What this catches is an *unbounded*\n * one: an argument tree built by a loop, or forwarded from a request body, that\n * describes a thousand levels. Under the batched planner every level is at least\n * one query, so the guard is what stops a malformed argument from becoming a\n * self-inflicted denial of service.\n */\nexport class RelationDepthExceededError extends Error {\n  constructor(\n    public readonly model: string,\n    public readonly limit: number,\n  ) {\n    super(\n      `The include tree nests more than ${limit} relations deep (at model ` +\n        `${model}). Deeply nested includes are legal, so this is a guard ` +\n        `against a generated or malformed argument tree rather than a limit on ` +\n        `modelling — every level costs at least one query.`,\n    );\n    this.name = \"RelationDepthExceededError\";\n  }\n}\n\n/**\n * Thrown when a relation names a model the registry does not hold. Every\n * relation in a generated artifact was emitted from a model in the same\n * `schema.prisma`, so this can only mean the artifact and the registry disagree.\n */\nexport class UnregisteredRelationTargetError extends Error {\n  constructor(\n    public readonly model: string,\n    public readonly relation: string,\n    public readonly target: string,\n    known: string[],\n  ) {\n    super(\n      `${model}.${relation} points at model '${target}', which nothing has ` +\n        `registered. The generated artifact and the registry disagree: re-run ` +\n        `\\`prisma generate\\`, and check that app/models/generated/index.ts is ` +\n        `imported. ` +\n        (known.length > 0\n          ? `Registered models: ${known.join(\", \")}.`\n          : `Nothing is registered at all.`),\n    );\n    this.name = \"UnregisteredRelationTargetError\";\n  }\n}\n\n/**\n * Thrown when a relation is registered on both sides but the two sides do not\n * describe a link the planner can follow: no matching `relationName` on the\n * other model, or a `from` / `to` naming a field that is not there. Like\n * `UnregisteredRelationTargetError`, it means a stale generated artifact — a\n * consistent one cannot produce it.\n */\nexport class MalformedRelationError extends Error {\n  constructor(\n    public readonly model: string,\n    public readonly relation: string,\n    detail: string,\n  ) {\n    super(\n      `Cannot resolve how ${model}.${relation} joins: ${detail} This means ` +\n        `app/models/generated is stale or hand-edited — re-run ` +\n        `\\`prisma generate\\`.`,\n    );\n    this.name = \"MalformedRelationError\";\n  }\n}\n\n/** Thrown when a relation resolves to a model name nothing registered. */\nexport class ModelNotRegisteredError extends Error {\n  constructor(name: string, known: string[]) {\n    super(\n      `No model is registered under the name '${name}'. ` +\n        (known.length > 0\n          ? `Registered models: ${known.join(\", \")}.`\n          : `Nothing is registered — is app/models/generated/index.ts imported?`),\n    );\n    this.name = \"ModelNotRegisteredError\";\n  }\n}\n\n/** Thrown when a model class is used before the generator has given it a schema. */\nexport class MissingModelSchemaError extends Error {\n  constructor(className: string) {\n    super(\n      `${className} has no $schema. Model subclasses must extend a generated ` +\n        `base class from app/models/generated/models.ts.`,\n    );\n    this.name = \"MissingModelSchemaError\";\n  }\n}\n\n/**\n * A `lock` asked for outside a transaction.\n *\n * A row lock is held until the transaction that took it ends. Outside one, the\n * statement is its own transaction, so the lock is released the moment the row\n * comes back — before the write it was meant to guard has even been issued. The\n * read would succeed and protect nothing, which is the failure this refuses: the\n * race the lock was written to close stays open, silently.\n *\n * Raised on SQLite too, where the lock itself compiles to nothing, so code that\n * forgot its transaction fails in development rather than first on Postgres.\n */\nexport class LockOutsideTransactionError extends Error {\n  constructor(\n    public readonly model: string,\n    public readonly operation: string,\n  ) {\n    super(\n      `${model}.${operation} was given 'lock' outside a transaction. A row ` +\n        `lock lasts until the transaction that took it ends, so outside one it ` +\n        `is released as soon as the row is read and protects nothing. Run the ` +\n        `read and the writes it guards inside Model.transaction(async () => { ` +\n        `... }).`,\n    );\n    this.name = \"LockOutsideTransactionError\";\n  }\n}\n"
   ],
   "mappings": ";AAQO,MAAM,UAA8B,KAAM,CAE7B,SACA,MACA,UAHlB,WAAW,CACO,EACA,EACA,EAsBhB,EACA,CACA,MACE,8BAA8B,WAAkB,KAAS,OACvD,CACJ,EA7BgB,gBACA,aACA,iBA4BhB,KAAK,KAAO,wBAEhB,CAuDO,MAAM,UAA6B,CAAsB,CAC9D,WAAW,CACT,EACA,EACA,EAEA,EACA,CACA,MAAM,EAAU,EAAO,EAAW,CAAM,EACxC,KAAK,KAAO,uBACZ,KAAK,QAAU,YAAY,OAAc,KAAS,OAAe,IAErE,CAEO,MAAM,UAAiC,CAAsB,CAClE,WAAW,CACT,EACA,EACA,EAEA,EACA,CACA,MAAM,EAAU,EAAO,EAAW,CAAM,EACxC,KAAK,KAAO,2BACZ,KAAK,QACH,gCAAgC,OAAc,KAAS,iDACV,IAEnD,CAOO,MAAM,UAA0B,KAAM,CAEzB,MACA,MAFlB,WAAW,CACO,EACA,EAChB,EACA,CACA,MACE,IAAI,8BAAkC,oBACnB,EAAM,KAAK,IAAI,IACpC,EAPgB,aACA,aAOhB,KAAK,KAAO,oBAEhB,CAYO,MAAM,UAAoB,KAAM,CAEnB,MACA,MAFlB,WAAW,CACO,EACA,EAChB,CACA,MACE,8BAA8B,KAAK,UAAU,OAAO,CAAK,CAAC,kBACpD,EAAM,cAAc,EAAM,4CAC9B,6EACA,eACJ,EARgB,aACA,aAQhB,KAAK,KAAO,cAEhB,CAOO,MAAM,UAA4B,KAAM,CAE3B,MACA,UAFlB,WAAW,CACO,EACA,EAChB,CACA,MAAM,MAAM,YAAgB,KAAS,KAAa,EAHlC,aACA,iBAGhB,KAAK,KAAO,sBAEhB,CAkBO,SAAS,CAAqB,CAAC,EAA8C,CAClF,GAAI,aAAiB,EAAqB,MAAO,GAEjD,OACE,OAAO,IAAU,UACjB,IAAU,MACT,EAA6B,OAAS,sBA4CpC,MAAM,UAA8B,KAAM,CAE7B,MACA,UAEA,OAEA,WANlB,WAAW,CACO,EACA,EAEA,EAEA,EAChB,EACA,CACA,MACE,iCAAiC,KAAS,KACvC,EAAO,OAAS,EAAI,QAAQ,EAAO,KAAK,IAAI,IAAM,KAClD,EAAa,iBAAiB,MAAiB,IAChD,OAAO,sCACT,CACF,EAdgB,aACA,iBAEA,cAEA,kBAUhB,KAAK,KAAO,wBAEhB,CA8CO,SAAS,CAAuB,CACrC,EACgC,CAChC,GAAI,aAAiB,EAAuB,MAAO,GAEnD,OACE,OAAO,IAAU,UACjB,IAAU,MACT,EAA6B,OAAS,wBAYpC,MAAM,UAAkC,KAAM,CAEjC,MACA,UACA,QAHlB,WAAW,CACO,EACA,EACA,EAChB,CACA,MACE,GAAG,KAAS,oDACN,uDACJ,6DACJ,EARgB,aACA,iBACA,eAOhB,KAAK,KAAO,4BAEhB,CAgBO,MAAM,UAA0B,KAAM,CAEzB,MACA,UACA,OAHlB,WAAW,CACO,EACA,EACA,EAA+B,SAC/C,CACA,MACE,IAAW,UACP,GAAG,KAAS,qOAIZ,GAAG,KAAS,mBAA2B,aAC7C,EAXgB,aACA,iBACA,cAUhB,KAAK,KAAO,oBAEhB,CASO,SAAS,CAAmB,CAAC,EAA4C,CAC9E,GAAI,aAAiB,EAAmB,MAAO,GAE/C,OACE,OAAO,IAAU,UACjB,IAAU,MACT,EAA6B,OAAS,oBAoCpC,MAAM,UAAyB,KAAM,CAExB,MACA,UACA,OAHlB,WAAW,CACO,EACA,EACA,EAChB,CACA,IAAM,EAAQ,EAAO,IAAI,CAAC,IAAU,IAAI,IAAQ,EAAE,KAAK,IAAI,EAC3D,MACE,GAAG,KAAS,YAAoB,YAAgB,mBAC9C,yEACA;AAAA;AAAA,kFAEwB,EAAO,gBAAgB,EAAO,kBACtD,0EACA,8DACJ,EAbgB,aACA,iBACA,cAYhB,KAAK,KAAO,mBAEhB,CAgCO,MAAM,UAAqC,KAAM,CAEpC,MAQA,WAEA,QAOA,QAlBlB,WAAW,CACO,EAQA,EAEA,EAOA,EAAkD,UAClE,CACA,MACE,IAAY,YACR,GAAG,aAAmB,4BAAqC,kIAGzD,wCAAkC,uDACG,kBAClC,2BAAoC;AAAA;AAAA;AAAA;AAAA,MAIhC;AAAA;AAAA,EACP,oEACG,8DACH,GAAG;AAAA,EACL,IAAY,UACV,GAAG,iDAAuD,SACvD,0EACkB,8BAClB,4DACH;AAAA;AAAA;AAAA,mBAEoB,aAAmB;AAAA,EACvC,iBAAiB,OAAW;AAAA,EAC5B,2BAA2B,iCACvB,SAAa,6BAAsC,uEAEvD,uEACA,SAAS;AAAA;AAAA,MACF;AAAA;AAAA,EACP,yEACA;AAAA,CAER,EApDgB,aAQA,kBAEA,eAOA,eAoChB,KAAK,KAAO,+BAEhB,CA8CO,MAAM,UAAgC,KAAM,CAO/B,MAEA,MACA,OAOA,MAgBA,WAhClB,WAAW,CAMO,EAEA,EACA,EAOA,EAKhB,EAWgB,EAChB,EACA,CACA,IAAM,EAAQ,GAAG,eAAmB,KAC9B,EACJ,EAAM,OAAS,EACX,GAAG,EAAM,MAAM,EAAG,EAAE,EAAE,KAAK,IAAI,QAAQ,EAAM,EAAM,OAAS,KAC3D,EAAM,IAAM,GAEnB,MACE,IAAW,eACP,GAAG,QAAY,kDACb,8EACA;AAAA;AAAA;AAAA;AAAA;AAAA,EAIF,IAAW,oBACT,GAAG,QAAY,gDACf,oEACA;AAAA;AAAA;AAAA;AAAA;AAAA,EAGA,IAAW,oBACT,GAAG,QAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQf,IAAW,oBACT,GAAG,WAAe,8CAClB;AAAA,EAGA,GAAG,iBAAqB,2FAExB,iEACA,mBAAmB,KAClB,EACG,QAAQ,EAAW,sBAAsB,EAAW,UACpD,IACJ;AAAA,EACV,CACF,EAxEgB,aAEA,aACA,cAOA,aAgBA,kBA+ChB,KAAK,KAAO,0BAEhB,CA0BO,MAAM,UAAwC,KAAM,CAEvC,MACA,WAFlB,WAAW,CACO,EACA,EAChB,CACA,IAAM,EAAQ,EAAW,IAAI,CAAC,IAAc,IAAI,IAAY,EAAE,KAAK,IAAI,EACvE,MACE,8CAA8C,aAAW,gBACvD;AAAA;AAAA;AAAA;AAAA;AAAA,gBAIiB,OAAW,EAAW;AAAA;AAAA,4GAG3C,EAbgB,aACA,kBAahB,KAAK,KAAO,kCAEhB,CAqBO,MAAM,UAA4B,KAAM,CAE3B,MACA,UACA,SACA,MACA,QALlB,WAAW,CACO,EACA,EACA,EACA,EACA,EAChB,EACA,CACA,MACE,GAAG,KAAS,gBAAwB,0BAC9B,6BAAmC,uBACpC,KACF,IAAc,aACX,4LAGA,wEACA,uDACR,EAjBgB,aACA,iBACA,gBACA,aACA,eAchB,KAAK,KAAO,sBAEhB,CAUO,MAAM,UAAkC,KAAM,CAEjC,MACA,UACA,MAHlB,WAAW,CACO,EACA,EACA,EAChB,CACA,MACE,GAAG,KAAS,6BAAqC,2CAEnD,EAPgB,aACA,iBACA,aAMhB,KAAK,KAAO,4BAEhB,CAMO,MAAM,UAA6B,KAAM,CAE5B,SACA,MAFlB,WAAW,CACO,EACA,EAChB,EACA,CACA,MACE,IAAI,iCAAwC,OACzC,EAAM,OAAS,EACZ,oBAAoB,EAAM,KAAK,IAAI,KACnC,GAAG,2BACX,EATgB,gBACA,aAShB,KAAK,KAAO,uBAEhB,CAYO,MAAM,UAAmC,KAAM,CAElC,MACA,MAFlB,WAAW,CACO,EACA,EAChB,CACA,MACE,oCAAoC,8BAC/B,kIAEH,wDACJ,EARgB,aACA,aAQhB,KAAK,KAAO,6BAEhB,CAOO,MAAM,UAAwC,KAAM,CAEvC,MACA,SACA,OAHlB,WAAW,CACO,EACA,EACA,EAChB,EACA,CACA,MACE,GAAG,KAAS,sBAA6B,8KAItC,EAAM,OAAS,EACZ,sBAAsB,EAAM,KAAK,IAAI,KACrC,gCACR,EAbgB,aACA,gBACA,cAYhB,KAAK,KAAO,kCAEhB,CASO,MAAM,UAA+B,KAAM,CAE9B,MACA,SAFlB,WAAW,CACO,EACA,EAChB,EACA,CACA,MACE,sBAAsB,KAAS,YAAmB,gBAChD,8DACA,oBACJ,EARgB,aACA,gBAQhB,KAAK,KAAO,yBAEhB,CAGO,MAAM,UAAgC,KAAM,CACjD,WAAW,CAAC,EAAc,EAAiB,CACzC,MACE,0CAA0C,QACvC,EAAM,OAAS,EACZ,sBAAsB,EAAM,KAAK,IAAI,KACrC,0EACR,EACA,KAAK,KAAO,0BAEhB,CAGO,MAAM,UAAgC,KAAM,CACjD,WAAW,CAAC,EAAmB,CAC7B,MACE,GAAG,4GAEL,EACA,KAAK,KAAO,0BAEhB,CAcO,MAAM,UAAoC,KAAM,CAEnC,MACA,UAFlB,WAAW,CACO,EACA,EAChB,CACA,MACE,GAAG,KAAS,yQAKd,EATgB,aACA,iBAShB,KAAK,KAAO,8BAEhB",
-  "debugId": "17ABF8609633A14164756E2164756E21",
+  "debugId": "07129A59B2555A6264756E2164756E21",
   "names": []
 }

package/dist/chunk-aw8gj99f.js

@@ -0,0 +1,4 @@
+// @bun
+import{pl as J}from"./chunk-m6t5a0me.js";class L{kernel;onException;constructor(f){this.kernel=new f.kernel,this.kernel.boot.call(this.kernel),this.onException=f.onException??((A)=>{console.error("Unhandled exception in App:",A)})}async waitForBoot(){await this.kernel.waitForBoot()}getComponentTree(){return this.kernel.viewRoutes().componentTree}getFlatComponentTree(){let f=new Set;for(let A of this.kernel.domains().viewDispatchers())for(let C of A.flatComponentTree)f.add(C);return Array.from(f)}devAllowedHosts(){let f=this.kernel.domains();if(!f.resolver)return[];return f.acceptsCustomDomains?!0:[`.${f.resolver.root}`]}sockets(){return this.kernel.sockets.call(this.kernel)}applyTrustedClientIp(f){this.kernel.domains().applyClientIp(f)}getRouteManifest(){return this.kernel.viewRoutes().routeManifest}globallyGated=new WeakMap;async withGlobalMiddleware(f,A,C){let z;try{z=await this.kernel.run.call(this.kernel,()=>this.kernel.globalMiddleware(f))}catch(F){return await C(F)}if(z.refusal)return z.refusal;return this.globallyGated.set(f,z.carried),z.apply(await A(f))}async fetch(f){let A=new URL(f.url);return this.kernel.run.call(this.kernel,async()=>{this.applyTrustedClientIp(f);let C=this.globallyGated.has(f),z=C?null:await this.kernel.globalMiddleware(f),F=C?this.globallyGated.get(f):z.carried;if(z?.refusal)return z.refusal;let H=this.kernel.mcpHttp();if(H){let B=await H.handle(f);if(B)return z?z.apply(B):B}let I=this.kernel.domains(),D=await I.ask(f)??await I.route(f);if(D instanceof Response)return z?z.apply(D):D;if(!D){let B=new Response("Unknown host",{status:404});return z?z.apply(B):B}let G=J(A.pathname)?await D.api.handleApiRequest(f,F):await D.view.handleViewRequest(f,F);if(!z)return G;if(typeof G==="function"){let B=G;return async(...M)=>z.apply(await B(...M))}return z.apply(G)})}dispatchJob(f,A){return this.kernel.run.bind(this.kernel)(()=>{return this.kernel.queue().dispatchJob(f,A)})}shutdown(f){return this.kernel.shutdown(f)}destroy(){this.kernel.destroy()}clone(){return Object.assign(Object.create(Object.getPrototypeOf(this)),this)}}export{L as Da};
+
+//# debugId=846A6586247DF07864756E2164756E21

package/dist/chunk-aw8gj99f.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../app/App.ts"],
+  "sourcesContent": [
+    "import type { Kernel } from \"../kernel\";\nimport type { CarriedContext } from \"../http/requestContext\";\nimport { isApiPath } from \"../services/router/apiPath\";\nimport type { SocketHub } from \"../services/broadcast/SocketHub\";\n\n/** What the servers use of the broadcast `SocketHub`. */\nexport type SocketTransport = Pick<\n  SocketHub,\n  \"matches\" | \"upgrade\" | \"websocket\" | \"socketOptions\" | \"start\" | \"shutdown\"\n>;\n\ninterface AppParams {\n  kernel: new () => Kernel;\n  onException?: (error: Error) => void;\n}\n\nexport class App {\n  private kernel: Kernel;\n  public onException?: (error: Error) => void;\n\n  constructor(params: AppParams) {\n    this.kernel = new params.kernel();\n    this.kernel.boot.call(this.kernel);\n    this.onException =\n      params.onException ??\n      ((error: Error) => {\n        console.error(\"Unhandled exception in App:\", error);\n      });\n  }\n\n  // Every service this class touches is resolved through a `this.kernel.*`\n  // accessor rather than by importing the service class and calling `app()`\n  // here. That is deliberate: the built bin (`dist/bin/gemi.js`) bundles its own\n  // copy of gemi, while the app's Kernel is loaded from source and resolves\n  // `gemi/*` to the source modules — so the two copies have *different*\n  // `kernelContext` AsyncLocalStorage instances and different `Application`\n  // class objects. A method call on the Kernel executes in the app's copy and\n  // reads the app's container; a resolution attempted here would not. Service\n  // *tokens* still cross the boundary safely (they are plain strings), which is\n  // why `kernel.resolve()` works from either side.\n  public async waitForBoot() {\n    await this.kernel.waitForBoot();\n  }\n\n  public getComponentTree() {\n    return this.kernel.viewRoutes().componentTree;\n  }\n\n  // Every host group's views, not just the root's: the servers load these\n  // modules up front, and a view only an `admin.` group routes to still has\n  // to be among them.\n  public getFlatComponentTree() {\n    const views = new Set<string>();\n    for (const dispatcher of this.kernel.domains().viewDispatchers()) {\n      for (const view of dispatcher.flatComponentTree) {\n        views.add(view);\n      }\n    }\n    return Array.from(views);\n  }\n\n  /**\n   * The hosts the dev server's Vite may answer: the `route.domains` root and\n   * its subdomains, or any host when custom domains are on, since those are\n   * only known to the app's resolver.\n   */\n  public devAllowedHosts(): true | string[] {\n    const domains = this.kernel.domains();\n    if (!domains.resolver) {\n      return [];\n    }\n    return domains.acceptsCustomDomains ? true : [`.${domains.resolver.root}`];\n  }\n\n  /**\n   * The broadcast WebSocket endpoint the servers wire into `Bun.serve`, or\n   * `null` when the app has no `route.channels`. Typed structurally: the hub\n   * belongs to the app's copy of gemi (see the note above).\n   */\n  public sockets(): SocketTransport | null {\n    return this.kernel.sockets.call(this.kernel);\n  }\n\n  /**\n   * Applies `route.domains.trustProxy.clientIpHeader`, or\n   * `GEMI_CLIENT_IP_HEADER` for an app without `route.domains`: on a request\n   * that carries the proxy's secret, the address that header names becomes\n   * the one in `X-Forwarded-For`. The servers call it right after settling\n   * `X-Forwarded-For` (`GEMI_TRUST_PROXY`) and before anything reads it —\n   * the socket upgrade and the global middleware included. `fetch` calls it\n   * too, for a caller that is not one of the servers. Idempotent.\n   */\n  public applyTrustedClientIp(req: Request) {\n    this.kernel.domains().applyClientIp(req);\n  }\n\n  public getRouteManifest() {\n    return this.kernel.viewRoutes().routeManifest;\n  }\n\n  // Requests `withGlobalMiddleware` already ran the global middleware for, so\n  // `fetch` inside it does not run the list a second time, and can still hand\n  // the route what the list carried. Keyed by the Request object: the servers\n  // hand `fetch` the same one they gated.\n  private globallyGated = new WeakMap<Request, CarriedContext | null>();\n\n  /**\n   * Runs the `global` middleware list, then `next` — what the servers put in\n   * front of everything they serve, so the list covers static files, which\n   * never reach `fetch`, as well as routes. A refusal is answered without\n   * calling `next`. A global middleware that throws something other than a\n   * break is answered by `onError` rather than by `next`, since a gate that\n   * failed must not let a static file through.\n   */\n  public async withGlobalMiddleware(\n    req: Request,\n    next: (req: Request) => Promise<Response>,\n    onError: (err: unknown) => Response | Promise<Response>,\n  ): Promise<Response> {\n    let outcome: Awaited<ReturnType<Kernel[\"globalMiddleware\"]>>;\n    try {\n      outcome = await this.kernel.run.call(this.kernel, () => this.kernel.globalMiddleware(req));\n    } catch (err) {\n      return await onError(err);\n    }\n    if (outcome.refusal) {\n      return outcome.refusal;\n    }\n    this.globallyGated.set(req, outcome.carried);\n    return outcome.apply(await next(req));\n  }\n\n  public async fetch(req: Request): Promise<Response> {\n    const url = new URL(req.url);\n    return this.kernel.run.call(this.kernel, async () => {\n      // Repeated from the servers, for a caller that is not one of them.\n      this.applyTrustedClientIp(req);\n      // Run here too for a caller that is not one of the servers, a test or an\n      // app's own `Bun.serve`, so the list is not skipped by calling `fetch`.\n      const gated = this.globallyGated.has(req);\n      const outcome = gated ? null : await this.kernel.globalMiddleware(req);\n      const carried = gated ? this.globallyGated.get(req) : outcome.carried;\n      if (outcome?.refusal) {\n        return outcome.refusal;\n      }\n      // The MCP endpoint, and its OAuth endpoints, on the host it is\n      // configured for. Ahead of routing, so no route can shadow it, and after\n      // the global middleware, which covers it as it covers everything.\n      const mcp = this.kernel.mcpHttp();\n      if (mcp) {\n        const answered = await mcp.handle(req);\n        if (answered) {\n          return outcome ? outcome.apply(answered) : answered;\n        }\n      }\n      const domains = this.kernel.domains();\n      const dispatchers = (await domains.ask(req)) ?? (await domains.route(req));\n      if (dispatchers instanceof Response) {\n        return outcome ? outcome.apply(dispatchers) : dispatchers;\n      }\n      if (!dispatchers) {\n        const unknown = new Response(\"Unknown host\", { status: 404 });\n        return outcome ? outcome.apply(unknown) : unknown;\n      }\n      const result = isApiPath(url.pathname)\n        ? await dispatchers.api.handleApiRequest(req, carried)\n        : await dispatchers.view.handleViewRequest(req, carried);\n      if (!outcome) {\n        return result;\n      }\n      // A document comes back as a render function the server calls with its\n      // manifests, and the Response only exists once it has.\n      if (typeof result === \"function\") {\n        const render = result as (...args: any[]) => Promise<Response>;\n        return (async (...args: any[]) => outcome.apply(await render(...args))) as any;\n      }\n      return outcome.apply(result);\n    });\n  }\n\n  public dispatchJob(jobName: string, args: string) {\n    const kernelRun = this.kernel.run.bind(this.kernel);\n    return kernelRun(() => {\n      return this.kernel.queue().dispatchJob(jobName, args);\n    });\n  }\n\n  /** Every provider's `shutdown()`; see `Kernel.shutdown`. */\n  public shutdown(options?: { timeoutMs?: number }) {\n    return this.kernel.shutdown(options);\n  }\n\n  public destroy() {\n    this.kernel.destroy();\n  }\n\n  public clone() {\n    return Object.assign(Object.create(Object.getPrototypeOf(this)), this);\n  }\n}\n\nexport type FetchHandler = InstanceType<typeof App>[\"fetch\"];\n"
+  ],
+  "mappings": ";yCAgBO,MAAM,CAAI,CACP,OACD,YAEP,WAAW,CAAC,EAAmB,CAC7B,KAAK,OAAS,IAAI,EAAO,OACzB,KAAK,OAAO,KAAK,KAAK,KAAK,MAAM,EACjC,KAAK,YACH,EAAO,cACN,CAAC,IAAiB,CACjB,QAAQ,MAAM,8BAA+B,CAAK,SAc3C,YAAW,EAAG,CACzB,MAAM,KAAK,OAAO,YAAY,EAGzB,gBAAgB,EAAG,CACxB,OAAO,KAAK,OAAO,WAAW,EAAE,cAM3B,oBAAoB,EAAG,CAC5B,IAAM,EAAQ,IAAI,IAClB,QAAW,KAAc,KAAK,OAAO,QAAQ,EAAE,gBAAgB,EAC7D,QAAW,KAAQ,EAAW,kBAC5B,EAAM,IAAI,CAAI,EAGlB,OAAO,MAAM,KAAK,CAAK,EAQlB,eAAe,EAAoB,CACxC,IAAM,EAAU,KAAK,OAAO,QAAQ,EACpC,GAAI,CAAC,EAAQ,SACX,MAAO,CAAC,EAEV,OAAO,EAAQ,qBAAuB,GAAO,CAAC,IAAI,EAAQ,SAAS,MAAM,EAQpE,OAAO,EAA2B,CACvC,OAAO,KAAK,OAAO,QAAQ,KAAK,KAAK,MAAM,EAYtC,oBAAoB,CAAC,EAAc,CACxC,KAAK,OAAO,QAAQ,EAAE,cAAc,CAAG,EAGlC,gBAAgB,EAAG,CACxB,OAAO,KAAK,OAAO,WAAW,EAAE,cAO1B,cAAgB,IAAI,aAUf,qBAAoB,CAC/B,EACA,EACA,EACmB,CACnB,IAAI,EACJ,GAAI,CACF,EAAU,MAAM,KAAK,OAAO,IAAI,KAAK,KAAK,OAAQ,IAAM,KAAK,OAAO,iBAAiB,CAAG,CAAC,EACzF,MAAO,EAAK,CACZ,OAAO,MAAM,EAAQ,CAAG,EAE1B,GAAI,EAAQ,QACV,OAAO,EAAQ,QAGjB,OADA,KAAK,cAAc,IAAI,EAAK,EAAQ,OAAO,EACpC,EAAQ,MAAM,MAAM,EAAK,CAAG,CAAC,OAGzB,MAAK,CAAC,EAAiC,CAClD,IAAM,EAAM,IAAI,IAAI,EAAI,GAAG,EAC3B,OAAO,KAAK,OAAO,IAAI,KAAK,KAAK,OAAQ,SAAY,CAEnD,KAAK,qBAAqB,CAAG,EAG7B,IAAM,EAAQ,KAAK,cAAc,IAAI,CAAG,EAClC,EAAU,EAAQ,KAAO,MAAM,KAAK,OAAO,iBAAiB,CAAG,EAC/D,EAAU,EAAQ,KAAK,cAAc,IAAI,CAAG,EAAI,EAAQ,QAC9D,GAAI,GAAS,QACX,OAAO,EAAQ,QAKjB,IAAM,EAAM,KAAK,OAAO,QAAQ,EAChC,GAAI,EAAK,CACP,IAAM,EAAW,MAAM,EAAI,OAAO,CAAG,EACrC,GAAI,EACF,OAAO,EAAU,EAAQ,MAAM,CAAQ,EAAI,EAG/C,IAAM,EAAU,KAAK,OAAO,QAAQ,EAC9B,EAAe,MAAM,EAAQ,IAAI,CAAG,GAAO,MAAM,EAAQ,MAAM,CAAG,EACxE,GAAI,aAAuB,SACzB,OAAO,EAAU,EAAQ,MAAM,CAAW,EAAI,EAEhD,GAAI,CAAC,EAAa,CAChB,IAAM,EAAU,IAAI,SAAS,eAAgB,CAAE,OAAQ,GAAI,CAAC,EAC5D,OAAO,EAAU,EAAQ,MAAM,CAAO,EAAI,EAE5C,IAAM,EAAS,EAAU,EAAI,QAAQ,EACjC,MAAM,EAAY,IAAI,iBAAiB,EAAK,CAAO,EACnD,MAAM,EAAY,KAAK,kBAAkB,EAAK,CAAO,EACzD,GAAI,CAAC,EACH,OAAO,EAIT,GAAI,OAAO,IAAW,WAAY,CAChC,IAAM,EAAS,EACf,MAAQ,UAAU,IAAgB,EAAQ,MAAM,MAAM,EAAO,GAAG,CAAI,CAAC,EAEvE,OAAO,EAAQ,MAAM,CAAM,EAC5B,EAGI,WAAW,CAAC,EAAiB,EAAc,CAEhD,OADkB,KAAK,OAAO,IAAI,KAAK,KAAK,MAAM,EACjC,IAAM,CACrB,OAAO,KAAK,OAAO,MAAM,EAAE,YAAY,EAAS,CAAI,EACrD,EAII,QAAQ,CAAC,EAAkC,CAChD,OAAO,KAAK,OAAO,SAAS,CAAO,EAG9B,OAAO,EAAG,CACf,KAAK,OAAO,QAAQ,EAGf,KAAK,EAAG,CACb,OAAO,OAAO,OAAO,OAAO,OAAO,OAAO,eAAe,IAAI,CAAC,EAAG,IAAI,EAEzE",
+  "debugId": "846A6586247DF07864756E2164756E21",
+  "names": []
+}