gemi 0.188.0 → 0.189.0

package/dist/ai/providers/call.d.ts

@@ -19,6 +19,8 @@ export type ResponsesEndpoint = {
      *  to be read per request rather than per provider. */
     headers: () => Promise<Record<string, string>>;
     timeoutMs: number;
+    /** See `ProviderConfig.streamIdleTimeoutMs`. Absent or `0` is off. */
+    streamIdleTimeoutMs?: number;
     maxRetries: number;
     fetchImpl?: FetchLike;
     /** Injected by the tests, with `random`, so a backoff can be asserted on
@@ -59,6 +61,13 @@ export declare function responsesEndpoint(target: ProviderTarget): ResponsesEndp
  * endpoint's `maxRetries` and the same backoff as the request retry, and an
  * abort during the wait ends the call at once. The usage a dropped attempt
  * reported is added to the call's closing `finish`, because it was billed.
+ *
+ * A STREAM THAT GOES SILENT IS CUT (#1167). With `streamIdleTimeoutMs` set, a
+ * body that sends nothing for that long errors with a `ProviderStreamIdleError`
+ * and the attempt's request is aborted, which releases the socket. From there it
+ * is a broken stream like any other: retryable, so asked again before the first
+ * content event, and the call's error after it (nothing is repeated). The
+ * caller's signal still wins: an abort while waiting ends the call as aborted.
  */
 export declare function streamResponses(endpoint: ResponsesEndpoint, body: ResponsesRequest, params: {
     signal?: AbortSignal;

package/dist/ai/providers/call.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"call.d.ts","sourceRoot":"","sources":["../../../ai/providers/call.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,EAIL,KAAK,QAAQ,EACd,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAIL,KAAK,SAAS,EACd,KAAK,cAAc,EACpB,MAAM,QAAQ,CAAC;AAChB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAGlD;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB;2DACuD;IACvD,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;wDACoD;IACpD,KAAK,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CACvB,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,cAAc,GAAG,iBAAiB,CAQ3E;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAuB,eAAe,CACpC,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,gBAAgB,EACtB,MAAM,EAAE;IACN,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,gBAAgB,EAAE,OAAO,CAAC;IAC1B;kFAC8E;IAC9E,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;CAC/B,GACA,cAAc,CAAC,aAAa,CAAC,CA4H/B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,YAAY,CAAC;AAEvD;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,IAAI,EACV,OAAO,GAAE,aAA2B,GACnC,OAAO,CAAC,MAAM,CAAC,CAyBjB"}
+{"version":3,"file":"call.d.ts","sourceRoot":"","sources":["../../../ai/providers/call.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,EAIL,KAAK,QAAQ,EACd,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAKL,KAAK,SAAS,EACd,KAAK,cAAc,EACpB,MAAM,QAAQ,CAAC;AAChB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAGlD;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB;2DACuD;IACvD,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;wDACoD;IACpD,KAAK,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CACvB,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,cAAc,GAAG,iBAAiB,CAS3E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAuB,eAAe,CACpC,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,gBAAgB,EACtB,MAAM,EAAE;IACN,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,gBAAgB,EAAE,OAAO,CAAC;IAC1B;kFAC8E;IAC9E,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;CAC/B,GACA,cAAc,CAAC,aAAa,CAAC,CAuI/B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,YAAY,CAAC;AAEvD;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,IAAI,EACV,OAAO,GAAE,aAA2B,GACnC,OAAO,CAAC,MAAM,CAAC,CAyBjB"}

package/dist/ai/providers/endpoints.d.ts

@@ -24,6 +24,15 @@ export type ProviderConfig = {
     apiKey?: string;
     baseURL?: string;
     timeoutMs?: number;
+    /**
+     * The longest a streamed answer may go without sending anything (an event or
+     * a keepalive) once its response has started. Every chunk resets it. When it
+     * runs out the attempt is aborted with a retryable `ProviderTimeoutError`:
+     * before the first content event it is asked again like any other dropped
+     * stream, after it the call ends with an error. Default
+     * `DEFAULT_STREAM_IDLE_TIMEOUT_MS` (120 s); `0` turns it off.
+     */
+    streamIdleTimeoutMs?: number;
     maxRetries?: number;
     headers?: Record<string, string>;
 };
@@ -69,15 +78,36 @@ export type ProviderTarget = {
     /** Called per request. See the Azure branch for why that is not an accident. */
     headers: () => Promise<Record<string, string>>;
     timeoutMs: number;
+    /** See `ProviderConfig.streamIdleTimeoutMs`. `0` is off. */
+    streamIdleTimeoutMs: number;
     maxRetries: number;
 };
 /** Long enough for a reasoning model to think before it says anything, short
  *  enough that a hung connection is not mistaken for a slow one. For a streamed
- *  call it only covers getting a response; the stream that follows has no
- *  deadline. For a one-shot call it is the whole deadline — which is why the
+ *  call it only covers getting a response; the stream that follows is bounded
+ *  by `streamIdleTimeoutMs` instead. For a one-shot call it is the whole deadline — which is why the
  *  images path sets its own, and why `retryTimeouts` exists. */
 export declare const DEFAULT_TIMEOUT_MS = 120000;
 export declare const DEFAULT_MAX_RETRIES = 2;
+/**
+ * How long a streamed answer may stay silent once it has started (#1167).
+ *
+ * `timeoutMs` stops at the response headers, and a Responses stream sends its
+ * headers (and `response.created`) within a second or so, so before this
+ * nothing bounded a stream that went quiet: a stalled step waited for the
+ * run's `maxRunDurationMs`. Seen on an Azure deployment: completed steps took
+ * 1–12 s with the first event after 1–5 s, and the one that stalled sent
+ * nothing more for ten minutes.
+ *
+ * WHY NOT SHORTER. The cost of the two mistakes is not symmetric. Too long, and
+ * a rare stall takes two minutes to notice instead of one. Too short, and a
+ * reasoning model at a high effort, which can think for a long while between
+ * two events, is cut off mid-thought on every hard request, retried (and billed)
+ * up to `maxRetries` times, and fails anyway. So the default matches the
+ * header timeout, which already had to be long enough for a model to think
+ * before saying anything. An app on low effort can set it lower.
+ */
+export declare const DEFAULT_STREAM_IDLE_TIMEOUT_MS = 120000;
 export declare function env(name: string): string | undefined;
 /**
  * `preview` selects Azure's `/openai/v1` surface, which is the OpenAI-shaped

package/dist/ai/providers/endpoints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"endpoints.d.ts","sourceRoot":"","sources":["../../../ai/providers/endpoints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,cAAc,GAAG;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CAClC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;gEAIgE;AAChE,eAAO,MAAM,kBAAkB,SAAU,CAAC;AAC1C,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,wBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEpD;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,YAAY,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAS7C;AAED;0DAC0D;AAC1D,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,0EAA0E;AAC1E,MAAM,MAAM,cAAc,GAAG;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD,wBAAgB,YAAY,CAC1B,MAAM,EAAE,cAAc,EACtB,QAAQ,GAAE,cAAmB,GAC5B,cAAc,CAmBhB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAM7D;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,GAAE,cAAmB,GAAG,cAAc,CAoB9F;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,WAAW,EACnB,QAAQ,GAAE,cAAmB,GAC5B,cAAc,CAGhB"}
+{"version":3,"file":"endpoints.d.ts","sourceRoot":"","sources":["../../../ai/providers/endpoints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,cAAc,GAAG;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CAClC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;gEAIgE;AAChE,eAAO,MAAM,kBAAkB,SAAU,CAAC;AAC1C,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,8BAA8B,SAAU,CAAC;AAEtD,wBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEpD;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,YAAY,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAS7C;AAED;0DAC0D;AAC1D,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,0EAA0E;AAC1E,MAAM,MAAM,cAAc,GAAG;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD,wBAAgB,YAAY,CAC1B,MAAM,EAAE,cAAc,EACtB,QAAQ,GAAE,cAAmB,GAC5B,cAAc,CAoBhB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAM7D;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,GAAE,cAAmB,GAAG,cAAc,CAqB9F;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,WAAW,EACnB,QAAQ,GAAE,cAAmB,GAC5B,cAAc,CAGhB"}

package/dist/ai/providers/errors.d.ts

@@ -25,6 +25,15 @@ export declare class ProviderTimeoutError extends Error {
     readonly timeoutMs: number;
     constructor(timeoutMs: number);
 }
+/**
+ * A streamed answer that started and then sent nothing, not even a keepalive,
+ * for `streamIdleTimeoutMs` (#1167). A `ProviderTimeoutError`, so it reads the
+ * same everywhere: retryable `provider_error`, never an abort. The attempt was
+ * aborted, so its connection is released.
+ */
+export declare class ProviderStreamIdleError extends ProviderTimeoutError {
+    constructor(timeoutMs: number);
+}
 /**
  * The HTTP status and request id of a provider failure, read off what was
  * thrown — server-side detail for `AgentRunResult.error`, never for a frame.

package/dist/ai/providers/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../ai/providers/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE3C;;;;;;;;GAQG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,sEAAsE;IACtE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;gBAEjB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;CAQnF;AAED;;;;GAIG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,SAAS,EAAE,MAAM;CAK9B;AAyBD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAOvF;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CA4BjE;AA0DD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKzE"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../ai/providers/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE3C;;;;;;;;GAQG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,sEAAsE;IACtE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;gBAEjB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;CAQnF;AAED;;;;GAIG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,SAAS,EAAE,MAAM;CAK9B;AAED;;;;;GAKG;AACH,qBAAa,uBAAwB,SAAQ,oBAAoB;gBACnD,SAAS,EAAE,MAAM;CAK9B;AAyBD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAOvF;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CA4BjE;AA0DD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKzE"}

package/dist/ai/providers/http.d.ts

@@ -81,7 +81,24 @@ export declare function waitUnlessAborted(ms: number, signal: AbortSignal | unde
  * legitimately takes minutes, and a timeout that kept running would cut off
  * long completions at exactly the point where they were most expensive to
  * abandon — so the timer is cleared once the headers land, and only the
- * caller's own signal can end the body.
+ * caller's own signal or the stream idle limit (`idleTimeoutBody`, #1167)
+ * can end the body.
  */
 export declare function requestWithRetry(url: string, init: RequestInit, options: RequestOptions): Promise<Response>;
+/**
+ * `body`, errored with `onIdle()`'s error when a read waits longer than `ms`
+ * (#1167). `ms <= 0` or no body returns `body` as it is.
+ *
+ * `requestWithRetry`'s timer stops at the headers, so this is what bounds a
+ * stream that went quiet after it started. Every chunk resets the clock, so a
+ * slow but steady stream is never cut, and a keepalive comment counts as a
+ * sign of life. The clock runs only while the consumer is waiting on the
+ * source (the stream pulls on demand), so a consumer that is busy between two
+ * events is not mistaken for a silent provider.
+ *
+ * `onIdle` is expected to abort the request, which releases the socket; the
+ * source is cancelled here too, for a fetch that ignores its signal. The same
+ * shape as `Storage.fetch()`'s `fetchIdleTimeoutMs`.
+ */
+export declare function idleTimeoutBody(body: ReadableStream<Uint8Array> | null, ms: number, onIdle: () => Error): ReadableStream<Uint8Array> | null;
 //# sourceMappingURL=http.d.ts.map

package/dist/ai/providers/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../ai/providers/http.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEhF,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;iDAE6C;IAC7C,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;eAGW;IACX,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAMF,eAAO,MAAM,YAAY,QAAS,CAAC;AAEnC;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAOjG;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,MAAM,GAAG,MAAM,CAG5E;AA6CD;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,WAAW,GAAG,SAAS,EAC/B,KAAK,GAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAgB,GACxE,OAAO,CAAC,IAAI,CAAC,CAef;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,QAAQ,CAAC,CAqFnB"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../ai/providers/http.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEhF,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;iDAE6C;IAC7C,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;eAGW;IACX,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAMF,eAAO,MAAM,YAAY,QAAS,CAAC;AAEnC;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAOjG;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,MAAM,GAAG,MAAM,CAG5E;AA6CD;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,WAAW,GAAG,SAAS,EAC/B,KAAK,GAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAgB,GACxE,OAAO,CAAC,IAAI,CAAC,CAef;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,QAAQ,CAAC,CAqFnB;AAgBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,EACvC,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,KAAK,GAClB,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,CAkCnC"}

package/dist/app/index.js

@@ -1,4 +1,4 @@
 // @bun
-import{Ea as a}from"../chunk-kcgbb7cd.js";import"../chunk-scscdtd6.js";import"../chunk-jmgjhfya.js";export{a as App};
+import{Ea as a}from"../chunk-vy1334k3.js";import"../chunk-2ba0v2ar.js";import"../chunk-7wkwm0tn.js";export{a as App};
 
 //# debugId=A7FB3B2CC8B73BFE64756E2164756E21

package/dist/bun/plugin.js

@@ -1,4 +1,4 @@
 // @bun
-import{fa as a}from"../chunk-bmckdsec.js";import"../chunk-vpms0v5m.js";import"../chunk-nbfzyvav.js";import"../chunk-pchb1awj.js";import"../chunk-jmgjhfya.js";export{a as gemiPlugin};
+import{fa as a}from"../chunk-5dwbhjk7.js";import"../chunk-nfrgz3gw.js";import"../chunk-x3qtvs3n.js";import"../chunk-h5q6w17p.js";import"../chunk-7wkwm0tn.js";export{a as gemiPlugin};
 
 //# debugId=36D1825891C6658464756E2164756E21

package/dist/bun/preload.js

@@ -1,4 +1,4 @@
 // @bun
-import{fa as k}from"../chunk-bmckdsec.js";import"../chunk-vpms0v5m.js";import"../chunk-nbfzyvav.js";import"../chunk-pchb1awj.js";import{za as j}from"../chunk-7txst143.js";import"../chunk-jmgjhfya.js";var{plugin:q}=globalThis.Bun;q(k());var y=await j(process.cwd());for(let x of y.bun?.plugins??[])q(x);
+import{fa as k}from"../chunk-5dwbhjk7.js";import"../chunk-nfrgz3gw.js";import"../chunk-x3qtvs3n.js";import"../chunk-h5q6w17p.js";import{za as j}from"../chunk-7txst143.js";import"../chunk-7wkwm0tn.js";var{plugin:q}=globalThis.Bun;q(k());var y=await j(process.cwd());for(let x of y.bun?.plugins??[])q(x);
 
 //# debugId=FF5AD9F96BE6CCA964756E2164756E21

package/dist/{chunk-bwh1n2cj.js → chunk-1f9143dv.js}

@@ -1,5 +1,5 @@
 // @bun
-import{Kl as h}from"./chunk-jmgjhfya.js";var A=h((f)=>{f.HttpAuthLocation=void 0;(function(t){t.HEADER="header",t.QUERY="query"})(f.HttpAuthLocation||(f.HttpAuthLocation={}));f.HttpApiKeyAuthLocation=void 0;(function(t){t.HEADER="header",t.QUERY="query"})(f.HttpApiKeyAuthLocation||(f.HttpApiKeyAuthLocation={}));f.EndpointURLScheme=void 0;(function(t){t.HTTP="http",t.HTTPS="https"})(f.EndpointURLScheme||(f.EndpointURLScheme={}));f.AlgorithmId=void 0;(function(t){t.MD5="md5",t.CRC32="crc32",t.CRC32C="crc32c",t.SHA1="sha1",t.SHA256="sha256"})(f.AlgorithmId||(f.AlgorithmId={}));var x=(t)=>{let o=[];if(t.sha256!==void 0)o.push({algorithmId:()=>f.AlgorithmId.SHA256,checksumConstructor:()=>t.sha256});if(t.md5!=null)o.push({algorithmId:()=>f.AlgorithmId.MD5,checksumConstructor:()=>t.md5});return{addChecksumAlgorithm(s){o.push(s)},checksumAlgorithms(){return o}}},d=(t)=>{let o={};return t.checksumAlgorithms().forEach((s)=>{o[s.algorithmId()]=s.checksumConstructor()}),o},a=(t)=>{return x(t)},E=(t)=>{return d(t)};f.FieldPosition=void 0;(function(t){t[t.HEADER=0]="HEADER",t[t.TRAILER=1]="TRAILER"})(f.FieldPosition||(f.FieldPosition={}));var m="__smithy_context";f.IniSectionType=void 0;(function(t){t.PROFILE="profile",t.SSO_SESSION="sso-session",t.SERVICES="services"})(f.IniSectionType||(f.IniSectionType={}));f.RequestHandlerProtocol=void 0;(function(t){t.HTTP_0_9="http/0.9",t.HTTP_1_0="http/1.0",t.TDS_8_0="tds/8.0"})(f.RequestHandlerProtocol||(f.RequestHandlerProtocol={}));f.SMITHY_CONTEXT_KEY=m;f.getDefaultClientConfiguration=a;f.resolveDefaultRuntimeConfig=E});
+import{Ll as h}from"./chunk-7wkwm0tn.js";var A=h((f)=>{f.HttpAuthLocation=void 0;(function(t){t.HEADER="header",t.QUERY="query"})(f.HttpAuthLocation||(f.HttpAuthLocation={}));f.HttpApiKeyAuthLocation=void 0;(function(t){t.HEADER="header",t.QUERY="query"})(f.HttpApiKeyAuthLocation||(f.HttpApiKeyAuthLocation={}));f.EndpointURLScheme=void 0;(function(t){t.HTTP="http",t.HTTPS="https"})(f.EndpointURLScheme||(f.EndpointURLScheme={}));f.AlgorithmId=void 0;(function(t){t.MD5="md5",t.CRC32="crc32",t.CRC32C="crc32c",t.SHA1="sha1",t.SHA256="sha256"})(f.AlgorithmId||(f.AlgorithmId={}));var x=(t)=>{let o=[];if(t.sha256!==void 0)o.push({algorithmId:()=>f.AlgorithmId.SHA256,checksumConstructor:()=>t.sha256});if(t.md5!=null)o.push({algorithmId:()=>f.AlgorithmId.MD5,checksumConstructor:()=>t.md5});return{addChecksumAlgorithm(s){o.push(s)},checksumAlgorithms(){return o}}},d=(t)=>{let o={};return t.checksumAlgorithms().forEach((s)=>{o[s.algorithmId()]=s.checksumConstructor()}),o},a=(t)=>{return x(t)},E=(t)=>{return d(t)};f.FieldPosition=void 0;(function(t){t[t.HEADER=0]="HEADER",t[t.TRAILER=1]="TRAILER"})(f.FieldPosition||(f.FieldPosition={}));var m="__smithy_context";f.IniSectionType=void 0;(function(t){t.PROFILE="profile",t.SSO_SESSION="sso-session",t.SERVICES="services"})(f.IniSectionType||(f.IniSectionType={}));f.RequestHandlerProtocol=void 0;(function(t){t.HTTP_0_9="http/0.9",t.HTTP_1_0="http/1.0",t.TDS_8_0="tds/8.0"})(f.RequestHandlerProtocol||(f.RequestHandlerProtocol={}));f.SMITHY_CONTEXT_KEY=m;f.getDefaultClientConfiguration=a;f.resolveDefaultRuntimeConfig=E});
 export{A as T};
 
-//# debugId=53D3583FFD74F57364756E2164756E21
+//# debugId=7CB840005276C5E164756E2164756E21

package/dist/{chunk-bwh1n2cj.js.map → chunk-1f9143dv.js.map}

@@ -5,6 +5,6 @@
     "'use strict';\n\nexports.HttpAuthLocation = void 0;\n(function (HttpAuthLocation) {\n    HttpAuthLocation[\"HEADER\"] = \"header\";\n    HttpAuthLocation[\"QUERY\"] = \"query\";\n})(exports.HttpAuthLocation || (exports.HttpAuthLocation = {}));\n\nexports.HttpApiKeyAuthLocation = void 0;\n(function (HttpApiKeyAuthLocation) {\n    HttpApiKeyAuthLocation[\"HEADER\"] = \"header\";\n    HttpApiKeyAuthLocation[\"QUERY\"] = \"query\";\n})(exports.HttpApiKeyAuthLocation || (exports.HttpApiKeyAuthLocation = {}));\n\nexports.EndpointURLScheme = void 0;\n(function (EndpointURLScheme) {\n    EndpointURLScheme[\"HTTP\"] = \"http\";\n    EndpointURLScheme[\"HTTPS\"] = \"https\";\n})(exports.EndpointURLScheme || (exports.EndpointURLScheme = {}));\n\nexports.AlgorithmId = void 0;\n(function (AlgorithmId) {\n    AlgorithmId[\"MD5\"] = \"md5\";\n    AlgorithmId[\"CRC32\"] = \"crc32\";\n    AlgorithmId[\"CRC32C\"] = \"crc32c\";\n    AlgorithmId[\"SHA1\"] = \"sha1\";\n    AlgorithmId[\"SHA256\"] = \"sha256\";\n})(exports.AlgorithmId || (exports.AlgorithmId = {}));\nconst getChecksumConfiguration = (runtimeConfig) => {\n    const checksumAlgorithms = [];\n    if (runtimeConfig.sha256 !== undefined) {\n        checksumAlgorithms.push({\n            algorithmId: () => exports.AlgorithmId.SHA256,\n            checksumConstructor: () => runtimeConfig.sha256,\n        });\n    }\n    if (runtimeConfig.md5 != undefined) {\n        checksumAlgorithms.push({\n            algorithmId: () => exports.AlgorithmId.MD5,\n            checksumConstructor: () => runtimeConfig.md5,\n        });\n    }\n    return {\n        addChecksumAlgorithm(algo) {\n            checksumAlgorithms.push(algo);\n        },\n        checksumAlgorithms() {\n            return checksumAlgorithms;\n        },\n    };\n};\nconst resolveChecksumRuntimeConfig = (clientConfig) => {\n    const runtimeConfig = {};\n    clientConfig.checksumAlgorithms().forEach((checksumAlgorithm) => {\n        runtimeConfig[checksumAlgorithm.algorithmId()] = checksumAlgorithm.checksumConstructor();\n    });\n    return runtimeConfig;\n};\n\nconst getDefaultClientConfiguration = (runtimeConfig) => {\n    return getChecksumConfiguration(runtimeConfig);\n};\nconst resolveDefaultRuntimeConfig = (config) => {\n    return resolveChecksumRuntimeConfig(config);\n};\n\nexports.FieldPosition = void 0;\n(function (FieldPosition) {\n    FieldPosition[FieldPosition[\"HEADER\"] = 0] = \"HEADER\";\n    FieldPosition[FieldPosition[\"TRAILER\"] = 1] = \"TRAILER\";\n})(exports.FieldPosition || (exports.FieldPosition = {}));\n\nconst SMITHY_CONTEXT_KEY = \"__smithy_context\";\n\nexports.IniSectionType = void 0;\n(function (IniSectionType) {\n    IniSectionType[\"PROFILE\"] = \"profile\";\n    IniSectionType[\"SSO_SESSION\"] = \"sso-session\";\n    IniSectionType[\"SERVICES\"] = \"services\";\n})(exports.IniSectionType || (exports.IniSectionType = {}));\n\nexports.RequestHandlerProtocol = void 0;\n(function (RequestHandlerProtocol) {\n    RequestHandlerProtocol[\"HTTP_0_9\"] = \"http/0.9\";\n    RequestHandlerProtocol[\"HTTP_1_0\"] = \"http/1.0\";\n    RequestHandlerProtocol[\"TDS_8_0\"] = \"tds/8.0\";\n})(exports.RequestHandlerProtocol || (exports.RequestHandlerProtocol = {}));\n\nexports.SMITHY_CONTEXT_KEY = SMITHY_CONTEXT_KEY;\nexports.getDefaultClientConfiguration = getDefaultClientConfiguration;\nexports.resolveDefaultRuntimeConfig = resolveDefaultRuntimeConfig;\n"
   ],
   "mappings": ";uDAEQ,mBAAwB,QAC/B,QAAS,CAAC,EAAkB,CACzB,EAAiB,OAAY,SAC7B,EAAiB,MAAW,UACrB,qBAA6B,mBAAmB,CAAC,EAAE,EAEtD,yBAA8B,QACrC,QAAS,CAAC,EAAwB,CAC/B,EAAuB,OAAY,SACnC,EAAuB,MAAW,UAC3B,2BAAmC,yBAAyB,CAAC,EAAE,EAElE,oBAAyB,QAChC,QAAS,CAAC,EAAmB,CAC1B,EAAkB,KAAU,OAC5B,EAAkB,MAAW,UACtB,sBAA8B,oBAAoB,CAAC,EAAE,EAExD,cAAmB,QAC1B,QAAS,CAAC,EAAa,CACpB,EAAY,IAAS,MACrB,EAAY,MAAW,QACvB,EAAY,OAAY,SACxB,EAAY,KAAU,OACtB,EAAY,OAAY,WACjB,gBAAwB,cAAc,CAAC,EAAE,EACpD,IAAM,EAA2B,CAAC,IAAkB,CAChD,IAAM,EAAqB,CAAC,EAC5B,GAAI,EAAc,SAAW,OACzB,EAAmB,KAAK,CACpB,YAAa,IAAc,cAAY,OACvC,oBAAqB,IAAM,EAAc,MAC7C,CAAC,EAEL,GAAI,EAAc,KAAO,KACrB,EAAmB,KAAK,CACpB,YAAa,IAAc,cAAY,IACvC,oBAAqB,IAAM,EAAc,GAC7C,CAAC,EAEL,MAAO,CACH,oBAAoB,CAAC,EAAM,CACvB,EAAmB,KAAK,CAAI,GAEhC,kBAAkB,EAAG,CACjB,OAAO,EAEf,GAEE,EAA+B,CAAC,IAAiB,CACnD,IAAM,EAAgB,CAAC,EAIvB,OAHA,EAAa,mBAAmB,EAAE,QAAQ,CAAC,IAAsB,CAC7D,EAAc,EAAkB,YAAY,GAAK,EAAkB,oBAAoB,EAC1F,EACM,GAGL,EAAgC,CAAC,IAAkB,CACrD,OAAO,EAAyB,CAAa,GAE3C,EAA8B,CAAC,IAAW,CAC5C,OAAO,EAA6B,CAAM,GAGtC,gBAAqB,QAC5B,QAAS,CAAC,EAAe,CACtB,EAAc,EAAc,OAAY,GAAK,SAC7C,EAAc,EAAc,QAAa,GAAK,YACvC,kBAA0B,gBAAgB,CAAC,EAAE,EAExD,IAAM,EAAqB,mBAEnB,iBAAsB,QAC7B,QAAS,CAAC,EAAgB,CACvB,EAAe,QAAa,UAC5B,EAAe,YAAiB,cAChC,EAAe,SAAc,aACtB,mBAA2B,iBAAiB,CAAC,EAAE,EAElD,yBAA8B,QACrC,QAAS,CAAC,EAAwB,CAC/B,EAAuB,SAAc,WACrC,EAAuB,SAAc,WACrC,EAAuB,QAAa,YAC7B,2BAAmC,yBAAyB,CAAC,EAAE,EAElE,qBAAqB,EACrB,gCAAgC,EAChC,8BAA8B",
-  "debugId": "53D3583FFD74F57364756E2164756E21",
+  "debugId": "7CB840005276C5E164756E2164756E21",
   "names": []
 }

package/dist/{chunk-tfvdrvbn.js → chunk-1q0bqfas.js}

@@ -1,4 +1,4 @@
 // @bun
-import{S as A}from"./chunk-czw7kqtp.js";import"./chunk-bwh1n2cj.js";import{U as T}from"./chunk-6dtq4h9p.js";import{V as y}from"./chunk-kkymwxt2.js";import{Jl as r}from"./chunk-jmgjhfya.js";var u=r(A(),1);var i=r(y(),1),E=r(A(),1);import{exec as d}from"child_process";import{promisify as I}from"util";var x=r(T(),1),_=(c,n,e)=>{if(n.Version!==1)throw Error(`Profile ${c} credential_process did not return Version 1.`);if(n.AccessKeyId===void 0||n.SecretAccessKey===void 0)throw Error(`Profile ${c} credential_process returned invalid credentials.`);if(n.Expiration){let w=new Date;if(new Date(n.Expiration)<w)throw Error(`Profile ${c} credential_process returned expired credentials.`)}let s=n.AccountId;if(!s&&e?.[c]?.aws_account_id)s=e[c].aws_account_id;let t={accessKeyId:n.AccessKeyId,secretAccessKey:n.SecretAccessKey,...n.SessionToken&&{sessionToken:n.SessionToken},...n.Expiration&&{expiration:new Date(n.Expiration)},...n.CredentialScope&&{credentialScope:n.CredentialScope},...s&&{accountId:s}};return x.setCredentialFeature(t,"CREDENTIALS_PROCESS","w"),t};var K=async(c,n,e)=>{let s=n[c];if(n[c]){let t=s.credential_process;if(t!==void 0){let w=I(E.externalDataInterceptor?.getTokenRecord?.().exec??d);try{let{stdout:o}=await w(t),S;try{S=JSON.parse(o.trim())}catch{throw Error(`Profile ${c} credential_process returned invalid JSON.`)}return _(c,S,n)}catch(o){throw new i.CredentialsProviderError(o.message,{logger:e})}}else throw new i.CredentialsProviderError(`Profile ${c} did not contain credential_process.`,{logger:e})}else throw new i.CredentialsProviderError(`Profile ${c} could not be found in shared credentials file.`,{logger:e})};var R=(c={})=>async({callerClientConfig:n}={})=>{c.logger?.debug("@aws-sdk/credential-provider-process - fromProcess");let e=await u.parseKnownFiles(c);return K(u.getProfileName({profile:c.profile??n?.profile}),e,c.logger)};export{R as fromProcess};
+import{S as A}from"./chunk-a1fb8zz6.js";import"./chunk-1f9143dv.js";import{U as T}from"./chunk-45fbwj3s.js";import{V as y}from"./chunk-x7yrxhk9.js";import{Kl as r}from"./chunk-7wkwm0tn.js";var u=r(A(),1);var i=r(y(),1),E=r(A(),1);import{exec as d}from"child_process";import{promisify as I}from"util";var x=r(T(),1),_=(c,n,e)=>{if(n.Version!==1)throw Error(`Profile ${c} credential_process did not return Version 1.`);if(n.AccessKeyId===void 0||n.SecretAccessKey===void 0)throw Error(`Profile ${c} credential_process returned invalid credentials.`);if(n.Expiration){let w=new Date;if(new Date(n.Expiration)<w)throw Error(`Profile ${c} credential_process returned expired credentials.`)}let s=n.AccountId;if(!s&&e?.[c]?.aws_account_id)s=e[c].aws_account_id;let t={accessKeyId:n.AccessKeyId,secretAccessKey:n.SecretAccessKey,...n.SessionToken&&{sessionToken:n.SessionToken},...n.Expiration&&{expiration:new Date(n.Expiration)},...n.CredentialScope&&{credentialScope:n.CredentialScope},...s&&{accountId:s}};return x.setCredentialFeature(t,"CREDENTIALS_PROCESS","w"),t};var K=async(c,n,e)=>{let s=n[c];if(n[c]){let t=s.credential_process;if(t!==void 0){let w=I(E.externalDataInterceptor?.getTokenRecord?.().exec??d);try{let{stdout:o}=await w(t),S;try{S=JSON.parse(o.trim())}catch{throw Error(`Profile ${c} credential_process returned invalid JSON.`)}return _(c,S,n)}catch(o){throw new i.CredentialsProviderError(o.message,{logger:e})}}else throw new i.CredentialsProviderError(`Profile ${c} did not contain credential_process.`,{logger:e})}else throw new i.CredentialsProviderError(`Profile ${c} could not be found in shared credentials file.`,{logger:e})};var R=(c={})=>async({callerClientConfig:n}={})=>{c.logger?.debug("@aws-sdk/credential-provider-process - fromProcess");let e=await u.parseKnownFiles(c);return K(u.getProfileName({profile:c.profile??n?.profile}),e,c.logger)};export{R as fromProcess};
 
-//# debugId=2296DA6421CF2FAA64756E2164756E21
+//# debugId=D79E49AF40A8CE6264756E2164756E21

package/dist/{chunk-tfvdrvbn.js.map → chunk-1q0bqfas.js.map}

@@ -7,6 +7,6 @@
     "import { setCredentialFeature } from \"@aws-sdk/core/client\";\nexport const getValidatedProcessCredentials = (profileName, data, profiles) => {\n    if (data.Version !== 1) {\n        throw Error(`Profile ${profileName} credential_process did not return Version 1.`);\n    }\n    if (data.AccessKeyId === undefined || data.SecretAccessKey === undefined) {\n        throw Error(`Profile ${profileName} credential_process returned invalid credentials.`);\n    }\n    if (data.Expiration) {\n        const currentTime = new Date();\n        const expireTime = new Date(data.Expiration);\n        if (expireTime < currentTime) {\n            throw Error(`Profile ${profileName} credential_process returned expired credentials.`);\n        }\n    }\n    let accountId = data.AccountId;\n    if (!accountId && profiles?.[profileName]?.aws_account_id) {\n        accountId = profiles[profileName].aws_account_id;\n    }\n    const credentials = {\n        accessKeyId: data.AccessKeyId,\n        secretAccessKey: data.SecretAccessKey,\n        ...(data.SessionToken && { sessionToken: data.SessionToken }),\n        ...(data.Expiration && { expiration: new Date(data.Expiration) }),\n        ...(data.CredentialScope && { credentialScope: data.CredentialScope }),\n        ...(accountId && { accountId }),\n    };\n    setCredentialFeature(credentials, \"CREDENTIALS_PROCESS\", \"w\");\n    return credentials;\n};\n"
   ],
   "mappings": ";qNAAA,SCAA,SACA,KACA,SAAS,sBACT,oBAAS,aCHT,eACa,EAAiC,CAAC,EAAa,EAAM,IAAa,CAC3E,GAAI,EAAK,UAAY,EACjB,MAAM,MAAM,WAAW,gDAA0D,EAErF,GAAI,EAAK,cAAgB,QAAa,EAAK,kBAAoB,OAC3D,MAAM,MAAM,WAAW,oDAA8D,EAEzF,GAAI,EAAK,WAAY,CACjB,IAAM,EAAc,IAAI,KAExB,GADmB,IAAI,KAAK,EAAK,UAAU,EAC1B,EACb,MAAM,MAAM,WAAW,oDAA8D,EAG7F,IAAI,EAAY,EAAK,UACrB,GAAI,CAAC,GAAa,IAAW,IAAc,eACvC,EAAY,EAAS,GAAa,eAEtC,IAAM,EAAc,CAChB,YAAa,EAAK,YAClB,gBAAiB,EAAK,mBAClB,EAAK,cAAgB,CAAE,aAAc,EAAK,YAAa,KACvD,EAAK,YAAc,CAAE,WAAY,IAAI,KAAK,EAAK,UAAU,CAAE,KAC3D,EAAK,iBAAmB,CAAE,gBAAiB,EAAK,eAAgB,KAChE,GAAa,CAAE,WAAU,CACjC,EAEA,OADA,uBAAqB,EAAa,sBAAuB,GAAG,EACrD,GDvBJ,IAAM,EAA4B,MAAO,EAAa,EAAU,IAAW,CAC9E,IAAM,EAAU,EAAS,GACzB,GAAI,EAAS,GAAc,CACvB,IAAM,EAAoB,EAAQ,mBAClC,GAAI,IAAsB,OAAW,CACjC,IAAM,EAAc,EAAU,2BAAyB,iBAAiB,EAAE,MAAQ,CAAI,EACtF,GAAI,CACA,IAAQ,UAAW,MAAM,EAAY,CAAiB,EAClD,EACJ,GAAI,CACA,EAAO,KAAK,MAAM,EAAO,KAAK,CAAC,EAEnC,KAAM,CACF,MAAM,MAAM,WAAW,6CAAuD,EAElF,OAAO,EAA+B,EAAa,EAAM,CAAQ,EAErE,MAAO,EAAO,CACV,MAAM,IAAI,2BAAyB,EAAM,QAAS,CAAE,QAAO,CAAC,GAIhE,WAAM,IAAI,2BAAyB,WAAW,wCAAmD,CAAE,QAAO,CAAC,EAI/G,WAAM,IAAI,2BAAyB,WAAW,mDAA8D,CACxG,QACJ,CAAC,GD/BF,IAAM,EAAc,CAAC,EAAO,CAAC,IAAM,OAAS,sBAAuB,CAAC,IAAM,CAC7E,EAAK,QAAQ,MAAM,oDAAoD,EACvE,IAAM,EAAW,MAAM,kBAAgB,CAAI,EAC3C,OAAO,EAA0B,iBAAe,CAC5C,QAAS,EAAK,SAAW,GAAoB,OACjD,CAAC,EAAG,EAAU,EAAK,MAAM",
-  "debugId": "2296DA6421CF2FAA64756E2164756E21",
+  "debugId": "D79E49AF40A8CE6264756E2164756E21",
   "names": []
 }

package/dist/{chunk-q9b0ndf0.js → chunk-1tryvab1.js}

@@ -1,5 +1,5 @@
 // @bun
-import{zj as O}from"./chunk-80cwastb.js";import{hk as S}from"./chunk-ktgmrjj3.js";import{Ok as E}from"./chunk-kzny5cj2.js";import{ml as U}from"./chunk-edj701p0.js";class F{rows=new Map;async find(j,G){for(let Q of this.rows.values())if(Q.userId===j&&Q.provider===G)return{...Q};return null}async list(j){return[...this.rows.values()].filter((G)=>G.userId===j).map((G)=>({...G}))}async save(j,G,Q){let V=await this.find(j,G),W=new Date,Y={id:V?.id??Bun.randomUUIDv7(),userId:j,provider:G,...P(Q),needsReconnect:!1,revision:(V?.revision??0)+1,createdAt:V?.createdAt??W,updatedAt:W};return this.rows.set(Y.id,Y),{...Y}}async updateTokens(j,G,Q){let V=this.rows.get(j);if(!V||V.revision!==G)return null;let W=P(Q);W.providerAccountId??=V.providerAccountId;let Y={...V,...W,needsReconnect:!1,revision:G+1,updatedAt:new Date};return this.rows.set(j,Y),{...Y}}async markNeedsReconnect(j){let G=this.rows.get(j);if(G)this.rows.set(j,{...G,needsReconnect:!0,updatedAt:new Date})}async delete(j){this.rows.delete(j)}}class L{encrypter;table;sql;dialect;constructor(j,G,Q={}){this.encrypter=G;let V=Q.table??"gemi_oauth_connections";if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(V))throw Error(`The connections table name "${V}" is not a plain identifier.`);this.table=V,this.sql=j.sql,this.dialect=j.dialect}async createTable(){for(let j of q(this.dialect,this.table))await this.sql.unsafe(j)}async find(j,G){let Q=this.sql,V=await Q`
+import{Aj as O}from"./chunk-j5txga06.js";import{ik as S}from"./chunk-h16bfh2v.js";import{Pk as E}from"./chunk-9fpecjxg.js";import{nl as U}from"./chunk-fr6e5g2z.js";class F{rows=new Map;async find(j,G){for(let Q of this.rows.values())if(Q.userId===j&&Q.provider===G)return{...Q};return null}async list(j){return[...this.rows.values()].filter((G)=>G.userId===j).map((G)=>({...G}))}async save(j,G,Q){let V=await this.find(j,G),W=new Date,Y={id:V?.id??Bun.randomUUIDv7(),userId:j,provider:G,...P(Q),needsReconnect:!1,revision:(V?.revision??0)+1,createdAt:V?.createdAt??W,updatedAt:W};return this.rows.set(Y.id,Y),{...Y}}async updateTokens(j,G,Q){let V=this.rows.get(j);if(!V||V.revision!==G)return null;let W=P(Q);W.providerAccountId??=V.providerAccountId;let Y={...V,...W,needsReconnect:!1,revision:G+1,updatedAt:new Date};return this.rows.set(j,Y),{...Y}}async markNeedsReconnect(j){let G=this.rows.get(j);if(G)this.rows.set(j,{...G,needsReconnect:!0,updatedAt:new Date})}async delete(j){this.rows.delete(j)}}class L{encrypter;table;sql;dialect;constructor(j,G,Q={}){this.encrypter=G;let V=Q.table??"gemi_oauth_connections";if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(V))throw Error(`The connections table name "${V}" is not a plain identifier.`);this.table=V,this.sql=j.sql,this.dialect=j.dialect}async createTable(){for(let j of q(this.dialect,this.table))await this.sql.unsafe(j)}async find(j,G){let Q=this.sql,V=await Q`
       SELECT * FROM ${this.name(Q)} WHERE user_id = ${j} AND provider = ${G}
     `;return V[0]?this.decode(V[0]):null}async list(j){let G=this.sql;return(await G`
       SELECT * FROM ${this.name(G)} WHERE user_id = ${j} ORDER BY provider
@@ -66,6 +66,6 @@ import{zj as O}from"./chunk-80cwastb.js";import{hk as S}from"./chunk-ktgmrjj3.js
     "created_at" BIGINT NOT NULL,
     "updated_at" BIGINT NOT NULL${V}
 )`,`CREATE UNIQUE INDEX IF NOT EXISTS "${G}_user_id_provider_key" ON "${G}"("user_id", "provider")`]}class X extends Error{code;status;providerError;constructor(j,G,Q={}){super(G,Q.cause!==void 0?{cause:Q.cause}:void 0);this.code=j;this.name="OAuthConnectionError",this.status=Q.status,this.providerError=Q.providerError}}class K extends X{provider;constructor(j,G={}){super("reconnect_required",`The ${j} connection needs to be reconnected: its tokens were refused and could not be refreshed.`,G);this.provider=j;this.name="OAuthReconnectRequiredError"}}class C{config;constructor(j){for(let G of["authorizeUrl","tokenUrl"])_(G,j[G]);for(let G of["refreshUrl","revokeUrl"])if(j[G]!==void 0)_(G,j[G]);if(j.apiBaseUrl===void 0||j.apiBaseUrl===null||j.apiBaseUrl==="")throw Error(`OAuthConnectionProvider: apiBaseUrl is required. Set it to the provider's API origin (e.g. apiBaseUrl: "https://api.figma.com"); connection.fetch only sends the token there.`);_("apiBaseUrl",j.apiBaseUrl),this.config={scopeSeparator:" ",clientAuth:"body",pkce:!0,authorizationParams:{},refreshLeewaySeconds:60,multiple:!1,tokenPlacement:"header",...j,refreshGrantType:j.refreshGrantType??"refresh_token"}}async isTokenRejected(j){let G=this.config.isTokenRejected;if(!G)return j.status===401;return await G(j)}authorizationUrl(j){let G=new URL(this.config.authorizeUrl),Q={...this.config.authorizationParams,response_type:"code",client_id:this.config.clientId,redirect_uri:j.redirectUri,scope:this.config.scopes.join(this.config.scopeSeparator),state:j.state};if(this.config.pkce)Q.code_challenge=j.codeChallenge,Q.code_challenge_method="S256";for(let[V,W]of Object.entries(Q))G.searchParams.set(V,W);return G.toString()}exchangeCode(j){let G=new URLSearchParams({grant_type:"authorization_code",code:j.code,redirect_uri:j.redirectUri});if(this.config.pkce)G.set("code_verifier",j.codeVerifier);return this.tokenRequest(this.config.tokenUrl,G,{scopes:this.config.scopes,refreshToken:null,phase:"exchange"})}refresh(j,G){let Q=new URLSearchParams,V=this.config.refreshGrantType;if(V!==!1&&V!=="")Q.set("grant_type",V);return Q.set("refresh_token",j),this.tokenRequest(this.config.refreshUrl??this.config.tokenUrl,Q,{scopes:G,refreshToken:j,phase:"refresh"})}async revoke(j,G){if(!this.config.revokeUrl)throw new X("revoke_unsupported","This provider has no revokeUrl configured. Use disconnect() to forget the tokens locally.");let Q=new URLSearchParams({token:j,token_type_hint:G}),V;try{V=await fetch(this.config.revokeUrl,this.post(Q))}catch(W){throw new X("revoke_failed","The revocation request failed.",{cause:W})}if(!V.ok)throw new X("revoke_failed",`The provider refused the revocation (HTTP ${V.status}).`,{status:V.status})}post(j){let G={"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"};if(this.config.clientAuth==="basic"){let Q=`${encodeURIComponent(this.config.clientId)}:${encodeURIComponent(this.config.clientSecret)}`;G.Authorization=`Basic ${Buffer.from(Q).toString("base64")}`}else j.set("client_id",this.config.clientId),j.set("client_secret",this.config.clientSecret);return{method:"POST",headers:G,body:j.toString(),redirect:"error"}}async tokenRequest(j,G,Q){let V=Q.phase==="exchange"?"exchange_failed":"refresh_failed",W;try{W=await fetch(j,this.post(G))}catch($){throw new X(V,"The token request failed.",{cause:$})}let Y=await W.json().catch(()=>({}));if(!W.ok||typeof Y.access_token!=="string"||Y.access_token===""){let $=typeof Y.error==="string"&&/^[a-z0-9_]{1,64}$/.test(Y.error)?Y.error:void 0;throw new X(V,`The token endpoint refused the ${Q.phase==="exchange"?"code":"refresh token"} (HTTP ${W.status}${$?`, ${$}`:""}).`,{status:W.status,providerError:$})}let Z=Number(Y.expires_in),B=typeof Y.scope==="string"?Y.scope:void 0,J=Y.user_id_string??Y.user_id??Y.account_id;return{accessToken:Y.access_token,refreshToken:typeof Y.refresh_token==="string"&&Y.refresh_token!==""?Y.refresh_token:Q.refreshToken,tokenType:typeof Y.token_type==="string"?Y.token_type:null,expiresAt:Number.isFinite(Z)&&Z>0?new Date(Date.now()+Z*1000):null,scopes:B!==void 0?B.split(/[\s,]+/).filter(Boolean):Q.scopes,providerAccountId:typeof J==="string"||typeof J==="number"?String(J):null}}}function _(j,G){let Q;try{Q=new URL(String(G))}catch{Q=void 0}if(!Q||Q.protocol!=="https:"&&!(Q.protocol==="http:"&&M(Q.hostname)))throw Error(`OAuthConnectionProvider: ${j} must be an https URL (http only for localhost), got ${JSON.stringify(G)}.`)}function M(j){return j==="localhost"||j==="127.0.0.1"||j==="[::1]"||j==="::1"}class A{options;static token="auth.connections";resolvedStore;refreshing=new Map;fakes;fakeStore;fakeRequests=[];constructor(j){this.options=j;for(let[G,Q]of Object.entries(j.providers)){if(!Q.config.multiple)continue;let V=Object.keys(j.providers).find((W)=>W.startsWith(`${G}${D}`));if(G.includes(D)||V)throw Error(`auth.connections: "${V??G}" cannot be used alongside the multiple-account provider "${G}" ("${D}" separates a provider from an account id in the store).`)}}get providers(){return this.options.providers}get store(){if(this.fakeStore)return this.fakeStore;if(!this.resolvedStore){let j=this.options.store;this.resolvedStore=typeof j==="function"?j():j??new L(U(E).connection(),()=>O())}return this.resolvedStore}provider(j){let G=this.options.providers[j];if(!G){let Q=Object.keys(this.options.providers);throw new X("unknown_provider",`No OAuth connection provider "${j}" in auth.connections`+(Q.length>0?` (configured: ${Q.join(", ")}).`:" (none are configured)."))}return G}async for(j,G,Q){let V=this.provider(G),W=N(j);if(!V.config.multiple){let Z=await this.store.find(W,G);if(!Z||Q!==void 0&&Z.providerAccountId!==Q)return null;return new z(this,Z)}if(Q!==void 0){let Z=await this.store.find(W,T(G,Q))??await this.store.find(W,G);return Z&&Z.providerAccountId===Q?new z(this,Z):null}let[Y]=(await this.list(j,G)).sort((Z,B)=>B.connectedAt.getTime()-Z.connectedAt.getTime());return Y??null}async list(j,G){if(G!==void 0)this.provider(G);return(await this.store.list(N(j))).filter((V)=>{let W=this.providerName(V.provider);return W!==null&&(G===void 0||W===G)}).map((V)=>new z(this,V))}async save(j,G,Q){let V=this.provider(G),W=N(j),{profile:Y,...Z}=Q,B={refreshToken:null,tokenType:null,expiresAt:null,providerAccountId:null,scopes:V.config.scopes,...Z};if(!V.config.multiple)return new z(this,await this.store.save(W,G,B));let J=B.providerAccountId;if(typeof J!=="string"||J==="")throw new X("missing_account_id",`"${G}" allows several accounts per user, so a connection needs the provider's account id (providerAccountId), and the token exchange did not supply one.`);let $=await this.store.save(W,T(G,J),B),H=await this.store.find(W,G);if(H&&H.providerAccountId===J)await this.store.delete(H.id);return new z(this,$)}providerName(j){let G=this.options.providers;if(Object.hasOwn(G,j))return j;let Q=j.indexOf(D);if(Q<=0)return null;let V=j.slice(0,Q);return Object.hasOwn(G,V)&&G[V].config.multiple?V:null}fake(j={}){return this.fakes=new Map(Object.entries(j)),this.fakeStore=new F,this.fakeRequests.length=0,this}restore(){this.fakes=void 0,this.fakeStore=void 0,this.fakeRequests.length=0}get faked(){return this.fakes!==void 0}async send(j,G){if(!this.fakes)return fetch(G);this.fakeRequests.push(G.clone());let Q=this.fakes.get(j);if(!Q)throw Error(`Connections.fake() has no handler for "${j}". Pass one: Connections.fake({ ${j}: (req) => ... }).`);return Q(G)}refresh(j,G="requested"){let Q=this.refreshing.get(j.id);if(Q)return Q;let V=this.withLock(j.id,()=>this.refreshOnce(j,G)).finally(()=>this.refreshing.delete(j.id));return this.refreshing.set(j.id,V),V}async refreshOnce(j,G){let Q=this.providerName(j.provider)??j.provider,V=await this.store.find(j.userId,j.provider);if(!V||V.id!==j.id)throw new K(Q);if(V.revision!==j.revision&&!V.needsReconnect)return V;if(V.needsReconnect)throw new K(Q);let W=this.provider(Q);if(this.faked)return V;let Y=W.config.refreshStrategy;if(!Y&&V.refreshToken===null)throw await this.store.markNeedsReconnect(V.id),new K(Q);let Z;try{Z=Y?await Y({accessToken:V.accessToken,refreshToken:V.refreshToken,scopes:[...V.scopes],expiresAt:V.expiresAt,issuedAt:V.updatedAt,reason:G,providerAccountId:V.providerAccountId}):await W.refresh(V.refreshToken,V.scopes)}catch($){if($ instanceof X&&$.status!==void 0&&$.status>=400&&$.status<500&&$.providerError!=="invalid_client")throw await this.store.markNeedsReconnect(V.id),new K(Q,{cause:$,status:$.status,providerError:$.providerError});throw $}if(Z===null)return V;let B=await this.store.updateTokens(V.id,V.revision,Z);if(B)return B;let J=await this.store.find(V.userId,V.provider);if(!J)throw new K(Q);return J}async withLock(j,G){let Q=U();if(this.faked||!Q.bound(S))return G();let V=await Q.make(S).run(`gemi:oauth-connection:${j}`,{ttl:30000,wait:20000},()=>G());if(!V.acquired)throw new X("refresh_failed","Timed out waiting for another refresh of this connection to finish.");return V.value}}class z{manager;record;constructor(j,G){this.manager=j;this.record=G}get provider(){return this.manager.providerName(this.record.provider)??this.record.provider}get userId(){return this.record.userId}get providerAccountId(){return this.record.providerAccountId}get scopes(){return this.record.scopes}get expiresAt(){return this.record.expiresAt}get needsReconnect(){return this.record.needsReconnect}get connectedAt(){return this.record.createdAt}get status(){if(this.record.needsReconnect)return"needs_reconnect";let j=this.record.expiresAt?.getTime();if(this.record.refreshToken===null&&j!==void 0&&j<=Date.now())return"needs_reconnect";return"connected"}connectionProvider(){return this.manager.provider(this.provider)}hasScopes(...j){return j.every((G)=>this.record.scopes.includes(G))}async fetch(j,G={}){let Q=this.resolveUrl(j),V=await this.current(),W=await this.send(Q,G,V.accessToken);if(!W.authorized||G.body instanceof ReadableStream)return W.response;if(!await this.manager.provider(this.provider).isTokenRejected(W.response))return W.response;await W.response.body?.cancel().catch(()=>{});let Z=await this.refreshFrom(V,"rejected");return(await this.send(Q,G,Z.accessToken)).response}async accessToken(){return(await this.current()).accessToken}async refresh(){await this.refreshFrom(this.record)}async revoke(){if(!this.manager.faked){let j=this.manager.provider(this.provider);if(this.record.refreshToken!==null)await j.revoke(this.record.refreshToken,"refresh_token");else await j.revoke(this.record.accessToken,"access_token")}await this.manager.store.delete(this.record.id)}async disconnect(){await this.manager.store.delete(this.record.id)}toJSON(){return{provider:this.provider,providerAccountId:this.providerAccountId,scopes:[...this.scopes],expiresAt:this.expiresAt,needsReconnect:this.needsReconnect,status:this.status,connectedAt:this.connectedAt}}[Symbol.for("nodejs.util.inspect.custom")](){return{ProviderConnection:this.toJSON()}}async current(){if(this.record.needsReconnect)throw new K(this.provider);let j=this.manager.provider(this.provider).config.refreshLeewaySeconds*1000,G=this.record.expiresAt?.getTime();if(G!==void 0&&G-Date.now()<=j)return this.refreshFrom(this.record,"expiring");return this.record}async refreshFrom(j,G="requested"){try{this.record=await this.manager.refresh(j,G)}catch(Q){if(Q instanceof K)this.record={...this.record,needsReconnect:!0};throw Q}return this.record}resolveUrl(j){let G=this.manager.provider(this.provider).config.apiBaseUrl,Q;try{Q=new URL(String(j),G)}catch{throw new X("forbidden_url",`connection.fetch was given ${JSON.stringify(String(j))}, which is not a URL.`)}if(Q.origin!==new URL(G).origin)throw new X("forbidden_url",`connection.fetch only sends the ${this.provider} token to ${new URL(G).origin} (apiBaseUrl), not to ${Q.origin}.`);if(Q.protocol!=="https:"&&!(Q.protocol==="http:"&&M(Q.hostname)))throw new X("forbidden_url",`connection.fetch only sends a token over https, not to ${Q.origin}.`);return Q}async send(j,G,Q){let V=j,W=(G.method??"GET").toUpperCase(),Y=G.body,Z=!0;if(G.redirect==="manual"||G.redirect==="error")return{response:await this.manager.send(this.provider,this.request(V,G,W,Y,Q)),authorized:Z};for(let B=0;;B++){let J=this.request(V,{...G,redirect:"manual"},W,Y,Z?Q:null),$=await this.manager.send(this.provider,J),H=$.headers.get("location");if(!b.has($.status)||H===null||B>=5)return{response:$,authorized:Z};await $.body?.cancel().catch(()=>{});let x=new URL(H,V);if(x.origin!==V.origin)Z=!1;if($.status===303||($.status===301||$.status===302)&&W==="POST")W="GET",Y=void 0;V=x}}request(j,G,Q,V,W){let Y=new Headers(G.headers),Z=new URL(j),B=this.manager.provider(this.provider).config.tokenPlacement;if(W===null)Y.delete("authorization");else if(B==="query")Z.searchParams.set("access_token",W);else Y.set("Authorization",`Bearer ${W}`);return new Request(Z,{...G,method:Q,body:V,headers:Y})}}var b=new Set([301,302,303,307,308]),D=":";function T(j,G){return`${j}${D}${G}`}function N(j){let G=typeof j==="object"&&j!==null?j.id:j;if(G===void 0||G===null||G==="")throw TypeError("An OAuth connection belongs to a user: pass the user (or its id).");return String(G)}
-export{F as ij,L as jj,X as kj,K as lj,C as mj,A as nj,z as oj};
+export{F as jj,L as kj,X as lj,K as mj,C as nj,A as oj,z as pj};
 
-//# debugId=8446AA4F9D5266BC64756E2164756E21
+//# debugId=569AA5FFD1D163D264756E2164756E21

package/dist/{chunk-q9b0ndf0.js.map → chunk-1tryvab1.js.map}

@@ -8,6 +8,6 @@
     "import { DatabaseManager } from \"../../database/DatabaseManager\";\nimport { app } from \"../../foundation/app\";\nimport { currentEncrypter } from \"../../orm/encryption\";\nimport { LockManager } from \"../../services/lock/LockManager\";\nimport {\n  type ConnectionRecord,\n  type ConnectionStore,\n  DatabaseConnectionStore,\n  MemoryConnectionStore,\n} from \"./ConnectionStore\";\nimport { OAuthConnectionError, OAuthReconnectRequiredError } from \"./errors\";\nimport {\n  type ConnectionRefreshReason,\n  type OAuthConnectionProvider,\n  type OAuthTokenSet,\n  isLoopback,\n} from \"./OAuthConnectionProvider\";\n\n/** A user, as far as a connection is concerned: anything with an `id`. */\nexport type ConnectionOwner = { id: string | number } | string | number;\n\n/** See `ProviderConnection.status`. */\nexport type ConnectionStatus = \"connected\" | \"needs_reconnect\";\n\n/** What `Connections.fake` answers an API request with. */\nexport type FakeConnectionHandler = (request: Request) => Response | Promise<Response>;\n\nexport interface ConnectionManagerOptions {\n  providers: Record<string, OAuthConnectionProvider>;\n  /** Default: a `DatabaseConnectionStore` on the default database connection. */\n  store?: ConnectionStore | (() => ConnectionStore);\n}\n\n/**\n * The OAuth connections a user has made, and the one place their tokens are\n * read, refreshed and spent. Reached through the `Connections` facade.\n */\nexport class ConnectionManager {\n  static token = \"auth.connections\";\n\n  private resolvedStore: ConnectionStore | undefined;\n  private readonly refreshing = new Map<string, Promise<ConnectionRecord>>();\n  private fakes: Map<string, FakeConnectionHandler> | undefined;\n  private fakeStore: MemoryConnectionStore | undefined;\n  readonly fakeRequests: Request[] = [];\n\n  constructor(private readonly options: ConnectionManagerOptions) {\n    for (const [name, provider] of Object.entries(options.providers)) {\n      if (!provider.config.multiple) continue;\n      // A multiple-account provider's connections are stored under\n      // `<name>:<account id>`, which must not be read as another provider's.\n      const clash = Object.keys(options.providers).find((other) => other.startsWith(`${name}${ACCOUNT_SEPARATOR}`));\n      if (name.includes(ACCOUNT_SEPARATOR) || clash) {\n        throw new Error(\n          `auth.connections: \"${clash ?? name}\" cannot be used alongside the multiple-account provider \"${name}\" ` +\n            `(\"${ACCOUNT_SEPARATOR}\" separates a provider from an account id in the store).`,\n        );\n      }\n    }\n  }\n\n  get providers(): Record<string, OAuthConnectionProvider> {\n    return this.options.providers;\n  }\n\n  /** The store connections are kept in. */\n  get store(): ConnectionStore {\n    if (this.fakeStore) return this.fakeStore;\n    if (!this.resolvedStore) {\n      const configured = this.options.store;\n      this.resolvedStore =\n        typeof configured === \"function\"\n          ? configured()\n          : (configured ??\n            new DatabaseConnectionStore(app(DatabaseManager).connection(), () => currentEncrypter()));\n    }\n    return this.resolvedStore;\n  }\n\n  provider(name: string): OAuthConnectionProvider {\n    const provider = this.options.providers[name];\n    if (!provider) {\n      const known = Object.keys(this.options.providers);\n      throw new OAuthConnectionError(\n        \"unknown_provider\",\n        `No OAuth connection provider \"${name}\" in auth.connections` +\n          (known.length > 0 ? ` (configured: ${known.join(\", \")}).` : \" (none are configured).\"),\n      );\n    }\n    return provider;\n  }\n\n  /**\n   * The user's connection to `provider`, or `null` when they have not\n   * connected it. With `accountId`, only the connection to that account\n   * (`providerAccountId`). For a provider with `multiple: true` and no\n   * `accountId`, the account added most recently; use `list(user,\n   * provider)` for all of them.\n   */\n  async for(user: ConnectionOwner, provider: string, accountId?: string): Promise<ProviderConnection | null> {\n    const config = this.provider(provider);\n    const userId = ownerId(user);\n    if (!config.config.multiple) {\n      const record = await this.store.find(userId, provider);\n      if (!record || (accountId !== undefined && record.providerAccountId !== accountId)) return null;\n      return new ProviderConnection(this, record);\n    }\n    if (accountId !== undefined) {\n      const record =\n        (await this.store.find(userId, storeKey(provider, accountId))) ??\n        // Stored before the provider was switched to `multiple`.\n        (await this.store.find(userId, provider));\n      return record && record.providerAccountId === accountId ? new ProviderConnection(this, record) : null;\n    }\n    const [latest] = (await this.list(user, provider)).sort(\n      (a, b) => b.connectedAt.getTime() - a.connectedAt.getTime(),\n    );\n    return latest ?? null;\n  }\n\n  /** Every connection the user has, or only those to `provider`. */\n  async list(user: ConnectionOwner, provider?: string): Promise<ProviderConnection[]> {\n    if (provider !== undefined) this.provider(provider);\n    const records = await this.store.list(ownerId(user));\n    return records\n      .filter((record) => {\n        const name = this.providerName(record.provider);\n        return name !== null && (provider === undefined || name === provider);\n      })\n      .map((record) => new ProviderConnection(this, record));\n  }\n\n  /**\n   * Stores tokens for the user, replacing any earlier connection to the same\n   * provider — or, for a provider with `multiple: true`, to the same account\n   * (`providerAccountId`, required there). The connect callback calls this;\n   * call it yourself for tokens obtained some other way.\n   */\n  async save(\n    user: ConnectionOwner,\n    provider: string,\n    tokens: Partial<OAuthTokenSet> & { accessToken: string },\n  ): Promise<ProviderConnection> {\n    const config = this.provider(provider);\n    const userId = ownerId(user);\n    const { profile: _profile, ...grant } = tokens;\n    const set: OAuthTokenSet = {\n      refreshToken: null,\n      tokenType: null,\n      expiresAt: null,\n      providerAccountId: null,\n      scopes: config.config.scopes,\n      ...grant,\n    };\n    if (!config.config.multiple) {\n      return new ProviderConnection(this, await this.store.save(userId, provider, set));\n    }\n\n    const accountId = set.providerAccountId;\n    if (typeof accountId !== \"string\" || accountId === \"\") {\n      throw new OAuthConnectionError(\n        \"missing_account_id\",\n        `\"${provider}\" allows several accounts per user, so a connection needs the provider's account id ` +\n          \"(providerAccountId), and the token exchange did not supply one.\",\n      );\n    }\n    const record = await this.store.save(userId, storeKey(provider, accountId), set);\n    // The same account, stored before the provider was switched to `multiple`.\n    const legacy = await this.store.find(userId, provider);\n    if (legacy && legacy.providerAccountId === accountId) await this.store.delete(legacy.id);\n    return new ProviderConnection(this, record);\n  }\n\n  /**\n   * The configured provider a stored connection belongs to: the store key\n   * itself, or `<name>` of a multiple-account provider's `<name>:<account id>`.\n   * `null` for a provider no longer configured.\n   *\n   * @internal\n   */\n  providerName(key: string): string | null {\n    const providers = this.options.providers;\n    if (Object.hasOwn(providers, key)) return key;\n    const at = key.indexOf(ACCOUNT_SEPARATOR);\n    if (at <= 0) return null;\n    const name = key.slice(0, at);\n    return Object.hasOwn(providers, name) && providers[name].config.multiple ? name : null;\n  }\n\n  // --- testing ---------------------------------------------------------------\n\n  /**\n   * Fakes every provider's API: connections live in memory, `fetch` answers\n   * through `handlers[provider]` (recorded in `fakeRequests`), and nothing\n   * reaches a token or revocation endpoint. Returns `this` so a test can\n   * `save` a connection to start from.\n   */\n  fake(handlers: Record<string, FakeConnectionHandler> = {}): this {\n    this.fakes = new Map(Object.entries(handlers));\n    this.fakeStore = new MemoryConnectionStore();\n    this.fakeRequests.length = 0;\n    return this;\n  }\n\n  /** Undoes `fake`. */\n  restore(): void {\n    this.fakes = undefined;\n    this.fakeStore = undefined;\n    this.fakeRequests.length = 0;\n  }\n\n  get faked(): boolean {\n    return this.fakes !== undefined;\n  }\n\n  // --- internals, for ProviderConnection ---------------------------------------\n\n  /** @internal */\n  async send(provider: string, request: Request): Promise<Response> {\n    if (!this.fakes) return fetch(request);\n    this.fakeRequests.push(request.clone());\n    const handler = this.fakes.get(provider);\n    if (!handler) {\n      throw new Error(`Connections.fake() has no handler for \"${provider}\". Pass one: Connections.fake({ ${provider}: (req) => ... }).`);\n    }\n    return handler(request);\n  }\n\n  /**\n   * A record whose access token is not the one at `staleRevision`: refreshed\n   * by this call, or by whoever refreshed it first. Serialised per connection\n   * in this process (concurrent callers share one refresh) and, through the\n   * app's lock store, across processes — a rotating refresh token must be\n   * spent exactly once.\n   *\n   * @internal\n   */\n  refresh(record: ConnectionRecord, reason: ConnectionRefreshReason = \"requested\"): Promise<ConnectionRecord> {\n    const inFlight = this.refreshing.get(record.id);\n    if (inFlight) return inFlight;\n    const task = this.withLock(record.id, () => this.refreshOnce(record, reason)).finally(() =>\n      this.refreshing.delete(record.id),\n    );\n    this.refreshing.set(record.id, task);\n    return task;\n  }\n\n  private async refreshOnce(seen: ConnectionRecord, reason: ConnectionRefreshReason): Promise<ConnectionRecord> {\n    // Re-read under the lock: another process may have refreshed already.\n    const name = this.providerName(seen.provider) ?? seen.provider;\n    const current = await this.store.find(seen.userId, seen.provider);\n    if (!current || current.id !== seen.id) {\n      throw new OAuthReconnectRequiredError(name);\n    }\n    if (current.revision !== seen.revision && !current.needsReconnect) return current;\n    if (current.needsReconnect) throw new OAuthReconnectRequiredError(name);\n\n    const provider = this.provider(name);\n    if (this.faked) return current;\n    const strategy = provider.config.refreshStrategy;\n    if (!strategy && current.refreshToken === null) {\n      await this.store.markNeedsReconnect(current.id);\n      throw new OAuthReconnectRequiredError(name);\n    }\n\n    let tokens: OAuthTokenSet | null;\n    try {\n      tokens = strategy\n        ? await strategy({\n            accessToken: current.accessToken,\n            refreshToken: current.refreshToken,\n            scopes: [...current.scopes],\n            expiresAt: current.expiresAt,\n            issuedAt: current.updatedAt,\n            reason,\n            providerAccountId: current.providerAccountId,\n          })\n        : await provider.refresh(current.refreshToken as string, current.scopes);\n    } catch (error) {\n      // A refusal from the token endpoint is final: the grant is gone. A\n      // network error or a 5xx is not, and leaves the connection alone. Nor\n      // is `invalid_client`: the app's own credentials (or `clientAuth`) are\n      // wrong, reconnecting would fail the same way, and marking would make\n      // every user reconnect once the config is fixed.\n      if (\n        error instanceof OAuthConnectionError &&\n        error.status !== undefined &&\n        error.status >= 400 &&\n        error.status < 500 &&\n        error.providerError !== \"invalid_client\"\n      ) {\n        await this.store.markNeedsReconnect(current.id);\n        throw new OAuthReconnectRequiredError(name, {\n          cause: error,\n          status: error.status,\n          providerError: error.providerError,\n        });\n      }\n      throw error;\n    }\n    // The strategy has nothing to refresh yet: keep the current token.\n    if (tokens === null) return current;\n\n    const updated = await this.store.updateTokens(current.id, current.revision, tokens);\n    if (updated) return updated;\n    // Someone else wrote first (only possible without a shared lock store).\n    const winner = await this.store.find(current.userId, current.provider);\n    if (!winner) throw new OAuthReconnectRequiredError(name);\n    return winner;\n  }\n\n  private async withLock<T>(id: string, fn: () => Promise<T>): Promise<T> {\n    const application = app();\n    if (this.faked || !application.bound(LockManager)) return fn();\n    const result = await application\n      .make(LockManager)\n      .run(`gemi:oauth-connection:${id}`, { ttl: 30_000, wait: 20_000 }, () => fn());\n    if (!result.acquired) {\n      throw new OAuthConnectionError(\n        \"refresh_failed\",\n        \"Timed out waiting for another refresh of this connection to finish.\",\n      );\n    }\n    return result.value as T;\n  }\n}\n\n/**\n * One user's connection to one provider. Never exposes a token as a property,\n * and serialises (`toJSON`, `console.log`) without them.\n */\nexport class ProviderConnection {\n  constructor(\n    private readonly manager: ConnectionManager,\n    private record: ConnectionRecord,\n  ) {}\n\n  /** The provider's name under `auth.connections`. */\n  get provider(): string {\n    return this.manager.providerName(this.record.provider) ?? this.record.provider;\n  }\n  get userId(): string {\n    return this.record.userId;\n  }\n  get providerAccountId(): string | null {\n    return this.record.providerAccountId;\n  }\n  /** The scopes the provider granted. */\n  get scopes(): readonly string[] {\n    return this.record.scopes;\n  }\n  get expiresAt(): Date | null {\n    return this.record.expiresAt;\n  }\n  /** A refresh was refused: the user has to connect again. */\n  get needsReconnect(): boolean {\n    return this.record.needsReconnect;\n  }\n  get connectedAt(): Date {\n    return this.record.createdAt;\n  }\n\n  /**\n   * What to show the user: `\"needs_reconnect\"` when a refresh was refused, or\n   * when the access token has expired and there is no refresh token to renew\n   * it; `\"connected\"` otherwise. Read without calling the provider.\n   */\n  get status(): ConnectionStatus {\n    if (this.record.needsReconnect) return \"needs_reconnect\";\n    const expiresAt = this.record.expiresAt?.getTime();\n    if (this.record.refreshToken === null && expiresAt !== undefined && expiresAt <= Date.now()) {\n      return \"needs_reconnect\";\n    }\n    return \"connected\";\n  }\n\n  /**\n   * The provider this connection belongs to, as configured in\n   * `auth.connections` (for helpers built on a connection).\n   *\n   * @internal\n   */\n  connectionProvider(): OAuthConnectionProvider {\n    return this.manager.provider(this.provider);\n  }\n\n  /** Whether every one of `scopes` was granted. */\n  hasScopes(...scopes: string[]): boolean {\n    return scopes.every((scope) => this.record.scopes.includes(scope));\n  }\n\n  /**\n   * `fetch`, as the user: adds `Authorization: Bearer <token>`, refreshes the\n   * token first when it is about to expire, and after a 401 refreshes and\n   * retries once. A refresh the provider refuses marks the connection and\n   * throws `OAuthReconnectRequiredError`.\n   *\n   * A path is resolved against the provider's `apiBaseUrl`, and a URL on any\n   * other origin is refused (`OAuthConnectionError`,\n   * `forbidden_url`), so the token only ever goes to the provider. Redirects\n   * are followed by hand: the token is dropped on one that leaves the origin.\n   * A streamed request body cannot be sent twice, so a 401 for one is\n   * returned rather than retried.\n   */\n  async fetch(input: string | URL, init: RequestInit = {}): Promise<Response> {\n    const url = this.resolveUrl(input);\n    const record = await this.current();\n    const first = await this.send(url, init, record.accessToken);\n    // Retry only a refusal of the token itself, not one from where a redirect\n    // led after the token was dropped.\n    if (!first.authorized || init.body instanceof ReadableStream) return first.response;\n    const provider = this.manager.provider(this.provider);\n    if (!(await provider.isTokenRejected(first.response))) return first.response;\n\n    await first.response.body?.cancel().catch(() => {});\n    const refreshed = await this.refreshFrom(record, \"rejected\");\n    return (await this.send(url, init, refreshed.accessToken)).response;\n  }\n\n  /**\n   * A valid access token, refreshed first if it is about to expire — for an\n   * SDK that wants the token itself. Prefer `fetch`, which also retries a 401.\n   */\n  async accessToken(): Promise<string> {\n    return (await this.current()).accessToken;\n  }\n\n  /** Refreshes now, whatever the expiry says. */\n  async refresh(): Promise<void> {\n    await this.refreshFrom(this.record);\n  }\n\n  /**\n   * Revokes the grant at the provider (the refresh token when there is one,\n   * which ends the whole grant, else the access token) and deletes the\n   * connection. If the provider refuses, nothing is deleted and\n   * `OAuthConnectionError` (`revoke_failed`) is thrown — call `disconnect()`\n   * to forget the tokens anyway. A provider without a `revokeUrl` throws\n   * `revoke_unsupported`; use `disconnect()`.\n   */\n  async revoke(): Promise<void> {\n    if (!this.manager.faked) {\n      const provider = this.manager.provider(this.provider);\n      if (this.record.refreshToken !== null) {\n        await provider.revoke(this.record.refreshToken, \"refresh_token\");\n      } else {\n        await provider.revoke(this.record.accessToken, \"access_token\");\n      }\n    }\n    await this.manager.store.delete(this.record.id);\n  }\n\n  /** Forgets the tokens locally without telling the provider. */\n  async disconnect(): Promise<void> {\n    await this.manager.store.delete(this.record.id);\n  }\n\n  toJSON() {\n    return {\n      provider: this.provider,\n      providerAccountId: this.providerAccountId,\n      scopes: [...this.scopes],\n      expiresAt: this.expiresAt,\n      needsReconnect: this.needsReconnect,\n      status: this.status,\n      connectedAt: this.connectedAt,\n    };\n  }\n\n  [Symbol.for(\"nodejs.util.inspect.custom\")]() {\n    return { ProviderConnection: this.toJSON() };\n  }\n\n  private async current(): Promise<ConnectionRecord> {\n    if (this.record.needsReconnect) throw new OAuthReconnectRequiredError(this.provider);\n    const leeway = this.manager.provider(this.provider).config.refreshLeewaySeconds * 1000;\n    const expiresAt = this.record.expiresAt?.getTime();\n    if (expiresAt !== undefined && expiresAt - Date.now() <= leeway) {\n      return this.refreshFrom(this.record, \"expiring\");\n    }\n    return this.record;\n  }\n\n  private async refreshFrom(\n    record: ConnectionRecord,\n    reason: ConnectionRefreshReason = \"requested\",\n  ): Promise<ConnectionRecord> {\n    try {\n      this.record = await this.manager.refresh(record, reason);\n    } catch (error) {\n      if (error instanceof OAuthReconnectRequiredError) {\n        this.record = { ...this.record, needsReconnect: true };\n      }\n      throw error;\n    }\n    return this.record;\n  }\n\n  private resolveUrl(input: string | URL): URL {\n    const base = this.manager.provider(this.provider).config.apiBaseUrl;\n    let url: URL;\n    try {\n      url = new URL(String(input), base);\n    } catch {\n      throw new OAuthConnectionError(\n        \"forbidden_url\",\n        `connection.fetch was given ${JSON.stringify(String(input))}, which is not a URL.`,\n      );\n    }\n    if (url.origin !== new URL(base).origin) {\n      throw new OAuthConnectionError(\n        \"forbidden_url\",\n        `connection.fetch only sends the ${this.provider} token to ${new URL(base).origin} ` +\n          `(apiBaseUrl), not to ${url.origin}.`,\n      );\n    }\n    if (url.protocol !== \"https:\" && !(url.protocol === \"http:\" && isLoopback(url.hostname))) {\n      throw new OAuthConnectionError(\n        \"forbidden_url\",\n        `connection.fetch only sends a token over https, not to ${url.origin}.`,\n      );\n    }\n    return url;\n  }\n\n  private async send(url: URL, init: RequestInit, token: string): Promise<{ response: Response; authorized: boolean }> {\n    let target = url;\n    let method = (init.method ?? \"GET\").toUpperCase();\n    let body = init.body;\n    let authorized = true;\n\n    // Followed by hand (unless the caller asked for \"manual\" or \"error\"), so\n    // the token never follows a redirect to another origin.\n    if (init.redirect === \"manual\" || init.redirect === \"error\") {\n      const response = await this.manager.send(this.provider, this.request(target, init, method, body, token));\n      return { response, authorized };\n    }\n\n    for (let hop = 0; ; hop++) {\n      const request = this.request(target, { ...init, redirect: \"manual\" }, method, body, authorized ? token : null);\n      const response = await this.manager.send(this.provider, request);\n      const location = response.headers.get(\"location\");\n      if (!REDIRECTS.has(response.status) || location === null || hop >= 5) return { response, authorized };\n\n      await response.body?.cancel().catch(() => {});\n      const next = new URL(location, target);\n      if (next.origin !== target.origin) authorized = false;\n      if (response.status === 303 || ((response.status === 301 || response.status === 302) && method === \"POST\")) {\n        method = \"GET\";\n        body = undefined;\n      }\n      target = next;\n    }\n  }\n\n  private request(url: URL, init: RequestInit, method: string, body: RequestInit[\"body\"], token: string | null): Request {\n    const headers = new Headers(init.headers);\n    const target = new URL(url);\n    const placement = this.manager.provider(this.provider).config.tokenPlacement;\n    if (token === null) {\n      headers.delete(\"authorization\");\n    } else if (placement === \"query\") {\n      // Where the provider documents it (Instagram's Graph API). Only ever on\n      // `apiBaseUrl`'s origin: a redirect elsewhere is sent with `token` null.\n      target.searchParams.set(\"access_token\", token);\n    } else {\n      headers.set(\"Authorization\", `Bearer ${token}`);\n    }\n    return new Request(target, { ...init, method, body, headers });\n  }\n}\n\nconst REDIRECTS = new Set([301, 302, 303, 307, 308]);\n\n/** Between a multiple-account provider's name and the account id, in the store's `provider` column. */\nconst ACCOUNT_SEPARATOR = \":\";\n\nfunction storeKey(provider: string, accountId: string): string {\n  return `${provider}${ACCOUNT_SEPARATOR}${accountId}`;\n}\n\nfunction ownerId(user: ConnectionOwner): string {\n  const id = typeof user === \"object\" && user !== null ? user.id : user;\n  if (id === undefined || id === null || id === \"\") {\n    throw new TypeError(\"An OAuth connection belongs to a user: pass the user (or its id).\");\n  }\n  return String(id);\n}\n"
   ],
   "mappings": ";sLAwCO,AAAM,LAAiD,LAC3C,KAAO,IAAI,SAEtB,KAAI,CAAC,EAAgB,EAAkB,CAC3C,QAAW,KAAO,KAAK,KAAK,OAAO,EACjC,GAAI,EAAI,SAAW,GAAU,EAAI,WAAa,EAAU,MAAO,IAAK,CAAI,EAE1E,OAAO,UAGH,KAAI,CAAC,EAAgB,CACzB,MAAO,CAAC,GAAG,KAAK,KAAK,OAAO,CAAC,EAAE,OAAO,CAAC,IAAQ,EAAI,SAAW,CAAM,EAAE,IAAI,CAAC,KAAS,IAAK,CAAI,EAAE,OAG3F,KAAI,CAAC,EAAgB,EAAkB,EAAuB,CAClE,IAAM,EAAW,MAAM,KAAK,KAAK,EAAQ,CAAQ,EAC3C,EAAM,IAAI,KACV,EAAwB,CAC5B,GAAI,GAAU,IAAM,IAAI,aAAa,EACrC,SACA,cACG,EAAW,CAAM,EACpB,eAAgB,GAChB,UAAW,GAAU,UAAY,GAAK,EACtC,UAAW,GAAU,WAAa,EAClC,UAAW,CACb,EAEA,OADA,KAAK,KAAK,IAAI,EAAI,GAAI,CAAG,EAClB,IAAK,CAAI,OAGZ,aAAY,CAAC,EAAY,EAAkB,EAAuB,CACtE,IAAM,EAAM,KAAK,KAAK,IAAI,CAAE,EAC5B,GAAI,CAAC,GAAO,EAAI,WAAa,EAAU,OAAO,KAG9C,IAAM,EAAQ,EAAW,CAAM,EAC/B,EAAM,oBAAsB,EAAI,kBAChC,IAAM,EAAO,IAAK,KAAQ,EAAO,eAAgB,GAAO,SAAU,EAAW,EAAG,UAAW,IAAI,IAAO,EAEtG,OADA,KAAK,KAAK,IAAI,EAAI,CAAI,EACf,IAAK,CAAK,OAGb,mBAAkB,CAAC,EAAY,CACnC,IAAM,EAAM,KAAK,KAAK,IAAI,CAAE,EAC5B,GAAI,EAAK,KAAK,KAAK,IAAI,EAAI,IAAK,EAAK,eAAgB,GAAM,UAAW,IAAI,IAAO,CAAC,OAG9E,OAAM,CAAC,EAAY,CACvB,KAAK,KAAK,OAAO,CAAE,EAEvB,CAaO,MAAM,CAAmD,CAO3C,UANV,MACQ,IACA,QAEjB,WAAW,CACT,EACiB,EACjB,EAA0C,CAAC,EAC3C,CAFiB,iBAGjB,IAAM,EAAQ,EAAQ,OAAS,yBAC/B,GAAI,CAAC,2BAA2B,KAAK,CAAK,EACxC,MAAU,MAAM,+BAA+B,+BAAmC,EAEpF,KAAK,MAAQ,EACb,KAAK,IAAM,EAAW,IACtB,KAAK,QAAU,EAAW,aAItB,YAAW,EAAkB,CACjC,QAAW,KAAa,EAAgC,KAAK,QAAS,KAAK,KAAK,EAC9E,MAAM,KAAK,IAAI,OAAO,CAAS,OAI7B,KAAI,CAAC,EAAgB,EAAkB,CAC3C,IAAM,EAAI,KAAK,IACT,EAAQ,KAAM;AAAA,sBACF,KAAK,KAAK,CAAC,qBAAqB,oBAAyB;AAAA,MAE3E,OAAO,EAAK,GAAK,KAAK,OAAO,EAAK,EAAE,EAAI,UAGpC,KAAI,CAAC,EAAgB,CACzB,IAAM,EAAI,KAAK,IAIf,OAHc,KAAM;AAAA,sBACF,KAAK,KAAK,CAAC,qBAAqB;AAAA,OAEtC,IAAI,CAAC,IAAQ,KAAK,OAAO,CAAG,CAAC,OAGrC,KAAI,CAAC,EAAgB,EAAkB,EAAuB,CAClE,IAAM,EAAI,KAAK,IACT,EAAS,KAAK,OAAO,CAAM,EAC3B,EAAM,KAAK,IAAI,EAEf,EAAS,SACb,EACE,KAAM;AAAA,mBACK,KAAK,KAAK,CAAC;AAAA,sCACQ,EAAO,+BAA+B,EAAO;AAAA,+BACpD,EAAO,gCAAgC,EAAO;AAAA,6BAChD,EAAO,2BAA2B,EAAO;AAAA,2EACK;AAAA,4BAC/C,oBAAyB;AAAA,SAE/C,EAEF,GAAK,MAAM,EAAO,IAAO,EACvB,GAAI,CACF,KAAM;AAAA,wBACU,KAAK,KAAK,CAAC;AAAA;AAAA;AAAA,oBAGf,IAAI,aAAa,MAAM,MAAW,MAAa,EAAO;AAAA,cAC5D,EAAO,WAAW,EAAO,gBAAgB,EAAO,iBAAiB,EAAO;AAAA,cACxE,EAAO,oBAAoB,MAAQ;AAAA,UAEzC,MAAO,EAAO,CAEd,GAAK,MAAM,EAAO,IAAO,EAAG,MAAM,EAItC,IAAM,EAAQ,MAAM,KAAK,KAAK,EAAQ,CAAQ,EAC9C,GAAI,CAAC,EAAO,MAAU,MAAM,yDAAyD,EACrF,OAAO,OAGH,aAAY,CAAC,EAAY,EAAkB,EAAuB,CACtE,IAAM,EAAI,KAAK,IACT,EAAS,KAAK,OAAO,CAAM,EAC3B,EAAS,KAAM;AAAA,eACV,KAAK,KAAK,CAAC;AAAA,2CACiB,EAAO;AAAA,qBAC7B,EAAO,0BAA0B,EAAO;AAAA,4BACjC,EAAO,8BAA8B,EAAO;AAAA,yBAC/C,EAAO;AAAA,yBACP,KAAK,IAAI;AAAA,mBACf,oBAAqB;AAAA,MAEpC,GAAI,EAAS,CAAM,IAAM,EAAG,OAAO,KACnC,IAAM,EAAQ,KAAM,mBAAkB,KAAK,KAAK,CAAC,gBAAgB,IACjE,OAAO,EAAK,GAAK,KAAK,OAAO,EAAK,EAAE,EAAI,UAGpC,mBAAkB,CAAC,EAAY,CACnC,IAAM,EAAI,KAAK,IACf,KAAM,YAAW,KAAK,KAAK,CAAC,2CAA2C,KAAK,IAAI,gBAAgB,SAG5F,OAAM,CAAC,EAAY,CACvB,IAAM,EAAI,KAAK,IACf,KAAM,iBAAgB,KAAK,KAAK,CAAC,gBAAgB,SAQ7C,iBAAgB,CAAC,EAAgC,CAAC,EAAkD,CACxG,IAAM,EAAI,KAAK,IACT,EAAY,KAAK,UAAU,EAC3B,EAAQ,KAAM;AAAA,8DACsC,KAAK,KAAK,CAAC;AAAA,MAEjE,EAAU,EACd,QAAW,KAAO,EAAM,CACtB,IAAM,EAAQ,CAAC,IAAyB,OAAO,IAAU,UAAY,EAAU,kBAAkB,CAAK,EACtG,GAAI,CAAC,EAAM,EAAI,YAAY,GAAK,CAAC,EAAM,EAAI,aAAa,EAAG,SAE3D,GADA,GAAW,EACP,EAAQ,OAAQ,SACpB,IAAM,EAAS,CAAC,IAA0B,IAAU,KAAO,KAAO,EAAU,QAAQ,EAAU,QAAQ,CAAK,CAAC,EAC5G,KAAM;AAAA,iBACK,KAAK,KAAK,CAAC;AAAA,6BACC,EAAO,EAAI,YAAY,sBAAsB,EAAO,EAAI,aAAa;AAAA;AAAA,qBAE7E,EAAI,qBAAqB,OAAO,EAAI,QAAQ;AAAA,QAG7D,MAAO,CAAE,QAAS,EAAK,OAAQ,SAAQ,EAGjC,MAAM,CAAC,EAAuB,CACpC,IAAM,EAAY,KAAK,UAAU,EACjC,MAAO,CACL,kBAAmB,EAAO,kBAC1B,OAAQ,EAAO,OAAO,KAAK,GAAG,EAC9B,YAAa,EAAU,QAAQ,EAAO,WAAW,EACjD,aAAc,EAAO,eAAiB,KAAO,KAAO,EAAU,QAAQ,EAAO,YAAY,EACzF,UAAW,EAAO,UAClB,UAAW,EAAO,YAAc,KAAO,KAAO,EAAO,UAAU,QAAQ,CACzE,EAGM,MAAM,CAAC,EAA+B,CAC5C,IAAM,EAAY,KAAK,UAAU,EACjC,MAAO,CACL,GAAI,OAAO,EAAI,EAAE,EACjB,OAAQ,OAAO,EAAI,OAAO,EAC1B,SAAU,OAAO,EAAI,QAAQ,EAC7B,kBAAmB,EAAI,sBAAwB,KAAO,KAAO,OAAO,EAAI,mBAAmB,EAC3F,OAAQ,OAAO,EAAI,QAAU,EAAE,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO,EAC1D,YAAa,EAAU,QAAQ,OAAO,EAAI,YAAY,CAAC,EACvD,aAAc,EAAI,gBAAkB,KAAO,KAAO,EAAU,QAAQ,OAAO,EAAI,aAAa,CAAC,EAC7F,UAAW,EAAI,aAAe,KAAO,KAAO,OAAO,EAAI,UAAU,EACjE,UAAW,EAAI,aAAe,KAAO,KAAO,IAAI,KAAK,OAAO,EAAI,UAAU,CAAC,EAC3E,eAAgB,OAAO,EAAI,eAAe,IAAM,EAChD,SAAU,OAAO,EAAI,QAAQ,EAC7B,UAAW,IAAI,KAAK,OAAO,EAAI,UAAU,CAAC,EAC1C,UAAW,IAAI,KAAK,OAAO,EAAI,UAAU,CAAC,CAC5C,KAGU,MAAK,EAAG,CAClB,OAAO,KAAK,UAAY,SAAW,KAAK,UAAY,UAG9C,IAAI,CAAC,EAAQ,CACnB,OAAO,EAAE,OAAO,KAAK,MAAQ,KAAK,KAAK,UAAY,IAAI,KAAK,QAAQ,EAExE,CAkBA,SAAS,CAAU,CAAC,EAAuB,CACzC,MAAO,CACL,kBAAmB,EAAO,kBAC1B,OAAQ,CAAC,GAAG,EAAO,MAAM,EACzB,YAAa,EAAO,YACpB,aAAc,EAAO,aACrB,UAAW,EAAO,UAClB,UAAW,EAAO,SACpB,EAGF,SAAS,CAAQ,CAAC,EAAyB,CACzC,IAAM,EAAS,EACf,OAAO,KAAK,IAAI,OAAO,EAAO,OAAS,CAAC,EAAG,OAAO,EAAO,cAAgB,CAAC,CAAC,EAItE,SAAS,CAA+B,CAAC,EAAkB,EAAyB,CACzF,GAAI,IAAY,SAAW,IAAY,UACrC,MAAO,CACL,gCAAgC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qBAejB;AAAA;AAAA,2DAGjB,EAEF,IAAM,EAAM,IAAY,SAAW,kCAAoC,sBACjE,EACJ,IAAY,SAAW,GAAK;AAAA;AAAA,kBAAwB,6BACtD,MAAO,CACL,+BAA+B;AAAA,MAC7B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kCAY4B;AAAA,GAE9B,sCAAsC,+BAAmC,2BAC3E,ECpVK,MAAM,UAA6B,KAAM,CAKnC,KAJF,OACA,cAET,WAAW,CACA,EACT,EACA,EAAwE,CAAC,EACzE,CACA,MAAM,EAAS,EAAQ,QAAU,OAAY,CAAE,MAAO,EAAQ,KAAM,EAAI,MAAS,EAJxE,YAKT,KAAK,KAAO,uBACZ,KAAK,OAAS,EAAQ,OACtB,KAAK,cAAgB,EAAQ,cAEjC,CASO,MAAM,UAAoC,CAAqB,CAEzD,SADX,WAAW,CACA,EACT,EAAwE,CAAC,EACzE,CACA,MACE,qBACA,OAAO,4FACP,CACF,EAPS,gBAQT,KAAK,KAAO,8BAEhB,CCwHO,MAAM,CAAwB,CAC1B,OAQT,WAAW,CAAC,EAAuC,CACjD,QAAW,IAAO,CAAC,eAAgB,UAAU,EAC3C,EAAc,EAAK,EAAO,EAAI,EAEhC,QAAW,IAAO,CAAC,aAAc,WAAW,EAC1C,GAAI,EAAO,KAAS,OAAW,EAAc,EAAK,EAAO,EAAI,EAM/D,GAAI,EAAO,aAAe,QAAa,EAAO,aAAe,MAAQ,EAAO,aAAe,GACzF,MAAU,MACR,+KAEF,EAEF,EAAc,aAAc,EAAO,UAAU,EAC7C,KAAK,OAAS,CACZ,eAAgB,IAChB,WAAY,OACZ,KAAM,GACN,oBAAqB,CAAC,EACtB,qBAAsB,GACtB,SAAU,GACV,eAAgB,YACb,EACH,iBAAkB,EAAO,kBAAoB,eAC/C,OAOI,gBAAe,CAAC,EAAsC,CAC1D,IAAM,EAAQ,KAAK,OAAO,gBAC1B,GAAI,CAAC,EAAO,OAAO,EAAS,SAAW,IACvC,OAAO,MAAM,EAAM,CAAQ,EAI7B,gBAAgB,CAAC,EAA6E,CAC5F,IAAM,EAAM,IAAI,IAAI,KAAK,OAAO,YAAY,EACtC,EAAiC,IAClC,KAAK,OAAO,oBACf,cAAe,OACf,UAAW,KAAK,OAAO,SACvB,aAAc,EAAK,YACnB,MAAO,KAAK,OAAO,OAAO,KAAK,KAAK,OAAO,cAAc,EACzD,MAAO,EAAK,KACd,EACA,GAAI,KAAK,OAAO,KACd,EAAO,eAAiB,EAAK,cAC7B,EAAO,sBAAwB,OAEjC,QAAY,EAAK,KAAU,OAAO,QAAQ,CAAM,EAAG,EAAI,aAAa,IAAI,EAAK,CAAK,EAClF,OAAO,EAAI,SAAS,EAItB,YAAY,CAAC,EAA2F,CACtG,IAAM,EAAO,IAAI,gBAAgB,CAC/B,WAAY,qBACZ,KAAM,EAAK,KACX,aAAc,EAAK,WACrB,CAAC,EACD,GAAI,KAAK,OAAO,KAAM,EAAK,IAAI,gBAAiB,EAAK,YAAY,EACjE,OAAO,KAAK,aAAa,KAAK,OAAO,SAAU,EAAM,CACnD,OAAQ,KAAK,OAAO,OACpB,aAAc,KACd,MAAO,UACT,CAAC,EAQH,OAAO,CAAC,EAAsB,EAA0C,CACtE,IAAM,EAAO,IAAI,gBACX,EAAY,KAAK,OAAO,iBAC9B,GAAI,IAAc,IAAS,IAAc,GAAI,EAAK,IAAI,aAAc,CAAS,EAE7E,OADA,EAAK,IAAI,gBAAiB,CAAY,EAC/B,KAAK,aAAa,KAAK,OAAO,YAAc,KAAK,OAAO,SAAU,EAAM,CAC7E,SACA,eACA,MAAO,SACT,CAAC,OAIG,OAAM,CAAC,EAAe,EAAuD,CACjF,GAAI,CAAC,KAAK,OAAO,UACf,MAAM,IAAI,EACR,qBACA,2FACF,EAEF,IAAM,EAAO,IAAI,gBAAgB,CAAE,QAAO,gBAAiB,CAAK,CAAC,EAC7D,EACJ,GAAI,CACF,EAAW,MAAM,MAAM,KAAK,OAAO,UAAW,KAAK,KAAK,CAAI,CAAC,EAC7D,MAAO,EAAO,CACd,MAAM,IAAI,EAAqB,gBAAiB,iCAAkC,CAAE,OAAM,CAAC,EAG7F,GAAI,CAAC,EAAS,GACZ,MAAM,IAAI,EACR,gBACA,6CAA6C,EAAS,WACtD,CAAE,OAAQ,EAAS,MAAO,CAC5B,EAII,IAAI,CAAC,EAAoC,CAC/C,IAAM,EAAkC,CACtC,eAAgB,oCAEhB,OAAQ,kBACV,EACA,GAAI,KAAK,OAAO,aAAe,QAAS,CACtC,IAAM,EAAc,GAAG,mBAAmB,KAAK,OAAO,QAAQ,KAAK,mBAAmB,KAAK,OAAO,YAAY,IAC9G,EAAQ,cAAgB,SAAS,OAAO,KAAK,CAAW,EAAE,SAAS,QAAQ,IAE3E,OAAK,IAAI,YAAa,KAAK,OAAO,QAAQ,EAC1C,EAAK,IAAI,gBAAiB,KAAK,OAAO,YAAY,EAEpD,MAAO,CAAE,OAAQ,OAAQ,UAAS,KAAM,EAAK,SAAS,EAAG,SAAU,OAAQ,OAG/D,aAAY,CACxB,EACA,EACA,EACwB,CACxB,IAAM,EAAU,EAAS,QAAU,WAAa,kBAAoB,iBAChE,EACJ,GAAI,CACF,EAAW,MAAM,MAAM,EAAU,KAAK,KAAK,CAAI,CAAC,EAChD,MAAO,EAAO,CACd,MAAM,IAAI,EAAqB,EAAS,4BAA6B,CAAE,OAAM,CAAC,EAGhF,IAAM,EAAW,MAAM,EAAS,KAAK,EAAE,MAAM,KAAO,CAAC,EAAE,EACvD,GAAI,CAAC,EAAS,IAAM,OAAO,EAAQ,eAAiB,UAAY,EAAQ,eAAiB,GAAI,CAE3F,IAAM,EAAO,OAAO,EAAQ,QAAU,UAAY,oBAAoB,KAAK,EAAQ,KAAK,EAAI,EAAQ,MAAQ,OAC5G,MAAM,IAAI,EACR,EACA,kCAAkC,EAAS,QAAU,WAAa,OAAS,yBAChE,EAAS,SAAS,EAAO,KAAK,IAAS,OAClD,CAAE,OAAQ,EAAS,OAAQ,cAAe,CAAK,CACjD,EAGF,IAAM,EAAY,OAAO,EAAQ,UAAU,EACrC,EAAQ,OAAO,EAAQ,QAAU,SAAW,EAAQ,MAAQ,OAG5D,EAAY,EAAQ,gBAAkB,EAAQ,SAAW,EAAQ,WACvE,MAAO,CACL,YAAa,EAAQ,aACrB,aACE,OAAO,EAAQ,gBAAkB,UAAY,EAAQ,gBAAkB,GACnE,EAAQ,cACR,EAAS,aACf,UAAW,OAAO,EAAQ,aAAe,SAAW,EAAQ,WAAa,KACzE,UAAW,OAAO,SAAS,CAAS,GAAK,EAAY,EAAI,IAAI,KAAK,KAAK,IAAI,EAAI,EAAY,IAAI,EAAI,KACnG,OAAQ,IAAU,OAAY,EAAM,MAAM,QAAQ,EAAE,OAAO,OAAO,EAAI,EAAS,OAC/E,kBACE,OAAO,IAAc,UAAY,OAAO,IAAc,SAAW,OAAO,CAAS,EAAI,IACzF,EAEJ,CAEA,SAAS,CAAa,CAAC,EAAa,EAAsB,CACxD,IAAI,EACJ,GAAI,CACF,EAAM,IAAI,IAAI,OAAO,CAAK,CAAC,EAC3B,KAAM,CACN,EAAM,OAER,GAAI,CAAC,GAAQ,EAAI,WAAa,UAAY,EAAE,EAAI,WAAa,SAAW,EAAW,EAAI,QAAQ,GAC7F,MAAU,MACR,4BAA4B,yDAA2D,KAAK,UAAU,CAAK,IAC7G,EAIG,SAAS,CAAU,CAAC,EAA2B,CACpD,OAAO,IAAa,aAAe,IAAa,aAAe,IAAa,SAAW,IAAa,MC/U/F,MAAM,CAAkB,CASA,cARtB,OAAQ,mBAEP,cACS,WAAa,IAAI,IAC1B,MACA,UACC,aAA0B,CAAC,EAEpC,WAAW,CAAkB,EAAmC,CAAnC,eAC3B,QAAY,EAAM,KAAa,OAAO,QAAQ,EAAQ,SAAS,EAAG,CAChE,GAAI,CAAC,EAAS,OAAO,SAAU,SAG/B,IAAM,EAAQ,OAAO,KAAK,EAAQ,SAAS,EAAE,KAAK,CAAC,IAAU,EAAM,WAAW,GAAG,IAAO,GAAmB,CAAC,EAC5G,GAAI,EAAK,SAAS,CAAiB,GAAK,EACtC,MAAU,MACR,sBAAsB,GAAS,8DAAiE,QACzF,2DACT,MAKF,UAAS,EAA4C,CACvD,OAAO,KAAK,QAAQ,aAIlB,MAAK,EAAoB,CAC3B,GAAI,KAAK,UAAW,OAAO,KAAK,UAChC,GAAI,CAAC,KAAK,cAAe,CACvB,IAAM,EAAa,KAAK,QAAQ,MAChC,KAAK,cACH,OAAO,IAAe,WAClB,EAAW,EACV,GACD,IAAI,EAAwB,EAAI,CAAe,EAAE,WAAW,EAAG,IAAM,EAAiB,CAAC,EAE/F,OAAO,KAAK,cAGd,QAAQ,CAAC,EAAuC,CAC9C,IAAM,EAAW,KAAK,QAAQ,UAAU,GACxC,GAAI,CAAC,EAAU,CACb,IAAM,EAAQ,OAAO,KAAK,KAAK,QAAQ,SAAS,EAChD,MAAM,IAAI,EACR,mBACA,iCAAiC,0BAC9B,EAAM,OAAS,EAAI,iBAAiB,EAAM,KAAK,IAAI,MAAQ,0BAChE,EAEF,OAAO,OAUH,IAAG,CAAC,EAAuB,EAAkB,EAAwD,CACzG,IAAM,EAAS,KAAK,SAAS,CAAQ,EAC/B,EAAS,EAAQ,CAAI,EAC3B,GAAI,CAAC,EAAO,OAAO,SAAU,CAC3B,IAAM,EAAS,MAAM,KAAK,MAAM,KAAK,EAAQ,CAAQ,EACrD,GAAI,CAAC,GAAW,IAAc,QAAa,EAAO,oBAAsB,EAAY,OAAO,KAC3F,OAAO,IAAI,EAAmB,KAAM,CAAM,EAE5C,GAAI,IAAc,OAAW,CAC3B,IAAM,EACH,MAAM,KAAK,MAAM,KAAK,EAAQ,EAAS,EAAU,CAAS,CAAC,GAE3D,MAAM,KAAK,MAAM,KAAK,EAAQ,CAAQ,EACzC,OAAO,GAAU,EAAO,oBAAsB,EAAY,IAAI,EAAmB,KAAM,CAAM,EAAI,KAEnG,IAAO,IAAW,MAAM,KAAK,KAAK,EAAM,CAAQ,GAAG,KACjD,CAAC,EAAG,IAAM,EAAE,YAAY,QAAQ,EAAI,EAAE,YAAY,QAAQ,CAC5D,EACA,OAAO,GAAU,UAIb,KAAI,CAAC,EAAuB,EAAkD,CAClF,GAAI,IAAa,OAAW,KAAK,SAAS,CAAQ,EAElD,OADgB,MAAM,KAAK,MAAM,KAAK,EAAQ,CAAI,CAAC,GAEhD,OAAO,CAAC,IAAW,CAClB,IAAM,EAAO,KAAK,aAAa,EAAO,QAAQ,EAC9C,OAAO,IAAS,OAAS,IAAa,QAAa,IAAS,GAC7D,EACA,IAAI,CAAC,IAAW,IAAI,EAAmB,KAAM,CAAM,CAAC,OASnD,KAAI,CACR,EACA,EACA,EAC6B,CAC7B,IAAM,EAAS,KAAK,SAAS,CAAQ,EAC/B,EAAS,EAAQ,CAAI,GACnB,QAAS,KAAa,GAAU,EAClC,EAAqB,CACzB,aAAc,KACd,UAAW,KACX,UAAW,KACX,kBAAmB,KACnB,OAAQ,EAAO,OAAO,UACnB,CACL,EACA,GAAI,CAAC,EAAO,OAAO,SACjB,OAAO,IAAI,EAAmB,KAAM,MAAM,KAAK,MAAM,KAAK,EAAQ,EAAU,CAAG,CAAC,EAGlF,IAAM,EAAY,EAAI,kBACtB,GAAI,OAAO,IAAc,UAAY,IAAc,GACjD,MAAM,IAAI,EACR,qBACA,IAAI,sJAEN,EAEF,IAAM,EAAS,MAAM,KAAK,MAAM,KAAK,EAAQ,EAAS,EAAU,CAAS,EAAG,CAAG,EAEzE,EAAS,MAAM,KAAK,MAAM,KAAK,EAAQ,CAAQ,EACrD,GAAI,GAAU,EAAO,oBAAsB,EAAW,MAAM,KAAK,MAAM,OAAO,EAAO,EAAE,EACvF,OAAO,IAAI,EAAmB,KAAM,CAAM,EAU5C,YAAY,CAAC,EAA4B,CACvC,IAAM,EAAY,KAAK,QAAQ,UAC/B,GAAI,OAAO,OAAO,EAAW,CAAG,EAAG,OAAO,EAC1C,IAAM,EAAK,EAAI,QAAQ,CAAiB,EACxC,GAAI,GAAM,EAAG,OAAO,KACpB,IAAM,EAAO,EAAI,MAAM,EAAG,CAAE,EAC5B,OAAO,OAAO,OAAO,EAAW,CAAI,GAAK,EAAU,GAAM,OAAO,SAAW,EAAO,KAWpF,IAAI,CAAC,EAAkD,CAAC,EAAS,CAI/D,OAHA,KAAK,MAAQ,IAAI,IAAI,OAAO,QAAQ,CAAQ,CAAC,EAC7C,KAAK,UAAY,IAAI,EACrB,KAAK,aAAa,OAAS,EACpB,KAIT,OAAO,EAAS,CACd,KAAK,MAAQ,OACb,KAAK,UAAY,OACjB,KAAK,aAAa,OAAS,KAGzB,MAAK,EAAY,CACnB,OAAO,KAAK,QAAU,YAMlB,KAAI,CAAC,EAAkB,EAAqC,CAChE,GAAI,CAAC,KAAK,MAAO,OAAO,MAAM,CAAO,EACrC,KAAK,aAAa,KAAK,EAAQ,MAAM,CAAC,EACtC,IAAM,EAAU,KAAK,MAAM,IAAI,CAAQ,EACvC,GAAI,CAAC,EACH,MAAU,MAAM,0CAA0C,oCAA2C,qBAA4B,EAEnI,OAAO,EAAQ,CAAO,EAYxB,OAAO,CAAC,EAA0B,EAAkC,YAAwC,CAC1G,IAAM,EAAW,KAAK,WAAW,IAAI,EAAO,EAAE,EAC9C,GAAI,EAAU,OAAO,EACrB,IAAM,EAAO,KAAK,SAAS,EAAO,GAAI,IAAM,KAAK,YAAY,EAAQ,CAAM,CAAC,EAAE,QAAQ,IACpF,KAAK,WAAW,OAAO,EAAO,EAAE,CAClC,EAEA,OADA,KAAK,WAAW,IAAI,EAAO,GAAI,CAAI,EAC5B,OAGK,YAAW,CAAC,EAAwB,EAA4D,CAE5G,IAAM,EAAO,KAAK,aAAa,EAAK,QAAQ,GAAK,EAAK,SAChD,EAAU,MAAM,KAAK,MAAM,KAAK,EAAK,OAAQ,EAAK,QAAQ,EAChE,GAAI,CAAC,GAAW,EAAQ,KAAO,EAAK,GAClC,MAAM,IAAI,EAA4B,CAAI,EAE5C,GAAI,EAAQ,WAAa,EAAK,UAAY,CAAC,EAAQ,eAAgB,OAAO,EAC1E,GAAI,EAAQ,eAAgB,MAAM,IAAI,EAA4B,CAAI,EAEtE,IAAM,EAAW,KAAK,SAAS,CAAI,EACnC,GAAI,KAAK,MAAO,OAAO,EACvB,IAAM,EAAW,EAAS,OAAO,gBACjC,GAAI,CAAC,GAAY,EAAQ,eAAiB,KAExC,MADA,MAAM,KAAK,MAAM,mBAAmB,EAAQ,EAAE,EACxC,IAAI,EAA4B,CAAI,EAG5C,IAAI,EACJ,GAAI,CACF,EAAS,EACL,MAAM,EAAS,CACb,YAAa,EAAQ,YACrB,aAAc,EAAQ,aACtB,OAAQ,CAAC,GAAG,EAAQ,MAAM,EAC1B,UAAW,EAAQ,UACnB,SAAU,EAAQ,UAClB,SACA,kBAAmB,EAAQ,iBAC7B,CAAC,EACD,MAAM,EAAS,QAAQ,EAAQ,aAAwB,EAAQ,MAAM,EACzE,MAAO,EAAO,CAMd,GACE,aAAiB,GACjB,EAAM,SAAW,QACjB,EAAM,QAAU,KAChB,EAAM,OAAS,KACf,EAAM,gBAAkB,iBAGxB,MADA,MAAM,KAAK,MAAM,mBAAmB,EAAQ,EAAE,EACxC,IAAI,EAA4B,EAAM,CAC1C,MAAO,EACP,OAAQ,EAAM,OACd,cAAe,EAAM,aACvB,CAAC,EAEH,MAAM,EAGR,GAAI,IAAW,KAAM,OAAO,EAE5B,IAAM,EAAU,MAAM,KAAK,MAAM,aAAa,EAAQ,GAAI,EAAQ,SAAU,CAAM,EAClF,GAAI,EAAS,OAAO,EAEpB,IAAM,EAAS,MAAM,KAAK,MAAM,KAAK,EAAQ,OAAQ,EAAQ,QAAQ,EACrE,GAAI,CAAC,EAAQ,MAAM,IAAI,EAA4B,CAAI,EACvD,OAAO,OAGK,SAAW,CAAC,EAAY,EAAkC,CACtE,IAAM,EAAc,EAAI,EACxB,GAAI,KAAK,OAAS,CAAC,EAAY,MAAM,CAAW,EAAG,OAAO,EAAG,EAC7D,IAAM,EAAS,MAAM,EAClB,KAAK,CAAW,EAChB,IAAI,yBAAyB,IAAM,CAAE,IAAK,MAAQ,KAAM,KAAO,EAAG,IAAM,EAAG,CAAC,EAC/E,GAAI,CAAC,EAAO,SACV,MAAM,IAAI,EACR,iBACA,qEACF,EAEF,OAAO,EAAO,MAElB,CAMO,MAAM,CAAmB,CAEX,QACT,OAFV,WAAW,CACQ,EACT,EACR,CAFiB,eACT,iBAIN,SAAQ,EAAW,CACrB,OAAO,KAAK,QAAQ,aAAa,KAAK,OAAO,QAAQ,GAAK,KAAK,OAAO,YAEpE,OAAM,EAAW,CACnB,OAAO,KAAK,OAAO,UAEjB,kBAAiB,EAAkB,CACrC,OAAO,KAAK,OAAO,qBAGjB,OAAM,EAAsB,CAC9B,OAAO,KAAK,OAAO,UAEjB,UAAS,EAAgB,CAC3B,OAAO,KAAK,OAAO,aAGjB,eAAc,EAAY,CAC5B,OAAO,KAAK,OAAO,kBAEjB,YAAW,EAAS,CACtB,OAAO,KAAK,OAAO,aAQjB,OAAM,EAAqB,CAC7B,GAAI,KAAK,OAAO,eAAgB,MAAO,kBACvC,IAAM,EAAY,KAAK,OAAO,WAAW,QAAQ,EACjD,GAAI,KAAK,OAAO,eAAiB,MAAQ,IAAc,QAAa,GAAa,KAAK,IAAI,EACxF,MAAO,kBAET,MAAO,YAST,kBAAkB,EAA4B,CAC5C,OAAO,KAAK,QAAQ,SAAS,KAAK,QAAQ,EAI5C,SAAS,IAAI,EAA2B,CACtC,OAAO,EAAO,MAAM,CAAC,IAAU,KAAK,OAAO,OAAO,SAAS,CAAK,CAAC,OAgB7D,MAAK,CAAC,EAAqB,EAAoB,CAAC,EAAsB,CAC1E,IAAM,EAAM,KAAK,WAAW,CAAK,EAC3B,EAAS,MAAM,KAAK,QAAQ,EAC5B,EAAQ,MAAM,KAAK,KAAK,EAAK,EAAM,EAAO,WAAW,EAG3D,GAAI,CAAC,EAAM,YAAc,EAAK,gBAAgB,eAAgB,OAAO,EAAM,SAE3E,GAAI,CAAE,MADW,KAAK,QAAQ,SAAS,KAAK,QAAQ,EAC/B,gBAAgB,EAAM,QAAQ,EAAI,OAAO,EAAM,SAEpE,MAAM,EAAM,SAAS,MAAM,OAAO,EAAE,MAAM,IAAM,EAAE,EAClD,IAAM,EAAY,MAAM,KAAK,YAAY,EAAQ,UAAU,EAC3D,OAAQ,MAAM,KAAK,KAAK,EAAK,EAAM,EAAU,WAAW,GAAG,cAOvD,YAAW,EAAoB,CACnC,OAAQ,MAAM,KAAK,QAAQ,GAAG,iBAI1B,QAAO,EAAkB,CAC7B,MAAM,KAAK,YAAY,KAAK,MAAM,OAW9B,OAAM,EAAkB,CAC5B,GAAI,CAAC,KAAK,QAAQ,MAAO,CACvB,IAAM,EAAW,KAAK,QAAQ,SAAS,KAAK,QAAQ,EACpD,GAAI,KAAK,OAAO,eAAiB,KAC/B,MAAM,EAAS,OAAO,KAAK,OAAO,aAAc,eAAe,EAE/D,WAAM,EAAS,OAAO,KAAK,OAAO,YAAa,cAAc,EAGjE,MAAM,KAAK,QAAQ,MAAM,OAAO,KAAK,OAAO,EAAE,OAI1C,WAAU,EAAkB,CAChC,MAAM,KAAK,QAAQ,MAAM,OAAO,KAAK,OAAO,EAAE,EAGhD,MAAM,EAAG,CACP,MAAO,CACL,SAAU,KAAK,SACf,kBAAmB,KAAK,kBACxB,OAAQ,CAAC,GAAG,KAAK,MAAM,EACvB,UAAW,KAAK,UAChB,eAAgB,KAAK,eACrB,OAAQ,KAAK,OACb,YAAa,KAAK,WACpB,GAGD,OAAO,IAAI,4BAA4B,EAAE,EAAG,CAC3C,MAAO,CAAE,mBAAoB,KAAK,OAAO,CAAE,OAG/B,QAAO,EAA8B,CACjD,GAAI,KAAK,OAAO,eAAgB,MAAM,IAAI,EAA4B,KAAK,QAAQ,EACnF,IAAM,EAAS,KAAK,QAAQ,SAAS,KAAK,QAAQ,EAAE,OAAO,qBAAuB,KAC5E,EAAY,KAAK,OAAO,WAAW,QAAQ,EACjD,GAAI,IAAc,QAAa,EAAY,KAAK,IAAI,GAAK,EACvD,OAAO,KAAK,YAAY,KAAK,OAAQ,UAAU,EAEjD,OAAO,KAAK,YAGA,YAAW,CACvB,EACA,EAAkC,YACP,CAC3B,GAAI,CACF,KAAK,OAAS,MAAM,KAAK,QAAQ,QAAQ,EAAQ,CAAM,EACvD,MAAO,EAAO,CACd,GAAI,aAAiB,EACnB,KAAK,OAAS,IAAK,KAAK,OAAQ,eAAgB,EAAK,EAEvD,MAAM,EAER,OAAO,KAAK,OAGN,UAAU,CAAC,EAA0B,CAC3C,IAAM,EAAO,KAAK,QAAQ,SAAS,KAAK,QAAQ,EAAE,OAAO,WACrD,EACJ,GAAI,CACF,EAAM,IAAI,IAAI,OAAO,CAAK,EAAG,CAAI,EACjC,KAAM,CACN,MAAM,IAAI,EACR,gBACA,8BAA8B,KAAK,UAAU,OAAO,CAAK,CAAC,wBAC5D,EAEF,GAAI,EAAI,SAAW,IAAI,IAAI,CAAI,EAAE,OAC/B,MAAM,IAAI,EACR,gBACA,mCAAmC,KAAK,qBAAqB,IAAI,IAAI,CAAI,EAAE,+BACjD,EAAI,SAChC,EAEF,GAAI,EAAI,WAAa,UAAY,EAAE,EAAI,WAAa,SAAW,EAAW,EAAI,QAAQ,GACpF,MAAM,IAAI,EACR,gBACA,0DAA0D,EAAI,SAChE,EAEF,OAAO,OAGK,KAAI,CAAC,EAAU,EAAmB,EAAqE,CACnH,IAAI,EAAS,EACT,GAAU,EAAK,QAAU,OAAO,YAAY,EAC5C,EAAO,EAAK,KACZ,EAAa,GAIjB,GAAI,EAAK,WAAa,UAAY,EAAK,WAAa,QAElD,MAAO,CAAE,SADQ,MAAM,KAAK,QAAQ,KAAK,KAAK,SAAU,KAAK,QAAQ,EAAQ,EAAM,EAAQ,EAAM,CAAK,CAAC,EACpF,YAAW,EAGhC,QAAS,EAAM,GAAK,IAAO,CACzB,IAAM,EAAU,KAAK,QAAQ,EAAQ,IAAK,EAAM,SAAU,QAAS,EAAG,EAAQ,EAAM,EAAa,EAAQ,IAAI,EACvG,EAAW,MAAM,KAAK,QAAQ,KAAK,KAAK,SAAU,CAAO,EACzD,EAAW,EAAS,QAAQ,IAAI,UAAU,EAChD,GAAI,CAAC,EAAU,IAAI,EAAS,MAAM,GAAK,IAAa,MAAQ,GAAO,EAAG,MAAO,CAAE,WAAU,YAAW,EAEpG,MAAM,EAAS,MAAM,OAAO,EAAE,MAAM,IAAM,EAAE,EAC5C,IAAM,EAAO,IAAI,IAAI,EAAU,CAAM,EACrC,GAAI,EAAK,SAAW,EAAO,OAAQ,EAAa,GAChD,GAAI,EAAS,SAAW,MAAS,EAAS,SAAW,KAAO,EAAS,SAAW,MAAQ,IAAW,OACjG,EAAS,MACT,EAAO,OAET,EAAS,GAIL,OAAO,CAAC,EAAU,EAAmB,EAAgB,EAA2B,EAA+B,CACrH,IAAM,EAAU,IAAI,QAAQ,EAAK,OAAO,EAClC,EAAS,IAAI,IAAI,CAAG,EACpB,EAAY,KAAK,QAAQ,SAAS,KAAK,QAAQ,EAAE,OAAO,eAC9D,GAAI,IAAU,KACZ,EAAQ,OAAO,eAAe,EACzB,QAAI,IAAc,QAGvB,EAAO,aAAa,IAAI,eAAgB,CAAK,EAE7C,OAAQ,IAAI,gBAAiB,UAAU,GAAO,EAEhD,OAAO,IAAI,QAAQ,EAAQ,IAAK,EAAM,SAAQ,OAAM,SAAQ,CAAC,EAEjE,CAEA,IAAM,EAAY,IAAI,IAAI,CAAC,IAAK,IAAK,IAAK,IAAK,GAAG,CAAC,EAG7C,EAAoB,IAE1B,SAAS,CAAQ,CAAC,EAAkB,EAA2B,CAC7D,MAAO,GAAG,IAAW,IAAoB,IAG3C,SAAS,CAAO,CAAC,EAA+B,CAC9C,IAAM,EAAK,OAAO,IAAS,UAAY,IAAS,KAAO,EAAK,GAAK,EACjE,GAAI,IAAO,QAAa,IAAO,MAAQ,IAAO,GAC5C,MAAU,UAAU,mEAAmE,EAEzF,OAAO,OAAO,CAAE",
-  "debugId": "8446AA4F9D5266BC64756E2164756E21",
+  "debugId": "569AA5FFD1D163D264756E2164756E21",
   "names": []
 }

package/dist/{chunk-ph793v5g.js → chunk-1v70g3kn.js}

@@ -1,4 +1,4 @@
 // @bun
-import{h as ps}from"./chunk-1mg3x0j0.js";import{A as ys,B as Zr,C as ro,i as Se,k as X,l as qs,m as Fs,n as Ws,p as Oo,q as Ko,r as as,s as ws,t as gt,u as Us,v as lo,w as Qt,x as ls,y as Es,z as Ps}from"./chunk-8a72czrb.js";import{D as us}from"./chunk-ma2sders.js";import{E as $o,F as Jr,H as cs,L as dt,P as k}from"./chunk-yqf1k3kb.js";import{Q as hs}from"./chunk-4x22y92r.js";import{R as Xr}from"./chunk-dm61gz7e.js";import"./chunk-czw7kqtp.js";import"./chunk-bwh1n2cj.js";import{U as Bs}from"./chunk-6dtq4h9p.js";import"./chunk-kkymwxt2.js";import{ba as Hr}from"./chunk-0sjz2g5b.js";import{ma as ds}from"./chunk-pchb1awj.js";import{Kl as y}from"./chunk-jmgjhfya.js";var Z=y(($e)=>{Object.defineProperty($e,"__esModule",{value:!0});$e.resolveHttpAuthSchemeConfig=$e.resolveStsAuthConfig=$e.defaultSTSHttpAuthSchemeProvider=$e.defaultSTSHttpAuthSchemeParametersProvider=void 0;var bo=X(),J=$o(),ho=C(),No=async(e,t,r)=>{return{operation:(0,J.getSmithyContext)(t).operation,region:await(0,J.normalizeProvider)(e.region)()||(()=>{throw Error("expected `region` to be configured for `aws.auth#sigv4`")})()}};$e.defaultSTSHttpAuthSchemeParametersProvider=No;function qo(e){return{schemeId:"aws.auth#sigv4",signingProperties:{name:"sts",region:e.region},propertiesExtractor:(t,r)=>({signingProperties:{config:t,context:r}})}}function Fo(e){return{schemeId:"smithy.api#noAuth"}}var Wo=(e)=>{let t=[];switch(e.operation){case"AssumeRoleWithWebIdentity":{t.push(Fo(e));break}default:t.push(qo(e))}return t};$e.defaultSTSHttpAuthSchemeProvider=Wo;var wo=(e)=>Object.assign(e,{stsClientCtor:ho.STSClient});$e.resolveStsAuthConfig=wo;var Uo=(e)=>{let t=$e.resolveStsAuthConfig(e),r=(0,bo.resolveAwsSdkSigV4Config)(t);return Object.assign(r,{authSchemePreference:(0,J.normalizeProvider)(e.authSchemePreference??[])})};$e.resolveHttpAuthSchemeConfig=Uo});var f=y((Ne)=>{Object.defineProperty(Ne,"__esModule",{value:!0});Ne.commonParams=Ne.resolveClientEndpointParameters=void 0;var Lo=(e)=>{return Object.assign(e,{useDualstackEndpoint:e.useDualstackEndpoint??!1,useFipsEndpoint:e.useFipsEndpoint??!1,useGlobalEndpoint:e.useGlobalEndpoint??!1,defaultSigningName:"sts"})};Ne.resolveClientEndpointParameters=Lo;Ne.commonParams={UseGlobalEndpoint:{type:"builtInParams",name:"useGlobalEndpoint"},UseFIPS:{type:"builtInParams",name:"useFipsEndpoint"},Endpoint:{type:"builtInParams",name:"endpoint"},Region:{type:"builtInParams",name:"region"},UseDualStack:{type:"builtInParams",name:"useDualstackEndpoint"}}});var et=y((Ce)=>{Object.defineProperty(Ce,"__esModule",{value:!0});Ce.ruleSet=void 0;var Ve="required",o="type",n="fn",i="argv",v="ref",Fe=!1,ee=!0,S="booleanEquals",p="stringEquals",ze="sigv4",Be="sts",ge="us-east-1",c="endpoint",We="https://sts.{Region}.{PartitionResult#dnsSuffix}",R="tree",M="error",oe="getAttr",we={[Ve]:!1,[o]:"string"},te={[Ve]:!0,default:!1,[o]:"boolean"},Qe={[v]:"Endpoint"},Ue={[n]:"isSet",[i]:[{[v]:"Region"}]},l={[v]:"Region"},Me={[n]:"aws.partition",[i]:[l],assign:"PartitionResult"},Ye={[v]:"UseFIPS"},He={[v]:"UseDualStack"},P={url:"https://sts.amazonaws.com",properties:{authSchemes:[{name:ze,signingName:Be,signingRegion:ge}]},headers:{}},_={},ke={conditions:[{[n]:p,[i]:[l,"aws-global"]}],[c]:P,[o]:c},Je={[n]:S,[i]:[Ye,!0]},Xe={[n]:S,[i]:[He,!0]},Le={[n]:oe,[i]:[{[v]:"PartitionResult"},"supportsFIPS"]},Ze={[v]:"PartitionResult"},je={[n]:S,[i]:[!0,{[n]:oe,[i]:[Ze,"supportsDualStack"]}]},Ge=[{[n]:"isSet",[i]:[Qe]}],Oe=[Je],Ke=[Xe],Go={version:"1.0",parameters:{Region:we,UseDualStack:te,UseFIPS:te,Endpoint:we,UseGlobalEndpoint:te},rules:[{conditions:[{[n]:S,[i]:[{[v]:"UseGlobalEndpoint"},ee]},{[n]:"not",[i]:Ge},Ue,Me,{[n]:S,[i]:[Ye,Fe]},{[n]:S,[i]:[He,Fe]}],rules:[{conditions:[{[n]:p,[i]:[l,"ap-northeast-1"]}],endpoint:P,[o]:c},{conditions:[{[n]:p,[i]:[l,"ap-south-1"]}],endpoint:P,[o]:c},{conditions:[{[n]:p,[i]:[l,"ap-southeast-1"]}],endpoint:P,[o]:c},{conditions:[{[n]:p,[i]:[l,"ap-southeast-2"]}],endpoint:P,[o]:c},ke,{conditions:[{[n]:p,[i]:[l,"ca-central-1"]}],endpoint:P,[o]:c},{conditions:[{[n]:p,[i]:[l,"eu-central-1"]}],endpoint:P,[o]:c},{conditions:[{[n]:p,[i]:[l,"eu-north-1"]}],endpoint:P,[o]:c},{conditions:[{[n]:p,[i]:[l,"eu-west-1"]}],endpoint:P,[o]:c},{conditions:[{[n]:p,[i]:[l,"eu-west-2"]}],endpoint:P,[o]:c},{conditions:[{[n]:p,[i]:[l,"eu-west-3"]}],endpoint:P,[o]:c},{conditions:[{[n]:p,[i]:[l,"sa-east-1"]}],endpoint:P,[o]:c},{conditions:[{[n]:p,[i]:[l,ge]}],endpoint:P,[o]:c},{conditions:[{[n]:p,[i]:[l,"us-east-2"]}],endpoint:P,[o]:c},{conditions:[{[n]:p,[i]:[l,"us-west-1"]}],endpoint:P,[o]:c},{conditions:[{[n]:p,[i]:[l,"us-west-2"]}],endpoint:P,[o]:c},{endpoint:{url:We,properties:{authSchemes:[{name:ze,signingName:Be,signingRegion:"{Region}"}]},headers:_},[o]:c}],[o]:R},{conditions:Ge,rules:[{conditions:Oe,error:"Invalid Configuration: FIPS and custom endpoint are not supported",[o]:M},{conditions:Ke,error:"Invalid Configuration: Dualstack and custom endpoint are not supported",[o]:M},{endpoint:{url:Qe,properties:_,headers:_},[o]:c}],[o]:R},{conditions:[Ue],rules:[{conditions:[Me],rules:[{conditions:[Je,Xe],rules:[{conditions:[{[n]:S,[i]:[ee,Le]},je],rules:[{endpoint:{url:"https://sts-fips.{Region}.{PartitionResult#dualStackDnsSuffix}",properties:_,headers:_},[o]:c}],[o]:R},{error:"FIPS and DualStack are enabled, but this partition does not support one or both",[o]:M}],[o]:R},{conditions:Oe,rules:[{conditions:[{[n]:S,[i]:[Le,ee]}],rules:[{conditions:[{[n]:p,[i]:[{[n]:oe,[i]:[Ze,"name"]},"aws-us-gov"]}],endpoint:{url:"https://sts.{Region}.amazonaws.com",properties:_,headers:_},[o]:c},{endpoint:{url:"https://sts-fips.{Region}.{PartitionResult#dnsSuffix}",properties:_,headers:_},[o]:c}],[o]:R},{error:"FIPS is enabled but this partition does not support FIPS",[o]:M}],[o]:R},{conditions:Ke,rules:[{conditions:[je],rules:[{endpoint:{url:"https://sts.{Region}.{PartitionResult#dualStackDnsSuffix}",properties:_,headers:_},[o]:c}],[o]:R},{error:"DualStack is enabled but this partition does not support DualStack",[o]:M}],[o]:R},ke,{endpoint:{url:We,properties:_,headers:_},[o]:c}],[o]:R}],[o]:R},{error:"Invalid Configuration: Missing Region",[o]:M}]};Ce.ruleSet=Go});var rt=y((tt)=>{Object.defineProperty(tt,"__esModule",{value:!0});tt.defaultEndpointResolver=void 0;var Vo=Ko(),re=Oo(),zo=et(),Bo=new re.EndpointCache({size:50,params:["Endpoint","Region","UseDualStack","UseFIPS","UseGlobalEndpoint"]}),go=(e,t={})=>{return Bo.get(e,()=>(0,re.resolveEndpoint)(zo.ruleSet,{endpointParams:e,logger:t.logger}))};tt.defaultEndpointResolver=go;re.customEndpointFunctions.aws=Vo.awsEndpointFunctions});var O=y((ne)=>{Object.defineProperty(ne,"__esModule",{value:!0});ne.STSServiceException=ne.__ServiceException=void 0;var st=k();Object.defineProperty(ne,"__ServiceException",{enumerable:!0,get:function(){return st.ServiceException}});class se extends st.ServiceException{constructor(e){super(e);Object.setPrototypeOf(this,se.prototype)}}ne.STSServiceException=se});var Ee=y((it)=>{Object.defineProperty(it,"__esModule",{value:!0});it.IDPCommunicationErrorException=it.InvalidIdentityTokenException=it.IDPRejectedClaimException=it.RegionDisabledException=it.PackedPolicyTooLargeException=it.MalformedPolicyDocumentException=it.ExpiredTokenException=void 0;var A=O();class ie extends A.STSServiceException{name="ExpiredTokenException";$fault="client";constructor(e){super({name:"ExpiredTokenException",$fault:"client",...e});Object.setPrototypeOf(this,ie.prototype)}}it.ExpiredTokenException=ie;class ce extends A.STSServiceException{name="MalformedPolicyDocumentException";$fault="client";constructor(e){super({name:"MalformedPolicyDocumentException",$fault:"client",...e});Object.setPrototypeOf(this,ce.prototype)}}it.MalformedPolicyDocumentException=ce;class de extends A.STSServiceException{name="PackedPolicyTooLargeException";$fault="client";constructor(e){super({name:"PackedPolicyTooLargeException",$fault:"client",...e});Object.setPrototypeOf(this,de.prototype)}}it.PackedPolicyTooLargeException=de;class ae extends A.STSServiceException{name="RegionDisabledException";$fault="client";constructor(e){super({name:"RegionDisabledException",$fault:"client",...e});Object.setPrototypeOf(this,ae.prototype)}}it.RegionDisabledException=ae;class ue extends A.STSServiceException{name="IDPRejectedClaimException";$fault="client";constructor(e){super({name:"IDPRejectedClaimException",$fault:"client",...e});Object.setPrototypeOf(this,ue.prototype)}}it.IDPRejectedClaimException=ue;class pe extends A.STSServiceException{name="InvalidIdentityTokenException";$fault="client";constructor(e){super({name:"InvalidIdentityTokenException",$fault:"client",...e});Object.setPrototypeOf(this,pe.prototype)}}it.InvalidIdentityTokenException=pe;class le extends A.STSServiceException{name="IDPCommunicationErrorException";$fault="client";constructor(e){super({name:"IDPCommunicationErrorException",$fault:"client",...e});Object.setPrototypeOf(this,le.prototype)}}it.IDPCommunicationErrorException=le});var Te=y((Tt)=>{Object.defineProperty(Tt,"__esModule",{value:!0});Tt.AssumeRoleWithWebIdentity$=Tt.AssumeRole$=Tt.Tag$=Tt.ProvidedContext$=Tt.PolicyDescriptorType$=Tt.Credentials$=Tt.AssumeRoleWithWebIdentityResponse$=Tt.AssumeRoleWithWebIdentityRequest$=Tt.AssumeRoleResponse$=Tt.AssumeRoleRequest$=Tt.AssumedRoleUser$=Tt.errorTypeRegistries=Tt.RegionDisabledException$=Tt.PackedPolicyTooLargeException$=Tt.MalformedPolicyDocumentException$=Tt.InvalidIdentityTokenException$=Tt.IDPRejectedClaimException$=Tt.IDPCommunicationErrorException$=Tt.ExpiredTokenException$=Tt.STSServiceException$=void 0;var Co="Arn",fo="AccessKeyId",er="AssumeRole",tr="AssumedRoleId",or="AssumeRoleRequest",rr="AssumeRoleResponse",Pe="AssumedRoleUser",sr="AssumeRoleWithWebIdentity",nr="AssumeRoleWithWebIdentityRequest",ir="AssumeRoleWithWebIdentityResponse",cr="Audience",ye="Credentials",dr="ContextAssertion",at="DurationSeconds",ar="Expiration",ur="ExternalId",pr="ExpiredTokenException",lr="IDPCommunicationErrorException",Er="IDPRejectedClaimException",Pr="InvalidIdentityTokenException",yr="Key",_r="MalformedPolicyDocumentException",ut="Policy",pt="PolicyArns",Ir="ProviderArn",Rr="ProvidedContexts",Tr="ProvidedContextsListType",Sr="ProvidedContext",vr="PolicyDescriptorType",xr="ProviderId",lt="PackedPolicySize",Dr="PackedPolicyTooLargeException",mr="Provider",Et="RoleArn",Ar="RegionDisabledException",Pt="RoleSessionName",$r="SecretAccessKey",br="SubjectFromWebIdentityToken",_e="SourceIdentity",hr="SerialNumber",Nr="SessionToken",qr="Tags",Fr="TokenCode",Wr="TransitiveTagKeys",wr="Tag",Ur="Value",Mr="WebIdentityToken",kr="arn",Lr="accessKeySecretType",$="awsQueryError",b="client",jr="clientTokenType",h="error",N="httpError",q="message",Gr="policyDescriptorListType",yt="smithy.ts.sdk.synthetic.com.amazonaws.sts",Or="tagListType",d="com.amazonaws.sts",_t=dt(),F=Ee(),Kr=O(),It=_t.TypeRegistry.for(yt);Tt.STSServiceException$=[-3,yt,"STSServiceException",0,[],[]];It.registerError(Tt.STSServiceException$,Kr.STSServiceException);var x=_t.TypeRegistry.for(d);Tt.ExpiredTokenException$=[-3,d,pr,{[$]:["ExpiredTokenException",400],[h]:b,[N]:400},[q],[0]];x.registerError(Tt.ExpiredTokenException$,F.ExpiredTokenException);Tt.IDPCommunicationErrorException$=[-3,d,lr,{[$]:["IDPCommunicationError",400],[h]:b,[N]:400},[q],[0]];x.registerError(Tt.IDPCommunicationErrorException$,F.IDPCommunicationErrorException);Tt.IDPRejectedClaimException$=[-3,d,Er,{[$]:["IDPRejectedClaim",403],[h]:b,[N]:403},[q],[0]];x.registerError(Tt.IDPRejectedClaimException$,F.IDPRejectedClaimException);Tt.InvalidIdentityTokenException$=[-3,d,Pr,{[$]:["InvalidIdentityToken",400],[h]:b,[N]:400},[q],[0]];x.registerError(Tt.InvalidIdentityTokenException$,F.InvalidIdentityTokenException);Tt.MalformedPolicyDocumentException$=[-3,d,_r,{[$]:["MalformedPolicyDocument",400],[h]:b,[N]:400},[q],[0]];x.registerError(Tt.MalformedPolicyDocumentException$,F.MalformedPolicyDocumentException);Tt.PackedPolicyTooLargeException$=[-3,d,Dr,{[$]:["PackedPolicyTooLarge",400],[h]:b,[N]:400},[q],[0]];x.registerError(Tt.PackedPolicyTooLargeException$,F.PackedPolicyTooLargeException);Tt.RegionDisabledException$=[-3,d,Ar,{[$]:["RegionDisabledException",403],[h]:b,[N]:403},[q],[0]];x.registerError(Tt.RegionDisabledException$,F.RegionDisabledException);Tt.errorTypeRegistries=[It,x];var Vr=[0,d,Lr,8,0],zr=[0,d,jr,8,0];Tt.AssumedRoleUser$=[3,d,Pe,0,[tr,Co],[0,0],2];Tt.AssumeRoleRequest$=[3,d,or,0,[Et,Pt,pt,ut,at,qr,Wr,ur,hr,Fr,_e,Rr],[0,0,()=>Rt,0,1,()=>gr,64,0,0,0,0,()=>Br],2];Tt.AssumeRoleResponse$=[3,d,rr,0,[ye,Pe,lt,_e],[[()=>Tt.Credentials$,0],()=>Tt.AssumedRoleUser$,1,0]];Tt.AssumeRoleWithWebIdentityRequest$=[3,d,nr,0,[Et,Pt,Mr,xr,pt,ut,at],[0,0,[()=>zr,0],0,()=>Rt,0,1],3];Tt.AssumeRoleWithWebIdentityResponse$=[3,d,ir,0,[ye,br,Pe,lt,mr,cr,_e],[[()=>Tt.Credentials$,0],0,()=>Tt.AssumedRoleUser$,1,0,0,0]];Tt.Credentials$=[3,d,ye,0,[fo,$r,Nr,ar],[0,[()=>Vr,0],0,4],4];Tt.PolicyDescriptorType$=[3,d,vr,0,[kr],[0]];Tt.ProvidedContext$=[3,d,Sr,0,[Ir,dr],[0,0]];Tt.Tag$=[3,d,wr,0,[yr,Ur],[0,0],2];var Rt=[1,d,Gr,0,()=>Tt.PolicyDescriptorType$],Br=[1,d,Tr,0,()=>Tt.ProvidedContext$],gr=[1,d,Or,0,()=>Tt.Tag$];Tt.AssumeRole$=[9,d,er,0,()=>Tt.AssumeRoleRequest$,()=>Tt.AssumeRoleResponse$];Tt.AssumeRoleWithWebIdentity$=[9,d,sr,0,()=>Tt.AssumeRoleWithWebIdentityRequest$,()=>Tt.AssumeRoleWithWebIdentityResponse$]});var Ot=y((jt)=>{Object.defineProperty(jt,"__esModule",{value:!0});jt.getRuntimeConfig=void 0;var Cr=X(),fr=Zr(),es=Se(),ts=k(),os=Xr(),kt=Jr(),Lt=Hr(),rs=Z(),ss=rt(),ns=Te(),is=(e)=>{return{apiVersion:"2011-06-15",base64Decoder:e?.base64Decoder??kt.fromBase64,base64Encoder:e?.base64Encoder??kt.toBase64,disableHostPrefix:e?.disableHostPrefix??!1,endpointProvider:e?.endpointProvider??ss.defaultEndpointResolver,extensions:e?.extensions??[],httpAuthSchemeProvider:e?.httpAuthSchemeProvider??rs.defaultSTSHttpAuthSchemeProvider,httpAuthSchemes:e?.httpAuthSchemes??[{schemeId:"aws.auth#sigv4",identityProvider:(t)=>t.getIdentityProvider("aws.auth#sigv4"),signer:new Cr.AwsSdkSigV4Signer},{schemeId:"smithy.api#noAuth",identityProvider:(t)=>t.getIdentityProvider("smithy.api#noAuth")||(async()=>({})),signer:new es.NoAuthSigner}],logger:e?.logger??new ts.NoOpLogger,protocol:e?.protocol??fr.AwsQueryProtocol,protocolSettings:e?.protocolSettings??{defaultNamespace:"com.amazonaws.sts",errorTypeRegistries:ns.errorTypeRegistries,xmlNamespace:"https://sts.amazonaws.com/doc/2011-06-15/",version:"2011-06-15",serviceTarget:"AWSSecurityTokenServiceV20110615"},serviceId:e?.serviceId??"STS",urlParser:e?.urlParser??os.parseUrl,utf8Decoder:e?.utf8Decoder??Lt.fromUtf8,utf8Encoder:e?.utf8Encoder??Lt.toUtf8}};jt.getRuntimeConfig=is});var Jt=y((Yt)=>{Object.defineProperty(Yt,"__esModule",{value:!0});Yt.getRuntimeConfig=void 0;var _s=ds(),Is=_s.__importDefault(ps()),ve=X(),Kt=ls(),K=gt(),Rs=Se(),Ts=Es(),Vt=Qt(),W=us(),zt=cs(),Bt=k(),Ss=Ps(),vs=ys(),xs=as(),Ds=Ot(),ms=(e)=>{(0,Bt.emitWarningIfUnsupportedVersion)(process.version);let t=(0,vs.resolveDefaultsModeConfig)(e),r=()=>t().then(Bt.loadConfigsForDefaultMode),a=(0,Ds.getRuntimeConfig)(e);(0,ve.emitWarningIfUnsupportedVersion)(process.version);let s={profile:e?.profile,logger:a.logger};return{...a,...e,runtime:"node",defaultsMode:t,authSchemePreference:e?.authSchemePreference??(0,W.loadConfig)(ve.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS,s),bodyLengthChecker:e?.bodyLengthChecker??Ss.calculateBodyLength,defaultUserAgentProvider:e?.defaultUserAgentProvider??(0,Kt.createDefaultUserAgentProvider)({serviceId:a.serviceId,clientVersion:Is.default.version}),httpAuthSchemes:e?.httpAuthSchemes??[{schemeId:"aws.auth#sigv4",identityProvider:(E)=>E.getIdentityProvider("aws.auth#sigv4")||(async(u)=>await e.credentialDefaultProvider(u?.__config||{})()),signer:new ve.AwsSdkSigV4Signer},{schemeId:"smithy.api#noAuth",identityProvider:(E)=>E.getIdentityProvider("smithy.api#noAuth")||(async()=>({})),signer:new Rs.NoAuthSigner}],maxAttempts:e?.maxAttempts??(0,W.loadConfig)(Vt.NODE_MAX_ATTEMPT_CONFIG_OPTIONS,e),region:e?.region??(0,W.loadConfig)(K.NODE_REGION_CONFIG_OPTIONS,{...K.NODE_REGION_CONFIG_FILE_OPTIONS,...s}),requestHandler:zt.NodeHttpHandler.create(e?.requestHandler??r),retryMode:e?.retryMode??(0,W.loadConfig)({...Vt.NODE_RETRY_MODE_CONFIG_OPTIONS,default:async()=>(await r()).retryMode||xs.DEFAULT_RETRY_MODE},e),sha256:e?.sha256??Ts.Hash.bind(null,"sha256"),streamCollector:e?.streamCollector??zt.streamCollector,useDualstackEndpoint:e?.useDualstackEndpoint??(0,W.loadConfig)(K.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS,s),useFipsEndpoint:e?.useFipsEndpoint??(0,W.loadConfig)(K.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS,s),userAgentAppId:e?.userAgentAppId??(0,W.loadConfig)(Kt.NODE_APP_ID_CONFIG_OPTIONS,s)}};Yt.getRuntimeConfig=ms});var Ct=y((Xt)=>{Object.defineProperty(Xt,"__esModule",{value:!0});Xt.resolveHttpAuthRuntimeConfig=Xt.getHttpAuthExtensionConfiguration=void 0;var As=(e)=>{let{httpAuthSchemes:t,httpAuthSchemeProvider:r,credentials:a}=e;return{setHttpAuthScheme(s){let E=t.findIndex((u)=>u.schemeId===s.schemeId);if(E===-1)t.push(s);else t.splice(E,1,s)},httpAuthSchemes(){return t},setHttpAuthSchemeProvider(s){r=s},httpAuthSchemeProvider(){return r},setCredentials(s){a=s},credentials(){return a}}};Xt.getHttpAuthExtensionConfiguration=As;var $s=(e)=>{return{httpAuthSchemes:e.httpAuthSchemes(),httpAuthSchemeProvider:e.httpAuthSchemeProvider(),credentials:e.credentials()}};Xt.resolveHttpAuthRuntimeConfig=$s});var io=y((so)=>{Object.defineProperty(so,"__esModule",{value:!0});so.resolveRuntimeExtensions=void 0;var ft=ro(),eo=hs(),to=k(),oo=Ct(),Ns=(e,t)=>{let r=Object.assign((0,ft.getAwsRegionExtensionConfiguration)(e),(0,to.getDefaultExtensionConfiguration)(e),(0,eo.getHttpHandlerExtensionConfiguration)(e),(0,oo.getHttpAuthExtensionConfiguration)(e));return t.forEach((a)=>a.configure(r)),Object.assign(e,(0,ft.resolveAwsRegionExtensionConfiguration)(r),(0,to.resolveDefaultRuntimeConfig)(r),(0,eo.resolveHttpHandlerRuntimeConfig)(r),(0,oo.resolveHttpAuthRuntimeConfig)(r))};so.resolveRuntimeExtensions=Ns});var C=y((De)=>{Object.defineProperty(De,"__esModule",{value:!0});De.STSClient=De.__Client=void 0;var co=qs(),Ms=Fs(),ks=Ws(),ao=ws(),Ls=gt(),xe=Se(),js=dt(),Gs=Us(),Os=lo(),uo=Qt(),Eo=k();Object.defineProperty(De,"__Client",{enumerable:!0,get:function(){return Eo.Client}});var po=Z(),Ks=f(),Vs=Jt(),zs=io();class Po extends Eo.Client{config;constructor(...[e]){let t=(0,Vs.getRuntimeConfig)(e||{});super(t);this.initConfig=t;let r=(0,Ks.resolveClientEndpointParameters)(t),a=(0,ao.resolveUserAgentConfig)(r),s=(0,uo.resolveRetryConfig)(a),E=(0,Ls.resolveRegionConfig)(s),u=(0,co.resolveHostHeaderConfig)(E),T=(0,Os.resolveEndpointConfig)(u),D=(0,po.resolveHttpAuthSchemeConfig)(T),m=(0,zs.resolveRuntimeExtensions)(D,e?.extensions||[]);this.config=m,this.middlewareStack.use((0,js.getSchemaSerdePlugin)(this.config)),this.middlewareStack.use((0,ao.getUserAgentPlugin)(this.config)),this.middlewareStack.use((0,uo.getRetryPlugin)(this.config)),this.middlewareStack.use((0,Gs.getContentLengthPlugin)(this.config)),this.middlewareStack.use((0,co.getHostHeaderPlugin)(this.config)),this.middlewareStack.use((0,Ms.getLoggerPlugin)(this.config)),this.middlewareStack.use((0,ks.getRecursionDetectionPlugin)(this.config)),this.middlewareStack.use((0,xe.getHttpAuthSchemeEndpointRuleSetPlugin)(this.config,{httpAuthSchemeParametersProvider:po.defaultSTSHttpAuthSchemeParametersProvider,identityProviderConfigProvider:async(U)=>new xe.DefaultIdentityProviderConfig({"aws.auth#sigv4":U.credentials})})),this.middlewareStack.use((0,xe.getHttpSigningPlugin)(this.config))}destroy(){super.destroy()}}De.STSClient=Po});var nn=y((I)=>{var w=C(),z=k(),_o=lo(),Io=f(),L=Te(),V=Ee(),me=Bs(),gs=ro(),Qs=O();class B extends z.Command.classBuilder().ep(Io.commonParams).m(function(e,t,r,a){return[_o.getEndpointPlugin(r,e.getEndpointParameterInstructions())]}).s("AWSSecurityTokenServiceV20110615","AssumeRole",{}).n("STSClient","AssumeRoleCommand").sc(L.AssumeRole$).build(){}class g extends z.Command.classBuilder().ep(Io.commonParams).m(function(e,t,r,a){return[_o.getEndpointPlugin(r,e.getEndpointParameterInstructions())]}).s("AWSSecurityTokenServiceV20110615","AssumeRoleWithWebIdentity",{}).n("STSClient","AssumeRoleWithWebIdentityCommand").sc(L.AssumeRoleWithWebIdentity$).build(){}var Ys={AssumeRoleCommand:B,AssumeRoleWithWebIdentityCommand:g};class Ae extends w.STSClient{}z.createAggregatedClient(Ys,Ae);var Ro=(e)=>{if(typeof e?.Arn==="string"){let t=e.Arn.split(":");if(t.length>4&&t[4]!=="")return t[4]}return},To=async(e,t,r,a={})=>{let s=typeof e==="function"?await e():e,E=typeof t==="function"?await t():t,u="",T=s??E??(u=await gs.stsRegionDefaultResolver(a)());return r?.debug?.("@aws-sdk/client-sts::resolveRegion","accepting first of:",`${s} (credential provider clientConfig)`,`${E} (contextual client)`,`${u} (STS default: AWS_REGION, profile region, or us-east-1)`),T},Hs=(e,t)=>{let r,a;return async(s,E)=>{if(a=s,!r){let{logger:U=e?.parentClientConfig?.logger,profile:j=e?.parentClientConfig?.profile,region:Q,requestHandler:G=e?.parentClientConfig?.requestHandler,credentialProviderLogger:Y,userAgentAppId:H=e?.parentClientConfig?.userAgentAppId}=e,mo=await To(Q,e?.parentClientConfig?.region,Y,{logger:U,profile:j}),Ao=!So(G);r=new t({...e,userAgentAppId:H,profile:j,credentialDefaultProvider:()=>async()=>a,region:mo,requestHandler:Ao?G:void 0,logger:U})}let{Credentials:u,AssumedRoleUser:T}=await r.send(new B(E));if(!u||!u.AccessKeyId||!u.SecretAccessKey)throw Error(`Invalid response from STS.assumeRole call with role ${E.RoleArn}`);let D=Ro(T),m={accessKeyId:u.AccessKeyId,secretAccessKey:u.SecretAccessKey,sessionToken:u.SessionToken,expiration:u.Expiration,...u.CredentialScope&&{credentialScope:u.CredentialScope},...D&&{accountId:D}};return me.setCredentialFeature(m,"CREDENTIALS_STS_ASSUME_ROLE","i"),m}},Js=(e,t)=>{let r;return async(a)=>{if(!r){let{logger:D=e?.parentClientConfig?.logger,profile:m=e?.parentClientConfig?.profile,region:U,requestHandler:j=e?.parentClientConfig?.requestHandler,credentialProviderLogger:Q,userAgentAppId:G=e?.parentClientConfig?.userAgentAppId}=e,Y=await To(U,e?.parentClientConfig?.region,Q,{logger:D,profile:m}),H=!So(j);r=new t({...e,userAgentAppId:G,profile:m,region:Y,requestHandler:H?j:void 0,logger:D})}let{Credentials:s,AssumedRoleUser:E}=await r.send(new g(a));if(!s||!s.AccessKeyId||!s.SecretAccessKey)throw Error(`Invalid response from STS.assumeRoleWithWebIdentity call with role ${a.RoleArn}`);let u=Ro(E),T={accessKeyId:s.AccessKeyId,secretAccessKey:s.SecretAccessKey,sessionToken:s.SessionToken,expiration:s.Expiration,...s.CredentialScope&&{credentialScope:s.CredentialScope},...u&&{accountId:u}};if(u)me.setCredentialFeature(T,"RESOLVED_ACCOUNT_ID","T");return me.setCredentialFeature(T,"CREDENTIALS_STS_ASSUME_ROLE_WEB_ID","k"),T}},So=(e)=>{return e?.metadata?.handlerProtocol==="h2"},vo=(e,t)=>{if(!t)return e;else return class extends e{constructor(a){super(a);for(let s of t)this.middlewareStack.use(s)}}},xo=(e={},t)=>Hs(e,vo(w.STSClient,t)),Do=(e={},t)=>Js(e,vo(w.STSClient,t)),Xs=(e)=>(t)=>e({roleAssumer:xo(t),roleAssumerWithWebIdentity:Do(t),...t});I.$Command=z.Command;I.STSServiceException=Qs.STSServiceException;I.AssumeRoleCommand=B;I.AssumeRoleWithWebIdentityCommand=g;I.STS=Ae;I.decorateDefaultCredentialProvider=Xs;I.getDefaultRoleAssumer=xo;I.getDefaultRoleAssumerWithWebIdentity=Do;Object.prototype.hasOwnProperty.call(w,"__proto__")&&!Object.prototype.hasOwnProperty.call(I,"__proto__")&&Object.defineProperty(I,"__proto__",{enumerable:!0,value:w.__proto__});Object.keys(w).forEach(function(e){if(e!=="default"&&!Object.prototype.hasOwnProperty.call(I,e))I[e]=w[e]});Object.prototype.hasOwnProperty.call(L,"__proto__")&&!Object.prototype.hasOwnProperty.call(I,"__proto__")&&Object.defineProperty(I,"__proto__",{enumerable:!0,value:L.__proto__});Object.keys(L).forEach(function(e){if(e!=="default"&&!Object.prototype.hasOwnProperty.call(I,e))I[e]=L[e]});Object.prototype.hasOwnProperty.call(V,"__proto__")&&!Object.prototype.hasOwnProperty.call(I,"__proto__")&&Object.defineProperty(I,"__proto__",{enumerable:!0,value:V.__proto__});Object.keys(V).forEach(function(e){if(e!=="default"&&!Object.prototype.hasOwnProperty.call(I,e))I[e]=V[e]})});export default nn();
+import{h as ps}from"./chunk-4j7zwk5c.js";import{A as ys,B as Zr,C as ro,i as Se,k as X,l as qs,m as Fs,n as Ws,p as Oo,q as Ko,r as as,s as ws,t as gt,u as Us,v as lo,w as Qt,x as ls,y as Es,z as Ps}from"./chunk-esgq4rbk.js";import{D as us}from"./chunk-97hpxdgf.js";import{E as $o,F as Jr,H as cs,L as dt,P as k}from"./chunk-wytpqkss.js";import{Q as hs}from"./chunk-y6q1gv83.js";import{R as Xr}from"./chunk-ashn5jqy.js";import"./chunk-a1fb8zz6.js";import"./chunk-1f9143dv.js";import{U as Bs}from"./chunk-45fbwj3s.js";import"./chunk-x7yrxhk9.js";import{ba as Hr}from"./chunk-znyte3fp.js";import{ma as ds}from"./chunk-h5q6w17p.js";import{Ll as y}from"./chunk-7wkwm0tn.js";var Z=y(($e)=>{Object.defineProperty($e,"__esModule",{value:!0});$e.resolveHttpAuthSchemeConfig=$e.resolveStsAuthConfig=$e.defaultSTSHttpAuthSchemeProvider=$e.defaultSTSHttpAuthSchemeParametersProvider=void 0;var bo=X(),J=$o(),ho=C(),No=async(e,t,r)=>{return{operation:(0,J.getSmithyContext)(t).operation,region:await(0,J.normalizeProvider)(e.region)()||(()=>{throw Error("expected `region` to be configured for `aws.auth#sigv4`")})()}};$e.defaultSTSHttpAuthSchemeParametersProvider=No;function qo(e){return{schemeId:"aws.auth#sigv4",signingProperties:{name:"sts",region:e.region},propertiesExtractor:(t,r)=>({signingProperties:{config:t,context:r}})}}function Fo(e){return{schemeId:"smithy.api#noAuth"}}var Wo=(e)=>{let t=[];switch(e.operation){case"AssumeRoleWithWebIdentity":{t.push(Fo(e));break}default:t.push(qo(e))}return t};$e.defaultSTSHttpAuthSchemeProvider=Wo;var wo=(e)=>Object.assign(e,{stsClientCtor:ho.STSClient});$e.resolveStsAuthConfig=wo;var Uo=(e)=>{let t=$e.resolveStsAuthConfig(e),r=(0,bo.resolveAwsSdkSigV4Config)(t);return Object.assign(r,{authSchemePreference:(0,J.normalizeProvider)(e.authSchemePreference??[])})};$e.resolveHttpAuthSchemeConfig=Uo});var f=y((Ne)=>{Object.defineProperty(Ne,"__esModule",{value:!0});Ne.commonParams=Ne.resolveClientEndpointParameters=void 0;var Lo=(e)=>{return Object.assign(e,{useDualstackEndpoint:e.useDualstackEndpoint??!1,useFipsEndpoint:e.useFipsEndpoint??!1,useGlobalEndpoint:e.useGlobalEndpoint??!1,defaultSigningName:"sts"})};Ne.resolveClientEndpointParameters=Lo;Ne.commonParams={UseGlobalEndpoint:{type:"builtInParams",name:"useGlobalEndpoint"},UseFIPS:{type:"builtInParams",name:"useFipsEndpoint"},Endpoint:{type:"builtInParams",name:"endpoint"},Region:{type:"builtInParams",name:"region"},UseDualStack:{type:"builtInParams",name:"useDualstackEndpoint"}}});var et=y((Ce)=>{Object.defineProperty(Ce,"__esModule",{value:!0});Ce.ruleSet=void 0;var Ve="required",o="type",n="fn",i="argv",v="ref",Fe=!1,ee=!0,S="booleanEquals",p="stringEquals",ze="sigv4",Be="sts",ge="us-east-1",c="endpoint",We="https://sts.{Region}.{PartitionResult#dnsSuffix}",R="tree",M="error",oe="getAttr",we={[Ve]:!1,[o]:"string"},te={[Ve]:!0,default:!1,[o]:"boolean"},Qe={[v]:"Endpoint"},Ue={[n]:"isSet",[i]:[{[v]:"Region"}]},l={[v]:"Region"},Me={[n]:"aws.partition",[i]:[l],assign:"PartitionResult"},Ye={[v]:"UseFIPS"},He={[v]:"UseDualStack"},P={url:"https://sts.amazonaws.com",properties:{authSchemes:[{name:ze,signingName:Be,signingRegion:ge}]},headers:{}},_={},ke={conditions:[{[n]:p,[i]:[l,"aws-global"]}],[c]:P,[o]:c},Je={[n]:S,[i]:[Ye,!0]},Xe={[n]:S,[i]:[He,!0]},Le={[n]:oe,[i]:[{[v]:"PartitionResult"},"supportsFIPS"]},Ze={[v]:"PartitionResult"},je={[n]:S,[i]:[!0,{[n]:oe,[i]:[Ze,"supportsDualStack"]}]},Ge=[{[n]:"isSet",[i]:[Qe]}],Oe=[Je],Ke=[Xe],Go={version:"1.0",parameters:{Region:we,UseDualStack:te,UseFIPS:te,Endpoint:we,UseGlobalEndpoint:te},rules:[{conditions:[{[n]:S,[i]:[{[v]:"UseGlobalEndpoint"},ee]},{[n]:"not",[i]:Ge},Ue,Me,{[n]:S,[i]:[Ye,Fe]},{[n]:S,[i]:[He,Fe]}],rules:[{conditions:[{[n]:p,[i]:[l,"ap-northeast-1"]}],endpoint:P,[o]:c},{conditions:[{[n]:p,[i]:[l,"ap-south-1"]}],endpoint:P,[o]:c},{conditions:[{[n]:p,[i]:[l,"ap-southeast-1"]}],endpoint:P,[o]:c},{conditions:[{[n]:p,[i]:[l,"ap-southeast-2"]}],endpoint:P,[o]:c},ke,{conditions:[{[n]:p,[i]:[l,"ca-central-1"]}],endpoint:P,[o]:c},{conditions:[{[n]:p,[i]:[l,"eu-central-1"]}],endpoint:P,[o]:c},{conditions:[{[n]:p,[i]:[l,"eu-north-1"]}],endpoint:P,[o]:c},{conditions:[{[n]:p,[i]:[l,"eu-west-1"]}],endpoint:P,[o]:c},{conditions:[{[n]:p,[i]:[l,"eu-west-2"]}],endpoint:P,[o]:c},{conditions:[{[n]:p,[i]:[l,"eu-west-3"]}],endpoint:P,[o]:c},{conditions:[{[n]:p,[i]:[l,"sa-east-1"]}],endpoint:P,[o]:c},{conditions:[{[n]:p,[i]:[l,ge]}],endpoint:P,[o]:c},{conditions:[{[n]:p,[i]:[l,"us-east-2"]}],endpoint:P,[o]:c},{conditions:[{[n]:p,[i]:[l,"us-west-1"]}],endpoint:P,[o]:c},{conditions:[{[n]:p,[i]:[l,"us-west-2"]}],endpoint:P,[o]:c},{endpoint:{url:We,properties:{authSchemes:[{name:ze,signingName:Be,signingRegion:"{Region}"}]},headers:_},[o]:c}],[o]:R},{conditions:Ge,rules:[{conditions:Oe,error:"Invalid Configuration: FIPS and custom endpoint are not supported",[o]:M},{conditions:Ke,error:"Invalid Configuration: Dualstack and custom endpoint are not supported",[o]:M},{endpoint:{url:Qe,properties:_,headers:_},[o]:c}],[o]:R},{conditions:[Ue],rules:[{conditions:[Me],rules:[{conditions:[Je,Xe],rules:[{conditions:[{[n]:S,[i]:[ee,Le]},je],rules:[{endpoint:{url:"https://sts-fips.{Region}.{PartitionResult#dualStackDnsSuffix}",properties:_,headers:_},[o]:c}],[o]:R},{error:"FIPS and DualStack are enabled, but this partition does not support one or both",[o]:M}],[o]:R},{conditions:Oe,rules:[{conditions:[{[n]:S,[i]:[Le,ee]}],rules:[{conditions:[{[n]:p,[i]:[{[n]:oe,[i]:[Ze,"name"]},"aws-us-gov"]}],endpoint:{url:"https://sts.{Region}.amazonaws.com",properties:_,headers:_},[o]:c},{endpoint:{url:"https://sts-fips.{Region}.{PartitionResult#dnsSuffix}",properties:_,headers:_},[o]:c}],[o]:R},{error:"FIPS is enabled but this partition does not support FIPS",[o]:M}],[o]:R},{conditions:Ke,rules:[{conditions:[je],rules:[{endpoint:{url:"https://sts.{Region}.{PartitionResult#dualStackDnsSuffix}",properties:_,headers:_},[o]:c}],[o]:R},{error:"DualStack is enabled but this partition does not support DualStack",[o]:M}],[o]:R},ke,{endpoint:{url:We,properties:_,headers:_},[o]:c}],[o]:R}],[o]:R},{error:"Invalid Configuration: Missing Region",[o]:M}]};Ce.ruleSet=Go});var rt=y((tt)=>{Object.defineProperty(tt,"__esModule",{value:!0});tt.defaultEndpointResolver=void 0;var Vo=Ko(),re=Oo(),zo=et(),Bo=new re.EndpointCache({size:50,params:["Endpoint","Region","UseDualStack","UseFIPS","UseGlobalEndpoint"]}),go=(e,t={})=>{return Bo.get(e,()=>(0,re.resolveEndpoint)(zo.ruleSet,{endpointParams:e,logger:t.logger}))};tt.defaultEndpointResolver=go;re.customEndpointFunctions.aws=Vo.awsEndpointFunctions});var O=y((ne)=>{Object.defineProperty(ne,"__esModule",{value:!0});ne.STSServiceException=ne.__ServiceException=void 0;var st=k();Object.defineProperty(ne,"__ServiceException",{enumerable:!0,get:function(){return st.ServiceException}});class se extends st.ServiceException{constructor(e){super(e);Object.setPrototypeOf(this,se.prototype)}}ne.STSServiceException=se});var Ee=y((it)=>{Object.defineProperty(it,"__esModule",{value:!0});it.IDPCommunicationErrorException=it.InvalidIdentityTokenException=it.IDPRejectedClaimException=it.RegionDisabledException=it.PackedPolicyTooLargeException=it.MalformedPolicyDocumentException=it.ExpiredTokenException=void 0;var A=O();class ie extends A.STSServiceException{name="ExpiredTokenException";$fault="client";constructor(e){super({name:"ExpiredTokenException",$fault:"client",...e});Object.setPrototypeOf(this,ie.prototype)}}it.ExpiredTokenException=ie;class ce extends A.STSServiceException{name="MalformedPolicyDocumentException";$fault="client";constructor(e){super({name:"MalformedPolicyDocumentException",$fault:"client",...e});Object.setPrototypeOf(this,ce.prototype)}}it.MalformedPolicyDocumentException=ce;class de extends A.STSServiceException{name="PackedPolicyTooLargeException";$fault="client";constructor(e){super({name:"PackedPolicyTooLargeException",$fault:"client",...e});Object.setPrototypeOf(this,de.prototype)}}it.PackedPolicyTooLargeException=de;class ae extends A.STSServiceException{name="RegionDisabledException";$fault="client";constructor(e){super({name:"RegionDisabledException",$fault:"client",...e});Object.setPrototypeOf(this,ae.prototype)}}it.RegionDisabledException=ae;class ue extends A.STSServiceException{name="IDPRejectedClaimException";$fault="client";constructor(e){super({name:"IDPRejectedClaimException",$fault:"client",...e});Object.setPrototypeOf(this,ue.prototype)}}it.IDPRejectedClaimException=ue;class pe extends A.STSServiceException{name="InvalidIdentityTokenException";$fault="client";constructor(e){super({name:"InvalidIdentityTokenException",$fault:"client",...e});Object.setPrototypeOf(this,pe.prototype)}}it.InvalidIdentityTokenException=pe;class le extends A.STSServiceException{name="IDPCommunicationErrorException";$fault="client";constructor(e){super({name:"IDPCommunicationErrorException",$fault:"client",...e});Object.setPrototypeOf(this,le.prototype)}}it.IDPCommunicationErrorException=le});var Te=y((Tt)=>{Object.defineProperty(Tt,"__esModule",{value:!0});Tt.AssumeRoleWithWebIdentity$=Tt.AssumeRole$=Tt.Tag$=Tt.ProvidedContext$=Tt.PolicyDescriptorType$=Tt.Credentials$=Tt.AssumeRoleWithWebIdentityResponse$=Tt.AssumeRoleWithWebIdentityRequest$=Tt.AssumeRoleResponse$=Tt.AssumeRoleRequest$=Tt.AssumedRoleUser$=Tt.errorTypeRegistries=Tt.RegionDisabledException$=Tt.PackedPolicyTooLargeException$=Tt.MalformedPolicyDocumentException$=Tt.InvalidIdentityTokenException$=Tt.IDPRejectedClaimException$=Tt.IDPCommunicationErrorException$=Tt.ExpiredTokenException$=Tt.STSServiceException$=void 0;var Co="Arn",fo="AccessKeyId",er="AssumeRole",tr="AssumedRoleId",or="AssumeRoleRequest",rr="AssumeRoleResponse",Pe="AssumedRoleUser",sr="AssumeRoleWithWebIdentity",nr="AssumeRoleWithWebIdentityRequest",ir="AssumeRoleWithWebIdentityResponse",cr="Audience",ye="Credentials",dr="ContextAssertion",at="DurationSeconds",ar="Expiration",ur="ExternalId",pr="ExpiredTokenException",lr="IDPCommunicationErrorException",Er="IDPRejectedClaimException",Pr="InvalidIdentityTokenException",yr="Key",_r="MalformedPolicyDocumentException",ut="Policy",pt="PolicyArns",Ir="ProviderArn",Rr="ProvidedContexts",Tr="ProvidedContextsListType",Sr="ProvidedContext",vr="PolicyDescriptorType",xr="ProviderId",lt="PackedPolicySize",Dr="PackedPolicyTooLargeException",mr="Provider",Et="RoleArn",Ar="RegionDisabledException",Pt="RoleSessionName",$r="SecretAccessKey",br="SubjectFromWebIdentityToken",_e="SourceIdentity",hr="SerialNumber",Nr="SessionToken",qr="Tags",Fr="TokenCode",Wr="TransitiveTagKeys",wr="Tag",Ur="Value",Mr="WebIdentityToken",kr="arn",Lr="accessKeySecretType",$="awsQueryError",b="client",jr="clientTokenType",h="error",N="httpError",q="message",Gr="policyDescriptorListType",yt="smithy.ts.sdk.synthetic.com.amazonaws.sts",Or="tagListType",d="com.amazonaws.sts",_t=dt(),F=Ee(),Kr=O(),It=_t.TypeRegistry.for(yt);Tt.STSServiceException$=[-3,yt,"STSServiceException",0,[],[]];It.registerError(Tt.STSServiceException$,Kr.STSServiceException);var x=_t.TypeRegistry.for(d);Tt.ExpiredTokenException$=[-3,d,pr,{[$]:["ExpiredTokenException",400],[h]:b,[N]:400},[q],[0]];x.registerError(Tt.ExpiredTokenException$,F.ExpiredTokenException);Tt.IDPCommunicationErrorException$=[-3,d,lr,{[$]:["IDPCommunicationError",400],[h]:b,[N]:400},[q],[0]];x.registerError(Tt.IDPCommunicationErrorException$,F.IDPCommunicationErrorException);Tt.IDPRejectedClaimException$=[-3,d,Er,{[$]:["IDPRejectedClaim",403],[h]:b,[N]:403},[q],[0]];x.registerError(Tt.IDPRejectedClaimException$,F.IDPRejectedClaimException);Tt.InvalidIdentityTokenException$=[-3,d,Pr,{[$]:["InvalidIdentityToken",400],[h]:b,[N]:400},[q],[0]];x.registerError(Tt.InvalidIdentityTokenException$,F.InvalidIdentityTokenException);Tt.MalformedPolicyDocumentException$=[-3,d,_r,{[$]:["MalformedPolicyDocument",400],[h]:b,[N]:400},[q],[0]];x.registerError(Tt.MalformedPolicyDocumentException$,F.MalformedPolicyDocumentException);Tt.PackedPolicyTooLargeException$=[-3,d,Dr,{[$]:["PackedPolicyTooLarge",400],[h]:b,[N]:400},[q],[0]];x.registerError(Tt.PackedPolicyTooLargeException$,F.PackedPolicyTooLargeException);Tt.RegionDisabledException$=[-3,d,Ar,{[$]:["RegionDisabledException",403],[h]:b,[N]:403},[q],[0]];x.registerError(Tt.RegionDisabledException$,F.RegionDisabledException);Tt.errorTypeRegistries=[It,x];var Vr=[0,d,Lr,8,0],zr=[0,d,jr,8,0];Tt.AssumedRoleUser$=[3,d,Pe,0,[tr,Co],[0,0],2];Tt.AssumeRoleRequest$=[3,d,or,0,[Et,Pt,pt,ut,at,qr,Wr,ur,hr,Fr,_e,Rr],[0,0,()=>Rt,0,1,()=>gr,64,0,0,0,0,()=>Br],2];Tt.AssumeRoleResponse$=[3,d,rr,0,[ye,Pe,lt,_e],[[()=>Tt.Credentials$,0],()=>Tt.AssumedRoleUser$,1,0]];Tt.AssumeRoleWithWebIdentityRequest$=[3,d,nr,0,[Et,Pt,Mr,xr,pt,ut,at],[0,0,[()=>zr,0],0,()=>Rt,0,1],3];Tt.AssumeRoleWithWebIdentityResponse$=[3,d,ir,0,[ye,br,Pe,lt,mr,cr,_e],[[()=>Tt.Credentials$,0],0,()=>Tt.AssumedRoleUser$,1,0,0,0]];Tt.Credentials$=[3,d,ye,0,[fo,$r,Nr,ar],[0,[()=>Vr,0],0,4],4];Tt.PolicyDescriptorType$=[3,d,vr,0,[kr],[0]];Tt.ProvidedContext$=[3,d,Sr,0,[Ir,dr],[0,0]];Tt.Tag$=[3,d,wr,0,[yr,Ur],[0,0],2];var Rt=[1,d,Gr,0,()=>Tt.PolicyDescriptorType$],Br=[1,d,Tr,0,()=>Tt.ProvidedContext$],gr=[1,d,Or,0,()=>Tt.Tag$];Tt.AssumeRole$=[9,d,er,0,()=>Tt.AssumeRoleRequest$,()=>Tt.AssumeRoleResponse$];Tt.AssumeRoleWithWebIdentity$=[9,d,sr,0,()=>Tt.AssumeRoleWithWebIdentityRequest$,()=>Tt.AssumeRoleWithWebIdentityResponse$]});var Ot=y((jt)=>{Object.defineProperty(jt,"__esModule",{value:!0});jt.getRuntimeConfig=void 0;var Cr=X(),fr=Zr(),es=Se(),ts=k(),os=Xr(),kt=Jr(),Lt=Hr(),rs=Z(),ss=rt(),ns=Te(),is=(e)=>{return{apiVersion:"2011-06-15",base64Decoder:e?.base64Decoder??kt.fromBase64,base64Encoder:e?.base64Encoder??kt.toBase64,disableHostPrefix:e?.disableHostPrefix??!1,endpointProvider:e?.endpointProvider??ss.defaultEndpointResolver,extensions:e?.extensions??[],httpAuthSchemeProvider:e?.httpAuthSchemeProvider??rs.defaultSTSHttpAuthSchemeProvider,httpAuthSchemes:e?.httpAuthSchemes??[{schemeId:"aws.auth#sigv4",identityProvider:(t)=>t.getIdentityProvider("aws.auth#sigv4"),signer:new Cr.AwsSdkSigV4Signer},{schemeId:"smithy.api#noAuth",identityProvider:(t)=>t.getIdentityProvider("smithy.api#noAuth")||(async()=>({})),signer:new es.NoAuthSigner}],logger:e?.logger??new ts.NoOpLogger,protocol:e?.protocol??fr.AwsQueryProtocol,protocolSettings:e?.protocolSettings??{defaultNamespace:"com.amazonaws.sts",errorTypeRegistries:ns.errorTypeRegistries,xmlNamespace:"https://sts.amazonaws.com/doc/2011-06-15/",version:"2011-06-15",serviceTarget:"AWSSecurityTokenServiceV20110615"},serviceId:e?.serviceId??"STS",urlParser:e?.urlParser??os.parseUrl,utf8Decoder:e?.utf8Decoder??Lt.fromUtf8,utf8Encoder:e?.utf8Encoder??Lt.toUtf8}};jt.getRuntimeConfig=is});var Jt=y((Yt)=>{Object.defineProperty(Yt,"__esModule",{value:!0});Yt.getRuntimeConfig=void 0;var _s=ds(),Is=_s.__importDefault(ps()),ve=X(),Kt=ls(),K=gt(),Rs=Se(),Ts=Es(),Vt=Qt(),W=us(),zt=cs(),Bt=k(),Ss=Ps(),vs=ys(),xs=as(),Ds=Ot(),ms=(e)=>{(0,Bt.emitWarningIfUnsupportedVersion)(process.version);let t=(0,vs.resolveDefaultsModeConfig)(e),r=()=>t().then(Bt.loadConfigsForDefaultMode),a=(0,Ds.getRuntimeConfig)(e);(0,ve.emitWarningIfUnsupportedVersion)(process.version);let s={profile:e?.profile,logger:a.logger};return{...a,...e,runtime:"node",defaultsMode:t,authSchemePreference:e?.authSchemePreference??(0,W.loadConfig)(ve.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS,s),bodyLengthChecker:e?.bodyLengthChecker??Ss.calculateBodyLength,defaultUserAgentProvider:e?.defaultUserAgentProvider??(0,Kt.createDefaultUserAgentProvider)({serviceId:a.serviceId,clientVersion:Is.default.version}),httpAuthSchemes:e?.httpAuthSchemes??[{schemeId:"aws.auth#sigv4",identityProvider:(E)=>E.getIdentityProvider("aws.auth#sigv4")||(async(u)=>await e.credentialDefaultProvider(u?.__config||{})()),signer:new ve.AwsSdkSigV4Signer},{schemeId:"smithy.api#noAuth",identityProvider:(E)=>E.getIdentityProvider("smithy.api#noAuth")||(async()=>({})),signer:new Rs.NoAuthSigner}],maxAttempts:e?.maxAttempts??(0,W.loadConfig)(Vt.NODE_MAX_ATTEMPT_CONFIG_OPTIONS,e),region:e?.region??(0,W.loadConfig)(K.NODE_REGION_CONFIG_OPTIONS,{...K.NODE_REGION_CONFIG_FILE_OPTIONS,...s}),requestHandler:zt.NodeHttpHandler.create(e?.requestHandler??r),retryMode:e?.retryMode??(0,W.loadConfig)({...Vt.NODE_RETRY_MODE_CONFIG_OPTIONS,default:async()=>(await r()).retryMode||xs.DEFAULT_RETRY_MODE},e),sha256:e?.sha256??Ts.Hash.bind(null,"sha256"),streamCollector:e?.streamCollector??zt.streamCollector,useDualstackEndpoint:e?.useDualstackEndpoint??(0,W.loadConfig)(K.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS,s),useFipsEndpoint:e?.useFipsEndpoint??(0,W.loadConfig)(K.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS,s),userAgentAppId:e?.userAgentAppId??(0,W.loadConfig)(Kt.NODE_APP_ID_CONFIG_OPTIONS,s)}};Yt.getRuntimeConfig=ms});var Ct=y((Xt)=>{Object.defineProperty(Xt,"__esModule",{value:!0});Xt.resolveHttpAuthRuntimeConfig=Xt.getHttpAuthExtensionConfiguration=void 0;var As=(e)=>{let{httpAuthSchemes:t,httpAuthSchemeProvider:r,credentials:a}=e;return{setHttpAuthScheme(s){let E=t.findIndex((u)=>u.schemeId===s.schemeId);if(E===-1)t.push(s);else t.splice(E,1,s)},httpAuthSchemes(){return t},setHttpAuthSchemeProvider(s){r=s},httpAuthSchemeProvider(){return r},setCredentials(s){a=s},credentials(){return a}}};Xt.getHttpAuthExtensionConfiguration=As;var $s=(e)=>{return{httpAuthSchemes:e.httpAuthSchemes(),httpAuthSchemeProvider:e.httpAuthSchemeProvider(),credentials:e.credentials()}};Xt.resolveHttpAuthRuntimeConfig=$s});var io=y((so)=>{Object.defineProperty(so,"__esModule",{value:!0});so.resolveRuntimeExtensions=void 0;var ft=ro(),eo=hs(),to=k(),oo=Ct(),Ns=(e,t)=>{let r=Object.assign((0,ft.getAwsRegionExtensionConfiguration)(e),(0,to.getDefaultExtensionConfiguration)(e),(0,eo.getHttpHandlerExtensionConfiguration)(e),(0,oo.getHttpAuthExtensionConfiguration)(e));return t.forEach((a)=>a.configure(r)),Object.assign(e,(0,ft.resolveAwsRegionExtensionConfiguration)(r),(0,to.resolveDefaultRuntimeConfig)(r),(0,eo.resolveHttpHandlerRuntimeConfig)(r),(0,oo.resolveHttpAuthRuntimeConfig)(r))};so.resolveRuntimeExtensions=Ns});var C=y((De)=>{Object.defineProperty(De,"__esModule",{value:!0});De.STSClient=De.__Client=void 0;var co=qs(),Ms=Fs(),ks=Ws(),ao=ws(),Ls=gt(),xe=Se(),js=dt(),Gs=Us(),Os=lo(),uo=Qt(),Eo=k();Object.defineProperty(De,"__Client",{enumerable:!0,get:function(){return Eo.Client}});var po=Z(),Ks=f(),Vs=Jt(),zs=io();class Po extends Eo.Client{config;constructor(...[e]){let t=(0,Vs.getRuntimeConfig)(e||{});super(t);this.initConfig=t;let r=(0,Ks.resolveClientEndpointParameters)(t),a=(0,ao.resolveUserAgentConfig)(r),s=(0,uo.resolveRetryConfig)(a),E=(0,Ls.resolveRegionConfig)(s),u=(0,co.resolveHostHeaderConfig)(E),T=(0,Os.resolveEndpointConfig)(u),D=(0,po.resolveHttpAuthSchemeConfig)(T),m=(0,zs.resolveRuntimeExtensions)(D,e?.extensions||[]);this.config=m,this.middlewareStack.use((0,js.getSchemaSerdePlugin)(this.config)),this.middlewareStack.use((0,ao.getUserAgentPlugin)(this.config)),this.middlewareStack.use((0,uo.getRetryPlugin)(this.config)),this.middlewareStack.use((0,Gs.getContentLengthPlugin)(this.config)),this.middlewareStack.use((0,co.getHostHeaderPlugin)(this.config)),this.middlewareStack.use((0,Ms.getLoggerPlugin)(this.config)),this.middlewareStack.use((0,ks.getRecursionDetectionPlugin)(this.config)),this.middlewareStack.use((0,xe.getHttpAuthSchemeEndpointRuleSetPlugin)(this.config,{httpAuthSchemeParametersProvider:po.defaultSTSHttpAuthSchemeParametersProvider,identityProviderConfigProvider:async(U)=>new xe.DefaultIdentityProviderConfig({"aws.auth#sigv4":U.credentials})})),this.middlewareStack.use((0,xe.getHttpSigningPlugin)(this.config))}destroy(){super.destroy()}}De.STSClient=Po});var nn=y((I)=>{var w=C(),z=k(),_o=lo(),Io=f(),L=Te(),V=Ee(),me=Bs(),gs=ro(),Qs=O();class B extends z.Command.classBuilder().ep(Io.commonParams).m(function(e,t,r,a){return[_o.getEndpointPlugin(r,e.getEndpointParameterInstructions())]}).s("AWSSecurityTokenServiceV20110615","AssumeRole",{}).n("STSClient","AssumeRoleCommand").sc(L.AssumeRole$).build(){}class g extends z.Command.classBuilder().ep(Io.commonParams).m(function(e,t,r,a){return[_o.getEndpointPlugin(r,e.getEndpointParameterInstructions())]}).s("AWSSecurityTokenServiceV20110615","AssumeRoleWithWebIdentity",{}).n("STSClient","AssumeRoleWithWebIdentityCommand").sc(L.AssumeRoleWithWebIdentity$).build(){}var Ys={AssumeRoleCommand:B,AssumeRoleWithWebIdentityCommand:g};class Ae extends w.STSClient{}z.createAggregatedClient(Ys,Ae);var Ro=(e)=>{if(typeof e?.Arn==="string"){let t=e.Arn.split(":");if(t.length>4&&t[4]!=="")return t[4]}return},To=async(e,t,r,a={})=>{let s=typeof e==="function"?await e():e,E=typeof t==="function"?await t():t,u="",T=s??E??(u=await gs.stsRegionDefaultResolver(a)());return r?.debug?.("@aws-sdk/client-sts::resolveRegion","accepting first of:",`${s} (credential provider clientConfig)`,`${E} (contextual client)`,`${u} (STS default: AWS_REGION, profile region, or us-east-1)`),T},Hs=(e,t)=>{let r,a;return async(s,E)=>{if(a=s,!r){let{logger:U=e?.parentClientConfig?.logger,profile:j=e?.parentClientConfig?.profile,region:Q,requestHandler:G=e?.parentClientConfig?.requestHandler,credentialProviderLogger:Y,userAgentAppId:H=e?.parentClientConfig?.userAgentAppId}=e,mo=await To(Q,e?.parentClientConfig?.region,Y,{logger:U,profile:j}),Ao=!So(G);r=new t({...e,userAgentAppId:H,profile:j,credentialDefaultProvider:()=>async()=>a,region:mo,requestHandler:Ao?G:void 0,logger:U})}let{Credentials:u,AssumedRoleUser:T}=await r.send(new B(E));if(!u||!u.AccessKeyId||!u.SecretAccessKey)throw Error(`Invalid response from STS.assumeRole call with role ${E.RoleArn}`);let D=Ro(T),m={accessKeyId:u.AccessKeyId,secretAccessKey:u.SecretAccessKey,sessionToken:u.SessionToken,expiration:u.Expiration,...u.CredentialScope&&{credentialScope:u.CredentialScope},...D&&{accountId:D}};return me.setCredentialFeature(m,"CREDENTIALS_STS_ASSUME_ROLE","i"),m}},Js=(e,t)=>{let r;return async(a)=>{if(!r){let{logger:D=e?.parentClientConfig?.logger,profile:m=e?.parentClientConfig?.profile,region:U,requestHandler:j=e?.parentClientConfig?.requestHandler,credentialProviderLogger:Q,userAgentAppId:G=e?.parentClientConfig?.userAgentAppId}=e,Y=await To(U,e?.parentClientConfig?.region,Q,{logger:D,profile:m}),H=!So(j);r=new t({...e,userAgentAppId:G,profile:m,region:Y,requestHandler:H?j:void 0,logger:D})}let{Credentials:s,AssumedRoleUser:E}=await r.send(new g(a));if(!s||!s.AccessKeyId||!s.SecretAccessKey)throw Error(`Invalid response from STS.assumeRoleWithWebIdentity call with role ${a.RoleArn}`);let u=Ro(E),T={accessKeyId:s.AccessKeyId,secretAccessKey:s.SecretAccessKey,sessionToken:s.SessionToken,expiration:s.Expiration,...s.CredentialScope&&{credentialScope:s.CredentialScope},...u&&{accountId:u}};if(u)me.setCredentialFeature(T,"RESOLVED_ACCOUNT_ID","T");return me.setCredentialFeature(T,"CREDENTIALS_STS_ASSUME_ROLE_WEB_ID","k"),T}},So=(e)=>{return e?.metadata?.handlerProtocol==="h2"},vo=(e,t)=>{if(!t)return e;else return class extends e{constructor(a){super(a);for(let s of t)this.middlewareStack.use(s)}}},xo=(e={},t)=>Hs(e,vo(w.STSClient,t)),Do=(e={},t)=>Js(e,vo(w.STSClient,t)),Xs=(e)=>(t)=>e({roleAssumer:xo(t),roleAssumerWithWebIdentity:Do(t),...t});I.$Command=z.Command;I.STSServiceException=Qs.STSServiceException;I.AssumeRoleCommand=B;I.AssumeRoleWithWebIdentityCommand=g;I.STS=Ae;I.decorateDefaultCredentialProvider=Xs;I.getDefaultRoleAssumer=xo;I.getDefaultRoleAssumerWithWebIdentity=Do;Object.prototype.hasOwnProperty.call(w,"__proto__")&&!Object.prototype.hasOwnProperty.call(I,"__proto__")&&Object.defineProperty(I,"__proto__",{enumerable:!0,value:w.__proto__});Object.keys(w).forEach(function(e){if(e!=="default"&&!Object.prototype.hasOwnProperty.call(I,e))I[e]=w[e]});Object.prototype.hasOwnProperty.call(L,"__proto__")&&!Object.prototype.hasOwnProperty.call(I,"__proto__")&&Object.defineProperty(I,"__proto__",{enumerable:!0,value:L.__proto__});Object.keys(L).forEach(function(e){if(e!=="default"&&!Object.prototype.hasOwnProperty.call(I,e))I[e]=L[e]});Object.prototype.hasOwnProperty.call(V,"__proto__")&&!Object.prototype.hasOwnProperty.call(I,"__proto__")&&Object.defineProperty(I,"__proto__",{enumerable:!0,value:V.__proto__});Object.keys(V).forEach(function(e){if(e!=="default"&&!Object.prototype.hasOwnProperty.call(I,e))I[e]=V[e]})});export default nn();
 
-//# debugId=4873522D674244D364756E2164756E21
+//# debugId=B2DF56AE86FEBF4364756E2164756E21