gemi 0.196.2 → 0.197.0

package/dist/{chunk-pg5hm00s.js.map → chunk-j84r2j7a.js.map}

@@ -7,6 +7,6 @@
     "import {\n  AmbiguousModelRegistrationError,\n  UnregisteredPolicyClassError,\n} from \"./errors\";\nimport { assertPolicyShapes, policiesFor } from \"./policy\";\nimport * as registry from \"./registry\";\nimport type { ModelSchema } from \"./schema\";\n\n/** A model class, as much of one as anything below `Model.ts` can name. */\ntype ModelClass = object & { $schema: ModelSchema };\n\n/**\n * Checks that every policied model class an application defines is the one the\n * registry resolves its name to — **ahead of any query**, rather than when one\n * happens to be run.\n *\n * ### Why this exists\n *\n * `Model.$exec` already refuses a query whose class carries policies the\n * registered class does not (`UnregisteredPolicyClassError`). That guard closed\n * the two shapes found in #51, and it is the right check, but it can only fire\n * on a class somebody actually queries **at the root**. Its condition begins\n * `registered !== this`, and there is a case where that is false and the leak is\n * real:\n *\n *     export class Membership extends MembershipModel {\n *       static $policies = [{ scope: (ctx) => ({ orgId: ctx.user.orgId }) }]\n *     }\n *     // ...and no `register(\"Membership\", Membership)`\n *\n * If nothing ever calls `Membership.findMany()` — because memberships are only\n * ever read through `include: { memberships: true }` — then the include resolves\n * the name to the *generated base*, `this` **is** that base, the comparison\n * never runs, and rows come back unscoped with no error. Not a policy chain that\n * fails to diverge: a check that is never reached.\n *\n * A model reached only through includes is usually a membership or a pivot,\n * which is exactly the kind that carries a tenant scope. So the residual runs\n * the wrong way: the guard is weakest where the data is most sensitive.\n *\n * ### What this does about it\n *\n * The same rule, triggered differently. Instead of waiting for a root query,\n * it takes the modules where an application's model classes live and applies the\n * divergence comparison to every one of them:\n *\n *     import * as models from \"@/app/models\"\n *     assertPoliciesRegistered(models)\n *\n * Reading a class out of a module namespace is what makes the unqueried case\n * visible — the class exists and is exported whether or not anything queries it.\n *\n * `registerModels` runs this after registering, and `Kernel.models` runs\n * `registerModels` at boot, so an application that declares its model modules\n * gets it without asking. This is the same check for modules the Kernel does\n * not own — a test over a package's models, a script that boots nothing.\n *\n * It can only see modules it is handed, which is the residual either way: a\n * policied class in a file no barrel re-exports is invisible to it.\n * `gemi check models` closes that by handing it the files instead of the\n * barrel — see `auditModelRegistrations`, which is the same rule without the\n * throw.\n */\nexport function assertPoliciesRegistered(\n  ...modules: Array<Record<string, unknown>>\n): void {\n  const [first] = auditModelRegistrations(...modules);\n  if (first !== undefined) throw first;\n}\n\n/**\n * Every problem `assertPoliciesRegistered` would report, as values rather than\n * as a throw — in the order it would have reported them, so the first element is\n * exactly what that function throws.\n *\n * ### Why the rule needed a second caller\n *\n * A throw is the right shape at boot: the first policied class that does not own\n * its name is a reason not to start, and the rest of the list is noise nobody\n * reads before fixing the first one.\n *\n * It is the wrong shape for a checker. `gemi check models` walks\n * `app/models/**` and audits each file, so it wants *all* of them, and it wants\n * to sort them — a policied class the Kernel never sees is a leak to report,\n * while a policied view deliberately kept out of the declared modules is the\n * arrangement the error for that case actually recommends, and reporting it\n * would be telling an author to undo what the framework told them to do.\n * `UnregisteredPolicyClassError.carries` is what separates the two, and it can\n * only be read off an error somebody is holding.\n *\n * Errors rather than a plain finding type, because the message is the useful\n * part and it is already written once, in the error. Constructing them is not\n * free — a stack per finding — and it is a check somebody runs, not a request\n * path.\n */\nexport function auditModelRegistrations(\n  ...modules: Array<Record<string, unknown>>\n): UnregisteredPolicyClassError[] {\n  const problems: UnregisteredPolicyClassError[] = [];\n\n  for (const module of modules) {\n    for (const exported of Object.values(module)) {\n      const model = asModelClass(exported);\n      if (model === null) continue;\n\n      // #321's boot-time half, run **before** the early return below and for\n      // every class rather than only the diverging ones. Left below the return,\n      // the two commonest arrangements were never checked at all — a class that\n      // already owns its name, and one whose name nothing else claims — so a\n      // `{ scopes: … }` typo registered, reported green, and read unscoped.\n      //\n      // `assertPolicyShapes` and not `policiesFor`, and the difference is the\n      // point: this walk checks the entries and constructs nothing. Resolving\n      // here instead is one line and would additionally catch a policy class\n      // whose constructor throws — at the price of constructing every policy\n      // class in the application at `registerModels` time, ahead of whatever\n      // config or container the constructor reaches for. A guard against a\n      // policy that does nothing must not become the reason a working\n      // application stops booting, so the cases that need an instance are left\n      // to `policiesFor`, which is reached below, on the first query, and by\n      // `Model.$exec`.\n      assertPolicyShapes(model);\n\n      const name = model.$schema.name;\n      const registered = registry.has(name)\n        ? (registry.get<unknown>(name) as object)\n        : undefined;\n\n      // Nothing registered under the name at all. The generated `index.ts`\n      // registers every model, so reaching this means it was never imported —\n      // a different mistake, and one the first query reports clearly through\n      // `ModelNotRegisteredError`. Not this function's business.\n      if (registered === undefined || registered === model) continue;\n\n      const ours = policiesFor(model);\n      const theirs = policiesFor(registered);\n      const diverges =\n        ours.length !== theirs.length ||\n        ours.some((policy, index) => policy !== theirs[index]);\n\n      // The two classes are on one prototype chain — a base and something\n      // extending it — which is the arrangement almost every application has,\n      // and the one this audit used to get wrong in both directions.\n      //\n      // `policiesFor` accumulates upwards, so a descendant's chain always\n      // contains its ancestor's. What separates the two shapes is therefore\n      // whether the **ancestor** carries anything of its own.\n      if (descendsFrom(registered, model) || descendsFrom(model, registered)) {\n        const ancestor = descendsFrom(model, registered) ? registered : model;\n        const descendant = ancestor === registered ? model : registered;\n\n        if (policiesFor(ancestor).length === 0) {\n          // The ancestor contributes nothing, so the descendant is the first\n          // class to carry a policy: it is not a view over the model, it *is*\n          // the model. A generated base is the usual ancestor here, and a\n          // hand-written intermediate behaves the same way.\n          //\n          // Registered already? Then this is the correct arrangement, and it\n          // has to be skipped rather than reported — it used not to be, and\n          // that is why the documented\n          //\n          //     assertPoliciesRegistered(generated, models)\n          //\n          // threw the moment an application wrote its first policy: it walked\n          // the generated namespace, found `UserModel` diverging from the\n          // registered `User`, and refused the thing it exists to protect.\n          // Being reachable through a base is not the bug; querying through one\n          // is, and that is a property of a call site rather than of a module's\n          // export list, so `Model.$exec` keeps that direction.\n          if (registered === descendant) continue;\n\n          // Neither class carries anything, so which one owns the name changes\n          // no query's scope. An unregistered plain subclass is not a mistake.\n          if (!diverges) continue;\n\n          // Not registered, and it has policies: #316 itself. The policied\n          // class is not the one the name resolves to, so every nested read\n          // runs the ancestor and skips it.\n          problems.push(\n            new UnregisteredPolicyClassError(\n              name,\n              nameOf(registered),\n              nameOf(model),\n              ours.length > 0 ? \"queried\" : \"registered\",\n            ),\n          );\n          continue;\n        }\n\n        // The ancestor carries policies of its own, so it is a registered model\n        // in good standing and the descendant is narrowing it. The registry\n        // holds one class per name: registering the view applies its narrowing\n        // to every nested read, and leaving the ancestor registered skips the\n        // view's policies entirely. Both are silent, so neither is chosen.\n        if (diverges) {\n          problems.push(\n            new UnregisteredPolicyClassError(\n              name,\n              nameOf(ancestor),\n              nameOf(descendant),\n              \"narrowing\",\n            ),\n          );\n        }\n\n        // Same chain, same policies — a plain typed view. Nothing to report.\n        continue;\n      }\n\n      if (!diverges) continue;\n\n      // Unrelated classes claiming one name. Whichever is registered, the\n      // other's policies are simply not in effect.\n      problems.push(\n        new UnregisteredPolicyClassError(\n          name,\n          nameOf(registered),\n          nameOf(model),\n          ours.length > 0 ? \"queried\" : \"registered\",\n        ),\n      );\n    }\n  }\n\n  return problems;\n}\n\n/**\n * Registers every model class the given modules export, under the name each\n * one's schema carries, and then audits the result.\n *\n * ### The line this exists to delete\n *\n * `register(\"User\", User)` next to every subclass is a correct instruction and\n * a bad mechanism, because forgetting it is invisible. A relation read resolves\n * its target by name, so an unregistered policied subclass leaves the generated\n * base owning the name and every nested `include` of that model comes back\n * unscoped — no error, no warning, and an authorization hole in the direction\n * nobody checks. `assertPoliciesRegistered` turns that into a loud failure, but\n * only for someone who remembered to run it.\n *\n * Deriving the registration from the module removes the mistake instead of\n * reporting it. The name is not a string an author repeats; it is\n * `$schema.name`, which the generator wrote and the subclass inherits:\n *\n *     import * as generated from \"./generated\"\n *     import * as models from \"./models\"\n *\n *     registerModels(generated, models)\n *\n * Later modules win, so the application's classes replace the generated bases\n * they extend. `register` still exists and still works — this is what an\n * application calls once instead of writing it thirteen times.\n *\n * ### What it still cannot see\n *\n * Modules it is handed. A policied class in a file nothing imports is invisible\n * to this exactly as it is to `assertPoliciesRegistered`, and closing *that*\n * would take the framework enumerating the filesystem at boot. Handing it a\n * barrel is the whole discipline: one file to add a model to, and the audit\n * covers everything in it.\n *\n * `Kernel.models` is that call, wired at boot, so an application declares its\n * model modules the way it already declares config slices and providers.\n */\nexport function registerModels(\n  ...modules: Array<Record<string, unknown>>\n): void {\n  // Elected into a local map first, and only committed once the audit passes.\n  //\n  // The registry is process-wide and outlives the throw. Registering as we went\n  // meant a refused call left the arrangement it had just refused installed —\n  // `registerModels({Ours}, {Theirs})` threw, and `\"User\"` resolved to `Theirs`\n  // afterwards, which is the leaking mapping the audit exists to reject. A\n  // server whose boot dies never notices; a dev server that catches and keeps\n  // serving, or a test harness that continues past the error, serves the rest\n  // of the process from it.\n  const staged = new Map<string, ModelClass>();\n\n  for (const module of modules) {\n    const candidates = new Map<string, ModelClass[]>();\n\n    // Deduped by identity first: `export { User }` alongside a default export\n    // is the same class under two keys, not two classes competing for a name.\n    for (const exported of new Set(Object.values(module))) {\n      const model = asModelClass(exported);\n      if (model === null) continue;\n\n      const name = model.$schema.name;\n      const existing = candidates.get(name);\n      if (existing === undefined) candidates.set(name, [model]);\n      else existing.push(model);\n    }\n\n    // Later modules win, which is what lets an application's classes replace\n    // the generated bases they extend.\n    for (const [name, classes] of candidates) {\n      staged.set(name, elect(name, classes));\n    }\n  }\n\n  // What the registry said before, so a failed audit can put it back. `register`\n  // has no inverse, so a name that was previously *absent* cannot be made\n  // absent again — it is left pointing at what this call elected. That is the\n  // one residue, and it is the harmless direction: the alternative to a wrong\n  // registration under a name nothing claimed is `ModelNotRegisteredError`, and\n  // the class elected here is the one this module set would have used anyway.\n  const previous = [...staged.keys()]\n    .filter((name) => registry.has(name))\n    .map((name) => [name, registry.get<unknown>(name)] as const);\n\n  for (const [name, model] of staged) registry.register(name, model);\n\n  try {\n    assertPoliciesRegistered(...modules);\n  } catch (error) {\n    for (const [name, model] of previous) registry.register(name, model);\n    throw error;\n  }\n}\n\n/**\n * Which of several classes claiming one name in one module gets it.\n *\n * Two shapes put more than one candidate in a namespace, and they want opposite\n * answers, so neither \"most derived\" nor \"least derived\" is the rule on its\n * own:\n *\n *     export * from \"./generated\"      // UserModel, and\n *     export class User extends UserModel { static $policies = [...] }\n *\n * wants the subclass — electing the base here *is* the leak, in the one file an\n * author most plausibly writes it in. While\n *\n *     export class User extends UserModel { static $policies = [...] }\n *     export class AdminUser extends User {}\n *\n * wants `User`. `AdminUser` is a typed view over the same rows; it inherits the\n * policies either way, so registering it changes nothing when it adds none and\n * silently applies its own narrowing to every nested read when it does.\n *\n * What separates them is which class the *generator* wrote. It emits\n * `static $schema = schema.User` on the base, and a subclass inherits that\n * property rather than declaring one — so an own `$schema` is the mark of a\n * generated base, and it is a fact about the classes rather than about the\n * order somebody exported them in. Application classes are preferred over\n * bases; among application classes the least derived wins, for the reason\n * `AdminUser` gives.\n *\n * When that leaves no single answer the candidates are unrelated classes with a\n * genuine claim each, and there is nothing left to infer. That case is refused\n * rather than guessed at: `register` says which, in the application's own\n * words.\n */\nfunction elect(name: string, classes: ModelClass[]): ModelClass {\n  if (classes.length === 1) return classes[0]!;\n\n  const written = classes.filter((candidate) => !isGeneratedBase(candidate));\n  const eligible = written.length > 0 ? written : classes;\n\n  if (eligible.length === 1) return eligible[0]!;\n\n  const roots = eligible.filter((candidate) =>\n    eligible.every(\n      (other) => other === candidate || descendsFrom(other, candidate),\n    ),\n  );\n\n  if (roots.length === 1) return roots[0]!;\n\n  throw new AmbiguousModelRegistrationError(\n    name,\n    eligible.map((candidate) => nameOf(candidate)),\n  );\n}\n\n/**\n * Whether the generator wrote this class, rather than an application extending\n * one it wrote.\n *\n * The generator marks its own output — `static $generated = true` on each\n * emitted base, and on nothing else — so for artifacts that carry the mark this\n * is a fact the generator stated rather than a property of how it happens to be\n * written. A subclass *inherits* the mark and does not own it, which is what\n * makes own-vs-inherited the whole test.\n *\n * ### The fallback, and why it is second\n *\n * `$schema` is also declared on the emitted base and inherited below it, so\n * owning *that* used to answer the same question, and it answered it wrongly for\n * one shape (#318): a subclass that redeclares `static $schema` — pointing at a\n * modified schema object, or by copy-paste — read as a base, every candidate\n * looked generated, and the least derived won. That did not pass quietly, since\n * `assertPoliciesRegistered` runs immediately after `elect` and refuses a\n * policied class that lost its name. But loud-and-wrong is still wrong, and the\n * silent half — a subclass with statics and row methods but no policies, whose\n * methods then never run inside a nested read — had nothing to refuse.\n *\n * The inference survives as the fallback for artifacts generated *before* the\n * mark existed, where it is the only signal there is. `\"$generated\" in candidate`\n * is what separates the two worlds: it walks the prototype chain, so it is true\n * for a marked base and for everything under it, and false for every class in an\n * app whose `app/models/generated` predates 0.51. Asking `Object.hasOwn` first\n * and falling back on `false` would send a subclass of a *marked* base back into\n * the inference — which is exactly the case the mark was added to fix.\n *\n * `registration.test.ts` in the template asserts the contract against real\n * generator output, because this is the one place a generator change could\n * quietly invalidate an assumption made here.\n */\nfunction isGeneratedBase(candidate: ModelClass): boolean {\n  // Owning the mark, not merely having it — and owning it set to `true`. The\n  // declared type is `?: true`, so TypeScript already refuses `false`; reading\n  // the value anyway is what makes `static $generated = false` mean the thing\n  // it plainly says in an app with no typechecking between it and here.\n  if (\"$generated\" in candidate) {\n    return (\n      Object.hasOwn(candidate, \"$generated\") &&\n      (candidate as { $generated?: unknown }).$generated === true\n    );\n  }\n\n  return Object.hasOwn(candidate, \"$schema\");\n}\n\n/**\n * Whether `derived` has `base` in its static prototype chain — the `extends`\n * relation between two classes, walked on the constructor side because that is\n * where `$schema` and `$policies` live.\n */\nfunction descendsFrom(derived: unknown, base: unknown): boolean {\n  let current = Object.getPrototypeOf(derived);\n\n  while (current !== null && current !== Function.prototype) {\n    if (current === base) return true;\n    current = Object.getPrototypeOf(current);\n  }\n\n  return false;\n}\n\nfunction nameOf(value: unknown): string {\n  return (value as { name?: string })?.name ?? String(value);\n}\n\n/**\n * A model class, structurally.\n *\n * Structural rather than `instanceof Model` on purpose: this module sits below\n * `Model.ts` in the import graph, and importing it here to answer a question\n * about shape would put a cycle between the registry, the policy hook and the\n * model base for no gain. `$schema` carrying a `name` is what every operation\n * already relies on.\n *\n * A module namespace holds anything the author exported — types erase, but\n * constants, helpers and re-exported values do not — so everything that is not\n * a model class is skipped rather than treated as an error.\n */\nfunction asModelClass(value: unknown): ModelClass | null {\n  if (typeof value !== \"function\") return null;\n\n  const schema = (value as { $schema?: ModelSchema }).$schema;\n  if (schema === undefined || typeof schema.name !== \"string\") return null;\n\n  return value as unknown as ModelClass;\n}\n"
   ],
   "mappings": ";+OAyBA,FAAM,HAAwB,LAAC,QAAS,OAAQ,MAAM,EAChD,GAAuB,CAAC,KAAM,OAAO,EAsBpC,SAAS,CAAuB,CACrC,EACmB,CACnB,OAAO,IAAS,OAAS,GAAwB,GAgB5C,SAAS,CAAc,CAC5B,EACA,EACS,CACT,IAAM,EAAO,OAAO,KAAK,CAAK,EAC9B,OAAO,EAAK,OAAS,GAAK,EAAK,MAAM,CAAC,IAAQ,EAAU,SAAS,CAAG,CAAC,EAYhE,IAAM,EAAY,SAqBlB,SAAS,CAAkB,CAAC,EAEtB,CACX,OAAO,OAAO,KAAK,EAAO,SAAS,EAChC,OAAO,CAAC,IAAS,EAAO,UAAU,IAAO,OAAS,MAAM,EACxD,KAAK,EClBH,SAAS,CAAa,CAC3B,EACA,EACA,EACA,EACe,CASf,IAAM,EAAU,CAAE,QAAO,YAAW,QAAS,GAAQ,IAAK,EAiB1D,OAVA,OAAO,eAAe,EAAS,OAAQ,CACrC,WAAY,GACZ,GAAG,EAAG,CACJ,GAAI,GAAQ,MAAQ,CAAC,EACnB,MAAM,IAAI,EAAkB,EAAO,EAAW,SAAS,EAEzD,OAAO,EAEX,CAAC,EAEM,EAyHF,MAAe,CAAgD,CAAC,CAahE,MAAe,WAIZ,CAA8B,CAOxC,CAyBA,IAAM,GAAW,IAAI,IAAY,CAC/B,WACA,YACA,mBACA,aACA,oBACA,QAIA,YAMA,UACA,SACA,aACA,SACA,YACF,CAAC,EAGK,GAAW,IAAI,IAAY,CAAC,SAAU,aAAc,QAAQ,CAAC,EAQ7D,GAAW,IAAI,IAAY,CAAC,SAAU,aAAc,QAAQ,CAAC,EAM7D,GAAW,IAAI,IAAY,CAAC,SAAU,YAAY,CAAC,EAQnD,GAAY,IAAI,IAAY,CAAC,SAAU,YAAY,CAAC,EAoBpD,EAAe,IAAI,QAmBzB,SAAS,EAAY,CACnB,EACA,EACA,EACa,CACb,GAAI,OAAO,IAAU,WAAY,OAAO,EAExC,IAAM,EAAW,EAAa,IAAI,CAAK,EACvC,GAAI,IAAa,OAAW,OAAO,EAEnC,IAAI,EACJ,GAAI,CACF,EAAO,IAAK,EACZ,MAAO,EAAO,CACd,MAAM,IAAI,EACR,EAAY,CAAK,EACjB,EACA,oBACA,GAAG,EAAiB,CAAK;AAAA;AAAA,MACnB,GAAiB,SAAW,OAAO,CAAK,IAC9C,EACA,OACA,CAAE,OAAM,CACV,EAMF,OAHA,EAAsB,EAAiC,EAAO,CAAK,EAEnE,EAAa,IAAI,EAAO,CAAI,EACrB,EAIT,SAAS,CAAY,CACnB,EACA,EACe,CACf,OAAO,EAAQ,IAAI,CAAC,EAAO,IAAU,GAAa,EAAO,EAAO,CAAK,CAAC,EA4BxE,IAAM,EAAmB,CACvB,SACA,QACA,WACA,WACA,QACF,EAuCA,IAAM,EAAiB,IAAI,QAmB3B,SAAS,CAAmB,CAC1B,EACA,EACM,CACN,GAAI,EAAe,IAAI,CAAO,EAAG,OAEjC,QAAS,EAAQ,EAAG,EAAQ,EAAQ,OAAQ,IAC1C,GAAkB,EAAQ,GAAuB,EAAO,CAAK,EAG/D,EAAe,IAAI,CAAO,EAmB5B,SAAS,EAAiB,CACxB,EACA,EACA,EACM,CACN,IAAM,EAAQ,EAAY,CAAK,EACzB,EAAO,OAAO,EAMpB,GACE,IAAU,MACV,MAAM,QAAQ,CAAK,GAClB,IAAS,UAAY,IAAS,WAE/B,MAAM,IAAI,EACR,EACA,EACA,eACA,EAAc,CAAK,EACnB,CACF,EAGF,GAAI,IAAS,WAAY,CACvB,GAAI,CAAC,GAAgB,CAAiB,EACpC,MAAM,IAAI,EACR,EACA,EACA,oBACA,EAAiB,CAAiB,EAClC,CACF,EAIF,OAGF,EAAsB,EAAkC,EAAO,CAAK,EAWtE,SAAS,CAAqB,CAC5B,EACA,EACA,EACM,CACN,IAAM,EAAQ,EAAY,CAAK,EAC3B,EAAW,EAGT,EAAkB,CAAC,EAEzB,QAAW,KAAQ,EAAkB,CACnC,IAAM,EAAQ,EAAO,GAIrB,GAAI,IAAU,QAAa,IAAU,KAAM,CACzC,GAAI,KAAQ,EAAQ,EAAM,KAAK,CAAI,EACnC,SAGF,GAAI,OAAO,IAAU,WACnB,MAAM,IAAI,EACR,EACA,EACA,oBACA,IAAI,cAAiB,EAAc,CAAK,2BACxC,CACF,EAGF,IAGF,GAAI,EAAW,EAAG,OAElB,GAAI,EAAM,OAAS,EACjB,MAAM,IAAI,EACR,EACA,EACA,WACA,aAAa,EAAM,IAAI,CAAC,IAAS,IAAI,IAAO,EAAE,KAAK,IAAI,qBAC3C,EAAM,SAAW,EAAI,KAAO,gCACtC,2CACF,CACF,EAGF,IAAM,EAAU,GAAY,CAAM,EAC5B,EAAO,GAAY,CAAO,EAEhC,MAAM,IAAI,EACR,EACA,EACA,WACA,EAAQ,SAAW,EACf,eACA,aAAa,GAAS,CAAO,MAK1B,EAAQ,SAAW,GAAK,EAAQ,KAAO,UACpC,kEACA,oEACA,kBACA,IACV,EACA,CACF,EAUF,SAAS,EAAQ,CAAC,EAAiC,CACjD,IAAM,EAAQ,EAAK,MAAM,EAAG,CAAC,EAAE,IAAI,CAAC,IAAQ,IAAI,IAAM,EACtD,OAAO,EAAK,OAAS,EAAM,OACvB,GAAG,EAAM,KAAK,IAAI,SAAS,EAAK,OAAS,EAAM,cAC/C,EAAM,KAAK,IAAI,EAqBrB,SAAS,EAAe,CAAC,EAA0B,CACjD,GAAI,CAEF,OADA,QAAQ,UAAU,GAAM,CAAC,EAAG,CAA0B,EAC/C,GACP,KAAM,CACN,MAAO,IAKX,IAAM,GAAO,QAAS,EAAG,GAQzB,SAAS,EAAW,CAAC,EAA0B,CAC7C,IAAM,EAAO,IAAI,IAEb,EAAyB,EAC7B,MAAO,IAAY,MAAQ,IAAY,OAAO,UAAW,CACvD,QAAW,KAAO,OAAO,oBAAoB,CAAO,EAClD,GAAI,IAAQ,cAAe,EAAK,IAAI,CAAG,EAEzC,EAAU,OAAO,eAAe,CAAO,EAGzC,MAAO,CAAC,GAAG,CAAI,EAuBjB,SAAS,EAAW,CAClB,EAC2C,CAC3C,IAAI,EACA,EAAe,EAEnB,QAAW,KAAO,EAChB,QAAW,KAAQ,EAAkB,CACnC,IAAM,EAAW,GAAa,EAAI,YAAY,EAAG,EAAK,YAAY,CAAC,EACnE,GAAI,EAAW,EACb,EAAe,EACf,EAAO,CAAE,MAAK,MAAK,EAKzB,OAAO,EAIT,SAAS,EAAY,CAAC,EAAW,EAAmB,CAClD,GAAI,IAAM,EAAG,MAAO,GAEpB,IAAI,EAAM,MAAM,KAAK,CAAE,OAAQ,EAAE,OAAS,CAAE,EAAG,CAAC,EAAQ,IAAU,CAAK,EAEvE,QAAS,EAAI,EAAG,GAAK,EAAE,OAAQ,IAAK,CAClC,IAAI,EAAW,EAAI,GACnB,EAAI,GAAK,EAET,QAAS,EAAI,EAAG,GAAK,EAAE,OAAQ,IAAK,CAClC,IAAM,EAAO,EAAI,GACjB,EAAI,GAAK,KAAK,IACZ,EAAI,GAAM,EACV,EAAI,EAAI,GAAM,EACd,GAAY,EAAE,EAAI,KAAO,EAAE,EAAI,GAAK,EAAI,EAC1C,EACA,EAAW,GAIf,OAAO,EAAI,EAAE,QAQf,SAAS,CAAa,CAAC,EAAwB,CAC7C,GAAI,IAAU,KAAM,MAAO,OAC3B,GAAI,IAAU,OAAW,MAAO,YAChC,GAAI,OAAO,IAAU,SAAU,MAAO,cAAc,KAAK,UAAU,CAAK,IACxE,GAAI,OAAO,IAAU,WAAY,OAAO,EAAiB,CAAK,EAC9D,GAAI,MAAM,QAAQ,CAAK,EAAG,MAAO,WACjC,GAAI,OAAO,IAAU,SAAU,MAAO,YACtC,MAAO,OAAO,OAAO,KAAS,OAAO,CAAK,IAG5C,SAAS,CAAgB,CAAC,EAAyB,CACjD,OAAO,EAAM,KAAO,kBAAkB,EAAM,SAAW,wBAyBlD,SAAS,CAAW,CAAC,EAAwC,CAClE,IAAI,EACA,EAGA,EAEA,EAAU,EACd,MAAO,GAAW,IAAY,SAAS,UAAW,CAWhD,GAAI,OAAO,OAAO,EAAS,SAAS,EAClC,MAAU,MACR,GAAI,EAA8B,MAAQ,2FAExC,wEACA,oDACJ,EAGF,GAAI,OAAO,OAAO,EAAS,WAAW,GAAK,EAAQ,UAAW,CAC5D,IAAM,EAAQ,EAAQ,UACtB,GAAI,EAAM,OAAS,EAAG,CAOpB,IAAM,EAAQ,EAGd,GAFA,EAAoB,EAAO,CAAK,EAE5B,IAAS,QAAa,IAAU,OAKlC,EAAO,EACP,EAAY,EAKZ,SAAU,EAAa,EAAgC,CAAS,EAChE,EAAO,OACP,EAAM,QAAQ,GAAG,EAAa,EAAO,CAAK,CAAC,GAIjD,EAAU,OAAO,eAAe,CAAO,EAGzC,GAAI,IAAU,OAAW,OAAO,EAChC,GAAI,IAAS,OAAW,OAAO,GAK/B,OAAO,EAAK,KAAK,CAAC,IAAU,OAAO,IAAU,UAAU,EACnD,EAAa,EAAM,CAAS,EAC3B,EAuBA,SAAS,CAAkB,CAAC,EAAsB,CACvD,IAAI,EAAU,EAEd,MAAO,GAAW,IAAY,SAAS,UAAW,CAKhD,GAAI,OAAO,OAAO,EAAS,WAAW,GAAK,EAAQ,UAAW,CAC5D,IAAM,EAAQ,EAAQ,UACtB,GAAI,EAAM,OAAS,EAAG,EAAoB,EAAS,CAAK,EAE1D,EAAU,OAAO,eAAe,CAAO,GAI3C,SAAS,CAAW,CAAC,EAAwB,CAC3C,OAAQ,GAA6B,MAAQ,aAG/C,IAAM,GAAgC,OAAO,OAAO,CAAC,CAAC,EAS/C,SAAS,CAAa,CAC3B,EACA,EACA,EAKA,EAAiC,CAAC,EAC7B,CACL,GAAI,EAAS,SAAW,EAAG,OAAO,EAElC,IAAI,EAAM,EAON,EAEJ,QAAW,KAAU,EACnB,GAAI,EAAO,QAET,GADgB,EAAO,OAAO,CAAO,IACrB,GACd,MAAM,IAAI,EAAkB,EAAQ,MAAO,EAAQ,SAAS,EAKlE,QAAW,KAAU,EAAU,CAC7B,GAAI,CAAC,EAAO,MAAO,SAOnB,GAAI,GAAU,IAAI,EAAQ,SAAS,EAAG,CACpC,GAAoB,EAAQ,CAAO,EACnC,SAGF,IAAM,EAAQ,EAAO,MAAM,CAAO,EAClC,GAAI,IAAU,QAAa,IAAU,KAAM,SAO3C,GALA,GAAe,CAAO,EAKlB,GAAS,IAAI,EAAQ,SAAS,GAAK,CAAC,EAAO,SAAU,CACvD,IAAM,EAAQ,GAAiB,CAAK,EACpC,GAAI,EAAM,OAAS,GAAI,IAAc,CAAC,GAAG,KAAK,GAAG,CAAK,EAGxD,EAAM,GAAU,EAAK,CAAK,EAG5B,GAAI,GAAS,IAAI,EAAQ,SAAS,GAChC,QAAW,KAAU,EACnB,GAAI,EAAO,SAAU,EAAM,GAAY,EAAK,EAAS,CAAM,EAI/D,GAAI,GAAS,IAAI,EAAQ,SAAS,GAChC,QAAW,KAAU,EACnB,GAAI,EAAO,SAAU,EAAM,GAAY,EAAK,EAAS,CAAM,EAsB/D,GAAI,IAAc,OAChB,GAAoB,EAAW,EAAS,EAAK,CAAW,EAG1D,OAAO,EAyBT,SAAS,EAAS,CAAC,EAAW,EAAqB,CACjD,IAAM,EAAQ,GAAM,MAEpB,GAAI,IAAU,QAAa,IAAU,KACnC,MAAO,IAAK,EAAM,MAAO,CAAM,EAGjC,GAAI,OAAO,IAAU,UAAY,MAAM,QAAQ,CAAK,EAClD,MAAO,IAAK,EAAM,MAAO,CAAE,IAAK,CAAC,EAAO,CAAK,CAAE,CAAE,EAInD,IAAM,EAAW,EAAM,IACjB,EACJ,IAAa,QAAa,IAAa,KACnC,CAAC,EACD,MAAM,QAAQ,CAAQ,EACpB,EACA,CAAC,CAAQ,EAEjB,MAAO,IAAK,EAAM,MAAO,IAAK,EAAO,IAAK,CAAC,GAAG,EAAS,CAAK,CAAE,CAAE,EAIlE,SAAS,EAAW,CAAC,EAAW,EAAwB,EAA0B,CAQhF,IAAM,EAAM,CAAC,IAAc,EAAO,SAAU,EAAS,IAAK,CAAK,CAAC,EAEhE,GAAI,EAAQ,YAAc,aAAc,CACtC,IAAM,EAAO,GAAM,KACnB,MAAO,IACF,EACH,KAAM,MAAM,QAAQ,CAAI,EAAI,EAAK,IAAI,CAAG,EAAI,EAAI,CAAI,CACtD,EAGF,GAAI,EAAQ,YAAc,SAGxB,MAAO,IAAK,EAAM,OAAQ,EAAI,GAAM,MAAM,CAAE,EAG9C,MAAO,IAAK,EAAM,KAAM,EAAI,GAAM,IAAI,CAAE,EAU1C,SAAS,EAAW,CAClB,EACA,EACA,EACK,CACL,IAAM,EAAM,EAAQ,YAAc,SAAW,SAAW,OAClD,EAAU,IAAO,GAIvB,GAAI,IAAY,QAAa,IAAY,KAAM,OAAO,EAEtD,MAAO,IAAK,GAAO,GAAM,EAAO,SAAU,EAAS,IAAK,CAAQ,CAAC,CAAE,EAgBrE,SAAS,EAAmB,CAC1B,EACA,EACA,EAgBA,EAAiC,CAAC,EAC5B,CACN,IAAM,EAAO,GAAM,KACnB,GAAI,OAAO,IAAS,UAAY,IAAS,KAAM,OAE/C,IAAM,EAAW,EAAU,OACzB,CAAC,KAAU,KAAS,IAAQ,CAAC,EAAY,SAAS,CAAK,CACzD,EACA,GAAI,EAAS,SAAW,EAAG,OAE3B,MAAM,IAAI,EAAiB,EAAQ,MAAO,EAAQ,UAAW,CAC3D,GAAG,IAAI,IAAI,CAAQ,CACrB,CAAC,EAYH,SAAS,EAAgB,CAAC,EAA0B,CAClD,GAAI,OAAO,IAAU,UAAY,IAAU,MAAQ,MAAM,QAAQ,CAAK,EACpE,MAAO,CAAC,EAGV,IAAM,EAAkB,CAAC,EACzB,QAAW,KAAO,OAAO,KAAK,CAAgC,EAAG,CAC/D,GAAI,IAAQ,OAAS,IAAQ,MAAQ,IAAQ,MAAO,SACpD,EAAM,KAAK,CAAG,EAEhB,OAAO,EAqBT,SAAS,EAAmB,CAC1B,EACA,EACM,CACN,GAAI,EAAO,SAAU,OAErB,MAAM,IAAI,EACR,EAAQ,UACR,EAAQ,MACR,EAAQ,UACR,GAAG,EAAQ,+DACN,EAAQ,gMAGX,+EACA,kCACJ,EAaF,SAAS,EAAc,CAAC,EAA8B,CACpD,GAAI,GAAS,IAAI,EAAQ,SAAS,EAAG,OAErC,MAAM,IAAI,EACR,EAAQ,UACR,EAAQ,MACR,EAAQ,UACR,GAAG,EAAQ,wCAAwC,EAAQ;AAAA;AAAA,mEAKzD,iFACA,qIAEJ,EAYK,SAAS,EAAc,CAC5B,EACA,EACA,EACM,CACN,GAAI,EAAS,SAAW,EAAG,OAE3B,IAAM,EAAY,EAAS,OAAO,CAAC,IAAW,EAAO,MAAM,EAC3D,GAAI,EAAU,SAAW,EAAG,OAE5B,QAAW,KAAO,GAAO,CAAM,EAC7B,QAAW,KAAU,EAAW,EAAO,OAAQ,EAAS,CAAG,EAI/D,SAAS,EAAM,CAAC,EAAwB,CACtC,GAAI,MAAM,QAAQ,CAAM,EAAG,OAAO,EAClC,GAAI,IAAW,MAAQ,IAAW,OAAW,MAAO,CAAC,EACrD,GAAI,OAAO,IAAW,SAAU,MAAO,CAAC,EACxC,MAAO,CAAC,CAAM,EAgBT,SAAS,EAAc,CAC5B,EACA,EACA,EACM,CACN,QAAW,KAAQ,EAAQ,CACzB,IAAM,EAAQ,EAAO,OAAO,GAE5B,GAAI,GAAS,CAAC,EAAM,SAClB,MAAM,IAAI,EACR,UAAU,IACV,EAAO,KACP,SACA,IAAI,8DACF,2EACA,mIAEJ,EAGF,GAAI,KAAQ,EAAK,EAAI,GAAQ,MA0B1B,SAAS,EAAW,EAAY,CAIrC,IAAM,EAAQ,EAAa,EAC3B,GAAI,EAAO,OAAO,EAAM,KAKxB,OAAO,GAAa,GAAG,MAAQ,KAGjC,SAAS,EAAY,EAAmC,CACtD,GAAI,CACF,OAAO,EAAe,SAAS,EAC/B,KAAM,CAIN,QAiBJ,IAAM,EAAa,OAAO,kCAAkC,EAErD,SAAS,EAAa,CAAC,EAAqC,CACjE,MAAO,IAAK,GAAU,GAAa,EAAK,EAGnC,SAAS,EAAW,CAAC,EAA2B,CACrD,OACE,OAAO,IAAY,UACnB,IAAY,MACX,EAAoC,KAAgB,GAyBzD,IAAM,GAAe,OAAO,iCAAiC,EAEtD,SAAS,EAAe,CAC7B,EACA,EACQ,CACR,MAAO,IAAK,GAAU,IAAe,CAAO,EAGvC,SAAS,EAAiB,CAAC,EAAqC,CACrE,GAAI,OAAO,IAAY,UAAY,IAAY,KAAM,OAAO,EAC5D,IAAM,EAAU,EAAoC,IACpD,OAAO,MAAM,QAAQ,CAAM,EAAK,EAAsB,EAGxD,IAAM,EAAkC,CAAC,EAwDnC,GAAc,OAAO,uCAAuC,EAE3D,SAAS,EAAc,CAC5B,EACA,EACQ,CACR,MAAO,IAAK,GAAU,IAAc,CAAU,EAGzC,SAAS,EAAU,CAAC,EAAyC,CAClE,GAAI,OAAO,IAAY,UAAY,IAAY,KAAM,OACrD,IAAM,EAAa,EAAoC,IACvD,OAAO,OAAO,IAAc,SAAY,EAA0B,OAiC7D,IAAM,EAAyB,WA+D/B,SAAS,EAAmB,CACjC,EAGA,EACA,EACA,EACA,EACK,CACL,GAAI,IAAS,QAAa,IAAS,KAAM,OAAO,EAChD,GAAI,OAAO,IAAS,SAAU,OAAO,EAErC,IAAI,EAAM,EAEV,QAAW,IAAa,CAAC,UAAW,QAAQ,EAAY,CACtD,IAAM,EAAO,EAAK,GAClB,GAAI,OAAO,IAAS,UAAY,IAAS,MAAQ,MAAM,QAAQ,CAAI,EACjE,SAGF,IAAI,EAEJ,QAAW,KAAO,OAAO,KAAK,CAAI,EAAG,CAMnC,GAAI,IAAQ,EAAW,CACrB,IAAM,EAAe,GACnB,EACC,EAAiC,GAClC,EACA,EACA,CACF,EACA,GAAI,IAAkB,EAAiC,GACrD,IAAc,IAAM,CAAiC,EACrD,EAAU,GAAO,EAEnB,SAGF,IAAM,EAAW,EAAO,UAAU,GAClC,GAAI,CAAC,EAAU,SAEf,IAAM,EAAQ,EAAiC,GAC/C,GAAI,IAAS,QAAa,IAAS,GAAO,SAE1C,IAAM,EAAS,EAAO,EAAS,KAAK,EAGpC,GAAI,CAAC,EAAQ,SAOb,IAAM,EAAW,IAAS,GAAO,CAAC,EAAI,EACtC,GAAI,OAAO,IAAa,UAAY,MAAM,QAAQ,CAAQ,EAAG,SAI7D,IAAM,EAAS,GACb,EAAO,OACP,EACA,EACA,EACA,CACF,EAIM,EACJ,CAAC,GAAU,EAAO,SAAS,OAAS,EAChC,EACE,EAAO,SACP,EAAc,EAAO,OAAO,KAAM,EAAa,EAAM,CAAM,EAC3D,CACF,EACA,EAIN,GAAI,IAAW,EACb,IAAc,IAAM,CAAiC,EACrD,EAAU,GAAO,EAIrB,GAAI,EAAW,EAAM,IAAK,GAAM,GAAY,CAAU,EAOxD,IAAM,EAAU,GACd,EACA,EAAI,QACJ,EACA,EACA,CACF,EACA,GAAI,IAAY,EAAI,QAAS,EAAM,IAAK,EAAK,QAAS,CAAQ,EAK9D,IAAM,EAAW,EACf,EACA,EAAI,MACJ,EACA,EACA,CACF,EACA,GAAI,IAAa,EAAI,MAAO,EAAM,IAAK,EAAK,MAAO,CAAS,EAE5D,OAAO,EAoBT,SAAS,EAAsB,CAC7B,EACA,EACA,EACA,EACA,EACS,CACT,GAAI,EAAQ,OAAO,EACnB,GAAI,OAAO,IAAY,UAAY,IAAY,KAAM,OAAO,EAE5D,GAAI,MAAM,QAAQ,CAAO,EAAG,CAC1B,IAAI,EAAU,GACR,EAAM,EAAQ,IAAI,CAAC,IAAU,CACjC,IAAM,EAAS,GACb,EACA,EACA,EACA,EACA,CACF,EACA,GAAI,IAAW,EAAO,EAAU,GAChC,OAAO,EACR,EACD,OAAO,EAAU,EAAM,EAGzB,IAAI,EACE,EAAS,EAEf,QAAW,KAAO,OAAO,KAAK,CAAM,EAAG,CACrC,IAAM,EAAW,EAAO,UAAU,GAClC,GAAI,CAAC,EAAU,SAEf,IAAM,EAAO,EAAO,GACpB,GAAI,OAAO,IAAS,UAAY,IAAS,MAAQ,MAAM,QAAQ,CAAI,EAEjE,SAGF,IAAM,EAAS,EAAO,EAAS,KAAK,EACpC,GAAI,CAAC,GAAU,EAAO,SAAS,SAAW,EAAG,SAE7C,IAAM,EAAS,EACb,EAAO,SACP,EAAc,EAAO,OAAO,KAAM,EAAa,EAAM,CAAM,EAC3D,CACF,EAEA,GAAI,IAAW,EACb,IAAc,IAAK,CAAO,EAC1B,EAAU,GAAO,EAIrB,OAAO,GAAa,EAUtB,SAAS,EAAW,CAClB,EACA,EACA,EACA,EACA,EACS,CACT,GAAI,EAAQ,OAAO,EAkBnB,IAAM,EAAY,IAAS,GAE3B,GACE,CAAC,IACA,OAAO,IAAS,UAAY,IAAS,MAAQ,MAAM,QAAQ,CAAI,GAEhE,OAAO,EAGT,IAAM,EAAY,EACd,OAAO,YAAY,EAAmB,CAAM,EAAE,IAAI,CAAC,IAAS,CAAC,EAAM,EAAI,CAAC,CAAC,EACxE,EAAiC,OAEtC,GACE,OAAO,IAAc,UACrB,IAAc,MACd,MAAM,QAAQ,CAAS,EAGvB,OAAO,EAGT,IAAI,EACE,EAAS,EAEf,QAAW,KAAO,OAAO,KAAK,CAAM,EAAG,CACrC,IAAM,EAAQ,EAAO,GACrB,GAAI,IAAU,QAAa,IAAU,GAAO,SAE5C,IAAM,EAAW,EAAO,UAAU,GAClC,GAAI,CAAC,EAAU,SAEf,IAAM,EAAS,EAAO,EAAS,KAAK,EACpC,GAAI,CAAC,GAAU,EAAO,SAAS,SAAW,EAAG,SAE7C,IAAM,EAAW,IAAU,GAAO,CAAC,EAAI,EACvC,GAAI,OAAO,IAAa,UAAY,MAAM,QAAQ,CAAQ,EAAG,SAE7D,IAAM,EAAS,EACb,EAAO,SACP,EAAc,EAAO,OAAO,KAAM,EAAa,EAAM,CAAM,EAC3D,CACF,EAEA,GAAI,IAAW,EACb,IAAc,IAAK,CAAO,EAC1B,EAAU,GAAO,EAIrB,GAAI,CAAC,EAAW,OAAO,EAKvB,OAAO,EACH,CAAE,OAAQ,CAAU,EACpB,IAAM,EAAkC,OAAQ,CAAU,EAgBhE,SAAS,CAAoB,CAC3B,EACA,EACA,EACA,EACA,EACS,CACT,GAAI,OAAO,IAAU,UAAY,IAAU,KAAM,OAAO,EAExD,GAAI,MAAM,QAAQ,CAAK,EAAG,CACxB,IAAI,EAAU,GACR,EAAM,EAAM,IAAI,CAAC,IAAU,CAC/B,IAAM,EAAS,EACb,EACA,EACA,EACA,EACA,CACF,EACA,GAAI,IAAW,EAAO,EAAU,GAChC,OAAO,EACR,EACD,OAAO,EAAU,EAAM,EAGzB,IAAI,EACE,EAAS,EAEf,QAAW,KAAO,OAAO,KAAK,CAAM,EAAG,CACrC,IAAM,EAAQ,EAAO,GACrB,GAAI,IAAU,OAAW,SAIzB,GAAI,IAAQ,OAAS,IAAQ,MAAQ,IAAQ,MAAO,CAClD,IAAM,EAAS,EACb,EACA,EACA,EACA,EACA,CACF,EACA,GAAI,IAAW,EACb,IAAc,IAAK,CAAO,EAC1B,EAAU,GAAO,EAEnB,SAGF,IAAM,EAAW,EAAO,UAAU,GAClC,GAAI,CAAC,EAAU,SAEf,IAAM,EAAS,GACb,EACA,EACA,EACA,EACA,CACF,EACA,GAAI,IAAW,EACb,IAAc,IAAK,CAAO,EAC1B,EAAU,GAAO,EAIrB,OAAO,GAAa,EAItB,SAAS,EAAiB,CACxB,EACA,EACA,EACA,EACA,EACS,CACT,GAAI,OAAO,IAAU,UAAY,IAAU,MAAQ,MAAM,QAAQ,CAAK,EAKpE,OAAO,EAGT,IAAM,EAAS,EAAO,EAAS,KAAK,EACpC,GAAI,CAAC,EAAQ,OAAO,EAEpB,IAAM,EAAY,EAAwB,EAAS,IAAI,EACjD,EAAY,CAAC,EAAe,EAAO,CAAS,EAC5C,EAAoC,EACtC,CAAC,CAAC,KAAM,CAAK,CAAC,EACd,OAAO,QAAQ,CAAgC,EAE/C,EAEJ,QAAY,EAAU,KAAa,EAAS,CAC1C,GAAI,IAAa,MAAQ,IAAa,OAAW,SAIjD,IAAM,EAAS,EACb,EAAO,OACP,EACA,EACA,EACA,CACF,EAEM,EACJ,CAAC,GAAU,EAAO,SAAS,OAAS,EAChC,EACE,EAAO,SACP,EAAc,EAAO,OAAO,KAAM,EAAa,EAAM,CAAM,EAC3D,CAAE,MAAO,CAAO,CAClB,EAAE,MACF,EAEA,EAAQ,IAAa,QAAU,GAAe,EAAQ,CAAK,EAAI,EAErE,GAAI,IAAU,EACZ,IAAc,EACV,CAAC,EACD,IAAM,CAAkC,EAC5C,EAAU,GAAY,EAI1B,GAAI,CAAC,EAAW,OAAO,EAGvB,OAAO,EAkCT,SAAS,EAAc,CAAC,EAAgB,EAA0B,CAChE,GAAI,IAAW,EAAO,OAAO,EAK7B,IAAM,EAAS,EAAW,CAAK,EAEzB,EADQ,EAAW,CAAM,EACX,MAAM,EAAO,MAAM,EACvC,GAAI,EAAM,SAAW,EAAG,OAAO,EAK/B,MAAO,CAAE,GAAI,CAAC,CAAE,IAFd,EAAM,SAAW,EAAI,EAAM,GAAK,CAAE,IAAK,CAAM,CAEd,EAAG,CAAK,CAAE,EAG7C,SAAS,CAAU,CAAC,EAA2B,CAC7C,GAAI,OAAO,IAAU,UAAY,IAAU,KAAM,MAAO,CAAC,EACzD,IAAM,EAAS,EAAkC,IACjD,GAAI,IAAU,OAAW,MAAO,CAAC,EACjC,OAAO,MAAM,QAAQ,CAAK,EAAI,EAAQ,CAAC,CAAK,ECr/DvC,SAAS,EAAwB,IACnC,EACG,CACN,IAAO,GAAS,GAAwB,GAAG,CAAO,EAClD,GAAI,IAAU,OAAW,MAAM,EA4B1B,SAAS,EAAuB,IAClC,EAC6B,CAChC,IAAM,EAA2C,CAAC,EAElD,QAAW,KAAU,EACnB,QAAW,KAAY,OAAO,OAAO,CAAM,EAAG,CAC5C,IAAM,EAAQ,GAAa,CAAQ,EACnC,GAAI,IAAU,KAAM,SAkBpB,EAAmB,CAAK,EAExB,IAAM,EAAO,EAAM,QAAQ,KACrB,EAAsB,EAAI,CAAI,EACtB,EAAa,CAAI,EAC3B,OAMJ,GAAI,IAAe,QAAa,IAAe,EAAO,SAEtD,IAAM,EAAO,EAAY,CAAK,EACxB,EAAS,EAAY,CAAU,EAC/B,EACJ,EAAK,SAAW,EAAO,QACvB,EAAK,KAAK,CAAC,EAAQ,IAAU,IAAW,EAAO,EAAM,EASvD,GAAI,EAAa,EAAY,CAAK,GAAK,EAAa,EAAO,CAAU,EAAG,CACtE,IAAM,EAAW,EAAa,EAAO,CAAU,EAAI,EAAa,EAC1D,EAAa,IAAa,EAAa,EAAQ,EAErD,GAAI,EAAY,CAAQ,EAAE,SAAW,EAAG,CAkBtC,GAAI,IAAe,EAAY,SAI/B,GAAI,CAAC,EAAU,SAKf,EAAS,KACP,IAAI,EACF,EACA,EAAO,CAAU,EACjB,EAAO,CAAK,EACZ,EAAK,OAAS,EAAI,UAAY,YAChC,CACF,EACA,SAQF,GAAI,EACF,EAAS,KACP,IAAI,EACF,EACA,EAAO,CAAQ,EACf,EAAO,CAAU,EACjB,WACF,CACF,EAIF,SAGF,GAAI,CAAC,EAAU,SAIf,EAAS,KACP,IAAI,EACF,EACA,EAAO,CAAU,EACjB,EAAO,CAAK,EACZ,EAAK,OAAS,EAAI,UAAY,YAChC,CACF,EAIJ,OAAO,EAyCF,SAAS,EAAc,IACzB,EACG,CAUN,IAAM,EAAS,IAAI,IAEnB,QAAW,KAAU,EAAS,CAC5B,IAAM,EAAa,IAAI,IAIvB,QAAW,KAAY,IAAI,IAAI,OAAO,OAAO,CAAM,CAAC,EAAG,CACrD,IAAM,EAAQ,GAAa,CAAQ,EACnC,GAAI,IAAU,KAAM,SAEpB,IAAM,EAAO,EAAM,QAAQ,KACrB,EAAW,EAAW,IAAI,CAAI,EACpC,GAAI,IAAa,OAAW,EAAW,IAAI,EAAM,CAAC,CAAK,CAAC,EACnD,OAAS,KAAK,CAAK,EAK1B,QAAY,EAAM,KAAY,EAC5B,EAAO,IAAI,EAAM,GAAM,EAAM,CAAO,CAAC,EAUzC,IAAM,EAAW,CAAC,GAAG,EAAO,KAAK,CAAC,EAC/B,OAAO,CAAC,IAAkB,EAAI,CAAI,CAAC,EACnC,IAAI,CAAC,IAAS,CAAC,EAAe,EAAa,CAAI,CAAC,CAAU,EAE7D,QAAY,EAAM,KAAU,EAAiB,EAAS,EAAM,CAAK,EAEjE,GAAI,CACF,GAAyB,GAAG,CAAO,EACnC,MAAO,EAAO,CACd,QAAY,EAAM,KAAU,EAAmB,EAAS,EAAM,CAAK,EACnE,MAAM,GAqCV,SAAS,EAAK,CAAC,EAAc,EAAmC,CAC9D,GAAI,EAAQ,SAAW,EAAG,OAAO,EAAQ,GAEzC,IAAM,EAAU,EAAQ,OAAO,CAAC,IAAc,CAAC,GAAgB,CAAS,CAAC,EACnE,EAAW,EAAQ,OAAS,EAAI,EAAU,EAEhD,GAAI,EAAS,SAAW,EAAG,OAAO,EAAS,GAE3C,IAAM,EAAQ,EAAS,OAAO,CAAC,IAC7B,EAAS,MACP,CAAC,IAAU,IAAU,GAAa,EAAa,EAAO,CAAS,CACjE,CACF,EAEA,GAAI,EAAM,SAAW,EAAG,OAAO,EAAM,GAErC,MAAM,IAAI,GACR,EACA,EAAS,IAAI,CAAC,IAAc,EAAO,CAAS,CAAC,CAC/C,EAqCF,SAAS,EAAe,CAAC,EAAgC,CAKvD,GAAI,eAAgB,EAClB,OACE,OAAO,OAAO,EAAW,YAAY,GACpC,EAAuC,aAAe,GAI3D,OAAO,OAAO,OAAO,EAAW,SAAS,EAQ3C,SAAS,CAAY,CAAC,EAAkB,EAAwB,CAC9D,IAAI,EAAU,OAAO,eAAe,CAAO,EAE3C,MAAO,IAAY,MAAQ,IAAY,SAAS,UAAW,CACzD,GAAI,IAAY,EAAM,MAAO,GAC7B,EAAU,OAAO,eAAe,CAAO,EAGzC,MAAO,GAGT,SAAS,CAAM,CAAC,EAAwB,CACtC,OAAQ,GAA6B,MAAQ,OAAO,CAAK,EAgB3D,SAAS,EAAY,CAAC,EAAmC,CACvD,GAAI,OAAO,IAAU,WAAY,OAAO,KAExC,IAAM,EAAU,EAAoC,QACpD,GAAI,IAAW,QAAa,OAAO,EAAO,OAAS,SAAU,OAAO,KAEpE,OAAO",
-  "debugId": "47E1B4E8BB1AA46E64756E2164756E21",
+  "debugId": "02B68C4D9B8E7CE764756E2164756E21",
   "names": []
 }

package/dist/{chunk-1705yamg.js → chunk-kjgy7sk0.js}

@@ -45,6 +45,6 @@ Say which, and registerModels will leave it alone:
     register("${j}", ${z[0]})
 
 A class that is only a typed view over the same rows belongs in a module you do not hand to registerModels.`);this.model=j;this.candidates=z;this.name="AmbiguousModelRegistrationError"}}class C extends Error{model;operation;required;limit;dialect;constructor(j,z,B,G,H,I){super(`${j}.${z} would bind ${B} parameters, and the '${H}' driver accepts at most ${G} in one statement. ${I}`+(z==="createMany"?" A createMany over the ceiling is normally split across statements inside one transaction, so reaching this means splitting cannot help: a single row binds more than the driver accepts.":" Splitting is not something this operation can do for you \u2014 one "+"statement has to carry one answer. Narrow the query."));this.model=j;this.operation=z;this.required=B;this.limit=G;this.dialect=H;this.name="ParameterLimitError"}}class D extends Error{model;operation;field;constructor(j,z,B){super(`${j}.${z} is missing a value for '${B}', which is required and has no default.`);this.model=j;this.operation=z;this.field=B;this.name="MissingRequiredValueError"}}class F extends Error{relation;model;constructor(j,z,B){super(`'${j}' is not a relation on model ${z}. `+(B.length>0?`Known relations: ${B.join(", ")}.`:`${z} declares no relations.`));this.relation=j;this.model=z;this.name="UnknownRelationError"}}class b extends Error{model;limit;constructor(j,z){super(`The include tree nests more than ${z} relations deep (at model ${j}). Deeply nested includes are legal, so this is a guard against a generated or malformed argument tree rather than a limit on `+"modelling \u2014 every level costs at least one query.");this.model=j;this.limit=z;this.name="RelationDepthExceededError"}}class P extends Error{model;relation;target;constructor(j,z,B,G){super(`${j}.${z} points at model '${B}', which nothing has registered. The generated artifact and the registry disagree: re-run \`prisma generate\`, and check that app/models/generated/index.ts is imported. `+(G.length>0?`Registered models: ${G.join(", ")}.`:"Nothing is registered at all."));this.model=j;this.relation=z;this.target=B;this.name="UnregisteredRelationTargetError"}}class R extends Error{model;relation;constructor(j,z,B){super(`Cannot resolve how ${j}.${z} joins: ${B} This means `+"app/models/generated is stale or hand-edited \u2014 re-run "+"`prisma generate`.");this.model=j;this.relation=z;this.name="MalformedRelationError"}}class v extends Error{constructor(j,z){super(`No model is registered under the name '${j}'. `+(z.length>0?`Registered models: ${z.join(", ")}.`:"Nothing is registered \u2014 is app/models/generated/index.ts imported?"));this.name="ModelNotRegisteredError"}}class N extends Error{constructor(j){super(`${j} has no $schema. Model subclasses must extend a generated base class from app/models/generated/models.ts.`);this.name="MissingModelSchemaError"}}class Q extends Error{model;operation;constructor(j,z){super(`${j}.${z} was given 'lock' outside a transaction. A row lock lasts until the transaction that took it ends, so outside one it is released as soon as the row is read and protects nothing. Run the read and the writes it guards inside Model.transaction(async () => { ... }).`);this.model=j;this.operation=z;this.name="LockOutsideTransactionError"}}
-export{K as Nj,Z as Oj,_ as Pj,$ as Qj,L as Rj,M as Sj,U as Tj,V as Uj,y as Vj,O as Wj,W as Xj,E as Yj,S as Zj,T as _j,x as $j,A as ak,C as bk,D as ck,F as dk,b as ek,P as fk,R as gk,v as hk,N as ik,Q as jk};
+export{K as Rj,Z as Sj,_ as Tj,$ as Uj,L as Vj,M as Wj,U as Xj,V as Yj,y as Zj,O as _j,W as $j,E as ak,S as bk,T as ck,x as dk,A as ek,C as fk,D as gk,F as hk,b as ik,P as jk,R as kk,v as lk,N as mk,Q as nk};
 
-//# debugId=C7E85E34119F941664756E2164756E21
+//# debugId=73496901A3DAB52164756E2164756E21

package/dist/{chunk-1705yamg.js.map → chunk-kjgy7sk0.js.map}

@@ -5,6 +5,6 @@
     "/**\n * Thrown when the compiler is handed an argument it does not implement yet.\n *\n * Every public operation accepts the full Prisma argument type from iteration 1\n * — signatures are final, capability grows underneath them. The price of that is\n * that anything unimplemented has to fail loudly: silently dropping a `take: 10`\n * and returning the whole table is the worst failure mode this ORM has.\n */\nexport class UnsupportedQueryError extends Error {\n  constructor(\n    public readonly argument: string,\n    public readonly model: string,\n    public readonly operation: string,\n    /**\n     * What cannot work, and what to do instead.\n     *\n     * **Required**, which is the second half of #61 — the first being the\n     * `UnsupportedByDesignError` split beside this. It was optional, and the\n     * refusals that omitted it were the highest-traffic ones: an argument the\n     * operation does not accept, on the path a typo takes. Those said only\n     * *that* something was refused, to the reader least likely to know why.\n     *\n     * Required rather than conventionally-supplied for the reason five other\n     * parameters here are — `render`'s `origin`, `changedFields`' `schema`,\n     * `RelationExecutor.exec`'s `preScoped`, `resolveLink`'s `operation`,\n     * `assertPageArgument`'s reported name: where omitting an argument produces\n     * a *worse* result rather than an error, `tsc` is the only thing that keeps\n     * a convention. Ninety-five of a hundred call sites already passed one; the\n     * five that did not are exactly the ones nobody revisited.\n     *\n     * `UnknownFieldError` and `UnknownRelationError` set the standard this\n     * meets: both enumerate the valid names rather than only rejecting the\n     * invalid one.\n     */\n    detail: string,\n  ) {\n    super(\n      `gemi ORM does not support '${argument}' yet (${model}.${operation}). ` +\n        detail,\n    );\n    this.name = \"UnsupportedQueryError\";\n  }\n}\n\n/**\n * An argument the ORM has **decided not to implement**, as opposed to one it has\n * not implemented yet.\n *\n * The distinction is the whole point, and it is a distinction a caller can act\n * on: \"yet\" means wait for a release, \"will not\" means change the code. Sharing\n * one error for both meant `docs/orm.md` could list `omit` under *Not in scope*\n * while the runtime said \"yet\" — a contradiction a reader has no way to\n * resolve, and the one #68 exists to end.\n *\n * A subclass rather than a sibling, so `catch (e) { if (e instanceof\n * UnsupportedQueryError) … }` keeps working for callers that do not care which\n * kind it is.\n */\n/**\n * An argument the ORM **does** implement, given a value it cannot mean.\n *\n * The third category, and the one that made \"yet\" wrong four separate times —\n * #82, #88, #100 and #101 each corrected it at their own call site before #61\n * was found to own the problem. The taxonomy the three classes now draw:\n *\n *   not implemented yet     UnsupportedQueryError      wait for a release\n *   decided against         UnsupportedByDesignError   change the call  (#78)\n *   implemented, bad value  InvalidArgumentError       fix the value\n *\n * `take: \"-2\"` is the clearest case. `take` is implemented; `\"-2\"` is not a\n * take. Telling that caller the ORM \"does not support 'take' yet\" is wrong on\n * both halves — it does, and there is nothing to wait for — and it sends them\n * to a changelog when the fix is one character in their own code.\n *\n * **Extends `UnsupportedQueryError`**, so every existing `catch` and every test\n * asserting the base class keeps working. That is the same choice\n * `UnsupportedByDesignError` made, and it is what lets a taxonomy be added to a\n * shipped ORM without a breaking change: the specific classes are for the\n * reader, the base class is for the handler.\n *\n * **Where the taxonomy stops, and why it stops there.** An argument that is not\n * in the grammar at all keeps the base class and its \"yet\" — `{ nope: 1 }`\n * reports \"does not support 'nope' yet\". That is right for half of what reaches\n * that path and wrong for the other half: the same check refuses a typo and a\n * real Prisma argument this ORM has genuinely not implemented, and nothing at\n * that point can tell them apart. Splitting it would mean carrying Prisma's\n * full argument grammar per operation, which is a large amount of duplicated\n * schema for a small gain.\n *\n * What makes it tolerable is the sentence after it. Since #61's other half made\n * `detail` mandatory, that refusal always continues *\"findMany takes include,\n * omit, orderBy, select, skip, take, where\"* — so a caller who typed `nope`\n * learns it is not coming from the very next clause, without the class having\n * to know. Recorded here rather than left to be re-derived, because \"the third\n * class did not cover this one\" is the obvious first reading and it is not the\n * interesting part.\n */\nexport class InvalidArgumentError extends UnsupportedQueryError {\n  constructor(\n    argument: string,\n    model: string,\n    operation: string,\n    /** What is wrong with the value, and what a good one looks like. */\n    reason: string,\n  ) {\n    super(argument, model, operation, reason);\n    this.name = \"InvalidArgumentError\";\n    this.message = `Invalid '${argument}' (${model}.${operation}). ${reason}`;\n  }\n}\n\nexport class UnsupportedByDesignError extends UnsupportedQueryError {\n  constructor(\n    argument: string,\n    model: string,\n    operation: string,\n    /** What to use instead. Required — see #61: a refusal owes the caller a next step. */\n    reason: string,\n  ) {\n    super(argument, model, operation, reason);\n    this.name = \"UnsupportedByDesignError\";\n    this.message =\n      `gemi ORM does not implement '${argument}' (${model}.${operation}), ` +\n      `and this is a decision rather than a gap. ${reason}`;\n  }\n}\n\n/**\n * Thrown when an argument names something that is not a field on the model. A\n * `where` key with no matching field is an error, never a passthrough — that is\n * the rule that keeps user input out of the identifier positions in the SQL.\n */\nexport class UnknownFieldError extends Error {\n  constructor(\n    public readonly field: string,\n    public readonly model: string,\n    known: string[],\n  ) {\n    super(\n      `'${field}' is not a field on model ${model}. ` +\n        `Known fields: ${known.join(\", \")}.`,\n    );\n    this.name = \"UnknownFieldError\";\n  }\n}\n\n/**\n * Thrown when a column holds something the generated schema says it cannot —\n * an unparseable timestamp, a fractional value in a `BigInt` column, malformed\n * JSON. Every dialect needs it, which is why it lives here rather than beside\n * one of them.\n *\n * It exists so those cases fail rather than decode into a plausible wrong\n * value: `new Date(\"nonsense\")` is an `Invalid Date`, not an error, and it\n * would travel a long way before anyone noticed.\n */\nexport class DecodeError extends Error {\n  constructor(\n    public readonly field: { column: string; type: string },\n    public readonly value: unknown,\n  ) {\n    super(\n      `Could not decode the value ${JSON.stringify(String(value))} from column ` +\n        `'${field.column}' as ${field.type}. The column's contents do not match ` +\n        `the Prisma schema — was it written by something other than Prisma or ` +\n        `the gemi ORM?`,\n    );\n    this.name = \"DecodeError\";\n  }\n}\n\n/**\n * Thrown by the `*OrThrow` operations when the query matched nothing. Prisma\n * raises `NotFoundError` / `P2025` for the same case; the differential harness\n * compares the fact of throwing, not the error type.\n */\nexport class RecordNotFoundError extends Error {\n  constructor(\n    public readonly model: string,\n    public readonly operation: string,\n  ) {\n    super(`No ${model} found (${model}.${operation}).`);\n    this.name = \"RecordNotFoundError\";\n  }\n}\n\n/**\n * The dispatchers' test for a lookup that matched nothing and should be\n * answered with a 404.\n *\n * Matches the name as well as the class for the reason `isPolicyDeniedError`\n * and `isUniqueConstraintError` do: `instanceof` compares against *this*\n * module instance's class object, so a second copy of `gemi/orm` — two\n * versions in one dependency tree, a linked package beside a bundled one —\n * throws an error this would not recognise, and the request would go back to\n * being a 500 carrying the model's name in its body.\n *\n * The name is the identity here, so an application error that calls itself\n * `RecordNotFoundError` is deliberately matched too. That is the same bargain\n * the other two predicates make, and the failure it trades against — a 500\n * where a 404 was meant — is the worse one.\n */\nexport function isRecordNotFoundError(error: unknown): error is RecordNotFoundError {\n  if (error instanceof RecordNotFoundError) return true;\n\n  return (\n    typeof error === \"object\" &&\n    error !== null &&\n    (error as { name?: unknown }).name === \"RecordNotFoundError\"\n  );\n}\n\n/**\n * Thrown when a write violates a unique constraint.\n *\n * DECISION — gemi defines its own error rather than mirroring Prisma's codes.\n *\n * Prisma raises `PrismaClientKnownRequestError` with code `P2002` and\n * `meta.target` holding the field names. Mirroring that would ease a migration\n * for code already branching on `P2002`.\n *\n * **The premise this note used to rest on was wrong, and the conclusion is\n * unchanged.** It said \"nothing in this repository does (checked)\", which was\n * true of *this* repository and was never the question — the code that branches\n * on `P2002` lives in the applications the ORM is for. The first real port\n * measured four such guards, every one of them in concurrency-recovery code\n * (catch the collision, re-read, retry), and every one of them silently dead the\n * moment the write moved onto gemi: the `catch` still ran, the condition was\n * false, the recovery did not happen. Nor was the repository itself clean —\n * `templates/saas-starter/app/models/differential.ts:621` branches on `P2002`\n * today, and did when this was written.\n *\n * What the premise was doing was answering \"would anyone notice?\", and the\n * answer is that four people noticed at once. The decision never depended on it.\n * Carrying a `P` code implies the rest of the taxonomy is implemented too:\n * `P2003`, `P2025`, and the fifty others an application might reasonably then\n * expect to catch. Claiming a compatibility surface we have not built is worse\n * than asking the call sites that need it to catch a gemi error instead —\n * *especially* when the code in question is a retry loop, because a\n * compatibility surface that covers `P2002` and not `P2034` fails in exactly\n * the same silent way, one layer further in.\n *\n * A porter reaches for `isUniqueConstraintError` below. `UPGRADE.md` carries\n * the temporary `|| error.code === \"P2002\"` bridge, for a codebase halfway\n * through the move, with the marker that says when to delete it; it is\n * deliberately not exported, because a Prisma code in gemi's permanent surface\n * is the thing this note declined.\n *\n * What the contract does promise is the part that matters: the error is typed,\n * catchable, and names the fields — as *field* names, the way Prisma's\n * `meta.target` does, not as the database columns the driver reported.\n */\nexport class UniqueConstraintError extends Error {\n  constructor(\n    public readonly model: string,\n    public readonly operation: string,\n    /** Field names, mapped back through the schema from the driver's columns. */\n    public readonly fields: string[],\n    /** The constraint's own name, when the dialect reports one. */\n    public readonly constraint?: string,\n    options?: { cause?: unknown },\n  ) {\n    super(\n      `Unique constraint violated on ${model}.${operation}` +\n        (fields.length > 0 ? ` for ${fields.join(\", \")}` : \"\") +\n        (constraint ? ` (constraint '${constraint}')` : \"\") +\n        `. A ${model} with those values already exists.`,\n      options,\n    );\n    this.name = \"UniqueConstraintError\";\n  }\n}\n\n/**\n * The guard to write in a retry-on-collision `catch`, which is where a\n * `code === \"P2002\"` test almost always was:\n *\n *     try {\n *       return await Invite.create({ data: { token } })\n *     } catch (error) {\n *       if (!isUniqueConstraintError(error)) throw error\n *       return await Invite.findUniqueOrThrow({ where: { token } })\n *     }\n *\n * **Why this is worth shipping rather than telling people to write\n * `instanceof`**, which is the obvious objection and the reason it nearly was\n * not shipped. The second half of the test is the whole of it:\n *\n *     error instanceof UniqueConstraintError   ||   error.name === \"UniqueConstraintError\"\n *\n * `instanceof` compares against *this module instance's* class object, so it is\n * false across a duplicate copy of `gemi/orm` — two versions in one dependency\n * tree, a bundled build alongside a linked one, a monorepo package resolving\n * its own. The error is the right error, thrown by the right code, and the\n * guard silently does not fire. That is not a hypothetical: duck-typing rather\n * than importing the class is precisely what the ported application had already\n * done for Prisma's error, for precisely this reason, and shipping a predicate\n * that only does `instanceof` would hand it back the same trap under a new\n * name.\n *\n * So the name is load-bearing rather than a convenience: it is the identity\n * that survives module duplication, which is why every error in this file sets\n * `this.name` explicitly instead of relying on the class name surviving\n * minification.\n *\n * **The narrowing is a claim, and this is what it rests on.** The name branch\n * asserts `UniqueConstraintError` on the strength of a string — a second copy\n * of this module really does carry `model`, `operation` and `fields`, so the\n * claim holds for the case it exists for. An unrelated object named\n * `\"UniqueConstraintError\"` would defeat it, and that is not something that\n * happens by accident.\n *\n * **It deliberately does not match `code === \"P2002\"`.** See the DECISION\n * above: the temporary bridge for a half-ported codebase is in `UPGRADE.md`,\n * where it can carry a delete-me marker, rather than in gemi's permanent\n * surface, where it would have neither.\n */\nexport function isUniqueConstraintError(\n  error: unknown,\n): error is UniqueConstraintError {\n  if (error instanceof UniqueConstraintError) return true;\n\n  return (\n    typeof error === \"object\" &&\n    error !== null &&\n    (error as { name?: unknown }).name === \"UniqueConstraintError\"\n  );\n}\n\n/**\n * Thrown when a write needs `RETURNING` and the dialect has none.\n *\n * Unreachable on SQLite and Postgres, which both support it. It exists so that\n * the MySQL / MariaDB path is a named gap rather than a wrong answer: the\n * fallback there is `lastInsertRowid` plus a re-select, which is a different\n * statement shape and is not implemented.\n */\nexport class ReturningUnsupportedError extends Error {\n  constructor(\n    public readonly model: string,\n    public readonly operation: string,\n    public readonly dialect: string,\n  ) {\n    super(\n      `${model}.${operation} needs RETURNING to report its result, and the ` +\n        `'${dialect}' dialect does not support it. The fallback — ` +\n        `lastInsertRowid plus a re-select — is not implemented.`,\n    );\n    this.name = \"ReturningUnsupportedError\";\n  }\n}\n\n/**\n * Thrown when a policy denies an operation.\n *\n * Two ways to get here, and the message distinguishes them because the fixes\n * are different: a policy's `before` returned false, or the model is policied\n * and there is no user in scope at all.\n *\n * The second is the deny-by-default rule, and it is the reason this error is\n * loud. A cron tick or a queue worker reading a policied model has no user, and\n * the alternative — treating \"no user\" as \"no policy\" — means the dangerous\n * case is the silent one: a request whose auth middleware was misconfigured\n * would read every tenant's rows rather than failing. So unscoped access is\n * always a decision written at the call site, through `Model.asSystem`.\n */\nexport class PolicyDeniedError extends Error {\n  constructor(\n    public readonly model: string,\n    public readonly operation: string,\n    public readonly reason: \"denied\" | \"no-user\" = \"denied\",\n  ) {\n    super(\n      reason === \"no-user\"\n        ? `${model}.${operation} is governed by a policy and there is no user ` +\n            `in scope. If this is a cron tick, a queue worker or a script, say ` +\n            `so at the call site: Model.asSystem(() => ...). Policies are ` +\n            `never skipped just because a user failed to turn up.`\n        : `${model}.${operation} was denied by ${model}'s policy.`,\n    );\n    this.name = \"PolicyDeniedError\";\n  }\n}\n\n/**\n * The api dispatcher's test for a denial it should answer with a 403. It\n * matches the name as well as the class for the reason\n * `isUniqueConstraintError` does: a second copy of `gemi/orm` throws an error\n * that is not `instanceof` this class, and a denial that failed the test would\n * go back to being a 500 that carries the policy's message.\n */\nexport function isPolicyDeniedError(error: unknown): error is PolicyDeniedError {\n  if (error instanceof PolicyDeniedError) return true;\n\n  return (\n    typeof error === \"object\" &&\n    error !== null &&\n    (error as { name?: unknown }).name === \"PolicyDeniedError\"\n  );\n}\n\n/**\n * Thrown when an `update` writes to a column its own policy's `scope` selects on,\n * and the policy has no `onUpdate` saying what that should mean.\n *\n * The shape it catches:\n *\n *     scope: (ctx) => ({ organizationId: ctx.user.organizationId })\n *     // ...and then\n *     User.update({ where: { id }, data: { organizationId: 999 } })\n *\n * The scope did its job — only rows in the caller's own tenant could be selected\n * — and the statement still hands one of them to another tenant. Afterwards the\n * row is outside the scope, so it cannot be read back and cannot be put right by\n * the same caller: a one-way door rather than a visible failure. The usual way in\n * is not malice but mass assignment, a handler forwarding request fields into\n * `data`.\n *\n * This is `assertCreateCovered`'s question asked of the other write. There it is\n * \"you scoped reads but never said what an insert means\"; here it is \"you scoped\n * reads but never said whether an update may move a row out\". Both are answered\n * by writing the hook, including when the answer is \"allow it\" —\n * `onUpdate: (_ctx, data) => data` is a complete and legitimate answer, and\n * saying it out loud is the point.\n *\n * **What it cannot see.** The scope-owned columns are read off the top level of\n * the fragment the policy returned, so `{ organizationId: 7 }` is understood and\n * `{ OR: [...] }` is not — a scope built from combinators is not attributed to\n * any column and an update through it is not checked. Narrowing that would mean\n * either interpreting arbitrary `where` grammar or refusing every update on such\n * a model, and neither is worth it: the guard is a rail on the common shape, not\n * a proof.\n */\nexport class ScopeEscapeError extends Error {\n  constructor(\n    public readonly model: string,\n    public readonly operation: string,\n    public readonly fields: readonly string[],\n  ) {\n    const named = fields.map((field) => `'${field}'`).join(\", \");\n    super(\n      `${model}.${operation} writes ${named}, which ${model}'s policy also ` +\n        `scopes on — so this update can move a row outside the scope that ` +\n        `selected it, where the caller can no longer read or repair it.\\n\\n` +\n        `Add an onUpdate to that policy. It may reassert the column ` +\n        `(data => ({ ...data, ${fields[0]}: ctx.user.${fields[0]} })), reject ` +\n        `the write, or allow it explicitly with (_ctx, data) => data — all ` +\n        `three are fine, and the point is that the policy says which.`,\n    );\n    this.name = \"ScopeEscapeError\";\n  }\n}\n\n/**\n * Thrown when a model class carries policies but is not the class the registry\n * resolves its name to.\n *\n * This exists because of a cross-tenant leak that shipped past review. The\n * generated `index.ts` registers the *generated* base — `register(\"Account\",\n * AccountModel)` — while an application authors its policy on a subclass:\n *\n *     export class Account extends AccountModel {\n *       static $policies = [{ scope: (ctx) => ({ organizationId: … }) }]\n *     }\n *\n * A root query goes through `Account`, so `policiesFor(this)` finds the policy\n * and the scope applies. A **nested** relation read resolves through the\n * registry, gets `AccountModel`, and walks a prototype chain the policy is not\n * on — so `User.findMany({ include: { accounts: true } })` returned every\n * tenant's accounts. Root queries scoped, nested reads unscoped: exactly the\n * Prisma behaviour policies exist to fix, and silent.\n *\n * Raised at the first query through the unregistered class, naming the one-line\n * fix, because the alternative is data crossing a tenant boundary with nothing\n * to notice it.\n *\n * It fires on a divergence in the resolved policy *chain*, not merely on the two\n * classes differing. A plain subclass that adds no policy of its own inherits\n * the same policy objects in the same order, so a nested read resolving to its\n * parent applies exactly what the root query applied — no divergence, nothing\n * to refuse. An earlier version compared class identity and rejected\n * `class AdminUser extends User {}` for policies it had not written.\n */\nexport class UnregisteredPolicyClassError extends Error {\n  constructor(\n    public readonly model: string,\n    /**\n     * Under `carries: \"narrowing\"` this is the *ancestor* — the class the model\n     * belongs to — rather than whatever the registry currently holds. The two\n     * classes are on one prototype chain there, and which of them is registered\n     * is the thing in question, so naming them by their relationship is what\n     * makes the message readable.\n     */\n    public readonly registered: string,\n    /** Under `carries: \"narrowing\"`, the descendant: the view that narrows. */\n    public readonly queried: string,\n    /**\n     * Which side carries the policies that would be skipped, and therefore what\n     * the author should do about it. Three, because they need three different\n     * answers: a missing registration, a query through the wrong class, and a\n     * view that should not be competing for the name at all.\n     */\n    public readonly carries: \"queried\" | \"registered\" | \"narrowing\" = \"queried\",\n  ) {\n    super(\n      carries === \"narrowing\"\n        ? `${queried} extends ${registered}, which owns the model '${model}', ` +\n            `and carries policies of its own on top of it. A class that ` +\n            `narrows an existing model is a view, and the registry holds one ` +\n            `class per name — so registering ${queried} would apply its ` +\n            `narrowing to every nested read of ${model}, and leaving ` +\n            `${registered} registered would skip ${queried}'s policies ` +\n            `entirely. Neither is a thing to choose for you.\\n\\n` +\n            `Keep the view out of the modules you hand to Kernel.models, and ` +\n            `query it directly where you want it:\\n\\n` +\n            `    ${queried}.findMany(…)   // narrowed, at the call site\\n\\n` +\n            `If it is not a view but the model itself, move the policies onto ` +\n            `${registered} — the class the model's name resolves to — and ` +\n            `${queried} inherits them everywhere.\\n`\n        : carries === \"queried\"\n          ? `${queried} carries policies but the registry resolves '${model}' to ` +\n            `${registered}. Nested relation reads go through the registry, so ` +\n            `they would run on ${registered} and skip every policy on ` +\n            `${queried} — scoped at the root, unscoped inside an include. ` +\n            `Register the class that carries the policy:\\n\\n` +\n            `    import { register } from \"gemi/orm\"\\n` +\n            `    export class ${queried} extends ${registered} { … }\\n` +\n            `    register(\"${model}\", ${queried})\\n`\n          : `This query goes through ${queried}, but the registry resolves ` +\n            `'${model}' to ${registered}, which carries policies ${queried} ` +\n            `does not. Nested relation reads would be scoped and this query is ` +\n            `not — the same policy applying to some queries and not others. ` +\n            `Query ${registered} instead:\\n\\n` +\n            `    ${registered}.findMany(…)\\n\\n` +\n            `If skipping policies is intended, say so at the call site — that ` +\n            `is what Model.asSystem() is for, and it is the only way to do it ` +\n            `that a reader can see.\\n`,\n    );\n    this.name = \"UnregisteredPolicyClassError\";\n  }\n}\n\n/**\n * Thrown when a `$policies` array holds something that is not a usable policy.\n *\n * Every case it covers is refused today — by `tsc`, at the class declaration,\n * with `TS2417`, because `Model` declares `static $policies?: readonly\n * PolicyEntry[]` and `ModelPolicy`'s members are all optional, so a typo'd key\n * trips weak-type detection. This is therefore a guard on the paths that import\n * user code *without* having type-checked it: `registerModels` at boot, and\n * `gemi check models`, whose whole job is to find mistakes in a file somebody is\n * still writing.\n *\n * Two failures, and the second is the one that matters.\n *\n * **A function the ORM cannot get a policy out of.** `resolveEntry` instantiates\n * every function entry with no arguments, and there are two ways that goes\n * wrong. A factory nobody called — `softDeletes` rather than\n * `softDeletes({ field })` — is not constructable at all and reached `new entry`\n * to produce `TypeError: function is not a constructor`. A class that *is*\n * constructable and whose constructor wants an argument gets through that check\n * and dies inside its own body instead, with\n * `TypeError: undefined is not an object (evaluating 'opts.field')`. Both are\n * loud and neither named the model, the index or the file, which on a 79-model\n * app leaves the first question unanswered; the second is the case that survived\n * a first pass at this error, because \"constructable\" is a fact about\n * `[[Construct]]` and says nothing about what the constructor then does.\n *\n * **An entry with no recognised hook.** `{ scopes: … }` and\n * `{ default: { scope: … } }` were accepted in silence: `applyPolicies`\n * dispatches on `before` / `scope` / `onCreate` / `onUpdate` and\n * `applyRedaction` on `redact`, so an entry spelling none of them contributes\n * nothing. The model then carries a visible `$policies` array, passes\n * `gemi check models` as correctly registered, and **reads unscoped** — the same\n * written-believed-not-in-effect shape `UnregisteredPolicyClassError` exists\n * for, arriving through a typo instead of through the registry.\n *\n * The line between *empty but valid* and *malformed* is drawn at \"would this\n * ever run\": an entry with at least one recognised hook that is callable is\n * accepted whatever else it carries, because a factory's return value and a\n * policy class routinely hold configuration and helpers beside the hooks, and\n * refusing unknown *extra* keys would reject code that works. An entry with no\n * callable hook at all is refused, `{}` included — it is indistinguishable from\n * a policy that was meant to do something, and a conditional policy belongs in\n * the array rather than in the entry.\n */\nexport class InvalidPolicyEntryError extends Error {\n  constructor(\n    /**\n     * The class whose **own** `$policies` array holds the entry — the class the\n     * author wrote the array on, which is not necessarily the model being\n     * queried when the array is on a base.\n     */\n    public readonly model: string,\n    /** The entry's index in that array. */\n    public readonly index: number,\n    public readonly reason:\n      | \"not-a-policy\"\n      | \"not-constructable\"\n      | \"constructor-threw\"\n      | \"no-hooks\"\n      | \"hook-not-callable\",\n    /** What was found in the entry's place, rendered for a human. */\n    public readonly found: string,\n    /**\n     * The hook names the runtime dispatches on, supplied by `policy.ts` so the\n     * list lives beside the code that reads it rather than being restated here.\n     */\n    hooks: readonly string[],\n    /**\n     * A key the entry actually spells and the hook it is within one edit of.\n     *\n     * **The pair, not the hook alone.** An unattributed \"Did you mean `scope`?\"\n     * after a list of five keys does not say which of them was read as a\n     * misspelling, so a reader who can see that none of them are has no way to\n     * dismiss it — and this error is about an authorization rule that is not in\n     * effect, where a suggestion followed wrongly costs a rename of something\n     * that was never the problem.\n     */\n    public readonly suggestion?: { key: string; hook: string },\n    options?: { cause?: unknown },\n  ) {\n    const where = `${model}.$policies[${index}]`;\n    const named =\n      hooks.length > 1\n        ? `${hooks.slice(0, -1).join(\", \")} or ${hooks[hooks.length - 1]}`\n        : (hooks[0] ?? \"\");\n\n    super(\n      reason === \"not-a-policy\"\n        ? `${where} is ${found}, which is not a policy. An entry is either a ` +\n            `policy object — { scope, onCreate, … } — or a class the ORM ` +\n            `constructs with no arguments.\\n\\n` +\n            `A policy that only sometimes applies belongs in the array rather ` +\n            `than in the entry:\\n\\n` +\n            `    static $policies = [...(multiTenant ? [tenantScope] : [])]\\n`\n        : reason === \"not-constructable\"\n          ? `${where} is ${found}, and a function entry is instantiated with ` +\n            `no arguments — so an arrow function, a plain function, or a ` +\n            `factory that was never called cannot be one.\\n\\n` +\n            `If it is a factory, call it:\\n\\n` +\n            `    static $policies = [softDeletes({ field: \"deletedAt\" })]\\n`\n          : reason === \"constructor-threw\"\n            ? `${where} is ${found}\\n\\n` +\n              `A class entry is constructed with no arguments. If this one ` +\n              `needs some, construct it yourself and put the instance in the ` +\n              `array:\\n\\n` +\n              `    static $policies = [new TenantPolicy({ field: \"orgId\" })]\\n\\n` +\n              `If the constructor reaches for something that is not ready yet, ` +\n              `note that it runs on the first query through this model, not at ` +\n              `boot.\\n`\n            : reason === \"hook-not-callable\"\n              ? `${where} has a ${found}, and every hook is called — so this ` +\n                `would throw on the first query that reached it rather than ` +\n                `doing whatever it was meant to do. Give it a function, or ` +\n                `leave the key out.\\n`\n              : `${where} has none of ${named}, so it would never run. The ` +\n                `model carries a visible $policies array and nothing in it ` +\n                `applies to any query — which for a scope means the model ` +\n                `reads unscoped. ${found}` +\n                (suggestion\n                  ? ` Is '${suggestion.key}' meant to be \\`${suggestion.hook}\\`?`\n                  : \"\") +\n                `\\n`,\n      options,\n    );\n    this.name = \"InvalidPolicyEntryError\";\n  }\n}\n\n/**\n * Thrown when `registerModels` finds two unrelated classes in one module both\n * claiming the same model name.\n *\n * Deriving registration from a module namespace works because the candidates\n * are normally a chain — a generated base, the application's subclass, perhaps\n * a typed view over it — and a chain has a least element to elect. Two classes\n * that extend the same base without extending each other do not: both were\n * written for this model, and only the author knows which one nested reads\n * should run.\n *\n * Refused rather than guessed at, because both guesses are silent. Picking\n * either would scope every `include` of the model by one class's policies while\n * the other's code keeps reading as though its own applied.\n *\n * **\"In one module\" is the exact scope, and the asymmetry is deliberate.**\n * Election happens per module, so two unrelated claims split across *different*\n * modules never meet inside one — the later import simply wins. What catches\n * that is the audit at the end of `registerModels` rather than this error, and\n * only when the two diverge in policies. Two unrelated *unpolicied* claims on\n * one name resolve by import order and nothing reports it, which is tolerable\n * for the same reason it is invisible: with no policies on either, the choice\n * changes no query's scope.\n */\nexport class AmbiguousModelRegistrationError extends Error {\n  constructor(\n    public readonly model: string,\n    public readonly candidates: readonly string[],\n  ) {\n    const named = candidates.map((candidate) => `'${candidate}'`).join(\", \");\n    super(\n      `Two classes in one module claim the model '${model}' — ${named} — and ` +\n        `neither extends the other, so there is no way to tell which one ` +\n        `nested relation reads should run.\\n\\n` +\n        `Say which, and registerModels will leave it alone:\\n\\n` +\n        `    import { register } from \"gemi/orm\"\\n` +\n        `    register(\"${model}\", ${candidates[0]})\\n\\n` +\n        `A class that is only a typed view over the same rows belongs in a ` +\n        `module you do not hand to registerModels.`,\n    );\n    this.name = \"AmbiguousModelRegistrationError\";\n  }\n}\n\n/**\n * Thrown when a statement would bind more parameters than the driver's wire\n * protocol can carry.\n *\n * Three shapes reach it, all of them scaling with the caller's *data* rather\n * than with the query's shape: `createMany` at `rows × columns`, an `in` list on\n * SQLite (one placeholder per element, and such a list is routinely\n * request-derived), and a to-many `include` on SQLite, which batches an `in`\n * over the parent keys. Both limits are hard and low enough to hit with an\n * ordinary import — Postgres counts parameters in an int16 (65535), SQLite\n * defaults `SQLITE_MAX_VARIABLE_NUMBER` to 32766. Postgres escapes the last two\n * either way: `= any($1)` is one parameter however long the array.\n *\n * Prisma chunks the insert automatically. Doing that here means several\n * statements, which without a transaction is a partially-applied `createMany`\n * on failure — so it waits for iteration 5, and until then this is a named gap\n * rather than a driver error naming neither the model nor the cause. Same\n * treatment as `ReturningUnsupportedError`, for the same reason.\n */\nexport class ParameterLimitError extends Error {\n  constructor(\n    public readonly model: string,\n    public readonly operation: string,\n    public readonly required: number,\n    public readonly limit: number,\n    public readonly dialect: string,\n    detail: string,\n  ) {\n    super(\n      `${model}.${operation} would bind ${required} parameters, and the ` +\n        `'${dialect}' driver accepts at most ${limit} in one statement. ` +\n        `${detail}` +\n        (operation === \"createMany\"\n          ? ` A createMany over the ceiling is normally split across statements ` +\n            `inside one transaction, so reaching this means splitting cannot ` +\n            `help: a single row binds more than the driver accepts.`\n          : ` Splitting is not something this operation can do for you — one ` +\n            `statement has to carry one answer. Narrow the query.`),\n    );\n    this.name = \"ParameterLimitError\";\n  }\n}\n\n/**\n * Thrown when a write omits a column that has no value to fall back on: not\n * supplied, no client-side default, no database default, and not nullable.\n *\n * Raised in the compiler rather than left to the database so the message names\n * the field and the model, instead of surfacing as `NOT NULL constraint failed`\n * with a column name and no context.\n */\nexport class MissingRequiredValueError extends Error {\n  constructor(\n    public readonly model: string,\n    public readonly operation: string,\n    public readonly field: string,\n  ) {\n    super(\n      `${model}.${operation} is missing a value for '${field}', which is ` +\n        `required and has no default.`,\n    );\n    this.name = \"MissingRequiredValueError\";\n  }\n}\n\n/**\n * Thrown when an `include` — or a relation-shaped key inside a `select` — names\n * something the model does not declare as a relation.\n */\nexport class UnknownRelationError extends Error {\n  constructor(\n    public readonly relation: string,\n    public readonly model: string,\n    known: string[],\n  ) {\n    super(\n      `'${relation}' is not a relation on model ${model}. ` +\n        (known.length > 0\n          ? `Known relations: ${known.join(\", \")}.`\n          : `${model} declares no relations.`),\n    );\n    this.name = \"UnknownRelationError\";\n  }\n}\n\n/**\n * Thrown when an include tree nests deeper than the guard allows.\n *\n * A cyclic include is legal and finite — `user -> accounts -> user` terminates\n * because the caller wrote a finite tree. What this catches is an *unbounded*\n * one: an argument tree built by a loop, or forwarded from a request body, that\n * describes a thousand levels. Under the batched planner every level is at least\n * one query, so the guard is what stops a malformed argument from becoming a\n * self-inflicted denial of service.\n */\nexport class RelationDepthExceededError extends Error {\n  constructor(\n    public readonly model: string,\n    public readonly limit: number,\n  ) {\n    super(\n      `The include tree nests more than ${limit} relations deep (at model ` +\n        `${model}). Deeply nested includes are legal, so this is a guard ` +\n        `against a generated or malformed argument tree rather than a limit on ` +\n        `modelling — every level costs at least one query.`,\n    );\n    this.name = \"RelationDepthExceededError\";\n  }\n}\n\n/**\n * Thrown when a relation names a model the registry does not hold. Every\n * relation in a generated artifact was emitted from a model in the same\n * `schema.prisma`, so this can only mean the artifact and the registry disagree.\n */\nexport class UnregisteredRelationTargetError extends Error {\n  constructor(\n    public readonly model: string,\n    public readonly relation: string,\n    public readonly target: string,\n    known: string[],\n  ) {\n    super(\n      `${model}.${relation} points at model '${target}', which nothing has ` +\n        `registered. The generated artifact and the registry disagree: re-run ` +\n        `\\`prisma generate\\`, and check that app/models/generated/index.ts is ` +\n        `imported. ` +\n        (known.length > 0\n          ? `Registered models: ${known.join(\", \")}.`\n          : `Nothing is registered at all.`),\n    );\n    this.name = \"UnregisteredRelationTargetError\";\n  }\n}\n\n/**\n * Thrown when a relation is registered on both sides but the two sides do not\n * describe a link the planner can follow: no matching `relationName` on the\n * other model, or a `from` / `to` naming a field that is not there. Like\n * `UnregisteredRelationTargetError`, it means a stale generated artifact — a\n * consistent one cannot produce it.\n */\nexport class MalformedRelationError extends Error {\n  constructor(\n    public readonly model: string,\n    public readonly relation: string,\n    detail: string,\n  ) {\n    super(\n      `Cannot resolve how ${model}.${relation} joins: ${detail} This means ` +\n        `app/models/generated is stale or hand-edited — re-run ` +\n        `\\`prisma generate\\`.`,\n    );\n    this.name = \"MalformedRelationError\";\n  }\n}\n\n/** Thrown when a relation resolves to a model name nothing registered. */\nexport class ModelNotRegisteredError extends Error {\n  constructor(name: string, known: string[]) {\n    super(\n      `No model is registered under the name '${name}'. ` +\n        (known.length > 0\n          ? `Registered models: ${known.join(\", \")}.`\n          : `Nothing is registered — is app/models/generated/index.ts imported?`),\n    );\n    this.name = \"ModelNotRegisteredError\";\n  }\n}\n\n/** Thrown when a model class is used before the generator has given it a schema. */\nexport class MissingModelSchemaError extends Error {\n  constructor(className: string) {\n    super(\n      `${className} has no $schema. Model subclasses must extend a generated ` +\n        `base class from app/models/generated/models.ts.`,\n    );\n    this.name = \"MissingModelSchemaError\";\n  }\n}\n\n/**\n * A `lock` asked for outside a transaction.\n *\n * A row lock is held until the transaction that took it ends. Outside one, the\n * statement is its own transaction, so the lock is released the moment the row\n * comes back — before the write it was meant to guard has even been issued. The\n * read would succeed and protect nothing, which is the failure this refuses: the\n * race the lock was written to close stays open, silently.\n *\n * Raised on SQLite too, where the lock itself compiles to nothing, so code that\n * forgot its transaction fails in development rather than first on Postgres.\n */\nexport class LockOutsideTransactionError extends Error {\n  constructor(\n    public readonly model: string,\n    public readonly operation: string,\n  ) {\n    super(\n      `${model}.${operation} was given 'lock' outside a transaction. A row ` +\n        `lock lasts until the transaction that took it ends, so outside one it ` +\n        `is released as soon as the row is read and protects nothing. Run the ` +\n        `read and the writes it guards inside Model.transaction(async () => { ` +\n        `... }).`,\n    );\n    this.name = \"LockOutsideTransactionError\";\n  }\n}\n"
   ],
   "mappings": ";AAQO,MAAM,UAA8B,KAAM,CAE7B,SACA,MACA,UAHlB,WAAW,CACO,EACA,EACA,EAsBhB,EACA,CACA,MACE,8BAA8B,WAAkB,KAAS,OACvD,CACJ,EA7BgB,gBACA,aACA,iBA4BhB,KAAK,KAAO,wBAEhB,CAuDO,MAAM,UAA6B,CAAsB,CAC9D,WAAW,CACT,EACA,EACA,EAEA,EACA,CACA,MAAM,EAAU,EAAO,EAAW,CAAM,EACxC,KAAK,KAAO,uBACZ,KAAK,QAAU,YAAY,OAAc,KAAS,OAAe,IAErE,CAEO,MAAM,UAAiC,CAAsB,CAClE,WAAW,CACT,EACA,EACA,EAEA,EACA,CACA,MAAM,EAAU,EAAO,EAAW,CAAM,EACxC,KAAK,KAAO,2BACZ,KAAK,QACH,gCAAgC,OAAc,KAAS,iDACV,IAEnD,CAOO,MAAM,UAA0B,KAAM,CAEzB,MACA,MAFlB,WAAW,CACO,EACA,EAChB,EACA,CACA,MACE,IAAI,8BAAkC,oBACnB,EAAM,KAAK,IAAI,IACpC,EAPgB,aACA,aAOhB,KAAK,KAAO,oBAEhB,CAYO,MAAM,UAAoB,KAAM,CAEnB,MACA,MAFlB,WAAW,CACO,EACA,EAChB,CACA,MACE,8BAA8B,KAAK,UAAU,OAAO,CAAK,CAAC,kBACpD,EAAM,cAAc,EAAM,4CAC9B,6EACA,eACJ,EARgB,aACA,aAQhB,KAAK,KAAO,cAEhB,CAOO,MAAM,UAA4B,KAAM,CAE3B,MACA,UAFlB,WAAW,CACO,EACA,EAChB,CACA,MAAM,MAAM,YAAgB,KAAS,KAAa,EAHlC,aACA,iBAGhB,KAAK,KAAO,sBAEhB,CAkBO,SAAS,CAAqB,CAAC,EAA8C,CAClF,GAAI,aAAiB,EAAqB,MAAO,GAEjD,OACE,OAAO,IAAU,UACjB,IAAU,MACT,EAA6B,OAAS,sBA4CpC,MAAM,UAA8B,KAAM,CAE7B,MACA,UAEA,OAEA,WANlB,WAAW,CACO,EACA,EAEA,EAEA,EAChB,EACA,CACA,MACE,iCAAiC,KAAS,KACvC,EAAO,OAAS,EAAI,QAAQ,EAAO,KAAK,IAAI,IAAM,KAClD,EAAa,iBAAiB,MAAiB,IAChD,OAAO,sCACT,CACF,EAdgB,aACA,iBAEA,cAEA,kBAUhB,KAAK,KAAO,wBAEhB,CA8CO,SAAS,CAAuB,CACrC,EACgC,CAChC,GAAI,aAAiB,EAAuB,MAAO,GAEnD,OACE,OAAO,IAAU,UACjB,IAAU,MACT,EAA6B,OAAS,wBAYpC,MAAM,UAAkC,KAAM,CAEjC,MACA,UACA,QAHlB,WAAW,CACO,EACA,EACA,EAChB,CACA,MACE,GAAG,KAAS,oDACN,uDACJ,6DACJ,EARgB,aACA,iBACA,eAOhB,KAAK,KAAO,4BAEhB,CAgBO,MAAM,UAA0B,KAAM,CAEzB,MACA,UACA,OAHlB,WAAW,CACO,EACA,EACA,EAA+B,SAC/C,CACA,MACE,IAAW,UACP,GAAG,KAAS,qOAIZ,GAAG,KAAS,mBAA2B,aAC7C,EAXgB,aACA,iBACA,cAUhB,KAAK,KAAO,oBAEhB,CASO,SAAS,CAAmB,CAAC,EAA4C,CAC9E,GAAI,aAAiB,EAAmB,MAAO,GAE/C,OACE,OAAO,IAAU,UACjB,IAAU,MACT,EAA6B,OAAS,oBAoCpC,MAAM,UAAyB,KAAM,CAExB,MACA,UACA,OAHlB,WAAW,CACO,EACA,EACA,EAChB,CACA,IAAM,EAAQ,EAAO,IAAI,CAAC,IAAU,IAAI,IAAQ,EAAE,KAAK,IAAI,EAC3D,MACE,GAAG,KAAS,YAAoB,YAAgB,mBAC9C,yEACA;AAAA;AAAA,kFAEwB,EAAO,gBAAgB,EAAO,kBACtD,0EACA,8DACJ,EAbgB,aACA,iBACA,cAYhB,KAAK,KAAO,mBAEhB,CAgCO,MAAM,UAAqC,KAAM,CAEpC,MAQA,WAEA,QAOA,QAlBlB,WAAW,CACO,EAQA,EAEA,EAOA,EAAkD,UAClE,CACA,MACE,IAAY,YACR,GAAG,aAAmB,4BAAqC,kIAGzD,wCAAkC,uDACG,kBAClC,2BAAoC;AAAA;AAAA;AAAA;AAAA,MAIhC;AAAA;AAAA,EACP,oEACG,8DACH,GAAG;AAAA,EACL,IAAY,UACV,GAAG,iDAAuD,SACvD,0EACkB,8BAClB,4DACH;AAAA;AAAA;AAAA,mBAEoB,aAAmB;AAAA,EACvC,iBAAiB,OAAW;AAAA,EAC5B,2BAA2B,iCACvB,SAAa,6BAAsC,uEAEvD,uEACA,SAAS;AAAA;AAAA,MACF;AAAA;AAAA,EACP,yEACA;AAAA,CAER,EApDgB,aAQA,kBAEA,eAOA,eAoChB,KAAK,KAAO,+BAEhB,CA8CO,MAAM,UAAgC,KAAM,CAO/B,MAEA,MACA,OAOA,MAgBA,WAhClB,WAAW,CAMO,EAEA,EACA,EAOA,EAKhB,EAWgB,EAChB,EACA,CACA,IAAM,EAAQ,GAAG,eAAmB,KAC9B,EACJ,EAAM,OAAS,EACX,GAAG,EAAM,MAAM,EAAG,EAAE,EAAE,KAAK,IAAI,QAAQ,EAAM,EAAM,OAAS,KAC3D,EAAM,IAAM,GAEnB,MACE,IAAW,eACP,GAAG,QAAY,kDACb,8EACA;AAAA;AAAA;AAAA;AAAA;AAAA,EAIF,IAAW,oBACT,GAAG,QAAY,gDACf,oEACA;AAAA;AAAA;AAAA;AAAA;AAAA,EAGA,IAAW,oBACT,GAAG,QAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQf,IAAW,oBACT,GAAG,WAAe,8CAClB;AAAA,EAGA,GAAG,iBAAqB,2FAExB,iEACA,mBAAmB,KAClB,EACG,QAAQ,EAAW,sBAAsB,EAAW,UACpD,IACJ;AAAA,EACV,CACF,EAxEgB,aAEA,aACA,cAOA,aAgBA,kBA+ChB,KAAK,KAAO,0BAEhB,CA0BO,MAAM,UAAwC,KAAM,CAEvC,MACA,WAFlB,WAAW,CACO,EACA,EAChB,CACA,IAAM,EAAQ,EAAW,IAAI,CAAC,IAAc,IAAI,IAAY,EAAE,KAAK,IAAI,EACvE,MACE,8CAA8C,aAAW,gBACvD;AAAA;AAAA;AAAA;AAAA;AAAA,gBAIiB,OAAW,EAAW;AAAA;AAAA,4GAG3C,EAbgB,aACA,kBAahB,KAAK,KAAO,kCAEhB,CAqBO,MAAM,UAA4B,KAAM,CAE3B,MACA,UACA,SACA,MACA,QALlB,WAAW,CACO,EACA,EACA,EACA,EACA,EAChB,EACA,CACA,MACE,GAAG,KAAS,gBAAwB,0BAC9B,6BAAmC,uBACpC,KACF,IAAc,aACX,4LAGA,wEACA,uDACR,EAjBgB,aACA,iBACA,gBACA,aACA,eAchB,KAAK,KAAO,sBAEhB,CAUO,MAAM,UAAkC,KAAM,CAEjC,MACA,UACA,MAHlB,WAAW,CACO,EACA,EACA,EAChB,CACA,MACE,GAAG,KAAS,6BAAqC,2CAEnD,EAPgB,aACA,iBACA,aAMhB,KAAK,KAAO,4BAEhB,CAMO,MAAM,UAA6B,KAAM,CAE5B,SACA,MAFlB,WAAW,CACO,EACA,EAChB,EACA,CACA,MACE,IAAI,iCAAwC,OACzC,EAAM,OAAS,EACZ,oBAAoB,EAAM,KAAK,IAAI,KACnC,GAAG,2BACX,EATgB,gBACA,aAShB,KAAK,KAAO,uBAEhB,CAYO,MAAM,UAAmC,KAAM,CAElC,MACA,MAFlB,WAAW,CACO,EACA,EAChB,CACA,MACE,oCAAoC,8BAC/B,kIAEH,wDACJ,EARgB,aACA,aAQhB,KAAK,KAAO,6BAEhB,CAOO,MAAM,UAAwC,KAAM,CAEvC,MACA,SACA,OAHlB,WAAW,CACO,EACA,EACA,EAChB,EACA,CACA,MACE,GAAG,KAAS,sBAA6B,8KAItC,EAAM,OAAS,EACZ,sBAAsB,EAAM,KAAK,IAAI,KACrC,gCACR,EAbgB,aACA,gBACA,cAYhB,KAAK,KAAO,kCAEhB,CASO,MAAM,UAA+B,KAAM,CAE9B,MACA,SAFlB,WAAW,CACO,EACA,EAChB,EACA,CACA,MACE,sBAAsB,KAAS,YAAmB,gBAChD,8DACA,oBACJ,EARgB,aACA,gBAQhB,KAAK,KAAO,yBAEhB,CAGO,MAAM,UAAgC,KAAM,CACjD,WAAW,CAAC,EAAc,EAAiB,CACzC,MACE,0CAA0C,QACvC,EAAM,OAAS,EACZ,sBAAsB,EAAM,KAAK,IAAI,KACrC,0EACR,EACA,KAAK,KAAO,0BAEhB,CAGO,MAAM,UAAgC,KAAM,CACjD,WAAW,CAAC,EAAmB,CAC7B,MACE,GAAG,4GAEL,EACA,KAAK,KAAO,0BAEhB,CAcO,MAAM,UAAoC,KAAM,CAEnC,MACA,UAFlB,WAAW,CACO,EACA,EAChB,CACA,MACE,GAAG,KAAS,yQAKd,EATgB,aACA,iBAShB,KAAK,KAAO,8BAEhB",
-  "debugId": "C7E85E34119F941664756E2164756E21",
+  "debugId": "73496901A3DAB52164756E2164756E21",
   "names": []
 }

package/dist/{chunk-6m9qrs6d.js → chunk-kjygnj7y.js}

@@ -1,4 +1,4 @@
 // @bun
-import{h as Nt}from"./chunk-q1aaqhnw.js";import{A as xt,B as pt,C as Xt,i as er,k as L,l as At,m as Wt,n as Yt,p as Hr,q as Lr,r as Rt,s as jt,t as ar,u as Bt,v as Jt,w as lr,x as Mt,y as Ut,z as wt}from"./chunk-bc7hr358.js";import{D as Ft}from"./chunk-28fz99pn.js";import{E as Nr,F as at,H as Dt,L as He,P as M}from"./chunk-8fdk8bfd.js";import{Q as zt}from"./chunk-f6css3z6.js";import{R as lt}from"./chunk-07zfrfbg.js";import"./chunk-nk7nmtng.js";import"./chunk-paawtkza.js";import"./chunk-pqr01waj.js";import"./chunk-a02bmp0q.js";import{ba as ut}from"./chunk-tj7z65ba.js";import{ma as bt}from"./chunk-fhfkcmkc.js";import{Rl as p}from"./chunk-vgxkt9vd.js";var V=p((se)=>{Object.defineProperty(se,"__esModule",{value:!0});se.resolveHttpAuthSchemeConfig=se.defaultSigninHttpAuthSchemeProvider=se.defaultSigninHttpAuthSchemeParametersProvider=void 0;var Mr=L(),H=Nr(),Ur=async(e,r,t)=>{return{operation:(0,H.getSmithyContext)(r).operation,region:await(0,H.normalizeProvider)(e.region)()||(()=>{throw Error("expected `region` to be configured for `aws.auth#sigv4`")})()}};se.defaultSigninHttpAuthSchemeParametersProvider=Ur;function wr(e){return{schemeId:"aws.auth#sigv4",signingProperties:{name:"signin",region:e.region},propertiesExtractor:(r,t)=>({signingProperties:{config:r,context:t}})}}function xr(e){return{schemeId:"smithy.api#noAuth"}}var gr=(e)=>{let r=[];switch(e.operation){case"CreateOAuth2Token":{r.push(xr(e));break}default:r.push(wr(e))}return r};se.defaultSigninHttpAuthSchemeProvider=gr;var fr=(e)=>{let r=(0,Mr.resolveAwsSdkSigV4Config)(e);return Object.assign(r,{authSchemePreference:(0,H.normalizeProvider)(e.authSchemePreference??[])})};se.resolveHttpAuthSchemeConfig=fr});var Se=p((Ee)=>{Object.defineProperty(Ee,"__esModule",{value:!0});Ee.ruleSet=void 0;var ve="required",o="fn",n="argv",c="ref",ne=!0,ie="isSet",S="booleanEquals",I="error",E="endpoint",l="tree",N="PartitionResult",z="stringEquals",de={[ve]:!0,default:!1,type:"boolean"},ue={[ve]:!1,type:"string"},ae={[c]:"Endpoint"},A={[o]:S,[n]:[{[c]:"UseFIPS"},!0]},W={[o]:S,[n]:[{[c]:"UseDualStack"},!0]},s={},Y={[o]:"getAttr",[n]:[{[c]:N},"name"]},R={[o]:S,[n]:[{[c]:"UseFIPS"},!1]},F={[o]:S,[n]:[{[c]:"UseDualStack"},!1]},le={[o]:"getAttr",[n]:[{[c]:N},"supportsFIPS"]},pe={[o]:S,[n]:[!0,{[o]:"getAttr",[n]:[{[c]:N},"supportsDualStack"]}]},ce=[{[c]:"Region"}],hr={version:"1.0",parameters:{UseDualStack:de,UseFIPS:de,Endpoint:ue,Region:ue},rules:[{conditions:[{[o]:ie,[n]:[ae]}],rules:[{conditions:[A],error:"Invalid Configuration: FIPS and custom endpoint are not supported",type:I},{rules:[{conditions:[W],error:"Invalid Configuration: Dualstack and custom endpoint are not supported",type:I},{endpoint:{url:ae,properties:s,headers:s},type:E}],type:l}],type:l},{rules:[{conditions:[{[o]:ie,[n]:ce}],rules:[{conditions:[{[o]:"aws.partition",[n]:ce,assign:N}],rules:[{conditions:[{[o]:z,[n]:[Y,"aws"]},R,F],endpoint:{url:"https://{Region}.signin.aws.amazon.com",properties:s,headers:s},type:E},{conditions:[{[o]:z,[n]:[Y,"aws-cn"]},R,F],endpoint:{url:"https://{Region}.signin.amazonaws.cn",properties:s,headers:s},type:E},{conditions:[{[o]:z,[n]:[Y,"aws-us-gov"]},R,F],endpoint:{url:"https://{Region}.signin.amazonaws-us-gov.com",properties:s,headers:s},type:E},{conditions:[A,W],rules:[{conditions:[{[o]:S,[n]:[ne,le]},pe],rules:[{endpoint:{url:"https://signin-fips.{Region}.{PartitionResult#dualStackDnsSuffix}",properties:s,headers:s},type:E}],type:l},{error:"FIPS and DualStack are enabled, but this partition does not support one or both",type:I}],type:l},{conditions:[A,F],rules:[{conditions:[{[o]:S,[n]:[le,ne]}],rules:[{endpoint:{url:"https://signin-fips.{Region}.{PartitionResult#dnsSuffix}",properties:s,headers:s},type:E}],type:l},{error:"FIPS is enabled but this partition does not support FIPS",type:I}],type:l},{conditions:[R,W],rules:[{conditions:[pe],rules:[{endpoint:{url:"https://signin.{Region}.{PartitionResult#dualStackDnsSuffix}",properties:s,headers:s},type:E}],type:l},{error:"DualStack is enabled but this partition does not support DualStack",type:I}],type:l},{endpoint:{url:"https://signin.{Region}.{PartitionResult#dnsSuffix}",properties:s,headers:s},type:E}],type:l}],type:l},{error:"Invalid Configuration: Missing Region",type:I}],type:l}]};Ee.ruleSet=hr});var Ie=p((Pe)=>{Object.defineProperty(Pe,"__esModule",{value:!0});Pe.defaultEndpointResolver=void 0;var Vr=Lr(),j=Hr(),zr=Se(),Ar=new j.EndpointCache({size:50,params:["Endpoint","Region","UseDualStack","UseFIPS"]}),Wr=(e,r={})=>{return Ar.get(e,()=>(0,j.resolveEndpoint)(zr.ruleSet,{endpointParams:e,logger:r.logger}))};Pe.defaultEndpointResolver=Wr;j.customEndpointFunctions.aws=Vr.awsEndpointFunctions});var U=p((J)=>{Object.defineProperty(J,"__esModule",{value:!0});J.SigninServiceException=J.__ServiceException=void 0;var qe=M();Object.defineProperty(J,"__ServiceException",{enumerable:!0,get:function(){return qe.ServiceException}});class B extends qe.ServiceException{constructor(e){super(e);Object.setPrototypeOf(this,B.prototype)}}J.SigninServiceException=B});var k=p((be)=>{Object.defineProperty(be,"__esModule",{value:!0});be.ValidationException=be.TooManyRequestsError=be.InternalServerException=be.AccessDeniedException=void 0;var w=U();class X extends w.SigninServiceException{name="AccessDeniedException";$fault="client";error;constructor(e){super({name:"AccessDeniedException",$fault:"client",...e});Object.setPrototypeOf(this,X.prototype),this.error=e.error}}be.AccessDeniedException=X;class Q extends w.SigninServiceException{name="InternalServerException";$fault="server";error;constructor(e){super({name:"InternalServerException",$fault:"server",...e});Object.setPrototypeOf(this,Q.prototype),this.error=e.error}}be.InternalServerException=Q;class Z extends w.SigninServiceException{name="TooManyRequestsError";$fault="client";error;constructor(e){super({name:"TooManyRequestsError",$fault:"client",...e});Object.setPrototypeOf(this,Z.prototype),this.error=e.error}}be.TooManyRequestsError=Z;class K extends w.SigninServiceException{name="ValidationException";$fault="client";error;constructor(e){super({name:"ValidationException",$fault:"client",...e});Object.setPrototypeOf(this,K.prototype),this.error=e.error}}be.ValidationException=K});var C=p((We)=>{Object.defineProperty(We,"__esModule",{value:!0});We.CreateOAuth2Token$=We.CreateOAuth2TokenResponseBody$=We.CreateOAuth2TokenResponse$=We.CreateOAuth2TokenRequestBody$=We.CreateOAuth2TokenRequest$=We.AccessToken$=We.errorTypeRegistries=We.ValidationException$=We.TooManyRequestsError$=We.InternalServerException$=We.AccessDeniedException$=We.SigninServiceException$=void 0;var Jr="AccessDeniedException",Xr="AccessToken",Qr="CreateOAuth2Token",Zr="CreateOAuth2TokenRequest",Kr="CreateOAuth2TokenRequestBody",kr="CreateOAuth2TokenResponseBody",Tr="CreateOAuth2TokenResponse",mr="InternalServerException",Cr="RefreshToken",_r="TooManyRequestsError",et="ValidationException",Fe="accessKeyId",Ne="accessToken",T="client",Me="clientId",Ue="codeVerifier",rt="code",y="error",we="expiresIn",xe="grantType",tt="http",m="httpError",ge="idToken",d="jsonName",g="message",x="refreshToken",fe="redirectUri",Le="smithy.ts.sdk.synthetic.com.amazonaws.signin",Ge="secretAccessKey",$e="sessionToken",st="server",ot="tokenInput",nt="tokenOutput",he="tokenType",u="com.amazonaws.signin",Ve=He(),f=k(),it=U(),ze=Ve.TypeRegistry.for(Le);We.SigninServiceException$=[-3,Le,"SigninServiceException",0,[],[]];ze.registerError(We.SigninServiceException$,it.SigninServiceException);var q=Ve.TypeRegistry.for(u);We.AccessDeniedException$=[-3,u,Jr,{[y]:T},[y,g],[0,0],2];q.registerError(We.AccessDeniedException$,f.AccessDeniedException);We.InternalServerException$=[-3,u,mr,{[y]:st,[m]:500},[y,g],[0,0],2];q.registerError(We.InternalServerException$,f.InternalServerException);We.TooManyRequestsError$=[-3,u,_r,{[y]:T,[m]:429},[y,g],[0,0],2];q.registerError(We.TooManyRequestsError$,f.TooManyRequestsError);We.ValidationException$=[-3,u,et,{[y]:T,[m]:400},[y,g],[0,0],2];q.registerError(We.ValidationException$,f.ValidationException);We.errorTypeRegistries=[ze,q];var Ae=[0,u,Cr,8,0];We.AccessToken$=[3,u,Xr,8,[Fe,Ge,$e],[[0,{[d]:Fe}],[0,{[d]:Ge}],[0,{[d]:$e}]],3];We.CreateOAuth2TokenRequest$=[3,u,Zr,0,[ot],[[()=>We.CreateOAuth2TokenRequestBody$,16]],1];We.CreateOAuth2TokenRequestBody$=[3,u,Kr,0,[Me,xe,rt,fe,Ue,x],[[0,{[d]:Me}],[0,{[d]:xe}],0,[0,{[d]:fe}],[0,{[d]:Ue}],[()=>Ae,{[d]:x}]],2];We.CreateOAuth2TokenResponse$=[3,u,Tr,0,[nt],[[()=>We.CreateOAuth2TokenResponseBody$,16]],1];We.CreateOAuth2TokenResponseBody$=[3,u,kr,0,[Ne,he,we,x,ge],[[()=>We.AccessToken$,{[d]:Ne}],[0,{[d]:he}],[1,{[d]:we}],[()=>Ae,{[d]:x}],[0,{[d]:ge}]],4];We.CreateOAuth2Token$=[9,u,Qr,{[tt]:["POST","/v1/token",200]},()=>We.CreateOAuth2TokenRequest$,()=>We.CreateOAuth2TokenResponse$]});var sr=p((rr)=>{Object.defineProperty(rr,"__esModule",{value:!0});rr.getRuntimeConfig=void 0;var ct=L(),vt=pt(),Et=er(),yt=M(),St=lt(),Ce=at(),_e=ut(),Pt=V(),Ot=Ie(),It=C(),qt=(e)=>{return{apiVersion:"2023-01-01",base64Decoder:e?.base64Decoder??Ce.fromBase64,base64Encoder:e?.base64Encoder??Ce.toBase64,disableHostPrefix:e?.disableHostPrefix??!1,endpointProvider:e?.endpointProvider??Ot.defaultEndpointResolver,extensions:e?.extensions??[],httpAuthSchemeProvider:e?.httpAuthSchemeProvider??Pt.defaultSigninHttpAuthSchemeProvider,httpAuthSchemes:e?.httpAuthSchemes??[{schemeId:"aws.auth#sigv4",identityProvider:(r)=>r.getIdentityProvider("aws.auth#sigv4"),signer:new ct.AwsSdkSigV4Signer},{schemeId:"smithy.api#noAuth",identityProvider:(r)=>r.getIdentityProvider("smithy.api#noAuth")||(async()=>({})),signer:new Et.NoAuthSigner}],logger:e?.logger??new yt.NoOpLogger,protocol:e?.protocol??vt.AwsRestJsonProtocol,protocolSettings:e?.protocolSettings??{defaultNamespace:"com.amazonaws.signin",errorTypeRegistries:It.errorTypeRegistries,version:"2023-01-01",serviceTarget:"Signin"},serviceId:e?.serviceId??"Signin",urlParser:e?.urlParser??St.parseUrl,utf8Decoder:e?.utf8Decoder??_e.fromUtf8,utf8Encoder:e?.utf8Encoder??_e.toUtf8}};rr.getRuntimeConfig=qt});var vr=p((pr)=>{Object.defineProperty(pr,"__esModule",{value:!0});pr.getRuntimeConfig=void 0;var gt=bt(),ft=gt.__importDefault(Nt()),or=L(),nr=Mt(),G=ar(),Gt=Ut(),ir=lr(),P=Ft(),dr=Dt(),ur=M(),$t=wt(),ht=xt(),Ht=Rt(),Lt=sr(),Vt=(e)=>{(0,ur.emitWarningIfUnsupportedVersion)(process.version);let r=(0,ht.resolveDefaultsModeConfig)(e),t=()=>r().then(ur.loadConfigsForDefaultMode),a=(0,Lt.getRuntimeConfig)(e);(0,or.emitWarningIfUnsupportedVersion)(process.version);let i={profile:e?.profile,logger:a.logger};return{...a,...e,runtime:"node",defaultsMode:r,authSchemePreference:e?.authSchemePreference??(0,P.loadConfig)(or.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS,i),bodyLengthChecker:e?.bodyLengthChecker??$t.calculateBodyLength,defaultUserAgentProvider:e?.defaultUserAgentProvider??(0,nr.createDefaultUserAgentProvider)({serviceId:a.serviceId,clientVersion:ft.default.version}),maxAttempts:e?.maxAttempts??(0,P.loadConfig)(ir.NODE_MAX_ATTEMPT_CONFIG_OPTIONS,e),region:e?.region??(0,P.loadConfig)(G.NODE_REGION_CONFIG_OPTIONS,{...G.NODE_REGION_CONFIG_FILE_OPTIONS,...i}),requestHandler:dr.NodeHttpHandler.create(e?.requestHandler??t),retryMode:e?.retryMode??(0,P.loadConfig)({...ir.NODE_RETRY_MODE_CONFIG_OPTIONS,default:async()=>(await t()).retryMode||Ht.DEFAULT_RETRY_MODE},e),sha256:e?.sha256??Gt.Hash.bind(null,"sha256"),streamCollector:e?.streamCollector??dr.streamCollector,useDualstackEndpoint:e?.useDualstackEndpoint??(0,P.loadConfig)(G.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS,i),useFipsEndpoint:e?.useFipsEndpoint??(0,P.loadConfig)(G.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS,i),userAgentAppId:e?.userAgentAppId??(0,P.loadConfig)(nr.NODE_APP_ID_CONFIG_OPTIONS,i)}};pr.getRuntimeConfig=Vt});var vs=p((v)=>{var Er=At(),Qt=Wt(),Zt=Yt(),yr=jt(),Kt=ar(),_=er(),kt=He(),Tt=Bt(),qr=Jt(),Sr=lr(),O=M(),Pr=V(),mt=vr(),Or=Xt(),Ir=zt(),D=C(),$=k(),Ct=U(),_t=(e)=>{return Object.assign(e,{useDualstackEndpoint:e.useDualstackEndpoint??!1,useFipsEndpoint:e.useFipsEndpoint??!1,defaultSigningName:"signin"})},es={UseFIPS:{type:"builtInParams",name:"useFipsEndpoint"},Endpoint:{type:"builtInParams",name:"endpoint"},Region:{type:"builtInParams",name:"region"},UseDualStack:{type:"builtInParams",name:"useDualstackEndpoint"}},rs=(e)=>{let{httpAuthSchemes:r,httpAuthSchemeProvider:t,credentials:a}=e;return{setHttpAuthScheme(i){let b=r.findIndex((h)=>h.schemeId===i.schemeId);if(b===-1)r.push(i);else r.splice(b,1,i)},httpAuthSchemes(){return r},setHttpAuthSchemeProvider(i){t=i},httpAuthSchemeProvider(){return t},setCredentials(i){a=i},credentials(){return a}}},ts=(e)=>{return{httpAuthSchemes:e.httpAuthSchemes(),httpAuthSchemeProvider:e.httpAuthSchemeProvider(),credentials:e.credentials()}},ss=(e,r)=>{let t=Object.assign(Or.getAwsRegionExtensionConfiguration(e),O.getDefaultExtensionConfiguration(e),Ir.getHttpHandlerExtensionConfiguration(e),rs(e));return r.forEach((a)=>a.configure(t)),Object.assign(e,Or.resolveAwsRegionExtensionConfiguration(t),O.resolveDefaultRuntimeConfig(t),Ir.resolveHttpHandlerRuntimeConfig(t),ts(t))};class ee extends O.Client{config;constructor(...[e]){let r=mt.getRuntimeConfig(e||{});super(r);this.initConfig=r;let t=_t(r),a=yr.resolveUserAgentConfig(t),i=Sr.resolveRetryConfig(a),b=Kt.resolveRegionConfig(i),h=Er.resolveHostHeaderConfig(b),Dr=qr.resolveEndpointConfig(h),br=Pr.resolveHttpAuthSchemeConfig(Dr),Rr=ss(br,e?.extensions||[]);this.config=Rr,this.middlewareStack.use(kt.getSchemaSerdePlugin(this.config)),this.middlewareStack.use(yr.getUserAgentPlugin(this.config)),this.middlewareStack.use(Sr.getRetryPlugin(this.config)),this.middlewareStack.use(Tt.getContentLengthPlugin(this.config)),this.middlewareStack.use(Er.getHostHeaderPlugin(this.config)),this.middlewareStack.use(Qt.getLoggerPlugin(this.config)),this.middlewareStack.use(Zt.getRecursionDetectionPlugin(this.config)),this.middlewareStack.use(_.getHttpAuthSchemeEndpointRuleSetPlugin(this.config,{httpAuthSchemeParametersProvider:Pr.defaultSigninHttpAuthSchemeParametersProvider,identityProviderConfigProvider:async(Fr)=>new _.DefaultIdentityProviderConfig({"aws.auth#sigv4":Fr.credentials})})),this.middlewareStack.use(_.getHttpSigningPlugin(this.config))}destroy(){super.destroy()}}class re extends O.Command.classBuilder().ep(es).m(function(e,r,t,a){return[qr.getEndpointPlugin(t,e.getEndpointParameterInstructions())]}).s("Signin","CreateOAuth2Token",{}).n("SigninClient","CreateOAuth2TokenCommand").sc(D.CreateOAuth2Token$).build(){}var os={CreateOAuth2TokenCommand:re};class te extends ee{}O.createAggregatedClient(os,te);var ns={AUTHCODE_EXPIRED:"AUTHCODE_EXPIRED",INSUFFICIENT_PERMISSIONS:"INSUFFICIENT_PERMISSIONS",INVALID_REQUEST:"INVALID_REQUEST",SERVER_ERROR:"server_error",TOKEN_EXPIRED:"TOKEN_EXPIRED",USER_CREDENTIALS_CHANGED:"USER_CREDENTIALS_CHANGED"};v.$Command=O.Command;v.__Client=O.Client;v.SigninServiceException=Ct.SigninServiceException;v.CreateOAuth2TokenCommand=re;v.OAuth2ErrorCode=ns;v.Signin=te;v.SigninClient=ee;Object.prototype.hasOwnProperty.call(D,"__proto__")&&!Object.prototype.hasOwnProperty.call(v,"__proto__")&&Object.defineProperty(v,"__proto__",{enumerable:!0,value:D.__proto__});Object.keys(D).forEach(function(e){if(e!=="default"&&!Object.prototype.hasOwnProperty.call(v,e))v[e]=D[e]});Object.prototype.hasOwnProperty.call($,"__proto__")&&!Object.prototype.hasOwnProperty.call(v,"__proto__")&&Object.defineProperty(v,"__proto__",{enumerable:!0,value:$.__proto__});Object.keys($).forEach(function(e){if(e!=="default"&&!Object.prototype.hasOwnProperty.call(v,e))v[e]=$[e]})});export default vs();
+import{h as Nt}from"./chunk-rqs2s5nh.js";import{A as xt,B as pt,C as Xt,i as er,k as L,l as At,m as Wt,n as Yt,p as Hr,q as Lr,r as Rt,s as jt,t as ar,u as Bt,v as Jt,w as lr,x as Mt,y as Ut,z as wt}from"./chunk-zrykhpn9.js";import{D as Ft}from"./chunk-qx1vc11v.js";import{E as Nr,F as at,H as Dt,L as He,P as M}from"./chunk-zryrem89.js";import{Q as zt}from"./chunk-v4ka65g8.js";import{R as lt}from"./chunk-mk4x0vtp.js";import"./chunk-20y02g4n.js";import"./chunk-bcydd231.js";import"./chunk-9dnbf9q8.js";import"./chunk-wprzrnqh.js";import{ba as ut}from"./chunk-x05mj7ye.js";import{ma as bt}from"./chunk-zv55h4x9.js";import{Vl as p}from"./chunk-fzy1z97a.js";var V=p((se)=>{Object.defineProperty(se,"__esModule",{value:!0});se.resolveHttpAuthSchemeConfig=se.defaultSigninHttpAuthSchemeProvider=se.defaultSigninHttpAuthSchemeParametersProvider=void 0;var Mr=L(),H=Nr(),Ur=async(e,r,t)=>{return{operation:(0,H.getSmithyContext)(r).operation,region:await(0,H.normalizeProvider)(e.region)()||(()=>{throw Error("expected `region` to be configured for `aws.auth#sigv4`")})()}};se.defaultSigninHttpAuthSchemeParametersProvider=Ur;function wr(e){return{schemeId:"aws.auth#sigv4",signingProperties:{name:"signin",region:e.region},propertiesExtractor:(r,t)=>({signingProperties:{config:r,context:t}})}}function xr(e){return{schemeId:"smithy.api#noAuth"}}var gr=(e)=>{let r=[];switch(e.operation){case"CreateOAuth2Token":{r.push(xr(e));break}default:r.push(wr(e))}return r};se.defaultSigninHttpAuthSchemeProvider=gr;var fr=(e)=>{let r=(0,Mr.resolveAwsSdkSigV4Config)(e);return Object.assign(r,{authSchemePreference:(0,H.normalizeProvider)(e.authSchemePreference??[])})};se.resolveHttpAuthSchemeConfig=fr});var Se=p((Ee)=>{Object.defineProperty(Ee,"__esModule",{value:!0});Ee.ruleSet=void 0;var ve="required",o="fn",n="argv",c="ref",ne=!0,ie="isSet",S="booleanEquals",I="error",E="endpoint",l="tree",N="PartitionResult",z="stringEquals",de={[ve]:!0,default:!1,type:"boolean"},ue={[ve]:!1,type:"string"},ae={[c]:"Endpoint"},A={[o]:S,[n]:[{[c]:"UseFIPS"},!0]},W={[o]:S,[n]:[{[c]:"UseDualStack"},!0]},s={},Y={[o]:"getAttr",[n]:[{[c]:N},"name"]},R={[o]:S,[n]:[{[c]:"UseFIPS"},!1]},F={[o]:S,[n]:[{[c]:"UseDualStack"},!1]},le={[o]:"getAttr",[n]:[{[c]:N},"supportsFIPS"]},pe={[o]:S,[n]:[!0,{[o]:"getAttr",[n]:[{[c]:N},"supportsDualStack"]}]},ce=[{[c]:"Region"}],hr={version:"1.0",parameters:{UseDualStack:de,UseFIPS:de,Endpoint:ue,Region:ue},rules:[{conditions:[{[o]:ie,[n]:[ae]}],rules:[{conditions:[A],error:"Invalid Configuration: FIPS and custom endpoint are not supported",type:I},{rules:[{conditions:[W],error:"Invalid Configuration: Dualstack and custom endpoint are not supported",type:I},{endpoint:{url:ae,properties:s,headers:s},type:E}],type:l}],type:l},{rules:[{conditions:[{[o]:ie,[n]:ce}],rules:[{conditions:[{[o]:"aws.partition",[n]:ce,assign:N}],rules:[{conditions:[{[o]:z,[n]:[Y,"aws"]},R,F],endpoint:{url:"https://{Region}.signin.aws.amazon.com",properties:s,headers:s},type:E},{conditions:[{[o]:z,[n]:[Y,"aws-cn"]},R,F],endpoint:{url:"https://{Region}.signin.amazonaws.cn",properties:s,headers:s},type:E},{conditions:[{[o]:z,[n]:[Y,"aws-us-gov"]},R,F],endpoint:{url:"https://{Region}.signin.amazonaws-us-gov.com",properties:s,headers:s},type:E},{conditions:[A,W],rules:[{conditions:[{[o]:S,[n]:[ne,le]},pe],rules:[{endpoint:{url:"https://signin-fips.{Region}.{PartitionResult#dualStackDnsSuffix}",properties:s,headers:s},type:E}],type:l},{error:"FIPS and DualStack are enabled, but this partition does not support one or both",type:I}],type:l},{conditions:[A,F],rules:[{conditions:[{[o]:S,[n]:[le,ne]}],rules:[{endpoint:{url:"https://signin-fips.{Region}.{PartitionResult#dnsSuffix}",properties:s,headers:s},type:E}],type:l},{error:"FIPS is enabled but this partition does not support FIPS",type:I}],type:l},{conditions:[R,W],rules:[{conditions:[pe],rules:[{endpoint:{url:"https://signin.{Region}.{PartitionResult#dualStackDnsSuffix}",properties:s,headers:s},type:E}],type:l},{error:"DualStack is enabled but this partition does not support DualStack",type:I}],type:l},{endpoint:{url:"https://signin.{Region}.{PartitionResult#dnsSuffix}",properties:s,headers:s},type:E}],type:l}],type:l},{error:"Invalid Configuration: Missing Region",type:I}],type:l}]};Ee.ruleSet=hr});var Ie=p((Pe)=>{Object.defineProperty(Pe,"__esModule",{value:!0});Pe.defaultEndpointResolver=void 0;var Vr=Lr(),j=Hr(),zr=Se(),Ar=new j.EndpointCache({size:50,params:["Endpoint","Region","UseDualStack","UseFIPS"]}),Wr=(e,r={})=>{return Ar.get(e,()=>(0,j.resolveEndpoint)(zr.ruleSet,{endpointParams:e,logger:r.logger}))};Pe.defaultEndpointResolver=Wr;j.customEndpointFunctions.aws=Vr.awsEndpointFunctions});var U=p((J)=>{Object.defineProperty(J,"__esModule",{value:!0});J.SigninServiceException=J.__ServiceException=void 0;var qe=M();Object.defineProperty(J,"__ServiceException",{enumerable:!0,get:function(){return qe.ServiceException}});class B extends qe.ServiceException{constructor(e){super(e);Object.setPrototypeOf(this,B.prototype)}}J.SigninServiceException=B});var k=p((be)=>{Object.defineProperty(be,"__esModule",{value:!0});be.ValidationException=be.TooManyRequestsError=be.InternalServerException=be.AccessDeniedException=void 0;var w=U();class X extends w.SigninServiceException{name="AccessDeniedException";$fault="client";error;constructor(e){super({name:"AccessDeniedException",$fault:"client",...e});Object.setPrototypeOf(this,X.prototype),this.error=e.error}}be.AccessDeniedException=X;class Q extends w.SigninServiceException{name="InternalServerException";$fault="server";error;constructor(e){super({name:"InternalServerException",$fault:"server",...e});Object.setPrototypeOf(this,Q.prototype),this.error=e.error}}be.InternalServerException=Q;class Z extends w.SigninServiceException{name="TooManyRequestsError";$fault="client";error;constructor(e){super({name:"TooManyRequestsError",$fault:"client",...e});Object.setPrototypeOf(this,Z.prototype),this.error=e.error}}be.TooManyRequestsError=Z;class K extends w.SigninServiceException{name="ValidationException";$fault="client";error;constructor(e){super({name:"ValidationException",$fault:"client",...e});Object.setPrototypeOf(this,K.prototype),this.error=e.error}}be.ValidationException=K});var C=p((We)=>{Object.defineProperty(We,"__esModule",{value:!0});We.CreateOAuth2Token$=We.CreateOAuth2TokenResponseBody$=We.CreateOAuth2TokenResponse$=We.CreateOAuth2TokenRequestBody$=We.CreateOAuth2TokenRequest$=We.AccessToken$=We.errorTypeRegistries=We.ValidationException$=We.TooManyRequestsError$=We.InternalServerException$=We.AccessDeniedException$=We.SigninServiceException$=void 0;var Jr="AccessDeniedException",Xr="AccessToken",Qr="CreateOAuth2Token",Zr="CreateOAuth2TokenRequest",Kr="CreateOAuth2TokenRequestBody",kr="CreateOAuth2TokenResponseBody",Tr="CreateOAuth2TokenResponse",mr="InternalServerException",Cr="RefreshToken",_r="TooManyRequestsError",et="ValidationException",Fe="accessKeyId",Ne="accessToken",T="client",Me="clientId",Ue="codeVerifier",rt="code",y="error",we="expiresIn",xe="grantType",tt="http",m="httpError",ge="idToken",d="jsonName",g="message",x="refreshToken",fe="redirectUri",Le="smithy.ts.sdk.synthetic.com.amazonaws.signin",Ge="secretAccessKey",$e="sessionToken",st="server",ot="tokenInput",nt="tokenOutput",he="tokenType",u="com.amazonaws.signin",Ve=He(),f=k(),it=U(),ze=Ve.TypeRegistry.for(Le);We.SigninServiceException$=[-3,Le,"SigninServiceException",0,[],[]];ze.registerError(We.SigninServiceException$,it.SigninServiceException);var q=Ve.TypeRegistry.for(u);We.AccessDeniedException$=[-3,u,Jr,{[y]:T},[y,g],[0,0],2];q.registerError(We.AccessDeniedException$,f.AccessDeniedException);We.InternalServerException$=[-3,u,mr,{[y]:st,[m]:500},[y,g],[0,0],2];q.registerError(We.InternalServerException$,f.InternalServerException);We.TooManyRequestsError$=[-3,u,_r,{[y]:T,[m]:429},[y,g],[0,0],2];q.registerError(We.TooManyRequestsError$,f.TooManyRequestsError);We.ValidationException$=[-3,u,et,{[y]:T,[m]:400},[y,g],[0,0],2];q.registerError(We.ValidationException$,f.ValidationException);We.errorTypeRegistries=[ze,q];var Ae=[0,u,Cr,8,0];We.AccessToken$=[3,u,Xr,8,[Fe,Ge,$e],[[0,{[d]:Fe}],[0,{[d]:Ge}],[0,{[d]:$e}]],3];We.CreateOAuth2TokenRequest$=[3,u,Zr,0,[ot],[[()=>We.CreateOAuth2TokenRequestBody$,16]],1];We.CreateOAuth2TokenRequestBody$=[3,u,Kr,0,[Me,xe,rt,fe,Ue,x],[[0,{[d]:Me}],[0,{[d]:xe}],0,[0,{[d]:fe}],[0,{[d]:Ue}],[()=>Ae,{[d]:x}]],2];We.CreateOAuth2TokenResponse$=[3,u,Tr,0,[nt],[[()=>We.CreateOAuth2TokenResponseBody$,16]],1];We.CreateOAuth2TokenResponseBody$=[3,u,kr,0,[Ne,he,we,x,ge],[[()=>We.AccessToken$,{[d]:Ne}],[0,{[d]:he}],[1,{[d]:we}],[()=>Ae,{[d]:x}],[0,{[d]:ge}]],4];We.CreateOAuth2Token$=[9,u,Qr,{[tt]:["POST","/v1/token",200]},()=>We.CreateOAuth2TokenRequest$,()=>We.CreateOAuth2TokenResponse$]});var sr=p((rr)=>{Object.defineProperty(rr,"__esModule",{value:!0});rr.getRuntimeConfig=void 0;var ct=L(),vt=pt(),Et=er(),yt=M(),St=lt(),Ce=at(),_e=ut(),Pt=V(),Ot=Ie(),It=C(),qt=(e)=>{return{apiVersion:"2023-01-01",base64Decoder:e?.base64Decoder??Ce.fromBase64,base64Encoder:e?.base64Encoder??Ce.toBase64,disableHostPrefix:e?.disableHostPrefix??!1,endpointProvider:e?.endpointProvider??Ot.defaultEndpointResolver,extensions:e?.extensions??[],httpAuthSchemeProvider:e?.httpAuthSchemeProvider??Pt.defaultSigninHttpAuthSchemeProvider,httpAuthSchemes:e?.httpAuthSchemes??[{schemeId:"aws.auth#sigv4",identityProvider:(r)=>r.getIdentityProvider("aws.auth#sigv4"),signer:new ct.AwsSdkSigV4Signer},{schemeId:"smithy.api#noAuth",identityProvider:(r)=>r.getIdentityProvider("smithy.api#noAuth")||(async()=>({})),signer:new Et.NoAuthSigner}],logger:e?.logger??new yt.NoOpLogger,protocol:e?.protocol??vt.AwsRestJsonProtocol,protocolSettings:e?.protocolSettings??{defaultNamespace:"com.amazonaws.signin",errorTypeRegistries:It.errorTypeRegistries,version:"2023-01-01",serviceTarget:"Signin"},serviceId:e?.serviceId??"Signin",urlParser:e?.urlParser??St.parseUrl,utf8Decoder:e?.utf8Decoder??_e.fromUtf8,utf8Encoder:e?.utf8Encoder??_e.toUtf8}};rr.getRuntimeConfig=qt});var vr=p((pr)=>{Object.defineProperty(pr,"__esModule",{value:!0});pr.getRuntimeConfig=void 0;var gt=bt(),ft=gt.__importDefault(Nt()),or=L(),nr=Mt(),G=ar(),Gt=Ut(),ir=lr(),P=Ft(),dr=Dt(),ur=M(),$t=wt(),ht=xt(),Ht=Rt(),Lt=sr(),Vt=(e)=>{(0,ur.emitWarningIfUnsupportedVersion)(process.version);let r=(0,ht.resolveDefaultsModeConfig)(e),t=()=>r().then(ur.loadConfigsForDefaultMode),a=(0,Lt.getRuntimeConfig)(e);(0,or.emitWarningIfUnsupportedVersion)(process.version);let i={profile:e?.profile,logger:a.logger};return{...a,...e,runtime:"node",defaultsMode:r,authSchemePreference:e?.authSchemePreference??(0,P.loadConfig)(or.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS,i),bodyLengthChecker:e?.bodyLengthChecker??$t.calculateBodyLength,defaultUserAgentProvider:e?.defaultUserAgentProvider??(0,nr.createDefaultUserAgentProvider)({serviceId:a.serviceId,clientVersion:ft.default.version}),maxAttempts:e?.maxAttempts??(0,P.loadConfig)(ir.NODE_MAX_ATTEMPT_CONFIG_OPTIONS,e),region:e?.region??(0,P.loadConfig)(G.NODE_REGION_CONFIG_OPTIONS,{...G.NODE_REGION_CONFIG_FILE_OPTIONS,...i}),requestHandler:dr.NodeHttpHandler.create(e?.requestHandler??t),retryMode:e?.retryMode??(0,P.loadConfig)({...ir.NODE_RETRY_MODE_CONFIG_OPTIONS,default:async()=>(await t()).retryMode||Ht.DEFAULT_RETRY_MODE},e),sha256:e?.sha256??Gt.Hash.bind(null,"sha256"),streamCollector:e?.streamCollector??dr.streamCollector,useDualstackEndpoint:e?.useDualstackEndpoint??(0,P.loadConfig)(G.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS,i),useFipsEndpoint:e?.useFipsEndpoint??(0,P.loadConfig)(G.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS,i),userAgentAppId:e?.userAgentAppId??(0,P.loadConfig)(nr.NODE_APP_ID_CONFIG_OPTIONS,i)}};pr.getRuntimeConfig=Vt});var vs=p((v)=>{var Er=At(),Qt=Wt(),Zt=Yt(),yr=jt(),Kt=ar(),_=er(),kt=He(),Tt=Bt(),qr=Jt(),Sr=lr(),O=M(),Pr=V(),mt=vr(),Or=Xt(),Ir=zt(),D=C(),$=k(),Ct=U(),_t=(e)=>{return Object.assign(e,{useDualstackEndpoint:e.useDualstackEndpoint??!1,useFipsEndpoint:e.useFipsEndpoint??!1,defaultSigningName:"signin"})},es={UseFIPS:{type:"builtInParams",name:"useFipsEndpoint"},Endpoint:{type:"builtInParams",name:"endpoint"},Region:{type:"builtInParams",name:"region"},UseDualStack:{type:"builtInParams",name:"useDualstackEndpoint"}},rs=(e)=>{let{httpAuthSchemes:r,httpAuthSchemeProvider:t,credentials:a}=e;return{setHttpAuthScheme(i){let b=r.findIndex((h)=>h.schemeId===i.schemeId);if(b===-1)r.push(i);else r.splice(b,1,i)},httpAuthSchemes(){return r},setHttpAuthSchemeProvider(i){t=i},httpAuthSchemeProvider(){return t},setCredentials(i){a=i},credentials(){return a}}},ts=(e)=>{return{httpAuthSchemes:e.httpAuthSchemes(),httpAuthSchemeProvider:e.httpAuthSchemeProvider(),credentials:e.credentials()}},ss=(e,r)=>{let t=Object.assign(Or.getAwsRegionExtensionConfiguration(e),O.getDefaultExtensionConfiguration(e),Ir.getHttpHandlerExtensionConfiguration(e),rs(e));return r.forEach((a)=>a.configure(t)),Object.assign(e,Or.resolveAwsRegionExtensionConfiguration(t),O.resolveDefaultRuntimeConfig(t),Ir.resolveHttpHandlerRuntimeConfig(t),ts(t))};class ee extends O.Client{config;constructor(...[e]){let r=mt.getRuntimeConfig(e||{});super(r);this.initConfig=r;let t=_t(r),a=yr.resolveUserAgentConfig(t),i=Sr.resolveRetryConfig(a),b=Kt.resolveRegionConfig(i),h=Er.resolveHostHeaderConfig(b),Dr=qr.resolveEndpointConfig(h),br=Pr.resolveHttpAuthSchemeConfig(Dr),Rr=ss(br,e?.extensions||[]);this.config=Rr,this.middlewareStack.use(kt.getSchemaSerdePlugin(this.config)),this.middlewareStack.use(yr.getUserAgentPlugin(this.config)),this.middlewareStack.use(Sr.getRetryPlugin(this.config)),this.middlewareStack.use(Tt.getContentLengthPlugin(this.config)),this.middlewareStack.use(Er.getHostHeaderPlugin(this.config)),this.middlewareStack.use(Qt.getLoggerPlugin(this.config)),this.middlewareStack.use(Zt.getRecursionDetectionPlugin(this.config)),this.middlewareStack.use(_.getHttpAuthSchemeEndpointRuleSetPlugin(this.config,{httpAuthSchemeParametersProvider:Pr.defaultSigninHttpAuthSchemeParametersProvider,identityProviderConfigProvider:async(Fr)=>new _.DefaultIdentityProviderConfig({"aws.auth#sigv4":Fr.credentials})})),this.middlewareStack.use(_.getHttpSigningPlugin(this.config))}destroy(){super.destroy()}}class re extends O.Command.classBuilder().ep(es).m(function(e,r,t,a){return[qr.getEndpointPlugin(t,e.getEndpointParameterInstructions())]}).s("Signin","CreateOAuth2Token",{}).n("SigninClient","CreateOAuth2TokenCommand").sc(D.CreateOAuth2Token$).build(){}var os={CreateOAuth2TokenCommand:re};class te extends ee{}O.createAggregatedClient(os,te);var ns={AUTHCODE_EXPIRED:"AUTHCODE_EXPIRED",INSUFFICIENT_PERMISSIONS:"INSUFFICIENT_PERMISSIONS",INVALID_REQUEST:"INVALID_REQUEST",SERVER_ERROR:"server_error",TOKEN_EXPIRED:"TOKEN_EXPIRED",USER_CREDENTIALS_CHANGED:"USER_CREDENTIALS_CHANGED"};v.$Command=O.Command;v.__Client=O.Client;v.SigninServiceException=Ct.SigninServiceException;v.CreateOAuth2TokenCommand=re;v.OAuth2ErrorCode=ns;v.Signin=te;v.SigninClient=ee;Object.prototype.hasOwnProperty.call(D,"__proto__")&&!Object.prototype.hasOwnProperty.call(v,"__proto__")&&Object.defineProperty(v,"__proto__",{enumerable:!0,value:D.__proto__});Object.keys(D).forEach(function(e){if(e!=="default"&&!Object.prototype.hasOwnProperty.call(v,e))v[e]=D[e]});Object.prototype.hasOwnProperty.call($,"__proto__")&&!Object.prototype.hasOwnProperty.call(v,"__proto__")&&Object.defineProperty(v,"__proto__",{enumerable:!0,value:$.__proto__});Object.keys($).forEach(function(e){if(e!=="default"&&!Object.prototype.hasOwnProperty.call(v,e))v[e]=$[e]})});export default vs();
 
-//# debugId=E9840AC1BCC37D9764756E2164756E21
+//# debugId=34EC47671CBDC41C64756E2164756E21

package/dist/{chunk-6m9qrs6d.js.map → chunk-kjygnj7y.js.map}

@@ -13,6 +13,6 @@
     "'use strict';\n\nvar middlewareHostHeader = require('@aws-sdk/middleware-host-header');\nvar middlewareLogger = require('@aws-sdk/middleware-logger');\nvar middlewareRecursionDetection = require('@aws-sdk/middleware-recursion-detection');\nvar middlewareUserAgent = require('@aws-sdk/middleware-user-agent');\nvar configResolver = require('@smithy/config-resolver');\nvar core = require('@smithy/core');\nvar schema = require('@smithy/core/schema');\nvar middlewareContentLength = require('@smithy/middleware-content-length');\nvar middlewareEndpoint = require('@smithy/middleware-endpoint');\nvar middlewareRetry = require('@smithy/middleware-retry');\nvar smithyClient = require('@smithy/smithy-client');\nvar httpAuthSchemeProvider = require('./auth/httpAuthSchemeProvider');\nvar runtimeConfig = require('./runtimeConfig');\nvar regionConfigResolver = require('@aws-sdk/region-config-resolver');\nvar protocolHttp = require('@smithy/protocol-http');\nvar schemas_0 = require('./schemas/schemas_0');\nvar errors = require('./models/errors');\nvar SigninServiceException = require('./models/SigninServiceException');\n\nconst resolveClientEndpointParameters = (options) => {\n    return Object.assign(options, {\n        useDualstackEndpoint: options.useDualstackEndpoint ?? false,\n        useFipsEndpoint: options.useFipsEndpoint ?? false,\n        defaultSigningName: \"signin\",\n    });\n};\nconst commonParams = {\n    UseFIPS: { type: \"builtInParams\", name: \"useFipsEndpoint\" },\n    Endpoint: { type: \"builtInParams\", name: \"endpoint\" },\n    Region: { type: \"builtInParams\", name: \"region\" },\n    UseDualStack: { type: \"builtInParams\", name: \"useDualstackEndpoint\" },\n};\n\nconst getHttpAuthExtensionConfiguration = (runtimeConfig) => {\n    const _httpAuthSchemes = runtimeConfig.httpAuthSchemes;\n    let _httpAuthSchemeProvider = runtimeConfig.httpAuthSchemeProvider;\n    let _credentials = runtimeConfig.credentials;\n    return {\n        setHttpAuthScheme(httpAuthScheme) {\n            const index = _httpAuthSchemes.findIndex((scheme) => scheme.schemeId === httpAuthScheme.schemeId);\n            if (index === -1) {\n                _httpAuthSchemes.push(httpAuthScheme);\n            }\n            else {\n                _httpAuthSchemes.splice(index, 1, httpAuthScheme);\n            }\n        },\n        httpAuthSchemes() {\n            return _httpAuthSchemes;\n        },\n        setHttpAuthSchemeProvider(httpAuthSchemeProvider) {\n            _httpAuthSchemeProvider = httpAuthSchemeProvider;\n        },\n        httpAuthSchemeProvider() {\n            return _httpAuthSchemeProvider;\n        },\n        setCredentials(credentials) {\n            _credentials = credentials;\n        },\n        credentials() {\n            return _credentials;\n        },\n    };\n};\nconst resolveHttpAuthRuntimeConfig = (config) => {\n    return {\n        httpAuthSchemes: config.httpAuthSchemes(),\n        httpAuthSchemeProvider: config.httpAuthSchemeProvider(),\n        credentials: config.credentials(),\n    };\n};\n\nconst resolveRuntimeExtensions = (runtimeConfig, extensions) => {\n    const extensionConfiguration = Object.assign(regionConfigResolver.getAwsRegionExtensionConfiguration(runtimeConfig), smithyClient.getDefaultExtensionConfiguration(runtimeConfig), protocolHttp.getHttpHandlerExtensionConfiguration(runtimeConfig), getHttpAuthExtensionConfiguration(runtimeConfig));\n    extensions.forEach((extension) => extension.configure(extensionConfiguration));\n    return Object.assign(runtimeConfig, regionConfigResolver.resolveAwsRegionExtensionConfiguration(extensionConfiguration), smithyClient.resolveDefaultRuntimeConfig(extensionConfiguration), protocolHttp.resolveHttpHandlerRuntimeConfig(extensionConfiguration), resolveHttpAuthRuntimeConfig(extensionConfiguration));\n};\n\nclass SigninClient extends smithyClient.Client {\n    config;\n    constructor(...[configuration]) {\n        const _config_0 = runtimeConfig.getRuntimeConfig(configuration || {});\n        super(_config_0);\n        this.initConfig = _config_0;\n        const _config_1 = resolveClientEndpointParameters(_config_0);\n        const _config_2 = middlewareUserAgent.resolveUserAgentConfig(_config_1);\n        const _config_3 = middlewareRetry.resolveRetryConfig(_config_2);\n        const _config_4 = configResolver.resolveRegionConfig(_config_3);\n        const _config_5 = middlewareHostHeader.resolveHostHeaderConfig(_config_4);\n        const _config_6 = middlewareEndpoint.resolveEndpointConfig(_config_5);\n        const _config_7 = httpAuthSchemeProvider.resolveHttpAuthSchemeConfig(_config_6);\n        const _config_8 = resolveRuntimeExtensions(_config_7, configuration?.extensions || []);\n        this.config = _config_8;\n        this.middlewareStack.use(schema.getSchemaSerdePlugin(this.config));\n        this.middlewareStack.use(middlewareUserAgent.getUserAgentPlugin(this.config));\n        this.middlewareStack.use(middlewareRetry.getRetryPlugin(this.config));\n        this.middlewareStack.use(middlewareContentLength.getContentLengthPlugin(this.config));\n        this.middlewareStack.use(middlewareHostHeader.getHostHeaderPlugin(this.config));\n        this.middlewareStack.use(middlewareLogger.getLoggerPlugin(this.config));\n        this.middlewareStack.use(middlewareRecursionDetection.getRecursionDetectionPlugin(this.config));\n        this.middlewareStack.use(core.getHttpAuthSchemeEndpointRuleSetPlugin(this.config, {\n            httpAuthSchemeParametersProvider: httpAuthSchemeProvider.defaultSigninHttpAuthSchemeParametersProvider,\n            identityProviderConfigProvider: async (config) => new core.DefaultIdentityProviderConfig({\n                \"aws.auth#sigv4\": config.credentials,\n            }),\n        }));\n        this.middlewareStack.use(core.getHttpSigningPlugin(this.config));\n    }\n    destroy() {\n        super.destroy();\n    }\n}\n\nclass CreateOAuth2TokenCommand extends smithyClient.Command\n    .classBuilder()\n    .ep(commonParams)\n    .m(function (Command, cs, config, o) {\n    return [middlewareEndpoint.getEndpointPlugin(config, Command.getEndpointParameterInstructions())];\n})\n    .s(\"Signin\", \"CreateOAuth2Token\", {})\n    .n(\"SigninClient\", \"CreateOAuth2TokenCommand\")\n    .sc(schemas_0.CreateOAuth2Token$)\n    .build() {\n}\n\nconst commands = {\n    CreateOAuth2TokenCommand,\n};\nclass Signin extends SigninClient {\n}\nsmithyClient.createAggregatedClient(commands, Signin);\n\nconst OAuth2ErrorCode = {\n    AUTHCODE_EXPIRED: \"AUTHCODE_EXPIRED\",\n    INSUFFICIENT_PERMISSIONS: \"INSUFFICIENT_PERMISSIONS\",\n    INVALID_REQUEST: \"INVALID_REQUEST\",\n    SERVER_ERROR: \"server_error\",\n    TOKEN_EXPIRED: \"TOKEN_EXPIRED\",\n    USER_CREDENTIALS_CHANGED: \"USER_CREDENTIALS_CHANGED\",\n};\n\nexports.$Command = smithyClient.Command;\nexports.__Client = smithyClient.Client;\nexports.SigninServiceException = SigninServiceException.SigninServiceException;\nexports.CreateOAuth2TokenCommand = CreateOAuth2TokenCommand;\nexports.OAuth2ErrorCode = OAuth2ErrorCode;\nexports.Signin = Signin;\nexports.SigninClient = SigninClient;\nObject.prototype.hasOwnProperty.call(schemas_0, '__proto__') &&\n    !Object.prototype.hasOwnProperty.call(exports, '__proto__') &&\n    Object.defineProperty(exports, '__proto__', {\n        enumerable: true,\n        value: schemas_0['__proto__']\n    });\n\nObject.keys(schemas_0).forEach(function (k) {\n    if (k !== 'default' && !Object.prototype.hasOwnProperty.call(exports, k)) exports[k] = schemas_0[k];\n});\nObject.prototype.hasOwnProperty.call(errors, '__proto__') &&\n    !Object.prototype.hasOwnProperty.call(exports, '__proto__') &&\n    Object.defineProperty(exports, '__proto__', {\n        enumerable: true,\n        value: errors['__proto__']\n    });\n\nObject.keys(errors).forEach(function (k) {\n    if (k !== 'default' && !Object.prototype.hasOwnProperty.call(exports, k)) exports[k] = errors[k];\n});\n"
   ],
   "mappings": ";wuBACA,CAAO,SAAe,HAAS,OAAc,LAAE,AAAO,JAAK,LAAC,JACpD,yBAAsC,iCAA8C,2CAAqD,OACjJ,IAAM,OACA,OACA,GAAgD,MAAO,EAAQ,EAAS,IAAU,CACpF,MAAO,CACH,WAAY,EAAG,EAAkB,kBAAkB,CAAO,EAAE,UAC5D,OAAS,MAAO,EAAG,EAAkB,mBAAmB,EAAO,MAAM,EAAE,IAClE,IAAM,CACH,MAAU,MAAM,yDAAyD,IAC1E,CACX,GAEI,iDAAgD,GACxD,SAAS,EAAgC,CAAC,EAAgB,CACtD,MAAO,CACH,SAAU,iBACV,kBAAmB,CACf,KAAM,SACN,OAAQ,EAAe,MAC3B,EACA,oBAAqB,CAAC,EAAQ,KAAa,CACvC,kBAAmB,CACf,SACA,SACJ,CACJ,EACJ,EAEJ,SAAS,EAAmC,CAAC,EAAgB,CACzD,MAAO,CACH,SAAU,mBACd,EAEJ,IAAM,GAAsC,CAAC,IAAmB,CAC5D,IAAM,EAAU,CAAC,EACjB,OAAQ,EAAe,eACd,oBAAqB,CACtB,EAAQ,KAAK,GAAoC,CAAc,CAAC,EAChE,KACJ,SAEI,EAAQ,KAAK,GAAiC,CAAc,CAAC,EAGrE,OAAO,GAEH,uCAAsC,GAC9C,IAAM,GAA8B,CAAC,IAAW,CAC5C,IAAM,GAAY,EAAG,GAAO,0BAA0B,CAAM,EAC5D,OAAO,OAAO,OAAO,EAAU,CAC3B,sBAAuB,EAAG,EAAkB,mBAAmB,EAAO,sBAAwB,CAAC,CAAC,CACpG,CAAC,GAEG,+BAA8B,qBCtDtC,OAAO,eAAe,GAAS,aAAc,CAAE,MAAO,EAAK,CAAC,EACpD,WAAe,OACvB,IAAM,GAAI,WAAY,EAAI,KAAM,EAAI,OAAQ,EAAI,MAC1C,GAAI,GAAM,GAAI,QAAS,EAAI,gBAAiB,EAAI,QAAS,EAAI,WAAY,EAAI,OAAQ,EAAI,kBAAmB,EAAI,eAAgB,GAAI,EAAG,IAAI,GAAM,QAAS,GAAO,KAAM,SAAU,EAAG,GAAI,EAAG,IAAI,GAAO,KAAM,QAAS,EAAG,GAAI,EAAG,GAAI,UAAW,EAAG,EAAI,EAAG,GAAI,GAAI,GAAI,CAAC,EAAG,GAAI,SAAU,EAAG,EAAI,CAAE,EAAG,EAAI,EAAG,GAAI,GAAI,GAAI,CAAC,EAAG,GAAI,cAAe,EAAG,EAAI,CAAE,EAAG,EAAI,CAAC,EAAG,EAAI,EAAG,GAAI,WAAY,GAAI,CAAC,EAAG,GAAI,CAAE,EAAG,MAAM,CAAE,EAAG,EAAI,EAAG,GAAI,GAAI,GAAI,CAAC,EAAG,GAAI,SAAU,EAAG,EAAK,CAAE,EAAG,EAAI,EAAG,GAAI,GAAI,GAAI,CAAC,EAAG,GAAI,cAAe,EAAG,EAAK,CAAE,EAAG,GAAI,EAAG,GAAI,WAAY,GAAI,CAAC,EAAG,GAAI,CAAE,EAAG,cAAc,CAAE,EAAG,GAAI,EAAG,GAAI,GAAI,GAAI,CAAC,GAAM,EAAG,GAAI,WAAY,GAAI,CAAC,EAAG,GAAI,CAAE,EAAG,mBAAmB,CAAE,CAAC,CAAE,EAAG,GAAI,CAAC,EAAG,GAAI,QAAS,CAAC,EACtqB,GAAQ,CACV,QAAS,MACT,WAAY,CAAE,aAAc,GAAG,QAAS,GAAG,SAAU,GAAG,OAAQ,EAAE,EAClE,MAAO,CACH,CACI,WAAY,CAAC,EAAG,GAAI,IAAI,GAAI,CAAC,EAAC,CAAE,CAAC,EACjC,MAAO,CACH,CAAE,WAAY,CAAC,CAAC,EAAG,MAAO,oEAAqE,KAAM,CAAE,EACvG,CACI,MAAO,CACH,CACI,WAAY,CAAC,CAAC,EACd,MAAO,yEACP,KAAM,CACV,EACA,CAAE,SAAU,CAAE,IAAK,GAAG,WAAY,EAAG,QAAS,CAAE,EAAG,KAAM,CAAE,CAC/D,EACA,KAAM,CACV,CACJ,EACA,KAAM,CACV,EACA,CACI,MAAO,CACH,CACI,WAAY,CAAC,EAAG,GAAI,IAAI,GAAI,EAAE,CAAC,EAC/B,MAAO,CACH,CACI,WAAY,CAAC,EAAG,GAAI,iBAAkB,GAAI,GAAG,OAAQ,CAAE,CAAC,EACxD,MAAO,CACH,CACI,WAAY,CAAC,EAAG,GAAI,GAAI,GAAI,CAAC,EAAG,KAAK,CAAE,EAAG,EAAG,CAAC,EAC9C,SAAU,CAAE,IAAK,yCAA0C,WAAY,EAAG,QAAS,CAAE,EACrF,KAAM,CACV,EACA,CACI,WAAY,CAAC,EAAG,GAAI,GAAI,GAAI,CAAC,EAAG,QAAQ,CAAE,EAAG,EAAG,CAAC,EACjD,SAAU,CAAE,IAAK,uCAAwC,WAAY,EAAG,QAAS,CAAE,EACnF,KAAM,CACV,EACA,CACI,WAAY,CAAC,EAAG,GAAI,GAAI,GAAI,CAAC,EAAG,YAAY,CAAE,EAAG,EAAG,CAAC,EACrD,SAAU,CAAE,IAAK,+CAAgD,WAAY,EAAG,QAAS,CAAE,EAC3F,KAAM,CACV,EACA,CACI,WAAY,CAAC,EAAG,CAAC,EACjB,MAAO,CACH,CACI,WAAY,CAAC,EAAG,GAAI,GAAI,GAAI,CAAC,GAAG,EAAC,CAAE,EAAG,EAAC,EACvC,MAAO,CACH,CACI,SAAU,CACN,IAAK,oEACL,WAAY,EACZ,QAAS,CACb,EACA,KAAM,CACV,CACJ,EACA,KAAM,CACV,EACA,CACI,MAAO,kFACP,KAAM,CACV,CACJ,EACA,KAAM,CACV,EACA,CACI,WAAY,CAAC,EAAG,CAAC,EACjB,MAAO,CACH,CACI,WAAY,CAAC,EAAG,GAAI,GAAI,GAAI,CAAC,GAAG,EAAC,CAAE,CAAC,EACpC,MAAO,CACH,CACI,SAAU,CACN,IAAK,2DACL,WAAY,EACZ,QAAS,CACb,EACA,KAAM,CACV,CACJ,EACA,KAAM,CACV,EACA,CAAE,MAAO,2DAA4D,KAAM,CAAE,CACjF,EACA,KAAM,CACV,EACA,CACI,WAAY,CAAC,EAAG,CAAC,EACjB,MAAO,CACH,CACI,WAAY,CAAC,EAAC,EACd,MAAO,CACH,CACI,SAAU,CACN,IAAK,+DACL,WAAY,EACZ,QAAS,CACb,EACA,KAAM,CACV,CACJ,EACA,KAAM,CACV,EACA,CAAE,MAAO,qEAAsE,KAAM,CAAE,CAC3F,EACA,KAAM,CACV,EACA,CACI,SAAU,CAAE,IAAK,sDAAuD,WAAY,EAAG,QAAS,CAAE,EAClG,KAAM,CACV,CACJ,EACA,KAAM,CACV,CACJ,EACA,KAAM,CACV,EACA,CAAE,MAAO,wCAAyC,KAAM,CAAE,CAC9D,EACA,KAAM,CACV,CACJ,CACJ,EACQ,WAAU,qBCnIlB,OAAO,eAAe,GAAS,aAAc,CAAE,MAAO,EAAK,CAAC,EACpD,2BAA+B,OACvC,IAAM,QACA,OACA,QACA,GAAQ,IAAI,EAAiB,cAAc,CAC7C,KAAM,GACN,OAAQ,CAAC,WAAY,SAAU,eAAgB,SAAS,CAC5D,CAAC,EACK,GAA0B,CAAC,EAAgB,EAAU,CAAC,IAAM,CAC9D,OAAO,GAAM,IAAI,EAAgB,KAAO,EAAG,EAAiB,iBAAiB,GAAU,QAAS,CAC5F,eAAgB,EAChB,OAAQ,EAAQ,MACpB,CAAC,CAAC,GAEE,2BAA0B,GAClC,EAAiB,wBAAwB,IAAM,GAAiB,qCChBhE,OAAO,eAAe,EAAS,aAAc,CAAE,MAAO,EAAK,CAAC,EACpD,yBAAiC,qBAA0B,OACnE,IAAM,OACN,OAAO,eAAe,EAAS,qBAAsB,CAAE,WAAY,GAAM,IAAK,QAAS,EAAG,CAAE,OAAO,GAAgB,iBAAoB,CAAC,EACxI,MAAM,UAA+B,GAAgB,gBAAiB,CAClE,WAAW,CAAC,EAAS,CACjB,MAAM,CAAO,EACb,OAAO,eAAe,KAAM,EAAuB,SAAS,EAEpE,CACQ,yBAAyB,mBCVjC,OAAO,eAAe,GAAS,aAAc,CAAE,MAAO,EAAK,CAAC,EACpD,uBAA8B,wBAA+B,2BAAkC,yBAA6B,OACpI,IAAM,MACN,MAAM,UAA8B,EAAyB,sBAAuB,CAChF,KAAO,wBACP,OAAS,SACT,MACA,WAAW,CAAC,EAAM,CACd,MAAM,CACF,KAAM,wBACN,OAAQ,YACL,CACP,CAAC,EACD,OAAO,eAAe,KAAM,EAAsB,SAAS,EAC3D,KAAK,MAAQ,EAAK,MAE1B,CACQ,yBAAwB,EAChC,MAAM,UAAgC,EAAyB,sBAAuB,CAClF,KAAO,0BACP,OAAS,SACT,MACA,WAAW,CAAC,EAAM,CACd,MAAM,CACF,KAAM,0BACN,OAAQ,YACL,CACP,CAAC,EACD,OAAO,eAAe,KAAM,EAAwB,SAAS,EAC7D,KAAK,MAAQ,EAAK,MAE1B,CACQ,2BAA0B,EAClC,MAAM,UAA6B,EAAyB,sBAAuB,CAC/E,KAAO,uBACP,OAAS,SACT,MACA,WAAW,CAAC,EAAM,CACd,MAAM,CACF,KAAM,uBACN,OAAQ,YACL,CACP,CAAC,EACD,OAAO,eAAe,KAAM,EAAqB,SAAS,EAC1D,KAAK,MAAQ,EAAK,MAE1B,CACQ,wBAAuB,EAC/B,MAAM,UAA4B,EAAyB,sBAAuB,CAC9E,KAAO,sBACP,OAAS,SACT,MACA,WAAW,CAAC,EAAM,CACd,MAAM,CACF,KAAM,sBACN,OAAQ,YACL,CACP,CAAC,EACD,OAAO,eAAe,KAAM,EAAoB,SAAS,EACzD,KAAK,MAAQ,EAAK,MAE1B,CACQ,uBAAsB,mBC9D9B,OAAO,eAAe,GAAS,aAAc,CAAE,MAAO,EAAK,CAAC,EACpD,sBAA6B,kCAAyC,8BAAqC,iCAAwC,6BAAoC,gBAAuB,uBAA8B,wBAA+B,yBAAgC,4BAAmC,0BAAiC,2BAA+B,OACtZ,IAAM,GAAO,wBACP,GAAM,cACN,GAAQ,oBACR,GAAS,2BACT,GAAU,+BACV,GAAW,gCACX,GAAU,4BACV,GAAO,0BACP,GAAM,eACN,GAAQ,uBACR,GAAM,sBACN,GAAO,cACP,GAAM,cACN,EAAK,SACL,GAAM,WACN,GAAM,eACN,GAAM,OACN,EAAK,QACL,GAAM,YACN,GAAM,YACN,GAAK,OACL,EAAM,YACN,GAAM,UACN,EAAM,WACN,EAAK,UACL,EAAM,eACN,GAAM,cACN,GAAK,+CACL,GAAO,kBACP,GAAM,eACN,GAAM,SACN,GAAM,aACN,GAAM,cACN,GAAM,YACN,EAAK,uBACL,QACA,MACA,OACA,GAAc,GAAS,aAAa,IAAI,EAAE,EACxC,2BAA0B,CAAC,GAAI,GAAI,yBAA0B,EAAG,CAAC,EAAG,CAAC,CAAC,EAC9E,GAAY,cAAsB,2BAAyB,GAAyB,sBAAsB,EAC1G,IAAM,EAAc,GAAS,aAAa,IAAI,CAAE,EACxC,0BAAyB,CAAC,GAAI,EAAI,GAAM,EAAG,GAAK,CAAG,EAAG,CAAC,EAAI,CAAE,EAAG,CAAC,EAAG,CAAC,EAAG,CAAC,EACjF,EAAY,cAAsB,0BAAwB,EAAS,qBAAqB,EAChF,4BAA2B,CAAC,GAAI,EAAI,GAAM,EAAG,GAAK,IAAM,GAAM,GAAI,EAAG,CAAC,EAAI,CAAE,EAAG,CAAC,EAAG,CAAC,EAAG,CAAC,EAChG,EAAY,cAAsB,4BAA0B,EAAS,uBAAuB,EACpF,yBAAwB,CAAC,GAAI,EAAI,GAAO,EAAG,GAAK,GAAK,GAAM,GAAI,EAAG,CAAC,EAAI,CAAE,EAAG,CAAC,EAAG,CAAC,EAAG,CAAC,EAC7F,EAAY,cAAsB,yBAAuB,EAAS,oBAAoB,EAC9E,wBAAuB,CAAC,GAAI,EAAI,GAAK,EAAG,GAAK,GAAK,GAAM,GAAI,EAAG,CAAC,EAAI,CAAE,EAAG,CAAC,EAAG,CAAC,EAAG,CAAC,EAC1F,EAAY,cAAsB,wBAAsB,EAAS,mBAAmB,EAC5E,uBAAsB,CAAC,GAAa,CAAW,EACvD,IAAI,GAAe,CAAC,EAAG,EAAI,GAAK,EAAG,CAAC,EAC5B,gBAAe,CACnB,EACA,EACA,GACA,EACA,CAAC,GAAM,GAAM,EAAG,EAChB,CACI,CAAC,EAAG,EAAG,GAAM,EAAK,CAAC,EACnB,CAAC,EAAG,EAAG,GAAM,EAAK,CAAC,EACnB,CAAC,EAAG,EAAG,GAAM,EAAI,CAAC,CACtB,EACA,CACJ,EACQ,6BAA4B,CAChC,EACA,EACA,GACA,EACA,CAAC,EAAG,EACJ,CAAC,CAAC,IAAc,iCAA+B,EAAE,CAAC,EAClD,CACJ,EACQ,iCAAgC,CACpC,EACA,EACA,GACA,EACA,CAAC,GAAK,GAAK,GAAK,GAAK,GAAK,CAAG,EAC7B,CACI,CAAC,EAAG,EAAG,GAAM,EAAI,CAAC,EAClB,CAAC,EAAG,EAAG,GAAM,EAAI,CAAC,EAClB,EACA,CAAC,EAAG,EAAG,GAAM,EAAI,CAAC,EAClB,CAAC,EAAG,EAAG,GAAM,EAAI,CAAC,EAClB,CAAC,IAAM,GAAc,EAAG,GAAM,CAAI,CAAC,CACvC,EACA,CACJ,EACQ,8BAA6B,CACjC,EACA,EACA,GACA,EACA,CAAC,EAAG,EACJ,CAAC,CAAC,IAAc,kCAAgC,EAAE,CAAC,EACnD,CACJ,EACQ,kCAAiC,CACrC,EACA,EACA,GACA,EACA,CAAC,GAAK,GAAK,GAAK,EAAK,EAAG,EACxB,CACI,CAAC,IAAc,gBAAc,EAAG,GAAM,EAAI,CAAC,EAC3C,CAAC,EAAG,EAAG,GAAM,EAAI,CAAC,EAClB,CAAC,EAAG,EAAG,GAAM,EAAI,CAAC,EAClB,CAAC,IAAM,GAAc,EAAG,GAAM,CAAI,CAAC,EACnC,CAAC,EAAG,EAAG,GAAM,EAAI,CAAC,CACtB,EACA,CACJ,EACQ,sBAAqB,CACzB,EACA,EACA,GACA,EAAG,IAAK,CAAC,OAAQ,YAAa,GAAG,CAAE,EACnC,IAAc,6BACd,IAAc,6BAClB,oBC3HA,OAAO,eAAe,GAAS,aAAc,CAAE,MAAO,EAAK,CAAC,EACpD,oBAAwB,OAChC,IAAM,OACA,QACA,QACA,OACA,QACA,QACA,QACA,OACA,QACA,OACA,GAAmB,CAAC,IAAW,CACjC,MAAO,CACH,WAAY,aACZ,cAAe,GAAQ,eAAiB,GAAc,WACtD,cAAe,GAAQ,eAAiB,GAAc,SACtD,kBAAmB,GAAQ,mBAAqB,GAChD,iBAAkB,GAAQ,kBAAoB,GAAmB,wBACjE,WAAY,GAAQ,YAAc,CAAC,EACnC,uBAAwB,GAAQ,wBAA0B,GAAyB,oCACnF,gBAAiB,GAAQ,iBAAmB,CACxC,CACI,SAAU,iBACV,iBAAkB,CAAC,IAAQ,EAAI,oBAAoB,gBAAgB,EACnE,OAAQ,IAAI,GAAO,iBACvB,EACA,CACI,SAAU,oBACV,iBAAkB,CAAC,IAAQ,EAAI,oBAAoB,mBAAmB,IAAM,UAAa,CAAC,IAC1F,OAAQ,IAAI,GAAO,YACvB,CACJ,EACA,OAAQ,GAAQ,QAAU,IAAI,GAAgB,WAC9C,SAAU,GAAQ,UAAY,GAAY,oBAC1C,iBAAkB,GAAQ,kBAAoB,CAC1C,iBAAkB,uBAClB,oBAAqB,GAAY,oBACjC,QAAS,aACT,cAAe,QACnB,EACA,UAAW,GAAQ,WAAa,SAChC,UAAW,GAAQ,WAAa,GAAa,SAC7C,YAAa,GAAQ,aAAe,GAAY,SAChD,YAAa,GAAQ,aAAe,GAAY,MACpD,GAEI,oBAAmB,qBC/C3B,OAAO,eAAe,GAAS,aAAc,CAAE,MAAO,EAAK,CAAC,EACpD,oBAAwB,OAChC,IAAM,QACA,GAAiB,GAAQ,oBAAgD,EACzE,OACA,QACA,OACA,QACA,QACA,OACA,QACA,OACA,QACA,QACA,QACA,QACA,GAAmB,CAAC,IAAW,EAChC,EAAG,GAAgB,iCAAiC,QAAQ,OAAO,EACpE,IAAM,GAAgB,EAAG,GAA0B,2BAA2B,CAAM,EAC9E,EAAwB,IAAM,EAAa,EAAE,KAAK,GAAgB,yBAAyB,EAC3F,GAAsB,EAAG,GAAuB,kBAAkB,CAAM,GAC7E,EAAG,GAAO,iCAAiC,QAAQ,OAAO,EAC3D,IAAM,EAAe,CACjB,QAAS,GAAQ,QACjB,OAAQ,EAAmB,MAC/B,EACA,MAAO,IACA,KACA,EACH,QAAS,OACT,eACA,qBAAsB,GAAQ,uBAAyB,EAAG,EAAuB,YAAY,GAAO,oCAAqC,CAAY,EACrJ,kBAAmB,GAAQ,mBAAqB,GAAwB,oBACxE,yBAA0B,GAAQ,2BAC7B,EAAG,GAAuB,gCAAgC,CAAE,UAAW,EAAmB,UAAW,cAAe,GAAe,QAAQ,OAAQ,CAAC,EACzJ,YAAa,GAAQ,cAAgB,EAAG,EAAuB,YAAY,GAAmB,gCAAiC,CAAM,EACrI,OAAQ,GAAQ,SACX,EAAG,EAAuB,YAAY,EAAkB,2BAA4B,IAAK,EAAkB,mCAAoC,CAAa,CAAC,EAClK,eAAgB,GAAoB,gBAAgB,OAAO,GAAQ,gBAAkB,CAAqB,EAC1G,UAAW,GAAQ,YACd,EAAG,EAAuB,YAAY,IAChC,GAAmB,+BACtB,QAAS,UAAa,MAAM,EAAsB,GAAG,WAAa,GAAa,kBACnF,EAAG,CAAM,EACb,OAAQ,GAAQ,QAAU,GAAY,KAAK,KAAK,KAAM,QAAQ,EAC9D,gBAAiB,GAAQ,iBAAmB,GAAoB,gBAChE,qBAAsB,GAAQ,uBAAyB,EAAG,EAAuB,YAAY,EAAkB,2CAA4C,CAAY,EACvK,gBAAiB,GAAQ,kBAAoB,EAAG,EAAuB,YAAY,EAAkB,sCAAuC,CAAY,EACxJ,eAAgB,GAAQ,iBAAmB,EAAG,EAAuB,YAAY,GAAuB,2BAA4B,CAAY,CACpJ,GAEI,oBAAmB,oBClD3B,IAAI,QACA,QACA,QACA,QACA,QACA,OACA,QACA,QACA,QACA,QACA,MACA,OACA,QACA,QACA,QACA,MACA,MACA,OAEE,GAAkC,CAAC,IAAY,CACjD,OAAO,OAAO,OAAO,EAAS,CAC1B,qBAAsB,EAAQ,sBAAwB,GACtD,gBAAiB,EAAQ,iBAAmB,GAC5C,mBAAoB,QACxB,CAAC,GAEC,GAAe,CACjB,QAAS,CAAE,KAAM,gBAAiB,KAAM,iBAAkB,EAC1D,SAAU,CAAE,KAAM,gBAAiB,KAAM,UAAW,EACpD,OAAQ,CAAE,KAAM,gBAAiB,KAAM,QAAS,EAChD,aAAc,CAAE,KAAM,gBAAiB,KAAM,sBAAuB,CACxE,EAEM,GAAoC,CAAC,IAAkB,CACzD,IAAuC,gBAAjC,EACsC,uBAAxC,EAC6B,YAA7B,GAD0B,EAE9B,MAAO,CACH,iBAAiB,CAAC,EAAgB,CAC9B,IAAM,EAAQ,EAAiB,UAAU,CAAC,IAAW,EAAO,WAAa,EAAe,QAAQ,EAChG,GAAI,IAAU,GACV,EAAiB,KAAK,CAAc,EAGpC,OAAiB,OAAO,EAAO,EAAG,CAAc,GAGxD,eAAe,EAAG,CACd,OAAO,GAEX,yBAAyB,CAAC,EAAwB,CAC9C,EAA0B,GAE9B,sBAAsB,EAAG,CACrB,OAAO,GAEX,cAAc,CAAC,EAAa,CACxB,EAAe,GAEnB,WAAW,EAAG,CACV,OAAO,EAEf,GAEE,GAA+B,CAAC,IAAW,CAC7C,MAAO,CACH,gBAAiB,EAAO,gBAAgB,EACxC,uBAAwB,EAAO,uBAAuB,EACtD,YAAa,EAAO,YAAY,CACpC,GAGE,GAA2B,CAAC,EAAe,IAAe,CAC5D,IAAM,EAAyB,OAAO,OAAO,GAAqB,mCAAmC,CAAa,EAAG,EAAa,iCAAiC,CAAa,EAAG,GAAa,qCAAqC,CAAa,EAAG,GAAkC,CAAa,CAAC,EAErS,OADA,EAAW,QAAQ,CAAC,IAAc,EAAU,UAAU,CAAsB,CAAC,EACtE,OAAO,OAAO,EAAe,GAAqB,uCAAuC,CAAsB,EAAG,EAAa,4BAA4B,CAAsB,EAAG,GAAa,gCAAgC,CAAsB,EAAG,GAA6B,CAAsB,CAAC,GAGzT,MAAM,WAAqB,EAAa,MAAO,CAC3C,OACA,WAAW,KAAK,GAAgB,CAC5B,IAAM,EAAY,GAAc,iBAAiB,GAAiB,CAAC,CAAC,EACpE,MAAM,CAAS,EACf,KAAK,WAAa,EAClB,IAAM,EAAY,GAAgC,CAAS,EACrD,EAAY,GAAoB,uBAAuB,CAAS,EAChE,EAAY,GAAgB,mBAAmB,CAAS,EACxD,EAAY,GAAe,oBAAoB,CAAS,EACxD,EAAY,GAAqB,wBAAwB,CAAS,EAClE,GAAY,GAAmB,sBAAsB,CAAS,EAC9D,GAAY,GAAuB,4BAA4B,EAAS,EACxE,GAAY,GAAyB,GAAW,GAAe,YAAc,CAAC,CAAC,EACrF,KAAK,OAAS,GACd,KAAK,gBAAgB,IAAI,GAAO,qBAAqB,KAAK,MAAM,CAAC,EACjE,KAAK,gBAAgB,IAAI,GAAoB,mBAAmB,KAAK,MAAM,CAAC,EAC5E,KAAK,gBAAgB,IAAI,GAAgB,eAAe,KAAK,MAAM,CAAC,EACpE,KAAK,gBAAgB,IAAI,GAAwB,uBAAuB,KAAK,MAAM,CAAC,EACpF,KAAK,gBAAgB,IAAI,GAAqB,oBAAoB,KAAK,MAAM,CAAC,EAC9E,KAAK,gBAAgB,IAAI,GAAiB,gBAAgB,KAAK,MAAM,CAAC,EACtE,KAAK,gBAAgB,IAAI,GAA6B,4BAA4B,KAAK,MAAM,CAAC,EAC9F,KAAK,gBAAgB,IAAI,EAAK,uCAAuC,KAAK,OAAQ,CAC9E,iCAAkC,GAAuB,8CACzD,+BAAgC,MAAO,KAAW,IAAI,EAAK,8BAA8B,CACrF,iBAAkB,GAAO,WAC7B,CAAC,CACL,CAAC,CAAC,EACF,KAAK,gBAAgB,IAAI,EAAK,qBAAqB,KAAK,MAAM,CAAC,EAEnE,OAAO,EAAG,CACN,MAAM,QAAQ,EAEtB,CAEA,MAAM,WAAiC,EAAa,QAC/C,aAAa,EACb,GAAG,EAAY,EACf,EAAE,QAAS,CAAC,EAAS,EAAI,EAAQ,EAAG,CACrC,MAAO,CAAC,GAAmB,kBAAkB,EAAQ,EAAQ,iCAAiC,CAAC,CAAC,EACnG,EACI,EAAE,SAAU,oBAAqB,CAAC,CAAC,EACnC,EAAE,eAAgB,0BAA0B,EAC5C,GAAG,EAAU,kBAAkB,EAC/B,MAAM,CAAE,CACb,CAEA,IAAM,GAAW,CACb,2BACJ,EACA,MAAM,WAAe,EAAa,CAClC,CACA,EAAa,uBAAuB,GAAU,EAAM,EAEpD,IAAM,GAAkB,CACpB,iBAAkB,mBAClB,yBAA0B,2BAC1B,gBAAiB,kBACjB,aAAc,eACd,cAAe,gBACf,yBAA0B,0BAC9B,EAEQ,WAAW,EAAa,QACxB,WAAW,EAAa,OACxB,yBAAyB,GAAuB,uBAChD,2BAA2B,GAC3B,kBAAkB,GAClB,SAAS,GACT,eAAe,GACvB,OAAO,UAAU,eAAe,KAAK,EAAW,WAAW,GACvD,CAAC,OAAO,UAAU,eAAe,KAAK,EAAS,WAAW,GAC1D,OAAO,eAAe,EAAS,YAAa,CACxC,WAAY,GACZ,MAAO,EAAU,SACrB,CAAC,EAEL,OAAO,KAAK,CAAS,EAAE,QAAQ,QAAS,CAAC,EAAG,CACxC,GAAI,IAAM,WAAa,CAAC,OAAO,UAAU,eAAe,KAAK,EAAS,CAAC,EAAG,EAAQ,GAAK,EAAU,GACpG,EACD,OAAO,UAAU,eAAe,KAAK,EAAQ,WAAW,GACpD,CAAC,OAAO,UAAU,eAAe,KAAK,EAAS,WAAW,GAC1D,OAAO,eAAe,EAAS,YAAa,CACxC,WAAY,GACZ,MAAO,EAAO,SAClB,CAAC,EAEL,OAAO,KAAK,CAAM,EAAE,QAAQ,QAAS,CAAC,EAAG,CACrC,GAAI,IAAM,WAAa,CAAC,OAAO,UAAU,eAAe,KAAK,EAAS,CAAC,EAAG,EAAQ,GAAK,EAAO,GACjG",
-  "debugId": "E9840AC1BCC37D9764756E2164756E21",
+  "debugId": "34EC47671CBDC41C64756E2164756E21",
   "names": []
 }

package/dist/{chunk-n914rs58.js → chunk-kzy4pyqb.js}

@@ -1,5 +1,5 @@
 // @bun
-import{Gj as O}from"./chunk-g02gqhq0.js";import{ok as S}from"./chunk-gmcttf0f.js";import{Vk as E}from"./chunk-ftvc1a0k.js";import{tl as U}from"./chunk-ermvtpy9.js";class F{rows=new Map;async find(j,G){for(let Q of this.rows.values())if(Q.userId===j&&Q.provider===G)return{...Q};return null}async list(j){return[...this.rows.values()].filter((G)=>G.userId===j).map((G)=>({...G}))}async save(j,G,Q){let V=await this.find(j,G),W=new Date,Y={id:V?.id??Bun.randomUUIDv7(),userId:j,provider:G,...P(Q),needsReconnect:!1,revision:(V?.revision??0)+1,createdAt:V?.createdAt??W,updatedAt:W};return this.rows.set(Y.id,Y),{...Y}}async updateTokens(j,G,Q){let V=this.rows.get(j);if(!V||V.revision!==G)return null;let W=P(Q);W.providerAccountId??=V.providerAccountId;let Y={...V,...W,needsReconnect:!1,revision:G+1,updatedAt:new Date};return this.rows.set(j,Y),{...Y}}async markNeedsReconnect(j){let G=this.rows.get(j);if(G)this.rows.set(j,{...G,needsReconnect:!0,updatedAt:new Date})}async delete(j){this.rows.delete(j)}}class L{encrypter;table;sql;dialect;constructor(j,G,Q={}){this.encrypter=G;let V=Q.table??"gemi_oauth_connections";if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(V))throw Error(`The connections table name "${V}" is not a plain identifier.`);this.table=V,this.sql=j.sql,this.dialect=j.dialect}async createTable(){for(let j of q(this.dialect,this.table))await this.sql.unsafe(j)}async find(j,G){let Q=this.sql,V=await Q`
+import{Kj as O}from"./chunk-ecyq52t3.js";import{sk as S}from"./chunk-mnmz8n5k.js";import{Zk as E}from"./chunk-htnbmbx1.js";import{xl as U}from"./chunk-9ky5d5js.js";class F{rows=new Map;async find(j,G){for(let Q of this.rows.values())if(Q.userId===j&&Q.provider===G)return{...Q};return null}async list(j){return[...this.rows.values()].filter((G)=>G.userId===j).map((G)=>({...G}))}async save(j,G,Q){let V=await this.find(j,G),W=new Date,Y={id:V?.id??Bun.randomUUIDv7(),userId:j,provider:G,...P(Q),needsReconnect:!1,revision:(V?.revision??0)+1,createdAt:V?.createdAt??W,updatedAt:W};return this.rows.set(Y.id,Y),{...Y}}async updateTokens(j,G,Q){let V=this.rows.get(j);if(!V||V.revision!==G)return null;let W=P(Q);W.providerAccountId??=V.providerAccountId;let Y={...V,...W,needsReconnect:!1,revision:G+1,updatedAt:new Date};return this.rows.set(j,Y),{...Y}}async markNeedsReconnect(j){let G=this.rows.get(j);if(G)this.rows.set(j,{...G,needsReconnect:!0,updatedAt:new Date})}async delete(j){this.rows.delete(j)}}class L{encrypter;table;sql;dialect;constructor(j,G,Q={}){this.encrypter=G;let V=Q.table??"gemi_oauth_connections";if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(V))throw Error(`The connections table name "${V}" is not a plain identifier.`);this.table=V,this.sql=j.sql,this.dialect=j.dialect}async createTable(){for(let j of q(this.dialect,this.table))await this.sql.unsafe(j)}async find(j,G){let Q=this.sql,V=await Q`
       SELECT * FROM ${this.name(Q)} WHERE user_id = ${j} AND provider = ${G}
     `;return V[0]?this.decode(V[0]):null}async list(j){let G=this.sql;return(await G`
       SELECT * FROM ${this.name(G)} WHERE user_id = ${j} ORDER BY provider
@@ -66,6 +66,6 @@ import{Gj as O}from"./chunk-g02gqhq0.js";import{ok as S}from"./chunk-gmcttf0f.js
     "created_at" BIGINT NOT NULL,
     "updated_at" BIGINT NOT NULL${V}
 )`,`CREATE UNIQUE INDEX IF NOT EXISTS "${G}_user_id_provider_key" ON "${G}"("user_id", "provider")`]}class X extends Error{code;status;providerError;constructor(j,G,Q={}){super(G,Q.cause!==void 0?{cause:Q.cause}:void 0);this.code=j;this.name="OAuthConnectionError",this.status=Q.status,this.providerError=Q.providerError}}class K extends X{provider;constructor(j,G={}){super("reconnect_required",`The ${j} connection needs to be reconnected: its tokens were refused and could not be refreshed.`,G);this.provider=j;this.name="OAuthReconnectRequiredError"}}class C{config;constructor(j){for(let G of["authorizeUrl","tokenUrl"])_(G,j[G]);for(let G of["refreshUrl","revokeUrl"])if(j[G]!==void 0)_(G,j[G]);if(j.apiBaseUrl===void 0||j.apiBaseUrl===null||j.apiBaseUrl==="")throw Error(`OAuthConnectionProvider: apiBaseUrl is required. Set it to the provider's API origin (e.g. apiBaseUrl: "https://api.figma.com"); connection.fetch only sends the token there.`);_("apiBaseUrl",j.apiBaseUrl),this.config={scopeSeparator:" ",clientAuth:"body",pkce:!0,authorizationParams:{},refreshLeewaySeconds:60,multiple:!1,tokenPlacement:"header",...j,refreshGrantType:j.refreshGrantType??"refresh_token"}}async isTokenRejected(j){let G=this.config.isTokenRejected;if(!G)return j.status===401;return await G(j)}authorizationUrl(j){let G=new URL(this.config.authorizeUrl),Q={...this.config.authorizationParams,response_type:"code",client_id:this.config.clientId,redirect_uri:j.redirectUri,scope:this.config.scopes.join(this.config.scopeSeparator),state:j.state};if(this.config.pkce)Q.code_challenge=j.codeChallenge,Q.code_challenge_method="S256";for(let[V,W]of Object.entries(Q))G.searchParams.set(V,W);return G.toString()}exchangeCode(j){let G=new URLSearchParams({grant_type:"authorization_code",code:j.code,redirect_uri:j.redirectUri});if(this.config.pkce)G.set("code_verifier",j.codeVerifier);return this.tokenRequest(this.config.tokenUrl,G,{scopes:this.config.scopes,refreshToken:null,phase:"exchange"})}refresh(j,G){let Q=new URLSearchParams,V=this.config.refreshGrantType;if(V!==!1&&V!=="")Q.set("grant_type",V);return Q.set("refresh_token",j),this.tokenRequest(this.config.refreshUrl??this.config.tokenUrl,Q,{scopes:G,refreshToken:j,phase:"refresh"})}async revoke(j,G){if(!this.config.revokeUrl)throw new X("revoke_unsupported","This provider has no revokeUrl configured. Use disconnect() to forget the tokens locally.");let Q=new URLSearchParams({token:j,token_type_hint:G}),V;try{V=await fetch(this.config.revokeUrl,this.post(Q))}catch(W){throw new X("revoke_failed","The revocation request failed.",{cause:W})}if(!V.ok)throw new X("revoke_failed",`The provider refused the revocation (HTTP ${V.status}).`,{status:V.status})}post(j){let G={"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"};if(this.config.clientAuth==="basic"){let Q=`${encodeURIComponent(this.config.clientId)}:${encodeURIComponent(this.config.clientSecret)}`;G.Authorization=`Basic ${Buffer.from(Q).toString("base64")}`}else j.set("client_id",this.config.clientId),j.set("client_secret",this.config.clientSecret);return{method:"POST",headers:G,body:j.toString(),redirect:"error"}}async tokenRequest(j,G,Q){let V=Q.phase==="exchange"?"exchange_failed":"refresh_failed",W;try{W=await fetch(j,this.post(G))}catch($){throw new X(V,"The token request failed.",{cause:$})}let Y=await W.json().catch(()=>({}));if(!W.ok||typeof Y.access_token!=="string"||Y.access_token===""){let $=typeof Y.error==="string"&&/^[a-z0-9_]{1,64}$/.test(Y.error)?Y.error:void 0;throw new X(V,`The token endpoint refused the ${Q.phase==="exchange"?"code":"refresh token"} (HTTP ${W.status}${$?`, ${$}`:""}).`,{status:W.status,providerError:$})}let Z=Number(Y.expires_in),B=typeof Y.scope==="string"?Y.scope:void 0,J=Y.user_id_string??Y.user_id??Y.account_id;return{accessToken:Y.access_token,refreshToken:typeof Y.refresh_token==="string"&&Y.refresh_token!==""?Y.refresh_token:Q.refreshToken,tokenType:typeof Y.token_type==="string"?Y.token_type:null,expiresAt:Number.isFinite(Z)&&Z>0?new Date(Date.now()+Z*1000):null,scopes:B!==void 0?B.split(/[\s,]+/).filter(Boolean):Q.scopes,providerAccountId:typeof J==="string"||typeof J==="number"?String(J):null}}}function _(j,G){let Q;try{Q=new URL(String(G))}catch{Q=void 0}if(!Q||Q.protocol!=="https:"&&!(Q.protocol==="http:"&&M(Q.hostname)))throw Error(`OAuthConnectionProvider: ${j} must be an https URL (http only for localhost), got ${JSON.stringify(G)}.`)}function M(j){return j==="localhost"||j==="127.0.0.1"||j==="[::1]"||j==="::1"}class A{options;static token="auth.connections";resolvedStore;refreshing=new Map;fakes;fakeStore;fakeRequests=[];constructor(j){this.options=j;for(let[G,Q]of Object.entries(j.providers)){if(!Q.config.multiple)continue;let V=Object.keys(j.providers).find((W)=>W.startsWith(`${G}${D}`));if(G.includes(D)||V)throw Error(`auth.connections: "${V??G}" cannot be used alongside the multiple-account provider "${G}" ("${D}" separates a provider from an account id in the store).`)}}get providers(){return this.options.providers}get store(){if(this.fakeStore)return this.fakeStore;if(!this.resolvedStore){let j=this.options.store;this.resolvedStore=typeof j==="function"?j():j??new L(U(E).connection(),()=>O())}return this.resolvedStore}provider(j){let G=this.options.providers[j];if(!G){let Q=Object.keys(this.options.providers);throw new X("unknown_provider",`No OAuth connection provider "${j}" in auth.connections`+(Q.length>0?` (configured: ${Q.join(", ")}).`:" (none are configured)."))}return G}async for(j,G,Q){let V=this.provider(G),W=N(j);if(!V.config.multiple){let Z=await this.store.find(W,G);if(!Z||Q!==void 0&&Z.providerAccountId!==Q)return null;return new z(this,Z)}if(Q!==void 0){let Z=await this.store.find(W,T(G,Q))??await this.store.find(W,G);return Z&&Z.providerAccountId===Q?new z(this,Z):null}let[Y]=(await this.list(j,G)).sort((Z,B)=>B.connectedAt.getTime()-Z.connectedAt.getTime());return Y??null}async list(j,G){if(G!==void 0)this.provider(G);return(await this.store.list(N(j))).filter((V)=>{let W=this.providerName(V.provider);return W!==null&&(G===void 0||W===G)}).map((V)=>new z(this,V))}async save(j,G,Q){let V=this.provider(G),W=N(j),{profile:Y,...Z}=Q,B={refreshToken:null,tokenType:null,expiresAt:null,providerAccountId:null,scopes:V.config.scopes,...Z};if(!V.config.multiple)return new z(this,await this.store.save(W,G,B));let J=B.providerAccountId;if(typeof J!=="string"||J==="")throw new X("missing_account_id",`"${G}" allows several accounts per user, so a connection needs the provider's account id (providerAccountId), and the token exchange did not supply one.`);let $=await this.store.save(W,T(G,J),B),H=await this.store.find(W,G);if(H&&H.providerAccountId===J)await this.store.delete(H.id);return new z(this,$)}providerName(j){let G=this.options.providers;if(Object.hasOwn(G,j))return j;let Q=j.indexOf(D);if(Q<=0)return null;let V=j.slice(0,Q);return Object.hasOwn(G,V)&&G[V].config.multiple?V:null}fake(j={}){return this.fakes=new Map(Object.entries(j)),this.fakeStore=new F,this.fakeRequests.length=0,this}restore(){this.fakes=void 0,this.fakeStore=void 0,this.fakeRequests.length=0}get faked(){return this.fakes!==void 0}async send(j,G){if(!this.fakes)return fetch(G);this.fakeRequests.push(G.clone());let Q=this.fakes.get(j);if(!Q)throw Error(`Connections.fake() has no handler for "${j}". Pass one: Connections.fake({ ${j}: (req) => ... }).`);return Q(G)}refresh(j,G="requested"){let Q=this.refreshing.get(j.id);if(Q)return Q;let V=this.withLock(j.id,()=>this.refreshOnce(j,G)).finally(()=>this.refreshing.delete(j.id));return this.refreshing.set(j.id,V),V}async refreshOnce(j,G){let Q=this.providerName(j.provider)??j.provider,V=await this.store.find(j.userId,j.provider);if(!V||V.id!==j.id)throw new K(Q);if(V.revision!==j.revision&&!V.needsReconnect)return V;if(V.needsReconnect)throw new K(Q);let W=this.provider(Q);if(this.faked)return V;let Y=W.config.refreshStrategy;if(!Y&&V.refreshToken===null)throw await this.store.markNeedsReconnect(V.id),new K(Q);let Z;try{Z=Y?await Y({accessToken:V.accessToken,refreshToken:V.refreshToken,scopes:[...V.scopes],expiresAt:V.expiresAt,issuedAt:V.updatedAt,reason:G,providerAccountId:V.providerAccountId}):await W.refresh(V.refreshToken,V.scopes)}catch($){if($ instanceof X&&$.status!==void 0&&$.status>=400&&$.status<500&&$.providerError!=="invalid_client")throw await this.store.markNeedsReconnect(V.id),new K(Q,{cause:$,status:$.status,providerError:$.providerError});throw $}if(Z===null)return V;let B=await this.store.updateTokens(V.id,V.revision,Z);if(B)return B;let J=await this.store.find(V.userId,V.provider);if(!J)throw new K(Q);return J}async withLock(j,G){let Q=U();if(this.faked||!Q.bound(S))return G();let V=await Q.make(S).run(`gemi:oauth-connection:${j}`,{ttl:30000,wait:20000},()=>G());if(!V.acquired)throw new X("refresh_failed","Timed out waiting for another refresh of this connection to finish.");return V.value}}class z{manager;record;constructor(j,G){this.manager=j;this.record=G}get provider(){return this.manager.providerName(this.record.provider)??this.record.provider}get userId(){return this.record.userId}get providerAccountId(){return this.record.providerAccountId}get scopes(){return this.record.scopes}get expiresAt(){return this.record.expiresAt}get needsReconnect(){return this.record.needsReconnect}get connectedAt(){return this.record.createdAt}get status(){if(this.record.needsReconnect)return"needs_reconnect";let j=this.record.expiresAt?.getTime();if(this.record.refreshToken===null&&j!==void 0&&j<=Date.now())return"needs_reconnect";return"connected"}connectionProvider(){return this.manager.provider(this.provider)}hasScopes(...j){return j.every((G)=>this.record.scopes.includes(G))}async fetch(j,G={}){let Q=this.resolveUrl(j),V=await this.current(),W=await this.send(Q,G,V.accessToken);if(!W.authorized||G.body instanceof ReadableStream)return W.response;if(!await this.manager.provider(this.provider).isTokenRejected(W.response))return W.response;await W.response.body?.cancel().catch(()=>{});let Z=await this.refreshFrom(V,"rejected");return(await this.send(Q,G,Z.accessToken)).response}async accessToken(){return(await this.current()).accessToken}async refresh(){await this.refreshFrom(this.record)}async revoke(){if(!this.manager.faked){let j=this.manager.provider(this.provider);if(this.record.refreshToken!==null)await j.revoke(this.record.refreshToken,"refresh_token");else await j.revoke(this.record.accessToken,"access_token")}await this.manager.store.delete(this.record.id)}async disconnect(){await this.manager.store.delete(this.record.id)}toJSON(){return{provider:this.provider,providerAccountId:this.providerAccountId,scopes:[...this.scopes],expiresAt:this.expiresAt,needsReconnect:this.needsReconnect,status:this.status,connectedAt:this.connectedAt}}[Symbol.for("nodejs.util.inspect.custom")](){return{ProviderConnection:this.toJSON()}}async current(){if(this.record.needsReconnect)throw new K(this.provider);let j=this.manager.provider(this.provider).config.refreshLeewaySeconds*1000,G=this.record.expiresAt?.getTime();if(G!==void 0&&G-Date.now()<=j)return this.refreshFrom(this.record,"expiring");return this.record}async refreshFrom(j,G="requested"){try{this.record=await this.manager.refresh(j,G)}catch(Q){if(Q instanceof K)this.record={...this.record,needsReconnect:!0};throw Q}return this.record}resolveUrl(j){let G=this.manager.provider(this.provider).config.apiBaseUrl,Q;try{Q=new URL(String(j),G)}catch{throw new X("forbidden_url",`connection.fetch was given ${JSON.stringify(String(j))}, which is not a URL.`)}if(Q.origin!==new URL(G).origin)throw new X("forbidden_url",`connection.fetch only sends the ${this.provider} token to ${new URL(G).origin} (apiBaseUrl), not to ${Q.origin}.`);if(Q.protocol!=="https:"&&!(Q.protocol==="http:"&&M(Q.hostname)))throw new X("forbidden_url",`connection.fetch only sends a token over https, not to ${Q.origin}.`);return Q}async send(j,G,Q){let V=j,W=(G.method??"GET").toUpperCase(),Y=G.body,Z=!0;if(G.redirect==="manual"||G.redirect==="error")return{response:await this.manager.send(this.provider,this.request(V,G,W,Y,Q)),authorized:Z};for(let B=0;;B++){let J=this.request(V,{...G,redirect:"manual"},W,Y,Z?Q:null),$=await this.manager.send(this.provider,J),H=$.headers.get("location");if(!b.has($.status)||H===null||B>=5)return{response:$,authorized:Z};await $.body?.cancel().catch(()=>{});let x=new URL(H,V);if(x.origin!==V.origin)Z=!1;if($.status===303||($.status===301||$.status===302)&&W==="POST")W="GET",Y=void 0;V=x}}request(j,G,Q,V,W){let Y=new Headers(G.headers),Z=new URL(j),B=this.manager.provider(this.provider).config.tokenPlacement;if(W===null)Y.delete("authorization");else if(B==="query")Z.searchParams.set("access_token",W);else Y.set("Authorization",`Bearer ${W}`);return new Request(Z,{...G,method:Q,body:V,headers:Y})}}var b=new Set([301,302,303,307,308]),D=":";function T(j,G){return`${j}${D}${G}`}function N(j){let G=typeof j==="object"&&j!==null?j.id:j;if(G===void 0||G===null||G==="")throw TypeError("An OAuth connection belongs to a user: pass the user (or its id).");return String(G)}
-export{F as pj,L as qj,X as rj,K as sj,C as tj,A as uj,z as vj};
+export{F as tj,L as uj,X as vj,K as wj,C as xj,A as yj,z as zj};
 
-//# debugId=63ACA0C1EBA4552164756E2164756E21
+//# debugId=76D0BE7A645DC69E64756E2164756E21

package/dist/{chunk-n914rs58.js.map → chunk-kzy4pyqb.js.map}

@@ -8,6 +8,6 @@
     "import { DatabaseManager } from \"../../database/DatabaseManager\";\nimport { app } from \"../../foundation/app\";\nimport { currentEncrypter } from \"../../orm/encryption\";\nimport { LockManager } from \"../../services/lock/LockManager\";\nimport {\n  type ConnectionRecord,\n  type ConnectionStore,\n  DatabaseConnectionStore,\n  MemoryConnectionStore,\n} from \"./ConnectionStore\";\nimport { OAuthConnectionError, OAuthReconnectRequiredError } from \"./errors\";\nimport {\n  type ConnectionRefreshReason,\n  type OAuthConnectionProvider,\n  type OAuthTokenSet,\n  isLoopback,\n} from \"./OAuthConnectionProvider\";\n\n/** A user, as far as a connection is concerned: anything with an `id`. */\nexport type ConnectionOwner = { id: string | number } | string | number;\n\n/** See `ProviderConnection.status`. */\nexport type ConnectionStatus = \"connected\" | \"needs_reconnect\";\n\n/** What `Connections.fake` answers an API request with. */\nexport type FakeConnectionHandler = (request: Request) => Response | Promise<Response>;\n\nexport interface ConnectionManagerOptions {\n  providers: Record<string, OAuthConnectionProvider>;\n  /** Default: a `DatabaseConnectionStore` on the default database connection. */\n  store?: ConnectionStore | (() => ConnectionStore);\n}\n\n/**\n * The OAuth connections a user has made, and the one place their tokens are\n * read, refreshed and spent. Reached through the `Connections` facade.\n */\nexport class ConnectionManager {\n  static token = \"auth.connections\";\n\n  private resolvedStore: ConnectionStore | undefined;\n  private readonly refreshing = new Map<string, Promise<ConnectionRecord>>();\n  private fakes: Map<string, FakeConnectionHandler> | undefined;\n  private fakeStore: MemoryConnectionStore | undefined;\n  readonly fakeRequests: Request[] = [];\n\n  constructor(private readonly options: ConnectionManagerOptions) {\n    for (const [name, provider] of Object.entries(options.providers)) {\n      if (!provider.config.multiple) continue;\n      // A multiple-account provider's connections are stored under\n      // `<name>:<account id>`, which must not be read as another provider's.\n      const clash = Object.keys(options.providers).find((other) => other.startsWith(`${name}${ACCOUNT_SEPARATOR}`));\n      if (name.includes(ACCOUNT_SEPARATOR) || clash) {\n        throw new Error(\n          `auth.connections: \"${clash ?? name}\" cannot be used alongside the multiple-account provider \"${name}\" ` +\n            `(\"${ACCOUNT_SEPARATOR}\" separates a provider from an account id in the store).`,\n        );\n      }\n    }\n  }\n\n  get providers(): Record<string, OAuthConnectionProvider> {\n    return this.options.providers;\n  }\n\n  /** The store connections are kept in. */\n  get store(): ConnectionStore {\n    if (this.fakeStore) return this.fakeStore;\n    if (!this.resolvedStore) {\n      const configured = this.options.store;\n      this.resolvedStore =\n        typeof configured === \"function\"\n          ? configured()\n          : (configured ??\n            new DatabaseConnectionStore(app(DatabaseManager).connection(), () => currentEncrypter()));\n    }\n    return this.resolvedStore;\n  }\n\n  provider(name: string): OAuthConnectionProvider {\n    const provider = this.options.providers[name];\n    if (!provider) {\n      const known = Object.keys(this.options.providers);\n      throw new OAuthConnectionError(\n        \"unknown_provider\",\n        `No OAuth connection provider \"${name}\" in auth.connections` +\n          (known.length > 0 ? ` (configured: ${known.join(\", \")}).` : \" (none are configured).\"),\n      );\n    }\n    return provider;\n  }\n\n  /**\n   * The user's connection to `provider`, or `null` when they have not\n   * connected it. With `accountId`, only the connection to that account\n   * (`providerAccountId`). For a provider with `multiple: true` and no\n   * `accountId`, the account added most recently; use `list(user,\n   * provider)` for all of them.\n   */\n  async for(user: ConnectionOwner, provider: string, accountId?: string): Promise<ProviderConnection | null> {\n    const config = this.provider(provider);\n    const userId = ownerId(user);\n    if (!config.config.multiple) {\n      const record = await this.store.find(userId, provider);\n      if (!record || (accountId !== undefined && record.providerAccountId !== accountId)) return null;\n      return new ProviderConnection(this, record);\n    }\n    if (accountId !== undefined) {\n      const record =\n        (await this.store.find(userId, storeKey(provider, accountId))) ??\n        // Stored before the provider was switched to `multiple`.\n        (await this.store.find(userId, provider));\n      return record && record.providerAccountId === accountId ? new ProviderConnection(this, record) : null;\n    }\n    const [latest] = (await this.list(user, provider)).sort(\n      (a, b) => b.connectedAt.getTime() - a.connectedAt.getTime(),\n    );\n    return latest ?? null;\n  }\n\n  /** Every connection the user has, or only those to `provider`. */\n  async list(user: ConnectionOwner, provider?: string): Promise<ProviderConnection[]> {\n    if (provider !== undefined) this.provider(provider);\n    const records = await this.store.list(ownerId(user));\n    return records\n      .filter((record) => {\n        const name = this.providerName(record.provider);\n        return name !== null && (provider === undefined || name === provider);\n      })\n      .map((record) => new ProviderConnection(this, record));\n  }\n\n  /**\n   * Stores tokens for the user, replacing any earlier connection to the same\n   * provider — or, for a provider with `multiple: true`, to the same account\n   * (`providerAccountId`, required there). The connect callback calls this;\n   * call it yourself for tokens obtained some other way.\n   */\n  async save(\n    user: ConnectionOwner,\n    provider: string,\n    tokens: Partial<OAuthTokenSet> & { accessToken: string },\n  ): Promise<ProviderConnection> {\n    const config = this.provider(provider);\n    const userId = ownerId(user);\n    const { profile: _profile, ...grant } = tokens;\n    const set: OAuthTokenSet = {\n      refreshToken: null,\n      tokenType: null,\n      expiresAt: null,\n      providerAccountId: null,\n      scopes: config.config.scopes,\n      ...grant,\n    };\n    if (!config.config.multiple) {\n      return new ProviderConnection(this, await this.store.save(userId, provider, set));\n    }\n\n    const accountId = set.providerAccountId;\n    if (typeof accountId !== \"string\" || accountId === \"\") {\n      throw new OAuthConnectionError(\n        \"missing_account_id\",\n        `\"${provider}\" allows several accounts per user, so a connection needs the provider's account id ` +\n          \"(providerAccountId), and the token exchange did not supply one.\",\n      );\n    }\n    const record = await this.store.save(userId, storeKey(provider, accountId), set);\n    // The same account, stored before the provider was switched to `multiple`.\n    const legacy = await this.store.find(userId, provider);\n    if (legacy && legacy.providerAccountId === accountId) await this.store.delete(legacy.id);\n    return new ProviderConnection(this, record);\n  }\n\n  /**\n   * The configured provider a stored connection belongs to: the store key\n   * itself, or `<name>` of a multiple-account provider's `<name>:<account id>`.\n   * `null` for a provider no longer configured.\n   *\n   * @internal\n   */\n  providerName(key: string): string | null {\n    const providers = this.options.providers;\n    if (Object.hasOwn(providers, key)) return key;\n    const at = key.indexOf(ACCOUNT_SEPARATOR);\n    if (at <= 0) return null;\n    const name = key.slice(0, at);\n    return Object.hasOwn(providers, name) && providers[name].config.multiple ? name : null;\n  }\n\n  // --- testing ---------------------------------------------------------------\n\n  /**\n   * Fakes every provider's API: connections live in memory, `fetch` answers\n   * through `handlers[provider]` (recorded in `fakeRequests`), and nothing\n   * reaches a token or revocation endpoint. Returns `this` so a test can\n   * `save` a connection to start from.\n   */\n  fake(handlers: Record<string, FakeConnectionHandler> = {}): this {\n    this.fakes = new Map(Object.entries(handlers));\n    this.fakeStore = new MemoryConnectionStore();\n    this.fakeRequests.length = 0;\n    return this;\n  }\n\n  /** Undoes `fake`. */\n  restore(): void {\n    this.fakes = undefined;\n    this.fakeStore = undefined;\n    this.fakeRequests.length = 0;\n  }\n\n  get faked(): boolean {\n    return this.fakes !== undefined;\n  }\n\n  // --- internals, for ProviderConnection ---------------------------------------\n\n  /** @internal */\n  async send(provider: string, request: Request): Promise<Response> {\n    if (!this.fakes) return fetch(request);\n    this.fakeRequests.push(request.clone());\n    const handler = this.fakes.get(provider);\n    if (!handler) {\n      throw new Error(`Connections.fake() has no handler for \"${provider}\". Pass one: Connections.fake({ ${provider}: (req) => ... }).`);\n    }\n    return handler(request);\n  }\n\n  /**\n   * A record whose access token is not the one at `staleRevision`: refreshed\n   * by this call, or by whoever refreshed it first. Serialised per connection\n   * in this process (concurrent callers share one refresh) and, through the\n   * app's lock store, across processes — a rotating refresh token must be\n   * spent exactly once.\n   *\n   * @internal\n   */\n  refresh(record: ConnectionRecord, reason: ConnectionRefreshReason = \"requested\"): Promise<ConnectionRecord> {\n    const inFlight = this.refreshing.get(record.id);\n    if (inFlight) return inFlight;\n    const task = this.withLock(record.id, () => this.refreshOnce(record, reason)).finally(() =>\n      this.refreshing.delete(record.id),\n    );\n    this.refreshing.set(record.id, task);\n    return task;\n  }\n\n  private async refreshOnce(seen: ConnectionRecord, reason: ConnectionRefreshReason): Promise<ConnectionRecord> {\n    // Re-read under the lock: another process may have refreshed already.\n    const name = this.providerName(seen.provider) ?? seen.provider;\n    const current = await this.store.find(seen.userId, seen.provider);\n    if (!current || current.id !== seen.id) {\n      throw new OAuthReconnectRequiredError(name);\n    }\n    if (current.revision !== seen.revision && !current.needsReconnect) return current;\n    if (current.needsReconnect) throw new OAuthReconnectRequiredError(name);\n\n    const provider = this.provider(name);\n    if (this.faked) return current;\n    const strategy = provider.config.refreshStrategy;\n    if (!strategy && current.refreshToken === null) {\n      await this.store.markNeedsReconnect(current.id);\n      throw new OAuthReconnectRequiredError(name);\n    }\n\n    let tokens: OAuthTokenSet | null;\n    try {\n      tokens = strategy\n        ? await strategy({\n            accessToken: current.accessToken,\n            refreshToken: current.refreshToken,\n            scopes: [...current.scopes],\n            expiresAt: current.expiresAt,\n            issuedAt: current.updatedAt,\n            reason,\n            providerAccountId: current.providerAccountId,\n          })\n        : await provider.refresh(current.refreshToken as string, current.scopes);\n    } catch (error) {\n      // A refusal from the token endpoint is final: the grant is gone. A\n      // network error or a 5xx is not, and leaves the connection alone. Nor\n      // is `invalid_client`: the app's own credentials (or `clientAuth`) are\n      // wrong, reconnecting would fail the same way, and marking would make\n      // every user reconnect once the config is fixed.\n      if (\n        error instanceof OAuthConnectionError &&\n        error.status !== undefined &&\n        error.status >= 400 &&\n        error.status < 500 &&\n        error.providerError !== \"invalid_client\"\n      ) {\n        await this.store.markNeedsReconnect(current.id);\n        throw new OAuthReconnectRequiredError(name, {\n          cause: error,\n          status: error.status,\n          providerError: error.providerError,\n        });\n      }\n      throw error;\n    }\n    // The strategy has nothing to refresh yet: keep the current token.\n    if (tokens === null) return current;\n\n    const updated = await this.store.updateTokens(current.id, current.revision, tokens);\n    if (updated) return updated;\n    // Someone else wrote first (only possible without a shared lock store).\n    const winner = await this.store.find(current.userId, current.provider);\n    if (!winner) throw new OAuthReconnectRequiredError(name);\n    return winner;\n  }\n\n  private async withLock<T>(id: string, fn: () => Promise<T>): Promise<T> {\n    const application = app();\n    if (this.faked || !application.bound(LockManager)) return fn();\n    const result = await application\n      .make(LockManager)\n      .run(`gemi:oauth-connection:${id}`, { ttl: 30_000, wait: 20_000 }, () => fn());\n    if (!result.acquired) {\n      throw new OAuthConnectionError(\n        \"refresh_failed\",\n        \"Timed out waiting for another refresh of this connection to finish.\",\n      );\n    }\n    return result.value as T;\n  }\n}\n\n/**\n * One user's connection to one provider. Never exposes a token as a property,\n * and serialises (`toJSON`, `console.log`) without them.\n */\nexport class ProviderConnection {\n  constructor(\n    private readonly manager: ConnectionManager,\n    private record: ConnectionRecord,\n  ) {}\n\n  /** The provider's name under `auth.connections`. */\n  get provider(): string {\n    return this.manager.providerName(this.record.provider) ?? this.record.provider;\n  }\n  get userId(): string {\n    return this.record.userId;\n  }\n  get providerAccountId(): string | null {\n    return this.record.providerAccountId;\n  }\n  /** The scopes the provider granted. */\n  get scopes(): readonly string[] {\n    return this.record.scopes;\n  }\n  get expiresAt(): Date | null {\n    return this.record.expiresAt;\n  }\n  /** A refresh was refused: the user has to connect again. */\n  get needsReconnect(): boolean {\n    return this.record.needsReconnect;\n  }\n  get connectedAt(): Date {\n    return this.record.createdAt;\n  }\n\n  /**\n   * What to show the user: `\"needs_reconnect\"` when a refresh was refused, or\n   * when the access token has expired and there is no refresh token to renew\n   * it; `\"connected\"` otherwise. Read without calling the provider.\n   */\n  get status(): ConnectionStatus {\n    if (this.record.needsReconnect) return \"needs_reconnect\";\n    const expiresAt = this.record.expiresAt?.getTime();\n    if (this.record.refreshToken === null && expiresAt !== undefined && expiresAt <= Date.now()) {\n      return \"needs_reconnect\";\n    }\n    return \"connected\";\n  }\n\n  /**\n   * The provider this connection belongs to, as configured in\n   * `auth.connections` (for helpers built on a connection).\n   *\n   * @internal\n   */\n  connectionProvider(): OAuthConnectionProvider {\n    return this.manager.provider(this.provider);\n  }\n\n  /** Whether every one of `scopes` was granted. */\n  hasScopes(...scopes: string[]): boolean {\n    return scopes.every((scope) => this.record.scopes.includes(scope));\n  }\n\n  /**\n   * `fetch`, as the user: adds `Authorization: Bearer <token>`, refreshes the\n   * token first when it is about to expire, and after a 401 refreshes and\n   * retries once. A refresh the provider refuses marks the connection and\n   * throws `OAuthReconnectRequiredError`.\n   *\n   * A path is resolved against the provider's `apiBaseUrl`, and a URL on any\n   * other origin is refused (`OAuthConnectionError`,\n   * `forbidden_url`), so the token only ever goes to the provider. Redirects\n   * are followed by hand: the token is dropped on one that leaves the origin.\n   * A streamed request body cannot be sent twice, so a 401 for one is\n   * returned rather than retried.\n   */\n  async fetch(input: string | URL, init: RequestInit = {}): Promise<Response> {\n    const url = this.resolveUrl(input);\n    const record = await this.current();\n    const first = await this.send(url, init, record.accessToken);\n    // Retry only a refusal of the token itself, not one from where a redirect\n    // led after the token was dropped.\n    if (!first.authorized || init.body instanceof ReadableStream) return first.response;\n    const provider = this.manager.provider(this.provider);\n    if (!(await provider.isTokenRejected(first.response))) return first.response;\n\n    await first.response.body?.cancel().catch(() => {});\n    const refreshed = await this.refreshFrom(record, \"rejected\");\n    return (await this.send(url, init, refreshed.accessToken)).response;\n  }\n\n  /**\n   * A valid access token, refreshed first if it is about to expire — for an\n   * SDK that wants the token itself. Prefer `fetch`, which also retries a 401.\n   */\n  async accessToken(): Promise<string> {\n    return (await this.current()).accessToken;\n  }\n\n  /** Refreshes now, whatever the expiry says. */\n  async refresh(): Promise<void> {\n    await this.refreshFrom(this.record);\n  }\n\n  /**\n   * Revokes the grant at the provider (the refresh token when there is one,\n   * which ends the whole grant, else the access token) and deletes the\n   * connection. If the provider refuses, nothing is deleted and\n   * `OAuthConnectionError` (`revoke_failed`) is thrown — call `disconnect()`\n   * to forget the tokens anyway. A provider without a `revokeUrl` throws\n   * `revoke_unsupported`; use `disconnect()`.\n   */\n  async revoke(): Promise<void> {\n    if (!this.manager.faked) {\n      const provider = this.manager.provider(this.provider);\n      if (this.record.refreshToken !== null) {\n        await provider.revoke(this.record.refreshToken, \"refresh_token\");\n      } else {\n        await provider.revoke(this.record.accessToken, \"access_token\");\n      }\n    }\n    await this.manager.store.delete(this.record.id);\n  }\n\n  /** Forgets the tokens locally without telling the provider. */\n  async disconnect(): Promise<void> {\n    await this.manager.store.delete(this.record.id);\n  }\n\n  toJSON() {\n    return {\n      provider: this.provider,\n      providerAccountId: this.providerAccountId,\n      scopes: [...this.scopes],\n      expiresAt: this.expiresAt,\n      needsReconnect: this.needsReconnect,\n      status: this.status,\n      connectedAt: this.connectedAt,\n    };\n  }\n\n  [Symbol.for(\"nodejs.util.inspect.custom\")]() {\n    return { ProviderConnection: this.toJSON() };\n  }\n\n  private async current(): Promise<ConnectionRecord> {\n    if (this.record.needsReconnect) throw new OAuthReconnectRequiredError(this.provider);\n    const leeway = this.manager.provider(this.provider).config.refreshLeewaySeconds * 1000;\n    const expiresAt = this.record.expiresAt?.getTime();\n    if (expiresAt !== undefined && expiresAt - Date.now() <= leeway) {\n      return this.refreshFrom(this.record, \"expiring\");\n    }\n    return this.record;\n  }\n\n  private async refreshFrom(\n    record: ConnectionRecord,\n    reason: ConnectionRefreshReason = \"requested\",\n  ): Promise<ConnectionRecord> {\n    try {\n      this.record = await this.manager.refresh(record, reason);\n    } catch (error) {\n      if (error instanceof OAuthReconnectRequiredError) {\n        this.record = { ...this.record, needsReconnect: true };\n      }\n      throw error;\n    }\n    return this.record;\n  }\n\n  private resolveUrl(input: string | URL): URL {\n    const base = this.manager.provider(this.provider).config.apiBaseUrl;\n    let url: URL;\n    try {\n      url = new URL(String(input), base);\n    } catch {\n      throw new OAuthConnectionError(\n        \"forbidden_url\",\n        `connection.fetch was given ${JSON.stringify(String(input))}, which is not a URL.`,\n      );\n    }\n    if (url.origin !== new URL(base).origin) {\n      throw new OAuthConnectionError(\n        \"forbidden_url\",\n        `connection.fetch only sends the ${this.provider} token to ${new URL(base).origin} ` +\n          `(apiBaseUrl), not to ${url.origin}.`,\n      );\n    }\n    if (url.protocol !== \"https:\" && !(url.protocol === \"http:\" && isLoopback(url.hostname))) {\n      throw new OAuthConnectionError(\n        \"forbidden_url\",\n        `connection.fetch only sends a token over https, not to ${url.origin}.`,\n      );\n    }\n    return url;\n  }\n\n  private async send(url: URL, init: RequestInit, token: string): Promise<{ response: Response; authorized: boolean }> {\n    let target = url;\n    let method = (init.method ?? \"GET\").toUpperCase();\n    let body = init.body;\n    let authorized = true;\n\n    // Followed by hand (unless the caller asked for \"manual\" or \"error\"), so\n    // the token never follows a redirect to another origin.\n    if (init.redirect === \"manual\" || init.redirect === \"error\") {\n      const response = await this.manager.send(this.provider, this.request(target, init, method, body, token));\n      return { response, authorized };\n    }\n\n    for (let hop = 0; ; hop++) {\n      const request = this.request(target, { ...init, redirect: \"manual\" }, method, body, authorized ? token : null);\n      const response = await this.manager.send(this.provider, request);\n      const location = response.headers.get(\"location\");\n      if (!REDIRECTS.has(response.status) || location === null || hop >= 5) return { response, authorized };\n\n      await response.body?.cancel().catch(() => {});\n      const next = new URL(location, target);\n      if (next.origin !== target.origin) authorized = false;\n      if (response.status === 303 || ((response.status === 301 || response.status === 302) && method === \"POST\")) {\n        method = \"GET\";\n        body = undefined;\n      }\n      target = next;\n    }\n  }\n\n  private request(url: URL, init: RequestInit, method: string, body: RequestInit[\"body\"], token: string | null): Request {\n    const headers = new Headers(init.headers);\n    const target = new URL(url);\n    const placement = this.manager.provider(this.provider).config.tokenPlacement;\n    if (token === null) {\n      headers.delete(\"authorization\");\n    } else if (placement === \"query\") {\n      // Where the provider documents it (Instagram's Graph API). Only ever on\n      // `apiBaseUrl`'s origin: a redirect elsewhere is sent with `token` null.\n      target.searchParams.set(\"access_token\", token);\n    } else {\n      headers.set(\"Authorization\", `Bearer ${token}`);\n    }\n    return new Request(target, { ...init, method, body, headers });\n  }\n}\n\nconst REDIRECTS = new Set([301, 302, 303, 307, 308]);\n\n/** Between a multiple-account provider's name and the account id, in the store's `provider` column. */\nconst ACCOUNT_SEPARATOR = \":\";\n\nfunction storeKey(provider: string, accountId: string): string {\n  return `${provider}${ACCOUNT_SEPARATOR}${accountId}`;\n}\n\nfunction ownerId(user: ConnectionOwner): string {\n  const id = typeof user === \"object\" && user !== null ? user.id : user;\n  if (id === undefined || id === null || id === \"\") {\n    throw new TypeError(\"An OAuth connection belongs to a user: pass the user (or its id).\");\n  }\n  return String(id);\n}\n"
   ],
   "mappings": ";sLAwCO,AAAM,LAAiD,LAC3C,KAAO,IAAI,SAEtB,KAAI,CAAC,EAAgB,EAAkB,CAC3C,QAAW,KAAO,KAAK,KAAK,OAAO,EACjC,GAAI,EAAI,SAAW,GAAU,EAAI,WAAa,EAAU,MAAO,IAAK,CAAI,EAE1E,OAAO,UAGH,KAAI,CAAC,EAAgB,CACzB,MAAO,CAAC,GAAG,KAAK,KAAK,OAAO,CAAC,EAAE,OAAO,CAAC,IAAQ,EAAI,SAAW,CAAM,EAAE,IAAI,CAAC,KAAS,IAAK,CAAI,EAAE,OAG3F,KAAI,CAAC,EAAgB,EAAkB,EAAuB,CAClE,IAAM,EAAW,MAAM,KAAK,KAAK,EAAQ,CAAQ,EAC3C,EAAM,IAAI,KACV,EAAwB,CAC5B,GAAI,GAAU,IAAM,IAAI,aAAa,EACrC,SACA,cACG,EAAW,CAAM,EACpB,eAAgB,GAChB,UAAW,GAAU,UAAY,GAAK,EACtC,UAAW,GAAU,WAAa,EAClC,UAAW,CACb,EAEA,OADA,KAAK,KAAK,IAAI,EAAI,GAAI,CAAG,EAClB,IAAK,CAAI,OAGZ,aAAY,CAAC,EAAY,EAAkB,EAAuB,CACtE,IAAM,EAAM,KAAK,KAAK,IAAI,CAAE,EAC5B,GAAI,CAAC,GAAO,EAAI,WAAa,EAAU,OAAO,KAG9C,IAAM,EAAQ,EAAW,CAAM,EAC/B,EAAM,oBAAsB,EAAI,kBAChC,IAAM,EAAO,IAAK,KAAQ,EAAO,eAAgB,GAAO,SAAU,EAAW,EAAG,UAAW,IAAI,IAAO,EAEtG,OADA,KAAK,KAAK,IAAI,EAAI,CAAI,EACf,IAAK,CAAK,OAGb,mBAAkB,CAAC,EAAY,CACnC,IAAM,EAAM,KAAK,KAAK,IAAI,CAAE,EAC5B,GAAI,EAAK,KAAK,KAAK,IAAI,EAAI,IAAK,EAAK,eAAgB,GAAM,UAAW,IAAI,IAAO,CAAC,OAG9E,OAAM,CAAC,EAAY,CACvB,KAAK,KAAK,OAAO,CAAE,EAEvB,CAaO,MAAM,CAAmD,CAO3C,UANV,MACQ,IACA,QAEjB,WAAW,CACT,EACiB,EACjB,EAA0C,CAAC,EAC3C,CAFiB,iBAGjB,IAAM,EAAQ,EAAQ,OAAS,yBAC/B,GAAI,CAAC,2BAA2B,KAAK,CAAK,EACxC,MAAU,MAAM,+BAA+B,+BAAmC,EAEpF,KAAK,MAAQ,EACb,KAAK,IAAM,EAAW,IACtB,KAAK,QAAU,EAAW,aAItB,YAAW,EAAkB,CACjC,QAAW,KAAa,EAAgC,KAAK,QAAS,KAAK,KAAK,EAC9E,MAAM,KAAK,IAAI,OAAO,CAAS,OAI7B,KAAI,CAAC,EAAgB,EAAkB,CAC3C,IAAM,EAAI,KAAK,IACT,EAAQ,KAAM;AAAA,sBACF,KAAK,KAAK,CAAC,qBAAqB,oBAAyB;AAAA,MAE3E,OAAO,EAAK,GAAK,KAAK,OAAO,EAAK,EAAE,EAAI,UAGpC,KAAI,CAAC,EAAgB,CACzB,IAAM,EAAI,KAAK,IAIf,OAHc,KAAM;AAAA,sBACF,KAAK,KAAK,CAAC,qBAAqB;AAAA,OAEtC,IAAI,CAAC,IAAQ,KAAK,OAAO,CAAG,CAAC,OAGrC,KAAI,CAAC,EAAgB,EAAkB,EAAuB,CAClE,IAAM,EAAI,KAAK,IACT,EAAS,KAAK,OAAO,CAAM,EAC3B,EAAM,KAAK,IAAI,EAEf,EAAS,SACb,EACE,KAAM;AAAA,mBACK,KAAK,KAAK,CAAC;AAAA,sCACQ,EAAO,+BAA+B,EAAO;AAAA,+BACpD,EAAO,gCAAgC,EAAO;AAAA,6BAChD,EAAO,2BAA2B,EAAO;AAAA,2EACK;AAAA,4BAC/C,oBAAyB;AAAA,SAE/C,EAEF,GAAK,MAAM,EAAO,IAAO,EACvB,GAAI,CACF,KAAM;AAAA,wBACU,KAAK,KAAK,CAAC;AAAA;AAAA;AAAA,oBAGf,IAAI,aAAa,MAAM,MAAW,MAAa,EAAO;AAAA,cAC5D,EAAO,WAAW,EAAO,gBAAgB,EAAO,iBAAiB,EAAO;AAAA,cACxE,EAAO,oBAAoB,MAAQ;AAAA,UAEzC,MAAO,EAAO,CAEd,GAAK,MAAM,EAAO,IAAO,EAAG,MAAM,EAItC,IAAM,EAAQ,MAAM,KAAK,KAAK,EAAQ,CAAQ,EAC9C,GAAI,CAAC,EAAO,MAAU,MAAM,yDAAyD,EACrF,OAAO,OAGH,aAAY,CAAC,EAAY,EAAkB,EAAuB,CACtE,IAAM,EAAI,KAAK,IACT,EAAS,KAAK,OAAO,CAAM,EAC3B,EAAS,KAAM;AAAA,eACV,KAAK,KAAK,CAAC;AAAA,2CACiB,EAAO;AAAA,qBAC7B,EAAO,0BAA0B,EAAO;AAAA,4BACjC,EAAO,8BAA8B,EAAO;AAAA,yBAC/C,EAAO;AAAA,yBACP,KAAK,IAAI;AAAA,mBACf,oBAAqB;AAAA,MAEpC,GAAI,EAAS,CAAM,IAAM,EAAG,OAAO,KACnC,IAAM,EAAQ,KAAM,mBAAkB,KAAK,KAAK,CAAC,gBAAgB,IACjE,OAAO,EAAK,GAAK,KAAK,OAAO,EAAK,EAAE,EAAI,UAGpC,mBAAkB,CAAC,EAAY,CACnC,IAAM,EAAI,KAAK,IACf,KAAM,YAAW,KAAK,KAAK,CAAC,2CAA2C,KAAK,IAAI,gBAAgB,SAG5F,OAAM,CAAC,EAAY,CACvB,IAAM,EAAI,KAAK,IACf,KAAM,iBAAgB,KAAK,KAAK,CAAC,gBAAgB,SAQ7C,iBAAgB,CAAC,EAAgC,CAAC,EAAkD,CACxG,IAAM,EAAI,KAAK,IACT,EAAY,KAAK,UAAU,EAC3B,EAAQ,KAAM;AAAA,8DACsC,KAAK,KAAK,CAAC;AAAA,MAEjE,EAAU,EACd,QAAW,KAAO,EAAM,CACtB,IAAM,EAAQ,CAAC,IAAyB,OAAO,IAAU,UAAY,EAAU,kBAAkB,CAAK,EACtG,GAAI,CAAC,EAAM,EAAI,YAAY,GAAK,CAAC,EAAM,EAAI,aAAa,EAAG,SAE3D,GADA,GAAW,EACP,EAAQ,OAAQ,SACpB,IAAM,EAAS,CAAC,IAA0B,IAAU,KAAO,KAAO,EAAU,QAAQ,EAAU,QAAQ,CAAK,CAAC,EAC5G,KAAM;AAAA,iBACK,KAAK,KAAK,CAAC;AAAA,6BACC,EAAO,EAAI,YAAY,sBAAsB,EAAO,EAAI,aAAa;AAAA;AAAA,qBAE7E,EAAI,qBAAqB,OAAO,EAAI,QAAQ;AAAA,QAG7D,MAAO,CAAE,QAAS,EAAK,OAAQ,SAAQ,EAGjC,MAAM,CAAC,EAAuB,CACpC,IAAM,EAAY,KAAK,UAAU,EACjC,MAAO,CACL,kBAAmB,EAAO,kBAC1B,OAAQ,EAAO,OAAO,KAAK,GAAG,EAC9B,YAAa,EAAU,QAAQ,EAAO,WAAW,EACjD,aAAc,EAAO,eAAiB,KAAO,KAAO,EAAU,QAAQ,EAAO,YAAY,EACzF,UAAW,EAAO,UAClB,UAAW,EAAO,YAAc,KAAO,KAAO,EAAO,UAAU,QAAQ,CACzE,EAGM,MAAM,CAAC,EAA+B,CAC5C,IAAM,EAAY,KAAK,UAAU,EACjC,MAAO,CACL,GAAI,OAAO,EAAI,EAAE,EACjB,OAAQ,OAAO,EAAI,OAAO,EAC1B,SAAU,OAAO,EAAI,QAAQ,EAC7B,kBAAmB,EAAI,sBAAwB,KAAO,KAAO,OAAO,EAAI,mBAAmB,EAC3F,OAAQ,OAAO,EAAI,QAAU,EAAE,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO,EAC1D,YAAa,EAAU,QAAQ,OAAO,EAAI,YAAY,CAAC,EACvD,aAAc,EAAI,gBAAkB,KAAO,KAAO,EAAU,QAAQ,OAAO,EAAI,aAAa,CAAC,EAC7F,UAAW,EAAI,aAAe,KAAO,KAAO,OAAO,EAAI,UAAU,EACjE,UAAW,EAAI,aAAe,KAAO,KAAO,IAAI,KAAK,OAAO,EAAI,UAAU,CAAC,EAC3E,eAAgB,OAAO,EAAI,eAAe,IAAM,EAChD,SAAU,OAAO,EAAI,QAAQ,EAC7B,UAAW,IAAI,KAAK,OAAO,EAAI,UAAU,CAAC,EAC1C,UAAW,IAAI,KAAK,OAAO,EAAI,UAAU,CAAC,CAC5C,KAGU,MAAK,EAAG,CAClB,OAAO,KAAK,UAAY,SAAW,KAAK,UAAY,UAG9C,IAAI,CAAC,EAAQ,CACnB,OAAO,EAAE,OAAO,KAAK,MAAQ,KAAK,KAAK,UAAY,IAAI,KAAK,QAAQ,EAExE,CAkBA,SAAS,CAAU,CAAC,EAAuB,CACzC,MAAO,CACL,kBAAmB,EAAO,kBAC1B,OAAQ,CAAC,GAAG,EAAO,MAAM,EACzB,YAAa,EAAO,YACpB,aAAc,EAAO,aACrB,UAAW,EAAO,UAClB,UAAW,EAAO,SACpB,EAGF,SAAS,CAAQ,CAAC,EAAyB,CACzC,IAAM,EAAS,EACf,OAAO,KAAK,IAAI,OAAO,EAAO,OAAS,CAAC,EAAG,OAAO,EAAO,cAAgB,CAAC,CAAC,EAItE,SAAS,CAA+B,CAAC,EAAkB,EAAyB,CACzF,GAAI,IAAY,SAAW,IAAY,UACrC,MAAO,CACL,gCAAgC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qBAejB;AAAA;AAAA,2DAGjB,EAEF,IAAM,EAAM,IAAY,SAAW,kCAAoC,sBACjE,EACJ,IAAY,SAAW,GAAK;AAAA;AAAA,kBAAwB,6BACtD,MAAO,CACL,+BAA+B;AAAA,MAC7B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kCAY4B;AAAA,GAE9B,sCAAsC,+BAAmC,2BAC3E,ECpVK,MAAM,UAA6B,KAAM,CAKnC,KAJF,OACA,cAET,WAAW,CACA,EACT,EACA,EAAwE,CAAC,EACzE,CACA,MAAM,EAAS,EAAQ,QAAU,OAAY,CAAE,MAAO,EAAQ,KAAM,EAAI,MAAS,EAJxE,YAKT,KAAK,KAAO,uBACZ,KAAK,OAAS,EAAQ,OACtB,KAAK,cAAgB,EAAQ,cAEjC,CASO,MAAM,UAAoC,CAAqB,CAEzD,SADX,WAAW,CACA,EACT,EAAwE,CAAC,EACzE,CACA,MACE,qBACA,OAAO,4FACP,CACF,EAPS,gBAQT,KAAK,KAAO,8BAEhB,CCwHO,MAAM,CAAwB,CAC1B,OAQT,WAAW,CAAC,EAAuC,CACjD,QAAW,IAAO,CAAC,eAAgB,UAAU,EAC3C,EAAc,EAAK,EAAO,EAAI,EAEhC,QAAW,IAAO,CAAC,aAAc,WAAW,EAC1C,GAAI,EAAO,KAAS,OAAW,EAAc,EAAK,EAAO,EAAI,EAM/D,GAAI,EAAO,aAAe,QAAa,EAAO,aAAe,MAAQ,EAAO,aAAe,GACzF,MAAU,MACR,+KAEF,EAEF,EAAc,aAAc,EAAO,UAAU,EAC7C,KAAK,OAAS,CACZ,eAAgB,IAChB,WAAY,OACZ,KAAM,GACN,oBAAqB,CAAC,EACtB,qBAAsB,GACtB,SAAU,GACV,eAAgB,YACb,EACH,iBAAkB,EAAO,kBAAoB,eAC/C,OAOI,gBAAe,CAAC,EAAsC,CAC1D,IAAM,EAAQ,KAAK,OAAO,gBAC1B,GAAI,CAAC,EAAO,OAAO,EAAS,SAAW,IACvC,OAAO,MAAM,EAAM,CAAQ,EAI7B,gBAAgB,CAAC,EAA6E,CAC5F,IAAM,EAAM,IAAI,IAAI,KAAK,OAAO,YAAY,EACtC,EAAiC,IAClC,KAAK,OAAO,oBACf,cAAe,OACf,UAAW,KAAK,OAAO,SACvB,aAAc,EAAK,YACnB,MAAO,KAAK,OAAO,OAAO,KAAK,KAAK,OAAO,cAAc,EACzD,MAAO,EAAK,KACd,EACA,GAAI,KAAK,OAAO,KACd,EAAO,eAAiB,EAAK,cAC7B,EAAO,sBAAwB,OAEjC,QAAY,EAAK,KAAU,OAAO,QAAQ,CAAM,EAAG,EAAI,aAAa,IAAI,EAAK,CAAK,EAClF,OAAO,EAAI,SAAS,EAItB,YAAY,CAAC,EAA2F,CACtG,IAAM,EAAO,IAAI,gBAAgB,CAC/B,WAAY,qBACZ,KAAM,EAAK,KACX,aAAc,EAAK,WACrB,CAAC,EACD,GAAI,KAAK,OAAO,KAAM,EAAK,IAAI,gBAAiB,EAAK,YAAY,EACjE,OAAO,KAAK,aAAa,KAAK,OAAO,SAAU,EAAM,CACnD,OAAQ,KAAK,OAAO,OACpB,aAAc,KACd,MAAO,UACT,CAAC,EAQH,OAAO,CAAC,EAAsB,EAA0C,CACtE,IAAM,EAAO,IAAI,gBACX,EAAY,KAAK,OAAO,iBAC9B,GAAI,IAAc,IAAS,IAAc,GAAI,EAAK,IAAI,aAAc,CAAS,EAE7E,OADA,EAAK,IAAI,gBAAiB,CAAY,EAC/B,KAAK,aAAa,KAAK,OAAO,YAAc,KAAK,OAAO,SAAU,EAAM,CAC7E,SACA,eACA,MAAO,SACT,CAAC,OAIG,OAAM,CAAC,EAAe,EAAuD,CACjF,GAAI,CAAC,KAAK,OAAO,UACf,MAAM,IAAI,EACR,qBACA,2FACF,EAEF,IAAM,EAAO,IAAI,gBAAgB,CAAE,QAAO,gBAAiB,CAAK,CAAC,EAC7D,EACJ,GAAI,CACF,EAAW,MAAM,MAAM,KAAK,OAAO,UAAW,KAAK,KAAK,CAAI,CAAC,EAC7D,MAAO,EAAO,CACd,MAAM,IAAI,EAAqB,gBAAiB,iCAAkC,CAAE,OAAM,CAAC,EAG7F,GAAI,CAAC,EAAS,GACZ,MAAM,IAAI,EACR,gBACA,6CAA6C,EAAS,WACtD,CAAE,OAAQ,EAAS,MAAO,CAC5B,EAII,IAAI,CAAC,EAAoC,CAC/C,IAAM,EAAkC,CACtC,eAAgB,oCAEhB,OAAQ,kBACV,EACA,GAAI,KAAK,OAAO,aAAe,QAAS,CACtC,IAAM,EAAc,GAAG,mBAAmB,KAAK,OAAO,QAAQ,KAAK,mBAAmB,KAAK,OAAO,YAAY,IAC9G,EAAQ,cAAgB,SAAS,OAAO,KAAK,CAAW,EAAE,SAAS,QAAQ,IAE3E,OAAK,IAAI,YAAa,KAAK,OAAO,QAAQ,EAC1C,EAAK,IAAI,gBAAiB,KAAK,OAAO,YAAY,EAEpD,MAAO,CAAE,OAAQ,OAAQ,UAAS,KAAM,EAAK,SAAS,EAAG,SAAU,OAAQ,OAG/D,aAAY,CACxB,EACA,EACA,EACwB,CACxB,IAAM,EAAU,EAAS,QAAU,WAAa,kBAAoB,iBAChE,EACJ,GAAI,CACF,EAAW,MAAM,MAAM,EAAU,KAAK,KAAK,CAAI,CAAC,EAChD,MAAO,EAAO,CACd,MAAM,IAAI,EAAqB,EAAS,4BAA6B,CAAE,OAAM,CAAC,EAGhF,IAAM,EAAW,MAAM,EAAS,KAAK,EAAE,MAAM,KAAO,CAAC,EAAE,EACvD,GAAI,CAAC,EAAS,IAAM,OAAO,EAAQ,eAAiB,UAAY,EAAQ,eAAiB,GAAI,CAE3F,IAAM,EAAO,OAAO,EAAQ,QAAU,UAAY,oBAAoB,KAAK,EAAQ,KAAK,EAAI,EAAQ,MAAQ,OAC5G,MAAM,IAAI,EACR,EACA,kCAAkC,EAAS,QAAU,WAAa,OAAS,yBAChE,EAAS,SAAS,EAAO,KAAK,IAAS,OAClD,CAAE,OAAQ,EAAS,OAAQ,cAAe,CAAK,CACjD,EAGF,IAAM,EAAY,OAAO,EAAQ,UAAU,EACrC,EAAQ,OAAO,EAAQ,QAAU,SAAW,EAAQ,MAAQ,OAG5D,EAAY,EAAQ,gBAAkB,EAAQ,SAAW,EAAQ,WACvE,MAAO,CACL,YAAa,EAAQ,aACrB,aACE,OAAO,EAAQ,gBAAkB,UAAY,EAAQ,gBAAkB,GACnE,EAAQ,cACR,EAAS,aACf,UAAW,OAAO,EAAQ,aAAe,SAAW,EAAQ,WAAa,KACzE,UAAW,OAAO,SAAS,CAAS,GAAK,EAAY,EAAI,IAAI,KAAK,KAAK,IAAI,EAAI,EAAY,IAAI,EAAI,KACnG,OAAQ,IAAU,OAAY,EAAM,MAAM,QAAQ,EAAE,OAAO,OAAO,EAAI,EAAS,OAC/E,kBACE,OAAO,IAAc,UAAY,OAAO,IAAc,SAAW,OAAO,CAAS,EAAI,IACzF,EAEJ,CAEA,SAAS,CAAa,CAAC,EAAa,EAAsB,CACxD,IAAI,EACJ,GAAI,CACF,EAAM,IAAI,IAAI,OAAO,CAAK,CAAC,EAC3B,KAAM,CACN,EAAM,OAER,GAAI,CAAC,GAAQ,EAAI,WAAa,UAAY,EAAE,EAAI,WAAa,SAAW,EAAW,EAAI,QAAQ,GAC7F,MAAU,MACR,4BAA4B,yDAA2D,KAAK,UAAU,CAAK,IAC7G,EAIG,SAAS,CAAU,CAAC,EAA2B,CACpD,OAAO,IAAa,aAAe,IAAa,aAAe,IAAa,SAAW,IAAa,MC/U/F,MAAM,CAAkB,CASA,cARtB,OAAQ,mBAEP,cACS,WAAa,IAAI,IAC1B,MACA,UACC,aAA0B,CAAC,EAEpC,WAAW,CAAkB,EAAmC,CAAnC,eAC3B,QAAY,EAAM,KAAa,OAAO,QAAQ,EAAQ,SAAS,EAAG,CAChE,GAAI,CAAC,EAAS,OAAO,SAAU,SAG/B,IAAM,EAAQ,OAAO,KAAK,EAAQ,SAAS,EAAE,KAAK,CAAC,IAAU,EAAM,WAAW,GAAG,IAAO,GAAmB,CAAC,EAC5G,GAAI,EAAK,SAAS,CAAiB,GAAK,EACtC,MAAU,MACR,sBAAsB,GAAS,8DAAiE,QACzF,2DACT,MAKF,UAAS,EAA4C,CACvD,OAAO,KAAK,QAAQ,aAIlB,MAAK,EAAoB,CAC3B,GAAI,KAAK,UAAW,OAAO,KAAK,UAChC,GAAI,CAAC,KAAK,cAAe,CACvB,IAAM,EAAa,KAAK,QAAQ,MAChC,KAAK,cACH,OAAO,IAAe,WAClB,EAAW,EACV,GACD,IAAI,EAAwB,EAAI,CAAe,EAAE,WAAW,EAAG,IAAM,EAAiB,CAAC,EAE/F,OAAO,KAAK,cAGd,QAAQ,CAAC,EAAuC,CAC9C,IAAM,EAAW,KAAK,QAAQ,UAAU,GACxC,GAAI,CAAC,EAAU,CACb,IAAM,EAAQ,OAAO,KAAK,KAAK,QAAQ,SAAS,EAChD,MAAM,IAAI,EACR,mBACA,iCAAiC,0BAC9B,EAAM,OAAS,EAAI,iBAAiB,EAAM,KAAK,IAAI,MAAQ,0BAChE,EAEF,OAAO,OAUH,IAAG,CAAC,EAAuB,EAAkB,EAAwD,CACzG,IAAM,EAAS,KAAK,SAAS,CAAQ,EAC/B,EAAS,EAAQ,CAAI,EAC3B,GAAI,CAAC,EAAO,OAAO,SAAU,CAC3B,IAAM,EAAS,MAAM,KAAK,MAAM,KAAK,EAAQ,CAAQ,EACrD,GAAI,CAAC,GAAW,IAAc,QAAa,EAAO,oBAAsB,EAAY,OAAO,KAC3F,OAAO,IAAI,EAAmB,KAAM,CAAM,EAE5C,GAAI,IAAc,OAAW,CAC3B,IAAM,EACH,MAAM,KAAK,MAAM,KAAK,EAAQ,EAAS,EAAU,CAAS,CAAC,GAE3D,MAAM,KAAK,MAAM,KAAK,EAAQ,CAAQ,EACzC,OAAO,GAAU,EAAO,oBAAsB,EAAY,IAAI,EAAmB,KAAM,CAAM,EAAI,KAEnG,IAAO,IAAW,MAAM,KAAK,KAAK,EAAM,CAAQ,GAAG,KACjD,CAAC,EAAG,IAAM,EAAE,YAAY,QAAQ,EAAI,EAAE,YAAY,QAAQ,CAC5D,EACA,OAAO,GAAU,UAIb,KAAI,CAAC,EAAuB,EAAkD,CAClF,GAAI,IAAa,OAAW,KAAK,SAAS,CAAQ,EAElD,OADgB,MAAM,KAAK,MAAM,KAAK,EAAQ,CAAI,CAAC,GAEhD,OAAO,CAAC,IAAW,CAClB,IAAM,EAAO,KAAK,aAAa,EAAO,QAAQ,EAC9C,OAAO,IAAS,OAAS,IAAa,QAAa,IAAS,GAC7D,EACA,IAAI,CAAC,IAAW,IAAI,EAAmB,KAAM,CAAM,CAAC,OASnD,KAAI,CACR,EACA,EACA,EAC6B,CAC7B,IAAM,EAAS,KAAK,SAAS,CAAQ,EAC/B,EAAS,EAAQ,CAAI,GACnB,QAAS,KAAa,GAAU,EAClC,EAAqB,CACzB,aAAc,KACd,UAAW,KACX,UAAW,KACX,kBAAmB,KACnB,OAAQ,EAAO,OAAO,UACnB,CACL,EACA,GAAI,CAAC,EAAO,OAAO,SACjB,OAAO,IAAI,EAAmB,KAAM,MAAM,KAAK,MAAM,KAAK,EAAQ,EAAU,CAAG,CAAC,EAGlF,IAAM,EAAY,EAAI,kBACtB,GAAI,OAAO,IAAc,UAAY,IAAc,GACjD,MAAM,IAAI,EACR,qBACA,IAAI,sJAEN,EAEF,IAAM,EAAS,MAAM,KAAK,MAAM,KAAK,EAAQ,EAAS,EAAU,CAAS,EAAG,CAAG,EAEzE,EAAS,MAAM,KAAK,MAAM,KAAK,EAAQ,CAAQ,EACrD,GAAI,GAAU,EAAO,oBAAsB,EAAW,MAAM,KAAK,MAAM,OAAO,EAAO,EAAE,EACvF,OAAO,IAAI,EAAmB,KAAM,CAAM,EAU5C,YAAY,CAAC,EAA4B,CACvC,IAAM,EAAY,KAAK,QAAQ,UAC/B,GAAI,OAAO,OAAO,EAAW,CAAG,EAAG,OAAO,EAC1C,IAAM,EAAK,EAAI,QAAQ,CAAiB,EACxC,GAAI,GAAM,EAAG,OAAO,KACpB,IAAM,EAAO,EAAI,MAAM,EAAG,CAAE,EAC5B,OAAO,OAAO,OAAO,EAAW,CAAI,GAAK,EAAU,GAAM,OAAO,SAAW,EAAO,KAWpF,IAAI,CAAC,EAAkD,CAAC,EAAS,CAI/D,OAHA,KAAK,MAAQ,IAAI,IAAI,OAAO,QAAQ,CAAQ,CAAC,EAC7C,KAAK,UAAY,IAAI,EACrB,KAAK,aAAa,OAAS,EACpB,KAIT,OAAO,EAAS,CACd,KAAK,MAAQ,OACb,KAAK,UAAY,OACjB,KAAK,aAAa,OAAS,KAGzB,MAAK,EAAY,CACnB,OAAO,KAAK,QAAU,YAMlB,KAAI,CAAC,EAAkB,EAAqC,CAChE,GAAI,CAAC,KAAK,MAAO,OAAO,MAAM,CAAO,EACrC,KAAK,aAAa,KAAK,EAAQ,MAAM,CAAC,EACtC,IAAM,EAAU,KAAK,MAAM,IAAI,CAAQ,EACvC,GAAI,CAAC,EACH,MAAU,MAAM,0CAA0C,oCAA2C,qBAA4B,EAEnI,OAAO,EAAQ,CAAO,EAYxB,OAAO,CAAC,EAA0B,EAAkC,YAAwC,CAC1G,IAAM,EAAW,KAAK,WAAW,IAAI,EAAO,EAAE,EAC9C,GAAI,EAAU,OAAO,EACrB,IAAM,EAAO,KAAK,SAAS,EAAO,GAAI,IAAM,KAAK,YAAY,EAAQ,CAAM,CAAC,EAAE,QAAQ,IACpF,KAAK,WAAW,OAAO,EAAO,EAAE,CAClC,EAEA,OADA,KAAK,WAAW,IAAI,EAAO,GAAI,CAAI,EAC5B,OAGK,YAAW,CAAC,EAAwB,EAA4D,CAE5G,IAAM,EAAO,KAAK,aAAa,EAAK,QAAQ,GAAK,EAAK,SAChD,EAAU,MAAM,KAAK,MAAM,KAAK,EAAK,OAAQ,EAAK,QAAQ,EAChE,GAAI,CAAC,GAAW,EAAQ,KAAO,EAAK,GAClC,MAAM,IAAI,EAA4B,CAAI,EAE5C,GAAI,EAAQ,WAAa,EAAK,UAAY,CAAC,EAAQ,eAAgB,OAAO,EAC1E,GAAI,EAAQ,eAAgB,MAAM,IAAI,EAA4B,CAAI,EAEtE,IAAM,EAAW,KAAK,SAAS,CAAI,EACnC,GAAI,KAAK,MAAO,OAAO,EACvB,IAAM,EAAW,EAAS,OAAO,gBACjC,GAAI,CAAC,GAAY,EAAQ,eAAiB,KAExC,MADA,MAAM,KAAK,MAAM,mBAAmB,EAAQ,EAAE,EACxC,IAAI,EAA4B,CAAI,EAG5C,IAAI,EACJ,GAAI,CACF,EAAS,EACL,MAAM,EAAS,CACb,YAAa,EAAQ,YACrB,aAAc,EAAQ,aACtB,OAAQ,CAAC,GAAG,EAAQ,MAAM,EAC1B,UAAW,EAAQ,UACnB,SAAU,EAAQ,UAClB,SACA,kBAAmB,EAAQ,iBAC7B,CAAC,EACD,MAAM,EAAS,QAAQ,EAAQ,aAAwB,EAAQ,MAAM,EACzE,MAAO,EAAO,CAMd,GACE,aAAiB,GACjB,EAAM,SAAW,QACjB,EAAM,QAAU,KAChB,EAAM,OAAS,KACf,EAAM,gBAAkB,iBAGxB,MADA,MAAM,KAAK,MAAM,mBAAmB,EAAQ,EAAE,EACxC,IAAI,EAA4B,EAAM,CAC1C,MAAO,EACP,OAAQ,EAAM,OACd,cAAe,EAAM,aACvB,CAAC,EAEH,MAAM,EAGR,GAAI,IAAW,KAAM,OAAO,EAE5B,IAAM,EAAU,MAAM,KAAK,MAAM,aAAa,EAAQ,GAAI,EAAQ,SAAU,CAAM,EAClF,GAAI,EAAS,OAAO,EAEpB,IAAM,EAAS,MAAM,KAAK,MAAM,KAAK,EAAQ,OAAQ,EAAQ,QAAQ,EACrE,GAAI,CAAC,EAAQ,MAAM,IAAI,EAA4B,CAAI,EACvD,OAAO,OAGK,SAAW,CAAC,EAAY,EAAkC,CACtE,IAAM,EAAc,EAAI,EACxB,GAAI,KAAK,OAAS,CAAC,EAAY,MAAM,CAAW,EAAG,OAAO,EAAG,EAC7D,IAAM,EAAS,MAAM,EAClB,KAAK,CAAW,EAChB,IAAI,yBAAyB,IAAM,CAAE,IAAK,MAAQ,KAAM,KAAO,EAAG,IAAM,EAAG,CAAC,EAC/E,GAAI,CAAC,EAAO,SACV,MAAM,IAAI,EACR,iBACA,qEACF,EAEF,OAAO,EAAO,MAElB,CAMO,MAAM,CAAmB,CAEX,QACT,OAFV,WAAW,CACQ,EACT,EACR,CAFiB,eACT,iBAIN,SAAQ,EAAW,CACrB,OAAO,KAAK,QAAQ,aAAa,KAAK,OAAO,QAAQ,GAAK,KAAK,OAAO,YAEpE,OAAM,EAAW,CACnB,OAAO,KAAK,OAAO,UAEjB,kBAAiB,EAAkB,CACrC,OAAO,KAAK,OAAO,qBAGjB,OAAM,EAAsB,CAC9B,OAAO,KAAK,OAAO,UAEjB,UAAS,EAAgB,CAC3B,OAAO,KAAK,OAAO,aAGjB,eAAc,EAAY,CAC5B,OAAO,KAAK,OAAO,kBAEjB,YAAW,EAAS,CACtB,OAAO,KAAK,OAAO,aAQjB,OAAM,EAAqB,CAC7B,GAAI,KAAK,OAAO,eAAgB,MAAO,kBACvC,IAAM,EAAY,KAAK,OAAO,WAAW,QAAQ,EACjD,GAAI,KAAK,OAAO,eAAiB,MAAQ,IAAc,QAAa,GAAa,KAAK,IAAI,EACxF,MAAO,kBAET,MAAO,YAST,kBAAkB,EAA4B,CAC5C,OAAO,KAAK,QAAQ,SAAS,KAAK,QAAQ,EAI5C,SAAS,IAAI,EAA2B,CACtC,OAAO,EAAO,MAAM,CAAC,IAAU,KAAK,OAAO,OAAO,SAAS,CAAK,CAAC,OAgB7D,MAAK,CAAC,EAAqB,EAAoB,CAAC,EAAsB,CAC1E,IAAM,EAAM,KAAK,WAAW,CAAK,EAC3B,EAAS,MAAM,KAAK,QAAQ,EAC5B,EAAQ,MAAM,KAAK,KAAK,EAAK,EAAM,EAAO,WAAW,EAG3D,GAAI,CAAC,EAAM,YAAc,EAAK,gBAAgB,eAAgB,OAAO,EAAM,SAE3E,GAAI,CAAE,MADW,KAAK,QAAQ,SAAS,KAAK,QAAQ,EAC/B,gBAAgB,EAAM,QAAQ,EAAI,OAAO,EAAM,SAEpE,MAAM,EAAM,SAAS,MAAM,OAAO,EAAE,MAAM,IAAM,EAAE,EAClD,IAAM,EAAY,MAAM,KAAK,YAAY,EAAQ,UAAU,EAC3D,OAAQ,MAAM,KAAK,KAAK,EAAK,EAAM,EAAU,WAAW,GAAG,cAOvD,YAAW,EAAoB,CACnC,OAAQ,MAAM,KAAK,QAAQ,GAAG,iBAI1B,QAAO,EAAkB,CAC7B,MAAM,KAAK,YAAY,KAAK,MAAM,OAW9B,OAAM,EAAkB,CAC5B,GAAI,CAAC,KAAK,QAAQ,MAAO,CACvB,IAAM,EAAW,KAAK,QAAQ,SAAS,KAAK,QAAQ,EACpD,GAAI,KAAK,OAAO,eAAiB,KAC/B,MAAM,EAAS,OAAO,KAAK,OAAO,aAAc,eAAe,EAE/D,WAAM,EAAS,OAAO,KAAK,OAAO,YAAa,cAAc,EAGjE,MAAM,KAAK,QAAQ,MAAM,OAAO,KAAK,OAAO,EAAE,OAI1C,WAAU,EAAkB,CAChC,MAAM,KAAK,QAAQ,MAAM,OAAO,KAAK,OAAO,EAAE,EAGhD,MAAM,EAAG,CACP,MAAO,CACL,SAAU,KAAK,SACf,kBAAmB,KAAK,kBACxB,OAAQ,CAAC,GAAG,KAAK,MAAM,EACvB,UAAW,KAAK,UAChB,eAAgB,KAAK,eACrB,OAAQ,KAAK,OACb,YAAa,KAAK,WACpB,GAGD,OAAO,IAAI,4BAA4B,EAAE,EAAG,CAC3C,MAAO,CAAE,mBAAoB,KAAK,OAAO,CAAE,OAG/B,QAAO,EAA8B,CACjD,GAAI,KAAK,OAAO,eAAgB,MAAM,IAAI,EAA4B,KAAK,QAAQ,EACnF,IAAM,EAAS,KAAK,QAAQ,SAAS,KAAK,QAAQ,EAAE,OAAO,qBAAuB,KAC5E,EAAY,KAAK,OAAO,WAAW,QAAQ,EACjD,GAAI,IAAc,QAAa,EAAY,KAAK,IAAI,GAAK,EACvD,OAAO,KAAK,YAAY,KAAK,OAAQ,UAAU,EAEjD,OAAO,KAAK,YAGA,YAAW,CACvB,EACA,EAAkC,YACP,CAC3B,GAAI,CACF,KAAK,OAAS,MAAM,KAAK,QAAQ,QAAQ,EAAQ,CAAM,EACvD,MAAO,EAAO,CACd,GAAI,aAAiB,EACnB,KAAK,OAAS,IAAK,KAAK,OAAQ,eAAgB,EAAK,EAEvD,MAAM,EAER,OAAO,KAAK,OAGN,UAAU,CAAC,EAA0B,CAC3C,IAAM,EAAO,KAAK,QAAQ,SAAS,KAAK,QAAQ,EAAE,OAAO,WACrD,EACJ,GAAI,CACF,EAAM,IAAI,IAAI,OAAO,CAAK,EAAG,CAAI,EACjC,KAAM,CACN,MAAM,IAAI,EACR,gBACA,8BAA8B,KAAK,UAAU,OAAO,CAAK,CAAC,wBAC5D,EAEF,GAAI,EAAI,SAAW,IAAI,IAAI,CAAI,EAAE,OAC/B,MAAM,IAAI,EACR,gBACA,mCAAmC,KAAK,qBAAqB,IAAI,IAAI,CAAI,EAAE,+BACjD,EAAI,SAChC,EAEF,GAAI,EAAI,WAAa,UAAY,EAAE,EAAI,WAAa,SAAW,EAAW,EAAI,QAAQ,GACpF,MAAM,IAAI,EACR,gBACA,0DAA0D,EAAI,SAChE,EAEF,OAAO,OAGK,KAAI,CAAC,EAAU,EAAmB,EAAqE,CACnH,IAAI,EAAS,EACT,GAAU,EAAK,QAAU,OAAO,YAAY,EAC5C,EAAO,EAAK,KACZ,EAAa,GAIjB,GAAI,EAAK,WAAa,UAAY,EAAK,WAAa,QAElD,MAAO,CAAE,SADQ,MAAM,KAAK,QAAQ,KAAK,KAAK,SAAU,KAAK,QAAQ,EAAQ,EAAM,EAAQ,EAAM,CAAK,CAAC,EACpF,YAAW,EAGhC,QAAS,EAAM,GAAK,IAAO,CACzB,IAAM,EAAU,KAAK,QAAQ,EAAQ,IAAK,EAAM,SAAU,QAAS,EAAG,EAAQ,EAAM,EAAa,EAAQ,IAAI,EACvG,EAAW,MAAM,KAAK,QAAQ,KAAK,KAAK,SAAU,CAAO,EACzD,EAAW,EAAS,QAAQ,IAAI,UAAU,EAChD,GAAI,CAAC,EAAU,IAAI,EAAS,MAAM,GAAK,IAAa,MAAQ,GAAO,EAAG,MAAO,CAAE,WAAU,YAAW,EAEpG,MAAM,EAAS,MAAM,OAAO,EAAE,MAAM,IAAM,EAAE,EAC5C,IAAM,EAAO,IAAI,IAAI,EAAU,CAAM,EACrC,GAAI,EAAK,SAAW,EAAO,OAAQ,EAAa,GAChD,GAAI,EAAS,SAAW,MAAS,EAAS,SAAW,KAAO,EAAS,SAAW,MAAQ,IAAW,OACjG,EAAS,MACT,EAAO,OAET,EAAS,GAIL,OAAO,CAAC,EAAU,EAAmB,EAAgB,EAA2B,EAA+B,CACrH,IAAM,EAAU,IAAI,QAAQ,EAAK,OAAO,EAClC,EAAS,IAAI,IAAI,CAAG,EACpB,EAAY,KAAK,QAAQ,SAAS,KAAK,QAAQ,EAAE,OAAO,eAC9D,GAAI,IAAU,KACZ,EAAQ,OAAO,eAAe,EACzB,QAAI,IAAc,QAGvB,EAAO,aAAa,IAAI,eAAgB,CAAK,EAE7C,OAAQ,IAAI,gBAAiB,UAAU,GAAO,EAEhD,OAAO,IAAI,QAAQ,EAAQ,IAAK,EAAM,SAAQ,OAAM,SAAQ,CAAC,EAEjE,CAEA,IAAM,EAAY,IAAI,IAAI,CAAC,IAAK,IAAK,IAAK,IAAK,GAAG,CAAC,EAG7C,EAAoB,IAE1B,SAAS,CAAQ,CAAC,EAAkB,EAA2B,CAC7D,MAAO,GAAG,IAAW,IAAoB,IAG3C,SAAS,CAAO,CAAC,EAA+B,CAC9C,IAAM,EAAK,OAAO,IAAS,UAAY,IAAS,KAAO,EAAK,GAAK,EACjE,GAAI,IAAO,QAAa,IAAO,MAAQ,IAAO,GAC5C,MAAU,UAAU,mEAAmE,EAEzF,OAAO,OAAO,CAAE",
-  "debugId": "63ACA0C1EBA4552164756E2164756E21",
+  "debugId": "76D0BE7A645DC69E64756E2164756E21",
   "names": []
 }

package/dist/{chunk-07zfrfbg.js → chunk-mk4x0vtp.js}

@@ -1,5 +1,5 @@
 // @bun
-import{Rl as a}from"./chunk-vgxkt9vd.js";var i=a((f)=>{function u(t){let r={};if(t=t.replace(/^\?/,""),t)for(let n of t.split("&")){let[e,s=null]=n.split("=");if(e=decodeURIComponent(e),s)s=decodeURIComponent(s);if(!(e in r))r[e]=s;else if(Array.isArray(r[e]))r[e].push(s);else r[e]=[r[e],s]}return r}f.parseQueryString=u});var U=a((d)=>{var y=i(),c=(t)=>{if(typeof t==="string")return c(new URL(t));let{hostname:r,pathname:n,port:e,protocol:s,search:o}=t,p;if(o)p=y.parseQueryString(o);return{hostname:r,port:e?parseInt(e):void 0,protocol:s,path:n,query:p}};d.parseUrl=c});
+import{Vl as a}from"./chunk-fzy1z97a.js";var i=a((f)=>{function u(t){let r={};if(t=t.replace(/^\?/,""),t)for(let n of t.split("&")){let[e,s=null]=n.split("=");if(e=decodeURIComponent(e),s)s=decodeURIComponent(s);if(!(e in r))r[e]=s;else if(Array.isArray(r[e]))r[e].push(s);else r[e]=[r[e],s]}return r}f.parseQueryString=u});var U=a((d)=>{var y=i(),c=(t)=>{if(typeof t==="string")return c(new URL(t));let{hostname:r,pathname:n,port:e,protocol:s,search:o}=t,p;if(o)p=y.parseQueryString(o);return{hostname:r,port:e?parseInt(e):void 0,protocol:s,path:n,query:p}};d.parseUrl=c});
 export{U as R};
 
-//# debugId=BE1EA71C6B82210E64756E2164756E21
+//# debugId=F7E99F2A7512B3B964756E2164756E21

package/dist/{chunk-07zfrfbg.js.map → chunk-mk4x0vtp.js.map}

@@ -6,6 +6,6 @@
     "'use strict';\n\nvar querystringParser = require('@smithy/querystring-parser');\n\nconst parseUrl = (url) => {\n    if (typeof url === \"string\") {\n        return parseUrl(new URL(url));\n    }\n    const { hostname, pathname, port, protocol, search } = url;\n    let query;\n    if (search) {\n        query = querystringParser.parseQueryString(search);\n    }\n    return {\n        hostname,\n        port: port ? parseInt(port) : undefined,\n        protocol,\n        path: pathname,\n        query,\n    };\n};\n\nexports.parseUrl = parseUrl;\n"
   ],
   "mappings": ";uDAEA,SAAS,CAAgB,CAAC,EAAa,CACnC,IAAM,EAAQ,CAAC,EAEf,GADA,EAAc,EAAY,QAAQ,MAAO,EAAE,EACvC,EACA,QAAW,KAAQ,EAAY,MAAM,GAAG,EAAG,CACvC,IAAK,EAAK,EAAQ,MAAQ,EAAK,MAAM,GAAG,EAExC,GADA,EAAM,mBAAmB,CAAG,EACxB,EACA,EAAQ,mBAAmB,CAAK,EAEpC,GAAI,EAAE,KAAO,GACT,EAAM,GAAO,EAEZ,QAAI,MAAM,QAAQ,EAAM,EAAI,EAC7B,EAAM,GAAK,KAAK,CAAK,EAGrB,OAAM,GAAO,CAAC,EAAM,GAAM,CAAK,EAI3C,OAAO,EAGH,mBAAmB,kBCxB3B,IAAI,MAEE,EAAW,CAAC,IAAQ,CACtB,GAAI,OAAO,IAAQ,SACf,OAAO,EAAS,IAAI,IAAI,CAAG,CAAC,EAEhC,IAAQ,WAAU,WAAU,OAAM,WAAU,UAAW,EACnD,EACJ,GAAI,EACA,EAAQ,EAAkB,iBAAiB,CAAM,EAErD,MAAO,CACH,WACA,KAAM,EAAO,SAAS,CAAI,EAAI,OAC9B,WACA,KAAM,EACN,OACJ,GAGI,WAAW",
-  "debugId": "BE1EA71C6B82210E64756E2164756E21",
+  "debugId": "F7E99F2A7512B3B964756E2164756E21",
   "names": []
 }

package/dist/{chunk-gmcttf0f.js → chunk-mnmz8n5k.js}

@@ -1,5 +1,5 @@
 // @bun
 class K extends Error{lock;token;constructor(x,z,C="its lease ran out or another holder took it"){super(`Lost the lock "${x}" (token ${z}): ${C}.`);this.lock=x;this.token=z;this.name="LockLostError"}}var X=60000,Y=100,Z=(x)=>new Promise((z)=>setTimeout(z,x));class V{store;name;owner;token;ttl;lost;controller=new AbortController;deadline;expiryTimer;renewTimer;done=!1;constructor(x,z,C,B,G,J){this.store=x;this.name=z;this.owner=C;this.token=B;this.ttl=G;this.lost=this.controller.signal,this.deadline=J+G,this.armExpiry()}get expired(){return this.lost.aborted||performance.now()>=this.deadline}async extend(x=this.ttl){if(this.lost.aborted)return!1;let z=performance.now();if(!await this.store.extend(this.name,this.owner,this.token,x))return this.markLost(),!1;if(this.done)return!0;return this.deadline=Math.max(this.deadline,z+x),this.armExpiry(),!0}async isHeld(){if(this.lost.aborted)return!1;let x=await this.store.held(this.name,this.owner,this.token);if(!x)this.markLost();return x}async fence(x){if(this.lost.aborted)throw new K(this.name,this.token);try{return await this.store.fence(this.name,this.owner,this.token,x)}catch(z){if(z instanceof K)this.markLost();throw z}}async release(){if(this.stop(),this.lost.aborted)return!1;return this.store.release(this.name,this.owner,this.token)}startRenewing(){if(this.renewTimer||this.done)return;this.renewTimer=setInterval(()=>{this.extend().catch((x)=>{console.error(`[gemi] Could not renew the lock "${this.name}".`,x)})},Math.max(1,Math.floor(this.ttl/3))),this.renewTimer.unref?.()}markLost(x){if(this.stop(),!this.lost.aborted)this.controller.abort(new K(this.name,this.token,x))}stop(){this.done=!0,clearInterval(this.renewTimer),clearTimeout(this.expiryTimer),this.renewTimer=void 0,this.expiryTimer=void 0}armExpiry(){clearTimeout(this.expiryTimer),this.expiryTimer=setTimeout(()=>this.markLost("its lease ran out before it was renewed"),Math.max(0,this.deadline-performance.now())),this.expiryTimer.unref?.()}}class ${store;static token="locks";constructor(x){this.store=x}async acquire(x,z={}){let C=z.ttl??X;if(!(C>0))throw Error(`A lock's ttl must be a positive number of milliseconds; got ${C}.`);let B=Bun.randomUUIDv7(),G=performance.now()+Math.max(0,z.wait??0);for(;;){let J=performance.now(),M=await this.store.acquire(x,B,C);if(M!==null){let Q=new V(this.store,x,B,M,C,J);if(z.renew)Q.startRenewing();return Q}let O=G-performance.now();if(O<=0)return null;await Z(Math.min(Y,O))}}async run(x,z,C){let B=await this.acquire(x,{...z,renew:z.renew??!0});if(!B)return{acquired:!1};let G;try{G=await C(B)}catch(J){throw await B.release().catch(()=>{}),J}if(B.expired)throw B.markLost(),B.lost.reason;return await B.release(),{acquired:!0,value:G}}}var j={ms:1,s:1000,m:60000,h:3600000,d:86400000,w:604800000};function P(x){if(typeof x==="number"){if(!Number.isFinite(x)||x<0)throw TypeError(`A duration is 0 or more milliseconds; got ${x}.`);return Math.round(x)}let z=/^\s*(\d+(?:\.\d+)?)\s*(ms|s|m|h|d|w)\s*$/.exec(String(x));if(!z)throw TypeError(`"${String(x)}" is not a duration. Use milliseconds, or a number and one of ms, s, m, h, d, w ("30s", "7d").`);return Math.round(Number(z[1])*j[z[2]])}
-export{P as lk,K as mk,V as nk,$ as ok};
+export{P as pk,K as qk,V as rk,$ as sk};
 
-//# debugId=D562626EF50B2BD664756E2164756E21
+//# debugId=9EEDF938763F781E64756E2164756E21