@selvajs/selva 4.16.0 → 4.16.2

package/build/server/chunks/chunks/access.js-BcvkxfjS.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"access.js-BcvkxfjS.js","sources":["../../../../.svelte-kit/output/server/chunks/access.js"],"sourcesContent":["import { O as ALL_PLATFORM_PERMISSIONS, r as hasPermission, v as ALL_ORG_PERMISSIONS } from \"./src.js\";\nimport { d as Qe, t as UI_SCHEMA_VERSION, u as Je } from \"./schema.js\";\n//#region ../platform/src/access/rules.ts\n/**\n* Pure access-control rules — single source of truth for UI gating across\n* adapters. Mutating store methods MUST re-enforce the same predicate\n* independently (RLS in SQL, code in local/JSON).\n*\n* `instance_admin` bypass is not baked into rule bodies — wrap calls with\n* `withAdminBypass` at the call site.\n*/\nfunction isInstanceAdmin(platformPermissions) {\n\treturn platformPermissions.includes(\"instance_admin\");\n}\nfunction withAdminBypass(platformPermissions, rule) {\n\tif (isInstanceAdmin(platformPermissions)) return true;\n\treturn rule();\n}\n/**\n* Authenticated-user view rule. Anonymous access goes through share-link\n* tokens instead — the route resolves a valid token before this runs.\n*\n* Platform projects: `instance_admin` always passes; otherwise any grant\n* (view-only or canSolve) satisfies view access.\n*/\nfunction canView(input) {\n\tconst { project, member, orgMember, allowCrossOrgPublic, enablePlatformProjects, platformPermissions, platformGrants, actingOrgId, userId } = input;\n\tif (!project) return false;\n\tif (project.visibility === \"platform\") {\n\t\tif (!enablePlatformProjects) return false;\n\t\tif (isInstanceAdmin(platformPermissions)) return true;\n\t\treturn platformGrants.some((g) => g.granteeType === \"user\" && g.granteeId === userId || g.granteeType === \"org\" && g.granteeId === actingOrgId);\n\t}\n\tif (project.visibility === \"private\") return member !== null;\n\tif (project.visibility === \"org\") return orgMember !== null;\n\tif (project.visibility === \"public\") return allowCrossOrgPublic ? true : orgMember !== null;\n\treturn false;\n}\n/**\n* Non-platform projects: same as `canView` — kept as a separate function so\n* cost gating can diverge from view access later.\n*\n* Platform projects: `instance_admin` always passes; a view-only grant\n* satisfies `canView` but not `canSolve` — the grant needs `canSolve: true`.\n*/\nfunction canSolve(input) {\n\tconst { project, enablePlatformProjects, platformPermissions, platformGrants, actingOrgId, userId } = input;\n\tif (!project) return false;\n\tif (project.visibility === \"platform\") {\n\t\tif (!enablePlatformProjects) return false;\n\t\tif (isInstanceAdmin(platformPermissions)) return true;\n\t\treturn platformGrants.some((g) => g.canSolve && (g.granteeType === \"user\" && g.granteeId === userId || g.granteeType === \"org\" && g.granteeId === actingOrgId));\n\t}\n\treturn canView(input);\n}\n/**\n* Platform projects: `instance_admin` only (they have no member rows).\n* All other visibilities: project owner/editor.\n*/\nfunction canEdit(input) {\n\tconst { member, project, enablePlatformProjects, platformPermissions } = input;\n\tif (project?.visibility === \"platform\") {\n\t\tif (!enablePlatformProjects) return false;\n\t\treturn isInstanceAdmin(platformPermissions);\n\t}\n\treturn member?.role === \"owner\" || member?.role === \"editor\";\n}\n/** Platform projects: `instance_admin` only. All other visibilities: project owner. */\nfunction canManage(input) {\n\tif (input.project?.visibility === \"platform\") {\n\t\tif (!input.enablePlatformProjects) return false;\n\t\treturn isInstanceAdmin(input.platformPermissions);\n\t}\n\treturn input.member?.role === \"owner\";\n}\n/** Platform projects: `instance_admin` only. All other visibilities: project owner. */\nfunction canEditProjectSettings(input) {\n\tif (input.project?.visibility === \"platform\") {\n\t\tif (!input.enablePlatformProjects) return false;\n\t\treturn isInstanceAdmin(input.platformPermissions);\n\t}\n\treturn input.member?.role === \"owner\";\n}\n/**\n* Authorization to flip a project to `public`. The `ALLOW_CROSS_ORG_PUBLIC`\n* flag only changes what `public` means post-flip; the flip itself is gated\n* by org owner/admin role.\n*/\nfunction canChangeVisibilityToPublic(input) {\n\tconst role = input.orgMember?.role;\n\treturn role === \"owner\" || role === \"admin\";\n}\n/**\n* For platform projects: `instance_admin` only.\n* For all other projects: project editor/owner can always edit (moderation).\n* On commons projects (`autoJoinOnUpload=true`) the definition owner can edit\n* their own, as long as they still belong to the project's org.\n*/\nfunction canEditDefinition(input) {\n\tconst { project, definition, member, orgMember, userId, platformPermissions, enablePlatformProjects } = input;\n\tif (!project || !definition) return false;\n\tif (project.visibility === \"platform\") {\n\t\tif (!enablePlatformProjects) return false;\n\t\treturn isInstanceAdmin(platformPermissions);\n\t}\n\tif (member?.role === \"owner\" || member?.role === \"editor\") return true;\n\tif (project.autoJoinOnUpload && userId === definition.ownerId && orgMember) return true;\n\treturn false;\n}\n/**\n* Org leadership escape hatch: adds the actor as co-owner without demoting\n* the existing owner. Tenancy must match.\n*\n* Platform projects can't be reclaimed — `instance_admin` already has\n* management access to them.\n*/\nfunction canReclaim(input) {\n\tconst { project, orgMember, actingOrgId } = input;\n\tif (!project || !actingOrgId) return false;\n\tif (project.visibility === \"platform\") return false;\n\tif (actingOrgId !== project.orgId) return false;\n\tconst role = orgMember?.role;\n\treturn role === \"owner\" || role === \"admin\";\n}\n/**\n* Owner/admin can always create; a `member` needs `manage_projects` org\n* permission. Tenancy is enforced.\n*\n* Platform projects (`visibility: 'platform'`) go through the admin API,\n* gated on `instance_admin` — this rule isn't consulted for them.\n*/\nfunction canCreateProject(input) {\n\tconst { orgMember, orgPermissions, actingOrgId, targetOrgId } = input;\n\tif (actingOrgId !== targetOrgId) return false;\n\tconst role = orgMember?.role;\n\tif (role === \"owner\" || role === \"admin\") return true;\n\tif (role === \"member\" && orgPermissions.includes(\"manage_projects\")) return true;\n\treturn false;\n}\n/**\n* Whether the actor may hand out or take away org `owner`/`admin` standing (§3).\n*\n* Three routes decide this — inviting someone as owner/admin, changing an\n* existing member's role, and removing an owner — and all three had written it\n* out longhand. Two of them had drifted by the time the access audit found\n* them: the invite route let an admin mint an `owner` invite for themselves,\n* and DELETE let an admin remove an owner that PATCH would not let them demote.\n* They are one rule, so they read it from one place.\n*\n* Reads the actor's **membership row**. `Organization.ownerId` is a separate\n* field that can disagree with it — see the sole-`instance_admin` finding — and\n* is not authority for this decision.\n*/\nfunction canChangeOrgRole(input) {\n\tif (input.role === \"member\") return true;\n\treturn input.actorMember?.role === \"owner\";\n}\nfunction checkOwnerRemoval(input) {\n\tif (input.target.role !== \"owner\") return \"ok\";\n\tif (input.allMembers.filter((m) => m.role === \"owner\").length <= 1) return \"sole_owner\";\n\tif (!input.confirmed) return \"needs_confirm\";\n\treturn \"ok\";\n}\n//#endregion\n//#region ../platform/src/events/interface.ts\n/**\n* `ctx.userId === ''` is the `SYSTEM_CONTEXT` convention for a server-internal\n* caller (bootstrap, janitors, migrations), which resolves to `'system'` here.\n*/\nfunction actorFrom(ctx) {\n\treturn ctx.userId || \"system\";\n}\n/** Discards every event. Used when `SelvaConfig.events` is omitted. */\nvar NoopEventSink = class {\n\tasync emit(_event) {}\n};\n//#endregion\n//#region ../platform/src/config.ts\nfunction isFlagEnabled(config, flag) {\n\treturn Boolean(config.flags?.[flag]);\n}\n//#endregion\n//#region ../server/src/api/errors.ts\n/**\n* The transport-free error type every API handler raises.\n*\n* `apiError` used to throw SvelteKit's `error()` directly, which welded all 151\n* of its call sites to one framework. `ApiError` carries the same envelope as a\n* plain exception; the host adapter converts it to whatever its framework\n* expects (see `toApiResponse`). Call sites are unchanged — only the throw\n* site and the boundary know the difference.\n*/\n/** Stable, machine-readable error codes. Append-only — never renumber/rename. */\nvar ApiErrorCode = {\n\tVALIDATION_FAILED: \"VALIDATION_FAILED\",\n\tUNAUTHORIZED: \"UNAUTHORIZED\",\n\tFORBIDDEN: \"FORBIDDEN\",\n\tNOT_FOUND: \"NOT_FOUND\",\n\tCONFLICT: \"CONFLICT\",\n\tUNPROCESSABLE: \"UNPROCESSABLE\",\n\tCOMPUTE_UNAVAILABLE: \"COMPUTE_UNAVAILABLE\",\n\tSETUP_REQUIRED: \"SETUP_REQUIRED\",\n\tINTERNAL: \"INTERNAL\"\n};\nvar ApiError = class extends Error {\n\tstatus;\n\tcode;\n\t/** Per-field validation messages, keyed by dotted path. Only on VALIDATION_FAILED. */\n\tfields;\n\tconstructor(status, code, message, fields) {\n\t\tsuper(message);\n\t\tthis.name = \"ApiError\";\n\t\tthis.status = status;\n\t\tthis.code = code;\n\t\tthis.fields = fields;\n\t}\n};\nfunction isApiError(err) {\n\treturn err instanceof ApiError;\n}\n/** Raise a structured API error. The only way handlers should fail. */\nfunction apiError(status, code, message, fields) {\n\tthrow new ApiError(status, code, message, fields);\n}\n/** Default code for a status, for mapping errors that carry no code of their own. */\nfunction codeForStatus(status) {\n\tswitch (status) {\n\t\tcase 400: return ApiErrorCode.VALIDATION_FAILED;\n\t\tcase 401: return ApiErrorCode.UNAUTHORIZED;\n\t\tcase 403: return ApiErrorCode.FORBIDDEN;\n\t\tcase 404: return ApiErrorCode.NOT_FOUND;\n\t\tcase 409: return ApiErrorCode.CONFLICT;\n\t\tcase 422: return ApiErrorCode.UNPROCESSABLE;\n\t\tcase 503: return ApiErrorCode.COMPUTE_UNAVAILABLE;\n\t\tdefault: return ApiErrorCode.INTERNAL;\n\t}\n}\n//#endregion\n//#region ../server/src/definitions/schema-extraction.ts\n/** Thin re-export of @selvajs/compute's unwrap, typed to `UISchema`. */\nfunction readSchemaResults(raw) {\n\treturn Je(raw);\n}\n/** Thrown when compute is reachable but the definition yields no usable schema. */\nvar SchemaExtractionError = class extends Error {\n\tkind;\n\tconstructor(kind, message) {\n\t\tsuper(message);\n\t\tthis.kind = kind;\n\t\tthis.name = \"SchemaExtractionError\";\n\t}\n};\n/**\n* Rejects a schema whose keys are not camelCase by the time it reaches a consumer.\n*\n* Compute serializes the plugin's `UISchema` POCO, whose camelCase names live in\n* `[JsonProperty]` attributes. `Selva.gha` ILRepack-merges Newtonsoft, so those\n* attributes have type `Selva!Newtonsoft.Json.JsonPropertyAttribute`; a compute\n* server serializing with its OWN Newtonsoft does not recognize them, reads no\n* attributes, and falls back to raw CLR member names — `Inputs`, `Layout`.\n* Nothing throws on the wire: every consumer just reads `schema.inputs` as\n* undefined and renders a definition with no inputs.\n*\n* `postSchemaFormData` repairs that casing via `normalizeUISchemaCasing`, so a\n* schema fresh off the wire never trips this. It stays because schemas are also\n* PERSISTED: a row cached before the normalizer existed still holds PascalCase,\n* and it reaches consumers without passing through `postSchemaFormData` again.\n* A schema with no `inputs` in any casing lands here too. It is a backstop, not\n* the primary defense — which is why it names the missing key rather than telling\n* the operator to go update their compute server.\n*\n* Checked structurally rather than by plugin version, because the casing depends\n* on which assembly serialized the schema, not on any version number.\n*/\nfunction assertCamelCaseSchema(schema) {\n\tconst raw = schema;\n\tif (Array.isArray(raw.inputs)) return;\n\tconst pascalKeys = [\n\t\t\"Inputs\",\n\t\t\"Outputs\",\n\t\t\"Layout\",\n\t\t\"SchemaVersion\"\n\t].filter((k) => k in raw);\n\tif (pascalKeys.length > 0) throw new SchemaExtractionError(\"malformed\", `Schema keys are PascalCase (found ${pascalKeys.join(\", \")}), so every property name is wrong and the definition would render with no inputs. Compute serialized it with its own Newtonsoft instead of the one merged into Selva.gha. Fresh responses are normalized, so this is most likely a schema cached before that fix — re-save the definition version to re-extract it.`);\n\tthrow new SchemaExtractionError(\"malformed\", `Compute returned a schema with no 'inputs' array (got keys: ${Object.keys(raw).slice(0, 12).join(\", \")}).`);\n}\nfunction parseSemver(version) {\n\tconst m = /^(\\d+)\\.(\\d+)\\.(\\d+)$/.exec(version);\n\treturn m ? [\n\t\tNumber(m[1]),\n\t\tNumber(m[2]),\n\t\tNumber(m[3])\n\t] : null;\n}\n/**\n* Rejects a schema from a NEWER plugin than this app was built against — its\n* shape may contain constructs the renderer doesn't know. Older (or missing)\n* versions pass: the compute-side C# migrator always emits its own current\n* version, and an older shape only lacks optional additions.\n*/\nfunction assertSupportedSchemaVersion(schema) {\n\tconst version = schema.schemaVersion;\n\tif (!version) return;\n\tconst extracted = parseSemver(version);\n\tconst supported = parseSemver(UI_SCHEMA_VERSION);\n\tif (!extracted || !supported) return;\n\tif (extracted[0] > supported[0] || extracted[0] === supported[0] && (extracted[1] > supported[1] || extracted[1] === supported[1] && extracted[2] > supported[2])) throw new SchemaExtractionError(\"unsupported\", `This definition was authored with a newer Selva plugin (schema format ${version}); this server supports schema format ≤ ${UI_SCHEMA_VERSION}. Update the server, or re-save the definition with a matching plugin version.`);\n}\n/**\n* POSTs a multipart form to Rhino Compute's `/grasshopper/schema` endpoint (no\n* solve required). Throws 'unreachable' on a network failure or non-2xx. The\n* per-file `error` Compute reports on its 200-with-no-schemas case is left to\n* the caller — single-file and multi-file callers want different messages.\n*/\nasync function postSchemaFormData(formData, server) {\n\tconst schemaUrl = new URL(\"/grasshopper/schema\", server.serverUrl).toString();\n\tconst headers = {};\n\tif (server.apiKey) headers[\"RhinoComputeKey\"] = server.apiKey;\n\tlet response;\n\ttry {\n\t\tresponse = await fetch(schemaUrl, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders,\n\t\t\tbody: formData\n\t\t});\n\t} catch (err) {\n\t\tthrow new SchemaExtractionError(\"unreachable\", `Compute server is unreachable: ${err instanceof Error ? err.message : String(err)}`);\n\t}\n\tif (!response.ok) throw new SchemaExtractionError(\"unreachable\", `Schema endpoint returned ${response.status}: ${response.statusText}`);\n\treturn readSchemaResults(await response.json()).map((result) => ({\n\t\t...result,\n\t\tschemas: result.schemas?.map((schema) => Qe(schema))\n\t}));\n}\n/**\n* Throws `SchemaExtractionError` so callers can map to the right HTTP status:\n* 503 unreachable / 422 invalid or unsupported.\n*/\nasync function fetchSchemaFromCompute(definitionBytes, server) {\n\tconst formData = new FormData();\n\tconst blob = new Blob([new Uint8Array(definitionBytes)], { type: \"application/octet-stream\" });\n\tformData.append(\"file\", blob, \"definition.gh\");\n\tconst results = await postSchemaFormData(formData, server);\n\tconst schemas = results.flatMap((r) => r.schemas ?? []);\n\tif (schemas.length === 0) {\n\t\tconst diagnosis = results.map((r) => r.error).filter(Boolean);\n\t\tif (diagnosis.length > 0) throw new SchemaExtractionError(\"invalid\", diagnosis.join(\"\\n\"));\n\t\tthrow new SchemaExtractionError(\"invalid\", \"No schemas found in definition.\\n\\nIn Grasshopper, verify a Context Bake component with the output name \\\"Schema\\\" is present and wired to the solver.\");\n\t}\n\tassertSupportedSchemaVersion(schemas[0]);\n\tassertCamelCaseSchema(schemas[0]);\n\treturn schemas[0];\n}\n//#endregion\n//#region ../server/src/access/project-access-input.ts\nfunction createProjectAccessInputBuilder(deps) {\n\treturn {\n\t\tasync buildProjectAccessInput(ctx, project, overrides = {}) {\n\t\t\tconst { allowCrossOrgPublic, enablePlatformProjects } = deps.flags();\n\t\t\tlet member = null;\n\t\t\tlet orgMember = null;\n\t\t\tlet platformGrants = [];\n\t\t\tif (project.visibility === \"platform\") {\n\t\t\t\tif (enablePlatformProjects) platformGrants = await deps.listPlatformGrants(ctx, project.id);\n\t\t\t} else if (project.visibility === \"private\") member = await deps.getProjectMember(ctx, project.id, ctx.userId);\n\t\t\telse {\n\t\t\t\tconst skipOrgMember = project.visibility === \"public\" && allowCrossOrgPublic;\n\t\t\t\t[member, orgMember] = await Promise.all([deps.getProjectMember(ctx, project.id, ctx.userId), skipOrgMember ? Promise.resolve(null) : deps.getOrgMember(ctx, project.orgId, ctx.userId)]);\n\t\t\t}\n\t\t\treturn {\n\t\t\t\torgPermissions: ctx.orgPermissions,\n\t\t\t\tplatformPermissions: ctx.platformPermissions,\n\t\t\t\tproject,\n\t\t\t\tmember,\n\t\t\t\torgMember,\n\t\t\t\tallowCrossOrgPublic,\n\t\t\t\tenablePlatformProjects,\n\t\t\t\tplatformGrants,\n\t\t\t\tactingOrgId: ctx.actingOrgId ?? null,\n\t\t\t\tuserId: ctx.userId,\n\t\t\t\t...overrides\n\t\t\t};\n\t\t},\n\t\tprojectAccessInputFromRows(ctx, project, rows) {\n\t\t\tconst { allowCrossOrgPublic, enablePlatformProjects } = deps.flags();\n\t\t\treturn {\n\t\t\t\torgPermissions: ctx.orgPermissions,\n\t\t\t\tplatformPermissions: ctx.platformPermissions,\n\t\t\t\tproject,\n\t\t\t\tmember: rows.member ?? null,\n\t\t\t\torgMember: rows.orgMember ?? null,\n\t\t\t\tallowCrossOrgPublic,\n\t\t\t\tenablePlatformProjects,\n\t\t\t\tplatformGrants: rows.platformGrants ?? [],\n\t\t\t\tactingOrgId: ctx.actingOrgId ?? null,\n\t\t\t\tuserId: ctx.userId\n\t\t\t};\n\t\t}\n\t};\n}\n//#endregion\n//#region ../server/src/access/guards.ts\n/**\n* Derive the stores a guard needs from a resolved config.\n*\n* Pure — it reads the config it is handed and nothing else, which is what keeps\n* this module free of any import that boots the app. Page loads pass\n* `locals.providers`; `hooks.server.ts` sets it on every request.\n*/\nfunction accessDepsFromConfig(config) {\n\treturn {\n\t\torgs: config.data.orgs,\n\t\tprojects: config.data.projects,\n\t\tdefinitionMeta: config.data.definitions,\n\t\tplatformProjectGrants: config.data.platformProjectGrants,\n\t\tflag: (name) => isFlagEnabled(config, name)\n\t};\n}\n/** `locals` as a store-reading guard wants it. */\nfunction scoped(locals) {\n\treturn {\n\t\t...locals,\n\t\tdeps: accessDepsFromConfig(locals.providers)\n\t};\n}\nvar orgsOf = (src) => src.deps.orgs;\nvar projectsOf = (src) => src.deps.projects;\nvar definitionMetaOf = (src) => src.deps.definitionMeta;\nvar flagOf = (src) => src.deps.flag;\nfunction requireAuthed(locals) {\n\tconst { user, ctx } = locals;\n\tif (!user || !ctx) apiError(401, ApiErrorCode.UNAUTHORIZED, \"Unauthorized\");\n\treturn {\n\t\tuser,\n\t\tctx\n\t};\n}\n/** Throws 403 — use in API routes. */\nfunction requirePermission(locals, permission) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tif (!hasPermission(ctx, permission)) apiError(403, ApiErrorCode.FORBIDDEN, `You don't have permission to do this.`);\n\treturn user;\n}\nvar requireManageInstanceUsers = (locals) => requirePermission(locals, \"manage_instance_users\");\nvar requireManageCompute = (locals) => requirePermission(locals, \"manage_compute\");\nvar requireManageOrgMembers = (locals) => requirePermission(locals, \"manage_org_members\");\nvar requireManageOrgCompute = (locals) => requirePermission(locals, \"manage_org_compute\");\nvar requireInstanceAdmin = (locals) => requirePermission(locals, \"instance_admin\");\n/**\n* Platform scope is not delegable: `manage_instance_users` runs the user-admin\n* surface but must not be able to mint an `instance_admin`, or an org admin\n* holding it self-elevates. Three routes write platform permissions — the two\n* `/api/admin/users` handlers and the invite mint route — and each carried its\n* own copy of this check.\n*\n* Pass `current` on an update. Revoking is a platform-scope change too, so a\n* PATCH that drops `instance_admin` is refused for the same reason granting it\n* is; without `current` the caller is creating (a user, an invite) and there is\n* nothing to compare against.\n*\n* Requesting nothing on a create is always allowed — that is a\n* `manage_instance_users` operation, not a platform-scope one.\n*/\nfunction assertCanGrantPlatformPermissions(ctx, requested, current) {\n\tif (!(current ? requested.length !== current.length || requested.some((p) => !current.includes(p)) || current.some((p) => !requested.includes(p)) : requested.length > 0)) return;\n\tif (hasPermission(ctx, \"instance_admin\")) return;\n\tapiError(403, ApiErrorCode.FORBIDDEN, current ? \"Only a platform admin can change platform-scope permissions\" : \"Only a platform admin can grant platform-scope permissions\");\n}\n/**\n* Tenancy gate for `/api/v1/orgs/{orgId}/…`. The URL id is never trusted alone\n* — the acting context decides which tenant a request applies to, so a\n* mismatch is 403 rather than a silent read of the caller's own org.\n*/\nfunction requireActingOrg(locals, orgId) {\n\tconst ctx = locals.ctx;\n\tif (!ctx) apiError(401, ApiErrorCode.UNAUTHORIZED, \"Unauthorized\");\n\tif (!orgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing org ID\");\n\tif (!ctx.actingOrgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"No active organization\");\n\tif (ctx.actingOrgId !== orgId) apiError(403, ApiErrorCode.FORBIDDEN, \"Acting org does not match the target org.\");\n\treturn {\n\t\tctx,\n\t\torgId\n\t};\n}\n/**\n* Gate for pages reachable by any platform-class permission holder (the\n\n/**\n* Management-scope bypass — used for org governance and project management\n* actions (Reclaim, create project, delete project, manage members, edit\n* settings). `instance_admin` bypasses these so platform staff can administer\n* the instance without being a member of every org.\n*\n* NOT used for content access (view, solve, edit definitions):\n* `instance_admin` follows the same `canView`/`canEdit` rules as any other\n* user there, keeping blast radius small and forcing content escalation\n* through Reclaim, which leaves an audit trail.\n*/\nasync function managementBypassOrRun(ctx, check) {\n\tif (hasPermission(ctx, \"instance_admin\")) return true;\n\treturn await check();\n}\nasync function contentCheck(check) {\n\treturn await check();\n}\nasync function loadProjectOr404(ctx, projectId, src) {\n\tconst project = await projectsOf(src).getProject(ctx, projectId);\n\tif (!project) apiError(404, ApiErrorCode.NOT_FOUND, \"Project not found\");\n\treturn project;\n}\nfunction accessInputsFor(src) {\n\tconst readFlag = flagOf(src);\n\treturn createProjectAccessInputBuilder({\n\t\tgetProjectMember: (ctx, projectId, userId) => projectsOf(src).getProjectMember(ctx, projectId, userId),\n\t\tgetOrgMember: (ctx, orgId, userId) => orgsOf(src).getOrgMember(ctx, orgId, userId),\n\t\tlistPlatformGrants: (ctx, projectId) => src.deps.platformProjectGrants.listByProject(ctx, projectId),\n\t\tflags: () => ({\n\t\t\tallowCrossOrgPublic: readFlag(\"ALLOW_CROSS_ORG_PUBLIC\"),\n\t\t\tenablePlatformProjects: readFlag(\"ENABLE_PLATFORM_PROJECTS\")\n\t\t})\n\t});\n}\nfunction buildProjectAccessInput(ctx, project, src, overrides) {\n\treturn accessInputsFor(src).buildProjectAccessInput(ctx, project, overrides);\n}\n/**\n* Assemble a rule input from rows the caller already loaded.\n*\n* Unlike the other builders this one issues no reads — the caller batched them.\n* It still needs `deps` for the flag lookups, which decide whether a\n* cross-org-public or platform project is visible at all.\n*/\nfunction projectAccessInputFromRowsWith(src, ...args) {\n\treturn accessInputsFor(src).projectAccessInputFromRows(...args);\n}\n/**\n* Gates creation of a *new* definition. Container projects require project\n* owner/editor (canEdit). Commons projects (`autoJoinOnUpload=true`) accept\n* any authenticated user — the handler stamps `ownerId = user.id` so the\n* uploader becomes the owner.\n*/\nasync function requireCanCreateDefinition(locals, projectId) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tconst project = await loadProjectOr404(ctx, projectId, locals);\n\tif (!await contentCheck(async () => {\n\t\tif (project.autoJoinOnUpload) return true;\n\t\treturn canEdit(await buildProjectAccessInput(ctx, project, locals));\n\t})) apiError(403, ApiErrorCode.FORBIDDEN, \"You do not have permission to upload definitions to this project.\");\n\treturn {\n\t\tuser,\n\t\tctx,\n\t\tproject\n\t};\n}\n/**\n* Org-content gate — the caller must be a member of `orgId`. Used by the\n* file-serving proxy for org-private assets (e.g. pricing sheets under\n* `orgs/{id}/private/*`). Org membership is the only rule; runs through\n* `contentCheck` (no `instance_admin` bypass) — platform staff use Reclaim\n* if they need access without membership.\n*\n* Throws 401 unauthenticated, 403 when not a member.\n*/\nasync function requireCanViewOrg(locals, orgId) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tif (!await contentCheck(async () => {\n\t\treturn await orgsOf(locals).getOrgMember(ctx, orgId, ctx.userId) !== null;\n\t})) apiError(403, ApiErrorCode.FORBIDDEN, \"You do not have access to this organization.\");\n\treturn user;\n}\n/**\n* Project members must belong to the project's parent org. Enforced at the\n* rule layer, not as a DB constraint, to leave room for cross-org guests\n* later without a schema migration.\n*/\nasync function requireTargetIsOrgMember(locals, orgId, targetUserId) {\n\tconst { ctx } = requireAuthed(locals);\n\tif (!await orgsOf(locals).getOrgMember(ctx, orgId, targetUserId)) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"User must be a member of this organization to be added to a project.\");\n}\n/**\n* `canChangeOrgRole` with the actor's membership row loaded — whether the\n* caller may grant or revoke org `owner`/`admin` standing (§3).\n*\n* Returns rather than throws: the three callers each phrase the refusal for\n* what they were doing (\"invite someone as owner\", \"change roles\", \"remove\n* another owner\") and raise it through `apiError`. What must not diverge is the\n* decision, which is why that half lives in `rules.ts` and this loads its input.\n*/\nasync function canActorChangeOrgRole(ctx, orgId, role, src) {\n\tif (role === \"member\") return true;\n\treturn canChangeOrgRole({\n\t\tactorMember: await orgsOf(src).getOrgMember(ctx, orgId, ctx.userId),\n\t\trole\n\t});\n}\n/**\n* `canReclaim` — org owner/admin escape hatch. Returns the project so the\n* handler can use its `orgId` without re-fetching.\n*/\nasync function requireCanReclaim(locals, projectId) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tconst project = await loadProjectOr404(ctx, projectId, locals);\n\tif (project.visibility === \"platform\") apiError(403, ApiErrorCode.FORBIDDEN, \"Platform projects cannot be reclaimed.\");\n\tif (!await managementBypassOrRun(ctx, async () => {\n\t\tconst orgMember = await orgsOf(locals).getOrgMember(ctx, project.orgId, ctx.userId);\n\t\treturn canReclaim({\n\t\t\tproject,\n\t\t\torgMember,\n\t\t\tactingOrgId: ctx.actingOrgId ?? null\n\t\t});\n\t})) apiError(403, ApiErrorCode.FORBIDDEN, \"Only org owners or admins of this project’s org can reclaim it.\");\n\treturn {\n\t\tuser,\n\t\tctx,\n\t\tproject\n\t};\n}\n/**\n* `canCreateProject` — owner/admin always; member needs `manage_projects`.\n* Tenancy is enforced via `actingOrgId`.\n*/\nasync function requireCanCreateProject(locals, targetOrgId) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tif (!await managementBypassOrRun(ctx, async () => {\n\t\tconst orgMember = await orgsOf(locals).getOrgMember(ctx, targetOrgId, ctx.userId);\n\t\treturn canCreateProject({\n\t\t\torgPermissions: ctx.orgPermissions,\n\t\t\torgMember,\n\t\t\tactingOrgId: ctx.actingOrgId ?? null,\n\t\t\ttargetOrgId\n\t\t});\n\t})) apiError(403, ApiErrorCode.FORBIDDEN, \"You do not have permission to create projects in this org.\");\n\treturn {\n\t\tuser,\n\t\tctx\n\t};\n}\n/**\n* Project-management gate (`canManage` — owner, or `instance_admin` via the\n* bypass). Managing members is the same authority as managing the project, so\n* both callers share this; `action` only shapes the 403 message.\n*/\nasync function requireCanManage(locals, projectId, action = \"project\") {\n\tconst { user, ctx } = requireAuthed(locals);\n\tif (!await managementBypassOrRun(ctx, async () => {\n\t\tconst project = await loadProjectOr404(ctx, projectId, locals);\n\t\treturn canManage(await buildProjectAccessInput(ctx, project, locals));\n\t})) apiError(403, ApiErrorCode.FORBIDDEN, action === \"members\" ? \"Only project owners can manage members.\" : \"Only project owners can manage this project.\");\n\treturn user;\n}\nasync function requireCanEditProjectSettings(locals, projectId) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tconst project = await loadProjectOr404(ctx, projectId, locals);\n\tif (!await managementBypassOrRun(ctx, async () => canEditProjectSettings(await buildProjectAccessInput(ctx, project, locals)))) apiError(403, ApiErrorCode.FORBIDDEN, \"Only project owners can edit project settings.\");\n\treturn {\n\t\tuser,\n\t\tctx,\n\t\tproject\n\t};\n}\nasync function requireCanViewProject(locals, projectId) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tif (!await contentCheck(async () => {\n\t\tconst project = await loadProjectOr404(ctx, projectId, locals);\n\t\treturn canView(await buildProjectAccessInput(ctx, project, locals));\n\t})) apiError(403, ApiErrorCode.FORBIDDEN, \"You do not have access to this project.\");\n\treturn user;\n}\n/**\n* Solve gating. Today `canSolve === canView` for non-platform projects, but\n* the rule lives in its own function so future cost-gating (quotas, rate\n* limits) lands without touching view semantics. `viewer` project role\n* passes; platform projects narrow to grants with `canSolve=true`.\n*/\nasync function requireCanSolve(locals, projectId, preloadedProject) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tconst project = preloadedProject ?? await loadProjectOr404(ctx, projectId, locals);\n\tif (!await contentCheck(async () => canSolve(await buildProjectAccessInput(ctx, project, locals)))) apiError(403, ApiErrorCode.FORBIDDEN, \"You do not have access to this project.\");\n\treturn {\n\t\tuser,\n\t\tctx,\n\t\tproject\n\t};\n}\n/**\n* Org membership for the commons branch of `canEditDefinition`, or `null` when\n* that branch cannot fire. Skipping the round-trip on container projects keeps\n* the common edit path at the same two reads it had before commons gained the\n* membership test.\n*/\nasync function loadCommonsOrgMember(ctx, project, src) {\n\tif (!project?.autoJoinOnUpload) return null;\n\treturn await orgsOf(src).getOrgMember(ctx, project.orgId, ctx.userId);\n}\n/**\n* Loads the record and gates editing. Returns the record AND the project it\n* loads for the gate, so callers skip a re-fetch of either.\n*/\nasync function requireEditableDefinition(locals, guid) {\n\tconst { ctx } = requireAuthed(locals);\n\tconst record = await definitionMetaOf(locals).get(ctx, guid);\n\tif (!record) apiError(404, ApiErrorCode.NOT_FOUND, \"Definition not found\");\n\tconst [project, member] = await Promise.all([projectsOf(locals).getProject(ctx, record.projectId), projectsOf(locals).getProjectMember(ctx, record.projectId, ctx.userId)]);\n\tif (!await contentCheck(async () => canEditDefinition({\n\t\tproject,\n\t\tdefinition: record,\n\t\tmember,\n\t\torgMember: await loadCommonsOrgMember(ctx, project, locals),\n\t\tuserId: ctx.userId,\n\t\tplatformPermissions: ctx.platformPermissions,\n\t\tenablePlatformProjects: flagOf(locals)(\"ENABLE_PLATFORM_PROJECTS\")\n\t}))) apiError(403, ApiErrorCode.FORBIDDEN, \"You do not have permission to edit this definition.\");\n\treturn {\n\t\trecord,\n\t\tctx,\n\t\tproject\n\t};\n}\nasync function requireCanEditDefinition(locals, projectId, definitionGuid, preloaded) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tif (!await contentCheck(async () => {\n\t\tconst [project, definition, member] = await Promise.all([\n\t\t\tpreloaded?.project !== void 0 ? Promise.resolve(preloaded.project) : projectsOf(locals).getProject(ctx, projectId),\n\t\t\tpreloaded?.definition !== void 0 ? Promise.resolve(preloaded.definition) : definitionMetaOf(locals).get(ctx, definitionGuid),\n\t\t\tprojectsOf(locals).getProjectMember(ctx, projectId, ctx.userId)\n\t\t]);\n\t\treturn canEditDefinition({\n\t\t\tproject,\n\t\t\tdefinition,\n\t\t\tmember,\n\t\t\torgMember: await loadCommonsOrgMember(ctx, project, locals),\n\t\t\tuserId: ctx.userId,\n\t\t\tplatformPermissions: ctx.platformPermissions,\n\t\t\tenablePlatformProjects: flagOf(locals)(\"ENABLE_PLATFORM_PROJECTS\")\n\t\t});\n\t})) apiError(403, ApiErrorCode.FORBIDDEN, \"You do not have permission to edit this definition.\");\n\treturn user;\n}\n//#endregion\n//#region ../server/src/access/permissions-scope.ts\nvar PLATFORM_SET = new Set(ALL_PLATFORM_PERMISSIONS);\nvar ORG_SET = new Set(ALL_ORG_PERMISSIONS);\n/** Split a flat array into platform + org scope buckets, dropping unknowns. */\nfunction splitFlatPermissions(flat) {\n\tconst platform = [];\n\tconst org = [];\n\tfor (const p of flat) if (PLATFORM_SET.has(p)) platform.push(p);\n\telse if (ORG_SET.has(p)) org.push(p);\n\treturn {\n\t\tplatform,\n\t\torg\n\t};\n}\n//#endregion\nexport { postSchemaFormData as A, canChangeVisibilityToPublic as B, requirePermission as C, SchemaExtractionError as D, createProjectAccessInputBuilder as E, isApiError as F, checkOwnerRemoval as G, canManage as H, isFlagEnabled as I, withAdminBypass as K, NoopEventSink as L, ApiErrorCode as M, apiError as N, assertCamelCaseSchema as O, codeForStatus as P, actorFrom as R, requireManageOrgMembers as S, scoped as T, canSolve as U, canEdit as V, canView as W, requireEditableDefinition as _, projectAccessInputFromRowsWith as a, requireManageInstanceUsers as b, requireCanCreateDefinition as c, requireCanEditProjectSettings as d, requireCanManage as f, requireCanViewProject as g, requireCanViewOrg as h, canActorChangeOrgRole as i, ApiError as j, fetchSchemaFromCompute as k, requireCanCreateProject as l, requireCanSolve as m, accessDepsFromConfig as n, requireActingOrg as o, requireCanReclaim as p, assertCanGrantPlatformPermissions as r, requireAuthed as s, splitFlatPermissions as t, requireCanEditDefinition as u, requireInstanceAdmin as v, requireTargetIsOrgMember as w, requireManageOrgCompute as x, requireManageCompute as y, canChangeOrgRole as z };\n"],"names":[],"mappings":";;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,eAAe,CAAC,mBAAmB,EAAE;AAC9C,CAAC,OAAO,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC;AACtD;AACA,SAAS,eAAe,CAAC,mBAAmB,EAAE,IAAI,EAAE;AACpD,CAAC,IAAI,eAAe,CAAC,mBAAmB,CAAC,EAAE,OAAO,IAAI;AACtD,CAAC,OAAO,IAAI,EAAE;AACd;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,OAAO,CAAC,KAAK,EAAE;AACxB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,KAAK;AACpJ,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,KAAK;AAC3B,CAAC,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE;AACxC,EAAE,IAAI,CAAC,sBAAsB,EAAE,OAAO,KAAK;AAC3C,EAAE,IAAI,eAAe,CAAC,mBAAmB,CAAC,EAAE,OAAO,IAAI;AACvD,EAAE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,KAAK,IAAI,CAAC,CAAC,SAAS,KAAK,WAAW,CAAC;AACjJ,CAAC;AACD,CAAC,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,OAAO,MAAM,KAAK,IAAI;AAC7D,CAAC,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,EAAE,OAAO,SAAS,KAAK,IAAI;AAC5D,CAAC,IAAI,OAAO,CAAC,UAAU,KAAK,QAAQ,EAAE,OAAO,mBAAmB,GAAG,IAAI,GAAG,SAAS,KAAK,IAAI;AAC5F,CAAC,OAAO,KAAK;AACb;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,QAAQ,CAAC,KAAK,EAAE;AACzB,CAAC,MAAM,EAAE,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,KAAK;AAC5G,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,KAAK;AAC3B,CAAC,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE;AACxC,EAAE,IAAI,CAAC,sBAAsB,EAAE,OAAO,KAAK;AAC3C,EAAE,IAAI,eAAe,CAAC,mBAAmB,CAAC,EAAE,OAAO,IAAI;AACvD,EAAE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,KAAK,IAAI,CAAC,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC;AACjK,CAAC;AACD,CAAC,OAAO,OAAO,CAAC,KAAK,CAAC;AACtB;AACA;AACA;AACA;AACA;AACA,SAAS,OAAO,CAAC,KAAK,EAAE;AACxB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,GAAG,KAAK;AAC/E,CAAC,IAAI,OAAO,EAAE,UAAU,KAAK,UAAU,EAAE;AACzC,EAAE,IAAI,CAAC,sBAAsB,EAAE,OAAO,KAAK;AAC3C,EAAE,OAAO,eAAe,CAAC,mBAAmB,CAAC;AAC7C,CAAC;AACD,CAAC,OAAO,MAAM,EAAE,IAAI,KAAK,OAAO,IAAI,MAAM,EAAE,IAAI,KAAK,QAAQ;AAC7D;AACA;AACA,SAAS,SAAS,CAAC,KAAK,EAAE;AAC1B,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,UAAU,KAAK,UAAU,EAAE;AAC/C,EAAE,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,OAAO,KAAK;AACjD,EAAE,OAAO,eAAe,CAAC,KAAK,CAAC,mBAAmB,CAAC;AACnD,CAAC;AACD,CAAC,OAAO,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,OAAO;AACtC;AACA;AACA,SAAS,sBAAsB,CAAC,KAAK,EAAE;AACvC,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,UAAU,KAAK,UAAU,EAAE;AAC/C,EAAE,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,OAAO,KAAK;AACjD,EAAE,OAAO,eAAe,CAAC,KAAK,CAAC,mBAAmB,CAAC;AACnD,CAAC;AACD,CAAC,OAAO,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,OAAO;AACtC;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,2BAA2B,CAAC,KAAK,EAAE;AAC5C,CAAC,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,EAAE,IAAI;AACnC,CAAC,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO;AAC5C;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,KAAK,EAAE;AAClC,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,GAAG,KAAK;AAC9G,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,EAAE,OAAO,KAAK;AAC1C,CAAC,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE;AACxC,EAAE,IAAI,CAAC,sBAAsB,EAAE,OAAO,KAAK;AAC3C,EAAE,OAAO,eAAe,CAAC,mBAAmB,CAAC;AAC7C,CAAC;AACD,CAAC,IAAI,MAAM,EAAE,IAAI,KAAK,OAAO,IAAI,MAAM,EAAE,IAAI,KAAK,QAAQ,EAAE,OAAO,IAAI;AACvE,CAAC,IAAI,OAAO,CAAC,gBAAgB,IAAI,MAAM,KAAK,UAAU,CAAC,OAAO,IAAI,SAAS,EAAE,OAAO,IAAI;AACxF,CAAC,OAAO,KAAK;AACb;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,UAAU,CAAC,KAAK,EAAE;AAC3B,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,KAAK;AAClD,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,EAAE,OAAO,KAAK;AAC3C,CAAC,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,OAAO,KAAK;AACpD,CAAC,IAAI,WAAW,KAAK,OAAO,CAAC,KAAK,EAAE,OAAO,KAAK;AAChD,CAAC,MAAM,IAAI,GAAG,SAAS,EAAE,IAAI;AAC7B,CAAC,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO;AAC5C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,CAAC,KAAK,EAAE;AACjC,CAAC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,KAAK;AACtE,CAAC,IAAI,WAAW,KAAK,WAAW,EAAE,OAAO,KAAK;AAC9C,CAAC,MAAM,IAAI,GAAG,SAAS,EAAE,IAAI;AAC7B,CAAC,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,OAAO,IAAI;AACtD,CAAC,IAAI,IAAI,KAAK,QAAQ,IAAI,cAAc,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,IAAI;AACjF,CAAC,OAAO,KAAK;AACb;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,CAAC,KAAK,EAAE;AACjC,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,OAAO,IAAI;AACzC,CAAC,OAAO,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,OAAO;AAC3C;AACA,SAAS,iBAAiB,CAAC,KAAK,EAAE;AAClC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,OAAO,IAAI;AAC/C,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,OAAO,YAAY;AACxF,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,eAAe;AAC7C,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,SAAS,CAAC,GAAG,EAAE;AACxB,CAAC,OAAO,GAAG,CAAC,MAAM,IAAI,QAAQ;AAC9B;AACA;AACG,IAAC,aAAa,GAAG,MAAM;AAC1B,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;AACrB;AACA;AACA;AACA,SAAS,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE;AACrC,CAAC,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;AACrC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,YAAY,GAAG;AACnB,CAAC,iBAAiB,EAAE,mBAAmB;AACvC,CAAC,YAAY,EAAE,cAAc;AAC7B,CAAC,SAAS,EAAE,WAAW;AACvB,CAAC,SAAS,EAAE,WAAW;AACvB,CAAC,QAAQ,EAAE,UAAU;AACrB,CAAC,aAAa,EAAE,eAAe;AAC/B,CAAC,mBAAmB,EAAE,qBAAqB;AAC3C,CACC,QAAQ,EAAE;AACX;AACG,IAAC,QAAQ,GAAG,cAAc,KAAK,CAAC;AACnC,CAAC,MAAM;AACP,CAAC,IAAI;AACL;AACA,CAAC,MAAM;AACP,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE;AAC5C,EAAE,KAAK,CAAC,OAAO,CAAC;AAChB,EAAE,IAAI,CAAC,IAAI,GAAG,UAAU;AACxB,EAAE,IAAI,CAAC,MAAM,GAAG,MAAM;AACtB,EAAE,IAAI,CAAC,IAAI,GAAG,IAAI;AAClB,EAAE,IAAI,CAAC,MAAM,GAAG,MAAM;AACtB,CAAC;AACD;AACA,SAAS,UAAU,CAAC,GAAG,EAAE;AACzB,CAAC,OAAO,GAAG,YAAY,QAAQ;AAC/B;AACA;AACA,SAAS,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE;AACjD,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC;AAClD;AACA;AACA,SAAS,aAAa,CAAC,MAAM,EAAE;AAC/B,CAAC,QAAQ,MAAM;AACf,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,iBAAiB;AACjD,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,YAAY;AAC5C,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,SAAS;AACzC,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,SAAS;AACzC,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,QAAQ;AACxC,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,aAAa;AAC7C,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,mBAAmB;AACnD,EAAE,SAAS,OAAO,YAAY,CAAC,QAAQ;AACvC;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,GAAG,EAAE;AAChC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC;AACf;AACA;AACG,IAAC,qBAAqB,GAAG,cAAc,KAAK,CAAC;AAChD,CAAC,IAAI;AACL,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE;AAC5B,EAAE,KAAK,CAAC,OAAO,CAAC;AAChB,EAAE,IAAI,CAAC,IAAI,GAAG,IAAI;AAClB,EAAE,IAAI,CAAC,IAAI,GAAG,uBAAuB;AACrC,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,MAAM,EAAE;AACvC,CAAC,MAAM,GAAG,GAAG,MAAM;AACnB,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;AAChC,CAAC,MAAM,UAAU,GAAG;AACpB,EAAE,QAAQ;AACV,EAAE,SAAS;AACX,EAAE,QAAQ;AACV,EAAE;AACF,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC;AAC1B,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,MAAM,IAAI,qBAAqB,CAAC,WAAW,EAAE,CAAC,kCAAkC,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,oTAAoT,CAAC,CAAC;AAC1b,CAAC,MAAM,IAAI,qBAAqB,CAAC,WAAW,EAAE,CAAC,4DAA4D,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;AAC1J;AACA,SAAS,WAAW,CAAC,OAAO,EAAE;AAC9B,CAAC,MAAM,CAAC,GAAG,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC;AAChD,CAAC,OAAO,CAAC,GAAG;AACZ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACd,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACd,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AACb,EAAE,GAAG,IAAI;AACT;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,4BAA4B,CAAC,MAAM,EAAE;AAC9C,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa;AACrC,CAAC,IAAI,CAAC,OAAO,EAAE;AACf,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC;AACvC,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC,iBAAiB,CAAC;AACjD,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE;AAC/B,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,qBAAqB,CAAC,aAAa,EAAE,CAAC,sEAAsE,EAAE,OAAO,CAAC,wCAAwC,EAAE,iBAAiB,CAAC,8EAA8E,CAAC,CAAC;AAChb;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE;AACpD,CAAC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE;AAC9E,CAAC,MAAM,OAAO,GAAG,EAAE;AACnB,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,MAAM,CAAC,MAAM;AAC9D,CAAC,IAAI,QAAQ;AACb,CAAC,IAAI;AACL,EAAE,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE;AACpC,GAAG,MAAM,EAAE,MAAM;AACjB,GAAG,OAAO;AACV,GAAG,IAAI,EAAE;AACT,GAAG,CAAC;AACJ,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,MAAM,IAAI,qBAAqB,CAAC,aAAa,EAAE,CAAC,+BAA+B,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACtI,CAAC;AACD,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,IAAI,qBAAqB,CAAC,aAAa,EAAE,CAAC,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;AACxI,CAAC,OAAO,iBAAiB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,MAAM;AAClE,EAAE,GAAG,MAAM;AACX,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,CAAC;AACrD,EAAE,CAAC,CAAC;AACJ;AACA;AACA;AACA;AACA;AACA,eAAe,sBAAsB,CAAC,eAAe,EAAE,MAAM,EAAE;AAC/D,CAAC,MAAM,QAAQ,GAAG,IAAI,QAAQ,EAAE;AAChC,CAAC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,CAAC,IAAI,UAAU,CAAC,eAAe,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC;AAC/F,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,eAAe,CAAC;AAC/C,CAAC,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC;AAC3D,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;AACxD,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE;AAC3B,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;AAC/D,EAAE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,MAAM,IAAI,qBAAqB,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5F,EAAE,MAAM,IAAI,qBAAqB,CAAC,SAAS,EAAE,wJAAwJ,CAAC;AACtM,CAAC;AACD,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACzC,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC,OAAO,OAAO,CAAC,CAAC,CAAC;AAClB;AACA;AACA;AACA,SAAS,+BAA+B,CAAC,IAAI,EAAE;AAC/C,CAAC,OAAO;AACR,EAAE,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,EAAE;AAC9D,GAAG,MAAM,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE;AACvE,GAAG,IAAI,MAAM,GAAG,IAAI;AACpB,GAAG,IAAI,SAAS,GAAG,IAAI;AACvB,GAAG,IAAI,cAAc,GAAG,EAAE;AAC1B,GAAG,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE;AAC1C,IAAI,IAAI,sBAAsB,EAAE,cAAc,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;AAC/F,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC;AACjH,QAAQ;AACR,IAAI,MAAM,aAAa,GAAG,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,mBAAmB;AAChF,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5L,GAAG;AACH,GAAG,OAAO;AACV,IAAI,cAAc,EAAE,GAAG,CAAC,cAAc;AACtC,IAAI,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;AAChD,IAAI,OAAO;AACX,IAAI,MAAM;AACV,IAAI,SAAS;AACb,IAAI,mBAAmB;AACvB,IAAI,sBAAsB;AAC1B,IAAI,cAAc;AAClB,IAAI,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;AACxC,IAAI,MAAM,EAAE,GAAG,CAAC,MAAM;AACtB,IAAI,GAAG;AACP,IAAI;AACJ,EAAE,CAAC;AACH,EAAE,0BAA0B,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;AACjD,GAAG,MAAM,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE;AACvE,GAAG,OAAO;AACV,IAAI,cAAc,EAAE,GAAG,CAAC,cAAc;AACtC,IAAI,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;AAChD,IAAI,OAAO;AACX,IAAI,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;AAC/B,IAAI,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;AACrC,IAAI,mBAAmB;AACvB,IAAI,sBAAsB;AAC1B,IAAI,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE;AAC7C,IAAI,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;AACxC,IAAI,MAAM,EAAE,GAAG,CAAC;AAChB,IAAI;AACJ,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,oBAAoB,CAAC,MAAM,EAAE;AACtC,CAAC,OAAO;AACR,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;AACxB,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;AAChC,EAAE,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;AACzC,EAAE,qBAAqB,EAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB;AAC1D,EAAE,IAAI,EAAE,CAAC,IAAI,KAAK,aAAa,CAAC,MAAM,EAAE,IAAI;AAC5C,EAAE;AACF;AACA;AACA,SAAS,MAAM,CAAC,MAAM,EAAE;AACxB,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAC,SAAS;AAC7C,EAAE;AACF;AACA,IAAI,MAAM,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI;AACnC,IAAI,UAAU,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,CAAC,QAAQ;AAC3C,IAAI,gBAAgB,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,CAAC,cAAc;AACvD,IAAI,MAAM,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI;AACnC,SAAS,aAAa,CAAC,MAAM,EAAE;AAC/B,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM;AAC7B,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC;AAC5E,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE;AACF,EAAE;AACF;AACA;AACA,SAAS,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE;AAC/C,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,qCAAqC,CAAC,CAAC;AACpH,CAAC,OAAO,IAAI;AACZ;AACG,IAAC,0BAA0B,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,uBAAuB;AAC3F,IAAC,oBAAoB,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,gBAAgB;AAC9E,IAAC,uBAAuB,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,oBAAoB;AACrF,IAAC,uBAAuB,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,oBAAoB;AACrF,IAAC,oBAAoB,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,gBAAgB;AACjF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iCAAiC,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE;AACpE,CAAC,IAAI,EAAE,OAAO,GAAG,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE;AAC5K,CAAC,IAAI,aAAa,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE;AAC3C,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,OAAO,GAAG,6DAA6D,GAAG,4DAA4D,CAAC;AAC9K;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,CAAC,MAAM,EAAE,KAAK,EAAE;AACzC,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACvB,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC;AACnE,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;AAC5E,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;AAC9F,CAAC,IAAI,GAAG,CAAC,WAAW,KAAK,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,2CAA2C,CAAC;AAClH,CAAC,OAAO;AACR,EAAE,GAAG;AACL,EAAE;AACF,EAAE;AACF;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE;AACjD,CAAC,IAAI,aAAa,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,OAAO,IAAI;AACtD,CAAC,OAAO,MAAM,KAAK,EAAE;AACrB;AACA,eAAe,YAAY,CAAC,KAAK,EAAE;AACnC,CAAC,OAAO,MAAM,KAAK,EAAE;AACrB;AACA,eAAe,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE;AACrD,CAAC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;AACjE,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,mBAAmB,CAAC;AACzE,CAAC,OAAO,OAAO;AACf;AACA,SAAS,eAAe,CAAC,GAAG,EAAE;AAC9B,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC;AAC7B,CAAC,OAAO,+BAA+B,CAAC;AACxC,EAAE,gBAAgB,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,KAAK,UAAU,CAAC,GAAG,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC;AACxG,EAAE,YAAY,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC;AACpF,EAAE,kBAAkB,EAAE,CAAC,GAAG,EAAE,SAAS,KAAK,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC;AACtG,EAAE,KAAK,EAAE,OAAO;AAChB,GAAG,mBAAmB,EAAE,QAAQ,CAAC,wBAAwB,CAAC;AAC1D,GAAG,sBAAsB,EAAE,QAAQ,CAAC,0BAA0B;AAC9D,GAAG;AACH,EAAE,CAAC;AACH;AACA,SAAS,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE;AAC/D,CAAC,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC;AAC7E;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,8BAA8B,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE;AACtD,CAAC,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,0BAA0B,CAAC,GAAG,IAAI,CAAC;AAChE;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,0BAA0B,CAAC,MAAM,EAAE,SAAS,EAAE;AAC7D,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC;AAC/D,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,YAAY;AACrC,EAAE,IAAI,OAAO,CAAC,gBAAgB,EAAE,OAAO,IAAI;AAC3C,EAAE,OAAO,OAAO,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AACrE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,mEAAmE,CAAC;AAC/G,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE,GAAG;AACL,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,iBAAiB,CAAC,MAAM,EAAE,KAAK,EAAE;AAChD,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,YAAY;AACrC,EAAE,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI;AAC3E,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,8CAA8C,CAAC;AAC1F,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,wBAAwB,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE;AACrE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AACtC,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,sEAAsE,CAAC;AACxL;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE;AAC5D,CAAC,IAAI,IAAI,KAAK,QAAQ,EAAE,OAAO,IAAI;AACnC,CAAC,OAAO,gBAAgB,CAAC;AACzB,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC;AACrE,EAAE;AACF,EAAE,CAAC;AACH;AACA;AACA;AACA;AACA;AACA,eAAe,iBAAiB,CAAC,MAAM,EAAE,SAAS,EAAE;AACpD,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC;AAC/D,CAAC,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,wCAAwC,CAAC;AACvH,CAAC,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,YAAY;AACnD,EAAE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC;AACrF,EAAE,OAAO,UAAU,CAAC;AACpB,GAAG,OAAO;AACV,GAAG,SAAS;AACZ,GAAG,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI;AACnC,GAAG,CAAC;AACJ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,iEAAiE,CAAC;AAC7G,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE,GAAG;AACL,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA,eAAe,uBAAuB,CAAC,MAAM,EAAE,WAAW,EAAE;AAC5D,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,YAAY;AACnD,EAAE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC;AACnF,EAAE,OAAO,gBAAgB,CAAC;AAC1B,GAAG,cAAc,EAAE,GAAG,CAAC,cAAc;AACrC,GAAG,SAAS;AACZ,GAAG,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;AACvC,GAAG;AACH,GAAG,CAAC;AACJ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,4DAA4D,CAAC;AACxG,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE;AACvE,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,YAAY;AACnD,EAAE,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC;AAChE,EAAE,OAAO,SAAS,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AACvE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,MAAM,KAAK,SAAS,GAAG,yCAAyC,GAAG,8CAA8C,CAAC;AAC7J,CAAC,OAAO,IAAI;AACZ;AACA,eAAe,6BAA6B,CAAC,MAAM,EAAE,SAAS,EAAE;AAChE,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC;AAC/D,CAAC,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,YAAY,sBAAsB,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gDAAgD,CAAC;AACxN,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE,GAAG;AACL,EAAE;AACF,EAAE;AACF;AACA,eAAe,qBAAqB,CAAC,MAAM,EAAE,SAAS,EAAE;AACxD,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,YAAY;AACrC,EAAE,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC;AAChE,EAAE,OAAO,OAAO,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AACrE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,yCAAyC,CAAC;AACrF,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE;AACpE,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,MAAM,OAAO,GAAG,gBAAgB,IAAI,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC;AACnF,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,YAAY,QAAQ,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,yCAAyC,CAAC;AACrL,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE,GAAG;AACL,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE;AACvD,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,OAAO,IAAI;AAC5C,CAAC,OAAO,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC;AACtE;AACA;AACA;AACA;AACA;AACA,eAAe,yBAAyB,CAAC,MAAM,EAAE,IAAI,EAAE;AACvD,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AACtC,CAAC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC;AAC7D,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,sBAAsB,CAAC;AAC3E,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5K,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,YAAY,iBAAiB,CAAC;AACvD,EAAE,OAAO;AACT,EAAE,UAAU,EAAE,MAAM;AACpB,EAAE,MAAM;AACR,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC;AAC7D,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM;AACpB,EAAE,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;AAC9C,EAAE,sBAAsB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,0BAA0B;AACnE,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,qDAAqD,CAAC;AAClG,CAAC,OAAO;AACR,EAAE,MAAM;AACR,EAAE,GAAG;AACL,EAAE;AACF,EAAE;AACF;AACA,eAAe,wBAAwB,CAAC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE;AACtF,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,YAAY;AACrC,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AAC1D,GAAG,SAAS,EAAE,OAAO,KAAK,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;AACrH,GAAG,SAAS,EAAE,UAAU,KAAK,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC;AAC/H,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM;AACjE,GAAG,CAAC;AACJ,EAAE,OAAO,iBAAiB,CAAC;AAC3B,GAAG,OAAO;AACV,GAAG,UAAU;AACb,GAAG,MAAM;AACT,GAAG,SAAS,EAAE,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC;AAC9D,GAAG,MAAM,EAAE,GAAG,CAAC,MAAM;AACrB,GAAG,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;AAC/C,GAAG,sBAAsB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,0BAA0B;AACpE,GAAG,CAAC;AACJ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,qDAAqD,CAAC;AACjG,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA,IAAI,YAAY,GAAG,IAAI,GAAG,CAAC,wBAAwB,CAAC;AACpD,IAAI,OAAO,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC;AAC1C;AACA,SAAS,oBAAoB,CAAC,IAAI,EAAE;AACpC,CAAC,MAAM,QAAQ,GAAG,EAAE;AACpB,CAAC,MAAM,GAAG,GAAG,EAAE;AACf,CAAC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAChE,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AACrC,CAAC,OAAO;AACR,EAAE,QAAQ;AACV,EAAE;AACF,EAAE;AACF;;;;"}

package/build/server/chunks/chunks/access.server.js-Cg7yYegl.js

@@ -1,12 +0,0 @@
-import { B as requireEditableDefinition } from './access.js-BcvkxfjS.js';
-import './src.js-Cf1j97Z6.js';
-import './api.js-DErw1H-D.js';
-import '@sveltejs/kit';
-import './schema.js-BVfByvmD.js';
-import './core-BQtRL5GE.js-B9MmO4om.js';
-import 'zod';
-
-
-
-export { requireEditableDefinition };
-//# sourceMappingURL=access.server.js-Cg7yYegl.js.map

package/build/server/chunks/chunks/access.server.js-Cg7yYegl.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"access.server.js-Cg7yYegl.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;"}

package/build/server/chunks/chunks/access2.server.js-B8CP1AuO.js

@@ -1,62 +0,0 @@
-import { A as ALL_PLATFORM_PERMISSIONS, h as hasPermission } from './src.js-Cf1j97Z6.js';
-import { e as isApiError, r as requireAuthed } from './access.js-BcvkxfjS.js';
-import './api.js-DErw1H-D.js';
-import { error, redirect } from '@sveltejs/kit';
-
-//#region src/lib/server/access.server.ts
-/**
-* The app's access guards: the framework-free ones re-exported from
-* `@selvajs/server/access`, plus the redirecting ones that only make sense here.
-*
-* A redirect is a browser-page outcome, and SvelteKit implements it by throwing
-* a value only SvelteKit recognizes — so these three cannot move into the
-* package without dragging the framework in with them. Every other guard did
-* move, and the handlers that call them no longer name SvelteKit at all.
-*
-* Guards raise `ApiError` now rather than SvelteKit's `error()`. API routes get
-* that folded into the envelope by `mapAppError`; **page loads must wrap the
-* call in {@link asHttpError}**. SvelteKit derives a response status by checking
-* `error instanceof HttpError` and returns 500 for everything else, and
-* `handleError` runs too late to change it — so an unwrapped guard renders the
-* right message under the wrong status, which looks like a crash rather than a
-* denial and never trips a test that only asserts on the message.
-*/
-/**
-* Run a guard outside `mount`, converting its `ApiError` into the `HttpError`
-* SvelteKit needs to produce a real status. Needed by page loads and by API
-* routes that build their own `Response` instead of going through `mount`,
-* since those never reach `mapAppError`.
-*/
-async function asHttpError(run) {
-	try {
-		return await run();
-	} catch (err) {
-		if (isApiError(err)) throw error(err.status, {
-			message: err.message,
-			code: err.code,
-			fields: err.fields
-		});
-		throw err;
-	}
-}
-function assertPagePermission(locals, permission) {
-	const { user, ctx } = requireAuthed(locals);
-	if (!hasPermission(ctx, permission)) redirect(303, "/admin");
-	return user;
-}
-var assertManageInstanceUsers = (locals) => assertPagePermission(locals, "manage_instance_users");
-var assertManageCompute = (locals) => assertPagePermission(locals, "manage_compute");
-/**
-* Gate for pages reachable by any platform-class permission holder (the
-* `/admin` shell — `instance_admin`, `manage_compute`, `manage_instance_users`,
-* or `manage_updates` all qualify). Org-scope permissions never admit entry:
-* org admins do not belong on platform-scoped surfaces.
-*/
-function assertAnyPlatformPermission(locals) {
-	const { user, ctx } = requireAuthed(locals);
-	if (!ALL_PLATFORM_PERMISSIONS.some((p) => hasPermission(ctx, p))) redirect(303, "/library");
-	return user;
-}
-
-export { assertAnyPlatformPermission as a, assertPagePermission as b, assertManageCompute as c, asHttpError as d, assertManageInstanceUsers as e };
-//# sourceMappingURL=access2.server.js-B8CP1AuO.js.map

package/build/server/chunks/chunks/access2.server.js-B8CP1AuO.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"access2.server.js-B8CP1AuO.js","sources":["../../../../.svelte-kit/output/server/chunks/access2.server.js"],"sourcesContent":["import { O as ALL_PLATFORM_PERMISSIONS, r as hasPermission } from \"./src.js\";\nimport { F as isApiError, s as requireAuthed } from \"./access.js\";\nimport \"./api.js\";\nimport { error, redirect } from \"@sveltejs/kit\";\n//#region src/lib/server/access.server.ts\n/**\n* The app's access guards: the framework-free ones re-exported from\n* `@selvajs/server/access`, plus the redirecting ones that only make sense here.\n*\n* A redirect is a browser-page outcome, and SvelteKit implements it by throwing\n* a value only SvelteKit recognizes — so these three cannot move into the\n* package without dragging the framework in with them. Every other guard did\n* move, and the handlers that call them no longer name SvelteKit at all.\n*\n* Guards raise `ApiError` now rather than SvelteKit's `error()`. API routes get\n* that folded into the envelope by `mapAppError`; **page loads must wrap the\n* call in {@link asHttpError}**. SvelteKit derives a response status by checking\n* `error instanceof HttpError` and returns 500 for everything else, and\n* `handleError` runs too late to change it — so an unwrapped guard renders the\n* right message under the wrong status, which looks like a crash rather than a\n* denial and never trips a test that only asserts on the message.\n*/\n/**\n* Run a guard outside `mount`, converting its `ApiError` into the `HttpError`\n* SvelteKit needs to produce a real status. Needed by page loads and by API\n* routes that build their own `Response` instead of going through `mount`,\n* since those never reach `mapAppError`.\n*/\nasync function asHttpError(run) {\n\ttry {\n\t\treturn await run();\n\t} catch (err) {\n\t\tif (isApiError(err)) throw error(err.status, {\n\t\t\tmessage: err.message,\n\t\t\tcode: err.code,\n\t\t\tfields: err.fields\n\t\t});\n\t\tthrow err;\n\t}\n}\nfunction assertPagePermission(locals, permission) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tif (!hasPermission(ctx, permission)) redirect(303, \"/admin\");\n\treturn user;\n}\nvar assertManageInstanceUsers = (locals) => assertPagePermission(locals, \"manage_instance_users\");\nvar assertManageCompute = (locals) => assertPagePermission(locals, \"manage_compute\");\n/**\n* Gate for pages reachable by any platform-class permission holder (the\n* `/admin` shell — `instance_admin`, `manage_compute`, `manage_instance_users`,\n* or `manage_updates` all qualify). Org-scope permissions never admit entry:\n* org admins do not belong on platform-scoped surfaces.\n*/\nfunction assertAnyPlatformPermission(locals) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tif (!ALL_PLATFORM_PERMISSIONS.some((p) => hasPermission(ctx, p))) redirect(303, \"/library\");\n\treturn user;\n}\n//#endregion\nexport { assertPagePermission as a, assertManageInstanceUsers as i, assertAnyPlatformPermission as n, assertManageCompute as r, asHttpError as t };\n"],"names":[],"mappings":";;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,WAAW,CAAC,GAAG,EAAE;AAChC,CAAC,IAAI;AACL,EAAE,OAAO,MAAM,GAAG,EAAE;AACpB,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE;AAC/C,GAAG,OAAO,EAAE,GAAG,CAAC,OAAO;AACvB,GAAG,IAAI,EAAE,GAAG,CAAC,IAAI;AACjB,GAAG,MAAM,EAAE,GAAG,CAAC;AACf,GAAG,CAAC;AACJ,EAAE,MAAM,GAAG;AACX,CAAC;AACD;AACA,SAAS,oBAAoB,CAAC,MAAM,EAAE,UAAU,EAAE;AAClD,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;AAC7D,CAAC,OAAO,IAAI;AACZ;AACG,IAAC,yBAAyB,GAAG,CAAC,MAAM,KAAK,oBAAoB,CAAC,MAAM,EAAE,uBAAuB;AAC7F,IAAC,mBAAmB,GAAG,CAAC,MAAM,KAAK,oBAAoB,CAAC,MAAM,EAAE,gBAAgB;AACnF;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,2BAA2B,CAAC,MAAM,EAAE;AAC7C,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;AAC5F,CAAC,OAAO,IAAI;AACZ;;;;"}

package/build/server/chunks/chunks/api-errors.js-WdfUbt0r.js

@@ -1,83 +0,0 @@
-import { P as ProviderError } from './src.js-Cf1j97Z6.js';
-import { r as renderThrown } from './definitions.js-CqxzwiLn.js';
-import { e as isApiError, S as SchemaExtractionError } from './access.js-BcvkxfjS.js';
-import { C as ComputeServerUnconfiguredError } from './api.js-DErw1H-D.js';
-import 'node:dns/promises';
-import 'node:net';
-import { error, isHttpError } from '@sveltejs/kit';
-
-//#region src/lib/server/api-errors.ts
-/** Stable, machine-readable error codes. Append-only — never renumber/rename. */
-var ApiErrorCode = {
-	VALIDATION_FAILED: "VALIDATION_FAILED",
-	UNAUTHORIZED: "UNAUTHORIZED",
-	FORBIDDEN: "FORBIDDEN",
-	NOT_FOUND: "NOT_FOUND",
-	CONFLICT: "CONFLICT",
-	UNPROCESSABLE: "UNPROCESSABLE",
-	COMPUTE_UNAVAILABLE: "COMPUTE_UNAVAILABLE",
-	SETUP_REQUIRED: "SETUP_REQUIRED",
-	INTERNAL: "INTERNAL"
-};
-/**
-* Thin wrapper over SvelteKit's `error()` that forces the `{ message, code }`
-* envelope. Use instead of `error(status, 'message string')` so every error
-* carries a code.
-*/
-function apiError(status, code, message, fields) {
-	throw error(status, fields ? {
-		message,
-		code,
-		fields
-	} : {
-		message,
-		code
-	});
-}
-/** Default code for a given HTTP status, used when mapping opaque errors. */
-function codeForStatus(status) {
-	switch (status) {
-		case 400: return ApiErrorCode.VALIDATION_FAILED;
-		case 401: return ApiErrorCode.UNAUTHORIZED;
-		case 403: return ApiErrorCode.FORBIDDEN;
-		case 404: return ApiErrorCode.NOT_FOUND;
-		case 409: return ApiErrorCode.CONFLICT;
-		case 422: return ApiErrorCode.UNPROCESSABLE;
-		case 503: return ApiErrorCode.COMPUTE_UNAVAILABLE;
-		default: return ApiErrorCode.INTERNAL;
-	}
-}
-var UNIQUE_CONSTRAINT_MESSAGES = {
-	projects_org_name_unique: "A project with that name already exists in this organization.",
-	projects_org_id_slug_key: "A project with that name already exists in this organization.",
-	orgs_slug_key: "An organization with that slug already exists.",
-	definitions_pkey: "A definition with that ID already exists."
-};
-function friendlyConstraintMessage(raw) {
-	for (const [name, msg] of Object.entries(UNIQUE_CONSTRAINT_MESSAGES)) if (raw.includes(name)) return msg;
-	return null;
-}
-/** Normalizes any error raised inside an API handler to a structured SvelteKit HTTP error. */
-function handleApiError(err, fallback, log) {
-	if (isHttpError(err)) throw err;
-	if (isApiError(err)) apiError(err.status, err.code, err.message, err.fields);
-	if (err instanceof SchemaExtractionError) {
-		if (err.kind === "unreachable" || err.kind === "malformed") apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, err.message);
-		apiError(422, ApiErrorCode.UNPROCESSABLE, err.message);
-	}
-	if (err instanceof ComputeServerUnconfiguredError) apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, err.message);
-	if (err instanceof ProviderError) {
-		const friendly = friendlyConstraintMessage(err.message);
-		apiError(err.statusCode, codeForStatus(err.statusCode), friendly ?? err.message);
-	}
-	const rendered = renderThrown(err);
-	if (log) log.error(`[API] ${fallback}`, {
-		component: "api",
-		err: rendered
-	});
-	else console.error(`[API] ${fallback}:`, rendered);
-	apiError(500, ApiErrorCode.INTERNAL, fallback);
-}
-
-export { ApiErrorCode as A, apiError as a, handleApiError as h };
-//# sourceMappingURL=api-errors.js-WdfUbt0r.js.map

package/build/server/chunks/chunks/api-errors.js-WdfUbt0r.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"api-errors.js-WdfUbt0r.js","sources":["../../../../.svelte-kit/output/server/chunks/api-errors.js"],"sourcesContent":["import { i as ProviderError } from \"./src.js\";\nimport { l as renderThrown } from \"./definitions.js\";\nimport { D as SchemaExtractionError, F as isApiError } from \"./access.js\";\nimport { _ as ComputeServerUnconfiguredError } from \"./api.js\";\nimport \"./compute.js\";\nimport { error, isHttpError } from \"@sveltejs/kit\";\n//#region src/lib/server/api-errors.ts\n/** Stable, machine-readable error codes. Append-only — never renumber/rename. */\nvar ApiErrorCode = {\n\tVALIDATION_FAILED: \"VALIDATION_FAILED\",\n\tUNAUTHORIZED: \"UNAUTHORIZED\",\n\tFORBIDDEN: \"FORBIDDEN\",\n\tNOT_FOUND: \"NOT_FOUND\",\n\tCONFLICT: \"CONFLICT\",\n\tUNPROCESSABLE: \"UNPROCESSABLE\",\n\tCOMPUTE_UNAVAILABLE: \"COMPUTE_UNAVAILABLE\",\n\tSETUP_REQUIRED: \"SETUP_REQUIRED\",\n\tINTERNAL: \"INTERNAL\"\n};\n/**\n* Thin wrapper over SvelteKit's `error()` that forces the `{ message, code }`\n* envelope. Use instead of `error(status, 'message string')` so every error\n* carries a code.\n*/\nfunction apiError(status, code, message, fields) {\n\tthrow error(status, fields ? {\n\t\tmessage,\n\t\tcode,\n\t\tfields\n\t} : {\n\t\tmessage,\n\t\tcode\n\t});\n}\n/** Default code for a given HTTP status, used when mapping opaque errors. */\nfunction codeForStatus(status) {\n\tswitch (status) {\n\t\tcase 400: return ApiErrorCode.VALIDATION_FAILED;\n\t\tcase 401: return ApiErrorCode.UNAUTHORIZED;\n\t\tcase 403: return ApiErrorCode.FORBIDDEN;\n\t\tcase 404: return ApiErrorCode.NOT_FOUND;\n\t\tcase 409: return ApiErrorCode.CONFLICT;\n\t\tcase 422: return ApiErrorCode.UNPROCESSABLE;\n\t\tcase 503: return ApiErrorCode.COMPUTE_UNAVAILABLE;\n\t\tdefault: return ApiErrorCode.INTERNAL;\n\t}\n}\nvar UNIQUE_CONSTRAINT_MESSAGES = {\n\tprojects_org_name_unique: \"A project with that name already exists in this organization.\",\n\tprojects_org_id_slug_key: \"A project with that name already exists in this organization.\",\n\torgs_slug_key: \"An organization with that slug already exists.\",\n\tdefinitions_pkey: \"A definition with that ID already exists.\"\n};\nfunction friendlyConstraintMessage(raw) {\n\tfor (const [name, msg] of Object.entries(UNIQUE_CONSTRAINT_MESSAGES)) if (raw.includes(name)) return msg;\n\treturn null;\n}\n/** Normalizes any error raised inside an API handler to a structured SvelteKit HTTP error. */\nfunction handleApiError(err, fallback, log) {\n\tif (isHttpError(err)) throw err;\n\tif (isApiError(err)) apiError(err.status, err.code, err.message, err.fields);\n\tif (err instanceof SchemaExtractionError) {\n\t\tif (err.kind === \"unreachable\" || err.kind === \"malformed\") apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, err.message);\n\t\tapiError(422, ApiErrorCode.UNPROCESSABLE, err.message);\n\t}\n\tif (err instanceof ComputeServerUnconfiguredError) apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, err.message);\n\tif (err instanceof ProviderError) {\n\t\tconst friendly = friendlyConstraintMessage(err.message);\n\t\tapiError(err.statusCode, codeForStatus(err.statusCode), friendly ?? err.message);\n\t}\n\tconst rendered = renderThrown(err);\n\tif (log) log.error(`[API] ${fallback}`, {\n\t\tcomponent: \"api\",\n\t\terr: rendered\n\t});\n\telse console.error(`[API] ${fallback}:`, rendered);\n\tapiError(500, ApiErrorCode.INTERNAL, fallback);\n}\n//#endregion\nexport { apiError as n, handleApiError as r, ApiErrorCode as t };\n"],"names":[],"mappings":";;;;;;;;AAMA;AACA;AACG,IAAC,YAAY,GAAG;AACnB,CAAC,iBAAiB,EAAE,mBAAmB;AACvC,CAAC,YAAY,EAAE,cAAc;AAC7B,CAAC,SAAS,EAAE,WAAW;AACvB,CAAC,SAAS,EAAE,WAAW;AACvB,CAAC,QAAQ,EAAE,UAAU;AACrB,CAAC,aAAa,EAAE,eAAe;AAC/B,CAAC,mBAAmB,EAAE,qBAAqB;AAC3C,CAAC,cAAc,EAAE,gBAAgB;AACjC,CAAC,QAAQ,EAAE;AACX;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE;AACjD,CAAC,MAAM,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG;AAC9B,EAAE,OAAO;AACT,EAAE,IAAI;AACN,EAAE;AACF,EAAE,GAAG;AACL,EAAE,OAAO;AACT,EAAE;AACF,EAAE,CAAC;AACH;AACA;AACA,SAAS,aAAa,CAAC,MAAM,EAAE;AAC/B,CAAC,QAAQ,MAAM;AACf,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,iBAAiB;AACjD,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,YAAY;AAC5C,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,SAAS;AACzC,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,SAAS;AACzC,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,QAAQ;AACxC,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,aAAa;AAC7C,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,mBAAmB;AACnD,EAAE,SAAS,OAAO,YAAY,CAAC,QAAQ;AACvC;AACA;AACA,IAAI,0BAA0B,GAAG;AACjC,CAAC,wBAAwB,EAAE,+DAA+D;AAC1F,CAAC,wBAAwB,EAAE,+DAA+D;AAC1F,CAAC,aAAa,EAAE,gDAAgD;AAChE,CAAC,gBAAgB,EAAE;AACnB,CAAC;AACD,SAAS,yBAAyB,CAAC,GAAG,EAAE;AACxC,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG;AACzG,CAAC,OAAO,IAAI;AACZ;AACA;AACA,SAAS,cAAc,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE;AAC5C,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG;AAChC,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC;AAC7E,CAAC,IAAI,GAAG,YAAY,qBAAqB,EAAE;AAC3C,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,GAAG,CAAC,OAAO,CAAC;AAC1H,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC;AACxD,CAAC;AACD,CAAC,IAAI,GAAG,YAAY,8BAA8B,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,GAAG,CAAC,OAAO,CAAC;AAChH,CAAC,IAAI,GAAG,YAAY,aAAa,EAAE;AACnC,EAAE,MAAM,QAAQ,GAAG,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC;AACzD,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC;AAClF,CAAC;AACD,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC;AACnC,CAAC,IAAI,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE;AACzC,EAAE,SAAS,EAAE,KAAK;AAClB,EAAE,GAAG,EAAE;AACP,EAAE,CAAC;AACH,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;AACnD,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC;AAC/C;;;;"}

package/build/server/chunks/chunks/api.js-DErw1H-D.js

@@ -1,321 +0,0 @@
-import { d as ProjectVisibilitySchema, e as ProjectRoleSchema, f as PlatformPermissionSchema, O as OrgPermissionSchema, g as OrgRoleSchema, a as ALL_ORG_PERMISSIONS, P as ProviderError } from './src.js-Cf1j97Z6.js';
-import { N as NoopEventSink, i as isFlagEnabled, S as SchemaExtractionError, A as ApiError, b as ApiErrorCode, d as codeForStatus } from './access.js-BcvkxfjS.js';
-import { z } from 'zod';
-
-//#region ../server/src/api/deps.ts
-/**
-* Everything an API handler talks to, as one injected value.
-*
-* Handlers used to reach module-global getters (`getProjectProvider()`,
-* `getDefinitionService()`, …) from the Selva app's composition root — 77 call
-* sites across the v1 routes. That welded them to one app's boot: a second app
-* on a different provider set (parafa, on Supabase) could not call them at all.
-*
-* Most fields are sub-stores of `IDataProvider`, so a host that already built a
-* `SelvaConfig` gets them via `depsFromConfig`. `services` stays host-defined:
-* `DefinitionService` and friends are composed rather than resolved, and a host
-* may supply its own.
-*/
-/**
-* Build deps from a resolved `SelvaConfig`, plus whatever services and token
-* codecs the host composed on top. The hoisted fields are aliases into `data`,
-* not copies.
-*
-* `services` stays positional — every existing caller passes it there — and
-* `tokens` arrives in an options object rather than as a third positional, so
-* the two composed bags cannot be swapped at a call site.
-*/
-function depsFromConfig(config, services = {}, { tokens = {}, uploadLimits, evictComputeClient = () => {}, notifications, instanceName = "Selva" } = {}) {
-	const { data } = config;
-	return {
-		auth: config.auth,
-		storage: config.storage,
-		data,
-		orgs: data.orgs,
-		projects: data.projects,
-		definitionMeta: data.definitions,
-		computeServer: data.computeServer,
-		userProfile: data.userProfile,
-		shareLinks: data.shareLinks,
-		invites: data.invites,
-		permissions: data.permissions,
-		platformProjectGrants: data.platformProjectGrants,
-		events: config.events ?? new NoopEventSink(),
-		flag: (name) => isFlagEnabled(config, name),
-		tokens,
-		uploadLimits: {
-			maxDefinitionFileSize: uploadLimits?.maxDefinitionFileSize ?? 52428800,
-			maxImageFileSize: uploadLimits?.maxImageFileSize ?? 10485760
-		},
-		evictComputeClient,
-		notifications,
-		instanceName,
-		services
-	};
-}
-//#endregion
-//#region ../server/src/compute/errors.ts
-/**
-* Compute error types, kept in a leaf module with no imports.
-*
-* Separate from the function that throws them on purpose: an error mapper needs
-* nothing but the class to `instanceof` against, and importing it from beside
-* the throw site drags that module's dependencies into every mapper. Anything
-* an error mapper imports belongs here.
-*/
-/**
-* Thrown when no compute server is configured or visible for the org — a
-* misconfiguration an operator must fix in `/admin/compute`, not a bug. Routes
-* map this to 503 instead of letting the pure helper's plain `Error` surface as
-* a generic 500.
-*/
-var ComputeServerUnconfiguredError = class extends Error {
-	constructor(message = "No compute server configured. Ask an admin to add one in /admin/compute.") {
-		super(message);
-		this.name = "ComputeServerUnconfiguredError";
-	}
-};
-//#endregion
-//#region ../server/src/api/map-core-error.ts
-/**
-* The domain errors this package's own handlers raise, folded into the envelope.
-*
-* A host's `mapError` should call this first and add only its own error types.
-* These rules cannot live solely in a host: the handler that throws them ships
-* from here, so a host that forgot one would serve 500 where every other host
-* serves 503 — the same API answering differently depending on who mounted it.
-*
-* Postgres surfaces a unique-constraint name verbatim, which is useless to an
-* end user, so the constraints this package's handlers can trip are translated
-* here rather than left to each host.
-*/
-var UNIQUE_CONSTRAINT_MESSAGES = {
-	projects_org_name_unique: "A project with that name already exists in this organization.",
-	projects_org_id_slug_key: "A project with that name already exists in this organization.",
-	orgs_slug_key: "An organization with that slug already exists.",
-	definitions_pkey: "A definition with that ID already exists."
-};
-function friendlyConstraintMessage(raw) {
-	for (const [name, msg] of Object.entries(UNIQUE_CONSTRAINT_MESSAGES)) if (raw.includes(name)) return msg;
-	return null;
-}
-/**
-* Compute unreachable or serving an unreadable schema is operator-side (503); a
-* schema the parser cannot read is the caller's file (422).
-*/
-function mapCoreError(err) {
-	if (err instanceof SchemaExtractionError) return err.kind === "unreachable" || err.kind === "malformed" ? new ApiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, err.message) : new ApiError(422, ApiErrorCode.UNPROCESSABLE, err.message);
-	if (err instanceof ComputeServerUnconfiguredError) return new ApiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, err.message);
-	if (err instanceof ProviderError) {
-		const friendly = friendlyConstraintMessage(err.message);
-		return new ApiError(err.statusCode, codeForStatus(err.statusCode), friendly ?? err.message);
-	}
-}
-//#endregion
-//#region ../server/src/api/pagination.ts
-/**
-* Query-param parsing for the list pagination contract:
-* `?limit=&cursor=&orderBy=&orderDir=` → `{ items, nextCursor? }`.
-*
-* Every list endpoint parses these identically, so the clamping lives here
-* rather than inline per handler — a handler that clamps differently publishes
-* a different contract under the same documented one, and nothing fails at
-* build time.
-*/
-/**
-* An unparseable or out-of-range `limit` clamps rather than 400s: pagination
-* params are plumbing, and failing a read over one is hostile to clients
-* walking a cursor.
-*/
-function parseListOptions(url) {
-	const raw = Number(url.searchParams.get("limit") ?? 50);
-	const limit = Number.isFinite(raw) ? Math.min(Math.max(Math.trunc(raw), 1), 200) : 50;
-	const orderByRaw = url.searchParams.get("orderBy");
-	const orderBy = orderByRaw === "createdAt" || orderByRaw === "updatedAt" || orderByRaw === "name" ? orderByRaw : void 0;
-	return {
-		limit,
-		cursor: url.searchParams.get("cursor") ?? void 0,
-		orderBy,
-		orderDir: url.searchParams.get("orderDir") === "asc" ? "asc" : void 0
-	};
-}
-/** `parseListOptions` plus the definition-only `solveCount` ordering. */
-function parseDefinitionListOptions(url) {
-	const base = parseListOptions(url);
-	if (url.searchParams.get("orderBy") === "solveCount") return {
-		...base,
-		orderBy: "solveCount"
-	};
-	return base;
-}
-//#endregion
-//#region ../server/src/api/bodies.ts
-/**
-* Request-body validators for the API routes that take JSON.
-*
-* They live apart from their handlers so a spec generator can import them
-* without loading a host's route module — in Selva's case a `+server.ts` imports
-* `./$types`, which only resolves inside a SvelteKit build.
-*
-* **A JSON body accepted by an API route belongs in this file.** Adding one
-* inline is invisible to the generator, so the endpoint documents an empty body.
-* Multipart handlers are the exception — `FormData` has no Zod schema to derive
-* from, so their fields are described in the spec directly.
-*/
-var SolveBodySchema = z.object({
-	inputs: z.array(z.unknown()).default([]),
-	values: z.record(z.string(), z.unknown()).default({}),
-	channel: z.enum(["live", "draft"]).default("live"),
-	versionId: z.string().optional(),
-	/** Must name this same definition, or the route 400s instead of solving a different one. */
-	definitionUrl: z.string().optional()
-});
-var CreateProjectBodySchema = z.object({
-	name: z.string().min(1, "Project name is required").max(128).trim(),
-	description: z.string().max(2e3).optional(),
-	visibility: ProjectVisibilitySchema.default("private"),
-	autoJoinOnUpload: z.boolean().optional()
-});
-var UpdateProjectBodySchema = z.object({
-	name: z.string().min(1).max(128).trim(),
-	description: z.string().max(2e3).nullish(),
-	visibility: ProjectVisibilitySchema,
-	autoJoinOnUpload: z.boolean()
-}).partial();
-var AddProjectMemberBodySchema = z.object({
-	userId: z.string().min(1, "userId is required"),
-	role: ProjectRoleSchema
-});
-var UpdateProjectMemberBodySchema = z.object({ role: ProjectRoleSchema });
-/** Platform-scope entries are dropped downstream — an invite only grants org rights. */
-var FlatPermissionSchema = z.union([PlatformPermissionSchema, OrgPermissionSchema]);
-var CreateInviteBodySchema = z.object({
-	email: z.email("Valid email is required").transform((s) => s.toLowerCase().trim()),
-	orgRole: OrgRoleSchema.default("member"),
-	permissions: z.array(FlatPermissionSchema).default([])
-});
-/**
-* `apiKey` is tri-state: **omitted** keeps the stored key, **null** clears it, a
-* string replaces it. `.optional().nullable()` — not `.nullish()` — because the
-* two must stay distinguishable after parsing, or a request that just omits the
-* field would silently wipe the stored credential.
-*/
-var IncomingComputeServerSchema = z.object({
-	id: z.string().min(1),
-	label: z.string().min(1),
-	serverUrl: z.string().min(1),
-	apiKey: z.string().nullable().optional(),
-	timeoutMs: z.number().optional(),
-	retryCount: z.number().optional()
-});
-var OrgComputePatchBodySchema = z.object({
-	servers: z.array(IncomingComputeServerSchema),
-	/** May name any server visible to the org. `null` clears the override; omitted leaves it untouched. */
-	defaultServerId: z.string().nullable().optional()
-});
-var UpdateOrgMemberBodySchema = z.object({
-	role: OrgRoleSchema.optional(),
-	permissions: z.array(z.enum(ALL_ORG_PERMISSIONS)).optional()
-}).refine((b) => b.role !== void 0 || b.permissions !== void 0, { message: "Provide at least one of role, permissions" });
-//#endregion
-//#region ../server/src/api/responses-schema.ts
-/**
-* Response schemas for the v1 payloads that must not carry a stored secret.
-*
-* Three store types hold a credential next to fields a client legitimately
-* reads: `ShareLink.tokenHash` and `Invite.tokenHash` are HMACs of a token,
-* `ComputeServerCommon.apiKey` is a live Rhino.Compute key. Handlers used to
-* strip them by destructuring — `const { tokenHash: _omit, ...rest } = invite`
-* — which works until someone adds a field to the stored type or edits the line
-* away. Nothing fails at build time; the credential just starts appearing in a
-* response.
-*
-* Parsing through these schemas inverts the default: the response carries only
-* what the schema names, so a new field on the stored type is invisible to
-* clients until added here on purpose. Use them via `shaped`/`shapedCollection`
-* in `./route.ts`.
-*
-* These describe **responses**, not stored records — where the two differ (an
-* invite's one-time `acceptUrl`, a share link's `hasToken` sentinel) the
-* response is the authority.
-*/
-var ShareLinkResponseSchema = z.object({
-	id: z.string(),
-	definitionId: z.string(),
-	channel: z.enum(["live", "draft"]),
-	name: z.string().optional(),
-	createdBy: z.string(),
-	createdAt: z.string(),
-	expiresAt: z.string().nullish(),
-	revokedAt: z.string().nullish(),
-	allowSolve: z.boolean(),
-	maxSolves: z.number().nullish(),
-	solveCount: z.number(),
-	/** Sentinel replacing `tokenHash`: a token exists, its hash is not yours. */
-	hasToken: z.literal(true)
-});
-/** The mint response. `token` is the plaintext, returned exactly once. */
-var CreatedShareLinkResponseSchema = z.object({
-	link: ShareLinkResponseSchema,
-	token: z.string()
-});
-var InviteResponseSchema = z.object({
-	id: z.string(),
-	email: z.string(),
-	orgId: z.string(),
-	orgRole: z.string(),
-	orgPermissions: z.array(z.string()),
-	platformPermissions: z.array(z.string()).default([]),
-	invitedBy: z.string(),
-	createdAt: z.string(),
-	expiresAt: z.string(),
-	acceptedAt: z.string().optional(),
-	acceptedByUserId: z.string().optional()
-});
-/**
-* The create response: the invite plus the link to send, built per request.
-*
-* `acceptUrl` is returned whatever `delivery` says — mail is best-effort, and
-* manual sharing is the fallback when it is off or the send failed.
-*/
-var CreatedInviteResponseSchema = InviteResponseSchema.extend({
-	acceptUrl: z.string(),
-	delivery: z.enum([
-		"sent",
-		"not-configured",
-		"failed"
-	])
-});
-/**
-* An org-owned compute server. `apiKey` is replaced by `hasApiKey`, so a picker
-* can render "key set" without any store decrypting a secret to throw away.
-*/
-var OrgComputeServerResponseSchema = z.object({
-	id: z.string(),
-	label: z.string(),
-	serverUrl: z.string(),
-	scope: z.literal("org"),
-	ownerOrgId: z.string(),
-	timeoutMs: z.number().optional(),
-	retryCount: z.number().optional(),
-	hasApiKey: z.boolean()
-});
-/** A server this org may select but not edit. Never carries a key either. */
-var ComputeCatalogEntrySchema = z.object({
-	id: z.string(),
-	label: z.string(),
-	serverUrl: z.string(),
-	scope: z.enum(["platform", "org"]),
-	source: z.enum(["platform", "org"]),
-	timeoutMs: z.number().optional(),
-	retryCount: z.number().optional()
-});
-var OrgComputeResponseSchema = z.object({
-	servers: z.array(OrgComputeServerResponseSchema),
-	defaultServerId: z.string().nullish(),
-	globalDefaultServerId: z.string().nullish(),
-	catalog: z.array(ComputeCatalogEntrySchema)
-});
-
-export { AddProjectMemberBodySchema as A, ComputeServerUnconfiguredError as C, InviteResponseSchema as I, OrgComputePatchBodySchema as O, SolveBodySchema as S, UpdateProjectBodySchema as U, CreateProjectBodySchema as a, UpdateProjectMemberBodySchema as b, UpdateOrgMemberBodySchema as c, CreateInviteBodySchema as d, depsFromConfig as e, parseListOptions as f, ShareLinkResponseSchema as g, CreatedShareLinkResponseSchema as h, OrgComputeResponseSchema as i, CreatedInviteResponseSchema as j, mapCoreError as m, parseDefinitionListOptions as p };
-//# sourceMappingURL=api.js-DErw1H-D.js.map