npm - @selvajs/selva - Versions diffs - 4.17.1 → 4.18.0 - Mend

@selvajs/selva 4.17.1 → 4.18.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1772) hide show

package/build/server/chunks/entries/endpoints/docs/api/openapi.yaml/_server.ts.js-Ds38ZE4x.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"_server.ts.js-Ds38ZE4x.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/docs/api/openapi.yaml/_server.ts.js"],"sourcesContent":["//#region openapi/v1.yaml?raw\nvar v1_default = \"# Generated from the Zod validators and the route registry in\\n# src/lib/server/api/v1/. Do not edit by hand — `pnpm test` fails when this\\n# file drifts from the code. Regenerate with `pnpm openapi:generate`.\\nopenapi: \\\"3.1.0\\\"\\ninfo:\\n title: Selva API\\n version: \\\"1.0.0\\\"\\n description: \\\"The tenant-scoped Selva API. Every endpoint acts as the calling identity and is confined to that identity's organization.\\\\n\\\\n**Stability.** Public endpoints are additive-only within v1: new optional fields and parameters may appear, but nothing is removed, renamed, or changed in type or meaning. A breaking change ships as a new route under `/api/v2` alongside this one. Anything deprecated inside v1 keeps working for a stated window and returns a `Deprecation` header while it does.\\\\n\\\\n**Operations marked `x-internal` carry none of that promise.** They exist to serve the Selva web UI and may change or disappear without notice.\\\\n\\\\n**Existence is never disclosed.** A resource the caller may not see returns `404`, not `403`. `403` means the resource is visible but the action is not allowed.\\\\n\\\\n**No CORS.** `/api/v1` sends no cross-origin headers; it serves same-origin browser requests and non-browser clients holding a token.\\\\n\\\\nInstance administration lives at `/api/admin`, is session-only, is never reachable with a bearer token, and is not described here.\\\"\\n license:\\n name: MIT\\nservers:\\n - url: /\\n description: The Selva instance serving this document.\\nsecurity:\\n - cookieAuth: []\\n - bearerAuth: []\\ncomponents:\\n securitySchemes:\\n cookieAuth:\\n type: apiKey\\n in: cookie\\n name: session\\n description: Browser session cookie. Same-origin only.\\n bearerAuth:\\n type: http\\n scheme: bearer\\n description: \\\"A personal access token. `/api/v1` is the only prefix that accepts one — `/api/admin` never does.\\\"\\n parameters:\\n limit:\\n name: limit\\n in: query\\n required: false\\n description: \\\"Page size. Out-of-range values clamp rather than fail, so a client walking a cursor is never stopped by pagination plumbing. Default 50.\\\"\\n schema:\\n type: integer\\n minimum: 1\\n maximum: 200\\n cursor:\\n name: cursor\\n in: query\\n required: false\\n description: \\\"An opaque cursor from a previous response's `nextCursor`. Do not construct or parse one.\\\"\\n schema:\\n type: string\\n orderBy:\\n name: orderBy\\n in: query\\n required: false\\n schema:\\n type: string\\n enum:\\n - createdAt\\n - updatedAt\\n - name\\n orderDir:\\n name: orderDir\\n in: query\\n required: false\\n schema:\\n type: string\\n enum:\\n - asc\\n - desc\\n schemas:\\n Page:\\n type: object\\n description: \\\"The envelope every collection returns. `nextCursor` is absent on the last page.\\\"\\n properties:\\n items:\\n type: array\\n items:\\n type: object\\n nextCursor:\\n type: string\\n required:\\n - items\\n Error:\\n type: object\\n description: \\\"Every failure carries this shape. Branch on `code`, not on the human-readable `message`.\\\"\\n properties:\\n message:\\n type: string\\n code:\\n type: string\\n enum:\\n - VALIDATION_FAILED\\n - UNAUTHORIZED\\n - FORBIDDEN\\n - NOT_FOUND\\n - CONFLICT\\n - UNPROCESSABLE\\n - COMPUTE_UNAVAILABLE\\n - SETUP_REQUIRED\\n - INTERNAL\\n fields:\\n type: object\\n description: \\\"Per-field messages, keyed by dotted path. Present on validation failures.\\\"\\n additionalProperties:\\n type: string\\n required:\\n - message\\n - code\\npaths:\\n /api/v1/me:\\n get:\\n summary: \\\"The calling identity, its acting org, and its effective permissions.\\\"\\n operationId: getMe\\n tags:\\n - Me\\n responses:\\n \\\"200\\\":\\n description: Success.\\n content:\\n application/json:\\n schema:\\n type: object\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"/api/v1/me/starred/{guid}\\\":\\n put:\\n summary: Star a definition. Idempotent.\\n operationId: putMeStarredByGuid\\n tags:\\n - Me\\n parameters:\\n - name: guid\\n in: path\\n required: true\\n schema:\\n type: string\\n responses:\\n \\\"204\\\":\\n description: Success. No content.\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"404\\\":\\n description: \\\"No such resource, or the caller cannot see it.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n delete:\\n summary: Unstar a definition. Idempotent.\\n operationId: deleteMeStarredByGuid\\n tags:\\n - Me\\n parameters:\\n - name: guid\\n in: path\\n required: true\\n schema:\\n type: string\\n responses:\\n \\\"204\\\":\\n description: Success. No content.\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n /api/v1/definitions:\\n get:\\n summary: List definitions the caller can see.\\n operationId: getDefinitions\\n tags:\\n - Definitions\\n parameters:\\n - $ref: \\\"#/components/parameters/limit\\\"\\n - $ref: \\\"#/components/parameters/cursor\\\"\\n - $ref: \\\"#/components/parameters/orderBy\\\"\\n - $ref: \\\"#/components/parameters/orderDir\\\"\\n - name: projectId\\n in: query\\n required: false\\n description: Restrict to one project.\\n schema:\\n type: string\\n - name: status\\n in: query\\n required: false\\n description: \\\"One of `draft`, `published`, `archived`.\\\"\\n schema:\\n type: string\\n responses:\\n \\\"200\\\":\\n description: A page of results.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Page\\\"\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n post:\\n summary: Create a definition from a Grasshopper file.\\n operationId: postDefinitions\\n tags:\\n - Definitions\\n requestBody:\\n required: true\\n content:\\n multipart/form-data:\\n schema:\\n type: object\\n properties:\\n file:\\n type: string\\n description: \\\"The `.gh` or `.ghx` file.\\\"\\n projectId:\\n type: string\\n description: Owning project.\\n displayName:\\n type: string\\n description: Human-readable name.\\n description:\\n type: string\\n description: Long description.\\n category:\\n type: string\\n description: Grouping label.\\n tags:\\n type: string\\n description: Comma-separated tags.\\n image:\\n type: string\\n description: Cover image.\\n computeServerId:\\n type: string\\n description: Pin to a compute server.\\n required:\\n - file\\n - projectId\\n - displayName\\n responses:\\n \\\"201\\\":\\n description: Success.\\n content:\\n application/json:\\n schema:\\n type: object\\n \\\"400\\\":\\n description: Validation failed.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"403\\\":\\n description: \\\"Authenticated, but not permitted to perform this action.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"422\\\":\\n description: Well-formed but not processable.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"503\\\":\\n description: The compute server is unconfigured or unreachable.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"/api/v1/definitions/{guid}\\\":\\n get:\\n summary: Definition record plus its live and draft version summaries.\\n operationId: getDefinitionsByGuid\\n tags:\\n - Definitions\\n parameters:\\n - name: guid\\n in: path\\n required: true\\n schema:\\n type: string\\n responses:\\n \\\"200\\\":\\n description: Success.\\n content:\\n application/json:\\n schema:\\n type: object\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"404\\\":\\n description: \\\"No such resource, or the caller cannot see it.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n patch:\\n summary: Update definition metadata.\\n operationId: patchDefinitionsByGuid\\n tags:\\n - Definitions\\n parameters:\\n - name: guid\\n in: path\\n required: true\\n schema:\\n type: string\\n responses:\\n \\\"204\\\":\\n description: Success. No content.\\n \\\"400\\\":\\n description: Validation failed.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"404\\\":\\n description: \\\"No such resource, or the caller cannot see it.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n delete:\\n summary: Soft-delete a definition.\\n operationId: deleteDefinitionsByGuid\\n tags:\\n - Definitions\\n parameters:\\n - name: guid\\n in: path\\n required: true\\n schema:\\n type: string\\n responses:\\n \\\"204\\\":\\n description: Success. No content.\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"404\\\":\\n description: \\\"No such resource, or the caller cannot see it.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"/api/v1/definitions/{guid}/solve\\\":\\n post:\\n summary: Solve a definition. The primary action of the API.\\n operationId: postDefinitionsByGuidSolve\\n tags:\\n - Definitions\\n parameters:\\n - name: guid\\n in: path\\n required: true\\n schema:\\n type: string\\n - name: Idempotency-Key\\n in: header\\n required: false\\n description: \\\"A client-chosen key. Repeating a request with the same key within the retention window replays the first response instead of solving again; the replay carries `Idempotency-Replayed: true`. The store is per-process and in-memory — it absorbs retries, it is not a durable result cache, and it does not survive a restart or a second app instance.\\\"\\n schema:\\n type: string\\n requestBody:\\n required: true\\n content:\\n application/json:\\n schema:\\n type: object\\n properties:\\n inputs:\\n default: []\\n type: array\\n items: {}\\n values:\\n default: {}\\n type: object\\n propertyNames:\\n type: string\\n additionalProperties: {}\\n channel:\\n default: live\\n type: string\\n enum:\\n - live\\n - draft\\n versionId:\\n type: string\\n definitionUrl:\\n type: string\\n responses:\\n \\\"200\\\":\\n description: Success.\\n content:\\n application/json:\\n schema:\\n type: object\\n \\\"400\\\":\\n description: Validation failed.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"404\\\":\\n description: \\\"No such resource, or the caller cannot see it.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"429\\\":\\n description: \\\"Rate limited. Retry after the interval in `Retry-After`.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"503\\\":\\n description: The compute server is unconfigured or unreachable.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"/api/v1/definitions/{guid}/schema\\\":\\n get:\\n summary: \\\"The live version's UI schema. 404 when nothing is published.\\\"\\n operationId: getDefinitionsByGuidSchema\\n tags:\\n - Definitions\\n parameters:\\n - name: guid\\n in: path\\n required: true\\n schema:\\n type: string\\n responses:\\n \\\"200\\\":\\n description: Success.\\n content:\\n application/json:\\n schema:\\n type: object\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"404\\\":\\n description: \\\"No such resource, or the caller cannot see it.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"/api/v1/definitions/{guid}/versions\\\":\\n get:\\n summary: \\\"List versions, newest first.\\\"\\n operationId: getDefinitionsByGuidVersions\\n tags:\\n - Definitions\\n parameters:\\n - name: guid\\n in: path\\n required: true\\n schema:\\n type: string\\n - $ref: \\\"#/components/parameters/limit\\\"\\n - $ref: \\\"#/components/parameters/cursor\\\"\\n - $ref: \\\"#/components/parameters/orderBy\\\"\\n - $ref: \\\"#/components/parameters/orderDir\\\"\\n responses:\\n \\\"200\\\":\\n description: A page of results.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Page\\\"\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"404\\\":\\n description: \\\"No such resource, or the caller cannot see it.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n post:\\n summary: Upload a new version.\\n operationId: postDefinitionsByGuidVersions\\n tags:\\n - Definitions\\n parameters:\\n - name: guid\\n in: path\\n required: true\\n schema:\\n type: string\\n requestBody:\\n required: true\\n content:\\n multipart/form-data:\\n schema:\\n type: object\\n properties:\\n file:\\n type: string\\n description: \\\"The `.gh` or `.ghx` file.\\\"\\n changeNote:\\n type: string\\n description: Truncated to 1000 characters.\\n required:\\n - file\\n responses:\\n \\\"201\\\":\\n description: Success.\\n content:\\n application/json:\\n schema:\\n type: object\\n \\\"400\\\":\\n description: Validation failed.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"404\\\":\\n description: \\\"No such resource, or the caller cannot see it.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"422\\\":\\n description: Well-formed but not processable.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"503\\\":\\n description: The compute server is unconfigured or unreachable.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"/api/v1/definitions/{guid}/versions/{versionId}\\\":\\n get:\\n summary: \\\"One version, without its cached schema.\\\"\\n operationId: getDefinitionsByGuidVersionsByVersionId\\n tags:\\n - Definitions\\n parameters:\\n - name: guid\\n in: path\\n required: true\\n schema:\\n type: string\\n - name: versionId\\n in: path\\n required: true\\n schema:\\n type: string\\n responses:\\n \\\"200\\\":\\n description: Success.\\n content:\\n application/json:\\n schema:\\n type: object\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"404\\\":\\n description: \\\"No such resource, or the caller cannot see it.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n delete:\\n summary: Delete a version. 409 when it is the live or draft pointer.\\n operationId: deleteDefinitionsByGuidVersionsByVersionId\\n tags:\\n - Definitions\\n parameters:\\n - name: guid\\n in: path\\n required: true\\n schema:\\n type: string\\n - name: versionId\\n in: path\\n required: true\\n schema:\\n type: string\\n responses:\\n \\\"204\\\":\\n description: Success. No content.\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"404\\\":\\n description: \\\"No such resource, or the caller cannot see it.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"409\\\":\\n description: The request conflicts with the current state.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"/api/v1/definitions/{guid}/versions/{versionId}/schema\\\":\\n get:\\n summary: \\\"That version's cached UI schema. No compute round-trip.\\\"\\n operationId: getDefinitionsByGuidVersionsByVersionIdSchema\\n tags:\\n - Definitions\\n parameters:\\n - name: guid\\n in: path\\n required: true\\n schema:\\n type: string\\n - name: versionId\\n in: path\\n required: true\\n schema:\\n type: string\\n responses:\\n \\\"200\\\":\\n description: Success.\\n content:\\n application/json:\\n schema:\\n type: object\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"404\\\":\\n description: \\\"No such resource, or the caller cannot see it.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"/api/v1/definitions/{guid}/publish\\\":\\n post:\\n summary: Promote a version to live.\\n operationId: postDefinitionsByGuidPublish\\n tags:\\n - Definitions\\n parameters:\\n - name: guid\\n in: path\\n required: true\\n schema:\\n type: string\\n responses:\\n \\\"200\\\":\\n description: Success.\\n content:\\n application/json:\\n schema:\\n type: object\\n \\\"400\\\":\\n description: Validation failed.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"404\\\":\\n description: \\\"No such resource, or the caller cannot see it.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"/api/v1/definitions/{guid}/image\\\":\\n post:\\n summary: Upload a cover image.\\n operationId: postDefinitionsByGuidImage\\n tags:\\n - Definitions\\n parameters:\\n - name: guid\\n in: path\\n required: true\\n schema:\\n type: string\\n requestBody:\\n required: true\\n content:\\n multipart/form-data:\\n schema:\\n type: object\\n properties:\\n image:\\n type: string\\n description: \\\"PNG, JPEG, WebP or GIF.\\\"\\n required:\\n - image\\n responses:\\n \\\"200\\\":\\n description: Success.\\n content:\\n application/json:\\n schema:\\n type: object\\n \\\"400\\\":\\n description: Validation failed.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"404\\\":\\n description: \\\"No such resource, or the caller cannot see it.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"/api/v1/definitions/{guid}/share-links\\\":\\n get:\\n summary: List share links. 404 when sharing is disabled on the instance.\\n operationId: getDefinitionsByGuidShare-links\\n tags:\\n - Definitions\\n parameters:\\n - name: guid\\n in: path\\n required: true\\n schema:\\n type: string\\n - $ref: \\\"#/components/parameters/limit\\\"\\n - $ref: \\\"#/components/parameters/cursor\\\"\\n - $ref: \\\"#/components/parameters/orderBy\\\"\\n - $ref: \\\"#/components/parameters/orderDir\\\"\\n responses:\\n \\\"200\\\":\\n description: A page of results.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Page\\\"\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"404\\\":\\n description: \\\"No such resource, or the caller cannot see it.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n post:\\n summary: Create a share link. The raw token is returned once and never again.\\n operationId: postDefinitionsByGuidShare-links\\n tags:\\n - Definitions\\n parameters:\\n - name: guid\\n in: path\\n required: true\\n schema:\\n type: string\\n responses:\\n \\\"201\\\":\\n description: Success.\\n content:\\n application/json:\\n schema:\\n type: object\\n \\\"400\\\":\\n description: Validation failed.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"404\\\":\\n description: \\\"No such resource, or the caller cannot see it.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"/api/v1/definitions/{guid}/share-links/{linkId}\\\":\\n delete:\\n summary: Revoke a share link.\\n operationId: deleteDefinitionsByGuidShare-linksByLinkId\\n tags:\\n - Definitions\\n parameters:\\n - name: guid\\n in: path\\n required: true\\n schema:\\n type: string\\n - name: linkId\\n in: path\\n required: true\\n schema:\\n type: string\\n responses:\\n \\\"204\\\":\\n description: Success. No content.\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"404\\\":\\n description: \\\"No such resource, or the caller cannot see it.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n /api/v1/projects:\\n get:\\n summary: List projects the caller can view.\\n operationId: getProjects\\n tags:\\n - Projects\\n parameters:\\n - $ref: \\\"#/components/parameters/limit\\\"\\n - $ref: \\\"#/components/parameters/cursor\\\"\\n - $ref: \\\"#/components/parameters/orderBy\\\"\\n - $ref: \\\"#/components/parameters/orderDir\\\"\\n responses:\\n \\\"200\\\":\\n description: A page of results.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Page\\\"\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n post:\\n summary: Create a project.\\n operationId: postProjects\\n tags:\\n - Projects\\n requestBody:\\n required: true\\n content:\\n application/json:\\n schema:\\n type: object\\n properties:\\n name:\\n type: string\\n minLength: 1\\n maxLength: 128\\n description:\\n type: string\\n maxLength: 2000\\n visibility:\\n default: private\\n type: string\\n enum:\\n - public\\n - org\\n - private\\n - platform\\n autoJoinOnUpload:\\n type: boolean\\n required:\\n - name\\n responses:\\n \\\"201\\\":\\n description: Success.\\n content:\\n application/json:\\n schema:\\n type: object\\n \\\"400\\\":\\n description: Validation failed.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"403\\\":\\n description: \\\"Authenticated, but not permitted to perform this action.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"409\\\":\\n description: The request conflicts with the current state.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"/api/v1/projects/{id}\\\":\\n get:\\n summary: \\\"Project record plus the caller's effective role and capabilities.\\\"\\n operationId: getProjectsById\\n tags:\\n - Projects\\n parameters:\\n - name: id\\n in: path\\n required: true\\n schema:\\n type: string\\n responses:\\n \\\"200\\\":\\n description: Success.\\n content:\\n application/json:\\n schema:\\n type: object\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"404\\\":\\n description: \\\"No such resource, or the caller cannot see it.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n patch:\\n summary: Update project settings. Owner-only.\\n operationId: patchProjectsById\\n tags:\\n - Projects\\n parameters:\\n - name: id\\n in: path\\n required: true\\n schema:\\n type: string\\n requestBody:\\n required: true\\n content:\\n application/json:\\n schema:\\n type: object\\n properties:\\n name:\\n type: string\\n minLength: 1\\n maxLength: 128\\n description:\\n anyOf:\\n - type: string\\n maxLength: 2000\\n - type: \\\"null\\\"\\n visibility:\\n type: string\\n enum:\\n - public\\n - org\\n - private\\n - platform\\n autoJoinOnUpload:\\n type: boolean\\n responses:\\n \\\"204\\\":\\n description: Success. No content.\\n \\\"400\\\":\\n description: Validation failed.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"403\\\":\\n description: \\\"Authenticated, but not permitted to perform this action.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"404\\\":\\n description: \\\"No such resource, or the caller cannot see it.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"409\\\":\\n description: The request conflicts with the current state.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n delete:\\n summary: Delete a project.\\n operationId: deleteProjectsById\\n tags:\\n - Projects\\n parameters:\\n - name: id\\n in: path\\n required: true\\n schema:\\n type: string\\n responses:\\n \\\"204\\\":\\n description: Success. No content.\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"403\\\":\\n description: \\\"Authenticated, but not permitted to perform this action.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"404\\\":\\n description: \\\"No such resource, or the caller cannot see it.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"/api/v1/projects/{id}/members\\\":\\n get:\\n summary: List project members.\\n operationId: getProjectsByIdMembers\\n tags:\\n - Projects\\n parameters:\\n - name: id\\n in: path\\n required: true\\n schema:\\n type: string\\n - $ref: \\\"#/components/parameters/limit\\\"\\n - $ref: \\\"#/components/parameters/cursor\\\"\\n - $ref: \\\"#/components/parameters/orderBy\\\"\\n - $ref: \\\"#/components/parameters/orderDir\\\"\\n responses:\\n \\\"200\\\":\\n description: A page of results.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Page\\\"\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"403\\\":\\n description: \\\"Authenticated, but not permitted to perform this action.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"404\\\":\\n description: \\\"No such resource, or the caller cannot see it.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n post:\\n summary: Add a member. The target must already belong to the org.\\n operationId: postProjectsByIdMembers\\n tags:\\n - Projects\\n parameters:\\n - name: id\\n in: path\\n required: true\\n schema:\\n type: string\\n requestBody:\\n required: true\\n content:\\n application/json:\\n schema:\\n type: object\\n properties:\\n userId:\\n type: string\\n minLength: 1\\n role:\\n type: string\\n enum:\\n - owner\\n - editor\\n - viewer\\n required:\\n - userId\\n - role\\n responses:\\n \\\"201\\\":\\n description: Success.\\n content:\\n application/json:\\n schema:\\n type: object\\n \\\"400\\\":\\n description: Validation failed.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"403\\\":\\n description: \\\"Authenticated, but not permitted to perform this action.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"404\\\":\\n description: \\\"No such resource, or the caller cannot see it.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"/api/v1/projects/{id}/members/{userId}\\\":\\n patch:\\n summary: Change a member role.\\n operationId: patchProjectsByIdMembersByUserId\\n tags:\\n - Projects\\n parameters:\\n - name: id\\n in: path\\n required: true\\n schema:\\n type: string\\n - name: userId\\n in: path\\n required: true\\n schema:\\n type: string\\n requestBody:\\n required: true\\n content:\\n application/json:\\n schema:\\n type: object\\n properties:\\n role:\\n type: string\\n enum:\\n - owner\\n - editor\\n - viewer\\n required:\\n - role\\n responses:\\n \\\"204\\\":\\n description: Success. No content.\\n \\\"400\\\":\\n description: Validation failed.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"403\\\":\\n description: \\\"Authenticated, but not permitted to perform this action.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"404\\\":\\n description: \\\"No such resource, or the caller cannot see it.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"409\\\":\\n description: The request conflicts with the current state.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n delete:\\n summary: Remove a member. Idempotent.\\n operationId: deleteProjectsByIdMembersByUserId\\n tags:\\n - Projects\\n parameters:\\n - name: id\\n in: path\\n required: true\\n schema:\\n type: string\\n - name: userId\\n in: path\\n required: true\\n schema:\\n type: string\\n - name: confirm\\n in: query\\n required: false\\n description: \\\"Set to `true` to remove a co-owner; without it the call returns 409.\\\"\\n schema:\\n type: string\\n responses:\\n \\\"204\\\":\\n description: Success. No content.\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"403\\\":\\n description: \\\"Authenticated, but not permitted to perform this action.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"404\\\":\\n description: \\\"No such resource, or the caller cannot see it.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"409\\\":\\n description: The request conflicts with the current state.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"/api/v1/projects/{id}/reclaim\\\":\\n post:\\n summary: Claim ownership of an unowned project.\\n operationId: postProjectsByIdReclaim\\n tags:\\n - Projects\\n parameters:\\n - name: id\\n in: path\\n required: true\\n schema:\\n type: string\\n responses:\\n \\\"201\\\":\\n description: Success.\\n content:\\n application/json:\\n schema:\\n type: object\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"403\\\":\\n description: \\\"Authenticated, but not permitted to perform this action.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"404\\\":\\n description: \\\"No such resource, or the caller cannot see it.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"409\\\":\\n description: The request conflicts with the current state.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"/api/v1/orgs/{orgId}\\\":\\n get:\\n summary: \\\"Org record. The org must be the caller's acting org.\\\"\\n operationId: getOrgsByOrgId\\n tags:\\n - Orgs\\n parameters:\\n - name: orgId\\n in: path\\n required: true\\n schema:\\n type: string\\n responses:\\n \\\"200\\\":\\n description: Success.\\n content:\\n application/json:\\n schema:\\n type: object\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"403\\\":\\n description: \\\"Authenticated, but not permitted to perform this action.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"404\\\":\\n description: \\\"No such resource, or the caller cannot see it.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"/api/v1/orgs/{orgId}/members\\\":\\n get:\\n summary: List org members.\\n operationId: getOrgsByOrgIdMembers\\n tags:\\n - Orgs\\n parameters:\\n - name: orgId\\n in: path\\n required: true\\n schema:\\n type: string\\n - $ref: \\\"#/components/parameters/limit\\\"\\n - $ref: \\\"#/components/parameters/cursor\\\"\\n - $ref: \\\"#/components/parameters/orderBy\\\"\\n - $ref: \\\"#/components/parameters/orderDir\\\"\\n responses:\\n \\\"200\\\":\\n description: A page of results.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Page\\\"\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"403\\\":\\n description: \\\"Authenticated, but not permitted to perform this action.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"/api/v1/orgs/{orgId}/members/{userId}\\\":\\n patch:\\n summary: Change an org role or permission set. The sole owner cannot be demoted.\\n operationId: patchOrgsByOrgIdMembersByUserId\\n tags:\\n - Orgs\\n parameters:\\n - name: orgId\\n in: path\\n required: true\\n schema:\\n type: string\\n - name: userId\\n in: path\\n required: true\\n schema:\\n type: string\\n requestBody:\\n required: true\\n content:\\n application/json:\\n schema:\\n type: object\\n properties:\\n role:\\n type: string\\n enum:\\n - owner\\n - admin\\n - member\\n permissions:\\n type: array\\n items:\\n type: string\\n enum:\\n - manage_org_members\\n - manage_org_compute\\n - manage_definitions\\n - manage_projects\\n responses:\\n \\\"204\\\":\\n description: Success. No content.\\n \\\"400\\\":\\n description: Validation failed.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"403\\\":\\n description: \\\"Authenticated, but not permitted to perform this action.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"404\\\":\\n description: \\\"No such resource, or the caller cannot see it.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"409\\\":\\n description: The request conflicts with the current state.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n delete:\\n summary: Remove an org member. The sole owner cannot be removed.\\n operationId: deleteOrgsByOrgIdMembersByUserId\\n tags:\\n - Orgs\\n parameters:\\n - name: orgId\\n in: path\\n required: true\\n schema:\\n type: string\\n - name: userId\\n in: path\\n required: true\\n schema:\\n type: string\\n responses:\\n \\\"204\\\":\\n description: Success. No content.\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"403\\\":\\n description: \\\"Authenticated, but not permitted to perform this action.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"404\\\":\\n description: \\\"No such resource, or the caller cannot see it.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"409\\\":\\n description: The request conflicts with the current state.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"/api/v1/orgs/{orgId}/invites\\\":\\n get:\\n summary: List pending invites.\\n operationId: getOrgsByOrgIdInvites\\n tags:\\n - Orgs\\n parameters:\\n - name: orgId\\n in: path\\n required: true\\n schema:\\n type: string\\n - $ref: \\\"#/components/parameters/limit\\\"\\n - $ref: \\\"#/components/parameters/cursor\\\"\\n - $ref: \\\"#/components/parameters/orderBy\\\"\\n - $ref: \\\"#/components/parameters/orderDir\\\"\\n responses:\\n \\\"200\\\":\\n description: A page of results.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Page\\\"\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"403\\\":\\n description: \\\"Authenticated, but not permitted to perform this action.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n post:\\n summary: Invite someone to the org. The accept URL is returned once.\\n operationId: postOrgsByOrgIdInvites\\n tags:\\n - Orgs\\n parameters:\\n - name: orgId\\n in: path\\n required: true\\n schema:\\n type: string\\n requestBody:\\n required: true\\n content:\\n application/json:\\n schema:\\n type: object\\n properties:\\n email:\\n type: string\\n format: email\\n pattern: \\\"^(?:[A-Za-z0-9_'+\\\\\\\\-]+\\\\\\\\.)*[A-Za-z0-9_'+\\\\\\\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\\\\\\\-]*\\\\\\\\.)+[A-Za-z]{2,}$\\\"\\n orgRole:\\n default: member\\n type: string\\n enum:\\n - owner\\n - admin\\n - member\\n permissions:\\n default: []\\n type: array\\n items:\\n anyOf:\\n - type: string\\n enum:\\n - instance_admin\\n - manage_compute\\n - manage_instance_users\\n - manage_updates\\n - type: string\\n enum:\\n - manage_org_members\\n - manage_org_compute\\n - manage_definitions\\n - manage_projects\\n required:\\n - email\\n responses:\\n \\\"201\\\":\\n description: Success.\\n content:\\n application/json:\\n schema:\\n type: object\\n \\\"400\\\":\\n description: Validation failed.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"403\\\":\\n description: \\\"Authenticated, but not permitted to perform this action.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"409\\\":\\n description: The request conflicts with the current state.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"/api/v1/orgs/{orgId}/invites/{id}\\\":\\n delete:\\n summary: Revoke an invite.\\n operationId: deleteOrgsByOrgIdInvitesById\\n tags:\\n - Orgs\\n parameters:\\n - name: orgId\\n in: path\\n required: true\\n schema:\\n type: string\\n - name: id\\n in: path\\n required: true\\n schema:\\n type: string\\n responses:\\n \\\"204\\\":\\n description: Success. No content.\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"403\\\":\\n description: \\\"Authenticated, but not permitted to perform this action.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"404\\\":\\n description: \\\"No such resource, or the caller cannot see it.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"/api/v1/orgs/{orgId}/invites/{id}/resend\\\":\\n post:\\n summary: \\\"Re-send an invite. Issues a replacement and revokes the original, so the previous link stops working.\\\"\\n operationId: postOrgsByOrgIdInvitesByIdResend\\n tags:\\n - Orgs\\n parameters:\\n - name: orgId\\n in: path\\n required: true\\n schema:\\n type: string\\n - name: id\\n in: path\\n required: true\\n schema:\\n type: string\\n responses:\\n \\\"201\\\":\\n description: Success.\\n content:\\n application/json:\\n schema:\\n type: object\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"403\\\":\\n description: \\\"Authenticated, but not permitted to perform this action.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"404\\\":\\n description: \\\"No such resource, or the caller cannot see it.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"409\\\":\\n description: The request conflicts with the current state.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"/api/v1/orgs/{orgId}/compute\\\":\\n get:\\n summary: Org compute-server overrides and the shared catalog.\\n operationId: getOrgsByOrgIdCompute\\n tags:\\n - Orgs\\n x-internal: true\\n parameters:\\n - name: orgId\\n in: path\\n required: true\\n schema:\\n type: string\\n responses:\\n \\\"200\\\":\\n description: Success.\\n content:\\n application/json:\\n schema:\\n type: object\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"403\\\":\\n description: \\\"Authenticated, but not permitted to perform this action.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n patch:\\n summary: Replace the org compute-server overrides.\\n operationId: patchOrgsByOrgIdCompute\\n tags:\\n - Orgs\\n x-internal: true\\n parameters:\\n - name: orgId\\n in: path\\n required: true\\n schema:\\n type: string\\n requestBody:\\n required: true\\n content:\\n application/json:\\n schema:\\n type: object\\n properties:\\n servers:\\n type: array\\n items:\\n type: object\\n properties:\\n id:\\n type: string\\n minLength: 1\\n label:\\n type: string\\n minLength: 1\\n serverUrl:\\n type: string\\n minLength: 1\\n apiKey:\\n type:\\n - string\\n - \\\"null\\\"\\n timeoutMs:\\n type: number\\n retryCount:\\n type: number\\n required:\\n - id\\n - label\\n - serverUrl\\n defaultServerId:\\n type:\\n - string\\n - \\\"null\\\"\\n required:\\n - servers\\n responses:\\n \\\"204\\\":\\n description: Success. No content.\\n \\\"400\\\":\\n description: Validation failed.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"403\\\":\\n description: \\\"Authenticated, but not permitted to perform this action.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"/api/v1/orgs/{orgId}/assets/{kind}\\\":\\n post:\\n summary: Upload an org branding asset.\\n operationId: postOrgsByOrgIdAssetsByKind\\n tags:\\n - Orgs\\n x-internal: true\\n parameters:\\n - name: orgId\\n in: path\\n required: true\\n schema:\\n type: string\\n - name: kind\\n in: path\\n required: true\\n schema:\\n type: string\\n requestBody:\\n required: true\\n content:\\n multipart/form-data:\\n schema:\\n type: object\\n properties:\\n image:\\n type: string\\n description: \\\"PNG, JPEG, WebP, GIF or SVG.\\\"\\n required:\\n - image\\n responses:\\n \\\"200\\\":\\n description: Success.\\n content:\\n application/json:\\n schema:\\n type: object\\n \\\"400\\\":\\n description: Validation failed.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"403\\\":\\n description: \\\"Authenticated, but not permitted to perform this action.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"404\\\":\\n description: \\\"No such resource, or the caller cannot see it.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n delete:\\n summary: Remove an org branding asset.\\n operationId: deleteOrgsByOrgIdAssetsByKind\\n tags:\\n - Orgs\\n x-internal: true\\n parameters:\\n - name: orgId\\n in: path\\n required: true\\n schema:\\n type: string\\n - name: kind\\n in: path\\n required: true\\n schema:\\n type: string\\n responses:\\n \\\"204\\\":\\n description: Success. No content.\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"403\\\":\\n description: \\\"Authenticated, but not permitted to perform this action.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"404\\\":\\n description: \\\"No such resource, or the caller cannot see it.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n /api/v1/compute:\\n post:\\n summary: \\\"Generic solve, including remote definition URLs and share-token access.\\\"\\n operationId: postCompute\\n tags:\\n - Compute\\n x-internal: true\\n responses:\\n \\\"200\\\":\\n description: Success.\\n content:\\n application/json:\\n schema:\\n type: object\\n \\\"400\\\":\\n description: Validation failed.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"404\\\":\\n description: \\\"No such resource, or the caller cannot see it.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"429\\\":\\n description: \\\"Rate limited. Retry after the interval in `Retry-After`.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"503\\\":\\n description: The compute server is unconfigured or unreachable.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n /api/v1/compute/schema:\\n post:\\n summary: Extract UI schemas from an uploaded file before it becomes a definition.\\n operationId: postComputeSchema\\n tags:\\n - Compute\\n x-internal: true\\n parameters:\\n - name: projectId\\n in: query\\n required: false\\n description: Project the file will belong to.\\n schema:\\n type: string\\n - name: computeServerId\\n in: query\\n required: false\\n description: Pin to a compute server.\\n schema:\\n type: string\\n requestBody:\\n required: true\\n content:\\n multipart/form-data:\\n schema:\\n type: object\\n properties:\\n file:\\n type: string\\n description: \\\"The `.gh` or `.ghx` file.\\\"\\n required:\\n - file\\n responses:\\n \\\"200\\\":\\n description: Success.\\n content:\\n application/json:\\n schema:\\n type: object\\n \\\"400\\\":\\n description: Validation failed.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"403\\\":\\n description: \\\"Authenticated, but not permitted to perform this action.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"422\\\":\\n description: Well-formed but not processable.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"503\\\":\\n description: The compute server is unconfigured or unreachable.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n /api/v1/solve-events:\\n get:\\n summary: \\\"The tab's live event stream (SSE). Solves that name its `streamId` report here.\\\"\\n operationId: getSolve-events\\n tags:\\n - Solve-events\\n x-internal: true\\n parameters:\\n - name: streamId\\n in: query\\n required: false\\n description: \\\"Minted by the tab, 16-64 URL-safe characters.\\\"\\n schema:\\n type: string\\n responses:\\n \\\"200\\\":\\n description: Success.\\n content:\\n application/json:\\n schema:\\n type: object\\n \\\"400\\\":\\n description: Validation failed.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"409\\\":\\n description: The request conflicts with the current state.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"/api/v1/solve-events/{solveId}\\\":\\n post:\\n summary: \\\"The plugin's callback from inside a Compute solve. The reply carries `abort`.\\\"\\n operationId: postSolve-eventsBySolveId\\n tags:\\n - Solve-events\\n x-internal: true\\n parameters:\\n - name: solveId\\n in: path\\n required: true\\n schema:\\n type: string\\n responses:\\n \\\"200\\\":\\n description: Success.\\n content:\\n application/json:\\n schema:\\n type: object\\n \\\"400\\\":\\n description: Validation failed.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"410\\\":\\n description: Error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"/api/v1/solve/{solveId}/cancel\\\":\\n post:\\n summary: \\\"Ask a running solve to abort. Cooperative: it stops at the next component.\\\"\\n operationId: postSolveBySolveIdCancel\\n tags:\\n - Solve\\n x-internal: true\\n parameters:\\n - name: solveId\\n in: path\\n required: true\\n schema:\\n type: string\\n responses:\\n \\\"204\\\":\\n description: Success. No content.\\n \\\"401\\\":\\n description: Missing or invalid credentials.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"404\\\":\\n description: \\\"No such resource, or the caller cannot see it.\\\"\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n \\\"500\\\":\\n description: Unexpected server error.\\n content:\\n application/json:\\n schema:\\n $ref: \\\"#/components/schemas/Error\\\"\\n\";\n//#endregion\n//#region src/routes/docs/api/openapi.yaml/+server.ts\nvar GET = async () => new Response(v1_default, { headers: {\n\t\"Content-Type\": \"application/yaml; charset=utf-8\",\n\t\"Cache-Control\": \"public, max-age=300\"\n} });\n//#endregion\nexport { GET };\n"],"names":[],"mappings":"AAAA;AACA,IAAI,UAAU,GAAG,ig3EAAig3E;AAClh3E;AACA;AACG,IAAC,GAAG,GAAG,YAAY,IAAI,QAAQ,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE;AAC1D,CAAC,cAAc,EAAE,iCAAiC;AAClD,CAAC,eAAe,EAAE;AAClB,CAAC,EAAE;;;;"}

package/build/server/chunks/entries/hooks.server.js-BXvNmUf9.js ADDED Viewed

@@ -0,0 +1,336 @@
+import { b as private_env } from '../chunks/shared-server.js-BGs15m2r.js';
+import { S as SYSTEM_CONTEXT } from '../chunks/src.js-Cf1j97Z6.js';
+import { p as providers, g as getLogger, h as getErrorReporter, i as getEventSink } from '../chunks/providers.server.js-DQ1uVPlR.js';
+import { a as resolveRequestId, r as renderThrown, R as REQUEST_ID_HEADER } from '../chunks/definitions.js-DK6GL3vh.js';
+import { e as isApiError } from '../chunks/access.js-DFbcJ7ZG.js';
+import '../chunks/api.js-BF_dHNnR.js';
+import { g as getRefreshToken, s as setSessionCookie, a as setRefreshCookie, c as clearRefreshCookie } from '../chunks/admin-auth.server.js-I3ZwmT--.js';
+import { f as findDeploymentDir, s as startUpdateOutcomeReconciler } from '../chunks/selfUpdate.server.js-B_lTx07q.js';
+import { g as getBootHealth } from '../chunks/bootHealth.server.js-CsuNMcI6.js';
+import { w as wireHeaderAuthBootstrap, b as bootstrapUserSession } from '../chunks/auth-bootstrap.server.js-Z3bHapez.js';
+import { redirect, isHttpError } from '@sveltejs/kit';
+import 'zod';
+import '../chunks/limits.js-chQOq2eQ.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '../chunks/schema.js-YChb_4u9.js';
+import '../chunks/update-outcome.js-Dl8LwqJM.js';
+//#region ../platform/src/userProfile/types.ts
+function emptyProfile(userId) {
+	return {
+		userId,
+		starredDefinitions: [],
+		recentRuns: []
+	};
+}
+//#endregion
+//#region ../server/src/http/security-headers.ts
+/**
+* Apply baseline browser-hardening headers to a response and return it for
+* chaining. Each is a cheap win that needs no UI verification:
+*
+*   - X-Content-Type-Options: nosniff — disables MIME sniffing.
+*   - Referrer-Policy: strict-origin-when-cross-origin — strips path and query
+*     from cross-origin Referer headers. Matches modern browser defaults, but
+*     pins the behavior in case a default drifts.
+*   - Permissions-Policy: opts out of browser APIs Selva-engine apps don't use,
+*     so XSS can't enable them.
+*   - HSTS when `opts.hsts`.
+*   - X-Frame-Options + `frame-ancestors 'none'` when `opts.denyFraming` — the
+*     caller opts in per route, since embeddable app routes must stay framable.
+*
+* **Intentionally NOT set here:**
+*   - A full Content-Security-Policy. Selva-engine apps are built for iframe
+*     embedding, so a strict CSP needs validating against real consumer sites
+*     before it can ship. `denyFraming` sets only the `frame-ancestors`
+*     directive, which constrains nothing else the page loads.
+*   - Cache-Control. Asset-path layout is app policy; set it in the caller.
+*/
+function applySecurityHeaders(response, opts) {
+	response.headers.set("X-Content-Type-Options", "nosniff");
+	response.headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
+	response.headers.set("Permissions-Policy", "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()");
+	if (opts.hsts) response.headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
+	if (opts.denyFraming) {
+		response.headers.set("X-Frame-Options", "DENY");
+		response.headers.set("Content-Security-Policy", "frame-ancestors 'none'");
+	}
+	return response;
+}
+//#endregion
+//#region ../server/src/http/route-classifier.ts
+function createRouteClassifier(config) {
+	const publicPages = new Set(config.publicPages ?? []);
+	const publicPrefixes = config.publicPrefixes ?? [];
+	const publicApis = new Set(config.publicApis ?? []);
+	const selfGatingPrefixes = [...config.selfGatingPrefixes ?? [], ...config.selfGatingPrefix !== void 0 ? [config.selfGatingPrefix] : []];
+	const staticPrefixes = config.staticPrefixes ?? [];
+	const staticPaths = new Set(config.staticPaths ?? []);
+	function isStaticAsset(pathname) {
+		if (staticPaths.has(pathname)) return true;
+		return staticPrefixes.some((p) => pathname.startsWith(p));
+	}
+	function isSelfGatingApiRoute(pathname) {
+		return selfGatingPrefixes.some((p) => pathname.startsWith(p));
+	}
+	function isPublicRoute(pathname) {
+		if (publicPages.has(pathname)) return true;
+		if (publicApis.has(pathname)) return true;
+		if (isSelfGatingApiRoute(pathname)) return true;
+		return publicPrefixes.some((p) => pathname.startsWith(p));
+	}
+	return {
+		isStaticAsset,
+		isSelfGatingApiRoute,
+		isPublicRoute
+	};
+}
+//#endregion
+//#region src/hooks.server.ts
+var headerAuthBootstrapWired = false;
+var bootHealthKicked = false;
+var proxyAuthLoginMissWarned = false;
+var firstRunResolved = false;
+async function isFirstRun() {
+	if (firstRunResolved) return false;
+	const usersPage = await providers.auth.listUsers({ limit: 1 });
+	if (usersPage === null) {
+		firstRunResolved = true;
+		return false;
+	}
+	if (usersPage.items.length === 0) return true;
+	firstRunResolved = true;
+	return false;
+}
+var ensuredUserIds = /* @__PURE__ */ new Set();
+async function ensureUserOnce(userId) {
+	if (ensuredUserIds.has(userId)) return;
+	await providers.data.ensureUser(SYSTEM_CONTEXT, userId);
+	ensuredUserIds.add(userId);
+}
+/**
+* Builds a per-request context from an authenticated user: resolves active-org
+* membership and its OrgPermissions.
+*
+* Active-org resolution: single tenancy picks the deployment's one org; multi
+* tenancy picks the first org the user belongs to (URL-prefix resolution via
+* `/o/{slug}/...` will replace this once routes are tenant-namespaced).
+*
+* Exported for tests: the fixture's `actAs()` mirrors this logic, so a direct
+* test pins the production function against drift.
+*/
+async function buildContext(user, sessionToken, platformPermissions, membership) {
+	let actingOrgId;
+	let orgPermissions = [];
+	if (membership) {
+		actingOrgId = membership.org.id;
+		orgPermissions = membership.member.permissions;
+	}
+	if (!actingOrgId && platformPermissions.includes("instance_admin")) {
+		const firstOrg = (await providers.data.orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items[0];
+		if (firstOrg) actingOrgId = firstOrg.id;
+	}
+	return {
+		userId: user.id,
+		actingOrgId,
+		platformPermissions,
+		orgPermissions,
+		adapterContext: sessionToken ? { sessionToken } : void 0
+	};
+}
+var PUBLIC_PAGE_ROUTES = /* @__PURE__ */ new Set([
+	"/",
+	"/login",
+	"/setup",
+	"/accept-invite"
+]);
+var { isStaticAsset, isSelfGatingApiRoute, isPublicRoute } = createRouteClassifier({
+	publicPages: PUBLIC_PAGE_ROUTES,
+	publicPrefixes: [
+		"/auth/",
+		"/logout",
+		"/docs/"
+	],
+	publicApis: ["/api/health", "/api/health/ready"],
+	selfGatingPrefixes: ["/api/files/", "/api/v1/solve-events"],
+	staticPrefixes: ["/_app/", "/favicon/"],
+	staticPaths: ["/favicon.svg", "/robots.txt"]
+});
+var handle = async ({ event, resolve }) => {
+	event.locals.providers = providers;
+	const requestId = resolveRequestId(event.request.headers);
+	event.locals.requestId = requestId;
+	event.locals.log = getLogger().child({
+		requestId,
+		method: event.request.method,
+		route: event.url.pathname
+	});
+	if (!headerAuthBootstrapWired) {
+		wireHeaderAuthBootstrap();
+		headerAuthBootstrapWired = true;
+	}
+	if (!bootHealthKicked) {
+		bootHealthKicked = true;
+		getBootHealth();
+		const deploymentDir = findDeploymentDir(private_env);
+		if (deploymentDir) startUpdateOutcomeReconciler({
+			deploymentDir,
+			emit: (e) => getEventSink().emit(e),
+			report: (err) => getErrorReporter().capture(err, { tags: { origin: "selfUpdate" } })
+		});
+	}
+	const { pathname } = event.url;
+	if (isStaticAsset(pathname)) return applyResponseHeaders(await resolve(event), pathname, requestId);
+	if (pathname === "/api/health" || pathname === "/api/health/ready") return applyResponseHeaders(await resolve(event), pathname, requestId);
+	const publicRoute = isPublicRoute(pathname);
+	const isJsonApiRoute = pathname.startsWith("/api/");
+	if (!publicRoute) {
+		if (await isFirstRun()) {
+			if (isJsonApiRoute) return applyResponseHeaders(new Response(JSON.stringify({
+				message: "Setup required",
+				code: "SETUP_REQUIRED"
+			}), {
+				status: 503,
+				headers: { "Content-Type": "application/json" }
+			}), pathname, requestId);
+			redirect(303, "/setup");
+		}
+	}
+	if (!publicRoute) {
+		let token = event.cookies.get("admin_session") ?? "";
+		let user = await providers.auth.verifyToken(token);
+		if (!user) {
+			const refreshToken = getRefreshToken(event.cookies);
+			const oauth = providers.auth.oauth;
+			if (refreshToken && oauth) {
+				const refreshed = await oauth.refreshSession(refreshToken);
+				if (refreshed) {
+					setSessionCookie(event.cookies, refreshed.sessionToken);
+					setRefreshCookie(event.cookies, refreshed.refreshToken);
+					token = refreshed.sessionToken;
+					user = await providers.auth.verifyToken(token);
+				} else clearRefreshCookie(event.cookies);
+			}
+		}
+		if (!user && providers.auth.proxyAuth) {
+			user = await providers.auth.proxyAuth.identifyFromHeaders(event.request.headers);
+			if (user) await bootstrapUserSession(user);
+		}
+		if (!user) {
+			if (isJsonApiRoute) return applyResponseHeaders(new Response(JSON.stringify({
+				message: "Your session has expired. Sign in again to continue.",
+				code: "UNAUTHORIZED"
+			}), {
+				status: 401,
+				headers: { "Content-Type": "application/json" }
+			}), pathname, requestId);
+			redirect(303, `/login?redirectTo=${encodeURIComponent(pathname)}`);
+		}
+		const [, profile, platformPermissions, membership] = await Promise.all([
+			ensureUserOnce(user.id),
+			providers.data.userProfile.getProfile(SYSTEM_CONTEXT, user.id),
+			providers.data.permissions.getFor(SYSTEM_CONTEXT, user.id),
+			providers.data.orgs.findUserMembership(SYSTEM_CONTEXT, user.id)
+		]);
+		event.locals.user = user;
+		event.locals.profile = profile ?? emptyProfile(user.id);
+		event.locals.ctx = await buildContext(user, token, platformPermissions, membership);
+	} else {
+		const wantsSessionAttach = PUBLIC_PAGE_ROUTES.has(pathname) || isSelfGatingApiRoute(pathname);
+		const token = wantsSessionAttach ? event.cookies.get("admin_session") ?? "" : "";
+		let user = token ? await providers.auth.verifyToken(token) : null;
+		if (!user && wantsSessionAttach && providers.auth.proxyAuth) {
+			user = await providers.auth.proxyAuth.identifyFromHeaders(event.request.headers);
+			if (!user && pathname === "/login" && !proxyAuthLoginMissWarned) {
+				proxyAuthLoginMissWarned = true;
+				const proxyAuth = providers.auth.proxyAuth;
+				const noHeaders = proxyAuth.hasNoIdentityHeaders(event.request.headers);
+				const configured = proxyAuth.configuredHeaderNames.join(", ");
+				if (noHeaders) event.locals.log.warn("/login was hit and NONE of the configured identity headers arrived. The forward-auth proxy is not reaching this process, or is not forwarding the configured headers. See the @selvajs/header-auth-provider README \"Verification\" section.", {
+					component: "HeaderAuth",
+					configuredHeaders: configured
+				});
+				else event.locals.log.warn("/login was hit but the UPN header was missing or the user is not allowlisted. Some headers arrived but identification still failed — check that the UPN header is populated and that the user has been added to header-allowlist.json.", {
+					component: "HeaderAuth",
+					configuredHeaders: configured
+				});
+			}
+		}
+		if (user) {
+			const [, profile, platformPermissions, membership] = await Promise.all([
+				ensureUserOnce(user.id),
+				providers.data.userProfile.getProfile(SYSTEM_CONTEXT, user.id),
+				providers.data.permissions.getFor(SYSTEM_CONTEXT, user.id),
+				providers.data.orgs.findUserMembership(SYSTEM_CONTEXT, user.id)
+			]);
+			event.locals.user = user;
+			event.locals.profile = profile ?? emptyProfile(user.id);
+			event.locals.ctx = await buildContext(user, token, platformPermissions, membership);
+		}
+	}
+	return applyResponseHeaders(await resolve(event), pathname, requestId);
+};
+var FRAME_DENIED_PREFIXES = [
+	"/admin",
+	"/setup",
+	"/login"
+];
+function deniesFraming(pathname) {
+	return FRAME_DENIED_PREFIXES.some((p) => pathname === p || pathname.startsWith(`${p}/`));
+}
+function applyResponseHeaders(response, pathname, requestId) {
+	applySecurityHeaders(response, {
+		hsts: process.env.NODE_ENV === "production",
+		denyFraming: deniesFraming(pathname)
+	});
+	response.headers.set(REQUEST_ID_HEADER, requestId);
+	if (pathname.startsWith("/_app/")) response.headers.set("Cache-Control", "public, max-age=31536000, immutable");
+	else if (pathname.startsWith("/favicon/") || pathname === "/favicon.svg" || pathname === "/robots.txt") response.headers.set("Cache-Control", "public, max-age=604800");
+	return response;
+}
+var handleError = ({ error, status, event }) => {
+	if (isHttpError(error)) {
+		const body = error.body;
+		return {
+			message: body.message,
+			code: body.code,
+			fields: body.fields
+		};
+	}
+	if (isApiError(error)) return {
+		message: error.message,
+		code: error.code,
+		fields: error.fields
+	};
+	if (status === 404) return {
+		message: "Page not found.",
+		code: "NOT_FOUND"
+	};
+	(event.locals.log ?? getLogger().child({
+		method: event.request.method,
+		route: event.url.pathname
+	})).error("Unhandled error", {
+		component: "handleError",
+		status,
+		err: renderThrown(error),
+		cause: error instanceof Error && error.cause ? String(error.cause) : void 0
+	});
+	getErrorReporter().capture(error, {
+		method: event.request.method,
+		route: event.url.pathname,
+		userId: event.locals.ctx?.userId || void 0,
+		orgId: event.locals.ctx?.actingOrgId
+	});
+	return {
+		message: "An unexpected error occurred.",
+		code: "INTERNAL"
+	};
+};
+export { buildContext, handle, handleError, isPublicRoute, isSelfGatingApiRoute, isStaticAsset };
+//# sourceMappingURL=hooks.server.js-BXvNmUf9.js.map

package/build/server/chunks/entries/hooks.server.js-BXvNmUf9.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"hooks.server.js-BXvNmUf9.js","sources":["../../../../.svelte-kit/output/server/entries/hooks.server.js"],"sourcesContent":["import { t as private_env } from \"../chunks/shared-server.js\";\nimport { t as SYSTEM_CONTEXT } from \"../chunks/src.js\";\nimport { T as providers, f as getLogger, l as getErrorReporter, u as getEventSink } from \"../chunks/providers.server.js\";\nimport { c as REQUEST_ID_HEADER, l as renderThrown, u as resolveRequestId } from \"../chunks/definitions.js\";\nimport { F as isApiError } from \"../chunks/access.js\";\nimport \"../chunks/api.js\";\nimport { a as getRefreshToken, l as setRefreshCookie, r as clearRefreshCookie, u as setSessionCookie } from \"../chunks/admin-auth.server.js\";\nimport { n as startUpdateOutcomeReconciler, t as findDeploymentDir } from \"../chunks/selfUpdate.server.js\";\nimport { t as getBootHealth } from \"../chunks/bootHealth.server.js\";\nimport { n as wireHeaderAuthBootstrap, t as bootstrapUserSession } from \"../chunks/auth-bootstrap.server.js\";\nimport { isHttpError, redirect } from \"@sveltejs/kit\";\n//#region ../platform/src/userProfile/types.ts\nfunction emptyProfile(userId) {\n\treturn {\n\t\tuserId,\n\t\tstarredDefinitions: [],\n\t\trecentRuns: []\n\t};\n}\n//#endregion\n//#region ../server/src/http/security-headers.ts\n/**\n* Apply baseline browser-hardening headers to a response and return it for\n* chaining. Each is a cheap win that needs no UI verification:\n*\n* - X-Content-Type-Options: nosniff — disables MIME sniffing.\n* - Referrer-Policy: strict-origin-when-cross-origin — strips path and query\n* from cross-origin Referer headers. Matches modern browser defaults, but\n* pins the behavior in case a default drifts.\n* - Permissions-Policy: opts out of browser APIs Selva-engine apps don't use,\n* so XSS can't enable them.\n* - HSTS when `opts.hsts`.\n* - X-Frame-Options + `frame-ancestors 'none'` when `opts.denyFraming` — the\n* caller opts in per route, since embeddable app routes must stay framable.\n*\n* **Intentionally NOT set here:**\n* - A full Content-Security-Policy. Selva-engine apps are built for iframe\n* embedding, so a strict CSP needs validating against real consumer sites\n* before it can ship. `denyFraming` sets only the `frame-ancestors`\n* directive, which constrains nothing else the page loads.\n* - Cache-Control. Asset-path layout is app policy; set it in the caller.\n*/\nfunction applySecurityHeaders(response, opts) {\n\tresponse.headers.set(\"X-Content-Type-Options\", \"nosniff\");\n\tresponse.headers.set(\"Referrer-Policy\", \"strict-origin-when-cross-origin\");\n\tresponse.headers.set(\"Permissions-Policy\", \"accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()\");\n\tif (opts.hsts) response.headers.set(\"Strict-Transport-Security\", \"max-age=31536000; includeSubDomains\");\n\tif (opts.denyFraming) {\n\t\tresponse.headers.set(\"X-Frame-Options\", \"DENY\");\n\t\tresponse.headers.set(\"Content-Security-Policy\", \"frame-ancestors 'none'\");\n\t}\n\treturn response;\n}\n//#endregion\n//#region ../server/src/http/route-classifier.ts\nfunction createRouteClassifier(config) {\n\tconst publicPages = new Set(config.publicPages ?? []);\n\tconst publicPrefixes = config.publicPrefixes ?? [];\n\tconst publicApis = new Set(config.publicApis ?? []);\n\tconst selfGatingPrefixes = [...config.selfGatingPrefixes ?? [], ...config.selfGatingPrefix !== void 0 ? [config.selfGatingPrefix] : []];\n\tconst staticPrefixes = config.staticPrefixes ?? [];\n\tconst staticPaths = new Set(config.staticPaths ?? []);\n\tfunction isStaticAsset(pathname) {\n\t\tif (staticPaths.has(pathname)) return true;\n\t\treturn staticPrefixes.some((p) => pathname.startsWith(p));\n\t}\n\tfunction isSelfGatingApiRoute(pathname) {\n\t\treturn selfGatingPrefixes.some((p) => pathname.startsWith(p));\n\t}\n\tfunction isPublicRoute(pathname) {\n\t\tif (publicPages.has(pathname)) return true;\n\t\tif (publicApis.has(pathname)) return true;\n\t\tif (isSelfGatingApiRoute(pathname)) return true;\n\t\treturn publicPrefixes.some((p) => pathname.startsWith(p));\n\t}\n\treturn {\n\t\tisStaticAsset,\n\t\tisSelfGatingApiRoute,\n\t\tisPublicRoute\n\t};\n}\n//#endregion\n//#region src/hooks.server.ts\nvar headerAuthBootstrapWired = false;\nvar bootHealthKicked = false;\nvar proxyAuthLoginMissWarned = false;\nvar firstRunResolved = false;\nasync function isFirstRun() {\n\tif (firstRunResolved) return false;\n\tconst usersPage = await providers.auth.listUsers({ limit: 1 });\n\tif (usersPage === null) {\n\t\tfirstRunResolved = true;\n\t\treturn false;\n\t}\n\tif (usersPage.items.length === 0) return true;\n\tfirstRunResolved = true;\n\treturn false;\n}\nvar ensuredUserIds = /* @__PURE__ */ new Set();\nasync function ensureUserOnce(userId) {\n\tif (ensuredUserIds.has(userId)) return;\n\tawait providers.data.ensureUser(SYSTEM_CONTEXT, userId);\n\tensuredUserIds.add(userId);\n}\n/**\n* Builds a per-request context from an authenticated user: resolves active-org\n* membership and its OrgPermissions.\n*\n* Active-org resolution: single tenancy picks the deployment's one org; multi\n* tenancy picks the first org the user belongs to (URL-prefix resolution via\n* `/o/{slug}/...` will replace this once routes are tenant-namespaced).\n*\n* Exported for tests: the fixture's `actAs()` mirrors this logic, so a direct\n* test pins the production function against drift.\n*/\nasync function buildContext(user, sessionToken, platformPermissions, membership) {\n\tlet actingOrgId;\n\tlet orgPermissions = [];\n\tif (membership) {\n\t\tactingOrgId = membership.org.id;\n\t\torgPermissions = membership.member.permissions;\n\t}\n\tif (!actingOrgId && platformPermissions.includes(\"instance_admin\")) {\n\t\tconst firstOrg = (await providers.data.orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items[0];\n\t\tif (firstOrg) actingOrgId = firstOrg.id;\n\t}\n\treturn {\n\t\tuserId: user.id,\n\t\tactingOrgId,\n\t\tplatformPermissions,\n\t\torgPermissions,\n\t\tadapterContext: sessionToken ? { sessionToken } : void 0\n\t};\n}\nvar PUBLIC_PAGE_ROUTES = /* @__PURE__ */ new Set([\n\t\"/\",\n\t\"/login\",\n\t\"/setup\",\n\t\"/accept-invite\"\n]);\nvar { isStaticAsset, isSelfGatingApiRoute, isPublicRoute } = createRouteClassifier({\n\tpublicPages: PUBLIC_PAGE_ROUTES,\n\tpublicPrefixes: [\n\t\t\"/auth/\",\n\t\t\"/logout\",\n\t\t\"/docs/\"\n\t],\n\tpublicApis: [\"/api/health\", \"/api/health/ready\"],\n\tselfGatingPrefixes: [\"/api/files/\", \"/api/v1/solve-events\"],\n\tstaticPrefixes: [\"/_app/\", \"/favicon/\"],\n\tstaticPaths: [\"/favicon.svg\", \"/robots.txt\"]\n});\nvar handle = async ({ event, resolve }) => {\n\tevent.locals.providers = providers;\n\tconst requestId = resolveRequestId(event.request.headers);\n\tevent.locals.requestId = requestId;\n\tevent.locals.log = getLogger().child({\n\t\trequestId,\n\t\tmethod: event.request.method,\n\t\troute: event.url.pathname\n\t});\n\tif (!headerAuthBootstrapWired) {\n\t\twireHeaderAuthBootstrap();\n\t\theaderAuthBootstrapWired = true;\n\t}\n\tif (!bootHealthKicked) {\n\t\tbootHealthKicked = true;\n\t\tgetBootHealth();\n\t\tconst deploymentDir = findDeploymentDir(private_env);\n\t\tif (deploymentDir) startUpdateOutcomeReconciler({\n\t\t\tdeploymentDir,\n\t\t\temit: (e) => getEventSink().emit(e),\n\t\t\treport: (err) => getErrorReporter().capture(err, { tags: { origin: \"selfUpdate\" } })\n\t\t});\n\t}\n\tconst { pathname } = event.url;\n\tif (isStaticAsset(pathname)) return applyResponseHeaders(await resolve(event), pathname, requestId);\n\tif (pathname === \"/api/health\" || pathname === \"/api/health/ready\") return applyResponseHeaders(await resolve(event), pathname, requestId);\n\tconst publicRoute = isPublicRoute(pathname);\n\tconst isJsonApiRoute = pathname.startsWith(\"/api/\");\n\tif (!publicRoute) {\n\t\tif (await isFirstRun()) {\n\t\t\tif (isJsonApiRoute) return applyResponseHeaders(new Response(JSON.stringify({\n\t\t\t\tmessage: \"Setup required\",\n\t\t\t\tcode: \"SETUP_REQUIRED\"\n\t\t\t}), {\n\t\t\t\tstatus: 503,\n\t\t\t\theaders: { \"Content-Type\": \"application/json\" }\n\t\t\t}), pathname, requestId);\n\t\t\tredirect(303, \"/setup\");\n\t\t}\n\t}\n\tif (!publicRoute) {\n\t\tlet token = event.cookies.get(\"admin_session\") ?? \"\";\n\t\tlet user = await providers.auth.verifyToken(token);\n\t\tif (!user) {\n\t\t\tconst refreshToken = getRefreshToken(event.cookies);\n\t\t\tconst oauth = providers.auth.oauth;\n\t\t\tif (refreshToken && oauth) {\n\t\t\t\tconst refreshed = await oauth.refreshSession(refreshToken);\n\t\t\t\tif (refreshed) {\n\t\t\t\t\tsetSessionCookie(event.cookies, refreshed.sessionToken);\n\t\t\t\t\tsetRefreshCookie(event.cookies, refreshed.refreshToken);\n\t\t\t\t\ttoken = refreshed.sessionToken;\n\t\t\t\t\tuser = await providers.auth.verifyToken(token);\n\t\t\t\t} else clearRefreshCookie(event.cookies);\n\t\t\t}\n\t\t}\n\t\tif (!user && providers.auth.proxyAuth) {\n\t\t\tuser = await providers.auth.proxyAuth.identifyFromHeaders(event.request.headers);\n\t\t\tif (user) await bootstrapUserSession(user);\n\t\t}\n\t\tif (!user) {\n\t\t\tif (isJsonApiRoute) return applyResponseHeaders(new Response(JSON.stringify({\n\t\t\t\tmessage: \"Your session has expired. Sign in again to continue.\",\n\t\t\t\tcode: \"UNAUTHORIZED\"\n\t\t\t}), {\n\t\t\t\tstatus: 401,\n\t\t\t\theaders: { \"Content-Type\": \"application/json\" }\n\t\t\t}), pathname, requestId);\n\t\t\tredirect(303, `/login?redirectTo=${encodeURIComponent(pathname)}`);\n\t\t}\n\t\tconst [, profile, platformPermissions, membership] = await Promise.all([\n\t\t\tensureUserOnce(user.id),\n\t\t\tproviders.data.userProfile.getProfile(SYSTEM_CONTEXT, user.id),\n\t\t\tproviders.data.permissions.getFor(SYSTEM_CONTEXT, user.id),\n\t\t\tproviders.data.orgs.findUserMembership(SYSTEM_CONTEXT, user.id)\n\t\t]);\n\t\tevent.locals.user = user;\n\t\tevent.locals.profile = profile ?? emptyProfile(user.id);\n\t\tevent.locals.ctx = await buildContext(user, token, platformPermissions, membership);\n\t} else {\n\t\tconst wantsSessionAttach = PUBLIC_PAGE_ROUTES.has(pathname) || isSelfGatingApiRoute(pathname);\n\t\tconst token = wantsSessionAttach ? event.cookies.get(\"admin_session\") ?? \"\" : \"\";\n\t\tlet user = token ? await providers.auth.verifyToken(token) : null;\n\t\tif (!user && wantsSessionAttach && providers.auth.proxyAuth) {\n\t\t\tuser = await providers.auth.proxyAuth.identifyFromHeaders(event.request.headers);\n\t\t\tif (!user && pathname === \"/login\" && !proxyAuthLoginMissWarned) {\n\t\t\t\tproxyAuthLoginMissWarned = true;\n\t\t\t\tconst proxyAuth = providers.auth.proxyAuth;\n\t\t\t\tconst noHeaders = proxyAuth.hasNoIdentityHeaders(event.request.headers);\n\t\t\t\tconst configured = proxyAuth.configuredHeaderNames.join(\", \");\n\t\t\t\tif (noHeaders) event.locals.log.warn(\"/login was hit and NONE of the configured identity headers arrived. The forward-auth proxy is not reaching this process, or is not forwarding the configured headers. See the @selvajs/header-auth-provider README \\\"Verification\\\" section.\", {\n\t\t\t\t\tcomponent: \"HeaderAuth\",\n\t\t\t\t\tconfiguredHeaders: configured\n\t\t\t\t});\n\t\t\t\telse event.locals.log.warn(\"/login was hit but the UPN header was missing or the user is not allowlisted. Some headers arrived but identification still failed — check that the UPN header is populated and that the user has been added to header-allowlist.json.\", {\n\t\t\t\t\tcomponent: \"HeaderAuth\",\n\t\t\t\t\tconfiguredHeaders: configured\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\t\tif (user) {\n\t\t\tconst [, profile, platformPermissions, membership] = await Promise.all([\n\t\t\t\tensureUserOnce(user.id),\n\t\t\t\tproviders.data.userProfile.getProfile(SYSTEM_CONTEXT, user.id),\n\t\t\t\tproviders.data.permissions.getFor(SYSTEM_CONTEXT, user.id),\n\t\t\t\tproviders.data.orgs.findUserMembership(SYSTEM_CONTEXT, user.id)\n\t\t\t]);\n\t\t\tevent.locals.user = user;\n\t\t\tevent.locals.profile = profile ?? emptyProfile(user.id);\n\t\t\tevent.locals.ctx = await buildContext(user, token, platformPermissions, membership);\n\t\t}\n\t}\n\treturn applyResponseHeaders(await resolve(event), pathname, requestId);\n};\nvar FRAME_DENIED_PREFIXES = [\n\t\"/admin\",\n\t\"/setup\",\n\t\"/login\"\n];\nfunction deniesFraming(pathname) {\n\treturn FRAME_DENIED_PREFIXES.some((p) => pathname === p || pathname.startsWith(`${p}/`));\n}\nfunction applyResponseHeaders(response, pathname, requestId) {\n\tapplySecurityHeaders(response, {\n\t\thsts: process.env.NODE_ENV === \"production\",\n\t\tdenyFraming: deniesFraming(pathname)\n\t});\n\tresponse.headers.set(REQUEST_ID_HEADER, requestId);\n\tif (pathname.startsWith(\"/_app/\")) response.headers.set(\"Cache-Control\", \"public, max-age=31536000, immutable\");\n\telse if (pathname.startsWith(\"/favicon/\") || pathname === \"/favicon.svg\" || pathname === \"/robots.txt\") response.headers.set(\"Cache-Control\", \"public, max-age=604800\");\n\treturn response;\n}\nvar handleError = ({ error, status, event }) => {\n\tif (isHttpError(error)) {\n\t\tconst body = error.body;\n\t\treturn {\n\t\t\tmessage: body.message,\n\t\t\tcode: body.code,\n\t\t\tfields: body.fields\n\t\t};\n\t}\n\tif (isApiError(error)) return {\n\t\tmessage: error.message,\n\t\tcode: error.code,\n\t\tfields: error.fields\n\t};\n\tif (status === 404) return {\n\t\tmessage: \"Page not found.\",\n\t\tcode: \"NOT_FOUND\"\n\t};\n\t(event.locals.log ?? getLogger().child({\n\t\tmethod: event.request.method,\n\t\troute: event.url.pathname\n\t})).error(\"Unhandled error\", {\n\t\tcomponent: \"handleError\",\n\t\tstatus,\n\t\terr: renderThrown(error),\n\t\tcause: error instanceof Error && error.cause ? String(error.cause) : void 0\n\t});\n\tgetErrorReporter().capture(error, {\n\t\tmethod: event.request.method,\n\t\troute: event.url.pathname,\n\t\tuserId: event.locals.ctx?.userId || void 0,\n\t\torgId: event.locals.ctx?.actingOrgId\n\t});\n\treturn {\n\t\tmessage: \"An unexpected error occurred.\",\n\t\tcode: \"INTERNAL\"\n\t};\n};\n//#endregion\nexport { buildContext, handle, handleError, isPublicRoute, isSelfGatingApiRoute, isStaticAsset };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAWA;AACA,SAAS,YAAY,CAAC,MAAM,EAAE;AAC9B,CAAC,OAAO;AACR,EAAE,MAAM;AACR,EAAE,kBAAkB,EAAE,EAAE;AACxB,EAAE,UAAU,EAAE;AACd,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,oBAAoB,CAAC,QAAQ,EAAE,IAAI,EAAE;AAC9C,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC;AAC1D,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,iCAAiC,CAAC;AAC3E,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,+GAA+G,CAAC;AAC5J,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,qCAAqC,CAAC;AACxG,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE;AACvB,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC;AACjD,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,wBAAwB,CAAC;AAC3E,CAAC;AACD,CAAC,OAAO,QAAQ;AAChB;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,MAAM,EAAE;AACvC,CAAC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;AACtD,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,EAAE;AACnD,CAAC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;AACpD,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAG,MAAM,CAAC,kBAAkB,IAAI,EAAE,EAAE,GAAG,MAAM,CAAC,gBAAgB,KAAK,MAAM,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,EAAE,CAAC;AACxI,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,EAAE;AACnD,CAAC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;AACtD,CAAC,SAAS,aAAa,CAAC,QAAQ,EAAE;AAClC,EAAE,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI;AAC5C,EAAE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AACD,CAAC,SAAS,oBAAoB,CAAC,QAAQ,EAAE;AACzC,EAAE,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AACD,CAAC,SAAS,aAAa,CAAC,QAAQ,EAAE;AAClC,EAAE,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI;AAC5C,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI;AAC3C,EAAE,IAAI,oBAAoB,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI;AACjD,EAAE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AACD,CAAC,OAAO;AACR,EAAE,aAAa;AACf,EAAE,oBAAoB;AACtB,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA,IAAI,wBAAwB,GAAG,KAAK;AACpC,IAAI,gBAAgB,GAAG,KAAK;AAC5B,IAAI,wBAAwB,GAAG,KAAK;AACpC,IAAI,gBAAgB,GAAG,KAAK;AAC5B,eAAe,UAAU,GAAG;AAC5B,CAAC,IAAI,gBAAgB,EAAE,OAAO,KAAK;AACnC,CAAC,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAC/D,CAAC,IAAI,SAAS,KAAK,IAAI,EAAE;AACzB,EAAE,gBAAgB,GAAG,IAAI;AACzB,EAAE,OAAO,KAAK;AACd,CAAC;AACD,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,IAAI;AAC9C,CAAC,gBAAgB,GAAG,IAAI;AACxB,CAAC,OAAO,KAAK;AACb;AACA,IAAI,cAAc,mBAAmB,IAAI,GAAG,EAAE;AAC9C,eAAe,cAAc,CAAC,MAAM,EAAE;AACtC,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;AACjC,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC;AACxD,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;AAC3B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE,mBAAmB,EAAE,UAAU,EAAE;AACjF,CAAC,IAAI,WAAW;AAChB,CAAC,IAAI,cAAc,GAAG,EAAE;AACxB,CAAC,IAAI,UAAU,EAAE;AACjB,EAAE,WAAW,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE;AACjC,EAAE,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW;AAChD,CAAC;AACD,CAAC,IAAI,CAAC,WAAW,IAAI,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE;AACrE,EAAE,MAAM,QAAQ,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AAC9F,EAAE,IAAI,QAAQ,EAAE,WAAW,GAAG,QAAQ,CAAC,EAAE;AACzC,CAAC;AACD,CAAC,OAAO;AACR,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;AACjB,EAAE,WAAW;AACb,EAAE,mBAAmB;AACrB,EAAE,cAAc;AAChB,EAAE,cAAc,EAAE,YAAY,GAAG,EAAE,YAAY,EAAE,GAAG;AACpD,EAAE;AACF;AACA,IAAI,kBAAkB,mBAAmB,IAAI,GAAG,CAAC;AACjD,CAAC,GAAG;AACJ,CAAC,QAAQ;AACT,CAAC,QAAQ;AACT,CAAC;AACD,CAAC,CAAC;AACC,IAAC,EAAE,aAAa,EAAE,oBAAoB,EAAE,aAAa,EAAE,GAAG,qBAAqB,CAAC;AACnF,CAAC,WAAW,EAAE,kBAAkB;AAChC,CAAC,cAAc,EAAE;AACjB,EAAE,QAAQ;AACV,EAAE,SAAS;AACX,EAAE;AACF,EAAE;AACF,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE,mBAAmB,CAAC;AACjD,CAAC,kBAAkB,EAAE,CAAC,aAAa,EAAE,sBAAsB,CAAC;AAC5D,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC;AACxC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,aAAa;AAC5C,CAAC;AACE,IAAC,MAAM,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;AAC3C,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,SAAS;AACnC,CAAC,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;AAC1D,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,SAAS;AACnC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,GAAG,SAAS,EAAE,CAAC,KAAK,CAAC;AACtC,EAAE,SAAS;AACX,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;AAC9B,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;AACnB,EAAE,CAAC;AACH,CAAC,IAAI,CAAC,wBAAwB,EAAE;AAChC,EAAE,uBAAuB,EAAE;AAC3B,EAAE,wBAAwB,GAAG,IAAI;AACjC,CAAC;AACD,CAAC,IAAI,CAAC,gBAAgB,EAAE;AACxB,EAAE,gBAAgB,GAAG,IAAI;AACzB,EAAE,aAAa,EAAE;AACjB,EAAE,MAAM,aAAa,GAAG,iBAAiB,CAAC,WAAW,CAAC;AACtD,EAAE,IAAI,aAAa,EAAE,4BAA4B,CAAC;AAClD,GAAG,aAAa;AAChB,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;AACtC,GAAG,MAAM,EAAE,CAAC,GAAG,KAAK,gBAAgB,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;AACtF,GAAG,CAAC;AACJ,CAAC;AACD,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,GAAG;AAC/B,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,OAAO,oBAAoB,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC;AACpG,CAAC,IAAI,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK,mBAAmB,EAAE,OAAO,oBAAoB,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC;AAC3I,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC,QAAQ,CAAC;AAC5C,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;AACpD,CAAC,IAAI,CAAC,WAAW,EAAE;AACnB,EAAE,IAAI,MAAM,UAAU,EAAE,EAAE;AAC1B,GAAG,IAAI,cAAc,EAAE,OAAO,oBAAoB,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;AAC/E,IAAI,OAAO,EAAE,gBAAgB;AAC7B,IAAI,IAAI,EAAE;AACV,IAAI,CAAC,EAAE;AACP,IAAI,MAAM,EAAE,GAAG;AACf,IAAI,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AACjD,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC;AAC3B,GAAG,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;AAC1B,EAAE;AACF,CAAC;AACD,CAAC,IAAI,CAAC,WAAW,EAAE;AACnB,EAAE,IAAI,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE;AACtD,EAAE,IAAI,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;AACpD,EAAE,IAAI,CAAC,IAAI,EAAE;AACb,GAAG,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC;AACtD,GAAG,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK;AACrC,GAAG,IAAI,YAAY,IAAI,KAAK,EAAE;AAC9B,IAAI,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,YAAY,CAAC;AAC9D,IAAI,IAAI,SAAS,EAAE;AACnB,KAAK,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,CAAC;AAC5D,KAAK,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,CAAC;AAC5D,KAAK,KAAK,GAAG,SAAS,CAAC,YAAY;AACnC,KAAK,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;AACnD,IAAI,CAAC,MAAM,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC;AAC5C,GAAG;AACH,EAAE;AACF,EAAE,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE;AACzC,GAAG,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;AACnF,GAAG,IAAI,IAAI,EAAE,MAAM,oBAAoB,CAAC,IAAI,CAAC;AAC7C,EAAE;AACF,EAAE,IAAI,CAAC,IAAI,EAAE;AACb,GAAG,IAAI,cAAc,EAAE,OAAO,oBAAoB,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;AAC/E,IAAI,OAAO,EAAE,sDAAsD;AACnE,IAAI,IAAI,EAAE;AACV,IAAI,CAAC,EAAE;AACP,IAAI,MAAM,EAAE,GAAG;AACf,IAAI,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AACjD,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC;AAC3B,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACrE,EAAE;AACF,EAAE,MAAM,GAAG,OAAO,EAAE,mBAAmB,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AACzE,GAAG,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;AAC1B,GAAG,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AACjE,GAAG,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAC7D,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE;AACjE,GAAG,CAAC;AACJ,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI;AAC1B,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;AACzD,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,mBAAmB,EAAE,UAAU,CAAC;AACrF,CAAC,CAAC,MAAM;AACR,EAAE,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,oBAAoB,CAAC,QAAQ,CAAC;AAC/F,EAAE,MAAM,KAAK,GAAG,kBAAkB,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,EAAE;AAClF,EAAE,IAAI,IAAI,GAAG,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,IAAI;AACnE,EAAE,IAAI,CAAC,IAAI,IAAI,kBAAkB,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE;AAC/D,GAAG,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;AACnF,GAAG,IAAI,CAAC,IAAI,IAAI,QAAQ,KAAK,QAAQ,IAAI,CAAC,wBAAwB,EAAE;AACpE,IAAI,wBAAwB,GAAG,IAAI;AACnC,IAAI,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS;AAC9C,IAAI,MAAM,SAAS,GAAG,SAAS,CAAC,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;AAC3E,IAAI,MAAM,UAAU,GAAG,SAAS,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;AACjE,IAAI,IAAI,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,8OAA8O,EAAE;AACzR,KAAK,SAAS,EAAE,YAAY;AAC5B,KAAK,iBAAiB,EAAE;AACxB,KAAK,CAAC;AACN,SAAS,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,wOAAwO,EAAE;AACzQ,KAAK,SAAS,EAAE,YAAY;AAC5B,KAAK,iBAAiB,EAAE;AACxB,KAAK,CAAC;AACN,GAAG;AACH,EAAE;AACF,EAAE,IAAI,IAAI,EAAE;AACZ,GAAG,MAAM,GAAG,OAAO,EAAE,mBAAmB,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AAC1E,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3B,IAAI,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAClE,IAAI,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAC9D,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE;AAClE,IAAI,CAAC;AACL,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI;AAC3B,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;AAC1D,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,mBAAmB,EAAE,UAAU,CAAC;AACtF,EAAE;AACF,CAAC;AACD,CAAC,OAAO,oBAAoB,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC;AACvE;AACA,IAAI,qBAAqB,GAAG;AAC5B,CAAC,QAAQ;AACT,CAAC,QAAQ;AACT,CAAC;AACD,CAAC;AACD,SAAS,aAAa,CAAC,QAAQ,EAAE;AACjC,CAAC,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,KAAK,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACzF;AACA,SAAS,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE;AAC7D,CAAC,oBAAoB,CAAC,QAAQ,EAAE;AAChC,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;AAC7C,EAAE,WAAW,EAAE,aAAa,CAAC,QAAQ;AACrC,EAAE,CAAC;AACH,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,SAAS,CAAC;AACnD,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,qCAAqC,CAAC;AAChH,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,QAAQ,KAAK,cAAc,IAAI,QAAQ,KAAK,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,wBAAwB,CAAC;AACxK,CAAC,OAAO,QAAQ;AAChB;AACG,IAAC,WAAW,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK;AAChD,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE;AACzB,EAAE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI;AACzB,EAAE,OAAO;AACT,GAAG,OAAO,EAAE,IAAI,CAAC,OAAO;AACxB,GAAG,IAAI,EAAE,IAAI,CAAC,IAAI;AAClB,GAAG,MAAM,EAAE,IAAI,CAAC;AAChB,GAAG;AACH,CAAC;AACD,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,OAAO;AAC/B,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO;AACxB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI;AAClB,EAAE,MAAM,EAAE,KAAK,CAAC;AAChB,EAAE;AACF,CAAC,IAAI,MAAM,KAAK,GAAG,EAAE,OAAO;AAC5B,EAAE,OAAO,EAAE,iBAAiB;AAC5B,EAAE,IAAI,EAAE;AACR,EAAE;AACF,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,SAAS,EAAE,CAAC,KAAK,CAAC;AACxC,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;AAC9B,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;AACnB,EAAE,CAAC,EAAE,KAAK,CAAC,iBAAiB,EAAE;AAC9B,EAAE,SAAS,EAAE,aAAa;AAC1B,EAAE,MAAM;AACR,EAAE,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC;AAC1B,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG;AACvE,EAAE,CAAC;AACH,CAAC,gBAAgB,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE;AACnC,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;AAC9B,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ;AAC3B,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,IAAI,MAAM;AAC5C,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE;AAC3B,EAAE,CAAC;AACH,CAAC,OAAO;AACR,EAAE,OAAO,EAAE,+BAA+B;AAC1C,EAAE,IAAI,EAAE;AACR,EAAE;AACF;;;;"}