@selvajs/selva 4.18.1 → 4.20.0-beta.0

package/build/server/chunks/chunks/api.js-Cv6E39MW.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js-Cv6E39MW.js","sources":["../../../../.svelte-kit/output/server/chunks/api.js"],"sourcesContent":["import { L as PlatformPermissionSchema, M as OrgRoleSchema, b as API_TOKEN_LIFETIME_DAYS, h as ProjectVisibilitySchema, j as OrgPermissionSchema, m as ProjectRoleSchema, v as scopeAllows, w as ALL_ORG_PERMISSIONS, x as ApiScopeStringSchema, y as ProviderError } from \"./src.js\";\nimport { D as SchemaExtractionError, F as isApiError, I as isFlagEnabled, L as NoopEventSink, M as ApiErrorCode, N as apiError, P as codeForStatus, j as ApiError } from \"./access.js\";\nimport { z } from \"zod\";\n//#region ../server/src/api/deps.ts\n/**\n* Everything an API handler talks to, as one injected value.\n*\n* Handlers used to reach module-global getters (`getProjectProvider()`,\n* `getDefinitionService()`, …) from the Selva app's composition root — 77 call\n* sites across the v1 routes. That welded them to one app's boot: a second app\n* on a different provider set could not call them at all.\n*\n* Most fields are sub-stores of `IDataProvider`, so a host that already built a\n* `SelvaConfig` gets them via `depsFromConfig`. `services` stays host-defined:\n* `DefinitionService` and friends are composed rather than resolved, and a host\n* may supply its own.\n*/\n/**\n* Build deps from a resolved `SelvaConfig`, plus whatever services and token\n* codecs the host composed on top. The hoisted fields are aliases into `data`,\n* not copies.\n*\n* `services` stays positional — every existing caller passes it there — and\n* `tokens` arrives in an options object rather than as a third positional, so\n* the two composed bags cannot be swapped at a call site.\n*/\nfunction depsFromConfig(config, services = {}, { tokens = {}, uploadLimits, evictComputeClient = () => {}, notifications, instanceName = \"Selva\" } = {}) {\n\tconst { data } = config;\n\treturn {\n\t\tauth: config.auth,\n\t\tstorage: config.storage,\n\t\tdata,\n\t\torgs: data.orgs,\n\t\tprojects: data.projects,\n\t\tdefinitionMeta: data.definitions,\n\t\tcomputeServer: data.computeServer,\n\t\tuserProfile: data.userProfile,\n\t\tshareLinks: data.shareLinks,\n\t\tinvites: data.invites,\n\t\tpermissions: data.permissions,\n\t\tplatformProjectGrants: data.platformProjectGrants,\n\t\tevents: config.events ?? new NoopEventSink(),\n\t\tflag: (name) => isFlagEnabled(config, name),\n\t\ttokens,\n\t\tuploadLimits: {\n\t\t\tmaxDefinitionFileSize: uploadLimits?.maxDefinitionFileSize ?? 52428800,\n\t\t\tmaxImageFileSize: uploadLimits?.maxImageFileSize ?? 10485760\n\t\t},\n\t\tevictComputeClient,\n\t\tnotifications,\n\t\tinstanceName,\n\t\tservices\n\t};\n}\n//#endregion\n//#region ../server/src/api/scope.ts\n/** The default action for a method: reads are `read`, everything else `write`. */\nfunction actionForMethod(method) {\n\treturn method === \"GET\" || method === \"HEAD\" ? \"read\" : \"write\";\n}\n/**\n* Refuse an API-token request its scopes don't cover, with 403 naming the\n* scope that would have passed. Browser sessions always pass.\n*\n* `runHandler` calls this for every mounted route. A route that builds its own\n* `Response` must call it itself.\n*/\nfunction assertScope(ctx, action, target) {\n\tif (!ctx?.apiScope || scopeAllows(ctx, action, target)) return;\n\trecordRefusal(ctx.apiScope.tokenId);\n\tapiError(403, ApiErrorCode.FORBIDDEN, `This API token doesn't allow ${action} here.`, void 0, { requiredScope: requiredScope(ctx, action, target) });\n}\nvar refusals = /* @__PURE__ */ new Map();\nvar utcDay = () => (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);\nfunction recordRefusal(tokenId) {\n\tconst day = utcDay();\n\tconst entry = refusals.get(tokenId);\n\tif (entry?.day === day) entry.count++;\n\telse refusals.set(tokenId, {\n\t\tday,\n\t\tcount: 1\n\t});\n}\n/** Scope refusals for `tokenId` since midnight UTC, in this process. */\nfunction scopeRefusalsToday(tokenId) {\n\tconst entry = refusals.get(tokenId);\n\treturn entry?.day === utcDay() ? entry.count : 0;\n}\nfunction requiredScope(ctx, action, target) {\n\tif (target?.projectId) return `${action}:project:${target.projectId}`;\n\tif (target?.definitionId) return `${action}:definition:${target.definitionId}`;\n\treturn `${action}:org:${ctx.actingOrgId}`;\n}\n/** Scope target for routes addressed by a project id param. */\nfunction projectScopeTarget(param = \"id\") {\n\treturn (req) => ({ projectId: req.params[param] });\n}\n/**\n* Scope target for routes addressed by a definition guid param. Loads the\n* record so a project-scoped key reaches the definitions inside its project.\n*/\nfunction definitionScopeTarget(param = \"guid\") {\n\treturn async (req) => {\n\t\tconst definitionId = req.params[param];\n\t\tif (!definitionId || !req.ctx) return { definitionId };\n\t\treturn {\n\t\t\tdefinitionId,\n\t\t\tprojectId: (await req.deps.definitionMeta.get(req.ctx, definitionId))?.projectId\n\t\t};\n\t};\n}\n//#endregion\n//#region ../server/src/api/respond.ts\n/**\n* Turn a handler result — or a thrown `ApiError` — into a web-standard\n* `Response`.\n*\n* This is the whole serialization boundary. A host framework that speaks\n* `Request`/`Response` (SvelteKit, Next route handlers, Hono, Remix) needs only\n* to build an `ApiRequest` and call `runHandler`; one that does not can reuse\n* `toErrorBody` and serialize itself.\n*/\nfunction toErrorBody(err) {\n\tconst body = {\n\t\tmessage: err.message,\n\t\tcode: err.code\n\t};\n\tif (err.fields) body.fields = err.fields;\n\tif (err.details) body.details = err.details;\n\treturn body;\n}\nfunction toResponse(result) {\n\tif (result instanceof Response) return result;\n\tconst { status, body, headers } = result;\n\tif (body === void 0) return new Response(null, {\n\t\tstatus: status ?? 204,\n\t\theaders\n\t});\n\treturn new Response(JSON.stringify(body), {\n\t\tstatus: status ?? 200,\n\t\theaders: {\n\t\t\t\"content-type\": \"application/json\",\n\t\t\t...headers\n\t\t}\n\t});\n}\n/** Run a handler and serialize whatever comes out, including failures. */\nasync function runHandler(handler, req, { fallback, mapError, action, scopeTarget }) {\n\ttry {\n\t\tif (req.ctx?.apiScope) assertScope(req.ctx, action ?? actionForMethod(req.request.method), scopeTarget ? await scopeTarget(req) : void 0);\n\t\treturn toResponse(await handler(req));\n\t} catch (err) {\n\t\tif (isApiError(err)) return toResponse({\n\t\t\tstatus: err.status,\n\t\t\tbody: toErrorBody(err)\n\t\t});\n\t\tconst mapped = mapError?.(err);\n\t\tif (mapped) return toResponse({\n\t\t\tstatus: mapped.status,\n\t\t\tbody: toErrorBody(mapped)\n\t\t});\n\t\treq.log.error(`[API] ${fallback}`, {\n\t\t\tcomponent: \"api\",\n\t\t\terr: err instanceof Error ? err.stack ?? err.message : String(err)\n\t\t});\n\t\treturn toResponse({\n\t\t\tstatus: 500,\n\t\t\tbody: {\n\t\t\t\tmessage: fallback,\n\t\t\t\tcode: ApiErrorCode.INTERNAL\n\t\t\t}\n\t\t});\n\t}\n}\n//#endregion\n//#region ../server/src/compute/errors.ts\n/**\n* Compute error types, kept in a leaf module with no imports.\n*\n* Separate from the function that throws them on purpose: an error mapper needs\n* nothing but the class to `instanceof` against, and importing it from beside\n* the throw site drags that module's dependencies into every mapper. Anything\n* an error mapper imports belongs here.\n*/\n/**\n* Thrown when no compute server is configured or visible for the org — a\n* misconfiguration an operator must fix in `/admin/compute`, not a bug. Routes\n* map this to 503 instead of letting the pure helper's plain `Error` surface as\n* a generic 500.\n*/\nvar ComputeServerUnconfiguredError = class extends Error {\n\tconstructor(message = \"No compute server configured. Ask an admin to add one in /admin/compute.\") {\n\t\tsuper(message);\n\t\tthis.name = \"ComputeServerUnconfiguredError\";\n\t}\n};\n//#endregion\n//#region ../server/src/api/map-core-error.ts\n/**\n* The domain errors this package's own handlers raise, folded into the envelope.\n*\n* A host's `mapError` should call this first and add only its own error types.\n* These rules cannot live solely in a host: the handler that throws them ships\n* from here, so a host that forgot one would serve 500 where every other host\n* serves 503 — the same API answering differently depending on who mounted it.\n*\n* Postgres surfaces a unique-constraint name verbatim, which is useless to an\n* end user, so the constraints this package's handlers can trip are translated\n* here rather than left to each host.\n*/\nvar UNIQUE_CONSTRAINT_MESSAGES = {\n\tprojects_org_name_unique: \"A project with that name already exists in this organization.\",\n\tprojects_org_id_slug_key: \"A project with that name already exists in this organization.\",\n\torgs_slug_key: \"An organization with that slug already exists.\",\n\tdefinitions_pkey: \"A definition with that ID already exists.\"\n};\nfunction friendlyConstraintMessage(raw) {\n\tfor (const [name, msg] of Object.entries(UNIQUE_CONSTRAINT_MESSAGES)) if (raw.includes(name)) return msg;\n\treturn null;\n}\n/**\n* Compute unreachable or serving an unreadable schema is operator-side (503); a\n* schema the parser cannot read is the caller's file (422).\n*/\nfunction mapCoreError(err) {\n\tif (err instanceof SchemaExtractionError) return err.kind === \"unreachable\" || err.kind === \"malformed\" ? new ApiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, err.message) : new ApiError(422, ApiErrorCode.UNPROCESSABLE, err.message);\n\tif (err instanceof ComputeServerUnconfiguredError) return new ApiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, err.message);\n\tif (err instanceof ProviderError) {\n\t\tconst friendly = friendlyConstraintMessage(err.message);\n\t\treturn new ApiError(err.statusCode, codeForStatus(err.statusCode), friendly ?? err.message);\n\t}\n}\n//#endregion\n//#region ../server/src/api/pagination.ts\n/**\n* Query-param parsing for the list pagination contract:\n* `?limit=&cursor=&orderBy=&orderDir=` → `{ items, nextCursor? }`.\n*\n* Every list endpoint parses these identically, so the clamping lives here\n* rather than inline per handler — a handler that clamps differently publishes\n* a different contract under the same documented one, and nothing fails at\n* build time.\n*/\n/**\n* An unparseable or out-of-range `limit` clamps rather than 400s: pagination\n* params are plumbing, and failing a read over one is hostile to clients\n* walking a cursor.\n*/\nfunction parseListOptions(url) {\n\tconst raw = Number(url.searchParams.get(\"limit\") ?? 50);\n\tconst limit = Number.isFinite(raw) ? Math.min(Math.max(Math.trunc(raw), 1), 200) : 50;\n\tconst orderByRaw = url.searchParams.get(\"orderBy\");\n\tconst orderBy = orderByRaw === \"createdAt\" || orderByRaw === \"updatedAt\" || orderByRaw === \"name\" ? orderByRaw : void 0;\n\treturn {\n\t\tlimit,\n\t\tcursor: url.searchParams.get(\"cursor\") ?? void 0,\n\t\torderBy,\n\t\torderDir: url.searchParams.get(\"orderDir\") === \"asc\" ? \"asc\" : void 0\n\t};\n}\n/** `parseListOptions` plus the definition-only `solveCount` ordering. */\nfunction parseDefinitionListOptions(url) {\n\tconst base = parseListOptions(url);\n\tif (url.searchParams.get(\"orderBy\") === \"solveCount\") return {\n\t\t...base,\n\t\torderBy: \"solveCount\"\n\t};\n\treturn base;\n}\n//#endregion\n//#region ../server/src/api/bodies.ts\n/**\n* Request-body validators for the API routes that take JSON.\n*\n* They live apart from their handlers so a spec generator can import them\n* without loading a host's route module — in Selva's case a `+server.ts` imports\n* `./$types`, which only resolves inside a SvelteKit build.\n*\n* **A JSON body accepted by an API route belongs in this file.** Adding one\n* inline is invisible to the generator, so the endpoint documents an empty body.\n* Multipart handlers are the exception — `FormData` has no Zod schema to derive\n* from, so their fields are described in the spec directly.\n*/\nvar SolveBodySchema = z.object({\n\tinputs: z.array(z.unknown()).default([]),\n\tvalues: z.record(z.string(), z.unknown()).default({}),\n\tchannel: z.enum([\"live\", \"draft\"]).default(\"live\"),\n\tversionId: z.string().optional(),\n\t/** Must name this same definition, or the route 400s instead of solving a different one. */\n\tdefinitionUrl: z.string().optional()\n});\nvar CreateProjectBodySchema = z.object({\n\tname: z.string().min(1, \"Project name is required\").max(128).trim(),\n\tdescription: z.string().max(2e3).optional(),\n\tvisibility: ProjectVisibilitySchema.default(\"private\"),\n\tautoJoinOnUpload: z.boolean().optional()\n});\nvar UpdateProjectBodySchema = z.object({\n\tname: z.string().min(1).max(128).trim(),\n\tdescription: z.string().max(2e3).nullish(),\n\tvisibility: ProjectVisibilitySchema,\n\tautoJoinOnUpload: z.boolean()\n}).partial();\nvar AddProjectMemberBodySchema = z.object({\n\tuserId: z.string().min(1, \"userId is required\"),\n\trole: ProjectRoleSchema\n});\nvar UpdateProjectMemberBodySchema = z.object({ role: ProjectRoleSchema });\n/** Platform-scope entries are dropped downstream — an invite only grants org rights. */\nvar FlatPermissionSchema = z.union([PlatformPermissionSchema, OrgPermissionSchema]);\nvar CreateInviteBodySchema = z.object({\n\temail: z.email(\"Valid email is required\").transform((s) => s.toLowerCase().trim()),\n\torgRole: OrgRoleSchema.default(\"member\"),\n\tpermissions: z.array(FlatPermissionSchema).default([])\n});\n/**\n* `apiKey` is tri-state: **omitted** keeps the stored key, **null** clears it, a\n* string replaces it. `.optional().nullable()` — not `.nullish()` — because the\n* two must stay distinguishable after parsing, or a request that just omits the\n* field would silently wipe the stored credential.\n*/\nvar IncomingComputeServerSchema = z.object({\n\tid: z.string().min(1),\n\tlabel: z.string().min(1),\n\tserverUrl: z.string().min(1),\n\tapiKey: z.string().nullable().optional(),\n\ttimeoutMs: z.number().optional(),\n\tretryCount: z.number().optional()\n});\nvar OrgComputePatchBodySchema = z.object({\n\tservers: z.array(IncomingComputeServerSchema),\n\t/** May name any server visible to the org. `null` clears the override; omitted leaves it untouched. */\n\tdefaultServerId: z.string().nullable().optional()\n});\nvar UpdateOrgMemberBodySchema = z.object({\n\trole: OrgRoleSchema.optional(),\n\tpermissions: z.array(z.enum(ALL_ORG_PERMISSIONS)).optional()\n}).refine((b) => b.role !== void 0 || b.permissions !== void 0, { message: \"Provide at least one of role, permissions\" });\nvar CreateApiTokenBodySchema = z.object({\n\tname: z.string().trim().min(1, \"Name is required\").max(100),\n\tscopes: z.array(ApiScopeStringSchema).min(1, \"Pick at least one scope\").max(20),\n\texpiresInDays: z.union(API_TOKEN_LIFETIME_DAYS.map((d) => z.literal(d)))\n});\n//#endregion\n//#region ../server/src/api/responses-schema.ts\n/**\n* Response schemas for the v1 payloads that must not carry a stored secret.\n*\n* Four store types hold a credential next to fields a client legitimately\n* reads: `ShareLink.tokenHash`, `Invite.tokenHash` and `ApiToken.tokenHash` are HMACs of a token,\n* `ComputeServerCommon.apiKey` is a live Rhino.Compute key. Handlers used to\n* strip them by destructuring — `const { tokenHash: _omit, ...rest } = invite`\n* — which works until someone adds a field to the stored type or edits the line\n* away. Nothing fails at build time; the credential just starts appearing in a\n* response.\n*\n* Parsing through these schemas inverts the default: the response carries only\n* what the schema names, so a new field on the stored type is invisible to\n* clients until added here on purpose. Use them via `shaped`/`shapedCollection`\n* in `./route.ts`.\n*\n* These describe **responses**, not stored records — where the two differ (an\n* invite's one-time `acceptUrl`, a share link's `hasToken` sentinel) the\n* response is the authority.\n*/\nvar ShareLinkResponseSchema = z.object({\n\tid: z.string(),\n\tdefinitionId: z.string(),\n\tchannel: z.enum([\"live\", \"draft\"]),\n\tname: z.string().optional(),\n\tcreatedBy: z.string(),\n\tcreatedAt: z.string(),\n\texpiresAt: z.string().nullish(),\n\trevokedAt: z.string().nullish(),\n\tallowSolve: z.boolean(),\n\tmaxSolves: z.number().nullish(),\n\tsolveCount: z.number(),\n\t/** Sentinel replacing `tokenHash`: a token exists, its hash is not yours. */\n\thasToken: z.literal(true)\n});\n/** The mint response. `token` is the plaintext, returned exactly once. */\nvar CreatedShareLinkResponseSchema = z.object({\n\tlink: ShareLinkResponseSchema,\n\ttoken: z.string()\n});\nvar InviteResponseSchema = z.object({\n\tid: z.string(),\n\temail: z.string(),\n\torgId: z.string(),\n\torgRole: z.string(),\n\torgPermissions: z.array(z.string()),\n\tplatformPermissions: z.array(z.string()).default([]),\n\tinvitedBy: z.string(),\n\tcreatedAt: z.string(),\n\texpiresAt: z.string(),\n\tacceptedAt: z.string().optional(),\n\tacceptedByUserId: z.string().optional()\n});\n/**\n* The create response: the invite plus the link to send, built per request.\n*\n* `acceptUrl` is returned whatever `delivery` says — mail is best-effort, and\n* manual sharing is the fallback when it is off or the send failed.\n*/\nvar CreatedInviteResponseSchema = InviteResponseSchema.extend({\n\tacceptUrl: z.string(),\n\tdelivery: z.enum([\n\t\t\"sent\",\n\t\t\"not-configured\",\n\t\t\"failed\"\n\t])\n});\n/**\n* An org-owned compute server. `apiKey` is replaced by `hasApiKey`, so a picker\n* can render \"key set\" without any store decrypting a secret to throw away.\n*/\nvar OrgComputeServerResponseSchema = z.object({\n\tid: z.string(),\n\tlabel: z.string(),\n\tserverUrl: z.string(),\n\tscope: z.literal(\"org\"),\n\townerOrgId: z.string(),\n\ttimeoutMs: z.number().optional(),\n\tretryCount: z.number().optional(),\n\thasApiKey: z.boolean()\n});\n/** A server this org may select but not edit. Never carries a key either. */\nvar ComputeCatalogEntrySchema = z.object({\n\tid: z.string(),\n\tlabel: z.string(),\n\tserverUrl: z.string(),\n\tscope: z.enum([\"platform\", \"org\"]),\n\tsource: z.enum([\"platform\", \"org\"]),\n\ttimeoutMs: z.number().optional(),\n\tretryCount: z.number().optional()\n});\nvar OrgComputeResponseSchema = z.object({\n\tservers: z.array(OrgComputeServerResponseSchema),\n\tdefaultServerId: z.string().nullish(),\n\tglobalDefaultServerId: z.string().nullish(),\n\tcatalog: z.array(ComputeCatalogEntrySchema)\n});\nvar ApiTokenResponseSchema = z.object({\n\tid: z.string(),\n\tuserId: z.string(),\n\tcreatedBy: z.string().nullable(),\n\torgId: z.string(),\n\tname: z.string(),\n\tscopes: z.array(z.string()),\n\tcreatedAt: z.string(),\n\texpiresAt: z.string(),\n\tlastUsedAt: z.string().nullable(),\n\trevokedAt: z.string().nullable(),\n\t/** Scope refusals since midnight UTC, counted in this process only. */\n\trefusedToday: z.number()\n});\n/** The mint response. `secret` is the raw key, returned exactly once. */\nvar CreatedApiTokenResponseSchema = z.object({\n\ttoken: ApiTokenResponseSchema,\n\tsecret: z.string()\n});\n//#endregion\nexport { definitionScopeTarget as C, depsFromConfig as E, assertScope as S, scopeRefusalsToday as T, parseDefinitionListOptions as _, InviteResponseSchema as a, ComputeServerUnconfiguredError as b, AddProjectMemberBodySchema as c, CreateProjectBodySchema as d, OrgComputePatchBodySchema as f, UpdateProjectMemberBodySchema as g, UpdateProjectBodySchema as h, CreatedShareLinkResponseSchema as i, CreateApiTokenBodySchema as l, UpdateOrgMemberBodySchema as m, CreatedApiTokenResponseSchema as n, OrgComputeResponseSchema as o, SolveBodySchema as p, CreatedInviteResponseSchema as r, ShareLinkResponseSchema as s, ApiTokenResponseSchema as t, CreateInviteBodySchema as u, parseListOptions as v, projectScopeTarget as w, runHandler as x, mapCoreError as y };\n"],"names":[],"mappings":";;;;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,MAAM,EAAE,QAAQ,GAAG,EAAE,EAAE,EAAE,MAAM,GAAG,EAAE,EAAE,YAAY,EAAE,kBAAkB,GAAG,MAAM,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,GAAG,OAAO,EAAE,GAAG,EAAE,EAAE;AACzJ,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM;AACxB,CAAC,OAAO;AACR,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI;AACnB,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO;AACzB,EAAE,IAAI;AACN,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI;AACjB,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ;AACzB,EAAE,cAAc,EAAE,IAAI,CAAC,WAAW;AAClC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa;AACnC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW;AAC/B,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU;AAC7B,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO;AACvB,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW;AAC/B,EAAE,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;AACnD,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI,aAAa,EAAE;AAC9C,EAAE,IAAI,EAAE,CAAC,IAAI,KAAK,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;AAC7C,EAAE,MAAM;AACR,EAAE,YAAY,EAAE;AAChB,GAAG,qBAAqB,EAAE,YAAY,EAAE,qBAAqB,IAAI,QAAQ;AACzE,GAAG,gBAAgB,EAAE,YAAY,EAAE,gBAAgB,IAAI;AACvD,GAAG;AACH,EAAE,kBAAkB;AACpB,EAAE,aAAa;AACf,EAAE,YAAY;AACd,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA,SAAS,eAAe,CAAC,MAAM,EAAE;AACjC,CAAC,OAAO,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,GAAG,MAAM,GAAG,OAAO;AAChE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE;AAC1C,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,IAAI,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE;AACzD,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;AACpC,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,6BAA6B,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;AACrJ;AACA,IAAI,QAAQ,mBAAmB,IAAI,GAAG,EAAE;AACxC,IAAI,MAAM,GAAG,MAAM,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;AAC1E,SAAS,aAAa,CAAC,OAAO,EAAE;AAChC,CAAC,MAAM,GAAG,GAAG,MAAM,EAAE;AACrB,CAAC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;AACpC,CAAC,IAAI,KAAK,EAAE,GAAG,KAAK,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE;AACtC,MAAM,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE;AAC5B,EAAE,GAAG;AACL,EAAE,KAAK,EAAE;AACT,EAAE,CAAC;AACH;AACA;AACA,SAAS,kBAAkB,CAAC,OAAO,EAAE;AACrC,CAAC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;AACpC,CAAC,OAAO,KAAK,EAAE,GAAG,KAAK,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC;AACjD;AACA,SAAS,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE;AAC5C,CAAC,IAAI,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;AACtE,CAAC,IAAI,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;AAC/E,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;AAC1C;AACA;AACA,SAAS,kBAAkB,CAAC,KAAK,GAAG,IAAI,EAAE;AAC1C,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACnD;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,KAAK,GAAG,MAAM,EAAE;AAC/C,CAAC,OAAO,OAAO,GAAG,KAAK;AACvB,EAAE,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;AACxC,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE;AACxD,EAAE,OAAO;AACT,GAAG,YAAY;AACf,GAAG,SAAS,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,GAAG;AAC1E,GAAG;AACH,CAAC,CAAC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,WAAW,CAAC,GAAG,EAAE;AAC1B,CAAC,MAAM,IAAI,GAAG;AACd,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO;AACtB,EAAE,IAAI,EAAE,GAAG,CAAC;AACZ,EAAE;AACF,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM;AACzC,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO;AAC5C,CAAC,OAAO,IAAI;AACZ;AACA,SAAS,UAAU,CAAC,MAAM,EAAE;AAC5B,CAAC,IAAI,MAAM,YAAY,QAAQ,EAAE,OAAO,MAAM;AAC9C,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM;AACzC,CAAC,IAAI,IAAI,KAAK,MAAM,EAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;AAChD,EAAE,MAAM,EAAE,MAAM,IAAI,GAAG;AACvB,EAAE;AACF,EAAE,CAAC;AACH,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;AAC3C,EAAE,MAAM,EAAE,MAAM,IAAI,GAAG;AACvB,EAAE,OAAO,EAAE;AACX,GAAG,cAAc,EAAE,kBAAkB;AACrC,GAAG,GAAG;AACN;AACA,EAAE,CAAC;AACH;AACA;AACA,eAAe,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE;AACrF,CAAC,IAAI;AACL,EAAE,IAAI,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;AAC3I,EAAE,OAAO,UAAU,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;AACvC,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,OAAO,UAAU,CAAC;AACzC,GAAG,MAAM,EAAE,GAAG,CAAC,MAAM;AACrB,GAAG,IAAI,EAAE,WAAW,CAAC,GAAG;AACxB,GAAG,CAAC;AACJ,EAAE,MAAM,MAAM,GAAG,QAAQ,GAAG,GAAG,CAAC;AAChC,EAAE,IAAI,MAAM,EAAE,OAAO,UAAU,CAAC;AAChC,GAAG,MAAM,EAAE,MAAM,CAAC,MAAM;AACxB,GAAG,IAAI,EAAE,WAAW,CAAC,MAAM;AAC3B,GAAG,CAAC;AACJ,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE;AACrC,GAAG,SAAS,EAAE,KAAK;AACnB,GAAG,GAAG,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG;AACpE,GAAG,CAAC;AACJ,EAAE,OAAO,UAAU,CAAC;AACpB,GAAG,MAAM,EAAE,GAAG;AACd,GAAG,IAAI,EAAE;AACT,IAAI,OAAO,EAAE,QAAQ;AACrB,IAAI,IAAI,EAAE,YAAY,CAAC;AACvB;AACA,GAAG,CAAC;AACJ,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,8BAA8B,GAAG,cAAc,KAAK,CAAC;AACzD,CAAC,WAAW,CAAC,OAAO,GAAG,0EAA0E,EAAE;AACnG,EAAE,KAAK,CAAC,OAAO,CAAC;AAChB,EAAE,IAAI,CAAC,IAAI,GAAG,gCAAgC;AAC9C,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,0BAA0B,GAAG;AACjC,CAAC,wBAAwB,EAAE,+DAA+D;AAC1F,CAAC,wBAAwB,EAAE,+DAA+D;AAC1F,CAAC,aAAa,EAAE,gDAAgD;AAChE,CAAC,gBAAgB,EAAE;AACnB,CAAC;AACD,SAAS,yBAAyB,CAAC,GAAG,EAAE;AACxC,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG;AACzG,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA,SAAS,YAAY,CAAC,GAAG,EAAE;AAC3B,CAAC,IAAI,GAAG,YAAY,qBAAqB,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,aAAa,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,GAAG,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC;AACxO,CAAC,IAAI,GAAG,YAAY,8BAA8B,EAAE,OAAO,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,GAAG,CAAC,OAAO,CAAC;AAC3H,CAAC,IAAI,GAAG,YAAY,aAAa,EAAE;AACnC,EAAE,MAAM,QAAQ,GAAG,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC;AACzD,EAAE,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC;AAC7F,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,CAAC,GAAG,EAAE;AAC/B,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;AACxD,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,EAAE;AACtF,CAAC,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC;AACnD,CAAC,MAAM,OAAO,GAAG,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,MAAM,GAAG,UAAU,GAAG,MAAM;AACxH,CAAC,OAAO;AACR,EAAE,KAAK;AACP,EAAE,MAAM,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM;AAClD,EAAE,OAAO;AACT,EAAE,QAAQ,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,KAAK,GAAG,KAAK,GAAG;AACjE,EAAE;AACF;AACA;AACA,SAAS,0BAA0B,CAAC,GAAG,EAAE;AACzC,CAAC,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC;AACnC,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,YAAY,EAAE,OAAO;AAC9D,EAAE,GAAG,IAAI;AACT,EAAE,OAAO,EAAE;AACX,EAAE;AACF,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;AAC/B,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;AACzC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;AACtD,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;AACnD,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AACjC;AACA,CAAC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ;AACnC,CAAC;AACE,IAAC,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;AACvC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;AACpE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AAC5C,CAAC,UAAU,EAAE,uBAAuB,CAAC,OAAO,CAAC,SAAS,CAAC;AACvD,CAAC,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ;AACvC,CAAC;AACE,IAAC,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;AACvC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;AACxC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE;AAC3C,CAAC,UAAU,EAAE,uBAAuB;AACpC,CAAC,gBAAgB,EAAE,CAAC,CAAC,OAAO;AAC5B,CAAC,CAAC,CAAC,OAAO;AACP,IAAC,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;AAC1C,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,oBAAoB,CAAC;AAChD,CAAC,IAAI,EAAE;AACP,CAAC;AACE,IAAC,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE;AACxE;AACA,IAAI,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,wBAAwB,EAAE,mBAAmB,CAAC,CAAC;AAChF,IAAC,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;AACtC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;AACnF,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC;AACzC,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,EAAE;AACtD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;AAC3C,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AACtB,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AACzB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7B,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AACzC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AACjC,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ;AAChC,CAAC,CAAC;AACC,IAAC,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;AACzC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC;AAC9C;AACA,CAAC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ;AAChD,CAAC;AACE,IAAC,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;AACzC,CAAC,IAAI,EAAE,aAAa,CAAC,QAAQ,EAAE;AAC/B,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,QAAQ;AAC3D,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,MAAM,EAAE,EAAE,OAAO,EAAE,2CAA2C,EAAE;AACrH,IAAC,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;AACxC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;AAC5D,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;AAChF,CAAC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;AACvC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;AACf,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;AACzB,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACnC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AAC5B,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;AAChC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;AAChC,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;AACxB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;AAChC,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;AACvB;AACA,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI;AACzB,CAAC;AACD;AACG,IAAC,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;AAC9C,CAAC,IAAI,EAAE,uBAAuB;AAC9B,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM;AAChB,CAAC;AACE,IAAC,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;AACpC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;AACf,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;AAClB,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;AAClB,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;AACpB,CAAC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AACpC,CAAC,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;AACrD,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AAClC,CAAC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ;AACtC,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,2BAA2B,GAAG,oBAAoB,CAAC,MAAM,CAAC;AAC9D,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC;AAClB,EAAE,MAAM;AACR,EAAE,gBAAgB;AAClB,EAAE;AACF,EAAE;AACF,CAAC;AACD;AACA;AACA;AACA;AACA,IAAI,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;AAC9C,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;AACf,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;AAClB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;AACxB,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;AACvB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AACjC,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AAClC,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO;AACrB,CAAC,CAAC;AACF;AACA,IAAI,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;AACzC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;AACf,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;AAClB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AACpC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AACjC,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ;AAChC,CAAC,CAAC;AACC,IAAC,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;AACxC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC;AACjD,CAAC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;AACtC,CAAC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;AAC5C,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB;AAC3C,CAAC;AACE,IAAC,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;AACtC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;AACf,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;AACnB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AACjC,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;AAClB,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;AACjB,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AAC5B,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AAClC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AACjC;AACA,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM;AACvB,CAAC;AACD;AACG,IAAC,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;AAC7C,CAAC,KAAK,EAAE,sBAAsB;AAC9B,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM;AACjB,CAAC;;;;"}

package/build/server/chunks/chunks/arrow-left.js-CL-SopHe.js

@@ -0,0 +1,15 @@
+import { ai as spread_props } from './server.js-eNE8c09e.js';
+import { I as Icon } from './utils2.js-C1oP9gJ9.js';
+
+//#region ../../node_modules/.pnpm/@lucide+svelte@1.48.0_svelte@5.57.1_@typescript-eslint+types@8.70.1_/node_modules/@lucide/svelte/dist/icons/arrow-left.svelte
+function Arrow_left($$renderer, $$props) {
+	let { $$slots, $$events, ...props } = $$props;
+	Icon($$renderer, spread_props([props, { icon: {
+		"name": "arrow-left",
+		"size": 24,
+		"node": [["path", { "d": "m12 19-7-7 7-7" }], ["path", { "d": "M19 12H5" }]]
+	} }]));
+}
+
+export { Arrow_left as A };
+//# sourceMappingURL=arrow-left.js-CL-SopHe.js.map

package/build/server/chunks/chunks/arrow-left.js-CL-SopHe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"arrow-left.js-CL-SopHe.js","sources":["../../../../.svelte-kit/output/server/chunks/arrow-left.js"],"sourcesContent":["import { d as spread_props } from \"./server.js\";\nimport { n as Icon } from \"./utils2.js\";\n//#region ../../node_modules/.pnpm/@lucide+svelte@1.48.0_svelte@5.57.1_@typescript-eslint+types@8.70.1_/node_modules/@lucide/svelte/dist/icons/arrow-left.svelte\nfunction Arrow_left($$renderer, $$props) {\n\tlet { $$slots, $$events, ...props } = $$props;\n\tIcon($$renderer, spread_props([props, { icon: {\n\t\t\"name\": \"arrow-left\",\n\t\t\"size\": 24,\n\t\t\"node\": [[\"path\", { \"d\": \"m12 19-7-7 7-7\" }], [\"path\", { \"d\": \"M19 12H5\" }]]\n\t} }]));\n}\n//#endregion\nexport { Arrow_left as t };\n"],"names":[],"mappings":";;;AAEA;AACA,SAAS,UAAU,CAAC,UAAU,EAAE,OAAO,EAAE;AACzC,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO;AAC9C,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE;AAC/C,EAAE,MAAM,EAAE,YAAY;AACtB,EAAE,MAAM,EAAE,EAAE;AACZ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;AAC7E,EAAE,EAAE,CAAC,CAAC,CAAC;AACP;;;;"}

package/build/server/chunks/chunks/arrow-right.js-7VB0HIju.js

@@ -0,0 +1,15 @@
+import { ai as spread_props } from './server.js-eNE8c09e.js';
+import { I as Icon } from './utils2.js-C1oP9gJ9.js';
+
+//#region ../../node_modules/.pnpm/@lucide+svelte@1.48.0_svelte@5.57.1_@typescript-eslint+types@8.70.1_/node_modules/@lucide/svelte/dist/icons/arrow-right.svelte
+function Arrow_right($$renderer, $$props) {
+	let { $$slots, $$events, ...props } = $$props;
+	Icon($$renderer, spread_props([props, { icon: {
+		"name": "arrow-right",
+		"size": 24,
+		"node": [["path", { "d": "M5 12h14" }], ["path", { "d": "m12 5 7 7-7 7" }]]
+	} }]));
+}
+
+export { Arrow_right as A };
+//# sourceMappingURL=arrow-right.js-7VB0HIju.js.map

package/build/server/chunks/chunks/arrow-right.js-7VB0HIju.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"arrow-right.js-7VB0HIju.js","sources":["../../../../.svelte-kit/output/server/chunks/arrow-right.js"],"sourcesContent":["import { d as spread_props } from \"./server.js\";\nimport { n as Icon } from \"./utils2.js\";\n//#region ../../node_modules/.pnpm/@lucide+svelte@1.48.0_svelte@5.57.1_@typescript-eslint+types@8.70.1_/node_modules/@lucide/svelte/dist/icons/arrow-right.svelte\nfunction Arrow_right($$renderer, $$props) {\n\tlet { $$slots, $$events, ...props } = $$props;\n\tIcon($$renderer, spread_props([props, { icon: {\n\t\t\"name\": \"arrow-right\",\n\t\t\"size\": 24,\n\t\t\"node\": [[\"path\", { \"d\": \"M5 12h14\" }], [\"path\", { \"d\": \"m12 5 7 7-7 7\" }]]\n\t} }]));\n}\n//#endregion\nexport { Arrow_right as t };\n"],"names":[],"mappings":";;;AAEA;AACA,SAAS,WAAW,CAAC,UAAU,EAAE,OAAO,EAAE;AAC1C,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO;AAC9C,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE;AAC/C,EAAE,MAAM,EAAE,aAAa;AACvB,EAAE,MAAM,EAAE,EAAE;AACZ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;AAC5E,EAAE,EAAE,CAAC,CAAC,CAAC;AACP;;;;"}

package/build/server/chunks/chunks/auth-bootstrap.server.js-VpEomuJH.js

@@ -0,0 +1,152 @@
+import { b as private_env } from './shared-server.js-BGs15m2r.js';
+import { S as SYSTEM_CONTEXT, A as ALL_PLATFORM_PERMISSIONS, k as slugify } from './src.js-DubgTP8X.js';
+import { a as getAuthProvider, g as getLogger, b as getPermissionStore, c as getTenancy, d as getDataProvider, e as getOrganizationProvider, f as getProjectProvider } from './providers.server.js-ChZPXW9c.js';
+import { randomUUID } from 'node:crypto';
+
+//#region src/lib/server/auth-bootstrap.server.ts
+/**
+* Shared post-verification flow used by every IdP-callback route (OAuth,
+* email link, future SAML, …). Order matters:
+*
+*   1. `data.ensureUser` — guarantee a user-data row exists for whatever ID
+*      the auth provider issued. Local-provider creates a JSON row;
+*      Supabase no-ops (its DB trigger has already fired).
+*   2. Bootstrap-admin grant — if no instance_admin exists yet AND the
+*      tenancy/env policy allows it, grant the signing-in user every
+*      platform permission so `/admin` becomes reachable.
+*   3. Single-tenant org seed — create the default Organization + Project
+*      owned by the new admin, mirroring what `/setup` does for password
+*      auth. Without this, org-scoped permissions (manage_projects,
+*      manage_definitions) silently drop because `actingOrgId` resolves to
+*      undefined.
+*
+* Cookie/redirect are the caller's job since they vary by capability (OAuth
+* has refresh tokens, magic-link does sometimes, SAML doesn't).
+*/
+async function bootstrapUserSession(user) {
+	await getDataProvider().ensureUser(SYSTEM_CONTEXT, user.id);
+	const tenancy = getTenancy();
+	const perms = getPermissionStore();
+	const hasAdmin = await perms.hasInstanceAdmin(SYSTEM_CONTEXT);
+	let grantedAdminHere = false;
+	if (!hasAdmin) {
+		if (!shouldBootstrapAdmin(user, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, tenancy)) return;
+		grantedAdminHere = await perms.claimFirstInstanceAdmin(SYSTEM_CONTEXT, user.id, [...ALL_PLATFORM_PERMISSIONS]);
+		if (!grantedAdminHere) return;
+	}
+	if (tenancy !== "single") return;
+	if ((await getOrganizationProvider().listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items.length > 0) return;
+	if (!grantedAdminHere) {
+		if (!(await perms.getFor(SYSTEM_CONTEXT, user.id)).includes("instance_admin")) return;
+	}
+	await ensureSingleTenantDefaultOrg(user);
+}
+/**
+* Seeds the single default Organization + Project that `actingOrgId` needs
+* to resolve, for flows that skip `/setup` (header-auth, OAuth callback,
+* future SAML). No-op outside single-tenant mode and once any org exists.
+* Slug derives from the admin's email/displayName so the URL looks like the
+* deployment rather than a UUID; falls back to `default` for anonymous
+* UPN-only sign-ins.
+*/
+async function ensureSingleTenantDefaultOrg(user) {
+	if (getTenancy() !== "single") return;
+	const orgs = getOrganizationProvider();
+	if ((await orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items.length > 0) return;
+	const orgName = (typeof user.metadata?.displayName === "string" ? user.metadata.displayName : void 0)?.trim() || user.email?.split("@")[0]?.trim() || "Default";
+	const slug = slugify(orgName).length >= 3 ? slugify(orgName) : "default";
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const org = {
+		id: randomUUID(),
+		name: orgName,
+		slug,
+		ownerId: user.id,
+		createdBy: user.id,
+		updatedBy: user.id,
+		createdAt: now,
+		updatedAt: now,
+		deletedAt: null
+	};
+	await orgs.createOrg(SYSTEM_CONTEXT, org);
+	const projects = getProjectProvider();
+	const project = {
+		id: randomUUID(),
+		orgId: org.id,
+		name: "Default",
+		slug: "default",
+		visibility: "public",
+		ownerId: user.id,
+		createdBy: user.id,
+		updatedBy: user.id,
+		autoJoinOnUpload: false,
+		createdAt: now,
+		updatedAt: now,
+		deletedAt: null
+	};
+	await projects.createProject(SYSTEM_CONTEXT, project);
+}
+/**
+* Whether the signing-in user qualifies for the first-admin grant. Pure — no
+* I/O — so the policy is unit-testable.
+*
+* - `tenancy='single'` + no env var → first signer wins (fine for
+*   self-hosted fresh installs).
+* - `tenancy='single'` + env var set → only the named user qualifies.
+* - `tenancy='multi'` → env var REQUIRED; the named user must match the
+*   signer. Without it, the first random signup would become Selva staff.
+*
+* The env var also doubles as the break-glass recovery path when admin is
+* lost to backup restores or migration drift.
+*/
+function shouldBootstrapAdmin(user, configuredEmail, mode) {
+	const expected = configuredEmail?.trim().toLowerCase();
+	if (mode === "multi" && !expected) return false;
+	if (!expected) return true;
+	const actual = user.email?.trim().toLowerCase();
+	return !!actual && actual === expected;
+}
+/**
+* Header-auth variant of `shouldBootstrapAdmin`, used by
+* `wireHeaderAuthBootstrap` to decide whether an unrecognized UPN arriving
+* through the proxy should be auto-allowlisted as the first admin. Operates
+* on the raw UPN/email before any allowlist row exists. For Entra
+* deployments UPN ≈ email; if they differ, the proxy forwards both and we
+* prefer email when present.
+*/
+function shouldBootstrapUpn(upn, email, configuredEmail, mode) {
+	const expected = configuredEmail?.trim().toLowerCase();
+	if (mode === "multi" && !expected) return false;
+	if (!expected) return true;
+	const candidate = (email ?? upn).trim().toLowerCase();
+	return !!candidate && candidate === expected;
+}
+/**
+* Wires a bootstrap-allowlist policy onto the auth provider if it supports
+* header-auth-style first-admin bootstrapping. Idempotent — safe to call on
+* every startup; the provider holds the policy until process exit.
+*
+* Header-auth deployments can't reach `/setup` (no password form, no OAuth
+* callback), so without this the first proxy-authenticated visitor is
+* silently rejected (UPN not in allowlist) and the operator has to
+* hand-write JSON files. With it, the first visit whose UPN/email matches
+* `BOOTSTRAP_INSTANCE_ADMIN_EMAIL` is auto-allowlisted, and the immediately
+* following `bootstrapUserSession` call grants instance_admin.
+*
+* Gated by `hasInstanceAdmin` — once any admin exists, the policy returns
+* false and strict allowlist-only behavior resumes.
+*/
+function wireHeaderAuthBootstrap() {
+	const auth = getAuthProvider();
+	if (!auth.proxyAuth) return;
+	if (typeof auth.setBootstrapAllowlistPolicy !== "function") {
+		if (private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL?.trim()) getLogger().warn("BOOTSTRAP_INSTANCE_ADMIN_EMAIL is set but the installed @selvajs/header-auth-provider does not expose setBootstrapAllowlistPolicy. Upgrade the provider, or hand-seed header-allowlist.json.", { component: "auth-bootstrap" });
+		return;
+	}
+	auth.setBootstrapAllowlistPolicy(async ({ upn, email }) => {
+		if (await getPermissionStore().hasInstanceAdmin(SYSTEM_CONTEXT)) return false;
+		return shouldBootstrapUpn(upn, email, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, getTenancy());
+	});
+}
+
+export { bootstrapUserSession as b, wireHeaderAuthBootstrap as w };
+//# sourceMappingURL=auth-bootstrap.server.js-VpEomuJH.js.map

package/build/server/chunks/chunks/auth-bootstrap.server.js-VpEomuJH.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-bootstrap.server.js-VpEomuJH.js","sources":["../../../../.svelte-kit/output/server/chunks/auth-bootstrap.server.js"],"sourcesContent":["import { t as private_env } from \"./shared-server.js\";\nimport { F as ALL_PLATFORM_PERMISSIONS, P as slugify, t as SYSTEM_CONTEXT } from \"./src.js\";\nimport { S as getTenancy, f as getLogger, g as getPermissionStore, h as getOrganizationProvider, o as getDataProvider, r as getAuthProvider, v as getProjectProvider } from \"./providers.server.js\";\nimport { randomUUID } from \"node:crypto\";\n//#region src/lib/server/auth-bootstrap.server.ts\n/**\n* Shared post-verification flow used by every IdP-callback route (OAuth,\n* email link, future SAML, …). Order matters:\n*\n*   1. `data.ensureUser` — guarantee a user-data row exists for whatever ID\n*      the auth provider issued. Local-provider creates a JSON row;\n*      Supabase no-ops (its DB trigger has already fired).\n*   2. Bootstrap-admin grant — if no instance_admin exists yet AND the\n*      tenancy/env policy allows it, grant the signing-in user every\n*      platform permission so `/admin` becomes reachable.\n*   3. Single-tenant org seed — create the default Organization + Project\n*      owned by the new admin, mirroring what `/setup` does for password\n*      auth. Without this, org-scoped permissions (manage_projects,\n*      manage_definitions) silently drop because `actingOrgId` resolves to\n*      undefined.\n*\n* Cookie/redirect are the caller's job since they vary by capability (OAuth\n* has refresh tokens, magic-link does sometimes, SAML doesn't).\n*/\nasync function bootstrapUserSession(user) {\n\tawait getDataProvider().ensureUser(SYSTEM_CONTEXT, user.id);\n\tconst tenancy = getTenancy();\n\tconst perms = getPermissionStore();\n\tconst hasAdmin = await perms.hasInstanceAdmin(SYSTEM_CONTEXT);\n\tlet grantedAdminHere = false;\n\tif (!hasAdmin) {\n\t\tif (!shouldBootstrapAdmin(user, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, tenancy)) return;\n\t\tgrantedAdminHere = await perms.claimFirstInstanceAdmin(SYSTEM_CONTEXT, user.id, [...ALL_PLATFORM_PERMISSIONS]);\n\t\tif (!grantedAdminHere) return;\n\t}\n\tif (tenancy !== \"single\") return;\n\tif ((await getOrganizationProvider().listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items.length > 0) return;\n\tif (!grantedAdminHere) {\n\t\tif (!(await perms.getFor(SYSTEM_CONTEXT, user.id)).includes(\"instance_admin\")) return;\n\t}\n\tawait ensureSingleTenantDefaultOrg(user);\n}\n/**\n* Seeds the single default Organization + Project that `actingOrgId` needs\n* to resolve, for flows that skip `/setup` (header-auth, OAuth callback,\n* future SAML). No-op outside single-tenant mode and once any org exists.\n* Slug derives from the admin's email/displayName so the URL looks like the\n* deployment rather than a UUID; falls back to `default` for anonymous\n* UPN-only sign-ins.\n*/\nasync function ensureSingleTenantDefaultOrg(user) {\n\tif (getTenancy() !== \"single\") return;\n\tconst orgs = getOrganizationProvider();\n\tif ((await orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items.length > 0) return;\n\tconst orgName = (typeof user.metadata?.displayName === \"string\" ? user.metadata.displayName : void 0)?.trim() || user.email?.split(\"@\")[0]?.trim() || \"Default\";\n\tconst slug = slugify(orgName).length >= 3 ? slugify(orgName) : \"default\";\n\tconst now = (/* @__PURE__ */ new Date()).toISOString();\n\tconst org = {\n\t\tid: randomUUID(),\n\t\tname: orgName,\n\t\tslug,\n\t\townerId: user.id,\n\t\tcreatedBy: user.id,\n\t\tupdatedBy: user.id,\n\t\tcreatedAt: now,\n\t\tupdatedAt: now,\n\t\tdeletedAt: null\n\t};\n\tawait orgs.createOrg(SYSTEM_CONTEXT, org);\n\tconst projects = getProjectProvider();\n\tconst project = {\n\t\tid: randomUUID(),\n\t\torgId: org.id,\n\t\tname: \"Default\",\n\t\tslug: \"default\",\n\t\tvisibility: \"public\",\n\t\townerId: user.id,\n\t\tcreatedBy: user.id,\n\t\tupdatedBy: user.id,\n\t\tautoJoinOnUpload: false,\n\t\tcreatedAt: now,\n\t\tupdatedAt: now,\n\t\tdeletedAt: null\n\t};\n\tawait projects.createProject(SYSTEM_CONTEXT, project);\n}\n/**\n* Whether the signing-in user qualifies for the first-admin grant. Pure — no\n* I/O — so the policy is unit-testable.\n*\n* - `tenancy='single'` + no env var → first signer wins (fine for\n*   self-hosted fresh installs).\n* - `tenancy='single'` + env var set → only the named user qualifies.\n* - `tenancy='multi'` → env var REQUIRED; the named user must match the\n*   signer. Without it, the first random signup would become Selva staff.\n*\n* The env var also doubles as the break-glass recovery path when admin is\n* lost to backup restores or migration drift.\n*/\nfunction shouldBootstrapAdmin(user, configuredEmail, mode) {\n\tconst expected = configuredEmail?.trim().toLowerCase();\n\tif (mode === \"multi\" && !expected) return false;\n\tif (!expected) return true;\n\tconst actual = user.email?.trim().toLowerCase();\n\treturn !!actual && actual === expected;\n}\n/**\n* Header-auth variant of `shouldBootstrapAdmin`, used by\n* `wireHeaderAuthBootstrap` to decide whether an unrecognized UPN arriving\n* through the proxy should be auto-allowlisted as the first admin. Operates\n* on the raw UPN/email before any allowlist row exists. For Entra\n* deployments UPN ≈ email; if they differ, the proxy forwards both and we\n* prefer email when present.\n*/\nfunction shouldBootstrapUpn(upn, email, configuredEmail, mode) {\n\tconst expected = configuredEmail?.trim().toLowerCase();\n\tif (mode === \"multi\" && !expected) return false;\n\tif (!expected) return true;\n\tconst candidate = (email ?? upn).trim().toLowerCase();\n\treturn !!candidate && candidate === expected;\n}\n/**\n* Wires a bootstrap-allowlist policy onto the auth provider if it supports\n* header-auth-style first-admin bootstrapping. Idempotent — safe to call on\n* every startup; the provider holds the policy until process exit.\n*\n* Header-auth deployments can't reach `/setup` (no password form, no OAuth\n* callback), so without this the first proxy-authenticated visitor is\n* silently rejected (UPN not in allowlist) and the operator has to\n* hand-write JSON files. With it, the first visit whose UPN/email matches\n* `BOOTSTRAP_INSTANCE_ADMIN_EMAIL` is auto-allowlisted, and the immediately\n* following `bootstrapUserSession` call grants instance_admin.\n*\n* Gated by `hasInstanceAdmin` — once any admin exists, the policy returns\n* false and strict allowlist-only behavior resumes.\n*/\nfunction wireHeaderAuthBootstrap() {\n\tconst auth = getAuthProvider();\n\tif (!auth.proxyAuth) return;\n\tif (typeof auth.setBootstrapAllowlistPolicy !== \"function\") {\n\t\tif (private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL?.trim()) getLogger().warn(\"BOOTSTRAP_INSTANCE_ADMIN_EMAIL is set but the installed @selvajs/header-auth-provider does not expose setBootstrapAllowlistPolicy. Upgrade the provider, or hand-seed header-allowlist.json.\", { component: \"auth-bootstrap\" });\n\t\treturn;\n\t}\n\tauth.setBootstrapAllowlistPolicy(async ({ upn, email }) => {\n\t\tif (await getPermissionStore().hasInstanceAdmin(SYSTEM_CONTEXT)) return false;\n\t\treturn shouldBootstrapUpn(upn, email, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, getTenancy());\n\t});\n}\n//#endregion\nexport { wireHeaderAuthBootstrap as n, bootstrapUserSession as t };\n"],"names":[],"mappings":";;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,oBAAoB,CAAC,IAAI,EAAE;AAC1C,CAAC,MAAM,eAAe,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAC5D,CAAC,MAAM,OAAO,GAAG,UAAU,EAAE;AAC7B,CAAC,MAAM,KAAK,GAAG,kBAAkB,EAAE;AACnC,CAAC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,cAAc,CAAC;AAC9D,CAAC,IAAI,gBAAgB,GAAG,KAAK;AAC7B,CAAC,IAAI,CAAC,QAAQ,EAAE;AAChB,EAAE,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,WAAW,CAAC,8BAA8B,EAAE,OAAO,CAAC,EAAE;AACxF,EAAE,gBAAgB,GAAG,MAAM,KAAK,CAAC,uBAAuB,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,wBAAwB,CAAC,CAAC;AAChH,EAAE,IAAI,CAAC,gBAAgB,EAAE;AACzB,CAAC;AACD,CAAC,IAAI,OAAO,KAAK,QAAQ,EAAE;AAC3B,CAAC,IAAI,CAAC,MAAM,uBAAuB,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;AAChG,CAAC,IAAI,CAAC,gBAAgB,EAAE;AACxB,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE;AACjF,CAAC;AACD,CAAC,MAAM,4BAA4B,CAAC,IAAI,CAAC;AACzC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,4BAA4B,CAAC,IAAI,EAAE;AAClD,CAAC,IAAI,UAAU,EAAE,KAAK,QAAQ,EAAE;AAChC,CAAC,MAAM,IAAI,GAAG,uBAAuB,EAAE;AACvC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;AAC3E,CAAC,MAAM,OAAO,GAAG,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,WAAW,KAAK,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,GAAG,MAAM,GAAG,IAAI,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS;AAChK,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS;AACzE,CAAC,MAAM,GAAG,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACvD,CAAC,MAAM,GAAG,GAAG;AACb,EAAE,EAAE,EAAE,UAAU,EAAE;AAClB,EAAE,IAAI,EAAE,OAAO;AACf,EAAE,IAAI;AACN,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;AAClB,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;AACpB,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;AACpB,EAAE,SAAS,EAAE,GAAG;AAChB,EAAE,SAAS,EAAE,GAAG;AAChB,EAAE,SAAS,EAAE;AACb,EAAE;AACF,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,CAAC;AAC1C,CAAC,MAAM,QAAQ,GAAG,kBAAkB,EAAE;AACtC,CAAC,MAAM,OAAO,GAAG;AACjB,EAAE,EAAE,EAAE,UAAU,EAAE;AAClB,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE;AACf,EAAE,IAAI,EAAE,SAAS;AACjB,EAAE,IAAI,EAAE,SAAS;AACjB,EAAE,UAAU,EAAE,QAAQ;AACtB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;AAClB,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;AACpB,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;AACpB,EAAE,gBAAgB,EAAE,KAAK;AACzB,EAAE,SAAS,EAAE,GAAG;AAChB,EAAE,SAAS,EAAE,GAAG;AAChB,EAAE,SAAS,EAAE;AACb,EAAE;AACF,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,cAAc,EAAE,OAAO,CAAC;AACtD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,oBAAoB,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE;AAC3D,CAAC,MAAM,QAAQ,GAAG,eAAe,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACvD,CAAC,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,KAAK;AAChD,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI;AAC3B,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AAChD,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,MAAM,KAAK,QAAQ;AACvC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE;AAC/D,CAAC,MAAM,QAAQ,GAAG,eAAe,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACvD,CAAC,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,KAAK;AAChD,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI;AAC3B,CAAC,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACtD,CAAC,OAAO,CAAC,CAAC,SAAS,IAAI,SAAS,KAAK,QAAQ;AAC7C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,uBAAuB,GAAG;AACnC,CAAC,MAAM,IAAI,GAAG,eAAe,EAAE;AAC/B,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;AACtB,CAAC,IAAI,OAAO,IAAI,CAAC,2BAA2B,KAAK,UAAU,EAAE;AAC7D,EAAE,IAAI,WAAW,CAAC,8BAA8B,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,8LAA8L,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC;AAC3S,EAAE;AACF,CAAC;AACD,CAAC,IAAI,CAAC,2BAA2B,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK;AAC5D,EAAE,IAAI,MAAM,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,OAAO,KAAK;AAC/E,EAAE,OAAO,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,CAAC,8BAA8B,EAAE,UAAU,EAAE,CAAC;AACjG,CAAC,CAAC,CAAC;AACH;;;;"}

package/build/server/chunks/chunks/badge.js-BCG_Rnjh.js

@@ -0,0 +1,35 @@
+import { aq as element, al as attributes, am as clsx$1, at as bind_props } from './server.js-eNE8c09e.js';
+import { c as cn } from './utils2.js-C1oP9gJ9.js';
+import { tv } from 'tailwind-variants';
+
+//#region ../ui/dist/components/primitives/badge/badge.svelte
+var badgeVariants = tv({
+	base: "focus-visible:border-ring focus-visible:ring-ring/50 aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive inline-flex w-fit shrink-0 items-center justify-center gap-1 overflow-hidden rounded-full border px-2 py-0.5 text-xs font-medium whitespace-nowrap transition-[color,box-shadow] focus-visible:ring-[3px] [&>svg]:pointer-events-none [&>svg]:size-3",
+	variants: { variant: {
+		default: "bg-primary text-primary-foreground [a&]:hover:bg-primary/90 border-transparent",
+		secondary: "bg-secondary text-secondary-foreground [a&]:hover:bg-secondary/90 border-transparent",
+		destructive: "bg-destructive [a&]:hover:bg-destructive/90 focus-visible:ring-destructive/20 dark:focus-visible:ring-destructive/40 dark:bg-destructive/70 border-transparent text-white",
+		outline: "text-foreground [a&]:hover:bg-accent [a&]:hover:text-accent-foreground"
+	} },
+	defaultVariants: { variant: "default" }
+});
+function Badge($$renderer, $$props) {
+	$$renderer.component(($$renderer) => {
+		let { ref = null, href, class: className, variant = "default", children, $$slots, $$events, ...restProps } = $$props;
+		element($$renderer, href ? "a" : "span", () => {
+			$$renderer.push(`${attributes({
+				"data-slot": "badge",
+				href,
+				class: clsx$1(cn(badgeVariants({ variant }), className)),
+				...restProps
+			})}`);
+		}, () => {
+			children?.($$renderer);
+			$$renderer.push(`<!---->`);
+		});
+		bind_props($$props, { ref });
+	});
+}
+
+export { Badge as B };
+//# sourceMappingURL=badge.js-BCG_Rnjh.js.map

package/build/server/chunks/chunks/badge.js-BCG_Rnjh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"badge.js-BCG_Rnjh.js","sources":["../../../../.svelte-kit/output/server/chunks/badge.js"],"sourcesContent":["import { O as clsx, i as bind_props, o as element, r as attributes } from \"./server.js\";\nimport { t as cn } from \"./utils2.js\";\nimport { tv } from \"tailwind-variants\";\n//#region ../ui/dist/components/primitives/badge/badge.svelte\nvar badgeVariants = tv({\n\tbase: \"focus-visible:border-ring focus-visible:ring-ring/50 aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive inline-flex w-fit shrink-0 items-center justify-center gap-1 overflow-hidden rounded-full border px-2 py-0.5 text-xs font-medium whitespace-nowrap transition-[color,box-shadow] focus-visible:ring-[3px] [&>svg]:pointer-events-none [&>svg]:size-3\",\n\tvariants: { variant: {\n\t\tdefault: \"bg-primary text-primary-foreground [a&]:hover:bg-primary/90 border-transparent\",\n\t\tsecondary: \"bg-secondary text-secondary-foreground [a&]:hover:bg-secondary/90 border-transparent\",\n\t\tdestructive: \"bg-destructive [a&]:hover:bg-destructive/90 focus-visible:ring-destructive/20 dark:focus-visible:ring-destructive/40 dark:bg-destructive/70 border-transparent text-white\",\n\t\toutline: \"text-foreground [a&]:hover:bg-accent [a&]:hover:text-accent-foreground\"\n\t} },\n\tdefaultVariants: { variant: \"default\" }\n});\nfunction Badge($$renderer, $$props) {\n\t$$renderer.component(($$renderer) => {\n\t\tlet { ref = null, href, class: className, variant = \"default\", children, $$slots, $$events, ...restProps } = $$props;\n\t\telement($$renderer, href ? \"a\" : \"span\", () => {\n\t\t\t$$renderer.push(`${attributes({\n\t\t\t\t\"data-slot\": \"badge\",\n\t\t\t\thref,\n\t\t\t\tclass: clsx(cn(badgeVariants({ variant }), className)),\n\t\t\t\t...restProps\n\t\t\t})}`);\n\t\t}, () => {\n\t\t\tchildren?.($$renderer);\n\t\t\t$$renderer.push(`<!---->`);\n\t\t});\n\t\tbind_props($$props, { ref });\n\t});\n}\n//#endregion\nexport { Badge as t };\n"],"names":["clsx"],"mappings":";;;;AAGA;AACA,IAAI,aAAa,GAAG,EAAE,CAAC;AACvB,CAAC,IAAI,EAAE,kZAAkZ;AACzZ,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE;AACtB,EAAE,OAAO,EAAE,gFAAgF;AAC3F,EAAE,SAAS,EAAE,sFAAsF;AACnG,EAAE,WAAW,EAAE,2KAA2K;AAC1L,EAAE,OAAO,EAAE;AACX,EAAE,EAAE;AACJ,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,SAAS;AACtC,CAAC,CAAC;AACF,SAAS,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE;AACpC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,UAAU,KAAK;AACtC,EAAE,IAAI,EAAE,GAAG,GAAG,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,GAAG,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,SAAS,EAAE,GAAG,OAAO;AACtH,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,GAAG,GAAG,GAAG,MAAM,EAAE,MAAM;AACjD,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC;AACjC,IAAI,WAAW,EAAE,OAAO;AACxB,IAAI,IAAI;AACR,IAAI,KAAK,EAAEA,MAAI,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;AAC1D,IAAI,GAAG;AACP,IAAI,CAAC,CAAC,CAAC,CAAC;AACR,EAAE,CAAC,EAAE,MAAM;AACX,GAAG,QAAQ,GAAG,UAAU,CAAC;AACzB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;AAC7B,EAAE,CAAC,CAAC;AACJ,EAAE,UAAU,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC;AAC9B,CAAC,CAAC,CAAC;AACH;;;;"}

package/build/server/chunks/chunks/bootHealth.server.js-DcXPBDtQ.js

@@ -0,0 +1,90 @@
+import { p as providers, g as getLogger } from './providers.server.js-ChZPXW9c.js';
+import { r as renderThrown } from './definitions.js-BE-Zf2cL.js';
+
+//#region src/lib/server/bootHealth.server.ts
+var cached = null;
+var inflight = null;
+async function run() {
+	let atRestSecrets = null;
+	const store = providers.data.computeServer;
+	if (typeof store.verifySecrets === "function") try {
+		atRestSecrets = await store.verifySecrets();
+	} catch (err) {
+		getLogger().error("verifySecrets threw — treating as failure", {
+			component: "boot",
+			err: renderThrown(err)
+		});
+		atRestSecrets = {
+			ok: false,
+			plaintextFound: false,
+			failures: [{
+				serverId: "(unknown)",
+				serverLabel: "(unknown)",
+				reason: "key_mismatch",
+				cause: err instanceof Error ? err.message : String(err)
+			}]
+		};
+	}
+	if (atRestSecrets && !atRestSecrets.ok) {
+		for (const f of atRestSecrets.failures) getLogger().error("At-rest secret verification failed for compute server", {
+			component: "boot",
+			serverLabel: f.serverLabel,
+			serverId: f.serverId,
+			reason: f.reason,
+			cause: f.cause
+		});
+		getLogger().error("At-rest secret verification failed. /api/health will return 503. Recover by re-entering the affected apiKeys via /admin/compute, or by restoring the original SELVA_AT_REST_KEY. See docs/Troubleshooting.md.", { component: "boot" });
+	}
+	let schemaVersion = null;
+	const data = providers.data;
+	if (typeof data.verifySchemaVersion === "function") try {
+		schemaVersion = await data.verifySchemaVersion();
+	} catch (err) {
+		getLogger().error("verifySchemaVersion threw — treating as failure", {
+			component: "boot",
+			err: renderThrown(err)
+		});
+		schemaVersion = {
+			ok: false,
+			expected: "(unknown)",
+			actual: null,
+			message: err instanceof Error ? err.message : String(err)
+		};
+	}
+	if (schemaVersion && !schemaVersion.ok) getLogger().error("Database schema handshake failed. /api/health will return 503.", {
+		component: "boot",
+		expected: schemaVersion.expected,
+		actual: schemaVersion.actual ?? "unavailable",
+		detail: schemaVersion.message
+	});
+	return {
+		checkedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		atRestSecrets,
+		schemaVersion
+	};
+}
+/**
+* Runs the underlying checks at most once — subsequent callers receive the
+* same result; in-flight callers share a single promise. Does NOT auto-refresh
+* after an operator fixes the underlying issue — restart the process to
+* re-run the boot check. That's deliberate: boot health represents the state
+* at boot, by definition.
+*/
+function getBootHealth() {
+	if (cached) return Promise.resolve(cached);
+	if (inflight) return inflight;
+	inflight = run().then((result) => {
+		cached = result;
+		inflight = null;
+		return result;
+	});
+	return inflight;
+}
+function isDegraded(report) {
+	if (report.atRestSecrets !== null && !report.atRestSecrets.ok) return true;
+	if (report.schemaVersion !== null && !report.schemaVersion.ok) return true;
+	return false;
+}
+
+export { getBootHealth as g, isDegraded as i };
+//# sourceMappingURL=bootHealth.server.js-DcXPBDtQ.js.map

package/build/server/chunks/chunks/bootHealth.server.js-DcXPBDtQ.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootHealth.server.js-DcXPBDtQ.js","sources":["../../../../.svelte-kit/output/server/chunks/bootHealth.server.js"],"sourcesContent":["import { T as providers, f as getLogger } from \"./providers.server.js\";\nimport { l as renderThrown } from \"./definitions.js\";\n//#region src/lib/server/bootHealth.server.ts\nvar cached = null;\nvar inflight = null;\nasync function run() {\n\tlet atRestSecrets = null;\n\tconst store = providers.data.computeServer;\n\tif (typeof store.verifySecrets === \"function\") try {\n\t\tatRestSecrets = await store.verifySecrets();\n\t} catch (err) {\n\t\tgetLogger().error(\"verifySecrets threw — treating as failure\", {\n\t\t\tcomponent: \"boot\",\n\t\t\terr: renderThrown(err)\n\t\t});\n\t\tatRestSecrets = {\n\t\t\tok: false,\n\t\t\tplaintextFound: false,\n\t\t\tfailures: [{\n\t\t\t\tserverId: \"(unknown)\",\n\t\t\t\tserverLabel: \"(unknown)\",\n\t\t\t\treason: \"key_mismatch\",\n\t\t\t\tcause: err instanceof Error ? err.message : String(err)\n\t\t\t}]\n\t\t};\n\t}\n\tif (atRestSecrets && !atRestSecrets.ok) {\n\t\tfor (const f of atRestSecrets.failures) getLogger().error(\"At-rest secret verification failed for compute server\", {\n\t\t\tcomponent: \"boot\",\n\t\t\tserverLabel: f.serverLabel,\n\t\t\tserverId: f.serverId,\n\t\t\treason: f.reason,\n\t\t\tcause: f.cause\n\t\t});\n\t\tgetLogger().error(\"At-rest secret verification failed. /api/health will return 503. Recover by re-entering the affected apiKeys via /admin/compute, or by restoring the original SELVA_AT_REST_KEY. See docs/Troubleshooting.md.\", { component: \"boot\" });\n\t}\n\tlet schemaVersion = null;\n\tconst data = providers.data;\n\tif (typeof data.verifySchemaVersion === \"function\") try {\n\t\tschemaVersion = await data.verifySchemaVersion();\n\t} catch (err) {\n\t\tgetLogger().error(\"verifySchemaVersion threw — treating as failure\", {\n\t\t\tcomponent: \"boot\",\n\t\t\terr: renderThrown(err)\n\t\t});\n\t\tschemaVersion = {\n\t\t\tok: false,\n\t\t\texpected: \"(unknown)\",\n\t\t\tactual: null,\n\t\t\tmessage: err instanceof Error ? err.message : String(err)\n\t\t};\n\t}\n\tif (schemaVersion && !schemaVersion.ok) getLogger().error(\"Database schema handshake failed. /api/health will return 503.\", {\n\t\tcomponent: \"boot\",\n\t\texpected: schemaVersion.expected,\n\t\tactual: schemaVersion.actual ?? \"unavailable\",\n\t\tdetail: schemaVersion.message\n\t});\n\treturn {\n\t\tcheckedAt: (/* @__PURE__ */ new Date()).toISOString(),\n\t\tatRestSecrets,\n\t\tschemaVersion\n\t};\n}\n/**\n* Runs the underlying checks at most once — subsequent callers receive the\n* same result; in-flight callers share a single promise. Does NOT auto-refresh\n* after an operator fixes the underlying issue — restart the process to\n* re-run the boot check. That's deliberate: boot health represents the state\n* at boot, by definition.\n*/\nfunction getBootHealth() {\n\tif (cached) return Promise.resolve(cached);\n\tif (inflight) return inflight;\n\tinflight = run().then((result) => {\n\t\tcached = result;\n\t\tinflight = null;\n\t\treturn result;\n\t});\n\treturn inflight;\n}\nfunction isDegraded(report) {\n\tif (report.atRestSecrets !== null && !report.atRestSecrets.ok) return true;\n\tif (report.schemaVersion !== null && !report.schemaVersion.ok) return true;\n\treturn false;\n}\n//#endregion\nexport { isDegraded as n, getBootHealth as t };\n"],"names":[],"mappings":";;;AAEA;AACA,IAAI,MAAM,GAAG,IAAI;AACjB,IAAI,QAAQ,GAAG,IAAI;AACnB,eAAe,GAAG,GAAG;AACrB,CAAC,IAAI,aAAa,GAAG,IAAI;AACzB,CAAC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa;AAC3C,CAAC,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,UAAU,EAAE,IAAI;AACpD,EAAE,aAAa,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;AAC7C,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,2CAA2C,EAAE;AACjE,GAAG,SAAS,EAAE,MAAM;AACpB,GAAG,GAAG,EAAE,YAAY,CAAC,GAAG;AACxB,GAAG,CAAC;AACJ,EAAE,aAAa,GAAG;AAClB,GAAG,EAAE,EAAE,KAAK;AACZ,GAAG,cAAc,EAAE,KAAK;AACxB,GAAG,QAAQ,EAAE,CAAC;AACd,IAAI,QAAQ,EAAE,WAAW;AACzB,IAAI,WAAW,EAAE,WAAW;AAC5B,IAAI,MAAM,EAAE,cAAc;AAC1B,IAAI,KAAK,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG;AAC1D,IAAI;AACJ,GAAG;AACH,CAAC;AACD,CAAC,IAAI,aAAa,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE;AACzC,EAAE,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,uDAAuD,EAAE;AACrH,GAAG,SAAS,EAAE,MAAM;AACpB,GAAG,WAAW,EAAE,CAAC,CAAC,WAAW;AAC7B,GAAG,QAAQ,EAAE,CAAC,CAAC,QAAQ;AACvB,GAAG,MAAM,EAAE,CAAC,CAAC,MAAM;AACnB,GAAG,KAAK,EAAE,CAAC,CAAC;AACZ,GAAG,CAAC;AACJ,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,+MAA+M,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC3P,CAAC;AACD,CAAC,IAAI,aAAa,GAAG,IAAI;AACzB,CAAC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI;AAC5B,CAAC,IAAI,OAAO,IAAI,CAAC,mBAAmB,KAAK,UAAU,EAAE,IAAI;AACzD,EAAE,aAAa,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE;AAClD,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,iDAAiD,EAAE;AACvE,GAAG,SAAS,EAAE,MAAM;AACpB,GAAG,GAAG,EAAE,YAAY,CAAC,GAAG;AACxB,GAAG,CAAC;AACJ,EAAE,aAAa,GAAG;AAClB,GAAG,EAAE,EAAE,KAAK;AACZ,GAAG,QAAQ,EAAE,WAAW;AACxB,GAAG,MAAM,EAAE,IAAI;AACf,GAAG,OAAO,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG;AAC3D,GAAG;AACH,CAAC;AACD,CAAC,IAAI,aAAa,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,gEAAgE,EAAE;AAC7H,EAAE,SAAS,EAAE,MAAM;AACnB,EAAE,QAAQ,EAAE,aAAa,CAAC,QAAQ;AAClC,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,IAAI,aAAa;AAC/C,EAAE,MAAM,EAAE,aAAa,CAAC;AACxB,EAAE,CAAC;AACH,CAAC,OAAO;AACR,EAAE,SAAS,EAAE,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACvD,EAAE,aAAa;AACf,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,GAAG;AACzB,CAAC,IAAI,MAAM,EAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;AAC3C,CAAC,IAAI,QAAQ,EAAE,OAAO,QAAQ;AAC9B,CAAC,QAAQ,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK;AACnC,EAAE,MAAM,GAAG,MAAM;AACjB,EAAE,QAAQ,GAAG,IAAI;AACjB,EAAE,OAAO,MAAM;AACf,CAAC,CAAC,CAAC;AACH,CAAC,OAAO,QAAQ;AAChB;AACA,SAAS,UAAU,CAAC,MAAM,EAAE;AAC5B,CAAC,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,OAAO,IAAI;AAC3E,CAAC,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,OAAO,IAAI;AAC3E,CAAC,OAAO,KAAK;AACb;;;;"}

package/build/server/chunks/chunks/building-complex.js-GAE4qB9n.js

@@ -0,0 +1,22 @@
+import { ai as spread_props } from './server.js-eNE8c09e.js';
+import { I as Icon } from './utils2.js-C1oP9gJ9.js';
+
+//#region ../../node_modules/.pnpm/@lucide+svelte@1.48.0_svelte@5.57.1_@typescript-eslint+types@8.70.1_/node_modules/@lucide/svelte/dist/icons/building-complex.svelte
+function Building_complex($$renderer, $$props) {
+	let { $$slots, $$events, ...props } = $$props;
+	Icon($$renderer, spread_props([props, { icon: {
+		"name": "building-complex",
+		"size": 24,
+		"node": [
+			["path", { "d": "M10 12h4" }],
+			["path", { "d": "M10 8h4" }],
+			["path", { "d": "M14 21v-3a2 2 0 0 0-4 0v3" }],
+			["path", { "d": "M6 10H4a2 2 0 0 0-2 2v7a2 2 0 0 0 2 2h16a2 2 0 0 0 2-2V9a2 2 0 0 0-2-2h-2" }],
+			["path", { "d": "M6 21V5a2 2 0 0 1 2-2h8a2 2 0 0 1 2 2v16" }]
+		],
+		"aliases": ["building-2"]
+	} }]));
+}
+
+export { Building_complex as B };
+//# sourceMappingURL=building-complex.js-GAE4qB9n.js.map

package/build/server/chunks/chunks/building-complex.js-GAE4qB9n.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"building-complex.js-GAE4qB9n.js","sources":["../../../../.svelte-kit/output/server/chunks/building-complex.js"],"sourcesContent":["import { d as spread_props } from \"./server.js\";\nimport { n as Icon } from \"./utils2.js\";\n//#region ../../node_modules/.pnpm/@lucide+svelte@1.48.0_svelte@5.57.1_@typescript-eslint+types@8.70.1_/node_modules/@lucide/svelte/dist/icons/building-complex.svelte\nfunction Building_complex($$renderer, $$props) {\n\tlet { $$slots, $$events, ...props } = $$props;\n\tIcon($$renderer, spread_props([props, { icon: {\n\t\t\"name\": \"building-complex\",\n\t\t\"size\": 24,\n\t\t\"node\": [\n\t\t\t[\"path\", { \"d\": \"M10 12h4\" }],\n\t\t\t[\"path\", { \"d\": \"M10 8h4\" }],\n\t\t\t[\"path\", { \"d\": \"M14 21v-3a2 2 0 0 0-4 0v3\" }],\n\t\t\t[\"path\", { \"d\": \"M6 10H4a2 2 0 0 0-2 2v7a2 2 0 0 0 2 2h16a2 2 0 0 0 2-2V9a2 2 0 0 0-2-2h-2\" }],\n\t\t\t[\"path\", { \"d\": \"M6 21V5a2 2 0 0 1 2-2h8a2 2 0 0 1 2 2v16\" }]\n\t\t],\n\t\t\"aliases\": [\"building-2\"]\n\t} }]));\n}\n//#endregion\nexport { Building_complex as t };\n"],"names":[],"mappings":";;;AAEA;AACA,SAAS,gBAAgB,CAAC,UAAU,EAAE,OAAO,EAAE;AAC/C,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO;AAC9C,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE;AAC/C,EAAE,MAAM,EAAE,kBAAkB;AAC5B,EAAE,MAAM,EAAE,EAAE;AACZ,EAAE,MAAM,EAAE;AACV,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;AAChC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;AAC/B,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,2BAA2B,EAAE,CAAC;AACjD,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,2EAA2E,EAAE,CAAC;AACjG,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,0CAA0C,EAAE;AAC/D,GAAG;AACH,EAAE,SAAS,EAAE,CAAC,YAAY;AAC1B,EAAE,EAAE,CAAC,CAAC,CAAC;AACP;;;;"}

package/build/server/chunks/chunks/button.js-BrFJSLO-.js

@@ -0,0 +1,69 @@
+import { al as attributes, am as clsx$1, at as bind_props } from './server.js-eNE8c09e.js';
+import { c as cn } from './utils2.js-C1oP9gJ9.js';
+import { tv } from 'tailwind-variants';
+
+//#region ../ui/dist/components/primitives/button/button.svelte
+var buttonVariants = tv({
+	base: "focus-visible:border-ring focus-visible:ring-ring/50 aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive inline-flex shrink-0 items-center justify-center gap-2 whitespace-nowrap rounded-md text-sm font-medium outline-none transition-all focus-visible:ring-[3px] disabled:pointer-events-none disabled:opacity-50 aria-disabled:pointer-events-none aria-disabled:opacity-50 [&_svg:not([class*='size-'])]:size-4 [&_svg]:pointer-events-none [&_svg]:shrink-0",
+	variants: {
+		variant: {
+			default: "bg-primary text-primary-foreground shadow-xs hover:bg-primary/90",
+			destructive: "bg-destructive shadow-xs hover:bg-destructive/90 focus-visible:ring-destructive/20 dark:focus-visible:ring-destructive/40 dark:bg-destructive/60 text-white",
+			outline: "bg-background shadow-xs hover:bg-accent hover:text-accent-foreground dark:bg-input/30 dark:border-input dark:hover:bg-input/50 border",
+			secondary: "bg-secondary text-secondary-foreground shadow-xs hover:bg-secondary/80",
+			ghost: "hover:bg-accent hover:text-accent-foreground dark:hover:bg-accent/50",
+			dashed: "border border-dashed border-input bg-background text-muted-foreground hover:bg-muted hover:text-foreground",
+			link: "text-primary underline-offset-4 hover:underline"
+		},
+		size: {
+			default: "h-9 px-4 py-2 has-[>svg]:px-3",
+			sm: "h-8 gap-1.5 rounded-md px-3 has-[>svg]:px-2.5",
+			lg: "h-10 rounded-md px-6 has-[>svg]:px-4",
+			icon: "size-9",
+			"icon-sm": "size-8",
+			"icon-lg": "size-10"
+		}
+	},
+	defaultVariants: {
+		variant: "default",
+		size: "default"
+	}
+});
+function Button($$renderer, $$props) {
+	$$renderer.component(($$renderer) => {
+		let { class: className, variant = "default", size = "default", ref = null, href = void 0, type = "button", disabled, children, $$slots, $$events, ...restProps } = $$props;
+		if (href) {
+			$$renderer.push(`<!--[0--><a${attributes({
+				"data-slot": "button",
+				class: clsx$1(cn(buttonVariants({
+					variant,
+					size
+				}), className)),
+				href: disabled ? void 0 : href,
+				"aria-disabled": disabled,
+				"data-sveltekit-reload": true,
+				...restProps
+			})}>`);
+			children?.($$renderer);
+			$$renderer.push(`<!----></a>`);
+		} else {
+			$$renderer.push(`<!--[-1--><button${attributes({
+				"data-slot": "button",
+				class: clsx$1(cn(buttonVariants({
+					variant,
+					size
+				}), className)),
+				type,
+				disabled,
+				...restProps
+			})}>`);
+			children?.($$renderer);
+			$$renderer.push(`<!----></button>`);
+		}
+		$$renderer.push(`<!--]-->`);
+		bind_props($$props, { ref });
+	});
+}
+
+export { Button as B, buttonVariants as b };
+//# sourceMappingURL=button.js-BrFJSLO-.js.map

package/build/server/chunks/chunks/button.js-BrFJSLO-.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"button.js-BrFJSLO-.js","sources":["../../../../.svelte-kit/output/server/chunks/button.js"],"sourcesContent":["import { O as clsx, i as bind_props, r as attributes } from \"./server.js\";\nimport { t as cn } from \"./utils2.js\";\nimport { tv } from \"tailwind-variants\";\n//#region ../ui/dist/components/primitives/button/button.svelte\nvar buttonVariants = tv({\n\tbase: \"focus-visible:border-ring focus-visible:ring-ring/50 aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive inline-flex shrink-0 items-center justify-center gap-2 whitespace-nowrap rounded-md text-sm font-medium outline-none transition-all focus-visible:ring-[3px] disabled:pointer-events-none disabled:opacity-50 aria-disabled:pointer-events-none aria-disabled:opacity-50 [&_svg:not([class*='size-'])]:size-4 [&_svg]:pointer-events-none [&_svg]:shrink-0\",\n\tvariants: {\n\t\tvariant: {\n\t\t\tdefault: \"bg-primary text-primary-foreground shadow-xs hover:bg-primary/90\",\n\t\t\tdestructive: \"bg-destructive shadow-xs hover:bg-destructive/90 focus-visible:ring-destructive/20 dark:focus-visible:ring-destructive/40 dark:bg-destructive/60 text-white\",\n\t\t\toutline: \"bg-background shadow-xs hover:bg-accent hover:text-accent-foreground dark:bg-input/30 dark:border-input dark:hover:bg-input/50 border\",\n\t\t\tsecondary: \"bg-secondary text-secondary-foreground shadow-xs hover:bg-secondary/80\",\n\t\t\tghost: \"hover:bg-accent hover:text-accent-foreground dark:hover:bg-accent/50\",\n\t\t\tdashed: \"border border-dashed border-input bg-background text-muted-foreground hover:bg-muted hover:text-foreground\",\n\t\t\tlink: \"text-primary underline-offset-4 hover:underline\"\n\t\t},\n\t\tsize: {\n\t\t\tdefault: \"h-9 px-4 py-2 has-[>svg]:px-3\",\n\t\t\tsm: \"h-8 gap-1.5 rounded-md px-3 has-[>svg]:px-2.5\",\n\t\t\tlg: \"h-10 rounded-md px-6 has-[>svg]:px-4\",\n\t\t\ticon: \"size-9\",\n\t\t\t\"icon-sm\": \"size-8\",\n\t\t\t\"icon-lg\": \"size-10\"\n\t\t}\n\t},\n\tdefaultVariants: {\n\t\tvariant: \"default\",\n\t\tsize: \"default\"\n\t}\n});\nfunction Button($$renderer, $$props) {\n\t$$renderer.component(($$renderer) => {\n\t\tlet { class: className, variant = \"default\", size = \"default\", ref = null, href = void 0, type = \"button\", disabled, children, $$slots, $$events, ...restProps } = $$props;\n\t\tif (href) {\n\t\t\t$$renderer.push(`<!--[0--><a${attributes({\n\t\t\t\t\"data-slot\": \"button\",\n\t\t\t\tclass: clsx(cn(buttonVariants({\n\t\t\t\t\tvariant,\n\t\t\t\t\tsize\n\t\t\t\t}), className)),\n\t\t\t\thref: disabled ? void 0 : href,\n\t\t\t\t\"aria-disabled\": disabled,\n\t\t\t\t\"data-sveltekit-reload\": true,\n\t\t\t\t...restProps\n\t\t\t})}>`);\n\t\t\tchildren?.($$renderer);\n\t\t\t$$renderer.push(`<!----></a>`);\n\t\t} else {\n\t\t\t$$renderer.push(`<!--[-1--><button${attributes({\n\t\t\t\t\"data-slot\": \"button\",\n\t\t\t\tclass: clsx(cn(buttonVariants({\n\t\t\t\t\tvariant,\n\t\t\t\t\tsize\n\t\t\t\t}), className)),\n\t\t\t\ttype,\n\t\t\t\tdisabled,\n\t\t\t\t...restProps\n\t\t\t})}>`);\n\t\t\tchildren?.($$renderer);\n\t\t\t$$renderer.push(`<!----></button>`);\n\t\t}\n\t\t$$renderer.push(`<!--]-->`);\n\t\tbind_props($$props, { ref });\n\t});\n}\n//#endregion\nexport { buttonVariants as n, Button as t };\n"],"names":["clsx"],"mappings":";;;;AAGA;AACG,IAAC,cAAc,GAAG,EAAE,CAAC;AACxB,CAAC,IAAI,EAAE,wfAAwf;AAC/f,CAAC,QAAQ,EAAE;AACX,EAAE,OAAO,EAAE;AACX,GAAG,OAAO,EAAE,kEAAkE;AAC9E,GAAG,WAAW,EAAE,6JAA6J;AAC7K,GAAG,OAAO,EAAE,uIAAuI;AACnJ,GAAG,SAAS,EAAE,wEAAwE;AACtF,GAAG,KAAK,EAAE,sEAAsE;AAChF,GAAG,MAAM,EAAE,4GAA4G;AACvH,GAAG,IAAI,EAAE;AACT,GAAG;AACH,EAAE,IAAI,EAAE;AACR,GAAG,OAAO,EAAE,+BAA+B;AAC3C,GAAG,EAAE,EAAE,+CAA+C;AACtD,GAAG,EAAE,EAAE,sCAAsC;AAC7C,GAAG,IAAI,EAAE,QAAQ;AACjB,GAAG,SAAS,EAAE,QAAQ;AACtB,GAAG,SAAS,EAAE;AACd;AACA,EAAE;AACF,CAAC,eAAe,EAAE;AAClB,EAAE,OAAO,EAAE,SAAS;AACpB,EAAE,IAAI,EAAE;AACR;AACA,CAAC;AACD,SAAS,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE;AACrC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,UAAU,KAAK;AACtC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,GAAG,SAAS,EAAE,IAAI,GAAG,SAAS,EAAE,GAAG,GAAG,IAAI,EAAE,IAAI,GAAG,MAAM,EAAE,IAAI,GAAG,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,SAAS,EAAE,GAAG,OAAO;AAC5K,EAAE,IAAI,IAAI,EAAE;AACZ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,UAAU,CAAC;AAC5C,IAAI,WAAW,EAAE,QAAQ;AACzB,IAAI,KAAK,EAAEA,MAAI,CAAC,EAAE,CAAC,cAAc,CAAC;AAClC,KAAK,OAAO;AACZ,KAAK;AACL,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;AACnB,IAAI,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,IAAI;AAClC,IAAI,eAAe,EAAE,QAAQ;AAC7B,IAAI,uBAAuB,EAAE,IAAI;AACjC,IAAI,GAAG;AACP,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACT,GAAG,QAAQ,GAAG,UAAU,CAAC;AACzB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC;AACjC,EAAE,CAAC,MAAM;AACT,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,UAAU,CAAC;AAClD,IAAI,WAAW,EAAE,QAAQ;AACzB,IAAI,KAAK,EAAEA,MAAI,CAAC,EAAE,CAAC,cAAc,CAAC;AAClC,KAAK,OAAO;AACZ,KAAK;AACL,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;AACnB,IAAI,IAAI;AACR,IAAI,QAAQ;AACZ,IAAI,GAAG;AACP,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACT,GAAG,QAAQ,GAAG,UAAU,CAAC;AACzB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,CAAC;AACtC,EAAE;AACF,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;AAC7B,EAAE,UAAU,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC;AAC9B,CAAC,CAAC,CAAC;AACH;;;;"}

package/build/server/chunks/chunks/card-content.js-5qPeaM_y.js

@@ -0,0 +1,35 @@
+import { al as attributes, am as clsx$1, at as bind_props } from './server.js-eNE8c09e.js';
+import { c as cn } from './utils2.js-C1oP9gJ9.js';
+
+//#region ../ui/dist/components/primitives/card/card.svelte
+function Card($$renderer, $$props) {
+	$$renderer.component(($$renderer) => {
+		let { ref = null, class: className, children, $$slots, $$events, ...restProps } = $$props;
+		$$renderer.push(`<div${attributes({
+			"data-slot": "card",
+			class: clsx$1(cn("gap-6 py-6 shadow-sm flex flex-col rounded-xl border bg-card text-card-foreground", className)),
+			...restProps
+		})}>`);
+		children?.($$renderer);
+		$$renderer.push(`<!----></div>`);
+		bind_props($$props, { ref });
+	});
+}
+//#endregion
+//#region ../ui/dist/components/primitives/card/card-content.svelte
+function Card_content($$renderer, $$props) {
+	$$renderer.component(($$renderer) => {
+		let { ref = null, class: className, children, $$slots, $$events, ...restProps } = $$props;
+		$$renderer.push(`<div${attributes({
+			"data-slot": "card-content",
+			class: clsx$1(cn("px-6", className)),
+			...restProps
+		})}>`);
+		children?.($$renderer);
+		$$renderer.push(`<!----></div>`);
+		bind_props($$props, { ref });
+	});
+}
+
+export { Card as C, Card_content as a };
+//# sourceMappingURL=card-content.js-5qPeaM_y.js.map

package/build/server/chunks/chunks/card-content.js-5qPeaM_y.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"card-content.js-5qPeaM_y.js","sources":["../../../../.svelte-kit/output/server/chunks/card-content.js"],"sourcesContent":["import { O as clsx, i as bind_props, r as attributes } from \"./server.js\";\nimport { t as cn } from \"./utils2.js\";\n//#region ../ui/dist/components/primitives/card/card.svelte\nfunction Card($$renderer, $$props) {\n\t$$renderer.component(($$renderer) => {\n\t\tlet { ref = null, class: className, children, $$slots, $$events, ...restProps } = $$props;\n\t\t$$renderer.push(`<div${attributes({\n\t\t\t\"data-slot\": \"card\",\n\t\t\tclass: clsx(cn(\"gap-6 py-6 shadow-sm flex flex-col rounded-xl border bg-card text-card-foreground\", className)),\n\t\t\t...restProps\n\t\t})}>`);\n\t\tchildren?.($$renderer);\n\t\t$$renderer.push(`<!----></div>`);\n\t\tbind_props($$props, { ref });\n\t});\n}\n//#endregion\n//#region ../ui/dist/components/primitives/card/card-content.svelte\nfunction Card_content($$renderer, $$props) {\n\t$$renderer.component(($$renderer) => {\n\t\tlet { ref = null, class: className, children, $$slots, $$events, ...restProps } = $$props;\n\t\t$$renderer.push(`<div${attributes({\n\t\t\t\"data-slot\": \"card-content\",\n\t\t\tclass: clsx(cn(\"px-6\", className)),\n\t\t\t...restProps\n\t\t})}>`);\n\t\tchildren?.($$renderer);\n\t\t$$renderer.push(`<!----></div>`);\n\t\tbind_props($$props, { ref });\n\t});\n}\n//#endregion\nexport { Card as n, Card_content as t };\n"],"names":["clsx"],"mappings":";;;AAEA;AACA,SAAS,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE;AACnC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,UAAU,KAAK;AACtC,EAAE,IAAI,EAAE,GAAG,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,SAAS,EAAE,GAAG,OAAO;AAC3F,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC;AACpC,GAAG,WAAW,EAAE,MAAM;AACtB,GAAG,KAAK,EAAEA,MAAI,CAAC,EAAE,CAAC,mFAAmF,EAAE,SAAS,CAAC,CAAC;AAClH,GAAG,GAAG;AACN,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACR,EAAE,QAAQ,GAAG,UAAU,CAAC;AACxB,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC;AAClC,EAAE,UAAU,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC;AAC9B,CAAC,CAAC,CAAC;AACH;AACA;AACA;AACA,SAAS,YAAY,CAAC,UAAU,EAAE,OAAO,EAAE;AAC3C,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,UAAU,KAAK;AACtC,EAAE,IAAI,EAAE,GAAG,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,SAAS,EAAE,GAAG,OAAO;AAC3F,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC;AACpC,GAAG,WAAW,EAAE,cAAc;AAC9B,GAAG,KAAK,EAAEA,MAAI,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AACrC,GAAG,GAAG;AACN,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACR,EAAE,QAAQ,GAAG,UAAU,CAAC;AACxB,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC;AAClC,EAAE,UAAU,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC;AAC9B,CAAC,CAAC,CAAC;AACH;;;;"}