@selvajs/selva 4.18.1 → 4.20.0-beta.0

package/build/server/chunks/chunks/solve.server.js-BxpWFBr-.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"solve.server.js-BxpWFBr-.js","sources":["../../../../.svelte-kit/output/server/chunks/solve.server.js"],"sourcesContent":["import { T as providers, b as getSolveMetricSink, w as lazyLogger, x as getStorageProvider } from \"./providers.server.js\";\nimport { l as renderThrown } from \"./definitions.js\";\nimport { F as isApiError, T as scoped, k as fetchSchemaFromCompute, m as requireCanSolve, u as requireCanEditDefinition } from \"./access.js\";\nimport { _ as ComputeServerUnconfiguredError } from \"./api.js\";\nimport { S as t, y as e } from \"./schema.js\";\nimport { f as createComputeRateLimiter } from \"./admin-auth.server.js\";\nimport { a as createRemoteDefinitionFetcher, i as resolveServerForOrg } from \"./compute.js\";\nimport { n as apiError, t as ApiErrorCode } from \"./api-errors.js\";\nimport \"./access2.server.js\";\nimport { a as engine, t as COMPUTE_DEBUG } from \"./engine.server.js\";\nimport { c as RATE_LIMIT_WINDOW_MS, d as REMOTE_DEFINITION_MAX_BYTES, f as SOLVE_DEADLINE_MS, l as REMOTE_DEFINITION_CACHE_TTL_MS, s as RATE_LIMIT_MAX_REQUESTS, u as REMOTE_DEFINITION_FETCH_TIMEOUT_MS } from \"./computeLimits.js\";\nimport { n as liveOwnerKey, r as solveEndedKind, t as bindLiveSolve } from \"./liveSolve.server.js\";\nimport { isHttpError } from \"@sveltejs/kit\";\n//#region src/lib/server/compute/remoteDefinition.server.ts\n/**\n* App-wide instance of the remote-definition fetcher (SSRF guard, size cap,\n* deadline, TTL cache all live in `@selvajs/server`'s `createRemoteDefinitionFetcher`).\n*/\nvar fetcher = createRemoteDefinitionFetcher({\n\tmaxBytes: REMOTE_DEFINITION_MAX_BYTES,\n\tfetchTimeoutMs: REMOTE_DEFINITION_FETCH_TIMEOUT_MS,\n\tcacheTtlMs: REMOTE_DEFINITION_CACHE_TTL_MS,\n\tnow: () => Date.now(),\n\tlogger: lazyLogger\n});\n/** Fetch (or return cached) remote `.gh` bytes. Throws on unsafe host / oversized / timeout. */\nfunction loadRemoteDefinition(url) {\n\treturn fetcher.load(url);\n}\n//#endregion\n//#region src/lib/server/computeRateLimit.server.ts\n/**\n* App-wide instance of the compute-solve rate limiter (fixed-window, per-key,\n* process-local; `@selvajs/server`'s `createComputeRateLimiter`), wired with the\n* window + cap from `computeLimits.ts`.\n*\n* Keyed by caller — `user:{userId}` for authenticated solves, `share:{linkId}`\n* for share-token solves so anonymous consumers of one link don't share a\n* bucket with the link's owner.\n*/\nvar limiter = createComputeRateLimiter({\n\twindowMs: RATE_LIMIT_WINDOW_MS,\n\tmaxPerWindow: RATE_LIMIT_MAX_REQUESTS\n});\nfunction checkComputeRateLimit(key) {\n\treturn limiter.check(key);\n}\n//#endregion\n//#region src/lib/server/compute/solve.server.ts\n/**\n* The body-independent core of a solve request, shared by `POST /api/v1/compute`\n* (share-token and remote-URL capable) and `POST /api/v1/definitions/{guid}/solve`\n* (tenant-scoped, cookie or PAT).\n*\n* **Share-token resolution stays outside this module, in the route.** The caller\n* hands in an already-decided `SolveAccess`; the definition-addressed route only\n* ever constructs the `user` variant, so it cannot inherit the anonymous branch\n* by accident. Adding a token lookup here would silently give it one.\n*\n* What lives here: rate limiting, definition/version resolution, access checks,\n* compute-server routing, schema backfill, the engine call, metric recording, the\n* debug breakdown. What stays in a route: parsing its own body shape and deciding\n* who the caller is.\n*/\n/**\n* Run a solve and return the HTTP response.\n*\n* Throws `HttpError` (via `apiError`) for every refusal, and lets engine/network\n* failures propagate for the caller's outer catch to map — the two routes share\n* that mapping through `mapSolveError`.\n*/\nasync function runSolve(params) {\n\tconst { access, definitionUrl, inputs, values, channel, versionId: explicitVersionId, request, locals, loadStart, prepMarks, concealAccessFailure = false, streamId = null } = params;\n\tconst storage = getStorageProvider();\n\tconst sharedAccess = access.kind === \"share\" ? access : null;\n\tconst solveCtx = access.ctx;\n\tlet prevMark = performance.now();\n\tconst mark = (label) => {\n\t\tprepMarks.push([label, performance.now() - prevMark]);\n\t\tprevMark = performance.now();\n\t};\n\tlet definitionSource;\n\tlet localDefinitionRef = null;\n\tlet localVersionForBackfill = null;\n\tlet solveOrgId = null;\n\tlet definitionPin = null;\n\tlet metricDefinitionId = null;\n\tlet metricVersionId = null;\n\tconst isLocal = definitionUrl.startsWith(\"local:\");\n\tconst guid = isLocal ? definitionUrl.substring(6) : null;\n\tconst recordMetric = (failureKind, extra = {}) => {\n\t\tgetSolveMetricSink().record(solveCtx, {\n\t\t\tdefinitionUrl,\n\t\t\tdefinitionId: metricDefinitionId,\n\t\t\tversionId: metricVersionId,\n\t\t\tchannel,\n\t\t\torgId: solveOrgId,\n\t\t\tdurationMs: extra.durationMs ?? 0,\n\t\t\tok: failureKind === \"ok\",\n\t\t\tfailureKind,\n\t\t\terrorCount: extra.errorCount ?? 0,\n\t\t\twarningCount: extra.warningCount ?? 0\n\t\t}).catch((err) => locals.log.error(\"Solve-metric record failed\", {\n\t\t\tcomponent: \"API/Compute\",\n\t\t\terr: renderThrown(err)\n\t\t}));\n\t};\n\tconst rateLimit = checkComputeRateLimit(access.rateLimitKey);\n\tif (!rateLimit.allowed) {\n\t\trecordMetric(\"rate_limited\");\n\t\tconst retryAfter = rateLimit.retryAfter ?? 1;\n\t\treturn new Response(JSON.stringify({\n\t\t\tmessage: `Too many compute requests. Retry in ${retryAfter}s.`,\n\t\t\tretryAfter\n\t\t}), {\n\t\t\tstatus: 429,\n\t\t\theaders: {\n\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\"Retry-After\": String(retryAfter)\n\t\t\t}\n\t\t});\n\t}\n\tif (isLocal && guid) {\n\t\tlet record;\n\t\ttry {\n\t\t\trecord = await providers.data.definitions.get(solveCtx, guid);\n\t\t} catch (err) {\n\t\t\tlocals.log.error(\"Failed to load local definition\", {\n\t\t\t\tcomponent: \"API/Compute\",\n\t\t\t\tguid,\n\t\t\t\terr: renderThrown(err)\n\t\t\t});\n\t\t\tapiError(404, ApiErrorCode.NOT_FOUND, `Definition '${guid}' not found`);\n\t\t}\n\t\tif (!record) apiError(404, ApiErrorCode.NOT_FOUND, `Definition '${guid}' not found`);\n\t\tmark(\"defRecord\");\n\t\tconst project = await providers.data.projects.getProject(solveCtx, record.projectId);\n\t\tsolveOrgId = project?.orgId ?? null;\n\t\tdefinitionPin = record.computeServerId ?? null;\n\t\tmark(\"project\");\n\t\tif (!sharedAccess) try {\n\t\t\tif (channel === \"draft\" || explicitVersionId) await requireCanEditDefinition(scoped(locals), record.projectId, guid, {\n\t\t\t\tproject,\n\t\t\t\tdefinition: record\n\t\t\t});\n\t\t\telse await requireCanSolve(scoped(locals), record.projectId, project ?? void 0);\n\t\t} catch (err) {\n\t\t\tconst status = isApiError(err) ? err.status : isHttpError(err) ? err.status : void 0;\n\t\t\tif (concealAccessFailure && status === 403) apiError(404, ApiErrorCode.NOT_FOUND, `Definition '${guid}' not found`);\n\t\t\tthrow err;\n\t\t}\n\t\tmark(\"access\");\n\t\tconst versionId = explicitVersionId ?? (channel === \"live\" ? record.liveVersionId : record.draftVersionId);\n\t\tif (!versionId) apiError(404, ApiErrorCode.NOT_FOUND, `Definition '${guid}' has no ${channel} version yet`);\n\t\tconst version = await providers.data.definitions.getVersion(solveCtx, versionId);\n\t\tif (!version || version.definitionId !== guid) apiError(404, ApiErrorCode.NOT_FOUND, `Definition '${guid}' version is missing`);\n\t\tlocalVersionForBackfill = {\n\t\t\tid: version.id,\n\t\t\thasSchema: version.schema !== void 0\n\t\t};\n\t\tmetricDefinitionId = guid;\n\t\tmetricVersionId = version.id;\n\t\tmark(\"version\");\n\t\tlocalDefinitionRef = engine.definitionRef(version.id, async () => {\n\t\t\tconst bytes = await storage.get(version.fileKey);\n\t\t\tif (!bytes) throw new Error(`Version blob missing: ${version.fileKey}`);\n\t\t\treturn bytes;\n\t\t});\n\t\tdefinitionSource = localDefinitionRef;\n\t\tmark(\"blob\");\n\t} else {\n\t\ttry {\n\t\t\tdefinitionSource = await loadRemoteDefinition(definitionUrl);\n\t\t} catch (err) {\n\t\t\tlocals.log.error(\"Failed to fetch remote definition\", {\n\t\t\t\tcomponent: \"API/Compute\",\n\t\t\t\tdefinitionUrl,\n\t\t\t\terr: renderThrown(err)\n\t\t\t});\n\t\t\tapiError(400, ApiErrorCode.VALIDATION_FAILED, `Failed to load definition: ${err instanceof Error ? err.message : String(err)}`);\n\t\t}\n\t\tmark(\"remoteDef\");\n\t}\n\tconst defLoadMs = performance.now() - loadStart;\n\tif (sharedAccess) {\n\t\tif (await providers.data.shareLinks.tryIncrementSolveCount(solveCtx, sharedAccess.link.id) === null) {\n\t\t\trecordMetric(\"share_cap\");\n\t\t\tapiError(429, ApiErrorCode.INTERNAL, \"Share link solve cap reached.\");\n\t\t}\n\t\tmark(\"shareCap\");\n\t}\n\tconst serverConfig = await resolveServerForOrg(solveCtx, solveOrgId, locals.providers.data.computeServer, { definitionPin });\n\tmark(\"resolveServer\");\n\tif (localVersionForBackfill && !localVersionForBackfill.hasSchema && localDefinitionRef) {\n\t\tconst versionId = localVersionForBackfill.id;\n\t\ttry {\n\t\t\tconst bytes = await localDefinitionRef.load();\n\t\t\tconst schema = await fetchSchemaFromCompute(bytes, serverConfig);\n\t\t\tawait providers.data.definitions.setVersionSchema(solveCtx, versionId, schema);\n\t\t} catch (err) {\n\t\t\tlocals.log.warn(\"Schema backfill failed\", {\n\t\t\t\tcomponent: \"API/Compute\",\n\t\t\t\tversionId,\n\t\t\t\terr: renderThrown(err)\n\t\t\t});\n\t\t}\n\t\tmark(\"schemaBackfill\");\n\t}\n\tconst live = bindLiveSolve({\n\t\townerKey: liveOwnerKey(access.kind === \"user\" ? access.ctx.userId : null),\n\t\tstreamId,\n\t\trequest,\n\t\ttokenTtlMs: SOLVE_DEADLINE_MS + 6e4\n\t});\n\tlet outcome;\n\ttry {\n\t\toutcome = await engine.solve({\n\t\t\tserver: serverConfig,\n\t\t\tdefinitionSource,\n\t\t\tdefinitionKey: isLocal ? void 0 : definitionUrl,\n\t\t\tinputs,\n\t\t\tvalues,\n\t\t\tsignal: request.signal,\n\t\t\tacceptEncoding: request.headers.get(\"accept-encoding\") ?? \"\",\n\t\t\tdefinitionGuid: guid ?? void 0,\n\t\t\tloadStartMs: loadStart,\n\t\t\tdefLoadMs,\n\t\t\tprepMarks,\n\t\t\tselvaEvents: live.selvaEvents\n\t\t});\n\t} finally {\n\t\tlive.end(outcome ? solveEndedKind(outcome) : \"error\");\n\t}\n\tmark(\"solve\");\n\tif (outcome.kind === \"timeout\") recordMetric(\"timeout\", { durationMs: outcome.durationMs });\n\telse if (outcome.kind === \"client_abort\") recordMetric(\"client_abort\", { durationMs: outcome.durationMs });\n\telse if (outcome.kind === \"too_large\") recordMetric(\"too_large\");\n\telse if (outcome.kind === \"shed\") recordMetric(\"shed\", { durationMs: outcome.durationMs });\n\telse if (outcome.kind === \"ok\") {\n\t\trecordMetric(\"ok\", {\n\t\t\tdurationMs: outcome.solveMs,\n\t\t\terrorCount: outcome.errorCount,\n\t\t\twarningCount: outcome.warningCount\n\t\t});\n\t\tif (metricDefinitionId) providers.data.definitions.incrementSolveCount(solveCtx, metricDefinitionId).catch((err) => locals.log.warn(\"solveCount increment failed\", {\n\t\t\tcomponent: \"API/Compute\",\n\t\t\tdefinitionId: metricDefinitionId,\n\t\t\terr: renderThrown(err)\n\t\t}));\n\t\tif (COMPUTE_DEBUG) logDebugBreakdown(locals, request, outcome, defLoadMs, prepMarks);\n\t}\n\treturn engine.toWebResponse(outcome);\n}\n/**\n* Both solve routes share this so they cannot drift on which failures read as\n* \"compute is down\" (503) versus a server bug (500).\n*/\nfunction mapSolveError(err, locals) {\n\tif (isHttpError(err)) throw err;\n\tif (isApiError(err)) apiError(err.status, err.code, err.message);\n\tif (err instanceof ComputeServerUnconfiguredError) apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, err.message);\n\tconst message = err instanceof Error ? err.message : \"Unknown error\";\n\tlocals.log.error(\"Solve request failed\", {\n\t\tcomponent: \"API/Compute\",\n\t\terr: renderThrown(err),\n\t\t...err instanceof t && typeof err.context?.responseBody === \"string\" && { computeResponseBody: err.context.responseBody }\n\t});\n\tif (err instanceof t) {\n\t\tif (err.code === e.NETWORK_ERROR || err.code === e.CORS_ERROR) apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, \"Compute server is unreachable\");\n\t\tif (err.code === e.AUTH_ERROR) apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, \"Compute server rejected this deployment's credentials — check the compute API key configuration.\");\n\t\tif (err.code === e.RATE_LIMIT) apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, \"Compute server is rate-limiting requests. Retry shortly.\");\n\t\tif (err.code === e.TIMEOUT_ERROR) apiError(504, ApiErrorCode.COMPUTE_UNAVAILABLE, \"Compute server timed out running the solve.\");\n\t}\n\tif (err instanceof TypeError && message === \"fetch failed\") apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, \"Compute server is unreachable\");\n\tapiError(500, ApiErrorCode.INTERNAL, message);\n}\n/**\n* DEBUG (SELVA_FLAG_COMPUTE_DEBUG): the server-side overhead the solve metric's\n* `durationMs` doesn't capture. `load` = auth + DB + definition fetch; `tree` =\n* input tree build; `serialize` = JSON.stringify of the result.\n*/\nfunction logDebugBreakdown(locals, request, outcome, defLoadMs, prepMarks) {\n\tconst { metrics } = outcome.envelope;\n\tlocals.log.debug(\"Solve server-side phase breakdown\", {\n\t\tcomponent: \"Compute/server\",\n\t\tloadMs: Math.round(defLoadMs),\n\t\ttreeBuildMs: Math.round(metrics.treeBuildMs),\n\t\tsolveMs: Math.round(metrics.solveMs),\n\t\tserializeMs: Math.round(metrics.serializeMs),\n\t\tgzipMs: Math.round(metrics.gzipMs),\n\t\tserverTotalMs: Math.round(metrics.serverTotalMs),\n\t\tserializedBytes: metrics.serializedBytes\n\t});\n\tif (metrics.compressedBytes !== null) locals.log.debug(\"Response gzipped\", {\n\t\tcomponent: \"Compute/server\",\n\t\tserializedBytes: metrics.serializedBytes,\n\t\tcompressedBytes: metrics.compressedBytes,\n\t\tratio: Number((metrics.serializedBytes / metrics.compressedBytes).toFixed(1))\n\t});\n\telse {\n\t\tconst acceptEncoding = request.headers.get(\"accept-encoding\") ?? \"\";\n\t\tlocals.log.debug(\"Compression skipped\", {\n\t\t\tcomponent: \"Compute/server\",\n\t\t\tacceptEncoding,\n\t\t\thasAcceptEncoding: acceptEncoding !== \"\"\n\t\t});\n\t}\n\tlocals.log.debug(\"Prep breakdown\", {\n\t\tcomponent: \"Compute/server\",\n\t\t...Object.fromEntries(prepMarks.map(([label, ms]) => [`p_${label}Ms`, Math.round(ms)]))\n\t});\n\tconst db = engine.stats().definitionBytes;\n\tlocals.log.debug(\"Definition byte-cache counters\", {\n\t\tcomponent: \"Compute/def-bytes\",\n\t\thits: db.hits,\n\t\tmisses: db.misses,\n\t\tevictions: db.evictions,\n\t\tentries: db.entries,\n\t\tretainedBytes: db.bytes\n\t});\n}\n//#endregion\nexport { runSolve as n, mapSolveError as t };\n"],"names":[],"mappings":";;;;;;;;;;;;;;AAaA;AACA;AACA;AACA;AACA;AACA,IAAI,OAAO,GAAG,6BAA6B,CAAC;AAC5C,CAAC,QAAQ,EAAE,2BAA2B;AACtC,CAAC,cAAc,EAAE,kCAAkC;AACnD,CAAC,UAAU,EAAE,8BAA8B;AAC3C,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,GAAG,EAAE;AACtB,CAAC,MAAM,EAAE;AACT,CAAC,CAAC;AACF;AACA,SAAS,oBAAoB,CAAC,GAAG,EAAE;AACnC,CAAC,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;AACzB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,OAAO,GAAG,wBAAwB,CAAC;AACvC,CAAC,QAAQ,EAAE,oBAAoB;AAC/B,CAAC,YAAY,EAAE;AACf,CAAC,CAAC;AACF,SAAS,qBAAqB,CAAC,GAAG,EAAE;AACpC,CAAC,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC;AAC1B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,QAAQ,CAAC,MAAM,EAAE;AAChC,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,oBAAoB,GAAG,KAAK,EAAE,QAAQ,GAAG,IAAI,EAAE,GAAG,MAAM;AACtL,CAAC,MAAM,OAAO,GAAG,kBAAkB,EAAE;AACrC,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,KAAK,OAAO,GAAG,MAAM,GAAG,IAAI;AAC7D,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG;AAC5B,CAAC,IAAI,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;AACjC,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,KAAK;AACzB,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC;AACvD,EAAE,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;AAC9B,CAAC,CAAC;AACF,CAAC,IAAI,gBAAgB;AACrB,CAAC,IAAI,kBAAkB,GAAG,IAAI;AAC9B,CAAC,IAAI,uBAAuB,GAAG,IAAI;AACnC,CAAC,IAAI,UAAU,GAAG,IAAI;AACtB,CAAC,IAAI,aAAa,GAAG,IAAI;AACzB,CAAC,IAAI,kBAAkB,GAAG,IAAI;AAC9B,CAAC,IAAI,eAAe,GAAG,IAAI;AAC3B,CAAC,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC;AACnD,CAAC,MAAM,IAAI,GAAG,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI;AACzD,CAAC,MAAM,YAAY,GAAG,CAAC,WAAW,EAAE,KAAK,GAAG,EAAE,KAAK;AACnD,EAAE,kBAAkB,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE;AACxC,GAAG,aAAa;AAChB,GAAG,YAAY,EAAE,kBAAkB;AACnC,GAAG,SAAS,EAAE,eAAe;AAC7B,GAAG,OAAO;AACV,GAAG,KAAK,EAAE,UAAU;AACpB,GAAG,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC;AACpC,GAAG,EAAE,EAAE,WAAW,KAAK,IAAI;AAC3B,GAAG,WAAW;AACd,GAAG,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC;AACpC,GAAG,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI;AACvC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,4BAA4B,EAAE;AACnE,GAAG,SAAS,EAAE,aAAa;AAC3B,GAAG,GAAG,EAAE,YAAY,CAAC,GAAG;AACxB,GAAG,CAAC,CAAC;AACL,CAAC,CAAC;AACF,CAAC,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,CAAC,YAAY,CAAC;AAC7D,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE;AACzB,EAAE,YAAY,CAAC,cAAc,CAAC;AAC9B,EAAE,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,IAAI,CAAC;AAC9C,EAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;AACrC,GAAG,OAAO,EAAE,CAAC,oCAAoC,EAAE,UAAU,CAAC,EAAE,CAAC;AACjE,GAAG;AACH,GAAG,CAAC,EAAE;AACN,GAAG,MAAM,EAAE,GAAG;AACd,GAAG,OAAO,EAAE;AACZ,IAAI,cAAc,EAAE,kBAAkB;AACtC,IAAI,aAAa,EAAE,MAAM,CAAC,UAAU;AACpC;AACA,GAAG,CAAC;AACJ,CAAC;AACD,CAAC,IAAI,OAAO,IAAI,IAAI,EAAE;AACtB,EAAE,IAAI,MAAM;AACZ,EAAE,IAAI;AACN,GAAG,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC;AAChE,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,iCAAiC,EAAE;AACvD,IAAI,SAAS,EAAE,aAAa;AAC5B,IAAI,IAAI;AACR,IAAI,GAAG,EAAE,YAAY,CAAC,GAAG;AACzB,IAAI,CAAC;AACL,GAAG,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;AAC1E,EAAE;AACF,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;AACtF,EAAE,IAAI,CAAC,WAAW,CAAC;AACnB,EAAE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC;AACtF,EAAE,UAAU,GAAG,OAAO,EAAE,KAAK,IAAI,IAAI;AACrC,EAAE,aAAa,GAAG,MAAM,CAAC,eAAe,IAAI,IAAI;AAChD,EAAE,IAAI,CAAC,SAAS,CAAC;AACjB,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI;AACzB,GAAG,IAAI,OAAO,KAAK,OAAO,IAAI,iBAAiB,EAAE,MAAM,wBAAwB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE;AACxH,IAAI,OAAO;AACX,IAAI,UAAU,EAAE;AAChB,IAAI,CAAC;AACL,QAAQ,MAAM,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,IAAI,KAAK,CAAC,CAAC;AAClF,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,MAAM;AACvF,GAAG,IAAI,oBAAoB,IAAI,MAAM,KAAK,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;AACtH,GAAG,MAAM,GAAG;AACZ,EAAE;AACF,EAAE,IAAI,CAAC,QAAQ,CAAC;AAChB,EAAE,MAAM,SAAS,GAAG,iBAAiB,KAAK,OAAO,KAAK,MAAM,GAAG,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,cAAc,CAAC;AAC5G,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;AAC7G,EAAE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC;AAClF,EAAE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;AACjI,EAAE,uBAAuB,GAAG;AAC5B,GAAG,EAAE,EAAE,OAAO,CAAC,EAAE;AACjB,GAAG,SAAS,EAAE,OAAO,CAAC,MAAM,KAAK;AACjC,GAAG;AACH,EAAE,kBAAkB,GAAG,IAAI;AAC3B,EAAE,eAAe,GAAG,OAAO,CAAC,EAAE;AAC9B,EAAE,IAAI,CAAC,SAAS,CAAC;AACjB,EAAE,kBAAkB,GAAG,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY;AACpE,GAAG,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;AACnD,GAAG,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,sBAAsB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AAC1E,GAAG,OAAO,KAAK;AACf,EAAE,CAAC,CAAC;AACJ,EAAE,gBAAgB,GAAG,kBAAkB;AACvC,EAAE,IAAI,CAAC,MAAM,CAAC;AACd,CAAC,CAAC,MAAM;AACR,EAAE,IAAI;AACN,GAAG,gBAAgB,GAAG,MAAM,oBAAoB,CAAC,aAAa,CAAC;AAC/D,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,mCAAmC,EAAE;AACzD,IAAI,SAAS,EAAE,aAAa;AAC5B,IAAI,aAAa;AACjB,IAAI,GAAG,EAAE,YAAY,CAAC,GAAG;AACzB,IAAI,CAAC;AACL,GAAG,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,2BAA2B,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAClI,EAAE;AACF,EAAE,IAAI,CAAC,WAAW,CAAC;AACnB,CAAC;AACD,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS;AAChD,CAAC,IAAI,YAAY,EAAE;AACnB,EAAE,IAAI,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE;AACvG,GAAG,YAAY,CAAC,WAAW,CAAC;AAC5B,GAAG,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,+BAA+B,CAAC;AACxE,EAAE;AACF,EAAE,IAAI,CAAC,UAAU,CAAC;AAClB,CAAC;AACD,CAAC,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,aAAa,EAAE,CAAC;AAC7H,CAAC,IAAI,CAAC,eAAe,CAAC;AACtB,CAAC,IAAI,uBAAuB,IAAI,CAAC,uBAAuB,CAAC,SAAS,IAAI,kBAAkB,EAAE;AAC1F,EAAE,MAAM,SAAS,GAAG,uBAAuB,CAAC,EAAE;AAC9C,EAAE,IAAI;AACN,GAAG,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE;AAChD,GAAG,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,YAAY,CAAC;AACnE,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC;AACjF,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE;AAC7C,IAAI,SAAS,EAAE,aAAa;AAC5B,IAAI,SAAS;AACb,IAAI,GAAG,EAAE,YAAY,CAAC,GAAG;AACzB,IAAI,CAAC;AACL,EAAE;AACF,EAAE,IAAI,CAAC,gBAAgB,CAAC;AACxB,CAAC;AACD,CAAC,MAAM,IAAI,GAAG,aAAa,CAAC;AAC5B,EAAE,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC;AAC3E,EAAE,QAAQ;AACV,EAAE,OAAO;AACT,EAAE,UAAU,EAAE,iBAAiB,GAAG;AAClC,EAAE,CAAC;AACH,CAAC,IAAI,OAAO;AACZ,CAAC,IAAI;AACL,EAAE,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC;AAC/B,GAAG,MAAM,EAAE,YAAY;AACvB,GAAG,gBAAgB;AACnB,GAAG,aAAa,EAAE,OAAO,GAAG,KAAK,CAAC,GAAG,aAAa;AAClD,GAAG,MAAM;AACT,GAAG,MAAM;AACT,GAAG,MAAM,EAAE,OAAO,CAAC,MAAM;AACzB,GAAG,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE;AAC/D,GAAG,cAAc,EAAE,IAAI,IAAI,KAAK,CAAC;AACjC,GAAG,WAAW,EAAE,SAAS;AACzB,GAAG,SAAS;AACZ,GAAG,SAAS;AACZ,GAAG,WAAW,EAAE,IAAI,CAAC;AACrB,GAAG,CAAC;AACJ,CAAC,CAAC,SAAS;AACX,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;AACvD,CAAC;AACD,CAAC,IAAI,CAAC,OAAO,CAAC;AACd,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,YAAY,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;AAC5F,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,YAAY,CAAC,cAAc,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;AAC3G,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC;AACjE,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;AAC3F,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE;AACjC,EAAE,YAAY,CAAC,IAAI,EAAE;AACrB,GAAG,UAAU,EAAE,OAAO,CAAC,OAAO;AAC9B,GAAG,UAAU,EAAE,OAAO,CAAC,UAAU;AACjC,GAAG,YAAY,EAAE,OAAO,CAAC;AACzB,GAAG,CAAC;AACJ,EAAE,IAAI,kBAAkB,EAAE,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE;AACrK,GAAG,SAAS,EAAE,aAAa;AAC3B,GAAG,YAAY,EAAE,kBAAkB;AACnC,GAAG,GAAG,EAAE,YAAY,CAAC,GAAG;AACxB,GAAG,CAAC,CAAC;AACL,EAAE,IAAI,aAAa,EAAE,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC;AACtF,CAAC;AACD,CAAC,OAAO,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;AACrC;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE;AACpC,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG;AAChC,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC;AACjE,CAAC,IAAI,GAAG,YAAY,8BAA8B,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,GAAG,CAAC,OAAO,CAAC;AAChH,CAAC,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,eAAe;AACrE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE;AAC1C,EAAE,SAAS,EAAE,aAAa;AAC1B,EAAE,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC;AACxB,EAAE,GAAG,GAAG,YAAY,CAAC,IAAI,OAAO,GAAG,CAAC,OAAO,EAAE,YAAY,KAAK,QAAQ,IAAI,EAAE,mBAAmB,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY;AACzH,EAAE,CAAC;AACH,CAAC,IAAI,GAAG,YAAY,CAAC,EAAE;AACvB,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,aAAa,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,+BAA+B,CAAC;AACjJ,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,kGAAkG,CAAC;AACpL,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,0DAA0D,CAAC;AAC5I,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,6CAA6C,CAAC;AAClI,CAAC;AACD,CAAC,IAAI,GAAG,YAAY,SAAS,IAAI,OAAO,KAAK,cAAc,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,+BAA+B,CAAC;AAC7I,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC;AAC9C;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE;AAC3E,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,QAAQ;AACrC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,mCAAmC,EAAE;AACvD,EAAE,SAAS,EAAE,gBAAgB;AAC7B,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;AAC/B,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;AAC9C,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;AACtC,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;AAC9C,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;AACpC,EAAE,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;AAClD,EAAE,eAAe,EAAE,OAAO,CAAC;AAC3B,EAAE,CAAC;AACH,CAAC,IAAI,OAAO,CAAC,eAAe,KAAK,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,kBAAkB,EAAE;AAC5E,EAAE,SAAS,EAAE,gBAAgB;AAC7B,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe;AAC1C,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe;AAC1C,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC;AAC9E,EAAE,CAAC;AACH,MAAM;AACN,EAAE,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE;AACrE,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE;AAC1C,GAAG,SAAS,EAAE,gBAAgB;AAC9B,GAAG,cAAc;AACjB,GAAG,iBAAiB,EAAE,cAAc,KAAK;AACzC,GAAG,CAAC;AACJ,CAAC;AACD,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE;AACpC,EAAE,SAAS,EAAE,gBAAgB;AAC7B,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AACxF,EAAE,CAAC;AACH,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,eAAe;AAC1C,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,gCAAgC,EAAE;AACpD,EAAE,SAAS,EAAE,mBAAmB;AAChC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI;AACf,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM;AACnB,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS;AACzB,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO;AACrB,EAAE,aAAa,EAAE,EAAE,CAAC;AACpB,EAAE,CAAC;AACH;;;;"}

package/build/server/chunks/chunks/src.js-Cf1j97Z6.js

@@ -1,386 +0,0 @@
-import { z } from 'zod';
-
-//#region ../platform/src/permissions/types.ts
-/**
-* Platform-scope permissions. Reserved for Selva staff and instance operators;
-* regular users hold an empty array.
-*
-* - `instance_admin`        — superuser; implies every other permission
-* - `manage_compute`        — configure the instance-wide Rhino.Compute pool
-* - `manage_instance_users` — disable/enable any user on the instance
-* - `manage_updates`        — run system updates
-*/
-var PlatformPermissionSchema = z.enum([
-	"instance_admin",
-	"manage_compute",
-	"manage_instance_users",
-	"manage_updates"
-]);
-var ALL_PLATFORM_PERMISSIONS = PlatformPermissionSchema.options;
-var RESERVED_SLUG_SET = /* @__PURE__ */ new Set([
-	"o",
-	"api",
-	"admin",
-	"auth",
-	"login",
-	"logout",
-	"setup",
-	"team",
-	"library",
-	"projects",
-	"accept-invite"
-]);
-/**
-* Coerces an arbitrary name into a slug candidate. Does not guarantee a valid
-* slug — an all-symbols name yields `''`, and reserved words pass through
-* untouched — run the result through `SlugSchema` where validity matters.
-*/
-function slugify(name) {
-	return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 63);
-}
-/** Lowercase alphanumeric with internal hyphens, 3–63 chars, not a reserved word. */
-var SlugSchema = z.string().min(3, "Slug must be at least 3 characters").max(63, "Slug must be at most 63 characters").regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/, "Slug must be lowercase alphanumeric with hyphens (no leading/trailing/consecutive hyphens)").refine((s) => !RESERVED_SLUG_SET.has(s), { message: "Slug is reserved and cannot be used" });
-var OrgRoleSchema = z.enum([
-	"owner",
-	"admin",
-	"member"
-]);
-/** Kinds of org-scoped branding asset. Adding a kind is a single entry here — path, upload route, store, and UI are all generic over it. */
-var OrgAssetKindSchema = z.enum(["logo", "favicon"]);
-var ALL_ORG_ASSET_KINDS = OrgAssetKindSchema.options;
-/** Org-scope permissions. A user may hold different sets in different orgs. */
-var OrgPermissionSchema = z.enum([
-	"manage_org_members",
-	"manage_org_compute",
-	"manage_definitions",
-	"manage_projects"
-]);
-var ALL_ORG_PERMISSIONS = OrgPermissionSchema.options;
-/** Governance perms — never grantable to `member`. */
-var OWNER_ADMIN_ONLY_PERMISSIONS = ["manage_org_members", "manage_org_compute"];
-var MEMBER_ASSIGNABLE_PERMISSIONS = ALL_ORG_PERMISSIONS.filter((p) => !OWNER_ADMIN_ONLY_PERMISSIONS.includes(p));
-/** Applied when adding a member without an explicit permissions list. */
-var DEFAULT_ORG_PERMISSIONS = {
-	owner: [...ALL_ORG_PERMISSIONS],
-	admin: [...ALL_ORG_PERMISSIONS],
-	member: []
-};
-var CreateOrgSchema = z.object({
-	name: z.string().min(1, "Organization name is required").max(128),
-	slug: SlugSchema
-});
-var UpdateOrgSchema = CreateOrgSchema.partial();
-//#endregion
-//#region ../platform/src/projects/schemas.ts
-var ProjectVisibilitySchema = z.enum([
-	"public",
-	"org",
-	"private",
-	"platform"
-]);
-var ProjectRoleSchema = z.enum([
-	"owner",
-	"editor",
-	"viewer"
-]);
-/** Cross-field check for PATCH flows. Call on the merged post-patch shape. */
-function validateProjectFlags(merged) {
-	const issues = [];
-	if (merged.autoJoinOnUpload && merged.visibility !== "public") issues.push({
-		path: "autoJoinOnUpload",
-		message: "autoJoinOnUpload requires visibility=public"
-	});
-	if (merged.visibility === "platform" && merged.autoJoinOnUpload) issues.push({
-		path: "autoJoinOnUpload",
-		message: "autoJoinOnUpload is not allowed on platform projects"
-	});
-	return issues;
-}
-//#endregion
-//#region ../platform/src/platformProjects/schemas.ts
-var PlatformProjectGranteeTypeSchema = z.enum(["org", "user"]);
-z.object({
-	id: z.string(),
-	projectId: z.string(),
-	granteeType: PlatformProjectGranteeTypeSchema,
-	granteeId: z.string(),
-	canSolve: z.boolean(),
-	createdBy: z.string(),
-	createdAt: z.string()
-});
-//#endregion
-//#region ../platform/src/definitions/types.ts
-var GH_EXTENSIONS = [".gh", ".ghx"];
-var COVER_IMAGE_EXTENSIONS = [
-	".jpg",
-	".jpeg",
-	".png",
-	".webp",
-	".gif"
-];
-[...GH_EXTENSIONS, ...COVER_IMAGE_EXTENSIONS];
-var COVER_IMAGE_CONTENT_TYPES = {
-	".jpg": "image/jpeg",
-	".jpeg": "image/jpeg",
-	".png": "image/png",
-	".webp": "image/webp",
-	".gif": "image/gif"
-};
-function toDefinitionListItem(r) {
-	return {
-		guid: r.guid,
-		projectId: r.projectId,
-		displayName: r.displayName,
-		description: r.description,
-		category: r.category,
-		tags: r.tags,
-		coverImage: r.coverImage,
-		status: r.status,
-		solveCount: r.solveCount,
-		liveVersionId: r.liveVersionId,
-		updatedAt: r.updatedAt
-	};
-}
-var GuidSchema = z.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "Invalid GUID format");
-var DefinitionStatusSchema = z.enum([
-	"draft",
-	"published",
-	"archived"
-]);
-var DefinitionFileExtSchema = z.enum(["gh", "ghx"]);
-z.object({
-	id: GuidSchema,
-	definitionId: GuidSchema,
-	versionNumber: z.number().int().min(1),
-	fileExt: DefinitionFileExtSchema,
-	fileKey: z.string().min(1),
-	originalFilename: z.string().max(256).optional(),
-	uploadedBy: z.string().min(1),
-	uploadedAt: z.string(),
-	changeNote: z.string().max(1e3).optional(),
-	schema: z.record(z.string(), z.unknown()).optional(),
-	schemaExtractedAt: z.string().optional()
-});
-var DefinitionChannelSchema = z.enum(["live", "draft"]);
-/** HTTP-body validator for new-definition input. */
-var CreateDefinitionInputSchema = z.object({
-	displayName: z.string().min(1, "Display name is required").max(256),
-	description: z.string().max(2e3).optional(),
-	coverImage: z.string().max(2048).optional(),
-	category: z.string().max(128).optional(),
-	tags: z.array(z.string().max(64)).max(20).optional(),
-	projectId: GuidSchema,
-	computeServerId: GuidSchema.optional()
-});
-/**
-* PATCH validator. Field semantics match `DefinitionRecordPatch`:
-* - missing / `undefined` — leave unchanged
-* - `null` — clear (only on nullable fields)
-* - value — set
-*/
-var UpdateMetadataInputSchema = z.object({
-	displayName: z.string().min(1, "Display name is required").max(256).optional(),
-	description: z.string().max(2e3).nullable().optional(),
-	coverImage: z.string().max(2048).nullable().optional(),
-	category: z.string().max(128).nullable().optional(),
-	tags: z.array(z.string().max(64)).max(20).nullable().optional(),
-	projectId: GuidSchema.optional(),
-	computeServerId: GuidSchema.nullable().optional(),
-	solveCacheLimit: z.number().int().min(0).max(1e5).nullable().optional(),
-	status: DefinitionStatusSchema.optional()
-});
-/** Body for `POST /api/definitions/[guid]/publish`. */
-var PublishVersionInputSchema = z.object({ versionId: GuidSchema.optional() }).default({});
-//#endregion
-//#region ../platform/src/shareLinks/schemas.ts
-/**
-* HTTP body for `POST /api/definitions/[guid]/share-links`. The route returns
-* the raw token exactly once.
-*/
-var CreateShareLinkInputSchema = z.object({
-	channel: DefinitionChannelSchema.default("live"),
-	name: z.string().max(128).optional(),
-	allowSolve: z.boolean().default(true),
-	/** Null is the minter's deliberate "uncap" choice; omitted applies the default cap. */
-	maxSolves: z.number().int().min(1).nullable().optional(),
-	expiresAt: z.iso.datetime().nullable().optional()
-});
-//#endregion
-//#region ../platform/src/storage/image.ts
-/**
-* Shared image-transcoding helper for `IStorageProvider` implementations.
-* Normalizes uploads to WebP (capped at 1200px, quality 85) so storage,
-* bandwidth, and the viewer path stay predictable.
-*
-* `sharp` is a dynamic import, not a hard dependency of this package —
-* providers that need transcoding install it themselves.
-*/
-var IMAGE_MAX_WIDTH = 1200;
-/** True if the input looks like an image to process — by content type or path extension. */
-function isImageUpload(contentType, storagePath) {
-	if (contentType?.startsWith("image/")) return true;
-	return /\.(webp|png|jpe?g|gif|bmp|tif?f|svg)$/i.test(storagePath);
-}
-/**
-* Rewrites a path's extension to `.webp`; unchanged for non-image extensions.
-* SVG is rasterized like any other input, so no vector blob is ever
-* persisted — served bytes stay XSS-free without a sanitizer.
-*/
-function toWebpPath(storagePath) {
-	return storagePath.replace(/\.(png|jpe?g|gif|bmp|tif?f|svg)$/i, ".webp");
-}
-/**
-* Transcodes images to WebP; passes non-images through unchanged, so
-* providers can call this unconditionally before `put`.
-*
-* Throws if `sharp` isn't installed — a config error, not a fallback.
-*/
-async function transcodeImageIfNeeded(data, contentType, storagePath) {
-	if (!isImageUpload(contentType, storagePath)) return {
-		data,
-		contentType: contentType ?? "application/octet-stream",
-		path: storagePath
-	};
-	const compressed = await (await loadSharp())(Buffer.from(data)).resize({
-		width: IMAGE_MAX_WIDTH,
-		withoutEnlargement: true
-	}).webp({ quality: 85 }).toBuffer();
-	return {
-		data: new Uint8Array(compressed),
-		contentType: "image/webp",
-		path: toWebpPath(storagePath)
-	};
-}
-var cachedSharp = null;
-async function loadSharp() {
-	if (cachedSharp) return cachedSharp;
-	try {
-		const mod = await import('sharp');
-		cachedSharp = mod.default ?? mod;
-		return cachedSharp;
-	} catch (err) {
-		throw new Error("Image transcoding requires `sharp` to be installed. Add it as a dependency in your provider package.", { cause: err });
-	}
-}
-//#endregion
-//#region ../platform/src/storage/assetClasses.ts
-var BRANDING_KINDS = ALL_ORG_ASSET_KINDS.join("|");
-var COVER_EXTS = COVER_IMAGE_EXTENSIONS.map((ext) => ext.replace(/^\./, "").replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|");
-var SAFE_SEGMENT = String.raw`[A-Za-z0-9._-]+`;
-var GUID = String.raw`[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}`;
-/**
-* The closed registry of servable asset classes. Patterns are mutually
-* exclusive by prefix, order doesn't matter. Anything matching no class is
-* unservable (the route 404s) — default-deny, so a new blob type is opt-in.
-*/
-var ASSET_CLASSES = [
-	{
-		id: "org-branding",
-		visibility: "public",
-		scope: "none",
-		pattern: new RegExp(String.raw`^orgs\/(${SAFE_SEGMENT})\/branding\/(?:${BRANDING_KINDS})\.webp$`)
-	},
-	{
-		id: "org-private",
-		visibility: "org",
-		scope: "org",
-		pattern: new RegExp(String.raw`^orgs\/(${SAFE_SEGMENT})\/private\/${SAFE_SEGMENT}$`)
-	},
-	{
-		id: "definition-cover",
-		visibility: "project",
-		scope: "project",
-		pattern: new RegExp(String.raw`^definitions\/(${GUID})\/cover\.(?:${COVER_EXTS})$`, "i")
-	}
-];
-/**
-* Rejects traversal, empty, or backslash segments before a path can match a
-* class. The permissive segment alphabet (`[A-Za-z0-9._-]+`) admits a bare
-* `.` or `..` as a whole segment, which would otherwise let
-* `orgs/../branding/logo.webp` classify as public branding with `..`
-* captured as the orgId. Mirrors `assertSafeKey` on the write side, so a path
-* that can't be written can't be read either.
-*/
-function hasUnsafeSegment(storagePath) {
-	if (storagePath.includes("\\")) return true;
-	for (const segment of storagePath.split("/")) if (segment === "" || segment === "." || segment === "..") return true;
-	return false;
-}
-/**
-* Classifies a storage path into its asset class and scope id, or null when
-* no class matches (or the path is unsafe). `getPublicUrl` and the serving
-* route both consult this so URL generation and authorization never drift
-* apart.
-*
-* `scopeId` is null for `scope: 'none'` classes even when the pattern
-* captures an id (e.g. `org-branding` captures orgId but is public).
-*/
-function classifyAssetPath(storagePath) {
-	if (hasUnsafeSegment(storagePath)) return null;
-	for (const cls of ASSET_CLASSES) {
-		const m = cls.pattern.exec(storagePath);
-		if (!m) continue;
-		return {
-			class: cls,
-			scopeId: cls.scope === "none" ? null : m[1] ?? null
-		};
-	}
-	return null;
-}
-//#endregion
-//#region ../platform/src/errors.ts
-/**
-* Thrown by providers to signal an expected failure the API layer forwards with
-* a specific status. Unknown errors should propagate as plain `Error` and become 500s.
-*/
-var ProviderError = class extends Error {
-	statusCode;
-	constructor(message, statusCode = 400) {
-		super(message);
-		this.name = "ProviderError";
-		this.statusCode = statusCode;
-	}
-};
-//#endregion
-//#region ../platform/src/context.ts
-/** For server-internal operations outside any HTTP request (bootstrap, janitors, migrations). */
-var SYSTEM_CONTEXT = {
-	userId: "",
-	platformPermissions: [...ALL_PLATFORM_PERMISSIONS],
-	orgPermissions: [...ALL_ORG_PERMISSIONS],
-	system: true
-};
-/**
-* Does not cross-check `ctx.actingOrgId` — the caller must build a context scoped
-* to the org it's acting on. An org permission against a context without
-* `actingOrgId` returns false unless `instance_admin` or `system`.
-*/
-function hasPermission(ctx, permission) {
-	if (ctx.system) return true;
-	if (ctx.platformPermissions.includes("instance_admin")) return true;
-	if (isPlatformPermission(permission)) return ctx.platformPermissions.includes(permission);
-	return ctx.orgPermissions.includes(permission);
-}
-/**
-* An anonymous share-link holder. `system` is true on these contexts for adapter
-* dispatch only — a guard that treats `system` as "fully authorized" must
-* exclude them first.
-*/
-function isShareContext(ctx) {
-	return ctx.shareLinkId !== void 0;
-}
-/**
-* Refuse a privileged operation to a share-link context. Call at the top of any
-* guard whose first line is `if (ctx.system) return` — the token grants one
-* definition on one channel, never instance authority.
-*/
-function assertNotShareContext(ctx, what) {
-	if (isShareContext(ctx)) throw new ProviderError(`Forbidden: a share link cannot ${what}`, 403);
-}
-var PLATFORM_PERMISSION_VALUES = new Set(ALL_PLATFORM_PERMISSIONS);
-function isPlatformPermission(p) {
-	return PLATFORM_PERMISSION_VALUES.has(p);
-}
-
-export { ALL_PLATFORM_PERMISSIONS as A, CreateOrgSchema as C, DEFAULT_ORG_PERMISSIONS as D, GuidSchema as G, MEMBER_ASSIGNABLE_PERMISSIONS as M, OrgPermissionSchema as O, ProviderError as P, SYSTEM_CONTEXT as S, UpdateOrgSchema as U, ALL_ORG_PERMISSIONS as a, assertNotShareContext as b, classifyAssetPath as c, ProjectVisibilitySchema as d, ProjectRoleSchema as e, PlatformPermissionSchema as f, OrgRoleSchema as g, hasPermission as h, COVER_IMAGE_CONTENT_TYPES as i, toDefinitionListItem as j, CreateDefinitionInputSchema as k, GH_EXTENSIONS as l, UpdateMetadataInputSchema as m, PublishVersionInputSchema as n, CreateShareLinkInputSchema as o, OrgAssetKindSchema as p, OWNER_ADMIN_ONLY_PERMISSIONS as q, slugify as s, transcodeImageIfNeeded as t, validateProjectFlags as v };
-//# sourceMappingURL=src.js-Cf1j97Z6.js.map

package/build/server/chunks/chunks/src.js-Cf1j97Z6.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"src.js-Cf1j97Z6.js","sources":["../../../../.svelte-kit/output/server/chunks/src.js"],"sourcesContent":["import { z } from \"zod\";\n//#region ../platform/src/permissions/types.ts\n/**\n* Platform-scope permissions. Reserved for Selva staff and instance operators;\n* regular users hold an empty array.\n*\n* - `instance_admin`        — superuser; implies every other permission\n* - `manage_compute`        — configure the instance-wide Rhino.Compute pool\n* - `manage_instance_users` — disable/enable any user on the instance\n* - `manage_updates`        — run system updates\n*/\nvar PlatformPermissionSchema = z.enum([\n\t\"instance_admin\",\n\t\"manage_compute\",\n\t\"manage_instance_users\",\n\t\"manage_updates\"\n]);\nvar ALL_PLATFORM_PERMISSIONS = PlatformPermissionSchema.options;\nvar RESERVED_SLUG_SET = /* @__PURE__ */ new Set([\n\t\"o\",\n\t\"api\",\n\t\"admin\",\n\t\"auth\",\n\t\"login\",\n\t\"logout\",\n\t\"setup\",\n\t\"team\",\n\t\"library\",\n\t\"projects\",\n\t\"accept-invite\"\n]);\n/**\n* Coerces an arbitrary name into a slug candidate. Does not guarantee a valid\n* slug — an all-symbols name yields `''`, and reserved words pass through\n* untouched — run the result through `SlugSchema` where validity matters.\n*/\nfunction slugify(name) {\n\treturn name.trim().toLowerCase().replace(/[^a-z0-9]+/g, \"-\").replace(/^-|-$/g, \"\").slice(0, 63);\n}\n/** Lowercase alphanumeric with internal hyphens, 3–63 chars, not a reserved word. */\nvar SlugSchema = z.string().min(3, \"Slug must be at least 3 characters\").max(63, \"Slug must be at most 63 characters\").regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/, \"Slug must be lowercase alphanumeric with hyphens (no leading/trailing/consecutive hyphens)\").refine((s) => !RESERVED_SLUG_SET.has(s), { message: \"Slug is reserved and cannot be used\" });\nvar OrgRoleSchema = z.enum([\n\t\"owner\",\n\t\"admin\",\n\t\"member\"\n]);\n/** Kinds of org-scoped branding asset. Adding a kind is a single entry here — path, upload route, store, and UI are all generic over it. */\nvar OrgAssetKindSchema = z.enum([\"logo\", \"favicon\"]);\nvar ALL_ORG_ASSET_KINDS = OrgAssetKindSchema.options;\n/** Org-scope permissions. A user may hold different sets in different orgs. */\nvar OrgPermissionSchema = z.enum([\n\t\"manage_org_members\",\n\t\"manage_org_compute\",\n\t\"manage_definitions\",\n\t\"manage_projects\"\n]);\nvar ALL_ORG_PERMISSIONS = OrgPermissionSchema.options;\n/** Governance perms — never grantable to `member`. */\nvar OWNER_ADMIN_ONLY_PERMISSIONS = [\"manage_org_members\", \"manage_org_compute\"];\nvar MEMBER_ASSIGNABLE_PERMISSIONS = ALL_ORG_PERMISSIONS.filter((p) => !OWNER_ADMIN_ONLY_PERMISSIONS.includes(p));\n/** Applied when adding a member without an explicit permissions list. */\nvar DEFAULT_ORG_PERMISSIONS = {\n\towner: [...ALL_ORG_PERMISSIONS],\n\tadmin: [...ALL_ORG_PERMISSIONS],\n\tmember: []\n};\nvar CreateOrgSchema = z.object({\n\tname: z.string().min(1, \"Organization name is required\").max(128),\n\tslug: SlugSchema\n});\nvar UpdateOrgSchema = CreateOrgSchema.partial();\n//#endregion\n//#region ../platform/src/projects/schemas.ts\nvar ProjectVisibilitySchema = z.enum([\n\t\"public\",\n\t\"org\",\n\t\"private\",\n\t\"platform\"\n]);\nvar ProjectRoleSchema = z.enum([\n\t\"owner\",\n\t\"editor\",\n\t\"viewer\"\n]);\n/** Cross-field check for PATCH flows. Call on the merged post-patch shape. */\nfunction validateProjectFlags(merged) {\n\tconst issues = [];\n\tif (merged.autoJoinOnUpload && merged.visibility !== \"public\") issues.push({\n\t\tpath: \"autoJoinOnUpload\",\n\t\tmessage: \"autoJoinOnUpload requires visibility=public\"\n\t});\n\tif (merged.visibility === \"platform\" && merged.autoJoinOnUpload) issues.push({\n\t\tpath: \"autoJoinOnUpload\",\n\t\tmessage: \"autoJoinOnUpload is not allowed on platform projects\"\n\t});\n\treturn issues;\n}\n//#endregion\n//#region ../platform/src/platformProjects/schemas.ts\nvar PlatformProjectGranteeTypeSchema = z.enum([\"org\", \"user\"]);\nz.object({\n\tid: z.string(),\n\tprojectId: z.string(),\n\tgranteeType: PlatformProjectGranteeTypeSchema,\n\tgranteeId: z.string(),\n\tcanSolve: z.boolean(),\n\tcreatedBy: z.string(),\n\tcreatedAt: z.string()\n});\n//#endregion\n//#region ../platform/src/definitions/types.ts\nvar GH_EXTENSIONS = [\".gh\", \".ghx\"];\nvar COVER_IMAGE_EXTENSIONS = [\n\t\".jpg\",\n\t\".jpeg\",\n\t\".png\",\n\t\".webp\",\n\t\".gif\"\n];\n[...GH_EXTENSIONS, ...COVER_IMAGE_EXTENSIONS];\nvar COVER_IMAGE_CONTENT_TYPES = {\n\t\".jpg\": \"image/jpeg\",\n\t\".jpeg\": \"image/jpeg\",\n\t\".png\": \"image/png\",\n\t\".webp\": \"image/webp\",\n\t\".gif\": \"image/gif\"\n};\nfunction toDefinitionListItem(r) {\n\treturn {\n\t\tguid: r.guid,\n\t\tprojectId: r.projectId,\n\t\tdisplayName: r.displayName,\n\t\tdescription: r.description,\n\t\tcategory: r.category,\n\t\ttags: r.tags,\n\t\tcoverImage: r.coverImage,\n\t\tstatus: r.status,\n\t\tsolveCount: r.solveCount,\n\t\tliveVersionId: r.liveVersionId,\n\t\tupdatedAt: r.updatedAt\n\t};\n}\nvar GuidSchema = z.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, \"Invalid GUID format\");\nvar DefinitionStatusSchema = z.enum([\n\t\"draft\",\n\t\"published\",\n\t\"archived\"\n]);\nvar DefinitionFileExtSchema = z.enum([\"gh\", \"ghx\"]);\nz.object({\n\tid: GuidSchema,\n\tdefinitionId: GuidSchema,\n\tversionNumber: z.number().int().min(1),\n\tfileExt: DefinitionFileExtSchema,\n\tfileKey: z.string().min(1),\n\toriginalFilename: z.string().max(256).optional(),\n\tuploadedBy: z.string().min(1),\n\tuploadedAt: z.string(),\n\tchangeNote: z.string().max(1e3).optional(),\n\tschema: z.record(z.string(), z.unknown()).optional(),\n\tschemaExtractedAt: z.string().optional()\n});\nvar DefinitionChannelSchema = z.enum([\"live\", \"draft\"]);\n/** HTTP-body validator for new-definition input. */\nvar CreateDefinitionInputSchema = z.object({\n\tdisplayName: z.string().min(1, \"Display name is required\").max(256),\n\tdescription: z.string().max(2e3).optional(),\n\tcoverImage: z.string().max(2048).optional(),\n\tcategory: z.string().max(128).optional(),\n\ttags: z.array(z.string().max(64)).max(20).optional(),\n\tprojectId: GuidSchema,\n\tcomputeServerId: GuidSchema.optional()\n});\n/**\n* PATCH validator. Field semantics match `DefinitionRecordPatch`:\n* - missing / `undefined` — leave unchanged\n* - `null` — clear (only on nullable fields)\n* - value — set\n*/\nvar UpdateMetadataInputSchema = z.object({\n\tdisplayName: z.string().min(1, \"Display name is required\").max(256).optional(),\n\tdescription: z.string().max(2e3).nullable().optional(),\n\tcoverImage: z.string().max(2048).nullable().optional(),\n\tcategory: z.string().max(128).nullable().optional(),\n\ttags: z.array(z.string().max(64)).max(20).nullable().optional(),\n\tprojectId: GuidSchema.optional(),\n\tcomputeServerId: GuidSchema.nullable().optional(),\n\tsolveCacheLimit: z.number().int().min(0).max(1e5).nullable().optional(),\n\tstatus: DefinitionStatusSchema.optional()\n});\n/** Body for `POST /api/definitions/[guid]/publish`. */\nvar PublishVersionInputSchema = z.object({ versionId: GuidSchema.optional() }).default({});\n//#endregion\n//#region ../platform/src/shareLinks/schemas.ts\n/**\n* HTTP body for `POST /api/definitions/[guid]/share-links`. The route returns\n* the raw token exactly once.\n*/\nvar CreateShareLinkInputSchema = z.object({\n\tchannel: DefinitionChannelSchema.default(\"live\"),\n\tname: z.string().max(128).optional(),\n\tallowSolve: z.boolean().default(true),\n\t/** Null is the minter's deliberate \"uncap\" choice; omitted applies the default cap. */\n\tmaxSolves: z.number().int().min(1).nullable().optional(),\n\texpiresAt: z.iso.datetime().nullable().optional()\n});\n//#endregion\n//#region ../platform/src/storage/image.ts\n/**\n* Shared image-transcoding helper for `IStorageProvider` implementations.\n* Normalizes uploads to WebP (capped at 1200px, quality 85) so storage,\n* bandwidth, and the viewer path stay predictable.\n*\n* `sharp` is a dynamic import, not a hard dependency of this package —\n* providers that need transcoding install it themselves.\n*/\nvar IMAGE_MAX_WIDTH = 1200;\n/** True if the input looks like an image to process — by content type or path extension. */\nfunction isImageUpload(contentType, storagePath) {\n\tif (contentType?.startsWith(\"image/\")) return true;\n\treturn /\\.(webp|png|jpe?g|gif|bmp|tif?f|svg)$/i.test(storagePath);\n}\n/**\n* Rewrites a path's extension to `.webp`; unchanged for non-image extensions.\n* SVG is rasterized like any other input, so no vector blob is ever\n* persisted — served bytes stay XSS-free without a sanitizer.\n*/\nfunction toWebpPath(storagePath) {\n\treturn storagePath.replace(/\\.(png|jpe?g|gif|bmp|tif?f|svg)$/i, \".webp\");\n}\n/**\n* Transcodes images to WebP; passes non-images through unchanged, so\n* providers can call this unconditionally before `put`.\n*\n* Throws if `sharp` isn't installed — a config error, not a fallback.\n*/\nasync function transcodeImageIfNeeded(data, contentType, storagePath) {\n\tif (!isImageUpload(contentType, storagePath)) return {\n\t\tdata,\n\t\tcontentType: contentType ?? \"application/octet-stream\",\n\t\tpath: storagePath\n\t};\n\tconst compressed = await (await loadSharp())(Buffer.from(data)).resize({\n\t\twidth: IMAGE_MAX_WIDTH,\n\t\twithoutEnlargement: true\n\t}).webp({ quality: 85 }).toBuffer();\n\treturn {\n\t\tdata: new Uint8Array(compressed),\n\t\tcontentType: \"image/webp\",\n\t\tpath: toWebpPath(storagePath)\n\t};\n}\nvar cachedSharp = null;\nasync function loadSharp() {\n\tif (cachedSharp) return cachedSharp;\n\ttry {\n\t\tconst mod = await import(\"sharp\");\n\t\tcachedSharp = mod.default ?? mod;\n\t\treturn cachedSharp;\n\t} catch (err) {\n\t\tthrow new Error(\"Image transcoding requires `sharp` to be installed. Add it as a dependency in your provider package.\", { cause: err });\n\t}\n}\n//#endregion\n//#region ../platform/src/storage/assetClasses.ts\nvar BRANDING_KINDS = ALL_ORG_ASSET_KINDS.join(\"|\");\nvar COVER_EXTS = COVER_IMAGE_EXTENSIONS.map((ext) => ext.replace(/^\\./, \"\").replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\")).join(\"|\");\nvar SAFE_SEGMENT = String.raw`[A-Za-z0-9._-]+`;\nvar GUID = String.raw`[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}`;\n/**\n* The closed registry of servable asset classes. Patterns are mutually\n* exclusive by prefix, order doesn't matter. Anything matching no class is\n* unservable (the route 404s) — default-deny, so a new blob type is opt-in.\n*/\nvar ASSET_CLASSES = [\n\t{\n\t\tid: \"org-branding\",\n\t\tvisibility: \"public\",\n\t\tscope: \"none\",\n\t\tpattern: new RegExp(String.raw`^orgs\\/(${SAFE_SEGMENT})\\/branding\\/(?:${BRANDING_KINDS})\\.webp$`)\n\t},\n\t{\n\t\tid: \"org-private\",\n\t\tvisibility: \"org\",\n\t\tscope: \"org\",\n\t\tpattern: new RegExp(String.raw`^orgs\\/(${SAFE_SEGMENT})\\/private\\/${SAFE_SEGMENT}$`)\n\t},\n\t{\n\t\tid: \"definition-cover\",\n\t\tvisibility: \"project\",\n\t\tscope: \"project\",\n\t\tpattern: new RegExp(String.raw`^definitions\\/(${GUID})\\/cover\\.(?:${COVER_EXTS})$`, \"i\")\n\t}\n];\n/**\n* Rejects traversal, empty, or backslash segments before a path can match a\n* class. The permissive segment alphabet (`[A-Za-z0-9._-]+`) admits a bare\n* `.` or `..` as a whole segment, which would otherwise let\n* `orgs/../branding/logo.webp` classify as public branding with `..`\n* captured as the orgId. Mirrors `assertSafeKey` on the write side, so a path\n* that can't be written can't be read either.\n*/\nfunction hasUnsafeSegment(storagePath) {\n\tif (storagePath.includes(\"\\\\\")) return true;\n\tfor (const segment of storagePath.split(\"/\")) if (segment === \"\" || segment === \".\" || segment === \"..\") return true;\n\treturn false;\n}\n/**\n* Classifies a storage path into its asset class and scope id, or null when\n* no class matches (or the path is unsafe). `getPublicUrl` and the serving\n* route both consult this so URL generation and authorization never drift\n* apart.\n*\n* `scopeId` is null for `scope: 'none'` classes even when the pattern\n* captures an id (e.g. `org-branding` captures orgId but is public).\n*/\nfunction classifyAssetPath(storagePath) {\n\tif (hasUnsafeSegment(storagePath)) return null;\n\tfor (const cls of ASSET_CLASSES) {\n\t\tconst m = cls.pattern.exec(storagePath);\n\t\tif (!m) continue;\n\t\treturn {\n\t\t\tclass: cls,\n\t\t\tscopeId: cls.scope === \"none\" ? null : m[1] ?? null\n\t\t};\n\t}\n\treturn null;\n}\n//#endregion\n//#region ../platform/src/errors.ts\n/**\n* Thrown by providers to signal an expected failure the API layer forwards with\n* a specific status. Unknown errors should propagate as plain `Error` and become 500s.\n*/\nvar ProviderError = class extends Error {\n\tstatusCode;\n\tconstructor(message, statusCode = 400) {\n\t\tsuper(message);\n\t\tthis.name = \"ProviderError\";\n\t\tthis.statusCode = statusCode;\n\t}\n};\n//#endregion\n//#region ../platform/src/context.ts\n/** For server-internal operations outside any HTTP request (bootstrap, janitors, migrations). */\nvar SYSTEM_CONTEXT = {\n\tuserId: \"\",\n\tplatformPermissions: [...ALL_PLATFORM_PERMISSIONS],\n\torgPermissions: [...ALL_ORG_PERMISSIONS],\n\tsystem: true\n};\n/**\n* Does not cross-check `ctx.actingOrgId` — the caller must build a context scoped\n* to the org it's acting on. An org permission against a context without\n* `actingOrgId` returns false unless `instance_admin` or `system`.\n*/\nfunction hasPermission(ctx, permission) {\n\tif (ctx.system) return true;\n\tif (ctx.platformPermissions.includes(\"instance_admin\")) return true;\n\tif (isPlatformPermission(permission)) return ctx.platformPermissions.includes(permission);\n\treturn ctx.orgPermissions.includes(permission);\n}\n/**\n* An anonymous share-link holder. `system` is true on these contexts for adapter\n* dispatch only — a guard that treats `system` as \"fully authorized\" must\n* exclude them first.\n*/\nfunction isShareContext(ctx) {\n\treturn ctx.shareLinkId !== void 0;\n}\n/**\n* Refuse a privileged operation to a share-link context. Call at the top of any\n* guard whose first line is `if (ctx.system) return` — the token grants one\n* definition on one channel, never instance authority.\n*/\nfunction assertNotShareContext(ctx, what) {\n\tif (isShareContext(ctx)) throw new ProviderError(`Forbidden: a share link cannot ${what}`, 403);\n}\nvar PLATFORM_PERMISSION_VALUES = new Set(ALL_PLATFORM_PERMISSIONS);\nfunction isPlatformPermission(p) {\n\treturn PLATFORM_PERMISSION_VALUES.has(p);\n}\n//#endregion\nexport { OrgAssetKindSchema as C, slugify as D, UpdateOrgSchema as E, ALL_PLATFORM_PERMISSIONS as O, OWNER_ADMIN_ONLY_PERMISSIONS as S, OrgRoleSchema as T, validateProjectFlags as _, classifyAssetPath as a, DEFAULT_ORG_PERMISSIONS as b, CreateDefinitionInputSchema as c, UpdateMetadataInputSchema as d, COVER_IMAGE_CONTENT_TYPES as f, ProjectVisibilitySchema as g, ProjectRoleSchema as h, ProviderError as i, PlatformPermissionSchema as k, GuidSchema as l, toDefinitionListItem as m, assertNotShareContext as n, transcodeImageIfNeeded as o, GH_EXTENSIONS as p, hasPermission as r, CreateShareLinkInputSchema as s, SYSTEM_CONTEXT as t, PublishVersionInputSchema as u, ALL_ORG_PERMISSIONS as v, OrgPermissionSchema as w, MEMBER_ASSIGNABLE_PERMISSIONS as x, CreateOrgSchema as y };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC,gBAAgB;AACjB,CAAC,gBAAgB;AACjB,CAAC,uBAAuB;AACxB,CAAC;AACD,CAAC;AACE,IAAC,wBAAwB,GAAG,wBAAwB,CAAC;AACxD,IAAI,iBAAiB,mBAAmB,IAAI,GAAG,CAAC;AAChD,CAAC,GAAG;AACJ,CAAC,KAAK;AACN,CAAC,OAAO;AACR,CAAC,MAAM;AACP,CAAC,OAAO;AACR,CAAC,QAAQ;AACT,CAAC,OAAO;AACR,CAAC,MAAM;AACP,CAAC,SAAS;AACV,CAAC,UAAU;AACX,CAAC;AACD,CAAC,CAAC;AACF;AACA;AACA;AACA;AACA;AACA,SAAS,OAAO,CAAC,IAAI,EAAE;AACvB,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;AAChG;AACA;AACA,IAAI,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,oCAAoC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,oCAAoC,CAAC,CAAC,KAAK,CAAC,iCAAiC,EAAE,4FAA4F,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC;AACvV,IAAC,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC;AAC3B,CAAC,OAAO;AACR,CAAC,OAAO;AACR,CAAC;AACD,CAAC;AACD;AACG,IAAC,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC;AACnD,IAAI,mBAAmB,GAAG,kBAAkB,CAAC,OAAO;AACpD;AACG,IAAC,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC,oBAAoB;AACrB,CAAC,oBAAoB;AACrB,CAAC,oBAAoB;AACrB,CAAC;AACD,CAAC;AACE,IAAC,mBAAmB,GAAG,mBAAmB,CAAC;AAC9C;AACG,IAAC,4BAA4B,GAAG,CAAC,oBAAoB,EAAE,oBAAoB;AAC3E,IAAC,6BAA6B,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/G;AACG,IAAC,uBAAuB,GAAG;AAC9B,CAAC,KAAK,EAAE,CAAC,GAAG,mBAAmB,CAAC;AAChC,CAAC,KAAK,EAAE,CAAC,GAAG,mBAAmB,CAAC;AAChC,CAAC,MAAM,EAAE;AACT;AACG,IAAC,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;AAC/B,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,+BAA+B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;AAClE,CAAC,IAAI,EAAE;AACP,CAAC;AACE,IAAC,eAAe,GAAG,eAAe,CAAC,OAAO;AAC7C;AACA;AACG,IAAC,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC,QAAQ;AACT,CAAC,KAAK;AACN,CAAC,SAAS;AACV,CAAC;AACD,CAAC;AACE,IAAC,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;AAC/B,CAAC,OAAO;AACR,CAAC,QAAQ;AACT,CAAC;AACD,CAAC;AACD;AACA,SAAS,oBAAoB,CAAC,MAAM,EAAE;AACtC,CAAC,MAAM,MAAM,GAAG,EAAE;AAClB,CAAC,IAAI,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC;AAC5E,EAAE,IAAI,EAAE,kBAAkB;AAC1B,EAAE,OAAO,EAAE;AACX,EAAE,CAAC;AACH,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,IAAI,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC;AAC9E,EAAE,IAAI,EAAE,kBAAkB;AAC1B,EAAE,OAAO,EAAE;AACX,EAAE,CAAC;AACH,CAAC,OAAO,MAAM;AACd;AACA;AACA;AACA,IAAI,gCAAgC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAC9D,CAAC,CAAC,MAAM,CAAC;AACT,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;AACf,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,WAAW,EAAE,gCAAgC;AAC9C,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;AACtB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM;AACpB,CAAC,CAAC;AACF;AACA;AACG,IAAC,aAAa,GAAG,CAAC,KAAK,EAAE,MAAM;AAClC,IAAI,sBAAsB,GAAG;AAC7B,CAAC,MAAM;AACP,CAAC,OAAO;AACR,CAAC,MAAM;AACP,CAAC,OAAO;AACR,CAAC;AACD,CAAC;AACD,CAAC,GAAG,aAAa,EAAE,GAAG,sBAAsB,CAAC;AAC1C,IAAC,yBAAyB,GAAG;AAChC,CAAC,MAAM,EAAE,YAAY;AACrB,CAAC,OAAO,EAAE,YAAY;AACtB,CAAC,MAAM,EAAE,WAAW;AACpB,CAAC,OAAO,EAAE,YAAY;AACtB,CAAC,MAAM,EAAE;AACT;AACA,SAAS,oBAAoB,CAAC,CAAC,EAAE;AACjC,CAAC,OAAO;AACR,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;AACd,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;AACxB,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW;AAC5B,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW;AAC5B,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ;AACtB,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;AACd,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU;AAC1B,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM;AAClB,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU;AAC1B,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa;AAChC,EAAE,SAAS,EAAE,CAAC,CAAC;AACf,EAAE;AACF;AACG,IAAC,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iEAAiE,EAAE,qBAAqB;AAC1H,IAAI,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC;AACpC,CAAC,OAAO;AACR,CAAC,WAAW;AACZ,CAAC;AACD,CAAC,CAAC;AACF,IAAI,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC,CAAC,MAAM,CAAC;AACT,CAAC,EAAE,EAAE,UAAU;AACf,CAAC,YAAY,EAAE,UAAU;AACzB,CAAC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC,OAAO,EAAE,uBAAuB;AACjC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3B,CAAC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AACjD,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AAC9B,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;AACvB,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AAC3C,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;AACrD,CAAC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ;AACvC,CAAC,CAAC;AACF,IAAI,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACvD;AACG,IAAC,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;AAC3C,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;AACpE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AAC5C,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;AAC5C,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AACzC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;AACrD,CAAC,SAAS,EAAE,UAAU;AACtB,CAAC,eAAe,EAAE,UAAU,CAAC,QAAQ;AACrC,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;AACzC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AAC/E,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AACvD,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AACvD,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AACpD,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AAChE,CAAC,SAAS,EAAE,UAAU,CAAC,QAAQ,EAAE;AACjC,CAAC,eAAe,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AAClD,CAAC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AACxE,CAAC,MAAM,EAAE,sBAAsB,CAAC,QAAQ;AACxC,CAAC;AACD;AACG,IAAC,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE;AACzF;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;AAC1C,CAAC,OAAO,EAAE,uBAAuB,CAAC,OAAO,CAAC,MAAM,CAAC;AACjD,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AACrC,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;AACtC;AACA,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AACzD,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ;AAChD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,eAAe,GAAG,IAAI;AAC1B;AACA,SAAS,aAAa,CAAC,WAAW,EAAE,WAAW,EAAE;AACjD,CAAC,IAAI,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI;AACnD,CAAC,OAAO,wCAAwC,CAAC,IAAI,CAAC,WAAW,CAAC;AAClE;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,UAAU,CAAC,WAAW,EAAE;AACjC,CAAC,OAAO,WAAW,CAAC,OAAO,CAAC,mCAAmC,EAAE,OAAO,CAAC;AACzE;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,sBAAsB,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE;AACtE,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,OAAO;AACtD,EAAE,IAAI;AACN,EAAE,WAAW,EAAE,WAAW,IAAI,0BAA0B;AACxD,EAAE,IAAI,EAAE;AACR,EAAE;AACF,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,SAAS,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AACxE,EAAE,KAAK,EAAE,eAAe;AACxB,EAAE,kBAAkB,EAAE;AACtB,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;AACpC,CAAC,OAAO;AACR,EAAE,IAAI,EAAE,IAAI,UAAU,CAAC,UAAU,CAAC;AAClC,EAAE,WAAW,EAAE,YAAY;AAC3B,EAAE,IAAI,EAAE,UAAU,CAAC,WAAW;AAC9B,EAAE;AACF;AACA,IAAI,WAAW,GAAG,IAAI;AACtB,eAAe,SAAS,GAAG;AAC3B,CAAC,IAAI,WAAW,EAAE,OAAO,WAAW;AACpC,CAAC,IAAI;AACL,EAAE,MAAM,GAAG,GAAG,MAAM,OAAO,OAAO,CAAC;AACnC,EAAE,WAAW,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG;AAClC,EAAE,OAAO,WAAW;AACpB,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,MAAM,IAAI,KAAK,CAAC,sGAAsG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACzI,CAAC;AACD;AACA;AACA;AACA,IAAI,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;AAClD,IAAI,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;AAC7H,IAAI,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC;AAC9C,IAAI,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,4DAA4D,CAAC;AACnF;AACA;AACA;AACA;AACA;AACA,IAAI,aAAa,GAAG;AACpB,CAAC;AACD,EAAE,EAAE,EAAE,cAAc;AACpB,EAAE,UAAU,EAAE,QAAQ;AACtB,EAAE,KAAK,EAAE,MAAM;AACf,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC,gBAAgB,EAAE,cAAc,CAAC,QAAQ,CAAC;AAClG,EAAE;AACF,CAAC;AACD,EAAE,EAAE,EAAE,aAAa;AACnB,EAAE,UAAU,EAAE,KAAK;AACnB,EAAE,KAAK,EAAE,KAAK;AACd,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;AACrF,EAAE;AACF,CAAC;AACD,EAAE,EAAE,EAAE,kBAAkB;AACxB,EAAE,UAAU,EAAE,SAAS;AACvB,EAAE,KAAK,EAAE,SAAS;AAClB,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,GAAG;AACzF;AACA,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,CAAC,WAAW,EAAE;AACvC,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,IAAI;AAC5C,CAAC,KAAK,MAAM,OAAO,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,EAAE,OAAO,IAAI;AACrH,CAAC,OAAO,KAAK;AACb;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,WAAW,EAAE;AACxC,CAAC,IAAI,gBAAgB,CAAC,WAAW,CAAC,EAAE,OAAO,IAAI;AAC/C,CAAC,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE;AAClC,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;AACzC,EAAE,IAAI,CAAC,CAAC,EAAE;AACV,EAAE,OAAO;AACT,GAAG,KAAK,EAAE,GAAG;AACb,GAAG,OAAO,EAAE,GAAG,CAAC,KAAK,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;AAClD,GAAG;AACH,CAAC;AACD,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,aAAa,GAAG,cAAc,KAAK,CAAC;AACxC,CAAC,UAAU;AACX,CAAC,WAAW,CAAC,OAAO,EAAE,UAAU,GAAG,GAAG,EAAE;AACxC,EAAE,KAAK,CAAC,OAAO,CAAC;AAChB,EAAE,IAAI,CAAC,IAAI,GAAG,eAAe;AAC7B,EAAE,IAAI,CAAC,UAAU,GAAG,UAAU;AAC9B,CAAC;AACD;AACA;AACA;AACA;AACG,IAAC,cAAc,GAAG;AACrB,CAAC,MAAM,EAAE,EAAE;AACX,CAAC,mBAAmB,EAAE,CAAC,GAAG,wBAAwB,CAAC;AACnD,CAAC,cAAc,EAAE,CAAC,GAAG,mBAAmB,CAAC;AACzC,CAAC,MAAM,EAAE;AACT;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE;AACxC,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI;AAC5B,CAAC,IAAI,GAAG,CAAC,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,IAAI;AACpE,CAAC,IAAI,oBAAoB,CAAC,UAAU,CAAC,EAAE,OAAO,GAAG,CAAC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC;AAC1F,CAAC,OAAO,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC;AAC/C;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,GAAG,EAAE;AAC7B,CAAC,OAAO,GAAG,CAAC,WAAW,KAAK,MAAM;AAClC;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,GAAG,EAAE,IAAI,EAAE;AAC1C,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,aAAa,CAAC,CAAC,+BAA+B,EAAE,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC;AAChG;AACA,IAAI,0BAA0B,GAAG,IAAI,GAAG,CAAC,wBAAwB,CAAC;AAClE,SAAS,oBAAoB,CAAC,CAAC,EAAE;AACjC,CAAC,OAAO,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC;AACzC;;;;"}

package/build/server/chunks/chunks/star.js-CHCWLhuh.js

@@ -1,15 +0,0 @@
-import { ai as spread_props } from './server.js-DAQXUDN9.js';
-import { I as Icon } from './utils2.js-CfT1GkAF.js';
-
-//#region ../../node_modules/.pnpm/@lucide+svelte@1.48.0_svelte@5.57.1_@typescript-eslint+types@8.70.1_/node_modules/@lucide/svelte/dist/icons/star.svelte
-function Star($$renderer, $$props) {
-	let { $$slots, $$events, ...props } = $$props;
-	Icon($$renderer, spread_props([props, { icon: {
-		"name": "star",
-		"size": 24,
-		"node": [["path", { "d": "M11.525 2.295a.53.53 0 0 1 .95 0l2.31 4.679a2.123 2.123 0 0 0 1.595 1.16l5.166.756a.53.53 0 0 1 .294.904l-3.736 3.638a2.123 2.123 0 0 0-.611 1.878l.882 5.14a.53.53 0 0 1-.771.56l-4.618-2.428a2.122 2.122 0 0 0-1.973 0L6.396 21.01a.53.53 0 0 1-.77-.56l.881-5.139a2.122 2.122 0 0 0-.611-1.879L2.16 9.795a.53.53 0 0 1 .294-.906l5.165-.755a2.122 2.122 0 0 0 1.597-1.16z" }]]
-	} }]));
-}
-
-export { Star as S };
-//# sourceMappingURL=star.js-CHCWLhuh.js.map

package/build/server/chunks/chunks/star.js-CHCWLhuh.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"star.js-CHCWLhuh.js","sources":["../../../../.svelte-kit/output/server/chunks/star.js"],"sourcesContent":["import { d as spread_props } from \"./server.js\";\nimport { n as Icon } from \"./utils2.js\";\n//#region ../../node_modules/.pnpm/@lucide+svelte@1.48.0_svelte@5.57.1_@typescript-eslint+types@8.70.1_/node_modules/@lucide/svelte/dist/icons/star.svelte\nfunction Star($$renderer, $$props) {\n\tlet { $$slots, $$events, ...props } = $$props;\n\tIcon($$renderer, spread_props([props, { icon: {\n\t\t\"name\": \"star\",\n\t\t\"size\": 24,\n\t\t\"node\": [[\"path\", { \"d\": \"M11.525 2.295a.53.53 0 0 1 .95 0l2.31 4.679a2.123 2.123 0 0 0 1.595 1.16l5.166.756a.53.53 0 0 1 .294.904l-3.736 3.638a2.123 2.123 0 0 0-.611 1.878l.882 5.14a.53.53 0 0 1-.771.56l-4.618-2.428a2.122 2.122 0 0 0-1.973 0L6.396 21.01a.53.53 0 0 1-.77-.56l.881-5.139a2.122 2.122 0 0 0-.611-1.879L2.16 9.795a.53.53 0 0 1 .294-.906l5.165-.755a2.122 2.122 0 0 0 1.597-1.16z\" }]]\n\t} }]));\n}\n//#endregion\nexport { Star as t };\n"],"names":[],"mappings":";;;AAEA;AACA,SAAS,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE;AACnC,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO;AAC9C,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE;AAC/C,EAAE,MAAM,EAAE,MAAM;AAChB,EAAE,MAAM,EAAE,EAAE;AACZ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,8WAA8W,EAAE,CAAC;AAC5Y,EAAE,EAAE,CAAC,CAAC,CAAC;AACP;;;;"}

package/build/server/chunks/chunks/state.js-C008nVQR.js

@@ -1,76 +0,0 @@
-import { g as getContext } from './server.js-DAQXUDN9.js';
-import './client.js-WgeA1ywr.js';
-
-//#endregion
-//#region ../../node_modules/.pnpm/@sveltejs+kit@2.70.3_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.3.1_svelte_9172e0e9363bf3f5d5e1b1085ec23abb/node_modules/@sveltejs/kit/src/runtime/app/state/server.js
-function context() {
-	return getContext("__request__");
-}
-//#endregion
-//#region ../../node_modules/.pnpm/@sveltejs+kit@2.70.3_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.3.1_svelte_9172e0e9363bf3f5d5e1b1085ec23abb/node_modules/@sveltejs/kit/src/runtime/app/state/index.js
-/**
-* A read-only reactive object with information about the current page, serving several use cases:
-* - retrieving the combined `data` of all pages/layouts anywhere in your component tree (also see [loading data](https://svelte.dev/docs/kit/load))
-* - retrieving the current value of the `form` prop anywhere in your component tree (also see [form actions](https://svelte.dev/docs/kit/form-actions))
-* - retrieving the page state that was set through `goto`, `pushState` or `replaceState` (also see [goto](https://svelte.dev/docs/kit/$app-navigation#goto) and [shallow routing](https://svelte.dev/docs/kit/shallow-routing))
-* - retrieving metadata such as the URL you're on, the current route and its parameters, and whether or not there was an error
-*
-* ```svelte
-* <!--- file: +layout.svelte --->
-* <script>
-* 	import { page } from '$app/state';
-* <\/script>
-*
-* <p>Currently at {page.url.pathname}</p>
-*
-* {#if page.error}
-* 	<span class="red">Problem detected</span>
-* {:else}
-* 	<span class="small">All systems operational</span>
-* {/if}
-* ```
-*
-* Changes to `page` are available exclusively with runes. (The legacy reactivity syntax will not reflect any changes)
-*
-* ```svelte
-* <!--- file: +page.svelte --->
-* <script>
-* 	import { page } from '$app/state';
-* 	const id = $derived(page.params.id); // This will correctly update id for usage on this page
-* 	$: badId = page.params.id; // Do not use; will never update after initial load
-* <\/script>
-* ```
-*
-* On the server, values can only be read during rendering (in other words _not_ in e.g. `load` functions). In the browser, the values can be read at any time.
-*
-* @type {import('@sveltejs/kit').Page}
-*/
-var page = {
-	get data() {
-		return context().page.data;
-	},
-	get error() {
-		return context().page.error;
-	},
-	get form() {
-		return context().page.form;
-	},
-	get params() {
-		return context().page.params;
-	},
-	get route() {
-		return context().page.route;
-	},
-	get state() {
-		return context().page.state;
-	},
-	get status() {
-		return context().page.status;
-	},
-	get url() {
-		return context().page.url;
-	}
-};
-
-export { page as p };
-//# sourceMappingURL=state.js-C008nVQR.js.map

package/build/server/chunks/chunks/state.js-C008nVQR.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"state.js-C008nVQR.js","sources":["../../../../.svelte-kit/output/server/chunks/state.js"],"sourcesContent":["import \"./index-server.js\";\nimport { b as getContext } from \"./server.js\";\nimport \"./client.js\";\n//#endregion\n//#region ../../node_modules/.pnpm/@sveltejs+kit@2.70.3_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.3.1_svelte_9172e0e9363bf3f5d5e1b1085ec23abb/node_modules/@sveltejs/kit/src/runtime/app/state/server.js\nfunction context() {\n\treturn getContext(\"__request__\");\n}\n//#endregion\n//#region ../../node_modules/.pnpm/@sveltejs+kit@2.70.3_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.3.1_svelte_9172e0e9363bf3f5d5e1b1085ec23abb/node_modules/@sveltejs/kit/src/runtime/app/state/index.js\n/**\n* A read-only reactive object with information about the current page, serving several use cases:\n* - retrieving the combined `data` of all pages/layouts anywhere in your component tree (also see [loading data](https://svelte.dev/docs/kit/load))\n* - retrieving the current value of the `form` prop anywhere in your component tree (also see [form actions](https://svelte.dev/docs/kit/form-actions))\n* - retrieving the page state that was set through `goto`, `pushState` or `replaceState` (also see [goto](https://svelte.dev/docs/kit/$app-navigation#goto) and [shallow routing](https://svelte.dev/docs/kit/shallow-routing))\n* - retrieving metadata such as the URL you're on, the current route and its parameters, and whether or not there was an error\n*\n* ```svelte\n* <!--- file: +layout.svelte --->\n* <script>\n* \timport { page } from '$app/state';\n* <\\/script>\n*\n* <p>Currently at {page.url.pathname}</p>\n*\n* {#if page.error}\n* \t<span class=\"red\">Problem detected</span>\n* {:else}\n* \t<span class=\"small\">All systems operational</span>\n* {/if}\n* ```\n*\n* Changes to `page` are available exclusively with runes. (The legacy reactivity syntax will not reflect any changes)\n*\n* ```svelte\n* <!--- file: +page.svelte --->\n* <script>\n* \timport { page } from '$app/state';\n* \tconst id = $derived(page.params.id); // This will correctly update id for usage on this page\n* \t$: badId = page.params.id; // Do not use; will never update after initial load\n* <\\/script>\n* ```\n*\n* On the server, values can only be read during rendering (in other words _not_ in e.g. `load` functions). In the browser, the values can be read at any time.\n*\n* @type {import('@sveltejs/kit').Page}\n*/\nvar page = {\n\tget data() {\n\t\treturn context().page.data;\n\t},\n\tget error() {\n\t\treturn context().page.error;\n\t},\n\tget form() {\n\t\treturn context().page.form;\n\t},\n\tget params() {\n\t\treturn context().page.params;\n\t},\n\tget route() {\n\t\treturn context().page.route;\n\t},\n\tget state() {\n\t\treturn context().page.state;\n\t},\n\tget status() {\n\t\treturn context().page.status;\n\t},\n\tget url() {\n\t\treturn context().page.url;\n\t}\n};\n//#endregion\nexport { page as t };\n"],"names":[],"mappings":";;;AAGA;AACA;AACA,SAAS,OAAO,GAAG;AACnB,CAAC,OAAO,UAAU,CAAC,aAAa,CAAC;AACjC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,IAAI,GAAG;AACX,CAAC,IAAI,IAAI,GAAG;AACZ,EAAE,OAAO,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI;AAC5B,CAAC,CAAC;AACF,CAAC,IAAI,KAAK,GAAG;AACb,EAAE,OAAO,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK;AAC7B,CAAC,CAAC;AACF,CAAC,IAAI,IAAI,GAAG;AACZ,EAAE,OAAO,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI;AAC5B,CAAC,CAAC;AACF,CAAC,IAAI,MAAM,GAAG;AACd,EAAE,OAAO,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM;AAC9B,CAAC,CAAC;AACF,CAAC,IAAI,KAAK,GAAG;AACb,EAAE,OAAO,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK;AAC7B,CAAC,CAAC;AACF,CAAC,IAAI,KAAK,GAAG;AACb,EAAE,OAAO,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK;AAC7B,CAAC,CAAC;AACF,CAAC,IAAI,MAAM,GAAG;AACd,EAAE,OAAO,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM;AAC9B,CAAC,CAAC;AACF,CAAC,IAAI,GAAG,GAAG;AACX,EAAE,OAAO,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG;AAC3B,CAAC;AACD;;;;"}