npm - @selvajs/selva - Versions diffs - 4.18.1 → 4.20.0-beta.0 - Mend

@selvajs/selva 4.18.1 → 4.20.0-beta.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1351) hide show

package/build/server/chunks/chunks/solve.server.js-CWqV0aXu.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"solve.server.js-CWqV0aXu.js","sources":["../../../../.svelte-kit/output/server/chunks/solve.server.js"],"sourcesContent":["import { T as providers, b as getSolveMetricSink, w as lazyLogger, x as getStorageProvider } from \"./providers.server.js\";\nimport { l as renderThrown } from \"./definitions.js\";\nimport { F as isApiError, M as ApiErrorCode, T as scoped, k as fetchSchemaFromCompute, m as requireCanSolve, u as requireCanEditDefinition } from \"./access.js\";\nimport { S as assertScope, b as ComputeServerUnconfiguredError } from \"./api.js\";\nimport { S as t, y as e } from \"./schema.js\";\nimport { m as createComputeRateLimiter } from \"./admin-auth.server.js\";\nimport { a as createRemoteDefinitionFetcher, i as resolveServerForOrg } from \"./compute.js\";\nimport { t as apiError } from \"./api-errors.js\";\nimport \"./access2.server.js\";\nimport { a as engine, t as COMPUTE_DEBUG } from \"./engine.server.js\";\nimport { c as RATE_LIMIT_WINDOW_MS, d as REMOTE_DEFINITION_MAX_BYTES, f as SOLVE_DEADLINE_MS, l as REMOTE_DEFINITION_CACHE_TTL_MS, s as RATE_LIMIT_MAX_REQUESTS, u as REMOTE_DEFINITION_FETCH_TIMEOUT_MS } from \"./computeLimits.js\";\nimport { n as liveOwnerKey, r as solveEndedKind, t as bindLiveSolve } from \"./liveSolve.server.js\";\nimport { isHttpError } from \"@sveltejs/kit\";\n//#region src/lib/server/compute/remoteDefinition.server.ts\n/**\n* App-wide instance of the remote-definition fetcher (SSRF guard, size cap,\n* deadline, TTL cache all live in `@selvajs/server`'s `createRemoteDefinitionFetcher`).\n*/\nvar fetcher = createRemoteDefinitionFetcher({\n\tmaxBytes: REMOTE_DEFINITION_MAX_BYTES,\n\tfetchTimeoutMs: REMOTE_DEFINITION_FETCH_TIMEOUT_MS,\n\tcacheTtlMs: REMOTE_DEFINITION_CACHE_TTL_MS,\n\tnow: () => Date.now(),\n\tlogger: lazyLogger\n});\n/** Fetch (or return cached) remote `.gh` bytes. Throws on unsafe host / oversized / timeout. */\nfunction loadRemoteDefinition(url) {\n\treturn fetcher.load(url);\n}\n//#endregion\n//#region src/lib/server/computeRateLimit.server.ts\n/**\n* App-wide instance of the compute-solve rate limiter (fixed-window, per-key,\n* process-local; `@selvajs/server`'s `createComputeRateLimiter`), wired with the\n* window + cap from `computeLimits.ts`.\n*\n* Keyed by caller — `user:{userId}` for authenticated solves, `share:{linkId}`\n* for share-token solves so anonymous consumers of one link don't share a\n* bucket with the link's owner.\n*/\nvar limiter = createComputeRateLimiter({\n\twindowMs: RATE_LIMIT_WINDOW_MS,\n\tmaxPerWindow: RATE_LIMIT_MAX_REQUESTS\n});\nfunction checkComputeRateLimit(key) {\n\treturn limiter.check(key);\n}\n//#endregion\n//#region src/lib/server/compute/solve.server.ts\n/**\n* The body-independent core of a solve request, shared by `POST /api/v1/compute`\n* (share-token and remote-URL capable) and `POST /api/v1/definitions/{guid}/solve`\n* (tenant-scoped, cookie or PAT).\n*\n* **Share-token resolution stays outside this module, in the route.** The caller\n* hands in an already-decided `SolveAccess`; the definition-addressed route only\n* ever constructs the `user` variant, so it cannot inherit the anonymous branch\n* by accident. Adding a token lookup here would silently give it one.\n*\n* What lives here: rate limiting, definition/version resolution, access checks,\n* compute-server routing, schema backfill, the engine call, metric recording, the\n* debug breakdown. What stays in a route: parsing its own body shape and deciding\n* who the caller is.\n*/\n/**\n* Run a solve and return the HTTP response.\n*\n* Throws `HttpError` (via `apiError`) for every refusal, and lets engine/network\n* failures propagate for the caller's outer catch to map — the two routes share\n* that mapping through `mapSolveError`.\n*/\nasync function runSolve(params) {\n\tconst { access, definitionUrl, inputs, values, channel, versionId: explicitVersionId, request, locals, loadStart, prepMarks, concealAccessFailure = false, streamId = null } = params;\n\tconst storage = getStorageProvider();\n\tconst sharedAccess = access.kind === \"share\" ? access : null;\n\tconst solveCtx = access.ctx;\n\tlet prevMark = performance.now();\n\tconst mark = (label) => {\n\t\tprepMarks.push([label, performance.now() - prevMark]);\n\t\tprevMark = performance.now();\n\t};\n\tlet definitionSource;\n\tlet localDefinitionRef = null;\n\tlet localVersionForBackfill = null;\n\tlet solveOrgId = null;\n\tlet definitionPin = null;\n\tlet metricDefinitionId = null;\n\tlet metricVersionId = null;\n\tconst isLocal = definitionUrl.startsWith(\"local:\");\n\tconst guid = isLocal ? definitionUrl.substring(6) : null;\n\tconst recordMetric = (failureKind, extra = {}) => {\n\t\tgetSolveMetricSink().record(solveCtx, {\n\t\t\tdefinitionUrl,\n\t\t\tdefinitionId: metricDefinitionId,\n\t\t\tversionId: metricVersionId,\n\t\t\tchannel,\n\t\t\torgId: solveOrgId,\n\t\t\tdurationMs: extra.durationMs ?? 0,\n\t\t\tok: failureKind === \"ok\",\n\t\t\tfailureKind,\n\t\t\terrorCount: extra.errorCount ?? 0,\n\t\t\twarningCount: extra.warningCount ?? 0\n\t\t}).catch((err) => locals.log.error(\"Solve-metric record failed\", {\n\t\t\tcomponent: \"API/Compute\",\n\t\t\terr: renderThrown(err)\n\t\t}));\n\t};\n\tconst rateLimit = checkComputeRateLimit(access.rateLimitKey);\n\tif (!rateLimit.allowed) {\n\t\trecordMetric(\"rate_limited\");\n\t\tconst retryAfter = rateLimit.retryAfter ?? 1;\n\t\treturn new Response(JSON.stringify({\n\t\t\tmessage: `Too many compute requests. Retry in ${retryAfter}s.`,\n\t\t\tretryAfter\n\t\t}), {\n\t\t\tstatus: 429,\n\t\t\theaders: {\n\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\"Retry-After\": String(retryAfter)\n\t\t\t}\n\t\t});\n\t}\n\tif (isLocal && guid) {\n\t\tlet record;\n\t\ttry {\n\t\t\trecord = await providers.data.definitions.get(solveCtx, guid);\n\t\t} catch (err) {\n\t\t\tlocals.log.error(\"Failed to load local definition\", {\n\t\t\t\tcomponent: \"API/Compute\",\n\t\t\t\tguid,\n\t\t\t\terr: renderThrown(err)\n\t\t\t});\n\t\t\tapiError(404, ApiErrorCode.NOT_FOUND, `Definition '${guid}' not found`);\n\t\t}\n\t\tif (!record) apiError(404, ApiErrorCode.NOT_FOUND, `Definition '${guid}' not found`);\n\t\tmark(\"defRecord\");\n\t\tconst project = await providers.data.projects.getProject(solveCtx, record.projectId);\n\t\tsolveOrgId = project?.orgId ?? null;\n\t\tdefinitionPin = record.computeServerId ?? null;\n\t\tmark(\"project\");\n\t\tif (!sharedAccess) try {\n\t\t\tassertScope(access.ctx, \"solve\", {\n\t\t\t\tprojectId: record.projectId,\n\t\t\t\tdefinitionId: guid\n\t\t\t});\n\t\t\tif (channel === \"draft\" || explicitVersionId) await requireCanEditDefinition(scoped(locals), record.projectId, guid, {\n\t\t\t\tproject,\n\t\t\t\tdefinition: record\n\t\t\t});\n\t\t\telse await requireCanSolve(scoped(locals), record.projectId, project ?? void 0);\n\t\t} catch (err) {\n\t\t\tconst status = isApiError(err) ? err.status : isHttpError(err) ? err.status : void 0;\n\t\t\tif (concealAccessFailure && status === 403) apiError(404, ApiErrorCode.NOT_FOUND, `Definition '${guid}' not found`);\n\t\t\tthrow err;\n\t\t}\n\t\tmark(\"access\");\n\t\tconst versionId = explicitVersionId ?? (channel === \"live\" ? record.liveVersionId : record.draftVersionId);\n\t\tif (!versionId) apiError(404, ApiErrorCode.NOT_FOUND, `Definition '${guid}' has no ${channel} version yet`);\n\t\tconst version = await providers.data.definitions.getVersion(solveCtx, versionId);\n\t\tif (!version || version.definitionId !== guid) apiError(404, ApiErrorCode.NOT_FOUND, `Definition '${guid}' version is missing`);\n\t\tlocalVersionForBackfill = {\n\t\t\tid: version.id,\n\t\t\thasSchema: version.schema !== void 0\n\t\t};\n\t\tmetricDefinitionId = guid;\n\t\tmetricVersionId = version.id;\n\t\tmark(\"version\");\n\t\tlocalDefinitionRef = engine.definitionRef(version.id, async () => {\n\t\t\tconst bytes = await storage.get(version.fileKey);\n\t\t\tif (!bytes) throw new Error(`Version blob missing: ${version.fileKey}`);\n\t\t\treturn bytes;\n\t\t});\n\t\tdefinitionSource = localDefinitionRef;\n\t\tmark(\"blob\");\n\t} else {\n\t\tassertScope(access.ctx, \"solve\");\n\t\ttry {\n\t\t\tdefinitionSource = await loadRemoteDefinition(definitionUrl);\n\t\t} catch (err) {\n\t\t\tlocals.log.error(\"Failed to fetch remote definition\", {\n\t\t\t\tcomponent: \"API/Compute\",\n\t\t\t\tdefinitionUrl,\n\t\t\t\terr: renderThrown(err)\n\t\t\t});\n\t\t\tapiError(400, ApiErrorCode.VALIDATION_FAILED, `Failed to load definition: ${err instanceof Error ? err.message : String(err)}`);\n\t\t}\n\t\tmark(\"remoteDef\");\n\t}\n\tconst defLoadMs = performance.now() - loadStart;\n\tif (sharedAccess) {\n\t\tif (await providers.data.shareLinks.tryIncrementSolveCount(solveCtx, sharedAccess.link.id) === null) {\n\t\t\trecordMetric(\"share_cap\");\n\t\t\tapiError(429, ApiErrorCode.INTERNAL, \"Share link solve cap reached.\");\n\t\t}\n\t\tmark(\"shareCap\");\n\t}\n\tconst serverConfig = await resolveServerForOrg(solveCtx, solveOrgId, locals.providers.data.computeServer, { definitionPin });\n\tmark(\"resolveServer\");\n\tif (localVersionForBackfill && !localVersionForBackfill.hasSchema && localDefinitionRef) {\n\t\tconst versionId = localVersionForBackfill.id;\n\t\ttry {\n\t\t\tconst bytes = await localDefinitionRef.load();\n\t\t\tconst schema = await fetchSchemaFromCompute(bytes, serverConfig);\n\t\t\tawait providers.data.definitions.setVersionSchema(solveCtx, versionId, schema);\n\t\t} catch (err) {\n\t\t\tlocals.log.warn(\"Schema backfill failed\", {\n\t\t\t\tcomponent: \"API/Compute\",\n\t\t\t\tversionId,\n\t\t\t\terr: renderThrown(err)\n\t\t\t});\n\t\t}\n\t\tmark(\"schemaBackfill\");\n\t}\n\tconst live = bindLiveSolve({\n\t\townerKey: liveOwnerKey(access.kind === \"user\" ? access.ctx.userId : null),\n\t\tstreamId,\n\t\trequest,\n\t\ttokenTtlMs: SOLVE_DEADLINE_MS + 6e4\n\t});\n\tlet outcome;\n\ttry {\n\t\toutcome = await engine.solve({\n\t\t\tserver: serverConfig,\n\t\t\tdefinitionSource,\n\t\t\tdefinitionKey: isLocal ? void 0 : definitionUrl,\n\t\t\tinputs,\n\t\t\tvalues,\n\t\t\tsignal: request.signal,\n\t\t\tacceptEncoding: request.headers.get(\"accept-encoding\") ?? \"\",\n\t\t\tdefinitionGuid: guid ?? void 0,\n\t\t\tloadStartMs: loadStart,\n\t\t\tdefLoadMs,\n\t\t\tprepMarks,\n\t\t\tselvaEvents: live.selvaEvents\n\t\t});\n\t} finally {\n\t\tlive.end(outcome ? solveEndedKind(outcome) : \"error\");\n\t}\n\tmark(\"solve\");\n\tif (outcome.kind === \"timeout\") recordMetric(\"timeout\", { durationMs: outcome.durationMs });\n\telse if (outcome.kind === \"client_abort\") recordMetric(\"client_abort\", { durationMs: outcome.durationMs });\n\telse if (outcome.kind === \"too_large\") recordMetric(\"too_large\");\n\telse if (outcome.kind === \"shed\") recordMetric(\"shed\", { durationMs: outcome.durationMs });\n\telse if (outcome.kind === \"ok\") {\n\t\trecordMetric(\"ok\", {\n\t\t\tdurationMs: outcome.solveMs,\n\t\t\terrorCount: outcome.errorCount,\n\t\t\twarningCount: outcome.warningCount\n\t\t});\n\t\tif (metricDefinitionId) providers.data.definitions.incrementSolveCount(solveCtx, metricDefinitionId).catch((err) => locals.log.warn(\"solveCount increment failed\", {\n\t\t\tcomponent: \"API/Compute\",\n\t\t\tdefinitionId: metricDefinitionId,\n\t\t\terr: renderThrown(err)\n\t\t}));\n\t\tif (COMPUTE_DEBUG) logDebugBreakdown(locals, request, outcome, defLoadMs, prepMarks);\n\t}\n\treturn engine.toWebResponse(outcome);\n}\n/**\n* Both solve routes share this so they cannot drift on which failures read as\n* \"compute is down\" (503) versus a server bug (500).\n*/\nfunction mapSolveError(err, locals) {\n\tif (isHttpError(err)) throw err;\n\tif (isApiError(err)) apiError(err.status, err.code, err.message, err.fields, err.details);\n\tif (err instanceof ComputeServerUnconfiguredError) apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, err.message);\n\tconst message = err instanceof Error ? err.message : \"Unknown error\";\n\tlocals.log.error(\"Solve request failed\", {\n\t\tcomponent: \"API/Compute\",\n\t\terr: renderThrown(err),\n\t\t...err instanceof t && typeof err.context?.responseBody === \"string\" && { computeResponseBody: err.context.responseBody }\n\t});\n\tif (err instanceof t) {\n\t\tif (err.code === e.NETWORK_ERROR || err.code === e.CORS_ERROR) apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, \"Compute server is unreachable\");\n\t\tif (err.code === e.AUTH_ERROR) apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, \"Compute server rejected this deployment's credentials — check the compute API key configuration.\");\n\t\tif (err.code === e.RATE_LIMIT) apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, \"Compute server is rate-limiting requests. Retry shortly.\");\n\t\tif (err.code === e.TIMEOUT_ERROR) apiError(504, ApiErrorCode.COMPUTE_UNAVAILABLE, \"Compute server timed out running the solve.\");\n\t}\n\tif (err instanceof TypeError && message === \"fetch failed\") apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, \"Compute server is unreachable\");\n\tapiError(500, ApiErrorCode.INTERNAL, message);\n}\n/**\n* DEBUG (SELVA_FLAG_COMPUTE_DEBUG): the server-side overhead the solve metric's\n* `durationMs` doesn't capture. `load` = auth + DB + definition fetch; `tree` =\n* input tree build; `serialize` = JSON.stringify of the result.\n*/\nfunction logDebugBreakdown(locals, request, outcome, defLoadMs, prepMarks) {\n\tconst { metrics } = outcome.envelope;\n\tlocals.log.debug(\"Solve server-side phase breakdown\", {\n\t\tcomponent: \"Compute/server\",\n\t\tloadMs: Math.round(defLoadMs),\n\t\ttreeBuildMs: Math.round(metrics.treeBuildMs),\n\t\tsolveMs: Math.round(metrics.solveMs),\n\t\tserializeMs: Math.round(metrics.serializeMs),\n\t\tgzipMs: Math.round(metrics.gzipMs),\n\t\tserverTotalMs: Math.round(metrics.serverTotalMs),\n\t\tserializedBytes: metrics.serializedBytes\n\t});\n\tif (metrics.compressedBytes !== null) locals.log.debug(\"Response gzipped\", {\n\t\tcomponent: \"Compute/server\",\n\t\tserializedBytes: metrics.serializedBytes,\n\t\tcompressedBytes: metrics.compressedBytes,\n\t\tratio: Number((metrics.serializedBytes / metrics.compressedBytes).toFixed(1))\n\t});\n\telse {\n\t\tconst acceptEncoding = request.headers.get(\"accept-encoding\") ?? \"\";\n\t\tlocals.log.debug(\"Compression skipped\", {\n\t\t\tcomponent: \"Compute/server\",\n\t\t\tacceptEncoding,\n\t\t\thasAcceptEncoding: acceptEncoding !== \"\"\n\t\t});\n\t}\n\tlocals.log.debug(\"Prep breakdown\", {\n\t\tcomponent: \"Compute/server\",\n\t\t...Object.fromEntries(prepMarks.map(([label, ms]) => [`p_${label}Ms`, Math.round(ms)]))\n\t});\n\tconst db = engine.stats().definitionBytes;\n\tlocals.log.debug(\"Definition byte-cache counters\", {\n\t\tcomponent: \"Compute/def-bytes\",\n\t\thits: db.hits,\n\t\tmisses: db.misses,\n\t\tevictions: db.evictions,\n\t\tentries: db.entries,\n\t\tretainedBytes: db.bytes\n\t});\n}\n//#endregion\nexport { runSolve as n, mapSolveError as t };\n"],"names":[],"mappings":";;;;;;;;;;;;;;AAaA;AACA;AACA;AACA;AACA;AACA,IAAI,OAAO,GAAG,6BAA6B,CAAC;AAC5C,CAAC,QAAQ,EAAE,2BAA2B;AACtC,CAAC,cAAc,EAAE,kCAAkC;AACnD,CAAC,UAAU,EAAE,8BAA8B;AAC3C,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,GAAG,EAAE;AACtB,CAAC,MAAM,EAAE;AACT,CAAC,CAAC;AACF;AACA,SAAS,oBAAoB,CAAC,GAAG,EAAE;AACnC,CAAC,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;AACzB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,OAAO,GAAG,wBAAwB,CAAC;AACvC,CAAC,QAAQ,EAAE,oBAAoB;AAC/B,CAAC,YAAY,EAAE;AACf,CAAC,CAAC;AACF,SAAS,qBAAqB,CAAC,GAAG,EAAE;AACpC,CAAC,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC;AAC1B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,QAAQ,CAAC,MAAM,EAAE;AAChC,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,oBAAoB,GAAG,KAAK,EAAE,QAAQ,GAAG,IAAI,EAAE,GAAG,MAAM;AACtL,CAAC,MAAM,OAAO,GAAG,kBAAkB,EAAE;AACrC,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,KAAK,OAAO,GAAG,MAAM,GAAG,IAAI;AAC7D,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG;AAC5B,CAAC,IAAI,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;AACjC,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,KAAK;AACzB,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC;AACvD,EAAE,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;AAC9B,CAAC,CAAC;AACF,CAAC,IAAI,gBAAgB;AACrB,CAAC,IAAI,kBAAkB,GAAG,IAAI;AAC9B,CAAC,IAAI,uBAAuB,GAAG,IAAI;AACnC,CAAC,IAAI,UAAU,GAAG,IAAI;AACtB,CAAC,IAAI,aAAa,GAAG,IAAI;AACzB,CAAC,IAAI,kBAAkB,GAAG,IAAI;AAC9B,CAAC,IAAI,eAAe,GAAG,IAAI;AAC3B,CAAC,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC;AACnD,CAAC,MAAM,IAAI,GAAG,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI;AACzD,CAAC,MAAM,YAAY,GAAG,CAAC,WAAW,EAAE,KAAK,GAAG,EAAE,KAAK;AACnD,EAAE,kBAAkB,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE;AACxC,GAAG,aAAa;AAChB,GAAG,YAAY,EAAE,kBAAkB;AACnC,GAAG,SAAS,EAAE,eAAe;AAC7B,GAAG,OAAO;AACV,GAAG,KAAK,EAAE,UAAU;AACpB,GAAG,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC;AACpC,GAAG,EAAE,EAAE,WAAW,KAAK,IAAI;AAC3B,GAAG,WAAW;AACd,GAAG,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC;AACpC,GAAG,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI;AACvC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,4BAA4B,EAAE;AACnE,GAAG,SAAS,EAAE,aAAa;AAC3B,GAAG,GAAG,EAAE,YAAY,CAAC,GAAG;AACxB,GAAG,CAAC,CAAC;AACL,CAAC,CAAC;AACF,CAAC,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,CAAC,YAAY,CAAC;AAC7D,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE;AACzB,EAAE,YAAY,CAAC,cAAc,CAAC;AAC9B,EAAE,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,IAAI,CAAC;AAC9C,EAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;AACrC,GAAG,OAAO,EAAE,CAAC,oCAAoC,EAAE,UAAU,CAAC,EAAE,CAAC;AACjE,GAAG;AACH,GAAG,CAAC,EAAE;AACN,GAAG,MAAM,EAAE,GAAG;AACd,GAAG,OAAO,EAAE;AACZ,IAAI,cAAc,EAAE,kBAAkB;AACtC,IAAI,aAAa,EAAE,MAAM,CAAC,UAAU;AACpC;AACA,GAAG,CAAC;AACJ,CAAC;AACD,CAAC,IAAI,OAAO,IAAI,IAAI,EAAE;AACtB,EAAE,IAAI,MAAM;AACZ,EAAE,IAAI;AACN,GAAG,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC;AAChE,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,iCAAiC,EAAE;AACvD,IAAI,SAAS,EAAE,aAAa;AAC5B,IAAI,IAAI;AACR,IAAI,GAAG,EAAE,YAAY,CAAC,GAAG;AACzB,IAAI,CAAC;AACL,GAAG,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;AAC1E,EAAE;AACF,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;AACtF,EAAE,IAAI,CAAC,WAAW,CAAC;AACnB,EAAE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC;AACtF,EAAE,UAAU,GAAG,OAAO,EAAE,KAAK,IAAI,IAAI;AACrC,EAAE,aAAa,GAAG,MAAM,CAAC,eAAe,IAAI,IAAI;AAChD,EAAE,IAAI,CAAC,SAAS,CAAC;AACjB,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI;AACzB,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE;AACpC,IAAI,SAAS,EAAE,MAAM,CAAC,SAAS;AAC/B,IAAI,YAAY,EAAE;AAClB,IAAI,CAAC;AACL,GAAG,IAAI,OAAO,KAAK,OAAO,IAAI,iBAAiB,EAAE,MAAM,wBAAwB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE;AACxH,IAAI,OAAO;AACX,IAAI,UAAU,EAAE;AAChB,IAAI,CAAC;AACL,QAAQ,MAAM,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,IAAI,KAAK,CAAC,CAAC;AAClF,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,MAAM;AACvF,GAAG,IAAI,oBAAoB,IAAI,MAAM,KAAK,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;AACtH,GAAG,MAAM,GAAG;AACZ,EAAE;AACF,EAAE,IAAI,CAAC,QAAQ,CAAC;AAChB,EAAE,MAAM,SAAS,GAAG,iBAAiB,KAAK,OAAO,KAAK,MAAM,GAAG,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,cAAc,CAAC;AAC5G,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;AAC7G,EAAE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC;AAClF,EAAE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;AACjI,EAAE,uBAAuB,GAAG;AAC5B,GAAG,EAAE,EAAE,OAAO,CAAC,EAAE;AACjB,GAAG,SAAS,EAAE,OAAO,CAAC,MAAM,KAAK;AACjC,GAAG;AACH,EAAE,kBAAkB,GAAG,IAAI;AAC3B,EAAE,eAAe,GAAG,OAAO,CAAC,EAAE;AAC9B,EAAE,IAAI,CAAC,SAAS,CAAC;AACjB,EAAE,kBAAkB,GAAG,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY;AACpE,GAAG,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;AACnD,GAAG,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,sBAAsB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AAC1E,GAAG,OAAO,KAAK;AACf,EAAE,CAAC,CAAC;AACJ,EAAE,gBAAgB,GAAG,kBAAkB;AACvC,EAAE,IAAI,CAAC,MAAM,CAAC;AACd,CAAC,CAAC,MAAM;AACR,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC;AAClC,EAAE,IAAI;AACN,GAAG,gBAAgB,GAAG,MAAM,oBAAoB,CAAC,aAAa,CAAC;AAC/D,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,mCAAmC,EAAE;AACzD,IAAI,SAAS,EAAE,aAAa;AAC5B,IAAI,aAAa;AACjB,IAAI,GAAG,EAAE,YAAY,CAAC,GAAG;AACzB,IAAI,CAAC;AACL,GAAG,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,2BAA2B,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAClI,EAAE;AACF,EAAE,IAAI,CAAC,WAAW,CAAC;AACnB,CAAC;AACD,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS;AAChD,CAAC,IAAI,YAAY,EAAE;AACnB,EAAE,IAAI,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE;AACvG,GAAG,YAAY,CAAC,WAAW,CAAC;AAC5B,GAAG,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,+BAA+B,CAAC;AACxE,EAAE;AACF,EAAE,IAAI,CAAC,UAAU,CAAC;AAClB,CAAC;AACD,CAAC,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,aAAa,EAAE,CAAC;AAC7H,CAAC,IAAI,CAAC,eAAe,CAAC;AACtB,CAAC,IAAI,uBAAuB,IAAI,CAAC,uBAAuB,CAAC,SAAS,IAAI,kBAAkB,EAAE;AAC1F,EAAE,MAAM,SAAS,GAAG,uBAAuB,CAAC,EAAE;AAC9C,EAAE,IAAI;AACN,GAAG,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE;AAChD,GAAG,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,YAAY,CAAC;AACnE,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC;AACjF,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE;AAC7C,IAAI,SAAS,EAAE,aAAa;AAC5B,IAAI,SAAS;AACb,IAAI,GAAG,EAAE,YAAY,CAAC,GAAG;AACzB,IAAI,CAAC;AACL,EAAE;AACF,EAAE,IAAI,CAAC,gBAAgB,CAAC;AACxB,CAAC;AACD,CAAC,MAAM,IAAI,GAAG,aAAa,CAAC;AAC5B,EAAE,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC;AAC3E,EAAE,QAAQ;AACV,EAAE,OAAO;AACT,EAAE,UAAU,EAAE,iBAAiB,GAAG;AAClC,EAAE,CAAC;AACH,CAAC,IAAI,OAAO;AACZ,CAAC,IAAI;AACL,EAAE,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC;AAC/B,GAAG,MAAM,EAAE,YAAY;AACvB,GAAG,gBAAgB;AACnB,GAAG,aAAa,EAAE,OAAO,GAAG,KAAK,CAAC,GAAG,aAAa;AAClD,GAAG,MAAM;AACT,GAAG,MAAM;AACT,GAAG,MAAM,EAAE,OAAO,CAAC,MAAM;AACzB,GAAG,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE;AAC/D,GAAG,cAAc,EAAE,IAAI,IAAI,KAAK,CAAC;AACjC,GAAG,WAAW,EAAE,SAAS;AACzB,GAAG,SAAS;AACZ,GAAG,SAAS;AACZ,GAAG,WAAW,EAAE,IAAI,CAAC;AACrB,GAAG,CAAC;AACJ,CAAC,CAAC,SAAS;AACX,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;AACvD,CAAC;AACD,CAAC,IAAI,CAAC,OAAO,CAAC;AACd,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,YAAY,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;AAC5F,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,YAAY,CAAC,cAAc,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;AAC3G,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC;AACjE,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;AAC3F,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE;AACjC,EAAE,YAAY,CAAC,IAAI,EAAE;AACrB,GAAG,UAAU,EAAE,OAAO,CAAC,OAAO;AAC9B,GAAG,UAAU,EAAE,OAAO,CAAC,UAAU;AACjC,GAAG,YAAY,EAAE,OAAO,CAAC;AACzB,GAAG,CAAC;AACJ,EAAE,IAAI,kBAAkB,EAAE,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE;AACrK,GAAG,SAAS,EAAE,aAAa;AAC3B,GAAG,YAAY,EAAE,kBAAkB;AACnC,GAAG,GAAG,EAAE,YAAY,CAAC,GAAG;AACxB,GAAG,CAAC,CAAC;AACL,EAAE,IAAI,aAAa,EAAE,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC;AACtF,CAAC;AACD,CAAC,OAAO,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;AACrC;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE;AACpC,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG;AAChC,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC;AAC1F,CAAC,IAAI,GAAG,YAAY,8BAA8B,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,GAAG,CAAC,OAAO,CAAC;AAChH,CAAC,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,eAAe;AACrE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE;AAC1C,EAAE,SAAS,EAAE,aAAa;AAC1B,EAAE,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC;AACxB,EAAE,GAAG,GAAG,YAAY,CAAC,IAAI,OAAO,GAAG,CAAC,OAAO,EAAE,YAAY,KAAK,QAAQ,IAAI,EAAE,mBAAmB,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY;AACzH,EAAE,CAAC;AACH,CAAC,IAAI,GAAG,YAAY,CAAC,EAAE;AACvB,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,aAAa,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,+BAA+B,CAAC;AACjJ,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,kGAAkG,CAAC;AACpL,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,0DAA0D,CAAC;AAC5I,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,6CAA6C,CAAC;AAClI,CAAC;AACD,CAAC,IAAI,GAAG,YAAY,SAAS,IAAI,OAAO,KAAK,cAAc,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,+BAA+B,CAAC;AAC7I,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC;AAC9C;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE;AAC3E,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,QAAQ;AACrC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,mCAAmC,EAAE;AACvD,EAAE,SAAS,EAAE,gBAAgB;AAC7B,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;AAC/B,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;AAC9C,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;AACtC,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;AAC9C,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;AACpC,EAAE,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;AAClD,EAAE,eAAe,EAAE,OAAO,CAAC;AAC3B,EAAE,CAAC;AACH,CAAC,IAAI,OAAO,CAAC,eAAe,KAAK,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,kBAAkB,EAAE;AAC5E,EAAE,SAAS,EAAE,gBAAgB;AAC7B,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe;AAC1C,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe;AAC1C,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC;AAC9E,EAAE,CAAC;AACH,MAAM;AACN,EAAE,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE;AACrE,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE;AAC1C,GAAG,SAAS,EAAE,gBAAgB;AAC9B,GAAG,cAAc;AACjB,GAAG,iBAAiB,EAAE,cAAc,KAAK;AACzC,GAAG,CAAC;AACJ,CAAC;AACD,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE;AACpC,EAAE,SAAS,EAAE,gBAAgB;AAC7B,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AACxF,EAAE,CAAC;AACH,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,eAAe;AAC1C,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,gCAAgC,EAAE;AACpD,EAAE,SAAS,EAAE,mBAAmB;AAChC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI;AACf,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM;AACnB,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS;AACzB,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO;AACrB,EAAE,aAAa,EAAE,EAAE,CAAC;AACpB,EAAE,CAAC;AACH;;;;"}

package/build/server/chunks/chunks/src.js-DubgTP8X.js ADDED Viewed

@@ -0,0 +1,509 @@
+import { z } from 'zod';
+//#region ../platform/src/permissions/types.ts
+/**
+* Platform-scope permissions. All but `manage_api_tokens` are reserved for
+* Selva staff and instance operators; regular users hold an empty array.
+*
+* - `instance_admin`        — superuser; implies every other permission
+* - `manage_compute`        — configure the instance-wide Rhino.Compute pool
+* - `manage_instance_users` — disable/enable any user on the instance
+* - `manage_updates`        — run system updates
+* - `manage_api_tokens`     — mint API tokens for yourself
+*/
+var PlatformPermissionSchema = z.enum([
+	"instance_admin",
+	"manage_compute",
+	"manage_instance_users",
+	"manage_updates",
+	"manage_api_tokens"
+]);
+var ALL_PLATFORM_PERMISSIONS = PlatformPermissionSchema.options;
+/**
+* The permissions that admit someone to the `/admin` operator surface.
+* `manage_api_tokens` is granted to ordinary users, who have no business there.
+*/
+var OPERATOR_PLATFORM_PERMISSIONS = ALL_PLATFORM_PERMISSIONS.filter((p) => p !== "manage_api_tokens");
+var RESERVED_SLUG_SET = /* @__PURE__ */ new Set([
+	"o",
+	"api",
+	"admin",
+	"auth",
+	"login",
+	"logout",
+	"setup",
+	"settings",
+	"team",
+	"library",
+	"projects",
+	"accept-invite"
+]);
+/**
+* Coerces an arbitrary name into a slug candidate. Does not guarantee a valid
+* slug — an all-symbols name yields `''`, and reserved words pass through
+* untouched — run the result through `SlugSchema` where validity matters.
+*/
+function slugify(name) {
+	return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 63);
+}
+/** Lowercase alphanumeric with internal hyphens, 3–63 chars, not a reserved word. */
+var SlugSchema = z.string().min(3, "Slug must be at least 3 characters").max(63, "Slug must be at most 63 characters").regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/, "Slug must be lowercase alphanumeric with hyphens (no leading/trailing/consecutive hyphens)").refine((s) => !RESERVED_SLUG_SET.has(s), { message: "Slug is reserved and cannot be used" });
+var OrgRoleSchema = z.enum([
+	"owner",
+	"admin",
+	"member"
+]);
+/** Kinds of org-scoped branding asset. Adding a kind is a single entry here — path, upload route, store, and UI are all generic over it. */
+var OrgAssetKindSchema = z.enum(["logo", "favicon"]);
+var ALL_ORG_ASSET_KINDS = OrgAssetKindSchema.options;
+/**
+* Org-scope permissions. A user may hold different sets in different orgs.
+*
+* `read_all_org_projects` lets its holder mint an API token that reads and
+* solves every project in the org, including ones they aren't a member of.
+*/
+var OrgPermissionSchema = z.enum([
+	"manage_org_members",
+	"manage_org_compute",
+	"manage_definitions",
+	"manage_projects",
+	"read_all_org_projects"
+]);
+var ALL_ORG_PERMISSIONS = OrgPermissionSchema.options;
+/** The permissions that run some part of `/team`. */
+var ORG_MANAGEMENT_PERMISSIONS = ALL_ORG_PERMISSIONS.filter((p) => p !== "read_all_org_projects");
+/** Governance perms — never grantable to `member`. */
+var OWNER_ADMIN_ONLY_PERMISSIONS = ["manage_org_members", "manage_org_compute"];
+var MEMBER_ASSIGNABLE_PERMISSIONS = ALL_ORG_PERMISSIONS.filter((p) => !OWNER_ADMIN_ONLY_PERMISSIONS.includes(p));
+/**
+* Applied when adding a member without an explicit permissions list.
+*
+* `read_all_org_projects` is never a default: a key holding it reads projects
+* its owner isn't a member of, without the audit trail Reclaim leaves.
+*/
+var DEFAULT_ORG_PERMISSIONS = {
+	owner: [...ORG_MANAGEMENT_PERMISSIONS],
+	admin: [...ORG_MANAGEMENT_PERMISSIONS],
+	member: []
+};
+var CreateOrgSchema = z.object({
+	name: z.string().min(1, "Organization name is required").max(128),
+	slug: SlugSchema
+});
+var UpdateOrgSchema = CreateOrgSchema.partial();
+z.enum([
+	"read",
+	"write",
+	"solve"
+]);
+var SCOPE_PATTERN = /^(read|write|solve):(all|(org|project|definition):([A-Za-z0-9_-]{1,128}))$/;
+/** `read:all`, `write:org:<id>`, `solve:project:<id>`, `read:definition:<guid>`. */
+function parseApiScope(value) {
+	const m = SCOPE_PATTERN.exec(value);
+	if (!m) return null;
+	const action = m[1];
+	if (m[2] === "all") return {
+		action,
+		resource: { kind: "all" }
+	};
+	return {
+		action,
+		resource: {
+			kind: m[3],
+			id: m[4]
+		}
+	};
+}
+/**
+* Scopes are stored as strings so a new action or resource kind needs no
+* migration. Parsing rejects anything this version doesn't understand, so an
+* unknown scope grants nothing rather than being guessed at.
+*/
+var ApiScopeStringSchema = z.string().refine((s) => parseApiScope(s) !== null, { message: "Unknown scope" });
+z.enum([
+	"owner",
+	"admin",
+	"member_removed",
+	"user_disabled"
+]);
+/** The only lifetimes offered. Expiry is never optional. */
+var API_TOKEN_LIFETIME_DAYS = [
+	30,
+	90,
+	180
+];
+var ACTION_WORDS = {
+	read: "Read",
+	write: "Read and change",
+	solve: "Read and run solves on"
+};
+/** "Read and change everything in the org". Names no ids, so it suits an email. */
+function describeApiScope(value) {
+	const scope = parseApiScope(value);
+	if (!scope) return `Unknown scope (${value})`;
+	const what = scope.resource.kind === "project" ? "one project" : scope.resource.kind === "definition" ? "one definition" : "everything in the org";
+	return `${ACTION_WORDS[scope.action]} ${what}`;
+}
+//#endregion
+//#region ../platform/src/errors.ts
+/**
+* Thrown by providers to signal an expected failure the API layer forwards with
+* a specific status. Unknown errors should propagate as plain `Error` and become 500s.
+*/
+var ProviderError = class extends Error {
+	statusCode;
+	constructor(message, statusCode = 400) {
+		super(message);
+		this.name = "ProviderError";
+		this.statusCode = statusCode;
+	}
+};
+//#endregion
+//#region ../platform/src/apiTokens/scope.ts
+/**
+* May this request perform `action` on `target`?
+*
+* Without a target this is an org-level check, which only `all` and org scopes
+* pass: a project key must never reach a route that can't say which project it
+* touches. Requests without an API token always pass; their permissions are
+* checked elsewhere.
+*/
+function scopeAllows(ctx, action, target) {
+	const api = ctx.apiScope;
+	if (!api) return true;
+	return api.scopes.some((s) => actionCovers(s.action, action) && resourceCovers(s, ctx, target));
+}
+function actionCovers(granted, wanted) {
+	return granted === wanted || wanted === "read";
+}
+function resourceCovers(scope, ctx, target) {
+	const { resource } = scope;
+	switch (resource.kind) {
+		case "all": return true;
+		case "org": return resource.id === ctx.actingOrgId;
+		case "project": return target?.projectId === resource.id;
+		case "definition": return target?.definitionId === resource.id;
+	}
+}
+/**
+* Narrow the owner's live context to what the token grants. Only removes
+* rights:
+*
+* - Platform permissions are dropped. Instance authority never rides on a
+*   bearer key, so an operator's leaked key can't reach other tenants.
+* - `apiScope` is attached, which `scopeAllows` reads.
+*
+* Scopes this version can't parse are dropped, so they grant nothing.
+*/
+function narrowApiTokenContext(ctx, token) {
+	if (ctx.actingOrgId !== token.orgId) throw new ProviderError("API token context must act in the token’s org", 500);
+	const scopes = token.scopes.map(parseApiScope).filter((s) => s !== null);
+	return {
+		...ctx,
+		platformPermissions: [],
+		apiScope: {
+			tokenId: token.id,
+			scopes
+		}
+	};
+}
+//#endregion
+//#region ../platform/src/projects/schemas.ts
+var ProjectVisibilitySchema = z.enum([
+	"public",
+	"org",
+	"private",
+	"platform"
+]);
+var ProjectRoleSchema = z.enum([
+	"owner",
+	"editor",
+	"viewer"
+]);
+/** Cross-field check for PATCH flows. Call on the merged post-patch shape. */
+function validateProjectFlags(merged) {
+	const issues = [];
+	if (merged.autoJoinOnUpload && merged.visibility !== "public") issues.push({
+		path: "autoJoinOnUpload",
+		message: "autoJoinOnUpload requires visibility=public"
+	});
+	if (merged.visibility === "platform" && merged.autoJoinOnUpload) issues.push({
+		path: "autoJoinOnUpload",
+		message: "autoJoinOnUpload is not allowed on platform projects"
+	});
+	return issues;
+}
+//#endregion
+//#region ../platform/src/platformProjects/schemas.ts
+var PlatformProjectGranteeTypeSchema = z.enum(["org", "user"]);
+z.object({
+	id: z.string(),
+	projectId: z.string(),
+	granteeType: PlatformProjectGranteeTypeSchema,
+	granteeId: z.string(),
+	canSolve: z.boolean(),
+	createdBy: z.string(),
+	createdAt: z.string()
+});
+//#endregion
+//#region ../platform/src/definitions/types.ts
+var GH_EXTENSIONS = [".gh", ".ghx"];
+var COVER_IMAGE_EXTENSIONS = [
+	".jpg",
+	".jpeg",
+	".png",
+	".webp",
+	".gif"
+];
+[...GH_EXTENSIONS, ...COVER_IMAGE_EXTENSIONS];
+var COVER_IMAGE_CONTENT_TYPES = {
+	".jpg": "image/jpeg",
+	".jpeg": "image/jpeg",
+	".png": "image/png",
+	".webp": "image/webp",
+	".gif": "image/gif"
+};
+function toDefinitionListItem(r) {
+	return {
+		guid: r.guid,
+		projectId: r.projectId,
+		displayName: r.displayName,
+		description: r.description,
+		category: r.category,
+		tags: r.tags,
+		coverImage: r.coverImage,
+		status: r.status,
+		solveCount: r.solveCount,
+		liveVersionId: r.liveVersionId,
+		updatedAt: r.updatedAt
+	};
+}
+var GuidSchema = z.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "Invalid GUID format");
+var DefinitionStatusSchema = z.enum([
+	"draft",
+	"published",
+	"archived"
+]);
+var DefinitionFileExtSchema = z.enum(["gh", "ghx"]);
+z.object({
+	id: GuidSchema,
+	definitionId: GuidSchema,
+	versionNumber: z.number().int().min(1),
+	fileExt: DefinitionFileExtSchema,
+	fileKey: z.string().min(1),
+	originalFilename: z.string().max(256).optional(),
+	uploadedBy: z.string().min(1),
+	uploadedAt: z.string(),
+	changeNote: z.string().max(1e3).optional(),
+	schema: z.record(z.string(), z.unknown()).optional(),
+	schemaExtractedAt: z.string().optional()
+});
+var DefinitionChannelSchema = z.enum(["live", "draft"]);
+/** HTTP-body validator for new-definition input. */
+var CreateDefinitionInputSchema = z.object({
+	displayName: z.string().min(1, "Display name is required").max(256),
+	description: z.string().max(2e3).optional(),
+	coverImage: z.string().max(2048).optional(),
+	category: z.string().max(128).optional(),
+	tags: z.array(z.string().max(64)).max(20).optional(),
+	projectId: GuidSchema,
+	computeServerId: GuidSchema.optional()
+});
+/**
+* PATCH validator. Field semantics match `DefinitionRecordPatch`:
+* - missing / `undefined` — leave unchanged
+* - `null` — clear (only on nullable fields)
+* - value — set
+*/
+var UpdateMetadataInputSchema = z.object({
+	displayName: z.string().min(1, "Display name is required").max(256).optional(),
+	description: z.string().max(2e3).nullable().optional(),
+	coverImage: z.string().max(2048).nullable().optional(),
+	category: z.string().max(128).nullable().optional(),
+	tags: z.array(z.string().max(64)).max(20).nullable().optional(),
+	projectId: GuidSchema.optional(),
+	computeServerId: GuidSchema.nullable().optional(),
+	solveCacheLimit: z.number().int().min(0).max(1e5).nullable().optional(),
+	status: DefinitionStatusSchema.optional()
+});
+/** Body for `POST /api/definitions/[guid]/publish`. */
+var PublishVersionInputSchema = z.object({ versionId: GuidSchema.optional() }).default({});
+//#endregion
+//#region ../platform/src/shareLinks/schemas.ts
+/**
+* HTTP body for `POST /api/definitions/[guid]/share-links`. The route returns
+* the raw token exactly once.
+*/
+var CreateShareLinkInputSchema = z.object({
+	channel: DefinitionChannelSchema.default("live"),
+	name: z.string().max(128).optional(),
+	allowSolve: z.boolean().default(true),
+	/** Null is the minter's deliberate "uncap" choice; omitted applies the default cap. */
+	maxSolves: z.number().int().min(1).nullable().optional(),
+	expiresAt: z.iso.datetime().nullable().optional()
+});
+//#endregion
+//#region ../platform/src/storage/image.ts
+/**
+* Shared image-transcoding helper for `IStorageProvider` implementations.
+* Normalizes uploads to WebP (capped at 1200px, quality 85) so storage,
+* bandwidth, and the viewer path stay predictable.
+*
+* `sharp` is a dynamic import, not a hard dependency of this package —
+* providers that need transcoding install it themselves.
+*/
+var IMAGE_MAX_WIDTH = 1200;
+/** True if the input looks like an image to process — by content type or path extension. */
+function isImageUpload(contentType, storagePath) {
+	if (contentType?.startsWith("image/")) return true;
+	return /\.(webp|png|jpe?g|gif|bmp|tif?f|svg)$/i.test(storagePath);
+}
+/**
+* Rewrites a path's extension to `.webp`; unchanged for non-image extensions.
+* SVG is rasterized like any other input, so no vector blob is ever
+* persisted — served bytes stay XSS-free without a sanitizer.
+*/
+function toWebpPath(storagePath) {
+	return storagePath.replace(/\.(png|jpe?g|gif|bmp|tif?f|svg)$/i, ".webp");
+}
+/**
+* Transcodes images to WebP; passes non-images through unchanged, so
+* providers can call this unconditionally before `put`.
+*
+* Throws if `sharp` isn't installed — a config error, not a fallback.
+*/
+async function transcodeImageIfNeeded(data, contentType, storagePath) {
+	if (!isImageUpload(contentType, storagePath)) return {
+		data,
+		contentType: contentType ?? "application/octet-stream",
+		path: storagePath
+	};
+	const compressed = await (await loadSharp())(Buffer.from(data)).resize({
+		width: IMAGE_MAX_WIDTH,
+		withoutEnlargement: true
+	}).webp({ quality: 85 }).toBuffer();
+	return {
+		data: new Uint8Array(compressed),
+		contentType: "image/webp",
+		path: toWebpPath(storagePath)
+	};
+}
+var cachedSharp = null;
+async function loadSharp() {
+	if (cachedSharp) return cachedSharp;
+	try {
+		const mod = await import('sharp');
+		cachedSharp = mod.default ?? mod;
+		return cachedSharp;
+	} catch (err) {
+		throw new Error("Image transcoding requires `sharp` to be installed. Add it as a dependency in your provider package.", { cause: err });
+	}
+}
+//#endregion
+//#region ../platform/src/storage/assetClasses.ts
+var BRANDING_KINDS = ALL_ORG_ASSET_KINDS.join("|");
+var COVER_EXTS = COVER_IMAGE_EXTENSIONS.map((ext) => ext.replace(/^\./, "").replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|");
+var SAFE_SEGMENT = String.raw`[A-Za-z0-9._-]+`;
+var GUID = String.raw`[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}`;
+/**
+* The closed registry of servable asset classes. Patterns are mutually
+* exclusive by prefix, order doesn't matter. Anything matching no class is
+* unservable (the route 404s) — default-deny, so a new blob type is opt-in.
+*/
+var ASSET_CLASSES = [
+	{
+		id: "org-branding",
+		visibility: "public",
+		scope: "none",
+		pattern: new RegExp(String.raw`^orgs\/(${SAFE_SEGMENT})\/branding\/(?:${BRANDING_KINDS})\.webp$`)
+	},
+	{
+		id: "org-private",
+		visibility: "org",
+		scope: "org",
+		pattern: new RegExp(String.raw`^orgs\/(${SAFE_SEGMENT})\/private\/${SAFE_SEGMENT}$`)
+	},
+	{
+		id: "definition-cover",
+		visibility: "project",
+		scope: "project",
+		pattern: new RegExp(String.raw`^definitions\/(${GUID})\/cover\.(?:${COVER_EXTS})$`, "i")
+	}
+];
+/**
+* Rejects traversal, empty, or backslash segments before a path can match a
+* class. The permissive segment alphabet (`[A-Za-z0-9._-]+`) admits a bare
+* `.` or `..` as a whole segment, which would otherwise let
+* `orgs/../branding/logo.webp` classify as public branding with `..`
+* captured as the orgId. Mirrors `assertSafeKey` on the write side, so a path
+* that can't be written can't be read either.
+*/
+function hasUnsafeSegment(storagePath) {
+	if (storagePath.includes("\\")) return true;
+	for (const segment of storagePath.split("/")) if (segment === "" || segment === "." || segment === "..") return true;
+	return false;
+}
+/**
+* Classifies a storage path into its asset class and scope id, or null when
+* no class matches (or the path is unsafe). `getPublicUrl` and the serving
+* route both consult this so URL generation and authorization never drift
+* apart.
+*
+* `scopeId` is null for `scope: 'none'` classes even when the pattern
+* captures an id (e.g. `org-branding` captures orgId but is public).
+*/
+function classifyAssetPath(storagePath) {
+	if (hasUnsafeSegment(storagePath)) return null;
+	for (const cls of ASSET_CLASSES) {
+		const m = cls.pattern.exec(storagePath);
+		if (!m) continue;
+		return {
+			class: cls,
+			scopeId: cls.scope === "none" ? null : m[1] ?? null
+		};
+	}
+	return null;
+}
+//#endregion
+//#region ../platform/src/context.ts
+/** For server-internal operations outside any HTTP request (bootstrap, janitors, migrations). */
+var SYSTEM_CONTEXT = {
+	userId: "",
+	platformPermissions: [...ALL_PLATFORM_PERMISSIONS],
+	orgPermissions: [...ALL_ORG_PERMISSIONS],
+	system: true
+};
+/**
+* Does not cross-check `ctx.actingOrgId` — the caller must build a context scoped
+* to the org it's acting on. An org permission against a context without
+* `actingOrgId` returns false unless `instance_admin` or `system`.
+*/
+function hasPermission(ctx, permission) {
+	if (ctx.system) return true;
+	if (ctx.platformPermissions.includes("instance_admin")) return true;
+	if (isPlatformPermission(permission)) return ctx.platformPermissions.includes(permission);
+	return ctx.orgPermissions.includes(permission);
+}
+/**
+* An anonymous share-link holder. `system` is true on these contexts for adapter
+* dispatch only — a guard that treats `system` as "fully authorized" must
+* exclude them first.
+*/
+function isShareContext(ctx) {
+	return ctx.shareLinkId !== void 0;
+}
+/**
+* Refuse a privileged operation to a share-link context. Call at the top of any
+* guard whose first line is `if (ctx.system) return` — the token grants one
+* definition on one channel, never instance authority.
+*/
+function assertNotShareContext(ctx, what) {
+	if (isShareContext(ctx)) throw new ProviderError(`Forbidden: a share link cannot ${what}`, 403);
+}
+var PLATFORM_PERMISSION_VALUES = new Set(ALL_PLATFORM_PERMISSIONS);
+function isPlatformPermission(p) {
+	return PLATFORM_PERMISSION_VALUES.has(p);
+}
+export { ALL_PLATFORM_PERMISSIONS as A, ORG_MANAGEMENT_PERMISSIONS as B, CreateOrgSchema as C, DEFAULT_ORG_PERMISSIONS as D, OWNER_ADMIN_ONLY_PERMISSIONS as E, GuidSchema as G, MEMBER_ASSIGNABLE_PERMISSIONS as M, OrgPermissionSchema as O, ProviderError as P, SYSTEM_CONTEXT as S, UpdateOrgSchema as U, ALL_ORG_PERMISSIONS as a, assertNotShareContext as b, classifyAssetPath as c, ProjectVisibilitySchema as d, ProjectRoleSchema as e, PlatformPermissionSchema as f, OrgRoleSchema as g, hasPermission as h, API_TOKEN_LIFETIME_DAYS as i, ApiScopeStringSchema as j, slugify as k, OPERATOR_PLATFORM_PERMISSIONS as l, COVER_IMAGE_CONTENT_TYPES as m, narrowApiTokenContext as n, toDefinitionListItem as o, CreateDefinitionInputSchema as p, GH_EXTENSIONS as q, UpdateMetadataInputSchema as r, scopeAllows as s, transcodeImageIfNeeded as t, PublishVersionInputSchema as u, CreateShareLinkInputSchema as v, OrgAssetKindSchema as w, parseApiScope as x, describeApiScope as y, validateProjectFlags as z };
+//# sourceMappingURL=src.js-DubgTP8X.js.map

package/build/server/chunks/chunks/src.js-DubgTP8X.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"src.js-DubgTP8X.js","sources":["../../../../.svelte-kit/output/server/chunks/src.js"],"sourcesContent":["import { z } from \"zod\";\n//#region ../platform/src/permissions/types.ts\n/**\n* Platform-scope permissions. All but `manage_api_tokens` are reserved for\n* Selva staff and instance operators; regular users hold an empty array.\n*\n* - `instance_admin` — superuser; implies every other permission\n* - `manage_compute` — configure the instance-wide Rhino.Compute pool\n* - `manage_instance_users` — disable/enable any user on the instance\n* - `manage_updates` — run system updates\n* - `manage_api_tokens` — mint API tokens for yourself\n*/\nvar PlatformPermissionSchema = z.enum([\n\t\"instance_admin\",\n\t\"manage_compute\",\n\t\"manage_instance_users\",\n\t\"manage_updates\",\n\t\"manage_api_tokens\"\n]);\nvar ALL_PLATFORM_PERMISSIONS = PlatformPermissionSchema.options;\n/**\n* The permissions that admit someone to the `/admin` operator surface.\n* `manage_api_tokens` is granted to ordinary users, who have no business there.\n*/\nvar OPERATOR_PLATFORM_PERMISSIONS = ALL_PLATFORM_PERMISSIONS.filter((p) => p !== \"manage_api_tokens\");\nvar RESERVED_SLUG_SET = /* @__PURE__ */ new Set([\n\t\"o\",\n\t\"api\",\n\t\"admin\",\n\t\"auth\",\n\t\"login\",\n\t\"logout\",\n\t\"setup\",\n\t\"settings\",\n\t\"team\",\n\t\"library\",\n\t\"projects\",\n\t\"accept-invite\"\n]);\n/**\n* Coerces an arbitrary name into a slug candidate. Does not guarantee a valid\n* slug — an all-symbols name yields `''`, and reserved words pass through\n* untouched — run the result through `SlugSchema` where validity matters.\n*/\nfunction slugify(name) {\n\treturn name.trim().toLowerCase().replace(/[^a-z0-9]+/g, \"-\").replace(/^-|-$/g, \"\").slice(0, 63);\n}\n/** Lowercase alphanumeric with internal hyphens, 3–63 chars, not a reserved word. */\nvar SlugSchema = z.string().min(3, \"Slug must be at least 3 characters\").max(63, \"Slug must be at most 63 characters\").regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/, \"Slug must be lowercase alphanumeric with hyphens (no leading/trailing/consecutive hyphens)\").refine((s) => !RESERVED_SLUG_SET.has(s), { message: \"Slug is reserved and cannot be used\" });\nvar OrgRoleSchema = z.enum([\n\t\"owner\",\n\t\"admin\",\n\t\"member\"\n]);\n/** Kinds of org-scoped branding asset. Adding a kind is a single entry here — path, upload route, store, and UI are all generic over it. */\nvar OrgAssetKindSchema = z.enum([\"logo\", \"favicon\"]);\nvar ALL_ORG_ASSET_KINDS = OrgAssetKindSchema.options;\n/**\n* Org-scope permissions. A user may hold different sets in different orgs.\n*\n* `read_all_org_projects` lets its holder mint an API token that reads and\n* solves every project in the org, including ones they aren't a member of.\n*/\nvar OrgPermissionSchema = z.enum([\n\t\"manage_org_members\",\n\t\"manage_org_compute\",\n\t\"manage_definitions\",\n\t\"manage_projects\",\n\t\"read_all_org_projects\"\n]);\nvar ALL_ORG_PERMISSIONS = OrgPermissionSchema.options;\n/** The permissions that run some part of `/team`. */\nvar ORG_MANAGEMENT_PERMISSIONS = ALL_ORG_PERMISSIONS.filter((p) => p !== \"read_all_org_projects\");\n/** Governance perms — never grantable to `member`. */\nvar OWNER_ADMIN_ONLY_PERMISSIONS = [\"manage_org_members\", \"manage_org_compute\"];\nvar MEMBER_ASSIGNABLE_PERMISSIONS = ALL_ORG_PERMISSIONS.filter((p) => !OWNER_ADMIN_ONLY_PERMISSIONS.includes(p));\n/**\n* Applied when adding a member without an explicit permissions list.\n*\n* `read_all_org_projects` is never a default: a key holding it reads projects\n* its owner isn't a member of, without the audit trail Reclaim leaves.\n*/\nvar DEFAULT_ORG_PERMISSIONS = {\n\towner: [...ORG_MANAGEMENT_PERMISSIONS],\n\tadmin: [...ORG_MANAGEMENT_PERMISSIONS],\n\tmember: []\n};\nvar CreateOrgSchema = z.object({\n\tname: z.string().min(1, \"Organization name is required\").max(128),\n\tslug: SlugSchema\n});\nvar UpdateOrgSchema = CreateOrgSchema.partial();\nz.enum([\n\t\"read\",\n\t\"write\",\n\t\"solve\"\n]);\nvar SCOPE_PATTERN = /^(read|write|solve):(all|(org|project|definition):([A-Za-z0-9_-]{1,128}))$/;\n/** `read:all`, `write:org:<id>`, `solve:project:<id>`, `read:definition:<guid>`. */\nfunction parseApiScope(value) {\n\tconst m = SCOPE_PATTERN.exec(value);\n\tif (!m) return null;\n\tconst action = m[1];\n\tif (m[2] === \"all\") return {\n\t\taction,\n\t\tresource: { kind: \"all\" }\n\t};\n\treturn {\n\t\taction,\n\t\tresource: {\n\t\t\tkind: m[3],\n\t\t\tid: m[4]\n\t\t}\n\t};\n}\n/**\n* Scopes are stored as strings so a new action or resource kind needs no\n* migration. Parsing rejects anything this version doesn't understand, so an\n* unknown scope grants nothing rather than being guessed at.\n*/\nvar ApiScopeStringSchema = z.string().refine((s) => parseApiScope(s) !== null, { message: \"Unknown scope\" });\nz.enum([\n\t\"owner\",\n\t\"admin\",\n\t\"member_removed\",\n\t\"user_disabled\"\n]);\n/** The only lifetimes offered. Expiry is never optional. */\nvar API_TOKEN_LIFETIME_DAYS = [\n\t30,\n\t90,\n\t180\n];\nvar ACTION_WORDS = {\n\tread: \"Read\",\n\twrite: \"Read and change\",\n\tsolve: \"Read and run solves on\"\n};\n/** \"Read and change everything in the org\". Names no ids, so it suits an email. */\nfunction describeApiScope(value) {\n\tconst scope = parseApiScope(value);\n\tif (!scope) return `Unknown scope (${value})`;\n\tconst what = scope.resource.kind === \"project\" ? \"one project\" : scope.resource.kind === \"definition\" ? \"one definition\" : \"everything in the org\";\n\treturn `${ACTION_WORDS[scope.action]} ${what}`;\n}\n//#endregion\n//#region ../platform/src/errors.ts\n/**\n* Thrown by providers to signal an expected failure the API layer forwards with\n* a specific status. Unknown errors should propagate as plain `Error` and become 500s.\n*/\nvar ProviderError = class extends Error {\n\tstatusCode;\n\tconstructor(message, statusCode = 400) {\n\t\tsuper(message);\n\t\tthis.name = \"ProviderError\";\n\t\tthis.statusCode = statusCode;\n\t}\n};\n//#endregion\n//#region ../platform/src/apiTokens/scope.ts\n/**\n* May this request perform `action` on `target`?\n*\n* Without a target this is an org-level check, which only `all` and org scopes\n* pass: a project key must never reach a route that can't say which project it\n* touches. Requests without an API token always pass; their permissions are\n* checked elsewhere.\n*/\nfunction scopeAllows(ctx, action, target) {\n\tconst api = ctx.apiScope;\n\tif (!api) return true;\n\treturn api.scopes.some((s) => actionCovers(s.action, action) && resourceCovers(s, ctx, target));\n}\nfunction actionCovers(granted, wanted) {\n\treturn granted === wanted || wanted === \"read\";\n}\nfunction resourceCovers(scope, ctx, target) {\n\tconst { resource } = scope;\n\tswitch (resource.kind) {\n\t\tcase \"all\": return true;\n\t\tcase \"org\": return resource.id === ctx.actingOrgId;\n\t\tcase \"project\": return target?.projectId === resource.id;\n\t\tcase \"definition\": return target?.definitionId === resource.id;\n\t}\n}\n/**\n* Narrow the owner's live context to what the token grants. Only removes\n* rights:\n*\n* - Platform permissions are dropped. Instance authority never rides on a\n* bearer key, so an operator's leaked key can't reach other tenants.\n* - `apiScope` is attached, which `scopeAllows` reads.\n*\n* Scopes this version can't parse are dropped, so they grant nothing.\n*/\nfunction narrowApiTokenContext(ctx, token) {\n\tif (ctx.actingOrgId !== token.orgId) throw new ProviderError(\"API token context must act in the token’s org\", 500);\n\tconst scopes = token.scopes.map(parseApiScope).filter((s) => s !== null);\n\treturn {\n\t\t...ctx,\n\t\tplatformPermissions: [],\n\t\tapiScope: {\n\t\t\ttokenId: token.id,\n\t\t\tscopes\n\t\t}\n\t};\n}\n//#endregion\n//#region ../platform/src/projects/schemas.ts\nvar ProjectVisibilitySchema = z.enum([\n\t\"public\",\n\t\"org\",\n\t\"private\",\n\t\"platform\"\n]);\nvar ProjectRoleSchema = z.enum([\n\t\"owner\",\n\t\"editor\",\n\t\"viewer\"\n]);\n/** Cross-field check for PATCH flows. Call on the merged post-patch shape. */\nfunction validateProjectFlags(merged) {\n\tconst issues = [];\n\tif (merged.autoJoinOnUpload && merged.visibility !== \"public\") issues.push({\n\t\tpath: \"autoJoinOnUpload\",\n\t\tmessage: \"autoJoinOnUpload requires visibility=public\"\n\t});\n\tif (merged.visibility === \"platform\" && merged.autoJoinOnUpload) issues.push({\n\t\tpath: \"autoJoinOnUpload\",\n\t\tmessage: \"autoJoinOnUpload is not allowed on platform projects\"\n\t});\n\treturn issues;\n}\n//#endregion\n//#region ../platform/src/platformProjects/schemas.ts\nvar PlatformProjectGranteeTypeSchema = z.enum([\"org\", \"user\"]);\nz.object({\n\tid: z.string(),\n\tprojectId: z.string(),\n\tgranteeType: PlatformProjectGranteeTypeSchema,\n\tgranteeId: z.string(),\n\tcanSolve: z.boolean(),\n\tcreatedBy: z.string(),\n\tcreatedAt: z.string()\n});\n//#endregion\n//#region ../platform/src/definitions/types.ts\nvar GH_EXTENSIONS = [\".gh\", \".ghx\"];\nvar COVER_IMAGE_EXTENSIONS = [\n\t\".jpg\",\n\t\".jpeg\",\n\t\".png\",\n\t\".webp\",\n\t\".gif\"\n];\n[...GH_EXTENSIONS, ...COVER_IMAGE_EXTENSIONS];\nvar COVER_IMAGE_CONTENT_TYPES = {\n\t\".jpg\": \"image/jpeg\",\n\t\".jpeg\": \"image/jpeg\",\n\t\".png\": \"image/png\",\n\t\".webp\": \"image/webp\",\n\t\".gif\": \"image/gif\"\n};\nfunction toDefinitionListItem(r) {\n\treturn {\n\t\tguid: r.guid,\n\t\tprojectId: r.projectId,\n\t\tdisplayName: r.displayName,\n\t\tdescription: r.description,\n\t\tcategory: r.category,\n\t\ttags: r.tags,\n\t\tcoverImage: r.coverImage,\n\t\tstatus: r.status,\n\t\tsolveCount: r.solveCount,\n\t\tliveVersionId: r.liveVersionId,\n\t\tupdatedAt: r.updatedAt\n\t};\n}\nvar GuidSchema = z.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, \"Invalid GUID format\");\nvar DefinitionStatusSchema = z.enum([\n\t\"draft\",\n\t\"published\",\n\t\"archived\"\n]);\nvar DefinitionFileExtSchema = z.enum([\"gh\", \"ghx\"]);\nz.object({\n\tid: GuidSchema,\n\tdefinitionId: GuidSchema,\n\tversionNumber: z.number().int().min(1),\n\tfileExt: DefinitionFileExtSchema,\n\tfileKey: z.string().min(1),\n\toriginalFilename: z.string().max(256).optional(),\n\tuploadedBy: z.string().min(1),\n\tuploadedAt: z.string(),\n\tchangeNote: z.string().max(1e3).optional(),\n\tschema: z.record(z.string(), z.unknown()).optional(),\n\tschemaExtractedAt: z.string().optional()\n});\nvar DefinitionChannelSchema = z.enum([\"live\", \"draft\"]);\n/** HTTP-body validator for new-definition input. */\nvar CreateDefinitionInputSchema = z.object({\n\tdisplayName: z.string().min(1, \"Display name is required\").max(256),\n\tdescription: z.string().max(2e3).optional(),\n\tcoverImage: z.string().max(2048).optional(),\n\tcategory: z.string().max(128).optional(),\n\ttags: z.array(z.string().max(64)).max(20).optional(),\n\tprojectId: GuidSchema,\n\tcomputeServerId: GuidSchema.optional()\n});\n/**\n* PATCH validator. Field semantics match `DefinitionRecordPatch`:\n* - missing / `undefined` — leave unchanged\n* - `null` — clear (only on nullable fields)\n* - value — set\n*/\nvar UpdateMetadataInputSchema = z.object({\n\tdisplayName: z.string().min(1, \"Display name is required\").max(256).optional(),\n\tdescription: z.string().max(2e3).nullable().optional(),\n\tcoverImage: z.string().max(2048).nullable().optional(),\n\tcategory: z.string().max(128).nullable().optional(),\n\ttags: z.array(z.string().max(64)).max(20).nullable().optional(),\n\tprojectId: GuidSchema.optional(),\n\tcomputeServerId: GuidSchema.nullable().optional(),\n\tsolveCacheLimit: z.number().int().min(0).max(1e5).nullable().optional(),\n\tstatus: DefinitionStatusSchema.optional()\n});\n/** Body for `POST /api/definitions/[guid]/publish`. */\nvar PublishVersionInputSchema = z.object({ versionId: GuidSchema.optional() }).default({});\n//#endregion\n//#region ../platform/src/shareLinks/schemas.ts\n/**\n* HTTP body for `POST /api/definitions/[guid]/share-links`. The route returns\n* the raw token exactly once.\n*/\nvar CreateShareLinkInputSchema = z.object({\n\tchannel: DefinitionChannelSchema.default(\"live\"),\n\tname: z.string().max(128).optional(),\n\tallowSolve: z.boolean().default(true),\n\t/** Null is the minter's deliberate \"uncap\" choice; omitted applies the default cap. */\n\tmaxSolves: z.number().int().min(1).nullable().optional(),\n\texpiresAt: z.iso.datetime().nullable().optional()\n});\n//#endregion\n//#region ../platform/src/storage/image.ts\n/**\n* Shared image-transcoding helper for `IStorageProvider` implementations.\n* Normalizes uploads to WebP (capped at 1200px, quality 85) so storage,\n* bandwidth, and the viewer path stay predictable.\n*\n* `sharp` is a dynamic import, not a hard dependency of this package —\n* providers that need transcoding install it themselves.\n*/\nvar IMAGE_MAX_WIDTH = 1200;\n/** True if the input looks like an image to process — by content type or path extension. */\nfunction isImageUpload(contentType, storagePath) {\n\tif (contentType?.startsWith(\"image/\")) return true;\n\treturn /\\.(webp|png|jpe?g|gif|bmp|tif?f|svg)$/i.test(storagePath);\n}\n/**\n* Rewrites a path's extension to `.webp`; unchanged for non-image extensions.\n* SVG is rasterized like any other input, so no vector blob is ever\n* persisted — served bytes stay XSS-free without a sanitizer.\n*/\nfunction toWebpPath(storagePath) {\n\treturn storagePath.replace(/\\.(png|jpe?g|gif|bmp|tif?f|svg)$/i, \".webp\");\n}\n/**\n* Transcodes images to WebP; passes non-images through unchanged, so\n* providers can call this unconditionally before `put`.\n*\n* Throws if `sharp` isn't installed — a config error, not a fallback.\n*/\nasync function transcodeImageIfNeeded(data, contentType, storagePath) {\n\tif (!isImageUpload(contentType, storagePath)) return {\n\t\tdata,\n\t\tcontentType: contentType ?? \"application/octet-stream\",\n\t\tpath: storagePath\n\t};\n\tconst compressed = await (await loadSharp())(Buffer.from(data)).resize({\n\t\twidth: IMAGE_MAX_WIDTH,\n\t\twithoutEnlargement: true\n\t}).webp({ quality: 85 }).toBuffer();\n\treturn {\n\t\tdata: new Uint8Array(compressed),\n\t\tcontentType: \"image/webp\",\n\t\tpath: toWebpPath(storagePath)\n\t};\n}\nvar cachedSharp = null;\nasync function loadSharp() {\n\tif (cachedSharp) return cachedSharp;\n\ttry {\n\t\tconst mod = await import(\"sharp\");\n\t\tcachedSharp = mod.default ?? mod;\n\t\treturn cachedSharp;\n\t} catch (err) {\n\t\tthrow new Error(\"Image transcoding requires `sharp` to be installed. Add it as a dependency in your provider package.\", { cause: err });\n\t}\n}\n//#endregion\n//#region ../platform/src/storage/assetClasses.ts\nvar BRANDING_KINDS = ALL_ORG_ASSET_KINDS.join(\"|\");\nvar COVER_EXTS = COVER_IMAGE_EXTENSIONS.map((ext) => ext.replace(/^\\./, \"\").replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\")).join(\"|\");\nvar SAFE_SEGMENT = String.raw`[A-Za-z0-9._-]+`;\nvar GUID = String.raw`[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}`;\n/**\n* The closed registry of servable asset classes. Patterns are mutually\n* exclusive by prefix, order doesn't matter. Anything matching no class is\n* unservable (the route 404s) — default-deny, so a new blob type is opt-in.\n*/\nvar ASSET_CLASSES = [\n\t{\n\t\tid: \"org-branding\",\n\t\tvisibility: \"public\",\n\t\tscope: \"none\",\n\t\tpattern: new RegExp(String.raw`^orgs\\/(${SAFE_SEGMENT})\\/branding\\/(?:${BRANDING_KINDS})\\.webp$`)\n\t},\n\t{\n\t\tid: \"org-private\",\n\t\tvisibility: \"org\",\n\t\tscope: \"org\",\n\t\tpattern: new RegExp(String.raw`^orgs\\/(${SAFE_SEGMENT})\\/private\\/${SAFE_SEGMENT}$`)\n\t},\n\t{\n\t\tid: \"definition-cover\",\n\t\tvisibility: \"project\",\n\t\tscope: \"project\",\n\t\tpattern: new RegExp(String.raw`^definitions\\/(${GUID})\\/cover\\.(?:${COVER_EXTS})$`, \"i\")\n\t}\n];\n/**\n* Rejects traversal, empty, or backslash segments before a path can match a\n* class. The permissive segment alphabet (`[A-Za-z0-9._-]+`) admits a bare\n* `.` or `..` as a whole segment, which would otherwise let\n* `orgs/../branding/logo.webp` classify as public branding with `..`\n* captured as the orgId. Mirrors `assertSafeKey` on the write side, so a path\n* that can't be written can't be read either.\n*/\nfunction hasUnsafeSegment(storagePath) {\n\tif (storagePath.includes(\"\\\\\")) return true;\n\tfor (const segment of storagePath.split(\"/\")) if (segment === \"\" || segment === \".\" || segment === \"..\") return true;\n\treturn false;\n}\n/**\n* Classifies a storage path into its asset class and scope id, or null when\n* no class matches (or the path is unsafe). `getPublicUrl` and the serving\n* route both consult this so URL generation and authorization never drift\n* apart.\n*\n* `scopeId` is null for `scope: 'none'` classes even when the pattern\n* captures an id (e.g. `org-branding` captures orgId but is public).\n*/\nfunction classifyAssetPath(storagePath) {\n\tif (hasUnsafeSegment(storagePath)) return null;\n\tfor (const cls of ASSET_CLASSES) {\n\t\tconst m = cls.pattern.exec(storagePath);\n\t\tif (!m) continue;\n\t\treturn {\n\t\t\tclass: cls,\n\t\t\tscopeId: cls.scope === \"none\" ? null : m[1] ?? null\n\t\t};\n\t}\n\treturn null;\n}\n//#endregion\n//#region ../platform/src/context.ts\n/** For server-internal operations outside any HTTP request (bootstrap, janitors, migrations). */\nvar SYSTEM_CONTEXT = {\n\tuserId: \"\",\n\tplatformPermissions: [...ALL_PLATFORM_PERMISSIONS],\n\torgPermissions: [...ALL_ORG_PERMISSIONS],\n\tsystem: true\n};\n/**\n* Does not cross-check `ctx.actingOrgId` — the caller must build a context scoped\n* to the org it's acting on. An org permission against a context without\n* `actingOrgId` returns false unless `instance_admin` or `system`.\n*/\nfunction hasPermission(ctx, permission) {\n\tif (ctx.system) return true;\n\tif (ctx.platformPermissions.includes(\"instance_admin\")) return true;\n\tif (isPlatformPermission(permission)) return ctx.platformPermissions.includes(permission);\n\treturn ctx.orgPermissions.includes(permission);\n}\n/**\n* An anonymous share-link holder. `system` is true on these contexts for adapter\n* dispatch only — a guard that treats `system` as \"fully authorized\" must\n* exclude them first.\n*/\nfunction isShareContext(ctx) {\n\treturn ctx.shareLinkId !== void 0;\n}\n/**\n* Refuse a privileged operation to a share-link context. Call at the top of any\n* guard whose first line is `if (ctx.system) return` — the token grants one\n* definition on one channel, never instance authority.\n*/\nfunction assertNotShareContext(ctx, what) {\n\tif (isShareContext(ctx)) throw new ProviderError(`Forbidden: a share link cannot ${what}`, 403);\n}\nvar PLATFORM_PERMISSION_VALUES = new Set(ALL_PLATFORM_PERMISSIONS);\nfunction isPlatformPermission(p) {\n\treturn PLATFORM_PERMISSION_VALUES.has(p);\n}\n//#endregion\nexport { OrgAssetKindSchema as A, parseApiScope as C, MEMBER_ASSIGNABLE_PERMISSIONS as D, DEFAULT_ORG_PERMISSIONS as E, ALL_PLATFORM_PERMISSIONS as F, OPERATOR_PLATFORM_PERMISSIONS as I, PlatformPermissionSchema as L, OrgRoleSchema as M, UpdateOrgSchema as N, ORG_MANAGEMENT_PERMISSIONS as O, slugify as P, describeApiScope as S, CreateOrgSchema as T, narrowApiTokenContext as _, transcodeImageIfNeeded as a, API_TOKEN_LIFETIME_DAYS as b, GuidSchema as c, COVER_IMAGE_CONTENT_TYPES as d, GH_EXTENSIONS as f, validateProjectFlags as g, ProjectVisibilitySchema as h, classifyAssetPath as i, OrgPermissionSchema as j, OWNER_ADMIN_ONLY_PERMISSIONS as k, PublishVersionInputSchema as l, ProjectRoleSchema as m, assertNotShareContext as n, CreateShareLinkInputSchema as o, toDefinitionListItem as p, hasPermission as r, CreateDefinitionInputSchema as s, SYSTEM_CONTEXT as t, UpdateMetadataInputSchema as u, scopeAllows as v, ALL_ORG_PERMISSIONS as w, ApiScopeStringSchema as x, ProviderError as y };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC,gBAAgB;AACjB,CAAC,gBAAgB;AACjB,CAAC,uBAAuB;AACxB,CAAC,gBAAgB;AACjB,CAAC;AACD,CAAC;AACE,IAAC,wBAAwB,GAAG,wBAAwB,CAAC;AACxD;AACA;AACA;AACA;AACG,IAAC,6BAA6B,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,mBAAmB;AACpG,IAAI,iBAAiB,mBAAmB,IAAI,GAAG,CAAC;AAChD,CAAC,GAAG;AACJ,CAAC,KAAK;AACN,CAAC,OAAO;AACR,CAAC,MAAM;AACP,CAAC,OAAO;AACR,CAAC,QAAQ;AACT,CAAC,OAAO;AACR,CAAC,UAAU;AACX,CAAC,MAAM;AACP,CAAC,SAAS;AACV,CAAC,UAAU;AACX,CAAC;AACD,CAAC,CAAC;AACF;AACA;AACA;AACA;AACA;AACA,SAAS,OAAO,CAAC,IAAI,EAAE;AACvB,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;AAChG;AACA;AACA,IAAI,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,oCAAoC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,oCAAoC,CAAC,CAAC,KAAK,CAAC,iCAAiC,EAAE,4FAA4F,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC;AACvV,IAAC,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC;AAC3B,CAAC,OAAO;AACR,CAAC,OAAO;AACR,CAAC;AACD,CAAC;AACD;AACG,IAAC,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC;AACnD,IAAI,mBAAmB,GAAG,kBAAkB,CAAC,OAAO;AACpD;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC,oBAAoB;AACrB,CAAC,oBAAoB;AACrB,CAAC,oBAAoB;AACrB,CAAC,iBAAiB;AAClB,CAAC;AACD,CAAC;AACE,IAAC,mBAAmB,GAAG,mBAAmB,CAAC;AAC9C;AACG,IAAC,0BAA0B,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,uBAAuB;AAChG;AACG,IAAC,4BAA4B,GAAG,CAAC,oBAAoB,EAAE,oBAAoB;AAC3E,IAAC,6BAA6B,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/G;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,uBAAuB,GAAG;AAC9B,CAAC,KAAK,EAAE,CAAC,GAAG,0BAA0B,CAAC;AACvC,CAAC,KAAK,EAAE,CAAC,GAAG,0BAA0B,CAAC;AACvC,CAAC,MAAM,EAAE;AACT;AACG,IAAC,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;AAC/B,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,+BAA+B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;AAClE,CAAC,IAAI,EAAE;AACP,CAAC;AACE,IAAC,eAAe,GAAG,eAAe,CAAC,OAAO;AAC7C,CAAC,CAAC,IAAI,CAAC;AACP,CAAC,MAAM;AACP,CAAC,OAAO;AACR,CAAC;AACD,CAAC,CAAC;AACF,IAAI,aAAa,GAAG,4EAA4E;AAChG;AACA,SAAS,aAAa,CAAC,KAAK,EAAE;AAC9B,CAAC,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;AACpC,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,IAAI;AACpB,CAAC,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,OAAO;AAC5B,EAAE,MAAM;AACR,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK;AACzB,EAAE;AACF,CAAC,OAAO;AACR,EAAE,MAAM;AACR,EAAE,QAAQ,EAAE;AACZ,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACb,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;AACV;AACA,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,oBAAoB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE;AAC3G,CAAC,CAAC,IAAI,CAAC;AACP,CAAC,OAAO;AACR,CAAC,OAAO;AACR,CAAC,gBAAgB;AACjB,CAAC;AACD,CAAC,CAAC;AACF;AACG,IAAC,uBAAuB,GAAG;AAC9B,CAAC,EAAE;AACH,CAAC,EAAE;AACH,CAAC;AACD;AACA,IAAI,YAAY,GAAG;AACnB,CAAC,IAAI,EAAE,MAAM;AACb,CAAC,KAAK,EAAE,iBAAiB;AACzB,CAAC,KAAK,EAAE;AACR,CAAC;AACD;AACA,SAAS,gBAAgB,CAAC,KAAK,EAAE;AACjC,CAAC,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC;AACnC,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC;AAC9C,CAAC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,GAAG,aAAa,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY,GAAG,gBAAgB,GAAG,uBAAuB;AACnJ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAC/C;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,aAAa,GAAG,cAAc,KAAK,CAAC;AACxC,CAAC,UAAU;AACX,CAAC,WAAW,CAAC,OAAO,EAAE,UAAU,GAAG,GAAG,EAAE;AACxC,EAAE,KAAK,CAAC,OAAO,CAAC;AAChB,EAAE,IAAI,CAAC,IAAI,GAAG,eAAe;AAC7B,EAAE,IAAI,CAAC,UAAU,GAAG,UAAU;AAC9B,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE;AAC1C,CAAC,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ;AACzB,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,IAAI;AACtB,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,cAAc,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;AAChG;AACA,SAAS,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE;AACvC,CAAC,OAAO,OAAO,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM;AAC/C;AACA,SAAS,cAAc,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE;AAC5C,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK;AAC3B,CAAC,QAAQ,QAAQ,CAAC,IAAI;AACtB,EAAE,KAAK,KAAK,EAAE,OAAO,IAAI;AACzB,EAAE,KAAK,KAAK,EAAE,OAAO,QAAQ,CAAC,EAAE,KAAK,GAAG,CAAC,WAAW;AACpD,EAAE,KAAK,SAAS,EAAE,OAAO,MAAM,EAAE,SAAS,KAAK,QAAQ,CAAC,EAAE;AAC1D,EAAE,KAAK,YAAY,EAAE,OAAO,MAAM,EAAE,YAAY,KAAK,QAAQ,CAAC,EAAE;AAChE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE;AAC3C,CAAC,IAAI,GAAG,CAAC,WAAW,KAAK,KAAK,CAAC,KAAK,EAAE,MAAM,IAAI,aAAa,CAAC,+CAA+C,EAAE,GAAG,CAAC;AACnH,CAAC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AACzE,CAAC,OAAO;AACR,EAAE,GAAG,GAAG;AACR,EAAE,mBAAmB,EAAE,EAAE;AACzB,EAAE,QAAQ,EAAE;AACZ,GAAG,OAAO,EAAE,KAAK,CAAC,EAAE;AACpB,GAAG;AACH;AACA,EAAE;AACF;AACA;AACA;AACG,IAAC,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC,QAAQ;AACT,CAAC,KAAK;AACN,CAAC,SAAS;AACV,CAAC;AACD,CAAC;AACE,IAAC,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;AAC/B,CAAC,OAAO;AACR,CAAC,QAAQ;AACT,CAAC;AACD,CAAC;AACD;AACA,SAAS,oBAAoB,CAAC,MAAM,EAAE;AACtC,CAAC,MAAM,MAAM,GAAG,EAAE;AAClB,CAAC,IAAI,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC;AAC5E,EAAE,IAAI,EAAE,kBAAkB;AAC1B,EAAE,OAAO,EAAE;AACX,EAAE,CAAC;AACH,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,IAAI,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC;AAC9E,EAAE,IAAI,EAAE,kBAAkB;AAC1B,EAAE,OAAO,EAAE;AACX,EAAE,CAAC;AACH,CAAC,OAAO,MAAM;AACd;AACA;AACA;AACA,IAAI,gCAAgC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAC9D,CAAC,CAAC,MAAM,CAAC;AACT,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;AACf,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,WAAW,EAAE,gCAAgC;AAC9C,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;AACtB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM;AACpB,CAAC,CAAC;AACF;AACA;AACG,IAAC,aAAa,GAAG,CAAC,KAAK,EAAE,MAAM;AAClC,IAAI,sBAAsB,GAAG;AAC7B,CAAC,MAAM;AACP,CAAC,OAAO;AACR,CAAC,MAAM;AACP,CAAC,OAAO;AACR,CAAC;AACD,CAAC;AACD,CAAC,GAAG,aAAa,EAAE,GAAG,sBAAsB,CAAC;AAC1C,IAAC,yBAAyB,GAAG;AAChC,CAAC,MAAM,EAAE,YAAY;AACrB,CAAC,OAAO,EAAE,YAAY;AACtB,CAAC,MAAM,EAAE,WAAW;AACpB,CAAC,OAAO,EAAE,YAAY;AACtB,CAAC,MAAM,EAAE;AACT;AACA,SAAS,oBAAoB,CAAC,CAAC,EAAE;AACjC,CAAC,OAAO;AACR,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;AACd,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;AACxB,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW;AAC5B,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW;AAC5B,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ;AACtB,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;AACd,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU;AAC1B,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM;AAClB,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU;AAC1B,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa;AAChC,EAAE,SAAS,EAAE,CAAC,CAAC;AACf,EAAE;AACF;AACG,IAAC,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iEAAiE,EAAE,qBAAqB;AAC1H,IAAI,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC;AACpC,CAAC,OAAO;AACR,CAAC,WAAW;AACZ,CAAC;AACD,CAAC,CAAC;AACF,IAAI,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC,CAAC,MAAM,CAAC;AACT,CAAC,EAAE,EAAE,UAAU;AACf,CAAC,YAAY,EAAE,UAAU;AACzB,CAAC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC,OAAO,EAAE,uBAAuB;AACjC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3B,CAAC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AACjD,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AAC9B,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;AACvB,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AAC3C,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;AACrD,CAAC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ;AACvC,CAAC,CAAC;AACF,IAAI,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACvD;AACG,IAAC,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;AAC3C,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;AACpE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AAC5C,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;AAC5C,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AACzC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;AACrD,CAAC,SAAS,EAAE,UAAU;AACtB,CAAC,eAAe,EAAE,UAAU,CAAC,QAAQ;AACrC,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;AACzC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AAC/E,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AACvD,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AACvD,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AACpD,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AAChE,CAAC,SAAS,EAAE,UAAU,CAAC,QAAQ,EAAE;AACjC,CAAC,eAAe,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AAClD,CAAC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AACxE,CAAC,MAAM,EAAE,sBAAsB,CAAC,QAAQ;AACxC,CAAC;AACD;AACG,IAAC,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE;AACzF;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;AAC1C,CAAC,OAAO,EAAE,uBAAuB,CAAC,OAAO,CAAC,MAAM,CAAC;AACjD,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AACrC,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;AACtC;AACA,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AACzD,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ;AAChD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,eAAe,GAAG,IAAI;AAC1B;AACA,SAAS,aAAa,CAAC,WAAW,EAAE,WAAW,EAAE;AACjD,CAAC,IAAI,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI;AACnD,CAAC,OAAO,wCAAwC,CAAC,IAAI,CAAC,WAAW,CAAC;AAClE;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,UAAU,CAAC,WAAW,EAAE;AACjC,CAAC,OAAO,WAAW,CAAC,OAAO,CAAC,mCAAmC,EAAE,OAAO,CAAC;AACzE;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,sBAAsB,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE;AACtE,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,OAAO;AACtD,EAAE,IAAI;AACN,EAAE,WAAW,EAAE,WAAW,IAAI,0BAA0B;AACxD,EAAE,IAAI,EAAE;AACR,EAAE;AACF,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,SAAS,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AACxE,EAAE,KAAK,EAAE,eAAe;AACxB,EAAE,kBAAkB,EAAE;AACtB,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;AACpC,CAAC,OAAO;AACR,EAAE,IAAI,EAAE,IAAI,UAAU,CAAC,UAAU,CAAC;AAClC,EAAE,WAAW,EAAE,YAAY;AAC3B,EAAE,IAAI,EAAE,UAAU,CAAC,WAAW;AAC9B,EAAE;AACF;AACA,IAAI,WAAW,GAAG,IAAI;AACtB,eAAe,SAAS,GAAG;AAC3B,CAAC,IAAI,WAAW,EAAE,OAAO,WAAW;AACpC,CAAC,IAAI;AACL,EAAE,MAAM,GAAG,GAAG,MAAM,OAAO,OAAO,CAAC;AACnC,EAAE,WAAW,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG;AAClC,EAAE,OAAO,WAAW;AACpB,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,MAAM,IAAI,KAAK,CAAC,sGAAsG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACzI,CAAC;AACD;AACA;AACA;AACA,IAAI,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;AAClD,IAAI,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;AAC7H,IAAI,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC;AAC9C,IAAI,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,4DAA4D,CAAC;AACnF;AACA;AACA;AACA;AACA;AACA,IAAI,aAAa,GAAG;AACpB,CAAC;AACD,EAAE,EAAE,EAAE,cAAc;AACpB,EAAE,UAAU,EAAE,QAAQ;AACtB,EAAE,KAAK,EAAE,MAAM;AACf,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC,gBAAgB,EAAE,cAAc,CAAC,QAAQ,CAAC;AAClG,EAAE;AACF,CAAC;AACD,EAAE,EAAE,EAAE,aAAa;AACnB,EAAE,UAAU,EAAE,KAAK;AACnB,EAAE,KAAK,EAAE,KAAK;AACd,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;AACrF,EAAE;AACF,CAAC;AACD,EAAE,EAAE,EAAE,kBAAkB;AACxB,EAAE,UAAU,EAAE,SAAS;AACvB,EAAE,KAAK,EAAE,SAAS;AAClB,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,GAAG;AACzF;AACA,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,CAAC,WAAW,EAAE;AACvC,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,IAAI;AAC5C,CAAC,KAAK,MAAM,OAAO,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,EAAE,OAAO,IAAI;AACrH,CAAC,OAAO,KAAK;AACb;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,WAAW,EAAE;AACxC,CAAC,IAAI,gBAAgB,CAAC,WAAW,CAAC,EAAE,OAAO,IAAI;AAC/C,CAAC,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE;AAClC,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;AACzC,EAAE,IAAI,CAAC,CAAC,EAAE;AACV,EAAE,OAAO;AACT,GAAG,KAAK,EAAE,GAAG;AACb,GAAG,OAAO,EAAE,GAAG,CAAC,KAAK,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;AAClD,GAAG;AACH,CAAC;AACD,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACG,IAAC,cAAc,GAAG;AACrB,CAAC,MAAM,EAAE,EAAE;AACX,CAAC,mBAAmB,EAAE,CAAC,GAAG,wBAAwB,CAAC;AACnD,CAAC,cAAc,EAAE,CAAC,GAAG,mBAAmB,CAAC;AACzC,CAAC,MAAM,EAAE;AACT;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE;AACxC,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI;AAC5B,CAAC,IAAI,GAAG,CAAC,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,IAAI;AACpE,CAAC,IAAI,oBAAoB,CAAC,UAAU,CAAC,EAAE,OAAO,GAAG,CAAC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC;AAC1F,CAAC,OAAO,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC;AAC/C;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,GAAG,EAAE;AAC7B,CAAC,OAAO,GAAG,CAAC,WAAW,KAAK,MAAM;AAClC;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,GAAG,EAAE,IAAI,EAAE;AAC1C,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,aAAa,CAAC,CAAC,+BAA+B,EAAE,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC;AAChG;AACA,IAAI,0BAA0B,GAAG,IAAI,GAAG,CAAC,wBAAwB,CAAC;AAClE,SAAS,oBAAoB,CAAC,CAAC,EAAE;AACjC,CAAC,OAAO,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC;AACzC;;;;"}