@selvajs/selva 4.19.0 → 4.20.0-beta.0

package/build/server/chunks/chunks/request.js-Bg4Iiw0b.js

@@ -1,119 +0,0 @@
-import { h as apiError, b as ApiErrorCode } from './access.js-Cm9Px9Wy.js';
-
-//#region ../server/src/api/request.ts
-/**
-* The authenticated caller, or a 401.
-*
-* `ctx` and `user` are optional on `ApiRequest` because a host builds one for
-* anonymous requests too (share-token solves reach handlers with a `ctx` and no
-* `user`). Every handler that needs an identity narrows it here rather than
-* asserting the fields non-null, so the unauthenticated path fails as a denial
-* instead of a crash.
-*/
-function requireCaller(req) {
-	if (!req.ctx || !req.user) apiError(401, ApiErrorCode.UNAUTHORIZED, "Unauthorized");
-	return {
-		ctx: req.ctx,
-		user: req.user
-	};
-}
-/**
-* Fail with a Zod error's messages, one per field.
-*
-* The top-level `message` names the first problem so a human reading the
-* response learns something without parsing `fields`.
-*/
-function throwZodError(err) {
-	const fields = {};
-	for (const issue of err.issues) {
-		const key = issue.path.length ? issue.path.join(".") : "_";
-		if (!(key in fields)) fields[key] = issue.message;
-	}
-	const first = err.issues[0];
-	const path = first.path.length ? `${first.path.join(".")}: ` : "";
-	apiError(400, ApiErrorCode.VALIDATION_FAILED, `${path}${first.message}`, fields);
-}
-/**
-* Read required path params, 400ing on any that is missing or blank.
-*
-* A router types every param as `string`, but a route can be reached with an
-* empty segment — this catches that instead of letting a stale non-null
-* assertion paper over it.
-*
-* Does **not** validate format — a guid-shaped param still goes through a
-* schema where the route cares. Replaces the `if (!id) apiError(...)` preamble,
-* not the schema check.
-*/
-function requireParams(params, ...names) {
-	const out = {};
-	const missing = [];
-	for (const name of names) {
-		const value = params[name];
-		if (!value) {
-			missing.push(name);
-			continue;
-		}
-		out[name] = value;
-	}
-	if (missing.length) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Missing path parameter${missing.length > 1 ? "s" : ""}: ${missing.join(", ")}`);
-	return out;
-}
-/**
-* Read a path param through a Zod schema, 400ing on a bad value.
-*
-* The format-checking counterpart to `requireParams` — for guids, enum-shaped
-* segments, anything where "present" isn't the same as "valid".
-*/
-function parseParam(value, schema, name) {
-	const parsed = schema.safeParse(value);
-	if (!parsed.success) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid or missing ${name}`);
-	return parsed.data;
-}
-/**
-* Parse and validate a JSON body. A malformed body becomes `null` rather than
-* throwing, so it fails the schema as a validation error — broken JSON gets a
-* 400 naming the problem, not a 500 from `request.json()`.
-*
-* `missingAs` covers endpoints whose fields are all optional: passing `{}` lets
-* an empty body mean "no changes" instead of a validation failure.
-*/
-async function parseBody(request, schema, { missingAs } = {}) {
-	const raw = await request.json().catch(() => null);
-	const parsed = schema.safeParse(raw ?? missingAs ?? null);
-	if (!parsed.success) throwZodError(parsed.error);
-	return parsed.data;
-}
-/**
-* Pull a required file out of a multipart body and check its size and, where
-* given, its extension.
-*
-* A second line of defence, not the first: a host's body-size guard should
-* reject an oversized request before it is buffered. This catches a file that
-* is individually too large inside a request that isn't.
-*
-* Caps are passed in rather than read here — they are deployment config, and a
-* package that resolved them would pin every host to one source of truth.
-*/
-function requireUpload(form, field, { maxBytes, extensions, contentTypes, label = "File" }) {
-	const file = form.get(field);
-	if (!(file instanceof File) || file.size === 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, `A ${label.toLowerCase()} is required`);
-	const extension = file.name.slice(file.name.lastIndexOf(".")).toLowerCase();
-	if (extensions && !extensions.includes(extension)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `File type not allowed. Allowed: ${extensions.join(", ")}`);
-	if (contentTypes && !contentTypes.allowed.has(file.type)) apiError(400, ApiErrorCode.VALIDATION_FAILED, contentTypes.message);
-	if (file.size > maxBytes) apiError(400, ApiErrorCode.VALIDATION_FAILED, `${label} too large. Max size: ${maxBytes / 1048576} MB`);
-	return {
-		file,
-		extension
-	};
-}
-/** A multipart text field, trimmed and length-capped. Absent stays `undefined`. */
-function formText(form, field, { maxLength } = {}) {
-	const raw = form.get(field);
-	if (typeof raw !== "string") return void 0;
-	const trimmed = raw.trim();
-	if (!trimmed) return void 0;
-	return maxLength ? trimmed.slice(0, maxLength) : trimmed;
-}
-
-export { requireCaller as a, requireUpload as b, parseParam as c, formText as f, parseBody as p, requireParams as r, throwZodError as t };
-//# sourceMappingURL=request.js-Bg4Iiw0b.js.map

package/build/server/chunks/chunks/request.js-Bg4Iiw0b.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"request.js-Bg4Iiw0b.js","sources":["../../../../.svelte-kit/output/server/chunks/request.js"],"sourcesContent":["import { M as ApiErrorCode, N as apiError } from \"./access.js\";\n//#region ../server/src/api/request.ts\n/**\n* The authenticated caller, or a 401.\n*\n* `ctx` and `user` are optional on `ApiRequest` because a host builds one for\n* anonymous requests too (share-token solves reach handlers with a `ctx` and no\n* `user`). Every handler that needs an identity narrows it here rather than\n* asserting the fields non-null, so the unauthenticated path fails as a denial\n* instead of a crash.\n*/\nfunction requireCaller(req) {\n\tif (!req.ctx || !req.user) apiError(401, ApiErrorCode.UNAUTHORIZED, \"Unauthorized\");\n\treturn {\n\t\tctx: req.ctx,\n\t\tuser: req.user\n\t};\n}\n/**\n* Fail with a Zod error's messages, one per field.\n*\n* The top-level `message` names the first problem so a human reading the\n* response learns something without parsing `fields`.\n*/\nfunction throwZodError(err) {\n\tconst fields = {};\n\tfor (const issue of err.issues) {\n\t\tconst key = issue.path.length ? issue.path.join(\".\") : \"_\";\n\t\tif (!(key in fields)) fields[key] = issue.message;\n\t}\n\tconst first = err.issues[0];\n\tconst path = first.path.length ? `${first.path.join(\".\")}: ` : \"\";\n\tapiError(400, ApiErrorCode.VALIDATION_FAILED, `${path}${first.message}`, fields);\n}\n/**\n* Read required path params, 400ing on any that is missing or blank.\n*\n* A router types every param as `string`, but a route can be reached with an\n* empty segment — this catches that instead of letting a stale non-null\n* assertion paper over it.\n*\n* Does **not** validate format — a guid-shaped param still goes through a\n* schema where the route cares. Replaces the `if (!id) apiError(...)` preamble,\n* not the schema check.\n*/\nfunction requireParams(params, ...names) {\n\tconst out = {};\n\tconst missing = [];\n\tfor (const name of names) {\n\t\tconst value = params[name];\n\t\tif (!value) {\n\t\t\tmissing.push(name);\n\t\t\tcontinue;\n\t\t}\n\t\tout[name] = value;\n\t}\n\tif (missing.length) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Missing path parameter${missing.length > 1 ? \"s\" : \"\"}: ${missing.join(\", \")}`);\n\treturn out;\n}\n/**\n* Read a path param through a Zod schema, 400ing on a bad value.\n*\n* The format-checking counterpart to `requireParams` — for guids, enum-shaped\n* segments, anything where \"present\" isn't the same as \"valid\".\n*/\nfunction parseParam(value, schema, name) {\n\tconst parsed = schema.safeParse(value);\n\tif (!parsed.success) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid or missing ${name}`);\n\treturn parsed.data;\n}\n/**\n* Parse and validate a JSON body. A malformed body becomes `null` rather than\n* throwing, so it fails the schema as a validation error — broken JSON gets a\n* 400 naming the problem, not a 500 from `request.json()`.\n*\n* `missingAs` covers endpoints whose fields are all optional: passing `{}` lets\n* an empty body mean \"no changes\" instead of a validation failure.\n*/\nasync function parseBody(request, schema, { missingAs } = {}) {\n\tconst raw = await request.json().catch(() => null);\n\tconst parsed = schema.safeParse(raw ?? missingAs ?? null);\n\tif (!parsed.success) throwZodError(parsed.error);\n\treturn parsed.data;\n}\n/**\n* Pull a required file out of a multipart body and check its size and, where\n* given, its extension.\n*\n* A second line of defence, not the first: a host's body-size guard should\n* reject an oversized request before it is buffered. This catches a file that\n* is individually too large inside a request that isn't.\n*\n* Caps are passed in rather than read here — they are deployment config, and a\n* package that resolved them would pin every host to one source of truth.\n*/\nfunction requireUpload(form, field, { maxBytes, extensions, contentTypes, label = \"File\" }) {\n\tconst file = form.get(field);\n\tif (!(file instanceof File) || file.size === 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, `A ${label.toLowerCase()} is required`);\n\tconst extension = file.name.slice(file.name.lastIndexOf(\".\")).toLowerCase();\n\tif (extensions && !extensions.includes(extension)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `File type not allowed. Allowed: ${extensions.join(\", \")}`);\n\tif (contentTypes && !contentTypes.allowed.has(file.type)) apiError(400, ApiErrorCode.VALIDATION_FAILED, contentTypes.message);\n\tif (file.size > maxBytes) apiError(400, ApiErrorCode.VALIDATION_FAILED, `${label} too large. Max size: ${maxBytes / 1048576} MB`);\n\treturn {\n\t\tfile,\n\t\textension\n\t};\n}\n/** A multipart text field, trimmed and length-capped. Absent stays `undefined`. */\nfunction formText(form, field, { maxLength } = {}) {\n\tconst raw = form.get(field);\n\tif (typeof raw !== \"string\") return void 0;\n\tconst trimmed = raw.trim();\n\tif (!trimmed) return void 0;\n\treturn maxLength ? trimmed.slice(0, maxLength) : trimmed;\n}\n//#endregion\nexport { requireParams as a, requireCaller as i, parseBody as n, requireUpload as o, parseParam as r, throwZodError as s, formText as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,GAAG,EAAE;AAC5B,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC;AACpF,CAAC,OAAO;AACR,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG;AACd,EAAE,IAAI,EAAE,GAAG,CAAC;AACZ,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,GAAG,EAAE;AAC5B,CAAC,MAAM,MAAM,GAAG,EAAE;AAClB,CAAC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE;AACjC,EAAE,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG;AAC5D,EAAE,IAAI,EAAE,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO;AACnD,CAAC;AACD,CAAC,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5B,CAAC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE;AAClE,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC;AACjF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,MAAM,EAAE,GAAG,KAAK,EAAE;AACzC,CAAC,MAAM,GAAG,GAAG,EAAE;AACf,CAAC,MAAM,OAAO,GAAG,EAAE;AACnB,CAAC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE;AAC3B,EAAE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;AAC5B,EAAE,IAAI,CAAC,KAAK,EAAE;AACd,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;AACrB,GAAG;AACH,EAAE;AACF,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK;AACnB,CAAC;AACD,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,sBAAsB,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACnJ,CAAC,OAAO,GAAG;AACX;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;AACzC,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;AACvC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC,CAAC;AACjG,CAAC,OAAO,MAAM,CAAC,IAAI;AACnB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE;AAC9D,CAAC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;AACnD,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,SAAS,IAAI,IAAI,CAAC;AAC1D,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AACjD,CAAC,OAAO,MAAM,CAAC,IAAI;AACnB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,GAAG,MAAM,EAAE,EAAE;AAC5F,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;AAC7B,CAAC,IAAI,EAAE,IAAI,YAAY,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,YAAY,CAAC,CAAC;AACtI,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE;AAC5E,CAAC,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,gCAAgC,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC7J,CAAC,IAAI,YAAY,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,YAAY,CAAC,OAAO,CAAC;AAC9H,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,EAAE,KAAK,CAAC,sBAAsB,EAAE,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;AAClI,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE;AACF,EAAE;AACF;AACA;AACA,SAAS,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE;AACnD,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;AAC5B,CAAC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,OAAO,MAAM;AAC3C,CAAC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE;AAC3B,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,MAAM;AAC5B,CAAC,OAAO,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,OAAO;AACzD;;;;"}

package/build/server/chunks/chunks/resolve.server.js-C2MFfMn_.js

@@ -1,59 +0,0 @@
-import { S as SYSTEM_CONTEXT } from './src.js-Cf1j97Z6.js';
-import { p as providers, o as getDefinitionMeta, f as getProjectProvider, j as flag } from './providers.server.js-B7Ntio2w.js';
-import { h as hashToken, l as looksLikeShareToken } from './token2.server.js-dXKS8zg3.js';
-import { error } from '@sveltejs/kit';
-
-//#region src/lib/server/shareLinks/resolve.server.ts
-/**
-* Extracts a candidate share-link token from the request — `?token=share_…`
-* query param, or `Authorization: Bearer share_…` header. Returns the raw
-* token, or null when none present. Does NOT validate.
-*/
-function readShareToken(request, url) {
-	if (!flag("ENABLE_SHARING")) return null;
-	const q = url.searchParams.get("token");
-	if (q && looksLikeShareToken(q)) return q;
-	const auth = request.headers.get("authorization");
-	if (auth?.startsWith("Bearer ")) {
-		const candidate = auth.slice(7).trim();
-		if (looksLikeShareToken(candidate)) return candidate;
-	}
-	return null;
-}
-/**
-* Runs before user-based auth on definition-scoped routes.
-*
-* Throws only when a token is *present but invalid* (wrong definition, wrong
-* channel, expired, revoked, view-only when solve was requested) — deliberate
-* 401/403/429 responses to a misbehaving consumer. When no token is present
-* at all, returns null and the caller falls through to user-based auth.
-*/
-async function tryResolveShareToken(request, url, requestedDefinitionId, requestedChannel, opts) {
-	const raw = readShareToken(request, url);
-	if (!raw) return null;
-	const tokenHash = hashToken(raw);
-	const link = await providers.data.shareLinks.getByTokenHash(SYSTEM_CONTEXT, tokenHash);
-	if (!link) throw error(401, "Invalid or revoked share token.");
-	if (link.expiresAt && new Date(link.expiresAt).getTime() <= Date.now()) throw error(401, "Share token has expired.");
-	if (link.definitionId !== requestedDefinitionId) throw error(403, "Share token is not valid for this definition.");
-	if (link.channel !== requestedChannel) throw error(403, `Share token is for the '${link.channel}' channel only.`);
-	if (opts.requireSolve && !link.allowSolve) throw error(403, "Share token grants view-only access.");
-	const def = await getDefinitionMeta().get(SYSTEM_CONTEXT, link.definitionId);
-	if (!def) throw error(401, "Share token target no longer exists.");
-	const project = await getProjectProvider().getProject(SYSTEM_CONTEXT, def.projectId);
-	if (!project) throw error(401, "Share token target no longer exists.");
-	return {
-		link,
-		ctx: {
-			userId: `share:${link.id}`,
-			actingOrgId: project.orgId,
-			platformPermissions: [],
-			orgPermissions: [],
-			system: true,
-			shareLinkId: link.id
-		}
-	};
-}
-
-export { tryResolveShareToken as t };
-//# sourceMappingURL=resolve.server.js-C2MFfMn_.js.map

package/build/server/chunks/chunks/resolve.server.js-C2MFfMn_.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolve.server.js-C2MFfMn_.js","sources":["../../../../.svelte-kit/output/server/chunks/resolve.server.js"],"sourcesContent":["import { t as SYSTEM_CONTEXT } from \"./src.js\";\nimport { T as providers, s as getDefinitionMeta, t as flag, v as getProjectProvider } from \"./providers.server.js\";\nimport { n as looksLikeShareToken, t as hashToken } from \"./token2.server.js\";\nimport { error } from \"@sveltejs/kit\";\n//#region src/lib/server/shareLinks/resolve.server.ts\n/**\n* Extracts a candidate share-link token from the request — `?token=share_…`\n* query param, or `Authorization: Bearer share_…` header. Returns the raw\n* token, or null when none present. Does NOT validate.\n*/\nfunction readShareToken(request, url) {\n\tif (!flag(\"ENABLE_SHARING\")) return null;\n\tconst q = url.searchParams.get(\"token\");\n\tif (q && looksLikeShareToken(q)) return q;\n\tconst auth = request.headers.get(\"authorization\");\n\tif (auth?.startsWith(\"Bearer \")) {\n\t\tconst candidate = auth.slice(7).trim();\n\t\tif (looksLikeShareToken(candidate)) return candidate;\n\t}\n\treturn null;\n}\n/**\n* Runs before user-based auth on definition-scoped routes.\n*\n* Throws only when a token is *present but invalid* (wrong definition, wrong\n* channel, expired, revoked, view-only when solve was requested) — deliberate\n* 401/403/429 responses to a misbehaving consumer. When no token is present\n* at all, returns null and the caller falls through to user-based auth.\n*/\nasync function tryResolveShareToken(request, url, requestedDefinitionId, requestedChannel, opts) {\n\tconst raw = readShareToken(request, url);\n\tif (!raw) return null;\n\tconst tokenHash = hashToken(raw);\n\tconst link = await providers.data.shareLinks.getByTokenHash(SYSTEM_CONTEXT, tokenHash);\n\tif (!link) throw error(401, \"Invalid or revoked share token.\");\n\tif (link.expiresAt && new Date(link.expiresAt).getTime() <= Date.now()) throw error(401, \"Share token has expired.\");\n\tif (link.definitionId !== requestedDefinitionId) throw error(403, \"Share token is not valid for this definition.\");\n\tif (link.channel !== requestedChannel) throw error(403, `Share token is for the '${link.channel}' channel only.`);\n\tif (opts.requireSolve && !link.allowSolve) throw error(403, \"Share token grants view-only access.\");\n\tconst def = await getDefinitionMeta().get(SYSTEM_CONTEXT, link.definitionId);\n\tif (!def) throw error(401, \"Share token target no longer exists.\");\n\tconst project = await getProjectProvider().getProject(SYSTEM_CONTEXT, def.projectId);\n\tif (!project) throw error(401, \"Share token target no longer exists.\");\n\treturn {\n\t\tlink,\n\t\tctx: {\n\t\t\tuserId: `share:${link.id}`,\n\t\t\tactingOrgId: project.orgId,\n\t\t\tplatformPermissions: [],\n\t\t\torgPermissions: [],\n\t\t\tsystem: true,\n\t\t\tshareLinkId: link.id\n\t\t}\n\t};\n}\n//#endregion\nexport { tryResolveShareToken as t };\n"],"names":[],"mappings":";;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE;AACtC,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,OAAO,IAAI;AACzC,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;AACxC,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;AAC1C,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;AAClD,CAAC,IAAI,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE;AAClC,EAAE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;AACxC,EAAE,IAAI,mBAAmB,CAAC,SAAS,CAAC,EAAE,OAAO,SAAS;AACtD,CAAC;AACD,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,oBAAoB,CAAC,OAAO,EAAE,GAAG,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,IAAI,EAAE;AACjG,CAAC,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC;AACzC,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,IAAI;AACtB,CAAC,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC;AACjC,CAAC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,cAAc,EAAE,SAAS,CAAC;AACvF,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,iCAAiC,CAAC;AAC/D,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,0BAA0B,CAAC;AACrH,CAAC,IAAI,IAAI,CAAC,YAAY,KAAK,qBAAqB,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,+CAA+C,CAAC;AACnH,CAAC,IAAI,IAAI,CAAC,OAAO,KAAK,gBAAgB,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,wBAAwB,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;AAClH,CAAC,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,sCAAsC,CAAC;AACpG,CAAC,MAAM,GAAG,GAAG,MAAM,iBAAiB,EAAE,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC;AAC7E,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,sCAAsC,CAAC;AACnE,CAAC,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,GAAG,CAAC,SAAS,CAAC;AACrF,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,sCAAsC,CAAC;AACvE,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE,GAAG,EAAE;AACP,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;AAC7B,GAAG,WAAW,EAAE,OAAO,CAAC,KAAK;AAC7B,GAAG,mBAAmB,EAAE,EAAE;AAC1B,GAAG,cAAc,EAAE,EAAE;AACrB,GAAG,MAAM,EAAE,IAAI;AACf,GAAG,WAAW,EAAE,IAAI,CAAC;AACrB;AACA,EAAE;AACF;;;;"}

package/build/server/chunks/chunks/selfUpdate.server.js-Cp6OTEC1.js

@@ -1,144 +0,0 @@
-import { g as getLogger } from './providers.server.js-B7Ntio2w.js';
-import { r as renderThrown } from './definitions.js-D-3AihSg.js';
-import { d as deriveOutcome } from './update-outcome.js-Dl8LwqJM.js';
-import { join } from 'node:path';
-import { existsSync, readFileSync, rmSync } from 'node:fs';
-
-//#region src/lib/server/selfUpdate.server.ts
-/**
-* Durable log/state paths for the update runner, plus post-restart
-* reconciliation of the update's outcome into the audit event log.
-*
-* The process that launches an update is killed mid-update (`pm2 stop
-* selva-compute` is a step of the update itself), so only the
-* `system.update.started` event can be emitted synchronously by the POST
-* handler. The terminal event (`finished` / `rolled_back` / `failed`) is
-* derived AFTER the app is back up: the POST persists a pending-update state
-* file next to the log, and the reconciler here polls the log until the
-* runner's `[EXIT] code=N` marker appears, classifies it via `deriveOutcome`,
-* emits the matching event, and consumes the state file. Kicked from both the
-* POST (covers the no-restart "already up to date" path) and the first request
-* after boot (covers the real update path, where the emitting process is new).
-*/
-function isDeploymentDir(dir) {
-	return existsSync(join(dir, "node_modules", "@selvajs", "selva", "package.json"));
-}
-function findDeploymentDir(env) {
-	if (env.INSTALL_DIR && isDeploymentDir(env.INSTALL_DIR)) return env.INSTALL_DIR;
-	let dir = process.cwd();
-	for (let i = 0; i < 6; i++) {
-		if (isDeploymentDir(dir)) return dir;
-		const parent = join(dir, "..");
-		if (parent === dir) break;
-		dir = parent;
-	}
-	return null;
-}
-function updateLogPath(deploymentDir) {
-	return deploymentDir ? join(deploymentDir, "selva-update.log") : "/tmp/selva-update.log";
-}
-function updateStatePath(deploymentDir) {
-	return join(deploymentDir, "selva-update-state.json");
-}
-/**
-* One reconciliation attempt. Reads the pending-update state file; if the log
-* carries the runner's terminal `[EXIT] code=N` marker, classifies the outcome,
-* emits the terminal audit event, reports rollback/failure to the error
-* tracker, and deletes the state file (exactly-once across restarts — the
-* state file is the emission token).
-*/
-async function reconcileUpdateOutcome(deps) {
-	const statePath = updateStatePath(deps.deploymentDir);
-	let state;
-	try {
-		state = JSON.parse(readFileSync(statePath, "utf8"));
-	} catch {
-		return "no_pending_update";
-	}
-	let logs = "";
-	try {
-		logs = readFileSync(updateLogPath(deps.deploymentDir), "utf8");
-	} catch {}
-	const exitMatch = /\[EXIT\] code=(\d+)/.exec(logs);
-	if (!exitMatch) return "still_running";
-	const exitCode = Number(exitMatch[1]);
-	const outcome = deriveOutcome(exitCode, logs);
-	const base = {
-		fromVersion: state.fromVersion ?? outcome.from,
-		toVersion: outcome.to,
-		actorId: state.actorId
-	};
-	let event;
-	if (outcome.severity === "critical") event = {
-		type: "system.update.failed",
-		...base,
-		detail: outcome.title
-	};
-	else if (exitCode === 5 || logs.includes("Rolled back")) event = {
-		type: "system.update.rolled_back",
-		...base,
-		detail: outcome.title
-	};
-	else if (outcome.severity === "success" || outcome.severity === "info") event = {
-		type: "system.update.finished",
-		...base
-	};
-	else event = {
-		type: "system.update.finished",
-		...base,
-		detail: outcome.title
-	};
-	await deps.emit(event);
-	if (event.type !== "system.update.finished") deps.report(/* @__PURE__ */ new Error(`[selfUpdate] ${outcome.title}`));
-	try {
-		rmSync(statePath);
-	} catch {}
-	return "reconciled";
-}
-var POLL_MS = 15e3;
-var MAX_POLLS = 80;
-var reconcilerActive = false;
-/**
-* Idempotent: safe to call on every boot and on every update POST — exits
-* immediately when no state file exists and never runs twice concurrently.
-*/
-function startUpdateOutcomeReconciler(deps) {
-	if (reconcilerActive) return;
-	if (!existsSync(updateStatePath(deps.deploymentDir))) return;
-	reconcilerActive = true;
-	let polls = 0;
-	const timer = setInterval(() => {
-		(async () => {
-			polls += 1;
-			let result;
-			try {
-				result = await reconcileUpdateOutcome(deps);
-			} catch (err) {
-				getLogger().error("Outcome reconciliation failed", {
-					component: "selfUpdate",
-					err: renderThrown(err)
-				});
-				result = "still_running";
-			}
-			if (result === "still_running" && polls < MAX_POLLS) return;
-			if (result === "still_running") try {
-				const statePath = updateStatePath(deps.deploymentDir);
-				const state = JSON.parse(readFileSync(statePath, "utf8"));
-				await deps.emit({
-					type: "system.update.failed",
-					fromVersion: state.fromVersion,
-					actorId: state.actorId,
-					detail: "No terminal marker in the update log within 20 minutes."
-				});
-				deps.report(/* @__PURE__ */ new Error("[selfUpdate] update never reached a terminal state"));
-				rmSync(statePath);
-			} catch {}
-			clearInterval(timer);
-			reconcilerActive = false;
-		})();
-	}, POLL_MS);
-	timer.unref?.();
-}
-
-export { updateStatePath as a, findDeploymentDir as f, startUpdateOutcomeReconciler as s, updateLogPath as u };
-//# sourceMappingURL=selfUpdate.server.js-Cp6OTEC1.js.map

package/build/server/chunks/chunks/selfUpdate.server.js-Cp6OTEC1.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"selfUpdate.server.js-Cp6OTEC1.js","sources":["../../../../.svelte-kit/output/server/chunks/selfUpdate.server.js"],"sourcesContent":["import { f as getLogger } from \"./providers.server.js\";\nimport { l as renderThrown } from \"./definitions.js\";\nimport { t as deriveOutcome } from \"./update-outcome.js\";\nimport { join } from \"node:path\";\nimport { existsSync, readFileSync, rmSync } from \"node:fs\";\n//#region src/lib/server/selfUpdate.server.ts\n/**\n* Durable log/state paths for the update runner, plus post-restart\n* reconciliation of the update's outcome into the audit event log.\n*\n* The process that launches an update is killed mid-update (`pm2 stop\n* selva-compute` is a step of the update itself), so only the\n* `system.update.started` event can be emitted synchronously by the POST\n* handler. The terminal event (`finished` / `rolled_back` / `failed`) is\n* derived AFTER the app is back up: the POST persists a pending-update state\n* file next to the log, and the reconciler here polls the log until the\n* runner's `[EXIT] code=N` marker appears, classifies it via `deriveOutcome`,\n* emits the matching event, and consumes the state file. Kicked from both the\n* POST (covers the no-restart \"already up to date\" path) and the first request\n* after boot (covers the real update path, where the emitting process is new).\n*/\nfunction isDeploymentDir(dir) {\n\treturn existsSync(join(dir, \"node_modules\", \"@selvajs\", \"selva\", \"package.json\"));\n}\nfunction findDeploymentDir(env) {\n\tif (env.INSTALL_DIR && isDeploymentDir(env.INSTALL_DIR)) return env.INSTALL_DIR;\n\tlet dir = process.cwd();\n\tfor (let i = 0; i < 6; i++) {\n\t\tif (isDeploymentDir(dir)) return dir;\n\t\tconst parent = join(dir, \"..\");\n\t\tif (parent === dir) break;\n\t\tdir = parent;\n\t}\n\treturn null;\n}\nfunction updateLogPath(deploymentDir) {\n\treturn deploymentDir ? join(deploymentDir, \"selva-update.log\") : \"/tmp/selva-update.log\";\n}\nfunction updateStatePath(deploymentDir) {\n\treturn join(deploymentDir, \"selva-update-state.json\");\n}\n/**\n* One reconciliation attempt. Reads the pending-update state file; if the log\n* carries the runner's terminal `[EXIT] code=N` marker, classifies the outcome,\n* emits the terminal audit event, reports rollback/failure to the error\n* tracker, and deletes the state file (exactly-once across restarts — the\n* state file is the emission token).\n*/\nasync function reconcileUpdateOutcome(deps) {\n\tconst statePath = updateStatePath(deps.deploymentDir);\n\tlet state;\n\ttry {\n\t\tstate = JSON.parse(readFileSync(statePath, \"utf8\"));\n\t} catch {\n\t\treturn \"no_pending_update\";\n\t}\n\tlet logs = \"\";\n\ttry {\n\t\tlogs = readFileSync(updateLogPath(deps.deploymentDir), \"utf8\");\n\t} catch {}\n\tconst exitMatch = /\\[EXIT\\] code=(\\d+)/.exec(logs);\n\tif (!exitMatch) return \"still_running\";\n\tconst exitCode = Number(exitMatch[1]);\n\tconst outcome = deriveOutcome(exitCode, logs);\n\tconst base = {\n\t\tfromVersion: state.fromVersion ?? outcome.from,\n\t\ttoVersion: outcome.to,\n\t\tactorId: state.actorId\n\t};\n\tlet event;\n\tif (outcome.severity === \"critical\") event = {\n\t\ttype: \"system.update.failed\",\n\t\t...base,\n\t\tdetail: outcome.title\n\t};\n\telse if (exitCode === 5 || logs.includes(\"Rolled back\")) event = {\n\t\ttype: \"system.update.rolled_back\",\n\t\t...base,\n\t\tdetail: outcome.title\n\t};\n\telse if (outcome.severity === \"success\" || outcome.severity === \"info\") event = {\n\t\ttype: \"system.update.finished\",\n\t\t...base\n\t};\n\telse event = {\n\t\ttype: \"system.update.finished\",\n\t\t...base,\n\t\tdetail: outcome.title\n\t};\n\tawait deps.emit(event);\n\tif (event.type !== \"system.update.finished\") deps.report(/* @__PURE__ */ new Error(`[selfUpdate] ${outcome.title}`));\n\ttry {\n\t\trmSync(statePath);\n\t} catch {}\n\treturn \"reconciled\";\n}\nvar POLL_MS = 15e3;\nvar MAX_POLLS = 80;\nvar reconcilerActive = false;\n/**\n* Idempotent: safe to call on every boot and on every update POST — exits\n* immediately when no state file exists and never runs twice concurrently.\n*/\nfunction startUpdateOutcomeReconciler(deps) {\n\tif (reconcilerActive) return;\n\tif (!existsSync(updateStatePath(deps.deploymentDir))) return;\n\treconcilerActive = true;\n\tlet polls = 0;\n\tconst timer = setInterval(() => {\n\t\t(async () => {\n\t\t\tpolls += 1;\n\t\t\tlet result;\n\t\t\ttry {\n\t\t\t\tresult = await reconcileUpdateOutcome(deps);\n\t\t\t} catch (err) {\n\t\t\t\tgetLogger().error(\"Outcome reconciliation failed\", {\n\t\t\t\t\tcomponent: \"selfUpdate\",\n\t\t\t\t\terr: renderThrown(err)\n\t\t\t\t});\n\t\t\t\tresult = \"still_running\";\n\t\t\t}\n\t\t\tif (result === \"still_running\" && polls < MAX_POLLS) return;\n\t\t\tif (result === \"still_running\") try {\n\t\t\t\tconst statePath = updateStatePath(deps.deploymentDir);\n\t\t\t\tconst state = JSON.parse(readFileSync(statePath, \"utf8\"));\n\t\t\t\tawait deps.emit({\n\t\t\t\t\ttype: \"system.update.failed\",\n\t\t\t\t\tfromVersion: state.fromVersion,\n\t\t\t\t\tactorId: state.actorId,\n\t\t\t\t\tdetail: \"No terminal marker in the update log within 20 minutes.\"\n\t\t\t\t});\n\t\t\t\tdeps.report(/* @__PURE__ */ new Error(\"[selfUpdate] update never reached a terminal state\"));\n\t\t\t\trmSync(statePath);\n\t\t\t} catch {}\n\t\t\tclearInterval(timer);\n\t\t\treconcilerActive = false;\n\t\t})();\n\t}, POLL_MS);\n\ttimer.unref?.();\n}\n//#endregion\nexport { updateStatePath as i, startUpdateOutcomeReconciler as n, updateLogPath as r, findDeploymentDir as t };\n"],"names":[],"mappings":";;;;;;AAKA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,eAAe,CAAC,GAAG,EAAE;AAC9B,CAAC,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;AAClF;AACA,SAAS,iBAAiB,CAAC,GAAG,EAAE;AAChC,CAAC,IAAI,GAAG,CAAC,WAAW,IAAI,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,CAAC,WAAW;AAChF,CAAC,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;AACxB,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE;AAC7B,EAAE,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG;AACtC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC;AAChC,EAAE,IAAI,MAAM,KAAK,GAAG,EAAE;AACtB,EAAE,GAAG,GAAG,MAAM;AACd,CAAC;AACD,CAAC,OAAO,IAAI;AACZ;AACA,SAAS,aAAa,CAAC,aAAa,EAAE;AACtC,CAAC,OAAO,aAAa,GAAG,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC,GAAG,uBAAuB;AACzF;AACA,SAAS,eAAe,CAAC,aAAa,EAAE;AACxC,CAAC,OAAO,IAAI,CAAC,aAAa,EAAE,yBAAyB,CAAC;AACtD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,sBAAsB,CAAC,IAAI,EAAE;AAC5C,CAAC,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC;AACtD,CAAC,IAAI,KAAK;AACV,CAAC,IAAI;AACL,EAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,mBAAmB;AAC5B,CAAC;AACD,CAAC,IAAI,IAAI,GAAG,EAAE;AACd,CAAC,IAAI;AACL,EAAE,IAAI,GAAG,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;AAChE,CAAC,CAAC,CAAC,MAAM,CAAC;AACV,CAAC,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;AACnD,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,eAAe;AACvC,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC;AAC9C,CAAC,MAAM,IAAI,GAAG;AACd,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,OAAO,CAAC,IAAI;AAChD,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE;AACvB,EAAE,OAAO,EAAE,KAAK,CAAC;AACjB,EAAE;AACF,CAAC,IAAI,KAAK;AACV,CAAC,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU,EAAE,KAAK,GAAG;AAC9C,EAAE,IAAI,EAAE,sBAAsB;AAC9B,EAAE,GAAG,IAAI;AACT,EAAE,MAAM,EAAE,OAAO,CAAC;AAClB,EAAE;AACF,MAAM,IAAI,QAAQ,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,KAAK,GAAG;AAClE,EAAE,IAAI,EAAE,2BAA2B;AACnC,EAAE,GAAG,IAAI;AACT,EAAE,MAAM,EAAE,OAAO,CAAC;AAClB,EAAE;AACF,MAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,EAAE,KAAK,GAAG;AACjF,EAAE,IAAI,EAAE,wBAAwB;AAChC,EAAE,GAAG;AACL,EAAE;AACF,MAAM,KAAK,GAAG;AACd,EAAE,IAAI,EAAE,wBAAwB;AAChC,EAAE,GAAG,IAAI;AACT,EAAE,MAAM,EAAE,OAAO,CAAC;AAClB,EAAE;AACF,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;AACvB,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,wBAAwB,EAAE,IAAI,CAAC,MAAM,iBAAiB,IAAI,KAAK,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACrH,CAAC,IAAI;AACL,EAAE,MAAM,CAAC,SAAS,CAAC;AACnB,CAAC,CAAC,CAAC,MAAM,CAAC;AACV,CAAC,OAAO,YAAY;AACpB;AACA,IAAI,OAAO,GAAG,IAAI;AAClB,IAAI,SAAS,GAAG,EAAE;AAClB,IAAI,gBAAgB,GAAG,KAAK;AAC5B;AACA;AACA;AACA;AACA,SAAS,4BAA4B,CAAC,IAAI,EAAE;AAC5C,CAAC,IAAI,gBAAgB,EAAE;AACvB,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE;AACvD,CAAC,gBAAgB,GAAG,IAAI;AACxB,CAAC,IAAI,KAAK,GAAG,CAAC;AACd,CAAC,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM;AACjC,EAAE,CAAC,YAAY;AACf,GAAG,KAAK,IAAI,CAAC;AACb,GAAG,IAAI,MAAM;AACb,GAAG,IAAI;AACP,IAAI,MAAM,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC;AAC/C,GAAG,CAAC,CAAC,OAAO,GAAG,EAAE;AACjB,IAAI,SAAS,EAAE,CAAC,KAAK,CAAC,+BAA+B,EAAE;AACvD,KAAK,SAAS,EAAE,YAAY;AAC5B,KAAK,GAAG,EAAE,YAAY,CAAC,GAAG;AAC1B,KAAK,CAAC;AACN,IAAI,MAAM,GAAG,eAAe;AAC5B,GAAG;AACH,GAAG,IAAI,MAAM,KAAK,eAAe,IAAI,KAAK,GAAG,SAAS,EAAE;AACxD,GAAG,IAAI,MAAM,KAAK,eAAe,EAAE,IAAI;AACvC,IAAI,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC;AACzD,IAAI,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AAC7D,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC;AACpB,KAAK,IAAI,EAAE,sBAAsB;AACjC,KAAK,WAAW,EAAE,KAAK,CAAC,WAAW;AACnC,KAAK,OAAO,EAAE,KAAK,CAAC,OAAO;AAC3B,KAAK,MAAM,EAAE;AACb,KAAK,CAAC;AACN,IAAI,IAAI,CAAC,MAAM,iBAAiB,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;AAChG,IAAI,MAAM,CAAC,SAAS,CAAC;AACrB,GAAG,CAAC,CAAC,MAAM,CAAC;AACZ,GAAG,aAAa,CAAC,KAAK,CAAC;AACvB,GAAG,gBAAgB,GAAG,KAAK;AAC3B,EAAE,CAAC,GAAG;AACN,CAAC,CAAC,EAAE,OAAO,CAAC;AACZ,CAAC,KAAK,CAAC,KAAK,IAAI;AAChB;;;;"}