@selvajs/selva 4.19.0 → 4.20.0-beta.1

package/build/server/chunks/chunks/auth-bootstrap.server.js-C-OChNxp.js

@@ -0,0 +1,152 @@
+import { b as private_env } from './shared-server.js-BGs15m2r.js';
+import { S as SYSTEM_CONTEXT, A as ALL_PLATFORM_PERMISSIONS, k as slugify } from './src.js-bYgw0r8C.js';
+import { a as getAuthProvider, g as getLogger, b as getPermissionStore, c as getTenancy, d as getDataProvider, e as getOrganizationProvider, f as getProjectProvider } from './providers.server.js-BQkh28e-.js';
+import { randomUUID } from 'node:crypto';
+
+//#region src/lib/server/auth-bootstrap.server.ts
+/**
+* Shared post-verification flow used by every IdP-callback route (OAuth,
+* email link, future SAML, …). Order matters:
+*
+*   1. `data.ensureUser` — guarantee a user-data row exists for whatever ID
+*      the auth provider issued. Local-provider creates a JSON row;
+*      Supabase no-ops (its DB trigger has already fired).
+*   2. Bootstrap-admin grant — if no instance_admin exists yet AND the
+*      tenancy/env policy allows it, grant the signing-in user every
+*      platform permission so `/admin` becomes reachable.
+*   3. Single-tenant org seed — create the default Organization + Project
+*      owned by the new admin, mirroring what `/setup` does for password
+*      auth. Without this, org-scoped permissions (manage_projects,
+*      manage_definitions) silently drop because `actingOrgId` resolves to
+*      undefined.
+*
+* Cookie/redirect are the caller's job since they vary by capability (OAuth
+* has refresh tokens, magic-link does sometimes, SAML doesn't).
+*/
+async function bootstrapUserSession(user) {
+	await getDataProvider().ensureUser(SYSTEM_CONTEXT, user.id);
+	const tenancy = getTenancy();
+	const perms = getPermissionStore();
+	const hasAdmin = await perms.hasInstanceAdmin(SYSTEM_CONTEXT);
+	let grantedAdminHere = false;
+	if (!hasAdmin) {
+		if (!shouldBootstrapAdmin(user, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, tenancy)) return;
+		grantedAdminHere = await perms.claimFirstInstanceAdmin(SYSTEM_CONTEXT, user.id, [...ALL_PLATFORM_PERMISSIONS]);
+		if (!grantedAdminHere) return;
+	}
+	if (tenancy !== "single") return;
+	if ((await getOrganizationProvider().listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items.length > 0) return;
+	if (!grantedAdminHere) {
+		if (!(await perms.getFor(SYSTEM_CONTEXT, user.id)).includes("instance_admin")) return;
+	}
+	await ensureSingleTenantDefaultOrg(user);
+}
+/**
+* Seeds the single default Organization + Project that `actingOrgId` needs
+* to resolve, for flows that skip `/setup` (header-auth, OAuth callback,
+* future SAML). No-op outside single-tenant mode and once any org exists.
+* Slug derives from the admin's email/displayName so the URL looks like the
+* deployment rather than a UUID; falls back to `default` for anonymous
+* UPN-only sign-ins.
+*/
+async function ensureSingleTenantDefaultOrg(user) {
+	if (getTenancy() !== "single") return;
+	const orgs = getOrganizationProvider();
+	if ((await orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items.length > 0) return;
+	const orgName = (typeof user.metadata?.displayName === "string" ? user.metadata.displayName : void 0)?.trim() || user.email?.split("@")[0]?.trim() || "Default";
+	const slug = slugify(orgName).length >= 3 ? slugify(orgName) : "default";
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const org = {
+		id: randomUUID(),
+		name: orgName,
+		slug,
+		ownerId: user.id,
+		createdBy: user.id,
+		updatedBy: user.id,
+		createdAt: now,
+		updatedAt: now,
+		deletedAt: null
+	};
+	await orgs.createOrg(SYSTEM_CONTEXT, org);
+	const projects = getProjectProvider();
+	const project = {
+		id: randomUUID(),
+		orgId: org.id,
+		name: "Default",
+		slug: "default",
+		visibility: "public",
+		ownerId: user.id,
+		createdBy: user.id,
+		updatedBy: user.id,
+		autoJoinOnUpload: false,
+		createdAt: now,
+		updatedAt: now,
+		deletedAt: null
+	};
+	await projects.createProject(SYSTEM_CONTEXT, project);
+}
+/**
+* Whether the signing-in user qualifies for the first-admin grant. Pure — no
+* I/O — so the policy is unit-testable.
+*
+* - `tenancy='single'` + no env var → first signer wins (fine for
+*   self-hosted fresh installs).
+* - `tenancy='single'` + env var set → only the named user qualifies.
+* - `tenancy='multi'` → env var REQUIRED; the named user must match the
+*   signer. Without it, the first random signup would become Selva staff.
+*
+* The env var also doubles as the break-glass recovery path when admin is
+* lost to backup restores or migration drift.
+*/
+function shouldBootstrapAdmin(user, configuredEmail, mode) {
+	const expected = configuredEmail?.trim().toLowerCase();
+	if (mode === "multi" && !expected) return false;
+	if (!expected) return true;
+	const actual = user.email?.trim().toLowerCase();
+	return !!actual && actual === expected;
+}
+/**
+* Header-auth variant of `shouldBootstrapAdmin`, used by
+* `wireHeaderAuthBootstrap` to decide whether an unrecognized UPN arriving
+* through the proxy should be auto-allowlisted as the first admin. Operates
+* on the raw UPN/email before any allowlist row exists. For Entra
+* deployments UPN ≈ email; if they differ, the proxy forwards both and we
+* prefer email when present.
+*/
+function shouldBootstrapUpn(upn, email, configuredEmail, mode) {
+	const expected = configuredEmail?.trim().toLowerCase();
+	if (mode === "multi" && !expected) return false;
+	if (!expected) return true;
+	const candidate = (email ?? upn).trim().toLowerCase();
+	return !!candidate && candidate === expected;
+}
+/**
+* Wires a bootstrap-allowlist policy onto the auth provider if it supports
+* header-auth-style first-admin bootstrapping. Idempotent — safe to call on
+* every startup; the provider holds the policy until process exit.
+*
+* Header-auth deployments can't reach `/setup` (no password form, no OAuth
+* callback), so without this the first proxy-authenticated visitor is
+* silently rejected (UPN not in allowlist) and the operator has to
+* hand-write JSON files. With it, the first visit whose UPN/email matches
+* `BOOTSTRAP_INSTANCE_ADMIN_EMAIL` is auto-allowlisted, and the immediately
+* following `bootstrapUserSession` call grants instance_admin.
+*
+* Gated by `hasInstanceAdmin` — once any admin exists, the policy returns
+* false and strict allowlist-only behavior resumes.
+*/
+function wireHeaderAuthBootstrap() {
+	const auth = getAuthProvider();
+	if (!auth.proxyAuth) return;
+	if (typeof auth.setBootstrapAllowlistPolicy !== "function") {
+		if (private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL?.trim()) getLogger().warn("BOOTSTRAP_INSTANCE_ADMIN_EMAIL is set but the installed @selvajs/header-auth-provider does not expose setBootstrapAllowlistPolicy. Upgrade the provider, or hand-seed header-allowlist.json.", { component: "auth-bootstrap" });
+		return;
+	}
+	auth.setBootstrapAllowlistPolicy(async ({ upn, email }) => {
+		if (await getPermissionStore().hasInstanceAdmin(SYSTEM_CONTEXT)) return false;
+		return shouldBootstrapUpn(upn, email, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, getTenancy());
+	});
+}
+
+export { bootstrapUserSession as b, wireHeaderAuthBootstrap as w };
+//# sourceMappingURL=auth-bootstrap.server.js-C-OChNxp.js.map

package/build/server/chunks/chunks/auth-bootstrap.server.js-C-OChNxp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-bootstrap.server.js-C-OChNxp.js","sources":["../../../../.svelte-kit/output/server/chunks/auth-bootstrap.server.js"],"sourcesContent":["import { t as private_env } from \"./shared-server.js\";\nimport { F as slugify, I as ALL_PLATFORM_PERMISSIONS, t as SYSTEM_CONTEXT } from \"./src.js\";\nimport { S as getTenancy, f as getLogger, g as getPermissionStore, h as getOrganizationProvider, o as getDataProvider, r as getAuthProvider, v as getProjectProvider } from \"./providers.server.js\";\nimport { randomUUID } from \"node:crypto\";\n//#region src/lib/server/auth-bootstrap.server.ts\n/**\n* Shared post-verification flow used by every IdP-callback route (OAuth,\n* email link, future SAML, …). Order matters:\n*\n*   1. `data.ensureUser` — guarantee a user-data row exists for whatever ID\n*      the auth provider issued. Local-provider creates a JSON row;\n*      Supabase no-ops (its DB trigger has already fired).\n*   2. Bootstrap-admin grant — if no instance_admin exists yet AND the\n*      tenancy/env policy allows it, grant the signing-in user every\n*      platform permission so `/admin` becomes reachable.\n*   3. Single-tenant org seed — create the default Organization + Project\n*      owned by the new admin, mirroring what `/setup` does for password\n*      auth. Without this, org-scoped permissions (manage_projects,\n*      manage_definitions) silently drop because `actingOrgId` resolves to\n*      undefined.\n*\n* Cookie/redirect are the caller's job since they vary by capability (OAuth\n* has refresh tokens, magic-link does sometimes, SAML doesn't).\n*/\nasync function bootstrapUserSession(user) {\n\tawait getDataProvider().ensureUser(SYSTEM_CONTEXT, user.id);\n\tconst tenancy = getTenancy();\n\tconst perms = getPermissionStore();\n\tconst hasAdmin = await perms.hasInstanceAdmin(SYSTEM_CONTEXT);\n\tlet grantedAdminHere = false;\n\tif (!hasAdmin) {\n\t\tif (!shouldBootstrapAdmin(user, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, tenancy)) return;\n\t\tgrantedAdminHere = await perms.claimFirstInstanceAdmin(SYSTEM_CONTEXT, user.id, [...ALL_PLATFORM_PERMISSIONS]);\n\t\tif (!grantedAdminHere) return;\n\t}\n\tif (tenancy !== \"single\") return;\n\tif ((await getOrganizationProvider().listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items.length > 0) return;\n\tif (!grantedAdminHere) {\n\t\tif (!(await perms.getFor(SYSTEM_CONTEXT, user.id)).includes(\"instance_admin\")) return;\n\t}\n\tawait ensureSingleTenantDefaultOrg(user);\n}\n/**\n* Seeds the single default Organization + Project that `actingOrgId` needs\n* to resolve, for flows that skip `/setup` (header-auth, OAuth callback,\n* future SAML). No-op outside single-tenant mode and once any org exists.\n* Slug derives from the admin's email/displayName so the URL looks like the\n* deployment rather than a UUID; falls back to `default` for anonymous\n* UPN-only sign-ins.\n*/\nasync function ensureSingleTenantDefaultOrg(user) {\n\tif (getTenancy() !== \"single\") return;\n\tconst orgs = getOrganizationProvider();\n\tif ((await orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items.length > 0) return;\n\tconst orgName = (typeof user.metadata?.displayName === \"string\" ? user.metadata.displayName : void 0)?.trim() || user.email?.split(\"@\")[0]?.trim() || \"Default\";\n\tconst slug = slugify(orgName).length >= 3 ? slugify(orgName) : \"default\";\n\tconst now = (/* @__PURE__ */ new Date()).toISOString();\n\tconst org = {\n\t\tid: randomUUID(),\n\t\tname: orgName,\n\t\tslug,\n\t\townerId: user.id,\n\t\tcreatedBy: user.id,\n\t\tupdatedBy: user.id,\n\t\tcreatedAt: now,\n\t\tupdatedAt: now,\n\t\tdeletedAt: null\n\t};\n\tawait orgs.createOrg(SYSTEM_CONTEXT, org);\n\tconst projects = getProjectProvider();\n\tconst project = {\n\t\tid: randomUUID(),\n\t\torgId: org.id,\n\t\tname: \"Default\",\n\t\tslug: \"default\",\n\t\tvisibility: \"public\",\n\t\townerId: user.id,\n\t\tcreatedBy: user.id,\n\t\tupdatedBy: user.id,\n\t\tautoJoinOnUpload: false,\n\t\tcreatedAt: now,\n\t\tupdatedAt: now,\n\t\tdeletedAt: null\n\t};\n\tawait projects.createProject(SYSTEM_CONTEXT, project);\n}\n/**\n* Whether the signing-in user qualifies for the first-admin grant. Pure — no\n* I/O — so the policy is unit-testable.\n*\n* - `tenancy='single'` + no env var → first signer wins (fine for\n*   self-hosted fresh installs).\n* - `tenancy='single'` + env var set → only the named user qualifies.\n* - `tenancy='multi'` → env var REQUIRED; the named user must match the\n*   signer. Without it, the first random signup would become Selva staff.\n*\n* The env var also doubles as the break-glass recovery path when admin is\n* lost to backup restores or migration drift.\n*/\nfunction shouldBootstrapAdmin(user, configuredEmail, mode) {\n\tconst expected = configuredEmail?.trim().toLowerCase();\n\tif (mode === \"multi\" && !expected) return false;\n\tif (!expected) return true;\n\tconst actual = user.email?.trim().toLowerCase();\n\treturn !!actual && actual === expected;\n}\n/**\n* Header-auth variant of `shouldBootstrapAdmin`, used by\n* `wireHeaderAuthBootstrap` to decide whether an unrecognized UPN arriving\n* through the proxy should be auto-allowlisted as the first admin. Operates\n* on the raw UPN/email before any allowlist row exists. For Entra\n* deployments UPN ≈ email; if they differ, the proxy forwards both and we\n* prefer email when present.\n*/\nfunction shouldBootstrapUpn(upn, email, configuredEmail, mode) {\n\tconst expected = configuredEmail?.trim().toLowerCase();\n\tif (mode === \"multi\" && !expected) return false;\n\tif (!expected) return true;\n\tconst candidate = (email ?? upn).trim().toLowerCase();\n\treturn !!candidate && candidate === expected;\n}\n/**\n* Wires a bootstrap-allowlist policy onto the auth provider if it supports\n* header-auth-style first-admin bootstrapping. Idempotent — safe to call on\n* every startup; the provider holds the policy until process exit.\n*\n* Header-auth deployments can't reach `/setup` (no password form, no OAuth\n* callback), so without this the first proxy-authenticated visitor is\n* silently rejected (UPN not in allowlist) and the operator has to\n* hand-write JSON files. With it, the first visit whose UPN/email matches\n* `BOOTSTRAP_INSTANCE_ADMIN_EMAIL` is auto-allowlisted, and the immediately\n* following `bootstrapUserSession` call grants instance_admin.\n*\n* Gated by `hasInstanceAdmin` — once any admin exists, the policy returns\n* false and strict allowlist-only behavior resumes.\n*/\nfunction wireHeaderAuthBootstrap() {\n\tconst auth = getAuthProvider();\n\tif (!auth.proxyAuth) return;\n\tif (typeof auth.setBootstrapAllowlistPolicy !== \"function\") {\n\t\tif (private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL?.trim()) getLogger().warn(\"BOOTSTRAP_INSTANCE_ADMIN_EMAIL is set but the installed @selvajs/header-auth-provider does not expose setBootstrapAllowlistPolicy. Upgrade the provider, or hand-seed header-allowlist.json.\", { component: \"auth-bootstrap\" });\n\t\treturn;\n\t}\n\tauth.setBootstrapAllowlistPolicy(async ({ upn, email }) => {\n\t\tif (await getPermissionStore().hasInstanceAdmin(SYSTEM_CONTEXT)) return false;\n\t\treturn shouldBootstrapUpn(upn, email, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, getTenancy());\n\t});\n}\n//#endregion\nexport { wireHeaderAuthBootstrap as n, bootstrapUserSession as t };\n"],"names":[],"mappings":";;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,oBAAoB,CAAC,IAAI,EAAE;AAC1C,CAAC,MAAM,eAAe,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAC5D,CAAC,MAAM,OAAO,GAAG,UAAU,EAAE;AAC7B,CAAC,MAAM,KAAK,GAAG,kBAAkB,EAAE;AACnC,CAAC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,cAAc,CAAC;AAC9D,CAAC,IAAI,gBAAgB,GAAG,KAAK;AAC7B,CAAC,IAAI,CAAC,QAAQ,EAAE;AAChB,EAAE,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,WAAW,CAAC,8BAA8B,EAAE,OAAO,CAAC,EAAE;AACxF,EAAE,gBAAgB,GAAG,MAAM,KAAK,CAAC,uBAAuB,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,wBAAwB,CAAC,CAAC;AAChH,EAAE,IAAI,CAAC,gBAAgB,EAAE;AACzB,CAAC;AACD,CAAC,IAAI,OAAO,KAAK,QAAQ,EAAE;AAC3B,CAAC,IAAI,CAAC,MAAM,uBAAuB,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;AAChG,CAAC,IAAI,CAAC,gBAAgB,EAAE;AACxB,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE;AACjF,CAAC;AACD,CAAC,MAAM,4BAA4B,CAAC,IAAI,CAAC;AACzC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,4BAA4B,CAAC,IAAI,EAAE;AAClD,CAAC,IAAI,UAAU,EAAE,KAAK,QAAQ,EAAE;AAChC,CAAC,MAAM,IAAI,GAAG,uBAAuB,EAAE;AACvC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;AAC3E,CAAC,MAAM,OAAO,GAAG,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,WAAW,KAAK,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,GAAG,MAAM,GAAG,IAAI,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS;AAChK,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS;AACzE,CAAC,MAAM,GAAG,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACvD,CAAC,MAAM,GAAG,GAAG;AACb,EAAE,EAAE,EAAE,UAAU,EAAE;AAClB,EAAE,IAAI,EAAE,OAAO;AACf,EAAE,IAAI;AACN,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;AAClB,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;AACpB,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;AACpB,EAAE,SAAS,EAAE,GAAG;AAChB,EAAE,SAAS,EAAE,GAAG;AAChB,EAAE,SAAS,EAAE;AACb,EAAE;AACF,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,CAAC;AAC1C,CAAC,MAAM,QAAQ,GAAG,kBAAkB,EAAE;AACtC,CAAC,MAAM,OAAO,GAAG;AACjB,EAAE,EAAE,EAAE,UAAU,EAAE;AAClB,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE;AACf,EAAE,IAAI,EAAE,SAAS;AACjB,EAAE,IAAI,EAAE,SAAS;AACjB,EAAE,UAAU,EAAE,QAAQ;AACtB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;AAClB,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;AACpB,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;AACpB,EAAE,gBAAgB,EAAE,KAAK;AACzB,EAAE,SAAS,EAAE,GAAG;AAChB,EAAE,SAAS,EAAE,GAAG;AAChB,EAAE,SAAS,EAAE;AACb,EAAE;AACF,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,cAAc,EAAE,OAAO,CAAC;AACtD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,oBAAoB,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE;AAC3D,CAAC,MAAM,QAAQ,GAAG,eAAe,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACvD,CAAC,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,KAAK;AAChD,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI;AAC3B,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AAChD,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,MAAM,KAAK,QAAQ;AACvC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE;AAC/D,CAAC,MAAM,QAAQ,GAAG,eAAe,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACvD,CAAC,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,KAAK;AAChD,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI;AAC3B,CAAC,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACtD,CAAC,OAAO,CAAC,CAAC,SAAS,IAAI,SAAS,KAAK,QAAQ;AAC7C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,uBAAuB,GAAG;AACnC,CAAC,MAAM,IAAI,GAAG,eAAe,EAAE;AAC/B,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;AACtB,CAAC,IAAI,OAAO,IAAI,CAAC,2BAA2B,KAAK,UAAU,EAAE;AAC7D,EAAE,IAAI,WAAW,CAAC,8BAA8B,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,8LAA8L,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC;AAC3S,EAAE;AACF,CAAC;AACD,CAAC,IAAI,CAAC,2BAA2B,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK;AAC5D,EAAE,IAAI,MAAM,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,OAAO,KAAK;AAC/E,EAAE,OAAO,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,CAAC,8BAA8B,EAAE,UAAU,EAAE,CAAC;AACjG,CAAC,CAAC,CAAC;AACH;;;;"}

package/build/server/chunks/chunks/bootHealth.server.js-C4yGBLbM.js

@@ -0,0 +1,90 @@
+import { p as providers, g as getLogger } from './providers.server.js-BQkh28e-.js';
+import { r as renderThrown } from './definitions.js-BCLhFUqp.js';
+
+//#region src/lib/server/bootHealth.server.ts
+var cached = null;
+var inflight = null;
+async function run() {
+	let atRestSecrets = null;
+	const store = providers.data.computeServer;
+	if (typeof store.verifySecrets === "function") try {
+		atRestSecrets = await store.verifySecrets();
+	} catch (err) {
+		getLogger().error("verifySecrets threw — treating as failure", {
+			component: "boot",
+			err: renderThrown(err)
+		});
+		atRestSecrets = {
+			ok: false,
+			plaintextFound: false,
+			failures: [{
+				serverId: "(unknown)",
+				serverLabel: "(unknown)",
+				reason: "key_mismatch",
+				cause: err instanceof Error ? err.message : String(err)
+			}]
+		};
+	}
+	if (atRestSecrets && !atRestSecrets.ok) {
+		for (const f of atRestSecrets.failures) getLogger().error("At-rest secret verification failed for compute server", {
+			component: "boot",
+			serverLabel: f.serverLabel,
+			serverId: f.serverId,
+			reason: f.reason,
+			cause: f.cause
+		});
+		getLogger().error("At-rest secret verification failed. /api/health will return 503. Recover by re-entering the affected apiKeys via /admin/compute, or by restoring the original SELVA_AT_REST_KEY. See docs/Troubleshooting.md.", { component: "boot" });
+	}
+	let schemaVersion = null;
+	const data = providers.data;
+	if (typeof data.verifySchemaVersion === "function") try {
+		schemaVersion = await data.verifySchemaVersion();
+	} catch (err) {
+		getLogger().error("verifySchemaVersion threw — treating as failure", {
+			component: "boot",
+			err: renderThrown(err)
+		});
+		schemaVersion = {
+			ok: false,
+			expected: "(unknown)",
+			actual: null,
+			message: err instanceof Error ? err.message : String(err)
+		};
+	}
+	if (schemaVersion && !schemaVersion.ok) getLogger().error("Database schema handshake failed. /api/health will return 503.", {
+		component: "boot",
+		expected: schemaVersion.expected,
+		actual: schemaVersion.actual ?? "unavailable",
+		detail: schemaVersion.message
+	});
+	return {
+		checkedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		atRestSecrets,
+		schemaVersion
+	};
+}
+/**
+* Runs the underlying checks at most once — subsequent callers receive the
+* same result; in-flight callers share a single promise. Does NOT auto-refresh
+* after an operator fixes the underlying issue — restart the process to
+* re-run the boot check. That's deliberate: boot health represents the state
+* at boot, by definition.
+*/
+function getBootHealth() {
+	if (cached) return Promise.resolve(cached);
+	if (inflight) return inflight;
+	inflight = run().then((result) => {
+		cached = result;
+		inflight = null;
+		return result;
+	});
+	return inflight;
+}
+function isDegraded(report) {
+	if (report.atRestSecrets !== null && !report.atRestSecrets.ok) return true;
+	if (report.schemaVersion !== null && !report.schemaVersion.ok) return true;
+	return false;
+}
+
+export { getBootHealth as g, isDegraded as i };
+//# sourceMappingURL=bootHealth.server.js-C4yGBLbM.js.map

package/build/server/chunks/chunks/bootHealth.server.js-C4yGBLbM.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootHealth.server.js-C4yGBLbM.js","sources":["../../../../.svelte-kit/output/server/chunks/bootHealth.server.js"],"sourcesContent":["import { T as providers, f as getLogger } from \"./providers.server.js\";\nimport { l as renderThrown } from \"./definitions.js\";\n//#region src/lib/server/bootHealth.server.ts\nvar cached = null;\nvar inflight = null;\nasync function run() {\n\tlet atRestSecrets = null;\n\tconst store = providers.data.computeServer;\n\tif (typeof store.verifySecrets === \"function\") try {\n\t\tatRestSecrets = await store.verifySecrets();\n\t} catch (err) {\n\t\tgetLogger().error(\"verifySecrets threw — treating as failure\", {\n\t\t\tcomponent: \"boot\",\n\t\t\terr: renderThrown(err)\n\t\t});\n\t\tatRestSecrets = {\n\t\t\tok: false,\n\t\t\tplaintextFound: false,\n\t\t\tfailures: [{\n\t\t\t\tserverId: \"(unknown)\",\n\t\t\t\tserverLabel: \"(unknown)\",\n\t\t\t\treason: \"key_mismatch\",\n\t\t\t\tcause: err instanceof Error ? err.message : String(err)\n\t\t\t}]\n\t\t};\n\t}\n\tif (atRestSecrets && !atRestSecrets.ok) {\n\t\tfor (const f of atRestSecrets.failures) getLogger().error(\"At-rest secret verification failed for compute server\", {\n\t\t\tcomponent: \"boot\",\n\t\t\tserverLabel: f.serverLabel,\n\t\t\tserverId: f.serverId,\n\t\t\treason: f.reason,\n\t\t\tcause: f.cause\n\t\t});\n\t\tgetLogger().error(\"At-rest secret verification failed. /api/health will return 503. Recover by re-entering the affected apiKeys via /admin/compute, or by restoring the original SELVA_AT_REST_KEY. See docs/Troubleshooting.md.\", { component: \"boot\" });\n\t}\n\tlet schemaVersion = null;\n\tconst data = providers.data;\n\tif (typeof data.verifySchemaVersion === \"function\") try {\n\t\tschemaVersion = await data.verifySchemaVersion();\n\t} catch (err) {\n\t\tgetLogger().error(\"verifySchemaVersion threw — treating as failure\", {\n\t\t\tcomponent: \"boot\",\n\t\t\terr: renderThrown(err)\n\t\t});\n\t\tschemaVersion = {\n\t\t\tok: false,\n\t\t\texpected: \"(unknown)\",\n\t\t\tactual: null,\n\t\t\tmessage: err instanceof Error ? err.message : String(err)\n\t\t};\n\t}\n\tif (schemaVersion && !schemaVersion.ok) getLogger().error(\"Database schema handshake failed. /api/health will return 503.\", {\n\t\tcomponent: \"boot\",\n\t\texpected: schemaVersion.expected,\n\t\tactual: schemaVersion.actual ?? \"unavailable\",\n\t\tdetail: schemaVersion.message\n\t});\n\treturn {\n\t\tcheckedAt: (/* @__PURE__ */ new Date()).toISOString(),\n\t\tatRestSecrets,\n\t\tschemaVersion\n\t};\n}\n/**\n* Runs the underlying checks at most once — subsequent callers receive the\n* same result; in-flight callers share a single promise. Does NOT auto-refresh\n* after an operator fixes the underlying issue — restart the process to\n* re-run the boot check. That's deliberate: boot health represents the state\n* at boot, by definition.\n*/\nfunction getBootHealth() {\n\tif (cached) return Promise.resolve(cached);\n\tif (inflight) return inflight;\n\tinflight = run().then((result) => {\n\t\tcached = result;\n\t\tinflight = null;\n\t\treturn result;\n\t});\n\treturn inflight;\n}\nfunction isDegraded(report) {\n\tif (report.atRestSecrets !== null && !report.atRestSecrets.ok) return true;\n\tif (report.schemaVersion !== null && !report.schemaVersion.ok) return true;\n\treturn false;\n}\n//#endregion\nexport { isDegraded as n, getBootHealth as t };\n"],"names":[],"mappings":";;;AAEA;AACA,IAAI,MAAM,GAAG,IAAI;AACjB,IAAI,QAAQ,GAAG,IAAI;AACnB,eAAe,GAAG,GAAG;AACrB,CAAC,IAAI,aAAa,GAAG,IAAI;AACzB,CAAC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa;AAC3C,CAAC,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,UAAU,EAAE,IAAI;AACpD,EAAE,aAAa,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;AAC7C,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,2CAA2C,EAAE;AACjE,GAAG,SAAS,EAAE,MAAM;AACpB,GAAG,GAAG,EAAE,YAAY,CAAC,GAAG;AACxB,GAAG,CAAC;AACJ,EAAE,aAAa,GAAG;AAClB,GAAG,EAAE,EAAE,KAAK;AACZ,GAAG,cAAc,EAAE,KAAK;AACxB,GAAG,QAAQ,EAAE,CAAC;AACd,IAAI,QAAQ,EAAE,WAAW;AACzB,IAAI,WAAW,EAAE,WAAW;AAC5B,IAAI,MAAM,EAAE,cAAc;AAC1B,IAAI,KAAK,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG;AAC1D,IAAI;AACJ,GAAG;AACH,CAAC;AACD,CAAC,IAAI,aAAa,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE;AACzC,EAAE,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,uDAAuD,EAAE;AACrH,GAAG,SAAS,EAAE,MAAM;AACpB,GAAG,WAAW,EAAE,CAAC,CAAC,WAAW;AAC7B,GAAG,QAAQ,EAAE,CAAC,CAAC,QAAQ;AACvB,GAAG,MAAM,EAAE,CAAC,CAAC,MAAM;AACnB,GAAG,KAAK,EAAE,CAAC,CAAC;AACZ,GAAG,CAAC;AACJ,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,+MAA+M,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC3P,CAAC;AACD,CAAC,IAAI,aAAa,GAAG,IAAI;AACzB,CAAC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI;AAC5B,CAAC,IAAI,OAAO,IAAI,CAAC,mBAAmB,KAAK,UAAU,EAAE,IAAI;AACzD,EAAE,aAAa,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE;AAClD,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,iDAAiD,EAAE;AACvE,GAAG,SAAS,EAAE,MAAM;AACpB,GAAG,GAAG,EAAE,YAAY,CAAC,GAAG;AACxB,GAAG,CAAC;AACJ,EAAE,aAAa,GAAG;AAClB,GAAG,EAAE,EAAE,KAAK;AACZ,GAAG,QAAQ,EAAE,WAAW;AACxB,GAAG,MAAM,EAAE,IAAI;AACf,GAAG,OAAO,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG;AAC3D,GAAG;AACH,CAAC;AACD,CAAC,IAAI,aAAa,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,gEAAgE,EAAE;AAC7H,EAAE,SAAS,EAAE,MAAM;AACnB,EAAE,QAAQ,EAAE,aAAa,CAAC,QAAQ;AAClC,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,IAAI,aAAa;AAC/C,EAAE,MAAM,EAAE,aAAa,CAAC;AACxB,EAAE,CAAC;AACH,CAAC,OAAO;AACR,EAAE,SAAS,EAAE,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACvD,EAAE,aAAa;AACf,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,GAAG;AACzB,CAAC,IAAI,MAAM,EAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;AAC3C,CAAC,IAAI,QAAQ,EAAE,OAAO,QAAQ;AAC9B,CAAC,QAAQ,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK;AACnC,EAAE,MAAM,GAAG,MAAM;AACjB,EAAE,QAAQ,GAAG,IAAI;AACjB,EAAE,OAAO,MAAM;AACf,CAAC,CAAC,CAAC;AACH,CAAC,OAAO,QAAQ;AAChB;AACA,SAAS,UAAU,CAAC,MAAM,EAAE;AAC5B,CAAC,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,OAAO,IAAI;AAC3E,CAAC,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,OAAO,IAAI;AAC3E,CAAC,OAAO,KAAK;AACb;;;;"}

package/build/server/chunks/chunks/client.js-D8sOH3yA.js

@@ -0,0 +1,59 @@
+import { i as index_server_exports } from './index-server.js-B4lHrS_U.js';
+import './shared.js-BStsS1ju.js';
+import './exports.js-DurfUvtz.js';
+import './routing.js-CvcjLFt6.js';
+import { n as noop } from './server.js-eNE8c09e.js';
+import './internal2.js-Br4T9j60.js';
+import '@sveltejs/kit/internal/server';
+import '@sveltejs/kit/internal';
+
+var is_legacy = noop.toString().includes("$$") || /function \w+\(\) \{\}/.test(noop.toString());
+var placeholder_url = "a:";
+if (is_legacy) {
+	({
+		data: {},
+		form: null,
+		error: null,
+		params: {},
+		route: { id: null },
+		state: {},
+		status: -1,
+		url: new URL(placeholder_url)
+	});
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@sveltejs+kit@2.70.3_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.3.1_svelte_9172e0e9363bf3f5d5e1b1085ec23abb/node_modules/@sveltejs/kit/src/runtime/client/client.js
+/** @import { RemoteFunctionDataNode, ServerNodesResponse, ServerRedirectNode } from 'types' */
+/** @import { CacheEntry } from './remote-functions/cache.svelte.js' */
+/** @import { Query } from './remote-functions/query/instance.svelte.js' */
+/** @import { LiveQuery } from './remote-functions/query-live/instance.svelte.js' */
+var { onMount, tick } = index_server_exports;
+/**
+* Allows you to navigate programmatically to a given route, with options such as keeping the current element focused.
+* Returns a Promise that resolves when SvelteKit navigates (or fails to navigate, in which case the promise rejects) to the specified `url`.
+*
+* For external URLs, use `window.location = url` instead of calling `goto(url)`.
+*
+* @param {string | URL} url Where to navigate to. Note that if you've set [`config.kit.paths.base`](https://svelte.dev/docs/kit/configuration#paths) and the URL is root-relative, you need to prepend the base path if you want to navigate within the app.
+* @param {Object} [opts] Options related to the navigation
+* @param {boolean} [opts.replaceState] If `true`, will replace the current `history` entry rather than creating a new one with `pushState`
+* @param {boolean} [opts.noScroll] If `true`, the browser will maintain its scroll position rather than scrolling to the top of the page after navigation
+* @param {boolean} [opts.keepFocus] If `true`, the currently focused element will retain focus after navigation. Otherwise, focus will be reset to the body
+* @param {boolean} [opts.invalidateAll] If `true`, all `load` functions of the page will be rerun. See https://svelte.dev/docs/kit/load#rerunning-load-functions for more info on invalidation.
+* @param {Array<string | URL | ((url: URL) => boolean)>} [opts.invalidate] Causes any load functions to re-run if they depend on one of the urls
+* @param {App.PageState} [opts.state] An optional object that will be available as `page.state`
+* @returns {Promise<void>}
+*/
+function goto(url, opts = {}) {
+	throw new Error("Cannot call goto(...) on the server");
+}
+/**
+* Causes all `load` and `query` functions belonging to the currently active page to re-run. Returns a `Promise` that resolves when the page is subsequently updated.
+* @returns {Promise<void>}
+*/
+function invalidateAll() {
+	throw new Error("Cannot call invalidateAll() on the server");
+}
+
+export { goto as g, invalidateAll as i };
+//# sourceMappingURL=client.js-D8sOH3yA.js.map

package/build/server/chunks/chunks/client.js-D8sOH3yA.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js-D8sOH3yA.js","sources":["../../../../.svelte-kit/output/server/chunks/client.js"],"sourcesContent":["import { t as index_server_exports } from \"./index-server.js\";\nimport { x as noop } from \"./shared.js\";\nimport \"./internal.js\";\nimport \"./exports.js\";\nimport \"./routing.js\";\nimport { Ht as noop$1 } from \"./server.js\";\nimport { n as writable } from \"./shared2.js\";\nimport \"./paths.js\";\nimport \"@sveltejs/kit/internal\";\nvar PRELOAD_PRIORITIES = {\n\ttap: 1,\n\thover: 2,\n\tviewport: 3,\n\teager: 4,\n\toff: -1,\n\tfalse: -1\n};\n({ ...PRELOAD_PRIORITIES }), PRELOAD_PRIORITIES.hover;\n/** @param {any} value */\nfunction notifiable_store(value) {\n\tconst store = writable(value);\n\tlet ready = true;\n\tfunction notify() {\n\t\tready = true;\n\t\tstore.update((val) => val);\n\t}\n\t/** @param {any} new_value */\n\tfunction set(new_value) {\n\t\tready = false;\n\t\tstore.set(new_value);\n\t}\n\t/** @param {(value: any) => void} run */\n\tfunction subscribe(run) {\n\t\t/** @type {any} */\n\t\tlet old_value;\n\t\treturn store.subscribe((new_value) => {\n\t\t\tif (old_value === void 0 || ready && new_value !== old_value) run(old_value = new_value);\n\t\t});\n\t}\n\treturn {\n\t\tnotify,\n\t\tset,\n\t\tsubscribe\n\t};\n}\nvar updated_listener = { v: noop };\nfunction create_updated_store() {\n\tconst { set, subscribe } = writable(false);\n\treturn {\n\t\tsubscribe,\n\t\tcheck: async () => false\n\t};\n}\n//#endregion\n//#region ../../node_modules/.pnpm/@sveltejs+kit@2.70.3_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.3.1_svelte_9172e0e9363bf3f5d5e1b1085ec23abb/node_modules/@sveltejs/kit/src/runtime/client/state.svelte.js\nvar page;\nvar navigating;\nvar updated;\nvar is_legacy = noop$1.toString().includes(\"$$\") || /function \\w+\\(\\) \\{\\}/.test(noop$1.toString());\nvar placeholder_url = \"a:\";\nif (is_legacy) {\n\tpage = {\n\t\tdata: {},\n\t\tform: null,\n\t\terror: null,\n\t\tparams: {},\n\t\troute: { id: null },\n\t\tstate: {},\n\t\tstatus: -1,\n\t\turl: new URL(placeholder_url)\n\t};\n\tnavigating = { current: null };\n\tupdated = { current: false };\n} else {\n\tpage = new class Page {\n\t\tdata = {};\n\t\tform = null;\n\t\terror = null;\n\t\tparams = {};\n\t\troute = { id: null };\n\t\tstate = {};\n\t\tstatus = -1;\n\t\turl = new URL(placeholder_url);\n\t}();\n\tnavigating = new class Navigating {\n\t\tcurrent = null;\n\t}();\n\tupdated = new class Updated {\n\t\tcurrent = false;\n\t}();\n\tupdated_listener.v = () => updated.current = true;\n}\n//#endregion\n//#region ../../node_modules/.pnpm/@sveltejs+kit@2.70.3_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.3.1_svelte_9172e0e9363bf3f5d5e1b1085ec23abb/node_modules/@sveltejs/kit/src/runtime/client/client.js\n/** @import { RemoteFunctionDataNode, ServerNodesResponse, ServerRedirectNode } from 'types' */\n/** @import { CacheEntry } from './remote-functions/cache.svelte.js' */\n/** @import { Query } from './remote-functions/query/instance.svelte.js' */\n/** @import { LiveQuery } from './remote-functions/query-live/instance.svelte.js' */\nvar { onMount, tick } = index_server_exports;\nvar stores = {\n\turl: /* @__PURE__ */ notifiable_store({}),\n\tpage: /* @__PURE__ */ notifiable_store({}),\n\tnavigating: /* @__PURE__ */ writable(null),\n\tupdated: /* @__PURE__ */ create_updated_store()\n};\n/**\n* Allows you to navigate programmatically to a given route, with options such as keeping the current element focused.\n* Returns a Promise that resolves when SvelteKit navigates (or fails to navigate, in which case the promise rejects) to the specified `url`.\n*\n* For external URLs, use `window.location = url` instead of calling `goto(url)`.\n*\n* @param {string | URL} url Where to navigate to. Note that if you've set [`config.kit.paths.base`](https://svelte.dev/docs/kit/configuration#paths) and the URL is root-relative, you need to prepend the base path if you want to navigate within the app.\n* @param {Object} [opts] Options related to the navigation\n* @param {boolean} [opts.replaceState] If `true`, will replace the current `history` entry rather than creating a new one with `pushState`\n* @param {boolean} [opts.noScroll] If `true`, the browser will maintain its scroll position rather than scrolling to the top of the page after navigation\n* @param {boolean} [opts.keepFocus] If `true`, the currently focused element will retain focus after navigation. Otherwise, focus will be reset to the body\n* @param {boolean} [opts.invalidateAll] If `true`, all `load` functions of the page will be rerun. See https://svelte.dev/docs/kit/load#rerunning-load-functions for more info on invalidation.\n* @param {Array<string | URL | ((url: URL) => boolean)>} [opts.invalidate] Causes any load functions to re-run if they depend on one of the urls\n* @param {App.PageState} [opts.state] An optional object that will be available as `page.state`\n* @returns {Promise<void>}\n*/\nfunction goto(url, opts = {}) {\n\tthrow new Error(\"Cannot call goto(...) on the server\");\n}\n/**\n* Causes all `load` and `query` functions belonging to the currently active page to re-run. Returns a `Promise` that resolves when the page is subsequently updated.\n* @returns {Promise<void>}\n*/\nfunction invalidateAll() {\n\tthrow new Error(\"Cannot call invalidateAll() on the server\");\n}\n//#endregion\nexport { page as a, navigating as i, invalidateAll as n, stores as r, goto as t };\n"],"names":["noop$1"],"mappings":";;;;;;;;;AA0DA,IAAI,SAAS,GAAGA,IAAM,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAACA,IAAM,CAAC,QAAQ,EAAE,CAAC;AACnG,IAAI,eAAe,GAAG,IAAI;AAC1B,IAAI,SAAS,EAAE;AACf,EAAQ;AACR,EAAE,IAAI,EAAE,EAAE;AACV,EAAE,IAAI,EAAE,IAAI;AACZ,EAAE,KAAK,EAAE,IAAI;AACb,EAAE,MAAM,EAAE,EAAE;AACZ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;AACrB,EAAE,KAAK,EAAE,EAAE;AACX,EAAE,MAAM,EAAE,EAAE;AACZ,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,eAAe;AAC9B,GAAE;AAGF;AAmBA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,oBAAoB;AAO5C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,IAAI,CAAC,GAAG,EAAE,IAAI,GAAG,EAAE,EAAE;AAC9B,CAAC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC;AACvD;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,GAAG;AACzB,CAAC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC;AAC7D;;;;"}