@selvajs/selva 4.20.0-beta.0 → 4.20.0-beta.1

package/build/server/chunks/chunks/src.js-bYgw0r8C.js

@@ -0,0 +1,518 @@
+import { z } from 'zod';
+
+//#region ../platform/src/permissions/types.ts
+/**
+* Platform-scope permissions. All but `manage_api_tokens` are reserved for
+* Selva staff and instance operators; regular users hold an empty array.
+*
+* - `instance_admin`        — superuser; implies every other permission
+* - `manage_compute`        — configure the instance-wide Rhino.Compute pool
+* - `manage_instance_users` — disable/enable any user on the instance
+* - `manage_updates`        — run system updates
+* - `manage_api_tokens`     — mint API tokens for yourself
+*/
+var PlatformPermissionSchema = z.enum([
+	"instance_admin",
+	"manage_compute",
+	"manage_instance_users",
+	"manage_updates",
+	"manage_api_tokens"
+]);
+var ALL_PLATFORM_PERMISSIONS = PlatformPermissionSchema.options;
+/**
+* The permissions that admit someone to the `/admin` operator surface.
+* `manage_api_tokens` is granted to ordinary users, who have no business there.
+*/
+var OPERATOR_PLATFORM_PERMISSIONS = ALL_PLATFORM_PERMISSIONS.filter((p) => p !== "manage_api_tokens");
+var RESERVED_SLUG_SET = /* @__PURE__ */ new Set([
+	"o",
+	"api",
+	"admin",
+	"auth",
+	"login",
+	"logout",
+	"setup",
+	"settings",
+	"team",
+	"library",
+	"projects",
+	"accept-invite"
+]);
+/**
+* Coerces an arbitrary name into a slug candidate. Does not guarantee a valid
+* slug — an all-symbols name yields `''`, and reserved words pass through
+* untouched — run the result through `SlugSchema` where validity matters.
+*/
+function slugify(name) {
+	return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 63);
+}
+/** Lowercase alphanumeric with internal hyphens, 3–63 chars, not a reserved word. */
+var SlugSchema = z.string().min(3, "Slug must be at least 3 characters").max(63, "Slug must be at most 63 characters").regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/, "Slug must be lowercase alphanumeric with hyphens (no leading/trailing/consecutive hyphens)").refine((s) => !RESERVED_SLUG_SET.has(s), { message: "Slug is reserved and cannot be used" });
+var OrgRoleSchema = z.enum([
+	"owner",
+	"admin",
+	"member"
+]);
+/** Kinds of org-scoped branding asset. Adding a kind is a single entry here — path, upload route, store, and UI are all generic over it. */
+var OrgAssetKindSchema = z.enum(["logo", "favicon"]);
+var ALL_ORG_ASSET_KINDS = OrgAssetKindSchema.options;
+/**
+* Org-scope permissions. A user may hold different sets in different orgs.
+*
+* `read_all_org_projects` lets its holder mint an API token that reads and
+* solves every project in the org, including ones they aren't a member of.
+*/
+var OrgPermissionSchema = z.enum([
+	"manage_org_members",
+	"manage_org_compute",
+	"manage_definitions",
+	"manage_projects",
+	"read_all_org_projects"
+]);
+var ALL_ORG_PERMISSIONS = OrgPermissionSchema.options;
+/** The permissions that run some part of `/team`. */
+var ORG_MANAGEMENT_PERMISSIONS = ALL_ORG_PERMISSIONS.filter((p) => p !== "read_all_org_projects");
+/** Governance perms — never grantable to `member`. */
+var OWNER_ADMIN_ONLY_PERMISSIONS = ["manage_org_members", "manage_org_compute"];
+var MEMBER_ASSIGNABLE_PERMISSIONS = ALL_ORG_PERMISSIONS.filter((p) => !OWNER_ADMIN_ONLY_PERMISSIONS.includes(p));
+/**
+* Applied when adding a member without an explicit permissions list.
+*
+* `read_all_org_projects` is never a default: a key holding it reads projects
+* its owner isn't a member of, without the audit trail Reclaim leaves.
+*/
+var DEFAULT_ORG_PERMISSIONS = {
+	owner: [...ORG_MANAGEMENT_PERMISSIONS],
+	admin: [...ORG_MANAGEMENT_PERMISSIONS],
+	member: []
+};
+var CreateOrgSchema = z.object({
+	name: z.string().min(1, "Organization name is required").max(128),
+	slug: SlugSchema
+});
+var UpdateOrgSchema = CreateOrgSchema.partial();
+z.enum([
+	"read",
+	"write",
+	"solve"
+]);
+var SCOPE_PATTERN = /^(read|write|solve):(all|(org|project|definition):([A-Za-z0-9_-]{1,128}))$/;
+/** `read:all`, `write:org:<id>`, `solve:project:<id>`, `read:definition:<guid>`. */
+function parseApiScope(value) {
+	const m = SCOPE_PATTERN.exec(value);
+	if (!m) return null;
+	const action = m[1];
+	if (m[2] === "all") return {
+		action,
+		resource: { kind: "all" }
+	};
+	return {
+		action,
+		resource: {
+			kind: m[3],
+			id: m[4]
+		}
+	};
+}
+/**
+* Scopes are stored as strings so a new action or resource kind needs no
+* migration. Parsing rejects anything this version doesn't understand, so an
+* unknown scope grants nothing rather than being guessed at.
+*/
+var ApiScopeStringSchema = z.string().refine((s) => parseApiScope(s) !== null, { message: "Unknown scope" });
+z.enum([
+	"owner",
+	"admin",
+	"member_removed",
+	"user_disabled"
+]);
+/** The only lifetimes offered. Expiry is never optional. */
+var API_TOKEN_LIFETIME_DAYS = [
+	30,
+	90,
+	180
+];
+var ACTION_WORDS = {
+	read: "Read",
+	write: "Read and change",
+	solve: "Read and run solves on"
+};
+/** "Read and change everything in the org". Names no ids, so it suits an email. */
+function describeApiScope(value) {
+	const scope = parseApiScope(value);
+	if (!scope) return `Unknown scope (${value})`;
+	const what = scope.resource.kind === "project" ? "one project" : scope.resource.kind === "definition" ? "one definition" : "everything in the org";
+	return `${ACTION_WORDS[scope.action]} ${what}`;
+}
+//#endregion
+//#region ../platform/src/errors.ts
+/**
+* Thrown by providers to signal an expected failure the API layer forwards with
+* a specific status. Unknown errors should propagate as plain `Error` and become 500s.
+*/
+var ProviderError = class extends Error {
+	statusCode;
+	constructor(message, statusCode = 400) {
+		super(message);
+		this.name = "ProviderError";
+		this.statusCode = statusCode;
+	}
+};
+//#endregion
+//#region ../platform/src/apiTokens/scope.ts
+/**
+* May this request perform `action` on `target`?
+*
+* Without a target this is an org-level check, which only `all` and org scopes
+* pass: a project key must never reach a route that can't say which project it
+* touches. Requests without an API token always pass; their permissions are
+* checked elsewhere.
+*/
+function scopeAllows(ctx, action, target) {
+	const api = ctx.apiScope;
+	if (!api) return true;
+	return api.scopes.some((s) => actionCovers(s.action, action) && resourceCovers(s, ctx, target));
+}
+function actionCovers(granted, wanted) {
+	return granted === wanted || wanted === "read";
+}
+function resourceCovers(scope, ctx, target) {
+	const { resource } = scope;
+	switch (resource.kind) {
+		case "all": return true;
+		case "org": return resource.id === ctx.actingOrgId;
+		case "project": return target?.projectId === resource.id;
+		case "definition": return target?.definitionId === resource.id;
+	}
+}
+/**
+* Narrow the owner's live context to what the token grants. Only removes
+* rights:
+*
+* - Platform permissions are dropped. Instance authority never rides on a
+*   bearer key, so an operator's leaked key can't reach other tenants.
+* - `apiScope` is attached, which `scopeAllows` reads.
+*
+* Scopes this version can't parse are dropped, so they grant nothing.
+*/
+function narrowApiTokenContext(ctx, token) {
+	if (ctx.actingOrgId !== token.orgId) throw new ProviderError("API token context must act in the token’s org", 500);
+	const scopes = token.scopes.map(parseApiScope).filter((s) => s !== null);
+	return {
+		...ctx,
+		platformPermissions: [],
+		apiScope: {
+			tokenId: token.id,
+			scopes
+		}
+	};
+}
+/**
+* True when an API-token request reaches for something owned by an org other
+* than the token's. A token is bound to one org, so that resource doesn't
+* exist for it, even when the owner belongs to the other org too. Treat it as
+* not found. Session requests are never outside.
+*/
+function outsideTokenOrg(ctx, orgId) {
+	return ctx.apiScope !== void 0 && orgId !== ctx.actingOrgId;
+}
+//#endregion
+//#region ../platform/src/projects/schemas.ts
+var ProjectVisibilitySchema = z.enum([
+	"public",
+	"org",
+	"private",
+	"platform"
+]);
+var ProjectRoleSchema = z.enum([
+	"owner",
+	"editor",
+	"viewer"
+]);
+/** Cross-field check for PATCH flows. Call on the merged post-patch shape. */
+function validateProjectFlags(merged) {
+	const issues = [];
+	if (merged.autoJoinOnUpload && merged.visibility !== "public") issues.push({
+		path: "autoJoinOnUpload",
+		message: "autoJoinOnUpload requires visibility=public"
+	});
+	if (merged.visibility === "platform" && merged.autoJoinOnUpload) issues.push({
+		path: "autoJoinOnUpload",
+		message: "autoJoinOnUpload is not allowed on platform projects"
+	});
+	return issues;
+}
+//#endregion
+//#region ../platform/src/platformProjects/schemas.ts
+var PlatformProjectGranteeTypeSchema = z.enum(["org", "user"]);
+z.object({
+	id: z.string(),
+	projectId: z.string(),
+	granteeType: PlatformProjectGranteeTypeSchema,
+	granteeId: z.string(),
+	canSolve: z.boolean(),
+	createdBy: z.string(),
+	createdAt: z.string()
+});
+//#endregion
+//#region ../platform/src/definitions/types.ts
+var GH_EXTENSIONS = [".gh", ".ghx"];
+var COVER_IMAGE_EXTENSIONS = [
+	".jpg",
+	".jpeg",
+	".png",
+	".webp",
+	".gif"
+];
+[...GH_EXTENSIONS, ...COVER_IMAGE_EXTENSIONS];
+var COVER_IMAGE_CONTENT_TYPES = {
+	".jpg": "image/jpeg",
+	".jpeg": "image/jpeg",
+	".png": "image/png",
+	".webp": "image/webp",
+	".gif": "image/gif"
+};
+function toDefinitionListItem(r) {
+	return {
+		guid: r.guid,
+		projectId: r.projectId,
+		displayName: r.displayName,
+		description: r.description,
+		category: r.category,
+		tags: r.tags,
+		coverImage: r.coverImage,
+		status: r.status,
+		solveCount: r.solveCount,
+		liveVersionId: r.liveVersionId,
+		updatedAt: r.updatedAt
+	};
+}
+var GuidSchema = z.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "Invalid GUID format");
+var DefinitionStatusSchema = z.enum([
+	"draft",
+	"published",
+	"archived"
+]);
+var DefinitionFileExtSchema = z.enum(["gh", "ghx"]);
+z.object({
+	id: GuidSchema,
+	definitionId: GuidSchema,
+	versionNumber: z.number().int().min(1),
+	fileExt: DefinitionFileExtSchema,
+	fileKey: z.string().min(1),
+	originalFilename: z.string().max(256).optional(),
+	uploadedBy: z.string().min(1),
+	uploadedAt: z.string(),
+	changeNote: z.string().max(1e3).optional(),
+	schema: z.record(z.string(), z.unknown()).optional(),
+	schemaExtractedAt: z.string().optional()
+});
+var DefinitionChannelSchema = z.enum(["live", "draft"]);
+/** HTTP-body validator for new-definition input. */
+var CreateDefinitionInputSchema = z.object({
+	displayName: z.string().min(1, "Display name is required").max(256),
+	description: z.string().max(2e3).optional(),
+	coverImage: z.string().max(2048).optional(),
+	category: z.string().max(128).optional(),
+	tags: z.array(z.string().max(64)).max(20).optional(),
+	projectId: GuidSchema,
+	computeServerId: GuidSchema.optional()
+});
+/**
+* PATCH validator. Field semantics match `DefinitionRecordPatch`:
+* - missing / `undefined` — leave unchanged
+* - `null` — clear (only on nullable fields)
+* - value — set
+*/
+var UpdateMetadataInputSchema = z.object({
+	displayName: z.string().min(1, "Display name is required").max(256).optional(),
+	description: z.string().max(2e3).nullable().optional(),
+	coverImage: z.string().max(2048).nullable().optional(),
+	category: z.string().max(128).nullable().optional(),
+	tags: z.array(z.string().max(64)).max(20).nullable().optional(),
+	projectId: GuidSchema.optional(),
+	computeServerId: GuidSchema.nullable().optional(),
+	solveCacheLimit: z.number().int().min(0).max(1e5).nullable().optional(),
+	status: DefinitionStatusSchema.optional()
+});
+/** Body for `POST /api/definitions/[guid]/publish`. */
+var PublishVersionInputSchema = z.object({ versionId: GuidSchema.optional() }).default({});
+//#endregion
+//#region ../platform/src/shareLinks/schemas.ts
+/**
+* HTTP body for `POST /api/definitions/[guid]/share-links`. The route returns
+* the raw token exactly once.
+*/
+var CreateShareLinkInputSchema = z.object({
+	channel: DefinitionChannelSchema.default("live"),
+	name: z.string().max(128).optional(),
+	allowSolve: z.boolean().default(true),
+	/** Null is the minter's deliberate "uncap" choice; omitted applies the default cap. */
+	maxSolves: z.number().int().min(1).nullable().optional(),
+	expiresAt: z.iso.datetime().nullable().optional()
+});
+//#endregion
+//#region ../platform/src/storage/image.ts
+/**
+* Shared image-transcoding helper for `IStorageProvider` implementations.
+* Normalizes uploads to WebP (capped at 1200px, quality 85) so storage,
+* bandwidth, and the viewer path stay predictable.
+*
+* `sharp` is a dynamic import, not a hard dependency of this package —
+* providers that need transcoding install it themselves.
+*/
+var IMAGE_MAX_WIDTH = 1200;
+/** True if the input looks like an image to process — by content type or path extension. */
+function isImageUpload(contentType, storagePath) {
+	if (contentType?.startsWith("image/")) return true;
+	return /\.(webp|png|jpe?g|gif|bmp|tif?f|svg)$/i.test(storagePath);
+}
+/**
+* Rewrites a path's extension to `.webp`; unchanged for non-image extensions.
+* SVG is rasterized like any other input, so no vector blob is ever
+* persisted — served bytes stay XSS-free without a sanitizer.
+*/
+function toWebpPath(storagePath) {
+	return storagePath.replace(/\.(png|jpe?g|gif|bmp|tif?f|svg)$/i, ".webp");
+}
+/**
+* Transcodes images to WebP; passes non-images through unchanged, so
+* providers can call this unconditionally before `put`.
+*
+* Throws if `sharp` isn't installed — a config error, not a fallback.
+*/
+async function transcodeImageIfNeeded(data, contentType, storagePath) {
+	if (!isImageUpload(contentType, storagePath)) return {
+		data,
+		contentType: contentType ?? "application/octet-stream",
+		path: storagePath
+	};
+	const compressed = await (await loadSharp())(Buffer.from(data)).resize({
+		width: IMAGE_MAX_WIDTH,
+		withoutEnlargement: true
+	}).webp({ quality: 85 }).toBuffer();
+	return {
+		data: new Uint8Array(compressed),
+		contentType: "image/webp",
+		path: toWebpPath(storagePath)
+	};
+}
+var cachedSharp = null;
+async function loadSharp() {
+	if (cachedSharp) return cachedSharp;
+	try {
+		const mod = await import('sharp');
+		cachedSharp = mod.default ?? mod;
+		return cachedSharp;
+	} catch (err) {
+		throw new Error("Image transcoding requires `sharp` to be installed. Add it as a dependency in your provider package.", { cause: err });
+	}
+}
+//#endregion
+//#region ../platform/src/storage/assetClasses.ts
+var BRANDING_KINDS = ALL_ORG_ASSET_KINDS.join("|");
+var COVER_EXTS = COVER_IMAGE_EXTENSIONS.map((ext) => ext.replace(/^\./, "").replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|");
+var SAFE_SEGMENT = String.raw`[A-Za-z0-9._-]+`;
+var GUID = String.raw`[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}`;
+/**
+* The closed registry of servable asset classes. Patterns are mutually
+* exclusive by prefix, order doesn't matter. Anything matching no class is
+* unservable (the route 404s) — default-deny, so a new blob type is opt-in.
+*/
+var ASSET_CLASSES = [
+	{
+		id: "org-branding",
+		visibility: "public",
+		scope: "none",
+		pattern: new RegExp(String.raw`^orgs\/(${SAFE_SEGMENT})\/branding\/(?:${BRANDING_KINDS})\.webp$`)
+	},
+	{
+		id: "org-private",
+		visibility: "org",
+		scope: "org",
+		pattern: new RegExp(String.raw`^orgs\/(${SAFE_SEGMENT})\/private\/${SAFE_SEGMENT}$`)
+	},
+	{
+		id: "definition-cover",
+		visibility: "project",
+		scope: "project",
+		pattern: new RegExp(String.raw`^definitions\/(${GUID})\/cover\.(?:${COVER_EXTS})$`, "i")
+	}
+];
+/**
+* Rejects traversal, empty, or backslash segments before a path can match a
+* class. The permissive segment alphabet (`[A-Za-z0-9._-]+`) admits a bare
+* `.` or `..` as a whole segment, which would otherwise let
+* `orgs/../branding/logo.webp` classify as public branding with `..`
+* captured as the orgId. Mirrors `assertSafeKey` on the write side, so a path
+* that can't be written can't be read either.
+*/
+function hasUnsafeSegment(storagePath) {
+	if (storagePath.includes("\\")) return true;
+	for (const segment of storagePath.split("/")) if (segment === "" || segment === "." || segment === "..") return true;
+	return false;
+}
+/**
+* Classifies a storage path into its asset class and scope id, or null when
+* no class matches (or the path is unsafe). `getPublicUrl` and the serving
+* route both consult this so URL generation and authorization never drift
+* apart.
+*
+* `scopeId` is null for `scope: 'none'` classes even when the pattern
+* captures an id (e.g. `org-branding` captures orgId but is public).
+*/
+function classifyAssetPath(storagePath) {
+	if (hasUnsafeSegment(storagePath)) return null;
+	for (const cls of ASSET_CLASSES) {
+		const m = cls.pattern.exec(storagePath);
+		if (!m) continue;
+		return {
+			class: cls,
+			scopeId: cls.scope === "none" ? null : m[1] ?? null
+		};
+	}
+	return null;
+}
+//#endregion
+//#region ../platform/src/context.ts
+/** For server-internal operations outside any HTTP request (bootstrap, janitors, migrations). */
+var SYSTEM_CONTEXT = {
+	userId: "",
+	platformPermissions: [...ALL_PLATFORM_PERMISSIONS],
+	orgPermissions: [...ALL_ORG_PERMISSIONS],
+	system: true
+};
+/**
+* Does not cross-check `ctx.actingOrgId` — the caller must build a context scoped
+* to the org it's acting on. An org permission against a context without
+* `actingOrgId` returns false unless `instance_admin` or `system`.
+*/
+function hasPermission(ctx, permission) {
+	if (ctx.system) return true;
+	if (ctx.platformPermissions.includes("instance_admin")) return true;
+	if (isPlatformPermission(permission)) return ctx.platformPermissions.includes(permission);
+	return ctx.orgPermissions.includes(permission);
+}
+/**
+* An anonymous share-link holder. `system` is true on these contexts for adapter
+* dispatch only — a guard that treats `system` as "fully authorized" must
+* exclude them first.
+*/
+function isShareContext(ctx) {
+	return ctx.shareLinkId !== void 0;
+}
+/**
+* Refuse a privileged operation to a share-link context. Call at the top of any
+* guard whose first line is `if (ctx.system) return` — the token grants one
+* definition on one channel, never instance authority.
+*/
+function assertNotShareContext(ctx, what) {
+	if (isShareContext(ctx)) throw new ProviderError(`Forbidden: a share link cannot ${what}`, 403);
+}
+var PLATFORM_PERMISSION_VALUES = new Set(ALL_PLATFORM_PERMISSIONS);
+function isPlatformPermission(p) {
+	return PLATFORM_PERMISSION_VALUES.has(p);
+}
+
+export { ALL_PLATFORM_PERMISSIONS as A, COVER_IMAGE_CONTENT_TYPES as B, CreateOrgSchema as C, DEFAULT_ORG_PERMISSIONS as D, ORG_MANAGEMENT_PERMISSIONS as E, OWNER_ADMIN_ONLY_PERMISSIONS as F, GH_EXTENSIONS as G, MEMBER_ASSIGNABLE_PERMISSIONS as M, OrgPermissionSchema as O, ProviderError as P, SYSTEM_CONTEXT as S, UpdateOrgSchema as U, ALL_ORG_PERMISSIONS as a, assertNotShareContext as b, classifyAssetPath as c, ProjectVisibilitySchema as d, ProjectRoleSchema as e, PlatformPermissionSchema as f, OrgRoleSchema as g, hasPermission as h, API_TOKEN_LIFETIME_DAYS as i, ApiScopeStringSchema as j, slugify as k, OPERATOR_PLATFORM_PERMISSIONS as l, toDefinitionListItem as m, narrowApiTokenContext as n, outsideTokenOrg as o, CreateDefinitionInputSchema as p, UpdateMetadataInputSchema as q, GuidSchema as r, scopeAllows as s, transcodeImageIfNeeded as t, PublishVersionInputSchema as u, CreateShareLinkInputSchema as v, OrgAssetKindSchema as w, parseApiScope as x, describeApiScope as y, validateProjectFlags as z };
+//# sourceMappingURL=src.js-bYgw0r8C.js.map

package/build/server/chunks/chunks/src.js-bYgw0r8C.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"src.js-bYgw0r8C.js","sources":["../../../../.svelte-kit/output/server/chunks/src.js"],"sourcesContent":["import { z } from \"zod\";\n//#region ../platform/src/permissions/types.ts\n/**\n* Platform-scope permissions. All but `manage_api_tokens` are reserved for\n* Selva staff and instance operators; regular users hold an empty array.\n*\n* - `instance_admin`        — superuser; implies every other permission\n* - `manage_compute`        — configure the instance-wide Rhino.Compute pool\n* - `manage_instance_users` — disable/enable any user on the instance\n* - `manage_updates`        — run system updates\n* - `manage_api_tokens`     — mint API tokens for yourself\n*/\nvar PlatformPermissionSchema = z.enum([\n\t\"instance_admin\",\n\t\"manage_compute\",\n\t\"manage_instance_users\",\n\t\"manage_updates\",\n\t\"manage_api_tokens\"\n]);\nvar ALL_PLATFORM_PERMISSIONS = PlatformPermissionSchema.options;\n/**\n* The permissions that admit someone to the `/admin` operator surface.\n* `manage_api_tokens` is granted to ordinary users, who have no business there.\n*/\nvar OPERATOR_PLATFORM_PERMISSIONS = ALL_PLATFORM_PERMISSIONS.filter((p) => p !== \"manage_api_tokens\");\nvar RESERVED_SLUG_SET = /* @__PURE__ */ new Set([\n\t\"o\",\n\t\"api\",\n\t\"admin\",\n\t\"auth\",\n\t\"login\",\n\t\"logout\",\n\t\"setup\",\n\t\"settings\",\n\t\"team\",\n\t\"library\",\n\t\"projects\",\n\t\"accept-invite\"\n]);\n/**\n* Coerces an arbitrary name into a slug candidate. Does not guarantee a valid\n* slug — an all-symbols name yields `''`, and reserved words pass through\n* untouched — run the result through `SlugSchema` where validity matters.\n*/\nfunction slugify(name) {\n\treturn name.trim().toLowerCase().replace(/[^a-z0-9]+/g, \"-\").replace(/^-|-$/g, \"\").slice(0, 63);\n}\n/** Lowercase alphanumeric with internal hyphens, 3–63 chars, not a reserved word. */\nvar SlugSchema = z.string().min(3, \"Slug must be at least 3 characters\").max(63, \"Slug must be at most 63 characters\").regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/, \"Slug must be lowercase alphanumeric with hyphens (no leading/trailing/consecutive hyphens)\").refine((s) => !RESERVED_SLUG_SET.has(s), { message: \"Slug is reserved and cannot be used\" });\nvar OrgRoleSchema = z.enum([\n\t\"owner\",\n\t\"admin\",\n\t\"member\"\n]);\n/** Kinds of org-scoped branding asset. Adding a kind is a single entry here — path, upload route, store, and UI are all generic over it. */\nvar OrgAssetKindSchema = z.enum([\"logo\", \"favicon\"]);\nvar ALL_ORG_ASSET_KINDS = OrgAssetKindSchema.options;\n/**\n* Org-scope permissions. A user may hold different sets in different orgs.\n*\n* `read_all_org_projects` lets its holder mint an API token that reads and\n* solves every project in the org, including ones they aren't a member of.\n*/\nvar OrgPermissionSchema = z.enum([\n\t\"manage_org_members\",\n\t\"manage_org_compute\",\n\t\"manage_definitions\",\n\t\"manage_projects\",\n\t\"read_all_org_projects\"\n]);\nvar ALL_ORG_PERMISSIONS = OrgPermissionSchema.options;\n/** The permissions that run some part of `/team`. */\nvar ORG_MANAGEMENT_PERMISSIONS = ALL_ORG_PERMISSIONS.filter((p) => p !== \"read_all_org_projects\");\n/** Governance perms — never grantable to `member`. */\nvar OWNER_ADMIN_ONLY_PERMISSIONS = [\"manage_org_members\", \"manage_org_compute\"];\nvar MEMBER_ASSIGNABLE_PERMISSIONS = ALL_ORG_PERMISSIONS.filter((p) => !OWNER_ADMIN_ONLY_PERMISSIONS.includes(p));\n/**\n* Applied when adding a member without an explicit permissions list.\n*\n* `read_all_org_projects` is never a default: a key holding it reads projects\n* its owner isn't a member of, without the audit trail Reclaim leaves.\n*/\nvar DEFAULT_ORG_PERMISSIONS = {\n\towner: [...ORG_MANAGEMENT_PERMISSIONS],\n\tadmin: [...ORG_MANAGEMENT_PERMISSIONS],\n\tmember: []\n};\nvar CreateOrgSchema = z.object({\n\tname: z.string().min(1, \"Organization name is required\").max(128),\n\tslug: SlugSchema\n});\nvar UpdateOrgSchema = CreateOrgSchema.partial();\nz.enum([\n\t\"read\",\n\t\"write\",\n\t\"solve\"\n]);\nvar SCOPE_PATTERN = /^(read|write|solve):(all|(org|project|definition):([A-Za-z0-9_-]{1,128}))$/;\n/** `read:all`, `write:org:<id>`, `solve:project:<id>`, `read:definition:<guid>`. */\nfunction parseApiScope(value) {\n\tconst m = SCOPE_PATTERN.exec(value);\n\tif (!m) return null;\n\tconst action = m[1];\n\tif (m[2] === \"all\") return {\n\t\taction,\n\t\tresource: { kind: \"all\" }\n\t};\n\treturn {\n\t\taction,\n\t\tresource: {\n\t\t\tkind: m[3],\n\t\t\tid: m[4]\n\t\t}\n\t};\n}\n/**\n* Scopes are stored as strings so a new action or resource kind needs no\n* migration. Parsing rejects anything this version doesn't understand, so an\n* unknown scope grants nothing rather than being guessed at.\n*/\nvar ApiScopeStringSchema = z.string().refine((s) => parseApiScope(s) !== null, { message: \"Unknown scope\" });\nz.enum([\n\t\"owner\",\n\t\"admin\",\n\t\"member_removed\",\n\t\"user_disabled\"\n]);\n/** The only lifetimes offered. Expiry is never optional. */\nvar API_TOKEN_LIFETIME_DAYS = [\n\t30,\n\t90,\n\t180\n];\nvar ACTION_WORDS = {\n\tread: \"Read\",\n\twrite: \"Read and change\",\n\tsolve: \"Read and run solves on\"\n};\n/** \"Read and change everything in the org\". Names no ids, so it suits an email. */\nfunction describeApiScope(value) {\n\tconst scope = parseApiScope(value);\n\tif (!scope) return `Unknown scope (${value})`;\n\tconst what = scope.resource.kind === \"project\" ? \"one project\" : scope.resource.kind === \"definition\" ? \"one definition\" : \"everything in the org\";\n\treturn `${ACTION_WORDS[scope.action]} ${what}`;\n}\n//#endregion\n//#region ../platform/src/errors.ts\n/**\n* Thrown by providers to signal an expected failure the API layer forwards with\n* a specific status. Unknown errors should propagate as plain `Error` and become 500s.\n*/\nvar ProviderError = class extends Error {\n\tstatusCode;\n\tconstructor(message, statusCode = 400) {\n\t\tsuper(message);\n\t\tthis.name = \"ProviderError\";\n\t\tthis.statusCode = statusCode;\n\t}\n};\n//#endregion\n//#region ../platform/src/apiTokens/scope.ts\n/**\n* May this request perform `action` on `target`?\n*\n* Without a target this is an org-level check, which only `all` and org scopes\n* pass: a project key must never reach a route that can't say which project it\n* touches. Requests without an API token always pass; their permissions are\n* checked elsewhere.\n*/\nfunction scopeAllows(ctx, action, target) {\n\tconst api = ctx.apiScope;\n\tif (!api) return true;\n\treturn api.scopes.some((s) => actionCovers(s.action, action) && resourceCovers(s, ctx, target));\n}\nfunction actionCovers(granted, wanted) {\n\treturn granted === wanted || wanted === \"read\";\n}\nfunction resourceCovers(scope, ctx, target) {\n\tconst { resource } = scope;\n\tswitch (resource.kind) {\n\t\tcase \"all\": return true;\n\t\tcase \"org\": return resource.id === ctx.actingOrgId;\n\t\tcase \"project\": return target?.projectId === resource.id;\n\t\tcase \"definition\": return target?.definitionId === resource.id;\n\t}\n}\n/**\n* Narrow the owner's live context to what the token grants. Only removes\n* rights:\n*\n* - Platform permissions are dropped. Instance authority never rides on a\n*   bearer key, so an operator's leaked key can't reach other tenants.\n* - `apiScope` is attached, which `scopeAllows` reads.\n*\n* Scopes this version can't parse are dropped, so they grant nothing.\n*/\nfunction narrowApiTokenContext(ctx, token) {\n\tif (ctx.actingOrgId !== token.orgId) throw new ProviderError(\"API token context must act in the token’s org\", 500);\n\tconst scopes = token.scopes.map(parseApiScope).filter((s) => s !== null);\n\treturn {\n\t\t...ctx,\n\t\tplatformPermissions: [],\n\t\tapiScope: {\n\t\t\ttokenId: token.id,\n\t\t\tscopes\n\t\t}\n\t};\n}\n/**\n* True when an API-token request reaches for something owned by an org other\n* than the token's. A token is bound to one org, so that resource doesn't\n* exist for it, even when the owner belongs to the other org too. Treat it as\n* not found. Session requests are never outside.\n*/\nfunction outsideTokenOrg(ctx, orgId) {\n\treturn ctx.apiScope !== void 0 && orgId !== ctx.actingOrgId;\n}\n//#endregion\n//#region ../platform/src/projects/schemas.ts\nvar ProjectVisibilitySchema = z.enum([\n\t\"public\",\n\t\"org\",\n\t\"private\",\n\t\"platform\"\n]);\nvar ProjectRoleSchema = z.enum([\n\t\"owner\",\n\t\"editor\",\n\t\"viewer\"\n]);\n/** Cross-field check for PATCH flows. Call on the merged post-patch shape. */\nfunction validateProjectFlags(merged) {\n\tconst issues = [];\n\tif (merged.autoJoinOnUpload && merged.visibility !== \"public\") issues.push({\n\t\tpath: \"autoJoinOnUpload\",\n\t\tmessage: \"autoJoinOnUpload requires visibility=public\"\n\t});\n\tif (merged.visibility === \"platform\" && merged.autoJoinOnUpload) issues.push({\n\t\tpath: \"autoJoinOnUpload\",\n\t\tmessage: \"autoJoinOnUpload is not allowed on platform projects\"\n\t});\n\treturn issues;\n}\n//#endregion\n//#region ../platform/src/platformProjects/schemas.ts\nvar PlatformProjectGranteeTypeSchema = z.enum([\"org\", \"user\"]);\nz.object({\n\tid: z.string(),\n\tprojectId: z.string(),\n\tgranteeType: PlatformProjectGranteeTypeSchema,\n\tgranteeId: z.string(),\n\tcanSolve: z.boolean(),\n\tcreatedBy: z.string(),\n\tcreatedAt: z.string()\n});\n//#endregion\n//#region ../platform/src/definitions/types.ts\nvar GH_EXTENSIONS = [\".gh\", \".ghx\"];\nvar COVER_IMAGE_EXTENSIONS = [\n\t\".jpg\",\n\t\".jpeg\",\n\t\".png\",\n\t\".webp\",\n\t\".gif\"\n];\n[...GH_EXTENSIONS, ...COVER_IMAGE_EXTENSIONS];\nvar COVER_IMAGE_CONTENT_TYPES = {\n\t\".jpg\": \"image/jpeg\",\n\t\".jpeg\": \"image/jpeg\",\n\t\".png\": \"image/png\",\n\t\".webp\": \"image/webp\",\n\t\".gif\": \"image/gif\"\n};\nfunction toDefinitionListItem(r) {\n\treturn {\n\t\tguid: r.guid,\n\t\tprojectId: r.projectId,\n\t\tdisplayName: r.displayName,\n\t\tdescription: r.description,\n\t\tcategory: r.category,\n\t\ttags: r.tags,\n\t\tcoverImage: r.coverImage,\n\t\tstatus: r.status,\n\t\tsolveCount: r.solveCount,\n\t\tliveVersionId: r.liveVersionId,\n\t\tupdatedAt: r.updatedAt\n\t};\n}\nvar GuidSchema = z.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, \"Invalid GUID format\");\nvar DefinitionStatusSchema = z.enum([\n\t\"draft\",\n\t\"published\",\n\t\"archived\"\n]);\nvar DefinitionFileExtSchema = z.enum([\"gh\", \"ghx\"]);\nz.object({\n\tid: GuidSchema,\n\tdefinitionId: GuidSchema,\n\tversionNumber: z.number().int().min(1),\n\tfileExt: DefinitionFileExtSchema,\n\tfileKey: z.string().min(1),\n\toriginalFilename: z.string().max(256).optional(),\n\tuploadedBy: z.string().min(1),\n\tuploadedAt: z.string(),\n\tchangeNote: z.string().max(1e3).optional(),\n\tschema: z.record(z.string(), z.unknown()).optional(),\n\tschemaExtractedAt: z.string().optional()\n});\nvar DefinitionChannelSchema = z.enum([\"live\", \"draft\"]);\n/** HTTP-body validator for new-definition input. */\nvar CreateDefinitionInputSchema = z.object({\n\tdisplayName: z.string().min(1, \"Display name is required\").max(256),\n\tdescription: z.string().max(2e3).optional(),\n\tcoverImage: z.string().max(2048).optional(),\n\tcategory: z.string().max(128).optional(),\n\ttags: z.array(z.string().max(64)).max(20).optional(),\n\tprojectId: GuidSchema,\n\tcomputeServerId: GuidSchema.optional()\n});\n/**\n* PATCH validator. Field semantics match `DefinitionRecordPatch`:\n* - missing / `undefined` — leave unchanged\n* - `null` — clear (only on nullable fields)\n* - value — set\n*/\nvar UpdateMetadataInputSchema = z.object({\n\tdisplayName: z.string().min(1, \"Display name is required\").max(256).optional(),\n\tdescription: z.string().max(2e3).nullable().optional(),\n\tcoverImage: z.string().max(2048).nullable().optional(),\n\tcategory: z.string().max(128).nullable().optional(),\n\ttags: z.array(z.string().max(64)).max(20).nullable().optional(),\n\tprojectId: GuidSchema.optional(),\n\tcomputeServerId: GuidSchema.nullable().optional(),\n\tsolveCacheLimit: z.number().int().min(0).max(1e5).nullable().optional(),\n\tstatus: DefinitionStatusSchema.optional()\n});\n/** Body for `POST /api/definitions/[guid]/publish`. */\nvar PublishVersionInputSchema = z.object({ versionId: GuidSchema.optional() }).default({});\n//#endregion\n//#region ../platform/src/shareLinks/schemas.ts\n/**\n* HTTP body for `POST /api/definitions/[guid]/share-links`. The route returns\n* the raw token exactly once.\n*/\nvar CreateShareLinkInputSchema = z.object({\n\tchannel: DefinitionChannelSchema.default(\"live\"),\n\tname: z.string().max(128).optional(),\n\tallowSolve: z.boolean().default(true),\n\t/** Null is the minter's deliberate \"uncap\" choice; omitted applies the default cap. */\n\tmaxSolves: z.number().int().min(1).nullable().optional(),\n\texpiresAt: z.iso.datetime().nullable().optional()\n});\n//#endregion\n//#region ../platform/src/storage/image.ts\n/**\n* Shared image-transcoding helper for `IStorageProvider` implementations.\n* Normalizes uploads to WebP (capped at 1200px, quality 85) so storage,\n* bandwidth, and the viewer path stay predictable.\n*\n* `sharp` is a dynamic import, not a hard dependency of this package —\n* providers that need transcoding install it themselves.\n*/\nvar IMAGE_MAX_WIDTH = 1200;\n/** True if the input looks like an image to process — by content type or path extension. */\nfunction isImageUpload(contentType, storagePath) {\n\tif (contentType?.startsWith(\"image/\")) return true;\n\treturn /\\.(webp|png|jpe?g|gif|bmp|tif?f|svg)$/i.test(storagePath);\n}\n/**\n* Rewrites a path's extension to `.webp`; unchanged for non-image extensions.\n* SVG is rasterized like any other input, so no vector blob is ever\n* persisted — served bytes stay XSS-free without a sanitizer.\n*/\nfunction toWebpPath(storagePath) {\n\treturn storagePath.replace(/\\.(png|jpe?g|gif|bmp|tif?f|svg)$/i, \".webp\");\n}\n/**\n* Transcodes images to WebP; passes non-images through unchanged, so\n* providers can call this unconditionally before `put`.\n*\n* Throws if `sharp` isn't installed — a config error, not a fallback.\n*/\nasync function transcodeImageIfNeeded(data, contentType, storagePath) {\n\tif (!isImageUpload(contentType, storagePath)) return {\n\t\tdata,\n\t\tcontentType: contentType ?? \"application/octet-stream\",\n\t\tpath: storagePath\n\t};\n\tconst compressed = await (await loadSharp())(Buffer.from(data)).resize({\n\t\twidth: IMAGE_MAX_WIDTH,\n\t\twithoutEnlargement: true\n\t}).webp({ quality: 85 }).toBuffer();\n\treturn {\n\t\tdata: new Uint8Array(compressed),\n\t\tcontentType: \"image/webp\",\n\t\tpath: toWebpPath(storagePath)\n\t};\n}\nvar cachedSharp = null;\nasync function loadSharp() {\n\tif (cachedSharp) return cachedSharp;\n\ttry {\n\t\tconst mod = await import(\"sharp\");\n\t\tcachedSharp = mod.default ?? mod;\n\t\treturn cachedSharp;\n\t} catch (err) {\n\t\tthrow new Error(\"Image transcoding requires `sharp` to be installed. Add it as a dependency in your provider package.\", { cause: err });\n\t}\n}\n//#endregion\n//#region ../platform/src/storage/assetClasses.ts\nvar BRANDING_KINDS = ALL_ORG_ASSET_KINDS.join(\"|\");\nvar COVER_EXTS = COVER_IMAGE_EXTENSIONS.map((ext) => ext.replace(/^\\./, \"\").replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\")).join(\"|\");\nvar SAFE_SEGMENT = String.raw`[A-Za-z0-9._-]+`;\nvar GUID = String.raw`[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}`;\n/**\n* The closed registry of servable asset classes. Patterns are mutually\n* exclusive by prefix, order doesn't matter. Anything matching no class is\n* unservable (the route 404s) — default-deny, so a new blob type is opt-in.\n*/\nvar ASSET_CLASSES = [\n\t{\n\t\tid: \"org-branding\",\n\t\tvisibility: \"public\",\n\t\tscope: \"none\",\n\t\tpattern: new RegExp(String.raw`^orgs\\/(${SAFE_SEGMENT})\\/branding\\/(?:${BRANDING_KINDS})\\.webp$`)\n\t},\n\t{\n\t\tid: \"org-private\",\n\t\tvisibility: \"org\",\n\t\tscope: \"org\",\n\t\tpattern: new RegExp(String.raw`^orgs\\/(${SAFE_SEGMENT})\\/private\\/${SAFE_SEGMENT}$`)\n\t},\n\t{\n\t\tid: \"definition-cover\",\n\t\tvisibility: \"project\",\n\t\tscope: \"project\",\n\t\tpattern: new RegExp(String.raw`^definitions\\/(${GUID})\\/cover\\.(?:${COVER_EXTS})$`, \"i\")\n\t}\n];\n/**\n* Rejects traversal, empty, or backslash segments before a path can match a\n* class. The permissive segment alphabet (`[A-Za-z0-9._-]+`) admits a bare\n* `.` or `..` as a whole segment, which would otherwise let\n* `orgs/../branding/logo.webp` classify as public branding with `..`\n* captured as the orgId. Mirrors `assertSafeKey` on the write side, so a path\n* that can't be written can't be read either.\n*/\nfunction hasUnsafeSegment(storagePath) {\n\tif (storagePath.includes(\"\\\\\")) return true;\n\tfor (const segment of storagePath.split(\"/\")) if (segment === \"\" || segment === \".\" || segment === \"..\") return true;\n\treturn false;\n}\n/**\n* Classifies a storage path into its asset class and scope id, or null when\n* no class matches (or the path is unsafe). `getPublicUrl` and the serving\n* route both consult this so URL generation and authorization never drift\n* apart.\n*\n* `scopeId` is null for `scope: 'none'` classes even when the pattern\n* captures an id (e.g. `org-branding` captures orgId but is public).\n*/\nfunction classifyAssetPath(storagePath) {\n\tif (hasUnsafeSegment(storagePath)) return null;\n\tfor (const cls of ASSET_CLASSES) {\n\t\tconst m = cls.pattern.exec(storagePath);\n\t\tif (!m) continue;\n\t\treturn {\n\t\t\tclass: cls,\n\t\t\tscopeId: cls.scope === \"none\" ? null : m[1] ?? null\n\t\t};\n\t}\n\treturn null;\n}\n//#endregion\n//#region ../platform/src/context.ts\n/** For server-internal operations outside any HTTP request (bootstrap, janitors, migrations). */\nvar SYSTEM_CONTEXT = {\n\tuserId: \"\",\n\tplatformPermissions: [...ALL_PLATFORM_PERMISSIONS],\n\torgPermissions: [...ALL_ORG_PERMISSIONS],\n\tsystem: true\n};\n/**\n* Does not cross-check `ctx.actingOrgId` — the caller must build a context scoped\n* to the org it's acting on. An org permission against a context without\n* `actingOrgId` returns false unless `instance_admin` or `system`.\n*/\nfunction hasPermission(ctx, permission) {\n\tif (ctx.system) return true;\n\tif (ctx.platformPermissions.includes(\"instance_admin\")) return true;\n\tif (isPlatformPermission(permission)) return ctx.platformPermissions.includes(permission);\n\treturn ctx.orgPermissions.includes(permission);\n}\n/**\n* An anonymous share-link holder. `system` is true on these contexts for adapter\n* dispatch only — a guard that treats `system` as \"fully authorized\" must\n* exclude them first.\n*/\nfunction isShareContext(ctx) {\n\treturn ctx.shareLinkId !== void 0;\n}\n/**\n* Refuse a privileged operation to a share-link context. Call at the top of any\n* guard whose first line is `if (ctx.system) return` — the token grants one\n* definition on one channel, never instance authority.\n*/\nfunction assertNotShareContext(ctx, what) {\n\tif (isShareContext(ctx)) throw new ProviderError(`Forbidden: a share link cannot ${what}`, 403);\n}\nvar PLATFORM_PERMISSION_VALUES = new Set(ALL_PLATFORM_PERMISSIONS);\nfunction isPlatformPermission(p) {\n\treturn PLATFORM_PERMISSION_VALUES.has(p);\n}\n//#endregion\nexport { OWNER_ADMIN_ONLY_PERMISSIONS as A, describeApiScope as C, DEFAULT_ORG_PERMISSIONS as D, CreateOrgSchema as E, slugify as F, ALL_PLATFORM_PERMISSIONS as I, OPERATOR_PLATFORM_PERMISSIONS as L, OrgPermissionSchema as M, OrgRoleSchema as N, MEMBER_ASSIGNABLE_PERMISSIONS as O, UpdateOrgSchema as P, PlatformPermissionSchema as R, ApiScopeStringSchema as S, ALL_ORG_PERMISSIONS as T, narrowApiTokenContext as _, transcodeImageIfNeeded as a, ProviderError as b, GuidSchema as c, COVER_IMAGE_CONTENT_TYPES as d, GH_EXTENSIONS as f, validateProjectFlags as g, ProjectVisibilitySchema as h, classifyAssetPath as i, OrgAssetKindSchema as j, ORG_MANAGEMENT_PERMISSIONS as k, PublishVersionInputSchema as l, ProjectRoleSchema as m, assertNotShareContext as n, CreateShareLinkInputSchema as o, toDefinitionListItem as p, hasPermission as r, CreateDefinitionInputSchema as s, SYSTEM_CONTEXT as t, UpdateMetadataInputSchema as u, outsideTokenOrg as v, parseApiScope as w, API_TOKEN_LIFETIME_DAYS as x, scopeAllows as y };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC,gBAAgB;AACjB,CAAC,gBAAgB;AACjB,CAAC,uBAAuB;AACxB,CAAC,gBAAgB;AACjB,CAAC;AACD,CAAC;AACE,IAAC,wBAAwB,GAAG,wBAAwB,CAAC;AACxD;AACA;AACA;AACA;AACG,IAAC,6BAA6B,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,mBAAmB;AACpG,IAAI,iBAAiB,mBAAmB,IAAI,GAAG,CAAC;AAChD,CAAC,GAAG;AACJ,CAAC,KAAK;AACN,CAAC,OAAO;AACR,CAAC,MAAM;AACP,CAAC,OAAO;AACR,CAAC,QAAQ;AACT,CAAC,OAAO;AACR,CAAC,UAAU;AACX,CAAC,MAAM;AACP,CAAC,SAAS;AACV,CAAC,UAAU;AACX,CAAC;AACD,CAAC,CAAC;AACF;AACA;AACA;AACA;AACA;AACA,SAAS,OAAO,CAAC,IAAI,EAAE;AACvB,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;AAChG;AACA;AACA,IAAI,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,oCAAoC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,oCAAoC,CAAC,CAAC,KAAK,CAAC,iCAAiC,EAAE,4FAA4F,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC;AACvV,IAAC,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC;AAC3B,CAAC,OAAO;AACR,CAAC,OAAO;AACR,CAAC;AACD,CAAC;AACD;AACG,IAAC,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC;AACnD,IAAI,mBAAmB,GAAG,kBAAkB,CAAC,OAAO;AACpD;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC,oBAAoB;AACrB,CAAC,oBAAoB;AACrB,CAAC,oBAAoB;AACrB,CAAC,iBAAiB;AAClB,CAAC;AACD,CAAC;AACE,IAAC,mBAAmB,GAAG,mBAAmB,CAAC;AAC9C;AACG,IAAC,0BAA0B,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,uBAAuB;AAChG;AACG,IAAC,4BAA4B,GAAG,CAAC,oBAAoB,EAAE,oBAAoB;AAC3E,IAAC,6BAA6B,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/G;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,uBAAuB,GAAG;AAC9B,CAAC,KAAK,EAAE,CAAC,GAAG,0BAA0B,CAAC;AACvC,CAAC,KAAK,EAAE,CAAC,GAAG,0BAA0B,CAAC;AACvC,CAAC,MAAM,EAAE;AACT;AACG,IAAC,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;AAC/B,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,+BAA+B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;AAClE,CAAC,IAAI,EAAE;AACP,CAAC;AACE,IAAC,eAAe,GAAG,eAAe,CAAC,OAAO;AAC7C,CAAC,CAAC,IAAI,CAAC;AACP,CAAC,MAAM;AACP,CAAC,OAAO;AACR,CAAC;AACD,CAAC,CAAC;AACF,IAAI,aAAa,GAAG,4EAA4E;AAChG;AACA,SAAS,aAAa,CAAC,KAAK,EAAE;AAC9B,CAAC,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;AACpC,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,IAAI;AACpB,CAAC,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,OAAO;AAC5B,EAAE,MAAM;AACR,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK;AACzB,EAAE;AACF,CAAC,OAAO;AACR,EAAE,MAAM;AACR,EAAE,QAAQ,EAAE;AACZ,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACb,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;AACV;AACA,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,oBAAoB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE;AAC3G,CAAC,CAAC,IAAI,CAAC;AACP,CAAC,OAAO;AACR,CAAC,OAAO;AACR,CAAC,gBAAgB;AACjB,CAAC;AACD,CAAC,CAAC;AACF;AACG,IAAC,uBAAuB,GAAG;AAC9B,CAAC,EAAE;AACH,CAAC,EAAE;AACH,CAAC;AACD;AACA,IAAI,YAAY,GAAG;AACnB,CAAC,IAAI,EAAE,MAAM;AACb,CAAC,KAAK,EAAE,iBAAiB;AACzB,CAAC,KAAK,EAAE;AACR,CAAC;AACD;AACA,SAAS,gBAAgB,CAAC,KAAK,EAAE;AACjC,CAAC,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC;AACnC,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC;AAC9C,CAAC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,GAAG,aAAa,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY,GAAG,gBAAgB,GAAG,uBAAuB;AACnJ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAC/C;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,aAAa,GAAG,cAAc,KAAK,CAAC;AACxC,CAAC,UAAU;AACX,CAAC,WAAW,CAAC,OAAO,EAAE,UAAU,GAAG,GAAG,EAAE;AACxC,EAAE,KAAK,CAAC,OAAO,CAAC;AAChB,EAAE,IAAI,CAAC,IAAI,GAAG,eAAe;AAC7B,EAAE,IAAI,CAAC,UAAU,GAAG,UAAU;AAC9B,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE;AAC1C,CAAC,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ;AACzB,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,IAAI;AACtB,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,cAAc,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;AAChG;AACA,SAAS,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE;AACvC,CAAC,OAAO,OAAO,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM;AAC/C;AACA,SAAS,cAAc,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE;AAC5C,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK;AAC3B,CAAC,QAAQ,QAAQ,CAAC,IAAI;AACtB,EAAE,KAAK,KAAK,EAAE,OAAO,IAAI;AACzB,EAAE,KAAK,KAAK,EAAE,OAAO,QAAQ,CAAC,EAAE,KAAK,GAAG,CAAC,WAAW;AACpD,EAAE,KAAK,SAAS,EAAE,OAAO,MAAM,EAAE,SAAS,KAAK,QAAQ,CAAC,EAAE;AAC1D,EAAE,KAAK,YAAY,EAAE,OAAO,MAAM,EAAE,YAAY,KAAK,QAAQ,CAAC,EAAE;AAChE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE;AAC3C,CAAC,IAAI,GAAG,CAAC,WAAW,KAAK,KAAK,CAAC,KAAK,EAAE,MAAM,IAAI,aAAa,CAAC,+CAA+C,EAAE,GAAG,CAAC;AACnH,CAAC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AACzE,CAAC,OAAO;AACR,EAAE,GAAG,GAAG;AACR,EAAE,mBAAmB,EAAE,EAAE;AACzB,EAAE,QAAQ,EAAE;AACZ,GAAG,OAAO,EAAE,KAAK,CAAC,EAAE;AACpB,GAAG;AACH;AACA,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE;AACrC,CAAC,OAAO,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG,CAAC,WAAW;AAC5D;AACA;AACA;AACG,IAAC,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC,QAAQ;AACT,CAAC,KAAK;AACN,CAAC,SAAS;AACV,CAAC;AACD,CAAC;AACE,IAAC,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;AAC/B,CAAC,OAAO;AACR,CAAC,QAAQ;AACT,CAAC;AACD,CAAC;AACD;AACA,SAAS,oBAAoB,CAAC,MAAM,EAAE;AACtC,CAAC,MAAM,MAAM,GAAG,EAAE;AAClB,CAAC,IAAI,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC;AAC5E,EAAE,IAAI,EAAE,kBAAkB;AAC1B,EAAE,OAAO,EAAE;AACX,EAAE,CAAC;AACH,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,IAAI,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC;AAC9E,EAAE,IAAI,EAAE,kBAAkB;AAC1B,EAAE,OAAO,EAAE;AACX,EAAE,CAAC;AACH,CAAC,OAAO,MAAM;AACd;AACA;AACA;AACA,IAAI,gCAAgC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAC9D,CAAC,CAAC,MAAM,CAAC;AACT,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;AACf,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,WAAW,EAAE,gCAAgC;AAC9C,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;AACtB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM;AACpB,CAAC,CAAC;AACF;AACA;AACG,IAAC,aAAa,GAAG,CAAC,KAAK,EAAE,MAAM;AAClC,IAAI,sBAAsB,GAAG;AAC7B,CAAC,MAAM;AACP,CAAC,OAAO;AACR,CAAC,MAAM;AACP,CAAC,OAAO;AACR,CAAC;AACD,CAAC;AACD,CAAC,GAAG,aAAa,EAAE,GAAG,sBAAsB,CAAC;AAC1C,IAAC,yBAAyB,GAAG;AAChC,CAAC,MAAM,EAAE,YAAY;AACrB,CAAC,OAAO,EAAE,YAAY;AACtB,CAAC,MAAM,EAAE,WAAW;AACpB,CAAC,OAAO,EAAE,YAAY;AACtB,CAAC,MAAM,EAAE;AACT;AACA,SAAS,oBAAoB,CAAC,CAAC,EAAE;AACjC,CAAC,OAAO;AACR,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;AACd,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;AACxB,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW;AAC5B,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW;AAC5B,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ;AACtB,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;AACd,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU;AAC1B,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM;AAClB,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU;AAC1B,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa;AAChC,EAAE,SAAS,EAAE,CAAC,CAAC;AACf,EAAE;AACF;AACG,IAAC,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iEAAiE,EAAE,qBAAqB;AAC1H,IAAI,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC;AACpC,CAAC,OAAO;AACR,CAAC,WAAW;AACZ,CAAC;AACD,CAAC,CAAC;AACF,IAAI,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC,CAAC,MAAM,CAAC;AACT,CAAC,EAAE,EAAE,UAAU;AACf,CAAC,YAAY,EAAE,UAAU;AACzB,CAAC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC,OAAO,EAAE,uBAAuB;AACjC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3B,CAAC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AACjD,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AAC9B,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;AACvB,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AAC3C,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;AACrD,CAAC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ;AACvC,CAAC,CAAC;AACF,IAAI,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACvD;AACG,IAAC,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;AAC3C,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;AACpE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AAC5C,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;AAC5C,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AACzC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;AACrD,CAAC,SAAS,EAAE,UAAU;AACtB,CAAC,eAAe,EAAE,UAAU,CAAC,QAAQ;AACrC,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;AACzC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AAC/E,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AACvD,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AACvD,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AACpD,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AAChE,CAAC,SAAS,EAAE,UAAU,CAAC,QAAQ,EAAE;AACjC,CAAC,eAAe,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AAClD,CAAC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AACxE,CAAC,MAAM,EAAE,sBAAsB,CAAC,QAAQ;AACxC,CAAC;AACD;AACG,IAAC,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE;AACzF;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;AAC1C,CAAC,OAAO,EAAE,uBAAuB,CAAC,OAAO,CAAC,MAAM,CAAC;AACjD,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AACrC,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;AACtC;AACA,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AACzD,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ;AAChD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,eAAe,GAAG,IAAI;AAC1B;AACA,SAAS,aAAa,CAAC,WAAW,EAAE,WAAW,EAAE;AACjD,CAAC,IAAI,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI;AACnD,CAAC,OAAO,wCAAwC,CAAC,IAAI,CAAC,WAAW,CAAC;AAClE;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,UAAU,CAAC,WAAW,EAAE;AACjC,CAAC,OAAO,WAAW,CAAC,OAAO,CAAC,mCAAmC,EAAE,OAAO,CAAC;AACzE;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,sBAAsB,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE;AACtE,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,OAAO;AACtD,EAAE,IAAI;AACN,EAAE,WAAW,EAAE,WAAW,IAAI,0BAA0B;AACxD,EAAE,IAAI,EAAE;AACR,EAAE;AACF,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,SAAS,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AACxE,EAAE,KAAK,EAAE,eAAe;AACxB,EAAE,kBAAkB,EAAE;AACtB,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;AACpC,CAAC,OAAO;AACR,EAAE,IAAI,EAAE,IAAI,UAAU,CAAC,UAAU,CAAC;AAClC,EAAE,WAAW,EAAE,YAAY;AAC3B,EAAE,IAAI,EAAE,UAAU,CAAC,WAAW;AAC9B,EAAE;AACF;AACA,IAAI,WAAW,GAAG,IAAI;AACtB,eAAe,SAAS,GAAG;AAC3B,CAAC,IAAI,WAAW,EAAE,OAAO,WAAW;AACpC,CAAC,IAAI;AACL,EAAE,MAAM,GAAG,GAAG,MAAM,OAAO,OAAO,CAAC;AACnC,EAAE,WAAW,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG;AAClC,EAAE,OAAO,WAAW;AACpB,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,MAAM,IAAI,KAAK,CAAC,sGAAsG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACzI,CAAC;AACD;AACA;AACA;AACA,IAAI,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;AAClD,IAAI,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;AAC7H,IAAI,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC;AAC9C,IAAI,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,4DAA4D,CAAC;AACnF;AACA;AACA;AACA;AACA;AACA,IAAI,aAAa,GAAG;AACpB,CAAC;AACD,EAAE,EAAE,EAAE,cAAc;AACpB,EAAE,UAAU,EAAE,QAAQ;AACtB,EAAE,KAAK,EAAE,MAAM;AACf,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC,gBAAgB,EAAE,cAAc,CAAC,QAAQ,CAAC;AAClG,EAAE;AACF,CAAC;AACD,EAAE,EAAE,EAAE,aAAa;AACnB,EAAE,UAAU,EAAE,KAAK;AACnB,EAAE,KAAK,EAAE,KAAK;AACd,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;AACrF,EAAE;AACF,CAAC;AACD,EAAE,EAAE,EAAE,kBAAkB;AACxB,EAAE,UAAU,EAAE,SAAS;AACvB,EAAE,KAAK,EAAE,SAAS;AAClB,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,GAAG;AACzF;AACA,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,CAAC,WAAW,EAAE;AACvC,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,IAAI;AAC5C,CAAC,KAAK,MAAM,OAAO,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,EAAE,OAAO,IAAI;AACrH,CAAC,OAAO,KAAK;AACb;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,WAAW,EAAE;AACxC,CAAC,IAAI,gBAAgB,CAAC,WAAW,CAAC,EAAE,OAAO,IAAI;AAC/C,CAAC,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE;AAClC,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;AACzC,EAAE,IAAI,CAAC,CAAC,EAAE;AACV,EAAE,OAAO;AACT,GAAG,KAAK,EAAE,GAAG;AACb,GAAG,OAAO,EAAE,GAAG,CAAC,KAAK,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;AAClD,GAAG;AACH,CAAC;AACD,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACG,IAAC,cAAc,GAAG;AACrB,CAAC,MAAM,EAAE,EAAE;AACX,CAAC,mBAAmB,EAAE,CAAC,GAAG,wBAAwB,CAAC;AACnD,CAAC,cAAc,EAAE,CAAC,GAAG,mBAAmB,CAAC;AACzC,CAAC,MAAM,EAAE;AACT;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE;AACxC,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI;AAC5B,CAAC,IAAI,GAAG,CAAC,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,IAAI;AACpE,CAAC,IAAI,oBAAoB,CAAC,UAAU,CAAC,EAAE,OAAO,GAAG,CAAC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC;AAC1F,CAAC,OAAO,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC;AAC/C;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,GAAG,EAAE;AAC7B,CAAC,OAAO,GAAG,CAAC,WAAW,KAAK,MAAM;AAClC;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,GAAG,EAAE,IAAI,EAAE;AAC1C,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,aAAa,CAAC,CAAC,+BAA+B,EAAE,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC;AAChG;AACA,IAAI,0BAA0B,GAAG,IAAI,GAAG,CAAC,wBAAwB,CAAC;AAClE,SAAS,oBAAoB,CAAC,CAAC,EAAE;AACjC,CAAC,OAAO,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC;AACzC;;;;"}

package/build/server/chunks/chunks/state.js-CRby9tkH.js

@@ -0,0 +1,76 @@
+import { g as getContext } from './server.js-eNE8c09e.js';
+import './client.js-D8sOH3yA.js';
+
+//#endregion
+//#region ../../node_modules/.pnpm/@sveltejs+kit@2.70.3_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.3.1_svelte_9172e0e9363bf3f5d5e1b1085ec23abb/node_modules/@sveltejs/kit/src/runtime/app/state/server.js
+function context() {
+	return getContext("__request__");
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@sveltejs+kit@2.70.3_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.3.1_svelte_9172e0e9363bf3f5d5e1b1085ec23abb/node_modules/@sveltejs/kit/src/runtime/app/state/index.js
+/**
+* A read-only reactive object with information about the current page, serving several use cases:
+* - retrieving the combined `data` of all pages/layouts anywhere in your component tree (also see [loading data](https://svelte.dev/docs/kit/load))
+* - retrieving the current value of the `form` prop anywhere in your component tree (also see [form actions](https://svelte.dev/docs/kit/form-actions))
+* - retrieving the page state that was set through `goto`, `pushState` or `replaceState` (also see [goto](https://svelte.dev/docs/kit/$app-navigation#goto) and [shallow routing](https://svelte.dev/docs/kit/shallow-routing))
+* - retrieving metadata such as the URL you're on, the current route and its parameters, and whether or not there was an error
+*
+* ```svelte
+* <!--- file: +layout.svelte --->
+* <script>
+* 	import { page } from '$app/state';
+* <\/script>
+*
+* <p>Currently at {page.url.pathname}</p>
+*
+* {#if page.error}
+* 	<span class="red">Problem detected</span>
+* {:else}
+* 	<span class="small">All systems operational</span>
+* {/if}
+* ```
+*
+* Changes to `page` are available exclusively with runes. (The legacy reactivity syntax will not reflect any changes)
+*
+* ```svelte
+* <!--- file: +page.svelte --->
+* <script>
+* 	import { page } from '$app/state';
+* 	const id = $derived(page.params.id); // This will correctly update id for usage on this page
+* 	$: badId = page.params.id; // Do not use; will never update after initial load
+* <\/script>
+* ```
+*
+* On the server, values can only be read during rendering (in other words _not_ in e.g. `load` functions). In the browser, the values can be read at any time.
+*
+* @type {import('@sveltejs/kit').Page}
+*/
+var page = {
+	get data() {
+		return context().page.data;
+	},
+	get error() {
+		return context().page.error;
+	},
+	get form() {
+		return context().page.form;
+	},
+	get params() {
+		return context().page.params;
+	},
+	get route() {
+		return context().page.route;
+	},
+	get state() {
+		return context().page.state;
+	},
+	get status() {
+		return context().page.status;
+	},
+	get url() {
+		return context().page.url;
+	}
+};
+
+export { page as p };
+//# sourceMappingURL=state.js-CRby9tkH.js.map