@selvajs/selva 4.20.0-beta.0 → 4.20.0-beta.2

package/build/server/chunks/chunks/compute.js-HEQmvD6j.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"compute.js-HEQmvD6j.js","sources":["../../../../.svelte-kit/output/server/chunks/compute.js"],"sourcesContent":["import \"./src.js\";\nimport { d as NoopLogger } from \"./definitions.js\";\nimport { o as resolveServerForOrg$1 } from \"./limits.js\";\nimport { M as ApiErrorCode, N as apiError } from \"./access.js\";\nimport { b as ComputeServerUnconfiguredError } from \"./api.js\";\nimport { lookup } from \"node:dns/promises\";\nimport { isIP } from \"node:net\";\n//#region ../server/src/compute/safe-url.ts\n/**\n* SSRF guard for the remote-definition fetch. Without it an authenticated user\n* could submit `http://169.254.169.254/...` (cloud metadata) or any intranet\n* endpoint and the server would fetch it on their behalf.\n*\n* Two layers:\n*\n*   1. `isSafeRemoteDefinitionUrl` — synchronous, DNS-free literal filter.\n*      Rejects the protocol, hostname literals, and every IP *encoding* that\n*      maps to a blocked address: dotted-decimal, integer, octal, hex,\n*      short-form, IPv4-mapped IPv6.\n*   2. `assertSafeRemoteDefinitionUrl` — resolves the hostname and re-checks the\n*      *resolved* IP, catching a public name that points at a private one.\n*\n* Neither is bulletproof against DNS rebinding — the IP can change between our\n* lookup and fetch's own. Closing that needs the caller to connect to the\n* resolved IP directly, a much larger change; these two layers close the\n* bypasses an attacker actually reaches for (literal encodings, and a public\n* name whose record points inward).\n*/\n/**\n* True when `ip` (a normalized IPv4 or IPv6 literal from `isIP`/`dns.lookup`)\n* is loopback, private, link-local, or otherwise must-not-fetch. IPv4-mapped\n* IPv6 (`::ffff:a.b.c.d`) is unwrapped first so the v4 rules apply.\n*/\nfunction isBlockedIp(ip) {\n\tlet addr = ip.toLowerCase();\n\tconst mappedDotted = /^::ffff:(\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})$/.exec(addr);\n\tif (mappedDotted) addr = mappedDotted[1];\n\telse {\n\t\tconst mappedHex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(addr);\n\t\tif (mappedHex) {\n\t\t\tconst hi = parseInt(mappedHex[1], 16);\n\t\t\tconst lo = parseInt(mappedHex[2], 16);\n\t\t\taddr = [\n\t\t\t\thi >> 8 & 255,\n\t\t\t\thi & 255,\n\t\t\t\tlo >> 8 & 255,\n\t\t\t\tlo & 255\n\t\t\t].join(\".\");\n\t\t}\n\t}\n\tif (isIP(addr) === 4) {\n\t\tconst octets = addr.split(\".\").map(Number);\n\t\tif (octets.length !== 4 || octets.some((o) => o > 255)) return true;\n\t\tconst [a, b] = octets;\n\t\tif (a === 0) return true;\n\t\tif (a === 127) return true;\n\t\tif (a === 10) return true;\n\t\tif (a === 192 && b === 168) return true;\n\t\tif (a === 172 && b >= 16 && b <= 31) return true;\n\t\tif (a === 169 && b === 254) return true;\n\t\treturn false;\n\t}\n\tif (addr === \"::1\" || addr === \"::\") return true;\n\tif (/^(fc|fd)[0-9a-f]{0,2}:/.test(addr)) return true;\n\tif (/^fe[89ab][0-9a-f]:/.test(addr)) return true;\n\treturn false;\n}\n/**\n* Parse a bare-IPv4 hostname in any encoding browsers/glibc accept — integer\n* (`2130706433`), octal (`0177.0.0.1`), hex (`0x7f000001`), and short forms\n* (`127.1`) — into canonical dotted-decimal. An already-valid dotted-quad comes\n* back unchanged. Returns null only when the host is not a numeric IPv4 literal\n* at all, i.e. it's a real name — which is what callers use to decide whether\n* DNS resolution is needed.\n*/\nfunction canonicalizeNumericIpv4(host) {\n\tif (isIP(host) === 4) return host;\n\tconst rawParts = host.split(\".\");\n\tif (rawParts.length === 0 || rawParts.length > 4) return null;\n\tconst parseUInt = (s) => {\n\t\tif (s === \"\") return null;\n\t\tlet n;\n\t\tif (/^0x[0-9a-f]+$/i.test(s)) n = parseInt(s, 16);\n\t\telse if (/^0[0-7]+$/.test(s)) n = parseInt(s, 8);\n\t\telse if (/^[0-9]+$/.test(s)) n = parseInt(s, 10);\n\t\telse return null;\n\t\treturn Number.isFinite(n) ? n : null;\n\t};\n\tconst nums = rawParts.map(parseUInt);\n\tif (nums.some((n) => n === null)) return null;\n\tconst parts = nums;\n\tlet value;\n\tswitch (parts.length) {\n\t\tcase 1:\n\t\t\tvalue = parts[0];\n\t\t\tbreak;\n\t\tcase 2:\n\t\t\tif (parts[0] > 255 || parts[1] > 16777215) return null;\n\t\t\tvalue = parts[0] << 24 | parts[1];\n\t\t\tbreak;\n\t\tcase 3:\n\t\t\tif (parts[0] > 255 || parts[1] > 255 || parts[2] > 65535) return null;\n\t\t\tvalue = parts[0] << 24 | parts[1] << 16 | parts[2];\n\t\t\tbreak;\n\t\tdefault:\n\t\t\tif (parts.some((p) => p > 255)) return null;\n\t\t\tvalue = parts[0] << 24 | parts[1] << 16 | parts[2] << 8 | parts[3];\n\t}\n\tvalue = value >>> 0;\n\tif (value > 4294967295) return null;\n\treturn [\n\t\tvalue >>> 24 & 255,\n\t\tvalue >>> 16 & 255,\n\t\tvalue >>> 8 & 255,\n\t\tvalue & 255\n\t].join(\".\");\n}\n/**\n* Synchronous literal pre-filter: rejects bad schemes, loopback hostnames, and\n* any IP literal (in any encoding) that maps to a blocked address. Does NOT\n* perform DNS — a public *name* that points at a private IP passes here and is\n* caught only by `assertSafeRemoteDefinitionUrl`.\n*/\nfunction isSafeRemoteDefinitionUrl(raw) {\n\tlet parsed;\n\ttry {\n\t\tparsed = new URL(raw);\n\t} catch {\n\t\treturn false;\n\t}\n\tif (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") return false;\n\tlet host = parsed.hostname.toLowerCase();\n\tif (!host) return false;\n\tif (host === \"localhost\" || host.endsWith(\".localhost\")) return false;\n\tif (host.startsWith(\"[\") && host.endsWith(\"]\")) host = host.slice(1, -1);\n\tif (isIP(host) === 6) return !isBlockedIp(host);\n\tconst canonical = canonicalizeNumericIpv4(host);\n\tif (canonical) return !isBlockedIp(canonical);\n\treturn true;\n}\n/**\n* True when `raw` targets the link-local range (`169.254.0.0/16`), which\n* carries the cloud metadata service at `169.254.169.254` — the endpoint that\n* hands out a host's own IAM credentials to anything on the box.\n*\n* A far narrower judgement than {@link isSafeRemoteDefinitionUrl}, for the one\n* caller that must tolerate private addresses: an operator's own compute server\n* legitimately lives on `localhost` or a LAN, so blocking RFC1918 there would\n* reject the ordinary self-hosted layout. Nothing legitimate is ever reached\n* over link-local, so this stays blocked with no opt-out.\n*\n* Shares `canonicalizeNumericIpv4`, so the encodings that bypass a naive string\n* comparison — `http://2852039166/`, `http://0251.0376.0251.0376/`,\n* `http://0xa9fea9fe/` — all resolve to the same verdict.\n*/\nfunction isLinkLocalUrl(raw) {\n\tlet host;\n\ttry {\n\t\thost = new URL(raw).hostname.toLowerCase();\n\t} catch {\n\t\treturn false;\n\t}\n\tif (!host) return false;\n\tif (host.startsWith(\"[\") && host.endsWith(\"]\")) host = host.slice(1, -1);\n\tif (isIP(host) === 6) return /^fe[89ab][0-9a-f]:/.test(host);\n\tconst canonical = canonicalizeNumericIpv4(host);\n\tif (!canonical) return false;\n\tconst [a, b] = canonical.split(\".\").map(Number);\n\treturn a === 169 && b === 254;\n}\n/**\n* Full SSRF check: literal pre-filter, then resolve every A/AAAA record and\n* reject if *any* resolved IP is blocked. Returns the original URL on success\n* so callers can `await assertSafeRemoteDefinitionUrl(url)` inline.\n*\n* Every rejection throws the same generic message so the caller gets no oracle;\n* which host was blocked and by which layer is logged server-side instead.\n*/\nasync function assertSafeRemoteDefinitionUrl(raw, logger = new NoopLogger()) {\n\tif (!isSafeRemoteDefinitionUrl(raw)) {\n\t\tlogger.warn(\"Blocked remote definition URL\", {\n\t\t\tcomponent: \"Compute/ssrf\",\n\t\t\treason: \"literal-filter\",\n\t\t\thost: hostOf(raw)\n\t\t});\n\t\tthrow new Error(\"Remote definition URL is not allowed\");\n\t}\n\tconst host = new URL(raw).hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n\tif (isIP(host) !== 0 || canonicalizeNumericIpv4(host)) return raw;\n\tlet resolved;\n\ttry {\n\t\tresolved = await lookup(host, { all: true });\n\t} catch {\n\t\tlogger.warn(\"Blocked remote definition URL\", {\n\t\t\tcomponent: \"Compute/ssrf\",\n\t\t\treason: \"dns-lookup-failed\",\n\t\t\thost\n\t\t});\n\t\tthrow new Error(\"Remote definition URL is not allowed\");\n\t}\n\tif (resolved.length === 0 || resolved.some((r) => isBlockedIp(r.address))) {\n\t\tconst blocked = resolved.filter((r) => isBlockedIp(r.address)).map((r) => r.address);\n\t\tlogger.warn(\"Blocked remote definition URL\", {\n\t\t\tcomponent: \"Compute/ssrf\",\n\t\t\treason: \"resolves-to-blocked-ip\",\n\t\t\thost,\n\t\t\tblockedIps: blocked\n\t\t});\n\t\tthrow new Error(\"Remote definition URL is not allowed\");\n\t}\n\treturn raw;\n}\n/** Best-effort hostname for logging; falls back to a truncated raw string. */\nfunction hostOf(raw) {\n\ttry {\n\t\treturn new URL(raw).hostname;\n\t} catch {\n\t\treturn raw.slice(0, 120);\n\t}\n}\n//#endregion\n//#region ../server/src/compute/remote-definition.ts\n/**\n* Remote-definition fetch: SSRF-guarded, size-capped, timed, and TTL-cached.\n*\n* A solve can reference its `.gh` by remote URL instead of a stored blob, and\n* that URL is attacker-controllable — a share-token caller supplies\n* `definitionUrl`. Hence {@link assertSafeRemoteDefinitionUrl}, the early size\n* cap, and the deadline.\n*/\n/** Once the cache exceeds this many entries, evict the oldest 10 by `fetchedAt`. */\nvar CACHE_MAX_ENTRIES = 50;\nvar CACHE_EVICT_BATCH = 10;\n/**\n* Read a response body into memory, aborting (and throwing) as soon as the\n* running byte total exceeds `maxBytes`. Falls back to `arrayBuffer()` only when\n* the body isn't a readable stream (older fetch impls).\n*/\nasync function readBodyWithCap(response, maxBytes, controller) {\n\tif (!response.body) {\n\t\tconst buffer = await response.arrayBuffer();\n\t\tif (buffer.byteLength > maxBytes) throw new Error(\"Remote definition exceeds size limit\");\n\t\treturn new Uint8Array(buffer);\n\t}\n\tconst reader = response.body.getReader();\n\tconst chunks = [];\n\tlet total = 0;\n\twhile (true) {\n\t\tconst { done, value } = await reader.read();\n\t\tif (done) break;\n\t\ttotal += value.byteLength;\n\t\tif (total > maxBytes) {\n\t\t\tcontroller.abort();\n\t\t\tthrow new Error(\"Remote definition exceeds size limit\");\n\t\t}\n\t\tchunks.push(value);\n\t}\n\tconst out = new Uint8Array(total);\n\tlet offset = 0;\n\tfor (const chunk of chunks) {\n\t\tout.set(chunk, offset);\n\t\toffset += chunk.byteLength;\n\t}\n\treturn out;\n}\n/**\n* Build a remote-definition fetcher owning its own TTL cache. Each fetcher's\n* cache is independent, so one per process shares warm bytes while test fetchers\n* stay isolated.\n*/\nfunction createRemoteDefinitionFetcher(config) {\n\tconst cache = /* @__PURE__ */ new Map();\n\tconst logger = config.logger ?? new NoopLogger();\n\treturn { async load(url) {\n\t\tawait assertSafeRemoteDefinitionUrl(url, logger);\n\t\tconst now = config.now();\n\t\tconst cached = cache.get(url);\n\t\tif (cached && now - cached.fetchedAt < config.cacheTtlMs) return cached.data;\n\t\tconst controller = new AbortController();\n\t\tconst timeout = setTimeout(() => controller.abort(), config.fetchTimeoutMs);\n\t\tlet data;\n\t\ttry {\n\t\t\tconst response = await fetch(url, {\n\t\t\t\tsignal: controller.signal,\n\t\t\t\tredirect: \"error\"\n\t\t\t});\n\t\t\tif (!response.ok) throw new Error(`HTTP ${response.status}: ${response.statusText}`);\n\t\t\tconst declared = Number(response.headers.get(\"content-length\"));\n\t\t\tif (Number.isFinite(declared) && declared > config.maxBytes) throw new Error(\"Remote definition exceeds size limit\");\n\t\t\tdata = await readBodyWithCap(response, config.maxBytes, controller);\n\t\t} finally {\n\t\t\tclearTimeout(timeout);\n\t\t}\n\t\tcache.set(url, {\n\t\t\tdata,\n\t\t\tfetchedAt: now\n\t\t});\n\t\tif (cache.size > CACHE_MAX_ENTRIES) {\n\t\t\tconst entries = Array.from(cache.entries());\n\t\t\tentries.sort((a, b) => a[1].fetchedAt - b[1].fetchedAt);\n\t\t\tfor (let i = 0; i < CACHE_EVICT_BATCH; i++) cache.delete(entries[i][0]);\n\t\t}\n\t\treturn data;\n\t} };\n}\n//#endregion\n//#region ../server/src/compute/resolve-server.ts\n/**\n* Pick the right Rhino.Compute server for an (org, definition) pair.\n*\n* Resolution order, narrowest wins:\n*   1. `definitionPin` if it points at a server visible to `orgId`.\n*   2. `orgDefaults[orgId]` if set and visible.\n*   3. Global `defaultServerId`.\n*\n* The store returns the full config; the visibility predicate runs in the pure\n* helper so callers don't reimplement it. Re-throws the pure helper's \"nothing\n* visible\" failure as a typed `ComputeServerUnconfiguredError`.\n*\n* Reads a key-free config and fetches the `apiKey` only for the server that\n* actually wins, instead of decrypting every configured server's key to use\n* exactly one of them.\n*/\nasync function resolveServerForOrg(ctx, orgId, store, opts = {}) {\n\tconst config = await store.getConfig(ctx);\n\tlet server;\n\ttry {\n\t\tserver = resolveServerForOrg$1(config, orgId, { definitionPin: opts.definitionPin });\n\t} catch (err) {\n\t\tthrow new ComputeServerUnconfiguredError(err instanceof Error ? err.message : void 0);\n\t}\n\tif (!server.hasApiKey) return server;\n\treturn {\n\t\t...server,\n\t\tapiKey: await store.getServerApiKey(ctx, server.id)\n\t};\n}\n//#endregion\n//#region ../server/src/compute/server-config-write.ts\n/**\n* Shared write-path rules for compute server config.\n*\n* Two routes accept a server set: `/api/admin/compute` (platform scope,\n* `manage_compute`) and `/api/v1/orgs/{orgId}/compute` (org scope,\n* `manage_org_compute`). They differ in who may call them, what extra fields\n* they carry (`sharedWith` vs `ownerOrgId`), and how they validate the default\n* selection — but the field validation and the apiKey merge below must behave\n* identically in both, so they live here rather than in either handler.\n*\n* The apiKey merge is why this file exists: if the two copies disagree, a\n* stored credential silently gets cleared or leaked, and nothing fails at\n* build time.\n*/\n/**\n* A stored `serverUrl` is fetched server-side on every status probe, every\n* purge/shutdown action, and every solve, so an unfiltered one is an SSRF\n* primitive handed to whoever holds `manage_compute`. Two rules:\n*\n*   - Scheme allowlist: `http`/`https`. `file:`, `gopher:` and friends are never\n*     a Rhino.Compute endpoint.\n*   - Link-local (`169.254.0.0/16`) is refused. That range carries the cloud\n*     metadata service at `169.254.169.254`, which hands out the host's own IAM\n*     credentials to anything running on the box.\n*\n* **Loopback and RFC1918 are deliberately allowed.** Running compute on\n* `localhost:6500` or a LAN box is the ordinary self-hosted layout, not an\n* attack — most deployments reach their compute server over exactly those\n* addresses. Blocking them by default would break those instances on upgrade\n* and push every operator toward an opt-out flag, and a guard that everyone\n* disables protects nobody. So the check is narrowed to the range where no\n* legitimate compute server ever lives.\n*\n* What this does not stop: a privileged admin pointing the app at an internal\n* host to probe it. That is a real but much weaker concern than credential\n* theft, it needs `manage_compute` already, and it is inseparable from the\n* legitimate case. Revisit if `manage_org_compute` is ever delegated widely on\n* a multi-tenant instance.\n*\n* `isLinkLocalUrl` is reused rather than hand-rolled because a string compare\n* against `169.254.169.254` misses the encodings that reach the same address:\n* `http://2852039166/`, `http://0xa9fea9fe/`, `http://0251.0376.0251.0376/`.\n*/\nfunction assertUsableServerUrl(serverUrl) {\n\tlet parsed;\n\ttry {\n\t\tparsed = new URL(serverUrl);\n\t} catch {\n\t\tapiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid serverUrl: ${serverUrl}`);\n\t}\n\tif (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") apiError(400, ApiErrorCode.VALIDATION_FAILED, `serverUrl must use http or https: ${serverUrl}`);\n\tif (isLinkLocalUrl(serverUrl)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `serverUrl points at the link-local range, which carries the cloud metadata service: ${serverUrl}`);\n}\n/**\n* Validates the scope-independent fields of every submitted server. Throws the\n* first failure as a 400; scope-specific fields (`sharedWith`, `ownerOrgId`)\n* are the caller's business.\n*/\nfunction validateIncomingServers(servers) {\n\tfor (const s of servers) {\n\t\tif (!s.id || typeof s.id !== \"string\") apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Each server needs an id\");\n\t\tif (!s.label || typeof s.label !== \"string\") apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Each server needs a label\");\n\t\tif (!s.serverUrl || typeof s.serverUrl !== \"string\") apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Each server needs a serverUrl\");\n\t\tassertUsableServerUrl(s.serverUrl);\n\t\tif (s.apiKey !== void 0 && s.apiKey !== null && typeof s.apiKey !== \"string\") apiError(400, ApiErrorCode.VALIDATION_FAILED, \"apiKey must be a string, null, or omitted\");\n\t}\n}\n/**\n* The UI never receives stored keys — it sends back `hasApiKey` and omits the\n* field for servers the operator didn't touch. So \"omitted\" cannot mean \"clear\":\n* it has to preserve, or every save through the settings form would wipe the\n* keys of every server the operator left alone. Clearing is explicit (`null`);\n* an empty string is treated as \"not provided\" since that's what an untouched\n* password input submits.\n*/\nfunction resolveApiKey(submitted, storedKey) {\n\tif (submitted === null) return void 0;\n\treturn submitted ? submitted : storedKey;\n}\n/**\n* Builds the id → stored-key lookup the merge reads. The caller passes only the\n* servers in its own scope, so one scope's write can never resolve a key from\n* another's rows.\n*/\nfunction storedKeysById(scopedServers) {\n\treturn new Map(scopedServers.map((s) => [s.id, s.apiKey]));\n}\n//#endregion\nexport { createRemoteDefinitionFetcher as a, resolveServerForOrg as i, storedKeysById as n, validateIncomingServers as r, resolveApiKey as t };\n"],"names":[],"mappings":";;;;;;;;AAOA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,WAAW,CAAC,EAAE,EAAE;AACzB,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,WAAW,EAAE;AAC5B,CAAC,MAAM,YAAY,GAAG,+CAA+C,CAAC,IAAI,CAAC,IAAI,CAAC;AAChF,CAAC,IAAI,YAAY,EAAE,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC;AACzC,MAAM;AACN,EAAE,MAAM,SAAS,GAAG,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC;AACzE,EAAE,IAAI,SAAS,EAAE;AACjB,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACxC,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACxC,GAAG,IAAI,GAAG;AACV,IAAI,EAAE,IAAI,CAAC,GAAG,GAAG;AACjB,IAAI,EAAE,GAAG,GAAG;AACZ,IAAI,EAAE,IAAI,CAAC,GAAG,GAAG;AACjB,IAAI,EAAE,GAAG;AACT,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACd,EAAE;AACF,CAAC;AACD,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;AACvB,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;AAC5C,EAAE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,EAAE,OAAO,IAAI;AACrE,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM;AACvB,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,IAAI;AAC1B,EAAE,IAAI,CAAC,KAAK,GAAG,EAAE,OAAO,IAAI;AAC5B,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,OAAO,IAAI;AAC3B,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,OAAO,IAAI;AACzC,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,IAAI;AAClD,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,OAAO,IAAI;AACzC,EAAE,OAAO,KAAK;AACd,CAAC;AACD,CAAC,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI,EAAE,OAAO,IAAI;AACjD,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,IAAI;AACrD,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,IAAI;AACjD,CAAC,OAAO,KAAK;AACb;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,uBAAuB,CAAC,IAAI,EAAE;AACvC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,IAAI;AAClC,CAAC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;AACjC,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,OAAO,IAAI;AAC9D,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK;AAC1B,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,OAAO,IAAI;AAC3B,EAAE,IAAI,CAAC;AACP,EAAE,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC;AACnD,OAAO,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;AAClD,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC;AAClD,OAAO,OAAO,IAAI;AAClB,EAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI;AACtC,CAAC,CAAC;AACF,CAAC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;AACrC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,EAAE,OAAO,IAAI;AAC9C,CAAC,MAAM,KAAK,GAAG,IAAI;AACnB,CAAC,IAAI,KAAK;AACV,CAAC,QAAQ,KAAK,CAAC,MAAM;AACrB,EAAE,KAAK,CAAC;AACR,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC;AACnB,GAAG;AACH,EAAE,KAAK,CAAC;AACR,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,EAAE,OAAO,IAAI;AACzD,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;AACpC,GAAG;AACH,EAAE,KAAK,CAAC;AACR,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,OAAO,IAAI;AACxE,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;AACrD,GAAG;AACH,EAAE;AACF,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,EAAE,OAAO,IAAI;AAC9C,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;AACrE;AACA,CAAC,KAAK,GAAG,KAAK,KAAK,CAAC;AACpB,CAAC,IAAI,KAAK,GAAG,UAAU,EAAE,OAAO,IAAI;AACpC,CAAC,OAAO;AACR,EAAE,KAAK,KAAK,EAAE,GAAG,GAAG;AACpB,EAAE,KAAK,KAAK,EAAE,GAAG,GAAG;AACpB,EAAE,KAAK,KAAK,CAAC,GAAG,GAAG;AACnB,EAAE,KAAK,GAAG;AACV,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,yBAAyB,CAAC,GAAG,EAAE;AACxC,CAAC,IAAI,MAAM;AACX,CAAC,IAAI;AACL,EAAE,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC;AACvB,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD,CAAC,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,OAAO,KAAK;AAC9E,CAAC,IAAI,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE;AACzC,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,KAAK;AACxB,CAAC,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,KAAK;AACtE,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;AACzE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;AAChD,CAAC,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,CAAC;AAChD,CAAC,IAAI,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC;AAC9C,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,GAAG,EAAE;AAC7B,CAAC,IAAI,IAAI;AACT,CAAC,IAAI;AACL,EAAE,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE;AAC5C,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,KAAK;AACxB,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;AACzE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;AAC7D,CAAC,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,CAAC;AAChD,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,KAAK;AAC7B,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;AAChD,CAAC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;AAC9B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,6BAA6B,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,UAAU,EAAE,EAAE;AAC7E,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,EAAE;AACtC,EAAE,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;AAC/C,GAAG,SAAS,EAAE,cAAc;AAC5B,GAAG,MAAM,EAAE,gBAAgB;AAC3B,GAAG,IAAI,EAAE,MAAM,CAAC,GAAG;AACnB,GAAG,CAAC;AACJ,EAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC;AACzD,CAAC;AACD,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;AACzE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG;AAClE,CAAC,IAAI,QAAQ;AACb,CAAC,IAAI;AACL,EAAE,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AAC9C,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;AAC/C,GAAG,SAAS,EAAE,cAAc;AAC5B,GAAG,MAAM,EAAE,mBAAmB;AAC9B,GAAG;AACH,GAAG,CAAC;AACJ,EAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC;AACzD,CAAC;AACD,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE;AAC5E,EAAE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACtF,EAAE,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;AAC/C,GAAG,SAAS,EAAE,cAAc;AAC5B,GAAG,MAAM,EAAE,wBAAwB;AACnC,GAAG,IAAI;AACP,GAAG,UAAU,EAAE;AACf,GAAG,CAAC;AACJ,EAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC;AACzD,CAAC;AACD,CAAC,OAAO,GAAG;AACX;AACA;AACA,SAAS,MAAM,CAAC,GAAG,EAAE;AACrB,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ;AAC9B,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;AAC1B,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,iBAAiB,GAAG,EAAE;AAC1B,IAAI,iBAAiB,GAAG,EAAE;AAC1B;AACA;AACA;AACA;AACA;AACA,eAAe,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE;AAC/D,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;AACrB,EAAE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE;AAC7C,EAAE,IAAI,MAAM,CAAC,UAAU,GAAG,QAAQ,EAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC;AAC3F,EAAE,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC;AAC/B,CAAC;AACD,CAAC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE;AACzC,CAAC,MAAM,MAAM,GAAG,EAAE;AAClB,CAAC,IAAI,KAAK,GAAG,CAAC;AACd,CAAC,OAAO,IAAI,EAAE;AACd,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE;AAC7C,EAAE,IAAI,IAAI,EAAE;AACZ,EAAE,KAAK,IAAI,KAAK,CAAC,UAAU;AAC3B,EAAE,IAAI,KAAK,GAAG,QAAQ,EAAE;AACxB,GAAG,UAAU,CAAC,KAAK,EAAE;AACrB,GAAG,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC;AAC1D,EAAE;AACF,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AACD,CAAC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC;AAClC,CAAC,IAAI,MAAM,GAAG,CAAC;AACf,CAAC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE;AAC7B,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC;AACxB,EAAE,MAAM,IAAI,KAAK,CAAC,UAAU;AAC5B,CAAC;AACD,CAAC,OAAO,GAAG;AACX;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,6BAA6B,CAAC,MAAM,EAAE;AAC/C,CAAC,MAAM,KAAK,mBAAmB,IAAI,GAAG,EAAE;AACxC,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,UAAU,EAAE;AACjD,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,GAAG,EAAE;AAC1B,EAAE,MAAM,6BAA6B,CAAC,GAAG,EAAE,MAAM,CAAC;AAClD,EAAE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE;AAC1B,EAAE,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;AAC/B,EAAE,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,OAAO,MAAM,CAAC,IAAI;AAC9E,EAAE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE;AAC1C,EAAE,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,cAAc,CAAC;AAC7E,EAAE,IAAI,IAAI;AACV,EAAE,IAAI;AACN,GAAG,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;AACrC,IAAI,MAAM,EAAE,UAAU,CAAC,MAAM;AAC7B,IAAI,QAAQ,EAAE;AACd,IAAI,CAAC;AACL,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;AACvF,GAAG,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AAClE,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC;AACvH,GAAG,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC;AACtE,EAAE,CAAC,SAAS;AACZ,GAAG,YAAY,CAAC,OAAO,CAAC;AACxB,EAAE;AACF,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;AACjB,GAAG,IAAI;AACP,GAAG,SAAS,EAAE;AACd,GAAG,CAAC;AACJ,EAAE,IAAI,KAAK,CAAC,IAAI,GAAG,iBAAiB,EAAE;AACtC,GAAG,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;AAC9C,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1D,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,iBAAiB,EAAE,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1E,EAAE;AACF,EAAE,OAAO,IAAI;AACb,CAAC,CAAC,EAAE;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE;AACjE,CAAC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC;AAC1C,CAAC,IAAI,MAAM;AACX,CAAC,IAAI;AACL,EAAE,MAAM,GAAG,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;AACtF,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,MAAM,IAAI,8BAA8B,CAAC,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC;AACvF,CAAC;AACD,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,MAAM;AACrC,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,MAAM,EAAE,MAAM,KAAK,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE;AACpD,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,SAAS,EAAE;AAC1C,CAAC,IAAI,MAAM;AACX,CAAC,IAAI;AACL,EAAE,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC;AAC7B,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC,CAAC;AAClF,CAAC;AACD,CAAC,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,kCAAkC,EAAE,SAAS,CAAC,CAAC,CAAC;AACjK,CAAC,IAAI,cAAc,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,oFAAoF,EAAE,SAAS,CAAC,CAAC,CAAC;AACjL;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,uBAAuB,CAAC,OAAO,EAAE;AAC1C,CAAC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE;AAC1B,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,yBAAyB,CAAC;AACjH,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,2BAA2B,CAAC;AACzH,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,+BAA+B,CAAC;AACrI,EAAE,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC;AACpC,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,2CAA2C,CAAC;AAC1K,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE;AAC7C,CAAC,IAAI,SAAS,KAAK,IAAI,EAAE,OAAO,MAAM;AACtC,CAAC,OAAO,SAAS,GAAG,SAAS,GAAG,SAAS;AACzC;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,aAAa,EAAE;AACvC,CAAC,OAAO,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3D;;;;"}

package/build/server/chunks/chunks/computeLimits.js-CprilDAO.js

@@ -1,48 +0,0 @@
-import { b as private_env } from './shared-server.js-BGs15m2r.js';
-import { q as lazyLogger } from './providers.server.js-ChZPXW9c.js';
-import { c as resolveComputeLimits } from './limits.js-CXt-o5p8.js';
-import './src.js-DubgTP8X.js';
-import './access.js-DVAGPd2H.js';
-import './schema.js-CPjRq84j.js';
-import 'node:crypto';
-import './api.js-Cv6E39MW.js';
-import 'node:dns/promises';
-import 'node:net';
-
-//#region src/lib/server/computeLimits.ts
-/**
-* Thin adapter over `@selvajs/server`'s `resolveComputeLimits`: reads SvelteKit's
-* dynamic private env once and re-exports the resolved values as named constants.
-*
-* Uses `$env/dynamic/private`, not bare `process.env`: under `vite dev`, Vite
-* loads `.env` into this module but does NOT mirror it into `process.env`, so a
-* raw `process.env[name]` is undefined in dev and every knob silently falls back
-* to its default regardless of `.env`.
-*
-* Client-side counterparts (in-flight compute throttle, slider debounce) are
-* bundled into the client and can't read env — see `async-throttle.ts` in
-* `@selvajs/solve/client` and the input components.
-*/
-var limits = resolveComputeLimits(private_env, lazyLogger);
-/** The whole resolved object — passed wholesale to `SolveEngine` (`compute/engine.server.ts`). */
-var computeLimits = limits;
-var SOLVE_DEADLINE_MS = limits.solveDeadlineMs;
-var RATE_LIMIT_WINDOW_MS = limits.rateLimitWindowMs;
-var RATE_LIMIT_MAX_REQUESTS = limits.rateLimitMaxRequests;
-var MAX_DEFINITION_FILE_SIZE = limits.maxDefinitionFileSize;
-var MAX_IMAGE_FILE_SIZE = limits.maxImageFileSize;
-var COMPUTE_REQUEST_MAX_BYTES = limits.computeRequestMaxBytes;
-var COMPUTE_RESPONSE_MAX_BYTES = limits.computeResponseMaxBytes;
-var REMOTE_DEFINITION_MAX_BYTES = limits.remoteDefinitionMaxBytes;
-var REMOTE_DEFINITION_FETCH_TIMEOUT_MS = limits.remoteDefinitionFetchTimeoutMs;
-var REMOTE_DEFINITION_CACHE_TTL_MS = limits.remoteDefinitionCacheTtlMs;
-limits.computeReuseDefinitionCache;
-limits.computeServerCachesolve;
-limits.computeCacheErroredSolves;
-limits.computeMaxQueueDepth;
-limits.computeQueueWaitMs;
-var COMPUTE_DEFINITION_CACHE_BYTES = limits.computeDefinitionCacheBytes;
-var COMPUTE_SOLVE_CACHE_BYTES = limits.computeSolveCacheBytes;
-
-export { COMPUTE_DEFINITION_CACHE_BYTES as C, MAX_IMAGE_FILE_SIZE as M, REMOTE_DEFINITION_CACHE_TTL_MS as R, SOLVE_DEADLINE_MS as S, COMPUTE_SOLVE_CACHE_BYTES as a, REMOTE_DEFINITION_FETCH_TIMEOUT_MS as b, computeLimits as c, REMOTE_DEFINITION_MAX_BYTES as d, COMPUTE_RESPONSE_MAX_BYTES as e, COMPUTE_REQUEST_MAX_BYTES as f, MAX_DEFINITION_FILE_SIZE as g, RATE_LIMIT_MAX_REQUESTS as h, RATE_LIMIT_WINDOW_MS as i };
-//# sourceMappingURL=computeLimits.js-CprilDAO.js.map

package/build/server/chunks/chunks/computeLimits.js-CprilDAO.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"computeLimits.js-CprilDAO.js","sources":["../../../../.svelte-kit/output/server/chunks/computeLimits.js"],"sourcesContent":["import { t as private_env } from \"./shared-server.js\";\nimport { w as lazyLogger } from \"./providers.server.js\";\nimport { n as resolveComputeLimits } from \"./limits.js\";\nimport \"./compute.js\";\n//#region src/lib/server/computeLimits.ts\n/**\n* Thin adapter over `@selvajs/server`'s `resolveComputeLimits`: reads SvelteKit's\n* dynamic private env once and re-exports the resolved values as named constants.\n*\n* Uses `$env/dynamic/private`, not bare `process.env`: under `vite dev`, Vite\n* loads `.env` into this module but does NOT mirror it into `process.env`, so a\n* raw `process.env[name]` is undefined in dev and every knob silently falls back\n* to its default regardless of `.env`.\n*\n* Client-side counterparts (in-flight compute throttle, slider debounce) are\n* bundled into the client and can't read env — see `async-throttle.ts` in\n* `@selvajs/solve/client` and the input components.\n*/\nvar limits = resolveComputeLimits(private_env, lazyLogger);\n/** The whole resolved object — passed wholesale to `SolveEngine` (`compute/engine.server.ts`). */\nvar computeLimits = limits;\nvar SOLVE_DEADLINE_MS = limits.solveDeadlineMs;\nvar RATE_LIMIT_WINDOW_MS = limits.rateLimitWindowMs;\nvar RATE_LIMIT_MAX_REQUESTS = limits.rateLimitMaxRequests;\nvar MAX_DEFINITION_FILE_SIZE = limits.maxDefinitionFileSize;\nvar MAX_IMAGE_FILE_SIZE = limits.maxImageFileSize;\nvar COMPUTE_REQUEST_MAX_BYTES = limits.computeRequestMaxBytes;\nvar COMPUTE_RESPONSE_MAX_BYTES = limits.computeResponseMaxBytes;\nvar REMOTE_DEFINITION_MAX_BYTES = limits.remoteDefinitionMaxBytes;\nvar REMOTE_DEFINITION_FETCH_TIMEOUT_MS = limits.remoteDefinitionFetchTimeoutMs;\nvar REMOTE_DEFINITION_CACHE_TTL_MS = limits.remoteDefinitionCacheTtlMs;\nlimits.computeReuseDefinitionCache;\nlimits.computeServerCachesolve;\nlimits.computeCacheErroredSolves;\nlimits.computeMaxQueueDepth;\nlimits.computeQueueWaitMs;\nvar COMPUTE_DEFINITION_CACHE_BYTES = limits.computeDefinitionCacheBytes;\nvar COMPUTE_SOLVE_CACHE_BYTES = limits.computeSolveCacheBytes;\n//#endregion\nexport { MAX_DEFINITION_FILE_SIZE as a, RATE_LIMIT_WINDOW_MS as c, REMOTE_DEFINITION_MAX_BYTES as d, SOLVE_DEADLINE_MS as f, COMPUTE_SOLVE_CACHE_BYTES as i, REMOTE_DEFINITION_CACHE_TTL_MS as l, COMPUTE_REQUEST_MAX_BYTES as n, MAX_IMAGE_FILE_SIZE as o, computeLimits as p, COMPUTE_RESPONSE_MAX_BYTES as r, RATE_LIMIT_MAX_REQUESTS as s, COMPUTE_DEFINITION_CACHE_BYTES as t, REMOTE_DEFINITION_FETCH_TIMEOUT_MS as u };\n"],"names":[],"mappings":";;;;;;;;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,MAAM,GAAG,oBAAoB,CAAC,WAAW,EAAE,UAAU,CAAC;AAC1D;AACG,IAAC,aAAa,GAAG;AACjB,IAAC,iBAAiB,GAAG,MAAM,CAAC;AAC5B,IAAC,oBAAoB,GAAG,MAAM,CAAC;AAC/B,IAAC,uBAAuB,GAAG,MAAM,CAAC;AAClC,IAAC,wBAAwB,GAAG,MAAM,CAAC;AACnC,IAAC,mBAAmB,GAAG,MAAM,CAAC;AAC9B,IAAC,yBAAyB,GAAG,MAAM,CAAC;AACpC,IAAC,0BAA0B,GAAG,MAAM,CAAC;AACrC,IAAC,2BAA2B,GAAG,MAAM,CAAC;AACtC,IAAC,kCAAkC,GAAG,MAAM,CAAC;AAC7C,IAAC,8BAA8B,GAAG,MAAM,CAAC;AAC5C,MAAM,CAAC,2BAA2B;AAClC,MAAM,CAAC,uBAAuB;AAC9B,MAAM,CAAC,yBAAyB;AAChC,MAAM,CAAC,oBAAoB;AAC3B,MAAM,CAAC,kBAAkB;AACtB,IAAC,8BAA8B,GAAG,MAAM,CAAC;AACzC,IAAC,yBAAyB,GAAG,MAAM,CAAC;;;;"}

package/build/server/chunks/chunks/copy.js-EUqXVOK1.js

@@ -1,22 +0,0 @@
-import { ai as spread_props } from './server.js-eNE8c09e.js';
-import { I as Icon } from './utils2.js-C1oP9gJ9.js';
-
-//#region ../../node_modules/.pnpm/@lucide+svelte@1.48.0_svelte@5.57.1_@typescript-eslint+types@8.70.1_/node_modules/@lucide/svelte/dist/icons/copy.svelte
-function Copy($$renderer, $$props) {
-	let { $$slots, $$events, ...props } = $$props;
-	Icon($$renderer, spread_props([props, { icon: {
-		"name": "copy",
-		"size": 24,
-		"node": [["rect", {
-			"width": "14",
-			"height": "14",
-			"x": "8",
-			"y": "8",
-			"rx": "2",
-			"ry": "2"
-		}], ["path", { "d": "M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2" }]]
-	} }]));
-}
-
-export { Copy as C };
-//# sourceMappingURL=copy.js-EUqXVOK1.js.map

package/build/server/chunks/chunks/copy.js-EUqXVOK1.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"copy.js-EUqXVOK1.js","sources":["../../../../.svelte-kit/output/server/chunks/copy.js"],"sourcesContent":["import { d as spread_props } from \"./server.js\";\nimport { n as Icon } from \"./utils2.js\";\n//#region ../../node_modules/.pnpm/@lucide+svelte@1.48.0_svelte@5.57.1_@typescript-eslint+types@8.70.1_/node_modules/@lucide/svelte/dist/icons/copy.svelte\nfunction Copy($$renderer, $$props) {\n\tlet { $$slots, $$events, ...props } = $$props;\n\tIcon($$renderer, spread_props([props, { icon: {\n\t\t\"name\": \"copy\",\n\t\t\"size\": 24,\n\t\t\"node\": [[\"rect\", {\n\t\t\t\"width\": \"14\",\n\t\t\t\"height\": \"14\",\n\t\t\t\"x\": \"8\",\n\t\t\t\"y\": \"8\",\n\t\t\t\"rx\": \"2\",\n\t\t\t\"ry\": \"2\"\n\t\t}], [\"path\", { \"d\": \"M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2\" }]]\n\t} }]));\n}\n//#endregion\nexport { Copy as t };\n"],"names":[],"mappings":";;;AAEA;AACA,SAAS,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE;AACnC,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO;AAC9C,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE;AAC/C,EAAE,MAAM,EAAE,MAAM;AAChB,EAAE,MAAM,EAAE,EAAE;AACZ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;AACpB,GAAG,OAAO,EAAE,IAAI;AAChB,GAAG,QAAQ,EAAE,IAAI;AACjB,GAAG,GAAG,EAAE,GAAG;AACX,GAAG,GAAG,EAAE,GAAG;AACX,GAAG,IAAI,EAAE,GAAG;AACZ,GAAG,IAAI,EAAE;AACT,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,yDAAyD,EAAE,CAAC;AAClF,EAAE,EAAE,CAAC,CAAC,CAAC;AACP;;;;"}

package/build/server/chunks/chunks/definitions.js-BE-Zf2cL.js

@@ -1,508 +0,0 @@
-import { S as SYSTEM_CONTEXT, P as ProviderError } from './src.js-DubgTP8X.js';
-import { c as canView, p as projectAccessInputFromRowsWith, f as fetchSchemaFromCompute } from './access.js-DVAGPd2H.js';
-import './schema.js-CPjRq84j.js';
-import { randomUUID } from 'node:crypto';
-
-//#region ../platform/src/definitions/paths.ts
-/**
-* Path-segment safety check. Blocks traversal, separators, NUL, and empty
-* segments. Allowed alphabet `[A-Za-z0-9._-]+` covers GUIDs and sanitized
-* refs. Called by every helper so a malicious `guid` can't escape the
-* `definitions/` prefix.
-*/
-function assertSafeKey(value, label) {
-	if (!value || !/^[A-Za-z0-9._-]+$/.test(value) || value === "." || value === "..") throw new Error(`Unsafe ${label}: ${JSON.stringify(value)}`);
-}
-var definitionPaths = {
-	version: (guid, versionNumber, ext) => {
-		assertSafeKey(guid, "guid");
-		if (!Number.isInteger(versionNumber) || versionNumber < 1) throw new Error(`Unsafe versionNumber: ${versionNumber}`);
-		return `definitions/${guid}/versions/v${versionNumber}.${ext}`;
-	},
-	image: (guid) => {
-		assertSafeKey(guid, "guid");
-		return `definitions/${guid}/cover.webp`;
-	},
-	prefix: (guid) => {
-		assertSafeKey(guid, "guid");
-		return `definitions/${guid}/`;
-	}
-};
-//#endregion
-//#region ../platform/src/logging/interface.ts
-/**
-* Default `ILogger` — discards everything. Lets library code log
-* unconditionally without a configured backend, and keeps test output clean.
-* The app wires a real logger at its composition root; a consumer that wires
-* nothing gets silence rather than unsolicited stdout writes.
-*/
-var NoopLogger = class {
-	debug(_message, _fields) {}
-	info(_message, _fields) {}
-	warn(_message, _fields) {}
-	error(_message, _fields) {}
-	child(_fields) {
-		return this;
-	}
-};
-//#endregion
-//#region ../server/src/logging/requestId.ts
-/**
-* Request-id resolution for log correlation. Every record on a request path
-* carries the same `requestId`, so an operator handed one id can reconstruct
-* that request's whole story.
-*
-* Inbound ids are TRUSTED when present. Selva runs behind a reverse proxy
-* (Caddy/nginx) that mints a request id for its own access logs; minting a
-* second one here would split one request across two ids and kill cross-tier
-* correlation. The trade — a direct caller picks their own id — is fine, because
-* the id is only ever a log field and an echoed response header, never an
-* authorization or uniqueness input.
-*
-* That trust is why {@link sanitizeRequestId} exists: an attacker-chosen id is
-* untrusted content. Unbounded or newline-carrying values would let a caller
-* forge log lines (log injection) or bloat every record on the request.
-*/
-/** Header carrying a caller/proxy-supplied id. The de-facto standard spelling. */
-var REQUEST_ID_HEADER = "x-request-id";
-/** Long enough for a UUID or a W3C trace-id, short enough to bound a record. */
-var MAX_REQUEST_ID_LENGTH = 128;
-/**
-* Characters allowed through verbatim. Strict on purpose: UUIDs, ULIDs, hex
-* trace-ids and nginx's `$request_id` all fit. Everything else — whitespace,
-* control chars, quotes, CR/LF — is dropped rather than escaped, since no
-* legitimate id needs them and dropping can't be un-escaped downstream.
-*/
-var UNSAFE_REQUEST_ID_CHARS = /[^A-Za-z0-9._:-]/g;
-/** Returns `null` when nothing usable survives, so the caller generates instead. */
-function sanitizeRequestId(raw) {
-	if (!raw) return null;
-	const cleaned = raw.replace(UNSAFE_REQUEST_ID_CHARS, "").slice(0, MAX_REQUEST_ID_LENGTH);
-	return cleaned.length > 0 ? cleaned : null;
-}
-/**
-* Reuse the proxy's id when it survives sanitization, otherwise mint a UUID.
-*
-* @param generate injectable so tests get deterministic ids
-*/
-function resolveRequestId(headers, generate = randomId) {
-	return sanitizeRequestId(headers.get("x-request-id")) ?? generate();
-}
-/**
-* Render a thrown value into a log field.
-*
-* Not every rejection is an `Error` — provider adapters sometimes reject with a
-* plain `{ message, status }`, which would stringify to a useless
-* `[object Object]` and destroy the only record of the failure. Errors keep
-* their stack; anything else is JSON-serialized, with `String()` as the last
-* resort for cycles and exotic values.
-*
-* A `code` / `statusCode` carried on the error (ComputeError, ProviderError,
-* Node's ECONNREFUSED-style errors) is appended as a `[code=… status=…]` tag —
-* it classifies the failure and stacks alone don't show it.
-*/
-function renderThrown(error) {
-	if (error instanceof Error) {
-		const base = error.stack ?? error.message;
-		const code = error.code;
-		const statusCode = error.statusCode;
-		const tags = [];
-		if (typeof code === "string" || typeof code === "number") tags.push(`code=${code}`);
-		if (typeof statusCode === "number") tags.push(`status=${statusCode}`);
-		return tags.length > 0 ? `${base} [${tags.join(" ")}]` : base;
-	}
-	try {
-		return JSON.stringify(error) ?? String(error);
-	} catch {
-		return String(error);
-	}
-}
-/**
-* `crypto.randomUUID` exists in every runtime Selva targets (Node 22+, workers,
-* modern browsers); the `Math.random` branch only covers non-secure contexts
-* where it is missing. Not a weakness: these ids need to be collision-free
-* enough to correlate logs, never unguessable.
-*/
-function randomId() {
-	const c = globalThis.crypto;
-	if (c && typeof c.randomUUID === "function") return c.randomUUID();
-	return `req-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
-}
-//#endregion
-//#region ../server/src/definitions/definition-service.ts
-/**
-* Orchestrates writes spanning IDataProvider + IStorageProvider. Application
-* orchestration, not platform contract — hence not in @selvajs/platform.
-*
-* Methods that write both metadata and blobs order the two so a mid-flight
-* failure leaves a state the API can still serve; those reasons sit inline at
-* each write. `publish` and `updateMeta` flip pointers/metadata only and touch
-* storage not at all.
-*/
-var DefinitionService = class {
-	data;
-	storage;
-	constructor(data, storage) {
-		this.data = data;
-		this.storage = storage;
-	}
-	async create(ctx, input, file, schema) {
-		const now = (/* @__PURE__ */ new Date()).toISOString();
-		const actor = ctx.userId || input.ownerId;
-		const record = {
-			guid: input.guid,
-			projectId: input.projectId,
-			ownerId: input.ownerId,
-			createdBy: actor,
-			updatedBy: actor,
-			displayName: input.displayName,
-			description: input.description,
-			category: input.category,
-			tags: input.tags,
-			coverImage: input.coverImage,
-			computeServerId: input.computeServerId,
-			status: "pending",
-			solveCount: 0,
-			nextVersionNumber: 2,
-			liveVersionId: null,
-			draftVersionId: null,
-			createdAt: now,
-			updatedAt: now,
-			deletedAt: null
-		};
-		await this.data.definitions.create(ctx, record);
-		const versionId = randomUUID();
-		const fileKey = definitionPaths.version(input.guid, 1, input.fileExt);
-		await this.storage.put(fileKey, file, "application/octet-stream");
-		const version = {
-			id: versionId,
-			definitionId: input.guid,
-			versionNumber: 1,
-			fileExt: input.fileExt,
-			fileKey,
-			originalFilename: input.originalFilename,
-			uploadedBy: actor,
-			uploadedAt: now,
-			schema,
-			schemaExtractedAt: now
-		};
-		await this.data.definitions.createVersion(ctx, version);
-		await this.data.definitions.attachInitialVersion(ctx, input.guid, versionId);
-		return {
-			record: {
-				...record,
-				status: "draft",
-				liveVersionId: versionId,
-				draftVersionId: versionId
-			},
-			version
-		};
-	}
-	/**
-	* Advances the draft pointer only — `live` is unchanged. Use `publish` to
-	* promote.
-	*/
-	async uploadVersion(ctx, guid, file, ext, originalName, schema, changeNote) {
-		const existing = await this.data.definitions.get(ctx, guid);
-		if (!existing) throw new ProviderError(`Definition not found: ${guid}`, 404);
-		const next = await this.data.definitions.reserveNextVersionNumber(ctx, guid);
-		const versionId = randomUUID();
-		const fileKey = definitionPaths.version(guid, next, ext);
-		await this.storage.put(fileKey, file, "application/octet-stream");
-		const now = (/* @__PURE__ */ new Date()).toISOString();
-		const version = {
-			id: versionId,
-			definitionId: guid,
-			versionNumber: next,
-			fileExt: ext,
-			fileKey,
-			originalFilename: originalName,
-			uploadedBy: ctx.userId || existing.ownerId,
-			uploadedAt: now,
-			changeNote: changeNote?.trim() || void 0,
-			schema,
-			schemaExtractedAt: now
-		};
-		await this.data.definitions.createVersion(ctx, version);
-		await this.data.definitions.setDraftVersion(ctx, guid, versionId);
-		return version;
-	}
-	/**
-	* Moves the live channel to `versionId`, or to the current draft if omitted.
-	* Any version id is accepted, so this rolls backward as well as forward.
-	*/
-	async publish(ctx, guid, versionId) {
-		const existing = await this.data.definitions.get(ctx, guid);
-		if (!existing) throw new ProviderError(`Definition not found: ${guid}`, 404);
-		const target = versionId ?? existing.draftVersionId;
-		if (!target) throw new ProviderError("No version to publish", 400);
-		const version = await this.data.definitions.getVersion(ctx, target);
-		if (!version || version.definitionId !== guid) throw new ProviderError(`Version '${target}' not found for this definition`, 404);
-		await this.data.definitions.setLiveVersion(ctx, guid, target);
-		if (existing.status === "draft" || existing.status === "pending") await this.data.definitions.update(ctx, guid, { status: "published" });
-		return version;
-	}
-	async deleteVersion(ctx, guid, versionId) {
-		const version = await this.data.definitions.getVersion(ctx, versionId);
-		if (!version || version.definitionId !== guid) throw new ProviderError(`Version '${versionId}' not found for this definition`, 404);
-		await this.data.definitions.deleteVersion(ctx, versionId);
-		await this.storage.delete(version.fileKey);
-	}
-	async updateMeta(ctx, guid, patch) {
-		await this.data.definitions.update(ctx, guid, patch);
-	}
-	async saveCoverImage(ctx, guid, imageData) {
-		const path = definitionPaths.image(guid);
-		await this.storage.put(path, imageData, "image/webp");
-		const url = this.storage.getPublicUrl(path);
-		await this.data.definitions.update(ctx, guid, { coverImage: url });
-		return url;
-	}
-	async delete(ctx, guid) {
-		await this.data.definitions.delete(ctx, guid);
-		await this.storage.deletePrefix(definitionPaths.prefix(guid));
-	}
-};
-//#endregion
-//#region ../server/src/definitions/load-for-render.ts
-var DefinitionLoadError = class extends Error {
-	kind;
-	cause;
-	constructor(kind, message, cause) {
-		super(message);
-		this.kind = kind;
-		this.cause = cause;
-		this.name = "DefinitionLoadError";
-	}
-};
-/**
-* The returned loader resolves the `channel` pointer (live/draft) by default.
-* `explicitVersionId` renders an arbitrary historical version instead — the
-* caller MUST gate that behind edit permission, as with the draft channel.
-*/
-function createDefinitionLoader(deps) {
-	const { storage, definitions, projects, resolveServer, getClient, fetchSchema = fetchSchemaFromCompute, computeDebug = false, onWarn, logger = new NoopLogger() } = deps;
-	return async function loadDefinitionForRender(ctx, record, channel, explicitVersionId, options) {
-		const versionId = explicitVersionId ?? (channel === "draft" ? record.draftVersionId : record.liveVersionId);
-		if (!versionId) throw new DefinitionLoadError("data", `Definition '${record.guid}' has no ${channel} version`);
-		const version = await definitions.getVersion(ctx, versionId);
-		if (!version) throw new DefinitionLoadError("data", `version missing for '${record.guid}'`);
-		if (version.definitionId !== record.guid) throw new DefinitionLoadError("data", `version does not belong to '${record.guid}'`);
-		const definitionSource = await storage.get(version.fileKey);
-		if (!definitionSource) throw new DefinitionLoadError("data", `Definition file for '${record.guid}' not found on disk`);
-		const project = await projects.getProject(ctx, record.projectId);
-		let computeServer;
-		try {
-			computeServer = await resolveServer(ctx, project?.orgId ?? null, { definitionPin: record.computeServerId ?? null });
-		} catch (err) {
-			throw new DefinitionLoadError("missing-config", "No compute server configured for this definition", err);
-		}
-		if (options?.skipComputeDefaults) {
-			const cachedSchema = version.schema;
-			if (cachedSchema && isUsableCachedSchema(cachedSchema)) return {
-				version,
-				definitionSource,
-				computeServer,
-				schema: cachedSchema
-			};
-		}
-		let client;
-		try {
-			client = (await getClient(computeServer, { definitionGuid: record.guid })).client;
-		} catch (err) {
-			throw new DefinitionLoadError("connect", `Failed to connect to Rhino Compute server: ${err instanceof Error ? err.message : String(err)}`, err);
-		}
-		try {
-			const cachedSchema = version.schema;
-			const freshCache = cachedSchema && isUsableCachedSchema(cachedSchema) ? cachedSchema : null;
-			const [definition, fetchedSchema] = await Promise.all([client.getIO(definitionSource), freshCache ? Promise.resolve(freshCache) : fetchSchema(definitionSource, computeServer)]);
-			if (!freshCache && fetchedSchema.schemaVersion === "2.15.0") definitions.setVersionSchema(ctx, version.id, fetchedSchema).catch((err) => {
-				if (onWarn) {
-					onWarn(`[loadForRender] schema cache refresh failed for version ${version.id}: ${err instanceof Error ? err.message : String(err)}`);
-					return;
-				}
-				logger.warn("Schema cache refresh failed", {
-					component: "loadForRender",
-					versionId: version.id,
-					err: err instanceof Error ? err.stack ?? err.message : String(err)
-				});
-			});
-			if (!definition) throw new Error(`Failed to get definition IO — server returned undefined`);
-			const ioParseErrors = definition.parseErrors ?? [];
-			const ioLoadErrors = definition.loadErrors ?? [];
-			if (definition.inputs.length === 0 || ioParseErrors.length > 0 || ioLoadErrors.length > 0) {
-				const health = {
-					inputCount: definition.inputs.length,
-					outputCount: definition.outputs?.length,
-					parseErrors: ioParseErrors,
-					loadErrors: ioLoadErrors,
-					loadWarnings: definition.loadWarnings
-				};
-				if (onWarn) onWarn(`[loadForRender] IO health for '${record.guid}':`, JSON.stringify(health));
-				else logger.warn("Definition IO looks unhealthy", {
-					component: "loadForRender",
-					definitionGuid: record.guid,
-					...health
-				});
-				if (computeDebug) {
-					const rawIO = await client.getRawIO(definitionSource).catch((e) => ({ error: String(e) }));
-					const rendered = JSON.stringify(rawIO).slice(0, 3e3);
-					if (onWarn) onWarn("[loadForRender] raw /io:", rendered);
-					else logger.debug("Raw /io wire shape", {
-						component: "loadForRender",
-						definitionGuid: record.guid,
-						rawIO: rendered
-					});
-				}
-			}
-			return {
-				version,
-				definitionSource,
-				computeServer,
-				schema: mergeComputeDefaults(fetchedSchema, definition.inputs)
-			};
-		} catch (err) {
-			if (err instanceof DefinitionLoadError) throw err;
-			throw new DefinitionLoadError("schema", err instanceof Error ? err.message : String(err), err);
-		}
-	};
-}
-/**
-* A cached schema is usable only if it is BOTH the current format version and
-* structurally sound. The version check alone is not enough: a compute server
-* that serialized the schema with the wrong Newtonsoft emits PascalCase keys, so
-* `schemaVersion` reads as undefined while `SchemaVersion` holds the value —
-* and a row cached during that window would otherwise be served forever, long
-* after the server was fixed. See `assertCamelCaseSchema`.
-*/
-function isUsableCachedSchema(schema) {
-	return schema.schemaVersion === "2.15.0" && Array.isArray(schema.inputs);
-}
-function mergeComputeDefaults(schema, computeInputs) {
-	if (!Array.isArray(schema.inputs)) throw new DefinitionLoadError("schema", `Schema has no 'inputs' array (keys: ${Object.keys(schema).slice(0, 12).join(", ")}). A PascalCase shape here means compute serialized it with the wrong Newtonsoft — see assertCamelCaseSchema.`);
-	const byParamId = new Map(computeInputs.map((input) => [input.id, input]));
-	return {
-		...schema,
-		inputs: schema.inputs.map((schemaInput) => {
-			const computeInput = byParamId.get(schemaInput.id);
-			if (computeInput?.paramType === "Color" && computeInput.default !== void 0) {
-				const toHex = (value) => value.toString(16).padStart(2, "0");
-				const parts = String(computeInput.default).split(",").map((s) => parseInt(s.trim(), 10));
-				if (parts.length === 3) computeInput.default = `#${toHex(parts[0])}${toHex(parts[1])}${toHex(parts[2])}`;
-				else if (parts.length === 4) computeInput.default = `#${toHex(parts[1])}${toHex(parts[2])}${toHex(parts[3])}`;
-			}
-			if (computeInput && computeInput.default !== void 0) return {
-				...schemaInput,
-				default: computeInput.default
-			};
-			return schemaInput;
-		})
-	};
-}
-//#endregion
-//#region ../server/src/definitions/visibility.ts
-/**
-* Visibility-filtered definition reads, shared by the library page load and
-* `GET /api/v1/definitions`.
-*
-* **This is a tenancy boundary.** The project scan runs as `SYSTEM_CONTEXT` so
-* cross-org `public` projects are reachable when `ALLOW_CROSS_ORG_PUBLIC` is on;
-* `canView` over the fetched membership rows is the only thing keeping another
-* org's projects out of the result. The definition list itself is then filtered
-* *in the query* via `projectIds`, so the cursor is applied after visibility
-* rather than over a page that gets thinned afterwards.
-*
-* Cost is constant in the number of orgs and projects: three bulk membership
-* reads regardless of N. Anything added here must keep that property — a
-* per-project `await` inside a loop reintroduces the N+1 this replaced.
-*/
-/** Upper bound on the org/project scan. Visibility needs the whole set. */
-var SCAN_LIMIT = 200;
-/**
-* Resolve the caller's accessible project set in a constant number of queries.
-* Platform grants are fetched only for `platform`-visibility projects —
-* `canView` short-circuits before reading them for every other visibility.
-*/
-async function resolveAccessibleProjects(ctx, deps) {
-	const orgs = deps.orgs;
-	const projectStore = deps.projects;
-	const grantStore = deps.platformProjectGrants;
-	const orgIds = (await orgs.listOrgs(SYSTEM_CONTEXT, { limit: SCAN_LIMIT })).items.map((o) => o.id);
-	const allProjects = (await Promise.all(orgIds.map((orgId) => projectStore.listProjects(SYSTEM_CONTEXT, orgId, { limit: SCAN_LIMIT })))).flatMap((p) => p.items);
-	const projectIds = allProjects.map((p) => p.id);
-	const platformProjectIds = allProjects.filter((p) => p.visibility === "platform").map((p) => p.id);
-	const [orgMemberByOrgId, memberByProjectId, grantsByProjectId] = await Promise.all([
-		orgs.getOrgMembersFor(SYSTEM_CONTEXT, orgIds, ctx.userId),
-		projectStore.getProjectMembersFor(SYSTEM_CONTEXT, projectIds, ctx.userId),
-		platformProjectIds.length ? grantStore.listByProjects(SYSTEM_CONTEXT, platformProjectIds) : Promise.resolve(/* @__PURE__ */ new Map())
-	]);
-	return {
-		projects: allProjects.filter((project) => canView(projectAccessInputFromRowsWith({ deps }, ctx, project, {
-			member: memberByProjectId.get(project.id) ?? null,
-			orgMember: orgMemberByOrgId.get(project.orgId) ?? null,
-			platformGrants: grantsByProjectId.get(project.id) ?? []
-		}))),
-		allById: new Map(allProjects.map((p) => [p.id, p])),
-		memberByProjectId,
-		orgMemberByOrgId
-	};
-}
-/**
-* `opts.projectId` narrows to one project; a caller who cannot view it gets an
-* empty page rather than a 403, so this never reveals that a project exists.
-*/
-async function listVisibleDefinitions(ctx, opts = {}, deps) {
-	const { projectId, ...listOpts } = opts;
-	const { projects } = await resolveAccessibleProjects(ctx, deps);
-	const scoped = projectId ? projects.filter((p) => p.id === projectId) : projects;
-	const page = await deps.definitionMeta.list(ctx, {
-		...listOpts,
-		projectIds: scoped.map((p) => p.id)
-	});
-	return {
-		items: page.items,
-		nextCursor: page.nextCursor,
-		projects: scoped
-	};
-}
-/**
-* One definition, or `null` when the caller cannot view its project.
-*
-* Returns `null` rather than throwing 403 so callers surface a 404: a public
-* API that answers "forbidden" for a guid the caller cannot see turns
-* `/definitions/{guid}` into a cross-tenant existence oracle.
-*/
-async function getVisibleDefinition(ctx, guid, deps) {
-	const meta = deps.definitionMeta;
-	const projectStore = deps.projects;
-	const record = await meta.get(ctx, guid);
-	if (!record) return null;
-	const project = await projectStore.getProject(SYSTEM_CONTEXT, record.projectId);
-	if (!project) return null;
-	const [orgMembers, projectMembers, grants] = await Promise.all([
-		deps.orgs.getOrgMembersFor(SYSTEM_CONTEXT, [project.orgId], ctx.userId),
-		projectStore.getProjectMembersFor(SYSTEM_CONTEXT, [project.id], ctx.userId),
-		project.visibility === "platform" ? deps.platformProjectGrants.listByProject(SYSTEM_CONTEXT, project.id) : Promise.resolve([])
-	]);
-	return canView(projectAccessInputFromRowsWith({ deps }, ctx, project, {
-		member: projectMembers.get(project.id) ?? null,
-		orgMember: orgMembers.get(project.orgId) ?? null,
-		platformGrants: grants
-	})) ? record : null;
-}
-/**
-* One version of a definition the caller can view, including its cached
-* `schema`. `null` when the definition is invisible, the version is missing, or
-* the version belongs to a different definition — a caller must not be able to
-* read an arbitrary version by pairing it with a guid they can see.
-*/
-async function loadVisibleVersion(ctx, guid, versionId, deps) {
-	const record = await getVisibleDefinition(ctx, guid, deps);
-	if (!record) return null;
-	const version = await deps.definitionMeta.getVersion(ctx, versionId);
-	if (!version || version.definitionId !== record.guid) return null;
-	return version;
-}
-
-export { DefinitionService as D, NoopLogger as N, REQUEST_ID_HEADER as R, resolveRequestId as a, DefinitionLoadError as b, createDefinitionLoader as c, resolveAccessibleProjects as d, definitionPaths as e, loadVisibleVersion as f, getVisibleDefinition as g, listVisibleDefinitions as l, renderThrown as r };
-//# sourceMappingURL=definitions.js-BE-Zf2cL.js.map