@selvajs/selva 4.20.0-beta.1 → 4.20.0-beta.11

package/build/server/chunks/chunks/src.js-CkFJvvTE.js

@@ -0,0 +1,529 @@
+import { z } from 'zod';
+
+//#region ../platform/src/permissions/types.ts
+/**
+* Platform-scope permissions. All but `manage_api_tokens` are reserved for
+* Selva staff and instance operators; regular users hold an empty array.
+*
+* - `instance_admin`        — superuser; implies every other permission
+* - `manage_compute`        — configure the instance-wide Rhino.Compute pool
+* - `manage_instance_users` — disable/enable any user on the instance
+* - `manage_updates`        — run system updates
+* - `manage_api_tokens`     — mint API tokens for yourself
+*/
+var PlatformPermissionSchema = z.enum([
+	"instance_admin",
+	"manage_compute",
+	"manage_instance_users",
+	"manage_updates",
+	"manage_api_tokens"
+]);
+var ALL_PLATFORM_PERMISSIONS = PlatformPermissionSchema.options;
+/**
+* The permissions that admit someone to the `/admin` operator surface.
+* `manage_api_tokens` is granted to ordinary users, who have no business there.
+*/
+var OPERATOR_PLATFORM_PERMISSIONS = ALL_PLATFORM_PERMISSIONS.filter((p) => p !== "manage_api_tokens");
+var RESERVED_SLUG_SET = /* @__PURE__ */ new Set([
+	"o",
+	"api",
+	"admin",
+	"auth",
+	"login",
+	"logout",
+	"setup",
+	"settings",
+	"team",
+	"library",
+	"projects",
+	"accept-invite"
+]);
+/**
+* Coerces an arbitrary name into a slug candidate. Does not guarantee a valid
+* slug — an all-symbols name yields `''`, and reserved words pass through
+* untouched — run the result through `SlugSchema` where validity matters.
+*/
+function slugify(name) {
+	return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 63);
+}
+/** Lowercase alphanumeric with internal hyphens, 3–63 chars, not a reserved word. */
+var SlugSchema = z.string().min(3, "Slug must be at least 3 characters").max(63, "Slug must be at most 63 characters").regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/, "Slug must be lowercase alphanumeric with hyphens (no leading/trailing/consecutive hyphens)").refine((s) => !RESERVED_SLUG_SET.has(s), { message: "Slug is reserved and cannot be used" });
+var OrgRoleSchema = z.enum([
+	"owner",
+	"admin",
+	"member"
+]);
+/** Kinds of org-scoped branding asset. Adding a kind is a single entry here — path, upload route, store, and UI are all generic over it. */
+var OrgAssetKindSchema = z.enum(["logo", "favicon"]);
+var ALL_ORG_ASSET_KINDS = OrgAssetKindSchema.options;
+/** Org-scope permissions. A user may hold different sets in different orgs. */
+var OrgPermissionSchema = z.enum([
+	"manage_org_members",
+	"manage_org_compute",
+	"manage_definitions",
+	"manage_projects"
+]);
+var ALL_ORG_PERMISSIONS = OrgPermissionSchema.options;
+/** Governance perms — never grantable to `member`. */
+var OWNER_ADMIN_ONLY_PERMISSIONS = ["manage_org_members", "manage_org_compute"];
+var MEMBER_ASSIGNABLE_PERMISSIONS = ALL_ORG_PERMISSIONS.filter((p) => !OWNER_ADMIN_ONLY_PERMISSIONS.includes(p));
+/** Applied when adding a member without an explicit permissions list. */
+var DEFAULT_ORG_PERMISSIONS = {
+	owner: [...ALL_ORG_PERMISSIONS],
+	admin: [...ALL_ORG_PERMISSIONS],
+	member: []
+};
+var CreateOrgSchema = z.object({
+	name: z.string().min(1, "Organization name is required").max(128),
+	slug: SlugSchema
+});
+var UpdateOrgSchema = CreateOrgSchema.partial();
+//#endregion
+//#region ../platform/src/apiTokens/types.ts
+/**
+* `write`, `solve` and `upload` each include `read`, and `write` includes
+* `upload`. `upload` covers only creating definitions, uploading versions,
+* checking a file's schema before upload and making a version live: it can't
+* edit metadata, delete or share.
+*/
+var ApiScopeActionSchema = z.enum([
+	"read",
+	"write",
+	"solve",
+	"upload"
+]);
+var SCOPE_PATTERN = /^(read|write|solve|upload):(all|(org|project|definition):([A-Za-z0-9_-]{1,128}))$/;
+/** `read:all`, `write:org:<id>`, `solve:project:<id>`, `read:definition:<guid>`. */
+function parseApiScope(value) {
+	const m = SCOPE_PATTERN.exec(value);
+	if (!m) return null;
+	const action = m[1];
+	if (m[2] === "all") return {
+		action,
+		resource: { kind: "all" }
+	};
+	return {
+		action,
+		resource: {
+			kind: m[3],
+			id: m[4]
+		}
+	};
+}
+function formatApiScope(scope) {
+	const { action, resource } = scope;
+	return resource.kind === "all" ? `${action}:all` : `${action}:${resource.kind}:${resource.id}`;
+}
+/**
+* Scopes are stored as strings so a new action or resource kind needs no
+* migration. Parsing rejects anything this version doesn't understand, so an
+* unknown scope grants nothing rather than being guessed at.
+*/
+var ApiScopeStringSchema = z.string().refine((s) => parseApiScope(s) !== null, { message: "Unknown scope" });
+z.enum([
+	"owner",
+	"admin",
+	"member_removed",
+	"user_disabled"
+]);
+/** The only lifetimes offered. Expiry is never optional. */
+var API_TOKEN_LIFETIME_DAYS = [
+	30,
+	90,
+	180
+];
+var ACTION_WORDS = {
+	read: "Read",
+	write: "Read and change",
+	solve: "Read and run solves on",
+	upload: "Read and upload definitions to"
+};
+/** "Read and change everything in the org". Names no ids, so it suits an email. */
+function describeApiScope(value) {
+	const scope = parseApiScope(value);
+	if (!scope) return `Unknown scope (${value})`;
+	const what = scope.resource.kind === "project" ? "one project" : scope.resource.kind === "definition" ? "one definition" : "everything in the org";
+	return `${ACTION_WORDS[scope.action]} ${what}`;
+}
+//#endregion
+//#region ../platform/src/errors.ts
+/**
+* Thrown by providers to signal an expected failure the API layer forwards with
+* a specific status. Unknown errors should propagate as plain `Error` and become 500s.
+*/
+var ProviderError = class extends Error {
+	statusCode;
+	constructor(message, statusCode = 400) {
+		super(message);
+		this.name = "ProviderError";
+		this.statusCode = statusCode;
+	}
+};
+//#endregion
+//#region ../platform/src/apiTokens/scope.ts
+/**
+* May this request perform `action` on `target`?
+*
+* Without a target this is an org-level check, which only `all` and org scopes
+* pass: a project key must never reach a route that can't say which project it
+* touches. Requests without an API token always pass; their permissions are
+* checked elsewhere.
+*/
+function scopeAllows(ctx, action, target) {
+	const api = ctx.apiScope;
+	if (!api) return true;
+	return api.scopes.some((s) => apiScopeActionCovers(s.action, action) && resourceCovers(s, ctx, target));
+}
+/** Does a scope granting `granted` allow `wanted`? */
+function apiScopeActionCovers(granted, wanted) {
+	return granted === wanted || wanted === "read" || granted === "write" && wanted === "upload";
+}
+function resourceCovers(scope, ctx, target) {
+	const { resource } = scope;
+	switch (resource.kind) {
+		case "all": return true;
+		case "org": return resource.id === ctx.actingOrgId;
+		case "project": return target?.projectId === resource.id;
+		case "definition": return target?.definitionId === resource.id;
+	}
+}
+/**
+* Narrow the owner's live context to what the token grants. Only removes
+* rights:
+*
+* - Platform permissions are dropped. Instance authority never rides on a
+*   bearer key, so an operator's leaked key can't reach other tenants.
+* - `apiScope` is attached, which `scopeAllows` reads.
+*
+* Scopes this version can't parse are dropped, so they grant nothing.
+*/
+function narrowApiTokenContext(ctx, token) {
+	if (ctx.actingOrgId !== token.orgId) throw new ProviderError("API token context must act in the token’s org", 500);
+	const scopes = token.scopes.map(parseApiScope).filter((s) => s !== null);
+	return {
+		...ctx,
+		platformPermissions: [],
+		apiScope: {
+			tokenId: token.id,
+			scopes,
+			expiresAt: token.expiresAt
+		}
+	};
+}
+/**
+* True when an API-token request reaches for something owned by an org other
+* than the token's. A token is bound to one org, so that resource doesn't
+* exist for it, even when the owner belongs to the other org too. Treat it as
+* not found. Session requests are never outside.
+*/
+function outsideTokenOrg(ctx, orgId) {
+	return ctx.apiScope !== void 0 && orgId !== ctx.actingOrgId;
+}
+//#endregion
+//#region ../platform/src/projects/schemas.ts
+var ProjectVisibilitySchema = z.enum([
+	"public",
+	"org",
+	"private",
+	"platform"
+]);
+var ProjectRoleSchema = z.enum([
+	"owner",
+	"editor",
+	"viewer"
+]);
+/** Cross-field check for PATCH flows. Call on the merged post-patch shape. */
+function validateProjectFlags(merged) {
+	const issues = [];
+	if (merged.autoJoinOnUpload && merged.visibility !== "public") issues.push({
+		path: "autoJoinOnUpload",
+		message: "autoJoinOnUpload requires visibility=public"
+	});
+	if (merged.visibility === "platform" && merged.autoJoinOnUpload) issues.push({
+		path: "autoJoinOnUpload",
+		message: "autoJoinOnUpload is not allowed on platform projects"
+	});
+	return issues;
+}
+//#endregion
+//#region ../platform/src/platformProjects/schemas.ts
+var PlatformProjectGranteeTypeSchema = z.enum(["org", "user"]);
+z.object({
+	id: z.string(),
+	projectId: z.string(),
+	granteeType: PlatformProjectGranteeTypeSchema,
+	granteeId: z.string(),
+	canSolve: z.boolean(),
+	createdBy: z.string(),
+	createdAt: z.string()
+});
+//#endregion
+//#region ../platform/src/definitions/types.ts
+var GH_EXTENSIONS = [".gh", ".ghx"];
+var COVER_IMAGE_EXTENSIONS = [
+	".jpg",
+	".jpeg",
+	".png",
+	".webp",
+	".gif"
+];
+[...GH_EXTENSIONS, ...COVER_IMAGE_EXTENSIONS];
+var COVER_IMAGE_CONTENT_TYPES = {
+	".jpg": "image/jpeg",
+	".jpeg": "image/jpeg",
+	".png": "image/png",
+	".webp": "image/webp",
+	".gif": "image/gif"
+};
+function toDefinitionListItem(r) {
+	return {
+		guid: r.guid,
+		projectId: r.projectId,
+		displayName: r.displayName,
+		description: r.description,
+		category: r.category,
+		tags: r.tags,
+		coverImage: r.coverImage,
+		status: r.status,
+		solveCount: r.solveCount,
+		liveVersionId: r.liveVersionId,
+		sourceDocumentId: r.sourceDocumentId ?? null,
+		updatedAt: r.updatedAt
+	};
+}
+//#endregion
+//#region ../platform/src/definitions/schemas.ts
+var UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var GuidSchema = z.string().regex(UUID_REGEX, "Invalid GUID format");
+/** A Grasshopper document GUID as stores keep and compare it (lowercase), or null for anything else. */
+function toSourceDocumentId(value) {
+	return typeof value === "string" && UUID_REGEX.test(value) ? value.toLowerCase() : null;
+}
+var DefinitionStatusSchema = z.enum([
+	"draft",
+	"published",
+	"archived"
+]);
+var DefinitionFileExtSchema = z.enum(["gh", "ghx"]);
+z.object({
+	id: GuidSchema,
+	definitionId: GuidSchema,
+	versionNumber: z.number().int().min(1),
+	fileExt: DefinitionFileExtSchema,
+	fileKey: z.string().min(1),
+	originalFilename: z.string().max(256).optional(),
+	uploadedBy: z.string().min(1),
+	uploadedAt: z.string(),
+	changeNote: z.string().max(1e3).optional(),
+	schema: z.record(z.string(), z.unknown()).optional(),
+	schemaExtractedAt: z.string().optional()
+});
+var DefinitionChannelSchema = z.enum(["live", "draft"]);
+/** HTTP-body validator for new-definition input. */
+var CreateDefinitionInputSchema = z.object({
+	displayName: z.string().min(1, "Display name is required").max(256),
+	description: z.string().max(2e3).optional(),
+	coverImage: z.string().max(2048).optional(),
+	category: z.string().max(128).optional(),
+	tags: z.array(z.string().max(64)).max(20).optional(),
+	projectId: GuidSchema,
+	computeServerId: GuidSchema.optional()
+});
+/**
+* PATCH validator. Field semantics match `DefinitionRecordPatch`:
+* - missing / `undefined` — leave unchanged
+* - `null` — clear (only on nullable fields)
+* - value — set
+*/
+var UpdateMetadataInputSchema = z.object({
+	displayName: z.string().min(1, "Display name is required").max(256).optional(),
+	description: z.string().max(2e3).nullable().optional(),
+	coverImage: z.string().max(2048).nullable().optional(),
+	category: z.string().max(128).nullable().optional(),
+	tags: z.array(z.string().max(64)).max(20).nullable().optional(),
+	projectId: GuidSchema.optional(),
+	computeServerId: GuidSchema.nullable().optional(),
+	solveCacheLimit: z.number().int().min(0).max(1e5).nullable().optional(),
+	status: DefinitionStatusSchema.optional()
+});
+/** Body for `POST /api/definitions/[guid]/publish`. */
+var PublishVersionInputSchema = z.object({ versionId: GuidSchema.optional() }).default({});
+//#endregion
+//#region ../platform/src/shareLinks/schemas.ts
+/**
+* HTTP body for `POST /api/definitions/[guid]/share-links`. The route returns
+* the raw token exactly once.
+*/
+var CreateShareLinkInputSchema = z.object({
+	channel: DefinitionChannelSchema.default("live"),
+	name: z.string().max(128).optional(),
+	allowSolve: z.boolean().default(true),
+	/** Null is the minter's deliberate "uncap" choice; omitted applies the default cap. */
+	maxSolves: z.number().int().min(1).nullable().optional(),
+	expiresAt: z.iso.datetime().nullable().optional()
+});
+//#endregion
+//#region ../platform/src/storage/image.ts
+/**
+* Shared image-transcoding helper for `IStorageProvider` implementations.
+* Normalizes uploads to WebP (capped at 1200px, quality 85) so storage,
+* bandwidth, and the viewer path stay predictable.
+*
+* `sharp` is a dynamic import, not a hard dependency of this package —
+* providers that need transcoding install it themselves.
+*/
+var IMAGE_MAX_WIDTH = 1200;
+/** True if the input looks like an image to process — by content type or path extension. */
+function isImageUpload(contentType, storagePath) {
+	if (contentType?.startsWith("image/")) return true;
+	return /\.(webp|png|jpe?g|gif|bmp|tif?f|svg)$/i.test(storagePath);
+}
+/**
+* Rewrites a path's extension to `.webp`; unchanged for non-image extensions.
+* SVG is rasterized like any other input, so no vector blob is ever
+* persisted — served bytes stay XSS-free without a sanitizer.
+*/
+function toWebpPath(storagePath) {
+	return storagePath.replace(/\.(png|jpe?g|gif|bmp|tif?f|svg)$/i, ".webp");
+}
+/**
+* Transcodes images to WebP; passes non-images through unchanged, so
+* providers can call this unconditionally before `put`.
+*
+* Throws if `sharp` isn't installed — a config error, not a fallback.
+*/
+async function transcodeImageIfNeeded(data, contentType, storagePath) {
+	if (!isImageUpload(contentType, storagePath)) return {
+		data,
+		contentType: contentType ?? "application/octet-stream",
+		path: storagePath
+	};
+	const compressed = await (await loadSharp())(Buffer.from(data)).resize({
+		width: IMAGE_MAX_WIDTH,
+		withoutEnlargement: true
+	}).webp({ quality: 85 }).toBuffer();
+	return {
+		data: new Uint8Array(compressed),
+		contentType: "image/webp",
+		path: toWebpPath(storagePath)
+	};
+}
+var cachedSharp = null;
+async function loadSharp() {
+	if (cachedSharp) return cachedSharp;
+	try {
+		const mod = await import('sharp');
+		cachedSharp = mod.default ?? mod;
+		return cachedSharp;
+	} catch (err) {
+		throw new Error("Image transcoding requires `sharp` to be installed. Add it as a dependency in your provider package.", { cause: err });
+	}
+}
+//#endregion
+//#region ../platform/src/storage/assetClasses.ts
+var BRANDING_KINDS = ALL_ORG_ASSET_KINDS.join("|");
+var COVER_EXTS = COVER_IMAGE_EXTENSIONS.map((ext) => ext.replace(/^\./, "").replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|");
+var SAFE_SEGMENT = String.raw`[A-Za-z0-9._-]+`;
+var GUID = String.raw`[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}`;
+/**
+* The closed registry of servable asset classes. Patterns are mutually
+* exclusive by prefix, order doesn't matter. Anything matching no class is
+* unservable (the route 404s) — default-deny, so a new blob type is opt-in.
+*/
+var ASSET_CLASSES = [
+	{
+		id: "org-branding",
+		visibility: "public",
+		scope: "none",
+		pattern: new RegExp(String.raw`^orgs\/(${SAFE_SEGMENT})\/branding\/(?:${BRANDING_KINDS})\.webp$`)
+	},
+	{
+		id: "org-private",
+		visibility: "org",
+		scope: "org",
+		pattern: new RegExp(String.raw`^orgs\/(${SAFE_SEGMENT})\/private\/${SAFE_SEGMENT}$`)
+	},
+	{
+		id: "definition-cover",
+		visibility: "project",
+		scope: "project",
+		pattern: new RegExp(String.raw`^definitions\/(${GUID})\/cover\.(?:${COVER_EXTS})$`, "i")
+	}
+];
+/**
+* Rejects traversal, empty, or backslash segments before a path can match a
+* class. The permissive segment alphabet (`[A-Za-z0-9._-]+`) admits a bare
+* `.` or `..` as a whole segment, which would otherwise let
+* `orgs/../branding/logo.webp` classify as public branding with `..`
+* captured as the orgId. Mirrors `assertSafeKey` on the write side, so a path
+* that can't be written can't be read either.
+*/
+function hasUnsafeSegment(storagePath) {
+	if (storagePath.includes("\\")) return true;
+	for (const segment of storagePath.split("/")) if (segment === "" || segment === "." || segment === "..") return true;
+	return false;
+}
+/**
+* Classifies a storage path into its asset class and scope id, or null when
+* no class matches (or the path is unsafe). `getPublicUrl` and the serving
+* route both consult this so URL generation and authorization never drift
+* apart.
+*
+* `scopeId` is null for `scope: 'none'` classes even when the pattern
+* captures an id (e.g. `org-branding` captures orgId but is public).
+*/
+function classifyAssetPath(storagePath) {
+	if (hasUnsafeSegment(storagePath)) return null;
+	for (const cls of ASSET_CLASSES) {
+		const m = cls.pattern.exec(storagePath);
+		if (!m) continue;
+		return {
+			class: cls,
+			scopeId: cls.scope === "none" ? null : m[1] ?? null
+		};
+	}
+	return null;
+}
+//#endregion
+//#region ../platform/src/context.ts
+/** For server-internal operations outside any HTTP request (bootstrap, janitors, migrations). */
+var SYSTEM_CONTEXT = {
+	userId: "",
+	platformPermissions: [...ALL_PLATFORM_PERMISSIONS],
+	orgPermissions: [...ALL_ORG_PERMISSIONS],
+	system: true
+};
+/**
+* Does not cross-check `ctx.actingOrgId` — the caller must build a context scoped
+* to the org it's acting on. An org permission against a context without
+* `actingOrgId` returns false unless `instance_admin` or `system`.
+*/
+function hasPermission(ctx, permission) {
+	if (ctx.system) return true;
+	if (ctx.platformPermissions.includes("instance_admin")) return true;
+	if (isPlatformPermission(permission)) return ctx.platformPermissions.includes(permission);
+	return ctx.orgPermissions.includes(permission);
+}
+/**
+* An anonymous share-link holder. `system` is true on these contexts for adapter
+* dispatch only — a guard that treats `system` as "fully authorized" must
+* exclude them first.
+*/
+function isShareContext(ctx) {
+	return ctx.shareLinkId !== void 0;
+}
+/**
+* Refuse a privileged operation to a share-link context. Call at the top of any
+* guard whose first line is `if (ctx.system) return` — the token grants one
+* definition on one channel, never instance authority.
+*/
+function assertNotShareContext(ctx, what) {
+	if (isShareContext(ctx)) throw new ProviderError(`Forbidden: a share link cannot ${what}`, 403);
+}
+var PLATFORM_PERMISSION_VALUES = new Set(ALL_PLATFORM_PERMISSIONS);
+function isPlatformPermission(p) {
+	return PLATFORM_PERMISSION_VALUES.has(p);
+}
+
+export { ALL_PLATFORM_PERMISSIONS as A, validateProjectFlags as B, CreateDefinitionInputSchema as C, DEFAULT_ORG_PERMISSIONS as D, OPERATOR_PLATFORM_PERMISSIONS as E, CreateOrgSchema as F, GH_EXTENSIONS as G, UpdateOrgSchema as H, COVER_IMAGE_CONTENT_TYPES as I, OWNER_ADMIN_ONLY_PERMISSIONS as J, MEMBER_ASSIGNABLE_PERMISSIONS as M, OrgPermissionSchema as O, ProviderError as P, SYSTEM_CONTEXT as S, UpdateMetadataInputSchema as U, ALL_ORG_PERMISSIONS as a, transcodeImageIfNeeded as b, classifyAssetPath as c, assertNotShareContext as d, ProjectVisibilitySchema as e, ProjectRoleSchema as f, PlatformPermissionSchema as g, hasPermission as h, OrgRoleSchema as i, API_TOKEN_LIFETIME_DAYS as j, ApiScopeStringSchema as k, slugify as l, ApiScopeActionSchema as m, narrowApiTokenContext as n, outsideTokenOrg as o, parseApiScope as p, apiScopeActionCovers as q, describeApiScope as r, scopeAllows as s, toSourceDocumentId as t, toDefinitionListItem as u, GuidSchema as v, PublishVersionInputSchema as w, CreateShareLinkInputSchema as x, formatApiScope as y, OrgAssetKindSchema as z };
+//# sourceMappingURL=src.js-CkFJvvTE.js.map

package/build/server/chunks/chunks/src.js-CkFJvvTE.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"src.js-CkFJvvTE.js","sources":["../../../../.svelte-kit/output/server/chunks/src.js"],"sourcesContent":["import { z } from \"zod\";\n//#region ../platform/src/permissions/types.ts\n/**\n* Platform-scope permissions. All but `manage_api_tokens` are reserved for\n* Selva staff and instance operators; regular users hold an empty array.\n*\n* - `instance_admin`        — superuser; implies every other permission\n* - `manage_compute`        — configure the instance-wide Rhino.Compute pool\n* - `manage_instance_users` — disable/enable any user on the instance\n* - `manage_updates`        — run system updates\n* - `manage_api_tokens`     — mint API tokens for yourself\n*/\nvar PlatformPermissionSchema = z.enum([\n\t\"instance_admin\",\n\t\"manage_compute\",\n\t\"manage_instance_users\",\n\t\"manage_updates\",\n\t\"manage_api_tokens\"\n]);\nvar ALL_PLATFORM_PERMISSIONS = PlatformPermissionSchema.options;\n/**\n* The permissions that admit someone to the `/admin` operator surface.\n* `manage_api_tokens` is granted to ordinary users, who have no business there.\n*/\nvar OPERATOR_PLATFORM_PERMISSIONS = ALL_PLATFORM_PERMISSIONS.filter((p) => p !== \"manage_api_tokens\");\nvar RESERVED_SLUG_SET = /* @__PURE__ */ new Set([\n\t\"o\",\n\t\"api\",\n\t\"admin\",\n\t\"auth\",\n\t\"login\",\n\t\"logout\",\n\t\"setup\",\n\t\"settings\",\n\t\"team\",\n\t\"library\",\n\t\"projects\",\n\t\"accept-invite\"\n]);\n/**\n* Coerces an arbitrary name into a slug candidate. Does not guarantee a valid\n* slug — an all-symbols name yields `''`, and reserved words pass through\n* untouched — run the result through `SlugSchema` where validity matters.\n*/\nfunction slugify(name) {\n\treturn name.trim().toLowerCase().replace(/[^a-z0-9]+/g, \"-\").replace(/^-|-$/g, \"\").slice(0, 63);\n}\n/** Lowercase alphanumeric with internal hyphens, 3–63 chars, not a reserved word. */\nvar SlugSchema = z.string().min(3, \"Slug must be at least 3 characters\").max(63, \"Slug must be at most 63 characters\").regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/, \"Slug must be lowercase alphanumeric with hyphens (no leading/trailing/consecutive hyphens)\").refine((s) => !RESERVED_SLUG_SET.has(s), { message: \"Slug is reserved and cannot be used\" });\nvar OrgRoleSchema = z.enum([\n\t\"owner\",\n\t\"admin\",\n\t\"member\"\n]);\n/** Kinds of org-scoped branding asset. Adding a kind is a single entry here — path, upload route, store, and UI are all generic over it. */\nvar OrgAssetKindSchema = z.enum([\"logo\", \"favicon\"]);\nvar ALL_ORG_ASSET_KINDS = OrgAssetKindSchema.options;\n/** Org-scope permissions. A user may hold different sets in different orgs. */\nvar OrgPermissionSchema = z.enum([\n\t\"manage_org_members\",\n\t\"manage_org_compute\",\n\t\"manage_definitions\",\n\t\"manage_projects\"\n]);\nvar ALL_ORG_PERMISSIONS = OrgPermissionSchema.options;\n/** Governance perms — never grantable to `member`. */\nvar OWNER_ADMIN_ONLY_PERMISSIONS = [\"manage_org_members\", \"manage_org_compute\"];\nvar MEMBER_ASSIGNABLE_PERMISSIONS = ALL_ORG_PERMISSIONS.filter((p) => !OWNER_ADMIN_ONLY_PERMISSIONS.includes(p));\n/** Applied when adding a member without an explicit permissions list. */\nvar DEFAULT_ORG_PERMISSIONS = {\n\towner: [...ALL_ORG_PERMISSIONS],\n\tadmin: [...ALL_ORG_PERMISSIONS],\n\tmember: []\n};\nvar CreateOrgSchema = z.object({\n\tname: z.string().min(1, \"Organization name is required\").max(128),\n\tslug: SlugSchema\n});\nvar UpdateOrgSchema = CreateOrgSchema.partial();\n//#endregion\n//#region ../platform/src/apiTokens/types.ts\n/**\n* `write`, `solve` and `upload` each include `read`, and `write` includes\n* `upload`. `upload` covers only creating definitions, uploading versions,\n* checking a file's schema before upload and making a version live: it can't\n* edit metadata, delete or share.\n*/\nvar ApiScopeActionSchema = z.enum([\n\t\"read\",\n\t\"write\",\n\t\"solve\",\n\t\"upload\"\n]);\nvar SCOPE_PATTERN = /^(read|write|solve|upload):(all|(org|project|definition):([A-Za-z0-9_-]{1,128}))$/;\n/** `read:all`, `write:org:<id>`, `solve:project:<id>`, `read:definition:<guid>`. */\nfunction parseApiScope(value) {\n\tconst m = SCOPE_PATTERN.exec(value);\n\tif (!m) return null;\n\tconst action = m[1];\n\tif (m[2] === \"all\") return {\n\t\taction,\n\t\tresource: { kind: \"all\" }\n\t};\n\treturn {\n\t\taction,\n\t\tresource: {\n\t\t\tkind: m[3],\n\t\t\tid: m[4]\n\t\t}\n\t};\n}\nfunction formatApiScope(scope) {\n\tconst { action, resource } = scope;\n\treturn resource.kind === \"all\" ? `${action}:all` : `${action}:${resource.kind}:${resource.id}`;\n}\n/**\n* Scopes are stored as strings so a new action or resource kind needs no\n* migration. Parsing rejects anything this version doesn't understand, so an\n* unknown scope grants nothing rather than being guessed at.\n*/\nvar ApiScopeStringSchema = z.string().refine((s) => parseApiScope(s) !== null, { message: \"Unknown scope\" });\nz.enum([\n\t\"owner\",\n\t\"admin\",\n\t\"member_removed\",\n\t\"user_disabled\"\n]);\n/** The only lifetimes offered. Expiry is never optional. */\nvar API_TOKEN_LIFETIME_DAYS = [\n\t30,\n\t90,\n\t180\n];\nvar ACTION_WORDS = {\n\tread: \"Read\",\n\twrite: \"Read and change\",\n\tsolve: \"Read and run solves on\",\n\tupload: \"Read and upload definitions to\"\n};\n/** \"Read and change everything in the org\". Names no ids, so it suits an email. */\nfunction describeApiScope(value) {\n\tconst scope = parseApiScope(value);\n\tif (!scope) return `Unknown scope (${value})`;\n\tconst what = scope.resource.kind === \"project\" ? \"one project\" : scope.resource.kind === \"definition\" ? \"one definition\" : \"everything in the org\";\n\treturn `${ACTION_WORDS[scope.action]} ${what}`;\n}\n//#endregion\n//#region ../platform/src/errors.ts\n/**\n* Thrown by providers to signal an expected failure the API layer forwards with\n* a specific status. Unknown errors should propagate as plain `Error` and become 500s.\n*/\nvar ProviderError = class extends Error {\n\tstatusCode;\n\tconstructor(message, statusCode = 400) {\n\t\tsuper(message);\n\t\tthis.name = \"ProviderError\";\n\t\tthis.statusCode = statusCode;\n\t}\n};\n//#endregion\n//#region ../platform/src/apiTokens/scope.ts\n/**\n* May this request perform `action` on `target`?\n*\n* Without a target this is an org-level check, which only `all` and org scopes\n* pass: a project key must never reach a route that can't say which project it\n* touches. Requests without an API token always pass; their permissions are\n* checked elsewhere.\n*/\nfunction scopeAllows(ctx, action, target) {\n\tconst api = ctx.apiScope;\n\tif (!api) return true;\n\treturn api.scopes.some((s) => apiScopeActionCovers(s.action, action) && resourceCovers(s, ctx, target));\n}\n/** Does a scope granting `granted` allow `wanted`? */\nfunction apiScopeActionCovers(granted, wanted) {\n\treturn granted === wanted || wanted === \"read\" || granted === \"write\" && wanted === \"upload\";\n}\nfunction resourceCovers(scope, ctx, target) {\n\tconst { resource } = scope;\n\tswitch (resource.kind) {\n\t\tcase \"all\": return true;\n\t\tcase \"org\": return resource.id === ctx.actingOrgId;\n\t\tcase \"project\": return target?.projectId === resource.id;\n\t\tcase \"definition\": return target?.definitionId === resource.id;\n\t}\n}\n/**\n* Narrow the owner's live context to what the token grants. Only removes\n* rights:\n*\n* - Platform permissions are dropped. Instance authority never rides on a\n*   bearer key, so an operator's leaked key can't reach other tenants.\n* - `apiScope` is attached, which `scopeAllows` reads.\n*\n* Scopes this version can't parse are dropped, so they grant nothing.\n*/\nfunction narrowApiTokenContext(ctx, token) {\n\tif (ctx.actingOrgId !== token.orgId) throw new ProviderError(\"API token context must act in the token’s org\", 500);\n\tconst scopes = token.scopes.map(parseApiScope).filter((s) => s !== null);\n\treturn {\n\t\t...ctx,\n\t\tplatformPermissions: [],\n\t\tapiScope: {\n\t\t\ttokenId: token.id,\n\t\t\tscopes,\n\t\t\texpiresAt: token.expiresAt\n\t\t}\n\t};\n}\n/**\n* True when an API-token request reaches for something owned by an org other\n* than the token's. A token is bound to one org, so that resource doesn't\n* exist for it, even when the owner belongs to the other org too. Treat it as\n* not found. Session requests are never outside.\n*/\nfunction outsideTokenOrg(ctx, orgId) {\n\treturn ctx.apiScope !== void 0 && orgId !== ctx.actingOrgId;\n}\n//#endregion\n//#region ../platform/src/projects/schemas.ts\nvar ProjectVisibilitySchema = z.enum([\n\t\"public\",\n\t\"org\",\n\t\"private\",\n\t\"platform\"\n]);\nvar ProjectRoleSchema = z.enum([\n\t\"owner\",\n\t\"editor\",\n\t\"viewer\"\n]);\n/** Cross-field check for PATCH flows. Call on the merged post-patch shape. */\nfunction validateProjectFlags(merged) {\n\tconst issues = [];\n\tif (merged.autoJoinOnUpload && merged.visibility !== \"public\") issues.push({\n\t\tpath: \"autoJoinOnUpload\",\n\t\tmessage: \"autoJoinOnUpload requires visibility=public\"\n\t});\n\tif (merged.visibility === \"platform\" && merged.autoJoinOnUpload) issues.push({\n\t\tpath: \"autoJoinOnUpload\",\n\t\tmessage: \"autoJoinOnUpload is not allowed on platform projects\"\n\t});\n\treturn issues;\n}\n//#endregion\n//#region ../platform/src/platformProjects/schemas.ts\nvar PlatformProjectGranteeTypeSchema = z.enum([\"org\", \"user\"]);\nz.object({\n\tid: z.string(),\n\tprojectId: z.string(),\n\tgranteeType: PlatformProjectGranteeTypeSchema,\n\tgranteeId: z.string(),\n\tcanSolve: z.boolean(),\n\tcreatedBy: z.string(),\n\tcreatedAt: z.string()\n});\n//#endregion\n//#region ../platform/src/definitions/types.ts\nvar GH_EXTENSIONS = [\".gh\", \".ghx\"];\nvar COVER_IMAGE_EXTENSIONS = [\n\t\".jpg\",\n\t\".jpeg\",\n\t\".png\",\n\t\".webp\",\n\t\".gif\"\n];\n[...GH_EXTENSIONS, ...COVER_IMAGE_EXTENSIONS];\nvar COVER_IMAGE_CONTENT_TYPES = {\n\t\".jpg\": \"image/jpeg\",\n\t\".jpeg\": \"image/jpeg\",\n\t\".png\": \"image/png\",\n\t\".webp\": \"image/webp\",\n\t\".gif\": \"image/gif\"\n};\nfunction toDefinitionListItem(r) {\n\treturn {\n\t\tguid: r.guid,\n\t\tprojectId: r.projectId,\n\t\tdisplayName: r.displayName,\n\t\tdescription: r.description,\n\t\tcategory: r.category,\n\t\ttags: r.tags,\n\t\tcoverImage: r.coverImage,\n\t\tstatus: r.status,\n\t\tsolveCount: r.solveCount,\n\t\tliveVersionId: r.liveVersionId,\n\t\tsourceDocumentId: r.sourceDocumentId ?? null,\n\t\tupdatedAt: r.updatedAt\n\t};\n}\n//#endregion\n//#region ../platform/src/definitions/schemas.ts\nvar UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\nvar GuidSchema = z.string().regex(UUID_REGEX, \"Invalid GUID format\");\n/** A Grasshopper document GUID as stores keep and compare it (lowercase), or null for anything else. */\nfunction toSourceDocumentId(value) {\n\treturn typeof value === \"string\" && UUID_REGEX.test(value) ? value.toLowerCase() : null;\n}\nvar DefinitionStatusSchema = z.enum([\n\t\"draft\",\n\t\"published\",\n\t\"archived\"\n]);\nvar DefinitionFileExtSchema = z.enum([\"gh\", \"ghx\"]);\nz.object({\n\tid: GuidSchema,\n\tdefinitionId: GuidSchema,\n\tversionNumber: z.number().int().min(1),\n\tfileExt: DefinitionFileExtSchema,\n\tfileKey: z.string().min(1),\n\toriginalFilename: z.string().max(256).optional(),\n\tuploadedBy: z.string().min(1),\n\tuploadedAt: z.string(),\n\tchangeNote: z.string().max(1e3).optional(),\n\tschema: z.record(z.string(), z.unknown()).optional(),\n\tschemaExtractedAt: z.string().optional()\n});\nvar DefinitionChannelSchema = z.enum([\"live\", \"draft\"]);\n/** HTTP-body validator for new-definition input. */\nvar CreateDefinitionInputSchema = z.object({\n\tdisplayName: z.string().min(1, \"Display name is required\").max(256),\n\tdescription: z.string().max(2e3).optional(),\n\tcoverImage: z.string().max(2048).optional(),\n\tcategory: z.string().max(128).optional(),\n\ttags: z.array(z.string().max(64)).max(20).optional(),\n\tprojectId: GuidSchema,\n\tcomputeServerId: GuidSchema.optional()\n});\n/**\n* PATCH validator. Field semantics match `DefinitionRecordPatch`:\n* - missing / `undefined` — leave unchanged\n* - `null` — clear (only on nullable fields)\n* - value — set\n*/\nvar UpdateMetadataInputSchema = z.object({\n\tdisplayName: z.string().min(1, \"Display name is required\").max(256).optional(),\n\tdescription: z.string().max(2e3).nullable().optional(),\n\tcoverImage: z.string().max(2048).nullable().optional(),\n\tcategory: z.string().max(128).nullable().optional(),\n\ttags: z.array(z.string().max(64)).max(20).nullable().optional(),\n\tprojectId: GuidSchema.optional(),\n\tcomputeServerId: GuidSchema.nullable().optional(),\n\tsolveCacheLimit: z.number().int().min(0).max(1e5).nullable().optional(),\n\tstatus: DefinitionStatusSchema.optional()\n});\n/** Body for `POST /api/definitions/[guid]/publish`. */\nvar PublishVersionInputSchema = z.object({ versionId: GuidSchema.optional() }).default({});\n//#endregion\n//#region ../platform/src/shareLinks/schemas.ts\n/**\n* HTTP body for `POST /api/definitions/[guid]/share-links`. The route returns\n* the raw token exactly once.\n*/\nvar CreateShareLinkInputSchema = z.object({\n\tchannel: DefinitionChannelSchema.default(\"live\"),\n\tname: z.string().max(128).optional(),\n\tallowSolve: z.boolean().default(true),\n\t/** Null is the minter's deliberate \"uncap\" choice; omitted applies the default cap. */\n\tmaxSolves: z.number().int().min(1).nullable().optional(),\n\texpiresAt: z.iso.datetime().nullable().optional()\n});\n//#endregion\n//#region ../platform/src/storage/image.ts\n/**\n* Shared image-transcoding helper for `IStorageProvider` implementations.\n* Normalizes uploads to WebP (capped at 1200px, quality 85) so storage,\n* bandwidth, and the viewer path stay predictable.\n*\n* `sharp` is a dynamic import, not a hard dependency of this package —\n* providers that need transcoding install it themselves.\n*/\nvar IMAGE_MAX_WIDTH = 1200;\n/** True if the input looks like an image to process — by content type or path extension. */\nfunction isImageUpload(contentType, storagePath) {\n\tif (contentType?.startsWith(\"image/\")) return true;\n\treturn /\\.(webp|png|jpe?g|gif|bmp|tif?f|svg)$/i.test(storagePath);\n}\n/**\n* Rewrites a path's extension to `.webp`; unchanged for non-image extensions.\n* SVG is rasterized like any other input, so no vector blob is ever\n* persisted — served bytes stay XSS-free without a sanitizer.\n*/\nfunction toWebpPath(storagePath) {\n\treturn storagePath.replace(/\\.(png|jpe?g|gif|bmp|tif?f|svg)$/i, \".webp\");\n}\n/**\n* Transcodes images to WebP; passes non-images through unchanged, so\n* providers can call this unconditionally before `put`.\n*\n* Throws if `sharp` isn't installed — a config error, not a fallback.\n*/\nasync function transcodeImageIfNeeded(data, contentType, storagePath) {\n\tif (!isImageUpload(contentType, storagePath)) return {\n\t\tdata,\n\t\tcontentType: contentType ?? \"application/octet-stream\",\n\t\tpath: storagePath\n\t};\n\tconst compressed = await (await loadSharp())(Buffer.from(data)).resize({\n\t\twidth: IMAGE_MAX_WIDTH,\n\t\twithoutEnlargement: true\n\t}).webp({ quality: 85 }).toBuffer();\n\treturn {\n\t\tdata: new Uint8Array(compressed),\n\t\tcontentType: \"image/webp\",\n\t\tpath: toWebpPath(storagePath)\n\t};\n}\nvar cachedSharp = null;\nasync function loadSharp() {\n\tif (cachedSharp) return cachedSharp;\n\ttry {\n\t\tconst mod = await import(\"sharp\");\n\t\tcachedSharp = mod.default ?? mod;\n\t\treturn cachedSharp;\n\t} catch (err) {\n\t\tthrow new Error(\"Image transcoding requires `sharp` to be installed. Add it as a dependency in your provider package.\", { cause: err });\n\t}\n}\n//#endregion\n//#region ../platform/src/storage/assetClasses.ts\nvar BRANDING_KINDS = ALL_ORG_ASSET_KINDS.join(\"|\");\nvar COVER_EXTS = COVER_IMAGE_EXTENSIONS.map((ext) => ext.replace(/^\\./, \"\").replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\")).join(\"|\");\nvar SAFE_SEGMENT = String.raw`[A-Za-z0-9._-]+`;\nvar GUID = String.raw`[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}`;\n/**\n* The closed registry of servable asset classes. Patterns are mutually\n* exclusive by prefix, order doesn't matter. Anything matching no class is\n* unservable (the route 404s) — default-deny, so a new blob type is opt-in.\n*/\nvar ASSET_CLASSES = [\n\t{\n\t\tid: \"org-branding\",\n\t\tvisibility: \"public\",\n\t\tscope: \"none\",\n\t\tpattern: new RegExp(String.raw`^orgs\\/(${SAFE_SEGMENT})\\/branding\\/(?:${BRANDING_KINDS})\\.webp$`)\n\t},\n\t{\n\t\tid: \"org-private\",\n\t\tvisibility: \"org\",\n\t\tscope: \"org\",\n\t\tpattern: new RegExp(String.raw`^orgs\\/(${SAFE_SEGMENT})\\/private\\/${SAFE_SEGMENT}$`)\n\t},\n\t{\n\t\tid: \"definition-cover\",\n\t\tvisibility: \"project\",\n\t\tscope: \"project\",\n\t\tpattern: new RegExp(String.raw`^definitions\\/(${GUID})\\/cover\\.(?:${COVER_EXTS})$`, \"i\")\n\t}\n];\n/**\n* Rejects traversal, empty, or backslash segments before a path can match a\n* class. The permissive segment alphabet (`[A-Za-z0-9._-]+`) admits a bare\n* `.` or `..` as a whole segment, which would otherwise let\n* `orgs/../branding/logo.webp` classify as public branding with `..`\n* captured as the orgId. Mirrors `assertSafeKey` on the write side, so a path\n* that can't be written can't be read either.\n*/\nfunction hasUnsafeSegment(storagePath) {\n\tif (storagePath.includes(\"\\\\\")) return true;\n\tfor (const segment of storagePath.split(\"/\")) if (segment === \"\" || segment === \".\" || segment === \"..\") return true;\n\treturn false;\n}\n/**\n* Classifies a storage path into its asset class and scope id, or null when\n* no class matches (or the path is unsafe). `getPublicUrl` and the serving\n* route both consult this so URL generation and authorization never drift\n* apart.\n*\n* `scopeId` is null for `scope: 'none'` classes even when the pattern\n* captures an id (e.g. `org-branding` captures orgId but is public).\n*/\nfunction classifyAssetPath(storagePath) {\n\tif (hasUnsafeSegment(storagePath)) return null;\n\tfor (const cls of ASSET_CLASSES) {\n\t\tconst m = cls.pattern.exec(storagePath);\n\t\tif (!m) continue;\n\t\treturn {\n\t\t\tclass: cls,\n\t\t\tscopeId: cls.scope === \"none\" ? null : m[1] ?? null\n\t\t};\n\t}\n\treturn null;\n}\n//#endregion\n//#region ../platform/src/context.ts\n/** For server-internal operations outside any HTTP request (bootstrap, janitors, migrations). */\nvar SYSTEM_CONTEXT = {\n\tuserId: \"\",\n\tplatformPermissions: [...ALL_PLATFORM_PERMISSIONS],\n\torgPermissions: [...ALL_ORG_PERMISSIONS],\n\tsystem: true\n};\n/**\n* Does not cross-check `ctx.actingOrgId` — the caller must build a context scoped\n* to the org it's acting on. An org permission against a context without\n* `actingOrgId` returns false unless `instance_admin` or `system`.\n*/\nfunction hasPermission(ctx, permission) {\n\tif (ctx.system) return true;\n\tif (ctx.platformPermissions.includes(\"instance_admin\")) return true;\n\tif (isPlatformPermission(permission)) return ctx.platformPermissions.includes(permission);\n\treturn ctx.orgPermissions.includes(permission);\n}\n/**\n* An anonymous share-link holder. `system` is true on these contexts for adapter\n* dispatch only — a guard that treats `system` as \"fully authorized\" must\n* exclude them first.\n*/\nfunction isShareContext(ctx) {\n\treturn ctx.shareLinkId !== void 0;\n}\n/**\n* Refuse a privileged operation to a share-link context. Call at the top of any\n* guard whose first line is `if (ctx.system) return` — the token grants one\n* definition on one channel, never instance authority.\n*/\nfunction assertNotShareContext(ctx, what) {\n\tif (isShareContext(ctx)) throw new ProviderError(`Forbidden: a share link cannot ${what}`, 403);\n}\nvar PLATFORM_PERMISSION_VALUES = new Set(ALL_PLATFORM_PERMISSIONS);\nfunction isPlatformPermission(p) {\n\treturn PLATFORM_PERMISSION_VALUES.has(p);\n}\n//#endregion\nexport { CreateOrgSchema as A, OPERATOR_PLATFORM_PERMISSIONS as B, API_TOKEN_LIFETIME_DAYS as C, formatApiScope as D, describeApiScope as E, OrgPermissionSchema as F, OrgRoleSchema as I, UpdateOrgSchema as L, MEMBER_ASSIGNABLE_PERMISSIONS as M, OWNER_ADMIN_ONLY_PERMISSIONS as N, parseApiScope as O, OrgAssetKindSchema as P, slugify as R, ProviderError as S, ApiScopeStringSchema as T, PlatformPermissionSchema as V, validateProjectFlags as _, transcodeImageIfNeeded as a, outsideTokenOrg as b, GuidSchema as c, toSourceDocumentId as d, COVER_IMAGE_CONTENT_TYPES as f, ProjectVisibilitySchema as g, ProjectRoleSchema as h, classifyAssetPath as i, DEFAULT_ORG_PERMISSIONS as j, ALL_ORG_PERMISSIONS as k, PublishVersionInputSchema as l, toDefinitionListItem as m, assertNotShareContext as n, CreateShareLinkInputSchema as o, GH_EXTENSIONS as p, hasPermission as r, CreateDefinitionInputSchema as s, SYSTEM_CONTEXT as t, UpdateMetadataInputSchema as u, apiScopeActionCovers as v, ApiScopeActionSchema as w, scopeAllows as x, narrowApiTokenContext as y, ALL_PLATFORM_PERMISSIONS as z };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC,gBAAgB;AACjB,CAAC,gBAAgB;AACjB,CAAC,uBAAuB;AACxB,CAAC,gBAAgB;AACjB,CAAC;AACD,CAAC;AACE,IAAC,wBAAwB,GAAG,wBAAwB,CAAC;AACxD;AACA;AACA;AACA;AACG,IAAC,6BAA6B,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,mBAAmB;AACpG,IAAI,iBAAiB,mBAAmB,IAAI,GAAG,CAAC;AAChD,CAAC,GAAG;AACJ,CAAC,KAAK;AACN,CAAC,OAAO;AACR,CAAC,MAAM;AACP,CAAC,OAAO;AACR,CAAC,QAAQ;AACT,CAAC,OAAO;AACR,CAAC,UAAU;AACX,CAAC,MAAM;AACP,CAAC,SAAS;AACV,CAAC,UAAU;AACX,CAAC;AACD,CAAC,CAAC;AACF;AACA;AACA;AACA;AACA;AACA,SAAS,OAAO,CAAC,IAAI,EAAE;AACvB,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;AAChG;AACA;AACA,IAAI,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,oCAAoC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,oCAAoC,CAAC,CAAC,KAAK,CAAC,iCAAiC,EAAE,4FAA4F,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC;AACvV,IAAC,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC;AAC3B,CAAC,OAAO;AACR,CAAC,OAAO;AACR,CAAC;AACD,CAAC;AACD;AACG,IAAC,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC;AACnD,IAAI,mBAAmB,GAAG,kBAAkB,CAAC,OAAO;AACpD;AACG,IAAC,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC,oBAAoB;AACrB,CAAC,oBAAoB;AACrB,CAAC,oBAAoB;AACrB,CAAC;AACD,CAAC;AACE,IAAC,mBAAmB,GAAG,mBAAmB,CAAC;AAC9C;AACG,IAAC,4BAA4B,GAAG,CAAC,oBAAoB,EAAE,oBAAoB;AAC3E,IAAC,6BAA6B,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/G;AACG,IAAC,uBAAuB,GAAG;AAC9B,CAAC,KAAK,EAAE,CAAC,GAAG,mBAAmB,CAAC;AAChC,CAAC,KAAK,EAAE,CAAC,GAAG,mBAAmB,CAAC;AAChC,CAAC,MAAM,EAAE;AACT;AACG,IAAC,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;AAC/B,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,+BAA+B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;AAClE,CAAC,IAAI,EAAE;AACP,CAAC;AACE,IAAC,eAAe,GAAG,eAAe,CAAC,OAAO;AAC7C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC;AAClC,CAAC,MAAM;AACP,CAAC,OAAO;AACR,CAAC,OAAO;AACR,CAAC;AACD,CAAC;AACD,IAAI,aAAa,GAAG,mFAAmF;AACvG;AACA,SAAS,aAAa,CAAC,KAAK,EAAE;AAC9B,CAAC,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;AACpC,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,IAAI;AACpB,CAAC,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,OAAO;AAC5B,EAAE,MAAM;AACR,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK;AACzB,EAAE;AACF,CAAC,OAAO;AACR,EAAE,MAAM;AACR,EAAE,QAAQ,EAAE;AACZ,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACb,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;AACV;AACA,EAAE;AACF;AACA,SAAS,cAAc,CAAC,KAAK,EAAE;AAC/B,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK;AACnC,CAAC,OAAO,QAAQ,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC/F;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,oBAAoB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE;AAC3G,CAAC,CAAC,IAAI,CAAC;AACP,CAAC,OAAO;AACR,CAAC,OAAO;AACR,CAAC,gBAAgB;AACjB,CAAC;AACD,CAAC,CAAC;AACF;AACG,IAAC,uBAAuB,GAAG;AAC9B,CAAC,EAAE;AACH,CAAC,EAAE;AACH,CAAC;AACD;AACA,IAAI,YAAY,GAAG;AACnB,CAAC,IAAI,EAAE,MAAM;AACb,CAAC,KAAK,EAAE,iBAAiB;AACzB,CAAC,KAAK,EAAE,wBAAwB;AAChC,CAAC,MAAM,EAAE;AACT,CAAC;AACD;AACA,SAAS,gBAAgB,CAAC,KAAK,EAAE;AACjC,CAAC,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC;AACnC,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC;AAC9C,CAAC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,GAAG,aAAa,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY,GAAG,gBAAgB,GAAG,uBAAuB;AACnJ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAC/C;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,aAAa,GAAG,cAAc,KAAK,CAAC;AACxC,CAAC,UAAU;AACX,CAAC,WAAW,CAAC,OAAO,EAAE,UAAU,GAAG,GAAG,EAAE;AACxC,EAAE,KAAK,CAAC,OAAO,CAAC;AAChB,EAAE,IAAI,CAAC,IAAI,GAAG,eAAe;AAC7B,EAAE,IAAI,CAAC,UAAU,GAAG,UAAU;AAC9B,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE;AAC1C,CAAC,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ;AACzB,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,IAAI;AACtB,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,oBAAoB,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,cAAc,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;AACxG;AACA;AACA,SAAS,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE;AAC/C,CAAC,OAAO,OAAO,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM,IAAI,OAAO,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ;AAC7F;AACA,SAAS,cAAc,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE;AAC5C,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK;AAC3B,CAAC,QAAQ,QAAQ,CAAC,IAAI;AACtB,EAAE,KAAK,KAAK,EAAE,OAAO,IAAI;AACzB,EAAE,KAAK,KAAK,EAAE,OAAO,QAAQ,CAAC,EAAE,KAAK,GAAG,CAAC,WAAW;AACpD,EAAE,KAAK,SAAS,EAAE,OAAO,MAAM,EAAE,SAAS,KAAK,QAAQ,CAAC,EAAE;AAC1D,EAAE,KAAK,YAAY,EAAE,OAAO,MAAM,EAAE,YAAY,KAAK,QAAQ,CAAC,EAAE;AAChE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE;AAC3C,CAAC,IAAI,GAAG,CAAC,WAAW,KAAK,KAAK,CAAC,KAAK,EAAE,MAAM,IAAI,aAAa,CAAC,+CAA+C,EAAE,GAAG,CAAC;AACnH,CAAC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AACzE,CAAC,OAAO;AACR,EAAE,GAAG,GAAG;AACR,EAAE,mBAAmB,EAAE,EAAE;AACzB,EAAE,QAAQ,EAAE;AACZ,GAAG,OAAO,EAAE,KAAK,CAAC,EAAE;AACpB,GAAG,MAAM;AACT,GAAG,SAAS,EAAE,KAAK,CAAC;AACpB;AACA,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE;AACrC,CAAC,OAAO,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG,CAAC,WAAW;AAC5D;AACA;AACA;AACG,IAAC,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC,QAAQ;AACT,CAAC,KAAK;AACN,CAAC,SAAS;AACV,CAAC;AACD,CAAC;AACE,IAAC,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;AAC/B,CAAC,OAAO;AACR,CAAC,QAAQ;AACT,CAAC;AACD,CAAC;AACD;AACA,SAAS,oBAAoB,CAAC,MAAM,EAAE;AACtC,CAAC,MAAM,MAAM,GAAG,EAAE;AAClB,CAAC,IAAI,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC;AAC5E,EAAE,IAAI,EAAE,kBAAkB;AAC1B,EAAE,OAAO,EAAE;AACX,EAAE,CAAC;AACH,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,IAAI,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC;AAC9E,EAAE,IAAI,EAAE,kBAAkB;AAC1B,EAAE,OAAO,EAAE;AACX,EAAE,CAAC;AACH,CAAC,OAAO,MAAM;AACd;AACA;AACA;AACA,IAAI,gCAAgC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAC9D,CAAC,CAAC,MAAM,CAAC;AACT,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;AACf,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,WAAW,EAAE,gCAAgC;AAC9C,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;AACtB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM;AACpB,CAAC,CAAC;AACF;AACA;AACG,IAAC,aAAa,GAAG,CAAC,KAAK,EAAE,MAAM;AAClC,IAAI,sBAAsB,GAAG;AAC7B,CAAC,MAAM;AACP,CAAC,OAAO;AACR,CAAC,MAAM;AACP,CAAC,OAAO;AACR,CAAC;AACD,CAAC;AACD,CAAC,GAAG,aAAa,EAAE,GAAG,sBAAsB,CAAC;AAC1C,IAAC,yBAAyB,GAAG;AAChC,CAAC,MAAM,EAAE,YAAY;AACrB,CAAC,OAAO,EAAE,YAAY;AACtB,CAAC,MAAM,EAAE,WAAW;AACpB,CAAC,OAAO,EAAE,YAAY;AACtB,CAAC,MAAM,EAAE;AACT;AACA,SAAS,oBAAoB,CAAC,CAAC,EAAE;AACjC,CAAC,OAAO;AACR,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;AACd,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;AACxB,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW;AAC5B,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW;AAC5B,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ;AACtB,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;AACd,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU;AAC1B,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM;AAClB,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU;AAC1B,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa;AAChC,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,IAAI;AAC9C,EAAE,SAAS,EAAE,CAAC,CAAC;AACf,EAAE;AACF;AACA;AACA;AACA,IAAI,UAAU,GAAG,iEAAiE;AAC/E,IAAC,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,qBAAqB;AACnE;AACA,SAAS,kBAAkB,CAAC,KAAK,EAAE;AACnC,CAAC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,GAAG,IAAI;AACxF;AACA,IAAI,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC;AACpC,CAAC,OAAO;AACR,CAAC,WAAW;AACZ,CAAC;AACD,CAAC,CAAC;AACF,IAAI,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC,CAAC,MAAM,CAAC;AACT,CAAC,EAAE,EAAE,UAAU;AACf,CAAC,YAAY,EAAE,UAAU;AACzB,CAAC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC,OAAO,EAAE,uBAAuB;AACjC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3B,CAAC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AACjD,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AAC9B,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;AACvB,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AAC3C,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;AACrD,CAAC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ;AACvC,CAAC,CAAC;AACF,IAAI,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACvD;AACG,IAAC,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;AAC3C,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;AACpE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AAC5C,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;AAC5C,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AACzC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;AACrD,CAAC,SAAS,EAAE,UAAU;AACtB,CAAC,eAAe,EAAE,UAAU,CAAC,QAAQ;AACrC,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;AACzC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AAC/E,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AACvD,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AACvD,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AACpD,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AAChE,CAAC,SAAS,EAAE,UAAU,CAAC,QAAQ,EAAE;AACjC,CAAC,eAAe,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AAClD,CAAC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AACxE,CAAC,MAAM,EAAE,sBAAsB,CAAC,QAAQ;AACxC,CAAC;AACD;AACG,IAAC,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE;AACzF;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;AAC1C,CAAC,OAAO,EAAE,uBAAuB,CAAC,OAAO,CAAC,MAAM,CAAC;AACjD,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AACrC,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;AACtC;AACA,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AACzD,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ;AAChD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,eAAe,GAAG,IAAI;AAC1B;AACA,SAAS,aAAa,CAAC,WAAW,EAAE,WAAW,EAAE;AACjD,CAAC,IAAI,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI;AACnD,CAAC,OAAO,wCAAwC,CAAC,IAAI,CAAC,WAAW,CAAC;AAClE;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,UAAU,CAAC,WAAW,EAAE;AACjC,CAAC,OAAO,WAAW,CAAC,OAAO,CAAC,mCAAmC,EAAE,OAAO,CAAC;AACzE;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,sBAAsB,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE;AACtE,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,OAAO;AACtD,EAAE,IAAI;AACN,EAAE,WAAW,EAAE,WAAW,IAAI,0BAA0B;AACxD,EAAE,IAAI,EAAE;AACR,EAAE;AACF,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,SAAS,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AACxE,EAAE,KAAK,EAAE,eAAe;AACxB,EAAE,kBAAkB,EAAE;AACtB,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;AACpC,CAAC,OAAO;AACR,EAAE,IAAI,EAAE,IAAI,UAAU,CAAC,UAAU,CAAC;AAClC,EAAE,WAAW,EAAE,YAAY;AAC3B,EAAE,IAAI,EAAE,UAAU,CAAC,WAAW;AAC9B,EAAE;AACF;AACA,IAAI,WAAW,GAAG,IAAI;AACtB,eAAe,SAAS,GAAG;AAC3B,CAAC,IAAI,WAAW,EAAE,OAAO,WAAW;AACpC,CAAC,IAAI;AACL,EAAE,MAAM,GAAG,GAAG,MAAM,OAAO,OAAO,CAAC;AACnC,EAAE,WAAW,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG;AAClC,EAAE,OAAO,WAAW;AACpB,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,MAAM,IAAI,KAAK,CAAC,sGAAsG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACzI,CAAC;AACD;AACA;AACA;AACA,IAAI,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;AAClD,IAAI,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;AAC7H,IAAI,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC;AAC9C,IAAI,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,4DAA4D,CAAC;AACnF;AACA;AACA;AACA;AACA;AACA,IAAI,aAAa,GAAG;AACpB,CAAC;AACD,EAAE,EAAE,EAAE,cAAc;AACpB,EAAE,UAAU,EAAE,QAAQ;AACtB,EAAE,KAAK,EAAE,MAAM;AACf,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC,gBAAgB,EAAE,cAAc,CAAC,QAAQ,CAAC;AAClG,EAAE;AACF,CAAC;AACD,EAAE,EAAE,EAAE,aAAa;AACnB,EAAE,UAAU,EAAE,KAAK;AACnB,EAAE,KAAK,EAAE,KAAK;AACd,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;AACrF,EAAE;AACF,CAAC;AACD,EAAE,EAAE,EAAE,kBAAkB;AACxB,EAAE,UAAU,EAAE,SAAS;AACvB,EAAE,KAAK,EAAE,SAAS;AAClB,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,GAAG;AACzF;AACA,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,CAAC,WAAW,EAAE;AACvC,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,IAAI;AAC5C,CAAC,KAAK,MAAM,OAAO,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,EAAE,OAAO,IAAI;AACrH,CAAC,OAAO,KAAK;AACb;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,WAAW,EAAE;AACxC,CAAC,IAAI,gBAAgB,CAAC,WAAW,CAAC,EAAE,OAAO,IAAI;AAC/C,CAAC,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE;AAClC,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;AACzC,EAAE,IAAI,CAAC,CAAC,EAAE;AACV,EAAE,OAAO;AACT,GAAG,KAAK,EAAE,GAAG;AACb,GAAG,OAAO,EAAE,GAAG,CAAC,KAAK,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;AAClD,GAAG;AACH,CAAC;AACD,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACG,IAAC,cAAc,GAAG;AACrB,CAAC,MAAM,EAAE,EAAE;AACX,CAAC,mBAAmB,EAAE,CAAC,GAAG,wBAAwB,CAAC;AACnD,CAAC,cAAc,EAAE,CAAC,GAAG,mBAAmB,CAAC;AACzC,CAAC,MAAM,EAAE;AACT;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE;AACxC,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI;AAC5B,CAAC,IAAI,GAAG,CAAC,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,IAAI;AACpE,CAAC,IAAI,oBAAoB,CAAC,UAAU,CAAC,EAAE,OAAO,GAAG,CAAC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC;AAC1F,CAAC,OAAO,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC;AAC/C;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,GAAG,EAAE;AAC7B,CAAC,OAAO,GAAG,CAAC,WAAW,KAAK,MAAM;AAClC;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,GAAG,EAAE,IAAI,EAAE;AAC1C,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,aAAa,CAAC,CAAC,+BAA+B,EAAE,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC;AAChG;AACA,IAAI,0BAA0B,GAAG,IAAI,GAAG,CAAC,wBAAwB,CAAC;AAClE,SAAS,oBAAoB,CAAC,CAAC,EAAE;AACjC,CAAC,OAAO,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC;AACzC;;;;"}