@selvajs/selva 4.20.0-beta.13 → 4.20.0-beta.15

package/build/server/chunks/chunks/api.js-Z7amRz4t.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js-Z7amRz4t.js","sources":["../../../../.svelte-kit/output/server/chunks/api.js"],"sourcesContent":["import { C as API_TOKEN_LIFETIME_DAYS, F as OrgPermissionSchema, I as OrgRoleSchema, S as ProviderError, T as ApiScopeStringSchema, V as PlatformPermissionSchema, b as outsideTokenOrg, g as ProjectVisibilitySchema, h as ProjectRoleSchema, k as ALL_ORG_PERMISSIONS, v as apiScopeActionCovers, x as scopeAllows } from \"./src.js\";\nimport { A as codeForStatus, D as ApiError, F as readNonNegativeInt, I as readPositiveInt, M as toErrorBody, N as ComputeServerUnconfiguredError, O as ApiErrorCode, R as isFlagEnabled, j as isApiError, k as apiError } from \"./access.js\";\nimport { a as NoopEventSink, t as SchemaExtractionError } from \"./schema-extraction.js\";\nimport { t as createComputeRateLimiter } from \"./rate-limit.js\";\nimport { createHash } from \"node:crypto\";\nimport { z } from \"zod\";\n/**\n* `T` is whatever the caller replays. It must not be a `Response` — a body can\n* only be read once, so the solve route stores a serialized snapshot instead.\n* `weigh` measures a completed value for `maxWeight`.\n*/\nfunction createIdempotencyStore(config, weigh = () => 0) {\n\tconst ttlMs = Math.max(0, Math.floor(config.ttlMs));\n\tconst maxKeys = Math.max(1, Math.floor(config.maxKeys ?? 1e4));\n\tconst sweepIntervalMs = Math.max(0, Math.floor(config.sweepIntervalMs ?? ttlMs));\n\tconst maxWeight = config.maxWeight ?? Number.POSITIVE_INFINITY;\n\tconst resolvedConfig = Object.freeze({\n\t\t...config,\n\t\tttlMs,\n\t\tmaxKeys,\n\t\tsweepIntervalMs\n\t});\n\tconst entries = /* @__PURE__ */ new Map();\n\tlet nextSweepAt = Number.POSITIVE_INFINITY;\n\tlet totalWeight = 0;\n\tfunction drop(key) {\n\t\tconst entry = entries.get(key);\n\t\tif (!entry) return;\n\t\ttotalWeight -= entry.weight;\n\t\tentries.delete(key);\n\t}\n\t/** Settled entries only, nearest expiry first: in-flight ones have retries awaiting them. */\n\tfunction shedWeight() {\n\t\tif (totalWeight <= maxWeight) return;\n\t\tconst settled = [...entries.entries()].filter(([, e]) => e.expiresAt !== null).sort((a, b) => a[1].expiresAt - b[1].expiresAt);\n\t\tfor (const [key] of settled) {\n\t\t\tif (totalWeight <= maxWeight) break;\n\t\t\tdrop(key);\n\t\t}\n\t}\n\tfunction maybeSweep(now, headroom = 0) {\n\t\tconst budget = Math.max(0, maxKeys - headroom);\n\t\tif (!(sweepIntervalMs > 0 && now >= nextSweepAt) && entries.size <= budget) return;\n\t\tfor (const [key, entry] of entries) if (entry.expiresAt !== null && now > entry.expiresAt) drop(key);\n\t\tif (sweepIntervalMs > 0) nextSweepAt = now + sweepIntervalMs;\n\t\tif (entries.size > budget) {\n\t\t\tconst byExpiryAsc = [...entries.entries()].sort((a, b) => (a[1].expiresAt ?? Infinity) - (b[1].expiresAt ?? Infinity));\n\t\t\tfor (let i = 0; i < byExpiryAsc.length - budget; i++) drop(byExpiryAsc[i][0]);\n\t\t}\n\t}\n\treturn {\n\t\tconfig: resolvedConfig,\n\t\tasync run(key, fn) {\n\t\t\tconst now = Date.now();\n\t\t\tconst existing = entries.get(key);\n\t\t\tif (existing && (existing.expiresAt === null || now <= existing.expiresAt)) return {\n\t\t\t\tvalue: await existing.promise,\n\t\t\t\treplayed: true\n\t\t\t};\n\t\t\tmaybeSweep(now, entries.has(key) ? 0 : 1);\n\t\t\tconst promise = fn();\n\t\t\tconst entry = {\n\t\t\t\tpromise,\n\t\t\t\texpiresAt: null,\n\t\t\t\tweight: 0\n\t\t\t};\n\t\t\tdrop(key);\n\t\t\tentries.set(key, entry);\n\t\t\tif (sweepIntervalMs > 0 && nextSweepAt === Number.POSITIVE_INFINITY) nextSweepAt = now + sweepIntervalMs;\n\t\t\ttry {\n\t\t\t\tconst value = await promise;\n\t\t\t\tentry.expiresAt = Date.now() + ttlMs;\n\t\t\t\tif (entries.get(key) === entry) {\n\t\t\t\t\tentry.weight = weigh(value);\n\t\t\t\t\ttotalWeight += entry.weight;\n\t\t\t\t\tshedWeight();\n\t\t\t\t}\n\t\t\t\treturn {\n\t\t\t\t\tvalue,\n\t\t\t\t\treplayed: false\n\t\t\t\t};\n\t\t\t} catch (err) {\n\t\t\t\tif (entries.get(key) === entry) drop(key);\n\t\t\t\tthrow err;\n\t\t\t}\n\t\t},\n\t\treset() {\n\t\t\tentries.clear();\n\t\t\ttotalWeight = 0;\n\t\t\tnextSweepAt = Number.POSITIVE_INFINITY;\n\t\t},\n\t\tsize() {\n\t\t\treturn entries.size;\n\t\t}\n\t};\n}\n// ../server/src/api/deps.ts\n/**\n* Everything an API handler talks to, as one injected value.\n*\n* Handlers used to reach module-global getters (`getProjectProvider()`,\n* `getDefinitionService()`, …) from the Selva app's composition root — 77 call\n* sites across the v1 routes. That welded them to one app's boot: a second app\n* on a different provider set could not call them at all.\n*\n* Most fields are sub-stores of `IDataProvider`, so a host that already built a\n* `SelvaConfig` gets them via `depsFromConfig`. `services` stays host-defined:\n* `DefinitionService` and friends are composed rather than resolved, and a host\n* may supply its own.\n*/\n/**\n* Build deps from a resolved `SelvaConfig`, plus whatever services and token\n* codecs the host composed on top. The hoisted fields are aliases into `data`,\n* not copies.\n*\n* `services` stays positional — every existing caller passes it there — and\n* `tokens` arrives in an options object rather than as a third positional, so\n* the two composed bags cannot be swapped at a call site.\n*/\nfunction depsFromConfig(config, services = {}, { tokens = {}, uploadLimits, evictComputeClient = () => {}, notifications, instanceName = \"Selva\", apiTokenSettingsPath = \"/settings/tokens\", apiRateLimiter, idempotency } = {}) {\n\tconst { data } = config;\n\treturn {\n\t\tauth: config.auth,\n\t\tstorage: config.storage,\n\t\tdata,\n\t\torgs: data.orgs,\n\t\tprojects: data.projects,\n\t\tdefinitionMeta: data.definitions,\n\t\tcomputeServer: data.computeServer,\n\t\tuserProfile: data.userProfile,\n\t\tshareLinks: data.shareLinks,\n\t\tinvites: data.invites,\n\t\tpermissions: data.permissions,\n\t\tplatformProjectGrants: data.platformProjectGrants,\n\t\tevents: config.events ?? new NoopEventSink(),\n\t\tflag: (name) => isFlagEnabled(config, name),\n\t\ttokens,\n\t\tuploadLimits: {\n\t\t\tmaxDefinitionFileSize: uploadLimits?.maxDefinitionFileSize ?? 52428800,\n\t\t\tmaxImageFileSize: uploadLimits?.maxImageFileSize ?? 10485760\n\t\t},\n\t\tevictComputeClient,\n\t\tnotifications,\n\t\tinstanceName,\n\t\tapiTokenSettingsPath,\n\t\tapiRateLimiter,\n\t\tidempotency,\n\t\tservices\n\t};\n}\n// ../server/src/api/request.ts\n/**\n* The authenticated caller, or a 401.\n*\n* `ctx` and `user` are optional on `ApiRequest` because a host builds one for\n* anonymous requests too (share-token solves reach handlers with a `ctx` and no\n* `user`). Every handler that needs an identity narrows it here rather than\n* asserting the fields non-null, so the unauthenticated path fails as a denial\n* instead of a crash.\n*/\nfunction requireCaller(req) {\n\tif (!req.ctx || !req.user) apiError(401, ApiErrorCode.UNAUTHORIZED, \"Unauthorized\");\n\treturn {\n\t\tctx: req.ctx,\n\t\tuser: req.user\n\t};\n}\n/**\n* Fail with a Zod error's messages, one per field.\n*\n* The top-level `message` names the first problem so a human reading the\n* response learns something without parsing `fields`.\n*/\nfunction throwZodError(err) {\n\tconst fields = {};\n\tfor (const issue of err.issues) {\n\t\tconst key = issue.path.length ? issue.path.join(\".\") : \"_\";\n\t\tif (!(key in fields)) fields[key] = issue.message;\n\t}\n\tconst first = err.issues[0];\n\tconst path = first.path.length ? `${first.path.join(\".\")}: ` : \"\";\n\tapiError(400, ApiErrorCode.VALIDATION_FAILED, `${path}${first.message}`, fields);\n}\n/**\n* Read required path params, 400ing on any that is missing or blank.\n*\n* A router types every param as `string`, but a route can be reached with an\n* empty segment — this catches that instead of letting a stale non-null\n* assertion paper over it.\n*\n* Does **not** validate format — a guid-shaped param still goes through a\n* schema where the route cares. Replaces the `if (!id) apiError(...)` preamble,\n* not the schema check.\n*/\nfunction requireParams(params, ...names) {\n\tconst out = {};\n\tconst missing = [];\n\tfor (const name of names) {\n\t\tconst value = params[name];\n\t\tif (!value) {\n\t\t\tmissing.push(name);\n\t\t\tcontinue;\n\t\t}\n\t\tout[name] = value;\n\t}\n\tif (missing.length) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Missing path parameter${missing.length > 1 ? \"s\" : \"\"}: ${missing.join(\", \")}`);\n\treturn out;\n}\n/**\n* Read a path param through a Zod schema, 400ing on a bad value.\n*\n* The format-checking counterpart to `requireParams` — for guids, enum-shaped\n* segments, anything where \"present\" isn't the same as \"valid\".\n*/\nfunction parseParam(value, schema, name) {\n\tconst parsed = schema.safeParse(value);\n\tif (!parsed.success) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid or missing ${name}`);\n\treturn parsed.data;\n}\n/**\n* Parse and validate a JSON body. Broken JSON is a 400, not a 500 from\n* `request.json()`.\n*\n* `missingAs` covers endpoints whose fields are all optional: passing `{}` lets\n* an empty body mean \"no changes\" instead of a validation failure. Only an\n* empty body: a truncated `{\"versionId\":…` read as \"no changes\" would publish\n* the draft instead of rolling back.\n*/\nasync function parseBody(request, schema, { missingAs } = {}) {\n\tconst text = await request.text().catch(() => \"\");\n\tlet raw = null;\n\tif (text.trim()) try {\n\t\traw = JSON.parse(text);\n\t} catch {\n\t\tapiError(400, ApiErrorCode.VALIDATION_FAILED, \"The request body is not valid JSON.\");\n\t}\n\tconst parsed = schema.safeParse(raw ?? missingAs ?? null);\n\tif (!parsed.success) throwZodError(parsed.error);\n\treturn parsed.data;\n}\nvar parsedForms = /* @__PURE__ */ new WeakMap();\n/**\n* The request's form body, parsed once: the idempotency fingerprint reads it\n* before the handler does, and a definition upload is too large to buffer twice.\n* On an idempotent route, `request.formData()` throws: the body is already used.\n* A conformance test keeps handlers off it.\n*/\nfunction readForm(request) {\n\tlet form = parsedForms.get(request);\n\tif (!form) {\n\t\tform = request.formData().catch(() => apiError(400, ApiErrorCode.VALIDATION_FAILED, \"The request body is not a valid form.\"));\n\t\tparsedForms.set(request, form);\n\t}\n\treturn form;\n}\n/**\n* Pull a required file out of a multipart body and check its size and, where\n* given, its extension.\n*\n* A second line of defence, not the first: a host's body-size guard should\n* reject an oversized request before it is buffered. This catches a file that\n* is individually too large inside a request that isn't.\n*\n* Caps are passed in rather than read here — they are deployment config, and a\n* package that resolved them would pin every host to one source of truth.\n*/\nfunction requireUpload(form, field, { maxBytes, extensions, contentTypes, label = \"File\" }) {\n\tconst file = form.get(field);\n\tif (!(file instanceof File) || file.size === 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, `A ${label.toLowerCase()} is required`);\n\tconst extension = file.name.slice(file.name.lastIndexOf(\".\")).toLowerCase();\n\tif (extensions && !extensions.includes(extension)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `File type not allowed. Allowed: ${extensions.join(\", \")}`);\n\tif (contentTypes && !contentTypes.allowed.has(file.type)) apiError(400, ApiErrorCode.VALIDATION_FAILED, contentTypes.message);\n\tif (file.size > maxBytes) apiError(400, ApiErrorCode.VALIDATION_FAILED, `${label} too large. Max size: ${maxBytes / 1048576} MB`);\n\treturn {\n\t\tfile,\n\t\textension\n\t};\n}\n/** A multipart text field, trimmed and length-capped. Absent stays `undefined`. */\nfunction formText(form, field, { maxLength } = {}) {\n\tconst raw = form.get(field);\n\tif (typeof raw !== \"string\") return void 0;\n\tconst trimmed = raw.trim();\n\tif (!trimmed) return void 0;\n\treturn maxLength ? trimmed.slice(0, maxLength) : trimmed;\n}\n// ../server/src/api/scope.ts\n/** The default action for a method: reads are `read`, everything else `write`. */\nfunction actionForMethod(method) {\n\treturn method === \"GET\" || method === \"HEAD\" ? \"read\" : \"write\";\n}\n/**\n* Refuse an API-token request its scopes don't cover, with 403 naming the\n* scope that would have passed. Browser sessions always pass.\n*\n* `runHandler` calls this for every mounted route. A route that builds its own\n* `Response` must call it itself.\n*/\nfunction assertScope(ctx, action, target) {\n\tif (!ctx?.apiScope || scopeAllows(ctx, action, target)) return;\n\trecordRefusal(ctx.apiScope.tokenId);\n\tapiError(403, ApiErrorCode.FORBIDDEN, `This API token doesn't allow ${action} here.`, void 0, { requiredScope: requiredScope(ctx, action, target) });\n}\n/**\n* Refuse an API-token request whose key holds `action` on nothing at all. For\n* routes that act only on the caller's own solves and streams, which name no\n* project: a key that may solve in one project must still cancel and watch\n* those solves.\n*/\nfunction assertScopeAnywhere(ctx, action) {\n\tif (!ctx?.apiScope) return;\n\tif (ctx.apiScope.scopes.some((s) => apiScopeActionCovers(s.action, action))) return;\n\trecordRefusal(ctx.apiScope.tokenId);\n\tapiError(403, ApiErrorCode.FORBIDDEN, `This API token doesn't allow ${action}.`);\n}\nvar refusals = /* @__PURE__ */ new Map();\nvar utcDay = () => (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);\nfunction recordRefusal(tokenId) {\n\tconst day = utcDay();\n\tconst entry = refusals.get(tokenId);\n\tif (entry?.day === day) entry.count++;\n\telse refusals.set(tokenId, {\n\t\tday,\n\t\tcount: 1\n\t});\n}\n/** Scope refusals for `tokenId` since midnight UTC, in this process. */\nfunction scopeRefusalsToday(tokenId) {\n\tconst entry = refusals.get(tokenId);\n\treturn entry?.day === utcDay() ? entry.count : 0;\n}\nfunction requiredScope(ctx, action, target) {\n\tif (target?.projectId) return `${action}:project:${target.projectId}`;\n\tif (target?.definitionId) return `${action}:definition:${target.definitionId}`;\n\treturn `${action}:org:${ctx.actingOrgId}`;\n}\n/** Scope target for routes addressed by a project id param. */\nfunction projectScopeTarget(param = \"id\") {\n\treturn (req) => ({ projectId: req.params[param] });\n}\n/**\n* Scope target for routes addressed by a definition guid param. Loads the\n* record so a project-scoped key reaches the definitions inside its project.\n*\n* A definition outside the key's org resolves like a missing one: otherwise the\n* 403 detail would confirm the guid exists and name its project.\n*/\nfunction definitionScopeTarget(param = \"guid\") {\n\treturn async (req) => {\n\t\tconst definitionId = req.params[param];\n\t\tif (!definitionId || !req.ctx) return { definitionId };\n\t\tconst record = await req.deps.definitionMeta.get(req.ctx, definitionId);\n\t\tconst project = record ? await req.deps.projects.getProject(req.ctx, record.projectId) : null;\n\t\tif (!project || outsideTokenOrg(req.ctx, project.orgId)) return { definitionId };\n\t\treturn {\n\t\t\tdefinitionId,\n\t\t\tprojectId: project.id\n\t\t};\n\t};\n}\n// ../server/src/api/rate-limit.ts\nvar DEFAULT_API_RATE_LIMIT = Object.freeze({\n\twindowMs: 6e4,\n\tmaxPerWindow: 600\n});\n/**\n* Read `API_TOKEN_RATE_LIMIT_MAX` (requests per window, `0` = off) and\n* `API_TOKEN_RATE_LIMIT_WINDOW_MS` from an injected env map.\n*/\nfunction resolveApiRateLimitConfig(env, logger) {\n\treturn {\n\t\twindowMs: readPositiveInt(env, \"API_TOKEN_RATE_LIMIT_WINDOW_MS\", DEFAULT_API_RATE_LIMIT.windowMs, logger),\n\t\tmaxPerWindow: readNonNegativeInt(env, \"API_TOKEN_RATE_LIMIT_MAX\", DEFAULT_API_RATE_LIMIT.maxPerWindow, logger)\n\t};\n}\n/** Process-local fixed-window limiter. Returns `null` when `maxPerWindow` is 0. */\nfunction createApiRateLimiter(config = DEFAULT_API_RATE_LIMIT) {\n\tif (config.maxPerWindow <= 0) return null;\n\tconst inner = createComputeRateLimiter(config);\n\tconst limit = config.maxPerWindow;\n\treturn { hit(key) {\n\t\tconst result = inner.check(key);\n\t\treturn {\n\t\t\tallowed: result.allowed,\n\t\t\tlimit,\n\t\t\tremaining: Math.max(0, limit - inner.count(key)),\n\t\t\tretryAfter: result.retryAfter\n\t\t};\n\t} };\n}\nvar sharedDefault$1;\n/**\n* The limiter `depsFromConfig` wires when the host passes none. One per\n* process: deps are rebuilt per request, and a limiter per request counts\n* nothing.\n*/\nfunction defaultApiRateLimiter() {\n\tif (sharedDefault$1 === void 0) sharedDefault$1 = createApiRateLimiter();\n\treturn sharedDefault$1;\n}\n/**\n* Charge one request to the caller's token. `undefined` for a session caller\n* or when no limiter is wired.\n*/\nasync function chargeApiRateLimit(ctx, limiter) {\n\tif (!ctx?.apiScope || !limiter) return void 0;\n\treturn limiter.hit(`token:${ctx.apiScope.tokenId}`);\n}\nfunction rateLimitHeaders(verdict) {\n\tconst headers = {\n\t\t\"RateLimit-Limit\": String(verdict.limit),\n\t\t\"RateLimit-Remaining\": String(verdict.remaining)\n\t};\n\tif (!verdict.allowed) headers[\"Retry-After\"] = String(verdict.retryAfter ?? 1);\n\treturn headers;\n}\n/** The 429 envelope, with `Retry-After` and the `RateLimit-*` headers. */\nfunction rateLimitedResponse(verdict, message = `Too many requests for this API token. Retry in ${verdict.retryAfter ?? 1}s.`) {\n\tconst retryAfter = String(verdict.retryAfter ?? 1);\n\tconst err = new ApiError(429, ApiErrorCode.RATE_LIMITED, message, void 0, { retryAfter });\n\treturn new Response(JSON.stringify(toErrorBody(err)), {\n\t\tstatus: 429,\n\t\theaders: {\n\t\t\t\"content-type\": \"application/json\",\n\t\t\t...rateLimitHeaders(verdict)\n\t\t}\n\t});\n}\n/** Stamp the `RateLimit-*` headers onto a response. No-op without a verdict. */\nfunction withRateLimitHeaders(res, verdict) {\n\tif (!verdict) return res;\n\tconst headers = rateLimitHeaders(verdict);\n\ttry {\n\t\tfor (const [k, v] of Object.entries(headers)) res.headers.set(k, v);\n\t\treturn res;\n\t} catch {\n\t\tconst copy = new Headers(res.headers);\n\t\tfor (const [k, v] of Object.entries(headers)) copy.set(k, v);\n\t\treturn new Response(res.body, {\n\t\t\tstatus: res.status,\n\t\t\tstatusText: res.statusText,\n\t\t\theaders: copy\n\t\t});\n\t}\n}\n// ../server/src/api/idempotency-http.ts\n/**\n* The HTTP layer over {@link createIdempotencyStore}: how a replayed response\n* is keyed, snapshotted, and identified on the wire.\n*\n* The store itself is generic over `T` and knows nothing about requests. This\n* is the part two hosts must agree on to implement the same `Idempotency-Key`\n* contract, and the part each would otherwise reinvent:\n*\n*   - **The key namespaces by caller.** `Idempotency-Key` is client-chosen, so\n*     two tenants can pick the same string. Without the caller in the key one\n*     would replay the other's result — that is the whole security property\n*     here, and a host that got it wrong would leak across tenants with\n*     nothing failing at build time.\n*   - **The response round-trips through a snapshot.** A `Response` body reads\n*     exactly once, so storing the object itself replays an empty body.\n*   - **A replay says so**, via `Idempotency-Replayed`. A client that cannot\n*     tell a replay from a fresh run cannot tell a successful retry from a\n*     second execution.\n*\n* How long a response stays replayable is *not* here: that trades a client's\n* retry window against serving a stale result after the underlying resource\n* moves, and only the host knows its own deadlines.\n*/\n/** Header stamped on a replayed response, so a client can distinguish one. */\nvar IDEMPOTENCY_REPLAYED_HEADER = \"Idempotency-Replayed\";\n/**\n* Namespace a client-chosen key by its caller.\n*\n* `callerId` should be the narrowest identity available — a token id rather\n* than a user id where the host issues per-token credentials, so two tokens\n* held by one user do not share replays.\n*/\nfunction idempotencyKey(callerId, clientKey) {\n\treturn `${callerId} ${clientKey}`;\n}\n/** Flatten a response so it can be replayed. Consumes the body. */\nasync function toStoredResponse(res) {\n\treturn {\n\t\tstatus: res.status,\n\t\theaders: [...res.headers.entries()],\n\t\tbody: await res.arrayBuffer()\n\t};\n}\n/** Rebuild a live `Response` from a snapshot, marking it when it is a replay. */\nfunction fromStoredResponse(stored, replayed) {\n\tconst headers = new Headers(stored.headers);\n\tif (replayed) headers.set(IDEMPOTENCY_REPLAYED_HEADER, \"true\");\n\treturn new Response(stored.body, {\n\t\tstatus: stored.status,\n\t\theaders\n\t});\n}\n// ../server/src/api/idempotency.ts\n/**\n* `Idempotency-Key` for mounted routes that opt in with `idempotent: true`.\n*\n* Built on the generic store (`../compute/idempotency.ts`) and the wire\n* contract (`./idempotency-http.ts`). The store absorbs in-flight and near-term\n* retries in this process; it is not a durable record. A create that must never duplicate also needs the key on\n* the created row under a unique constraint, written in the same transaction.\n*\n* Each entry carries a fingerprint of method, path, query and body, so a client that\n* reuses a key for a different request gets 422 instead of someone else's\n* replay. Only responses below 400 are kept: a failed attempt frees the key so\n* a corrected retry can run.\n*/\nvar IDEMPOTENCY_KEY_HEADER = \"Idempotency-Key\";\n/** Covers a client's retry-on-timeout window without turning into a result cache. */\nvar DEFAULT_API_IDEMPOTENCY_TTL_MS = 3e5;\n/**\n* Replayable response bytes one store keeps. A solve response can run to\n* hundreds of MB, so the key cap alone would let a client that sends a fresh\n* key per solve hold gigabytes for the whole TTL. Evicting costs a re-run.\n*/\nvar DEFAULT_API_IDEMPOTENCY_MAX_BYTES = 268435456;\nvar CLIENT_CLOSED_REQUEST = 499;\nfunction createApiIdempotencyStore(ttlMs = DEFAULT_API_IDEMPOTENCY_TTL_MS, maxBytes = DEFAULT_API_IDEMPOTENCY_MAX_BYTES) {\n\treturn createIdempotencyStore({\n\t\tttlMs,\n\t\tmaxWeight: maxBytes\n\t}, (entry) => entry.response.body.byteLength);\n}\nvar sharedDefault;\n/** The store `depsFromConfig` wires when the host passes none. One per process. */\nfunction defaultApiIdempotencyStore() {\n\treturn sharedDefault ??= createApiIdempotencyStore();\n}\n/**\n* The narrowest identity a key is namespaced by: the token for a token\n* request, so two keys of one user never share replays, else the user.\n*/\nfunction idempotencyCallerId(ctx) {\n\treturn ctx.apiScope ? `token:${ctx.apiScope.tokenId}` : `user:${ctx.userId}`;\n}\n/** Read and validate the client's key. `null` when the header is absent. */\nfunction readIdempotencyKey(request) {\n\tconst key = request.headers.get(IDEMPOTENCY_KEY_HEADER);\n\tif (key === null) return null;\n\tif (key.length === 0 || key.length > 255) apiError(400, ApiErrorCode.VALIDATION_FAILED, `${IDEMPOTENCY_KEY_HEADER} must be 1 to 255 characters.`);\n\treturn key;\n}\nasync function sha256Hex(bytes) {\n\tconst digest = await crypto.subtle.digest(\"SHA-256\", bytes);\n\treturn Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n/** SHA-256 over method, path with query, and body, hex. */\nasync function requestFingerprint(method, url, body) {\n\tconst head = new TextEncoder().encode(`${method.toUpperCase()} ${url.pathname}${url.search}\\n`);\n\tconst tail = typeof body === \"string\" ? new TextEncoder().encode(body) : new Uint8Array(body);\n\tconst bytes = new Uint8Array(head.length + tail.length);\n\tbytes.set(head);\n\tbytes.set(tail, head.length);\n\treturn sha256Hex(bytes);\n}\nasync function fileSha256Hex(file) {\n\tconst hash = createHash(\"sha256\");\n\tfor await (const chunk of file.stream()) hash.update(chunk);\n\treturn hash.digest(\"hex\");\n}\n/**\n* The body `requestFingerprint` should hash. The handler can still read it: a\n* JSON body comes from a clone, a form through `readForm`, which parses it once\n* for both.\n*\n* Multipart is canonicalized to its fields and file contents: clients pick a\n* fresh random boundary per request, so the raw bytes of an identical retry\n* never match.\n*/\nasync function fingerprintBody(request) {\n\tif (!(request.headers.get(\"content-type\") ?? \"\").toLowerCase().startsWith(\"multipart/form-data\")) return request.clone().arrayBuffer();\n\tlet form;\n\ttry {\n\t\tform = await readForm(request);\n\t} catch {\n\t\treturn \"malformed multipart\";\n\t}\n\tconst parts = [];\n\tfor (const [name, value] of form) parts.push([name, typeof value === \"string\" ? value : {\n\t\tfile: value.name,\n\t\ttype: value.type,\n\t\tsha256: await fileSha256Hex(value)\n\t}]);\n\treturn JSON.stringify(parts);\n}\nvar NotReplayable = class {\n\tfingerprint;\n\tresponse;\n\tconstructor(fingerprint, response) {\n\t\tthis.fingerprint = fingerprint;\n\t\tthis.response = response;\n\t}\n};\nfunction assertSameRequest(stored, fingerprint) {\n\tif (stored !== fingerprint) apiError(422, ApiErrorCode.UNPROCESSABLE, `This ${IDEMPOTENCY_KEY_HEADER} was already used for a different request.`);\n}\n/**\n* Run `fn` once per `(callerId, clientKey)`, replaying its response to repeats\n* with `Idempotency-Replayed: true`. Throws 422 when the key was used for a\n* different request. Errors `fn` throws propagate and free the key.\n*/\nasync function runIdempotent({ store, callerId, clientKey, fingerprint }, fn) {\n\tlet outcome;\n\tlet ranHere = false;\n\ttry {\n\t\toutcome = await store.run(idempotencyKey(callerId, clientKey), async () => {\n\t\t\tranHere = true;\n\t\t\tconst res = await fn();\n\t\t\tconst response = await toStoredResponse(res);\n\t\t\tif (res.status >= 400) throw new NotReplayable(fingerprint, response);\n\t\t\treturn {\n\t\t\t\tfingerprint,\n\t\t\t\tresponse\n\t\t\t};\n\t\t});\n\t} catch (err) {\n\t\tif (!(err instanceof NotReplayable)) throw err;\n\t\tassertSameRequest(err.fingerprint, fingerprint);\n\t\tif (!ranHere && err.response.status === CLIENT_CLOSED_REQUEST) return runIdempotent({\n\t\t\tstore,\n\t\t\tcallerId,\n\t\t\tclientKey,\n\t\t\tfingerprint\n\t\t}, fn);\n\t\treturn fromStoredResponse(err.response, false);\n\t}\n\tassertSameRequest(outcome.value.fingerprint, fingerprint);\n\treturn fromStoredResponse(outcome.value.response, outcome.replayed);\n}\n// ../server/src/api/respond.ts\n/**\n* Turn a handler result — or a thrown `ApiError` — into a web-standard\n* `Response`.\n*\n* This is the whole serialization boundary. A host framework that speaks\n* `Request`/`Response` (SvelteKit, Next route handlers, Hono, Remix) needs only\n* to build an `ApiRequest` and call `runHandler`; one that does not can reuse\n* `toErrorBody` and serialize itself.\n*/\nfunction toResponse(result) {\n\tif (result instanceof Response) return result;\n\tconst { status, body, headers } = result;\n\tif (body === void 0) return new Response(null, {\n\t\tstatus: status ?? 204,\n\t\theaders\n\t});\n\treturn new Response(JSON.stringify(body), {\n\t\tstatus: status ?? 200,\n\t\theaders: {\n\t\t\t\"content-type\": \"application/json\",\n\t\t\t...headers\n\t\t}\n\t});\n}\n/** Run a handler and serialize whatever comes out, including failures. */\nasync function runHandler(handler, req, { fallback, mapError, action, scopeTarget, anyScope, idempotent }) {\n\tconst fail = (err) => {\n\t\tif (isApiError(err)) return toResponse({\n\t\t\tstatus: err.status,\n\t\t\tbody: toErrorBody(err)\n\t\t});\n\t\tconst mapped = mapError?.(err);\n\t\tif (mapped) return toResponse({\n\t\t\tstatus: mapped.status,\n\t\t\tbody: toErrorBody(mapped)\n\t\t});\n\t\treq.log.error(`[API] ${fallback}`, {\n\t\t\tcomponent: \"api\",\n\t\t\terr: err instanceof Error ? err.stack ?? err.message : String(err)\n\t\t});\n\t\treturn toResponse({\n\t\t\tstatus: 500,\n\t\t\tbody: {\n\t\t\t\tmessage: fallback,\n\t\t\t\tcode: ApiErrorCode.INTERNAL\n\t\t\t}\n\t\t});\n\t};\n\tlet verdict;\n\ttry {\n\t\tconst limiter = req.deps.apiRateLimiter === void 0 ? defaultApiRateLimiter() : req.deps.apiRateLimiter;\n\t\tverdict = await chargeApiRateLimit(req.ctx, limiter);\n\t\tif (verdict && !verdict.allowed) return rateLimitedResponse(verdict);\n\t} catch (err) {\n\t\treturn fail(err);\n\t}\n\tlet res;\n\ttry {\n\t\tif (req.ctx?.apiScope && !anyScope) assertScope(req.ctx, action ?? actionForMethod(req.request.method), scopeTarget ? await scopeTarget(req) : void 0);\n\t\tconst run = async () => {\n\t\t\ttry {\n\t\t\t\treturn toResponse(await handler(req));\n\t\t\t} catch (err) {\n\t\t\t\treturn fail(err);\n\t\t\t}\n\t\t};\n\t\tconst clientKey = idempotent && req.ctx ? readIdempotencyKey(req.request) : null;\n\t\tif (clientKey && req.ctx) {\n\t\t\tconst fingerprint = await requestFingerprint(req.request.method, req.url, await fingerprintBody(req.request));\n\t\t\tres = await runIdempotent({\n\t\t\t\tstore: req.deps.idempotency ?? defaultApiIdempotencyStore(),\n\t\t\t\tcallerId: idempotencyCallerId(req.ctx),\n\t\t\t\tclientKey,\n\t\t\t\tfingerprint\n\t\t\t}, run);\n\t\t} else res = await run();\n\t} catch (err) {\n\t\tres = fail(err);\n\t}\n\treturn withRateLimitHeaders(res, verdict);\n}\n// ../server/src/api/map-core-error.ts\n/**\n* The domain errors this package's own handlers raise, folded into the envelope.\n*\n* A host's `mapError` should call this first and add only its own error types.\n* These rules cannot live solely in a host: the handler that throws them ships\n* from here, so a host that forgot one would serve 500 where every other host\n* serves 503 — the same API answering differently depending on who mounted it.\n*\n* Postgres surfaces a unique-constraint name verbatim, which is useless to an\n* end user, so the constraints this package's handlers can trip are translated\n* here rather than left to each host.\n*/\nvar UNIQUE_CONSTRAINT_MESSAGES = {\n\tprojects_org_name_unique: \"A project with that name already exists in this organization.\",\n\tprojects_org_id_slug_key: \"A project with that name already exists in this organization.\",\n\torgs_slug_key: \"An organization with that slug already exists.\",\n\tdefinitions_pkey: \"A definition with that ID already exists.\"\n};\nfunction friendlyConstraintMessage(raw) {\n\tfor (const [name, msg] of Object.entries(UNIQUE_CONSTRAINT_MESSAGES)) if (raw.includes(name)) return msg;\n\treturn null;\n}\n/**\n* Compute unreachable or serving an unreadable schema is operator-side (503); a\n* schema the parser cannot read is the caller's file (422).\n*/\nfunction mapCoreError(err) {\n\tif (err instanceof SchemaExtractionError) return err.kind === \"unreachable\" || err.kind === \"malformed\" ? new ApiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, err.message) : new ApiError(422, ApiErrorCode.UNPROCESSABLE, err.message);\n\tif (err instanceof ComputeServerUnconfiguredError) return new ApiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, err.message);\n\tif (err instanceof ProviderError) {\n\t\tconst friendly = friendlyConstraintMessage(err.message);\n\t\treturn new ApiError(err.statusCode, codeForStatus(err.statusCode), friendly ?? err.message);\n\t}\n}\n// ../server/src/api/openapi.ts\n/**\n* Builds an OpenAPI 3.1 document for a host's `/api/v1` from its route registry.\n*\n* Shared so every host publishes the same shape: `@selvajs/mcp` reads\n* `operationId`, `x-scope`, `x-internal` and the `Idempotency-Key` parameter\n* from it, and nothing else.\n*\n* Request schemas come from `z.toJSONSchema` over the actual validators, so a\n* renamed body field changes the spec on the next generate. Response schemas\n* are not derived: handlers build payloads from store records with no Zod\n* validator on the way out. They're described structurally (pagination\n* envelope, error envelope) and resource bodies stay open; `returns` adds prose.\n*/\nvar DEFAULT_ERROR_DESCRIPTIONS = {\n\t400: \"Validation failed.\",\n\t401: \"Missing or invalid credentials.\",\n\t403: \"Authenticated, but not permitted to perform this action. For an API token, `details.requiredScope` names the scope that would have passed.\",\n\t404: \"No such resource, or the caller cannot see it.\",\n\t409: \"The request conflicts with the current state.\",\n\t422: \"Well-formed but not processable.\",\n\t429: \"Rate limited. Retry after the interval in `Retry-After`.\",\n\t500: \"Unexpected server error.\",\n\t503: \"A dependency is unconfigured or unreachable. Retry later.\"\n};\nvar DEFAULT_IDEMPOTENCY_KEY_DESCRIPTION = \"A client-chosen key, 1 to 255 characters. Repeating the request with the same key within the retention window replays the first successful response instead of running it again; the replay carries `Idempotency-Replayed: true`. Keys are scoped to the calling token (or user, for a browser session). Reusing a key with a different method, path or body returns `422`. A failed attempt is not kept, so a corrected retry runs. The store is per-process and in-memory: it absorbs retries, does not survive a restart, and is not shared between app instances.\";\nfunction requestBodySchema(schema) {\n\tconst json = z.toJSONSchema(schema, {\n\t\tio: \"input\",\n\t\ttarget: \"draft-2020-12\"\n\t});\n\tdelete json.$schema;\n\treturn json;\n}\nfunction multipartSchema(fields) {\n\tconst properties = {};\n\tconst required = [];\n\tfor (const f of fields) {\n\t\tproperties[f.field] = {\n\t\t\ttype: \"string\",\n\t\t\tdescription: f.description\n\t\t};\n\t\tif (f.required) required.push(f.field);\n\t}\n\treturn required.length ? {\n\t\ttype: \"object\",\n\t\tproperties,\n\t\trequired\n\t} : {\n\t\ttype: \"object\",\n\t\tproperties\n\t};\n}\nfunction responseFor(ep) {\n\tif (ep.response === \"empty\") return { \"204\": { description: ep.returns ?? \"Success. No content.\" } };\n\tconst status = String(ep.status ?? 200);\n\tif (ep.response === \"collection\") return { [status]: {\n\t\tdescription: ep.returns ?? \"A page of results.\",\n\t\tcontent: { \"application/json\": { schema: { $ref: \"#/components/schemas/Page\" } } }\n\t} };\n\tif (ep.response === \"binary\") return { [status]: {\n\t\tdescription: ep.returns ?? \"Binary payload.\",\n\t\tcontent: { [ep.contentType ?? \"application/octet-stream\"]: { schema: {\n\t\t\ttype: \"string\",\n\t\t\tformat: \"binary\"\n\t\t} } }\n\t} };\n\treturn { [status]: {\n\t\tdescription: ep.returns ?? \"Success.\",\n\t\tcontent: { \"application/json\": { schema: { type: \"object\" } } }\n\t} };\n}\nfunction parametersFor(ep) {\n\tconst params = [];\n\tfor (const name of ep.path.matchAll(/\\{(\\w+)\\}/g)) params.push({\n\t\tname: name[1],\n\t\tin: \"path\",\n\t\trequired: true,\n\t\tschema: { type: \"string\" }\n\t});\n\tif (ep.response === \"collection\") params.push({ $ref: \"#/components/parameters/limit\" }, { $ref: \"#/components/parameters/cursor\" }, { $ref: \"#/components/parameters/orderBy\" }, { $ref: \"#/components/parameters/orderDir\" });\n\tfor (const q of ep.query ?? []) params.push({\n\t\tname: q.name,\n\t\tin: \"query\",\n\t\trequired: false,\n\t\tdescription: q.description,\n\t\tschema: { type: \"string\" }\n\t});\n\tif (ep.idempotent) params.push({ $ref: \"#/components/parameters/idempotencyKey\" });\n\treturn params;\n}\nfunction operationFor(ep, errorDescriptions, alwaysErrors) {\n\tconst op = {\n\t\tsummary: ep.summary,\n\t\toperationId: operationId(ep),\n\t\ttags: [tagFor(ep.path)],\n\t\t\"x-scope\": ep.scope\n\t};\n\tif (ep.internal) op[\"x-internal\"] = true;\n\tconst params = parametersFor(ep);\n\tif (params.length) op.parameters = params;\n\tif (ep.requestBody) op.requestBody = {\n\t\trequired: true,\n\t\tcontent: { \"application/json\": { schema: requestBodySchema(ep.requestBody) } }\n\t};\n\telse if (ep.multipart) op.requestBody = {\n\t\trequired: true,\n\t\tcontent: { \"multipart/form-data\": { schema: multipartSchema(ep.multipart) } }\n\t};\n\tconst responses = responseFor(ep);\n\tconst statuses = /* @__PURE__ */ new Set([...ep.errors ?? [], ...alwaysErrors]);\n\tif (ep.idempotent) statuses.add(422);\n\tfor (const status of [...statuses].sort((a, b) => a - b)) responses[String(status)] = {\n\t\tdescription: errorDescriptions[status] ?? \"Error.\",\n\t\tcontent: { \"application/json\": { schema: { $ref: \"#/components/schemas/Error\" } } }\n\t};\n\top.responses = responses;\n\treturn op;\n}\nvar cap = (s) => s.charAt(0).toUpperCase() + s.slice(1);\nvar stem = (s) => s.replace(/\\..*$/, \"\");\nfunction tagFor(path) {\n\treturn cap(stem(path.split(\"/\")[1] ?? \"root\"));\n}\n/** `PATCH /jobs/{id}` → `patchJobsById`. Public contract: clients and MCP tools call by it. */\nfunction operationId(ep) {\n\tconst segments = ep.path.split(\"/\").filter(Boolean).map((s) => s.startsWith(\"{\") ? `By${cap(s.slice(1, -1))}` : cap(stem(s)));\n\treturn ep.method.toLowerCase() + segments.join(\"\");\n}\nfunction buildOpenApiDocument(endpoints, options) {\n\tconst errorDescriptions = {\n\t\t...DEFAULT_ERROR_DESCRIPTIONS,\n\t\t...options.errorDescriptions\n\t};\n\tconst alwaysErrors = options.alwaysErrors ?? [\n\t\t401,\n\t\t403,\n\t\t429,\n\t\t500\n\t];\n\tconst paths = {};\n\tfor (const ep of endpoints) {\n\t\tconst path = `${options.basePath}${ep.path}`;\n\t\t(paths[path] ??= {})[ep.method.toLowerCase()] = operationFor(ep, errorDescriptions, alwaysErrors);\n\t}\n\tconst paginated = endpoints.some((ep) => ep.response === \"collection\");\n\tconst parameters = {};\n\tif (paginated) {\n\t\tparameters.limit = {\n\t\t\tname: \"limit\",\n\t\t\tin: \"query\",\n\t\t\trequired: false,\n\t\t\tdescription: `Page size. Out-of-range values clamp rather than fail, so a client walking a cursor is never stopped by pagination plumbing. Default 50.`,\n\t\t\tschema: {\n\t\t\t\ttype: \"integer\",\n\t\t\t\tminimum: 1,\n\t\t\t\tmaximum: 200\n\t\t\t}\n\t\t};\n\t\tparameters.cursor = {\n\t\t\tname: \"cursor\",\n\t\t\tin: \"query\",\n\t\t\trequired: false,\n\t\t\tdescription: \"An opaque cursor from a previous response's `nextCursor`. Do not construct or parse one.\",\n\t\t\tschema: { type: \"string\" }\n\t\t};\n\t\tparameters.orderBy = {\n\t\t\tname: \"orderBy\",\n\t\t\tin: \"query\",\n\t\t\trequired: false,\n\t\t\tschema: {\n\t\t\t\ttype: \"string\",\n\t\t\t\tenum: [\n\t\t\t\t\t\"createdAt\",\n\t\t\t\t\t\"updatedAt\",\n\t\t\t\t\t\"name\"\n\t\t\t\t]\n\t\t\t}\n\t\t};\n\t\tparameters.orderDir = {\n\t\t\tname: \"orderDir\",\n\t\t\tin: \"query\",\n\t\t\trequired: false,\n\t\t\tschema: {\n\t\t\t\ttype: \"string\",\n\t\t\t\tenum: [\"asc\", \"desc\"]\n\t\t\t}\n\t\t};\n\t}\n\tif (endpoints.some((ep) => ep.idempotent)) parameters.idempotencyKey = {\n\t\tname: \"Idempotency-Key\",\n\t\tin: \"header\",\n\t\trequired: false,\n\t\tdescription: options.idempotencyKeyDescription ?? DEFAULT_IDEMPOTENCY_KEY_DESCRIPTION,\n\t\tschema: {\n\t\t\ttype: \"string\",\n\t\t\tminLength: 1,\n\t\t\tmaxLength: 255\n\t\t}\n\t};\n\tconst schemas = {};\n\tif (paginated) schemas.Page = {\n\t\ttype: \"object\",\n\t\tdescription: \"The envelope every collection returns. `nextCursor` is absent on the last page.\",\n\t\tproperties: {\n\t\t\titems: {\n\t\t\t\ttype: \"array\",\n\t\t\t\titems: { type: \"object\" }\n\t\t\t},\n\t\t\tnextCursor: { type: \"string\" }\n\t\t},\n\t\trequired: [\"items\"]\n\t};\n\tschemas.Error = {\n\t\ttype: \"object\",\n\t\tdescription: \"Every failure carries this shape. Branch on `code`, not on the human-readable `message`.\",\n\t\tproperties: {\n\t\t\tmessage: { type: \"string\" },\n\t\t\tcode: {\n\t\t\t\ttype: \"string\",\n\t\t\t\tenum: Object.values(ApiErrorCode)\n\t\t\t},\n\t\t\tfields: {\n\t\t\t\ttype: \"object\",\n\t\t\t\tdescription: \"Per-field messages, keyed by dotted path. Present on validation failures.\",\n\t\t\t\tadditionalProperties: { type: \"string\" }\n\t\t\t},\n\t\t\tdetails: {\n\t\t\t\ttype: \"object\",\n\t\t\t\tdescription: \"Machine-readable context. A scope refusal carries `requiredScope`, e.g. `write:org:<id>`.\",\n\t\t\t\tadditionalProperties: { type: \"string\" }\n\t\t\t}\n\t\t},\n\t\trequired: [\"message\", \"code\"]\n\t};\n\tObject.assign(schemas, options.schemas);\n\tconst components = { securitySchemes: options.securitySchemes };\n\tif (Object.keys(parameters).length) components.parameters = parameters;\n\tcomponents.schemas = schemas;\n\treturn {\n\t\topenapi: \"3.1.0\",\n\t\tinfo: options.info,\n\t\tservers: [{\n\t\t\turl: \"/\",\n\t\t\tdescription: \"The instance serving this document.\"\n\t\t}],\n\t\tsecurity: options.security,\n\t\tcomponents,\n\t\tpaths\n\t};\n}\n// ../server/src/api/pagination.ts\n/**\n* Query-param parsing for the list pagination contract:\n* `?limit=&cursor=&orderBy=&orderDir=` → `{ items, nextCursor? }`.\n*\n* Every list endpoint parses these identically, so the clamping lives here\n* rather than inline per handler — a handler that clamps differently publishes\n* a different contract under the same documented one, and nothing fails at\n* build time.\n*/\n/**\n* An unparseable or out-of-range `limit` clamps rather than 400s: pagination\n* params are plumbing, and failing a read over one is hostile to clients\n* walking a cursor.\n*/\nfunction parseListOptions(url) {\n\tconst raw = Number(url.searchParams.get(\"limit\") ?? 50);\n\tconst limit = Number.isFinite(raw) ? Math.min(Math.max(Math.trunc(raw), 1), 200) : 50;\n\tconst orderByRaw = url.searchParams.get(\"orderBy\");\n\tconst orderBy = orderByRaw === \"createdAt\" || orderByRaw === \"updatedAt\" || orderByRaw === \"name\" ? orderByRaw : void 0;\n\treturn {\n\t\tlimit,\n\t\tcursor: url.searchParams.get(\"cursor\") ?? void 0,\n\t\torderBy,\n\t\torderDir: url.searchParams.get(\"orderDir\") === \"asc\" ? \"asc\" : void 0\n\t};\n}\n/** `parseListOptions` plus the definition-only `solveCount` ordering. */\nfunction parseDefinitionListOptions(url) {\n\tconst base = parseListOptions(url);\n\tif (url.searchParams.get(\"orderBy\") === \"solveCount\") return {\n\t\t...base,\n\t\torderBy: \"solveCount\"\n\t};\n\treturn base;\n}\n// ../server/src/api/bodies.ts\n/**\n* Request-body validators for the API routes that take JSON.\n*\n* They live apart from their handlers so a spec generator can import them\n* without loading a host's route module — in Selva's case a `+server.ts` imports\n* `./$types`, which only resolves inside a SvelteKit build.\n*\n* **A JSON body accepted by an API route belongs in this file.** Adding one\n* inline is invisible to the generator, so the endpoint documents an empty body.\n* Multipart handlers are the exception — `FormData` has no Zod schema to derive\n* from, so their fields are described in the spec directly.\n*/\nvar SolveBodySchema = z.object({\n\tinputs: z.array(z.unknown()).default([]),\n\tvalues: z.record(z.string(), z.unknown()).default({}),\n\tchannel: z.enum([\"live\", \"draft\"]).default(\"live\"),\n\tversionId: z.string().optional(),\n\t/** Must name this same definition, or the route 400s instead of solving a different one. */\n\tdefinitionUrl: z.string().optional()\n});\nvar CreateProjectBodySchema = z.object({\n\tname: z.string().min(1, \"Project name is required\").max(128).trim(),\n\tdescription: z.string().max(2e3).optional(),\n\tvisibility: ProjectVisibilitySchema.default(\"private\"),\n\tautoJoinOnUpload: z.boolean().optional()\n});\nvar UpdateProjectBodySchema = z.object({\n\tname: z.string().min(1).max(128).trim(),\n\tdescription: z.string().max(2e3).nullish(),\n\tvisibility: ProjectVisibilitySchema,\n\tautoJoinOnUpload: z.boolean()\n}).partial();\nvar AddProjectMemberBodySchema = z.object({\n\tuserId: z.string().min(1, \"userId is required\"),\n\trole: ProjectRoleSchema\n});\nvar UpdateProjectMemberBodySchema = z.object({ role: ProjectRoleSchema });\n/** Platform-scope entries are dropped downstream — an invite only grants org rights. */\nvar FlatPermissionSchema = z.union([PlatformPermissionSchema, OrgPermissionSchema]);\nvar CreateInviteBodySchema = z.object({\n\temail: z.email(\"Valid email is required\").transform((s) => s.toLowerCase().trim()),\n\torgRole: OrgRoleSchema.default(\"member\"),\n\tpermissions: z.array(FlatPermissionSchema).default([])\n});\n/**\n* `apiKey` is tri-state: **omitted** keeps the stored key, **null** clears it, a\n* string replaces it. `.optional().nullable()` — not `.nullish()` — because the\n* two must stay distinguishable after parsing, or a request that just omits the\n* field would silently wipe the stored credential.\n*/\nvar IncomingComputeServerSchema = z.object({\n\tid: z.string().min(1),\n\tlabel: z.string().min(1),\n\tserverUrl: z.string().min(1),\n\tapiKey: z.string().nullable().optional(),\n\ttimeoutMs: z.number().optional(),\n\tretryCount: z.number().optional()\n});\nvar OrgComputePatchBodySchema = z.object({\n\tservers: z.array(IncomingComputeServerSchema),\n\t/** May name any server visible to the org. `null` clears the override; omitted leaves it untouched. */\n\tdefaultServerId: z.string().nullable().optional()\n});\nvar UpdateOrgMemberBodySchema = z.object({\n\trole: OrgRoleSchema.optional(),\n\tpermissions: z.array(z.enum(ALL_ORG_PERMISSIONS)).optional()\n}).refine((b) => b.role !== void 0 || b.permissions !== void 0, { message: \"Provide at least one of role, permissions\" });\nvar CreateApiTokenBodySchema = z.object({\n\tname: z.string().trim().min(1, \"Name is required\").max(100),\n\tscopes: z.array(ApiScopeStringSchema).min(1, \"Pick at least one scope\").max(20),\n\texpiresInDays: z.union(API_TOKEN_LIFETIME_DAYS.map((d) => z.literal(d)))\n});\n// ../server/src/api/responses-schema.ts\n/**\n* Response schemas for the v1 payloads that must not carry a stored secret.\n*\n* Four store types hold a credential next to fields a client legitimately\n* reads: `ShareLink.tokenHash`, `Invite.tokenHash` and `ApiToken.tokenHash` are HMACs of a token,\n* `ComputeServerCommon.apiKey` is a live Rhino.Compute key. Handlers used to\n* strip them by destructuring — `const { tokenHash: _omit, ...rest } = invite`\n* — which works until someone adds a field to the stored type or edits the line\n* away. Nothing fails at build time; the credential just starts appearing in a\n* response.\n*\n* Parsing through these schemas inverts the default: the response carries only\n* what the schema names, so a new field on the stored type is invisible to\n* clients until added here on purpose. Use them via `shaped`/`shapedCollection`\n* in `./route.ts`.\n*\n* These describe **responses**, not stored records — where the two differ (an\n* invite's one-time `acceptUrl`, a share link's `hasToken` sentinel) the\n* response is the authority.\n*/\nvar ShareLinkResponseSchema = z.object({\n\tid: z.string(),\n\tdefinitionId: z.string(),\n\tchannel: z.enum([\"live\", \"draft\"]),\n\tname: z.string().optional(),\n\tcreatedBy: z.string(),\n\tcreatedAt: z.string(),\n\texpiresAt: z.string().nullish(),\n\trevokedAt: z.string().nullish(),\n\tallowSolve: z.boolean(),\n\tmaxSolves: z.number().nullish(),\n\tsolveCount: z.number(),\n\t/** Sentinel replacing `tokenHash`: a token exists, its hash is not yours. */\n\thasToken: z.literal(true)\n});\n/** The mint response. `token` is the plaintext, returned exactly once. */\nvar CreatedShareLinkResponseSchema = z.object({\n\tlink: ShareLinkResponseSchema,\n\ttoken: z.string()\n});\nvar InviteResponseSchema = z.object({\n\tid: z.string(),\n\temail: z.string(),\n\torgId: z.string(),\n\torgRole: z.string(),\n\torgPermissions: z.array(z.string()),\n\tplatformPermissions: z.array(z.string()).default([]),\n\tinvitedBy: z.string(),\n\tcreatedAt: z.string(),\n\texpiresAt: z.string(),\n\tacceptedAt: z.string().optional(),\n\tacceptedByUserId: z.string().optional()\n});\n/**\n* The create response: the invite plus the link to send, built per request.\n*\n* `acceptUrl` is returned whatever `delivery` says — mail is best-effort, and\n* manual sharing is the fallback when it is off or the send failed.\n*/\nvar CreatedInviteResponseSchema = InviteResponseSchema.extend({\n\tacceptUrl: z.string(),\n\tdelivery: z.enum([\n\t\t\"sent\",\n\t\t\"not-configured\",\n\t\t\"failed\"\n\t])\n});\n/**\n* An org-owned compute server. `apiKey` is replaced by `hasApiKey`, so a picker\n* can render \"key set\" without any store decrypting a secret to throw away.\n*/\nvar OrgComputeServerResponseSchema = z.object({\n\tid: z.string(),\n\tlabel: z.string(),\n\tserverUrl: z.string(),\n\tscope: z.literal(\"org\"),\n\townerOrgId: z.string(),\n\ttimeoutMs: z.number().optional(),\n\tretryCount: z.number().optional(),\n\thasApiKey: z.boolean()\n});\n/** A server this org may select but not edit. Never carries a key either. */\nvar ComputeCatalogEntrySchema = z.object({\n\tid: z.string(),\n\tlabel: z.string(),\n\tserverUrl: z.string(),\n\tscope: z.enum([\"platform\", \"org\"]),\n\tsource: z.enum([\"platform\", \"org\"]),\n\ttimeoutMs: z.number().optional(),\n\tretryCount: z.number().optional()\n});\nvar OrgComputeResponseSchema = z.object({\n\tservers: z.array(OrgComputeServerResponseSchema),\n\tdefaultServerId: z.string().nullish(),\n\tglobalDefaultServerId: z.string().nullish(),\n\tcatalog: z.array(ComputeCatalogEntrySchema)\n});\nvar ApiTokenResponseSchema = z.object({\n\tid: z.string(),\n\tuserId: z.string(),\n\tcreatedBy: z.string().nullable(),\n\torgId: z.string(),\n\tname: z.string(),\n\tscopes: z.array(z.string()),\n\tcreatedAt: z.string(),\n\texpiresAt: z.string(),\n\tlastUsedAt: z.string().nullable(),\n\trevokedAt: z.string().nullable(),\n\t/** Scope refusals since midnight UTC, counted in this process only. */\n\trefusedToday: z.number()\n});\n/** The mint response. `secret` is the raw key, returned exactly once. */\nvar CreatedApiTokenResponseSchema = z.object({\n\ttoken: ApiTokenResponseSchema,\n\tsecret: z.string()\n});\nexport { resolveApiRateLimitConfig as A, readForm as B, idempotencyCallerId as C, chargeApiRateLimit as D, runIdempotent as E, projectScopeTarget as F, depsFromConfig as G, requireParams as H, scopeRefusalsToday as I, formText as L, assertScope as M, assertScopeAnywhere as N, createApiRateLimiter as O, definitionScopeTarget as P, parseBody as R, createApiIdempotencyStore as S, requestFingerprint as T, requireUpload as U, requireCaller as V, throwZodError as W, parseDefinitionListOptions as _, InviteResponseSchema as a, mapCoreError as b, AddProjectMemberBodySchema as c, CreateProjectBodySchema as d, OrgComputePatchBodySchema as f, UpdateProjectMemberBodySchema as g, UpdateProjectBodySchema as h, CreatedShareLinkResponseSchema as i, withRateLimitHeaders as j, rateLimitedResponse as k, CreateApiTokenBodySchema as l, UpdateOrgMemberBodySchema as m, CreatedApiTokenResponseSchema as n, OrgComputeResponseSchema as o, SolveBodySchema as p, CreatedInviteResponseSchema as r, ShareLinkResponseSchema as s, ApiTokenResponseSchema as t, CreateInviteBodySchema as u, parseListOptions as v, readIdempotencyKey as w, runHandler as x, buildOpenApiDocument as y, parseParam as z };\n"],"names":[],"mappings":";;;;;;;AAMA;AACA;AACA;AACA;AACA;AACA,SAAS,sBAAsB,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC,EAAE;AACzD,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC;AAC/D,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,IAAI,KAAK,CAAC,CAAC;AACjF,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,iBAAiB;AAC/D,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;AACtC,EAAE,GAAG,MAAM;AACX,EAAE,KAAK;AACP,EAAE,OAAO;AACT,EAAE;AACF,EAAE,CAAC;AACH,CAAC,MAAM,OAAO,mBAAmB,IAAI,GAAG,EAAE;AAC1C,CAAC,IAAI,WAAW,GAAG,MAAM,CAAC,iBAAiB;AAC3C,CAAC,IAAI,WAAW,GAAG,CAAC;AACpB,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE;AACpB,EAAE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;AAChC,EAAE,IAAI,CAAC,KAAK,EAAE;AACd,EAAE,WAAW,IAAI,KAAK,CAAC,MAAM;AAC7B,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;AACrB,CAAC;AACD;AACA,CAAC,SAAS,UAAU,GAAG;AACvB,EAAE,IAAI,WAAW,IAAI,SAAS,EAAE;AAChC,EAAE,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChI,EAAE,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,OAAO,EAAE;AAC/B,GAAG,IAAI,WAAW,IAAI,SAAS,EAAE;AACjC,GAAG,IAAI,CAAC,GAAG,CAAC;AACZ,EAAE;AACF,CAAC;AACD,CAAC,SAAS,UAAU,CAAC,GAAG,EAAE,QAAQ,GAAG,CAAC,EAAE;AACxC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;AAChD,EAAE,IAAI,EAAE,eAAe,GAAG,CAAC,IAAI,GAAG,IAAI,WAAW,CAAC,IAAI,OAAO,CAAC,IAAI,IAAI,MAAM,EAAE;AAC9E,EAAE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC;AACtG,EAAE,IAAI,eAAe,GAAG,CAAC,EAAE,WAAW,GAAG,GAAG,GAAG,eAAe;AAC9D,EAAE,IAAI,OAAO,CAAC,IAAI,GAAG,MAAM,EAAE;AAC7B,GAAG,MAAM,WAAW,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;AACzH,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChF,EAAE;AACF,CAAC;AACD,CAAC,OAAO;AACR,EAAE,MAAM,EAAE,cAAc;AACxB,EAAE,MAAM,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE;AACrB,GAAG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;AACzB,GAAG,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;AACpC,GAAG,IAAI,QAAQ,KAAK,QAAQ,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO;AACtF,IAAI,KAAK,EAAE,MAAM,QAAQ,CAAC,OAAO;AACjC,IAAI,QAAQ,EAAE;AACd,IAAI;AACJ,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC5C,GAAG,MAAM,OAAO,GAAG,EAAE,EAAE;AACvB,GAAG,MAAM,KAAK,GAAG;AACjB,IAAI,OAAO;AACX,IAAI,SAAS,EAAE,IAAI;AACnB,IAAI,MAAM,EAAE;AACZ,IAAI;AACJ,GAAG,IAAI,CAAC,GAAG,CAAC;AACZ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC;AAC1B,GAAG,IAAI,eAAe,GAAG,CAAC,IAAI,WAAW,KAAK,MAAM,CAAC,iBAAiB,EAAE,WAAW,GAAG,GAAG,GAAG,eAAe;AAC3G,GAAG,IAAI;AACP,IAAI,MAAM,KAAK,GAAG,MAAM,OAAO;AAC/B,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;AACxC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE;AACpC,KAAK,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC;AAChC,KAAK,WAAW,IAAI,KAAK,CAAC,MAAM;AAChC,KAAK,UAAU,EAAE;AACjB,IAAI;AACJ,IAAI,OAAO;AACX,KAAK,KAAK;AACV,KAAK,QAAQ,EAAE;AACf,KAAK;AACL,GAAG,CAAC,CAAC,OAAO,GAAG,EAAE;AACjB,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC;AAC7C,IAAI,MAAM,GAAG;AACb,GAAG;AACH,EAAE,CAAC;AACH,EAAE,KAAK,GAAG;AACV,GAAG,OAAO,CAAC,KAAK,EAAE;AAClB,GAAG,WAAW,GAAG,CAAC;AAClB,GAAG,WAAW,GAAG,MAAM,CAAC,iBAAiB;AACzC,EAAE,CAAC;AACH,EAAE,IAAI,GAAG;AACT,GAAG,OAAO,OAAO,CAAC,IAAI;AACtB,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,MAAM,EAAE,QAAQ,GAAG,EAAE,EAAE,EAAE,MAAM,GAAG,EAAE,EAAE,YAAY,EAAE,kBAAkB,GAAG,MAAM,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,GAAG,OAAO,EAAE,oBAAoB,GAAG,kBAAkB,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,EAAE,EAAE;AACjO,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM;AACxB,CAAC,OAAO;AACR,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI;AACnB,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO;AACzB,EAAE,IAAI;AACN,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI;AACjB,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ;AACzB,EAAE,cAAc,EAAE,IAAI,CAAC,WAAW;AAClC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa;AACnC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW;AAC/B,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU;AAC7B,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO;AACvB,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW;AAC/B,EAAE,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;AACnD,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI,aAAa,EAAE;AAC9C,EAAE,IAAI,EAAE,CAAC,IAAI,KAAK,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;AAC7C,EAAE,MAAM;AACR,EAAE,YAAY,EAAE;AAChB,GAAG,qBAAqB,EAAE,YAAY,EAAE,qBAAqB,IAAI,QAAQ;AACzE,GAAG,gBAAgB,EAAE,YAAY,EAAE,gBAAgB,IAAI;AACvD,GAAG;AACH,EAAE,kBAAkB;AACpB,EAAE,aAAa;AACf,EAAE,YAAY;AACd,EAAE,oBAAoB;AACtB,EAAE,cAAc;AAChB,EAAE,WAAW;AACb,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,GAAG,EAAE;AAC5B,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC;AACpF,CAAC,OAAO;AACR,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG;AACd,EAAE,IAAI,EAAE,GAAG,CAAC;AACZ,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,GAAG,EAAE;AAC5B,CAAC,MAAM,MAAM,GAAG,EAAE;AAClB,CAAC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE;AACjC,EAAE,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG;AAC5D,EAAE,IAAI,EAAE,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO;AACnD,CAAC;AACD,CAAC,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5B,CAAC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE;AAClE,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC;AACjF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,MAAM,EAAE,GAAG,KAAK,EAAE;AACzC,CAAC,MAAM,GAAG,GAAG,EAAE;AACf,CAAC,MAAM,OAAO,GAAG,EAAE;AACnB,CAAC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE;AAC3B,EAAE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;AAC5B,EAAE,IAAI,CAAC,KAAK,EAAE;AACd,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;AACrB,GAAG;AACH,EAAE;AACF,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK;AACnB,CAAC;AACD,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,sBAAsB,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACnJ,CAAC,OAAO,GAAG;AACX;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;AACzC,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;AACvC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC,CAAC;AACjG,CAAC,OAAO,MAAM,CAAC,IAAI;AACnB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE;AAC9D,CAAC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;AAClD,CAAC,IAAI,GAAG,GAAG,IAAI;AACf,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI;AACtB,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;AACxB,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,qCAAqC,CAAC;AACtF,CAAC;AACD,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,SAAS,IAAI,IAAI,CAAC;AAC1D,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AACjD,CAAC,OAAO,MAAM,CAAC,IAAI;AACnB;AACA,IAAI,WAAW,mBAAmB,IAAI,OAAO,EAAE;AAC/C;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,QAAQ,CAAC,OAAO,EAAE;AAC3B,CAAC,IAAI,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC;AACpC,CAAC,IAAI,CAAC,IAAI,EAAE;AACZ,EAAE,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,uCAAuC,CAAC,CAAC;AAC/H,EAAE,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC;AAChC,CAAC;AACD,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,GAAG,MAAM,EAAE,EAAE;AAC5F,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;AAC7B,CAAC,IAAI,EAAE,IAAI,YAAY,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,YAAY,CAAC,CAAC;AACtI,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE;AAC5E,CAAC,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,gCAAgC,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC7J,CAAC,IAAI,YAAY,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,YAAY,CAAC,OAAO,CAAC;AAC9H,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,EAAE,KAAK,CAAC,sBAAsB,EAAE,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;AAClI,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE;AACF,EAAE;AACF;AACA;AACA,SAAS,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE;AACnD,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;AAC5B,CAAC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,OAAO,MAAM;AAC3C,CAAC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE;AAC3B,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,MAAM;AAC5B,CAAC,OAAO,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,OAAO;AACzD;AACA;AACA;AACA,SAAS,eAAe,CAAC,MAAM,EAAE;AACjC,CAAC,OAAO,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,GAAG,MAAM,GAAG,OAAO;AAChE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE;AAC1C,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,IAAI,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE;AACzD,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;AACpC,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,6BAA6B,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;AACrJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE;AAC1C,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE;AACrB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,oBAAoB,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE;AAC9E,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;AACpC,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AACjF;AACA,IAAI,QAAQ,mBAAmB,IAAI,GAAG,EAAE;AACxC,IAAI,MAAM,GAAG,MAAM,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;AAC1E,SAAS,aAAa,CAAC,OAAO,EAAE;AAChC,CAAC,MAAM,GAAG,GAAG,MAAM,EAAE;AACrB,CAAC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;AACpC,CAAC,IAAI,KAAK,EAAE,GAAG,KAAK,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE;AACtC,MAAM,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE;AAC5B,EAAE,GAAG;AACL,EAAE,KAAK,EAAE;AACT,EAAE,CAAC;AACH;AACA;AACA,SAAS,kBAAkB,CAAC,OAAO,EAAE;AACrC,CAAC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;AACpC,CAAC,OAAO,KAAK,EAAE,GAAG,KAAK,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC;AACjD;AACA,SAAS,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE;AAC5C,CAAC,IAAI,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;AACtE,CAAC,IAAI,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;AAC/E,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;AAC1C;AACA;AACA,SAAS,kBAAkB,CAAC,KAAK,GAAG,IAAI,EAAE;AAC1C,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACnD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,KAAK,GAAG,MAAM,EAAE;AAC/C,CAAC,OAAO,OAAO,GAAG,KAAK;AACvB,EAAE,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;AACxC,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE;AACxD,EAAE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC;AACzE,EAAE,MAAM,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI;AAC/F,EAAE,IAAI,CAAC,OAAO,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE;AAClF,EAAE,OAAO;AACT,GAAG,YAAY;AACf,GAAG,SAAS,EAAE,OAAO,CAAC;AACtB,GAAG;AACH,CAAC,CAAC;AACF;AACA;AACA,IAAI,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC;AAC3C,CAAC,QAAQ,EAAE,GAAG;AACd,CAAC,YAAY,EAAE;AACf,CAAC,CAAC;AACF;AACA;AACA;AACA;AACA,SAAS,yBAAyB,CAAC,GAAG,EAAE,MAAM,EAAE;AAChD,CAAC,OAAO;AACR,EAAE,QAAQ,EAAE,eAAe,CAAC,GAAG,EAAE,gCAAgC,EAAE,sBAAsB,CAAC,QAAQ,EAAE,MAAM,CAAC;AAC3G,EAAE,YAAY,EAAE,kBAAkB,CAAC,GAAG,EAAE,0BAA0B,EAAE,sBAAsB,CAAC,YAAY,EAAE,MAAM;AAC/G,EAAE;AACF;AACA;AACA,SAAS,oBAAoB,CAAC,MAAM,GAAG,sBAAsB,EAAE;AAC/D,CAAC,IAAI,MAAM,CAAC,YAAY,IAAI,CAAC,EAAE,OAAO,IAAI;AAC1C,CAAC,MAAM,KAAK,GAAG,wBAAwB,CAAC,MAAM,CAAC;AAC/C,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY;AAClC,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE;AACnB,EAAE,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC;AACjC,EAAE,OAAO;AACT,GAAG,OAAO,EAAE,MAAM,CAAC,OAAO;AAC1B,GAAG,KAAK;AACR,GAAG,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACnD,GAAG,UAAU,EAAE,MAAM,CAAC;AACtB,GAAG;AACH,CAAC,CAAC,EAAE;AACJ;AACA,IAAI,eAAe;AACnB;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,GAAG;AACjC,CAAC,IAAI,eAAe,KAAK,MAAM,EAAE,eAAe,GAAG,oBAAoB,EAAE;AACzE,CAAC,OAAO,eAAe;AACvB;AACA;AACA;AACA;AACA;AACA,eAAe,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE;AAChD,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,IAAI,CAAC,OAAO,EAAE,OAAO,MAAM;AAC9C,CAAC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AACpD;AACA,SAAS,gBAAgB,CAAC,OAAO,EAAE;AACnC,CAAC,MAAM,OAAO,GAAG;AACjB,EAAE,iBAAiB,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;AAC1C,EAAE,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;AACjD,EAAE;AACF,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC;AAC/E,CAAC,OAAO,OAAO;AACf;AACA;AACA,SAAS,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,CAAC,+CAA+C,EAAE,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE;AAC/H,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC;AACnD,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC;AAC1F,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE;AACvD,EAAE,MAAM,EAAE,GAAG;AACb,EAAE,OAAO,EAAE;AACX,GAAG,cAAc,EAAE,kBAAkB;AACrC,GAAG,GAAG,gBAAgB,CAAC,OAAO;AAC9B;AACA,EAAE,CAAC;AACH;AACA;AACA,SAAS,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE;AAC5C,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG;AACzB,CAAC,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC;AAC1C,CAAC,IAAI;AACL,EAAE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;AACrE,EAAE,OAAO,GAAG;AACZ,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;AACvC,EAAE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;AAC9D,EAAE,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE;AAChC,GAAG,MAAM,EAAE,GAAG,CAAC,MAAM;AACrB,GAAG,UAAU,EAAE,GAAG,CAAC,UAAU;AAC7B,GAAG,OAAO,EAAE;AACZ,GAAG,CAAC;AACJ,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,2BAA2B,GAAG,sBAAsB;AACxD;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,QAAQ,EAAE,SAAS,EAAE;AAC7C,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AAClC;AACA;AACA,eAAe,gBAAgB,CAAC,GAAG,EAAE;AACrC,CAAC,OAAO;AACR,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM;AACpB,EAAE,OAAO,EAAE,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;AACrC,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,WAAW;AAC7B,EAAE;AACF;AACA;AACA,SAAS,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE;AAC9C,CAAC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;AAC5C,CAAC,IAAI,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,MAAM,CAAC;AAC/D,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE;AAClC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM;AACvB,EAAE;AACF,EAAE,CAAC;AACH;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,sBAAsB,GAAG,iBAAiB;AAC9C;AACA,IAAI,8BAA8B,GAAG,GAAG;AACxC;AACA;AACA;AACA;AACA;AACA,IAAI,iCAAiC,GAAG,SAAS;AACjD,IAAI,qBAAqB,GAAG,GAAG;AAC/B,SAAS,yBAAyB,CAAC,KAAK,GAAG,8BAA8B,EAAE,QAAQ,GAAG,iCAAiC,EAAE;AACzH,CAAC,OAAO,sBAAsB,CAAC;AAC/B,EAAE,KAAK;AACP,EAAE,SAAS,EAAE;AACb,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;AAC9C;AACA,IAAI,aAAa;AACjB;AACA,SAAS,0BAA0B,GAAG;AACtC,CAAC,OAAO,aAAa,KAAK,yBAAyB,EAAE;AACrD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,GAAG,EAAE;AAClC,CAAC,OAAO,GAAG,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;AAC7E;AACA;AACA,SAAS,kBAAkB,CAAC,OAAO,EAAE;AACrC,CAAC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;AACxD,CAAC,IAAI,GAAG,KAAK,IAAI,EAAE,OAAO,IAAI;AAC9B,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,EAAE,sBAAsB,CAAC,6BAA6B,CAAC,CAAC;AAClJ,CAAC,OAAO,GAAG;AACX;AACA,eAAe,SAAS,CAAC,KAAK,EAAE;AAChC,CAAC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC;AAC5D,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3F;AACA;AACA,eAAe,kBAAkB,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE;AACrD,CAAC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAChG,CAAC,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC;AAC9F,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;AACxD,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;AAChB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;AAC7B,CAAC,OAAO,SAAS,CAAC,KAAK,CAAC;AACxB;AACA,eAAe,aAAa,CAAC,IAAI,EAAE;AACnC,CAAC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC;AAClC,CAAC,WAAW,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;AAC5D,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;AAC1B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,eAAe,CAAC,OAAO,EAAE;AACxC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;AACvI,CAAC,IAAI,IAAI;AACT,CAAC,IAAI;AACL,EAAE,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC;AAChC,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,qBAAqB;AAC9B,CAAC;AACD,CAAC,MAAM,KAAK,GAAG,EAAE;AACjB,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,KAAK,KAAK,QAAQ,GAAG,KAAK,GAAG;AACzF,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI;AAClB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI;AAClB,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC,KAAK;AACnC,EAAE,CAAC,CAAC;AACJ,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;AAC7B;AACA,IAAI,aAAa,GAAG,MAAM;AAC1B,CAAC,WAAW;AACZ,CAAC,QAAQ;AACT,CAAC,WAAW,CAAC,WAAW,EAAE,QAAQ,EAAE;AACpC,EAAE,IAAI,CAAC,WAAW,GAAG,WAAW;AAChC,EAAE,IAAI,CAAC,QAAQ,GAAG,QAAQ;AAC1B,CAAC;AACD,CAAC;AACD,SAAS,iBAAiB,CAAC,MAAM,EAAE,WAAW,EAAE;AAChD,CAAC,IAAI,MAAM,KAAK,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,sBAAsB,CAAC,0CAA0C,CAAC,CAAC;AAClJ;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,aAAa,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE;AAC9E,CAAC,IAAI,OAAO;AACZ,CAAC,IAAI,OAAO,GAAG,KAAK;AACpB,CAAC,IAAI;AACL,EAAE,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,YAAY;AAC7E,GAAG,OAAO,GAAG,IAAI;AACjB,GAAG,MAAM,GAAG,GAAG,MAAM,EAAE,EAAE;AACzB,GAAG,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC;AAC/C,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC;AACxE,GAAG,OAAO;AACV,IAAI,WAAW;AACf,IAAI;AACJ,IAAI;AACJ,EAAE,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,IAAI,EAAE,GAAG,YAAY,aAAa,CAAC,EAAE,MAAM,GAAG;AAChD,EAAE,iBAAiB,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC;AACjD,EAAE,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,qBAAqB,EAAE,OAAO,aAAa,CAAC;AACtF,GAAG,KAAK;AACR,GAAG,QAAQ;AACX,GAAG,SAAS;AACZ,GAAG;AACH,GAAG,EAAE,EAAE,CAAC;AACR,EAAE,OAAO,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC;AAChD,CAAC;AACD,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,WAAW,CAAC;AAC1D,CAAC,OAAO,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC;AACpE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,UAAU,CAAC,MAAM,EAAE;AAC5B,CAAC,IAAI,MAAM,YAAY,QAAQ,EAAE,OAAO,MAAM;AAC9C,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM;AACzC,CAAC,IAAI,IAAI,KAAK,MAAM,EAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;AAChD,EAAE,MAAM,EAAE,MAAM,IAAI,GAAG;AACvB,EAAE;AACF,EAAE,CAAC;AACH,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;AAC3C,EAAE,MAAM,EAAE,MAAM,IAAI,GAAG;AACvB,EAAE,OAAO,EAAE;AACX,GAAG,cAAc,EAAE,kBAAkB;AACrC,GAAG,GAAG;AACN;AACA,EAAE,CAAC;AACH;AACA;AACA,eAAe,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE;AAC3G,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK;AACvB,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,OAAO,UAAU,CAAC;AACzC,GAAG,MAAM,EAAE,GAAG,CAAC,MAAM;AACrB,GAAG,IAAI,EAAE,WAAW,CAAC,GAAG;AACxB,GAAG,CAAC;AACJ,EAAE,MAAM,MAAM,GAAG,QAAQ,GAAG,GAAG,CAAC;AAChC,EAAE,IAAI,MAAM,EAAE,OAAO,UAAU,CAAC;AAChC,GAAG,MAAM,EAAE,MAAM,CAAC,MAAM;AACxB,GAAG,IAAI,EAAE,WAAW,CAAC,MAAM;AAC3B,GAAG,CAAC;AACJ,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE;AACrC,GAAG,SAAS,EAAE,KAAK;AACnB,GAAG,GAAG,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG;AACpE,GAAG,CAAC;AACJ,EAAE,OAAO,UAAU,CAAC;AACpB,GAAG,MAAM,EAAE,GAAG;AACd,GAAG,IAAI,EAAE;AACT,IAAI,OAAO,EAAE,QAAQ;AACrB,IAAI,IAAI,EAAE,YAAY,CAAC;AACvB;AACA,GAAG,CAAC;AACJ,CAAC,CAAC;AACF,CAAC,IAAI,OAAO;AACZ,CAAC,IAAI;AACL,EAAE,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,KAAK,CAAC,GAAG,qBAAqB,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,cAAc;AACxG,EAAE,OAAO,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC;AACtD,EAAE,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,mBAAmB,CAAC,OAAO,CAAC;AACtE,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC;AAClB,CAAC;AACD,CAAC,IAAI,GAAG;AACR,CAAC,IAAI;AACL,EAAE,IAAI,GAAG,CAAC,GAAG,EAAE,QAAQ,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;AACxJ,EAAE,MAAM,GAAG,GAAG,YAAY;AAC1B,GAAG,IAAI;AACP,IAAI,OAAO,UAAU,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;AACzC,GAAG,CAAC,CAAC,OAAO,GAAG,EAAE;AACjB,IAAI,OAAO,IAAI,CAAC,GAAG,CAAC;AACpB,GAAG;AACH,EAAE,CAAC;AACH,EAAE,MAAM,SAAS,GAAG,UAAU,IAAI,GAAG,CAAC,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI;AAClF,EAAE,IAAI,SAAS,IAAI,GAAG,CAAC,GAAG,EAAE;AAC5B,GAAG,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAChH,GAAG,GAAG,GAAG,MAAM,aAAa,CAAC;AAC7B,IAAI,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,0BAA0B,EAAE;AAC/D,IAAI,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC;AAC1C,IAAI,SAAS;AACb,IAAI;AACJ,IAAI,EAAE,GAAG,CAAC;AACV,EAAE,CAAC,MAAM,GAAG,GAAG,MAAM,GAAG,EAAE;AAC1B,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;AACjB,CAAC;AACD,CAAC,OAAO,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC;AAC1C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,0BAA0B,GAAG;AACjC,CAAC,wBAAwB,EAAE,+DAA+D;AAC1F,CAAC,wBAAwB,EAAE,+DAA+D;AAC1F,CAAC,aAAa,EAAE,gDAAgD;AAChE,CAAC,gBAAgB,EAAE;AACnB,CAAC;AACD,SAAS,yBAAyB,CAAC,GAAG,EAAE;AACxC,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG;AACzG,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA,SAAS,YAAY,CAAC,GAAG,EAAE;AAC3B,CAAC,IAAI,GAAG,YAAY,qBAAqB,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,aAAa,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,GAAG,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC;AACxO,CAAC,IAAI,GAAG,YAAY,8BAA8B,EAAE,OAAO,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,GAAG,CAAC,OAAO,CAAC;AAC3H,CAAC,IAAI,GAAG,YAAY,aAAa,EAAE;AACnC,EAAE,MAAM,QAAQ,GAAG,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC;AACzD,EAAE,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC;AAC7F,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,0BAA0B,GAAG;AACjC,CAAC,GAAG,EAAE,oBAAoB;AAC1B,CAAC,GAAG,EAAE,iCAAiC;AACvC,CAAC,GAAG,EAAE,4IAA4I;AAClJ,CAAC,GAAG,EAAE,gDAAgD;AACtD,CAAC,GAAG,EAAE,+CAA+C;AACrD,CAAC,GAAG,EAAE,kCAAkC;AACxC,CAAC,GAAG,EAAE,0DAA0D;AAChE,CAAC,GAAG,EAAE,0BAA0B;AAChC,CAAC,GAAG,EAAE;AACN,CAAC;AACD,IAAI,mCAAmC,GAAG,uiBAAuiB;AACjlB,SAAS,iBAAiB,CAAC,MAAM,EAAE;AACnC,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE;AACrC,EAAE,EAAE,EAAE,OAAO;AACb,EAAE,MAAM,EAAE;AACV,EAAE,CAAC;AACH,CAAC,OAAO,IAAI,CAAC,OAAO;AACpB,CAAC,OAAO,IAAI;AACZ;AACA,SAAS,eAAe,CAAC,MAAM,EAAE;AACjC,CAAC,MAAM,UAAU,GAAG,EAAE;AACtB,CAAC,MAAM,QAAQ,GAAG,EAAE;AACpB,CAAC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE;AACzB,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG;AACxB,GAAG,IAAI,EAAE,QAAQ;AACjB,GAAG,WAAW,EAAE,CAAC,CAAC;AAClB,GAAG;AACH,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AACxC,CAAC;AACD,CAAC,OAAO,QAAQ,CAAC,MAAM,GAAG;AAC1B,EAAE,IAAI,EAAE,QAAQ;AAChB,EAAE,UAAU;AACZ,EAAE;AACF,EAAE,GAAG;AACL,EAAE,IAAI,EAAE,QAAQ;AAChB,EAAE;AACF,EAAE;AACF;AACA,SAAS,WAAW,CAAC,EAAE,EAAE;AACzB,CAAC,IAAI,EAAE,CAAC,QAAQ,KAAK,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,OAAO,IAAI,sBAAsB,EAAE,EAAE;AACrG,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,MAAM,IAAI,GAAG,CAAC;AACxC,CAAC,IAAI,EAAE,CAAC,QAAQ,KAAK,YAAY,EAAE,OAAO,EAAE,CAAC,MAAM,GAAG;AACtD,EAAE,WAAW,EAAE,EAAE,CAAC,OAAO,IAAI,oBAAoB;AACjD,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,2BAA2B,EAAE,EAAE;AAClF,EAAE,EAAE;AACJ,CAAC,IAAI,EAAE,CAAC,QAAQ,KAAK,QAAQ,EAAE,OAAO,EAAE,CAAC,MAAM,GAAG;AAClD,EAAE,WAAW,EAAE,EAAE,CAAC,OAAO,IAAI,iBAAiB;AAC9C,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,IAAI,0BAA0B,GAAG,EAAE,MAAM,EAAE;AACvE,GAAG,IAAI,EAAE,QAAQ;AACjB,GAAG,MAAM,EAAE;AACX,GAAG,EAAE;AACL,EAAE,EAAE;AACJ,CAAC,OAAO,EAAE,CAAC,MAAM,GAAG;AACpB,EAAE,WAAW,EAAE,EAAE,CAAC,OAAO,IAAI,UAAU;AACvC,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;AAC/D,EAAE,EAAE;AACJ;AACA,SAAS,aAAa,CAAC,EAAE,EAAE;AAC3B,CAAC,MAAM,MAAM,GAAG,EAAE;AAClB,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC;AAChE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AACf,EAAE,EAAE,EAAE,MAAM;AACZ,EAAE,QAAQ,EAAE,IAAI;AAChB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ;AAC1B,EAAE,CAAC;AACH,CAAC,IAAI,EAAE,CAAC,QAAQ,KAAK,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,+BAA+B,EAAE,EAAE,EAAE,IAAI,EAAE,gCAAgC,EAAE,EAAE,EAAE,IAAI,EAAE,iCAAiC,EAAE,EAAE,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC;AAChO,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC;AAC7C,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;AACd,EAAE,EAAE,EAAE,OAAO;AACb,EAAE,QAAQ,EAAE,KAAK;AACjB,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW;AAC5B,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ;AAC1B,EAAE,CAAC;AACH,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,wCAAwC,EAAE,CAAC;AACnF,CAAC,OAAO,MAAM;AACd;AACA,SAAS,YAAY,CAAC,EAAE,EAAE,iBAAiB,EAAE,YAAY,EAAE;AAC3D,CAAC,MAAM,EAAE,GAAG;AACZ,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO;AACrB,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;AAC9B,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;AACzB,EAAE,SAAS,EAAE,EAAE,CAAC;AAChB,EAAE;AACF,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,IAAI;AACzC,CAAC,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,CAAC;AACjC,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,GAAG,MAAM;AAC1C,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,GAAG;AACtC,EAAE,QAAQ,EAAE,IAAI;AAChB,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE;AAC9E,EAAE;AACF,MAAM,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,WAAW,GAAG;AACzC,EAAE,QAAQ,EAAE,IAAI;AAChB,EAAE,OAAO,EAAE,EAAE,qBAAqB,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE;AAC7E,EAAE;AACF,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC;AAClC,CAAC,MAAM,QAAQ,mBAAmB,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,IAAI,EAAE,EAAE,GAAG,YAAY,CAAC,CAAC;AAChF,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;AACrC,CAAC,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG;AACvF,EAAE,WAAW,EAAE,iBAAiB,CAAC,MAAM,CAAC,IAAI,QAAQ;AACpD,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,EAAE;AACnF,EAAE;AACF,CAAC,EAAE,CAAC,SAAS,GAAG,SAAS;AACzB,CAAC,OAAO,EAAE;AACV;AACA,IAAI,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AACvD,IAAI,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;AACxC,SAAS,MAAM,CAAC,IAAI,EAAE;AACtB,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC;AAC/C;AACA;AACA,SAAS,WAAW,CAAC,EAAE,EAAE;AACzB,CAAC,MAAM,QAAQ,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9H,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;AACnD;AACA,SAAS,oBAAoB,CAAC,SAAS,EAAE,OAAO,EAAE;AAClD,CAAC,MAAM,iBAAiB,GAAG;AAC3B,EAAE,GAAG,0BAA0B;AAC/B,EAAE,GAAG,OAAO,CAAC;AACb,EAAE;AACF,CAAC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI;AAC9C,EAAE,GAAG;AACL,EAAE,GAAG;AACL,EAAE,GAAG;AACL,EAAE;AACF,EAAE;AACF,CAAC,MAAM,KAAK,GAAG,EAAE;AACjB,CAAC,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE;AAC7B,EAAE,MAAM,IAAI,GAAG,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAC9C,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,EAAE,iBAAiB,EAAE,YAAY,CAAC;AACnG,CAAC;AACD,CAAC,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,KAAK,YAAY,CAAC;AACvE,CAAC,MAAM,UAAU,GAAG,EAAE;AACtB,CAAC,IAAI,SAAS,EAAE;AAChB,EAAE,UAAU,CAAC,KAAK,GAAG;AACrB,GAAG,IAAI,EAAE,OAAO;AAChB,GAAG,EAAE,EAAE,OAAO;AACd,GAAG,QAAQ,EAAE,KAAK;AAClB,GAAG,WAAW,EAAE,CAAC,wIAAwI,CAAC;AAC1J,GAAG,MAAM,EAAE;AACX,IAAI,IAAI,EAAE,SAAS;AACnB,IAAI,OAAO,EAAE,CAAC;AACd,IAAI,OAAO,EAAE;AACb;AACA,GAAG;AACH,EAAE,UAAU,CAAC,MAAM,GAAG;AACtB,GAAG,IAAI,EAAE,QAAQ;AACjB,GAAG,EAAE,EAAE,OAAO;AACd,GAAG,QAAQ,EAAE,KAAK;AAClB,GAAG,WAAW,EAAE,0FAA0F;AAC1G,GAAG,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ;AAC3B,GAAG;AACH,EAAE,UAAU,CAAC,OAAO,GAAG;AACvB,GAAG,IAAI,EAAE,SAAS;AAClB,GAAG,EAAE,EAAE,OAAO;AACd,GAAG,QAAQ,EAAE,KAAK;AAClB,GAAG,MAAM,EAAE;AACX,IAAI,IAAI,EAAE,QAAQ;AAClB,IAAI,IAAI,EAAE;AACV,KAAK,WAAW;AAChB,KAAK,WAAW;AAChB,KAAK;AACL;AACA;AACA,GAAG;AACH,EAAE,UAAU,CAAC,QAAQ,GAAG;AACxB,GAAG,IAAI,EAAE,UAAU;AACnB,GAAG,EAAE,EAAE,OAAO;AACd,GAAG,QAAQ,EAAE,KAAK;AAClB,GAAG,MAAM,EAAE;AACX,IAAI,IAAI,EAAE,QAAQ;AAClB,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM;AACxB;AACA,GAAG;AACH,CAAC;AACD,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,cAAc,GAAG;AACxE,EAAE,IAAI,EAAE,iBAAiB;AACzB,EAAE,EAAE,EAAE,QAAQ;AACd,EAAE,QAAQ,EAAE,KAAK;AACjB,EAAE,WAAW,EAAE,OAAO,CAAC,yBAAyB,IAAI,mCAAmC;AACvF,EAAE,MAAM,EAAE;AACV,GAAG,IAAI,EAAE,QAAQ;AACjB,GAAG,SAAS,EAAE,CAAC;AACf,GAAG,SAAS,EAAE;AACd;AACA,EAAE;AACF,CAAC,MAAM,OAAO,GAAG,EAAE;AACnB,CAAC,IAAI,SAAS,EAAE,OAAO,CAAC,IAAI,GAAG;AAC/B,EAAE,IAAI,EAAE,QAAQ;AAChB,EAAE,WAAW,EAAE,iFAAiF;AAChG,EAAE,UAAU,EAAE;AACd,GAAG,KAAK,EAAE;AACV,IAAI,IAAI,EAAE,OAAO;AACjB,IAAI,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ;AAC3B,IAAI;AACJ,GAAG,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ;AAC/B,GAAG;AACH,EAAE,QAAQ,EAAE,CAAC,OAAO;AACpB,EAAE;AACF,CAAC,OAAO,CAAC,KAAK,GAAG;AACjB,EAAE,IAAI,EAAE,QAAQ;AAChB,EAAE,WAAW,EAAE,0FAA0F;AACzG,EAAE,UAAU,EAAE;AACd,GAAG,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;AAC9B,GAAG,IAAI,EAAE;AACT,IAAI,IAAI,EAAE,QAAQ;AAClB,IAAI,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY;AACpC,IAAI;AACJ,GAAG,MAAM,EAAE;AACX,IAAI,IAAI,EAAE,QAAQ;AAClB,IAAI,WAAW,EAAE,2EAA2E;AAC5F,IAAI,oBAAoB,EAAE,EAAE,IAAI,EAAE,QAAQ;AAC1C,IAAI;AACJ,GAAG,OAAO,EAAE;AACZ,IAAI,IAAI,EAAE,QAAQ;AAClB,IAAI,WAAW,EAAE,2FAA2F;AAC5G,IAAI,oBAAoB,EAAE,EAAE,IAAI,EAAE,QAAQ;AAC1C;AACA,GAAG;AACH,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM;AAC9B,EAAE;AACF,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC;AACxC,CAAC,MAAM,UAAU,GAAG,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE;AAChE,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,UAAU,GAAG,UAAU;AACvE,CAAC,UAAU,CAAC,OAAO,GAAG,OAAO;AAC7B,CAAC,OAAO;AACR,EAAE,OAAO,EAAE,OAAO;AAClB,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI;AACpB,EAAE,OAAO,EAAE,CAAC;AACZ,GAAG,GAAG,EAAE,GAAG;AACX,GAAG,WAAW,EAAE;AAChB,GAAG,CAAC;AACJ,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ;AAC5B,EAAE,UAAU;AACZ,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,CAAC,GAAG,EAAE;AAC/B,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;AACxD,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,EAAE;AACtF,CAAC,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC;AACnD,CAAC,MAAM,OAAO,GAAG,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,MAAM,GAAG,UAAU,GAAG,MAAM;AACxH,CAAC,OAAO;AACR,EAAE,KAAK;AACP,EAAE,MAAM,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM;AAClD,EAAE,OAAO;AACT,EAAE,QAAQ,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,KAAK,GAAG,KAAK,GAAG;AACjE,EAAE;AACF;AACA;AACA,SAAS,0BAA0B,CAAC,GAAG,EAAE;AACzC,CAAC,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC;AACnC,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,YAAY,EAAE,OAAO;AAC9D,EAAE,GAAG,IAAI;AACT,EAAE,OAAO,EAAE;AACX,EAAE;AACF,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;AAC/B,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;AACzC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;AACtD,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;AACnD,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AACjC;AACA,CAAC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ;AACnC,CAAC;AACE,IAAC,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;AACvC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;AACpE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AAC5C,CAAC,UAAU,EAAE,uBAAuB,CAAC,OAAO,CAAC,SAAS,CAAC;AACvD,CAAC,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ;AACvC,CAAC;AACE,IAAC,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;AACvC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;AACxC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE;AAC3C,CAAC,UAAU,EAAE,uBAAuB;AACpC,CAAC,gBAAgB,EAAE,CAAC,CAAC,OAAO;AAC5B,CAAC,CAAC,CAAC,OAAO;AACP,IAAC,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;AAC1C,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,oBAAoB,CAAC;AAChD,CAAC,IAAI,EAAE;AACP,CAAC;AACE,IAAC,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE;AACxE;AACA,IAAI,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,wBAAwB,EAAE,mBAAmB,CAAC,CAAC;AAChF,IAAC,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;AACtC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;AACnF,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC;AACzC,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,EAAE;AACtD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;AAC3C,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AACtB,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AACzB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7B,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AACzC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AACjC,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ;AAChC,CAAC,CAAC;AACC,IAAC,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;AACzC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC;AAC9C;AACA,CAAC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ;AAChD,CAAC;AACE,IAAC,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;AACzC,CAAC,IAAI,EAAE,aAAa,CAAC,QAAQ,EAAE;AAC/B,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,QAAQ;AAC3D,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,MAAM,EAAE,EAAE,OAAO,EAAE,2CAA2C,EAAE;AACrH,IAAC,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;AACxC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;AAC5D,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;AAChF,CAAC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;AACvC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;AACf,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;AACzB,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACnC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AAC5B,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;AAChC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;AAChC,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;AACxB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;AAChC,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;AACvB;AACA,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI;AACzB,CAAC;AACD;AACG,IAAC,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;AAC9C,CAAC,IAAI,EAAE,uBAAuB;AAC9B,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM;AAChB,CAAC;AACE,IAAC,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;AACpC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;AACf,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;AAClB,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;AAClB,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;AACpB,CAAC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AACpC,CAAC,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;AACrD,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AAClC,CAAC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ;AACtC,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,2BAA2B,GAAG,oBAAoB,CAAC,MAAM,CAAC;AAC9D,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC;AAClB,EAAE,MAAM;AACR,EAAE,gBAAgB;AAClB,EAAE;AACF,EAAE;AACF,CAAC;AACD;AACA;AACA;AACA;AACA,IAAI,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;AAC9C,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;AACf,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;AAClB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;AACxB,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;AACvB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AACjC,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AAClC,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO;AACrB,CAAC,CAAC;AACF;AACA,IAAI,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;AACzC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;AACf,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;AAClB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AACpC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AACjC,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ;AAChC,CAAC,CAAC;AACC,IAAC,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;AACxC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC;AACjD,CAAC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;AACtC,CAAC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;AAC5C,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB;AAC3C,CAAC;AACE,IAAC,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;AACtC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;AACf,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;AACnB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AACjC,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;AAClB,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;AACjB,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AAC5B,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AAClC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AACjC;AACA,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM;AACvB,CAAC;AACD;AACG,IAAC,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;AAC7C,CAAC,KAAK,EAAE,sBAAsB;AAC9B,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM;AACjB,CAAC;;;;"}

package/build/server/chunks/chunks/auth-bootstrap.server.js-BE7qNG2e.js

@@ -0,0 +1,152 @@
+import { b as private_env } from './shared-server.js-CJsQadj4.js';
+import { S as SYSTEM_CONTEXT, A as ALL_PLATFORM_PERMISSIONS, m as slugify } from './src.js-DYeCa7A9.js';
+import { a as getAuthProvider, g as getLogger, b as getPermissionStore, c as getTenancy, d as getDataProvider, e as getOrganizationProvider, f as getProjectProvider } from './providers.server.js-D30wnnA4.js';
+import { randomUUID } from 'node:crypto';
+
+// src/lib/server/auth-bootstrap.server.ts
+/**
+* Shared post-verification flow used by every IdP-callback route (OAuth,
+* email link, future SAML, …). Order matters:
+*
+*   1. `data.ensureUser` — guarantee a user-data row exists for whatever ID
+*      the auth provider issued. Local-provider creates a JSON row;
+*      Supabase no-ops (its DB trigger has already fired).
+*   2. Bootstrap-admin grant — if no instance_admin exists yet AND the
+*      tenancy/env policy allows it, grant the signing-in user every
+*      platform permission so `/admin` becomes reachable.
+*   3. Single-tenant org seed — create the default Organization + Project
+*      owned by the new admin, mirroring what `/setup` does for password
+*      auth. Without this, org-scoped permissions (manage_projects,
+*      manage_definitions) silently drop because `actingOrgId` resolves to
+*      undefined.
+*
+* Cookie/redirect are the caller's job since they vary by capability (OAuth
+* has refresh tokens, magic-link does sometimes, SAML doesn't).
+*/
+async function bootstrapUserSession(user) {
+	await getDataProvider().ensureUser(SYSTEM_CONTEXT, user.id);
+	const tenancy = getTenancy();
+	const perms = getPermissionStore();
+	const hasAdmin = await perms.hasInstanceAdmin(SYSTEM_CONTEXT);
+	let grantedAdminHere = false;
+	if (!hasAdmin) {
+		if (!shouldBootstrapAdmin(user, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, tenancy)) return;
+		grantedAdminHere = await perms.claimFirstInstanceAdmin(SYSTEM_CONTEXT, user.id, [...ALL_PLATFORM_PERMISSIONS]);
+		if (!grantedAdminHere) return;
+	}
+	if (tenancy !== "single") return;
+	if ((await getOrganizationProvider().listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items.length > 0) return;
+	if (!grantedAdminHere) {
+		if (!(await perms.getFor(SYSTEM_CONTEXT, user.id)).includes("instance_admin")) return;
+	}
+	await ensureSingleTenantDefaultOrg(user);
+}
+/**
+* Seeds the single default Organization + Project that `actingOrgId` needs
+* to resolve, for flows that skip `/setup` (header-auth, OAuth callback,
+* future SAML). No-op outside single-tenant mode and once any org exists.
+* Slug derives from the admin's email/displayName so the URL looks like the
+* deployment rather than a UUID; falls back to `default` for anonymous
+* UPN-only sign-ins.
+*/
+async function ensureSingleTenantDefaultOrg(user) {
+	if (getTenancy() !== "single") return;
+	const orgs = getOrganizationProvider();
+	if ((await orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items.length > 0) return;
+	const orgName = (typeof user.metadata?.displayName === "string" ? user.metadata.displayName : void 0)?.trim() || user.email?.split("@")[0]?.trim() || "Default";
+	const slug = slugify(orgName).length >= 3 ? slugify(orgName) : "default";
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const org = {
+		id: randomUUID(),
+		name: orgName,
+		slug,
+		ownerId: user.id,
+		createdBy: user.id,
+		updatedBy: user.id,
+		createdAt: now,
+		updatedAt: now,
+		deletedAt: null
+	};
+	await orgs.createOrg(SYSTEM_CONTEXT, org);
+	const projects = getProjectProvider();
+	const project = {
+		id: randomUUID(),
+		orgId: org.id,
+		name: "Default",
+		slug: "default",
+		visibility: "public",
+		ownerId: user.id,
+		createdBy: user.id,
+		updatedBy: user.id,
+		autoJoinOnUpload: false,
+		createdAt: now,
+		updatedAt: now,
+		deletedAt: null
+	};
+	await projects.createProject(SYSTEM_CONTEXT, project);
+}
+/**
+* Whether the signing-in user qualifies for the first-admin grant. Pure — no
+* I/O — so the policy is unit-testable.
+*
+* - `tenancy='single'` + no env var → first signer wins (fine for
+*   self-hosted fresh installs).
+* - `tenancy='single'` + env var set → only the named user qualifies.
+* - `tenancy='multi'` → env var REQUIRED; the named user must match the
+*   signer. Without it, the first random signup would become Selva staff.
+*
+* The env var also doubles as the break-glass recovery path when admin is
+* lost to backup restores or migration drift.
+*/
+function shouldBootstrapAdmin(user, configuredEmail, mode) {
+	const expected = configuredEmail?.trim().toLowerCase();
+	if (mode === "multi" && !expected) return false;
+	if (!expected) return true;
+	const actual = user.email?.trim().toLowerCase();
+	return !!actual && actual === expected;
+}
+/**
+* Header-auth variant of `shouldBootstrapAdmin`, used by
+* `wireHeaderAuthBootstrap` to decide whether an unrecognized UPN arriving
+* through the proxy should be auto-allowlisted as the first admin. Operates
+* on the raw UPN/email before any allowlist row exists. For Entra
+* deployments UPN ≈ email; if they differ, the proxy forwards both and we
+* prefer email when present.
+*/
+function shouldBootstrapUpn(upn, email, configuredEmail, mode) {
+	const expected = configuredEmail?.trim().toLowerCase();
+	if (mode === "multi" && !expected) return false;
+	if (!expected) return true;
+	const candidate = (email ?? upn).trim().toLowerCase();
+	return !!candidate && candidate === expected;
+}
+/**
+* Wires a bootstrap-allowlist policy onto the auth provider if it supports
+* header-auth-style first-admin bootstrapping. Idempotent — safe to call on
+* every startup; the provider holds the policy until process exit.
+*
+* Header-auth deployments can't reach `/setup` (no password form, no OAuth
+* callback), so without this the first proxy-authenticated visitor is
+* silently rejected (UPN not in allowlist) and the operator has to
+* hand-write JSON files. With it, the first visit whose UPN/email matches
+* `BOOTSTRAP_INSTANCE_ADMIN_EMAIL` is auto-allowlisted, and the immediately
+* following `bootstrapUserSession` call grants instance_admin.
+*
+* Gated by `hasInstanceAdmin` — once any admin exists, the policy returns
+* false and strict allowlist-only behavior resumes.
+*/
+function wireHeaderAuthBootstrap() {
+	const auth = getAuthProvider();
+	if (!auth.proxyAuth) return;
+	if (typeof auth.setBootstrapAllowlistPolicy !== "function") {
+		if (private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL?.trim()) getLogger().warn("BOOTSTRAP_INSTANCE_ADMIN_EMAIL is set but the installed @selvajs/header-auth-provider does not expose setBootstrapAllowlistPolicy. Upgrade the provider, or hand-seed header-allowlist.json.", { component: "auth-bootstrap" });
+		return;
+	}
+	auth.setBootstrapAllowlistPolicy(async ({ upn, email }) => {
+		if (await getPermissionStore().hasInstanceAdmin(SYSTEM_CONTEXT)) return false;
+		return shouldBootstrapUpn(upn, email, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, getTenancy());
+	});
+}
+
+export { bootstrapUserSession as b, wireHeaderAuthBootstrap as w };
+//# sourceMappingURL=auth-bootstrap.server.js-BE7qNG2e.js.map

package/build/server/chunks/chunks/auth-bootstrap.server.js-BE7qNG2e.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-bootstrap.server.js-BE7qNG2e.js","sources":["../../../../.svelte-kit/output/server/chunks/auth-bootstrap.server.js"],"sourcesContent":["import { t as private_env } from \"./shared-server.js\";\nimport { R as slugify, t as SYSTEM_CONTEXT, z as ALL_PLATFORM_PERMISSIONS } from \"./src.js\";\nimport { S as getTenancy, f as getLogger, g as getPermissionStore, h as getOrganizationProvider, o as getDataProvider, r as getAuthProvider, v as getProjectProvider } from \"./providers.server.js\";\nimport { randomUUID } from \"node:crypto\";\n// src/lib/server/auth-bootstrap.server.ts\n/**\n* Shared post-verification flow used by every IdP-callback route (OAuth,\n* email link, future SAML, …). Order matters:\n*\n*   1. `data.ensureUser` — guarantee a user-data row exists for whatever ID\n*      the auth provider issued. Local-provider creates a JSON row;\n*      Supabase no-ops (its DB trigger has already fired).\n*   2. Bootstrap-admin grant — if no instance_admin exists yet AND the\n*      tenancy/env policy allows it, grant the signing-in user every\n*      platform permission so `/admin` becomes reachable.\n*   3. Single-tenant org seed — create the default Organization + Project\n*      owned by the new admin, mirroring what `/setup` does for password\n*      auth. Without this, org-scoped permissions (manage_projects,\n*      manage_definitions) silently drop because `actingOrgId` resolves to\n*      undefined.\n*\n* Cookie/redirect are the caller's job since they vary by capability (OAuth\n* has refresh tokens, magic-link does sometimes, SAML doesn't).\n*/\nasync function bootstrapUserSession(user) {\n\tawait getDataProvider().ensureUser(SYSTEM_CONTEXT, user.id);\n\tconst tenancy = getTenancy();\n\tconst perms = getPermissionStore();\n\tconst hasAdmin = await perms.hasInstanceAdmin(SYSTEM_CONTEXT);\n\tlet grantedAdminHere = false;\n\tif (!hasAdmin) {\n\t\tif (!shouldBootstrapAdmin(user, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, tenancy)) return;\n\t\tgrantedAdminHere = await perms.claimFirstInstanceAdmin(SYSTEM_CONTEXT, user.id, [...ALL_PLATFORM_PERMISSIONS]);\n\t\tif (!grantedAdminHere) return;\n\t}\n\tif (tenancy !== \"single\") return;\n\tif ((await getOrganizationProvider().listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items.length > 0) return;\n\tif (!grantedAdminHere) {\n\t\tif (!(await perms.getFor(SYSTEM_CONTEXT, user.id)).includes(\"instance_admin\")) return;\n\t}\n\tawait ensureSingleTenantDefaultOrg(user);\n}\n/**\n* Seeds the single default Organization + Project that `actingOrgId` needs\n* to resolve, for flows that skip `/setup` (header-auth, OAuth callback,\n* future SAML). No-op outside single-tenant mode and once any org exists.\n* Slug derives from the admin's email/displayName so the URL looks like the\n* deployment rather than a UUID; falls back to `default` for anonymous\n* UPN-only sign-ins.\n*/\nasync function ensureSingleTenantDefaultOrg(user) {\n\tif (getTenancy() !== \"single\") return;\n\tconst orgs = getOrganizationProvider();\n\tif ((await orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items.length > 0) return;\n\tconst orgName = (typeof user.metadata?.displayName === \"string\" ? user.metadata.displayName : void 0)?.trim() || user.email?.split(\"@\")[0]?.trim() || \"Default\";\n\tconst slug = slugify(orgName).length >= 3 ? slugify(orgName) : \"default\";\n\tconst now = (/* @__PURE__ */ new Date()).toISOString();\n\tconst org = {\n\t\tid: randomUUID(),\n\t\tname: orgName,\n\t\tslug,\n\t\townerId: user.id,\n\t\tcreatedBy: user.id,\n\t\tupdatedBy: user.id,\n\t\tcreatedAt: now,\n\t\tupdatedAt: now,\n\t\tdeletedAt: null\n\t};\n\tawait orgs.createOrg(SYSTEM_CONTEXT, org);\n\tconst projects = getProjectProvider();\n\tconst project = {\n\t\tid: randomUUID(),\n\t\torgId: org.id,\n\t\tname: \"Default\",\n\t\tslug: \"default\",\n\t\tvisibility: \"public\",\n\t\townerId: user.id,\n\t\tcreatedBy: user.id,\n\t\tupdatedBy: user.id,\n\t\tautoJoinOnUpload: false,\n\t\tcreatedAt: now,\n\t\tupdatedAt: now,\n\t\tdeletedAt: null\n\t};\n\tawait projects.createProject(SYSTEM_CONTEXT, project);\n}\n/**\n* Whether the signing-in user qualifies for the first-admin grant. Pure — no\n* I/O — so the policy is unit-testable.\n*\n* - `tenancy='single'` + no env var → first signer wins (fine for\n*   self-hosted fresh installs).\n* - `tenancy='single'` + env var set → only the named user qualifies.\n* - `tenancy='multi'` → env var REQUIRED; the named user must match the\n*   signer. Without it, the first random signup would become Selva staff.\n*\n* The env var also doubles as the break-glass recovery path when admin is\n* lost to backup restores or migration drift.\n*/\nfunction shouldBootstrapAdmin(user, configuredEmail, mode) {\n\tconst expected = configuredEmail?.trim().toLowerCase();\n\tif (mode === \"multi\" && !expected) return false;\n\tif (!expected) return true;\n\tconst actual = user.email?.trim().toLowerCase();\n\treturn !!actual && actual === expected;\n}\n/**\n* Header-auth variant of `shouldBootstrapAdmin`, used by\n* `wireHeaderAuthBootstrap` to decide whether an unrecognized UPN arriving\n* through the proxy should be auto-allowlisted as the first admin. Operates\n* on the raw UPN/email before any allowlist row exists. For Entra\n* deployments UPN ≈ email; if they differ, the proxy forwards both and we\n* prefer email when present.\n*/\nfunction shouldBootstrapUpn(upn, email, configuredEmail, mode) {\n\tconst expected = configuredEmail?.trim().toLowerCase();\n\tif (mode === \"multi\" && !expected) return false;\n\tif (!expected) return true;\n\tconst candidate = (email ?? upn).trim().toLowerCase();\n\treturn !!candidate && candidate === expected;\n}\n/**\n* Wires a bootstrap-allowlist policy onto the auth provider if it supports\n* header-auth-style first-admin bootstrapping. Idempotent — safe to call on\n* every startup; the provider holds the policy until process exit.\n*\n* Header-auth deployments can't reach `/setup` (no password form, no OAuth\n* callback), so without this the first proxy-authenticated visitor is\n* silently rejected (UPN not in allowlist) and the operator has to\n* hand-write JSON files. With it, the first visit whose UPN/email matches\n* `BOOTSTRAP_INSTANCE_ADMIN_EMAIL` is auto-allowlisted, and the immediately\n* following `bootstrapUserSession` call grants instance_admin.\n*\n* Gated by `hasInstanceAdmin` — once any admin exists, the policy returns\n* false and strict allowlist-only behavior resumes.\n*/\nfunction wireHeaderAuthBootstrap() {\n\tconst auth = getAuthProvider();\n\tif (!auth.proxyAuth) return;\n\tif (typeof auth.setBootstrapAllowlistPolicy !== \"function\") {\n\t\tif (private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL?.trim()) getLogger().warn(\"BOOTSTRAP_INSTANCE_ADMIN_EMAIL is set but the installed @selvajs/header-auth-provider does not expose setBootstrapAllowlistPolicy. Upgrade the provider, or hand-seed header-allowlist.json.\", { component: \"auth-bootstrap\" });\n\t\treturn;\n\t}\n\tauth.setBootstrapAllowlistPolicy(async ({ upn, email }) => {\n\t\tif (await getPermissionStore().hasInstanceAdmin(SYSTEM_CONTEXT)) return false;\n\t\treturn shouldBootstrapUpn(upn, email, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, getTenancy());\n\t});\n}\nexport { wireHeaderAuthBootstrap as n, bootstrapUserSession as t };\n"],"names":[],"mappings":";;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,oBAAoB,CAAC,IAAI,EAAE;AAC1C,CAAC,MAAM,eAAe,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAC5D,CAAC,MAAM,OAAO,GAAG,UAAU,EAAE;AAC7B,CAAC,MAAM,KAAK,GAAG,kBAAkB,EAAE;AACnC,CAAC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,cAAc,CAAC;AAC9D,CAAC,IAAI,gBAAgB,GAAG,KAAK;AAC7B,CAAC,IAAI,CAAC,QAAQ,EAAE;AAChB,EAAE,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,WAAW,CAAC,8BAA8B,EAAE,OAAO,CAAC,EAAE;AACxF,EAAE,gBAAgB,GAAG,MAAM,KAAK,CAAC,uBAAuB,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,wBAAwB,CAAC,CAAC;AAChH,EAAE,IAAI,CAAC,gBAAgB,EAAE;AACzB,CAAC;AACD,CAAC,IAAI,OAAO,KAAK,QAAQ,EAAE;AAC3B,CAAC,IAAI,CAAC,MAAM,uBAAuB,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;AAChG,CAAC,IAAI,CAAC,gBAAgB,EAAE;AACxB,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE;AACjF,CAAC;AACD,CAAC,MAAM,4BAA4B,CAAC,IAAI,CAAC;AACzC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,4BAA4B,CAAC,IAAI,EAAE;AAClD,CAAC,IAAI,UAAU,EAAE,KAAK,QAAQ,EAAE;AAChC,CAAC,MAAM,IAAI,GAAG,uBAAuB,EAAE;AACvC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;AAC3E,CAAC,MAAM,OAAO,GAAG,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,WAAW,KAAK,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,GAAG,MAAM,GAAG,IAAI,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS;AAChK,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS;AACzE,CAAC,MAAM,GAAG,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACvD,CAAC,MAAM,GAAG,GAAG;AACb,EAAE,EAAE,EAAE,UAAU,EAAE;AAClB,EAAE,IAAI,EAAE,OAAO;AACf,EAAE,IAAI;AACN,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;AAClB,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;AACpB,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;AACpB,EAAE,SAAS,EAAE,GAAG;AAChB,EAAE,SAAS,EAAE,GAAG;AAChB,EAAE,SAAS,EAAE;AACb,EAAE;AACF,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,CAAC;AAC1C,CAAC,MAAM,QAAQ,GAAG,kBAAkB,EAAE;AACtC,CAAC,MAAM,OAAO,GAAG;AACjB,EAAE,EAAE,EAAE,UAAU,EAAE;AAClB,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE;AACf,EAAE,IAAI,EAAE,SAAS;AACjB,EAAE,IAAI,EAAE,SAAS;AACjB,EAAE,UAAU,EAAE,QAAQ;AACtB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;AAClB,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;AACpB,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;AACpB,EAAE,gBAAgB,EAAE,KAAK;AACzB,EAAE,SAAS,EAAE,GAAG;AAChB,EAAE,SAAS,EAAE,GAAG;AAChB,EAAE,SAAS,EAAE;AACb,EAAE;AACF,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,cAAc,EAAE,OAAO,CAAC;AACtD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,oBAAoB,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE;AAC3D,CAAC,MAAM,QAAQ,GAAG,eAAe,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACvD,CAAC,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,KAAK;AAChD,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI;AAC3B,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AAChD,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,MAAM,KAAK,QAAQ;AACvC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE;AAC/D,CAAC,MAAM,QAAQ,GAAG,eAAe,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACvD,CAAC,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,KAAK;AAChD,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI;AAC3B,CAAC,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACtD,CAAC,OAAO,CAAC,CAAC,SAAS,IAAI,SAAS,KAAK,QAAQ;AAC7C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,uBAAuB,GAAG;AACnC,CAAC,MAAM,IAAI,GAAG,eAAe,EAAE;AAC/B,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;AACtB,CAAC,IAAI,OAAO,IAAI,CAAC,2BAA2B,KAAK,UAAU,EAAE;AAC7D,EAAE,IAAI,WAAW,CAAC,8BAA8B,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,8LAA8L,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC;AAC3S,EAAE;AACF,CAAC;AACD,CAAC,IAAI,CAAC,2BAA2B,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK;AAC5D,EAAE,IAAI,MAAM,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,OAAO,KAAK;AAC/E,EAAE,OAAO,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,CAAC,8BAA8B,EAAE,UAAU,EAAE,CAAC;AACjG,CAAC,CAAC,CAAC;AACH;;;;"}

package/build/server/chunks/chunks/bootHealth.server.js-ymNofkZd.js

@@ -0,0 +1,90 @@
+import { p as providers, g as getLogger } from './providers.server.js-D30wnnA4.js';
+import { r as renderThrown } from './definitions.js-DNRCBvN_.js';
+
+// src/lib/server/bootHealth.server.ts
+var cached = null;
+var inflight = null;
+async function run() {
+	let atRestSecrets = null;
+	const store = providers.data.computeServer;
+	if (typeof store.verifySecrets === "function") try {
+		atRestSecrets = await store.verifySecrets();
+	} catch (err) {
+		getLogger().error("verifySecrets threw — treating as failure", {
+			component: "boot",
+			err: renderThrown(err)
+		});
+		atRestSecrets = {
+			ok: false,
+			plaintextFound: false,
+			failures: [{
+				serverId: "(unknown)",
+				serverLabel: "(unknown)",
+				reason: "key_mismatch",
+				cause: err instanceof Error ? err.message : String(err)
+			}]
+		};
+	}
+	if (atRestSecrets && !atRestSecrets.ok) {
+		for (const f of atRestSecrets.failures) getLogger().error("At-rest secret verification failed for compute server", {
+			component: "boot",
+			serverLabel: f.serverLabel,
+			serverId: f.serverId,
+			reason: f.reason,
+			cause: f.cause
+		});
+		getLogger().error("At-rest secret verification failed. /api/health will return 503. Recover by re-entering the affected apiKeys via /admin/compute, or by restoring the original SELVA_AT_REST_KEY. See docs/Troubleshooting.md.", { component: "boot" });
+	}
+	let schemaVersion = null;
+	const data = providers.data;
+	if (typeof data.verifySchemaVersion === "function") try {
+		schemaVersion = await data.verifySchemaVersion();
+	} catch (err) {
+		getLogger().error("verifySchemaVersion threw — treating as failure", {
+			component: "boot",
+			err: renderThrown(err)
+		});
+		schemaVersion = {
+			ok: false,
+			expected: "(unknown)",
+			actual: null,
+			message: err instanceof Error ? err.message : String(err)
+		};
+	}
+	if (schemaVersion && !schemaVersion.ok) getLogger().error("Database schema handshake failed. /api/health will return 503.", {
+		component: "boot",
+		expected: schemaVersion.expected,
+		actual: schemaVersion.actual ?? "unavailable",
+		detail: schemaVersion.message
+	});
+	return {
+		checkedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		atRestSecrets,
+		schemaVersion
+	};
+}
+/**
+* Runs the underlying checks at most once — subsequent callers receive the
+* same result; in-flight callers share a single promise. Does NOT auto-refresh
+* after an operator fixes the underlying issue — restart the process to
+* re-run the boot check. That's deliberate: boot health represents the state
+* at boot, by definition.
+*/
+function getBootHealth() {
+	if (cached) return Promise.resolve(cached);
+	if (inflight) return inflight;
+	inflight = run().then((result) => {
+		cached = result;
+		inflight = null;
+		return result;
+	});
+	return inflight;
+}
+function isDegraded(report) {
+	if (report.atRestSecrets !== null && !report.atRestSecrets.ok) return true;
+	if (report.schemaVersion !== null && !report.schemaVersion.ok) return true;
+	return false;
+}
+
+export { getBootHealth as g, isDegraded as i };
+//# sourceMappingURL=bootHealth.server.js-ymNofkZd.js.map

package/build/server/chunks/chunks/bootHealth.server.js-ymNofkZd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootHealth.server.js-ymNofkZd.js","sources":["../../../../.svelte-kit/output/server/chunks/bootHealth.server.js"],"sourcesContent":["import { T as providers, f as getLogger } from \"./providers.server.js\";\nimport { a as renderThrown } from \"./definitions.js\";\n// src/lib/server/bootHealth.server.ts\nvar cached = null;\nvar inflight = null;\nasync function run() {\n\tlet atRestSecrets = null;\n\tconst store = providers.data.computeServer;\n\tif (typeof store.verifySecrets === \"function\") try {\n\t\tatRestSecrets = await store.verifySecrets();\n\t} catch (err) {\n\t\tgetLogger().error(\"verifySecrets threw — treating as failure\", {\n\t\t\tcomponent: \"boot\",\n\t\t\terr: renderThrown(err)\n\t\t});\n\t\tatRestSecrets = {\n\t\t\tok: false,\n\t\t\tplaintextFound: false,\n\t\t\tfailures: [{\n\t\t\t\tserverId: \"(unknown)\",\n\t\t\t\tserverLabel: \"(unknown)\",\n\t\t\t\treason: \"key_mismatch\",\n\t\t\t\tcause: err instanceof Error ? err.message : String(err)\n\t\t\t}]\n\t\t};\n\t}\n\tif (atRestSecrets && !atRestSecrets.ok) {\n\t\tfor (const f of atRestSecrets.failures) getLogger().error(\"At-rest secret verification failed for compute server\", {\n\t\t\tcomponent: \"boot\",\n\t\t\tserverLabel: f.serverLabel,\n\t\t\tserverId: f.serverId,\n\t\t\treason: f.reason,\n\t\t\tcause: f.cause\n\t\t});\n\t\tgetLogger().error(\"At-rest secret verification failed. /api/health will return 503. Recover by re-entering the affected apiKeys via /admin/compute, or by restoring the original SELVA_AT_REST_KEY. See docs/Troubleshooting.md.\", { component: \"boot\" });\n\t}\n\tlet schemaVersion = null;\n\tconst data = providers.data;\n\tif (typeof data.verifySchemaVersion === \"function\") try {\n\t\tschemaVersion = await data.verifySchemaVersion();\n\t} catch (err) {\n\t\tgetLogger().error(\"verifySchemaVersion threw — treating as failure\", {\n\t\t\tcomponent: \"boot\",\n\t\t\terr: renderThrown(err)\n\t\t});\n\t\tschemaVersion = {\n\t\t\tok: false,\n\t\t\texpected: \"(unknown)\",\n\t\t\tactual: null,\n\t\t\tmessage: err instanceof Error ? err.message : String(err)\n\t\t};\n\t}\n\tif (schemaVersion && !schemaVersion.ok) getLogger().error(\"Database schema handshake failed. /api/health will return 503.\", {\n\t\tcomponent: \"boot\",\n\t\texpected: schemaVersion.expected,\n\t\tactual: schemaVersion.actual ?? \"unavailable\",\n\t\tdetail: schemaVersion.message\n\t});\n\treturn {\n\t\tcheckedAt: (/* @__PURE__ */ new Date()).toISOString(),\n\t\tatRestSecrets,\n\t\tschemaVersion\n\t};\n}\n/**\n* Runs the underlying checks at most once — subsequent callers receive the\n* same result; in-flight callers share a single promise. Does NOT auto-refresh\n* after an operator fixes the underlying issue — restart the process to\n* re-run the boot check. That's deliberate: boot health represents the state\n* at boot, by definition.\n*/\nfunction getBootHealth() {\n\tif (cached) return Promise.resolve(cached);\n\tif (inflight) return inflight;\n\tinflight = run().then((result) => {\n\t\tcached = result;\n\t\tinflight = null;\n\t\treturn result;\n\t});\n\treturn inflight;\n}\nfunction isDegraded(report) {\n\tif (report.atRestSecrets !== null && !report.atRestSecrets.ok) return true;\n\tif (report.schemaVersion !== null && !report.schemaVersion.ok) return true;\n\treturn false;\n}\nexport { isDegraded as n, getBootHealth as t };\n"],"names":[],"mappings":";;;AAEA;AACA,IAAI,MAAM,GAAG,IAAI;AACjB,IAAI,QAAQ,GAAG,IAAI;AACnB,eAAe,GAAG,GAAG;AACrB,CAAC,IAAI,aAAa,GAAG,IAAI;AACzB,CAAC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa;AAC3C,CAAC,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,UAAU,EAAE,IAAI;AACpD,EAAE,aAAa,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;AAC7C,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,2CAA2C,EAAE;AACjE,GAAG,SAAS,EAAE,MAAM;AACpB,GAAG,GAAG,EAAE,YAAY,CAAC,GAAG;AACxB,GAAG,CAAC;AACJ,EAAE,aAAa,GAAG;AAClB,GAAG,EAAE,EAAE,KAAK;AACZ,GAAG,cAAc,EAAE,KAAK;AACxB,GAAG,QAAQ,EAAE,CAAC;AACd,IAAI,QAAQ,EAAE,WAAW;AACzB,IAAI,WAAW,EAAE,WAAW;AAC5B,IAAI,MAAM,EAAE,cAAc;AAC1B,IAAI,KAAK,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG;AAC1D,IAAI;AACJ,GAAG;AACH,CAAC;AACD,CAAC,IAAI,aAAa,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE;AACzC,EAAE,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,uDAAuD,EAAE;AACrH,GAAG,SAAS,EAAE,MAAM;AACpB,GAAG,WAAW,EAAE,CAAC,CAAC,WAAW;AAC7B,GAAG,QAAQ,EAAE,CAAC,CAAC,QAAQ;AACvB,GAAG,MAAM,EAAE,CAAC,CAAC,MAAM;AACnB,GAAG,KAAK,EAAE,CAAC,CAAC;AACZ,GAAG,CAAC;AACJ,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,+MAA+M,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC3P,CAAC;AACD,CAAC,IAAI,aAAa,GAAG,IAAI;AACzB,CAAC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI;AAC5B,CAAC,IAAI,OAAO,IAAI,CAAC,mBAAmB,KAAK,UAAU,EAAE,IAAI;AACzD,EAAE,aAAa,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE;AAClD,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,iDAAiD,EAAE;AACvE,GAAG,SAAS,EAAE,MAAM;AACpB,GAAG,GAAG,EAAE,YAAY,CAAC,GAAG;AACxB,GAAG,CAAC;AACJ,EAAE,aAAa,GAAG;AAClB,GAAG,EAAE,EAAE,KAAK;AACZ,GAAG,QAAQ,EAAE,WAAW;AACxB,GAAG,MAAM,EAAE,IAAI;AACf,GAAG,OAAO,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG;AAC3D,GAAG;AACH,CAAC;AACD,CAAC,IAAI,aAAa,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,gEAAgE,EAAE;AAC7H,EAAE,SAAS,EAAE,MAAM;AACnB,EAAE,QAAQ,EAAE,aAAa,CAAC,QAAQ;AAClC,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,IAAI,aAAa;AAC/C,EAAE,MAAM,EAAE,aAAa,CAAC;AACxB,EAAE,CAAC;AACH,CAAC,OAAO;AACR,EAAE,SAAS,EAAE,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACvD,EAAE,aAAa;AACf,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,GAAG;AACzB,CAAC,IAAI,MAAM,EAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;AAC3C,CAAC,IAAI,QAAQ,EAAE,OAAO,QAAQ;AAC9B,CAAC,QAAQ,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK;AACnC,EAAE,MAAM,GAAG,MAAM;AACjB,EAAE,QAAQ,GAAG,IAAI;AACjB,EAAE,OAAO,MAAM;AACf,CAAC,CAAC,CAAC;AACH,CAAC,OAAO,QAAQ;AAChB;AACA,SAAS,UAAU,CAAC,MAAM,EAAE;AAC5B,CAAC,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,OAAO,IAAI;AAC3E,CAAC,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,OAAO,IAAI;AAC3E,CAAC,OAAO,KAAK;AACb;;;;"}

package/build/server/chunks/chunks/client.js-BlAaaeFi.js

@@ -0,0 +1,58 @@
+import { i as index_server_exports } from './index-server.js-DQcI4Uf0.js';
+import './shared.js-BT6FYGEZ.js';
+import './exports.js-Bl7JH3d7.js';
+import './routing.js-jOE0ETFb.js';
+import { n as noop } from './server.js-Bn3s-cVB.js';
+import './internal2.js-D31hcs3W.js';
+import '@sveltejs/kit/internal/server';
+import '@sveltejs/kit/internal';
+
+var is_legacy = noop.toString().includes("$$") || /function \w+\(\) \{\}/.test(noop.toString());
+var placeholder_url = "a:";
+if (is_legacy) {
+	({
+		data: {},
+		form: null,
+		error: null,
+		params: {},
+		route: { id: null },
+		state: {},
+		status: -1,
+		url: new URL(placeholder_url)
+	});
+}
+// ../../node_modules/.pnpm/@sveltejs+kit@2.70.3_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.3.1_svelte_47ca0476217d3a67b8821de8a7850a17/node_modules/@sveltejs/kit/src/runtime/client/client.js
+/** @import { RemoteFunctionDataNode, ServerNodesResponse, ServerRedirectNode } from 'types' */
+/** @import { CacheEntry } from './remote-functions/cache.svelte.js' */
+/** @import { Query } from './remote-functions/query/instance.svelte.js' */
+/** @import { LiveQuery } from './remote-functions/query-live/instance.svelte.js' */
+var { onMount, tick } = index_server_exports;
+/**
+* Allows you to navigate programmatically to a given route, with options such as keeping the current element focused.
+* Returns a Promise that resolves when SvelteKit navigates (or fails to navigate, in which case the promise rejects) to the specified `url`.
+*
+* For external URLs, use `window.location = url` instead of calling `goto(url)`.
+*
+* @param {string | URL} url Where to navigate to. Note that if you've set [`config.kit.paths.base`](https://svelte.dev/docs/kit/configuration#paths) and the URL is root-relative, you need to prepend the base path if you want to navigate within the app.
+* @param {Object} [opts] Options related to the navigation
+* @param {boolean} [opts.replaceState] If `true`, will replace the current `history` entry rather than creating a new one with `pushState`
+* @param {boolean} [opts.noScroll] If `true`, the browser will maintain its scroll position rather than scrolling to the top of the page after navigation
+* @param {boolean} [opts.keepFocus] If `true`, the currently focused element will retain focus after navigation. Otherwise, focus will be reset to the body
+* @param {boolean} [opts.invalidateAll] If `true`, all `load` functions of the page will be rerun. See https://svelte.dev/docs/kit/load#rerunning-load-functions for more info on invalidation.
+* @param {Array<string | URL | ((url: URL) => boolean)>} [opts.invalidate] Causes any load functions to re-run if they depend on one of the urls
+* @param {App.PageState} [opts.state] An optional object that will be available as `page.state`
+* @returns {Promise<void>}
+*/
+function goto(url, opts = {}) {
+	throw new Error("Cannot call goto(...) on the server");
+}
+/**
+* Causes all `load` and `query` functions belonging to the currently active page to re-run. Returns a `Promise` that resolves when the page is subsequently updated.
+* @returns {Promise<void>}
+*/
+function invalidateAll() {
+	throw new Error("Cannot call invalidateAll() on the server");
+}
+
+export { goto as g, invalidateAll as i };
+//# sourceMappingURL=client.js-BlAaaeFi.js.map

package/build/server/chunks/chunks/client.js-BlAaaeFi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js-BlAaaeFi.js","sources":["../../../../.svelte-kit/output/server/chunks/client.js"],"sourcesContent":["import { t as index_server_exports } from \"./index-server.js\";\nimport { x as noop } from \"./shared.js\";\nimport \"./internal.js\";\nimport \"./exports.js\";\nimport \"./routing.js\";\nimport { Gt as noop$1 } from \"./server.js\";\nimport { n as writable } from \"./shared2.js\";\nimport \"./paths.js\";\nimport \"@sveltejs/kit/internal\";\nvar PRELOAD_PRIORITIES = {\n\ttap: 1,\n\thover: 2,\n\tviewport: 3,\n\teager: 4,\n\toff: -1,\n\tfalse: -1\n};\n({ ...PRELOAD_PRIORITIES }), PRELOAD_PRIORITIES.hover;\n/** @param {any} value */\nfunction notifiable_store(value) {\n\tconst store = writable(value);\n\tlet ready = true;\n\tfunction notify() {\n\t\tready = true;\n\t\tstore.update((val) => val);\n\t}\n\t/** @param {any} new_value */\n\tfunction set(new_value) {\n\t\tready = false;\n\t\tstore.set(new_value);\n\t}\n\t/** @param {(value: any) => void} run */\n\tfunction subscribe(run) {\n\t\t/** @type {any} */\n\t\tlet old_value;\n\t\treturn store.subscribe((new_value) => {\n\t\t\tif (old_value === void 0 || ready && new_value !== old_value) run(old_value = new_value);\n\t\t});\n\t}\n\treturn {\n\t\tnotify,\n\t\tset,\n\t\tsubscribe\n\t};\n}\nvar updated_listener = { v: noop };\nfunction create_updated_store() {\n\tconst { set, subscribe } = writable(false);\n\treturn {\n\t\tsubscribe,\n\t\tcheck: async () => false\n\t};\n}\n// ../../node_modules/.pnpm/@sveltejs+kit@2.70.3_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.3.1_svelte_47ca0476217d3a67b8821de8a7850a17/node_modules/@sveltejs/kit/src/runtime/client/state.svelte.js\nvar page;\nvar navigating;\nvar updated;\nvar is_legacy = noop$1.toString().includes(\"$$\") || /function \\w+\\(\\) \\{\\}/.test(noop$1.toString());\nvar placeholder_url = \"a:\";\nif (is_legacy) {\n\tpage = {\n\t\tdata: {},\n\t\tform: null,\n\t\terror: null,\n\t\tparams: {},\n\t\troute: { id: null },\n\t\tstate: {},\n\t\tstatus: -1,\n\t\turl: new URL(placeholder_url)\n\t};\n\tnavigating = { current: null };\n\tupdated = { current: false };\n} else {\n\tpage = new class Page {\n\t\tdata = {};\n\t\tform = null;\n\t\terror = null;\n\t\tparams = {};\n\t\troute = { id: null };\n\t\tstate = {};\n\t\tstatus = -1;\n\t\turl = new URL(placeholder_url);\n\t}();\n\tnavigating = new class Navigating {\n\t\tcurrent = null;\n\t}();\n\tupdated = new class Updated {\n\t\tcurrent = false;\n\t}();\n\tupdated_listener.v = () => updated.current = true;\n}\n// ../../node_modules/.pnpm/@sveltejs+kit@2.70.3_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.3.1_svelte_47ca0476217d3a67b8821de8a7850a17/node_modules/@sveltejs/kit/src/runtime/client/client.js\n/** @import { RemoteFunctionDataNode, ServerNodesResponse, ServerRedirectNode } from 'types' */\n/** @import { CacheEntry } from './remote-functions/cache.svelte.js' */\n/** @import { Query } from './remote-functions/query/instance.svelte.js' */\n/** @import { LiveQuery } from './remote-functions/query-live/instance.svelte.js' */\nvar { onMount, tick } = index_server_exports;\nvar stores = {\n\turl: /* @__PURE__ */ notifiable_store({}),\n\tpage: /* @__PURE__ */ notifiable_store({}),\n\tnavigating: /* @__PURE__ */ writable(null),\n\tupdated: /* @__PURE__ */ create_updated_store()\n};\n/**\n* Allows you to navigate programmatically to a given route, with options such as keeping the current element focused.\n* Returns a Promise that resolves when SvelteKit navigates (or fails to navigate, in which case the promise rejects) to the specified `url`.\n*\n* For external URLs, use `window.location = url` instead of calling `goto(url)`.\n*\n* @param {string | URL} url Where to navigate to. Note that if you've set [`config.kit.paths.base`](https://svelte.dev/docs/kit/configuration#paths) and the URL is root-relative, you need to prepend the base path if you want to navigate within the app.\n* @param {Object} [opts] Options related to the navigation\n* @param {boolean} [opts.replaceState] If `true`, will replace the current `history` entry rather than creating a new one with `pushState`\n* @param {boolean} [opts.noScroll] If `true`, the browser will maintain its scroll position rather than scrolling to the top of the page after navigation\n* @param {boolean} [opts.keepFocus] If `true`, the currently focused element will retain focus after navigation. Otherwise, focus will be reset to the body\n* @param {boolean} [opts.invalidateAll] If `true`, all `load` functions of the page will be rerun. See https://svelte.dev/docs/kit/load#rerunning-load-functions for more info on invalidation.\n* @param {Array<string | URL | ((url: URL) => boolean)>} [opts.invalidate] Causes any load functions to re-run if they depend on one of the urls\n* @param {App.PageState} [opts.state] An optional object that will be available as `page.state`\n* @returns {Promise<void>}\n*/\nfunction goto(url, opts = {}) {\n\tthrow new Error(\"Cannot call goto(...) on the server\");\n}\n/**\n* Causes all `load` and `query` functions belonging to the currently active page to re-run. Returns a `Promise` that resolves when the page is subsequently updated.\n* @returns {Promise<void>}\n*/\nfunction invalidateAll() {\n\tthrow new Error(\"Cannot call invalidateAll() on the server\");\n}\nexport { page as a, navigating as i, invalidateAll as n, stores as r, goto as t };\n"],"names":["noop$1"],"mappings":";;;;;;;;;AAyDA,IAAI,SAAS,GAAGA,IAAM,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAACA,IAAM,CAAC,QAAQ,EAAE,CAAC;AACnG,IAAI,eAAe,GAAG,IAAI;AAC1B,IAAI,SAAS,EAAE;AACf,EAAQ;AACR,EAAE,IAAI,EAAE,EAAE;AACV,EAAE,IAAI,EAAE,IAAI;AACZ,EAAE,KAAK,EAAE,IAAI;AACb,EAAE,MAAM,EAAE,EAAE;AACZ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;AACrB,EAAE,KAAK,EAAE,EAAE;AACX,EAAE,MAAM,EAAE,EAAE;AACZ,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,eAAe;AAC9B,GAAE;AAGF;AAmBA;AACA;AACA;AACA;AACA;AACA,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,oBAAoB;AAO5C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,IAAI,CAAC,GAAG,EAAE,IAAI,GAAG,EAAE,EAAE;AAC9B,CAAC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC;AACvD;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,GAAG;AACzB,CAAC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC;AAC7D;;;;"}