@selvajs/selva 4.20.0-beta.14 → 4.20.0-beta.15

package/build/server/chunks/chunks/registry.js-8x04W1ns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js-8x04W1ns.js","sources":["../../../../.svelte-kit/output/server/chunks/registry.js"],"sourcesContent":["import { c as AddProjectMemberBodySchema, d as CreateProjectBodySchema, f as OrgComputePatchBodySchema, g as UpdateProjectMemberBodySchema, h as UpdateProjectBodySchema, l as CreateApiTokenBodySchema, m as UpdateOrgMemberBodySchema, p as SolveBodySchema, u as CreateInviteBodySchema } from \"./api.js\";\n// src/lib/server/api/v1/registry.ts\n/**\n* The v1 contract as data: one entry per method+path, naming its body validator,\n* response shape, and whether it's public or internal.\n*\n* Both the OpenAPI generator and the conformance test read this file. The test\n* walks `routes/api/v1/**` against this table and fails if either side has an\n* entry the other doesn't — a route with no registry entry is undocumented, a\n* registry entry with no route is a spec promising something that 404s.\n*\n* Request schemas are Zod values imported from `@selvajs/server/api`, not\n* transcribed, so a renamed field changes the spec on the next generate\n* instead of silently disagreeing with the validator.\n*/\nvar solveErrors = [\n\t400,\n\t401,\n\t404,\n\t429,\n\t503\n];\nvar V1_ENDPOINTS = [\n\t{\n\t\tmethod: \"GET\",\n\t\tpath: \"/openapi.json\",\n\t\tscope: \"read\",\n\t\tsummary: \"This document, as JSON.\",\n\t\tresponse: \"object\"\n\t},\n\t{\n\t\tmethod: \"GET\",\n\t\tpath: \"/me\",\n\t\tscope: \"read\",\n\t\tsummary: \"The calling identity, its acting org, its effective permissions, and for a token its id, scopes and expiry.\",\n\t\tresponse: \"object\",\n\t\treturns: \"`apiToken: { id, scopes, expiresAt }` is present only when the caller is an API token.\"\n\t},\n\t{\n\t\tmethod: \"DELETE\",\n\t\tpath: \"/me/token\",\n\t\tscope: \"read\",\n\t\tsummary: \"Revoke the API token that sent this request. A key can revoke itself and nothing else; a browser session gets 400.\",\n\t\tresponse: \"empty\",\n\t\terrors: [400, 503]\n\t},\n\t{\n\t\tmethod: \"PUT\",\n\t\tpath: \"/me/starred/{guid}\",\n\t\tscope: \"write\",\n\t\tsummary: \"Star a definition. Idempotent.\",\n\t\tresponse: \"empty\",\n\t\terrors: [404]\n\t},\n\t{\n\t\tmethod: \"DELETE\",\n\t\tpath: \"/me/starred/{guid}\",\n\t\tscope: \"write\",\n\t\tsummary: \"Unstar a definition. Idempotent.\",\n\t\tresponse: \"empty\"\n\t},\n\t{\n\t\tmethod: \"GET\",\n\t\tpath: \"/definitions\",\n\t\tscope: \"read\",\n\t\tsummary: \"List definitions the caller can see.\",\n\t\tresponse: \"collection\",\n\t\treturns: \"Each item has `sourceDocumentId`: the Grasshopper document GUID the definition was last uploaded from, or null.\",\n\t\tquery: [\n\t\t\t{\n\t\t\t\tname: \"projectId\",\n\t\t\t\tdescription: \"Restrict to one project.\"\n\t\t\t},\n\t\t\t{\n\t\t\t\tname: \"status\",\n\t\t\t\tdescription: \"One of `draft`, `published`, `archived`.\"\n\t\t\t},\n\t\t\t{\n\t\t\t\tname: \"documentId\",\n\t\t\t\tdescription: \"A Grasshopper document GUID. Returns only definitions last uploaded from that document which the caller can upload a new version of. Not a GUID: 400.\"\n\t\t\t}\n\t\t],\n\t\terrors: [400]\n\t},\n\t{\n\t\tmethod: \"POST\",\n\t\tpath: \"/definitions\",\n\t\tscope: \"upload\",\n\t\tidempotent: true,\n\t\tsummary: \"Create a definition from a Grasshopper file.\",\n\t\tresponse: \"object\",\n\t\tstatus: 201,\n\t\tmultipart: [\n\t\t\t{\n\t\t\t\tfield: \"file\",\n\t\t\t\trequired: true,\n\t\t\t\tdescription: \"The `.gh` or `.ghx` file.\"\n\t\t\t},\n\t\t\t{\n\t\t\t\tfield: \"projectId\",\n\t\t\t\trequired: true,\n\t\t\t\tdescription: \"Owning project.\"\n\t\t\t},\n\t\t\t{\n\t\t\t\tfield: \"displayName\",\n\t\t\t\trequired: true,\n\t\t\t\tdescription: \"Human-readable name.\"\n\t\t\t},\n\t\t\t{\n\t\t\t\tfield: \"description\",\n\t\t\t\trequired: false,\n\t\t\t\tdescription: \"Long description.\"\n\t\t\t},\n\t\t\t{\n\t\t\t\tfield: \"category\",\n\t\t\t\trequired: false,\n\t\t\t\tdescription: \"Grouping label.\"\n\t\t\t},\n\t\t\t{\n\t\t\t\tfield: \"tags\",\n\t\t\t\trequired: false,\n\t\t\t\tdescription: \"Comma-separated tags.\"\n\t\t\t},\n\t\t\t{\n\t\t\t\tfield: \"image\",\n\t\t\t\trequired: false,\n\t\t\t\tdescription: \"Cover image.\"\n\t\t\t},\n\t\t\t{\n\t\t\t\tfield: \"computeServerId\",\n\t\t\t\trequired: false,\n\t\t\t\tdescription: \"Pin to a compute server.\"\n\t\t\t}\n\t\t],\n\t\terrors: [\n\t\t\t400,\n\t\t\t403,\n\t\t\t422,\n\t\t\t503\n\t\t]\n\t},\n\t{\n\t\tmethod: \"GET\",\n\t\tpath: \"/definitions/{guid}\",\n\t\tscope: \"read\",\n\t\tsummary: \"Definition record plus its live and draft version summaries.\",\n\t\tresponse: \"object\",\n\t\treturns: \"`canEdit` is true when the caller can upload a version and make one live; for an API token that includes its scopes. `sourceDocumentId` is the Grasshopper document GUID it was last uploaded from, or null.\",\n\t\terrors: [404]\n\t},\n\t{\n\t\tmethod: \"PATCH\",\n\t\tpath: \"/definitions/{guid}\",\n\t\tscope: \"write\",\n\t\tsummary: \"Update definition metadata.\",\n\t\tresponse: \"empty\",\n\t\terrors: [400, 404]\n\t},\n\t{\n\t\tmethod: \"DELETE\",\n\t\tpath: \"/definitions/{guid}\",\n\t\tscope: \"write\",\n\t\tsummary: \"Soft-delete a definition.\",\n\t\tresponse: \"empty\",\n\t\terrors: [404]\n\t},\n\t{\n\t\tmethod: \"POST\",\n\t\tpath: \"/definitions/{guid}/solve\",\n\t\tscope: \"solve\",\n\t\tidempotent: true,\n\t\tsummary: \"Solve a definition. The primary action of the API.\",\n\t\tresponse: \"object\",\n\t\trequestBody: SolveBodySchema,\n\t\terrors: solveErrors\n\t},\n\t{\n\t\tmethod: \"GET\",\n\t\tpath: \"/definitions/{guid}/schema\",\n\t\tscope: \"read\",\n\t\tsummary: \"The live version's UI schema. 404 when nothing is published.\",\n\t\tresponse: \"object\",\n\t\terrors: [404]\n\t},\n\t{\n\t\tmethod: \"GET\",\n\t\tpath: \"/definitions/{guid}/versions\",\n\t\tscope: \"read\",\n\t\tsummary: \"List versions, newest first.\",\n\t\tresponse: \"collection\",\n\t\terrors: [404]\n\t},\n\t{\n\t\tmethod: \"POST\",\n\t\tpath: \"/definitions/{guid}/versions\",\n\t\tscope: \"upload\",\n\t\tidempotent: true,\n\t\tsummary: \"Upload a new version.\",\n\t\tresponse: \"object\",\n\t\tstatus: 201,\n\t\tmultipart: [{\n\t\t\tfield: \"file\",\n\t\t\trequired: true,\n\t\t\tdescription: \"The `.gh` or `.ghx` file.\"\n\t\t}, {\n\t\t\tfield: \"changeNote\",\n\t\t\trequired: false,\n\t\t\tdescription: \"Truncated to 1000 characters.\"\n\t\t}],\n\t\terrors: [\n\t\t\t400,\n\t\t\t404,\n\t\t\t422,\n\t\t\t503\n\t\t]\n\t},\n\t{\n\t\tmethod: \"GET\",\n\t\tpath: \"/definitions/{guid}/versions/{versionId}\",\n\t\tscope: \"read\",\n\t\tsummary: \"One version, without its cached schema.\",\n\t\tresponse: \"object\",\n\t\terrors: [404]\n\t},\n\t{\n\t\tmethod: \"DELETE\",\n\t\tpath: \"/definitions/{guid}/versions/{versionId}\",\n\t\tscope: \"write\",\n\t\tsummary: \"Delete a version. 409 when it is the live or draft pointer.\",\n\t\tresponse: \"empty\",\n\t\terrors: [404, 409]\n\t},\n\t{\n\t\tmethod: \"GET\",\n\t\tpath: \"/definitions/{guid}/versions/{versionId}/schema\",\n\t\tscope: \"read\",\n\t\tsummary: \"That version's cached UI schema. No compute round-trip.\",\n\t\tresponse: \"object\",\n\t\terrors: [404]\n\t},\n\t{\n\t\tmethod: \"POST\",\n\t\tpath: \"/definitions/{guid}/publish\",\n\t\tscope: \"upload\",\n\t\tsummary: \"Promote a version to live.\",\n\t\tresponse: \"object\",\n\t\terrors: [400, 404]\n\t},\n\t{\n\t\tmethod: \"POST\",\n\t\tpath: \"/definitions/{guid}/image\",\n\t\tscope: \"write\",\n\t\tsummary: \"Upload a cover image.\",\n\t\tresponse: \"object\",\n\t\tmultipart: [{\n\t\t\tfield: \"image\",\n\t\t\trequired: true,\n\t\t\tdescription: \"PNG, JPEG, WebP or GIF.\"\n\t\t}],\n\t\terrors: [400, 404]\n\t},\n\t{\n\t\tmethod: \"GET\",\n\t\tpath: \"/definitions/{guid}/share-links\",\n\t\tscope: \"read\",\n\t\tsummary: \"List share links. 404 when sharing is disabled on the instance.\",\n\t\tresponse: \"collection\",\n\t\terrors: [404]\n\t},\n\t{\n\t\tmethod: \"POST\",\n\t\tpath: \"/definitions/{guid}/share-links\",\n\t\tscope: \"write\",\n\t\tidempotent: true,\n\t\tsummary: \"Create a share link. The raw token is returned once and never again.\",\n\t\tresponse: \"object\",\n\t\tstatus: 201,\n\t\terrors: [400, 404]\n\t},\n\t{\n\t\tmethod: \"DELETE\",\n\t\tpath: \"/definitions/{guid}/share-links/{linkId}\",\n\t\tscope: \"write\",\n\t\tsummary: \"Revoke a share link.\",\n\t\tresponse: \"empty\",\n\t\terrors: [404]\n\t},\n\t{\n\t\tmethod: \"GET\",\n\t\tpath: \"/projects\",\n\t\tscope: \"read\",\n\t\tsummary: \"List projects the caller can view.\",\n\t\tresponse: \"collection\",\n\t\treturns: \"Each item has `canCreateDefinitions`: whether `POST /definitions` would accept this project from the caller, scopes included for an API token.\"\n\t},\n\t{\n\t\tmethod: \"POST\",\n\t\tpath: \"/projects\",\n\t\tscope: \"write\",\n\t\tidempotent: true,\n\t\tsummary: \"Create a project.\",\n\t\tresponse: \"object\",\n\t\tstatus: 201,\n\t\trequestBody: CreateProjectBodySchema,\n\t\terrors: [\n\t\t\t400,\n\t\t\t403,\n\t\t\t409\n\t\t]\n\t},\n\t{\n\t\tmethod: \"GET\",\n\t\tpath: \"/projects/{id}\",\n\t\tscope: \"read\",\n\t\tsummary: \"Project record plus the caller's effective role and capabilities.\",\n\t\tresponse: \"object\",\n\t\terrors: [404]\n\t},\n\t{\n\t\tmethod: \"PATCH\",\n\t\tpath: \"/projects/{id}\",\n\t\tscope: \"write\",\n\t\tsummary: \"Update project settings. Owner-only.\",\n\t\tresponse: \"empty\",\n\t\trequestBody: UpdateProjectBodySchema,\n\t\terrors: [\n\t\t\t400,\n\t\t\t403,\n\t\t\t404,\n\t\t\t409\n\t\t]\n\t},\n\t{\n\t\tmethod: \"DELETE\",\n\t\tpath: \"/projects/{id}\",\n\t\tscope: \"write\",\n\t\tsummary: \"Delete a project.\",\n\t\tresponse: \"empty\",\n\t\terrors: [403, 404]\n\t},\n\t{\n\t\tmethod: \"GET\",\n\t\tpath: \"/projects/{id}/members\",\n\t\tscope: \"read\",\n\t\tsummary: \"List project members.\",\n\t\tresponse: \"collection\",\n\t\terrors: [403, 404]\n\t},\n\t{\n\t\tmethod: \"POST\",\n\t\tpath: \"/projects/{id}/members\",\n\t\tscope: \"write\",\n\t\tsummary: \"Add a member. The target must already belong to the org.\",\n\t\tresponse: \"object\",\n\t\tstatus: 201,\n\t\trequestBody: AddProjectMemberBodySchema,\n\t\terrors: [\n\t\t\t400,\n\t\t\t403,\n\t\t\t404\n\t\t]\n\t},\n\t{\n\t\tmethod: \"PATCH\",\n\t\tpath: \"/projects/{id}/members/{userId}\",\n\t\tscope: \"write\",\n\t\tsummary: \"Change a member role.\",\n\t\tresponse: \"empty\",\n\t\trequestBody: UpdateProjectMemberBodySchema,\n\t\terrors: [\n\t\t\t400,\n\t\t\t403,\n\t\t\t404,\n\t\t\t409\n\t\t]\n\t},\n\t{\n\t\tmethod: \"DELETE\",\n\t\tpath: \"/projects/{id}/members/{userId}\",\n\t\tscope: \"write\",\n\t\tsummary: \"Remove a member. Idempotent.\",\n\t\tresponse: \"empty\",\n\t\tquery: [{\n\t\t\tname: \"confirm\",\n\t\t\tdescription: \"Set to `true` to remove a co-owner; without it the call returns 409.\"\n\t\t}],\n\t\terrors: [\n\t\t\t403,\n\t\t\t404,\n\t\t\t409\n\t\t]\n\t},\n\t{\n\t\tmethod: \"POST\",\n\t\tpath: \"/projects/{id}/reclaim\",\n\t\tscope: \"write\",\n\t\tsummary: \"Claim ownership of an unowned project.\",\n\t\tresponse: \"object\",\n\t\tstatus: 201,\n\t\terrors: [\n\t\t\t403,\n\t\t\t404,\n\t\t\t409\n\t\t]\n\t},\n\t{\n\t\tmethod: \"GET\",\n\t\tpath: \"/orgs/{orgId}\",\n\t\tscope: \"read\",\n\t\tsummary: \"Org record. The org must be the caller's acting org.\",\n\t\tresponse: \"object\",\n\t\terrors: [403, 404]\n\t},\n\t{\n\t\tmethod: \"GET\",\n\t\tpath: \"/orgs/{orgId}/members\",\n\t\tscope: \"read\",\n\t\tsummary: \"List org members.\",\n\t\tresponse: \"collection\",\n\t\terrors: [403]\n\t},\n\t{\n\t\tmethod: \"PATCH\",\n\t\tpath: \"/orgs/{orgId}/members/{userId}\",\n\t\tscope: \"write\",\n\t\tsummary: \"Change an org role or permission set. The sole owner cannot be demoted.\",\n\t\tresponse: \"empty\",\n\t\trequestBody: UpdateOrgMemberBodySchema,\n\t\terrors: [\n\t\t\t400,\n\t\t\t403,\n\t\t\t404,\n\t\t\t409\n\t\t]\n\t},\n\t{\n\t\tmethod: \"DELETE\",\n\t\tpath: \"/orgs/{orgId}/members/{userId}\",\n\t\tscope: \"write\",\n\t\tsummary: \"Remove an org member. The sole owner cannot be removed.\",\n\t\tresponse: \"empty\",\n\t\terrors: [\n\t\t\t403,\n\t\t\t404,\n\t\t\t409\n\t\t]\n\t},\n\t{\n\t\tmethod: \"GET\",\n\t\tpath: \"/orgs/{orgId}/invites\",\n\t\tscope: \"read\",\n\t\tsummary: \"List pending invites.\",\n\t\tresponse: \"collection\",\n\t\terrors: [403]\n\t},\n\t{\n\t\tmethod: \"POST\",\n\t\tpath: \"/orgs/{orgId}/invites\",\n\t\tscope: \"write\",\n\t\tsummary: \"Invite someone to the org. The accept URL is returned once.\",\n\t\tresponse: \"object\",\n\t\tstatus: 201,\n\t\trequestBody: CreateInviteBodySchema,\n\t\terrors: [\n\t\t\t400,\n\t\t\t403,\n\t\t\t409\n\t\t]\n\t},\n\t{\n\t\tmethod: \"DELETE\",\n\t\tpath: \"/orgs/{orgId}/invites/{id}\",\n\t\tscope: \"write\",\n\t\tsummary: \"Revoke an invite.\",\n\t\tresponse: \"empty\",\n\t\terrors: [403, 404]\n\t},\n\t{\n\t\tmethod: \"POST\",\n\t\tpath: \"/orgs/{orgId}/invites/{id}/resend\",\n\t\tscope: \"write\",\n\t\tsummary: \"Re-send an invite. Issues a replacement and revokes the original, so the previous link stops working.\",\n\t\tresponse: \"object\",\n\t\tstatus: 201,\n\t\terrors: [\n\t\t\t403,\n\t\t\t404,\n\t\t\t409\n\t\t]\n\t},\n\t{\n\t\tmethod: \"GET\",\n\t\tpath: \"/orgs/{orgId}/tokens\",\n\t\tscope: \"read\",\n\t\tsummary: \"Your API tokens in this org, revoked and expired included.\",\n\t\tinternal: true,\n\t\tresponse: \"collection\",\n\t\tquery: [{\n\t\t\tname: \"all\",\n\t\t\tdescription: \"`true` for every member's tokens. Needs `manage_org_members`.\"\n\t\t}],\n\t\terrors: [403, 503]\n\t},\n\t{\n\t\tmethod: \"POST\",\n\t\tpath: \"/orgs/{orgId}/tokens\",\n\t\tscope: \"write\",\n\t\tsummary: \"Create an API token acting as you. The raw key is returned once, as `secret`.\",\n\t\tinternal: true,\n\t\tresponse: \"object\",\n\t\tstatus: 201,\n\t\trequestBody: CreateApiTokenBodySchema,\n\t\terrors: [\n\t\t\t400,\n\t\t\t403,\n\t\t\t503\n\t\t]\n\t},\n\t{\n\t\tmethod: \"DELETE\",\n\t\tpath: \"/orgs/{orgId}/tokens/{tokenId}\",\n\t\tscope: \"write\",\n\t\tsummary: \"Revoke an API token: your own, or any in the org with `manage_org_members`.\",\n\t\tinternal: true,\n\t\tresponse: \"empty\",\n\t\terrors: [\n\t\t\t403,\n\t\t\t404,\n\t\t\t503\n\t\t]\n\t},\n\t{\n\t\tmethod: \"GET\",\n\t\tpath: \"/orgs/{orgId}/compute\",\n\t\tscope: \"read\",\n\t\tsummary: \"Org compute-server overrides and the shared catalog.\",\n\t\tinternal: true,\n\t\tresponse: \"object\",\n\t\terrors: [403]\n\t},\n\t{\n\t\tmethod: \"PATCH\",\n\t\tpath: \"/orgs/{orgId}/compute\",\n\t\tscope: \"write\",\n\t\tsummary: \"Replace the org compute-server overrides.\",\n\t\tinternal: true,\n\t\tresponse: \"empty\",\n\t\trequestBody: OrgComputePatchBodySchema,\n\t\terrors: [400, 403]\n\t},\n\t{\n\t\tmethod: \"POST\",\n\t\tpath: \"/orgs/{orgId}/assets/{kind}\",\n\t\tscope: \"write\",\n\t\tsummary: \"Upload an org branding asset.\",\n\t\tinternal: true,\n\t\tresponse: \"object\",\n\t\tmultipart: [{\n\t\t\tfield: \"image\",\n\t\t\trequired: true,\n\t\t\tdescription: \"PNG, JPEG, WebP, GIF or SVG.\"\n\t\t}],\n\t\terrors: [\n\t\t\t400,\n\t\t\t403,\n\t\t\t404\n\t\t]\n\t},\n\t{\n\t\tmethod: \"DELETE\",\n\t\tpath: \"/orgs/{orgId}/assets/{kind}\",\n\t\tscope: \"write\",\n\t\tsummary: \"Remove an org branding asset.\",\n\t\tinternal: true,\n\t\tresponse: \"empty\",\n\t\terrors: [403, 404]\n\t},\n\t{\n\t\tmethod: \"POST\",\n\t\tpath: \"/compute\",\n\t\tscope: \"solve\",\n\t\tsummary: \"Generic solve, including remote definition URLs and share-token access.\",\n\t\tinternal: true,\n\t\tresponse: \"object\",\n\t\terrors: solveErrors\n\t},\n\t{\n\t\tmethod: \"POST\",\n\t\tpath: \"/compute/schema\",\n\t\tscope: \"upload\",\n\t\tsummary: \"Extract UI schemas from an uploaded file before it becomes a definition.\",\n\t\tinternal: true,\n\t\tresponse: \"object\",\n\t\tmultipart: [{\n\t\t\tfield: \"file\",\n\t\t\trequired: true,\n\t\t\tdescription: \"The `.gh` or `.ghx` file.\"\n\t\t}],\n\t\tquery: [{\n\t\t\tname: \"projectId\",\n\t\t\tdescription: \"Project the file will belong to.\"\n\t\t}, {\n\t\t\tname: \"computeServerId\",\n\t\t\tdescription: \"Pin to a compute server.\"\n\t\t}],\n\t\terrors: [\n\t\t\t400,\n\t\t\t403,\n\t\t\t422,\n\t\t\t503\n\t\t]\n\t},\n\t{\n\t\tmethod: \"GET\",\n\t\tpath: \"/solve-events\",\n\t\tscope: \"read\",\n\t\tsummary: \"The tab's live event stream (SSE). Solves that name its `streamId` report here.\",\n\t\tinternal: true,\n\t\tresponse: \"object\",\n\t\tquery: [{\n\t\t\tname: \"streamId\",\n\t\t\tdescription: \"Minted by the tab, 16-64 URL-safe characters.\"\n\t\t}],\n\t\terrors: [\n\t\t\t400,\n\t\t\t401,\n\t\t\t409\n\t\t]\n\t},\n\t{\n\t\tmethod: \"POST\",\n\t\tpath: \"/solve-events/{solveId}\",\n\t\tscope: \"write\",\n\t\tsummary: \"The plugin's callback from inside a Compute solve. The reply carries `abort`.\",\n\t\tinternal: true,\n\t\tresponse: \"object\",\n\t\terrors: [\n\t\t\t400,\n\t\t\t401,\n\t\t\t410\n\t\t]\n\t},\n\t{\n\t\tmethod: \"POST\",\n\t\tpath: \"/solve/{solveId}/cancel\",\n\t\tscope: \"solve\",\n\t\tsummary: \"Ask a running solve to abort. Cooperative: it stops at the next component.\",\n\t\tinternal: true,\n\t\tresponse: \"empty\",\n\t\terrors: [401, 404]\n\t}\n];\nexport { V1_ENDPOINTS as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,WAAW,GAAG;AAClB,CAAC,GAAG;AACJ,CAAC,GAAG;AACJ,CAAC,GAAG;AACJ,CAAC,GAAG;AACJ,CAAC;AACD,CAAC;AACE,IAAC,YAAY,GAAG;AACnB,CAAC;AACD,EAAE,MAAM,EAAE,KAAK;AACf,EAAE,IAAI,EAAE,eAAe;AACvB,EAAE,KAAK,EAAE,MAAM;AACf,EAAE,OAAO,EAAE,yBAAyB;AACpC,EAAE,QAAQ,EAAE;AACZ,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,KAAK;AACf,EAAE,IAAI,EAAE,KAAK;AACb,EAAE,KAAK,EAAE,MAAM;AACf,EAAE,OAAO,EAAE,6GAA6G;AACxH,EAAE,QAAQ,EAAE,QAAQ;AACpB,EAAE,OAAO,EAAE;AACX,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,QAAQ;AAClB,EAAE,IAAI,EAAE,WAAW;AACnB,EAAE,KAAK,EAAE,MAAM;AACf,EAAE,OAAO,EAAE,oHAAoH;AAC/H,EAAE,QAAQ,EAAE,OAAO;AACnB,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG;AACnB,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,KAAK;AACf,EAAE,IAAI,EAAE,oBAAoB;AAC5B,EAAE,KAAK,EAAE,OAAO;AAChB,EAAE,OAAO,EAAE,gCAAgC;AAC3C,EAAE,QAAQ,EAAE,OAAO;AACnB,EAAE,MAAM,EAAE,CAAC,GAAG;AACd,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,QAAQ;AAClB,EAAE,IAAI,EAAE,oBAAoB;AAC5B,EAAE,KAAK,EAAE,OAAO;AAChB,EAAE,OAAO,EAAE,kCAAkC;AAC7C,EAAE,QAAQ,EAAE;AACZ,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,KAAK;AACf,EAAE,IAAI,EAAE,cAAc;AACtB,EAAE,KAAK,EAAE,MAAM;AACf,EAAE,OAAO,EAAE,sCAAsC;AACjD,EAAE,QAAQ,EAAE,YAAY;AACxB,EAAE,OAAO,EAAE,iHAAiH;AAC5H,EAAE,KAAK,EAAE;AACT,GAAG;AACH,IAAI,IAAI,EAAE,WAAW;AACrB,IAAI,WAAW,EAAE;AACjB,IAAI;AACJ,GAAG;AACH,IAAI,IAAI,EAAE,QAAQ;AAClB,IAAI,WAAW,EAAE;AACjB,IAAI;AACJ,GAAG;AACH,IAAI,IAAI,EAAE,YAAY;AACtB,IAAI,WAAW,EAAE;AACjB;AACA,GAAG;AACH,EAAE,MAAM,EAAE,CAAC,GAAG;AACd,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,MAAM;AAChB,EAAE,IAAI,EAAE,cAAc;AACtB,EAAE,KAAK,EAAE,QAAQ;AACjB,EAAE,UAAU,EAAE,IAAI;AAClB,EAAE,OAAO,EAAE,8CAA8C;AACzD,EAAE,QAAQ,EAAE,QAAQ;AACpB,EAAE,MAAM,EAAE,GAAG;AACb,EAAE,SAAS,EAAE;AACb,GAAG;AACH,IAAI,KAAK,EAAE,MAAM;AACjB,IAAI,QAAQ,EAAE,IAAI;AAClB,IAAI,WAAW,EAAE;AACjB,IAAI;AACJ,GAAG;AACH,IAAI,KAAK,EAAE,WAAW;AACtB,IAAI,QAAQ,EAAE,IAAI;AAClB,IAAI,WAAW,EAAE;AACjB,IAAI;AACJ,GAAG;AACH,IAAI,KAAK,EAAE,aAAa;AACxB,IAAI,QAAQ,EAAE,IAAI;AAClB,IAAI,WAAW,EAAE;AACjB,IAAI;AACJ,GAAG;AACH,IAAI,KAAK,EAAE,aAAa;AACxB,IAAI,QAAQ,EAAE,KAAK;AACnB,IAAI,WAAW,EAAE;AACjB,IAAI;AACJ,GAAG;AACH,IAAI,KAAK,EAAE,UAAU;AACrB,IAAI,QAAQ,EAAE,KAAK;AACnB,IAAI,WAAW,EAAE;AACjB,IAAI;AACJ,GAAG;AACH,IAAI,KAAK,EAAE,MAAM;AACjB,IAAI,QAAQ,EAAE,KAAK;AACnB,IAAI,WAAW,EAAE;AACjB,IAAI;AACJ,GAAG;AACH,IAAI,KAAK,EAAE,OAAO;AAClB,IAAI,QAAQ,EAAE,KAAK;AACnB,IAAI,WAAW,EAAE;AACjB,IAAI;AACJ,GAAG;AACH,IAAI,KAAK,EAAE,iBAAiB;AAC5B,IAAI,QAAQ,EAAE,KAAK;AACnB,IAAI,WAAW,EAAE;AACjB;AACA,GAAG;AACH,EAAE,MAAM,EAAE;AACV,GAAG,GAAG;AACN,GAAG,GAAG;AACN,GAAG,GAAG;AACN,GAAG;AACH;AACA,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,KAAK;AACf,EAAE,IAAI,EAAE,qBAAqB;AAC7B,EAAE,KAAK,EAAE,MAAM;AACf,EAAE,OAAO,EAAE,8DAA8D;AACzE,EAAE,QAAQ,EAAE,QAAQ;AACpB,EAAE,OAAO,EAAE,8MAA8M;AACzN,EAAE,MAAM,EAAE,CAAC,GAAG;AACd,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,OAAO;AACjB,EAAE,IAAI,EAAE,qBAAqB;AAC7B,EAAE,KAAK,EAAE,OAAO;AAChB,EAAE,OAAO,EAAE,6BAA6B;AACxC,EAAE,QAAQ,EAAE,OAAO;AACnB,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG;AACnB,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,QAAQ;AAClB,EAAE,IAAI,EAAE,qBAAqB;AAC7B,EAAE,KAAK,EAAE,OAAO;AAChB,EAAE,OAAO,EAAE,2BAA2B;AACtC,EAAE,QAAQ,EAAE,OAAO;AACnB,EAAE,MAAM,EAAE,CAAC,GAAG;AACd,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,MAAM;AAChB,EAAE,IAAI,EAAE,2BAA2B;AACnC,EAAE,KAAK,EAAE,OAAO;AAChB,EAAE,UAAU,EAAE,IAAI;AAClB,EAAE,OAAO,EAAE,oDAAoD;AAC/D,EAAE,QAAQ,EAAE,QAAQ;AACpB,EAAE,WAAW,EAAE,eAAe;AAC9B,EAAE,MAAM,EAAE;AACV,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,KAAK;AACf,EAAE,IAAI,EAAE,4BAA4B;AACpC,EAAE,KAAK,EAAE,MAAM;AACf,EAAE,OAAO,EAAE,8DAA8D;AACzE,EAAE,QAAQ,EAAE,QAAQ;AACpB,EAAE,MAAM,EAAE,CAAC,GAAG;AACd,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,KAAK;AACf,EAAE,IAAI,EAAE,8BAA8B;AACtC,EAAE,KAAK,EAAE,MAAM;AACf,EAAE,OAAO,EAAE,8BAA8B;AACzC,EAAE,QAAQ,EAAE,YAAY;AACxB,EAAE,MAAM,EAAE,CAAC,GAAG;AACd,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,MAAM;AAChB,EAAE,IAAI,EAAE,8BAA8B;AACtC,EAAE,KAAK,EAAE,QAAQ;AACjB,EAAE,UAAU,EAAE,IAAI;AAClB,EAAE,OAAO,EAAE,uBAAuB;AAClC,EAAE,QAAQ,EAAE,QAAQ;AACpB,EAAE,MAAM,EAAE,GAAG;AACb,EAAE,SAAS,EAAE,CAAC;AACd,GAAG,KAAK,EAAE,MAAM;AAChB,GAAG,QAAQ,EAAE,IAAI;AACjB,GAAG,WAAW,EAAE;AAChB,GAAG,EAAE;AACL,GAAG,KAAK,EAAE,YAAY;AACtB,GAAG,QAAQ,EAAE,KAAK;AAClB,GAAG,WAAW,EAAE;AAChB,GAAG,CAAC;AACJ,EAAE,MAAM,EAAE;AACV,GAAG,GAAG;AACN,GAAG,GAAG;AACN,GAAG,GAAG;AACN,GAAG;AACH;AACA,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,KAAK;AACf,EAAE,IAAI,EAAE,0CAA0C;AAClD,EAAE,KAAK,EAAE,MAAM;AACf,EAAE,OAAO,EAAE,yCAAyC;AACpD,EAAE,QAAQ,EAAE,QAAQ;AACpB,EAAE,MAAM,EAAE,CAAC,GAAG;AACd,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,QAAQ;AAClB,EAAE,IAAI,EAAE,0CAA0C;AAClD,EAAE,KAAK,EAAE,OAAO;AAChB,EAAE,OAAO,EAAE,6DAA6D;AACxE,EAAE,QAAQ,EAAE,OAAO;AACnB,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG;AACnB,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,KAAK;AACf,EAAE,IAAI,EAAE,iDAAiD;AACzD,EAAE,KAAK,EAAE,MAAM;AACf,EAAE,OAAO,EAAE,yDAAyD;AACpE,EAAE,QAAQ,EAAE,QAAQ;AACpB,EAAE,MAAM,EAAE,CAAC,GAAG;AACd,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,MAAM;AAChB,EAAE,IAAI,EAAE,6BAA6B;AACrC,EAAE,KAAK,EAAE,QAAQ;AACjB,EAAE,OAAO,EAAE,4BAA4B;AACvC,EAAE,QAAQ,EAAE,QAAQ;AACpB,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG;AACnB,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,MAAM;AAChB,EAAE,IAAI,EAAE,2BAA2B;AACnC,EAAE,KAAK,EAAE,OAAO;AAChB,EAAE,OAAO,EAAE,uBAAuB;AAClC,EAAE,QAAQ,EAAE,QAAQ;AACpB,EAAE,SAAS,EAAE,CAAC;AACd,GAAG,KAAK,EAAE,OAAO;AACjB,GAAG,QAAQ,EAAE,IAAI;AACjB,GAAG,WAAW,EAAE;AAChB,GAAG,CAAC;AACJ,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG;AACnB,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,KAAK;AACf,EAAE,IAAI,EAAE,iCAAiC;AACzC,EAAE,KAAK,EAAE,MAAM;AACf,EAAE,OAAO,EAAE,iEAAiE;AAC5E,EAAE,QAAQ,EAAE,YAAY;AACxB,EAAE,MAAM,EAAE,CAAC,GAAG;AACd,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,MAAM;AAChB,EAAE,IAAI,EAAE,iCAAiC;AACzC,EAAE,KAAK,EAAE,OAAO;AAChB,EAAE,UAAU,EAAE,IAAI;AAClB,EAAE,OAAO,EAAE,sEAAsE;AACjF,EAAE,QAAQ,EAAE,QAAQ;AACpB,EAAE,MAAM,EAAE,GAAG;AACb,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG;AACnB,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,QAAQ;AAClB,EAAE,IAAI,EAAE,0CAA0C;AAClD,EAAE,KAAK,EAAE,OAAO;AAChB,EAAE,OAAO,EAAE,sBAAsB;AACjC,EAAE,QAAQ,EAAE,OAAO;AACnB,EAAE,MAAM,EAAE,CAAC,GAAG;AACd,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,KAAK;AACf,EAAE,IAAI,EAAE,WAAW;AACnB,EAAE,KAAK,EAAE,MAAM;AACf,EAAE,OAAO,EAAE,oCAAoC;AAC/C,EAAE,QAAQ,EAAE,YAAY;AACxB,EAAE,OAAO,EAAE;AACX,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,MAAM;AAChB,EAAE,IAAI,EAAE,WAAW;AACnB,EAAE,KAAK,EAAE,OAAO;AAChB,EAAE,UAAU,EAAE,IAAI;AAClB,EAAE,OAAO,EAAE,mBAAmB;AAC9B,EAAE,QAAQ,EAAE,QAAQ;AACpB,EAAE,MAAM,EAAE,GAAG;AACb,EAAE,WAAW,EAAE,uBAAuB;AACtC,EAAE,MAAM,EAAE;AACV,GAAG,GAAG;AACN,GAAG,GAAG;AACN,GAAG;AACH;AACA,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,KAAK;AACf,EAAE,IAAI,EAAE,gBAAgB;AACxB,EAAE,KAAK,EAAE,MAAM;AACf,EAAE,OAAO,EAAE,mEAAmE;AAC9E,EAAE,QAAQ,EAAE,QAAQ;AACpB,EAAE,MAAM,EAAE,CAAC,GAAG;AACd,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,OAAO;AACjB,EAAE,IAAI,EAAE,gBAAgB;AACxB,EAAE,KAAK,EAAE,OAAO;AAChB,EAAE,OAAO,EAAE,sCAAsC;AACjD,EAAE,QAAQ,EAAE,OAAO;AACnB,EAAE,WAAW,EAAE,uBAAuB;AACtC,EAAE,MAAM,EAAE;AACV,GAAG,GAAG;AACN,GAAG,GAAG;AACN,GAAG,GAAG;AACN,GAAG;AACH;AACA,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,QAAQ;AAClB,EAAE,IAAI,EAAE,gBAAgB;AACxB,EAAE,KAAK,EAAE,OAAO;AAChB,EAAE,OAAO,EAAE,mBAAmB;AAC9B,EAAE,QAAQ,EAAE,OAAO;AACnB,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG;AACnB,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,KAAK;AACf,EAAE,IAAI,EAAE,wBAAwB;AAChC,EAAE,KAAK,EAAE,MAAM;AACf,EAAE,OAAO,EAAE,uBAAuB;AAClC,EAAE,QAAQ,EAAE,YAAY;AACxB,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG;AACnB,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,MAAM;AAChB,EAAE,IAAI,EAAE,wBAAwB;AAChC,EAAE,KAAK,EAAE,OAAO;AAChB,EAAE,OAAO,EAAE,0DAA0D;AACrE,EAAE,QAAQ,EAAE,QAAQ;AACpB,EAAE,MAAM,EAAE,GAAG;AACb,EAAE,WAAW,EAAE,0BAA0B;AACzC,EAAE,MAAM,EAAE;AACV,GAAG,GAAG;AACN,GAAG,GAAG;AACN,GAAG;AACH;AACA,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,OAAO;AACjB,EAAE,IAAI,EAAE,iCAAiC;AACzC,EAAE,KAAK,EAAE,OAAO;AAChB,EAAE,OAAO,EAAE,uBAAuB;AAClC,EAAE,QAAQ,EAAE,OAAO;AACnB,EAAE,WAAW,EAAE,6BAA6B;AAC5C,EAAE,MAAM,EAAE;AACV,GAAG,GAAG;AACN,GAAG,GAAG;AACN,GAAG,GAAG;AACN,GAAG;AACH;AACA,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,QAAQ;AAClB,EAAE,IAAI,EAAE,iCAAiC;AACzC,EAAE,KAAK,EAAE,OAAO;AAChB,EAAE,OAAO,EAAE,8BAA8B;AACzC,EAAE,QAAQ,EAAE,OAAO;AACnB,EAAE,KAAK,EAAE,CAAC;AACV,GAAG,IAAI,EAAE,SAAS;AAClB,GAAG,WAAW,EAAE;AAChB,GAAG,CAAC;AACJ,EAAE,MAAM,EAAE;AACV,GAAG,GAAG;AACN,GAAG,GAAG;AACN,GAAG;AACH;AACA,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,MAAM;AAChB,EAAE,IAAI,EAAE,wBAAwB;AAChC,EAAE,KAAK,EAAE,OAAO;AAChB,EAAE,OAAO,EAAE,wCAAwC;AACnD,EAAE,QAAQ,EAAE,QAAQ;AACpB,EAAE,MAAM,EAAE,GAAG;AACb,EAAE,MAAM,EAAE;AACV,GAAG,GAAG;AACN,GAAG,GAAG;AACN,GAAG;AACH;AACA,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,KAAK;AACf,EAAE,IAAI,EAAE,eAAe;AACvB,EAAE,KAAK,EAAE,MAAM;AACf,EAAE,OAAO,EAAE,sDAAsD;AACjE,EAAE,QAAQ,EAAE,QAAQ;AACpB,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG;AACnB,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,KAAK;AACf,EAAE,IAAI,EAAE,uBAAuB;AAC/B,EAAE,KAAK,EAAE,MAAM;AACf,EAAE,OAAO,EAAE,mBAAmB;AAC9B,EAAE,QAAQ,EAAE,YAAY;AACxB,EAAE,MAAM,EAAE,CAAC,GAAG;AACd,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,OAAO;AACjB,EAAE,IAAI,EAAE,gCAAgC;AACxC,EAAE,KAAK,EAAE,OAAO;AAChB,EAAE,OAAO,EAAE,yEAAyE;AACpF,EAAE,QAAQ,EAAE,OAAO;AACnB,EAAE,WAAW,EAAE,yBAAyB;AACxC,EAAE,MAAM,EAAE;AACV,GAAG,GAAG;AACN,GAAG,GAAG;AACN,GAAG,GAAG;AACN,GAAG;AACH;AACA,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,QAAQ;AAClB,EAAE,IAAI,EAAE,gCAAgC;AACxC,EAAE,KAAK,EAAE,OAAO;AAChB,EAAE,OAAO,EAAE,yDAAyD;AACpE,EAAE,QAAQ,EAAE,OAAO;AACnB,EAAE,MAAM,EAAE;AACV,GAAG,GAAG;AACN,GAAG,GAAG;AACN,GAAG;AACH;AACA,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,KAAK;AACf,EAAE,IAAI,EAAE,uBAAuB;AAC/B,EAAE,KAAK,EAAE,MAAM;AACf,EAAE,OAAO,EAAE,uBAAuB;AAClC,EAAE,QAAQ,EAAE,YAAY;AACxB,EAAE,MAAM,EAAE,CAAC,GAAG;AACd,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,MAAM;AAChB,EAAE,IAAI,EAAE,uBAAuB;AAC/B,EAAE,KAAK,EAAE,OAAO;AAChB,EAAE,OAAO,EAAE,6DAA6D;AACxE,EAAE,QAAQ,EAAE,QAAQ;AACpB,EAAE,MAAM,EAAE,GAAG;AACb,EAAE,WAAW,EAAE,sBAAsB;AACrC,EAAE,MAAM,EAAE;AACV,GAAG,GAAG;AACN,GAAG,GAAG;AACN,GAAG;AACH;AACA,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,QAAQ;AAClB,EAAE,IAAI,EAAE,4BAA4B;AACpC,EAAE,KAAK,EAAE,OAAO;AAChB,EAAE,OAAO,EAAE,mBAAmB;AAC9B,EAAE,QAAQ,EAAE,OAAO;AACnB,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG;AACnB,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,MAAM;AAChB,EAAE,IAAI,EAAE,mCAAmC;AAC3C,EAAE,KAAK,EAAE,OAAO;AAChB,EAAE,OAAO,EAAE,uGAAuG;AAClH,EAAE,QAAQ,EAAE,QAAQ;AACpB,EAAE,MAAM,EAAE,GAAG;AACb,EAAE,MAAM,EAAE;AACV,GAAG,GAAG;AACN,GAAG,GAAG;AACN,GAAG;AACH;AACA,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,KAAK;AACf,EAAE,IAAI,EAAE,sBAAsB;AAC9B,EAAE,KAAK,EAAE,MAAM;AACf,EAAE,OAAO,EAAE,4DAA4D;AACvE,EAAE,QAAQ,EAAE,IAAI;AAChB,EAAE,QAAQ,EAAE,YAAY;AACxB,EAAE,KAAK,EAAE,CAAC;AACV,GAAG,IAAI,EAAE,KAAK;AACd,GAAG,WAAW,EAAE;AAChB,GAAG,CAAC;AACJ,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG;AACnB,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,MAAM;AAChB,EAAE,IAAI,EAAE,sBAAsB;AAC9B,EAAE,KAAK,EAAE,OAAO;AAChB,EAAE,OAAO,EAAE,+EAA+E;AAC1F,EAAE,QAAQ,EAAE,IAAI;AAChB,EAAE,QAAQ,EAAE,QAAQ;AACpB,EAAE,MAAM,EAAE,GAAG;AACb,EAAE,WAAW,EAAE,wBAAwB;AACvC,EAAE,MAAM,EAAE;AACV,GAAG,GAAG;AACN,GAAG,GAAG;AACN,GAAG;AACH;AACA,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,QAAQ;AAClB,EAAE,IAAI,EAAE,gCAAgC;AACxC,EAAE,KAAK,EAAE,OAAO;AAChB,EAAE,OAAO,EAAE,6EAA6E;AACxF,EAAE,QAAQ,EAAE,IAAI;AAChB,EAAE,QAAQ,EAAE,OAAO;AACnB,EAAE,MAAM,EAAE;AACV,GAAG,GAAG;AACN,GAAG,GAAG;AACN,GAAG;AACH;AACA,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,KAAK;AACf,EAAE,IAAI,EAAE,uBAAuB;AAC/B,EAAE,KAAK,EAAE,MAAM;AACf,EAAE,OAAO,EAAE,sDAAsD;AACjE,EAAE,QAAQ,EAAE,IAAI;AAChB,EAAE,QAAQ,EAAE,QAAQ;AACpB,EAAE,MAAM,EAAE,CAAC,GAAG;AACd,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,OAAO;AACjB,EAAE,IAAI,EAAE,uBAAuB;AAC/B,EAAE,KAAK,EAAE,OAAO;AAChB,EAAE,OAAO,EAAE,2CAA2C;AACtD,EAAE,QAAQ,EAAE,IAAI;AAChB,EAAE,QAAQ,EAAE,OAAO;AACnB,EAAE,WAAW,EAAE,yBAAyB;AACxC,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG;AACnB,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,MAAM;AAChB,EAAE,IAAI,EAAE,6BAA6B;AACrC,EAAE,KAAK,EAAE,OAAO;AAChB,EAAE,OAAO,EAAE,+BAA+B;AAC1C,EAAE,QAAQ,EAAE,IAAI;AAChB,EAAE,QAAQ,EAAE,QAAQ;AACpB,EAAE,SAAS,EAAE,CAAC;AACd,GAAG,KAAK,EAAE,OAAO;AACjB,GAAG,QAAQ,EAAE,IAAI;AACjB,GAAG,WAAW,EAAE;AAChB,GAAG,CAAC;AACJ,EAAE,MAAM,EAAE;AACV,GAAG,GAAG;AACN,GAAG,GAAG;AACN,GAAG;AACH;AACA,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,QAAQ;AAClB,EAAE,IAAI,EAAE,6BAA6B;AACrC,EAAE,KAAK,EAAE,OAAO;AAChB,EAAE,OAAO,EAAE,+BAA+B;AAC1C,EAAE,QAAQ,EAAE,IAAI;AAChB,EAAE,QAAQ,EAAE,OAAO;AACnB,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG;AACnB,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,MAAM;AAChB,EAAE,IAAI,EAAE,UAAU;AAClB,EAAE,KAAK,EAAE,OAAO;AAChB,EAAE,OAAO,EAAE,yEAAyE;AACpF,EAAE,QAAQ,EAAE,IAAI;AAChB,EAAE,QAAQ,EAAE,QAAQ;AACpB,EAAE,MAAM,EAAE;AACV,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,MAAM;AAChB,EAAE,IAAI,EAAE,iBAAiB;AACzB,EAAE,KAAK,EAAE,QAAQ;AACjB,EAAE,OAAO,EAAE,0EAA0E;AACrF,EAAE,QAAQ,EAAE,IAAI;AAChB,EAAE,QAAQ,EAAE,QAAQ;AACpB,EAAE,SAAS,EAAE,CAAC;AACd,GAAG,KAAK,EAAE,MAAM;AAChB,GAAG,QAAQ,EAAE,IAAI;AACjB,GAAG,WAAW,EAAE;AAChB,GAAG,CAAC;AACJ,EAAE,KAAK,EAAE,CAAC;AACV,GAAG,IAAI,EAAE,WAAW;AACpB,GAAG,WAAW,EAAE;AAChB,GAAG,EAAE;AACL,GAAG,IAAI,EAAE,iBAAiB;AAC1B,GAAG,WAAW,EAAE;AAChB,GAAG,CAAC;AACJ,EAAE,MAAM,EAAE;AACV,GAAG,GAAG;AACN,GAAG,GAAG;AACN,GAAG,GAAG;AACN,GAAG;AACH;AACA,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,KAAK;AACf,EAAE,IAAI,EAAE,eAAe;AACvB,EAAE,KAAK,EAAE,MAAM;AACf,EAAE,OAAO,EAAE,iFAAiF;AAC5F,EAAE,QAAQ,EAAE,IAAI;AAChB,EAAE,QAAQ,EAAE,QAAQ;AACpB,EAAE,KAAK,EAAE,CAAC;AACV,GAAG,IAAI,EAAE,UAAU;AACnB,GAAG,WAAW,EAAE;AAChB,GAAG,CAAC;AACJ,EAAE,MAAM,EAAE;AACV,GAAG,GAAG;AACN,GAAG,GAAG;AACN,GAAG;AACH;AACA,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,MAAM;AAChB,EAAE,IAAI,EAAE,yBAAyB;AACjC,EAAE,KAAK,EAAE,OAAO;AAChB,EAAE,OAAO,EAAE,+EAA+E;AAC1F,EAAE,QAAQ,EAAE,IAAI;AAChB,EAAE,QAAQ,EAAE,QAAQ;AACpB,EAAE,MAAM,EAAE;AACV,GAAG,GAAG;AACN,GAAG,GAAG;AACN,GAAG;AACH;AACA,EAAE;AACF,CAAC;AACD,EAAE,MAAM,EAAE,MAAM;AAChB,EAAE,IAAI,EAAE,yBAAyB;AACjC,EAAE,KAAK,EAAE,OAAO;AAChB,EAAE,OAAO,EAAE,4EAA4E;AACvF,EAAE,QAAQ,EAAE,IAAI;AAChB,EAAE,QAAQ,EAAE,OAAO;AACnB,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG;AACnB;AACA;;;;"}

package/build/server/chunks/chunks/request-context.js-xKh-gy0-.js

@@ -0,0 +1,28 @@
+import { S as SYSTEM_CONTEXT } from './src.js-DYeCa7A9.js';
+
+// ../server/src/http/request-context.ts
+/**
+* One request's identity: the acting org and the permissions held there.
+*
+* Every sign-in path builds through here (cookie, forward-auth, API token, and
+* any host app's own hook), so they can't drift on what a context contains.
+*/
+async function buildRequestContext(input, deps) {
+	const { user, platformPermissions, membership, sessionToken, pinOrg } = input;
+	let actingOrgId = membership?.orgId;
+	const orgPermissions = membership ? [...membership.permissions] : [];
+	if (!actingOrgId && !pinOrg && platformPermissions.includes("instance_admin")) {
+		const firstOrg = (await deps.orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items[0];
+		if (firstOrg) actingOrgId = firstOrg.id;
+	}
+	return {
+		userId: user.id,
+		actingOrgId,
+		platformPermissions,
+		orgPermissions,
+		adapterContext: sessionToken ? { sessionToken } : void 0
+	};
+}
+
+export { buildRequestContext as b };
+//# sourceMappingURL=request-context.js-xKh-gy0-.js.map

package/build/server/chunks/chunks/request-context.js-xKh-gy0-.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-context.js-xKh-gy0-.js","sources":["../../../../.svelte-kit/output/server/chunks/request-context.js"],"sourcesContent":["import { t as SYSTEM_CONTEXT } from \"./src.js\";\n// ../server/src/http/request-context.ts\n/**\n* One request's identity: the acting org and the permissions held there.\n*\n* Every sign-in path builds through here (cookie, forward-auth, API token, and\n* any host app's own hook), so they can't drift on what a context contains.\n*/\nasync function buildRequestContext(input, deps) {\n\tconst { user, platformPermissions, membership, sessionToken, pinOrg } = input;\n\tlet actingOrgId = membership?.orgId;\n\tconst orgPermissions = membership ? [...membership.permissions] : [];\n\tif (!actingOrgId && !pinOrg && platformPermissions.includes(\"instance_admin\")) {\n\t\tconst firstOrg = (await deps.orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items[0];\n\t\tif (firstOrg) actingOrgId = firstOrg.id;\n\t}\n\treturn {\n\t\tuserId: user.id,\n\t\tactingOrgId,\n\t\tplatformPermissions,\n\t\torgPermissions,\n\t\tadapterContext: sessionToken ? { sessionToken } : void 0\n\t};\n}\nexport { buildRequestContext as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,mBAAmB,CAAC,KAAK,EAAE,IAAI,EAAE;AAChD,CAAC,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,KAAK;AAC9E,CAAC,IAAI,WAAW,GAAG,UAAU,EAAE,KAAK;AACpC,CAAC,MAAM,cAAc,GAAG,UAAU,GAAG,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,EAAE;AACrE,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,IAAI,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE;AAChF,EAAE,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AACpF,EAAE,IAAI,QAAQ,EAAE,WAAW,GAAG,QAAQ,CAAC,EAAE;AACzC,CAAC;AACD,CAAC,OAAO;AACR,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;AACjB,EAAE,WAAW;AACb,EAAE,mBAAmB;AACrB,EAAE,cAAc;AAChB,EAAE,cAAc,EAAE,YAAY,GAAG,EAAE,YAAY,EAAE,GAAG;AACpD,EAAE;AACF;;;;"}

package/build/server/chunks/chunks/resolve.server.js-CWWEJQMp.js

@@ -0,0 +1,59 @@
+import { S as SYSTEM_CONTEXT } from './src.js-DYeCa7A9.js';
+import { p as providers, u as getDefinitionMeta, f as getProjectProvider, i as flag } from './providers.server.js-D30wnnA4.js';
+import { h as hashToken, l as looksLikeShareToken } from './token2.server.js-B9Jq4mrm.js';
+import { error } from '@sveltejs/kit';
+
+// src/lib/server/shareLinks/resolve.server.ts
+/**
+* Extracts a candidate share-link token from the request — `?token=share_…`
+* query param, or `Authorization: Bearer share_…` header. Returns the raw
+* token, or null when none present. Does NOT validate.
+*/
+function readShareToken(request, url) {
+	if (!flag("ENABLE_SHARING")) return null;
+	const q = url.searchParams.get("token");
+	if (q && looksLikeShareToken(q)) return q;
+	const auth = request.headers.get("authorization");
+	if (auth?.startsWith("Bearer ")) {
+		const candidate = auth.slice(7).trim();
+		if (looksLikeShareToken(candidate)) return candidate;
+	}
+	return null;
+}
+/**
+* Runs before user-based auth on definition-scoped routes.
+*
+* Throws only when a token is *present but invalid* (wrong definition, wrong
+* channel, expired, revoked, view-only when solve was requested) — deliberate
+* 401/403/429 responses to a misbehaving consumer. When no token is present
+* at all, returns null and the caller falls through to user-based auth.
+*/
+async function tryResolveShareToken(request, url, requestedDefinitionId, requestedChannel, opts) {
+	const raw = readShareToken(request, url);
+	if (!raw) return null;
+	const tokenHash = hashToken(raw);
+	const link = await providers.data.shareLinks.getByTokenHash(SYSTEM_CONTEXT, tokenHash);
+	if (!link) throw error(401, "Invalid or revoked share token.");
+	if (link.expiresAt && new Date(link.expiresAt).getTime() <= Date.now()) throw error(401, "Share token has expired.");
+	if (link.definitionId !== requestedDefinitionId) throw error(403, "Share token is not valid for this definition.");
+	if (link.channel !== requestedChannel) throw error(403, `Share token is for the '${link.channel}' channel only.`);
+	if (opts.requireSolve && !link.allowSolve) throw error(403, "Share token grants view-only access.");
+	const def = await getDefinitionMeta().get(SYSTEM_CONTEXT, link.definitionId);
+	if (!def) throw error(401, "Share token target no longer exists.");
+	const project = await getProjectProvider().getProject(SYSTEM_CONTEXT, def.projectId);
+	if (!project) throw error(401, "Share token target no longer exists.");
+	return {
+		link,
+		ctx: {
+			userId: `share:${link.id}`,
+			actingOrgId: project.orgId,
+			platformPermissions: [],
+			orgPermissions: [],
+			system: true,
+			shareLinkId: link.id
+		}
+	};
+}
+
+export { tryResolveShareToken as t };
+//# sourceMappingURL=resolve.server.js-CWWEJQMp.js.map

package/build/server/chunks/chunks/resolve.server.js-CWWEJQMp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.server.js-CWWEJQMp.js","sources":["../../../../.svelte-kit/output/server/chunks/resolve.server.js"],"sourcesContent":["import { t as SYSTEM_CONTEXT } from \"./src.js\";\nimport { T as providers, s as getDefinitionMeta, t as flag, v as getProjectProvider } from \"./providers.server.js\";\nimport { n as looksLikeShareToken, t as hashToken } from \"./token2.server.js\";\nimport { error } from \"@sveltejs/kit\";\n// src/lib/server/shareLinks/resolve.server.ts\n/**\n* Extracts a candidate share-link token from the request — `?token=share_…`\n* query param, or `Authorization: Bearer share_…` header. Returns the raw\n* token, or null when none present. Does NOT validate.\n*/\nfunction readShareToken(request, url) {\n\tif (!flag(\"ENABLE_SHARING\")) return null;\n\tconst q = url.searchParams.get(\"token\");\n\tif (q && looksLikeShareToken(q)) return q;\n\tconst auth = request.headers.get(\"authorization\");\n\tif (auth?.startsWith(\"Bearer \")) {\n\t\tconst candidate = auth.slice(7).trim();\n\t\tif (looksLikeShareToken(candidate)) return candidate;\n\t}\n\treturn null;\n}\n/**\n* Runs before user-based auth on definition-scoped routes.\n*\n* Throws only when a token is *present but invalid* (wrong definition, wrong\n* channel, expired, revoked, view-only when solve was requested) — deliberate\n* 401/403/429 responses to a misbehaving consumer. When no token is present\n* at all, returns null and the caller falls through to user-based auth.\n*/\nasync function tryResolveShareToken(request, url, requestedDefinitionId, requestedChannel, opts) {\n\tconst raw = readShareToken(request, url);\n\tif (!raw) return null;\n\tconst tokenHash = hashToken(raw);\n\tconst link = await providers.data.shareLinks.getByTokenHash(SYSTEM_CONTEXT, tokenHash);\n\tif (!link) throw error(401, \"Invalid or revoked share token.\");\n\tif (link.expiresAt && new Date(link.expiresAt).getTime() <= Date.now()) throw error(401, \"Share token has expired.\");\n\tif (link.definitionId !== requestedDefinitionId) throw error(403, \"Share token is not valid for this definition.\");\n\tif (link.channel !== requestedChannel) throw error(403, `Share token is for the '${link.channel}' channel only.`);\n\tif (opts.requireSolve && !link.allowSolve) throw error(403, \"Share token grants view-only access.\");\n\tconst def = await getDefinitionMeta().get(SYSTEM_CONTEXT, link.definitionId);\n\tif (!def) throw error(401, \"Share token target no longer exists.\");\n\tconst project = await getProjectProvider().getProject(SYSTEM_CONTEXT, def.projectId);\n\tif (!project) throw error(401, \"Share token target no longer exists.\");\n\treturn {\n\t\tlink,\n\t\tctx: {\n\t\t\tuserId: `share:${link.id}`,\n\t\t\tactingOrgId: project.orgId,\n\t\t\tplatformPermissions: [],\n\t\t\torgPermissions: [],\n\t\t\tsystem: true,\n\t\t\tshareLinkId: link.id\n\t\t}\n\t};\n}\nexport { tryResolveShareToken as t };\n"],"names":[],"mappings":";;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE;AACtC,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,OAAO,IAAI;AACzC,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;AACxC,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;AAC1C,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;AAClD,CAAC,IAAI,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE;AAClC,EAAE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;AACxC,EAAE,IAAI,mBAAmB,CAAC,SAAS,CAAC,EAAE,OAAO,SAAS;AACtD,CAAC;AACD,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,oBAAoB,CAAC,OAAO,EAAE,GAAG,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,IAAI,EAAE;AACjG,CAAC,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC;AACzC,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,IAAI;AACtB,CAAC,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC;AACjC,CAAC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,cAAc,EAAE,SAAS,CAAC;AACvF,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,iCAAiC,CAAC;AAC/D,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,0BAA0B,CAAC;AACrH,CAAC,IAAI,IAAI,CAAC,YAAY,KAAK,qBAAqB,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,+CAA+C,CAAC;AACnH,CAAC,IAAI,IAAI,CAAC,OAAO,KAAK,gBAAgB,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,wBAAwB,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;AAClH,CAAC,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,sCAAsC,CAAC;AACpG,CAAC,MAAM,GAAG,GAAG,MAAM,iBAAiB,EAAE,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC;AAC7E,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,sCAAsC,CAAC;AACnE,CAAC,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,GAAG,CAAC,SAAS,CAAC;AACrF,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,sCAAsC,CAAC;AACvE,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE,GAAG,EAAE;AACP,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;AAC7B,GAAG,WAAW,EAAE,OAAO,CAAC,KAAK;AAC7B,GAAG,mBAAmB,EAAE,EAAE;AAC1B,GAAG,cAAc,EAAE,EAAE;AACrB,GAAG,MAAM,EAAE,IAAI;AACf,GAAG,WAAW,EAAE,IAAI,CAAC;AACrB;AACA,EAAE;AACF;;;;"}

package/build/server/chunks/chunks/selfUpdate.server.js-BICsp7tr.js

@@ -0,0 +1,144 @@
+import { g as getLogger } from './providers.server.js-D30wnnA4.js';
+import { r as renderThrown } from './definitions.js-DNRCBvN_.js';
+import { d as deriveOutcome } from './update-outcome.js-BnQsHDn7.js';
+import { join } from 'node:path';
+import { existsSync, readFileSync, rmSync } from 'node:fs';
+
+// src/lib/server/selfUpdate.server.ts
+/**
+* Durable log/state paths for the update runner, plus post-restart
+* reconciliation of the update's outcome into the audit event log.
+*
+* The process that launches an update is killed mid-update (`pm2 stop
+* selva-compute` is a step of the update itself), so only the
+* `system.update.started` event can be emitted synchronously by the POST
+* handler. The terminal event (`finished` / `rolled_back` / `failed`) is
+* derived AFTER the app is back up: the POST persists a pending-update state
+* file next to the log, and the reconciler here polls the log until the
+* runner's `[EXIT] code=N` marker appears, classifies it via `deriveOutcome`,
+* emits the matching event, and consumes the state file. Kicked from both the
+* POST (covers the no-restart "already up to date" path) and the first request
+* after boot (covers the real update path, where the emitting process is new).
+*/
+function isDeploymentDir(dir) {
+	return existsSync(join(dir, "node_modules", "@selvajs", "selva", "package.json"));
+}
+function findDeploymentDir(env) {
+	if (env.INSTALL_DIR && isDeploymentDir(env.INSTALL_DIR)) return env.INSTALL_DIR;
+	let dir = process.cwd();
+	for (let i = 0; i < 6; i++) {
+		if (isDeploymentDir(dir)) return dir;
+		const parent = join(dir, "..");
+		if (parent === dir) break;
+		dir = parent;
+	}
+	return null;
+}
+function updateLogPath(deploymentDir) {
+	return deploymentDir ? join(deploymentDir, "selva-update.log") : "/tmp/selva-update.log";
+}
+function updateStatePath(deploymentDir) {
+	return join(deploymentDir, "selva-update-state.json");
+}
+/**
+* One reconciliation attempt. Reads the pending-update state file; if the log
+* carries the runner's terminal `[EXIT] code=N` marker, classifies the outcome,
+* emits the terminal audit event, reports rollback/failure to the error
+* tracker, and deletes the state file (exactly-once across restarts — the
+* state file is the emission token).
+*/
+async function reconcileUpdateOutcome(deps) {
+	const statePath = updateStatePath(deps.deploymentDir);
+	let state;
+	try {
+		state = JSON.parse(readFileSync(statePath, "utf8"));
+	} catch {
+		return "no_pending_update";
+	}
+	let logs = "";
+	try {
+		logs = readFileSync(updateLogPath(deps.deploymentDir), "utf8");
+	} catch {}
+	const exitMatch = /\[EXIT\] code=(\d+)/.exec(logs);
+	if (!exitMatch) return "still_running";
+	const exitCode = Number(exitMatch[1]);
+	const outcome = deriveOutcome(exitCode, logs);
+	const base = {
+		fromVersion: state.fromVersion ?? outcome.from,
+		toVersion: outcome.to,
+		actorId: state.actorId
+	};
+	let event;
+	if (outcome.severity === "critical") event = {
+		type: "system.update.failed",
+		...base,
+		detail: outcome.title
+	};
+	else if (exitCode === 5 || logs.includes("Rolled back")) event = {
+		type: "system.update.rolled_back",
+		...base,
+		detail: outcome.title
+	};
+	else if (outcome.severity === "success" || outcome.severity === "info") event = {
+		type: "system.update.finished",
+		...base
+	};
+	else event = {
+		type: "system.update.finished",
+		...base,
+		detail: outcome.title
+	};
+	await deps.emit(event);
+	if (event.type !== "system.update.finished") deps.report(/* @__PURE__ */ new Error(`[selfUpdate] ${outcome.title}`));
+	try {
+		rmSync(statePath);
+	} catch {}
+	return "reconciled";
+}
+var POLL_MS = 15e3;
+var MAX_POLLS = 80;
+var reconcilerActive = false;
+/**
+* Idempotent: safe to call on every boot and on every update POST — exits
+* immediately when no state file exists and never runs twice concurrently.
+*/
+function startUpdateOutcomeReconciler(deps) {
+	if (reconcilerActive) return;
+	if (!existsSync(updateStatePath(deps.deploymentDir))) return;
+	reconcilerActive = true;
+	let polls = 0;
+	const timer = setInterval(() => {
+		(async () => {
+			polls += 1;
+			let result;
+			try {
+				result = await reconcileUpdateOutcome(deps);
+			} catch (err) {
+				getLogger().error("Outcome reconciliation failed", {
+					component: "selfUpdate",
+					err: renderThrown(err)
+				});
+				result = "still_running";
+			}
+			if (result === "still_running" && polls < MAX_POLLS) return;
+			if (result === "still_running") try {
+				const statePath = updateStatePath(deps.deploymentDir);
+				const state = JSON.parse(readFileSync(statePath, "utf8"));
+				await deps.emit({
+					type: "system.update.failed",
+					fromVersion: state.fromVersion,
+					actorId: state.actorId,
+					detail: "No terminal marker in the update log within 20 minutes."
+				});
+				deps.report(/* @__PURE__ */ new Error("[selfUpdate] update never reached a terminal state"));
+				rmSync(statePath);
+			} catch {}
+			clearInterval(timer);
+			reconcilerActive = false;
+		})();
+	}, POLL_MS);
+	timer.unref?.();
+}
+
+export { updateStatePath as a, findDeploymentDir as f, startUpdateOutcomeReconciler as s, updateLogPath as u };
+//# sourceMappingURL=selfUpdate.server.js-BICsp7tr.js.map

package/build/server/chunks/chunks/selfUpdate.server.js-BICsp7tr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"selfUpdate.server.js-BICsp7tr.js","sources":["../../../../.svelte-kit/output/server/chunks/selfUpdate.server.js"],"sourcesContent":["import { f as getLogger } from \"./providers.server.js\";\nimport { a as renderThrown } from \"./definitions.js\";\nimport { t as deriveOutcome } from \"./update-outcome.js\";\nimport { join } from \"node:path\";\nimport { existsSync, readFileSync, rmSync } from \"node:fs\";\n// src/lib/server/selfUpdate.server.ts\n/**\n* Durable log/state paths for the update runner, plus post-restart\n* reconciliation of the update's outcome into the audit event log.\n*\n* The process that launches an update is killed mid-update (`pm2 stop\n* selva-compute` is a step of the update itself), so only the\n* `system.update.started` event can be emitted synchronously by the POST\n* handler. The terminal event (`finished` / `rolled_back` / `failed`) is\n* derived AFTER the app is back up: the POST persists a pending-update state\n* file next to the log, and the reconciler here polls the log until the\n* runner's `[EXIT] code=N` marker appears, classifies it via `deriveOutcome`,\n* emits the matching event, and consumes the state file. Kicked from both the\n* POST (covers the no-restart \"already up to date\" path) and the first request\n* after boot (covers the real update path, where the emitting process is new).\n*/\nfunction isDeploymentDir(dir) {\n\treturn existsSync(join(dir, \"node_modules\", \"@selvajs\", \"selva\", \"package.json\"));\n}\nfunction findDeploymentDir(env) {\n\tif (env.INSTALL_DIR && isDeploymentDir(env.INSTALL_DIR)) return env.INSTALL_DIR;\n\tlet dir = process.cwd();\n\tfor (let i = 0; i < 6; i++) {\n\t\tif (isDeploymentDir(dir)) return dir;\n\t\tconst parent = join(dir, \"..\");\n\t\tif (parent === dir) break;\n\t\tdir = parent;\n\t}\n\treturn null;\n}\nfunction updateLogPath(deploymentDir) {\n\treturn deploymentDir ? join(deploymentDir, \"selva-update.log\") : \"/tmp/selva-update.log\";\n}\nfunction updateStatePath(deploymentDir) {\n\treturn join(deploymentDir, \"selva-update-state.json\");\n}\n/**\n* One reconciliation attempt. Reads the pending-update state file; if the log\n* carries the runner's terminal `[EXIT] code=N` marker, classifies the outcome,\n* emits the terminal audit event, reports rollback/failure to the error\n* tracker, and deletes the state file (exactly-once across restarts — the\n* state file is the emission token).\n*/\nasync function reconcileUpdateOutcome(deps) {\n\tconst statePath = updateStatePath(deps.deploymentDir);\n\tlet state;\n\ttry {\n\t\tstate = JSON.parse(readFileSync(statePath, \"utf8\"));\n\t} catch {\n\t\treturn \"no_pending_update\";\n\t}\n\tlet logs = \"\";\n\ttry {\n\t\tlogs = readFileSync(updateLogPath(deps.deploymentDir), \"utf8\");\n\t} catch {}\n\tconst exitMatch = /\\[EXIT\\] code=(\\d+)/.exec(logs);\n\tif (!exitMatch) return \"still_running\";\n\tconst exitCode = Number(exitMatch[1]);\n\tconst outcome = deriveOutcome(exitCode, logs);\n\tconst base = {\n\t\tfromVersion: state.fromVersion ?? outcome.from,\n\t\ttoVersion: outcome.to,\n\t\tactorId: state.actorId\n\t};\n\tlet event;\n\tif (outcome.severity === \"critical\") event = {\n\t\ttype: \"system.update.failed\",\n\t\t...base,\n\t\tdetail: outcome.title\n\t};\n\telse if (exitCode === 5 || logs.includes(\"Rolled back\")) event = {\n\t\ttype: \"system.update.rolled_back\",\n\t\t...base,\n\t\tdetail: outcome.title\n\t};\n\telse if (outcome.severity === \"success\" || outcome.severity === \"info\") event = {\n\t\ttype: \"system.update.finished\",\n\t\t...base\n\t};\n\telse event = {\n\t\ttype: \"system.update.finished\",\n\t\t...base,\n\t\tdetail: outcome.title\n\t};\n\tawait deps.emit(event);\n\tif (event.type !== \"system.update.finished\") deps.report(/* @__PURE__ */ new Error(`[selfUpdate] ${outcome.title}`));\n\ttry {\n\t\trmSync(statePath);\n\t} catch {}\n\treturn \"reconciled\";\n}\nvar POLL_MS = 15e3;\nvar MAX_POLLS = 80;\nvar reconcilerActive = false;\n/**\n* Idempotent: safe to call on every boot and on every update POST — exits\n* immediately when no state file exists and never runs twice concurrently.\n*/\nfunction startUpdateOutcomeReconciler(deps) {\n\tif (reconcilerActive) return;\n\tif (!existsSync(updateStatePath(deps.deploymentDir))) return;\n\treconcilerActive = true;\n\tlet polls = 0;\n\tconst timer = setInterval(() => {\n\t\t(async () => {\n\t\t\tpolls += 1;\n\t\t\tlet result;\n\t\t\ttry {\n\t\t\t\tresult = await reconcileUpdateOutcome(deps);\n\t\t\t} catch (err) {\n\t\t\t\tgetLogger().error(\"Outcome reconciliation failed\", {\n\t\t\t\t\tcomponent: \"selfUpdate\",\n\t\t\t\t\terr: renderThrown(err)\n\t\t\t\t});\n\t\t\t\tresult = \"still_running\";\n\t\t\t}\n\t\t\tif (result === \"still_running\" && polls < MAX_POLLS) return;\n\t\t\tif (result === \"still_running\") try {\n\t\t\t\tconst statePath = updateStatePath(deps.deploymentDir);\n\t\t\t\tconst state = JSON.parse(readFileSync(statePath, \"utf8\"));\n\t\t\t\tawait deps.emit({\n\t\t\t\t\ttype: \"system.update.failed\",\n\t\t\t\t\tfromVersion: state.fromVersion,\n\t\t\t\t\tactorId: state.actorId,\n\t\t\t\t\tdetail: \"No terminal marker in the update log within 20 minutes.\"\n\t\t\t\t});\n\t\t\t\tdeps.report(/* @__PURE__ */ new Error(\"[selfUpdate] update never reached a terminal state\"));\n\t\t\t\trmSync(statePath);\n\t\t\t} catch {}\n\t\t\tclearInterval(timer);\n\t\t\treconcilerActive = false;\n\t\t})();\n\t}, POLL_MS);\n\ttimer.unref?.();\n}\nexport { updateStatePath as i, startUpdateOutcomeReconciler as n, updateLogPath as r, findDeploymentDir as t };\n"],"names":[],"mappings":";;;;;;AAKA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,eAAe,CAAC,GAAG,EAAE;AAC9B,CAAC,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;AAClF;AACA,SAAS,iBAAiB,CAAC,GAAG,EAAE;AAChC,CAAC,IAAI,GAAG,CAAC,WAAW,IAAI,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,CAAC,WAAW;AAChF,CAAC,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;AACxB,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE;AAC7B,EAAE,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG;AACtC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC;AAChC,EAAE,IAAI,MAAM,KAAK,GAAG,EAAE;AACtB,EAAE,GAAG,GAAG,MAAM;AACd,CAAC;AACD,CAAC,OAAO,IAAI;AACZ;AACA,SAAS,aAAa,CAAC,aAAa,EAAE;AACtC,CAAC,OAAO,aAAa,GAAG,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC,GAAG,uBAAuB;AACzF;AACA,SAAS,eAAe,CAAC,aAAa,EAAE;AACxC,CAAC,OAAO,IAAI,CAAC,aAAa,EAAE,yBAAyB,CAAC;AACtD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,sBAAsB,CAAC,IAAI,EAAE;AAC5C,CAAC,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC;AACtD,CAAC,IAAI,KAAK;AACV,CAAC,IAAI;AACL,EAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,mBAAmB;AAC5B,CAAC;AACD,CAAC,IAAI,IAAI,GAAG,EAAE;AACd,CAAC,IAAI;AACL,EAAE,IAAI,GAAG,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;AAChE,CAAC,CAAC,CAAC,MAAM,CAAC;AACV,CAAC,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;AACnD,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,eAAe;AACvC,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC;AAC9C,CAAC,MAAM,IAAI,GAAG;AACd,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,OAAO,CAAC,IAAI;AAChD,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE;AACvB,EAAE,OAAO,EAAE,KAAK,CAAC;AACjB,EAAE;AACF,CAAC,IAAI,KAAK;AACV,CAAC,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU,EAAE,KAAK,GAAG;AAC9C,EAAE,IAAI,EAAE,sBAAsB;AAC9B,EAAE,GAAG,IAAI;AACT,EAAE,MAAM,EAAE,OAAO,CAAC;AAClB,EAAE;AACF,MAAM,IAAI,QAAQ,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,KAAK,GAAG;AAClE,EAAE,IAAI,EAAE,2BAA2B;AACnC,EAAE,GAAG,IAAI;AACT,EAAE,MAAM,EAAE,OAAO,CAAC;AAClB,EAAE;AACF,MAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,EAAE,KAAK,GAAG;AACjF,EAAE,IAAI,EAAE,wBAAwB;AAChC,EAAE,GAAG;AACL,EAAE;AACF,MAAM,KAAK,GAAG;AACd,EAAE,IAAI,EAAE,wBAAwB;AAChC,EAAE,GAAG,IAAI;AACT,EAAE,MAAM,EAAE,OAAO,CAAC;AAClB,EAAE;AACF,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;AACvB,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,wBAAwB,EAAE,IAAI,CAAC,MAAM,iBAAiB,IAAI,KAAK,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACrH,CAAC,IAAI;AACL,EAAE,MAAM,CAAC,SAAS,CAAC;AACnB,CAAC,CAAC,CAAC,MAAM,CAAC;AACV,CAAC,OAAO,YAAY;AACpB;AACA,IAAI,OAAO,GAAG,IAAI;AAClB,IAAI,SAAS,GAAG,EAAE;AAClB,IAAI,gBAAgB,GAAG,KAAK;AAC5B;AACA;AACA;AACA;AACA,SAAS,4BAA4B,CAAC,IAAI,EAAE;AAC5C,CAAC,IAAI,gBAAgB,EAAE;AACvB,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE;AACvD,CAAC,gBAAgB,GAAG,IAAI;AACxB,CAAC,IAAI,KAAK,GAAG,CAAC;AACd,CAAC,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM;AACjC,EAAE,CAAC,YAAY;AACf,GAAG,KAAK,IAAI,CAAC;AACb,GAAG,IAAI,MAAM;AACb,GAAG,IAAI;AACP,IAAI,MAAM,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC;AAC/C,GAAG,CAAC,CAAC,OAAO,GAAG,EAAE;AACjB,IAAI,SAAS,EAAE,CAAC,KAAK,CAAC,+BAA+B,EAAE;AACvD,KAAK,SAAS,EAAE,YAAY;AAC5B,KAAK,GAAG,EAAE,YAAY,CAAC,GAAG;AAC1B,KAAK,CAAC;AACN,IAAI,MAAM,GAAG,eAAe;AAC5B,GAAG;AACH,GAAG,IAAI,MAAM,KAAK,eAAe,IAAI,KAAK,GAAG,SAAS,EAAE;AACxD,GAAG,IAAI,MAAM,KAAK,eAAe,EAAE,IAAI;AACvC,IAAI,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC;AACzD,IAAI,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AAC7D,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC;AACpB,KAAK,IAAI,EAAE,sBAAsB;AACjC,KAAK,WAAW,EAAE,KAAK,CAAC,WAAW;AACnC,KAAK,OAAO,EAAE,KAAK,CAAC,OAAO;AAC3B,KAAK,MAAM,EAAE;AACb,KAAK,CAAC;AACN,IAAI,IAAI,CAAC,MAAM,iBAAiB,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;AAChG,IAAI,MAAM,CAAC,SAAS,CAAC;AACrB,GAAG,CAAC,CAAC,MAAM,CAAC;AACZ,GAAG,aAAa,CAAC,KAAK,CAAC;AACvB,GAAG,gBAAgB,GAAG,KAAK;AAC3B,EAAE,CAAC,GAAG;AACN,CAAC,CAAC,EAAE,OAAO,CAAC;AACZ,CAAC,KAAK,CAAC,KAAK,IAAI;AAChB;;;;"}

package/build/server/chunks/chunks/server2.js-DdkspPZm.js

@@ -0,0 +1,103 @@
+import { b as private_env } from './shared-server.js-CJsQadj4.js';
+import { c as createOAuthServer, C as CODE_TTL_MS } from './oauth.js-DS-eyMD8.js';
+import { b as assertSafeRemoteDefinitionUrl, r as readBodyWithCap } from './compute.js-a66mA6Yl.js';
+import { c as createComputeRateLimiter } from './rate-limit.js-Br3luBbc.js';
+import './src.js-DYeCa7A9.js';
+import './access.js-BZIkVfZv.js';
+import { json } from '@sveltejs/kit';
+
+// src/lib/server/oauth/server.ts
+/**
+* This instance's OAuth authorization server for MCP clients. The protocol lives
+* in `@selvajs/server/oauth`; this file supplies the secret, the SSRF-guarded
+* metadata fetch and the per-IP limit the endpoints share.
+*/
+var METADATA_TIMEOUT_MS = 5e3;
+var METADATA_MAX_BYTES = 65536;
+var cached = null;
+var redeemedCodes = /* @__PURE__ */ new Map();
+var ABANDON_AFTER_MS = CODE_TTL_MS + 6e4;
+var unredeemed = /* @__PURE__ */ new Map();
+/** Revoke `tokenId` with `revoke` unless its code is redeemed in time. */
+function expectRedemption(tokenId, revoke) {
+	const timer = setTimeout(() => {
+		unredeemed.delete(tokenId);
+		revoke().catch(() => {});
+	}, ABANDON_AFTER_MS);
+	timer.unref?.();
+	unredeemed.set(tokenId, timer);
+}
+function onRedeemed(tokenId) {
+	clearTimeout(unredeemed.get(tokenId));
+	unredeemed.delete(tokenId);
+}
+/** Whether `oauthServer` would build one, without building it. */
+function oauthConfigured() {
+	const secret = private_env.SELVA_HMAC_KEY;
+	return Boolean(secret && secret.length >= 32);
+}
+/** Undefined without a usable SELVA_HMAC_KEY: the endpoints then answer 503. */
+function oauthServer(origin) {
+	if (!oauthConfigured()) return void 0;
+	const secret = private_env.SELVA_HMAC_KEY;
+	if (cached?.origin !== origin || cached.secret !== secret) cached = {
+		origin,
+		secret,
+		server: createOAuthServer({
+			origin,
+			secret,
+			fetchClientMetadata,
+			redeemedCodes,
+			onRedeemed
+		})
+	};
+	return cached.server;
+}
+/** The URL is an unknown client's, so it goes through the same guard as remote definitions. */
+async function fetchClientMetadata(url) {
+	await assertSafeRemoteDefinitionUrl(url);
+	const controller = new AbortController();
+	const timer = setTimeout(() => controller.abort(), METADATA_TIMEOUT_MS);
+	try {
+		const res = await fetch(url, {
+			headers: { Accept: "application/json" },
+			redirect: "error",
+			signal: controller.signal
+		});
+		if (!res.ok) throw new Error(`HTTP ${res.status}`);
+		const bytes = await readBodyWithCap(res, METADATA_MAX_BYTES, controller);
+		return JSON.parse(new TextDecoder().decode(bytes));
+	} finally {
+		clearTimeout(timer);
+	}
+}
+var limiter = createComputeRateLimiter({
+	windowMs: 6e4,
+	maxPerWindow: 30
+});
+/** A 429 response when the caller's IP is over the limit, else undefined. */
+function oauthRateLimited(event) {
+	const verdict = limiter.check(`oauth:${event.getClientAddress()}`);
+	if (verdict.allowed) return void 0;
+	return json({
+		error: "slow_down",
+		error_description: "Too many requests. Try again shortly."
+	}, {
+		status: 429,
+		headers: { "Retry-After": String(verdict.retryAfter ?? 60) }
+	});
+}
+function oauthUnavailable() {
+	return json({
+		error: "temporarily_unavailable",
+		error_description: "OAuth is not configured here."
+	}, { status: 503 });
+}
+/** Discovery documents are read by browser-based clients too. */
+var DISCOVERY_HEADERS = {
+	"Access-Control-Allow-Origin": "*",
+	"Cache-Control": "public, max-age=3600"
+};
+
+export { DISCOVERY_HEADERS as D, oauthServer as a, oauthRateLimited as b, oauthUnavailable as c, expectRedemption as e, oauthConfigured as o };
+//# sourceMappingURL=server2.js-DdkspPZm.js.map

package/build/server/chunks/chunks/server2.js-DdkspPZm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server2.js-DdkspPZm.js","sources":["../../../../.svelte-kit/output/server/chunks/server2.js"],"sourcesContent":["import { t as private_env } from \"./shared-server.js\";\nimport { s as createOAuthServer, t as CODE_TTL_MS } from \"./oauth.js\";\nimport { o as readBodyWithCap, s as assertSafeRemoteDefinitionUrl } from \"./compute.js\";\nimport { t as createComputeRateLimiter } from \"./rate-limit.js\";\nimport \"./tokens.js\";\nimport { json } from \"@sveltejs/kit\";\n// src/lib/server/oauth/server.ts\n/**\n* This instance's OAuth authorization server for MCP clients. The protocol lives\n* in `@selvajs/server/oauth`; this file supplies the secret, the SSRF-guarded\n* metadata fetch and the per-IP limit the endpoints share.\n*/\nvar METADATA_TIMEOUT_MS = 5e3;\nvar METADATA_MAX_BYTES = 65536;\nvar cached = null;\nvar redeemedCodes = /* @__PURE__ */ new Map();\nvar ABANDON_AFTER_MS = CODE_TTL_MS + 6e4;\nvar unredeemed = /* @__PURE__ */ new Map();\n/** Revoke `tokenId` with `revoke` unless its code is redeemed in time. */\nfunction expectRedemption(tokenId, revoke) {\n\tconst timer = setTimeout(() => {\n\t\tunredeemed.delete(tokenId);\n\t\trevoke().catch(() => {});\n\t}, ABANDON_AFTER_MS);\n\ttimer.unref?.();\n\tunredeemed.set(tokenId, timer);\n}\nfunction onRedeemed(tokenId) {\n\tclearTimeout(unredeemed.get(tokenId));\n\tunredeemed.delete(tokenId);\n}\n/** Whether `oauthServer` would build one, without building it. */\nfunction oauthConfigured() {\n\tconst secret = private_env.SELVA_HMAC_KEY;\n\treturn Boolean(secret && secret.length >= 32);\n}\n/** Undefined without a usable SELVA_HMAC_KEY: the endpoints then answer 503. */\nfunction oauthServer(origin) {\n\tif (!oauthConfigured()) return void 0;\n\tconst secret = private_env.SELVA_HMAC_KEY;\n\tif (cached?.origin !== origin || cached.secret !== secret) cached = {\n\t\torigin,\n\t\tsecret,\n\t\tserver: createOAuthServer({\n\t\t\torigin,\n\t\t\tsecret,\n\t\t\tfetchClientMetadata,\n\t\t\tredeemedCodes,\n\t\t\tonRedeemed\n\t\t})\n\t};\n\treturn cached.server;\n}\n/** The URL is an unknown client's, so it goes through the same guard as remote definitions. */\nasync function fetchClientMetadata(url) {\n\tawait assertSafeRemoteDefinitionUrl(url);\n\tconst controller = new AbortController();\n\tconst timer = setTimeout(() => controller.abort(), METADATA_TIMEOUT_MS);\n\ttry {\n\t\tconst res = await fetch(url, {\n\t\t\theaders: { Accept: \"application/json\" },\n\t\t\tredirect: \"error\",\n\t\t\tsignal: controller.signal\n\t\t});\n\t\tif (!res.ok) throw new Error(`HTTP ${res.status}`);\n\t\tconst bytes = await readBodyWithCap(res, METADATA_MAX_BYTES, controller);\n\t\treturn JSON.parse(new TextDecoder().decode(bytes));\n\t} finally {\n\t\tclearTimeout(timer);\n\t}\n}\nvar limiter = createComputeRateLimiter({\n\twindowMs: 6e4,\n\tmaxPerWindow: 30\n});\n/** A 429 response when the caller's IP is over the limit, else undefined. */\nfunction oauthRateLimited(event) {\n\tconst verdict = limiter.check(`oauth:${event.getClientAddress()}`);\n\tif (verdict.allowed) return void 0;\n\treturn json({\n\t\terror: \"slow_down\",\n\t\terror_description: \"Too many requests. Try again shortly.\"\n\t}, {\n\t\tstatus: 429,\n\t\theaders: { \"Retry-After\": String(verdict.retryAfter ?? 60) }\n\t});\n}\nfunction oauthUnavailable() {\n\treturn json({\n\t\terror: \"temporarily_unavailable\",\n\t\terror_description: \"OAuth is not configured here.\"\n\t}, { status: 503 });\n}\n/** Discovery documents are read by browser-based clients too. */\nvar DISCOVERY_HEADERS = {\n\t\"Access-Control-Allow-Origin\": \"*\",\n\t\"Cache-Control\": \"public, max-age=3600\"\n};\nexport { oauthServer as a, oauthRateLimited as i, expectRedemption as n, oauthUnavailable as o, oauthConfigured as r, DISCOVERY_HEADERS as t };\n"],"names":[],"mappings":";;;;;;;;AAMA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,mBAAmB,GAAG,GAAG;AAC7B,IAAI,kBAAkB,GAAG,KAAK;AAC9B,IAAI,MAAM,GAAG,IAAI;AACjB,IAAI,aAAa,mBAAmB,IAAI,GAAG,EAAE;AAC7C,IAAI,gBAAgB,GAAG,WAAW,GAAG,GAAG;AACxC,IAAI,UAAU,mBAAmB,IAAI,GAAG,EAAE;AAC1C;AACA,SAAS,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE;AAC3C,CAAC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM;AAChC,EAAE,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;AAC5B,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;AAC1B,CAAC,CAAC,EAAE,gBAAgB,CAAC;AACrB,CAAC,KAAK,CAAC,KAAK,IAAI;AAChB,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC;AAC/B;AACA,SAAS,UAAU,CAAC,OAAO,EAAE;AAC7B,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;AAC3B;AACA;AACA,SAAS,eAAe,GAAG;AAC3B,CAAC,MAAM,MAAM,GAAG,WAAW,CAAC,cAAc;AAC1C,CAAC,OAAO,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;AAC9C;AACA;AACA,SAAS,WAAW,CAAC,MAAM,EAAE;AAC7B,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,OAAO,MAAM;AACtC,CAAC,MAAM,MAAM,GAAG,WAAW,CAAC,cAAc;AAC1C,CAAC,IAAI,MAAM,EAAE,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,MAAM,GAAG;AACrE,EAAE,MAAM;AACR,EAAE,MAAM;AACR,EAAE,MAAM,EAAE,iBAAiB,CAAC;AAC5B,GAAG,MAAM;AACT,GAAG,MAAM;AACT,GAAG,mBAAmB;AACtB,GAAG,aAAa;AAChB,GAAG;AACH,GAAG;AACH,EAAE;AACF,CAAC,OAAO,MAAM,CAAC,MAAM;AACrB;AACA;AACA,eAAe,mBAAmB,CAAC,GAAG,EAAE;AACxC,CAAC,MAAM,6BAA6B,CAAC,GAAG,CAAC;AACzC,CAAC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE;AACzC,CAAC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,UAAU,CAAC,KAAK,EAAE,EAAE,mBAAmB,CAAC;AACxE,CAAC,IAAI;AACL,EAAE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;AAC/B,GAAG,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;AAC1C,GAAG,QAAQ,EAAE,OAAO;AACpB,GAAG,MAAM,EAAE,UAAU,CAAC;AACtB,GAAG,CAAC;AACJ,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AACpD,EAAE,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,kBAAkB,EAAE,UAAU,CAAC;AAC1E,EAAE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC,CAAC,SAAS;AACX,EAAE,YAAY,CAAC,KAAK,CAAC;AACrB,CAAC;AACD;AACA,IAAI,OAAO,GAAG,wBAAwB,CAAC;AACvC,CAAC,QAAQ,EAAE,GAAG;AACd,CAAC,YAAY,EAAE;AACf,CAAC,CAAC;AACF;AACA,SAAS,gBAAgB,CAAC,KAAK,EAAE;AACjC,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;AACnE,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,OAAO,MAAM;AACnC,CAAC,OAAO,IAAI,CAAC;AACb,EAAE,KAAK,EAAE,WAAW;AACpB,EAAE,iBAAiB,EAAE;AACrB,EAAE,EAAE;AACJ,EAAE,MAAM,EAAE,GAAG;AACb,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;AAC5D,EAAE,CAAC;AACH;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,OAAO,IAAI,CAAC;AACb,EAAE,KAAK,EAAE,yBAAyB;AAClC,EAAE,iBAAiB,EAAE;AACrB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AACpB;AACA;AACG,IAAC,iBAAiB,GAAG;AACxB,CAAC,6BAA6B,EAAE,GAAG;AACnC,CAAC,eAAe,EAAE;AAClB;;;;"}