@selvajs/selva 4.20.0-beta.14 → 4.20.0-beta.15

package/build/server/chunks/chunks/oauth.js-WZFWOYa1.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth.js-WZFWOYa1.js","sources":["../../../../.svelte-kit/output/server/chunks/oauth.js"],"sourcesContent":["import { createCipheriv, createDecipheriv, createHash, createHmac, hkdfSync, randomBytes, timingSafeEqual } from \"node:crypto\";\n// ../server/src/oauth/index.ts\n/**\n* OAuth 2.1 for MCP clients and the Grasshopper plugin, with this instance as\n* its own authorization server.\n*\n* The access token is an ordinary API token. The host mints it while the user is\n* signed in, at consent, through the same path as Team → API tokens; this\n* module seals the raw key into the authorization code and hands it over at the\n* token endpoint. So `/mcp` and `/api/v1` keep one credential type.\n*\n* Nothing here is stored. A registered client's id is its own signed metadata,\n* and a code is its own encrypted grant, bound to the issuing origin. The only\n* state is the set of redeemed codes, in the host's memory, so on several\n* replicas a code could be redeemed once per replica within its minute, and only\n* by whoever holds the PKCE verifier.\n*/\n/** The scopes a grant can carry. Each maps to one org-wide API scope. */\nvar OAUTH_SCOPES = [\n\t\"read\",\n\t\"solve\",\n\t\"upload\"\n];\n/**\n* All a registered (DCR or CIMD) client can be granted. Its name and redirects\n* are whatever the registrant chose, so `upload`, which puts code on the org's\n* Compute server, stays with the built-in client and a look-alike can't phish for it.\n*/\nvar REGISTERED_CLIENT_SCOPES = [\"read\", \"solve\"];\nvar GRASSHOPPER_CLIENT = {\n\tclientId: \"selva-grasshopper\",\n\tname: \"Selva for Grasshopper\",\n\tredirectUris: [\"http://127.0.0.1/callback\"],\n\tbuiltIn: true,\n\tscopes: [\"read\", \"upload\"]\n};\nvar MCP_PATH = \"/mcp\";\nvar CODE_TTL_MS = 6e4;\nvar CLIENT_NAME_MAX = 100;\nvar REDIRECT_URIS_MAX = 10;\nvar CIMD_TTL_MS = 36e5;\nvar CIMD_FAILURE_TTL_MS = 6e4;\nvar CIMD_CACHE_MAX = 500;\nvar LOOPBACK_HOSTS = /* @__PURE__ */ new Set([\n\t\"localhost\",\n\t\"127.0.0.1\",\n\t\"[::1]\"\n]);\nvar OAuthError = class extends Error {\n\terror;\n\tstatus;\n\tconstructor(error, description, status = 400) {\n\t\tsuper(description);\n\t\tthis.error = error;\n\t\tthis.status = status;\n\t\tthis.name = \"OAuthError\";\n\t}\n\ttoBody() {\n\t\treturn {\n\t\t\terror: this.error,\n\t\t\terror_description: this.message\n\t\t};\n\t}\n};\nfunction mcpResourceUrl(origin) {\n\treturn origin + MCP_PATH;\n}\nfunction resourceMetadataUrl(origin) {\n\treturn `${origin}/.well-known/oauth-protected-resource${MCP_PATH}`;\n}\n/** RFC 9728. Claude uses only the first authorization server. */\nfunction protectedResourceMetadata(origin) {\n\treturn {\n\t\tresource: mcpResourceUrl(origin),\n\t\tauthorization_servers: [origin],\n\t\tscopes_supported: [...REGISTERED_CLIENT_SCOPES],\n\t\tbearer_methods_supported: [\"header\"]\n\t};\n}\n/**\n* RFC 8414. Claude picks Client ID Metadata Documents only when both\n* `client_id_metadata_document_supported` and the `none` auth method appear.\n*/\nfunction authorizationServerMetadata(origin) {\n\treturn {\n\t\tissuer: origin,\n\t\tauthorization_endpoint: `${origin}/oauth/authorize`,\n\t\ttoken_endpoint: `${origin}/oauth/token`,\n\t\tregistration_endpoint: `${origin}/oauth/register`,\n\t\tresponse_types_supported: [\"code\"],\n\t\tgrant_types_supported: [\"authorization_code\"],\n\t\tcode_challenge_methods_supported: [\"S256\"],\n\t\ttoken_endpoint_auth_methods_supported: [\"none\"],\n\t\tscopes_supported: [...OAUTH_SCOPES],\n\t\tclient_id_metadata_document_supported: true,\n\t\tauthorization_response_iss_parameter_supported: true\n\t};\n}\nfunction createOAuthServer(options) {\n\tconst { origin } = options;\n\tconst now = options.now ?? Date.now;\n\tconst signKey = derive(options.secret, \"selva-oauth-client\");\n\tconst codeKey = derive(options.secret, `selva-oauth-code:${origin}`);\n\tconst redeemed = options.redeemedCodes ?? /* @__PURE__ */ new Map();\n\tconst metadataCache = /* @__PURE__ */ new Map();\n\t/** RFC 7591. The client id carries the metadata, signed, so nothing is stored. */\n\tfunction register(input) {\n\t\ttry {\n\t\t\tconst meta = input ?? {};\n\t\t\tconst redirectUris = checkRedirectUris(meta.redirect_uris);\n\t\t\tconst name = typeof meta.client_name === \"string\" ? meta.client_name.trim() : \"\";\n\t\t\tconst payload = b64(JSON.stringify({\n\t\t\t\tn: name.slice(0, CLIENT_NAME_MAX),\n\t\t\t\tr: redirectUris,\n\t\t\t\tt: now()\n\t\t\t}));\n\t\t\treturn {\n\t\t\t\tstatus: 201,\n\t\t\t\tbody: {\n\t\t\t\t\tclient_id: `dcr_${payload}.${sign$1(signKey, payload)}`,\n\t\t\t\t\tclient_id_issued_at: Math.floor(now() / 1e3),\n\t\t\t\t\tclient_name: name || void 0,\n\t\t\t\t\tredirect_uris: redirectUris,\n\t\t\t\t\tgrant_types: [\"authorization_code\"],\n\t\t\t\t\tresponse_types: [\"code\"],\n\t\t\t\t\ttoken_endpoint_auth_method: \"none\"\n\t\t\t\t}\n\t\t\t};\n\t\t} catch (err) {\n\t\t\tif (err instanceof OAuthError) return {\n\t\t\t\tstatus: err.status,\n\t\t\t\tbody: err.toBody()\n\t\t\t};\n\t\t\tthrow err;\n\t\t}\n\t}\n\tasync function resolveClient(clientId) {\n\t\tif (clientId === \"selva-grasshopper\") return GRASSHOPPER_CLIENT;\n\t\tif (clientId.startsWith(\"dcr_\")) return registeredClient(clientId);\n\t\tif (clientId.startsWith(\"https://\")) return metadataClient(clientId);\n\t\tthrow new OAuthError(\"invalid_client\", \"Unknown client.\");\n\t}\n\tfunction registeredClient(clientId) {\n\t\tconst [payload, signature] = clientId.slice(4).split(\".\");\n\t\tif (!payload || !signature || !safeEqual(signature, sign$1(signKey, payload))) throw new OAuthError(\"invalid_client\", \"Unknown client.\");\n\t\tconst meta = JSON.parse(unb64(payload));\n\t\treturn {\n\t\t\tclientId,\n\t\t\tname: meta.n || \"An MCP client\",\n\t\t\tredirectUris: meta.r,\n\t\t\tbuiltIn: false,\n\t\t\tscopes: REGISTERED_CLIENT_SCOPES\n\t\t};\n\t}\n\tasync function metadataClient(url) {\n\t\tconst cached = metadataCache.get(url);\n\t\tif (cached) {\n\t\t\tif (\"client\" in cached && now() - cached.at < CIMD_TTL_MS) return cached.client;\n\t\t\tif (\"failure\" in cached && now() - cached.at < CIMD_FAILURE_TTL_MS) throw cached.failure;\n\t\t}\n\t\tif (!options.fetchClientMetadata) throw new OAuthError(\"invalid_client\", \"This server does not accept URL client ids.\");\n\t\ttry {\n\t\t\tconst client = await readMetadata(url, options.fetchClientMetadata);\n\t\t\tremember(url, {\n\t\t\t\tat: now(),\n\t\t\t\tclient\n\t\t\t});\n\t\t\treturn client;\n\t\t} catch (err) {\n\t\t\tif (!(err instanceof OAuthError)) throw err;\n\t\t\tremember(url, {\n\t\t\t\tat: now(),\n\t\t\t\tfailure: err\n\t\t\t});\n\t\t\tthrow err;\n\t\t}\n\t}\n\tfunction remember(url, entry) {\n\t\tif (metadataCache.size >= CIMD_CACHE_MAX) metadataCache.delete(metadataCache.keys().next().value);\n\t\tmetadataCache.set(url, entry);\n\t}\n\t/**\n\t* Validates the query `/oauth/authorize` arrives with. An `OAuthError` from a\n\t* bad client or redirect URI must be shown, not redirected: the redirect target\n\t* is exactly what can't be trusted.\n\t*/\n\tasync function parseAuthorizeRequest(query) {\n\t\tconst client = await resolveClient(query.get(\"client_id\") ?? \"\");\n\t\tconst redirectUri = query.get(\"redirect_uri\") ?? \"\";\n\t\tif (!client.redirectUris.some((r) => redirectMatches(r, redirectUri))) throw new OAuthError(\"invalid_request\", \"The redirect URI is not registered for this client.\");\n\t\tif (query.get(\"response_type\") !== \"code\") throw new OAuthError(\"unsupported_response_type\", \"Only response_type=code is supported.\");\n\t\tconst codeChallenge = query.get(\"code_challenge\") ?? \"\";\n\t\tif (!codeChallenge || query.get(\"code_challenge_method\") !== \"S256\") throw new OAuthError(\"invalid_request\", \"PKCE with code_challenge_method=S256 is required.\");\n\t\tconst resource = query.get(\"resource\") ?? mcpResourceUrl(origin);\n\t\tif (!isThisResource(resource)) throw new OAuthError(\"invalid_target\", \"The resource is not this server.\");\n\t\treturn {\n\t\t\tclient,\n\t\t\tredirectUri,\n\t\t\tstate: query.get(\"state\") ?? void 0,\n\t\t\tcodeChallenge,\n\t\t\tscopes: parseScopes(query.get(\"scope\"), client.scopes),\n\t\t\tresource\n\t\t};\n\t}\n\t/** Where to send the browser after consent: the client's redirect URI with a code. */\n\tfunction approve(request, grant) {\n\t\tconst code = seal(codeKey, {\n\t\t\tc: request.client.clientId,\n\t\t\tr: request.redirectUri,\n\t\t\tp: request.codeChallenge,\n\t\t\tx: now() + CODE_TTL_MS,\n\t\t\tg: grant\n\t\t});\n\t\treturn withParams(request.redirectUri, {\n\t\t\tcode,\n\t\t\tstate: request.state,\n\t\t\tiss: origin\n\t\t});\n\t}\n\tfunction deny(request) {\n\t\treturn withParams(request.redirectUri, {\n\t\t\terror: \"access_denied\",\n\t\t\tstate: request.state,\n\t\t\tiss: origin\n\t\t});\n\t}\n\tfunction exchange(form) {\n\t\ttry {\n\t\t\tif (form.get(\"grant_type\") !== \"authorization_code\") throw new OAuthError(\"unsupported_grant_type\", \"Only authorization_code is supported.\");\n\t\t\tconst code = form.get(\"code\") ?? \"\";\n\t\t\tconst sealed = open(codeKey, code);\n\t\t\tif (!sealed || sealed.x < now()) throw new OAuthError(\"invalid_grant\", \"The code is invalid or expired.\");\n\t\t\tif (sealed.c !== form.get(\"client_id\") || sealed.r !== form.get(\"redirect_uri\")) throw new OAuthError(\"invalid_grant\", \"The code was issued to another client.\");\n\t\t\tconst verifier = form.get(\"code_verifier\") ?? \"\";\n\t\t\tif (!safeEqual(createHash(\"sha256\").update(verifier).digest(\"base64url\"), sealed.p)) throw new OAuthError(\"invalid_grant\", \"The code_verifier does not match.\");\n\t\t\tconst resource = form.get(\"resource\");\n\t\t\tif (resource !== null && !isThisResource(resource)) throw new OAuthError(\"invalid_target\", \"The resource is not this server.\");\n\t\t\tif (!markRedeemed(code, sealed.x)) throw new OAuthError(\"invalid_grant\", \"The code was already used.\");\n\t\t\tconst { g } = sealed;\n\t\t\toptions.onRedeemed?.(g.tokenId);\n\t\t\treturn {\n\t\t\t\tstatus: 200,\n\t\t\t\tbody: {\n\t\t\t\t\taccess_token: g.secret,\n\t\t\t\t\ttoken_type: \"Bearer\",\n\t\t\t\t\texpires_in: Math.max(0, Math.floor((Date.parse(g.expiresAt) - now()) / 1e3)),\n\t\t\t\t\tscope: g.scopes.join(\" \")\n\t\t\t\t}\n\t\t\t};\n\t\t} catch (err) {\n\t\t\tif (err instanceof OAuthError) return {\n\t\t\t\tstatus: err.status,\n\t\t\t\tbody: err.toBody()\n\t\t\t};\n\t\t\tthrow err;\n\t\t}\n\t}\n\tfunction markRedeemed(code, expiresAt) {\n\t\tconst t = now();\n\t\tfor (const [k, x] of redeemed) if (x < t) redeemed.delete(k);\n\t\tconst id = createHash(\"sha256\").update(code).digest(\"base64url\");\n\t\tif (redeemed.has(id)) return false;\n\t\tredeemed.set(id, expiresAt);\n\t\treturn true;\n\t}\n\tfunction isThisResource(resource) {\n\t\tconst r = resource.replace(/\\/$/, \"\");\n\t\treturn r === origin || r === mcpResourceUrl(origin);\n\t}\n\treturn {\n\t\tregister,\n\t\tresolveClient,\n\t\tparseAuthorizeRequest,\n\t\tapprove,\n\t\tdeny,\n\t\texchange,\n\t\tprotectedResourceMetadata: () => protectedResourceMetadata(origin),\n\t\tauthorizationServerMetadata: () => authorizationServerMetadata(origin)\n\t};\n}\n/** OAuth scopes to the API scopes a minted token gets. */\nfunction apiScopesFor(scopes) {\n\treturn scopes.map((s) => `${s}:all`);\n}\nasync function readMetadata(url, fetchClientMetadata) {\n\tlet doc;\n\ttry {\n\t\tdoc = await fetchClientMetadata(url);\n\t} catch {\n\t\tthrow new OAuthError(\"invalid_client\", \"The client metadata document could not be read.\");\n\t}\n\tif (doc?.client_id !== url) throw new OAuthError(\"invalid_client\", \"The metadata document names a different client_id.\");\n\treturn {\n\t\tclientId: url,\n\t\tname: typeof doc.client_name === \"string\" && doc.client_name.trim() ? doc.client_name.trim().slice(0, CLIENT_NAME_MAX) : new URL(url).host,\n\t\tredirectUris: checkRedirectUris(doc.redirect_uris),\n\t\tbuiltIn: false,\n\t\tscopes: REGISTERED_CLIENT_SCOPES\n\t};\n}\n/**\n* What the request asks for, within what its client may have. A scope outside\n* that is dropped, not refused, so a client that asks for every advertised\n* scope still signs in with what it may have. Asking for none of them means all\n* of them. `read` rides along with `solve`, which the consent page offers as\n* \"read and run solves\".\n*/\nfunction parseScopes(raw, allowed) {\n\tconst asked = (raw ?? \"\").split(\" \").filter((s) => allowed.includes(s));\n\tif (!asked.length) return [...allowed];\n\treturn allowed.filter((s) => asked.includes(s) || s === \"read\" && asked.includes(\"solve\"));\n}\n/**\n* The access levels a consent page offers for a request, narrowest first. The\n* user may narrow what the client asked for, never widen it. An upload request\n* is offered as asked: narrowing it to read would leave the client unable to\n* do the one thing it signed in for.\n*/\nfunction consentChoices(scopes) {\n\tif (scopes.includes(\"upload\")) return [{\n\t\taccess: \"upload\",\n\t\tscopes: [...scopes]\n\t}];\n\tconst choices = [{\n\t\taccess: \"read\",\n\t\tscopes: [\"read\"]\n\t}];\n\tif (scopes.includes(\"solve\")) choices.push({\n\t\taccess: \"solve\",\n\t\tscopes: [...scopes]\n\t});\n\treturn choices;\n}\nfunction checkRedirectUris(value) {\n\tif (!Array.isArray(value) || !value.length || value.length > REDIRECT_URIS_MAX) throw new OAuthError(\"invalid_redirect_uri\", \"Give between 1 and 10 redirect_uris.\");\n\tfor (const uri of value) if (typeof uri !== \"string\" || !isAllowedRedirect(uri)) throw new OAuthError(\"invalid_redirect_uri\", \"Redirect URIs must be https, or http on a loopback address.\");\n\treturn value;\n}\nfunction isAllowedRedirect(uri) {\n\tlet url;\n\ttry {\n\t\turl = new URL(uri);\n\t} catch {\n\t\treturn false;\n\t}\n\tif (url.hash) return false;\n\treturn url.protocol === \"https:\" || url.protocol === \"http:\" && LOOPBACK_HOSTS.has(url.hostname);\n}\n/** A redirect to a program on the user's own machine, which any local process can claim. */\nfunction isLoopbackRedirect(uri) {\n\ttry {\n\t\treturn LOOPBACK_HOSTS.has(new URL(uri).hostname);\n\t} catch {\n\t\treturn false;\n\t}\n}\n/** Exact, except a loopback redirect matches on any port (RFC 8252 §7.3). */\nfunction redirectMatches(registered, requested) {\n\tif (registered === requested) return true;\n\tlet a, b;\n\ttry {\n\t\ta = new URL(registered);\n\t\tb = new URL(requested);\n\t} catch {\n\t\treturn false;\n\t}\n\treturn a.protocol === \"http:\" && b.protocol === \"http:\" && LOOPBACK_HOSTS.has(a.hostname) && a.hostname === b.hostname && a.pathname === b.pathname && a.search === b.search && !b.hash && !b.username && !b.password;\n}\nfunction withParams(uri, params) {\n\tconst url = new URL(uri);\n\tfor (const [k, v] of Object.entries(params)) if (v !== void 0) url.searchParams.set(k, v);\n\treturn url.toString();\n}\nfunction derive(secret, info) {\n\treturn Buffer.from(hkdfSync(\"sha256\", secret, \"\", info, 32));\n}\nfunction sign$1(key, data) {\n\treturn createHmac(\"sha256\", key).update(data).digest(\"base64url\");\n}\nfunction seal(key, value) {\n\tconst iv = randomBytes(12);\n\tconst cipher = createCipheriv(\"aes-256-gcm\", key, iv);\n\tconst body = Buffer.concat([cipher.update(JSON.stringify(value)), cipher.final()]);\n\treturn Buffer.concat([\n\t\tiv,\n\t\tcipher.getAuthTag(),\n\t\tbody\n\t]).toString(\"base64url\");\n}\nfunction open(key, sealed) {\n\ttry {\n\t\tconst raw = Buffer.from(sealed, \"base64url\");\n\t\tconst decipher = createDecipheriv(\"aes-256-gcm\", key, raw.subarray(0, 12), { authTagLength: 16 });\n\t\tdecipher.setAuthTag(raw.subarray(12, 28));\n\t\tconst body = Buffer.concat([decipher.update(raw.subarray(28)), decipher.final()]);\n\t\treturn JSON.parse(body.toString(\"utf8\"));\n\t} catch {\n\t\treturn null;\n\t}\n}\nfunction b64(text) {\n\treturn Buffer.from(text).toString(\"base64url\");\n}\nfunction unb64(text) {\n\treturn Buffer.from(text, \"base64url\").toString(\"utf8\");\n}\nfunction safeEqual(a, b) {\n\tconst x = Buffer.from(a);\n\tconst y = Buffer.from(b);\n\treturn x.length === y.length && timingSafeEqual(x, y);\n}\nexport { authorizationServerMetadata as a, isLoopbackRedirect as c, apiScopesFor as i, protectedResourceMetadata as l, OAuthError as n, consentChoices as o, REGISTERED_CLIENT_SCOPES as r, createOAuthServer as s, CODE_TTL_MS as t, resourceMetadataUrl as u };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,YAAY,GAAG;AACnB,CAAC,MAAM;AACP,CAAC,OAAO;AACR,CAAC;AACD,CAAC;AACD;AACA;AACA;AACA;AACA;AACG,IAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE,OAAO;AAC/C,IAAI,kBAAkB,GAAG;AACzB,CAAC,QAAQ,EAAE,mBAAmB;AAC9B,CAAC,IAAI,EAAE,uBAAuB;AAC9B,CAAC,YAAY,EAAE,CAAC,2BAA2B,CAAC;AAC5C,CAAC,OAAO,EAAE,IAAI;AACd,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ;AAC1B,CAAC;AACD,IAAI,QAAQ,GAAG,MAAM;AAClB,IAAC,WAAW,GAAG;AAClB,IAAI,eAAe,GAAG,GAAG;AACzB,IAAI,iBAAiB,GAAG,EAAE;AAC1B,IAAI,WAAW,GAAG,IAAI;AACtB,IAAI,mBAAmB,GAAG,GAAG;AAC7B,IAAI,cAAc,GAAG,GAAG;AACxB,IAAI,cAAc,mBAAmB,IAAI,GAAG,CAAC;AAC7C,CAAC,WAAW;AACZ,CAAC,WAAW;AACZ,CAAC;AACD,CAAC,CAAC;AACC,IAAC,UAAU,GAAG,cAAc,KAAK,CAAC;AACrC,CAAC,KAAK;AACN,CAAC,MAAM;AACP,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,GAAG,GAAG,EAAE;AAC/C,EAAE,KAAK,CAAC,WAAW,CAAC;AACpB,EAAE,IAAI,CAAC,KAAK,GAAG,KAAK;AACpB,EAAE,IAAI,CAAC,MAAM,GAAG,MAAM;AACtB,EAAE,IAAI,CAAC,IAAI,GAAG,YAAY;AAC1B,CAAC;AACD,CAAC,MAAM,GAAG;AACV,EAAE,OAAO;AACT,GAAG,KAAK,EAAE,IAAI,CAAC,KAAK;AACpB,GAAG,iBAAiB,EAAE,IAAI,CAAC;AAC3B,GAAG;AACH,CAAC;AACD;AACA,SAAS,cAAc,CAAC,MAAM,EAAE;AAChC,CAAC,OAAO,MAAM,GAAG,QAAQ;AACzB;AACA,SAAS,mBAAmB,CAAC,MAAM,EAAE;AACrC,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,qCAAqC,EAAE,QAAQ,CAAC,CAAC;AACnE;AACA;AACA,SAAS,yBAAyB,CAAC,MAAM,EAAE;AAC3C,CAAC,OAAO;AACR,EAAE,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC;AAClC,EAAE,qBAAqB,EAAE,CAAC,MAAM,CAAC;AACjC,EAAE,gBAAgB,EAAE,CAAC,GAAG,wBAAwB,CAAC;AACjD,EAAE,wBAAwB,EAAE,CAAC,QAAQ;AACrC,EAAE;AACF;AACA;AACA;AACA;AACA;AACA,SAAS,2BAA2B,CAAC,MAAM,EAAE;AAC7C,CAAC,OAAO;AACR,EAAE,MAAM,EAAE,MAAM;AAChB,EAAE,sBAAsB,EAAE,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC;AACrD,EAAE,cAAc,EAAE,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC;AACzC,EAAE,qBAAqB,EAAE,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC;AACnD,EAAE,wBAAwB,EAAE,CAAC,MAAM,CAAC;AACpC,EAAE,qBAAqB,EAAE,CAAC,oBAAoB,CAAC;AAC/C,EAAE,gCAAgC,EAAE,CAAC,MAAM,CAAC;AAC5C,EAAE,qCAAqC,EAAE,CAAC,MAAM,CAAC;AACjD,EAAE,gBAAgB,EAAE,CAAC,GAAG,YAAY,CAAC;AACrC,EAAE,qCAAqC,EAAE,IAAI;AAC7C,EAAE,8CAA8C,EAAE;AAClD,EAAE;AACF;AACA,SAAS,iBAAiB,CAAC,OAAO,EAAE;AACpC,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO;AAC3B,CAAC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG;AACpC,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,oBAAoB,CAAC;AAC7D,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC;AACrE,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,oBAAoB,IAAI,GAAG,EAAE;AACpE,CAAC,MAAM,aAAa,mBAAmB,IAAI,GAAG,EAAE;AAChD;AACA,CAAC,SAAS,QAAQ,CAAC,KAAK,EAAE;AAC1B,EAAE,IAAI;AACN,GAAG,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;AAC3B,GAAG,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,aAAa,CAAC;AAC7D,GAAG,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE;AACnF,GAAG,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;AACtC,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC;AACrC,IAAI,CAAC,EAAE,YAAY;AACnB,IAAI,CAAC,EAAE,GAAG;AACV,IAAI,CAAC,CAAC;AACN,GAAG,OAAO;AACV,IAAI,MAAM,EAAE,GAAG;AACf,IAAI,IAAI,EAAE;AACV,KAAK,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAC5D,KAAK,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC;AACjD,KAAK,WAAW,EAAE,IAAI,IAAI,KAAK,CAAC;AAChC,KAAK,aAAa,EAAE,YAAY;AAChC,KAAK,WAAW,EAAE,CAAC,oBAAoB,CAAC;AACxC,KAAK,cAAc,EAAE,CAAC,MAAM,CAAC;AAC7B,KAAK,0BAA0B,EAAE;AACjC;AACA,IAAI;AACJ,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,IAAI,GAAG,YAAY,UAAU,EAAE,OAAO;AACzC,IAAI,MAAM,EAAE,GAAG,CAAC,MAAM;AACtB,IAAI,IAAI,EAAE,GAAG,CAAC,MAAM;AACpB,IAAI;AACJ,GAAG,MAAM,GAAG;AACZ,EAAE;AACF,CAAC;AACD,CAAC,eAAe,aAAa,CAAC,QAAQ,EAAE;AACxC,EAAE,IAAI,QAAQ,KAAK,mBAAmB,EAAE,OAAO,kBAAkB;AACjE,EAAE,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,OAAO,gBAAgB,CAAC,QAAQ,CAAC;AACpE,EAAE,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,OAAO,cAAc,CAAC,QAAQ,CAAC;AACtE,EAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;AAC3D,CAAC;AACD,CAAC,SAAS,gBAAgB,CAAC,QAAQ,EAAE;AACrC,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;AAC3D,EAAE,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;AAC1I,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACzC,EAAE,OAAO;AACT,GAAG,QAAQ;AACX,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,eAAe;AAClC,GAAG,YAAY,EAAE,IAAI,CAAC,CAAC;AACvB,GAAG,OAAO,EAAE,KAAK;AACjB,GAAG,MAAM,EAAE;AACX,GAAG;AACH,CAAC;AACD,CAAC,eAAe,cAAc,CAAC,GAAG,EAAE;AACpC,EAAE,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC;AACvC,EAAE,IAAI,MAAM,EAAE;AACd,GAAG,IAAI,QAAQ,IAAI,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,WAAW,EAAE,OAAO,MAAM,CAAC,MAAM;AAClF,GAAG,IAAI,SAAS,IAAI,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,mBAAmB,EAAE,MAAM,MAAM,CAAC,OAAO;AAC3F,EAAE;AACF,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,6CAA6C,CAAC;AACzH,EAAE,IAAI;AACN,GAAG,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,mBAAmB,CAAC;AACtE,GAAG,QAAQ,CAAC,GAAG,EAAE;AACjB,IAAI,EAAE,EAAE,GAAG,EAAE;AACb,IAAI;AACJ,IAAI,CAAC;AACL,GAAG,OAAO,MAAM;AAChB,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,IAAI,EAAE,GAAG,YAAY,UAAU,CAAC,EAAE,MAAM,GAAG;AAC9C,GAAG,QAAQ,CAAC,GAAG,EAAE;AACjB,IAAI,EAAE,EAAE,GAAG,EAAE;AACb,IAAI,OAAO,EAAE;AACb,IAAI,CAAC;AACL,GAAG,MAAM,GAAG;AACZ,EAAE;AACF,CAAC;AACD,CAAC,SAAS,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE;AAC/B,EAAE,IAAI,aAAa,CAAC,IAAI,IAAI,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;AACnG,EAAE,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC;AAC/B,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,CAAC,eAAe,qBAAqB,CAAC,KAAK,EAAE;AAC7C,EAAE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;AAClE,EAAE,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE;AACrD,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,qDAAqD,CAAC;AACvK,EAAE,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,MAAM,EAAE,MAAM,IAAI,UAAU,CAAC,2BAA2B,EAAE,uCAAuC,CAAC;AACvI,EAAE,MAAM,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE;AACzD,EAAE,IAAI,CAAC,aAAa,IAAI,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,MAAM,EAAE,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,mDAAmD,CAAC;AACnK,EAAE,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,cAAc,CAAC,MAAM,CAAC;AAClE,EAAE,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,kCAAkC,CAAC;AAC3G,EAAE,OAAO;AACT,GAAG,MAAM;AACT,GAAG,WAAW;AACd,GAAG,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM;AACtC,GAAG,aAAa;AAChB,GAAG,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;AACzD,GAAG;AACH,GAAG;AACH,CAAC;AACD;AACA,CAAC,SAAS,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE;AAClC,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE;AAC7B,GAAG,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;AAC7B,GAAG,CAAC,EAAE,OAAO,CAAC,WAAW;AACzB,GAAG,CAAC,EAAE,OAAO,CAAC,aAAa;AAC3B,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,WAAW;AACzB,GAAG,CAAC,EAAE;AACN,GAAG,CAAC;AACJ,EAAE,OAAO,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE;AACzC,GAAG,IAAI;AACP,GAAG,KAAK,EAAE,OAAO,CAAC,KAAK;AACvB,GAAG,GAAG,EAAE;AACR,GAAG,CAAC;AACJ,CAAC;AACD,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE;AACxB,EAAE,OAAO,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE;AACzC,GAAG,KAAK,EAAE,eAAe;AACzB,GAAG,KAAK,EAAE,OAAO,CAAC,KAAK;AACvB,GAAG,GAAG,EAAE;AACR,GAAG,CAAC;AACJ,CAAC;AACD,CAAC,SAAS,QAAQ,CAAC,IAAI,EAAE;AACzB,EAAE,IAAI;AACN,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,oBAAoB,EAAE,MAAM,IAAI,UAAU,CAAC,wBAAwB,EAAE,uCAAuC,CAAC;AAC/I,GAAG,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE;AACtC,GAAG,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC;AACrC,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,GAAG,GAAG,EAAE,EAAE,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,iCAAiC,CAAC;AAC5G,GAAG,IAAI,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,wCAAwC,CAAC;AACnK,GAAG,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE;AACnD,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,mCAAmC,CAAC;AAClK,GAAG,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;AACxC,GAAG,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,kCAAkC,CAAC;AACjI,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,4BAA4B,CAAC;AACzG,GAAG,MAAM,EAAE,CAAC,EAAE,GAAG,MAAM;AACvB,GAAG,OAAO,CAAC,UAAU,GAAG,CAAC,CAAC,OAAO,CAAC;AAClC,GAAG,OAAO;AACV,IAAI,MAAM,EAAE,GAAG;AACf,IAAI,IAAI,EAAE;AACV,KAAK,YAAY,EAAE,CAAC,CAAC,MAAM;AAC3B,KAAK,UAAU,EAAE,QAAQ;AACzB,KAAK,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC;AACjF,KAAK,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG;AAC7B;AACA,IAAI;AACJ,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,IAAI,GAAG,YAAY,UAAU,EAAE,OAAO;AACzC,IAAI,MAAM,EAAE,GAAG,CAAC,MAAM;AACtB,IAAI,IAAI,EAAE,GAAG,CAAC,MAAM;AACpB,IAAI;AACJ,GAAG,MAAM,GAAG;AACZ,EAAE;AACF,CAAC;AACD,CAAC,SAAS,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE;AACxC,EAAE,MAAM,CAAC,GAAG,GAAG,EAAE;AACjB,EAAE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9D,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;AAClE,EAAE,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,OAAO,KAAK;AACpC,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC;AAC7B,EAAE,OAAO,IAAI;AACb,CAAC;AACD,CAAC,SAAS,cAAc,CAAC,QAAQ,EAAE;AACnC,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;AACvC,EAAE,OAAO,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,cAAc,CAAC,MAAM,CAAC;AACrD,CAAC;AACD,CAAC,OAAO;AACR,EAAE,QAAQ;AACV,EAAE,aAAa;AACf,EAAE,qBAAqB;AACvB,EAAE,OAAO;AACT,EAAE,IAAI;AACN,EAAE,QAAQ;AACV,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC,MAAM,CAAC;AACpE,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC,MAAM;AACvE,EAAE;AACF;AACA;AACA,SAAS,YAAY,CAAC,MAAM,EAAE;AAC9B,CAAC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AACrC;AACA,eAAe,YAAY,CAAC,GAAG,EAAE,mBAAmB,EAAE;AACtD,CAAC,IAAI,GAAG;AACR,CAAC,IAAI;AACL,EAAE,GAAG,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC;AACtC,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,iDAAiD,CAAC;AAC3F,CAAC;AACD,CAAC,IAAI,GAAG,EAAE,SAAS,KAAK,GAAG,EAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,oDAAoD,CAAC;AACzH,CAAC,OAAO;AACR,EAAE,QAAQ,EAAE,GAAG;AACf,EAAE,IAAI,EAAE,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI;AAC5I,EAAE,YAAY,EAAE,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC;AACpD,EAAE,OAAO,EAAE,KAAK;AAChB,EAAE,MAAM,EAAE;AACV,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE;AACnC,CAAC,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;AACvC,CAAC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC3F;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,MAAM,EAAE;AAChC,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;AACxC,EAAE,MAAM,EAAE,QAAQ;AAClB,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM;AACpB,EAAE,CAAC;AACH,CAAC,MAAM,OAAO,GAAG,CAAC;AAClB,EAAE,MAAM,EAAE,MAAM;AAChB,EAAE,MAAM,EAAE,CAAC,MAAM;AACjB,EAAE,CAAC;AACH,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC;AAC5C,EAAE,MAAM,EAAE,OAAO;AACjB,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM;AACpB,EAAE,CAAC;AACH,CAAC,OAAO,OAAO;AACf;AACA,SAAS,iBAAiB,CAAC,KAAK,EAAE;AAClC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,iBAAiB,EAAE,MAAM,IAAI,UAAU,CAAC,sBAAsB,EAAE,sCAAsC,CAAC;AACrK,CAAC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,UAAU,CAAC,sBAAsB,EAAE,6DAA6D,CAAC;AAC7L,CAAC,OAAO,KAAK;AACb;AACA,SAAS,iBAAiB,CAAC,GAAG,EAAE;AAChC,CAAC,IAAI,GAAG;AACR,CAAC,IAAI;AACL,EAAE,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC;AACpB,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK;AAC3B,CAAC,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;AACjG;AACA;AACA,SAAS,kBAAkB,CAAC,GAAG,EAAE;AACjC,CAAC,IAAI;AACL,EAAE,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;AAClD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD;AACA;AACA,SAAS,eAAe,CAAC,UAAU,EAAE,SAAS,EAAE;AAChD,CAAC,IAAI,UAAU,KAAK,SAAS,EAAE,OAAO,IAAI;AAC1C,CAAC,IAAI,CAAC,EAAE,CAAC;AACT,CAAC,IAAI;AACL,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC;AACzB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC;AACxB,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ;AACtN;AACA,SAAS,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE;AACjC,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC;AACzB,CAAC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,KAAK,MAAM,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;AAC1F,CAAC,OAAO,GAAG,CAAC,QAAQ,EAAE;AACtB;AACA,SAAS,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE;AAC9B,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AAC7D;AACA,SAAS,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE;AAC3B,CAAC,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;AAClE;AACA,SAAS,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE;AAC1B,CAAC,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC;AAC3B,CAAC,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC;AACtD,CAAC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;AACnF,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC;AACtB,EAAE,EAAE;AACJ,EAAE,MAAM,CAAC,UAAU,EAAE;AACrB,EAAE;AACF,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;AACzB;AACA,SAAS,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE;AAC3B,CAAC,IAAI;AACL,EAAE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC;AAC9C,EAAE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;AACnG,EAAE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AAC3C,EAAE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;AACnF,EAAE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,IAAI;AACb,CAAC;AACD;AACA,SAAS,GAAG,CAAC,IAAI,EAAE;AACnB,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;AAC/C;AACA,SAAS,KAAK,CAAC,IAAI,EAAE;AACrB,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;AACvD;AACA,SAAS,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE;AACzB,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AACzB,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AACzB,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC;AACtD;;;;"}

package/build/server/chunks/chunks/openapi.js-g360-BRe.js

@@ -1,61 +0,0 @@
-import { e as buildOpenApiDocument$1 } from './api.js-CWQeuHWw.js';
-import { V as V1_ENDPOINTS } from './registry.js-C2zKBHg3.js';
-
-// src/lib/server/api/v1/openapi.ts
-/**
-* Selva's `/api/v1` OpenAPI document: the shared builder from
-* `@selvajs/server/api` over this app's route registry.
-*/
-var ERROR_DESCRIPTIONS = {
-	403: "Authenticated, but not permitted to perform this action. For an API token, `details.requiredScope` names the scope that would have passed.",
-	429: "Rate limited. Retry after the interval in `Retry-After`. API-token callers have a per-token request budget, reported on every response in `RateLimit-Limit` and `RateLimit-Remaining`; solves also draw on the owner’s compute budget.",
-	503: "The compute server is unconfigured or unreachable, or API tokens are unavailable on this server (`API_TOKENS_UNAVAILABLE`)."
-};
-/** Route prefix every endpoint in this registry is served under. */
-var API_BASE_PATH = "/api/v1";
-/**
-* `info.version` describes the API, not the npm package — they move
-* independently on purpose. `/api/v1` is additive-only, so every release
-* publishes the same contract; embedding the package version made the spec
-* drift on every version bump for no API reason.
-*
-* Derived from the base path so the major can't contradict the prefix it's
-* served under: shipping `/api/v2` moves both at once, or neither.
-*/
-var API_VERSION = `${/v(\d+)$/.exec("/api/v1")?.[1] ?? "1"}.0.0`;
-function buildOpenApiDocument(version = API_VERSION) {
-	return buildOpenApiDocument$1(V1_ENDPOINTS, {
-		basePath: API_BASE_PATH,
-		errorDescriptions: ERROR_DESCRIPTIONS,
-		alwaysErrors: [
-			401,
-			403,
-			429,
-			500,
-			503
-		],
-		info: {
-			title: "Selva API",
-			version,
-			description: "The tenant-scoped Selva API. Every endpoint acts as the calling identity and is confined to that identity's organization.\n\n**Stability.** Public endpoints are additive-only within v1: new optional fields and parameters may appear, but nothing is removed, renamed, or changed in type or meaning. A breaking change ships as a new route under `/api/v2` alongside this one. Anything deprecated inside v1 keeps working for a stated window and returns a `Deprecation` header while it does.\n\n**Operations marked `x-internal` carry none of that promise.** They exist to serve the Selva web UI and may change or disappear without notice.\n\n**Existence is never disclosed.** A resource the caller may not see returns `404`, not `403`. `403` means the resource is visible but the action is not allowed.\n\n**No CORS.** `/api/v1` sends no cross-origin headers; it serves same-origin browser requests and non-browser clients holding a token.\n\n**Scopes.** Each operation names the API-token scope it needs as `x-scope`: `read`, `write`, `solve` or `upload`. `write`, `solve` and `upload` each include `read`, and `write` includes `upload`. `upload` allows creating definitions, uploading versions, checking a file's schema before upload and making a version live, and nothing else: it cannot edit metadata, delete or share.\n\nInstance administration lives at `/api/admin`, is session-only, is never reachable with a bearer token, and is not described here.",
-			license: { name: "MIT" }
-		},
-		security: [{ cookieAuth: [] }, { bearerAuth: [] }],
-		securitySchemes: {
-			cookieAuth: {
-				type: "apiKey",
-				in: "cookie",
-				name: "session",
-				description: "Browser session cookie. Same-origin only."
-			},
-			bearerAuth: {
-				type: "http",
-				scheme: "bearer",
-				description: "An API token (`selva_…`), sent as `Authorization: Bearer <token>` and never in the URL. It acts as the user who created it, in one org, narrowed by its scopes. `/api/v1` is the only prefix that accepts one; `/api/admin` never does."
-			}
-		}
-	});
-}
-
-export { buildOpenApiDocument as b };
-//# sourceMappingURL=openapi.js-g360-BRe.js.map

package/build/server/chunks/chunks/openapi.js-g360-BRe.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"openapi.js-g360-BRe.js","sources":["../../../../.svelte-kit/output/server/chunks/openapi.js"],"sourcesContent":["import { y as buildOpenApiDocument$1 } from \"./api.js\";\nimport { t as V1_ENDPOINTS } from \"./registry.js\";\n// src/lib/server/api/v1/openapi.ts\n/**\n* Selva's `/api/v1` OpenAPI document: the shared builder from\n* `@selvajs/server/api` over this app's route registry.\n*/\nvar ERROR_DESCRIPTIONS = {\n\t403: \"Authenticated, but not permitted to perform this action. For an API token, `details.requiredScope` names the scope that would have passed.\",\n\t429: \"Rate limited. Retry after the interval in `Retry-After`. API-token callers have a per-token request budget, reported on every response in `RateLimit-Limit` and `RateLimit-Remaining`; solves also draw on the owner’s compute budget.\",\n\t503: \"The compute server is unconfigured or unreachable, or API tokens are unavailable on this server (`API_TOKENS_UNAVAILABLE`).\"\n};\n/** Route prefix every endpoint in this registry is served under. */\nvar API_BASE_PATH = \"/api/v1\";\n/**\n* `info.version` describes the API, not the npm package — they move\n* independently on purpose. `/api/v1` is additive-only, so every release\n* publishes the same contract; embedding the package version made the spec\n* drift on every version bump for no API reason.\n*\n* Derived from the base path so the major can't contradict the prefix it's\n* served under: shipping `/api/v2` moves both at once, or neither.\n*/\nvar API_VERSION = `${/v(\\d+)$/.exec(\"/api/v1\")?.[1] ?? \"1\"}.0.0`;\nfunction buildOpenApiDocument(version = API_VERSION) {\n\treturn buildOpenApiDocument$1(V1_ENDPOINTS, {\n\t\tbasePath: API_BASE_PATH,\n\t\terrorDescriptions: ERROR_DESCRIPTIONS,\n\t\talwaysErrors: [\n\t\t\t401,\n\t\t\t403,\n\t\t\t429,\n\t\t\t500,\n\t\t\t503\n\t\t],\n\t\tinfo: {\n\t\t\ttitle: \"Selva API\",\n\t\t\tversion,\n\t\t\tdescription: \"The tenant-scoped Selva API. Every endpoint acts as the calling identity and is confined to that identity's organization.\\n\\n**Stability.** Public endpoints are additive-only within v1: new optional fields and parameters may appear, but nothing is removed, renamed, or changed in type or meaning. A breaking change ships as a new route under `/api/v2` alongside this one. Anything deprecated inside v1 keeps working for a stated window and returns a `Deprecation` header while it does.\\n\\n**Operations marked `x-internal` carry none of that promise.** They exist to serve the Selva web UI and may change or disappear without notice.\\n\\n**Existence is never disclosed.** A resource the caller may not see returns `404`, not `403`. `403` means the resource is visible but the action is not allowed.\\n\\n**No CORS.** `/api/v1` sends no cross-origin headers; it serves same-origin browser requests and non-browser clients holding a token.\\n\\n**Scopes.** Each operation names the API-token scope it needs as `x-scope`: `read`, `write`, `solve` or `upload`. `write`, `solve` and `upload` each include `read`, and `write` includes `upload`. `upload` allows creating definitions, uploading versions, checking a file's schema before upload and making a version live, and nothing else: it cannot edit metadata, delete or share.\\n\\nInstance administration lives at `/api/admin`, is session-only, is never reachable with a bearer token, and is not described here.\",\n\t\t\tlicense: { name: \"MIT\" }\n\t\t},\n\t\tsecurity: [{ cookieAuth: [] }, { bearerAuth: [] }],\n\t\tsecuritySchemes: {\n\t\t\tcookieAuth: {\n\t\t\t\ttype: \"apiKey\",\n\t\t\t\tin: \"cookie\",\n\t\t\t\tname: \"session\",\n\t\t\t\tdescription: \"Browser session cookie. Same-origin only.\"\n\t\t\t},\n\t\t\tbearerAuth: {\n\t\t\t\ttype: \"http\",\n\t\t\t\tscheme: \"bearer\",\n\t\t\t\tdescription: \"An API token (`selva_…`), sent as `Authorization: Bearer <token>` and never in the URL. It acts as the user who created it, in one org, narrowed by its scopes. `/api/v1` is the only prefix that accepts one; `/api/admin` never does.\"\n\t\t\t}\n\t\t}\n\t});\n}\nexport { buildOpenApiDocument as t };\n"],"names":[],"mappings":";;;AAEA;AACA;AACA;AACA;AACA;AACA,IAAI,kBAAkB,GAAG;AACzB,CAAC,GAAG,EAAE,4IAA4I;AAClJ,CAAC,GAAG,EAAE,wOAAwO;AAC9O,CAAC,GAAG,EAAE;AACN,CAAC;AACD;AACA,IAAI,aAAa,GAAG,SAAS;AAC7B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,WAAW,GAAG,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC;AAChE,SAAS,oBAAoB,CAAC,OAAO,GAAG,WAAW,EAAE;AACrD,CAAC,OAAO,sBAAsB,CAAC,YAAY,EAAE;AAC7C,EAAE,QAAQ,EAAE,aAAa;AACzB,EAAE,iBAAiB,EAAE,kBAAkB;AACvC,EAAE,YAAY,EAAE;AAChB,GAAG,GAAG;AACN,GAAG,GAAG;AACN,GAAG,GAAG;AACN,GAAG,GAAG;AACN,GAAG;AACH,GAAG;AACH,EAAE,IAAI,EAAE;AACR,GAAG,KAAK,EAAE,WAAW;AACrB,GAAG,OAAO;AACV,GAAG,WAAW,EAAE,46CAA46C;AAC57C,GAAG,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK;AACzB,GAAG;AACH,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;AACpD,EAAE,eAAe,EAAE;AACnB,GAAG,UAAU,EAAE;AACf,IAAI,IAAI,EAAE,QAAQ;AAClB,IAAI,EAAE,EAAE,QAAQ;AAChB,IAAI,IAAI,EAAE,SAAS;AACnB,IAAI,WAAW,EAAE;AACjB,IAAI;AACJ,GAAG,UAAU,EAAE;AACf,IAAI,IAAI,EAAE,MAAM;AAChB,IAAI,MAAM,EAAE,QAAQ;AACpB,IAAI,WAAW,EAAE;AACjB;AACA;AACA,EAAE,CAAC;AACH;;;;"}

package/build/server/chunks/chunks/package.js-B8ojgJpE.js

@@ -1,85 +0,0 @@
-var package_default = {
-	name: "@selvajs/selva",
-	version: "4.20.0-beta.14",
-	description: "Selva — self-contained Grasshopper-driven web app. Install, configure via .env, deploy.",
-	license: "MIT",
-	author: "VektorNode",
-	homepage: "https://selva.dev",
-	bugs: "https://github.com/VektorNode/selva/issues",
-	keywords: [
-		"grasshopper",
-		"rhino",
-		"rhino-compute",
-		"parametric-design",
-		"web-app",
-		"sveltekit"
-	],
-	publishConfig: { "access": "public" },
-	repository: {
-		"type": "git",
-		"url": "git+https://github.com/VektorNode/selva.git",
-		"directory": "packages/selva"
-	},
-	type: "module",
-	main: "./build/index.js",
-	files: ["build", "templates"],
-	engines: { "node": ">=24.0.0" },
-	scripts: {
-		"dev": "vite dev",
-		"dev:lan": "vite dev --host",
-		"build": "rimraf build && vite build && node ./scripts/generate-templates.js",
-		"preview": "vite preview",
-		"start": "node build/index.js",
-		"clean": "rimraf build templates",
-		"prepare": "svelte-kit sync || echo ''",
-		"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
-		"test": "vitest run",
-		"test:watch": "vitest",
-		"openapi:generate": "node scripts/generate-openapi.js",
-		"test:e2e": "playwright test",
-		"lint": "eslint .",
-		"lint:types": "eslint . --config eslint.typed.config.js"
-	},
-	dependencies: {
-		"@lucide/svelte": "catalog:",
-		"@supabase/supabase-js": "catalog:",
-		"@sveltejs/kit": "catalog:",
-		"bits-ui": "catalog:",
-		"clsx": "catalog:",
-		"mode-watcher": "catalog:",
-		"nodemailer": "catalog:",
-		"pino": "^10.4.0",
-		"rhino3dm": "catalog:",
-		"sharp": "catalog:",
-		"tailwind-merge": "catalog:",
-		"tailwind-variants": "catalog:",
-		"three": "catalog:",
-		"zod": "catalog:"
-	},
-	optionalDependencies: { "@sentry/node": "^11.9.0" },
-	devDependencies: {
-		"@playwright/test": "catalog:",
-		"@selvajs/compute": "workspace:*",
-		"@selvajs/config": "workspace:*",
-		"@selvajs/header-auth-provider": "workspace:*",
-		"@selvajs/local-provider": "workspace:*",
-		"@selvajs/mcp": "workspace:*",
-		"@selvajs/notifications": "workspace:*",
-		"@selvajs/platform": "workspace:*",
-		"@selvajs/schemas": "workspace:*",
-		"@selvajs/server": "workspace:*",
-		"@selvajs/solve": "workspace:*",
-		"@selvajs/supabase-provider": "workspace:*",
-		"@selvajs/ui": "workspace:*",
-		"@selvajs/visualization": "workspace:*",
-		"@sveltejs/adapter-node": "^5.5.4",
-		"@types/nodemailer": "catalog:",
-		"@types/three": "catalog:",
-		"rimraf": "catalog:",
-		"tw-animate-css": "catalog:",
-		"vitest": "catalog:"
-	}
-};
-
-export { package_default as p };
-//# sourceMappingURL=package.js-B8ojgJpE.js.map

package/build/server/chunks/chunks/package.js-B8ojgJpE.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"package.js-B8ojgJpE.js","sources":["../../../../.svelte-kit/output/server/chunks/package.js"],"sourcesContent":["var package_default = {\n\tname: \"@selvajs/selva\",\n\tversion: \"4.20.0-beta.14\",\n\tdescription: \"Selva — self-contained Grasshopper-driven web app. Install, configure via .env, deploy.\",\n\tlicense: \"MIT\",\n\tauthor: \"VektorNode\",\n\thomepage: \"https://selva.dev\",\n\tbugs: \"https://github.com/VektorNode/selva/issues\",\n\tkeywords: [\n\t\t\"grasshopper\",\n\t\t\"rhino\",\n\t\t\"rhino-compute\",\n\t\t\"parametric-design\",\n\t\t\"web-app\",\n\t\t\"sveltekit\"\n\t],\n\tpublishConfig: { \"access\": \"public\" },\n\trepository: {\n\t\t\"type\": \"git\",\n\t\t\"url\": \"git+https://github.com/VektorNode/selva.git\",\n\t\t\"directory\": \"packages/selva\"\n\t},\n\ttype: \"module\",\n\tmain: \"./build/index.js\",\n\tfiles: [\"build\", \"templates\"],\n\tengines: { \"node\": \">=24.0.0\" },\n\tscripts: {\n\t\t\"dev\": \"vite dev\",\n\t\t\"dev:lan\": \"vite dev --host\",\n\t\t\"build\": \"rimraf build && vite build && node ./scripts/generate-templates.js\",\n\t\t\"preview\": \"vite preview\",\n\t\t\"start\": \"node build/index.js\",\n\t\t\"clean\": \"rimraf build templates\",\n\t\t\"prepare\": \"svelte-kit sync || echo ''\",\n\t\t\"check\": \"svelte-kit sync && svelte-check --tsconfig ./tsconfig.json\",\n\t\t\"test\": \"vitest run\",\n\t\t\"test:watch\": \"vitest\",\n\t\t\"openapi:generate\": \"node scripts/generate-openapi.js\",\n\t\t\"test:e2e\": \"playwright test\",\n\t\t\"lint\": \"eslint .\",\n\t\t\"lint:types\": \"eslint . --config eslint.typed.config.js\"\n\t},\n\tdependencies: {\n\t\t\"@lucide/svelte\": \"catalog:\",\n\t\t\"@supabase/supabase-js\": \"catalog:\",\n\t\t\"@sveltejs/kit\": \"catalog:\",\n\t\t\"bits-ui\": \"catalog:\",\n\t\t\"clsx\": \"catalog:\",\n\t\t\"mode-watcher\": \"catalog:\",\n\t\t\"nodemailer\": \"catalog:\",\n\t\t\"pino\": \"^10.4.0\",\n\t\t\"rhino3dm\": \"catalog:\",\n\t\t\"sharp\": \"catalog:\",\n\t\t\"tailwind-merge\": \"catalog:\",\n\t\t\"tailwind-variants\": \"catalog:\",\n\t\t\"three\": \"catalog:\",\n\t\t\"zod\": \"catalog:\"\n\t},\n\toptionalDependencies: { \"@sentry/node\": \"^11.9.0\" },\n\tdevDependencies: {\n\t\t\"@playwright/test\": \"catalog:\",\n\t\t\"@selvajs/compute\": \"workspace:*\",\n\t\t\"@selvajs/config\": \"workspace:*\",\n\t\t\"@selvajs/header-auth-provider\": \"workspace:*\",\n\t\t\"@selvajs/local-provider\": \"workspace:*\",\n\t\t\"@selvajs/mcp\": \"workspace:*\",\n\t\t\"@selvajs/notifications\": \"workspace:*\",\n\t\t\"@selvajs/platform\": \"workspace:*\",\n\t\t\"@selvajs/schemas\": \"workspace:*\",\n\t\t\"@selvajs/server\": \"workspace:*\",\n\t\t\"@selvajs/solve\": \"workspace:*\",\n\t\t\"@selvajs/supabase-provider\": \"workspace:*\",\n\t\t\"@selvajs/ui\": \"workspace:*\",\n\t\t\"@selvajs/visualization\": \"workspace:*\",\n\t\t\"@sveltejs/adapter-node\": \"^5.5.4\",\n\t\t\"@types/nodemailer\": \"catalog:\",\n\t\t\"@types/three\": \"catalog:\",\n\t\t\"rimraf\": \"catalog:\",\n\t\t\"tw-animate-css\": \"catalog:\",\n\t\t\"vitest\": \"catalog:\"\n\t}\n};\nexport { package_default as t };\n"],"names":[],"mappings":"AAAG,IAAC,eAAe,GAAG;AACtB,CAAC,IAAI,EAAE,gBAAgB;AACvB,CAAC,OAAO,EAAE,gBAAgB;AAC1B,CAAC,WAAW,EAAE,yFAAyF;AACvG,CAAC,OAAO,EAAE,KAAK;AACf,CAAC,MAAM,EAAE,YAAY;AACrB,CAAC,QAAQ,EAAE,mBAAmB;AAC9B,CAAC,IAAI,EAAE,4CAA4C;AACnD,CAAC,QAAQ,EAAE;AACX,EAAE,aAAa;AACf,EAAE,OAAO;AACT,EAAE,eAAe;AACjB,EAAE,mBAAmB;AACrB,EAAE,SAAS;AACX,EAAE;AACF,EAAE;AACF,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;AACtC,CAAC,UAAU,EAAE;AACb,EAAE,MAAM,EAAE,KAAK;AACf,EAAE,KAAK,EAAE,6CAA6C;AACtD,EAAE,WAAW,EAAE;AACf,EAAE;AACF,CAAC,IAAI,EAAE,QAAQ;AACf,CAAC,IAAI,EAAE,kBAAkB;AACzB,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC;AAC9B,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE;AAChC,CAAC,OAAO,EAAE;AACV,EAAE,KAAK,EAAE,UAAU;AACnB,EAAE,SAAS,EAAE,iBAAiB;AAC9B,EAAE,OAAO,EAAE,oEAAoE;AAC/E,EAAE,SAAS,EAAE,cAAc;AAC3B,EAAE,OAAO,EAAE,qBAAqB;AAChC,EAAE,OAAO,EAAE,wBAAwB;AACnC,EAAE,SAAS,EAAE,4BAA4B;AACzC,EAAE,OAAO,EAAE,4DAA4D;AACvE,EAAE,MAAM,EAAE,YAAY;AACtB,EAAE,YAAY,EAAE,QAAQ;AACxB,EAAE,kBAAkB,EAAE,kCAAkC;AACxD,EAAE,UAAU,EAAE,iBAAiB;AAC/B,EAAE,MAAM,EAAE,UAAU;AACpB,EAAE,YAAY,EAAE;AAChB,EAAE;AACF,CAAC,YAAY,EAAE;AACf,EAAE,gBAAgB,EAAE,UAAU;AAC9B,EAAE,uBAAuB,EAAE,UAAU;AACrC,EAAE,eAAe,EAAE,UAAU;AAC7B,EAAE,SAAS,EAAE,UAAU;AACvB,EAAE,MAAM,EAAE,UAAU;AACpB,EAAE,cAAc,EAAE,UAAU;AAC5B,EAAE,YAAY,EAAE,UAAU;AAC1B,EAAE,MAAM,EAAE,SAAS;AACnB,EAAE,UAAU,EAAE,UAAU;AACxB,EAAE,OAAO,EAAE,UAAU;AACrB,EAAE,gBAAgB,EAAE,UAAU;AAC9B,EAAE,mBAAmB,EAAE,UAAU;AACjC,EAAE,OAAO,EAAE,UAAU;AACrB,EAAE,KAAK,EAAE;AACT,EAAE;AACF,CAAC,oBAAoB,EAAE,EAAE,cAAc,EAAE,SAAS,EAAE;AACpD,CAAC,eAAe,EAAE;AAClB,EAAE,kBAAkB,EAAE,UAAU;AAChC,EAAE,kBAAkB,EAAE,aAAa;AACnC,EAAE,iBAAiB,EAAE,aAAa;AAClC,EAAE,+BAA+B,EAAE,aAAa;AAChD,EAAE,yBAAyB,EAAE,aAAa;AAC1C,EAAE,cAAc,EAAE,aAAa;AAC/B,EAAE,wBAAwB,EAAE,aAAa;AACzC,EAAE,mBAAmB,EAAE,aAAa;AACpC,EAAE,kBAAkB,EAAE,aAAa;AACnC,EAAE,iBAAiB,EAAE,aAAa;AAClC,EAAE,gBAAgB,EAAE,aAAa;AACjC,EAAE,4BAA4B,EAAE,aAAa;AAC7C,EAAE,aAAa,EAAE,aAAa;AAC9B,EAAE,wBAAwB,EAAE,aAAa;AACzC,EAAE,wBAAwB,EAAE,QAAQ;AACpC,EAAE,mBAAmB,EAAE,UAAU;AACjC,EAAE,cAAc,EAAE,UAAU;AAC5B,EAAE,QAAQ,EAAE,UAAU;AACtB,EAAE,gBAAgB,EAAE,UAAU;AAC9B,EAAE,QAAQ,EAAE;AACZ;AACA;;;;"}

package/build/server/chunks/chunks/paths.js-KeZkYLzj.js

@@ -1,19 +0,0 @@
-import { i as initial_base, b as base } from './internal.js-BFfHHam5.js';
-import { i as resolve_route, c as add_data_suffix } from './routing.js-jOE0ETFb.js';
-import './internal2.js-Dx1x8Dv4.js';
-import { try_get_request_store } from '@sveltejs/kit/internal/server';
-
-// ../../node_modules/.pnpm/@sveltejs+kit@2.70.3_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.3.1_svelte_47ca0476217d3a67b8821de8a7850a17/node_modules/@sveltejs/kit/src/runtime/app/paths/server.js
-/** @type {import('./client.js').resolve} */
-function resolve(id, params) {
-	if (!id.startsWith("/")) throw new Error(`Cannot use \`resolve(...)\` with a non-absolute pathname or route ID (got "${id}"). \`resolve\` is only for internal pathnames and route IDs; external URLs should be used directly.`);
-	const resolved = resolve_route(id, params);
-	{
-		const store = try_get_request_store();
-		if (store && !store.state.prerendering?.fallback) return ((store.event.isDataRequest ? add_data_suffix(store.event.url.pathname) : store.event.url.pathname).slice(initial_base.length).split("/").slice(2).map(() => "..").join("/") || ".") + resolved;
-	}
-	return base + resolved;
-}
-
-export { resolve as r };
-//# sourceMappingURL=paths.js-KeZkYLzj.js.map

package/build/server/chunks/chunks/paths.js-KeZkYLzj.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"paths.js-KeZkYLzj.js","sources":["../../../../.svelte-kit/output/server/chunks/paths.js"],"sourcesContent":["import { c as initial_base, s as base } from \"./internal.js\";\nimport { n as resolve_route, u as add_data_suffix } from \"./routing.js\";\nimport \"./internal2.js\";\nimport { try_get_request_store } from \"@sveltejs/kit/internal/server\";\n// ../../node_modules/.pnpm/@sveltejs+kit@2.70.3_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.3.1_svelte_47ca0476217d3a67b8821de8a7850a17/node_modules/@sveltejs/kit/src/runtime/app/paths/server.js\n/** @type {import('./client.js').resolve} */\nfunction resolve(id, params) {\n\tif (!id.startsWith(\"/\")) throw new Error(`Cannot use \\`resolve(...)\\` with a non-absolute pathname or route ID (got \"${id}\"). \\`resolve\\` is only for internal pathnames and route IDs; external URLs should be used directly.`);\n\tconst resolved = resolve_route(id, params);\n\t{\n\t\tconst store = try_get_request_store();\n\t\tif (store && !store.state.prerendering?.fallback) return ((store.event.isDataRequest ? add_data_suffix(store.event.url.pathname) : store.event.url.pathname).slice(initial_base.length).split(\"/\").slice(2).map(() => \"..\").join(\"/\") || \".\") + resolved;\n\t}\n\treturn base + resolved;\n}\nexport { resolve as t };\n"],"names":[],"mappings":";;;;;AAIA;AACA;AACA,SAAS,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE;AAC7B,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,2EAA2E,EAAE,EAAE,CAAC,oGAAoG,CAAC,CAAC;AACjO,CAAC,MAAM,QAAQ,GAAG,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC;AAC3C,CAAC;AACD,EAAE,MAAM,KAAK,GAAG,qBAAqB,EAAE;AACvC,EAAE,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,QAAQ;AAC1P,CAAC;AACD,CAAC,OAAO,IAAI,GAAG,QAAQ;AACvB;;;;"}

package/build/server/chunks/chunks/permissions.server.js-B5seqY1O.js

@@ -1,24 +0,0 @@
-import './src.js-BQFsdJf3.js';
-import { b as getPermissionStore, j as getEventSink } from './providers.server.js-DbrdtkJK.js';
-import { b as actorFrom } from './schema-extraction.js-DxFeK69H.js';
-
-// src/lib/server/permissions.server.ts
-/**
-* Permission read/write seam over `IPlatformPermissionStore`. Reads happen
-* via `locals.ctx.platformPermissions` (set once in `hooks.server.ts`);
-* writes funnel through this module so any future change (caching,
-* invalidation, audit hooks) is one-file.
-*/
-async function setUserPlatformPermissions(ctx, userId, permissions) {
-	const result = await getPermissionStore().set(ctx, userId, permissions);
-	if (result === "ok") await getEventSink().emit({
-		type: "platform_permissions.changed",
-		userId,
-		permissions,
-		actorId: actorFrom(ctx)
-	});
-	return result;
-}
-
-export { setUserPlatformPermissions as s };
-//# sourceMappingURL=permissions.server.js-B5seqY1O.js.map

package/build/server/chunks/chunks/permissions.server.js-B5seqY1O.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"permissions.server.js-B5seqY1O.js","sources":["../../../../.svelte-kit/output/server/chunks/permissions.server.js"],"sourcesContent":["import \"./src.js\";\nimport { g as getPermissionStore, u as getEventSink } from \"./providers.server.js\";\nimport { o as actorFrom } from \"./schema-extraction.js\";\n// src/lib/server/permissions.server.ts\n/**\n* Permission read/write seam over `IPlatformPermissionStore`. Reads happen\n* via `locals.ctx.platformPermissions` (set once in `hooks.server.ts`);\n* writes funnel through this module so any future change (caching,\n* invalidation, audit hooks) is one-file.\n*/\nasync function setUserPlatformPermissions(ctx, userId, permissions) {\n\tconst result = await getPermissionStore().set(ctx, userId, permissions);\n\tif (result === \"ok\") await getEventSink().emit({\n\t\ttype: \"platform_permissions.changed\",\n\t\tuserId,\n\t\tpermissions,\n\t\tactorId: actorFrom(ctx)\n\t});\n\treturn result;\n}\nexport { setUserPlatformPermissions as t };\n"],"names":[],"mappings":";;;;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,0BAA0B,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE;AACpE,CAAC,MAAM,MAAM,GAAG,MAAM,kBAAkB,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC;AACxE,CAAC,IAAI,MAAM,KAAK,IAAI,EAAE,MAAM,YAAY,EAAE,CAAC,IAAI,CAAC;AAChD,EAAE,IAAI,EAAE,8BAA8B;AACtC,EAAE,MAAM;AACR,EAAE,WAAW;AACb,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG;AACxB,EAAE,CAAC;AACH,CAAC,OAAO,MAAM;AACd;;;;"}

package/build/server/chunks/chunks/presets.server.js-DvBaWEr5.js

@@ -1,21 +0,0 @@
-import { m as mayHoldApiTokens } from './handlers.js-BpDAlScc.js';
-import { t as toApiRequest } from './sveltekit.js-CwkcUXXi.js';
-import { A as ACCESS_PRESETS } from './apiTokens.js-CK12Vvpo.js';
-
-// src/lib/server/apiTokens/presets.server.ts
-/**
-* The token-form presets the signed-in user may mint in their acting org:
-* every preset for someone who may hold any key, the upload preset alone for
-* someone who may only hold upload keys, else none. Empty means the token page
-* and its tab stay hidden.
-*/
-async function offeredTokenPresets(event) {
-	const ctx = event.locals.ctx;
-	if (!ctx) return [];
-	const { deps } = toApiRequest(event);
-	if (await mayHoldApiTokens(deps, ctx, ACCESS_PRESETS.full.scopes)) return Object.keys(ACCESS_PRESETS);
-	return await mayHoldApiTokens(deps, ctx, ACCESS_PRESETS.upload.scopes) ? ["upload"] : [];
-}
-
-export { offeredTokenPresets as o };
-//# sourceMappingURL=presets.server.js-DvBaWEr5.js.map

package/build/server/chunks/chunks/presets.server.js-DvBaWEr5.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"presets.server.js-DvBaWEr5.js","sources":["../../../../.svelte-kit/output/server/chunks/presets.server.js"],"sourcesContent":["import { W as mayHoldApiTokens } from \"./handlers.js\";\nimport { n as toApiRequest } from \"./sveltekit.js\";\nimport { t as ACCESS_PRESETS } from \"./apiTokens.js\";\n// src/lib/server/apiTokens/presets.server.ts\n/**\n* The token-form presets the signed-in user may mint in their acting org:\n* every preset for someone who may hold any key, the upload preset alone for\n* someone who may only hold upload keys, else none. Empty means the token page\n* and its tab stay hidden.\n*/\nasync function offeredTokenPresets(event) {\n\tconst ctx = event.locals.ctx;\n\tif (!ctx) return [];\n\tconst { deps } = toApiRequest(event);\n\tif (await mayHoldApiTokens(deps, ctx, ACCESS_PRESETS.full.scopes)) return Object.keys(ACCESS_PRESETS);\n\treturn await mayHoldApiTokens(deps, ctx, ACCESS_PRESETS.upload.scopes) ? [\"upload\"] : [];\n}\nexport { offeredTokenPresets as t };\n"],"names":[],"mappings":";;;;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,mBAAmB,CAAC,KAAK,EAAE;AAC1C,CAAC,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG;AAC7B,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE;AACpB,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC;AACrC,CAAC,IAAI,MAAM,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC;AACtG,CAAC,OAAO,MAAM,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE;AACzF;;;;"}

package/build/server/chunks/chunks/projects.js-D6fN9oey.js

@@ -1,47 +0,0 @@
-import { l as slugify, P as ProviderError } from './src.js-BQFsdJf3.js';
-import { d as apiError, A as ApiErrorCode } from './access.js-DbWaEG7Y.js';
-
-// ../server/src/projects/create-project.ts
-var MAX_SLUG_ATTEMPTS = 25;
-function isSlugConflict(err) {
-	return err instanceof ProviderError && err.statusCode === 409 && /projects_org_id_slug_key/.test(err.message);
-}
-function isNameConflict(err) {
-	return err instanceof ProviderError && err.statusCode === 409 && /projects_org_name_unique/.test(err.message);
-}
-/**
-* Create a project, retrying on slug collision.
-*
-* The retry is not a nicety: the caller may not be able to *see* a colliding
-* project under RLS, so a pre-flight `getProjectBySlug` cannot decide it — the
-* unique index is the only source of truth.
-*
-* `/api/v1/projects` and `/api/admin/projects` both create projects and both
-* carried a copy of this loop. The copies had already drifted on three points
-* (error re-throw, slug stem, flag validation), which is what makes this the
-* one place in the access surface where duplication caused real divergence.
-*/
-async function createProjectWithUniqueSlug(store, draft, { writeCtx, fallbackSlug, conflictScope }) {
-	const baseSlug = slugify(draft.name) || fallbackSlug;
-	const now = (/* @__PURE__ */ new Date()).toISOString();
-	for (let attempt = 0; attempt < MAX_SLUG_ATTEMPTS; attempt++) {
-		const project = {
-			...draft,
-			slug: attempt === 0 ? baseSlug : `${baseSlug}-${attempt + 1}`,
-			createdAt: now,
-			updatedAt: now,
-			deletedAt: null
-		};
-		try {
-			await store.createProject(writeCtx, project);
-			return project;
-		} catch (err) {
-			if (isNameConflict(err)) apiError(409, ApiErrorCode.CONFLICT, `A project with that name already exists in ${conflictScope}.`);
-			if (!isSlugConflict(err)) throw err;
-		}
-	}
-	apiError(409, ApiErrorCode.CONFLICT, "Could not pick a unique project slug after several attempts.");
-}
-
-export { createProjectWithUniqueSlug as c };
-//# sourceMappingURL=projects.js-D6fN9oey.js.map

package/build/server/chunks/chunks/projects.js-D6fN9oey.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"projects.js-D6fN9oey.js","sources":["../../../../.svelte-kit/output/server/chunks/projects.js"],"sourcesContent":["import { R as slugify, S as ProviderError } from \"./src.js\";\nimport { O as ApiErrorCode, k as apiError } from \"./access.js\";\n// ../server/src/projects/create-project.ts\nvar MAX_SLUG_ATTEMPTS = 25;\nfunction isSlugConflict(err) {\n\treturn err instanceof ProviderError && err.statusCode === 409 && /projects_org_id_slug_key/.test(err.message);\n}\nfunction isNameConflict(err) {\n\treturn err instanceof ProviderError && err.statusCode === 409 && /projects_org_name_unique/.test(err.message);\n}\n/**\n* Create a project, retrying on slug collision.\n*\n* The retry is not a nicety: the caller may not be able to *see* a colliding\n* project under RLS, so a pre-flight `getProjectBySlug` cannot decide it — the\n* unique index is the only source of truth.\n*\n* `/api/v1/projects` and `/api/admin/projects` both create projects and both\n* carried a copy of this loop. The copies had already drifted on three points\n* (error re-throw, slug stem, flag validation), which is what makes this the\n* one place in the access surface where duplication caused real divergence.\n*/\nasync function createProjectWithUniqueSlug(store, draft, { writeCtx, fallbackSlug, conflictScope }) {\n\tconst baseSlug = slugify(draft.name) || fallbackSlug;\n\tconst now = (/* @__PURE__ */ new Date()).toISOString();\n\tfor (let attempt = 0; attempt < MAX_SLUG_ATTEMPTS; attempt++) {\n\t\tconst project = {\n\t\t\t...draft,\n\t\t\tslug: attempt === 0 ? baseSlug : `${baseSlug}-${attempt + 1}`,\n\t\t\tcreatedAt: now,\n\t\t\tupdatedAt: now,\n\t\t\tdeletedAt: null\n\t\t};\n\t\ttry {\n\t\t\tawait store.createProject(writeCtx, project);\n\t\t\treturn project;\n\t\t} catch (err) {\n\t\t\tif (isNameConflict(err)) apiError(409, ApiErrorCode.CONFLICT, `A project with that name already exists in ${conflictScope}.`);\n\t\t\tif (!isSlugConflict(err)) throw err;\n\t\t}\n\t}\n\tapiError(409, ApiErrorCode.CONFLICT, \"Could not pick a unique project slug after several attempts.\");\n}\nexport { createProjectWithUniqueSlug as t };\n"],"names":[],"mappings":";;;AAEA;AACA,IAAI,iBAAiB,GAAG,EAAE;AAC1B,SAAS,cAAc,CAAC,GAAG,EAAE;AAC7B,CAAC,OAAO,GAAG,YAAY,aAAa,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;AAC9G;AACA,SAAS,cAAc,CAAC,GAAG,EAAE;AAC7B,CAAC,OAAO,GAAG,YAAY,aAAa,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;AAC9G;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,2BAA2B,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,EAAE;AACpG,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,YAAY;AACrD,CAAC,MAAM,GAAG,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACvD,CAAC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,iBAAiB,EAAE,OAAO,EAAE,EAAE;AAC/D,EAAE,MAAM,OAAO,GAAG;AAClB,GAAG,GAAG,KAAK;AACX,GAAG,IAAI,EAAE,OAAO,KAAK,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;AAChE,GAAG,SAAS,EAAE,GAAG;AACjB,GAAG,SAAS,EAAE,GAAG;AACjB,GAAG,SAAS,EAAE;AACd,GAAG;AACH,EAAE,IAAI;AACN,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC;AAC/C,GAAG,OAAO,OAAO;AACjB,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,2CAA2C,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;AAChI,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG;AACtC,EAAE;AACF,CAAC;AACD,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,8DAA8D,CAAC;AACrG;;;;"}