@selvajs/selva 4.20.0-beta.15 → 4.20.0-beta.16

package/build/server/chunks/chunks/access.js-BfMTTCTH.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js-BfMTTCTH.js","sources":["../../../../.svelte-kit/output/server/chunks/access.js"],"sourcesContent":["import { o as parseApiScope } from \"./types.js\";\nimport { o as hasPermission, s as ProviderError, t as SYSTEM_CONTEXT } from \"./context.js\";\nimport { n as ALL_ORG_PERMISSIONS } from \"./schemas.js\";\nimport { t as ALL_PLATFORM_PERMISSIONS } from \"./types3.js\";\n// ../platform/src/access/rules.ts\n/**\n* Pure access-control rules — single source of truth for UI gating across\n* adapters. Mutating store methods MUST re-enforce the same predicate\n* independently (RLS in SQL, code in local/JSON).\n*\n* `instance_admin` bypass is not baked into rule bodies — wrap calls with\n* `withAdminBypass` at the call site.\n*/\nfunction isInstanceAdmin(platformPermissions) {\n\treturn platformPermissions.includes(\"instance_admin\");\n}\nfunction withAdminBypass(platformPermissions, rule) {\n\tif (isInstanceAdmin(platformPermissions)) return true;\n\treturn rule();\n}\n/**\n* Authenticated-user view rule. Anonymous access goes through share-link\n* tokens instead — the route resolves a valid token before this runs.\n*\n* Platform projects: `instance_admin` always passes; otherwise any grant\n* (view-only or canSolve) satisfies view access.\n*/\nfunction canView(input) {\n\tconst { project, member, orgMember, allowCrossOrgPublic, enablePlatformProjects, platformPermissions, platformGrants, actingOrgId, userId } = input;\n\tif (!project) return false;\n\tif (project.visibility === \"platform\") {\n\t\tif (!enablePlatformProjects) return false;\n\t\tif (isInstanceAdmin(platformPermissions)) return true;\n\t\treturn platformGrants.some((g) => g.granteeType === \"user\" && g.granteeId === userId || g.granteeType === \"org\" && g.granteeId === actingOrgId);\n\t}\n\tif (member !== null) return true;\n\tif (project.visibility === \"org\") return orgMember !== null && actingOrgId === project.orgId;\n\tif (project.visibility === \"public\") return allowCrossOrgPublic ? true : orgMember !== null;\n\treturn false;\n}\n/**\n* Non-platform projects: same as `canView` — kept as a separate function so\n* cost gating can diverge from view access later.\n*\n* Platform projects: `instance_admin` always passes; a view-only grant\n* satisfies `canView` but not `canSolve` — the grant needs `canSolve: true`.\n*/\nfunction canSolve(input) {\n\tconst { project, enablePlatformProjects, platformPermissions, platformGrants, actingOrgId, userId } = input;\n\tif (!project) return false;\n\tif (project.visibility === \"platform\") {\n\t\tif (!enablePlatformProjects) return false;\n\t\tif (isInstanceAdmin(platformPermissions)) return true;\n\t\treturn platformGrants.some((g) => g.canSolve && (g.granteeType === \"user\" && g.granteeId === userId || g.granteeType === \"org\" && g.granteeId === actingOrgId));\n\t}\n\treturn canView(input);\n}\n/**\n* Platform projects: `instance_admin` only (they have no member rows).\n* All other visibilities: project owner/editor.\n*/\nfunction canEdit(input) {\n\tconst { member, project, enablePlatformProjects, platformPermissions } = input;\n\tif (!project) return false;\n\tif (project.visibility === \"platform\") {\n\t\tif (!enablePlatformProjects) return false;\n\t\treturn isInstanceAdmin(platformPermissions);\n\t}\n\treturn member?.role === \"owner\" || member?.role === \"editor\";\n}\n/**\n* Adding a new definition. Commons projects (`autoJoinOnUpload`) take uploads\n* from anyone who can {@link canView} them, and the uploader owns what they\n* upload; everywhere else it needs {@link canEdit}.\n*/\nfunction canCreateDefinition(input) {\n\treturn input.project?.autoJoinOnUpload === true && canView(input) || canEdit(input);\n}\n/** Platform projects: `instance_admin` only. All other visibilities: project owner. */\nfunction canManage(input) {\n\tif (!input.project) return false;\n\tif (input.project.visibility === \"platform\") {\n\t\tif (!input.enablePlatformProjects) return false;\n\t\treturn isInstanceAdmin(input.platformPermissions);\n\t}\n\treturn input.member?.role === \"owner\";\n}\n/** Platform projects: `instance_admin` only. All other visibilities: project owner. */\nfunction canEditProjectSettings(input) {\n\treturn canManage(input);\n}\n/**\n* Authorization to flip a project to `public`. The `ALLOW_CROSS_ORG_PUBLIC`\n* flag only changes what `public` means post-flip; the flip itself is gated\n* by org owner/admin role.\n*/\nfunction canChangeVisibilityToPublic(input) {\n\tconst role = input.orgMember?.role;\n\treturn role === \"owner\" || role === \"admin\";\n}\n/**\n* For platform projects: `instance_admin` only.\n* For all other projects: project editor/owner can always edit (moderation).\n* On commons projects (`autoJoinOnUpload=true`) the definition owner can edit\n* their own, as long as they still belong to the project's org.\n*/\nfunction canEditDefinition(input) {\n\tconst { project, definition, member, orgMember, userId, platformPermissions, enablePlatformProjects } = input;\n\tif (!project || !definition) return false;\n\tif (definition.projectId !== project.id) return false;\n\tif (project.visibility === \"platform\") {\n\t\tif (!enablePlatformProjects) return false;\n\t\treturn isInstanceAdmin(platformPermissions);\n\t}\n\tif (member?.role === \"owner\" || member?.role === \"editor\") return true;\n\tif (project.autoJoinOnUpload && userId === definition.ownerId && orgMember) return true;\n\treturn false;\n}\n/**\n* Org leadership escape hatch: adds the actor as co-owner without demoting\n* the existing owner. Tenancy must match.\n*\n* Platform projects can't be reclaimed — `instance_admin` already has\n* management access to them.\n*/\nfunction canReclaim(input) {\n\tconst { project, orgMember, actingOrgId } = input;\n\tif (!project || !actingOrgId) return false;\n\tif (project.visibility === \"platform\") return false;\n\tif (actingOrgId !== project.orgId) return false;\n\tconst role = orgMember?.role;\n\treturn role === \"owner\" || role === \"admin\";\n}\n/**\n* Owner/admin can always create; a `member` needs `manage_projects` org\n* permission. Tenancy is enforced.\n*\n* Platform projects (`visibility: 'platform'`) go through the admin API,\n* gated on `instance_admin` — this rule isn't consulted for them.\n*/\nfunction canCreateProject(input) {\n\tconst { orgMember, orgPermissions, actingOrgId, targetOrgId } = input;\n\tif (actingOrgId !== targetOrgId) return false;\n\tconst role = orgMember?.role;\n\tif (role === \"owner\" || role === \"admin\") return true;\n\tif (role === \"member\" && orgPermissions.includes(\"manage_projects\")) return true;\n\treturn false;\n}\n/**\n* Whether the actor may hand out or take away org `owner`/`admin` standing.\n* Inviting someone as owner/admin, changing a member's role and removing an owner\n* are one rule, so all three read it here.\n*\n* Reads the actor's **membership row**. `Organization.ownerId` is a separate field\n* that can disagree with it and is not authority for this decision.\n*/\nfunction canChangeOrgRole(input) {\n\tif (input.role === \"member\") return true;\n\treturn input.actorMember?.role === \"owner\";\n}\nfunction checkOwnerRemoval(input) {\n\tif (input.target.role !== \"owner\") return \"ok\";\n\tif (input.allMembers.filter((m) => m.role === \"owner\").length <= 1) return \"sole_owner\";\n\tif (!input.confirmed) return \"needs_confirm\";\n\treturn \"ok\";\n}\n// ../platform/src/apiTokens/scope.ts\n/**\n* May this request perform `action` on `target`?\n*\n* Without a target this is an org-level check, which only `all` and org scopes\n* pass: a project key must never reach a route that can't say which project it\n* touches. Requests without an API token always pass; their permissions are\n* checked elsewhere.\n*/\nfunction scopeAllows(ctx, action, target) {\n\tconst api = ctx.apiScope;\n\tif (!api) return true;\n\treturn api.scopes.some((s) => apiScopeActionCovers(s.action, action) && resourceCovers(s, ctx, target));\n}\n/** Does a scope granting `granted` allow `wanted`? */\nfunction apiScopeActionCovers(granted, wanted) {\n\treturn granted === wanted || wanted === \"read\" || granted === \"write\" && wanted === \"upload\";\n}\nfunction resourceCovers(scope, ctx, target) {\n\tconst { resource } = scope;\n\tswitch (resource.kind) {\n\t\tcase \"all\": return true;\n\t\tcase \"org\": return resource.id === ctx.actingOrgId;\n\t\tcase \"project\": return target?.projectId === resource.id;\n\t\tcase \"definition\": return target?.definitionId === resource.id;\n\t}\n}\n/**\n* Narrow the owner's live context to what the token grants. Only removes\n* rights:\n*\n* - Platform permissions are dropped. Instance authority never rides on a\n*   bearer key, so an operator's leaked key can't reach other tenants.\n* - `apiScope` is attached, which `scopeAllows` reads.\n*\n* Scopes this version can't parse are dropped, so they grant nothing.\n*/\nfunction narrowApiTokenContext(ctx, token) {\n\tif (ctx.actingOrgId !== token.orgId) throw new ProviderError(\"API token context must act in the token’s org\", 500);\n\tconst scopes = token.scopes.map(parseApiScope).filter((s) => s !== null);\n\treturn {\n\t\t...ctx,\n\t\tplatformPermissions: [],\n\t\tapiScope: {\n\t\t\ttokenId: token.id,\n\t\t\tscopes,\n\t\t\texpiresAt: token.expiresAt\n\t\t}\n\t};\n}\n/**\n* True when an API-token request reaches for something owned by an org other\n* than the token's. A token is bound to one org, so that resource doesn't\n* exist for it, even when the owner belongs to the other org too. Treat it as\n* not found. Session requests are never outside.\n*/\nfunction outsideTokenOrg(ctx, orgId) {\n\treturn ctx.apiScope !== void 0 && orgId !== ctx.actingOrgId;\n}\n// ../platform/src/logging/interface.ts\n/**\n* Default `ILogger` — discards everything. Lets library code log\n* unconditionally without a configured backend, and keeps test output clean.\n* The app wires a real logger at its composition root; a consumer that wires\n* nothing gets silence rather than unsolicited stdout writes.\n*/\nvar NoopLogger = class {\n\tdebug(_message, _fields) {}\n\tinfo(_message, _fields) {}\n\twarn(_message, _fields) {}\n\terror(_message, _fields) {}\n\tchild(_fields) {\n\t\treturn this;\n\t}\n};\n// ../platform/src/config.ts\nfunction isFlagEnabled(config, flag) {\n\treturn Boolean(config.flags?.[flag]);\n}\n// ../server/src/compute/limits.ts\n/**\n* Compute/solve server limits, resolved from an injected env map.\n*\n* Env comes in as a parameter — nothing ambient is read — so this is importable\n* from any runtime and testable without env plumbing. Defaults are sized for\n* typical interactive use (sliders + small uploads).\n*\n* Client-side counterparts (the in-flight compute throttle and slider debounce)\n* are bundled into the client in `@selvajs/ui` and can't read env — they carry\n* their own defaults.\n*/\nvar MB = 1048576;\n/**\n* Default logger for the env-parsing warnings below. This is library code, so an\n* embedder that wires nothing gets silence rather than unsolicited stdout writes.\n*/\nvar noop = new NoopLogger();\n/** Parse a positive integer env value; absent, or present but not finite and positive, falls back. */\nfunction readPositiveInt(env, name, fallback, logger = noop) {\n\tconst raw = env[name];\n\tif (!raw) return fallback;\n\tconst parsed = Number(raw);\n\tif (!Number.isFinite(parsed) || parsed <= 0) {\n\t\tlogger.warn(\"Invalid env value, falling back to default\", {\n\t\t\tcomponent: \"selva\",\n\t\t\tenvVar: name,\n\t\t\tvalue: raw,\n\t\t\tfallback\n\t\t});\n\t\treturn fallback;\n\t}\n\treturn Math.floor(parsed);\n}\n/** Like {@link readPositiveInt}, but `0` is valid — knobs where it means \"disable\". */\nfunction readNonNegativeInt(env, name, fallback, logger = noop) {\n\tconst raw = env[name];\n\tif (!raw) return fallback;\n\tconst parsed = Number(raw);\n\tif (!Number.isFinite(parsed) || parsed < 0) {\n\t\tlogger.warn(\"Invalid env value, falling back to default\", {\n\t\t\tcomponent: \"selva\",\n\t\t\tenvVar: name,\n\t\t\tvalue: raw,\n\t\t\tfallback\n\t\t});\n\t\treturn fallback;\n\t}\n\treturn Math.floor(parsed);\n}\n/**\n* Fall back to a variable's previous name, warning when the old one is used.\n* Setting both is not an error: the new name wins silently, which is what an\n* operator mid-migration expects.\n*\n* A var that quietly stops being read looks exactly like one that is working —\n* the failure only surfaces as a memory number nobody is watching.\n*/\nfunction readRenamed(env, name, oldName, logger) {\n\tif (env[name] !== void 0 || env[oldName] === void 0) return env;\n\tlogger.warn(\"Deprecated env var: rename it\", {\n\t\tcomponent: \"selva\",\n\t\tenvVar: oldName,\n\t\trenamedTo: name\n\t});\n\treturn {\n\t\t...env,\n\t\t[name]: env[oldName]\n\t};\n}\n/**\n* Parse a boolean env flag. Accepts `true/1/yes/on` and `false/0/no/off`\n* (case-insensitive); any other spelling warns and falls back.\n*/\nfunction readBool(env, name, fallback, logger = noop) {\n\tconst raw = env[name];\n\tif (raw == null || raw === \"\") return fallback;\n\tconst v = raw.trim().toLowerCase();\n\tif (v === \"true\" || v === \"1\" || v === \"yes\" || v === \"on\") return true;\n\tif (v === \"false\" || v === \"0\" || v === \"no\" || v === \"off\") return false;\n\tlogger.warn(\"Invalid env value, falling back to default\", {\n\t\tcomponent: \"selva\",\n\t\tenvVar: name,\n\t\tvalue: raw,\n\t\tfallback\n\t});\n\treturn fallback;\n}\n/**\n* Resolve every server-side compute limit from an env map. The app calls this\n* once at its composition root with `$env/dynamic/private`.\n*/\nfunction resolveComputeLimits(env, logger = noop) {\n\tenv = readRenamed(env, \"COMPUTE_DEFINITION_CACHE_MB\", \"COMPUTE_DEFINITION_BYTE_CACHE_MB\", logger);\n\tenv = readRenamed(env, \"COMPUTE_SOLVE_CACHE_MB\", \"COMPUTE_RESPONSE_CACHE_MB\", logger);\n\tenv = readRenamed(env, \"REMOTE_DEFINITION_CACHE_TTL_MS\", \"DEFINITION_CACHE_TTL_MS\", logger);\n\tenv = readRenamed(env, \"COMPUTE_SOLVE_DEADLINE_MS\", \"MAX_SOLVE_DURATION_MS\", logger);\n\tconst maxDefinitionFileSize = readPositiveInt(env, \"MAX_DEFINITION_FILE_SIZE_BYTES\", 50 * MB, logger);\n\treturn {\n\t\tsolveDeadlineMs: readPositiveInt(env, \"COMPUTE_SOLVE_DEADLINE_MS\", 1e5, logger),\n\t\trateLimitWindowMs: readPositiveInt(env, \"COMPUTE_RATE_LIMIT_WINDOW_MS\", 1e5, logger),\n\t\trateLimitMaxRequests: readPositiveInt(env, \"COMPUTE_RATE_LIMIT_MAX\", 120, logger),\n\t\tmaxDefinitionFileSize,\n\t\tmaxImageFileSize: readPositiveInt(env, \"MAX_IMAGE_FILE_SIZE_BYTES\", 10 * MB, logger),\n\t\tcomputeRequestMaxBytes: readPositiveInt(env, \"COMPUTE_REQUEST_MAX_BYTES\", 256 * MB, logger),\n\t\tcomputeResponseMaxBytes: readPositiveInt(env, \"COMPUTE_RESPONSE_MAX_BYTES\", 300 * MB, logger),\n\t\tremoteDefinitionMaxBytes: maxDefinitionFileSize,\n\t\tremoteDefinitionFetchTimeoutMs: readPositiveInt(env, \"REMOTE_DEFINITION_FETCH_TIMEOUT_MS\", 3e4, logger),\n\t\tremoteDefinitionCacheTtlMs: readPositiveInt(env, \"REMOTE_DEFINITION_CACHE_TTL_MS\", 3e5, logger),\n\t\tcomputeReuseDefinitionCache: readBool(env, \"COMPUTE_REUSE_DEFINITION_CACHE\", true, logger),\n\t\tcomputeServerCachesolve: readBool(env, \"COMPUTE_SERVER_CACHESOLVE\", true, logger),\n\t\tcomputeMaxQueueDepth: readNonNegativeInt(env, \"COMPUTE_MAX_QUEUE_DEPTH\", 0, logger),\n\t\tcomputeQueueWaitMs: readNonNegativeInt(env, \"COMPUTE_QUEUE_WAIT_MS\", 0, logger),\n\t\tcomputeDefinitionCacheBytes: readNonNegativeInt(env, \"COMPUTE_DEFINITION_CACHE_MB\", 256, logger) * MB,\n\t\tcomputeSolveCacheBytes: readNonNegativeInt(env, \"COMPUTE_SOLVE_CACHE_MB\", 256, logger) * MB\n\t};\n}\n// ../server/src/api/errors.ts\n/**\n* The transport-free error type every API handler raises.\n*\n* `apiError` used to throw SvelteKit's `error()` directly, which welded all 151\n* of its call sites to one framework. `ApiError` carries the same envelope as a\n* plain exception; the host adapter converts it to whatever its framework\n* expects (see `toApiResponse`). Call sites are unchanged — only the throw\n* site and the boundary know the difference.\n*/\n/** Stable, machine-readable error codes. Append-only — never renumber/rename. */\nvar ApiErrorCode = {\n\tVALIDATION_FAILED: \"VALIDATION_FAILED\",\n\tUNAUTHORIZED: \"UNAUTHORIZED\",\n\tFORBIDDEN: \"FORBIDDEN\",\n\tNOT_FOUND: \"NOT_FOUND\",\n\tCONFLICT: \"CONFLICT\",\n\tUNPROCESSABLE: \"UNPROCESSABLE\",\n\tCOMPUTE_UNAVAILABLE: \"COMPUTE_UNAVAILABLE\",\n\tSETUP_REQUIRED: \"SETUP_REQUIRED\",\n\tINTERNAL: \"INTERNAL\",\n\t/** API tokens are switched off or misconfigured here; browser sessions still work. */\n\tAPI_TOKENS_UNAVAILABLE: \"API_TOKENS_UNAVAILABLE\",\n\t/** Too many requests, or a share link's solve cap is spent. `Retry-After`, when sent, says when to retry. */\n\tRATE_LIMITED: \"RATE_LIMITED\",\n\t/** The key is valid, but the host's holder policy no longer lets its owner hold API tokens. */\n\tAPI_TOKEN_HOLDER_REFUSED: \"API_TOKEN_HOLDER_REFUSED\"\n};\nvar ApiError = class extends Error {\n\tstatus;\n\tcode;\n\t/** Per-field validation messages, keyed by dotted path. Only on VALIDATION_FAILED. */\n\tfields;\n\t/** Machine-readable context, e.g. `requiredScope` on a scope refusal. */\n\tdetails;\n\tconstructor(status, code, message, fields, details) {\n\t\tsuper(message);\n\t\tthis.name = \"ApiError\";\n\t\tthis.status = status;\n\t\tthis.code = code;\n\t\tthis.fields = fields;\n\t\tthis.details = details;\n\t}\n};\nfunction toErrorBody(err) {\n\tconst body = {\n\t\tmessage: err.message,\n\t\tcode: err.code\n\t};\n\tif (err.fields) body.fields = err.fields;\n\tif (err.details) body.details = err.details;\n\treturn body;\n}\nfunction isApiError(err) {\n\treturn err instanceof ApiError;\n}\n/** Raise a structured API error. The only way handlers should fail. */\nfunction apiError(status, code, message, fields, details) {\n\tthrow new ApiError(status, code, message, fields, details);\n}\n/** Default code for a status, for mapping errors that carry no code of their own. */\nfunction codeForStatus(status) {\n\tswitch (status) {\n\t\tcase 400: return ApiErrorCode.VALIDATION_FAILED;\n\t\tcase 401: return ApiErrorCode.UNAUTHORIZED;\n\t\tcase 403: return ApiErrorCode.FORBIDDEN;\n\t\tcase 404: return ApiErrorCode.NOT_FOUND;\n\t\tcase 409: return ApiErrorCode.CONFLICT;\n\t\tcase 422: return ApiErrorCode.UNPROCESSABLE;\n\t\tcase 429: return ApiErrorCode.RATE_LIMITED;\n\t\tcase 503: return ApiErrorCode.COMPUTE_UNAVAILABLE;\n\t\tdefault: return ApiErrorCode.INTERNAL;\n\t}\n}\n// ../server/src/access/project-access-input.ts\nfunction createProjectAccessInputBuilder(deps) {\n\treturn {\n\t\tasync buildProjectAccessInput(ctx, project, overrides = {}) {\n\t\t\tconst { allowCrossOrgPublic, enablePlatformProjects } = deps.flags();\n\t\t\tlet member = null;\n\t\t\tlet orgMember = null;\n\t\t\tlet platformGrants = [];\n\t\t\tif (project.visibility === \"platform\") {\n\t\t\t\tif (enablePlatformProjects) platformGrants = await deps.listPlatformGrants(ctx, project.id);\n\t\t\t} else if (project.visibility === \"private\") member = await deps.getProjectMember(ctx, project.id, ctx.userId);\n\t\t\telse {\n\t\t\t\tconst skipOrgMember = project.visibility === \"public\" && allowCrossOrgPublic;\n\t\t\t\t[member, orgMember] = await Promise.all([deps.getProjectMember(ctx, project.id, ctx.userId), skipOrgMember ? Promise.resolve(null) : deps.getOrgMember(ctx, project.orgId, ctx.userId)]);\n\t\t\t}\n\t\t\treturn {\n\t\t\t\torgPermissions: ctx.orgPermissions,\n\t\t\t\tplatformPermissions: ctx.platformPermissions,\n\t\t\t\tproject,\n\t\t\t\tmember,\n\t\t\t\torgMember,\n\t\t\t\tallowCrossOrgPublic,\n\t\t\t\tenablePlatformProjects,\n\t\t\t\tplatformGrants,\n\t\t\t\tactingOrgId: ctx.actingOrgId ?? null,\n\t\t\t\tuserId: ctx.userId,\n\t\t\t\t...overrides\n\t\t\t};\n\t\t},\n\t\tprojectAccessInputFromRows(ctx, project, rows) {\n\t\t\tconst { allowCrossOrgPublic, enablePlatformProjects } = deps.flags();\n\t\t\treturn {\n\t\t\t\torgPermissions: ctx.orgPermissions,\n\t\t\t\tplatformPermissions: ctx.platformPermissions,\n\t\t\t\tproject,\n\t\t\t\tmember: rows.member ?? null,\n\t\t\t\torgMember: rows.orgMember ?? null,\n\t\t\t\tallowCrossOrgPublic,\n\t\t\t\tenablePlatformProjects,\n\t\t\t\tplatformGrants: rows.platformGrants ?? [],\n\t\t\t\tactingOrgId: ctx.actingOrgId ?? null,\n\t\t\t\tuserId: ctx.userId\n\t\t\t};\n\t\t}\n\t};\n}\n// ../server/src/access/guards.ts\n/**\n* Derive the stores a guard needs from a resolved config.\n*\n* Pure — it reads the config it is handed and nothing else, which is what keeps\n* this module free of any import that boots the app. Page loads pass\n* `locals.providers`; `hooks.server.ts` sets it on every request.\n*/\nfunction accessDepsFromConfig(config) {\n\treturn {\n\t\torgs: config.data.orgs,\n\t\tprojects: config.data.projects,\n\t\tdefinitionMeta: config.data.definitions,\n\t\tplatformProjectGrants: config.data.platformProjectGrants,\n\t\tflag: (name) => isFlagEnabled(config, name)\n\t};\n}\n/** `locals` as a store-reading guard wants it. */\nfunction scoped(locals) {\n\treturn {\n\t\t...locals,\n\t\tdeps: accessDepsFromConfig(locals.providers)\n\t};\n}\nvar orgsOf = (src) => src.deps.orgs;\nvar projectsOf = (src) => src.deps.projects;\nvar definitionMetaOf = (src) => src.deps.definitionMeta;\nvar flagOf = (src) => src.deps.flag;\nfunction requireAuthed(locals) {\n\tconst { user, ctx } = locals;\n\tif (!user || !ctx) apiError(401, ApiErrorCode.UNAUTHORIZED, \"Unauthorized\");\n\treturn {\n\t\tuser,\n\t\tctx\n\t};\n}\n/** Throws 403 — use in API routes. */\nfunction requirePermission(locals, permission) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tif (!hasPermission(ctx, permission)) apiError(403, ApiErrorCode.FORBIDDEN, `You don't have permission to do this.`);\n\treturn user;\n}\nvar requireManageInstanceUsers = (locals) => requirePermission(locals, \"manage_instance_users\");\nvar requireManageCompute = (locals) => requirePermission(locals, \"manage_compute\");\nvar requireManageOrgMembers = (locals) => requirePermission(locals, \"manage_org_members\");\nvar requireManageOrgCompute = (locals) => requirePermission(locals, \"manage_org_compute\");\nvar requireInstanceAdmin = (locals) => requirePermission(locals, \"instance_admin\");\n/**\n* Platform scope is not delegable: `manage_instance_users` runs the user-admin\n* surface but must not be able to mint an `instance_admin`, or an org admin\n* holding it self-elevates. Three routes write platform permissions — the two\n* `/api/admin/users` handlers and the invite mint route — and each carried its\n* own copy of this check.\n*\n* Pass `current` on an update. Revoking is a platform-scope change too, so a\n* PATCH that drops `instance_admin` is refused for the same reason granting it\n* is; without `current` the caller is creating (a user, an invite) and there is\n* nothing to compare against.\n*\n* Requesting nothing on a create is always allowed — that is a\n* `manage_instance_users` operation, not a platform-scope one.\n*/\nfunction assertCanGrantPlatformPermissions(ctx, requested, current) {\n\tif (!(current ? requested.length !== current.length || requested.some((p) => !current.includes(p)) || current.some((p) => !requested.includes(p)) : requested.length > 0)) return;\n\tif (hasPermission(ctx, \"instance_admin\")) return;\n\tapiError(403, ApiErrorCode.FORBIDDEN, current ? \"Only a platform admin can change platform-scope permissions\" : \"Only a platform admin can grant platform-scope permissions\");\n}\n/**\n* Tenancy gate for `/api/v1/orgs/{orgId}/…`. The URL id is never trusted alone\n* — the acting context decides which tenant a request applies to, so a\n* mismatch is 403 rather than a silent read of the caller's own org.\n*/\nfunction requireActingOrg(locals, orgId) {\n\tconst ctx = locals.ctx;\n\tif (!ctx) apiError(401, ApiErrorCode.UNAUTHORIZED, \"Unauthorized\");\n\tif (!orgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing org ID\");\n\tif (!ctx.actingOrgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"No active organization\");\n\tif (ctx.actingOrgId !== orgId) apiError(403, ApiErrorCode.FORBIDDEN, \"Acting org does not match the target org.\");\n\treturn {\n\t\tctx,\n\t\torgId\n\t};\n}\n/**\n* Gate for pages reachable by any platform-class permission holder (the\n\n/**\n* Management-scope bypass — used for org governance and project management\n* actions (Reclaim, create project, delete project, manage members, edit\n* settings). `instance_admin` bypasses these so platform staff can administer\n* the instance without being a member of every org.\n*\n* NOT used for content access (view, solve, edit definitions):\n* `instance_admin` follows the same `canView`/`canEdit` rules as any other\n* user there, keeping blast radius small and forcing content escalation\n* through Reclaim, which leaves an audit trail.\n*/\nasync function managementBypassOrRun(ctx, check) {\n\tif (hasPermission(ctx, \"instance_admin\")) return true;\n\treturn await check();\n}\nasync function contentCheck(check) {\n\treturn await check();\n}\nfunction managementBypassForProject(ctx, project, src, check) {\n\tif (project.visibility === \"platform\" && !flagOf(src)(\"ENABLE_PLATFORM_PROJECTS\")) return check();\n\treturn managementBypassOrRun(ctx, check);\n}\nasync function loadProjectOr404(ctx, projectId, src) {\n\tconst project = await projectsOf(src).getProject(ctx, projectId);\n\tif (!project || outsideTokenOrg(ctx, project.orgId)) apiError(404, ApiErrorCode.NOT_FOUND, \"Project not found\");\n\treturn project;\n}\nfunction accessInputsFor(src) {\n\tconst readFlag = flagOf(src);\n\treturn createProjectAccessInputBuilder({\n\t\tgetProjectMember: (ctx, projectId, userId) => projectsOf(src).getProjectMember(ctx, projectId, userId),\n\t\tgetOrgMember: (ctx, orgId, userId) => orgsOf(src).getOrgMember(ctx, orgId, userId),\n\t\tlistPlatformGrants: (ctx, projectId) => src.deps.platformProjectGrants.listByProject(ctx, projectId),\n\t\tflags: () => ({\n\t\t\tallowCrossOrgPublic: readFlag(\"ALLOW_CROSS_ORG_PUBLIC\"),\n\t\t\tenablePlatformProjects: readFlag(\"ENABLE_PLATFORM_PROJECTS\")\n\t\t})\n\t});\n}\nfunction buildProjectAccessInput(ctx, project, src, overrides) {\n\treturn accessInputsFor(src).buildProjectAccessInput(ctx, project, overrides);\n}\n/**\n* Assemble a rule input from rows the caller already loaded.\n*\n* Unlike the other builders this one issues no reads — the caller batched them.\n* It still needs `deps` for the flag lookups, which decide whether a\n* cross-org-public or platform project is visible at all.\n*/\nfunction projectAccessInputFromRowsWith(src, ...args) {\n\treturn accessInputsFor(src).projectAccessInputFromRows(...args);\n}\n/**\n* Gates creation of a *new* definition. Container projects require project\n* owner/editor (canEdit). Commons projects (`autoJoinOnUpload=true`) accept\n* any authenticated user — the handler stamps `ownerId = user.id` so the\n* uploader becomes the owner.\n*/\nasync function requireCanCreateDefinition(locals, projectId) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tconst project = await loadProjectOr404(ctx, projectId, locals);\n\tif (!await contentCheck(async () => canCreateDefinition(await buildProjectAccessInput(ctx, project, locals)))) apiError(403, ApiErrorCode.FORBIDDEN, \"You do not have permission to upload definitions to this project.\");\n\treturn {\n\t\tuser,\n\t\tctx,\n\t\tproject\n\t};\n}\n/**\n* Project members must belong to the project's parent org. Enforced at the\n* rule layer, not as a DB constraint, to leave room for cross-org guests\n* later without a schema migration.\n*/\nasync function requireTargetIsOrgMember(locals, orgId, targetUserId) {\n\tconst { ctx } = requireAuthed(locals);\n\tif (!await orgsOf(locals).getOrgMember(ctx, orgId, targetUserId)) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"User must be a member of this organization to be added to a project.\");\n}\n/**\n* `canChangeOrgRole` with the actor's membership row loaded — whether the\n* caller may grant or revoke org `owner`/`admin` standing (§3).\n*\n* Returns rather than throws: the three callers each phrase the refusal for\n* what they were doing (\"invite someone as owner\", \"change roles\", \"remove\n* another owner\") and raise it through `apiError`. What must not diverge is the\n* decision, which is why that half lives in `rules.ts` and this loads its input.\n*/\nasync function canActorChangeOrgRole(ctx, orgId, role, src) {\n\tif (role === \"member\") return true;\n\treturn canChangeOrgRole({\n\t\tactorMember: await orgsOf(src).getOrgMember(ctx, orgId, ctx.userId),\n\t\trole\n\t});\n}\n/**\n* `canReclaim` — org owner/admin escape hatch. Returns the project so the\n* handler can use its `orgId` without re-fetching.\n*/\nasync function requireCanReclaim(locals, projectId) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tconst visible = await projectsOf(locals).getProject(ctx, projectId);\n\tconst project = visible ?? await projectsOf(locals).getProject(SYSTEM_CONTEXT, projectId);\n\tif (!project || outsideTokenOrg(ctx, project.orgId) || !visible && project.orgId !== ctx.actingOrgId) apiError(404, ApiErrorCode.NOT_FOUND, \"Project not found\");\n\tif (project.visibility === \"platform\") apiError(403, ApiErrorCode.FORBIDDEN, \"Platform projects cannot be reclaimed.\");\n\tif (!await managementBypassOrRun(ctx, async () => {\n\t\tconst orgMember = await orgsOf(locals).getOrgMember(ctx, project.orgId, ctx.userId);\n\t\treturn canReclaim({\n\t\t\tproject,\n\t\t\torgMember,\n\t\t\tactingOrgId: ctx.actingOrgId ?? null\n\t\t});\n\t})) {\n\t\tif (!visible) apiError(404, ApiErrorCode.NOT_FOUND, \"Project not found\");\n\t\tapiError(403, ApiErrorCode.FORBIDDEN, \"Only org owners or admins of this project’s org can reclaim it.\");\n\t}\n\treturn {\n\t\tuser,\n\t\tctx,\n\t\tproject\n\t};\n}\n/**\n* `canCreateProject` — owner/admin always; member needs `manage_projects`.\n* Tenancy is enforced via `actingOrgId`.\n*/\nasync function requireCanCreateProject(locals, targetOrgId) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tif (!await managementBypassOrRun(ctx, async () => {\n\t\tconst orgMember = await orgsOf(locals).getOrgMember(ctx, targetOrgId, ctx.userId);\n\t\treturn canCreateProject({\n\t\t\torgPermissions: ctx.orgPermissions,\n\t\t\torgMember,\n\t\t\tactingOrgId: ctx.actingOrgId ?? null,\n\t\t\ttargetOrgId\n\t\t});\n\t})) apiError(403, ApiErrorCode.FORBIDDEN, \"You do not have permission to create projects in this org.\");\n\treturn {\n\t\tuser,\n\t\tctx\n\t};\n}\n/**\n* Project-management gate (`canManage` — owner, or `instance_admin` via the\n* bypass). Managing members is the same authority as managing the project, so\n* both callers share this; `action` only shapes the 403 message.\n*/\nasync function requireCanManage(locals, projectId, action = \"project\") {\n\tconst { user, ctx } = requireAuthed(locals);\n\tconst project = await loadProjectOr404(ctx, projectId, locals);\n\tif (!await managementBypassForProject(ctx, project, locals, async () => canManage(await buildProjectAccessInput(ctx, project, locals)))) apiError(403, ApiErrorCode.FORBIDDEN, action === \"members\" ? \"Only project owners can manage members.\" : \"Only project owners can manage this project.\");\n\treturn user;\n}\nasync function requireCanEditProjectSettings(locals, projectId) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tconst project = await loadProjectOr404(ctx, projectId, locals);\n\tif (!await managementBypassForProject(ctx, project, locals, async () => canEditProjectSettings(await buildProjectAccessInput(ctx, project, locals)))) apiError(403, ApiErrorCode.FORBIDDEN, \"Only project owners can edit project settings.\");\n\treturn {\n\t\tuser,\n\t\tctx,\n\t\tproject\n\t};\n}\nasync function requireCanViewProject(locals, projectId) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tif (!await contentCheck(async () => {\n\t\tconst project = await loadProjectOr404(ctx, projectId, locals);\n\t\treturn canView(await buildProjectAccessInput(ctx, project, locals));\n\t})) apiError(403, ApiErrorCode.FORBIDDEN, \"You do not have access to this project.\");\n\treturn user;\n}\n/**\n* Solve gating. Today `canSolve === canView` for non-platform projects, but\n* the rule lives in its own function so future cost-gating (quotas, rate\n* limits) lands without touching view semantics. `viewer` project role\n* passes; platform projects narrow to grants with `canSolve=true`.\n*/\nasync function requireCanSolve(locals, projectId, preloadedProject) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tconst project = preloadedProject ?? await loadProjectOr404(ctx, projectId, locals);\n\tif (outsideTokenOrg(ctx, project.orgId)) apiError(404, ApiErrorCode.NOT_FOUND, \"Project not found\");\n\tif (!await contentCheck(async () => canSolve(await buildProjectAccessInput(ctx, project, locals)))) apiError(403, ApiErrorCode.FORBIDDEN, \"You do not have access to this project.\");\n\treturn {\n\t\tuser,\n\t\tctx,\n\t\tproject\n\t};\n}\n/**\n* Org membership for the commons branch of `canEditDefinition`, or `null` when\n* that branch cannot fire. Skipping the round-trip on container projects keeps\n* the common edit path at the same two reads it had before commons gained the\n* membership test.\n*/\nasync function loadCommonsOrgMember(ctx, project, src) {\n\tif (!project?.autoJoinOnUpload) return null;\n\treturn await orgsOf(src).getOrgMember(ctx, project.orgId, ctx.userId);\n}\n/**\n* Loads the record and gates editing. Returns the record AND the project it\n* loads for the gate, so callers skip a re-fetch of either.\n*/\nasync function requireEditableDefinition(locals, guid) {\n\tconst { ctx } = requireAuthed(locals);\n\tconst record = await definitionMetaOf(locals).get(ctx, guid);\n\tif (!record) apiError(404, ApiErrorCode.NOT_FOUND, \"Definition not found\");\n\tconst [project, member] = await Promise.all([projectsOf(locals).getProject(ctx, record.projectId), projectsOf(locals).getProjectMember(ctx, record.projectId, ctx.userId)]);\n\tif (project && outsideTokenOrg(ctx, project.orgId)) apiError(404, ApiErrorCode.NOT_FOUND, \"Definition not found\");\n\tif (!await contentCheck(async () => canEditDefinition({\n\t\tproject,\n\t\tdefinition: record,\n\t\tmember,\n\t\torgMember: await loadCommonsOrgMember(ctx, project, locals),\n\t\tuserId: ctx.userId,\n\t\tplatformPermissions: ctx.platformPermissions,\n\t\tenablePlatformProjects: flagOf(locals)(\"ENABLE_PLATFORM_PROJECTS\")\n\t}))) apiError(403, ApiErrorCode.FORBIDDEN, \"You do not have permission to edit this definition.\");\n\treturn {\n\t\trecord,\n\t\tctx,\n\t\tproject\n\t};\n}\nasync function requireCanEditDefinition(locals, projectId, definitionGuid, preloaded) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tif (!await contentCheck(async () => {\n\t\tconst [project, definition, member] = await Promise.all([\n\t\t\tpreloaded?.project !== void 0 ? Promise.resolve(preloaded.project) : projectsOf(locals).getProject(ctx, projectId),\n\t\t\tpreloaded?.definition !== void 0 ? Promise.resolve(preloaded.definition) : definitionMetaOf(locals).get(ctx, definitionGuid),\n\t\t\tprojectsOf(locals).getProjectMember(ctx, projectId, ctx.userId)\n\t\t]);\n\t\tif (project && outsideTokenOrg(ctx, project.orgId)) return false;\n\t\treturn canEditDefinition({\n\t\t\tproject,\n\t\t\tdefinition,\n\t\t\tmember,\n\t\t\torgMember: await loadCommonsOrgMember(ctx, project, locals),\n\t\t\tuserId: ctx.userId,\n\t\t\tplatformPermissions: ctx.platformPermissions,\n\t\t\tenablePlatformProjects: flagOf(locals)(\"ENABLE_PLATFORM_PROJECTS\")\n\t\t});\n\t})) apiError(403, ApiErrorCode.FORBIDDEN, \"You do not have permission to edit this definition.\");\n\treturn user;\n}\n// ../server/src/access/permissions-scope.ts\nvar PLATFORM_SET = new Set(ALL_PLATFORM_PERMISSIONS);\nvar ORG_SET = new Set(ALL_ORG_PERMISSIONS);\n/** Split a flat array into platform + org scope buckets, dropping unknowns. */\nfunction splitFlatPermissions(flat) {\n\tconst platform = [];\n\tconst org = [];\n\tfor (const p of flat) if (PLATFORM_SET.has(p)) platform.push(p);\n\telse if (ORG_SET.has(p)) org.push(p);\n\treturn {\n\t\tplatform,\n\t\torg\n\t};\n}\nexport { isApiError as A, outsideTokenOrg as B, requireTargetIsOrgMember as C, ApiErrorCode as D, ApiError as E, resolveComputeLimits as F, canEdit as G, canChangeOrgRole as H, isFlagEnabled as I, canSolve as J, canEditDefinition as K, NoopLogger as L, readBool as M, readNonNegativeInt as N, apiError as O, readPositiveInt as P, apiScopeActionCovers as R, requirePermission as S, createProjectAccessInputBuilder as T, canChangeVisibilityToPublic as U, scopeAllows as V, canCreateDefinition as W, checkOwnerRemoval as X, canView as Y, withAdminBypass as Z, requireInstanceAdmin as _, projectAccessInputFromRowsWith as a, requireManageOrgCompute as b, requireCanCreateDefinition as c, requireCanEditProjectSettings as d, requireCanManage as f, requireEditableDefinition as g, requireCanViewProject as h, canActorChangeOrgRole as i, toErrorBody as j, codeForStatus as k, requireCanCreateProject as l, requireCanSolve as m, accessDepsFromConfig as n, requireActingOrg as o, requireCanReclaim as p, canManage as q, assertCanGrantPlatformPermissions as r, requireAuthed as s, splitFlatPermissions as t, requireCanEditDefinition as u, requireManageCompute as v, scoped as w, requireManageOrgMembers as x, requireManageInstanceUsers as y, narrowApiTokenContext as z };\n"],"names":[],"mappings":";;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,eAAe,CAAC,mBAAmB,EAAE;AAC9C,CAAC,OAAO,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC;AACtD;AACA,SAAS,eAAe,CAAC,mBAAmB,EAAE,IAAI,EAAE;AACpD,CAAC,IAAI,eAAe,CAAC,mBAAmB,CAAC,EAAE,OAAO,IAAI;AACtD,CAAC,OAAO,IAAI,EAAE;AACd;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,OAAO,CAAC,KAAK,EAAE;AACxB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,KAAK;AACpJ,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,KAAK;AAC3B,CAAC,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE;AACxC,EAAE,IAAI,CAAC,sBAAsB,EAAE,OAAO,KAAK;AAC3C,EAAE,IAAI,eAAe,CAAC,mBAAmB,CAAC,EAAE,OAAO,IAAI;AACvD,EAAE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,KAAK,IAAI,CAAC,CAAC,SAAS,KAAK,WAAW,CAAC;AACjJ,CAAC;AACD,CAAC,IAAI,MAAM,KAAK,IAAI,EAAE,OAAO,IAAI;AACjC,CAAC,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,EAAE,OAAO,SAAS,KAAK,IAAI,IAAI,WAAW,KAAK,OAAO,CAAC,KAAK;AAC7F,CAAC,IAAI,OAAO,CAAC,UAAU,KAAK,QAAQ,EAAE,OAAO,mBAAmB,GAAG,IAAI,GAAG,SAAS,KAAK,IAAI;AAC5F,CAAC,OAAO,KAAK;AACb;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,QAAQ,CAAC,KAAK,EAAE;AACzB,CAAC,MAAM,EAAE,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,KAAK;AAC5G,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,KAAK;AAC3B,CAAC,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE;AACxC,EAAE,IAAI,CAAC,sBAAsB,EAAE,OAAO,KAAK;AAC3C,EAAE,IAAI,eAAe,CAAC,mBAAmB,CAAC,EAAE,OAAO,IAAI;AACvD,EAAE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,KAAK,IAAI,CAAC,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC;AACjK,CAAC;AACD,CAAC,OAAO,OAAO,CAAC,KAAK,CAAC;AACtB;AACA;AACA;AACA;AACA;AACA,SAAS,OAAO,CAAC,KAAK,EAAE;AACxB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,GAAG,KAAK;AAC/E,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,KAAK;AAC3B,CAAC,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE;AACxC,EAAE,IAAI,CAAC,sBAAsB,EAAE,OAAO,KAAK;AAC3C,EAAE,OAAO,eAAe,CAAC,mBAAmB,CAAC;AAC7C,CAAC;AACD,CAAC,OAAO,MAAM,EAAE,IAAI,KAAK,OAAO,IAAI,MAAM,EAAE,IAAI,KAAK,QAAQ;AAC7D;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE;AACpC,CAAC,OAAO,KAAK,CAAC,OAAO,EAAE,gBAAgB,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC;AACpF;AACA;AACA,SAAS,SAAS,CAAC,KAAK,EAAE;AAC1B,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,KAAK;AACjC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE;AAC9C,EAAE,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,OAAO,KAAK;AACjD,EAAE,OAAO,eAAe,CAAC,KAAK,CAAC,mBAAmB,CAAC;AACnD,CAAC;AACD,CAAC,OAAO,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,OAAO;AACtC;AACA;AACA,SAAS,sBAAsB,CAAC,KAAK,EAAE;AACvC,CAAC,OAAO,SAAS,CAAC,KAAK,CAAC;AACxB;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,2BAA2B,CAAC,KAAK,EAAE;AAC5C,CAAC,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,EAAE,IAAI;AACnC,CAAC,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO;AAC5C;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,KAAK,EAAE;AAClC,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,GAAG,KAAK;AAC9G,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,EAAE,OAAO,KAAK;AAC1C,CAAC,IAAI,UAAU,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,EAAE,OAAO,KAAK;AACtD,CAAC,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE;AACxC,EAAE,IAAI,CAAC,sBAAsB,EAAE,OAAO,KAAK;AAC3C,EAAE,OAAO,eAAe,CAAC,mBAAmB,CAAC;AAC7C,CAAC;AACD,CAAC,IAAI,MAAM,EAAE,IAAI,KAAK,OAAO,IAAI,MAAM,EAAE,IAAI,KAAK,QAAQ,EAAE,OAAO,IAAI;AACvE,CAAC,IAAI,OAAO,CAAC,gBAAgB,IAAI,MAAM,KAAK,UAAU,CAAC,OAAO,IAAI,SAAS,EAAE,OAAO,IAAI;AACxF,CAAC,OAAO,KAAK;AACb;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,UAAU,CAAC,KAAK,EAAE;AAC3B,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,KAAK;AAClD,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,EAAE,OAAO,KAAK;AAC3C,CAAC,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,OAAO,KAAK;AACpD,CAAC,IAAI,WAAW,KAAK,OAAO,CAAC,KAAK,EAAE,OAAO,KAAK;AAChD,CAAC,MAAM,IAAI,GAAG,SAAS,EAAE,IAAI;AAC7B,CAAC,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO;AAC5C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,CAAC,KAAK,EAAE;AACjC,CAAC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,KAAK;AACtE,CAAC,IAAI,WAAW,KAAK,WAAW,EAAE,OAAO,KAAK;AAC9C,CAAC,MAAM,IAAI,GAAG,SAAS,EAAE,IAAI;AAC7B,CAAC,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,OAAO,IAAI;AACtD,CAAC,IAAI,IAAI,KAAK,QAAQ,IAAI,cAAc,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,IAAI;AACjF,CAAC,OAAO,KAAK;AACb;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,CAAC,KAAK,EAAE;AACjC,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,OAAO,IAAI;AACzC,CAAC,OAAO,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,OAAO;AAC3C;AACA,SAAS,iBAAiB,CAAC,KAAK,EAAE;AAClC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,OAAO,IAAI;AAC/C,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,OAAO,YAAY;AACxF,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,eAAe;AAC7C,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE;AAC1C,CAAC,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ;AACzB,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,IAAI;AACtB,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,oBAAoB,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,cAAc,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;AACxG;AACA;AACA,SAAS,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE;AAC/C,CAAC,OAAO,OAAO,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM,IAAI,OAAO,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ;AAC7F;AACA,SAAS,cAAc,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE;AAC5C,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK;AAC3B,CAAC,QAAQ,QAAQ,CAAC,IAAI;AACtB,EAAE,KAAK,KAAK,EAAE,OAAO,IAAI;AACzB,EAAE,KAAK,KAAK,EAAE,OAAO,QAAQ,CAAC,EAAE,KAAK,GAAG,CAAC,WAAW;AACpD,EAAE,KAAK,SAAS,EAAE,OAAO,MAAM,EAAE,SAAS,KAAK,QAAQ,CAAC,EAAE;AAC1D,EAAE,KAAK,YAAY,EAAE,OAAO,MAAM,EAAE,YAAY,KAAK,QAAQ,CAAC,EAAE;AAChE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE;AAC3C,CAAC,IAAI,GAAG,CAAC,WAAW,KAAK,KAAK,CAAC,KAAK,EAAE,MAAM,IAAI,aAAa,CAAC,+CAA+C,EAAE,GAAG,CAAC;AACnH,CAAC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AACzE,CAAC,OAAO;AACR,EAAE,GAAG,GAAG;AACR,EAAE,mBAAmB,EAAE,EAAE;AACzB,EAAE,QAAQ,EAAE;AACZ,GAAG,OAAO,EAAE,KAAK,CAAC,EAAE;AACpB,GAAG,MAAM;AACT,GAAG,SAAS,EAAE,KAAK,CAAC;AACpB;AACA,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE;AACrC,CAAC,OAAO,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG,CAAC,WAAW;AAC5D;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,UAAU,GAAG,MAAM;AACvB,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC1B,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC1B,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC,KAAK,CAAC,OAAO,EAAE;AAChB,EAAE,OAAO,IAAI;AACb,CAAC;AACD;AACA;AACA,SAAS,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE;AACrC,CAAC,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;AACrC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,EAAE,GAAG,OAAO;AAChB;AACA;AACA;AACA;AACA,IAAI,IAAI,GAAG,IAAI,UAAU,EAAE;AAC3B;AACA,SAAS,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE;AAC7D,CAAC,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC;AACtB,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,QAAQ;AAC1B,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC;AAC3B,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE;AAC9C,EAAE,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE;AAC5D,GAAG,SAAS,EAAE,OAAO;AACrB,GAAG,MAAM,EAAE,IAAI;AACf,GAAG,KAAK,EAAE,GAAG;AACb,GAAG;AACH,GAAG,CAAC;AACJ,EAAE,OAAO,QAAQ;AACjB,CAAC;AACD,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;AAC1B;AACA;AACA,SAAS,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE;AAChE,CAAC,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC;AACtB,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,QAAQ;AAC1B,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC;AAC3B,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE;AAC7C,EAAE,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE;AAC5D,GAAG,SAAS,EAAE,OAAO;AACrB,GAAG,MAAM,EAAE,IAAI;AACf,GAAG,KAAK,EAAE,GAAG;AACb,GAAG;AACH,GAAG,CAAC;AACJ,EAAE,OAAO,QAAQ;AACjB,CAAC;AACD,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;AAC1B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE;AACjD,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,MAAM,EAAE,OAAO,GAAG;AAChE,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;AAC9C,EAAE,SAAS,EAAE,OAAO;AACpB,EAAE,MAAM,EAAE,OAAO;AACjB,EAAE,SAAS,EAAE;AACb,EAAE,CAAC;AACH,CAAC,OAAO;AACR,EAAE,GAAG,GAAG;AACR,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,OAAO;AACrB,EAAE;AACF;AACA;AACA;AACA;AACA;AACA,SAAS,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE;AACtD,CAAC,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC;AACtB,CAAC,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK,EAAE,EAAE,OAAO,QAAQ;AAC/C,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;AACnC,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,EAAE,OAAO,IAAI;AACxE,CAAC,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,EAAE,OAAO,KAAK;AAC1E,CAAC,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE;AAC3D,EAAE,SAAS,EAAE,OAAO;AACpB,EAAE,MAAM,EAAE,IAAI;AACd,EAAE,KAAK,EAAE,GAAG;AACZ,EAAE;AACF,EAAE,CAAC;AACH,CAAC,OAAO,QAAQ;AAChB;AACA;AACA;AACA;AACA;AACA,SAAS,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,EAAE;AAClD,CAAC,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,6BAA6B,EAAE,kCAAkC,EAAE,MAAM,CAAC;AAClG,CAAC,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,CAAC;AACtF,CAAC,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,gCAAgC,EAAE,yBAAyB,EAAE,MAAM,CAAC;AAC5F,CAAC,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,MAAM,CAAC;AACrF,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC,GAAG,EAAE,gCAAgC,EAAE,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC;AACtG,CAAC,OAAO;AACR,EAAE,eAAe,EAAE,eAAe,CAAC,GAAG,EAAE,2BAA2B,EAAE,GAAG,EAAE,MAAM,CAAC;AACjF,EAAE,iBAAiB,EAAE,eAAe,CAAC,GAAG,EAAE,8BAA8B,EAAE,GAAG,EAAE,MAAM,CAAC;AACtF,EAAE,oBAAoB,EAAE,eAAe,CAAC,GAAG,EAAE,wBAAwB,EAAE,GAAG,EAAE,MAAM,CAAC;AACnF,EAAE,qBAAqB;AACvB,EAAE,gBAAgB,EAAE,eAAe,CAAC,GAAG,EAAE,2BAA2B,EAAE,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC;AACtF,EAAE,sBAAsB,EAAE,eAAe,CAAC,GAAG,EAAE,2BAA2B,EAAE,GAAG,GAAG,EAAE,EAAE,MAAM,CAAC;AAC7F,EAAE,uBAAuB,EAAE,eAAe,CAAC,GAAG,EAAE,4BAA4B,EAAE,GAAG,GAAG,EAAE,EAAE,MAAM,CAAC;AAC/F,EAAE,wBAAwB,EAAE,qBAAqB;AACjD,EAAE,8BAA8B,EAAE,eAAe,CAAC,GAAG,EAAE,oCAAoC,EAAE,GAAG,EAAE,MAAM,CAAC;AACzG,EAAE,0BAA0B,EAAE,eAAe,CAAC,GAAG,EAAE,gCAAgC,EAAE,GAAG,EAAE,MAAM,CAAC;AACjG,EAAE,2BAA2B,EAAE,QAAQ,CAAC,GAAG,EAAE,gCAAgC,EAAE,IAAI,EAAE,MAAM,CAAC;AAC5F,EAAE,uBAAuB,EAAE,QAAQ,CAAC,GAAG,EAAE,2BAA2B,EAAE,IAAI,EAAE,MAAM,CAAC;AACnF,EAAE,oBAAoB,EAAE,kBAAkB,CAAC,GAAG,EAAE,yBAAyB,EAAE,CAAC,EAAE,MAAM,CAAC;AACrF,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,GAAG,EAAE,uBAAuB,EAAE,CAAC,EAAE,MAAM,CAAC;AACjF,EAAE,2BAA2B,EAAE,kBAAkB,CAAC,GAAG,EAAE,6BAA6B,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE;AACvG,EAAE,sBAAsB,EAAE,kBAAkB,CAAC,GAAG,EAAE,wBAAwB,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG;AAC3F,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,YAAY,GAAG;AACnB,CAAC,iBAAiB,EAAE,mBAAmB;AACvC,CAAC,YAAY,EAAE,cAAc;AAC7B,CAAC,SAAS,EAAE,WAAW;AACvB,CAAC,SAAS,EAAE,WAAW;AACvB,CAAC,QAAQ,EAAE,UAAU;AACrB,CAAC,aAAa,EAAE,eAAe;AAC/B,CAAC,mBAAmB,EAAE,qBAAqB;AAC3C,CAAC,cAAc,EAAE,gBAAgB;AACjC,CAAC,QAAQ,EAAE,UAAU;AACrB;AACA,CAAC,sBAAsB,EAAE,wBAAwB;AACjD;AACA,CAAC,YAAY,EAAE,cAAc;AAC7B;AACA,CAAC,wBAAwB,EAAE;AAC3B;AACG,IAAC,QAAQ,GAAG,cAAc,KAAK,CAAC;AACnC,CAAC,MAAM;AACP,CAAC,IAAI;AACL;AACA,CAAC,MAAM;AACP;AACA,CAAC,OAAO;AACR,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;AACrD,EAAE,KAAK,CAAC,OAAO,CAAC;AAChB,EAAE,IAAI,CAAC,IAAI,GAAG,UAAU;AACxB,EAAE,IAAI,CAAC,MAAM,GAAG,MAAM;AACtB,EAAE,IAAI,CAAC,IAAI,GAAG,IAAI;AAClB,EAAE,IAAI,CAAC,MAAM,GAAG,MAAM;AACtB,EAAE,IAAI,CAAC,OAAO,GAAG,OAAO;AACxB,CAAC;AACD;AACA,SAAS,WAAW,CAAC,GAAG,EAAE;AAC1B,CAAC,MAAM,IAAI,GAAG;AACd,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO;AACtB,EAAE,IAAI,EAAE,GAAG,CAAC;AACZ,EAAE;AACF,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM;AACzC,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO;AAC5C,CAAC,OAAO,IAAI;AACZ;AACA,SAAS,UAAU,CAAC,GAAG,EAAE;AACzB,CAAC,OAAO,GAAG,YAAY,QAAQ;AAC/B;AACA;AACA,SAAS,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;AAC1D,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;AAC3D;AACA;AACA,SAAS,aAAa,CAAC,MAAM,EAAE;AAC/B,CAAC,QAAQ,MAAM;AACf,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,iBAAiB;AACjD,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,YAAY;AAC5C,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,SAAS;AACzC,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,SAAS;AACzC,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,QAAQ;AACxC,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,aAAa;AAC7C,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,YAAY;AAC5C,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,mBAAmB;AACnD,EAAE,SAAS,OAAO,YAAY,CAAC,QAAQ;AACvC;AACA;AACA;AACA,SAAS,+BAA+B,CAAC,IAAI,EAAE;AAC/C,CAAC,OAAO;AACR,EAAE,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,EAAE;AAC9D,GAAG,MAAM,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE;AACvE,GAAG,IAAI,MAAM,GAAG,IAAI;AACpB,GAAG,IAAI,SAAS,GAAG,IAAI;AACvB,GAAG,IAAI,cAAc,GAAG,EAAE;AAC1B,GAAG,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE;AAC1C,IAAI,IAAI,sBAAsB,EAAE,cAAc,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;AAC/F,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC;AACjH,QAAQ;AACR,IAAI,MAAM,aAAa,GAAG,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,mBAAmB;AAChF,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5L,GAAG;AACH,GAAG,OAAO;AACV,IAAI,cAAc,EAAE,GAAG,CAAC,cAAc;AACtC,IAAI,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;AAChD,IAAI,OAAO;AACX,IAAI,MAAM;AACV,IAAI,SAAS;AACb,IAAI,mBAAmB;AACvB,IAAI,sBAAsB;AAC1B,IAAI,cAAc;AAClB,IAAI,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;AACxC,IAAI,MAAM,EAAE,GAAG,CAAC,MAAM;AACtB,IAAI,GAAG;AACP,IAAI;AACJ,EAAE,CAAC;AACH,EAAE,0BAA0B,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;AACjD,GAAG,MAAM,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE;AACvE,GAAG,OAAO;AACV,IAAI,cAAc,EAAE,GAAG,CAAC,cAAc;AACtC,IAAI,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;AAChD,IAAI,OAAO;AACX,IAAI,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;AAC/B,IAAI,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;AACrC,IAAI,mBAAmB;AACvB,IAAI,sBAAsB;AAC1B,IAAI,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE;AAC7C,IAAI,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;AACxC,IAAI,MAAM,EAAE,GAAG,CAAC;AAChB,IAAI;AACJ,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,oBAAoB,CAAC,MAAM,EAAE;AACtC,CAAC,OAAO;AACR,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;AACxB,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;AAChC,EAAE,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;AACzC,EAAE,qBAAqB,EAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB;AAC1D,EAAE,IAAI,EAAE,CAAC,IAAI,KAAK,aAAa,CAAC,MAAM,EAAE,IAAI;AAC5C,EAAE;AACF;AACA;AACA,SAAS,MAAM,CAAC,MAAM,EAAE;AACxB,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAC,SAAS;AAC7C,EAAE;AACF;AACA,IAAI,MAAM,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI;AACnC,IAAI,UAAU,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,CAAC,QAAQ;AAC3C,IAAI,gBAAgB,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,CAAC,cAAc;AACvD,IAAI,MAAM,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI;AACnC,SAAS,aAAa,CAAC,MAAM,EAAE;AAC/B,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM;AAC7B,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC;AAC5E,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE;AACF,EAAE;AACF;AACA;AACA,SAAS,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE;AAC/C,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,qCAAqC,CAAC,CAAC;AACpH,CAAC,OAAO,IAAI;AACZ;AACG,IAAC,0BAA0B,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,uBAAuB;AAC3F,IAAC,oBAAoB,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,gBAAgB;AAC9E,IAAC,uBAAuB,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,oBAAoB;AACrF,IAAC,uBAAuB,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,oBAAoB;AACrF,IAAC,oBAAoB,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,gBAAgB;AACjF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iCAAiC,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE;AACpE,CAAC,IAAI,EAAE,OAAO,GAAG,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE;AAC5K,CAAC,IAAI,aAAa,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE;AAC3C,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,OAAO,GAAG,6DAA6D,GAAG,4DAA4D,CAAC;AAC9K;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,CAAC,MAAM,EAAE,KAAK,EAAE;AACzC,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACvB,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC;AACnE,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;AAC5E,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;AAC9F,CAAC,IAAI,GAAG,CAAC,WAAW,KAAK,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,2CAA2C,CAAC;AAClH,CAAC,OAAO;AACR,EAAE,GAAG;AACL,EAAE;AACF,EAAE;AACF;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE;AACjD,CAAC,IAAI,aAAa,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,OAAO,IAAI;AACtD,CAAC,OAAO,MAAM,KAAK,EAAE;AACrB;AACA,eAAe,YAAY,CAAC,KAAK,EAAE;AACnC,CAAC,OAAO,MAAM,KAAK,EAAE;AACrB;AACA,SAAS,0BAA0B,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE;AAC9D,CAAC,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,0BAA0B,CAAC,EAAE,OAAO,KAAK,EAAE;AAClG,CAAC,OAAO,qBAAqB,CAAC,GAAG,EAAE,KAAK,CAAC;AACzC;AACA,eAAe,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE;AACrD,CAAC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;AACjE,CAAC,IAAI,CAAC,OAAO,IAAI,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,mBAAmB,CAAC;AAChH,CAAC,OAAO,OAAO;AACf;AACA,SAAS,eAAe,CAAC,GAAG,EAAE;AAC9B,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC;AAC7B,CAAC,OAAO,+BAA+B,CAAC;AACxC,EAAE,gBAAgB,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,KAAK,UAAU,CAAC,GAAG,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC;AACxG,EAAE,YAAY,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC;AACpF,EAAE,kBAAkB,EAAE,CAAC,GAAG,EAAE,SAAS,KAAK,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC;AACtG,EAAE,KAAK,EAAE,OAAO;AAChB,GAAG,mBAAmB,EAAE,QAAQ,CAAC,wBAAwB,CAAC;AAC1D,GAAG,sBAAsB,EAAE,QAAQ,CAAC,0BAA0B;AAC9D,GAAG;AACH,EAAE,CAAC;AACH;AACA,SAAS,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE;AAC/D,CAAC,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC;AAC7E;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,8BAA8B,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE;AACtD,CAAC,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,0BAA0B,CAAC,GAAG,IAAI,CAAC;AAChE;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,0BAA0B,CAAC,MAAM,EAAE,SAAS,EAAE;AAC7D,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC;AAC/D,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,YAAY,mBAAmB,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,mEAAmE,CAAC;AAC1N,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE,GAAG;AACL,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,wBAAwB,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE;AACrE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AACtC,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,sEAAsE,CAAC;AACxL;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE;AAC5D,CAAC,IAAI,IAAI,KAAK,QAAQ,EAAE,OAAO,IAAI;AACnC,CAAC,OAAO,gBAAgB,CAAC;AACzB,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC;AACrE,EAAE;AACF,EAAE,CAAC;AACH;AACA;AACA;AACA;AACA;AACA,eAAe,iBAAiB,CAAC,MAAM,EAAE,SAAS,EAAE;AACpD,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;AACpE,CAAC,MAAM,OAAO,GAAG,OAAO,IAAI,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,cAAc,EAAE,SAAS,CAAC;AAC1F,CAAC,IAAI,CAAC,OAAO,IAAI,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,mBAAmB,CAAC;AACjK,CAAC,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,wCAAwC,CAAC;AACvH,CAAC,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,YAAY;AACnD,EAAE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC;AACrF,EAAE,OAAO,UAAU,CAAC;AACpB,GAAG,OAAO;AACV,GAAG,SAAS;AACZ,GAAG,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI;AACnC,GAAG,CAAC;AACJ,CAAC,CAAC,CAAC,EAAE;AACL,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,mBAAmB,CAAC;AAC1E,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,iEAAiE,CAAC;AAC1G,CAAC;AACD,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE,GAAG;AACL,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA,eAAe,uBAAuB,CAAC,MAAM,EAAE,WAAW,EAAE;AAC5D,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,YAAY;AACnD,EAAE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC;AACnF,EAAE,OAAO,gBAAgB,CAAC;AAC1B,GAAG,cAAc,EAAE,GAAG,CAAC,cAAc;AACrC,GAAG,SAAS;AACZ,GAAG,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;AACvC,GAAG;AACH,GAAG,CAAC;AACJ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,4DAA4D,CAAC;AACxG,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE;AACvE,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC;AAC/D,CAAC,IAAI,CAAC,MAAM,0BAA0B,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,SAAS,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,MAAM,KAAK,SAAS,GAAG,yCAAyC,GAAG,8CAA8C,CAAC;AAClS,CAAC,OAAO,IAAI;AACZ;AACA,eAAe,6BAA6B,CAAC,MAAM,EAAE,SAAS,EAAE;AAChE,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC;AAC/D,CAAC,IAAI,CAAC,MAAM,0BAA0B,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,sBAAsB,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gDAAgD,CAAC;AAC9O,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE,GAAG;AACL,EAAE;AACF,EAAE;AACF;AACA,eAAe,qBAAqB,CAAC,MAAM,EAAE,SAAS,EAAE;AACxD,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,YAAY;AACrC,EAAE,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC;AAChE,EAAE,OAAO,OAAO,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AACrE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,yCAAyC,CAAC;AACrF,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE;AACpE,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,MAAM,OAAO,GAAG,gBAAgB,IAAI,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC;AACnF,CAAC,IAAI,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,mBAAmB,CAAC;AACpG,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,YAAY,QAAQ,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,yCAAyC,CAAC;AACrL,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE,GAAG;AACL,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE;AACvD,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,OAAO,IAAI;AAC5C,CAAC,OAAO,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC;AACtE;AACA;AACA;AACA;AACA;AACA,eAAe,yBAAyB,CAAC,MAAM,EAAE,IAAI,EAAE;AACvD,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AACtC,CAAC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC;AAC7D,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,sBAAsB,CAAC;AAC3E,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5K,CAAC,IAAI,OAAO,IAAI,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,sBAAsB,CAAC;AAClH,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,YAAY,iBAAiB,CAAC;AACvD,EAAE,OAAO;AACT,EAAE,UAAU,EAAE,MAAM;AACpB,EAAE,MAAM;AACR,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC;AAC7D,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM;AACpB,EAAE,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;AAC9C,EAAE,sBAAsB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,0BAA0B;AACnE,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,qDAAqD,CAAC;AAClG,CAAC,OAAO;AACR,EAAE,MAAM;AACR,EAAE,GAAG;AACL,EAAE;AACF,EAAE;AACF;AACA,eAAe,wBAAwB,CAAC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE;AACtF,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,YAAY;AACrC,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AAC1D,GAAG,SAAS,EAAE,OAAO,KAAK,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;AACrH,GAAG,SAAS,EAAE,UAAU,KAAK,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC;AAC/H,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM;AACjE,GAAG,CAAC;AACJ,EAAE,IAAI,OAAO,IAAI,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK;AAClE,EAAE,OAAO,iBAAiB,CAAC;AAC3B,GAAG,OAAO;AACV,GAAG,UAAU;AACb,GAAG,MAAM;AACT,GAAG,SAAS,EAAE,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC;AAC9D,GAAG,MAAM,EAAE,GAAG,CAAC,MAAM;AACrB,GAAG,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;AAC/C,GAAG,sBAAsB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,0BAA0B;AACpE,GAAG,CAAC;AACJ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,qDAAqD,CAAC;AACjG,CAAC,OAAO,IAAI;AACZ;AACA;AACA,IAAI,YAAY,GAAG,IAAI,GAAG,CAAC,wBAAwB,CAAC;AACpD,IAAI,OAAO,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC;AAC1C;AACA,SAAS,oBAAoB,CAAC,IAAI,EAAE;AACpC,CAAC,MAAM,QAAQ,GAAG,EAAE;AACpB,CAAC,MAAM,GAAG,GAAG,EAAE;AACf,CAAC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAChE,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AACrC,CAAC,OAAO;AACR,EAAE,QAAQ;AACV,EAAE;AACF,EAAE;AACF;;;;"}

package/build/server/chunks/chunks/access.server.js-CwcMbS6y.js

@@ -0,0 +1,15 @@
+import { q as requireEditableDefinition } from './access.js-BfMTTCTH.js';
+import './context.js-DgF3EFGQ.js';
+import './types3.js-BS6pAwdK.js';
+import './api.js-Chw-vSDJ.js';
+import '@sveltejs/kit';
+import './types.js-g5F0W_ER.js';
+import 'zod';
+import './schemas.js-CEHDw4oF.js';
+import './rate-limit.js-Br3luBbc.js';
+import 'node:crypto';
+
+
+
+export { requireEditableDefinition };
+//# sourceMappingURL=access.server.js-CwcMbS6y.js.map

package/build/server/chunks/chunks/access.server.js-CwcMbS6y.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.server.js-CwcMbS6y.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;"}

package/build/server/chunks/chunks/access2.server.js-CGXEalQg.js

@@ -0,0 +1,64 @@
+import { g as isApiError, O as requireAuthed } from './access.js-BfMTTCTH.js';
+import { h as hasPermission } from './context.js-DgF3EFGQ.js';
+import { O as OPERATOR_PLATFORM_PERMISSIONS } from './types3.js-BS6pAwdK.js';
+import './api.js-Chw-vSDJ.js';
+import { error, redirect } from '@sveltejs/kit';
+
+// src/lib/server/access.server.ts
+/**
+* The app's access guards: the framework-free ones re-exported from
+* `@selvajs/server/access`, plus the redirecting ones that only make sense here.
+*
+* A redirect is a browser-page outcome, and SvelteKit implements it by throwing
+* a value only SvelteKit recognizes — so these three cannot move into the
+* package without dragging the framework in with them. Every other guard did
+* move, and the handlers that call them no longer name SvelteKit at all.
+*
+* Guards raise `ApiError` now rather than SvelteKit's `error()`. API routes get
+* that folded into the envelope by `mapAppError`; **page loads must wrap the
+* call in {@link asHttpError}**. SvelteKit derives a response status by checking
+* `error instanceof HttpError` and returns 500 for everything else, and
+* `handleError` runs too late to change it — so an unwrapped guard renders the
+* right message under the wrong status, which looks like a crash rather than a
+* denial and never trips a test that only asserts on the message.
+*/
+/**
+* Run a guard outside `mount`, converting its `ApiError` into the `HttpError`
+* SvelteKit needs to produce a real status. Needed by page loads and by API
+* routes that build their own `Response` instead of going through `mount`,
+* since those never reach `mapAppError`.
+*/
+async function asHttpError(run) {
+	try {
+		return await run();
+	} catch (err) {
+		if (isApiError(err)) throw error(err.status, {
+			message: err.message,
+			code: err.code,
+			fields: err.fields,
+			details: err.details
+		});
+		throw err;
+	}
+}
+function assertPagePermission(locals, permission) {
+	const { user, ctx } = requireAuthed(locals);
+	if (!hasPermission(ctx, permission)) redirect(303, "/admin");
+	return user;
+}
+var assertManageInstanceUsers = (locals) => assertPagePermission(locals, "manage_instance_users");
+var assertManageCompute = (locals) => assertPagePermission(locals, "manage_compute");
+/**
+* Gate for pages reachable by any platform-class permission holder (the
+* `/admin` shell — `instance_admin`, `manage_compute`, `manage_instance_users`,
+* or `manage_updates` all qualify). Org-scope permissions never admit entry:
+* org admins do not belong on platform-scoped surfaces.
+*/
+function assertAnyPlatformPermission(locals) {
+	const { user, ctx } = requireAuthed(locals);
+	if (!OPERATOR_PLATFORM_PERMISSIONS.some((p) => hasPermission(ctx, p))) redirect(303, "/library");
+	return user;
+}
+
+export { assertAnyPlatformPermission as a, assertPagePermission as b, assertManageCompute as c, asHttpError as d, assertManageInstanceUsers as e };
+//# sourceMappingURL=access2.server.js-CGXEalQg.js.map

package/build/server/chunks/chunks/access2.server.js-CGXEalQg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access2.server.js-CGXEalQg.js","sources":["../../../../.svelte-kit/output/server/chunks/access2.server.js"],"sourcesContent":["import { A as isApiError, s as requireAuthed } from \"./access.js\";\nimport { o as hasPermission } from \"./context.js\";\nimport { n as OPERATOR_PLATFORM_PERMISSIONS } from \"./types3.js\";\nimport \"./api.js\";\nimport { error, redirect } from \"@sveltejs/kit\";\n// src/lib/server/access.server.ts\n/**\n* The app's access guards: the framework-free ones re-exported from\n* `@selvajs/server/access`, plus the redirecting ones that only make sense here.\n*\n* A redirect is a browser-page outcome, and SvelteKit implements it by throwing\n* a value only SvelteKit recognizes — so these three cannot move into the\n* package without dragging the framework in with them. Every other guard did\n* move, and the handlers that call them no longer name SvelteKit at all.\n*\n* Guards raise `ApiError` now rather than SvelteKit's `error()`. API routes get\n* that folded into the envelope by `mapAppError`; **page loads must wrap the\n* call in {@link asHttpError}**. SvelteKit derives a response status by checking\n* `error instanceof HttpError` and returns 500 for everything else, and\n* `handleError` runs too late to change it — so an unwrapped guard renders the\n* right message under the wrong status, which looks like a crash rather than a\n* denial and never trips a test that only asserts on the message.\n*/\n/**\n* Run a guard outside `mount`, converting its `ApiError` into the `HttpError`\n* SvelteKit needs to produce a real status. Needed by page loads and by API\n* routes that build their own `Response` instead of going through `mount`,\n* since those never reach `mapAppError`.\n*/\nasync function asHttpError(run) {\n\ttry {\n\t\treturn await run();\n\t} catch (err) {\n\t\tif (isApiError(err)) throw error(err.status, {\n\t\t\tmessage: err.message,\n\t\t\tcode: err.code,\n\t\t\tfields: err.fields,\n\t\t\tdetails: err.details\n\t\t});\n\t\tthrow err;\n\t}\n}\nfunction assertPagePermission(locals, permission) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tif (!hasPermission(ctx, permission)) redirect(303, \"/admin\");\n\treturn user;\n}\nvar assertManageInstanceUsers = (locals) => assertPagePermission(locals, \"manage_instance_users\");\nvar assertManageCompute = (locals) => assertPagePermission(locals, \"manage_compute\");\n/**\n* Gate for pages reachable by any platform-class permission holder (the\n* `/admin` shell — `instance_admin`, `manage_compute`, `manage_instance_users`,\n* or `manage_updates` all qualify). Org-scope permissions never admit entry:\n* org admins do not belong on platform-scoped surfaces.\n*/\nfunction assertAnyPlatformPermission(locals) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tif (!OPERATOR_PLATFORM_PERMISSIONS.some((p) => hasPermission(ctx, p))) redirect(303, \"/library\");\n\treturn user;\n}\nexport { assertPagePermission as a, assertManageInstanceUsers as i, assertAnyPlatformPermission as n, assertManageCompute as r, asHttpError as t };\n"],"names":[],"mappings":";;;;;;AAKA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,WAAW,CAAC,GAAG,EAAE;AAChC,CAAC,IAAI;AACL,EAAE,OAAO,MAAM,GAAG,EAAE;AACpB,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE;AAC/C,GAAG,OAAO,EAAE,GAAG,CAAC,OAAO;AACvB,GAAG,IAAI,EAAE,GAAG,CAAC,IAAI;AACjB,GAAG,MAAM,EAAE,GAAG,CAAC,MAAM;AACrB,GAAG,OAAO,EAAE,GAAG,CAAC;AAChB,GAAG,CAAC;AACJ,EAAE,MAAM,GAAG;AACX,CAAC;AACD;AACA,SAAS,oBAAoB,CAAC,MAAM,EAAE,UAAU,EAAE;AAClD,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;AAC7D,CAAC,OAAO,IAAI;AACZ;AACG,IAAC,yBAAyB,GAAG,CAAC,MAAM,KAAK,oBAAoB,CAAC,MAAM,EAAE,uBAAuB;AAC7F,IAAC,mBAAmB,GAAG,CAAC,MAAM,KAAK,oBAAoB,CAAC,MAAM,EAAE,gBAAgB;AACnF;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,2BAA2B,CAAC,MAAM,EAAE;AAC7C,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;AACjG,CAAC,OAAO,IAAI;AACZ;;;;"}

package/build/server/chunks/chunks/activity.js-BUIPDWt1.js

@@ -0,0 +1,17 @@
+import { al as spread_props } from './server.js-D3MqDbVt.js';
+import { I as Icon } from './utils3.js-DANle-lS.js';
+
+// ../../node_modules/.pnpm/@lucide+svelte@1.61.0_svelte@5.57.2_@typescript-eslint+types@8.72.0_/node_modules/@lucide/svelte/dist/icons/activity.svelte
+var __iconData = {
+	"name": "activity",
+	"size": 24,
+	"node": [["path", { "d": "M22 12h-2.48a2 2 0 0 0-1.93 1.46l-2.35 8.36a.25.25 0 0 1-.48 0L9.24 2.18a.25.25 0 0 0-.48 0l-2.35 8.36A2 2 0 0 1 4.49 12H2" }]]
+};
+__iconData.node;
+function Activity($$renderer, $$props) {
+	let { $$slots, $$events, ...props } = $$props;
+	Icon($$renderer, spread_props([props, { icon: __iconData }]));
+}
+
+export { Activity as A };
+//# sourceMappingURL=activity.js-BUIPDWt1.js.map

package/build/server/chunks/chunks/activity.js-BUIPDWt1.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"activity.js-BUIPDWt1.js","sources":["../../../../.svelte-kit/output/server/chunks/activity.js"],"sourcesContent":["import { d as spread_props } from \"./server.js\";\nimport { n as Icon } from \"./utils3.js\";\n// ../../node_modules/.pnpm/@lucide+svelte@1.61.0_svelte@5.57.2_@typescript-eslint+types@8.72.0_/node_modules/@lucide/svelte/dist/icons/activity.svelte\nvar __iconData = {\n\t\"name\": \"activity\",\n\t\"size\": 24,\n\t\"node\": [[\"path\", { \"d\": \"M22 12h-2.48a2 2 0 0 0-1.93 1.46l-2.35 8.36a.25.25 0 0 1-.48 0L9.24 2.18a.25.25 0 0 0-.48 0l-2.35 8.36A2 2 0 0 1 4.49 12H2\" }]]\n};\n__iconData.node;\nfunction Activity($$renderer, $$props) {\n\tlet { $$slots, $$events, ...props } = $$props;\n\tIcon($$renderer, spread_props([props, { icon: __iconData }]));\n}\nexport { Activity as t };\n"],"names":[],"mappings":";;;AAEA;AACA,IAAI,UAAU,GAAG;AACjB,CAAC,MAAM,EAAE,UAAU;AACnB,CAAC,MAAM,EAAE,EAAE;AACX,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,4HAA4H,EAAE,CAAC;AACzJ,CAAC;AACD,UAAU,CAAC,IAAI;AACf,SAAS,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE;AACvC,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO;AAC9C,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;AAC9D;;;;"}

package/build/server/chunks/chunks/admin-auth.server.js-CuH8RmWr.js

@@ -0,0 +1,353 @@
+import { b as private_env } from './shared-server.js-CX8yV6G4.js';
+import { e as ApiErrorCode, n as narrowApiTokenContext } from './access.js-BfMTTCTH.js';
+import { S as SYSTEM_CONTEXT } from './context.js-DgF3EFGQ.js';
+import { c as createComputeRateLimiter } from './rate-limit.js-Br3luBbc.js';
+import { l as looksLikeApiToken } from './api-token-codec.js--hQdn1xG.js';
+import { c as canHoldApiTokens } from './tokens.js-CwDDHAj0.js';
+import { b as buildRequestContext } from './request-context.js-IxX3HuOZ.js';
+import { error } from '@sveltejs/kit';
+
+// ../server/src/http/api-token.ts
+/** `lastUsedAt` is written at most this often per token, so a busy key isn't a write per request. */
+var LAST_USED_WRITE_INTERVAL_MS = 3e5;
+var UNAUTHORIZED = {
+	kind: "rejected",
+	status: 401,
+	code: ApiErrorCode.UNAUTHORIZED,
+	message: "This API token is invalid, expired or revoked."
+};
+var UNAVAILABLE = {
+	kind: "rejected",
+	status: 503,
+	code: ApiErrorCode.API_TOKENS_UNAVAILABLE,
+	message: "API tokens are not available on this server."
+};
+var HOLDER_REFUSED = {
+	kind: "rejected",
+	status: 403,
+	code: ApiErrorCode.API_TOKEN_HOLDER_REFUSED,
+	message: "This API token’s owner may no longer use API tokens in this org."
+};
+/**
+* Authenticate a request by its `Authorization: Bearer selva_…` header.
+*
+* Call it before any cookie or proxy sign-in. Once a `selva_` key is sent the
+* outcome is final: a bad key gets 401 even if a valid session cookie rides
+* along, because running the request as the cookie's user would hide the
+* broken key and act as someone else.
+*
+* The owner is re-checked on every request (disabled, still a member of the
+* token's org, still allowed to hold keys), then their live context is
+* narrowed to the token's scopes.
+*/
+async function resolveApiToken(request, deps, { pathPrefix = "/api/v1/" } = {}) {
+	const url = new URL(request.url);
+	for (const value of url.searchParams.values()) if (looksLikeApiToken(value)) return {
+		kind: "rejected",
+		status: 400,
+		code: ApiErrorCode.VALIDATION_FAILED,
+		message: "API tokens go in the Authorization header, never the URL. URLs end up in logs and browser history; revoke this key."
+	};
+	const raw = bearerOf(request);
+	if (!raw?.startsWith("selva_")) return { kind: "none" };
+	if (!url.pathname.startsWith(pathPrefix)) return {
+		kind: "rejected",
+		status: 403,
+		code: ApiErrorCode.FORBIDDEN,
+		message: `API tokens only work under ${pathPrefix}.`
+	};
+	const store = deps.data.apiTokens;
+	if (!deps.codec || !store) return UNAVAILABLE;
+	const delegated = deps.auth.delegatedSession;
+	if (delegated && !(await delegated.status()).ok) return UNAVAILABLE;
+	if (!deps.codec.hasValidChecksum(raw)) return UNAUTHORIZED;
+	const token = await store.getByTokenHash(SYSTEM_CONTEXT, deps.codec.hashToken(raw));
+	if (!token) return UNAUTHORIZED;
+	const [user, member, platformPermissions] = await Promise.all([
+		deps.auth.getUser(token.userId),
+		deps.data.orgs.getOrgMember(SYSTEM_CONTEXT, token.orgId, token.userId),
+		deps.data.permissions.getFor(SYSTEM_CONTEXT, token.userId)
+	]);
+	if (!user || user.disabled || !member) return UNAUTHORIZED;
+	const live = await buildRequestContext({
+		user,
+		platformPermissions,
+		membership: member,
+		pinOrg: true
+	}, { orgs: deps.data.orgs });
+	const now = deps.now?.() ?? Date.now();
+	if (!deps.holderVerdicts?.passed(token.id, now)) {
+		if (!await canHoldApiTokens(live, token.scopes, {
+			policy: deps.mayHoldApiTokens,
+			deps: {
+				orgs: deps.data.orgs,
+				projects: deps.data.projects,
+				platformProjectGrants: deps.data.platformProjectGrants,
+				definitionMeta: deps.data.definitions,
+				flag: deps.flag ?? (() => false)
+			}
+		})) return HOLDER_REFUSED;
+		deps.holderVerdicts?.remember(token.id, now);
+	}
+	let ctx = narrowApiTokenContext(live, token);
+	if (delegated) {
+		const sessionToken = await delegated.mint(user.id, { orgId: token.orgId });
+		ctx = {
+			...ctx,
+			adapterContext: { sessionToken }
+		};
+	}
+	if (!token.lastUsedAt || now - Date.parse(token.lastUsedAt) >= LAST_USED_WRITE_INTERVAL_MS) store.touchLastUsed(SYSTEM_CONTEXT, token.id, new Date(now).toISOString()).catch((err) => {
+		deps.log?.warn("Failed to record API token use", {
+			component: "apiToken",
+			tokenId: token.id,
+			err: err instanceof Error ? err.message : String(err)
+		});
+	});
+	return {
+		kind: "ok",
+		user,
+		ctx,
+		token
+	};
+}
+/**
+* Remembers passed holder checks for `ttlMs`, so a busy upload key doesn't
+* re-scan its org's projects on every request. A withdrawn right takes effect
+* within the TTL; a disabled owner or a removed member is still refused at once.
+*/
+function createHolderVerdictCache(ttlMs = 3e4, maxEntries = 1e4) {
+	const until = /* @__PURE__ */ new Map();
+	return {
+		passed(tokenId, now) {
+			const expiry = until.get(tokenId);
+			if (expiry === void 0) return false;
+			if (expiry > now) return true;
+			until.delete(tokenId);
+			return false;
+		},
+		remember(tokenId, now) {
+			if (until.size >= maxEntries) {
+				for (const [id, expiry] of until) if (expiry <= now) until.delete(id);
+				if (until.size >= maxEntries) until.delete(until.keys().next().value);
+			}
+			until.delete(tokenId);
+			until.set(tokenId, now + ttlMs);
+		}
+	};
+}
+/** The bearer credential, or null. CSRF's exemption reads it here too: the two must agree. */
+function bearerOf(request) {
+	const header = request.headers.get("authorization");
+	if (!header) return null;
+	const match = /^Bearer\s+(\S+)\s*$/i.exec(header);
+	return match ? match[1] : null;
+}
+// ../server/src/http/csrf.ts
+/**
+* SvelteKit's form-submission CSRF check, with the two exemptions it can't
+* express. A host turns the framework's own check off and calls this first.
+*
+* - A Selva API key in `Authorization`: a cross-site form can't set the header,
+*   and a `selva_` bearer never falls back to the cookie. API-token uploads are
+*   multipart with no `Origin`, which the framework check refuses. Any other
+*   `Authorization` (a proxy's id token) still gets checked: the request may run
+*   as the cookie session.
+* - `exemptPaths`: endpoints that take a form body from servers, which send no
+*   `Origin` (the OAuth token endpoint, per RFC 6749).
+*/
+var UNSAFE_METHODS = /* @__PURE__ */ new Set([
+	"POST",
+	"PUT",
+	"PATCH",
+	"DELETE"
+]);
+var FORM_TYPES = [
+	"application/x-www-form-urlencoded",
+	"multipart/form-data",
+	"text/plain",
+	"application/x-sveltekit-formdata"
+];
+function isCrossSiteFormSubmission(request, options = {}) {
+	if (!UNSAFE_METHODS.has(request.method)) return false;
+	const type = (request.headers.get("content-type") ?? "").split(";")[0].trim().toLowerCase();
+	if (!FORM_TYPES.includes(type)) return false;
+	if (bearerOf(request)?.startsWith("selva_")) return false;
+	const url = new URL(request.url);
+	if (options.exemptPaths?.includes(url.pathname)) return false;
+	return request.headers.get("origin") !== url.origin;
+}
+// ../server/src/http/body-size.ts
+/**
+* True when the request's declared `Content-Length` exceeds `maxBytes`. Call it
+* BEFORE reading the body, so a huge payload aimed at a small-body endpoint
+* can't burn memory; the route maps `true` to its transport's 413.
+*
+* This is the per-route lower bound. A global limit (e.g. adapter-node's
+* `BODY_SIZE_LIMIT`) has to clear the largest legitimate upload, so every small
+* JSON endpoint would otherwise inherit that ceiling.
+*
+* Requests without `Content-Length` (chunked encoding) slip past this check —
+* the global limit is the backstop there.
+*/
+function declaredBodySizeExceeds(headers, maxBytes) {
+	const declared = Number(headers.get("content-length"));
+	return Number.isFinite(declared) && declared > maxBytes;
+}
+// ../server/src/http/login-rate-limit.ts
+/**
+* Login rate limiting: two buckets per attempt, because neither dimension
+* covers the other.
+*
+*   - **Per-address** bounds one client hammering the form. It is only
+*     meaningful when the host resolves a real client address. Behind a reverse
+*     proxy that is not configured to forward one, every request reports the
+*     socket peer — `127.0.0.1` for all of them — which collapses the whole key
+*     space into a single bucket: five failed logins from anywhere lock out the
+*     entire instance, and only a success clears it, which nobody can now
+*     reach. That failure is completely silent, hence
+*     {@link addressKeysCollapsed}.
+*   - **Per-account** bounds a targeted guessing attack, which address limiting
+*     does not: an attacker spread across many source IPs contends with no
+*     shared counter at all, leaving password-hash cost as the only real bound
+*     on online guessing.
+*
+* An attempt must clear both and a failure charges both. A success clears the
+* account bucket and the calling address's — a *different* address that failed
+* against the same account keeps its own penalty.
+*
+* The flow counts failures rather than attempts: `check` gates without spending
+* budget, `recordFailure` spends, and `clear` forgives. A successful login
+* therefore costs nothing, so an ordinary user typing one wrong password never
+* walks toward a lockout.
+*/
+/** Loopback in the three spellings a Node server actually reports. */
+var LOOPBACK = /* @__PURE__ */ new Set([
+	"127.0.0.1",
+	"::1",
+	"::ffff:127.0.0.1"
+]);
+/** Normalized so case tricks (`Alice@` vs `alice@`) share one bucket. */
+function accountKey(email) {
+	return `account:${email.trim().toLowerCase()}`;
+}
+function createLoginRateLimiter(config = {}) {
+	const windowMs = config.windowMs ?? 9e5;
+	const byAddress = createComputeRateLimiter({
+		windowMs,
+		maxPerWindow: config.maxPerAddress ?? 5
+	});
+	const byAccount = createComputeRateLimiter({
+		windowMs,
+		maxPerWindow: config.maxPerAccount ?? 20
+	});
+	return {
+		check(address, email) {
+			const address_ = byAddress.peek(address);
+			if (!address_.allowed || !email) return address_;
+			return byAccount.peek(accountKey(email));
+		},
+		recordFailure(address, email) {
+			byAddress.check(address);
+			if (email) byAccount.check(accountKey(email));
+		},
+		clear(address, email) {
+			byAddress.clear(address);
+			if (email) byAccount.clear(accountKey(email));
+		},
+		reset() {
+			byAddress.reset();
+			byAccount.reset();
+		}
+	};
+}
+/**
+* Whether per-address limiting has degenerated into one shared bucket.
+*
+* True when the host reports a loopback address for a request it did not
+* originate — which means it sits behind a proxy and is reading the socket peer
+* instead of a forwarded client address. The host decides what to do about it;
+* warning once at startup is enough, and warning per request is not.
+*
+* `addressHeaderConfigured` is the host's answer to "am I reading a forwarded
+* header at all", since which header and how many hops to trust are deployment
+* config that no package can resolve for it.
+*/
+function addressKeysCollapsed(address, addressHeaderConfigured) {
+	if (addressHeaderConfigured) return false;
+	return LOOPBACK.has(address);
+}
+// src/lib/server/admin-auth.server.ts
+var SESSION_COOKIE_NAME = "admin_session";
+var SESSION_MAX_AGE_MS = 288e5;
+var REFRESH_COOKIE_NAME = "admin_refresh";
+var REFRESH_MAX_AGE_MS = 2592e6;
+var loginRateLimiter = createLoginRateLimiter();
+function checkRateLimit(ip, email) {
+	return loginRateLimiter.check(ip, email);
+}
+function recordFailedAttempt(ip, email) {
+	loginRateLimiter.recordFailure(ip, email);
+}
+function clearRateLimit(ip, email) {
+	loginRateLimiter.clear(ip, email);
+}
+var addressWarningIssued = false;
+function warnIfAddressKeysCollapse(ip, log) {
+	if (addressWarningIssued) return;
+	if (!private_env.ORIGIN) return;
+	if (!addressKeysCollapsed(ip, Boolean(private_env.ADDRESS_HEADER))) return;
+	addressWarningIssued = true;
+	log.warn("Login rate limiting is keyed to the loopback address for every request. The app is behind a proxy but ADDRESS_HEADER is unset, so getClientAddress() returns the socket peer and all clients share one bucket — five failed logins lock out the whole instance. Set ADDRESS_HEADER=X-Forwarded-For and XFF_DEPTH to your proxy count (see .env.example).", { component: "auth/rate-limit" });
+}
+function setSessionCookie(cookies, sessionToken) {
+	const isSecure = process.env.NODE_ENV === "production" && private_env.ALLOW_INSECURE_COOKIES !== "true";
+	cookies.set(SESSION_COOKIE_NAME, sessionToken, {
+		path: "/",
+		httpOnly: true,
+		sameSite: "lax",
+		secure: isSecure,
+		maxAge: SESSION_MAX_AGE_MS / 1e3
+	});
+}
+/** Call before `destroySession` — logout needs the token to revoke it provider-side. */
+function getSessionToken(cookies) {
+	return cookies.get(SESSION_COOKIE_NAME);
+}
+function destroySession(cookies) {
+	cookies.delete(SESSION_COOKIE_NAME, { path: "/" });
+	cookies.delete(REFRESH_COOKIE_NAME, { path: "/" });
+}
+/**
+* Refresh-token cookie for the OAuth/Supabase flow — `hooks.server.ts`'s
+* session-refresh middleware swaps an expired access token for a fresh one
+* using this. Local/HMAC sessions don't need it.
+*/
+function setRefreshCookie(cookies, refreshToken) {
+	const isSecure = process.env.NODE_ENV === "production" && private_env.ALLOW_INSECURE_COOKIES !== "true";
+	cookies.set(REFRESH_COOKIE_NAME, refreshToken, {
+		path: "/",
+		httpOnly: true,
+		sameSite: "lax",
+		secure: isSecure,
+		maxAge: REFRESH_MAX_AGE_MS / 1e3
+	});
+}
+function getRefreshToken(cookies) {
+	return cookies.get(REFRESH_COOKIE_NAME);
+}
+function clearRefreshCookie(cookies) {
+	cookies.delete(REFRESH_COOKIE_NAME, { path: "/" });
+}
+/**
+* Rejects a request whose declared `Content-Length` exceeds `maxBytes` — a
+* per-route lower bound under the global adapter-node `BODY_SIZE_LIMIT`
+* (which must stay high enough for 50MB .gh uploads). Throws 413 before the
+* body is read; see `declaredBodySizeExceeds` for the chunked-encoding caveat.
+*/
+function requireMaxBodySize(request, maxBytes) {
+	if (declaredBodySizeExceeds(request.headers, maxBytes)) throw error(413, `Request body exceeds the limit for this endpoint.`);
+}
+
+export { setRefreshCookie as a, createHolderVerdictCache as b, clearRefreshCookie as c, checkRateLimit as d, recordFailedAttempt as e, clearRateLimit as f, getRefreshToken as g, getSessionToken as h, isCrossSiteFormSubmission as i, destroySession as j, requireMaxBodySize as k, resolveApiToken as r, setSessionCookie as s, warnIfAddressKeysCollapse as w };
+//# sourceMappingURL=admin-auth.server.js-CuH8RmWr.js.map