@selvajs/selva 4.20.0-beta.15 → 4.20.0-beta.16

package/build/server/chunks/chunks/solve.server.js-CgNiK3RL.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"solve.server.js-CgNiK3RL.js","sources":["../../../../.svelte-kit/output/server/chunks/solve.server.js"],"sourcesContent":["import { T as providers, b as getSolveMetricSink, w as lazyLogger, x as getStorageProvider } from \"./providers.server.js\";\nimport { a as renderThrown } from \"./definitions.js\";\nimport { a as createRemoteDefinitionFetcher, i as resolveServerForOrg } from \"./compute.js\";\nimport { D as ApiError, M as toErrorBody, N as ComputeServerUnconfiguredError, O as ApiErrorCode, T as scoped, j as isApiError, m as requireCanSolve, u as requireCanEditDefinition } from \"./access.js\";\nimport { r as fetchSchemaFromCompute } from \"./schema-extraction.js\";\nimport { D as chargeApiRateLimit, M as assertScope, j as withRateLimitHeaders, k as rateLimitedResponse } from \"./api.js\";\nimport { f as e, m as t } from \"./grasshopper.js\";\nimport { t as apiError } from \"./api-errors.js\";\nimport \"./access2.server.js\";\nimport { a as engine, t as COMPUTE_DEBUG } from \"./engine.server.js\";\nimport { d as REMOTE_DEFINITION_MAX_BYTES, f as SOLVE_DEADLINE_MS, l as REMOTE_DEFINITION_CACHE_TTL_MS, u as REMOTE_DEFINITION_FETCH_TIMEOUT_MS } from \"./computeLimits.js\";\nimport { n as checkComputeRateLimit, t as apiRateLimiter } from \"./computeRateLimit.server.js\";\nimport { n as liveOwnerKey, r as solveEndedKind, t as bindLiveSolve } from \"./liveSolve.server.js\";\nimport { isHttpError } from \"@sveltejs/kit\";\n// src/lib/server/compute/remoteDefinition.server.ts\n/**\n* App-wide instance of the remote-definition fetcher (SSRF guard, size cap,\n* deadline, TTL cache all live in `@selvajs/server`'s `createRemoteDefinitionFetcher`).\n*/\nvar fetcher = createRemoteDefinitionFetcher({\n\tmaxBytes: REMOTE_DEFINITION_MAX_BYTES,\n\tfetchTimeoutMs: REMOTE_DEFINITION_FETCH_TIMEOUT_MS,\n\tcacheTtlMs: REMOTE_DEFINITION_CACHE_TTL_MS,\n\tnow: () => Date.now(),\n\tlogger: lazyLogger\n});\n/** Fetch (or return cached) remote `.gh` bytes. Throws on unsafe host / oversized / timeout. */\nfunction loadRemoteDefinition(url) {\n\treturn fetcher.load(url);\n}\n// src/lib/server/compute/solve.server.ts\n/**\n* The body-independent core of a solve request, shared by `POST /api/v1/compute`\n* (share-token and remote-URL capable) and `POST /api/v1/definitions/{guid}/solve`\n* (tenant-scoped, cookie or PAT).\n*\n* **Share-token resolution stays outside this module, in the route.** The caller\n* hands in an already-decided `SolveAccess`; the definition-addressed route only\n* ever constructs the `user` variant, so it cannot inherit the anonymous branch\n* by accident. Adding a token lookup here would silently give it one.\n*\n* What lives here: rate limiting, definition/version resolution, access checks,\n* compute-server routing, schema backfill, the engine call, metric recording, the\n* debug breakdown. What stays in a route: parsing its own body shape and deciding\n* who the caller is.\n*/\n/**\n* Run a solve and return the HTTP response.\n*\n* Throws `HttpError` (via `apiError`) for every refusal, and lets engine/network\n* failures propagate for the caller's outer catch to map — the two routes share\n* that mapping through `mapSolveError`.\n*/\nasync function runSolve(params) {\n\tconst { access, definitionUrl, inputs, values, channel, versionId: explicitVersionId, request, locals, loadStart, prepMarks, concealAccessFailure = false, streamId = null, tokenCharged = false } = params;\n\tconst storage = getStorageProvider();\n\tconst sharedAccess = access.kind === \"share\" ? access : null;\n\tconst solveCtx = access.ctx;\n\tlet prevMark = performance.now();\n\tconst mark = (label) => {\n\t\tprepMarks.push([label, performance.now() - prevMark]);\n\t\tprevMark = performance.now();\n\t};\n\tlet definitionSource;\n\tlet localDefinitionRef = null;\n\tlet localVersionForBackfill = null;\n\tlet solveOrgId = null;\n\tlet definitionPin = null;\n\tlet metricDefinitionId = null;\n\tlet metricVersionId = null;\n\tconst isLocal = definitionUrl.startsWith(\"local:\");\n\tconst guid = isLocal ? definitionUrl.substring(6) : null;\n\tconst recordMetric = (failureKind, extra = {}) => {\n\t\tgetSolveMetricSink().record(solveCtx, {\n\t\t\tdefinitionUrl,\n\t\t\tdefinitionId: metricDefinitionId,\n\t\t\tversionId: metricVersionId,\n\t\t\tchannel,\n\t\t\torgId: solveOrgId,\n\t\t\tdurationMs: extra.durationMs ?? 0,\n\t\t\tok: failureKind === \"ok\",\n\t\t\tfailureKind,\n\t\t\terrorCount: extra.errorCount ?? 0,\n\t\t\twarningCount: extra.warningCount ?? 0\n\t\t}).catch((err) => locals.log.error(\"Solve-metric record failed\", {\n\t\t\tcomponent: \"API/Compute\",\n\t\t\terr: renderThrown(err)\n\t\t}));\n\t};\n\tconst tokenVerdict = tokenCharged ? void 0 : await chargeApiRateLimit(access.ctx, apiRateLimiter);\n\tif (tokenVerdict && !tokenVerdict.allowed) {\n\t\trecordMetric(\"rate_limited\");\n\t\treturn rateLimitedResponse(tokenVerdict);\n\t}\n\tconst rateLimit = checkComputeRateLimit(access.rateLimitKey);\n\tif (!rateLimit.allowed) {\n\t\trecordMetric(\"rate_limited\");\n\t\tconst retryAfter = String(rateLimit.retryAfter ?? 1);\n\t\tconst err = new ApiError(429, ApiErrorCode.RATE_LIMITED, `Too many compute requests. Retry in ${retryAfter}s.`, void 0, { retryAfter });\n\t\treturn withRateLimitHeaders(new Response(JSON.stringify(toErrorBody(err)), {\n\t\t\tstatus: 429,\n\t\t\theaders: {\n\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\"Retry-After\": retryAfter\n\t\t\t}\n\t\t}), tokenVerdict);\n\t}\n\tif (isLocal && guid) {\n\t\tlet record;\n\t\ttry {\n\t\t\trecord = await providers.data.definitions.get(solveCtx, guid);\n\t\t} catch (err) {\n\t\t\tlocals.log.error(\"Failed to load local definition\", {\n\t\t\t\tcomponent: \"API/Compute\",\n\t\t\t\tguid,\n\t\t\t\terr: renderThrown(err)\n\t\t\t});\n\t\t\tapiError(404, ApiErrorCode.NOT_FOUND, `Definition '${guid}' not found`);\n\t\t}\n\t\tif (!record) apiError(404, ApiErrorCode.NOT_FOUND, `Definition '${guid}' not found`);\n\t\tmark(\"defRecord\");\n\t\tconst project = await providers.data.projects.getProject(solveCtx, record.projectId);\n\t\tsolveOrgId = project?.orgId ?? null;\n\t\tdefinitionPin = record.computeServerId ?? null;\n\t\tmark(\"project\");\n\t\tif (!sharedAccess) try {\n\t\t\tassertScope(access.ctx, \"solve\", {\n\t\t\t\tprojectId: record.projectId,\n\t\t\t\tdefinitionId: guid\n\t\t\t});\n\t\t\tif (channel === \"draft\" || explicitVersionId) await requireCanEditDefinition(scoped(locals), record.projectId, guid, {\n\t\t\t\tproject,\n\t\t\t\tdefinition: record\n\t\t\t});\n\t\t\telse await requireCanSolve(scoped(locals), record.projectId, project ?? void 0);\n\t\t} catch (err) {\n\t\t\tconst status = isApiError(err) ? err.status : isHttpError(err) ? err.status : void 0;\n\t\t\tif (concealAccessFailure && status === 403) apiError(404, ApiErrorCode.NOT_FOUND, `Definition '${guid}' not found`);\n\t\t\tthrow err;\n\t\t}\n\t\tmark(\"access\");\n\t\tconst versionId = explicitVersionId ?? (channel === \"live\" ? record.liveVersionId : record.draftVersionId);\n\t\tif (!versionId) apiError(404, ApiErrorCode.NOT_FOUND, `Definition '${guid}' has no ${channel} version yet`);\n\t\tconst version = await providers.data.definitions.getVersion(solveCtx, versionId);\n\t\tif (!version || version.definitionId !== guid) apiError(404, ApiErrorCode.NOT_FOUND, `Definition '${guid}' version is missing`);\n\t\tlocalVersionForBackfill = {\n\t\t\tid: version.id,\n\t\t\thasSchema: version.schema !== void 0\n\t\t};\n\t\tmetricDefinitionId = guid;\n\t\tmetricVersionId = version.id;\n\t\tmark(\"version\");\n\t\tlocalDefinitionRef = engine.definitionRef(version.id, async () => {\n\t\t\tconst bytes = await storage.get(version.fileKey);\n\t\t\tif (!bytes) throw new Error(`Version blob missing: ${version.fileKey}`);\n\t\t\treturn bytes;\n\t\t});\n\t\tdefinitionSource = localDefinitionRef;\n\t\tmark(\"blob\");\n\t} else {\n\t\tassertScope(access.ctx, \"solve\");\n\t\ttry {\n\t\t\tdefinitionSource = await loadRemoteDefinition(definitionUrl);\n\t\t} catch (err) {\n\t\t\tlocals.log.error(\"Failed to fetch remote definition\", {\n\t\t\t\tcomponent: \"API/Compute\",\n\t\t\t\tdefinitionUrl,\n\t\t\t\terr: renderThrown(err)\n\t\t\t});\n\t\t\tapiError(400, ApiErrorCode.VALIDATION_FAILED, `Failed to load definition: ${err instanceof Error ? err.message : String(err)}`);\n\t\t}\n\t\tmark(\"remoteDef\");\n\t}\n\tconst defLoadMs = performance.now() - loadStart;\n\tif (sharedAccess) {\n\t\tif (await providers.data.shareLinks.tryIncrementSolveCount(solveCtx, sharedAccess.link.id) === null) {\n\t\t\trecordMetric(\"share_cap\");\n\t\t\tapiError(429, ApiErrorCode.RATE_LIMITED, \"Share link solve cap reached.\");\n\t\t}\n\t\tmark(\"shareCap\");\n\t}\n\tconst serverConfig = await resolveServerForOrg(solveCtx, solveOrgId, locals.providers.data.computeServer, { definitionPin });\n\tmark(\"resolveServer\");\n\tif (localVersionForBackfill && !localVersionForBackfill.hasSchema && localDefinitionRef) {\n\t\tconst versionId = localVersionForBackfill.id;\n\t\ttry {\n\t\t\tconst bytes = await localDefinitionRef.load();\n\t\t\tconst schema = await fetchSchemaFromCompute(bytes, serverConfig);\n\t\t\tawait providers.data.definitions.setVersionSchema(solveCtx, versionId, schema);\n\t\t} catch (err) {\n\t\t\tlocals.log.warn(\"Schema backfill failed\", {\n\t\t\t\tcomponent: \"API/Compute\",\n\t\t\t\tversionId,\n\t\t\t\terr: renderThrown(err)\n\t\t\t});\n\t\t}\n\t\tmark(\"schemaBackfill\");\n\t}\n\tconst live = bindLiveSolve({\n\t\townerKey: liveOwnerKey(access.kind === \"user\" ? access.ctx.userId : null),\n\t\tstreamId,\n\t\trequest,\n\t\ttokenTtlMs: SOLVE_DEADLINE_MS + 6e4\n\t});\n\tlet outcome;\n\ttry {\n\t\toutcome = await engine.solve({\n\t\t\tserver: serverConfig,\n\t\t\tdefinitionSource,\n\t\t\tdefinitionKey: isLocal ? void 0 : definitionUrl,\n\t\t\tinputs,\n\t\t\tvalues,\n\t\t\tsignal: request.signal,\n\t\t\tacceptEncoding: request.headers.get(\"accept-encoding\") ?? \"\",\n\t\t\tdefinitionGuid: guid ?? void 0,\n\t\t\tloadStartMs: loadStart,\n\t\t\tdefLoadMs,\n\t\t\tprepMarks,\n\t\t\tselvaEvents: live.selvaEvents\n\t\t});\n\t} finally {\n\t\tlive.end(outcome ? solveEndedKind(outcome) : \"error\");\n\t}\n\tmark(\"solve\");\n\tif (outcome.kind === \"timeout\") recordMetric(\"timeout\", { durationMs: outcome.durationMs });\n\telse if (outcome.kind === \"client_abort\") recordMetric(\"client_abort\", { durationMs: outcome.durationMs });\n\telse if (outcome.kind === \"too_large\") recordMetric(\"too_large\");\n\telse if (outcome.kind === \"shed\") recordMetric(\"shed\", { durationMs: outcome.durationMs });\n\telse if (outcome.kind === \"ok\") {\n\t\trecordMetric(\"ok\", {\n\t\t\tdurationMs: outcome.solveMs,\n\t\t\terrorCount: outcome.errorCount,\n\t\t\twarningCount: outcome.warningCount\n\t\t});\n\t\tif (metricDefinitionId) providers.data.definitions.incrementSolveCount(solveCtx, metricDefinitionId).catch((err) => locals.log.warn(\"solveCount increment failed\", {\n\t\t\tcomponent: \"API/Compute\",\n\t\t\tdefinitionId: metricDefinitionId,\n\t\t\terr: renderThrown(err)\n\t\t}));\n\t\tif (COMPUTE_DEBUG) logDebugBreakdown(locals, request, outcome, defLoadMs, prepMarks);\n\t}\n\treturn withRateLimitHeaders(engine.toWebResponse(outcome), tokenVerdict);\n}\n/**\n* Both solve routes share this so they cannot drift on which failures read as\n* \"compute is down\" (503) versus a server bug (500).\n*/\nfunction mapSolveError(err, locals) {\n\tif (isHttpError(err)) throw err;\n\tif (isApiError(err)) apiError(err.status, err.code, err.message, err.fields, err.details);\n\tif (err instanceof ComputeServerUnconfiguredError) apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, err.message);\n\tconst message = err instanceof Error ? err.message : \"Unknown error\";\n\tlocals.log.error(\"Solve request failed\", {\n\t\tcomponent: \"API/Compute\",\n\t\terr: renderThrown(err),\n\t\t...err instanceof t && typeof err.context?.responseBody === \"string\" && { computeResponseBody: err.context.responseBody }\n\t});\n\tif (err instanceof t) {\n\t\tif (err.code === e.NETWORK_ERROR || err.code === e.CORS_ERROR) apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, \"Compute server is unreachable\");\n\t\tif (err.code === e.AUTH_ERROR) apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, \"Compute server rejected this deployment's credentials — check the compute API key configuration.\");\n\t\tif (err.code === e.RATE_LIMIT) apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, \"Compute server is rate-limiting requests. Retry shortly.\");\n\t\tif (err.code === e.TIMEOUT_ERROR) apiError(504, ApiErrorCode.COMPUTE_UNAVAILABLE, \"Compute server timed out running the solve.\");\n\t}\n\tif (err instanceof TypeError && message === \"fetch failed\") apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, \"Compute server is unreachable\");\n\tapiError(500, ApiErrorCode.INTERNAL, message);\n}\n/**\n* DEBUG (SELVA_FLAG_COMPUTE_DEBUG): the server-side overhead the solve metric's\n* `durationMs` doesn't capture. `load` = auth + DB + definition fetch; `tree` =\n* input tree build; `serialize` = JSON.stringify of the result.\n*/\nfunction logDebugBreakdown(locals, request, outcome, defLoadMs, prepMarks) {\n\tconst { metrics } = outcome.envelope;\n\tlocals.log.debug(\"Solve server-side phase breakdown\", {\n\t\tcomponent: \"Compute/server\",\n\t\tloadMs: Math.round(defLoadMs),\n\t\ttreeBuildMs: Math.round(metrics.treeBuildMs),\n\t\tsolveMs: Math.round(metrics.solveMs),\n\t\tserializeMs: Math.round(metrics.serializeMs),\n\t\tgzipMs: Math.round(metrics.gzipMs),\n\t\tserverTotalMs: Math.round(metrics.serverTotalMs),\n\t\tserializedBytes: metrics.serializedBytes\n\t});\n\tif (metrics.compressedBytes !== null) locals.log.debug(\"Response gzipped\", {\n\t\tcomponent: \"Compute/server\",\n\t\tserializedBytes: metrics.serializedBytes,\n\t\tcompressedBytes: metrics.compressedBytes,\n\t\tratio: Number((metrics.serializedBytes / metrics.compressedBytes).toFixed(1))\n\t});\n\telse {\n\t\tconst acceptEncoding = request.headers.get(\"accept-encoding\") ?? \"\";\n\t\tlocals.log.debug(\"Compression skipped\", {\n\t\t\tcomponent: \"Compute/server\",\n\t\t\tacceptEncoding,\n\t\t\thasAcceptEncoding: acceptEncoding !== \"\"\n\t\t});\n\t}\n\tlocals.log.debug(\"Prep breakdown\", {\n\t\tcomponent: \"Compute/server\",\n\t\t...Object.fromEntries(prepMarks.map(([label, ms]) => [`p_${label}Ms`, Math.round(ms)]))\n\t});\n\tconst db = engine.stats().definitionBytes;\n\tlocals.log.debug(\"Definition byte-cache counters\", {\n\t\tcomponent: \"Compute/def-bytes\",\n\t\thits: db.hits,\n\t\tmisses: db.misses,\n\t\tevictions: db.evictions,\n\t\tentries: db.entries,\n\t\tretainedBytes: db.bytes\n\t});\n}\nexport { runSolve as n, mapSolveError as t };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;AAcA;AACA;AACA;AACA;AACA;AACA,IAAI,OAAO,GAAG,6BAA6B,CAAC;AAC5C,CAAC,QAAQ,EAAE,2BAA2B;AACtC,CAAC,cAAc,EAAE,kCAAkC;AACnD,CAAC,UAAU,EAAE,8BAA8B;AAC3C,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,GAAG,EAAE;AACtB,CAAC,MAAM,EAAE;AACT,CAAC,CAAC;AACF;AACA,SAAS,oBAAoB,CAAC,GAAG,EAAE;AACnC,CAAC,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;AACzB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,QAAQ,CAAC,MAAM,EAAE;AAChC,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,oBAAoB,GAAG,KAAK,EAAE,QAAQ,GAAG,IAAI,EAAE,YAAY,GAAG,KAAK,EAAE,GAAG,MAAM;AAC5M,CAAC,MAAM,OAAO,GAAG,kBAAkB,EAAE;AACrC,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,KAAK,OAAO,GAAG,MAAM,GAAG,IAAI;AAC7D,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG;AAC5B,CAAC,IAAI,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;AACjC,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,KAAK;AACzB,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC;AACvD,EAAE,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;AAC9B,CAAC,CAAC;AACF,CAAC,IAAI,gBAAgB;AACrB,CAAC,IAAI,kBAAkB,GAAG,IAAI;AAC9B,CAAC,IAAI,uBAAuB,GAAG,IAAI;AACnC,CAAC,IAAI,UAAU,GAAG,IAAI;AACtB,CAAC,IAAI,aAAa,GAAG,IAAI;AACzB,CAAC,IAAI,kBAAkB,GAAG,IAAI;AAC9B,CAAC,IAAI,eAAe,GAAG,IAAI;AAC3B,CAAC,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC;AACnD,CAAC,MAAM,IAAI,GAAG,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI;AACzD,CAAC,MAAM,YAAY,GAAG,CAAC,WAAW,EAAE,KAAK,GAAG,EAAE,KAAK;AACnD,EAAE,kBAAkB,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE;AACxC,GAAG,aAAa;AAChB,GAAG,YAAY,EAAE,kBAAkB;AACnC,GAAG,SAAS,EAAE,eAAe;AAC7B,GAAG,OAAO;AACV,GAAG,KAAK,EAAE,UAAU;AACpB,GAAG,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC;AACpC,GAAG,EAAE,EAAE,WAAW,KAAK,IAAI;AAC3B,GAAG,WAAW;AACd,GAAG,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC;AACpC,GAAG,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI;AACvC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,4BAA4B,EAAE;AACnE,GAAG,SAAS,EAAE,aAAa;AAC3B,GAAG,GAAG,EAAE,YAAY,CAAC,GAAG;AACxB,GAAG,CAAC,CAAC;AACL,CAAC,CAAC;AACF,CAAC,MAAM,YAAY,GAAG,YAAY,GAAG,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,GAAG,EAAE,cAAc,CAAC;AAClG,CAAC,IAAI,YAAY,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE;AAC5C,EAAE,YAAY,CAAC,cAAc,CAAC;AAC9B,EAAE,OAAO,mBAAmB,CAAC,YAAY,CAAC;AAC1C,CAAC;AACD,CAAC,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,CAAC,YAAY,CAAC;AAC7D,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE;AACzB,EAAE,YAAY,CAAC,cAAc,CAAC;AAC9B,EAAE,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC;AACtD,EAAE,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,CAAC,oCAAoC,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC;AACzI,EAAE,OAAO,oBAAoB,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE;AAC7E,GAAG,MAAM,EAAE,GAAG;AACd,GAAG,OAAO,EAAE;AACZ,IAAI,cAAc,EAAE,kBAAkB;AACtC,IAAI,aAAa,EAAE;AACnB;AACA,GAAG,CAAC,EAAE,YAAY,CAAC;AACnB,CAAC;AACD,CAAC,IAAI,OAAO,IAAI,IAAI,EAAE;AACtB,EAAE,IAAI,MAAM;AACZ,EAAE,IAAI;AACN,GAAG,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC;AAChE,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,iCAAiC,EAAE;AACvD,IAAI,SAAS,EAAE,aAAa;AAC5B,IAAI,IAAI;AACR,IAAI,GAAG,EAAE,YAAY,CAAC,GAAG;AACzB,IAAI,CAAC;AACL,GAAG,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;AAC1E,EAAE;AACF,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;AACtF,EAAE,IAAI,CAAC,WAAW,CAAC;AACnB,EAAE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC;AACtF,EAAE,UAAU,GAAG,OAAO,EAAE,KAAK,IAAI,IAAI;AACrC,EAAE,aAAa,GAAG,MAAM,CAAC,eAAe,IAAI,IAAI;AAChD,EAAE,IAAI,CAAC,SAAS,CAAC;AACjB,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI;AACzB,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE;AACpC,IAAI,SAAS,EAAE,MAAM,CAAC,SAAS;AAC/B,IAAI,YAAY,EAAE;AAClB,IAAI,CAAC;AACL,GAAG,IAAI,OAAO,KAAK,OAAO,IAAI,iBAAiB,EAAE,MAAM,wBAAwB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE;AACxH,IAAI,OAAO;AACX,IAAI,UAAU,EAAE;AAChB,IAAI,CAAC;AACL,QAAQ,MAAM,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,IAAI,KAAK,CAAC,CAAC;AAClF,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,MAAM;AACvF,GAAG,IAAI,oBAAoB,IAAI,MAAM,KAAK,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;AACtH,GAAG,MAAM,GAAG;AACZ,EAAE;AACF,EAAE,IAAI,CAAC,QAAQ,CAAC;AAChB,EAAE,MAAM,SAAS,GAAG,iBAAiB,KAAK,OAAO,KAAK,MAAM,GAAG,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,cAAc,CAAC;AAC5G,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;AAC7G,EAAE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC;AAClF,EAAE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;AACjI,EAAE,uBAAuB,GAAG;AAC5B,GAAG,EAAE,EAAE,OAAO,CAAC,EAAE;AACjB,GAAG,SAAS,EAAE,OAAO,CAAC,MAAM,KAAK;AACjC,GAAG;AACH,EAAE,kBAAkB,GAAG,IAAI;AAC3B,EAAE,eAAe,GAAG,OAAO,CAAC,EAAE;AAC9B,EAAE,IAAI,CAAC,SAAS,CAAC;AACjB,EAAE,kBAAkB,GAAG,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY;AACpE,GAAG,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;AACnD,GAAG,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,sBAAsB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AAC1E,GAAG,OAAO,KAAK;AACf,EAAE,CAAC,CAAC;AACJ,EAAE,gBAAgB,GAAG,kBAAkB;AACvC,EAAE,IAAI,CAAC,MAAM,CAAC;AACd,CAAC,CAAC,MAAM;AACR,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC;AAClC,EAAE,IAAI;AACN,GAAG,gBAAgB,GAAG,MAAM,oBAAoB,CAAC,aAAa,CAAC;AAC/D,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,mCAAmC,EAAE;AACzD,IAAI,SAAS,EAAE,aAAa;AAC5B,IAAI,aAAa;AACjB,IAAI,GAAG,EAAE,YAAY,CAAC,GAAG;AACzB,IAAI,CAAC;AACL,GAAG,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,2BAA2B,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAClI,EAAE;AACF,EAAE,IAAI,CAAC,WAAW,CAAC;AACnB,CAAC;AACD,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS;AAChD,CAAC,IAAI,YAAY,EAAE;AACnB,EAAE,IAAI,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE;AACvG,GAAG,YAAY,CAAC,WAAW,CAAC;AAC5B,GAAG,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,+BAA+B,CAAC;AAC5E,EAAE;AACF,EAAE,IAAI,CAAC,UAAU,CAAC;AAClB,CAAC;AACD,CAAC,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,aAAa,EAAE,CAAC;AAC7H,CAAC,IAAI,CAAC,eAAe,CAAC;AACtB,CAAC,IAAI,uBAAuB,IAAI,CAAC,uBAAuB,CAAC,SAAS,IAAI,kBAAkB,EAAE;AAC1F,EAAE,MAAM,SAAS,GAAG,uBAAuB,CAAC,EAAE;AAC9C,EAAE,IAAI;AACN,GAAG,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE;AAChD,GAAG,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,YAAY,CAAC;AACnE,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC;AACjF,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE;AAC7C,IAAI,SAAS,EAAE,aAAa;AAC5B,IAAI,SAAS;AACb,IAAI,GAAG,EAAE,YAAY,CAAC,GAAG;AACzB,IAAI,CAAC;AACL,EAAE;AACF,EAAE,IAAI,CAAC,gBAAgB,CAAC;AACxB,CAAC;AACD,CAAC,MAAM,IAAI,GAAG,aAAa,CAAC;AAC5B,EAAE,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC;AAC3E,EAAE,QAAQ;AACV,EAAE,OAAO;AACT,EAAE,UAAU,EAAE,iBAAiB,GAAG;AAClC,EAAE,CAAC;AACH,CAAC,IAAI,OAAO;AACZ,CAAC,IAAI;AACL,EAAE,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC;AAC/B,GAAG,MAAM,EAAE,YAAY;AACvB,GAAG,gBAAgB;AACnB,GAAG,aAAa,EAAE,OAAO,GAAG,KAAK,CAAC,GAAG,aAAa;AAClD,GAAG,MAAM;AACT,GAAG,MAAM;AACT,GAAG,MAAM,EAAE,OAAO,CAAC,MAAM;AACzB,GAAG,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE;AAC/D,GAAG,cAAc,EAAE,IAAI,IAAI,KAAK,CAAC;AACjC,GAAG,WAAW,EAAE,SAAS;AACzB,GAAG,SAAS;AACZ,GAAG,SAAS;AACZ,GAAG,WAAW,EAAE,IAAI,CAAC;AACrB,GAAG,CAAC;AACJ,CAAC,CAAC,SAAS;AACX,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;AACvD,CAAC;AACD,CAAC,IAAI,CAAC,OAAO,CAAC;AACd,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,YAAY,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;AAC5F,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,YAAY,CAAC,cAAc,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;AAC3G,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC;AACjE,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;AAC3F,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE;AACjC,EAAE,YAAY,CAAC,IAAI,EAAE;AACrB,GAAG,UAAU,EAAE,OAAO,CAAC,OAAO;AAC9B,GAAG,UAAU,EAAE,OAAO,CAAC,UAAU;AACjC,GAAG,YAAY,EAAE,OAAO,CAAC;AACzB,GAAG,CAAC;AACJ,EAAE,IAAI,kBAAkB,EAAE,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE;AACrK,GAAG,SAAS,EAAE,aAAa;AAC3B,GAAG,YAAY,EAAE,kBAAkB;AACnC,GAAG,GAAG,EAAE,YAAY,CAAC,GAAG;AACxB,GAAG,CAAC,CAAC;AACL,EAAE,IAAI,aAAa,EAAE,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC;AACtF,CAAC;AACD,CAAC,OAAO,oBAAoB,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;AACzE;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE;AACpC,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG;AAChC,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC;AAC1F,CAAC,IAAI,GAAG,YAAY,8BAA8B,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,GAAG,CAAC,OAAO,CAAC;AAChH,CAAC,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,eAAe;AACrE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE;AAC1C,EAAE,SAAS,EAAE,aAAa;AAC1B,EAAE,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC;AACxB,EAAE,GAAG,GAAG,YAAY,CAAC,IAAI,OAAO,GAAG,CAAC,OAAO,EAAE,YAAY,KAAK,QAAQ,IAAI,EAAE,mBAAmB,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY;AACzH,EAAE,CAAC;AACH,CAAC,IAAI,GAAG,YAAY,CAAC,EAAE;AACvB,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,aAAa,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,+BAA+B,CAAC;AACjJ,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,kGAAkG,CAAC;AACpL,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,0DAA0D,CAAC;AAC5I,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,6CAA6C,CAAC;AAClI,CAAC;AACD,CAAC,IAAI,GAAG,YAAY,SAAS,IAAI,OAAO,KAAK,cAAc,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,+BAA+B,CAAC;AAC7I,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC;AAC9C;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE;AAC3E,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,QAAQ;AACrC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,mCAAmC,EAAE;AACvD,EAAE,SAAS,EAAE,gBAAgB;AAC7B,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;AAC/B,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;AAC9C,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;AACtC,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;AAC9C,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;AACpC,EAAE,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;AAClD,EAAE,eAAe,EAAE,OAAO,CAAC;AAC3B,EAAE,CAAC;AACH,CAAC,IAAI,OAAO,CAAC,eAAe,KAAK,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,kBAAkB,EAAE;AAC5E,EAAE,SAAS,EAAE,gBAAgB;AAC7B,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe;AAC1C,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe;AAC1C,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC;AAC9E,EAAE,CAAC;AACH,MAAM;AACN,EAAE,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE;AACrE,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE;AAC1C,GAAG,SAAS,EAAE,gBAAgB;AAC9B,GAAG,cAAc;AACjB,GAAG,iBAAiB,EAAE,cAAc,KAAK;AACzC,GAAG,CAAC;AACJ,CAAC;AACD,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE;AACpC,EAAE,SAAS,EAAE,gBAAgB;AAC7B,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AACxF,EAAE,CAAC;AACH,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,eAAe;AAC1C,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,gCAAgC,EAAE;AACpD,EAAE,SAAS,EAAE,mBAAmB;AAChC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI;AACf,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM;AACnB,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS;AACzB,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO;AACrB,EAAE,aAAa,EAAE,EAAE,CAAC;AACpB,EAAE,CAAC;AACH;;;;"}

package/build/server/chunks/chunks/sr-only-styles.js-Drt1VGf2.js

@@ -1,19 +0,0 @@
-import { f as styleToString } from './create-id.js-DyutBmRB.js';
-
-// ../../node_modules/.pnpm/svelte-toolbelt@0.10.6_@sveltejs+kit@2.70.3_@opentelemetry+api@1.9.1_@sveltejs+vite-plu_394b3d6b8b6cbb29d72b102c2c227167/node_modules/svelte-toolbelt/dist/utils/sr-only-styles.js
-var srOnlyStyles = {
-	position: "absolute",
-	width: "1px",
-	height: "1px",
-	padding: "0",
-	margin: "-1px",
-	overflow: "hidden",
-	clip: "rect(0, 0, 0, 0)",
-	whiteSpace: "nowrap",
-	borderWidth: "0",
-	transform: "translateX(-100%)"
-};
-styleToString(srOnlyStyles);
-
-export { srOnlyStyles as s };
-//# sourceMappingURL=sr-only-styles.js-Drt1VGf2.js.map

package/build/server/chunks/chunks/sr-only-styles.js-Drt1VGf2.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sr-only-styles.js-Drt1VGf2.js","sources":["../../../../.svelte-kit/output/server/chunks/sr-only-styles.js"],"sourcesContent":["import { p as styleToString } from \"./create-id.js\";\n// ../../node_modules/.pnpm/svelte-toolbelt@0.10.6_@sveltejs+kit@2.70.3_@opentelemetry+api@1.9.1_@sveltejs+vite-plu_394b3d6b8b6cbb29d72b102c2c227167/node_modules/svelte-toolbelt/dist/utils/sr-only-styles.js\nvar srOnlyStyles = {\n\tposition: \"absolute\",\n\twidth: \"1px\",\n\theight: \"1px\",\n\tpadding: \"0\",\n\tmargin: \"-1px\",\n\toverflow: \"hidden\",\n\tclip: \"rect(0, 0, 0, 0)\",\n\twhiteSpace: \"nowrap\",\n\tborderWidth: \"0\",\n\ttransform: \"translateX(-100%)\"\n};\nstyleToString(srOnlyStyles);\nexport { srOnlyStyles as t };\n"],"names":[],"mappings":";;AACA;AACG,IAAC,YAAY,GAAG;AACnB,CAAC,QAAQ,EAAE,UAAU;AACrB,CAAC,KAAK,EAAE,KAAK;AACb,CAAC,MAAM,EAAE,KAAK;AACd,CAAC,OAAO,EAAE,GAAG;AACb,CAAC,MAAM,EAAE,MAAM;AACf,CAAC,QAAQ,EAAE,QAAQ;AACnB,CAAC,IAAI,EAAE,kBAAkB;AACzB,CAAC,UAAU,EAAE,QAAQ;AACrB,CAAC,WAAW,EAAE,GAAG;AACjB,CAAC,SAAS,EAAE;AACZ;AACA,aAAa,CAAC,YAAY,CAAC;;;;"}

package/build/server/chunks/chunks/src.js-DYeCa7A9.js

@@ -1,518 +0,0 @@
-import { z } from 'zod';
-
-// ../platform/src/permissions/types.ts
-/**
-* Platform-scope permissions. All but `manage_api_tokens` are reserved for
-* Selva staff and instance operators; regular users hold an empty array.
-*
-* - `instance_admin`        — superuser; implies every other permission
-* - `manage_compute`        — configure the instance-wide Rhino.Compute pool
-* - `manage_instance_users` — disable/enable any user on the instance
-* - `manage_updates`        — run system updates
-* - `manage_api_tokens`     — mint API tokens for yourself
-*/
-var PlatformPermissionSchema = z.enum([
-	"instance_admin",
-	"manage_compute",
-	"manage_instance_users",
-	"manage_updates",
-	"manage_api_tokens"
-]);
-var ALL_PLATFORM_PERMISSIONS = PlatformPermissionSchema.options;
-/**
-* The permissions that admit someone to the `/admin` operator surface.
-* `manage_api_tokens` is granted to ordinary users, who have no business there.
-*/
-var OPERATOR_PLATFORM_PERMISSIONS = ALL_PLATFORM_PERMISSIONS.filter((p) => p !== "manage_api_tokens");
-var RESERVED_SLUG_SET = /* @__PURE__ */ new Set([
-	"o",
-	"api",
-	"admin",
-	"auth",
-	"login",
-	"logout",
-	"setup",
-	"settings",
-	"team",
-	"library",
-	"projects",
-	"accept-invite"
-]);
-/**
-* Coerces an arbitrary name into a slug candidate. Does not guarantee a valid
-* slug — an all-symbols name yields `''`, and reserved words pass through
-* untouched — run the result through `SlugSchema` where validity matters.
-*/
-function slugify(name) {
-	return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 63);
-}
-/** Lowercase alphanumeric with internal hyphens, 3–63 chars, not a reserved word. */
-var SlugSchema = z.string().min(3, "Slug must be at least 3 characters").max(63, "Slug must be at most 63 characters").regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/, "Slug must be lowercase alphanumeric with hyphens (no leading/trailing/consecutive hyphens)").refine((s) => !RESERVED_SLUG_SET.has(s), { message: "Slug is reserved and cannot be used" });
-var OrgRoleSchema = z.enum([
-	"owner",
-	"admin",
-	"member"
-]);
-/** Kinds of org-scoped branding asset. Adding a kind is a single entry here — path, upload route, store, and UI are all generic over it. */
-var OrgAssetKindSchema = z.enum(["logo", "favicon"]);
-var ALL_ORG_ASSET_KINDS = OrgAssetKindSchema.options;
-/** Org-scope permissions. A user may hold different sets in different orgs. */
-var OrgPermissionSchema = z.enum([
-	"manage_org_members",
-	"manage_org_compute",
-	"manage_definitions",
-	"manage_projects"
-]);
-var ALL_ORG_PERMISSIONS = OrgPermissionSchema.options;
-/** Governance perms — never grantable to `member`. */
-var OWNER_ADMIN_ONLY_PERMISSIONS = ["manage_org_members", "manage_org_compute"];
-var MEMBER_ASSIGNABLE_PERMISSIONS = ALL_ORG_PERMISSIONS.filter((p) => !OWNER_ADMIN_ONLY_PERMISSIONS.includes(p));
-/** Applied when adding a member without an explicit permissions list. */
-var DEFAULT_ORG_PERMISSIONS = {
-	owner: [...ALL_ORG_PERMISSIONS],
-	admin: [...ALL_ORG_PERMISSIONS],
-	member: []
-};
-var CreateOrgSchema = z.object({
-	name: z.string().min(1, "Organization name is required").max(128),
-	slug: SlugSchema
-});
-var UpdateOrgSchema = CreateOrgSchema.partial();
-// ../platform/src/apiTokens/types.ts
-/**
-* `write`, `solve` and `upload` each include `read`, and `write` includes
-* `upload`. `upload` covers only creating definitions, uploading versions,
-* checking a file's schema before upload and making a version live: it can't
-* edit metadata, delete or share.
-*/
-var ApiScopeActionSchema = z.enum([
-	"read",
-	"write",
-	"solve",
-	"upload"
-]);
-var SCOPE_PATTERN = /^(read|write|solve|upload):(all|(org|project|definition):([A-Za-z0-9_-]{1,128}))$/;
-/** `read:all`, `write:org:<id>`, `solve:project:<id>`, `read:definition:<guid>`. */
-function parseApiScope(value) {
-	const m = SCOPE_PATTERN.exec(value);
-	if (!m) return null;
-	const action = m[1];
-	if (m[2] === "all") return {
-		action,
-		resource: { kind: "all" }
-	};
-	return {
-		action,
-		resource: {
-			kind: m[3],
-			id: m[4]
-		}
-	};
-}
-function formatApiScope(scope) {
-	const { action, resource } = scope;
-	return resource.kind === "all" ? `${action}:all` : `${action}:${resource.kind}:${resource.id}`;
-}
-/**
-* Scopes are stored as strings so a new action or resource kind needs no
-* migration. Parsing rejects anything this version doesn't understand, so an
-* unknown scope grants nothing rather than being guessed at.
-*/
-var ApiScopeStringSchema = z.string().refine((s) => parseApiScope(s) !== null, { message: "Unknown scope" });
-z.enum([
-	"owner",
-	"admin",
-	"member_removed",
-	"user_disabled"
-]);
-/** The only lifetimes offered. Expiry is never optional. */
-var API_TOKEN_LIFETIME_DAYS = [
-	30,
-	90,
-	180
-];
-var ACTION_WORDS = {
-	read: "Read",
-	write: "Read and change",
-	solve: "Read and run solves on",
-	upload: "Read and upload definitions to"
-};
-/** "Read and change everything in the org". Names no ids, so it suits an email. */
-function describeApiScope(value) {
-	const scope = parseApiScope(value);
-	if (!scope) return `Unknown scope (${value})`;
-	const what = scope.resource.kind === "project" ? "one project" : scope.resource.kind === "definition" ? "one definition" : "everything in the org";
-	return `${ACTION_WORDS[scope.action]} ${what}`;
-}
-// ../platform/src/errors.ts
-/**
-* Thrown by providers to signal an expected failure the API layer forwards with
-* a specific status. Unknown errors should propagate as plain `Error` and become 500s.
-*/
-var ProviderError = class extends Error {
-	statusCode;
-	constructor(message, statusCode = 400) {
-		super(message);
-		this.name = "ProviderError";
-		this.statusCode = statusCode;
-	}
-};
-// ../platform/src/apiTokens/scope.ts
-/**
-* May this request perform `action` on `target`?
-*
-* Without a target this is an org-level check, which only `all` and org scopes
-* pass: a project key must never reach a route that can't say which project it
-* touches. Requests without an API token always pass; their permissions are
-* checked elsewhere.
-*/
-function scopeAllows(ctx, action, target) {
-	const api = ctx.apiScope;
-	if (!api) return true;
-	return api.scopes.some((s) => apiScopeActionCovers(s.action, action) && resourceCovers(s, ctx, target));
-}
-/** Does a scope granting `granted` allow `wanted`? */
-function apiScopeActionCovers(granted, wanted) {
-	return granted === wanted || wanted === "read" || granted === "write" && wanted === "upload";
-}
-function resourceCovers(scope, ctx, target) {
-	const { resource } = scope;
-	switch (resource.kind) {
-		case "all": return true;
-		case "org": return resource.id === ctx.actingOrgId;
-		case "project": return target?.projectId === resource.id;
-		case "definition": return target?.definitionId === resource.id;
-	}
-}
-/**
-* Narrow the owner's live context to what the token grants. Only removes
-* rights:
-*
-* - Platform permissions are dropped. Instance authority never rides on a
-*   bearer key, so an operator's leaked key can't reach other tenants.
-* - `apiScope` is attached, which `scopeAllows` reads.
-*
-* Scopes this version can't parse are dropped, so they grant nothing.
-*/
-function narrowApiTokenContext(ctx, token) {
-	if (ctx.actingOrgId !== token.orgId) throw new ProviderError("API token context must act in the token’s org", 500);
-	const scopes = token.scopes.map(parseApiScope).filter((s) => s !== null);
-	return {
-		...ctx,
-		platformPermissions: [],
-		apiScope: {
-			tokenId: token.id,
-			scopes,
-			expiresAt: token.expiresAt
-		}
-	};
-}
-/**
-* True when an API-token request reaches for something owned by an org other
-* than the token's. A token is bound to one org, so that resource doesn't
-* exist for it, even when the owner belongs to the other org too. Treat it as
-* not found. Session requests are never outside.
-*/
-function outsideTokenOrg(ctx, orgId) {
-	return ctx.apiScope !== void 0 && orgId !== ctx.actingOrgId;
-}
-// ../platform/src/projects/schemas.ts
-var ProjectVisibilitySchema = z.enum([
-	"public",
-	"org",
-	"private",
-	"platform"
-]);
-var ProjectRoleSchema = z.enum([
-	"owner",
-	"editor",
-	"viewer"
-]);
-/** Cross-field check for PATCH flows. Call on the merged post-patch shape. */
-function validateProjectFlags(merged) {
-	const issues = [];
-	if (merged.autoJoinOnUpload && merged.visibility !== "public") issues.push({
-		path: "autoJoinOnUpload",
-		message: "autoJoinOnUpload requires visibility=public"
-	});
-	if (merged.visibility === "platform" && merged.autoJoinOnUpload) issues.push({
-		path: "autoJoinOnUpload",
-		message: "autoJoinOnUpload is not allowed on platform projects"
-	});
-	return issues;
-}
-// ../platform/src/platformProjects/schemas.ts
-var PlatformProjectGranteeTypeSchema = z.enum(["org", "user"]);
-z.object({
-	id: z.string(),
-	projectId: z.string(),
-	granteeType: PlatformProjectGranteeTypeSchema,
-	granteeId: z.string(),
-	canSolve: z.boolean(),
-	createdBy: z.string(),
-	createdAt: z.string()
-});
-// ../platform/src/definitions/types.ts
-var GH_EXTENSIONS = [".gh", ".ghx"];
-var COVER_IMAGE_EXTENSIONS = [
-	".jpg",
-	".jpeg",
-	".png",
-	".webp",
-	".gif"
-];
-[...GH_EXTENSIONS, ...COVER_IMAGE_EXTENSIONS];
-var COVER_IMAGE_CONTENT_TYPES = {
-	".jpg": "image/jpeg",
-	".jpeg": "image/jpeg",
-	".png": "image/png",
-	".webp": "image/webp",
-	".gif": "image/gif"
-};
-function toDefinitionListItem(r) {
-	return {
-		guid: r.guid,
-		projectId: r.projectId,
-		displayName: r.displayName,
-		description: r.description,
-		category: r.category,
-		tags: r.tags,
-		coverImage: r.coverImage,
-		status: r.status,
-		solveCount: r.solveCount,
-		liveVersionId: r.liveVersionId,
-		sourceDocumentId: r.sourceDocumentId ?? null,
-		updatedAt: r.updatedAt
-	};
-}
-// ../platform/src/definitions/schemas.ts
-var UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-var GuidSchema = z.string().regex(UUID_REGEX, "Invalid GUID format");
-/** A Grasshopper document GUID as stores keep and compare it (lowercase), or null for anything else. */
-function toSourceDocumentId(value) {
-	return typeof value === "string" && UUID_REGEX.test(value) ? value.toLowerCase() : null;
-}
-var DefinitionStatusSchema = z.enum([
-	"draft",
-	"published",
-	"archived"
-]);
-var DefinitionFileExtSchema = z.enum(["gh", "ghx"]);
-z.object({
-	id: GuidSchema,
-	definitionId: GuidSchema,
-	versionNumber: z.number().int().min(1),
-	fileExt: DefinitionFileExtSchema,
-	fileKey: z.string().min(1),
-	originalFilename: z.string().max(256).optional(),
-	uploadedBy: z.string().min(1),
-	uploadedAt: z.string(),
-	changeNote: z.string().max(1e3).optional(),
-	schema: z.record(z.string(), z.unknown()).optional(),
-	schemaExtractedAt: z.string().optional()
-});
-var DefinitionChannelSchema = z.enum(["live", "draft"]);
-/** HTTP-body validator for new-definition input. */
-var CreateDefinitionInputSchema = z.object({
-	displayName: z.string().min(1, "Display name is required").max(256),
-	description: z.string().max(2e3).optional(),
-	coverImage: z.string().max(2048).optional(),
-	category: z.string().max(128).optional(),
-	tags: z.array(z.string().max(64)).max(20).optional(),
-	projectId: GuidSchema,
-	computeServerId: GuidSchema.optional()
-});
-/**
-* PATCH validator. Field semantics match `DefinitionRecordPatch`:
-* - missing / `undefined` — leave unchanged
-* - `null` — clear (only on nullable fields)
-* - value — set
-*/
-var UpdateMetadataInputSchema = z.object({
-	displayName: z.string().min(1, "Display name is required").max(256).optional(),
-	description: z.string().max(2e3).nullable().optional(),
-	coverImage: z.string().max(2048).nullable().optional(),
-	category: z.string().max(128).nullable().optional(),
-	tags: z.array(z.string().max(64)).max(20).nullable().optional(),
-	projectId: GuidSchema.optional(),
-	computeServerId: GuidSchema.nullable().optional(),
-	solveCacheLimit: z.number().int().min(0).max(1e5).nullable().optional(),
-	status: DefinitionStatusSchema.optional()
-});
-/** Body for `POST /api/definitions/[guid]/publish`. */
-var PublishVersionInputSchema = z.object({ versionId: GuidSchema.optional() }).default({});
-// ../platform/src/shareLinks/schemas.ts
-/**
-* HTTP body for `POST /api/definitions/[guid]/share-links`. The route returns
-* the raw token exactly once.
-*/
-var CreateShareLinkInputSchema = z.object({
-	channel: DefinitionChannelSchema.default("live"),
-	name: z.string().max(128).optional(),
-	allowSolve: z.boolean().default(true),
-	/** Null is the minter's deliberate "uncap" choice; omitted applies the default cap. */
-	maxSolves: z.number().int().min(1).nullable().optional(),
-	expiresAt: z.iso.datetime().nullable().optional()
-});
-// ../platform/src/storage/image.ts
-/**
-* Shared image-transcoding helper for `IStorageProvider` implementations.
-* Normalizes uploads to WebP (capped at 1200px, quality 85) so storage,
-* bandwidth, and the viewer path stay predictable.
-*
-* `sharp` is a dynamic import, not a hard dependency of this package —
-* providers that need transcoding install it themselves.
-*/
-var IMAGE_MAX_WIDTH = 1200;
-/** True if the input looks like an image to process — by content type or path extension. */
-function isImageUpload(contentType, storagePath) {
-	if (contentType?.startsWith("image/")) return true;
-	return /\.(webp|png|jpe?g|gif|bmp|tif?f|svg)$/i.test(storagePath);
-}
-/**
-* Rewrites a path's extension to `.webp`; unchanged for non-image extensions.
-* SVG is rasterized like any other input, so no vector blob is ever
-* persisted — served bytes stay XSS-free without a sanitizer.
-*/
-function toWebpPath(storagePath) {
-	return storagePath.replace(/\.(png|jpe?g|gif|bmp|tif?f|svg)$/i, ".webp");
-}
-/**
-* Transcodes images to WebP; passes non-images through unchanged, so
-* providers can call this unconditionally before `put`.
-*
-* Throws if `sharp` isn't installed — a config error, not a fallback.
-*/
-async function transcodeImageIfNeeded(data, contentType, storagePath) {
-	if (!isImageUpload(contentType, storagePath)) return {
-		data,
-		contentType: contentType ?? "application/octet-stream",
-		path: storagePath
-	};
-	const compressed = await (await loadSharp())(Buffer.from(data)).resize({
-		width: IMAGE_MAX_WIDTH,
-		withoutEnlargement: true
-	}).webp({ quality: 85 }).toBuffer();
-	return {
-		data: new Uint8Array(compressed),
-		contentType: "image/webp",
-		path: toWebpPath(storagePath)
-	};
-}
-var cachedSharp = null;
-async function loadSharp() {
-	if (cachedSharp) return cachedSharp;
-	try {
-		const mod = await import('sharp');
-		cachedSharp = mod.default ?? mod;
-		return cachedSharp;
-	} catch (err) {
-		throw new Error("Image transcoding requires `sharp` to be installed. Add it as a dependency in your provider package.", { cause: err });
-	}
-}
-// ../platform/src/storage/assetClasses.ts
-var BRANDING_KINDS = ALL_ORG_ASSET_KINDS.join("|");
-var COVER_EXTS = COVER_IMAGE_EXTENSIONS.map((ext) => ext.replace(/^\./, "").replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|");
-var SAFE_SEGMENT = String.raw`[A-Za-z0-9._-]+`;
-var GUID = String.raw`[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}`;
-/**
-* The closed registry of servable asset classes. Patterns are mutually
-* exclusive by prefix, order doesn't matter. Anything matching no class is
-* unservable (the route 404s) — default-deny, so a new blob type is opt-in.
-*/
-var ASSET_CLASSES = [
-	{
-		id: "org-branding",
-		visibility: "public",
-		scope: "none",
-		pattern: new RegExp(String.raw`^orgs\/(${SAFE_SEGMENT})\/branding\/(?:${BRANDING_KINDS})\.webp$`)
-	},
-	{
-		id: "org-private",
-		visibility: "org",
-		scope: "org",
-		pattern: new RegExp(String.raw`^orgs\/(${SAFE_SEGMENT})\/private\/${SAFE_SEGMENT}$`)
-	},
-	{
-		id: "definition-cover",
-		visibility: "project",
-		scope: "project",
-		pattern: new RegExp(String.raw`^definitions\/(${GUID})\/cover\.(?:${COVER_EXTS})$`, "i")
-	}
-];
-/**
-* Rejects traversal, empty, or backslash segments before a path can match a
-* class. The permissive segment alphabet (`[A-Za-z0-9._-]+`) admits a bare
-* `.` or `..` as a whole segment, which would otherwise let
-* `orgs/../branding/logo.webp` classify as public branding with `..`
-* captured as the orgId. Mirrors `assertSafeKey` on the write side, so a path
-* that can't be written can't be read either.
-*/
-function hasUnsafeSegment(storagePath) {
-	if (storagePath.includes("\\")) return true;
-	for (const segment of storagePath.split("/")) if (segment === "" || segment === "." || segment === "..") return true;
-	return false;
-}
-/**
-* Classifies a storage path into its asset class and scope id, or null when
-* no class matches (or the path is unsafe). `getPublicUrl` and the serving
-* route both consult this so URL generation and authorization never drift
-* apart.
-*
-* `scopeId` is null for `scope: 'none'` classes even when the pattern
-* captures an id (e.g. `org-branding` captures orgId but is public).
-*/
-function classifyAssetPath(storagePath) {
-	if (hasUnsafeSegment(storagePath)) return null;
-	for (const cls of ASSET_CLASSES) {
-		const m = cls.pattern.exec(storagePath);
-		if (!m) continue;
-		return {
-			class: cls,
-			scopeId: cls.scope === "none" ? null : m[1] ?? null
-		};
-	}
-	return null;
-}
-// ../platform/src/context.ts
-/** For server-internal operations outside any HTTP request (bootstrap, janitors, migrations). */
-var SYSTEM_CONTEXT = {
-	userId: "",
-	platformPermissions: [...ALL_PLATFORM_PERMISSIONS],
-	orgPermissions: [...ALL_ORG_PERMISSIONS],
-	system: true
-};
-/**
-* Does not cross-check `ctx.actingOrgId` — the caller must build a context scoped
-* to the org it's acting on. An org permission against a context without
-* `actingOrgId` returns false unless `instance_admin` or `system`.
-*/
-function hasPermission(ctx, permission) {
-	if (ctx.system) return true;
-	if (ctx.platformPermissions.includes("instance_admin")) return true;
-	if (isPlatformPermission(permission)) return ctx.platformPermissions.includes(permission);
-	return ctx.orgPermissions.includes(permission);
-}
-/**
-* An anonymous share-link holder. `system` is true on these contexts for adapter
-* dispatch only — a guard that treats `system` as "fully authorized" must
-* exclude them first.
-*/
-function isShareContext(ctx) {
-	return ctx.shareLinkId !== void 0;
-}
-/**
-* Refuse a privileged operation to a share-link context. Call at the top of any
-* guard whose first line is `if (ctx.system) return` — the token grants one
-* definition on one channel, never instance authority.
-*/
-function assertNotShareContext(ctx, what) {
-	if (isShareContext(ctx)) throw new ProviderError(`Forbidden: a share link cannot ${what}`, 403);
-}
-var PLATFORM_PERMISSION_VALUES = new Set(ALL_PLATFORM_PERMISSIONS);
-function isPlatformPermission(p) {
-	return PLATFORM_PERMISSION_VALUES.has(p);
-}
-
-export { ALL_PLATFORM_PERMISSIONS as A, OrgAssetKindSchema as B, COVER_IMAGE_CONTENT_TYPES as C, DEFAULT_ORG_PERMISSIONS as D, validateProjectFlags as E, OPERATOR_PLATFORM_PERMISSIONS as F, GH_EXTENSIONS as G, CreateOrgSchema as H, UpdateOrgSchema as I, OWNER_ADMIN_ONLY_PERMISSIONS as J, MEMBER_ASSIGNABLE_PERMISSIONS as M, OrgPermissionSchema as O, ProviderError as P, SYSTEM_CONTEXT as S, UpdateMetadataInputSchema as U, ALL_ORG_PERMISSIONS as a, transcodeImageIfNeeded as b, classifyAssetPath as c, assertNotShareContext as d, ProjectVisibilitySchema as e, ProjectRoleSchema as f, PlatformPermissionSchema as g, hasPermission as h, OrgRoleSchema as i, API_TOKEN_LIFETIME_DAYS as j, ApiScopeStringSchema as k, apiScopeActionCovers as l, slugify as m, narrowApiTokenContext as n, outsideTokenOrg as o, parseApiScope as p, ApiScopeActionSchema as q, describeApiScope as r, scopeAllows as s, toSourceDocumentId as t, toDefinitionListItem as u, CreateDefinitionInputSchema as v, GuidSchema as w, PublishVersionInputSchema as x, CreateShareLinkInputSchema as y, formatApiScope as z };
-//# sourceMappingURL=src.js-DYeCa7A9.js.map