@selvajs/selva 4.20.0-beta.15 → 4.20.0-beta.16

package/build/server/chunks/chunks/api.js-Chw-vSDJ.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js-Chw-vSDJ.js","sources":["../../../../.svelte-kit/output/server/chunks/api.js"],"sourcesContent":["import { A as isApiError, B as outsideTokenOrg, D as ApiErrorCode, E as ApiError, N as readNonNegativeInt, O as apiError, P as readPositiveInt, R as apiScopeActionCovers, V as scopeAllows, j as toErrorBody } from \"./access.js\";\nimport { r as ApiScopeStringSchema, t as API_TOKEN_LIFETIME_DAYS } from \"./types.js\";\nimport { c as OrgPermissionSchema, l as OrgRoleSchema, n as ALL_ORG_PERMISSIONS } from \"./schemas.js\";\nimport { r as PlatformPermissionSchema } from \"./types3.js\";\nimport { t as createComputeRateLimiter } from \"./rate-limit.js\";\nimport { createHash } from \"node:crypto\";\nimport { z } from \"zod\";\n// ../platform/src/projects/schemas.ts\nvar ProjectVisibilitySchema = z.enum([\n\t\"public\",\n\t\"org\",\n\t\"private\",\n\t\"platform\"\n]);\nvar ProjectRoleSchema = z.enum([\n\t\"owner\",\n\t\"editor\",\n\t\"viewer\"\n]);\n/** Cross-field check for PATCH flows. Call on the merged post-patch shape. */\nfunction validateProjectFlags(merged) {\n\tconst issues = [];\n\tif (merged.autoJoinOnUpload && merged.visibility !== \"public\") issues.push({\n\t\tpath: \"autoJoinOnUpload\",\n\t\tmessage: \"autoJoinOnUpload requires visibility=public\"\n\t});\n\tif (merged.visibility === \"platform\" && merged.autoJoinOnUpload) issues.push({\n\t\tpath: \"autoJoinOnUpload\",\n\t\tmessage: \"autoJoinOnUpload is not allowed on platform projects\"\n\t});\n\treturn issues;\n}\n/**\n* `T` is whatever the caller replays. It must not be a `Response` — a body can\n* only be read once, so the solve route stores a serialized snapshot instead.\n* `weigh` measures a completed value for `maxWeight`.\n*/\nfunction createIdempotencyStore(config, weigh = () => 0) {\n\tconst ttlMs = Math.max(0, Math.floor(config.ttlMs));\n\tconst maxKeys = Math.max(1, Math.floor(config.maxKeys ?? 1e4));\n\tconst sweepIntervalMs = Math.max(0, Math.floor(config.sweepIntervalMs ?? ttlMs));\n\tconst maxWeight = config.maxWeight ?? Number.POSITIVE_INFINITY;\n\tconst resolvedConfig = Object.freeze({\n\t\t...config,\n\t\tttlMs,\n\t\tmaxKeys,\n\t\tsweepIntervalMs\n\t});\n\tconst entries = /* @__PURE__ */ new Map();\n\tlet nextSweepAt = Number.POSITIVE_INFINITY;\n\tlet totalWeight = 0;\n\tfunction drop(key) {\n\t\tconst entry = entries.get(key);\n\t\tif (!entry) return;\n\t\ttotalWeight -= entry.weight;\n\t\tentries.delete(key);\n\t}\n\t/** Settled entries only, nearest expiry first: in-flight ones have retries awaiting them. */\n\tfunction shedWeight() {\n\t\tif (totalWeight <= maxWeight) return;\n\t\tconst settled = [...entries.entries()].filter(([, e]) => e.expiresAt !== null).sort((a, b) => a[1].expiresAt - b[1].expiresAt);\n\t\tfor (const [key] of settled) {\n\t\t\tif (totalWeight <= maxWeight) break;\n\t\t\tdrop(key);\n\t\t}\n\t}\n\tfunction maybeSweep(now, headroom = 0) {\n\t\tconst budget = Math.max(0, maxKeys - headroom);\n\t\tif (!(sweepIntervalMs > 0 && now >= nextSweepAt) && entries.size <= budget) return;\n\t\tfor (const [key, entry] of entries) if (entry.expiresAt !== null && now > entry.expiresAt) drop(key);\n\t\tif (sweepIntervalMs > 0) nextSweepAt = now + sweepIntervalMs;\n\t\tif (entries.size > budget) {\n\t\t\tconst byExpiryAsc = [...entries.entries()].sort((a, b) => (a[1].expiresAt ?? Infinity) - (b[1].expiresAt ?? Infinity));\n\t\t\tfor (let i = 0; i < byExpiryAsc.length - budget; i++) drop(byExpiryAsc[i][0]);\n\t\t}\n\t}\n\treturn {\n\t\tconfig: resolvedConfig,\n\t\tasync run(key, fn) {\n\t\t\tconst now = Date.now();\n\t\t\tconst existing = entries.get(key);\n\t\t\tif (existing && (existing.expiresAt === null || now <= existing.expiresAt)) return {\n\t\t\t\tvalue: await existing.promise,\n\t\t\t\treplayed: true\n\t\t\t};\n\t\t\tmaybeSweep(now, entries.has(key) ? 0 : 1);\n\t\t\tconst promise = fn();\n\t\t\tconst entry = {\n\t\t\t\tpromise,\n\t\t\t\texpiresAt: null,\n\t\t\t\tweight: 0\n\t\t\t};\n\t\t\tdrop(key);\n\t\t\tentries.set(key, entry);\n\t\t\tif (sweepIntervalMs > 0 && nextSweepAt === Number.POSITIVE_INFINITY) nextSweepAt = now + sweepIntervalMs;\n\t\t\ttry {\n\t\t\t\tconst value = await promise;\n\t\t\t\tentry.expiresAt = Date.now() + ttlMs;\n\t\t\t\tif (entries.get(key) === entry) {\n\t\t\t\t\tentry.weight = weigh(value);\n\t\t\t\t\ttotalWeight += entry.weight;\n\t\t\t\t\tshedWeight();\n\t\t\t\t}\n\t\t\t\treturn {\n\t\t\t\t\tvalue,\n\t\t\t\t\treplayed: false\n\t\t\t\t};\n\t\t\t} catch (err) {\n\t\t\t\tif (entries.get(key) === entry) drop(key);\n\t\t\t\tthrow err;\n\t\t\t}\n\t\t},\n\t\treset() {\n\t\t\tentries.clear();\n\t\t\ttotalWeight = 0;\n\t\t\tnextSweepAt = Number.POSITIVE_INFINITY;\n\t\t},\n\t\tsize() {\n\t\t\treturn entries.size;\n\t\t}\n\t};\n}\n// ../server/src/api/request.ts\n/**\n* The authenticated caller, or a 401.\n*\n* `ctx` and `user` are optional on `ApiRequest` because a host builds one for\n* anonymous requests too (share-token solves reach handlers with a `ctx` and no\n* `user`). Every handler that needs an identity narrows it here rather than\n* asserting the fields non-null, so the unauthenticated path fails as a denial\n* instead of a crash.\n*/\nfunction requireCaller(req) {\n\tif (!req.ctx || !req.user) apiError(401, ApiErrorCode.UNAUTHORIZED, \"Unauthorized\");\n\treturn {\n\t\tctx: req.ctx,\n\t\tuser: req.user\n\t};\n}\n/**\n* Fail with a Zod error's messages, one per field.\n*\n* The top-level `message` names the first problem so a human reading the\n* response learns something without parsing `fields`.\n*/\nfunction throwZodError(err) {\n\tconst fields = {};\n\tfor (const issue of err.issues) {\n\t\tconst key = issue.path.length ? issue.path.join(\".\") : \"_\";\n\t\tif (!(key in fields)) fields[key] = issue.message;\n\t}\n\tconst first = err.issues[0];\n\tconst path = first.path.length ? `${first.path.join(\".\")}: ` : \"\";\n\tapiError(400, ApiErrorCode.VALIDATION_FAILED, `${path}${first.message}`, fields);\n}\n/**\n* Read required path params, 400ing on any that is missing or blank.\n*\n* A router types every param as `string`, but a route can be reached with an\n* empty segment — this catches that instead of letting a stale non-null\n* assertion paper over it.\n*\n* Does **not** validate format — a guid-shaped param still goes through a\n* schema where the route cares. Replaces the `if (!id) apiError(...)` preamble,\n* not the schema check.\n*/\nfunction requireParams(params, ...names) {\n\tconst out = {};\n\tconst missing = [];\n\tfor (const name of names) {\n\t\tconst value = params[name];\n\t\tif (!value) {\n\t\t\tmissing.push(name);\n\t\t\tcontinue;\n\t\t}\n\t\tout[name] = value;\n\t}\n\tif (missing.length) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Missing path parameter${missing.length > 1 ? \"s\" : \"\"}: ${missing.join(\", \")}`);\n\treturn out;\n}\n/**\n* Read a path param through a Zod schema, 400ing on a bad value.\n*\n* The format-checking counterpart to `requireParams` — for guids, enum-shaped\n* segments, anything where \"present\" isn't the same as \"valid\".\n*/\nfunction parseParam(value, schema, name) {\n\tconst parsed = schema.safeParse(value);\n\tif (!parsed.success) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid or missing ${name}`);\n\treturn parsed.data;\n}\n/**\n* Parse and validate a JSON body. Broken JSON is a 400, not a 500 from\n* `request.json()`.\n*\n* `missingAs` covers endpoints whose fields are all optional: passing `{}` lets\n* an empty body mean \"no changes\" instead of a validation failure. Only an\n* empty body: a truncated `{\"versionId\":…` read as \"no changes\" would publish\n* the draft instead of rolling back.\n*/\nasync function parseBody(request, schema, { missingAs } = {}) {\n\tconst text = await request.text().catch(() => \"\");\n\tlet raw = null;\n\tif (text.trim()) try {\n\t\traw = JSON.parse(text);\n\t} catch {\n\t\tapiError(400, ApiErrorCode.VALIDATION_FAILED, \"The request body is not valid JSON.\");\n\t}\n\tconst parsed = schema.safeParse(raw ?? missingAs ?? null);\n\tif (!parsed.success) throwZodError(parsed.error);\n\treturn parsed.data;\n}\nvar parsedForms = /* @__PURE__ */ new WeakMap();\n/**\n* The request's form body, parsed once: the idempotency fingerprint reads it\n* before the handler does, and a definition upload is too large to buffer twice.\n* On an idempotent route, `request.formData()` throws: the body is already used.\n* A conformance test keeps handlers off it.\n*/\nfunction readForm(request) {\n\tlet form = parsedForms.get(request);\n\tif (!form) {\n\t\tform = request.formData().catch(() => apiError(400, ApiErrorCode.VALIDATION_FAILED, \"The request body is not a valid form.\"));\n\t\tparsedForms.set(request, form);\n\t}\n\treturn form;\n}\n/**\n* Pull a required file out of a multipart body and check its size and, where\n* given, its extension.\n*\n* A second line of defence, not the first: a host's body-size guard should\n* reject an oversized request before it is buffered. This catches a file that\n* is individually too large inside a request that isn't.\n*\n* Caps are passed in rather than read here — they are deployment config, and a\n* package that resolved them would pin every host to one source of truth.\n*/\nfunction requireUpload(form, field, { maxBytes, extensions, contentTypes, label = \"File\" }) {\n\tconst file = form.get(field);\n\tif (!(file instanceof File) || file.size === 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, `A ${label.toLowerCase()} is required`);\n\tconst extension = file.name.slice(file.name.lastIndexOf(\".\")).toLowerCase();\n\tif (extensions && !extensions.includes(extension)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `File type not allowed. Allowed: ${extensions.join(\", \")}`);\n\tif (contentTypes && !contentTypes.allowed.has(file.type)) apiError(400, ApiErrorCode.VALIDATION_FAILED, contentTypes.message);\n\tif (file.size > maxBytes) apiError(400, ApiErrorCode.VALIDATION_FAILED, `${label} too large. Max size: ${maxBytes / 1048576} MB`);\n\treturn {\n\t\tfile,\n\t\textension\n\t};\n}\n/** A multipart text field, trimmed and length-capped. Absent stays `undefined`. */\nfunction formText(form, field, { maxLength } = {}) {\n\tconst raw = form.get(field);\n\tif (typeof raw !== \"string\") return void 0;\n\tconst trimmed = raw.trim();\n\tif (!trimmed) return void 0;\n\treturn maxLength ? trimmed.slice(0, maxLength) : trimmed;\n}\n// ../server/src/api/scope.ts\n/** The default action for a method: reads are `read`, everything else `write`. */\nfunction actionForMethod(method) {\n\treturn method === \"GET\" || method === \"HEAD\" ? \"read\" : \"write\";\n}\n/**\n* Refuse an API-token request its scopes don't cover, with 403 naming the\n* scope that would have passed. Browser sessions always pass.\n*\n* `runHandler` calls this for every mounted route. A route that builds its own\n* `Response` must call it itself.\n*/\nfunction assertScope(ctx, action, target) {\n\tif (!ctx?.apiScope || scopeAllows(ctx, action, target)) return;\n\trecordRefusal(ctx.apiScope.tokenId);\n\tapiError(403, ApiErrorCode.FORBIDDEN, `This API token doesn't allow ${action} here.`, void 0, { requiredScope: requiredScope(ctx, action, target) });\n}\n/**\n* Refuse an API-token request whose key holds `action` on nothing at all. For\n* routes that act only on the caller's own solves and streams, which name no\n* project: a key that may solve in one project must still cancel and watch\n* those solves.\n*/\nfunction assertScopeAnywhere(ctx, action) {\n\tif (!ctx?.apiScope) return;\n\tif (ctx.apiScope.scopes.some((s) => apiScopeActionCovers(s.action, action))) return;\n\trecordRefusal(ctx.apiScope.tokenId);\n\tapiError(403, ApiErrorCode.FORBIDDEN, `This API token doesn't allow ${action}.`);\n}\nvar refusals = /* @__PURE__ */ new Map();\nvar utcDay = () => (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);\nfunction recordRefusal(tokenId) {\n\tconst day = utcDay();\n\tconst entry = refusals.get(tokenId);\n\tif (entry?.day === day) entry.count++;\n\telse refusals.set(tokenId, {\n\t\tday,\n\t\tcount: 1\n\t});\n}\n/** Scope refusals for `tokenId` since midnight UTC, in this process. */\nfunction scopeRefusalsToday(tokenId) {\n\tconst entry = refusals.get(tokenId);\n\treturn entry?.day === utcDay() ? entry.count : 0;\n}\nfunction requiredScope(ctx, action, target) {\n\tif (target?.projectId) return `${action}:project:${target.projectId}`;\n\tif (target?.definitionId) return `${action}:definition:${target.definitionId}`;\n\treturn `${action}:org:${ctx.actingOrgId}`;\n}\n/** Scope target for routes addressed by a project id param. */\nfunction projectScopeTarget(param = \"id\") {\n\treturn (req) => ({ projectId: req.params[param] });\n}\n/**\n* Scope target for routes addressed by a definition guid param. Loads the\n* record so a project-scoped key reaches the definitions inside its project.\n*\n* A definition outside the key's org resolves like a missing one: otherwise the\n* 403 detail would confirm the guid exists and name its project.\n*/\nfunction definitionScopeTarget(param = \"guid\") {\n\treturn async (req) => {\n\t\tconst definitionId = req.params[param];\n\t\tif (!definitionId || !req.ctx) return { definitionId };\n\t\tconst record = await req.deps.definitionMeta.get(req.ctx, definitionId);\n\t\tconst project = record ? await req.deps.projects.getProject(req.ctx, record.projectId) : null;\n\t\tif (!project || outsideTokenOrg(req.ctx, project.orgId)) return { definitionId };\n\t\treturn {\n\t\t\tdefinitionId,\n\t\t\tprojectId: project.id\n\t\t};\n\t};\n}\n// ../server/src/api/rate-limit.ts\nvar DEFAULT_API_RATE_LIMIT = Object.freeze({\n\twindowMs: 6e4,\n\tmaxPerWindow: 600\n});\n/**\n* Read `API_TOKEN_RATE_LIMIT_MAX` (requests per window, `0` = off) and\n* `API_TOKEN_RATE_LIMIT_WINDOW_MS` from an injected env map.\n*/\nfunction resolveApiRateLimitConfig(env, logger) {\n\treturn {\n\t\twindowMs: readPositiveInt(env, \"API_TOKEN_RATE_LIMIT_WINDOW_MS\", DEFAULT_API_RATE_LIMIT.windowMs, logger),\n\t\tmaxPerWindow: readNonNegativeInt(env, \"API_TOKEN_RATE_LIMIT_MAX\", DEFAULT_API_RATE_LIMIT.maxPerWindow, logger)\n\t};\n}\n/** Process-local fixed-window limiter. Returns `null` when `maxPerWindow` is 0. */\nfunction createApiRateLimiter(config = DEFAULT_API_RATE_LIMIT) {\n\tif (config.maxPerWindow <= 0) return null;\n\tconst inner = createComputeRateLimiter(config);\n\tconst limit = config.maxPerWindow;\n\treturn { hit(key) {\n\t\tconst result = inner.check(key);\n\t\treturn {\n\t\t\tallowed: result.allowed,\n\t\t\tlimit,\n\t\t\tremaining: Math.max(0, limit - inner.count(key)),\n\t\t\tretryAfter: result.retryAfter\n\t\t};\n\t} };\n}\nvar sharedDefault$1;\n/**\n* The limiter `depsFromConfig` wires when the host passes none. One per\n* process: deps are rebuilt per request, and a limiter per request counts\n* nothing.\n*/\nfunction defaultApiRateLimiter() {\n\tif (sharedDefault$1 === void 0) sharedDefault$1 = createApiRateLimiter();\n\treturn sharedDefault$1;\n}\n/**\n* Charge one request to the caller's token. `undefined` for a session caller\n* or when no limiter is wired.\n*/\nasync function chargeApiRateLimit(ctx, limiter) {\n\tif (!ctx?.apiScope || !limiter) return void 0;\n\treturn limiter.hit(`token:${ctx.apiScope.tokenId}`);\n}\nfunction rateLimitHeaders(verdict) {\n\tconst headers = {\n\t\t\"RateLimit-Limit\": String(verdict.limit),\n\t\t\"RateLimit-Remaining\": String(verdict.remaining)\n\t};\n\tif (!verdict.allowed) headers[\"Retry-After\"] = String(verdict.retryAfter ?? 1);\n\treturn headers;\n}\n/** The 429 envelope, with `Retry-After` and the `RateLimit-*` headers. */\nfunction rateLimitedResponse(verdict, message = `Too many requests for this API token. Retry in ${verdict.retryAfter ?? 1}s.`) {\n\tconst retryAfter = String(verdict.retryAfter ?? 1);\n\tconst err = new ApiError(429, ApiErrorCode.RATE_LIMITED, message, void 0, { retryAfter });\n\treturn new Response(JSON.stringify(toErrorBody(err)), {\n\t\tstatus: 429,\n\t\theaders: {\n\t\t\t\"content-type\": \"application/json\",\n\t\t\t...rateLimitHeaders(verdict)\n\t\t}\n\t});\n}\n/** Stamp the `RateLimit-*` headers onto a response. No-op without a verdict. */\nfunction withRateLimitHeaders(res, verdict) {\n\tif (!verdict) return res;\n\tconst headers = rateLimitHeaders(verdict);\n\ttry {\n\t\tfor (const [k, v] of Object.entries(headers)) res.headers.set(k, v);\n\t\treturn res;\n\t} catch {\n\t\tconst copy = new Headers(res.headers);\n\t\tfor (const [k, v] of Object.entries(headers)) copy.set(k, v);\n\t\treturn new Response(res.body, {\n\t\t\tstatus: res.status,\n\t\t\tstatusText: res.statusText,\n\t\t\theaders: copy\n\t\t});\n\t}\n}\n// ../server/src/api/idempotency-http.ts\n/**\n* The HTTP layer over {@link createIdempotencyStore}: how a replayed response\n* is keyed, snapshotted, and identified on the wire.\n*\n* The store itself is generic over `T` and knows nothing about requests. This\n* is the part two hosts must agree on to implement the same `Idempotency-Key`\n* contract, and the part each would otherwise reinvent:\n*\n*   - **The key namespaces by caller.** `Idempotency-Key` is client-chosen, so\n*     two tenants can pick the same string. Without the caller in the key one\n*     would replay the other's result — that is the whole security property\n*     here, and a host that got it wrong would leak across tenants with\n*     nothing failing at build time.\n*   - **The response round-trips through a snapshot.** A `Response` body reads\n*     exactly once, so storing the object itself replays an empty body.\n*   - **A replay says so**, via `Idempotency-Replayed`. A client that cannot\n*     tell a replay from a fresh run cannot tell a successful retry from a\n*     second execution.\n*\n* How long a response stays replayable is *not* here: that trades a client's\n* retry window against serving a stale result after the underlying resource\n* moves, and only the host knows its own deadlines.\n*/\n/** Header stamped on a replayed response, so a client can distinguish one. */\nvar IDEMPOTENCY_REPLAYED_HEADER = \"Idempotency-Replayed\";\n/**\n* Namespace a client-chosen key by its caller.\n*\n* `callerId` should be the narrowest identity available — a token id rather\n* than a user id where the host issues per-token credentials, so two tokens\n* held by one user do not share replays.\n*/\nfunction idempotencyKey(callerId, clientKey) {\n\treturn `${callerId} ${clientKey}`;\n}\n/** Flatten a response so it can be replayed. Consumes the body. */\nasync function toStoredResponse(res) {\n\treturn {\n\t\tstatus: res.status,\n\t\theaders: [...res.headers.entries()],\n\t\tbody: await res.arrayBuffer()\n\t};\n}\n/** Rebuild a live `Response` from a snapshot, marking it when it is a replay. */\nfunction fromStoredResponse(stored, replayed) {\n\tconst headers = new Headers(stored.headers);\n\tif (replayed) headers.set(IDEMPOTENCY_REPLAYED_HEADER, \"true\");\n\treturn new Response(stored.body, {\n\t\tstatus: stored.status,\n\t\theaders\n\t});\n}\n// ../server/src/api/idempotency.ts\n/**\n* `Idempotency-Key` for mounted routes that opt in with `idempotent: true`.\n*\n* Built on the generic store (`../compute/idempotency.ts`) and the wire\n* contract (`./idempotency-http.ts`). The store absorbs in-flight and near-term\n* retries in this process; it is not a durable record. A create that must never duplicate also needs the key on\n* the created row under a unique constraint, written in the same transaction.\n*\n* Each entry carries a fingerprint of method, path, query and body, so a client that\n* reuses a key for a different request gets 422 instead of someone else's\n* replay. Only responses below 400 are kept: a failed attempt frees the key so\n* a corrected retry can run.\n*/\nvar IDEMPOTENCY_KEY_HEADER = \"Idempotency-Key\";\n/** Covers a client's retry-on-timeout window without turning into a result cache. */\nvar DEFAULT_API_IDEMPOTENCY_TTL_MS = 3e5;\n/**\n* Replayable response bytes one store keeps. A solve response can run to\n* hundreds of MB, so the key cap alone would let a client that sends a fresh\n* key per solve hold gigabytes for the whole TTL. Evicting costs a re-run.\n*/\nvar DEFAULT_API_IDEMPOTENCY_MAX_BYTES = 268435456;\nvar CLIENT_CLOSED_REQUEST = 499;\nfunction createApiIdempotencyStore(ttlMs = DEFAULT_API_IDEMPOTENCY_TTL_MS, maxBytes = DEFAULT_API_IDEMPOTENCY_MAX_BYTES) {\n\treturn createIdempotencyStore({\n\t\tttlMs,\n\t\tmaxWeight: maxBytes\n\t}, (entry) => entry.response.body.byteLength);\n}\nvar sharedDefault;\n/** The store `depsFromConfig` wires when the host passes none. One per process. */\nfunction defaultApiIdempotencyStore() {\n\treturn sharedDefault ??= createApiIdempotencyStore();\n}\n/**\n* The narrowest identity a key is namespaced by: the token for a token\n* request, so two keys of one user never share replays, else the user.\n*/\nfunction idempotencyCallerId(ctx) {\n\treturn ctx.apiScope ? `token:${ctx.apiScope.tokenId}` : `user:${ctx.userId}`;\n}\n/** Read and validate the client's key. `null` when the header is absent. */\nfunction readIdempotencyKey(request) {\n\tconst key = request.headers.get(IDEMPOTENCY_KEY_HEADER);\n\tif (key === null) return null;\n\tif (key.length === 0 || key.length > 255) apiError(400, ApiErrorCode.VALIDATION_FAILED, `${IDEMPOTENCY_KEY_HEADER} must be 1 to 255 characters.`);\n\treturn key;\n}\nasync function sha256Hex(bytes) {\n\tconst digest = await crypto.subtle.digest(\"SHA-256\", bytes);\n\treturn Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n/** SHA-256 over method, path with query, and body, hex. */\nasync function requestFingerprint(method, url, body) {\n\tconst head = new TextEncoder().encode(`${method.toUpperCase()} ${url.pathname}${url.search}\\n`);\n\tconst tail = typeof body === \"string\" ? new TextEncoder().encode(body) : new Uint8Array(body);\n\tconst bytes = new Uint8Array(head.length + tail.length);\n\tbytes.set(head);\n\tbytes.set(tail, head.length);\n\treturn sha256Hex(bytes);\n}\nasync function fileSha256Hex(file) {\n\tconst hash = createHash(\"sha256\");\n\tfor await (const chunk of file.stream()) hash.update(chunk);\n\treturn hash.digest(\"hex\");\n}\n/**\n* The body `requestFingerprint` should hash. The handler can still read it: a\n* JSON body comes from a clone, a form through `readForm`, which parses it once\n* for both.\n*\n* Multipart is canonicalized to its fields and file contents: clients pick a\n* fresh random boundary per request, so the raw bytes of an identical retry\n* never match.\n*/\nasync function fingerprintBody(request) {\n\tif (!(request.headers.get(\"content-type\") ?? \"\").toLowerCase().startsWith(\"multipart/form-data\")) return request.clone().arrayBuffer();\n\tlet form;\n\ttry {\n\t\tform = await readForm(request);\n\t} catch {\n\t\treturn \"malformed multipart\";\n\t}\n\tconst parts = [];\n\tfor (const [name, value] of form) parts.push([name, typeof value === \"string\" ? value : {\n\t\tfile: value.name,\n\t\ttype: value.type,\n\t\tsha256: await fileSha256Hex(value)\n\t}]);\n\treturn JSON.stringify(parts);\n}\nvar NotReplayable = class {\n\tfingerprint;\n\tresponse;\n\tconstructor(fingerprint, response) {\n\t\tthis.fingerprint = fingerprint;\n\t\tthis.response = response;\n\t}\n};\nfunction assertSameRequest(stored, fingerprint) {\n\tif (stored !== fingerprint) apiError(422, ApiErrorCode.UNPROCESSABLE, `This ${IDEMPOTENCY_KEY_HEADER} was already used for a different request.`);\n}\n/**\n* Run `fn` once per `(callerId, clientKey)`, replaying its response to repeats\n* with `Idempotency-Replayed: true`. Throws 422 when the key was used for a\n* different request. Errors `fn` throws propagate and free the key.\n*/\nasync function runIdempotent({ store, callerId, clientKey, fingerprint }, fn) {\n\tlet outcome;\n\tlet ranHere = false;\n\ttry {\n\t\toutcome = await store.run(idempotencyKey(callerId, clientKey), async () => {\n\t\t\tranHere = true;\n\t\t\tconst res = await fn();\n\t\t\tconst response = await toStoredResponse(res);\n\t\t\tif (res.status >= 400) throw new NotReplayable(fingerprint, response);\n\t\t\treturn {\n\t\t\t\tfingerprint,\n\t\t\t\tresponse\n\t\t\t};\n\t\t});\n\t} catch (err) {\n\t\tif (!(err instanceof NotReplayable)) throw err;\n\t\tassertSameRequest(err.fingerprint, fingerprint);\n\t\tif (!ranHere && err.response.status === CLIENT_CLOSED_REQUEST) return runIdempotent({\n\t\t\tstore,\n\t\t\tcallerId,\n\t\t\tclientKey,\n\t\t\tfingerprint\n\t\t}, fn);\n\t\treturn fromStoredResponse(err.response, false);\n\t}\n\tassertSameRequest(outcome.value.fingerprint, fingerprint);\n\treturn fromStoredResponse(outcome.value.response, outcome.replayed);\n}\n// ../server/src/api/respond.ts\n/**\n* Turn a handler result — or a thrown `ApiError` — into a web-standard\n* `Response`.\n*\n* This is the whole serialization boundary. A host framework that speaks\n* `Request`/`Response` (SvelteKit, Next route handlers, Hono, Remix) needs only\n* to build an `ApiRequest` and call `runHandler`; one that does not can reuse\n* `toErrorBody` and serialize itself.\n*/\nfunction toResponse(result) {\n\tif (result instanceof Response) return result;\n\tconst { status, body, headers } = result;\n\tif (body === void 0) return new Response(null, {\n\t\tstatus: status ?? 204,\n\t\theaders\n\t});\n\treturn new Response(JSON.stringify(body), {\n\t\tstatus: status ?? 200,\n\t\theaders: {\n\t\t\t\"content-type\": \"application/json\",\n\t\t\t...headers\n\t\t}\n\t});\n}\n/** Run a handler and serialize whatever comes out, including failures. */\nasync function runHandler(handler, req, { fallback, mapError, action, scopeTarget, anyScope, idempotent }) {\n\tconst fail = (err) => {\n\t\tif (isApiError(err)) return toResponse({\n\t\t\tstatus: err.status,\n\t\t\tbody: toErrorBody(err)\n\t\t});\n\t\tconst mapped = mapError?.(err);\n\t\tif (mapped) return toResponse({\n\t\t\tstatus: mapped.status,\n\t\t\tbody: toErrorBody(mapped)\n\t\t});\n\t\treq.log.error(`[API] ${fallback}`, {\n\t\t\tcomponent: \"api\",\n\t\t\terr: err instanceof Error ? err.stack ?? err.message : String(err)\n\t\t});\n\t\treturn toResponse({\n\t\t\tstatus: 500,\n\t\t\tbody: {\n\t\t\t\tmessage: fallback,\n\t\t\t\tcode: ApiErrorCode.INTERNAL\n\t\t\t}\n\t\t});\n\t};\n\tlet verdict;\n\ttry {\n\t\tconst limiter = req.deps.apiRateLimiter === void 0 ? defaultApiRateLimiter() : req.deps.apiRateLimiter;\n\t\tverdict = await chargeApiRateLimit(req.ctx, limiter);\n\t\tif (verdict && !verdict.allowed) return rateLimitedResponse(verdict);\n\t} catch (err) {\n\t\treturn fail(err);\n\t}\n\tlet res;\n\ttry {\n\t\tif (req.ctx?.apiScope && !anyScope) assertScope(req.ctx, action ?? actionForMethod(req.request.method), scopeTarget ? await scopeTarget(req) : void 0);\n\t\tconst run = async () => {\n\t\t\ttry {\n\t\t\t\treturn toResponse(await handler(req));\n\t\t\t} catch (err) {\n\t\t\t\treturn fail(err);\n\t\t\t}\n\t\t};\n\t\tconst clientKey = idempotent && req.ctx ? readIdempotencyKey(req.request) : null;\n\t\tif (clientKey && req.ctx) {\n\t\t\tconst fingerprint = await requestFingerprint(req.request.method, req.url, await fingerprintBody(req.request));\n\t\t\tres = await runIdempotent({\n\t\t\t\tstore: req.deps.idempotency ?? defaultApiIdempotencyStore(),\n\t\t\t\tcallerId: idempotencyCallerId(req.ctx),\n\t\t\t\tclientKey,\n\t\t\t\tfingerprint\n\t\t\t}, run);\n\t\t} else res = await run();\n\t} catch (err) {\n\t\tres = fail(err);\n\t}\n\treturn withRateLimitHeaders(res, verdict);\n}\n// ../server/src/api/bodies.ts\n/**\n* Request-body validators for the API routes that take JSON.\n*\n* They live apart from their handlers so a spec generator can import them\n* without loading a host's route module — in Selva's case a `+server.ts` imports\n* `./$types`, which only resolves inside a SvelteKit build.\n*\n* **A JSON body accepted by an API route belongs in this file.** Adding one\n* inline is invisible to the generator, so the endpoint documents an empty body.\n* Multipart handlers are the exception — `FormData` has no Zod schema to derive\n* from, so their fields are described in the spec directly.\n*/\nvar SolveBodySchema = z.object({\n\tinputs: z.array(z.unknown()).default([]),\n\tvalues: z.record(z.string(), z.unknown()).default({}),\n\tchannel: z.enum([\"live\", \"draft\"]).default(\"live\"),\n\tversionId: z.string().optional(),\n\t/** Must name this same definition, or the route 400s instead of solving a different one. */\n\tdefinitionUrl: z.string().optional()\n});\nvar CreateProjectBodySchema = z.object({\n\tname: z.string().min(1, \"Project name is required\").max(128).trim(),\n\tdescription: z.string().max(2e3).optional(),\n\tvisibility: ProjectVisibilitySchema.default(\"private\"),\n\tautoJoinOnUpload: z.boolean().optional()\n});\nvar UpdateProjectBodySchema = z.object({\n\tname: z.string().min(1).max(128).trim(),\n\tdescription: z.string().max(2e3).nullish(),\n\tvisibility: ProjectVisibilitySchema,\n\tautoJoinOnUpload: z.boolean()\n}).partial();\nvar AddProjectMemberBodySchema = z.object({\n\tuserId: z.string().min(1, \"userId is required\"),\n\trole: ProjectRoleSchema\n});\nvar UpdateProjectMemberBodySchema = z.object({ role: ProjectRoleSchema });\n/** Platform-scope entries are dropped downstream — an invite only grants org rights. */\nvar FlatPermissionSchema = z.union([PlatformPermissionSchema, OrgPermissionSchema]);\nvar CreateInviteBodySchema = z.object({\n\temail: z.email(\"Valid email is required\").transform((s) => s.toLowerCase().trim()),\n\torgRole: OrgRoleSchema.default(\"member\"),\n\tpermissions: z.array(FlatPermissionSchema).default([])\n});\n/**\n* `apiKey` is tri-state: **omitted** keeps the stored key, **null** clears it, a\n* string replaces it. `.optional().nullable()` — not `.nullish()` — because the\n* two must stay distinguishable after parsing, or a request that just omits the\n* field would silently wipe the stored credential.\n*/\nvar IncomingComputeServerSchema = z.object({\n\tid: z.string().min(1),\n\tlabel: z.string().min(1),\n\tserverUrl: z.string().min(1),\n\tapiKey: z.string().nullable().optional(),\n\ttimeoutMs: z.number().optional(),\n\tretryCount: z.number().optional()\n});\nvar OrgComputePatchBodySchema = z.object({\n\tservers: z.array(IncomingComputeServerSchema),\n\t/** May name any server visible to the org. `null` clears the override; omitted leaves it untouched. */\n\tdefaultServerId: z.string().nullable().optional()\n});\nvar UpdateOrgMemberBodySchema = z.object({\n\trole: OrgRoleSchema.optional(),\n\tpermissions: z.array(z.enum(ALL_ORG_PERMISSIONS)).optional()\n}).refine((b) => b.role !== void 0 || b.permissions !== void 0, { message: \"Provide at least one of role, permissions\" });\nvar CreateApiTokenBodySchema = z.object({\n\tname: z.string().trim().min(1, \"Name is required\").max(100),\n\tscopes: z.array(ApiScopeStringSchema).min(1, \"Pick at least one scope\").max(20),\n\texpiresInDays: z.union(API_TOKEN_LIFETIME_DAYS.map((d) => z.literal(d)))\n});\n// ../server/src/api/responses-schema.ts\n/**\n* Response schemas for the v1 payloads that must not carry a stored secret.\n*\n* Four store types hold a credential next to fields a client legitimately\n* reads: `ShareLink.tokenHash`, `Invite.tokenHash` and `ApiToken.tokenHash` are HMACs of a token,\n* `ComputeServerCommon.apiKey` is a live Rhino.Compute key. Handlers used to\n* strip them by destructuring — `const { tokenHash: _omit, ...rest } = invite`\n* — which works until someone adds a field to the stored type or edits the line\n* away. Nothing fails at build time; the credential just starts appearing in a\n* response.\n*\n* Parsing through these schemas inverts the default: the response carries only\n* what the schema names, so a new field on the stored type is invisible to\n* clients until added here on purpose. Use them via `shaped`/`shapedCollection`\n* in `./route.ts`.\n*\n* These describe **responses**, not stored records — where the two differ (an\n* invite's one-time `acceptUrl`, a share link's `hasToken` sentinel) the\n* response is the authority.\n*/\nvar ShareLinkResponseSchema = z.object({\n\tid: z.string(),\n\tdefinitionId: z.string(),\n\tchannel: z.enum([\"live\", \"draft\"]),\n\tname: z.string().optional(),\n\tcreatedBy: z.string(),\n\tcreatedAt: z.string(),\n\texpiresAt: z.string().nullish(),\n\trevokedAt: z.string().nullish(),\n\tallowSolve: z.boolean(),\n\tmaxSolves: z.number().nullish(),\n\tsolveCount: z.number(),\n\t/** Sentinel replacing `tokenHash`: a token exists, its hash is not yours. */\n\thasToken: z.literal(true)\n});\n/** The mint response. `token` is the plaintext, returned exactly once. */\nvar CreatedShareLinkResponseSchema = z.object({\n\tlink: ShareLinkResponseSchema,\n\ttoken: z.string()\n});\nvar InviteResponseSchema = z.object({\n\tid: z.string(),\n\temail: z.string(),\n\torgId: z.string(),\n\torgRole: z.string(),\n\torgPermissions: z.array(z.string()),\n\tplatformPermissions: z.array(z.string()).default([]),\n\tinvitedBy: z.string(),\n\tcreatedAt: z.string(),\n\texpiresAt: z.string(),\n\tacceptedAt: z.string().optional(),\n\tacceptedByUserId: z.string().optional()\n});\n/**\n* The create response: the invite plus the link to send, built per request.\n*\n* `acceptUrl` is returned whatever `delivery` says — mail is best-effort, and\n* manual sharing is the fallback when it is off or the send failed.\n*/\nvar CreatedInviteResponseSchema = InviteResponseSchema.extend({\n\tacceptUrl: z.string(),\n\tdelivery: z.enum([\n\t\t\"sent\",\n\t\t\"not-configured\",\n\t\t\"failed\"\n\t])\n});\n/**\n* An org-owned compute server. `apiKey` is replaced by `hasApiKey`, so a picker\n* can render \"key set\" without any store decrypting a secret to throw away.\n*/\nvar OrgComputeServerResponseSchema = z.object({\n\tid: z.string(),\n\tlabel: z.string(),\n\tserverUrl: z.string(),\n\tscope: z.literal(\"org\"),\n\townerOrgId: z.string(),\n\ttimeoutMs: z.number().optional(),\n\tretryCount: z.number().optional(),\n\thasApiKey: z.boolean()\n});\n/** A server this org may select but not edit. Never carries a key either. */\nvar ComputeCatalogEntrySchema = z.object({\n\tid: z.string(),\n\tlabel: z.string(),\n\tserverUrl: z.string(),\n\tscope: z.enum([\"platform\", \"org\"]),\n\tsource: z.enum([\"platform\", \"org\"]),\n\ttimeoutMs: z.number().optional(),\n\tretryCount: z.number().optional()\n});\nvar OrgComputeResponseSchema = z.object({\n\tservers: z.array(OrgComputeServerResponseSchema),\n\tdefaultServerId: z.string().nullish(),\n\tglobalDefaultServerId: z.string().nullish(),\n\tcatalog: z.array(ComputeCatalogEntrySchema)\n});\nvar ApiTokenResponseSchema = z.object({\n\tid: z.string(),\n\tuserId: z.string(),\n\tcreatedBy: z.string().nullable(),\n\torgId: z.string(),\n\tname: z.string(),\n\tscopes: z.array(z.string()),\n\tcreatedAt: z.string(),\n\texpiresAt: z.string(),\n\tlastUsedAt: z.string().nullable(),\n\trevokedAt: z.string().nullable(),\n\t/** Scope refusals since midnight UTC, counted in this process only. */\n\trefusedToday: z.number()\n});\n/** The mint response. `secret` is the raw key, returned exactly once. */\nvar CreatedApiTokenResponseSchema = z.object({\n\ttoken: ApiTokenResponseSchema,\n\tsecret: z.string()\n});\nexport { definitionScopeTarget as A, throwZodError as B, chargeApiRateLimit as C, withRateLimitHeaders as D, resolveApiRateLimitConfig as E, parseParam as F, readForm as I, requireCaller as L, scopeRefusalsToday as M, formText as N, assertScope as O, parseBody as P, requireParams as R, runIdempotent as S, rateLimitedResponse as T, validateProjectFlags as V, runHandler as _, InviteResponseSchema as a, readIdempotencyKey as b, AddProjectMemberBodySchema as c, CreateProjectBodySchema as d, OrgComputePatchBodySchema as f, UpdateProjectMemberBodySchema as g, UpdateProjectBodySchema as h, CreatedShareLinkResponseSchema as i, projectScopeTarget as j, assertScopeAnywhere as k, CreateApiTokenBodySchema as l, UpdateOrgMemberBodySchema as m, CreatedApiTokenResponseSchema as n, OrgComputeResponseSchema as o, SolveBodySchema as p, CreatedInviteResponseSchema as r, ShareLinkResponseSchema as s, ApiTokenResponseSchema as t, CreateInviteBodySchema as u, createApiIdempotencyStore as v, createApiRateLimiter as w, requestFingerprint as x, idempotencyCallerId as y, requireUpload as z };\n"],"names":[],"mappings":";;;;;;;;AAOA;AACA,IAAI,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC,QAAQ;AACT,CAAC,KAAK;AACN,CAAC,SAAS;AACV,CAAC;AACD,CAAC,CAAC;AACF,IAAI,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;AAC/B,CAAC,OAAO;AACR,CAAC,QAAQ;AACT,CAAC;AACD,CAAC,CAAC;AACF;AACA,SAAS,oBAAoB,CAAC,MAAM,EAAE;AACtC,CAAC,MAAM,MAAM,GAAG,EAAE;AAClB,CAAC,IAAI,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC;AAC5E,EAAE,IAAI,EAAE,kBAAkB;AAC1B,EAAE,OAAO,EAAE;AACX,EAAE,CAAC;AACH,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,IAAI,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC;AAC9E,EAAE,IAAI,EAAE,kBAAkB;AAC1B,EAAE,OAAO,EAAE;AACX,EAAE,CAAC;AACH,CAAC,OAAO,MAAM;AACd;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,sBAAsB,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC,EAAE;AACzD,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC;AAC/D,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,IAAI,KAAK,CAAC,CAAC;AACjF,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,iBAAiB;AAC/D,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;AACtC,EAAE,GAAG,MAAM;AACX,EAAE,KAAK;AACP,EAAE,OAAO;AACT,EAAE;AACF,EAAE,CAAC;AACH,CAAC,MAAM,OAAO,mBAAmB,IAAI,GAAG,EAAE;AAC1C,CAAC,IAAI,WAAW,GAAG,MAAM,CAAC,iBAAiB;AAC3C,CAAC,IAAI,WAAW,GAAG,CAAC;AACpB,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE;AACpB,EAAE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;AAChC,EAAE,IAAI,CAAC,KAAK,EAAE;AACd,EAAE,WAAW,IAAI,KAAK,CAAC,MAAM;AAC7B,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;AACrB,CAAC;AACD;AACA,CAAC,SAAS,UAAU,GAAG;AACvB,EAAE,IAAI,WAAW,IAAI,SAAS,EAAE;AAChC,EAAE,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChI,EAAE,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,OAAO,EAAE;AAC/B,GAAG,IAAI,WAAW,IAAI,SAAS,EAAE;AACjC,GAAG,IAAI,CAAC,GAAG,CAAC;AACZ,EAAE;AACF,CAAC;AACD,CAAC,SAAS,UAAU,CAAC,GAAG,EAAE,QAAQ,GAAG,CAAC,EAAE;AACxC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;AAChD,EAAE,IAAI,EAAE,eAAe,GAAG,CAAC,IAAI,GAAG,IAAI,WAAW,CAAC,IAAI,OAAO,CAAC,IAAI,IAAI,MAAM,EAAE;AAC9E,EAAE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC;AACtG,EAAE,IAAI,eAAe,GAAG,CAAC,EAAE,WAAW,GAAG,GAAG,GAAG,eAAe;AAC9D,EAAE,IAAI,OAAO,CAAC,IAAI,GAAG,MAAM,EAAE;AAC7B,GAAG,MAAM,WAAW,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;AACzH,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChF,EAAE;AACF,CAAC;AACD,CAAC,OAAO;AACR,EAAE,MAAM,EAAE,cAAc;AACxB,EAAE,MAAM,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE;AACrB,GAAG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;AACzB,GAAG,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;AACpC,GAAG,IAAI,QAAQ,KAAK,QAAQ,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO;AACtF,IAAI,KAAK,EAAE,MAAM,QAAQ,CAAC,OAAO;AACjC,IAAI,QAAQ,EAAE;AACd,IAAI;AACJ,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC5C,GAAG,MAAM,OAAO,GAAG,EAAE,EAAE;AACvB,GAAG,MAAM,KAAK,GAAG;AACjB,IAAI,OAAO;AACX,IAAI,SAAS,EAAE,IAAI;AACnB,IAAI,MAAM,EAAE;AACZ,IAAI;AACJ,GAAG,IAAI,CAAC,GAAG,CAAC;AACZ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC;AAC1B,GAAG,IAAI,eAAe,GAAG,CAAC,IAAI,WAAW,KAAK,MAAM,CAAC,iBAAiB,EAAE,WAAW,GAAG,GAAG,GAAG,eAAe;AAC3G,GAAG,IAAI;AACP,IAAI,MAAM,KAAK,GAAG,MAAM,OAAO;AAC/B,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;AACxC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE;AACpC,KAAK,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC;AAChC,KAAK,WAAW,IAAI,KAAK,CAAC,MAAM;AAChC,KAAK,UAAU,EAAE;AACjB,IAAI;AACJ,IAAI,OAAO;AACX,KAAK,KAAK;AACV,KAAK,QAAQ,EAAE;AACf,KAAK;AACL,GAAG,CAAC,CAAC,OAAO,GAAG,EAAE;AACjB,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC;AAC7C,IAAI,MAAM,GAAG;AACb,GAAG;AACH,EAAE,CAAC;AACH,EAAE,KAAK,GAAG;AACV,GAAG,OAAO,CAAC,KAAK,EAAE;AAClB,GAAG,WAAW,GAAG,CAAC;AAClB,GAAG,WAAW,GAAG,MAAM,CAAC,iBAAiB;AACzC,EAAE,CAAC;AACH,EAAE,IAAI,GAAG;AACT,GAAG,OAAO,OAAO,CAAC,IAAI;AACtB,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,GAAG,EAAE;AAC5B,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC;AACpF,CAAC,OAAO;AACR,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG;AACd,EAAE,IAAI,EAAE,GAAG,CAAC;AACZ,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,GAAG,EAAE;AAC5B,CAAC,MAAM,MAAM,GAAG,EAAE;AAClB,CAAC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE;AACjC,EAAE,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG;AAC5D,EAAE,IAAI,EAAE,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO;AACnD,CAAC;AACD,CAAC,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5B,CAAC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE;AAClE,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC;AACjF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,MAAM,EAAE,GAAG,KAAK,EAAE;AACzC,CAAC,MAAM,GAAG,GAAG,EAAE;AACf,CAAC,MAAM,OAAO,GAAG,EAAE;AACnB,CAAC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE;AAC3B,EAAE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;AAC5B,EAAE,IAAI,CAAC,KAAK,EAAE;AACd,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;AACrB,GAAG;AACH,EAAE;AACF,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK;AACnB,CAAC;AACD,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,sBAAsB,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACnJ,CAAC,OAAO,GAAG;AACX;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;AACzC,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;AACvC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC,CAAC;AACjG,CAAC,OAAO,MAAM,CAAC,IAAI;AACnB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE;AAC9D,CAAC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;AAClD,CAAC,IAAI,GAAG,GAAG,IAAI;AACf,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI;AACtB,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;AACxB,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,qCAAqC,CAAC;AACtF,CAAC;AACD,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,SAAS,IAAI,IAAI,CAAC;AAC1D,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AACjD,CAAC,OAAO,MAAM,CAAC,IAAI;AACnB;AACA,IAAI,WAAW,mBAAmB,IAAI,OAAO,EAAE;AAC/C;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,QAAQ,CAAC,OAAO,EAAE;AAC3B,CAAC,IAAI,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC;AACpC,CAAC,IAAI,CAAC,IAAI,EAAE;AACZ,EAAE,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,uCAAuC,CAAC,CAAC;AAC/H,EAAE,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC;AAChC,CAAC;AACD,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,GAAG,MAAM,EAAE,EAAE;AAC5F,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;AAC7B,CAAC,IAAI,EAAE,IAAI,YAAY,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,YAAY,CAAC,CAAC;AACtI,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE;AAC5E,CAAC,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,gCAAgC,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC7J,CAAC,IAAI,YAAY,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,YAAY,CAAC,OAAO,CAAC;AAC9H,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,EAAE,KAAK,CAAC,sBAAsB,EAAE,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;AAClI,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE;AACF,EAAE;AACF;AACA;AACA,SAAS,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE;AACnD,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;AAC5B,CAAC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,OAAO,MAAM;AAC3C,CAAC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE;AAC3B,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,MAAM;AAC5B,CAAC,OAAO,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,OAAO;AACzD;AACA;AACA;AACA,SAAS,eAAe,CAAC,MAAM,EAAE;AACjC,CAAC,OAAO,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,GAAG,MAAM,GAAG,OAAO;AAChE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE;AAC1C,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,IAAI,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE;AACzD,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;AACpC,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,6BAA6B,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;AACrJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE;AAC1C,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE;AACrB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,oBAAoB,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE;AAC9E,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;AACpC,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AACjF;AACA,IAAI,QAAQ,mBAAmB,IAAI,GAAG,EAAE;AACxC,IAAI,MAAM,GAAG,MAAM,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;AAC1E,SAAS,aAAa,CAAC,OAAO,EAAE;AAChC,CAAC,MAAM,GAAG,GAAG,MAAM,EAAE;AACrB,CAAC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;AACpC,CAAC,IAAI,KAAK,EAAE,GAAG,KAAK,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE;AACtC,MAAM,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE;AAC5B,EAAE,GAAG;AACL,EAAE,KAAK,EAAE;AACT,EAAE,CAAC;AACH;AACA;AACA,SAAS,kBAAkB,CAAC,OAAO,EAAE;AACrC,CAAC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;AACpC,CAAC,OAAO,KAAK,EAAE,GAAG,KAAK,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC;AACjD;AACA,SAAS,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE;AAC5C,CAAC,IAAI,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;AACtE,CAAC,IAAI,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;AAC/E,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;AAC1C;AACA;AACA,SAAS,kBAAkB,CAAC,KAAK,GAAG,IAAI,EAAE;AAC1C,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACnD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,KAAK,GAAG,MAAM,EAAE;AAC/C,CAAC,OAAO,OAAO,GAAG,KAAK;AACvB,EAAE,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;AACxC,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE;AACxD,EAAE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC;AACzE,EAAE,MAAM,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI;AAC/F,EAAE,IAAI,CAAC,OAAO,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE;AAClF,EAAE,OAAO;AACT,GAAG,YAAY;AACf,GAAG,SAAS,EAAE,OAAO,CAAC;AACtB,GAAG;AACH,CAAC,CAAC;AACF;AACA;AACA,IAAI,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC;AAC3C,CAAC,QAAQ,EAAE,GAAG;AACd,CAAC,YAAY,EAAE;AACf,CAAC,CAAC;AACF;AACA;AACA;AACA;AACA,SAAS,yBAAyB,CAAC,GAAG,EAAE,MAAM,EAAE;AAChD,CAAC,OAAO;AACR,EAAE,QAAQ,EAAE,eAAe,CAAC,GAAG,EAAE,gCAAgC,EAAE,sBAAsB,CAAC,QAAQ,EAAE,MAAM,CAAC;AAC3G,EAAE,YAAY,EAAE,kBAAkB,CAAC,GAAG,EAAE,0BAA0B,EAAE,sBAAsB,CAAC,YAAY,EAAE,MAAM;AAC/G,EAAE;AACF;AACA;AACA,SAAS,oBAAoB,CAAC,MAAM,GAAG,sBAAsB,EAAE;AAC/D,CAAC,IAAI,MAAM,CAAC,YAAY,IAAI,CAAC,EAAE,OAAO,IAAI;AAC1C,CAAC,MAAM,KAAK,GAAG,wBAAwB,CAAC,MAAM,CAAC;AAC/C,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY;AAClC,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE;AACnB,EAAE,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC;AACjC,EAAE,OAAO;AACT,GAAG,OAAO,EAAE,MAAM,CAAC,OAAO;AAC1B,GAAG,KAAK;AACR,GAAG,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACnD,GAAG,UAAU,EAAE,MAAM,CAAC;AACtB,GAAG;AACH,CAAC,CAAC,EAAE;AACJ;AACA,IAAI,eAAe;AACnB;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,GAAG;AACjC,CAAC,IAAI,eAAe,KAAK,MAAM,EAAE,eAAe,GAAG,oBAAoB,EAAE;AACzE,CAAC,OAAO,eAAe;AACvB;AACA;AACA;AACA;AACA;AACA,eAAe,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE;AAChD,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,IAAI,CAAC,OAAO,EAAE,OAAO,MAAM;AAC9C,CAAC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AACpD;AACA,SAAS,gBAAgB,CAAC,OAAO,EAAE;AACnC,CAAC,MAAM,OAAO,GAAG;AACjB,EAAE,iBAAiB,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;AAC1C,EAAE,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;AACjD,EAAE;AACF,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC;AAC/E,CAAC,OAAO,OAAO;AACf;AACA;AACA,SAAS,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,CAAC,+CAA+C,EAAE,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE;AAC/H,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC;AACnD,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC;AAC1F,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE;AACvD,EAAE,MAAM,EAAE,GAAG;AACb,EAAE,OAAO,EAAE;AACX,GAAG,cAAc,EAAE,kBAAkB;AACrC,GAAG,GAAG,gBAAgB,CAAC,OAAO;AAC9B;AACA,EAAE,CAAC;AACH;AACA;AACA,SAAS,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE;AAC5C,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG;AACzB,CAAC,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC;AAC1C,CAAC,IAAI;AACL,EAAE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;AACrE,EAAE,OAAO,GAAG;AACZ,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;AACvC,EAAE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;AAC9D,EAAE,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE;AAChC,GAAG,MAAM,EAAE,GAAG,CAAC,MAAM;AACrB,GAAG,UAAU,EAAE,GAAG,CAAC,UAAU;AAC7B,GAAG,OAAO,EAAE;AACZ,GAAG,CAAC;AACJ,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,2BAA2B,GAAG,sBAAsB;AACxD;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,QAAQ,EAAE,SAAS,EAAE;AAC7C,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AAClC;AACA;AACA,eAAe,gBAAgB,CAAC,GAAG,EAAE;AACrC,CAAC,OAAO;AACR,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM;AACpB,EAAE,OAAO,EAAE,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;AACrC,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,WAAW;AAC7B,EAAE;AACF;AACA;AACA,SAAS,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE;AAC9C,CAAC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;AAC5C,CAAC,IAAI,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,MAAM,CAAC;AAC/D,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE;AAClC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM;AACvB,EAAE;AACF,EAAE,CAAC;AACH;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,sBAAsB,GAAG,iBAAiB;AAC9C;AACA,IAAI,8BAA8B,GAAG,GAAG;AACxC;AACA;AACA;AACA;AACA;AACA,IAAI,iCAAiC,GAAG,SAAS;AACjD,IAAI,qBAAqB,GAAG,GAAG;AAC/B,SAAS,yBAAyB,CAAC,KAAK,GAAG,8BAA8B,EAAE,QAAQ,GAAG,iCAAiC,EAAE;AACzH,CAAC,OAAO,sBAAsB,CAAC;AAC/B,EAAE,KAAK;AACP,EAAE,SAAS,EAAE;AACb,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;AAC9C;AACA,IAAI,aAAa;AACjB;AACA,SAAS,0BAA0B,GAAG;AACtC,CAAC,OAAO,aAAa,KAAK,yBAAyB,EAAE;AACrD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,GAAG,EAAE;AAClC,CAAC,OAAO,GAAG,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;AAC7E;AACA;AACA,SAAS,kBAAkB,CAAC,OAAO,EAAE;AACrC,CAAC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;AACxD,CAAC,IAAI,GAAG,KAAK,IAAI,EAAE,OAAO,IAAI;AAC9B,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,EAAE,sBAAsB,CAAC,6BAA6B,CAAC,CAAC;AAClJ,CAAC,OAAO,GAAG;AACX;AACA,eAAe,SAAS,CAAC,KAAK,EAAE;AAChC,CAAC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC;AAC5D,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3F;AACA;AACA,eAAe,kBAAkB,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE;AACrD,CAAC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAChG,CAAC,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC;AAC9F,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;AACxD,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;AAChB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;AAC7B,CAAC,OAAO,SAAS,CAAC,KAAK,CAAC;AACxB;AACA,eAAe,aAAa,CAAC,IAAI,EAAE;AACnC,CAAC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC;AAClC,CAAC,WAAW,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;AAC5D,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;AAC1B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,eAAe,CAAC,OAAO,EAAE;AACxC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;AACvI,CAAC,IAAI,IAAI;AACT,CAAC,IAAI;AACL,EAAE,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC;AAChC,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,qBAAqB;AAC9B,CAAC;AACD,CAAC,MAAM,KAAK,GAAG,EAAE;AACjB,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,KAAK,KAAK,QAAQ,GAAG,KAAK,GAAG;AACzF,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI;AAClB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI;AAClB,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC,KAAK;AACnC,EAAE,CAAC,CAAC;AACJ,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;AAC7B;AACA,IAAI,aAAa,GAAG,MAAM;AAC1B,CAAC,WAAW;AACZ,CAAC,QAAQ;AACT,CAAC,WAAW,CAAC,WAAW,EAAE,QAAQ,EAAE;AACpC,EAAE,IAAI,CAAC,WAAW,GAAG,WAAW;AAChC,EAAE,IAAI,CAAC,QAAQ,GAAG,QAAQ;AAC1B,CAAC;AACD,CAAC;AACD,SAAS,iBAAiB,CAAC,MAAM,EAAE,WAAW,EAAE;AAChD,CAAC,IAAI,MAAM,KAAK,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,sBAAsB,CAAC,0CAA0C,CAAC,CAAC;AAClJ;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,aAAa,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE;AAC9E,CAAC,IAAI,OAAO;AACZ,CAAC,IAAI,OAAO,GAAG,KAAK;AACpB,CAAC,IAAI;AACL,EAAE,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,YAAY;AAC7E,GAAG,OAAO,GAAG,IAAI;AACjB,GAAG,MAAM,GAAG,GAAG,MAAM,EAAE,EAAE;AACzB,GAAG,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC;AAC/C,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC;AACxE,GAAG,OAAO;AACV,IAAI,WAAW;AACf,IAAI;AACJ,IAAI;AACJ,EAAE,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,IAAI,EAAE,GAAG,YAAY,aAAa,CAAC,EAAE,MAAM,GAAG;AAChD,EAAE,iBAAiB,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC;AACjD,EAAE,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,qBAAqB,EAAE,OAAO,aAAa,CAAC;AACtF,GAAG,KAAK;AACR,GAAG,QAAQ;AACX,GAAG,SAAS;AACZ,GAAG;AACH,GAAG,EAAE,EAAE,CAAC;AACR,EAAE,OAAO,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC;AAChD,CAAC;AACD,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,WAAW,CAAC;AAC1D,CAAC,OAAO,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC;AACpE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,UAAU,CAAC,MAAM,EAAE;AAC5B,CAAC,IAAI,MAAM,YAAY,QAAQ,EAAE,OAAO,MAAM;AAC9C,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM;AACzC,CAAC,IAAI,IAAI,KAAK,MAAM,EAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;AAChD,EAAE,MAAM,EAAE,MAAM,IAAI,GAAG;AACvB,EAAE;AACF,EAAE,CAAC;AACH,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;AAC3C,EAAE,MAAM,EAAE,MAAM,IAAI,GAAG;AACvB,EAAE,OAAO,EAAE;AACX,GAAG,cAAc,EAAE,kBAAkB;AACrC,GAAG,GAAG;AACN;AACA,EAAE,CAAC;AACH;AACA;AACA,eAAe,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE;AAC3G,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK;AACvB,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,OAAO,UAAU,CAAC;AACzC,GAAG,MAAM,EAAE,GAAG,CAAC,MAAM;AACrB,GAAG,IAAI,EAAE,WAAW,CAAC,GAAG;AACxB,GAAG,CAAC;AACJ,EAAE,MAAM,MAAM,GAAG,QAAQ,GAAG,GAAG,CAAC;AAChC,EAAE,IAAI,MAAM,EAAE,OAAO,UAAU,CAAC;AAChC,GAAG,MAAM,EAAE,MAAM,CAAC,MAAM;AACxB,GAAG,IAAI,EAAE,WAAW,CAAC,MAAM;AAC3B,GAAG,CAAC;AACJ,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE;AACrC,GAAG,SAAS,EAAE,KAAK;AACnB,GAAG,GAAG,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG;AACpE,GAAG,CAAC;AACJ,EAAE,OAAO,UAAU,CAAC;AACpB,GAAG,MAAM,EAAE,GAAG;AACd,GAAG,IAAI,EAAE;AACT,IAAI,OAAO,EAAE,QAAQ;AACrB,IAAI,IAAI,EAAE,YAAY,CAAC;AACvB;AACA,GAAG,CAAC;AACJ,CAAC,CAAC;AACF,CAAC,IAAI,OAAO;AACZ,CAAC,IAAI;AACL,EAAE,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,KAAK,CAAC,GAAG,qBAAqB,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,cAAc;AACxG,EAAE,OAAO,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC;AACtD,EAAE,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,mBAAmB,CAAC,OAAO,CAAC;AACtE,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC;AAClB,CAAC;AACD,CAAC,IAAI,GAAG;AACR,CAAC,IAAI;AACL,EAAE,IAAI,GAAG,CAAC,GAAG,EAAE,QAAQ,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;AACxJ,EAAE,MAAM,GAAG,GAAG,YAAY;AAC1B,GAAG,IAAI;AACP,IAAI,OAAO,UAAU,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;AACzC,GAAG,CAAC,CAAC,OAAO,GAAG,EAAE;AACjB,IAAI,OAAO,IAAI,CAAC,GAAG,CAAC;AACpB,GAAG;AACH,EAAE,CAAC;AACH,EAAE,MAAM,SAAS,GAAG,UAAU,IAAI,GAAG,CAAC,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI;AAClF,EAAE,IAAI,SAAS,IAAI,GAAG,CAAC,GAAG,EAAE;AAC5B,GAAG,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAChH,GAAG,GAAG,GAAG,MAAM,aAAa,CAAC;AAC7B,IAAI,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,0BAA0B,EAAE;AAC/D,IAAI,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC;AAC1C,IAAI,SAAS;AACb,IAAI;AACJ,IAAI,EAAE,GAAG,CAAC;AACV,EAAE,CAAC,MAAM,GAAG,GAAG,MAAM,GAAG,EAAE;AAC1B,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;AACjB,CAAC;AACD,CAAC,OAAO,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC;AAC1C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;AAC/B,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;AACzC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;AACtD,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;AACnD,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AACjC;AACA,CAAC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ;AACnC,CAAC;AACE,IAAC,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;AACvC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;AACpE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AAC5C,CAAC,UAAU,EAAE,uBAAuB,CAAC,OAAO,CAAC,SAAS,CAAC;AACvD,CAAC,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ;AACvC,CAAC;AACE,IAAC,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;AACvC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;AACxC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE;AAC3C,CAAC,UAAU,EAAE,uBAAuB;AACpC,CAAC,gBAAgB,EAAE,CAAC,CAAC,OAAO;AAC5B,CAAC,CAAC,CAAC,OAAO;AACP,IAAC,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;AAC1C,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,oBAAoB,CAAC;AAChD,CAAC,IAAI,EAAE;AACP,CAAC;AACE,IAAC,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE;AACxE;AACA,IAAI,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,wBAAwB,EAAE,mBAAmB,CAAC,CAAC;AAChF,IAAC,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;AACtC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;AACnF,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC;AACzC,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,EAAE;AACtD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;AAC3C,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AACtB,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AACzB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7B,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AACzC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AACjC,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ;AAChC,CAAC,CAAC;AACC,IAAC,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;AACzC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC;AAC9C;AACA,CAAC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ;AAChD,CAAC;AACE,IAAC,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;AACzC,CAAC,IAAI,EAAE,aAAa,CAAC,QAAQ,EAAE;AAC/B,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,QAAQ;AAC3D,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,MAAM,EAAE,EAAE,OAAO,EAAE,2CAA2C,EAAE;AACrH,IAAC,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;AACxC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;AAC5D,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;AAChF,CAAC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;AACvC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;AACf,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;AACzB,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACnC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AAC5B,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;AAChC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;AAChC,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;AACxB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;AAChC,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;AACvB;AACA,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI;AACzB,CAAC;AACD;AACG,IAAC,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;AAC9C,CAAC,IAAI,EAAE,uBAAuB;AAC9B,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM;AAChB,CAAC;AACE,IAAC,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;AACpC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;AACf,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;AAClB,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;AAClB,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;AACpB,CAAC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AACpC,CAAC,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;AACrD,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AAClC,CAAC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ;AACtC,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,2BAA2B,GAAG,oBAAoB,CAAC,MAAM,CAAC;AAC9D,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC;AAClB,EAAE,MAAM;AACR,EAAE,gBAAgB;AAClB,EAAE;AACF,EAAE;AACF,CAAC;AACD;AACA;AACA;AACA;AACA,IAAI,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;AAC9C,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;AACf,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;AAClB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;AACxB,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;AACvB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AACjC,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AAClC,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO;AACrB,CAAC,CAAC;AACF;AACA,IAAI,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;AACzC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;AACf,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;AAClB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AACpC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AACjC,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ;AAChC,CAAC,CAAC;AACC,IAAC,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;AACxC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC;AACjD,CAAC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;AACtC,CAAC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;AAC5C,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB;AAC3C,CAAC;AACE,IAAC,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;AACtC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;AACf,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;AACnB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AACjC,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;AAClB,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;AACjB,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AAC5B,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AAClC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AACjC;AACA,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM;AACvB,CAAC;AACD;AACG,IAAC,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;AAC7C,CAAC,KAAK,EAAE,sBAAsB;AAC9B,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM;AACjB,CAAC;;;;"}

package/build/server/chunks/chunks/arrow-left.js-C91xD_i2.js

@@ -0,0 +1,17 @@
+import { al as spread_props } from './server.js-D3MqDbVt.js';
+import { I as Icon } from './utils3.js-DANle-lS.js';
+
+// ../../node_modules/.pnpm/@lucide+svelte@1.61.0_svelte@5.57.2_@typescript-eslint+types@8.72.0_/node_modules/@lucide/svelte/dist/icons/arrow-left.svelte
+var __iconData = {
+	"name": "arrow-left",
+	"size": 24,
+	"node": [["path", { "d": "m12 19-7-7 7-7" }], ["path", { "d": "M19 12H5" }]]
+};
+__iconData.node;
+function Arrow_left($$renderer, $$props) {
+	let { $$slots, $$events, ...props } = $$props;
+	Icon($$renderer, spread_props([props, { icon: __iconData }]));
+}
+
+export { Arrow_left as A };
+//# sourceMappingURL=arrow-left.js-C91xD_i2.js.map

package/build/server/chunks/chunks/arrow-left.js-C91xD_i2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"arrow-left.js-C91xD_i2.js","sources":["../../../../.svelte-kit/output/server/chunks/arrow-left.js"],"sourcesContent":["import { d as spread_props } from \"./server.js\";\nimport { n as Icon } from \"./utils3.js\";\n// ../../node_modules/.pnpm/@lucide+svelte@1.61.0_svelte@5.57.2_@typescript-eslint+types@8.72.0_/node_modules/@lucide/svelte/dist/icons/arrow-left.svelte\nvar __iconData = {\n\t\"name\": \"arrow-left\",\n\t\"size\": 24,\n\t\"node\": [[\"path\", { \"d\": \"m12 19-7-7 7-7\" }], [\"path\", { \"d\": \"M19 12H5\" }]]\n};\n__iconData.node;\nfunction Arrow_left($$renderer, $$props) {\n\tlet { $$slots, $$events, ...props } = $$props;\n\tIcon($$renderer, spread_props([props, { icon: __iconData }]));\n}\nexport { Arrow_left as t };\n"],"names":[],"mappings":";;;AAEA;AACA,IAAI,UAAU,GAAG;AACjB,CAAC,MAAM,EAAE,YAAY;AACrB,CAAC,MAAM,EAAE,EAAE;AACX,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;AAC5E,CAAC;AACD,UAAU,CAAC,IAAI;AACf,SAAS,UAAU,CAAC,UAAU,EAAE,OAAO,EAAE;AACzC,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO;AAC9C,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;AAC9D;;;;"}

package/build/server/chunks/chunks/arrow-right.js-Dd2VzUvu.js

@@ -0,0 +1,17 @@
+import { al as spread_props } from './server.js-D3MqDbVt.js';
+import { I as Icon } from './utils3.js-DANle-lS.js';
+
+// ../../node_modules/.pnpm/@lucide+svelte@1.61.0_svelte@5.57.2_@typescript-eslint+types@8.72.0_/node_modules/@lucide/svelte/dist/icons/arrow-right.svelte
+var __iconData = {
+	"name": "arrow-right",
+	"size": 24,
+	"node": [["path", { "d": "M5 12h14" }], ["path", { "d": "m12 5 7 7-7 7" }]]
+};
+__iconData.node;
+function Arrow_right($$renderer, $$props) {
+	let { $$slots, $$events, ...props } = $$props;
+	Icon($$renderer, spread_props([props, { icon: __iconData }]));
+}
+
+export { Arrow_right as A };
+//# sourceMappingURL=arrow-right.js-Dd2VzUvu.js.map

package/build/server/chunks/chunks/arrow-right.js-Dd2VzUvu.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"arrow-right.js-Dd2VzUvu.js","sources":["../../../../.svelte-kit/output/server/chunks/arrow-right.js"],"sourcesContent":["import { d as spread_props } from \"./server.js\";\nimport { n as Icon } from \"./utils3.js\";\n// ../../node_modules/.pnpm/@lucide+svelte@1.61.0_svelte@5.57.2_@typescript-eslint+types@8.72.0_/node_modules/@lucide/svelte/dist/icons/arrow-right.svelte\nvar __iconData = {\n\t\"name\": \"arrow-right\",\n\t\"size\": 24,\n\t\"node\": [[\"path\", { \"d\": \"M5 12h14\" }], [\"path\", { \"d\": \"m12 5 7 7-7 7\" }]]\n};\n__iconData.node;\nfunction Arrow_right($$renderer, $$props) {\n\tlet { $$slots, $$events, ...props } = $$props;\n\tIcon($$renderer, spread_props([props, { icon: __iconData }]));\n}\nexport { Arrow_right as t };\n"],"names":[],"mappings":";;;AAEA;AACA,IAAI,UAAU,GAAG;AACjB,CAAC,MAAM,EAAE,aAAa;AACtB,CAAC,MAAM,EAAE,EAAE;AACX,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;AAC3E,CAAC;AACD,UAAU,CAAC,IAAI;AACf,SAAS,WAAW,CAAC,UAAU,EAAE,OAAO,EAAE;AAC1C,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO;AAC9C,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;AAC9D;;;;"}

package/build/server/chunks/chunks/auth-bootstrap.server.js-x03Oudbh.js

@@ -0,0 +1,154 @@
+import { b as private_env } from './shared-server.js-CX8yV6G4.js';
+import { S as SYSTEM_CONTEXT } from './context.js-DgF3EFGQ.js';
+import { a as getAuthProvider, g as getLogger, b as getPermissionStore, c as getTenancy, d as getDataProvider, e as getOrganizationProvider, f as getProjectProvider } from './providers.server.js-NBgteuX7.js';
+import { o as orgSlugFromName } from './schemas.js-CEHDw4oF.js';
+import { A as ALL_PLATFORM_PERMISSIONS } from './types3.js-BS6pAwdK.js';
+import { randomUUID } from 'node:crypto';
+
+// src/lib/server/auth-bootstrap.server.ts
+/**
+* Shared post-verification flow used by every IdP-callback route (OAuth,
+* email link, future SAML, …). Order matters:
+*
+*   1. `data.ensureUser` — guarantee a user-data row exists for whatever ID
+*      the auth provider issued. Local-provider creates a JSON row;
+*      Supabase no-ops (its DB trigger has already fired).
+*   2. Bootstrap-admin grant — if no instance_admin exists yet AND the
+*      tenancy/env policy allows it, grant the signing-in user every
+*      platform permission so `/admin` becomes reachable.
+*   3. Single-tenant org seed — create the default Organization + Project
+*      owned by the new admin, mirroring what `/setup` does for password
+*      auth. Without this, org-scoped permissions (manage_projects,
+*      manage_definitions) silently drop because `actingOrgId` resolves to
+*      undefined.
+*
+* Cookie/redirect are the caller's job since they vary by capability (OAuth
+* has refresh tokens, magic-link does sometimes, SAML doesn't).
+*/
+async function bootstrapUserSession(user) {
+	await getDataProvider().ensureUser(SYSTEM_CONTEXT, user.id);
+	const tenancy = getTenancy();
+	const perms = getPermissionStore();
+	const hasAdmin = await perms.hasInstanceAdmin(SYSTEM_CONTEXT);
+	let grantedAdminHere = false;
+	if (!hasAdmin) {
+		if (!shouldBootstrapAdmin(user, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, tenancy)) return;
+		grantedAdminHere = await perms.claimFirstInstanceAdmin(SYSTEM_CONTEXT, user.id, [...ALL_PLATFORM_PERMISSIONS]);
+		if (!grantedAdminHere) return;
+	}
+	if (tenancy !== "single") return;
+	if ((await getOrganizationProvider().listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items.length > 0) return;
+	if (!grantedAdminHere) {
+		if (!(await perms.getFor(SYSTEM_CONTEXT, user.id)).includes("instance_admin")) return;
+	}
+	await ensureSingleTenantDefaultOrg(user);
+}
+/**
+* Seeds the single default Organization + Project that `actingOrgId` needs
+* to resolve, for flows that skip `/setup` (header-auth, OAuth callback,
+* future SAML). No-op outside single-tenant mode and once any org exists.
+* Slug derives from the admin's email/displayName so the URL looks like the
+* deployment rather than a UUID; falls back to `default` for anonymous
+* UPN-only sign-ins.
+*/
+async function ensureSingleTenantDefaultOrg(user) {
+	if (getTenancy() !== "single") return;
+	const orgs = getOrganizationProvider();
+	if ((await orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items.length > 0) return;
+	const orgName = (typeof user.metadata?.displayName === "string" ? user.metadata.displayName : void 0)?.trim() || user.email?.split("@")[0]?.trim() || "Default";
+	const slug = orgSlugFromName(orgName);
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const org = {
+		id: randomUUID(),
+		name: orgName,
+		slug,
+		ownerId: user.id,
+		createdBy: user.id,
+		updatedBy: user.id,
+		createdAt: now,
+		updatedAt: now,
+		deletedAt: null
+	};
+	await orgs.createOrg(SYSTEM_CONTEXT, org);
+	const projects = getProjectProvider();
+	const project = {
+		id: randomUUID(),
+		orgId: org.id,
+		name: "Default",
+		slug: "default",
+		visibility: "public",
+		ownerId: user.id,
+		createdBy: user.id,
+		updatedBy: user.id,
+		autoJoinOnUpload: false,
+		createdAt: now,
+		updatedAt: now,
+		deletedAt: null
+	};
+	await projects.createProject(SYSTEM_CONTEXT, project);
+}
+/**
+* Whether the signing-in user qualifies for the first-admin grant. Pure — no
+* I/O — so the policy is unit-testable.
+*
+* - `tenancy='single'` + no env var → first signer wins (fine for
+*   self-hosted fresh installs).
+* - `tenancy='single'` + env var set → only the named user qualifies.
+* - `tenancy='multi'` → env var REQUIRED; the named user must match the
+*   signer. Without it, the first random signup would become Selva staff.
+*
+* The env var also doubles as the break-glass recovery path when admin is
+* lost to backup restores or migration drift.
+*/
+function shouldBootstrapAdmin(user, configuredEmail, mode) {
+	const expected = configuredEmail?.trim().toLowerCase();
+	if (mode === "multi" && !expected) return false;
+	if (!expected) return true;
+	const actual = user.email?.trim().toLowerCase();
+	return !!actual && actual === expected;
+}
+/**
+* Header-auth variant of `shouldBootstrapAdmin`, used by
+* `wireHeaderAuthBootstrap` to decide whether an unrecognized UPN arriving
+* through the proxy should be auto-allowlisted as the first admin. Operates
+* on the raw UPN/email before any allowlist row exists. For Entra
+* deployments UPN ≈ email; if they differ, the proxy forwards both and we
+* prefer email when present.
+*/
+function shouldBootstrapUpn(upn, email, configuredEmail, mode) {
+	const expected = configuredEmail?.trim().toLowerCase();
+	if (mode === "multi" && !expected) return false;
+	if (!expected) return true;
+	const candidate = (email ?? upn).trim().toLowerCase();
+	return !!candidate && candidate === expected;
+}
+/**
+* Wires a bootstrap-allowlist policy onto the auth provider if it supports
+* header-auth-style first-admin bootstrapping. Idempotent — safe to call on
+* every startup; the provider holds the policy until process exit.
+*
+* Header-auth deployments can't reach `/setup` (no password form, no OAuth
+* callback), so without this the first proxy-authenticated visitor is
+* silently rejected (UPN not in allowlist) and the operator has to
+* hand-write JSON files. With it, the first visit whose UPN/email matches
+* `BOOTSTRAP_INSTANCE_ADMIN_EMAIL` is auto-allowlisted, and the immediately
+* following `bootstrapUserSession` call grants instance_admin.
+*
+* Gated by `hasInstanceAdmin` — once any admin exists, the policy returns
+* false and strict allowlist-only behavior resumes.
+*/
+function wireHeaderAuthBootstrap() {
+	const auth = getAuthProvider();
+	if (!auth.proxyAuth) return;
+	if (typeof auth.setBootstrapAllowlistPolicy !== "function") {
+		if (private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL?.trim()) getLogger().warn("BOOTSTRAP_INSTANCE_ADMIN_EMAIL is set but the installed @selvajs/header-auth-provider does not expose setBootstrapAllowlistPolicy. Upgrade the provider, or hand-seed header-allowlist.json.", { component: "auth-bootstrap" });
+		return;
+	}
+	auth.setBootstrapAllowlistPolicy(async ({ upn, email }) => {
+		if (await getPermissionStore().hasInstanceAdmin(SYSTEM_CONTEXT)) return false;
+		return shouldBootstrapUpn(upn, email, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, getTenancy());
+	});
+}
+
+export { bootstrapUserSession as b, wireHeaderAuthBootstrap as w };
+//# sourceMappingURL=auth-bootstrap.server.js-x03Oudbh.js.map

package/build/server/chunks/chunks/auth-bootstrap.server.js-x03Oudbh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-bootstrap.server.js-x03Oudbh.js","sources":["../../../../.svelte-kit/output/server/chunks/auth-bootstrap.server.js"],"sourcesContent":["import { t as private_env } from \"./shared-server.js\";\nimport { t as SYSTEM_CONTEXT } from \"./context.js\";\nimport { S as getTenancy, f as getLogger, g as getPermissionStore, h as getOrganizationProvider, o as getDataProvider, r as getAuthProvider, v as getProjectProvider } from \"./providers.server.js\";\nimport { d as orgSlugFromName } from \"./schemas.js\";\nimport { t as ALL_PLATFORM_PERMISSIONS } from \"./types3.js\";\nimport { randomUUID } from \"node:crypto\";\n// src/lib/server/auth-bootstrap.server.ts\n/**\n* Shared post-verification flow used by every IdP-callback route (OAuth,\n* email link, future SAML, …). Order matters:\n*\n*   1. `data.ensureUser` — guarantee a user-data row exists for whatever ID\n*      the auth provider issued. Local-provider creates a JSON row;\n*      Supabase no-ops (its DB trigger has already fired).\n*   2. Bootstrap-admin grant — if no instance_admin exists yet AND the\n*      tenancy/env policy allows it, grant the signing-in user every\n*      platform permission so `/admin` becomes reachable.\n*   3. Single-tenant org seed — create the default Organization + Project\n*      owned by the new admin, mirroring what `/setup` does for password\n*      auth. Without this, org-scoped permissions (manage_projects,\n*      manage_definitions) silently drop because `actingOrgId` resolves to\n*      undefined.\n*\n* Cookie/redirect are the caller's job since they vary by capability (OAuth\n* has refresh tokens, magic-link does sometimes, SAML doesn't).\n*/\nasync function bootstrapUserSession(user) {\n\tawait getDataProvider().ensureUser(SYSTEM_CONTEXT, user.id);\n\tconst tenancy = getTenancy();\n\tconst perms = getPermissionStore();\n\tconst hasAdmin = await perms.hasInstanceAdmin(SYSTEM_CONTEXT);\n\tlet grantedAdminHere = false;\n\tif (!hasAdmin) {\n\t\tif (!shouldBootstrapAdmin(user, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, tenancy)) return;\n\t\tgrantedAdminHere = await perms.claimFirstInstanceAdmin(SYSTEM_CONTEXT, user.id, [...ALL_PLATFORM_PERMISSIONS]);\n\t\tif (!grantedAdminHere) return;\n\t}\n\tif (tenancy !== \"single\") return;\n\tif ((await getOrganizationProvider().listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items.length > 0) return;\n\tif (!grantedAdminHere) {\n\t\tif (!(await perms.getFor(SYSTEM_CONTEXT, user.id)).includes(\"instance_admin\")) return;\n\t}\n\tawait ensureSingleTenantDefaultOrg(user);\n}\n/**\n* Seeds the single default Organization + Project that `actingOrgId` needs\n* to resolve, for flows that skip `/setup` (header-auth, OAuth callback,\n* future SAML). No-op outside single-tenant mode and once any org exists.\n* Slug derives from the admin's email/displayName so the URL looks like the\n* deployment rather than a UUID; falls back to `default` for anonymous\n* UPN-only sign-ins.\n*/\nasync function ensureSingleTenantDefaultOrg(user) {\n\tif (getTenancy() !== \"single\") return;\n\tconst orgs = getOrganizationProvider();\n\tif ((await orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items.length > 0) return;\n\tconst orgName = (typeof user.metadata?.displayName === \"string\" ? user.metadata.displayName : void 0)?.trim() || user.email?.split(\"@\")[0]?.trim() || \"Default\";\n\tconst slug = orgSlugFromName(orgName);\n\tconst now = (/* @__PURE__ */ new Date()).toISOString();\n\tconst org = {\n\t\tid: randomUUID(),\n\t\tname: orgName,\n\t\tslug,\n\t\townerId: user.id,\n\t\tcreatedBy: user.id,\n\t\tupdatedBy: user.id,\n\t\tcreatedAt: now,\n\t\tupdatedAt: now,\n\t\tdeletedAt: null\n\t};\n\tawait orgs.createOrg(SYSTEM_CONTEXT, org);\n\tconst projects = getProjectProvider();\n\tconst project = {\n\t\tid: randomUUID(),\n\t\torgId: org.id,\n\t\tname: \"Default\",\n\t\tslug: \"default\",\n\t\tvisibility: \"public\",\n\t\townerId: user.id,\n\t\tcreatedBy: user.id,\n\t\tupdatedBy: user.id,\n\t\tautoJoinOnUpload: false,\n\t\tcreatedAt: now,\n\t\tupdatedAt: now,\n\t\tdeletedAt: null\n\t};\n\tawait projects.createProject(SYSTEM_CONTEXT, project);\n}\n/**\n* Whether the signing-in user qualifies for the first-admin grant. Pure — no\n* I/O — so the policy is unit-testable.\n*\n* - `tenancy='single'` + no env var → first signer wins (fine for\n*   self-hosted fresh installs).\n* - `tenancy='single'` + env var set → only the named user qualifies.\n* - `tenancy='multi'` → env var REQUIRED; the named user must match the\n*   signer. Without it, the first random signup would become Selva staff.\n*\n* The env var also doubles as the break-glass recovery path when admin is\n* lost to backup restores or migration drift.\n*/\nfunction shouldBootstrapAdmin(user, configuredEmail, mode) {\n\tconst expected = configuredEmail?.trim().toLowerCase();\n\tif (mode === \"multi\" && !expected) return false;\n\tif (!expected) return true;\n\tconst actual = user.email?.trim().toLowerCase();\n\treturn !!actual && actual === expected;\n}\n/**\n* Header-auth variant of `shouldBootstrapAdmin`, used by\n* `wireHeaderAuthBootstrap` to decide whether an unrecognized UPN arriving\n* through the proxy should be auto-allowlisted as the first admin. Operates\n* on the raw UPN/email before any allowlist row exists. For Entra\n* deployments UPN ≈ email; if they differ, the proxy forwards both and we\n* prefer email when present.\n*/\nfunction shouldBootstrapUpn(upn, email, configuredEmail, mode) {\n\tconst expected = configuredEmail?.trim().toLowerCase();\n\tif (mode === \"multi\" && !expected) return false;\n\tif (!expected) return true;\n\tconst candidate = (email ?? upn).trim().toLowerCase();\n\treturn !!candidate && candidate === expected;\n}\n/**\n* Wires a bootstrap-allowlist policy onto the auth provider if it supports\n* header-auth-style first-admin bootstrapping. Idempotent — safe to call on\n* every startup; the provider holds the policy until process exit.\n*\n* Header-auth deployments can't reach `/setup` (no password form, no OAuth\n* callback), so without this the first proxy-authenticated visitor is\n* silently rejected (UPN not in allowlist) and the operator has to\n* hand-write JSON files. With it, the first visit whose UPN/email matches\n* `BOOTSTRAP_INSTANCE_ADMIN_EMAIL` is auto-allowlisted, and the immediately\n* following `bootstrapUserSession` call grants instance_admin.\n*\n* Gated by `hasInstanceAdmin` — once any admin exists, the policy returns\n* false and strict allowlist-only behavior resumes.\n*/\nfunction wireHeaderAuthBootstrap() {\n\tconst auth = getAuthProvider();\n\tif (!auth.proxyAuth) return;\n\tif (typeof auth.setBootstrapAllowlistPolicy !== \"function\") {\n\t\tif (private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL?.trim()) getLogger().warn(\"BOOTSTRAP_INSTANCE_ADMIN_EMAIL is set but the installed @selvajs/header-auth-provider does not expose setBootstrapAllowlistPolicy. Upgrade the provider, or hand-seed header-allowlist.json.\", { component: \"auth-bootstrap\" });\n\t\treturn;\n\t}\n\tauth.setBootstrapAllowlistPolicy(async ({ upn, email }) => {\n\t\tif (await getPermissionStore().hasInstanceAdmin(SYSTEM_CONTEXT)) return false;\n\t\treturn shouldBootstrapUpn(upn, email, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, getTenancy());\n\t});\n}\nexport { wireHeaderAuthBootstrap as n, bootstrapUserSession as t };\n"],"names":[],"mappings":";;;;;;;AAMA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,oBAAoB,CAAC,IAAI,EAAE;AAC1C,CAAC,MAAM,eAAe,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAC5D,CAAC,MAAM,OAAO,GAAG,UAAU,EAAE;AAC7B,CAAC,MAAM,KAAK,GAAG,kBAAkB,EAAE;AACnC,CAAC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,cAAc,CAAC;AAC9D,CAAC,IAAI,gBAAgB,GAAG,KAAK;AAC7B,CAAC,IAAI,CAAC,QAAQ,EAAE;AAChB,EAAE,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,WAAW,CAAC,8BAA8B,EAAE,OAAO,CAAC,EAAE;AACxF,EAAE,gBAAgB,GAAG,MAAM,KAAK,CAAC,uBAAuB,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,wBAAwB,CAAC,CAAC;AAChH,EAAE,IAAI,CAAC,gBAAgB,EAAE;AACzB,CAAC;AACD,CAAC,IAAI,OAAO,KAAK,QAAQ,EAAE;AAC3B,CAAC,IAAI,CAAC,MAAM,uBAAuB,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;AAChG,CAAC,IAAI,CAAC,gBAAgB,EAAE;AACxB,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE;AACjF,CAAC;AACD,CAAC,MAAM,4BAA4B,CAAC,IAAI,CAAC;AACzC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,4BAA4B,CAAC,IAAI,EAAE;AAClD,CAAC,IAAI,UAAU,EAAE,KAAK,QAAQ,EAAE;AAChC,CAAC,MAAM,IAAI,GAAG,uBAAuB,EAAE;AACvC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;AAC3E,CAAC,MAAM,OAAO,GAAG,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,WAAW,KAAK,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,GAAG,MAAM,GAAG,IAAI,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS;AAChK,CAAC,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC;AACtC,CAAC,MAAM,GAAG,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACvD,CAAC,MAAM,GAAG,GAAG;AACb,EAAE,EAAE,EAAE,UAAU,EAAE;AAClB,EAAE,IAAI,EAAE,OAAO;AACf,EAAE,IAAI;AACN,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;AAClB,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;AACpB,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;AACpB,EAAE,SAAS,EAAE,GAAG;AAChB,EAAE,SAAS,EAAE,GAAG;AAChB,EAAE,SAAS,EAAE;AACb,EAAE;AACF,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,CAAC;AAC1C,CAAC,MAAM,QAAQ,GAAG,kBAAkB,EAAE;AACtC,CAAC,MAAM,OAAO,GAAG;AACjB,EAAE,EAAE,EAAE,UAAU,EAAE;AAClB,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE;AACf,EAAE,IAAI,EAAE,SAAS;AACjB,EAAE,IAAI,EAAE,SAAS;AACjB,EAAE,UAAU,EAAE,QAAQ;AACtB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;AAClB,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;AACpB,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;AACpB,EAAE,gBAAgB,EAAE,KAAK;AACzB,EAAE,SAAS,EAAE,GAAG;AAChB,EAAE,SAAS,EAAE,GAAG;AAChB,EAAE,SAAS,EAAE;AACb,EAAE;AACF,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,cAAc,EAAE,OAAO,CAAC;AACtD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,oBAAoB,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE;AAC3D,CAAC,MAAM,QAAQ,GAAG,eAAe,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACvD,CAAC,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,KAAK;AAChD,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI;AAC3B,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AAChD,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,MAAM,KAAK,QAAQ;AACvC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE;AAC/D,CAAC,MAAM,QAAQ,GAAG,eAAe,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACvD,CAAC,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,KAAK;AAChD,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI;AAC3B,CAAC,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACtD,CAAC,OAAO,CAAC,CAAC,SAAS,IAAI,SAAS,KAAK,QAAQ;AAC7C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,uBAAuB,GAAG;AACnC,CAAC,MAAM,IAAI,GAAG,eAAe,EAAE;AAC/B,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;AACtB,CAAC,IAAI,OAAO,IAAI,CAAC,2BAA2B,KAAK,UAAU,EAAE;AAC7D,EAAE,IAAI,WAAW,CAAC,8BAA8B,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,8LAA8L,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC;AAC3S,EAAE;AACF,CAAC;AACD,CAAC,IAAI,CAAC,2BAA2B,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK;AAC5D,EAAE,IAAI,MAAM,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,OAAO,KAAK;AAC/E,EAAE,OAAO,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,CAAC,8BAA8B,EAAE,UAAU,EAAE,CAAC;AACjG,CAAC,CAAC,CAAC;AACH;;;;"}

package/build/server/chunks/chunks/badge.js-D2XQ42hh.js

@@ -0,0 +1,35 @@
+import { at as element, aw as bind_props, ao as attributes, ap as clsx$1 } from './server.js-D3MqDbVt.js';
+import { c as cn } from './utils3.js-DANle-lS.js';
+import { tv } from 'tailwind-variants';
+
+// ../ui/src/lib/components/primitives/badge/badge.svelte
+var badgeVariants = tv({
+	base: "focus-visible:border-ring focus-visible:ring-ring aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive inline-flex w-fit shrink-0 items-center justify-center gap-1 overflow-hidden rounded-full border px-2 py-0.5 text-xs font-medium whitespace-nowrap transition focus-visible:ring-3 [&>svg]:pointer-events-none [&>svg]:size-3",
+	variants: { variant: {
+		default: "bg-primary text-primary-foreground [a&]:hover:bg-primary/90 border-transparent",
+		secondary: "bg-secondary text-secondary-foreground [a&]:hover:bg-secondary/90 border-transparent",
+		destructive: "bg-destructive [a&]:hover:bg-destructive/90 dark:bg-destructive/70 border-transparent text-destructive-foreground",
+		outline: "text-foreground [a&]:hover:bg-accent [a&]:hover:text-accent-foreground"
+	} },
+	defaultVariants: { variant: "default" }
+});
+function Badge($$renderer, $$props) {
+	$$renderer.component(($$renderer) => {
+		let { ref = null, href, class: className, variant = "default", children, $$slots, $$events, ...restProps } = $$props;
+		element($$renderer, href ? "a" : "span", () => {
+			$$renderer.push(`${attributes({
+				"data-slot": "badge",
+				href,
+				class: clsx$1(cn(badgeVariants({ variant }), className)),
+				...restProps
+			})}`);
+		}, () => {
+			children?.($$renderer);
+			$$renderer.push(`<!---->`);
+		});
+		bind_props($$props, { ref });
+	});
+}
+
+export { Badge as B };
+//# sourceMappingURL=badge.js-D2XQ42hh.js.map

package/build/server/chunks/chunks/badge.js-D2XQ42hh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"badge.js-D2XQ42hh.js","sources":["../../../../.svelte-kit/output/server/chunks/badge.js"],"sourcesContent":["import { O as clsx, i as bind_props, o as element, r as attributes } from \"./server.js\";\nimport { t as cn } from \"./utils3.js\";\nimport { tv } from \"tailwind-variants\";\n// ../ui/src/lib/components/primitives/badge/badge.svelte\nvar badgeVariants = tv({\n\tbase: \"focus-visible:border-ring focus-visible:ring-ring aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive inline-flex w-fit shrink-0 items-center justify-center gap-1 overflow-hidden rounded-full border px-2 py-0.5 text-xs font-medium whitespace-nowrap transition focus-visible:ring-3 [&>svg]:pointer-events-none [&>svg]:size-3\",\n\tvariants: { variant: {\n\t\tdefault: \"bg-primary text-primary-foreground [a&]:hover:bg-primary/90 border-transparent\",\n\t\tsecondary: \"bg-secondary text-secondary-foreground [a&]:hover:bg-secondary/90 border-transparent\",\n\t\tdestructive: \"bg-destructive [a&]:hover:bg-destructive/90 dark:bg-destructive/70 border-transparent text-destructive-foreground\",\n\t\toutline: \"text-foreground [a&]:hover:bg-accent [a&]:hover:text-accent-foreground\"\n\t} },\n\tdefaultVariants: { variant: \"default\" }\n});\nfunction Badge($$renderer, $$props) {\n\t$$renderer.component(($$renderer) => {\n\t\tlet { ref = null, href, class: className, variant = \"default\", children, $$slots, $$events, ...restProps } = $$props;\n\t\telement($$renderer, href ? \"a\" : \"span\", () => {\n\t\t\t$$renderer.push(`${attributes({\n\t\t\t\t\"data-slot\": \"badge\",\n\t\t\t\thref,\n\t\t\t\tclass: clsx(cn(badgeVariants({ variant }), className)),\n\t\t\t\t...restProps\n\t\t\t})}`);\n\t\t}, () => {\n\t\t\tchildren?.($$renderer);\n\t\t\t$$renderer.push(`<!---->`);\n\t\t});\n\t\tbind_props($$props, { ref });\n\t});\n}\nexport { Badge as t };\n"],"names":["clsx"],"mappings":";;;;AAGA;AACA,IAAI,aAAa,GAAG,EAAE,CAAC;AACvB,CAAC,IAAI,EAAE,wXAAwX;AAC/X,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE;AACtB,EAAE,OAAO,EAAE,gFAAgF;AAC3F,EAAE,SAAS,EAAE,sFAAsF;AACnG,EAAE,WAAW,EAAE,mHAAmH;AAClI,EAAE,OAAO,EAAE;AACX,EAAE,EAAE;AACJ,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,SAAS;AACtC,CAAC,CAAC;AACF,SAAS,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE;AACpC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,UAAU,KAAK;AACtC,EAAE,IAAI,EAAE,GAAG,GAAG,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,GAAG,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,SAAS,EAAE,GAAG,OAAO;AACtH,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,GAAG,GAAG,GAAG,MAAM,EAAE,MAAM;AACjD,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC;AACjC,IAAI,WAAW,EAAE,OAAO;AACxB,IAAI,IAAI;AACR,IAAI,KAAK,EAAEA,MAAI,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;AAC1D,IAAI,GAAG;AACP,IAAI,CAAC,CAAC,CAAC,CAAC;AACR,EAAE,CAAC,EAAE,MAAM;AACX,GAAG,QAAQ,GAAG,UAAU,CAAC;AACzB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;AAC7B,EAAE,CAAC,CAAC;AACJ,EAAE,UAAU,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC;AAC9B,CAAC,CAAC,CAAC;AACH;;;;"}

package/build/server/chunks/chunks/bootHealth.server.js-DlFiVgGw.js

@@ -0,0 +1,90 @@
+import { p as providers, g as getLogger } from './providers.server.js-NBgteuX7.js';
+import { r as renderThrown } from './definitions.js-sHh4E-La.js';
+
+// src/lib/server/bootHealth.server.ts
+var cached = null;
+var inflight = null;
+async function run() {
+	let atRestSecrets = null;
+	const store = providers.data.computeServer;
+	if (typeof store.verifySecrets === "function") try {
+		atRestSecrets = await store.verifySecrets();
+	} catch (err) {
+		getLogger().error("verifySecrets threw — treating as failure", {
+			component: "boot",
+			err: renderThrown(err)
+		});
+		atRestSecrets = {
+			ok: false,
+			plaintextFound: false,
+			failures: [{
+				serverId: "(unknown)",
+				serverLabel: "(unknown)",
+				reason: "key_mismatch",
+				cause: err instanceof Error ? err.message : String(err)
+			}]
+		};
+	}
+	if (atRestSecrets && !atRestSecrets.ok) {
+		for (const f of atRestSecrets.failures) getLogger().error("At-rest secret verification failed for compute server", {
+			component: "boot",
+			serverLabel: f.serverLabel,
+			serverId: f.serverId,
+			reason: f.reason,
+			cause: f.cause
+		});
+		getLogger().error("At-rest secret verification failed. /api/health will return 503. Recover by re-entering the affected apiKeys via /admin/compute, or by restoring the original SELVA_AT_REST_KEY. See docs/Troubleshooting.md.", { component: "boot" });
+	}
+	let schemaVersion = null;
+	const data = providers.data;
+	if (typeof data.verifySchemaVersion === "function") try {
+		schemaVersion = await data.verifySchemaVersion();
+	} catch (err) {
+		getLogger().error("verifySchemaVersion threw — treating as failure", {
+			component: "boot",
+			err: renderThrown(err)
+		});
+		schemaVersion = {
+			ok: false,
+			expected: "(unknown)",
+			actual: null,
+			message: err instanceof Error ? err.message : String(err)
+		};
+	}
+	if (schemaVersion && !schemaVersion.ok) getLogger().error("Database schema handshake failed. /api/health will return 503.", {
+		component: "boot",
+		expected: schemaVersion.expected,
+		actual: schemaVersion.actual ?? "unavailable",
+		detail: schemaVersion.message
+	});
+	return {
+		checkedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		atRestSecrets,
+		schemaVersion
+	};
+}
+/**
+* Runs the underlying checks at most once — subsequent callers receive the
+* same result; in-flight callers share a single promise. Does NOT auto-refresh
+* after an operator fixes the underlying issue — restart the process to
+* re-run the boot check. That's deliberate: boot health represents the state
+* at boot, by definition.
+*/
+function getBootHealth() {
+	if (cached) return Promise.resolve(cached);
+	if (inflight) return inflight;
+	inflight = run().then((result) => {
+		cached = result;
+		inflight = null;
+		return result;
+	});
+	return inflight;
+}
+function isDegraded(report) {
+	if (report.atRestSecrets !== null && !report.atRestSecrets.ok) return true;
+	if (report.schemaVersion !== null && !report.schemaVersion.ok) return true;
+	return false;
+}
+
+export { getBootHealth as g, isDegraded as i };
+//# sourceMappingURL=bootHealth.server.js-DlFiVgGw.js.map

package/build/server/chunks/chunks/bootHealth.server.js-DlFiVgGw.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootHealth.server.js-DlFiVgGw.js","sources":["../../../../.svelte-kit/output/server/chunks/bootHealth.server.js"],"sourcesContent":["import { T as providers, f as getLogger } from \"./providers.server.js\";\nimport { n as renderThrown } from \"./definitions.js\";\n// src/lib/server/bootHealth.server.ts\nvar cached = null;\nvar inflight = null;\nasync function run() {\n\tlet atRestSecrets = null;\n\tconst store = providers.data.computeServer;\n\tif (typeof store.verifySecrets === \"function\") try {\n\t\tatRestSecrets = await store.verifySecrets();\n\t} catch (err) {\n\t\tgetLogger().error(\"verifySecrets threw — treating as failure\", {\n\t\t\tcomponent: \"boot\",\n\t\t\terr: renderThrown(err)\n\t\t});\n\t\tatRestSecrets = {\n\t\t\tok: false,\n\t\t\tplaintextFound: false,\n\t\t\tfailures: [{\n\t\t\t\tserverId: \"(unknown)\",\n\t\t\t\tserverLabel: \"(unknown)\",\n\t\t\t\treason: \"key_mismatch\",\n\t\t\t\tcause: err instanceof Error ? err.message : String(err)\n\t\t\t}]\n\t\t};\n\t}\n\tif (atRestSecrets && !atRestSecrets.ok) {\n\t\tfor (const f of atRestSecrets.failures) getLogger().error(\"At-rest secret verification failed for compute server\", {\n\t\t\tcomponent: \"boot\",\n\t\t\tserverLabel: f.serverLabel,\n\t\t\tserverId: f.serverId,\n\t\t\treason: f.reason,\n\t\t\tcause: f.cause\n\t\t});\n\t\tgetLogger().error(\"At-rest secret verification failed. /api/health will return 503. Recover by re-entering the affected apiKeys via /admin/compute, or by restoring the original SELVA_AT_REST_KEY. See docs/Troubleshooting.md.\", { component: \"boot\" });\n\t}\n\tlet schemaVersion = null;\n\tconst data = providers.data;\n\tif (typeof data.verifySchemaVersion === \"function\") try {\n\t\tschemaVersion = await data.verifySchemaVersion();\n\t} catch (err) {\n\t\tgetLogger().error(\"verifySchemaVersion threw — treating as failure\", {\n\t\t\tcomponent: \"boot\",\n\t\t\terr: renderThrown(err)\n\t\t});\n\t\tschemaVersion = {\n\t\t\tok: false,\n\t\t\texpected: \"(unknown)\",\n\t\t\tactual: null,\n\t\t\tmessage: err instanceof Error ? err.message : String(err)\n\t\t};\n\t}\n\tif (schemaVersion && !schemaVersion.ok) getLogger().error(\"Database schema handshake failed. /api/health will return 503.\", {\n\t\tcomponent: \"boot\",\n\t\texpected: schemaVersion.expected,\n\t\tactual: schemaVersion.actual ?? \"unavailable\",\n\t\tdetail: schemaVersion.message\n\t});\n\treturn {\n\t\tcheckedAt: (/* @__PURE__ */ new Date()).toISOString(),\n\t\tatRestSecrets,\n\t\tschemaVersion\n\t};\n}\n/**\n* Runs the underlying checks at most once — subsequent callers receive the\n* same result; in-flight callers share a single promise. Does NOT auto-refresh\n* after an operator fixes the underlying issue — restart the process to\n* re-run the boot check. That's deliberate: boot health represents the state\n* at boot, by definition.\n*/\nfunction getBootHealth() {\n\tif (cached) return Promise.resolve(cached);\n\tif (inflight) return inflight;\n\tinflight = run().then((result) => {\n\t\tcached = result;\n\t\tinflight = null;\n\t\treturn result;\n\t});\n\treturn inflight;\n}\nfunction isDegraded(report) {\n\tif (report.atRestSecrets !== null && !report.atRestSecrets.ok) return true;\n\tif (report.schemaVersion !== null && !report.schemaVersion.ok) return true;\n\treturn false;\n}\nexport { isDegraded as n, getBootHealth as t };\n"],"names":[],"mappings":";;;AAEA;AACA,IAAI,MAAM,GAAG,IAAI;AACjB,IAAI,QAAQ,GAAG,IAAI;AACnB,eAAe,GAAG,GAAG;AACrB,CAAC,IAAI,aAAa,GAAG,IAAI;AACzB,CAAC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa;AAC3C,CAAC,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,UAAU,EAAE,IAAI;AACpD,EAAE,aAAa,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;AAC7C,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,2CAA2C,EAAE;AACjE,GAAG,SAAS,EAAE,MAAM;AACpB,GAAG,GAAG,EAAE,YAAY,CAAC,GAAG;AACxB,GAAG,CAAC;AACJ,EAAE,aAAa,GAAG;AAClB,GAAG,EAAE,EAAE,KAAK;AACZ,GAAG,cAAc,EAAE,KAAK;AACxB,GAAG,QAAQ,EAAE,CAAC;AACd,IAAI,QAAQ,EAAE,WAAW;AACzB,IAAI,WAAW,EAAE,WAAW;AAC5B,IAAI,MAAM,EAAE,cAAc;AAC1B,IAAI,KAAK,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG;AAC1D,IAAI;AACJ,GAAG;AACH,CAAC;AACD,CAAC,IAAI,aAAa,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE;AACzC,EAAE,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,uDAAuD,EAAE;AACrH,GAAG,SAAS,EAAE,MAAM;AACpB,GAAG,WAAW,EAAE,CAAC,CAAC,WAAW;AAC7B,GAAG,QAAQ,EAAE,CAAC,CAAC,QAAQ;AACvB,GAAG,MAAM,EAAE,CAAC,CAAC,MAAM;AACnB,GAAG,KAAK,EAAE,CAAC,CAAC;AACZ,GAAG,CAAC;AACJ,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,+MAA+M,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC3P,CAAC;AACD,CAAC,IAAI,aAAa,GAAG,IAAI;AACzB,CAAC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI;AAC5B,CAAC,IAAI,OAAO,IAAI,CAAC,mBAAmB,KAAK,UAAU,EAAE,IAAI;AACzD,EAAE,aAAa,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE;AAClD,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,iDAAiD,EAAE;AACvE,GAAG,SAAS,EAAE,MAAM;AACpB,GAAG,GAAG,EAAE,YAAY,CAAC,GAAG;AACxB,GAAG,CAAC;AACJ,EAAE,aAAa,GAAG;AAClB,GAAG,EAAE,EAAE,KAAK;AACZ,GAAG,QAAQ,EAAE,WAAW;AACxB,GAAG,MAAM,EAAE,IAAI;AACf,GAAG,OAAO,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG;AAC3D,GAAG;AACH,CAAC;AACD,CAAC,IAAI,aAAa,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,gEAAgE,EAAE;AAC7H,EAAE,SAAS,EAAE,MAAM;AACnB,EAAE,QAAQ,EAAE,aAAa,CAAC,QAAQ;AAClC,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,IAAI,aAAa;AAC/C,EAAE,MAAM,EAAE,aAAa,CAAC;AACxB,EAAE,CAAC;AACH,CAAC,OAAO;AACR,EAAE,SAAS,EAAE,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACvD,EAAE,aAAa;AACf,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,GAAG;AACzB,CAAC,IAAI,MAAM,EAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;AAC3C,CAAC,IAAI,QAAQ,EAAE,OAAO,QAAQ;AAC9B,CAAC,QAAQ,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK;AACnC,EAAE,MAAM,GAAG,MAAM;AACjB,EAAE,QAAQ,GAAG,IAAI;AACjB,EAAE,OAAO,MAAM;AACf,CAAC,CAAC,CAAC;AACH,CAAC,OAAO,QAAQ;AAChB;AACA,SAAS,UAAU,CAAC,MAAM,EAAE;AAC5B,CAAC,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,OAAO,IAAI;AAC3E,CAAC,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,OAAO,IAAI;AAC3E,CAAC,OAAO,KAAK;AACb;;;;"}

package/build/server/chunks/chunks/building-complex.js-B0vpG_9C.js

@@ -0,0 +1,24 @@
+import { al as spread_props } from './server.js-D3MqDbVt.js';
+import { I as Icon } from './utils3.js-DANle-lS.js';
+
+// ../../node_modules/.pnpm/@lucide+svelte@1.61.0_svelte@5.57.2_@typescript-eslint+types@8.72.0_/node_modules/@lucide/svelte/dist/icons/building-complex.svelte
+var __iconData = {
+	"name": "building-complex",
+	"size": 24,
+	"node": [
+		["path", { "d": "M10 12h4" }],
+		["path", { "d": "M10 8h4" }],
+		["path", { "d": "M14 21v-3a2 2 0 0 0-4 0v3" }],
+		["path", { "d": "M6 10H4a2 2 0 0 0-2 2v7a2 2 0 0 0 2 2h16a2 2 0 0 0 2-2V9a2 2 0 0 0-2-2h-2" }],
+		["path", { "d": "M6 21V5a2 2 0 0 1 2-2h8a2 2 0 0 1 2 2v16" }]
+	],
+	"aliases": ["building-2"]
+};
+__iconData.node;
+function Building_complex($$renderer, $$props) {
+	let { $$slots, $$events, ...props } = $$props;
+	Icon($$renderer, spread_props([props, { icon: __iconData }]));
+}
+
+export { Building_complex as B };
+//# sourceMappingURL=building-complex.js-B0vpG_9C.js.map

package/build/server/chunks/chunks/building-complex.js-B0vpG_9C.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"building-complex.js-B0vpG_9C.js","sources":["../../../../.svelte-kit/output/server/chunks/building-complex.js"],"sourcesContent":["import { d as spread_props } from \"./server.js\";\nimport { n as Icon } from \"./utils3.js\";\n// ../../node_modules/.pnpm/@lucide+svelte@1.61.0_svelte@5.57.2_@typescript-eslint+types@8.72.0_/node_modules/@lucide/svelte/dist/icons/building-complex.svelte\nvar __iconData = {\n\t\"name\": \"building-complex\",\n\t\"size\": 24,\n\t\"node\": [\n\t\t[\"path\", { \"d\": \"M10 12h4\" }],\n\t\t[\"path\", { \"d\": \"M10 8h4\" }],\n\t\t[\"path\", { \"d\": \"M14 21v-3a2 2 0 0 0-4 0v3\" }],\n\t\t[\"path\", { \"d\": \"M6 10H4a2 2 0 0 0-2 2v7a2 2 0 0 0 2 2h16a2 2 0 0 0 2-2V9a2 2 0 0 0-2-2h-2\" }],\n\t\t[\"path\", { \"d\": \"M6 21V5a2 2 0 0 1 2-2h8a2 2 0 0 1 2 2v16\" }]\n\t],\n\t\"aliases\": [\"building-2\"]\n};\n__iconData.node;\nfunction Building_complex($$renderer, $$props) {\n\tlet { $$slots, $$events, ...props } = $$props;\n\tIcon($$renderer, spread_props([props, { icon: __iconData }]));\n}\nexport { Building_complex as t };\n"],"names":[],"mappings":";;;AAEA;AACA,IAAI,UAAU,GAAG;AACjB,CAAC,MAAM,EAAE,kBAAkB;AAC3B,CAAC,MAAM,EAAE,EAAE;AACX,CAAC,MAAM,EAAE;AACT,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;AAC/B,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;AAC9B,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,2BAA2B,EAAE,CAAC;AAChD,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,2EAA2E,EAAE,CAAC;AAChG,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,0CAA0C,EAAE;AAC9D,EAAE;AACF,CAAC,SAAS,EAAE,CAAC,YAAY;AACzB,CAAC;AACD,UAAU,CAAC,IAAI;AACf,SAAS,gBAAgB,CAAC,UAAU,EAAE,OAAO,EAAE;AAC/C,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO;AAC9C,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;AAC9D;;;;"}