@selvajs/selva 4.20.0-beta.3 → 4.20.0-beta.5

package/build/server/chunks/chunks/access.js-DfErwlEj.js

@@ -0,0 +1,570 @@
+import { A as ALL_PLATFORM_PERMISSIONS, a as ALL_ORG_PERMISSIONS, h as hasPermission, o as outsideTokenOrg } from './src.js-qWxoV-ql.js';
+import { a as apiError, i as isFlagEnabled, A as ApiErrorCode } from './schema-extraction.js-BPImouBL.js';
+
+//#region ../platform/src/access/rules.ts
+/**
+* Pure access-control rules — single source of truth for UI gating across
+* adapters. Mutating store methods MUST re-enforce the same predicate
+* independently (RLS in SQL, code in local/JSON).
+*
+* `instance_admin` bypass is not baked into rule bodies — wrap calls with
+* `withAdminBypass` at the call site.
+*/
+function isInstanceAdmin(platformPermissions) {
+	return platformPermissions.includes("instance_admin");
+}
+function withAdminBypass(platformPermissions, rule) {
+	if (isInstanceAdmin(platformPermissions)) return true;
+	return rule();
+}
+/**
+* Authenticated-user view rule. Anonymous access goes through share-link
+* tokens instead — the route resolves a valid token before this runs.
+*
+* Platform projects: `instance_admin` always passes; otherwise any grant
+* (view-only or canSolve) satisfies view access.
+*/
+function canView(input) {
+	const { project, member, orgMember, allowCrossOrgPublic, enablePlatformProjects, platformPermissions, platformGrants, actingOrgId, userId } = input;
+	if (!project) return false;
+	if (project.visibility === "platform") {
+		if (!enablePlatformProjects) return false;
+		if (isInstanceAdmin(platformPermissions)) return true;
+		return platformGrants.some((g) => g.granteeType === "user" && g.granteeId === userId || g.granteeType === "org" && g.granteeId === actingOrgId);
+	}
+	if (project.visibility === "private") return member !== null;
+	if (project.visibility === "org") return orgMember !== null;
+	if (project.visibility === "public") return allowCrossOrgPublic ? true : orgMember !== null;
+	return false;
+}
+/**
+* Non-platform projects: same as `canView` — kept as a separate function so
+* cost gating can diverge from view access later.
+*
+* Platform projects: `instance_admin` always passes; a view-only grant
+* satisfies `canView` but not `canSolve` — the grant needs `canSolve: true`.
+*/
+function canSolve(input) {
+	const { project, enablePlatformProjects, platformPermissions, platformGrants, actingOrgId, userId } = input;
+	if (!project) return false;
+	if (project.visibility === "platform") {
+		if (!enablePlatformProjects) return false;
+		if (isInstanceAdmin(platformPermissions)) return true;
+		return platformGrants.some((g) => g.canSolve && (g.granteeType === "user" && g.granteeId === userId || g.granteeType === "org" && g.granteeId === actingOrgId));
+	}
+	return canView(input);
+}
+/**
+* Platform projects: `instance_admin` only (they have no member rows).
+* All other visibilities: project owner/editor.
+*/
+function canEdit(input) {
+	const { member, project, enablePlatformProjects, platformPermissions } = input;
+	if (project?.visibility === "platform") {
+		if (!enablePlatformProjects) return false;
+		return isInstanceAdmin(platformPermissions);
+	}
+	return member?.role === "owner" || member?.role === "editor";
+}
+/** Platform projects: `instance_admin` only. All other visibilities: project owner. */
+function canManage(input) {
+	if (input.project?.visibility === "platform") {
+		if (!input.enablePlatformProjects) return false;
+		return isInstanceAdmin(input.platformPermissions);
+	}
+	return input.member?.role === "owner";
+}
+/** Platform projects: `instance_admin` only. All other visibilities: project owner. */
+function canEditProjectSettings(input) {
+	if (input.project?.visibility === "platform") {
+		if (!input.enablePlatformProjects) return false;
+		return isInstanceAdmin(input.platformPermissions);
+	}
+	return input.member?.role === "owner";
+}
+/**
+* Authorization to flip a project to `public`. The `ALLOW_CROSS_ORG_PUBLIC`
+* flag only changes what `public` means post-flip; the flip itself is gated
+* by org owner/admin role.
+*/
+function canChangeVisibilityToPublic(input) {
+	const role = input.orgMember?.role;
+	return role === "owner" || role === "admin";
+}
+/**
+* For platform projects: `instance_admin` only.
+* For all other projects: project editor/owner can always edit (moderation).
+* On commons projects (`autoJoinOnUpload=true`) the definition owner can edit
+* their own, as long as they still belong to the project's org.
+*/
+function canEditDefinition(input) {
+	const { project, definition, member, orgMember, userId, platformPermissions, enablePlatformProjects } = input;
+	if (!project || !definition) return false;
+	if (project.visibility === "platform") {
+		if (!enablePlatformProjects) return false;
+		return isInstanceAdmin(platformPermissions);
+	}
+	if (member?.role === "owner" || member?.role === "editor") return true;
+	if (project.autoJoinOnUpload && userId === definition.ownerId && orgMember) return true;
+	return false;
+}
+/**
+* Org leadership escape hatch: adds the actor as co-owner without demoting
+* the existing owner. Tenancy must match.
+*
+* Platform projects can't be reclaimed — `instance_admin` already has
+* management access to them.
+*/
+function canReclaim(input) {
+	const { project, orgMember, actingOrgId } = input;
+	if (!project || !actingOrgId) return false;
+	if (project.visibility === "platform") return false;
+	if (actingOrgId !== project.orgId) return false;
+	const role = orgMember?.role;
+	return role === "owner" || role === "admin";
+}
+/**
+* Owner/admin can always create; a `member` needs `manage_projects` org
+* permission. Tenancy is enforced.
+*
+* Platform projects (`visibility: 'platform'`) go through the admin API,
+* gated on `instance_admin` — this rule isn't consulted for them.
+*/
+function canCreateProject(input) {
+	const { orgMember, orgPermissions, actingOrgId, targetOrgId } = input;
+	if (actingOrgId !== targetOrgId) return false;
+	const role = orgMember?.role;
+	if (role === "owner" || role === "admin") return true;
+	if (role === "member" && orgPermissions.includes("manage_projects")) return true;
+	return false;
+}
+/**
+* Whether the actor may hand out or take away org `owner`/`admin` standing (§3).
+*
+* Three routes decide this — inviting someone as owner/admin, changing an
+* existing member's role, and removing an owner — and all three had written it
+* out longhand. Two of them had drifted by the time the access audit found
+* them: the invite route let an admin mint an `owner` invite for themselves,
+* and DELETE let an admin remove an owner that PATCH would not let them demote.
+* They are one rule, so they read it from one place.
+*
+* Reads the actor's **membership row**. `Organization.ownerId` is a separate
+* field that can disagree with it — see the sole-`instance_admin` finding — and
+* is not authority for this decision.
+*/
+function canChangeOrgRole(input) {
+	if (input.role === "member") return true;
+	return input.actorMember?.role === "owner";
+}
+function checkOwnerRemoval(input) {
+	if (input.target.role !== "owner") return "ok";
+	if (input.allMembers.filter((m) => m.role === "owner").length <= 1) return "sole_owner";
+	if (!input.confirmed) return "needs_confirm";
+	return "ok";
+}
+//#endregion
+//#region ../server/src/access/project-access-input.ts
+function createProjectAccessInputBuilder(deps) {
+	return {
+		async buildProjectAccessInput(ctx, project, overrides = {}) {
+			const { allowCrossOrgPublic, enablePlatformProjects } = deps.flags();
+			let member = null;
+			let orgMember = null;
+			let platformGrants = [];
+			if (project.visibility === "platform") {
+				if (enablePlatformProjects) platformGrants = await deps.listPlatformGrants(ctx, project.id);
+			} else if (project.visibility === "private") member = await deps.getProjectMember(ctx, project.id, ctx.userId);
+			else {
+				const skipOrgMember = project.visibility === "public" && allowCrossOrgPublic;
+				[member, orgMember] = await Promise.all([deps.getProjectMember(ctx, project.id, ctx.userId), skipOrgMember ? Promise.resolve(null) : deps.getOrgMember(ctx, project.orgId, ctx.userId)]);
+			}
+			return {
+				orgPermissions: ctx.orgPermissions,
+				platformPermissions: ctx.platformPermissions,
+				project,
+				member,
+				orgMember,
+				allowCrossOrgPublic,
+				enablePlatformProjects,
+				platformGrants,
+				actingOrgId: ctx.actingOrgId ?? null,
+				userId: ctx.userId,
+				...overrides
+			};
+		},
+		projectAccessInputFromRows(ctx, project, rows) {
+			const { allowCrossOrgPublic, enablePlatformProjects } = deps.flags();
+			return {
+				orgPermissions: ctx.orgPermissions,
+				platformPermissions: ctx.platformPermissions,
+				project,
+				member: rows.member ?? null,
+				orgMember: rows.orgMember ?? null,
+				allowCrossOrgPublic,
+				enablePlatformProjects,
+				platformGrants: rows.platformGrants ?? [],
+				actingOrgId: ctx.actingOrgId ?? null,
+				userId: ctx.userId
+			};
+		}
+	};
+}
+//#endregion
+//#region ../server/src/access/guards.ts
+/**
+* Derive the stores a guard needs from a resolved config.
+*
+* Pure — it reads the config it is handed and nothing else, which is what keeps
+* this module free of any import that boots the app. Page loads pass
+* `locals.providers`; `hooks.server.ts` sets it on every request.
+*/
+function accessDepsFromConfig(config) {
+	return {
+		orgs: config.data.orgs,
+		projects: config.data.projects,
+		definitionMeta: config.data.definitions,
+		platformProjectGrants: config.data.platformProjectGrants,
+		flag: (name) => isFlagEnabled(config, name)
+	};
+}
+/** `locals` as a store-reading guard wants it. */
+function scoped(locals) {
+	return {
+		...locals,
+		deps: accessDepsFromConfig(locals.providers)
+	};
+}
+var orgsOf = (src) => src.deps.orgs;
+var projectsOf = (src) => src.deps.projects;
+var definitionMetaOf = (src) => src.deps.definitionMeta;
+var flagOf = (src) => src.deps.flag;
+function requireAuthed(locals) {
+	const { user, ctx } = locals;
+	if (!user || !ctx) apiError(401, ApiErrorCode.UNAUTHORIZED, "Unauthorized");
+	return {
+		user,
+		ctx
+	};
+}
+/** Throws 403 — use in API routes. */
+function requirePermission(locals, permission) {
+	const { user, ctx } = requireAuthed(locals);
+	if (!hasPermission(ctx, permission)) apiError(403, ApiErrorCode.FORBIDDEN, `You don't have permission to do this.`);
+	return user;
+}
+var requireManageInstanceUsers = (locals) => requirePermission(locals, "manage_instance_users");
+var requireManageCompute = (locals) => requirePermission(locals, "manage_compute");
+var requireManageOrgMembers = (locals) => requirePermission(locals, "manage_org_members");
+var requireManageOrgCompute = (locals) => requirePermission(locals, "manage_org_compute");
+var requireInstanceAdmin = (locals) => requirePermission(locals, "instance_admin");
+/**
+* Platform scope is not delegable: `manage_instance_users` runs the user-admin
+* surface but must not be able to mint an `instance_admin`, or an org admin
+* holding it self-elevates. Three routes write platform permissions — the two
+* `/api/admin/users` handlers and the invite mint route — and each carried its
+* own copy of this check.
+*
+* Pass `current` on an update. Revoking is a platform-scope change too, so a
+* PATCH that drops `instance_admin` is refused for the same reason granting it
+* is; without `current` the caller is creating (a user, an invite) and there is
+* nothing to compare against.
+*
+* Requesting nothing on a create is always allowed — that is a
+* `manage_instance_users` operation, not a platform-scope one.
+*/
+function assertCanGrantPlatformPermissions(ctx, requested, current) {
+	if (!(current ? requested.length !== current.length || requested.some((p) => !current.includes(p)) || current.some((p) => !requested.includes(p)) : requested.length > 0)) return;
+	if (hasPermission(ctx, "instance_admin")) return;
+	apiError(403, ApiErrorCode.FORBIDDEN, current ? "Only a platform admin can change platform-scope permissions" : "Only a platform admin can grant platform-scope permissions");
+}
+/**
+* Tenancy gate for `/api/v1/orgs/{orgId}/…`. The URL id is never trusted alone
+* — the acting context decides which tenant a request applies to, so a
+* mismatch is 403 rather than a silent read of the caller's own org.
+*/
+function requireActingOrg(locals, orgId) {
+	const ctx = locals.ctx;
+	if (!ctx) apiError(401, ApiErrorCode.UNAUTHORIZED, "Unauthorized");
+	if (!orgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Missing org ID");
+	if (!ctx.actingOrgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, "No active organization");
+	if (ctx.actingOrgId !== orgId) apiError(403, ApiErrorCode.FORBIDDEN, "Acting org does not match the target org.");
+	return {
+		ctx,
+		orgId
+	};
+}
+/**
+* Gate for pages reachable by any platform-class permission holder (the
+
+/**
+* Management-scope bypass — used for org governance and project management
+* actions (Reclaim, create project, delete project, manage members, edit
+* settings). `instance_admin` bypasses these so platform staff can administer
+* the instance without being a member of every org.
+*
+* NOT used for content access (view, solve, edit definitions):
+* `instance_admin` follows the same `canView`/`canEdit` rules as any other
+* user there, keeping blast radius small and forcing content escalation
+* through Reclaim, which leaves an audit trail.
+*/
+async function managementBypassOrRun(ctx, check) {
+	if (hasPermission(ctx, "instance_admin")) return true;
+	return await check();
+}
+async function contentCheck(check) {
+	return await check();
+}
+async function loadProjectOr404(ctx, projectId, src) {
+	const project = await projectsOf(src).getProject(ctx, projectId);
+	if (!project || outsideTokenOrg(ctx, project.orgId)) apiError(404, ApiErrorCode.NOT_FOUND, "Project not found");
+	return project;
+}
+function accessInputsFor(src) {
+	const readFlag = flagOf(src);
+	return createProjectAccessInputBuilder({
+		getProjectMember: (ctx, projectId, userId) => projectsOf(src).getProjectMember(ctx, projectId, userId),
+		getOrgMember: (ctx, orgId, userId) => orgsOf(src).getOrgMember(ctx, orgId, userId),
+		listPlatformGrants: (ctx, projectId) => src.deps.platformProjectGrants.listByProject(ctx, projectId),
+		flags: () => ({
+			allowCrossOrgPublic: readFlag("ALLOW_CROSS_ORG_PUBLIC"),
+			enablePlatformProjects: readFlag("ENABLE_PLATFORM_PROJECTS")
+		})
+	});
+}
+function buildProjectAccessInput(ctx, project, src, overrides) {
+	return accessInputsFor(src).buildProjectAccessInput(ctx, project, overrides);
+}
+/**
+* Assemble a rule input from rows the caller already loaded.
+*
+* Unlike the other builders this one issues no reads — the caller batched them.
+* It still needs `deps` for the flag lookups, which decide whether a
+* cross-org-public or platform project is visible at all.
+*/
+function projectAccessInputFromRowsWith(src, ...args) {
+	return accessInputsFor(src).projectAccessInputFromRows(...args);
+}
+/**
+* Gates creation of a *new* definition. Container projects require project
+* owner/editor (canEdit). Commons projects (`autoJoinOnUpload=true`) accept
+* any authenticated user — the handler stamps `ownerId = user.id` so the
+* uploader becomes the owner.
+*/
+async function requireCanCreateDefinition(locals, projectId) {
+	const { user, ctx } = requireAuthed(locals);
+	const project = await loadProjectOr404(ctx, projectId, locals);
+	if (!await contentCheck(async () => {
+		if (project.autoJoinOnUpload) return true;
+		return canEdit(await buildProjectAccessInput(ctx, project, locals));
+	})) apiError(403, ApiErrorCode.FORBIDDEN, "You do not have permission to upload definitions to this project.");
+	return {
+		user,
+		ctx,
+		project
+	};
+}
+/**
+* Org-content gate — the caller must be a member of `orgId`. Used by the
+* file-serving proxy for org-private assets (e.g. pricing sheets under
+* `orgs/{id}/private/*`). Org membership is the only rule; runs through
+* `contentCheck` (no `instance_admin` bypass) — platform staff use Reclaim
+* if they need access without membership.
+*
+* Throws 401 unauthenticated, 403 when not a member.
+*/
+async function requireCanViewOrg(locals, orgId) {
+	const { user, ctx } = requireAuthed(locals);
+	if (!await contentCheck(async () => {
+		return await orgsOf(locals).getOrgMember(ctx, orgId, ctx.userId) !== null;
+	})) apiError(403, ApiErrorCode.FORBIDDEN, "You do not have access to this organization.");
+	return user;
+}
+/**
+* Project members must belong to the project's parent org. Enforced at the
+* rule layer, not as a DB constraint, to leave room for cross-org guests
+* later without a schema migration.
+*/
+async function requireTargetIsOrgMember(locals, orgId, targetUserId) {
+	const { ctx } = requireAuthed(locals);
+	if (!await orgsOf(locals).getOrgMember(ctx, orgId, targetUserId)) apiError(400, ApiErrorCode.VALIDATION_FAILED, "User must be a member of this organization to be added to a project.");
+}
+/**
+* `canChangeOrgRole` with the actor's membership row loaded — whether the
+* caller may grant or revoke org `owner`/`admin` standing (§3).
+*
+* Returns rather than throws: the three callers each phrase the refusal for
+* what they were doing ("invite someone as owner", "change roles", "remove
+* another owner") and raise it through `apiError`. What must not diverge is the
+* decision, which is why that half lives in `rules.ts` and this loads its input.
+*/
+async function canActorChangeOrgRole(ctx, orgId, role, src) {
+	if (role === "member") return true;
+	return canChangeOrgRole({
+		actorMember: await orgsOf(src).getOrgMember(ctx, orgId, ctx.userId),
+		role
+	});
+}
+/**
+* `canReclaim` — org owner/admin escape hatch. Returns the project so the
+* handler can use its `orgId` without re-fetching.
+*/
+async function requireCanReclaim(locals, projectId) {
+	const { user, ctx } = requireAuthed(locals);
+	const project = await loadProjectOr404(ctx, projectId, locals);
+	if (project.visibility === "platform") apiError(403, ApiErrorCode.FORBIDDEN, "Platform projects cannot be reclaimed.");
+	if (!await managementBypassOrRun(ctx, async () => {
+		const orgMember = await orgsOf(locals).getOrgMember(ctx, project.orgId, ctx.userId);
+		return canReclaim({
+			project,
+			orgMember,
+			actingOrgId: ctx.actingOrgId ?? null
+		});
+	})) apiError(403, ApiErrorCode.FORBIDDEN, "Only org owners or admins of this project’s org can reclaim it.");
+	return {
+		user,
+		ctx,
+		project
+	};
+}
+/**
+* `canCreateProject` — owner/admin always; member needs `manage_projects`.
+* Tenancy is enforced via `actingOrgId`.
+*/
+async function requireCanCreateProject(locals, targetOrgId) {
+	const { user, ctx } = requireAuthed(locals);
+	if (!await managementBypassOrRun(ctx, async () => {
+		const orgMember = await orgsOf(locals).getOrgMember(ctx, targetOrgId, ctx.userId);
+		return canCreateProject({
+			orgPermissions: ctx.orgPermissions,
+			orgMember,
+			actingOrgId: ctx.actingOrgId ?? null,
+			targetOrgId
+		});
+	})) apiError(403, ApiErrorCode.FORBIDDEN, "You do not have permission to create projects in this org.");
+	return {
+		user,
+		ctx
+	};
+}
+/**
+* Project-management gate (`canManage` — owner, or `instance_admin` via the
+* bypass). Managing members is the same authority as managing the project, so
+* both callers share this; `action` only shapes the 403 message.
+*/
+async function requireCanManage(locals, projectId, action = "project") {
+	const { user, ctx } = requireAuthed(locals);
+	if (!await managementBypassOrRun(ctx, async () => {
+		const project = await loadProjectOr404(ctx, projectId, locals);
+		return canManage(await buildProjectAccessInput(ctx, project, locals));
+	})) apiError(403, ApiErrorCode.FORBIDDEN, action === "members" ? "Only project owners can manage members." : "Only project owners can manage this project.");
+	return user;
+}
+async function requireCanEditProjectSettings(locals, projectId) {
+	const { user, ctx } = requireAuthed(locals);
+	const project = await loadProjectOr404(ctx, projectId, locals);
+	if (!await managementBypassOrRun(ctx, async () => canEditProjectSettings(await buildProjectAccessInput(ctx, project, locals)))) apiError(403, ApiErrorCode.FORBIDDEN, "Only project owners can edit project settings.");
+	return {
+		user,
+		ctx,
+		project
+	};
+}
+async function requireCanViewProject(locals, projectId) {
+	const { user, ctx } = requireAuthed(locals);
+	if (!await contentCheck(async () => {
+		const project = await loadProjectOr404(ctx, projectId, locals);
+		return canView(await buildProjectAccessInput(ctx, project, locals));
+	})) apiError(403, ApiErrorCode.FORBIDDEN, "You do not have access to this project.");
+	return user;
+}
+/**
+* Solve gating. Today `canSolve === canView` for non-platform projects, but
+* the rule lives in its own function so future cost-gating (quotas, rate
+* limits) lands without touching view semantics. `viewer` project role
+* passes; platform projects narrow to grants with `canSolve=true`.
+*/
+async function requireCanSolve(locals, projectId, preloadedProject) {
+	const { user, ctx } = requireAuthed(locals);
+	const project = preloadedProject ?? await loadProjectOr404(ctx, projectId, locals);
+	if (outsideTokenOrg(ctx, project.orgId)) apiError(404, ApiErrorCode.NOT_FOUND, "Project not found");
+	if (!await contentCheck(async () => canSolve(await buildProjectAccessInput(ctx, project, locals)))) apiError(403, ApiErrorCode.FORBIDDEN, "You do not have access to this project.");
+	return {
+		user,
+		ctx,
+		project
+	};
+}
+/**
+* Org membership for the commons branch of `canEditDefinition`, or `null` when
+* that branch cannot fire. Skipping the round-trip on container projects keeps
+* the common edit path at the same two reads it had before commons gained the
+* membership test.
+*/
+async function loadCommonsOrgMember(ctx, project, src) {
+	if (!project?.autoJoinOnUpload) return null;
+	return await orgsOf(src).getOrgMember(ctx, project.orgId, ctx.userId);
+}
+/**
+* Loads the record and gates editing. Returns the record AND the project it
+* loads for the gate, so callers skip a re-fetch of either.
+*/
+async function requireEditableDefinition(locals, guid) {
+	const { ctx } = requireAuthed(locals);
+	const record = await definitionMetaOf(locals).get(ctx, guid);
+	if (!record) apiError(404, ApiErrorCode.NOT_FOUND, "Definition not found");
+	const [project, member] = await Promise.all([projectsOf(locals).getProject(ctx, record.projectId), projectsOf(locals).getProjectMember(ctx, record.projectId, ctx.userId)]);
+	if (project && outsideTokenOrg(ctx, project.orgId)) apiError(404, ApiErrorCode.NOT_FOUND, "Definition not found");
+	if (!await contentCheck(async () => canEditDefinition({
+		project,
+		definition: record,
+		member,
+		orgMember: await loadCommonsOrgMember(ctx, project, locals),
+		userId: ctx.userId,
+		platformPermissions: ctx.platformPermissions,
+		enablePlatformProjects: flagOf(locals)("ENABLE_PLATFORM_PROJECTS")
+	}))) apiError(403, ApiErrorCode.FORBIDDEN, "You do not have permission to edit this definition.");
+	return {
+		record,
+		ctx,
+		project
+	};
+}
+async function requireCanEditDefinition(locals, projectId, definitionGuid, preloaded) {
+	const { user, ctx } = requireAuthed(locals);
+	if (!await contentCheck(async () => {
+		const [project, definition, member] = await Promise.all([
+			preloaded?.project !== void 0 ? Promise.resolve(preloaded.project) : projectsOf(locals).getProject(ctx, projectId),
+			preloaded?.definition !== void 0 ? Promise.resolve(preloaded.definition) : definitionMetaOf(locals).get(ctx, definitionGuid),
+			projectsOf(locals).getProjectMember(ctx, projectId, ctx.userId)
+		]);
+		if (project && outsideTokenOrg(ctx, project.orgId)) return false;
+		return canEditDefinition({
+			project,
+			definition,
+			member,
+			orgMember: await loadCommonsOrgMember(ctx, project, locals),
+			userId: ctx.userId,
+			platformPermissions: ctx.platformPermissions,
+			enablePlatformProjects: flagOf(locals)("ENABLE_PLATFORM_PROJECTS")
+		});
+	})) apiError(403, ApiErrorCode.FORBIDDEN, "You do not have permission to edit this definition.");
+	return user;
+}
+//#endregion
+//#region ../server/src/access/permissions-scope.ts
+var PLATFORM_SET = new Set(ALL_PLATFORM_PERMISSIONS);
+var ORG_SET = new Set(ALL_ORG_PERMISSIONS);
+/** Split a flat array into platform + org scope buckets, dropping unknowns. */
+function splitFlatPermissions(flat) {
+	const platform = [];
+	const org = [];
+	for (const p of flat) if (PLATFORM_SET.has(p)) platform.push(p);
+	else if (ORG_SET.has(p)) org.push(p);
+	return {
+		platform,
+		org
+	};
+}
+
+export { requireCanReclaim as A, canChangeVisibilityToPublic as B, requireManageCompute as C, requireInstanceAdmin as D, requireManageInstanceUsers as E, requireCanViewOrg as F, requireCanEditDefinition as G, accessDepsFromConfig as a, requirePermission as b, canView as c, requireCanSolve as d, canManage as e, canEdit as f, requireCanCreateDefinition as g, requireEditableDefinition as h, requireActingOrg as i, requireManageOrgMembers as j, requireManageOrgCompute as k, splitFlatPermissions as l, assertCanGrantPlatformPermissions as m, canActorChangeOrgRole as n, canChangeOrgRole as o, projectAccessInputFromRowsWith as p, requireCanViewProject as q, requireAuthed as r, scoped as s, requireCanCreateProject as t, canSolve as u, requireCanEditProjectSettings as v, withAdminBypass as w, requireCanManage as x, requireTargetIsOrgMember as y, checkOwnerRemoval as z };
+//# sourceMappingURL=access.js-DfErwlEj.js.map

package/build/server/chunks/chunks/access.js-DfErwlEj.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js-DfErwlEj.js","sources":["../../../../.svelte-kit/output/server/chunks/access.js"],"sourcesContent":["import { F as ALL_PLATFORM_PERMISSIONS, T as ALL_ORG_PERMISSIONS, r as hasPermission, v as outsideTokenOrg } from \"./src.js\";\nimport { d as ApiErrorCode, f as apiError, g as isFlagEnabled } from \"./schema-extraction.js\";\n//#region ../platform/src/access/rules.ts\n/**\n* Pure access-control rules — single source of truth for UI gating across\n* adapters. Mutating store methods MUST re-enforce the same predicate\n* independently (RLS in SQL, code in local/JSON).\n*\n* `instance_admin` bypass is not baked into rule bodies — wrap calls with\n* `withAdminBypass` at the call site.\n*/\nfunction isInstanceAdmin(platformPermissions) {\n\treturn platformPermissions.includes(\"instance_admin\");\n}\nfunction withAdminBypass(platformPermissions, rule) {\n\tif (isInstanceAdmin(platformPermissions)) return true;\n\treturn rule();\n}\n/**\n* Authenticated-user view rule. Anonymous access goes through share-link\n* tokens instead — the route resolves a valid token before this runs.\n*\n* Platform projects: `instance_admin` always passes; otherwise any grant\n* (view-only or canSolve) satisfies view access.\n*/\nfunction canView(input) {\n\tconst { project, member, orgMember, allowCrossOrgPublic, enablePlatformProjects, platformPermissions, platformGrants, actingOrgId, userId } = input;\n\tif (!project) return false;\n\tif (project.visibility === \"platform\") {\n\t\tif (!enablePlatformProjects) return false;\n\t\tif (isInstanceAdmin(platformPermissions)) return true;\n\t\treturn platformGrants.some((g) => g.granteeType === \"user\" && g.granteeId === userId || g.granteeType === \"org\" && g.granteeId === actingOrgId);\n\t}\n\tif (project.visibility === \"private\") return member !== null;\n\tif (project.visibility === \"org\") return orgMember !== null;\n\tif (project.visibility === \"public\") return allowCrossOrgPublic ? true : orgMember !== null;\n\treturn false;\n}\n/**\n* Non-platform projects: same as `canView` — kept as a separate function so\n* cost gating can diverge from view access later.\n*\n* Platform projects: `instance_admin` always passes; a view-only grant\n* satisfies `canView` but not `canSolve` — the grant needs `canSolve: true`.\n*/\nfunction canSolve(input) {\n\tconst { project, enablePlatformProjects, platformPermissions, platformGrants, actingOrgId, userId } = input;\n\tif (!project) return false;\n\tif (project.visibility === \"platform\") {\n\t\tif (!enablePlatformProjects) return false;\n\t\tif (isInstanceAdmin(platformPermissions)) return true;\n\t\treturn platformGrants.some((g) => g.canSolve && (g.granteeType === \"user\" && g.granteeId === userId || g.granteeType === \"org\" && g.granteeId === actingOrgId));\n\t}\n\treturn canView(input);\n}\n/**\n* Platform projects: `instance_admin` only (they have no member rows).\n* All other visibilities: project owner/editor.\n*/\nfunction canEdit(input) {\n\tconst { member, project, enablePlatformProjects, platformPermissions } = input;\n\tif (project?.visibility === \"platform\") {\n\t\tif (!enablePlatformProjects) return false;\n\t\treturn isInstanceAdmin(platformPermissions);\n\t}\n\treturn member?.role === \"owner\" || member?.role === \"editor\";\n}\n/** Platform projects: `instance_admin` only. All other visibilities: project owner. */\nfunction canManage(input) {\n\tif (input.project?.visibility === \"platform\") {\n\t\tif (!input.enablePlatformProjects) return false;\n\t\treturn isInstanceAdmin(input.platformPermissions);\n\t}\n\treturn input.member?.role === \"owner\";\n}\n/** Platform projects: `instance_admin` only. All other visibilities: project owner. */\nfunction canEditProjectSettings(input) {\n\tif (input.project?.visibility === \"platform\") {\n\t\tif (!input.enablePlatformProjects) return false;\n\t\treturn isInstanceAdmin(input.platformPermissions);\n\t}\n\treturn input.member?.role === \"owner\";\n}\n/**\n* Authorization to flip a project to `public`. The `ALLOW_CROSS_ORG_PUBLIC`\n* flag only changes what `public` means post-flip; the flip itself is gated\n* by org owner/admin role.\n*/\nfunction canChangeVisibilityToPublic(input) {\n\tconst role = input.orgMember?.role;\n\treturn role === \"owner\" || role === \"admin\";\n}\n/**\n* For platform projects: `instance_admin` only.\n* For all other projects: project editor/owner can always edit (moderation).\n* On commons projects (`autoJoinOnUpload=true`) the definition owner can edit\n* their own, as long as they still belong to the project's org.\n*/\nfunction canEditDefinition(input) {\n\tconst { project, definition, member, orgMember, userId, platformPermissions, enablePlatformProjects } = input;\n\tif (!project || !definition) return false;\n\tif (project.visibility === \"platform\") {\n\t\tif (!enablePlatformProjects) return false;\n\t\treturn isInstanceAdmin(platformPermissions);\n\t}\n\tif (member?.role === \"owner\" || member?.role === \"editor\") return true;\n\tif (project.autoJoinOnUpload && userId === definition.ownerId && orgMember) return true;\n\treturn false;\n}\n/**\n* Org leadership escape hatch: adds the actor as co-owner without demoting\n* the existing owner. Tenancy must match.\n*\n* Platform projects can't be reclaimed — `instance_admin` already has\n* management access to them.\n*/\nfunction canReclaim(input) {\n\tconst { project, orgMember, actingOrgId } = input;\n\tif (!project || !actingOrgId) return false;\n\tif (project.visibility === \"platform\") return false;\n\tif (actingOrgId !== project.orgId) return false;\n\tconst role = orgMember?.role;\n\treturn role === \"owner\" || role === \"admin\";\n}\n/**\n* Owner/admin can always create; a `member` needs `manage_projects` org\n* permission. Tenancy is enforced.\n*\n* Platform projects (`visibility: 'platform'`) go through the admin API,\n* gated on `instance_admin` — this rule isn't consulted for them.\n*/\nfunction canCreateProject(input) {\n\tconst { orgMember, orgPermissions, actingOrgId, targetOrgId } = input;\n\tif (actingOrgId !== targetOrgId) return false;\n\tconst role = orgMember?.role;\n\tif (role === \"owner\" || role === \"admin\") return true;\n\tif (role === \"member\" && orgPermissions.includes(\"manage_projects\")) return true;\n\treturn false;\n}\n/**\n* Whether the actor may hand out or take away org `owner`/`admin` standing (§3).\n*\n* Three routes decide this — inviting someone as owner/admin, changing an\n* existing member's role, and removing an owner — and all three had written it\n* out longhand. Two of them had drifted by the time the access audit found\n* them: the invite route let an admin mint an `owner` invite for themselves,\n* and DELETE let an admin remove an owner that PATCH would not let them demote.\n* They are one rule, so they read it from one place.\n*\n* Reads the actor's **membership row**. `Organization.ownerId` is a separate\n* field that can disagree with it — see the sole-`instance_admin` finding — and\n* is not authority for this decision.\n*/\nfunction canChangeOrgRole(input) {\n\tif (input.role === \"member\") return true;\n\treturn input.actorMember?.role === \"owner\";\n}\nfunction checkOwnerRemoval(input) {\n\tif (input.target.role !== \"owner\") return \"ok\";\n\tif (input.allMembers.filter((m) => m.role === \"owner\").length <= 1) return \"sole_owner\";\n\tif (!input.confirmed) return \"needs_confirm\";\n\treturn \"ok\";\n}\n//#endregion\n//#region ../server/src/access/project-access-input.ts\nfunction createProjectAccessInputBuilder(deps) {\n\treturn {\n\t\tasync buildProjectAccessInput(ctx, project, overrides = {}) {\n\t\t\tconst { allowCrossOrgPublic, enablePlatformProjects } = deps.flags();\n\t\t\tlet member = null;\n\t\t\tlet orgMember = null;\n\t\t\tlet platformGrants = [];\n\t\t\tif (project.visibility === \"platform\") {\n\t\t\t\tif (enablePlatformProjects) platformGrants = await deps.listPlatformGrants(ctx, project.id);\n\t\t\t} else if (project.visibility === \"private\") member = await deps.getProjectMember(ctx, project.id, ctx.userId);\n\t\t\telse {\n\t\t\t\tconst skipOrgMember = project.visibility === \"public\" && allowCrossOrgPublic;\n\t\t\t\t[member, orgMember] = await Promise.all([deps.getProjectMember(ctx, project.id, ctx.userId), skipOrgMember ? Promise.resolve(null) : deps.getOrgMember(ctx, project.orgId, ctx.userId)]);\n\t\t\t}\n\t\t\treturn {\n\t\t\t\torgPermissions: ctx.orgPermissions,\n\t\t\t\tplatformPermissions: ctx.platformPermissions,\n\t\t\t\tproject,\n\t\t\t\tmember,\n\t\t\t\torgMember,\n\t\t\t\tallowCrossOrgPublic,\n\t\t\t\tenablePlatformProjects,\n\t\t\t\tplatformGrants,\n\t\t\t\tactingOrgId: ctx.actingOrgId ?? null,\n\t\t\t\tuserId: ctx.userId,\n\t\t\t\t...overrides\n\t\t\t};\n\t\t},\n\t\tprojectAccessInputFromRows(ctx, project, rows) {\n\t\t\tconst { allowCrossOrgPublic, enablePlatformProjects } = deps.flags();\n\t\t\treturn {\n\t\t\t\torgPermissions: ctx.orgPermissions,\n\t\t\t\tplatformPermissions: ctx.platformPermissions,\n\t\t\t\tproject,\n\t\t\t\tmember: rows.member ?? null,\n\t\t\t\torgMember: rows.orgMember ?? null,\n\t\t\t\tallowCrossOrgPublic,\n\t\t\t\tenablePlatformProjects,\n\t\t\t\tplatformGrants: rows.platformGrants ?? [],\n\t\t\t\tactingOrgId: ctx.actingOrgId ?? null,\n\t\t\t\tuserId: ctx.userId\n\t\t\t};\n\t\t}\n\t};\n}\n//#endregion\n//#region ../server/src/access/guards.ts\n/**\n* Derive the stores a guard needs from a resolved config.\n*\n* Pure — it reads the config it is handed and nothing else, which is what keeps\n* this module free of any import that boots the app. Page loads pass\n* `locals.providers`; `hooks.server.ts` sets it on every request.\n*/\nfunction accessDepsFromConfig(config) {\n\treturn {\n\t\torgs: config.data.orgs,\n\t\tprojects: config.data.projects,\n\t\tdefinitionMeta: config.data.definitions,\n\t\tplatformProjectGrants: config.data.platformProjectGrants,\n\t\tflag: (name) => isFlagEnabled(config, name)\n\t};\n}\n/** `locals` as a store-reading guard wants it. */\nfunction scoped(locals) {\n\treturn {\n\t\t...locals,\n\t\tdeps: accessDepsFromConfig(locals.providers)\n\t};\n}\nvar orgsOf = (src) => src.deps.orgs;\nvar projectsOf = (src) => src.deps.projects;\nvar definitionMetaOf = (src) => src.deps.definitionMeta;\nvar flagOf = (src) => src.deps.flag;\nfunction requireAuthed(locals) {\n\tconst { user, ctx } = locals;\n\tif (!user || !ctx) apiError(401, ApiErrorCode.UNAUTHORIZED, \"Unauthorized\");\n\treturn {\n\t\tuser,\n\t\tctx\n\t};\n}\n/** Throws 403 — use in API routes. */\nfunction requirePermission(locals, permission) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tif (!hasPermission(ctx, permission)) apiError(403, ApiErrorCode.FORBIDDEN, `You don't have permission to do this.`);\n\treturn user;\n}\nvar requireManageInstanceUsers = (locals) => requirePermission(locals, \"manage_instance_users\");\nvar requireManageCompute = (locals) => requirePermission(locals, \"manage_compute\");\nvar requireManageOrgMembers = (locals) => requirePermission(locals, \"manage_org_members\");\nvar requireManageOrgCompute = (locals) => requirePermission(locals, \"manage_org_compute\");\nvar requireInstanceAdmin = (locals) => requirePermission(locals, \"instance_admin\");\n/**\n* Platform scope is not delegable: `manage_instance_users` runs the user-admin\n* surface but must not be able to mint an `instance_admin`, or an org admin\n* holding it self-elevates. Three routes write platform permissions — the two\n* `/api/admin/users` handlers and the invite mint route — and each carried its\n* own copy of this check.\n*\n* Pass `current` on an update. Revoking is a platform-scope change too, so a\n* PATCH that drops `instance_admin` is refused for the same reason granting it\n* is; without `current` the caller is creating (a user, an invite) and there is\n* nothing to compare against.\n*\n* Requesting nothing on a create is always allowed — that is a\n* `manage_instance_users` operation, not a platform-scope one.\n*/\nfunction assertCanGrantPlatformPermissions(ctx, requested, current) {\n\tif (!(current ? requested.length !== current.length || requested.some((p) => !current.includes(p)) || current.some((p) => !requested.includes(p)) : requested.length > 0)) return;\n\tif (hasPermission(ctx, \"instance_admin\")) return;\n\tapiError(403, ApiErrorCode.FORBIDDEN, current ? \"Only a platform admin can change platform-scope permissions\" : \"Only a platform admin can grant platform-scope permissions\");\n}\n/**\n* Tenancy gate for `/api/v1/orgs/{orgId}/…`. The URL id is never trusted alone\n* — the acting context decides which tenant a request applies to, so a\n* mismatch is 403 rather than a silent read of the caller's own org.\n*/\nfunction requireActingOrg(locals, orgId) {\n\tconst ctx = locals.ctx;\n\tif (!ctx) apiError(401, ApiErrorCode.UNAUTHORIZED, \"Unauthorized\");\n\tif (!orgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing org ID\");\n\tif (!ctx.actingOrgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"No active organization\");\n\tif (ctx.actingOrgId !== orgId) apiError(403, ApiErrorCode.FORBIDDEN, \"Acting org does not match the target org.\");\n\treturn {\n\t\tctx,\n\t\torgId\n\t};\n}\n/**\n* Gate for pages reachable by any platform-class permission holder (the\n\n/**\n* Management-scope bypass — used for org governance and project management\n* actions (Reclaim, create project, delete project, manage members, edit\n* settings). `instance_admin` bypasses these so platform staff can administer\n* the instance without being a member of every org.\n*\n* NOT used for content access (view, solve, edit definitions):\n* `instance_admin` follows the same `canView`/`canEdit` rules as any other\n* user there, keeping blast radius small and forcing content escalation\n* through Reclaim, which leaves an audit trail.\n*/\nasync function managementBypassOrRun(ctx, check) {\n\tif (hasPermission(ctx, \"instance_admin\")) return true;\n\treturn await check();\n}\nasync function contentCheck(check) {\n\treturn await check();\n}\nasync function loadProjectOr404(ctx, projectId, src) {\n\tconst project = await projectsOf(src).getProject(ctx, projectId);\n\tif (!project || outsideTokenOrg(ctx, project.orgId)) apiError(404, ApiErrorCode.NOT_FOUND, \"Project not found\");\n\treturn project;\n}\nfunction accessInputsFor(src) {\n\tconst readFlag = flagOf(src);\n\treturn createProjectAccessInputBuilder({\n\t\tgetProjectMember: (ctx, projectId, userId) => projectsOf(src).getProjectMember(ctx, projectId, userId),\n\t\tgetOrgMember: (ctx, orgId, userId) => orgsOf(src).getOrgMember(ctx, orgId, userId),\n\t\tlistPlatformGrants: (ctx, projectId) => src.deps.platformProjectGrants.listByProject(ctx, projectId),\n\t\tflags: () => ({\n\t\t\tallowCrossOrgPublic: readFlag(\"ALLOW_CROSS_ORG_PUBLIC\"),\n\t\t\tenablePlatformProjects: readFlag(\"ENABLE_PLATFORM_PROJECTS\")\n\t\t})\n\t});\n}\nfunction buildProjectAccessInput(ctx, project, src, overrides) {\n\treturn accessInputsFor(src).buildProjectAccessInput(ctx, project, overrides);\n}\n/**\n* Assemble a rule input from rows the caller already loaded.\n*\n* Unlike the other builders this one issues no reads — the caller batched them.\n* It still needs `deps` for the flag lookups, which decide whether a\n* cross-org-public or platform project is visible at all.\n*/\nfunction projectAccessInputFromRowsWith(src, ...args) {\n\treturn accessInputsFor(src).projectAccessInputFromRows(...args);\n}\n/**\n* Gates creation of a *new* definition. Container projects require project\n* owner/editor (canEdit). Commons projects (`autoJoinOnUpload=true`) accept\n* any authenticated user — the handler stamps `ownerId = user.id` so the\n* uploader becomes the owner.\n*/\nasync function requireCanCreateDefinition(locals, projectId) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tconst project = await loadProjectOr404(ctx, projectId, locals);\n\tif (!await contentCheck(async () => {\n\t\tif (project.autoJoinOnUpload) return true;\n\t\treturn canEdit(await buildProjectAccessInput(ctx, project, locals));\n\t})) apiError(403, ApiErrorCode.FORBIDDEN, \"You do not have permission to upload definitions to this project.\");\n\treturn {\n\t\tuser,\n\t\tctx,\n\t\tproject\n\t};\n}\n/**\n* Org-content gate — the caller must be a member of `orgId`. Used by the\n* file-serving proxy for org-private assets (e.g. pricing sheets under\n* `orgs/{id}/private/*`). Org membership is the only rule; runs through\n* `contentCheck` (no `instance_admin` bypass) — platform staff use Reclaim\n* if they need access without membership.\n*\n* Throws 401 unauthenticated, 403 when not a member.\n*/\nasync function requireCanViewOrg(locals, orgId) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tif (!await contentCheck(async () => {\n\t\treturn await orgsOf(locals).getOrgMember(ctx, orgId, ctx.userId) !== null;\n\t})) apiError(403, ApiErrorCode.FORBIDDEN, \"You do not have access to this organization.\");\n\treturn user;\n}\n/**\n* Project members must belong to the project's parent org. Enforced at the\n* rule layer, not as a DB constraint, to leave room for cross-org guests\n* later without a schema migration.\n*/\nasync function requireTargetIsOrgMember(locals, orgId, targetUserId) {\n\tconst { ctx } = requireAuthed(locals);\n\tif (!await orgsOf(locals).getOrgMember(ctx, orgId, targetUserId)) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"User must be a member of this organization to be added to a project.\");\n}\n/**\n* `canChangeOrgRole` with the actor's membership row loaded — whether the\n* caller may grant or revoke org `owner`/`admin` standing (§3).\n*\n* Returns rather than throws: the three callers each phrase the refusal for\n* what they were doing (\"invite someone as owner\", \"change roles\", \"remove\n* another owner\") and raise it through `apiError`. What must not diverge is the\n* decision, which is why that half lives in `rules.ts` and this loads its input.\n*/\nasync function canActorChangeOrgRole(ctx, orgId, role, src) {\n\tif (role === \"member\") return true;\n\treturn canChangeOrgRole({\n\t\tactorMember: await orgsOf(src).getOrgMember(ctx, orgId, ctx.userId),\n\t\trole\n\t});\n}\n/**\n* `canReclaim` — org owner/admin escape hatch. Returns the project so the\n* handler can use its `orgId` without re-fetching.\n*/\nasync function requireCanReclaim(locals, projectId) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tconst project = await loadProjectOr404(ctx, projectId, locals);\n\tif (project.visibility === \"platform\") apiError(403, ApiErrorCode.FORBIDDEN, \"Platform projects cannot be reclaimed.\");\n\tif (!await managementBypassOrRun(ctx, async () => {\n\t\tconst orgMember = await orgsOf(locals).getOrgMember(ctx, project.orgId, ctx.userId);\n\t\treturn canReclaim({\n\t\t\tproject,\n\t\t\torgMember,\n\t\t\tactingOrgId: ctx.actingOrgId ?? null\n\t\t});\n\t})) apiError(403, ApiErrorCode.FORBIDDEN, \"Only org owners or admins of this project’s org can reclaim it.\");\n\treturn {\n\t\tuser,\n\t\tctx,\n\t\tproject\n\t};\n}\n/**\n* `canCreateProject` — owner/admin always; member needs `manage_projects`.\n* Tenancy is enforced via `actingOrgId`.\n*/\nasync function requireCanCreateProject(locals, targetOrgId) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tif (!await managementBypassOrRun(ctx, async () => {\n\t\tconst orgMember = await orgsOf(locals).getOrgMember(ctx, targetOrgId, ctx.userId);\n\t\treturn canCreateProject({\n\t\t\torgPermissions: ctx.orgPermissions,\n\t\t\torgMember,\n\t\t\tactingOrgId: ctx.actingOrgId ?? null,\n\t\t\ttargetOrgId\n\t\t});\n\t})) apiError(403, ApiErrorCode.FORBIDDEN, \"You do not have permission to create projects in this org.\");\n\treturn {\n\t\tuser,\n\t\tctx\n\t};\n}\n/**\n* Project-management gate (`canManage` — owner, or `instance_admin` via the\n* bypass). Managing members is the same authority as managing the project, so\n* both callers share this; `action` only shapes the 403 message.\n*/\nasync function requireCanManage(locals, projectId, action = \"project\") {\n\tconst { user, ctx } = requireAuthed(locals);\n\tif (!await managementBypassOrRun(ctx, async () => {\n\t\tconst project = await loadProjectOr404(ctx, projectId, locals);\n\t\treturn canManage(await buildProjectAccessInput(ctx, project, locals));\n\t})) apiError(403, ApiErrorCode.FORBIDDEN, action === \"members\" ? \"Only project owners can manage members.\" : \"Only project owners can manage this project.\");\n\treturn user;\n}\nasync function requireCanEditProjectSettings(locals, projectId) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tconst project = await loadProjectOr404(ctx, projectId, locals);\n\tif (!await managementBypassOrRun(ctx, async () => canEditProjectSettings(await buildProjectAccessInput(ctx, project, locals)))) apiError(403, ApiErrorCode.FORBIDDEN, \"Only project owners can edit project settings.\");\n\treturn {\n\t\tuser,\n\t\tctx,\n\t\tproject\n\t};\n}\nasync function requireCanViewProject(locals, projectId) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tif (!await contentCheck(async () => {\n\t\tconst project = await loadProjectOr404(ctx, projectId, locals);\n\t\treturn canView(await buildProjectAccessInput(ctx, project, locals));\n\t})) apiError(403, ApiErrorCode.FORBIDDEN, \"You do not have access to this project.\");\n\treturn user;\n}\n/**\n* Solve gating. Today `canSolve === canView` for non-platform projects, but\n* the rule lives in its own function so future cost-gating (quotas, rate\n* limits) lands without touching view semantics. `viewer` project role\n* passes; platform projects narrow to grants with `canSolve=true`.\n*/\nasync function requireCanSolve(locals, projectId, preloadedProject) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tconst project = preloadedProject ?? await loadProjectOr404(ctx, projectId, locals);\n\tif (outsideTokenOrg(ctx, project.orgId)) apiError(404, ApiErrorCode.NOT_FOUND, \"Project not found\");\n\tif (!await contentCheck(async () => canSolve(await buildProjectAccessInput(ctx, project, locals)))) apiError(403, ApiErrorCode.FORBIDDEN, \"You do not have access to this project.\");\n\treturn {\n\t\tuser,\n\t\tctx,\n\t\tproject\n\t};\n}\n/**\n* Org membership for the commons branch of `canEditDefinition`, or `null` when\n* that branch cannot fire. Skipping the round-trip on container projects keeps\n* the common edit path at the same two reads it had before commons gained the\n* membership test.\n*/\nasync function loadCommonsOrgMember(ctx, project, src) {\n\tif (!project?.autoJoinOnUpload) return null;\n\treturn await orgsOf(src).getOrgMember(ctx, project.orgId, ctx.userId);\n}\n/**\n* Loads the record and gates editing. Returns the record AND the project it\n* loads for the gate, so callers skip a re-fetch of either.\n*/\nasync function requireEditableDefinition(locals, guid) {\n\tconst { ctx } = requireAuthed(locals);\n\tconst record = await definitionMetaOf(locals).get(ctx, guid);\n\tif (!record) apiError(404, ApiErrorCode.NOT_FOUND, \"Definition not found\");\n\tconst [project, member] = await Promise.all([projectsOf(locals).getProject(ctx, record.projectId), projectsOf(locals).getProjectMember(ctx, record.projectId, ctx.userId)]);\n\tif (project && outsideTokenOrg(ctx, project.orgId)) apiError(404, ApiErrorCode.NOT_FOUND, \"Definition not found\");\n\tif (!await contentCheck(async () => canEditDefinition({\n\t\tproject,\n\t\tdefinition: record,\n\t\tmember,\n\t\torgMember: await loadCommonsOrgMember(ctx, project, locals),\n\t\tuserId: ctx.userId,\n\t\tplatformPermissions: ctx.platformPermissions,\n\t\tenablePlatformProjects: flagOf(locals)(\"ENABLE_PLATFORM_PROJECTS\")\n\t}))) apiError(403, ApiErrorCode.FORBIDDEN, \"You do not have permission to edit this definition.\");\n\treturn {\n\t\trecord,\n\t\tctx,\n\t\tproject\n\t};\n}\nasync function requireCanEditDefinition(locals, projectId, definitionGuid, preloaded) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tif (!await contentCheck(async () => {\n\t\tconst [project, definition, member] = await Promise.all([\n\t\t\tpreloaded?.project !== void 0 ? Promise.resolve(preloaded.project) : projectsOf(locals).getProject(ctx, projectId),\n\t\t\tpreloaded?.definition !== void 0 ? Promise.resolve(preloaded.definition) : definitionMetaOf(locals).get(ctx, definitionGuid),\n\t\t\tprojectsOf(locals).getProjectMember(ctx, projectId, ctx.userId)\n\t\t]);\n\t\tif (project && outsideTokenOrg(ctx, project.orgId)) return false;\n\t\treturn canEditDefinition({\n\t\t\tproject,\n\t\t\tdefinition,\n\t\t\tmember,\n\t\t\torgMember: await loadCommonsOrgMember(ctx, project, locals),\n\t\t\tuserId: ctx.userId,\n\t\t\tplatformPermissions: ctx.platformPermissions,\n\t\t\tenablePlatformProjects: flagOf(locals)(\"ENABLE_PLATFORM_PROJECTS\")\n\t\t});\n\t})) apiError(403, ApiErrorCode.FORBIDDEN, \"You do not have permission to edit this definition.\");\n\treturn user;\n}\n//#endregion\n//#region ../server/src/access/permissions-scope.ts\nvar PLATFORM_SET = new Set(ALL_PLATFORM_PERMISSIONS);\nvar ORG_SET = new Set(ALL_ORG_PERMISSIONS);\n/** Split a flat array into platform + org scope buckets, dropping unknowns. */\nfunction splitFlatPermissions(flat) {\n\tconst platform = [];\n\tconst org = [];\n\tfor (const p of flat) if (PLATFORM_SET.has(p)) platform.push(p);\n\telse if (ORG_SET.has(p)) org.push(p);\n\treturn {\n\t\tplatform,\n\t\torg\n\t};\n}\n//#endregion\nexport { canManage as A, requirePermission as C, canChangeOrgRole as D, createProjectAccessInputBuilder as E, canView as M, checkOwnerRemoval as N, canChangeVisibilityToPublic as O, withAdminBypass as P, requireManageOrgMembers as S, scoped as T, requireEditableDefinition as _, projectAccessInputFromRowsWith as a, requireManageInstanceUsers as b, requireCanCreateDefinition as c, requireCanEditProjectSettings as d, requireCanManage as f, requireCanViewProject as g, requireCanViewOrg as h, canActorChangeOrgRole as i, canSolve as j, canEdit as k, requireCanCreateProject as l, requireCanSolve as m, accessDepsFromConfig as n, requireActingOrg as o, requireCanReclaim as p, assertCanGrantPlatformPermissions as r, requireAuthed as s, splitFlatPermissions as t, requireCanEditDefinition as u, requireInstanceAdmin as v, requireTargetIsOrgMember as w, requireManageOrgCompute as x, requireManageCompute as y };\n"],"names":[],"mappings":";;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,eAAe,CAAC,mBAAmB,EAAE;AAC9C,CAAC,OAAO,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC;AACtD;AACA,SAAS,eAAe,CAAC,mBAAmB,EAAE,IAAI,EAAE;AACpD,CAAC,IAAI,eAAe,CAAC,mBAAmB,CAAC,EAAE,OAAO,IAAI;AACtD,CAAC,OAAO,IAAI,EAAE;AACd;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,OAAO,CAAC,KAAK,EAAE;AACxB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,KAAK;AACpJ,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,KAAK;AAC3B,CAAC,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE;AACxC,EAAE,IAAI,CAAC,sBAAsB,EAAE,OAAO,KAAK;AAC3C,EAAE,IAAI,eAAe,CAAC,mBAAmB,CAAC,EAAE,OAAO,IAAI;AACvD,EAAE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,KAAK,IAAI,CAAC,CAAC,SAAS,KAAK,WAAW,CAAC;AACjJ,CAAC;AACD,CAAC,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,OAAO,MAAM,KAAK,IAAI;AAC7D,CAAC,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,EAAE,OAAO,SAAS,KAAK,IAAI;AAC5D,CAAC,IAAI,OAAO,CAAC,UAAU,KAAK,QAAQ,EAAE,OAAO,mBAAmB,GAAG,IAAI,GAAG,SAAS,KAAK,IAAI;AAC5F,CAAC,OAAO,KAAK;AACb;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,QAAQ,CAAC,KAAK,EAAE;AACzB,CAAC,MAAM,EAAE,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,KAAK;AAC5G,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,KAAK;AAC3B,CAAC,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE;AACxC,EAAE,IAAI,CAAC,sBAAsB,EAAE,OAAO,KAAK;AAC3C,EAAE,IAAI,eAAe,CAAC,mBAAmB,CAAC,EAAE,OAAO,IAAI;AACvD,EAAE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,KAAK,IAAI,CAAC,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC;AACjK,CAAC;AACD,CAAC,OAAO,OAAO,CAAC,KAAK,CAAC;AACtB;AACA;AACA;AACA;AACA;AACA,SAAS,OAAO,CAAC,KAAK,EAAE;AACxB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,GAAG,KAAK;AAC/E,CAAC,IAAI,OAAO,EAAE,UAAU,KAAK,UAAU,EAAE;AACzC,EAAE,IAAI,CAAC,sBAAsB,EAAE,OAAO,KAAK;AAC3C,EAAE,OAAO,eAAe,CAAC,mBAAmB,CAAC;AAC7C,CAAC;AACD,CAAC,OAAO,MAAM,EAAE,IAAI,KAAK,OAAO,IAAI,MAAM,EAAE,IAAI,KAAK,QAAQ;AAC7D;AACA;AACA,SAAS,SAAS,CAAC,KAAK,EAAE;AAC1B,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,UAAU,KAAK,UAAU,EAAE;AAC/C,EAAE,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,OAAO,KAAK;AACjD,EAAE,OAAO,eAAe,CAAC,KAAK,CAAC,mBAAmB,CAAC;AACnD,CAAC;AACD,CAAC,OAAO,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,OAAO;AACtC;AACA;AACA,SAAS,sBAAsB,CAAC,KAAK,EAAE;AACvC,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,UAAU,KAAK,UAAU,EAAE;AAC/C,EAAE,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,OAAO,KAAK;AACjD,EAAE,OAAO,eAAe,CAAC,KAAK,CAAC,mBAAmB,CAAC;AACnD,CAAC;AACD,CAAC,OAAO,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,OAAO;AACtC;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,2BAA2B,CAAC,KAAK,EAAE;AAC5C,CAAC,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,EAAE,IAAI;AACnC,CAAC,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO;AAC5C;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,KAAK,EAAE;AAClC,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,GAAG,KAAK;AAC9G,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,EAAE,OAAO,KAAK;AAC1C,CAAC,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE;AACxC,EAAE,IAAI,CAAC,sBAAsB,EAAE,OAAO,KAAK;AAC3C,EAAE,OAAO,eAAe,CAAC,mBAAmB,CAAC;AAC7C,CAAC;AACD,CAAC,IAAI,MAAM,EAAE,IAAI,KAAK,OAAO,IAAI,MAAM,EAAE,IAAI,KAAK,QAAQ,EAAE,OAAO,IAAI;AACvE,CAAC,IAAI,OAAO,CAAC,gBAAgB,IAAI,MAAM,KAAK,UAAU,CAAC,OAAO,IAAI,SAAS,EAAE,OAAO,IAAI;AACxF,CAAC,OAAO,KAAK;AACb;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,UAAU,CAAC,KAAK,EAAE;AAC3B,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,KAAK;AAClD,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,EAAE,OAAO,KAAK;AAC3C,CAAC,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,OAAO,KAAK;AACpD,CAAC,IAAI,WAAW,KAAK,OAAO,CAAC,KAAK,EAAE,OAAO,KAAK;AAChD,CAAC,MAAM,IAAI,GAAG,SAAS,EAAE,IAAI;AAC7B,CAAC,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO;AAC5C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,CAAC,KAAK,EAAE;AACjC,CAAC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,KAAK;AACtE,CAAC,IAAI,WAAW,KAAK,WAAW,EAAE,OAAO,KAAK;AAC9C,CAAC,MAAM,IAAI,GAAG,SAAS,EAAE,IAAI;AAC7B,CAAC,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,OAAO,IAAI;AACtD,CAAC,IAAI,IAAI,KAAK,QAAQ,IAAI,cAAc,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,IAAI;AACjF,CAAC,OAAO,KAAK;AACb;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,CAAC,KAAK,EAAE;AACjC,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,OAAO,IAAI;AACzC,CAAC,OAAO,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,OAAO;AAC3C;AACA,SAAS,iBAAiB,CAAC,KAAK,EAAE;AAClC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,OAAO,IAAI;AAC/C,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,OAAO,YAAY;AACxF,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,eAAe;AAC7C,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA,SAAS,+BAA+B,CAAC,IAAI,EAAE;AAC/C,CAAC,OAAO;AACR,EAAE,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,EAAE;AAC9D,GAAG,MAAM,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE;AACvE,GAAG,IAAI,MAAM,GAAG,IAAI;AACpB,GAAG,IAAI,SAAS,GAAG,IAAI;AACvB,GAAG,IAAI,cAAc,GAAG,EAAE;AAC1B,GAAG,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE;AAC1C,IAAI,IAAI,sBAAsB,EAAE,cAAc,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;AAC/F,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC;AACjH,QAAQ;AACR,IAAI,MAAM,aAAa,GAAG,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,mBAAmB;AAChF,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5L,GAAG;AACH,GAAG,OAAO;AACV,IAAI,cAAc,EAAE,GAAG,CAAC,cAAc;AACtC,IAAI,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;AAChD,IAAI,OAAO;AACX,IAAI,MAAM;AACV,IAAI,SAAS;AACb,IAAI,mBAAmB;AACvB,IAAI,sBAAsB;AAC1B,IAAI,cAAc;AAClB,IAAI,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;AACxC,IAAI,MAAM,EAAE,GAAG,CAAC,MAAM;AACtB,IAAI,GAAG;AACP,IAAI;AACJ,EAAE,CAAC;AACH,EAAE,0BAA0B,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;AACjD,GAAG,MAAM,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE;AACvE,GAAG,OAAO;AACV,IAAI,cAAc,EAAE,GAAG,CAAC,cAAc;AACtC,IAAI,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;AAChD,IAAI,OAAO;AACX,IAAI,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;AAC/B,IAAI,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;AACrC,IAAI,mBAAmB;AACvB,IAAI,sBAAsB;AAC1B,IAAI,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE;AAC7C,IAAI,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;AACxC,IAAI,MAAM,EAAE,GAAG,CAAC;AAChB,IAAI;AACJ,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,oBAAoB,CAAC,MAAM,EAAE;AACtC,CAAC,OAAO;AACR,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;AACxB,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;AAChC,EAAE,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;AACzC,EAAE,qBAAqB,EAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB;AAC1D,EAAE,IAAI,EAAE,CAAC,IAAI,KAAK,aAAa,CAAC,MAAM,EAAE,IAAI;AAC5C,EAAE;AACF;AACA;AACA,SAAS,MAAM,CAAC,MAAM,EAAE;AACxB,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAC,SAAS;AAC7C,EAAE;AACF;AACA,IAAI,MAAM,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI;AACnC,IAAI,UAAU,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,CAAC,QAAQ;AAC3C,IAAI,gBAAgB,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,CAAC,cAAc;AACvD,IAAI,MAAM,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI;AACnC,SAAS,aAAa,CAAC,MAAM,EAAE;AAC/B,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM;AAC7B,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC;AAC5E,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE;AACF,EAAE;AACF;AACA;AACA,SAAS,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE;AAC/C,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,qCAAqC,CAAC,CAAC;AACpH,CAAC,OAAO,IAAI;AACZ;AACG,IAAC,0BAA0B,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,uBAAuB;AAC3F,IAAC,oBAAoB,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,gBAAgB;AAC9E,IAAC,uBAAuB,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,oBAAoB;AACrF,IAAC,uBAAuB,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,oBAAoB;AACrF,IAAC,oBAAoB,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,gBAAgB;AACjF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iCAAiC,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE;AACpE,CAAC,IAAI,EAAE,OAAO,GAAG,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE;AAC5K,CAAC,IAAI,aAAa,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE;AAC3C,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,OAAO,GAAG,6DAA6D,GAAG,4DAA4D,CAAC;AAC9K;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,CAAC,MAAM,EAAE,KAAK,EAAE;AACzC,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACvB,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC;AACnE,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;AAC5E,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;AAC9F,CAAC,IAAI,GAAG,CAAC,WAAW,KAAK,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,2CAA2C,CAAC;AAClH,CAAC,OAAO;AACR,EAAE,GAAG;AACL,EAAE;AACF,EAAE;AACF;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE;AACjD,CAAC,IAAI,aAAa,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,OAAO,IAAI;AACtD,CAAC,OAAO,MAAM,KAAK,EAAE;AACrB;AACA,eAAe,YAAY,CAAC,KAAK,EAAE;AACnC,CAAC,OAAO,MAAM,KAAK,EAAE;AACrB;AACA,eAAe,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE;AACrD,CAAC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;AACjE,CAAC,IAAI,CAAC,OAAO,IAAI,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,mBAAmB,CAAC;AAChH,CAAC,OAAO,OAAO;AACf;AACA,SAAS,eAAe,CAAC,GAAG,EAAE;AAC9B,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC;AAC7B,CAAC,OAAO,+BAA+B,CAAC;AACxC,EAAE,gBAAgB,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,KAAK,UAAU,CAAC,GAAG,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC;AACxG,EAAE,YAAY,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC;AACpF,EAAE,kBAAkB,EAAE,CAAC,GAAG,EAAE,SAAS,KAAK,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC;AACtG,EAAE,KAAK,EAAE,OAAO;AAChB,GAAG,mBAAmB,EAAE,QAAQ,CAAC,wBAAwB,CAAC;AAC1D,GAAG,sBAAsB,EAAE,QAAQ,CAAC,0BAA0B;AAC9D,GAAG;AACH,EAAE,CAAC;AACH;AACA,SAAS,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE;AAC/D,CAAC,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC;AAC7E;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,8BAA8B,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE;AACtD,CAAC,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,0BAA0B,CAAC,GAAG,IAAI,CAAC;AAChE;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,0BAA0B,CAAC,MAAM,EAAE,SAAS,EAAE;AAC7D,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC;AAC/D,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,YAAY;AACrC,EAAE,IAAI,OAAO,CAAC,gBAAgB,EAAE,OAAO,IAAI;AAC3C,EAAE,OAAO,OAAO,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AACrE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,mEAAmE,CAAC;AAC/G,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE,GAAG;AACL,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,iBAAiB,CAAC,MAAM,EAAE,KAAK,EAAE;AAChD,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,YAAY;AACrC,EAAE,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI;AAC3E,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,8CAA8C,CAAC;AAC1F,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,wBAAwB,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE;AACrE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AACtC,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,sEAAsE,CAAC;AACxL;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE;AAC5D,CAAC,IAAI,IAAI,KAAK,QAAQ,EAAE,OAAO,IAAI;AACnC,CAAC,OAAO,gBAAgB,CAAC;AACzB,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC;AACrE,EAAE;AACF,EAAE,CAAC;AACH;AACA;AACA;AACA;AACA;AACA,eAAe,iBAAiB,CAAC,MAAM,EAAE,SAAS,EAAE;AACpD,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC;AAC/D,CAAC,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,wCAAwC,CAAC;AACvH,CAAC,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,YAAY;AACnD,EAAE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC;AACrF,EAAE,OAAO,UAAU,CAAC;AACpB,GAAG,OAAO;AACV,GAAG,SAAS;AACZ,GAAG,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI;AACnC,GAAG,CAAC;AACJ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,iEAAiE,CAAC;AAC7G,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE,GAAG;AACL,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA,eAAe,uBAAuB,CAAC,MAAM,EAAE,WAAW,EAAE;AAC5D,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,YAAY;AACnD,EAAE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC;AACnF,EAAE,OAAO,gBAAgB,CAAC;AAC1B,GAAG,cAAc,EAAE,GAAG,CAAC,cAAc;AACrC,GAAG,SAAS;AACZ,GAAG,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;AACvC,GAAG;AACH,GAAG,CAAC;AACJ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,4DAA4D,CAAC;AACxG,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE;AACvE,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,YAAY;AACnD,EAAE,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC;AAChE,EAAE,OAAO,SAAS,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AACvE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,MAAM,KAAK,SAAS,GAAG,yCAAyC,GAAG,8CAA8C,CAAC;AAC7J,CAAC,OAAO,IAAI;AACZ;AACA,eAAe,6BAA6B,CAAC,MAAM,EAAE,SAAS,EAAE;AAChE,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC;AAC/D,CAAC,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,YAAY,sBAAsB,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gDAAgD,CAAC;AACxN,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE,GAAG;AACL,EAAE;AACF,EAAE;AACF;AACA,eAAe,qBAAqB,CAAC,MAAM,EAAE,SAAS,EAAE;AACxD,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,YAAY;AACrC,EAAE,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC;AAChE,EAAE,OAAO,OAAO,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AACrE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,yCAAyC,CAAC;AACrF,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE;AACpE,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,MAAM,OAAO,GAAG,gBAAgB,IAAI,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC;AACnF,CAAC,IAAI,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,mBAAmB,CAAC;AACpG,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,YAAY,QAAQ,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,yCAAyC,CAAC;AACrL,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE,GAAG;AACL,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE;AACvD,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,OAAO,IAAI;AAC5C,CAAC,OAAO,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC;AACtE;AACA;AACA;AACA;AACA;AACA,eAAe,yBAAyB,CAAC,MAAM,EAAE,IAAI,EAAE;AACvD,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AACtC,CAAC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC;AAC7D,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,sBAAsB,CAAC;AAC3E,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5K,CAAC,IAAI,OAAO,IAAI,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,sBAAsB,CAAC;AAClH,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,YAAY,iBAAiB,CAAC;AACvD,EAAE,OAAO;AACT,EAAE,UAAU,EAAE,MAAM;AACpB,EAAE,MAAM;AACR,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC;AAC7D,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM;AACpB,EAAE,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;AAC9C,EAAE,sBAAsB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,0BAA0B;AACnE,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,qDAAqD,CAAC;AAClG,CAAC,OAAO;AACR,EAAE,MAAM;AACR,EAAE,GAAG;AACL,EAAE;AACF,EAAE;AACF;AACA,eAAe,wBAAwB,CAAC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE;AACtF,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,YAAY;AACrC,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AAC1D,GAAG,SAAS,EAAE,OAAO,KAAK,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;AACrH,GAAG,SAAS,EAAE,UAAU,KAAK,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC;AAC/H,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM;AACjE,GAAG,CAAC;AACJ,EAAE,IAAI,OAAO,IAAI,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK;AAClE,EAAE,OAAO,iBAAiB,CAAC;AAC3B,GAAG,OAAO;AACV,GAAG,UAAU;AACb,GAAG,MAAM;AACT,GAAG,SAAS,EAAE,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC;AAC9D,GAAG,MAAM,EAAE,GAAG,CAAC,MAAM;AACrB,GAAG,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;AAC/C,GAAG,sBAAsB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,0BAA0B;AACpE,GAAG,CAAC;AACJ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,qDAAqD,CAAC;AACjG,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA,IAAI,YAAY,GAAG,IAAI,GAAG,CAAC,wBAAwB,CAAC;AACpD,IAAI,OAAO,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC;AAC1C;AACA,SAAS,oBAAoB,CAAC,IAAI,EAAE;AACpC,CAAC,MAAM,QAAQ,GAAG,EAAE;AACpB,CAAC,MAAM,GAAG,GAAG,EAAE;AACf,CAAC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAChE,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AACrC,CAAC,OAAO;AACR,EAAE,QAAQ;AACV,EAAE;AACF,EAAE;AACF;;;;"}