@selvajs/selva 4.20.0-beta.3 → 4.20.0-beta.5

package/build/server/chunks/chunks/api.js-BuuiOavj.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js-BuuiOavj.js","sources":["../../../../.svelte-kit/output/server/chunks/api.js"],"sourcesContent":["import { L as PlatformPermissionSchema, M as OrgRoleSchema, S as ApiScopeStringSchema, T as ALL_ORG_PERMISSIONS, b as ProviderError, h as ProjectVisibilitySchema, j as OrgPermissionSchema, m as ProjectRoleSchema, v as outsideTokenOrg, x as API_TOKEN_LIFETIME_DAYS, y as scopeAllows } from \"./src.js\";\nimport { a as ComputeServerUnconfiguredError, c as readPositiveInt, d as ApiErrorCode, f as apiError, g as isFlagEnabled, h as toErrorBody, m as isApiError, p as codeForStatus, s as readNonNegativeInt, t as SchemaExtractionError, u as ApiError, v as NoopEventSink } from \"./schema-extraction.js\";\nimport { t as createComputeRateLimiter } from \"./rate-limit.js\";\nimport { z } from \"zod\";\n//#region ../server/src/api/deps.ts\n/**\n* Everything an API handler talks to, as one injected value.\n*\n* Handlers used to reach module-global getters (`getProjectProvider()`,\n* `getDefinitionService()`, …) from the Selva app's composition root — 77 call\n* sites across the v1 routes. That welded them to one app's boot: a second app\n* on a different provider set could not call them at all.\n*\n* Most fields are sub-stores of `IDataProvider`, so a host that already built a\n* `SelvaConfig` gets them via `depsFromConfig`. `services` stays host-defined:\n* `DefinitionService` and friends are composed rather than resolved, and a host\n* may supply its own.\n*/\n/**\n* Build deps from a resolved `SelvaConfig`, plus whatever services and token\n* codecs the host composed on top. The hoisted fields are aliases into `data`,\n* not copies.\n*\n* `services` stays positional — every existing caller passes it there — and\n* `tokens` arrives in an options object rather than as a third positional, so\n* the two composed bags cannot be swapped at a call site.\n*/\nfunction depsFromConfig(config, services = {}, { tokens = {}, uploadLimits, evictComputeClient = () => {}, notifications, instanceName = \"Selva\", apiTokenSettingsPath = \"/settings/tokens\", apiRateLimiter, idempotency } = {}) {\n\tconst { data } = config;\n\treturn {\n\t\tauth: config.auth,\n\t\tstorage: config.storage,\n\t\tdata,\n\t\torgs: data.orgs,\n\t\tprojects: data.projects,\n\t\tdefinitionMeta: data.definitions,\n\t\tcomputeServer: data.computeServer,\n\t\tuserProfile: data.userProfile,\n\t\tshareLinks: data.shareLinks,\n\t\tinvites: data.invites,\n\t\tpermissions: data.permissions,\n\t\tplatformProjectGrants: data.platformProjectGrants,\n\t\tevents: config.events ?? new NoopEventSink(),\n\t\tflag: (name) => isFlagEnabled(config, name),\n\t\ttokens,\n\t\tuploadLimits: {\n\t\t\tmaxDefinitionFileSize: uploadLimits?.maxDefinitionFileSize ?? 52428800,\n\t\t\tmaxImageFileSize: uploadLimits?.maxImageFileSize ?? 10485760\n\t\t},\n\t\tevictComputeClient,\n\t\tnotifications,\n\t\tinstanceName,\n\t\tapiTokenSettingsPath,\n\t\tapiRateLimiter,\n\t\tidempotency,\n\t\tservices\n\t};\n}\n//#endregion\n//#region ../server/src/api/scope.ts\n/** The default action for a method: reads are `read`, everything else `write`. */\nfunction actionForMethod(method) {\n\treturn method === \"GET\" || method === \"HEAD\" ? \"read\" : \"write\";\n}\n/**\n* Refuse an API-token request its scopes don't cover, with 403 naming the\n* scope that would have passed. Browser sessions always pass.\n*\n* `runHandler` calls this for every mounted route. A route that builds its own\n* `Response` must call it itself.\n*/\nfunction assertScope(ctx, action, target) {\n\tif (!ctx?.apiScope || scopeAllows(ctx, action, target)) return;\n\trecordRefusal(ctx.apiScope.tokenId);\n\tapiError(403, ApiErrorCode.FORBIDDEN, `This API token doesn't allow ${action} here.`, void 0, { requiredScope: requiredScope(ctx, action, target) });\n}\nvar refusals = /* @__PURE__ */ new Map();\nvar utcDay = () => (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);\nfunction recordRefusal(tokenId) {\n\tconst day = utcDay();\n\tconst entry = refusals.get(tokenId);\n\tif (entry?.day === day) entry.count++;\n\telse refusals.set(tokenId, {\n\t\tday,\n\t\tcount: 1\n\t});\n}\n/** Scope refusals for `tokenId` since midnight UTC, in this process. */\nfunction scopeRefusalsToday(tokenId) {\n\tconst entry = refusals.get(tokenId);\n\treturn entry?.day === utcDay() ? entry.count : 0;\n}\nfunction requiredScope(ctx, action, target) {\n\tif (target?.projectId) return `${action}:project:${target.projectId}`;\n\tif (target?.definitionId) return `${action}:definition:${target.definitionId}`;\n\treturn `${action}:org:${ctx.actingOrgId}`;\n}\n/** Scope target for routes addressed by a project id param. */\nfunction projectScopeTarget(param = \"id\") {\n\treturn (req) => ({ projectId: req.params[param] });\n}\n/**\n* Scope target for routes addressed by a definition guid param. Loads the\n* record so a project-scoped key reaches the definitions inside its project.\n*\n* A definition outside the key's org resolves like a missing one: otherwise the\n* 403 detail would confirm the guid exists and name its project.\n*/\nfunction definitionScopeTarget(param = \"guid\") {\n\treturn async (req) => {\n\t\tconst definitionId = req.params[param];\n\t\tif (!definitionId || !req.ctx) return { definitionId };\n\t\tconst record = await req.deps.definitionMeta.get(req.ctx, definitionId);\n\t\tconst project = record ? await req.deps.projects.getProject(req.ctx, record.projectId) : null;\n\t\tif (!project || outsideTokenOrg(req.ctx, project.orgId)) return { definitionId };\n\t\treturn {\n\t\t\tdefinitionId,\n\t\t\tprojectId: project.id\n\t\t};\n\t};\n}\n//#endregion\n//#region ../server/src/api/rate-limit.ts\nvar DEFAULT_API_RATE_LIMIT = Object.freeze({\n\twindowMs: 6e4,\n\tmaxPerWindow: 600\n});\n/**\n* Read `API_TOKEN_RATE_LIMIT_MAX` (requests per window, `0` = off) and\n* `API_TOKEN_RATE_LIMIT_WINDOW_MS` from an injected env map.\n*/\nfunction resolveApiRateLimitConfig(env, logger) {\n\treturn {\n\t\twindowMs: readPositiveInt(env, \"API_TOKEN_RATE_LIMIT_WINDOW_MS\", DEFAULT_API_RATE_LIMIT.windowMs, logger),\n\t\tmaxPerWindow: readNonNegativeInt(env, \"API_TOKEN_RATE_LIMIT_MAX\", DEFAULT_API_RATE_LIMIT.maxPerWindow, logger)\n\t};\n}\n/** Process-local fixed-window limiter. Returns `null` when `maxPerWindow` is 0. */\nfunction createApiRateLimiter(config = DEFAULT_API_RATE_LIMIT) {\n\tif (config.maxPerWindow <= 0) return null;\n\tconst inner = createComputeRateLimiter(config);\n\tconst limit = config.maxPerWindow;\n\treturn { hit(key) {\n\t\tconst result = inner.check(key);\n\t\treturn {\n\t\t\tallowed: result.allowed,\n\t\t\tlimit,\n\t\t\tremaining: Math.max(0, limit - inner.count(key)),\n\t\t\tretryAfter: result.retryAfter\n\t\t};\n\t} };\n}\nvar sharedDefault$1;\n/**\n* The limiter `depsFromConfig` wires when the host passes none. One per\n* process: deps are rebuilt per request, and a limiter per request counts\n* nothing.\n*/\nfunction defaultApiRateLimiter() {\n\tif (sharedDefault$1 === void 0) sharedDefault$1 = createApiRateLimiter();\n\treturn sharedDefault$1;\n}\n/**\n* Charge one request to the caller's token. `undefined` for a session caller\n* or when no limiter is wired.\n*/\nasync function chargeApiRateLimit(ctx, limiter) {\n\tif (!ctx?.apiScope || !limiter) return void 0;\n\treturn limiter.hit(`token:${ctx.apiScope.tokenId}`);\n}\nfunction rateLimitHeaders(verdict) {\n\tconst headers = {\n\t\t\"RateLimit-Limit\": String(verdict.limit),\n\t\t\"RateLimit-Remaining\": String(verdict.remaining)\n\t};\n\tif (!verdict.allowed) headers[\"Retry-After\"] = String(verdict.retryAfter ?? 1);\n\treturn headers;\n}\n/** The 429 envelope, with `Retry-After` and the `RateLimit-*` headers. */\nfunction rateLimitedResponse(verdict, message = `Too many requests for this API token. Retry in ${verdict.retryAfter ?? 1}s.`) {\n\tconst retryAfter = String(verdict.retryAfter ?? 1);\n\tconst err = new ApiError(429, ApiErrorCode.RATE_LIMITED, message, void 0, { retryAfter });\n\treturn new Response(JSON.stringify(toErrorBody(err)), {\n\t\tstatus: 429,\n\t\theaders: {\n\t\t\t\"content-type\": \"application/json\",\n\t\t\t...rateLimitHeaders(verdict)\n\t\t}\n\t});\n}\n/** Stamp the `RateLimit-*` headers onto a response. No-op without a verdict. */\nfunction withRateLimitHeaders(res, verdict) {\n\tif (!verdict) return res;\n\tconst headers = rateLimitHeaders(verdict);\n\ttry {\n\t\tfor (const [k, v] of Object.entries(headers)) res.headers.set(k, v);\n\t\treturn res;\n\t} catch {\n\t\tconst copy = new Headers(res.headers);\n\t\tfor (const [k, v] of Object.entries(headers)) copy.set(k, v);\n\t\treturn new Response(res.body, {\n\t\t\tstatus: res.status,\n\t\t\tstatusText: res.statusText,\n\t\t\theaders: copy\n\t\t});\n\t}\n}\n/**\n* `T` is whatever the caller replays. It must not be a `Response` — a body can\n* only be read once, so the solve route stores a serialized snapshot instead.\n*/\nfunction createIdempotencyStore(config) {\n\tconst ttlMs = Math.max(0, Math.floor(config.ttlMs));\n\tconst maxKeys = Math.max(1, Math.floor(config.maxKeys ?? 1e4));\n\tconst sweepIntervalMs = Math.max(0, Math.floor(config.sweepIntervalMs ?? ttlMs));\n\tconst resolvedConfig = Object.freeze({\n\t\t...config,\n\t\tttlMs,\n\t\tmaxKeys,\n\t\tsweepIntervalMs\n\t});\n\tconst entries = /* @__PURE__ */ new Map();\n\tlet nextSweepAt = Number.POSITIVE_INFINITY;\n\tfunction maybeSweep(now, headroom = 0) {\n\t\tconst budget = Math.max(0, maxKeys - headroom);\n\t\tif (!(sweepIntervalMs > 0 && now >= nextSweepAt) && entries.size <= budget) return;\n\t\tfor (const [key, entry] of entries) if (entry.expiresAt !== null && now > entry.expiresAt) entries.delete(key);\n\t\tif (sweepIntervalMs > 0) nextSweepAt = now + sweepIntervalMs;\n\t\tif (entries.size > budget) {\n\t\t\tconst byExpiryAsc = [...entries.entries()].sort((a, b) => (a[1].expiresAt ?? Infinity) - (b[1].expiresAt ?? Infinity));\n\t\t\tfor (let i = 0; i < byExpiryAsc.length - budget; i++) entries.delete(byExpiryAsc[i][0]);\n\t\t}\n\t}\n\treturn {\n\t\tconfig: resolvedConfig,\n\t\tasync run(key, fn) {\n\t\t\tconst now = Date.now();\n\t\t\tconst existing = entries.get(key);\n\t\t\tif (existing && (existing.expiresAt === null || now <= existing.expiresAt)) return {\n\t\t\t\tvalue: await existing.promise,\n\t\t\t\treplayed: true\n\t\t\t};\n\t\t\tmaybeSweep(now, entries.has(key) ? 0 : 1);\n\t\t\tconst promise = fn();\n\t\t\tconst entry = {\n\t\t\t\tpromise,\n\t\t\t\texpiresAt: null\n\t\t\t};\n\t\t\tentries.set(key, entry);\n\t\t\tif (sweepIntervalMs > 0 && nextSweepAt === Number.POSITIVE_INFINITY) nextSweepAt = now + sweepIntervalMs;\n\t\t\ttry {\n\t\t\t\tconst value = await promise;\n\t\t\t\tentry.expiresAt = Date.now() + ttlMs;\n\t\t\t\treturn {\n\t\t\t\t\tvalue,\n\t\t\t\t\treplayed: false\n\t\t\t\t};\n\t\t\t} catch (err) {\n\t\t\t\tif (entries.get(key) === entry) entries.delete(key);\n\t\t\t\tthrow err;\n\t\t\t}\n\t\t},\n\t\treset() {\n\t\t\tentries.clear();\n\t\t\tnextSweepAt = Number.POSITIVE_INFINITY;\n\t\t},\n\t\tsize() {\n\t\t\treturn entries.size;\n\t\t}\n\t};\n}\n//#endregion\n//#region ../server/src/api/idempotency-http.ts\n/**\n* The HTTP layer over {@link createIdempotencyStore}: how a replayed response\n* is keyed, snapshotted, and identified on the wire.\n*\n* The store itself is generic over `T` and knows nothing about requests. This\n* is the part two hosts must agree on to implement the same `Idempotency-Key`\n* contract, and the part each would otherwise reinvent:\n*\n*   - **The key namespaces by caller.** `Idempotency-Key` is client-chosen, so\n*     two tenants can pick the same string. Without the caller in the key one\n*     would replay the other's result — that is the whole security property\n*     here, and a host that got it wrong would leak across tenants with\n*     nothing failing at build time.\n*   - **The response round-trips through a snapshot.** A `Response` body reads\n*     exactly once, so storing the object itself replays an empty body.\n*   - **A replay says so**, via `Idempotency-Replayed`. A client that cannot\n*     tell a replay from a fresh run cannot tell a successful retry from a\n*     second execution.\n*\n* How long a response stays replayable is *not* here: that trades a client's\n* retry window against serving a stale result after the underlying resource\n* moves, and only the host knows its own deadlines.\n*/\n/** Header stamped on a replayed response, so a client can distinguish one. */\nvar IDEMPOTENCY_REPLAYED_HEADER = \"Idempotency-Replayed\";\n/**\n* Namespace a client-chosen key by its caller.\n*\n* `callerId` should be the narrowest identity available — a token id rather\n* than a user id where the host issues per-token credentials, so two tokens\n* held by one user do not share replays.\n*/\nfunction idempotencyKey(callerId, clientKey) {\n\treturn `${callerId} ${clientKey}`;\n}\n/** Flatten a response so it can be replayed. Consumes the body. */\nasync function toStoredResponse(res) {\n\treturn {\n\t\tstatus: res.status,\n\t\theaders: [...res.headers.entries()],\n\t\tbody: await res.arrayBuffer()\n\t};\n}\n/** Rebuild a live `Response` from a snapshot, marking it when it is a replay. */\nfunction fromStoredResponse(stored, replayed) {\n\tconst headers = new Headers(stored.headers);\n\tif (replayed) headers.set(IDEMPOTENCY_REPLAYED_HEADER, \"true\");\n\treturn new Response(stored.body, {\n\t\tstatus: stored.status,\n\t\theaders\n\t});\n}\n//#endregion\n//#region ../server/src/api/idempotency.ts\nvar IDEMPOTENCY_KEY_HEADER = \"Idempotency-Key\";\n/** Covers a client's retry-on-timeout window without turning into a result cache. */\nvar DEFAULT_API_IDEMPOTENCY_TTL_MS = 3e5;\nfunction createApiIdempotencyStore(ttlMs = DEFAULT_API_IDEMPOTENCY_TTL_MS) {\n\treturn createIdempotencyStore({ ttlMs });\n}\nvar sharedDefault;\n/** The store `depsFromConfig` wires when the host passes none. One per process. */\nfunction defaultApiIdempotencyStore() {\n\treturn sharedDefault ??= createApiIdempotencyStore();\n}\n/**\n* The narrowest identity a key is namespaced by: the token for a token\n* request, so two keys of one user never share replays, else the user.\n*/\nfunction idempotencyCallerId(ctx) {\n\treturn ctx.apiScope ? `token:${ctx.apiScope.tokenId}` : `user:${ctx.userId}`;\n}\n/** Read and validate the client's key. `null` when the header is absent. */\nfunction readIdempotencyKey(request) {\n\tconst key = request.headers.get(IDEMPOTENCY_KEY_HEADER);\n\tif (key === null) return null;\n\tif (key.length === 0 || key.length > 255) apiError(400, ApiErrorCode.VALIDATION_FAILED, `${IDEMPOTENCY_KEY_HEADER} must be 1 to 255 characters.`);\n\treturn key;\n}\nasync function sha256Hex(bytes) {\n\tconst digest = await crypto.subtle.digest(\"SHA-256\", bytes);\n\treturn Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n/** SHA-256 over method, path with query, and body, hex. */\nasync function requestFingerprint(method, url, body) {\n\tconst head = new TextEncoder().encode(`${method.toUpperCase()} ${url.pathname}${url.search}\\n`);\n\tconst tail = typeof body === \"string\" ? new TextEncoder().encode(body) : new Uint8Array(body);\n\tconst bytes = new Uint8Array(head.length + tail.length);\n\tbytes.set(head);\n\tbytes.set(tail, head.length);\n\treturn sha256Hex(bytes);\n}\n/**\n* The body `requestFingerprint` should hash, read from a clone so the handler\n* can still consume the original.\n*\n* Multipart is canonicalized to its fields and file contents: clients pick a\n* fresh random boundary per request, so the raw bytes of an identical retry\n* never match.\n*/\nasync function fingerprintBody(request) {\n\tif (!(request.headers.get(\"content-type\") ?? \"\").toLowerCase().startsWith(\"multipart/form-data\")) return request.clone().arrayBuffer();\n\tlet form;\n\ttry {\n\t\tform = await request.clone().formData();\n\t} catch {\n\t\treturn request.clone().arrayBuffer();\n\t}\n\tconst parts = [];\n\tfor (const [name, value] of form) parts.push([name, typeof value === \"string\" ? value : {\n\t\tfile: value.name,\n\t\ttype: value.type,\n\t\tsha256: await sha256Hex(await value.arrayBuffer())\n\t}]);\n\treturn JSON.stringify(parts);\n}\nvar NotReplayable = class {\n\tfingerprint;\n\tresponse;\n\tconstructor(fingerprint, response) {\n\t\tthis.fingerprint = fingerprint;\n\t\tthis.response = response;\n\t}\n};\nfunction assertSameRequest(stored, fingerprint) {\n\tif (stored !== fingerprint) apiError(422, ApiErrorCode.UNPROCESSABLE, `This ${IDEMPOTENCY_KEY_HEADER} was already used for a different request.`);\n}\n/**\n* Run `fn` once per `(callerId, clientKey)`, replaying its response to repeats\n* with `Idempotency-Replayed: true`. Throws 422 when the key was used for a\n* different request. Errors `fn` throws propagate and free the key.\n*/\nasync function runIdempotent({ store, callerId, clientKey, fingerprint }, fn) {\n\tlet outcome;\n\ttry {\n\t\toutcome = await store.run(idempotencyKey(callerId, clientKey), async () => {\n\t\t\tconst res = await fn();\n\t\t\tconst response = await toStoredResponse(res);\n\t\t\tif (res.status >= 400) throw new NotReplayable(fingerprint, response);\n\t\t\treturn {\n\t\t\t\tfingerprint,\n\t\t\t\tresponse\n\t\t\t};\n\t\t});\n\t} catch (err) {\n\t\tif (!(err instanceof NotReplayable)) throw err;\n\t\tassertSameRequest(err.fingerprint, fingerprint);\n\t\treturn fromStoredResponse(err.response, false);\n\t}\n\tassertSameRequest(outcome.value.fingerprint, fingerprint);\n\treturn fromStoredResponse(outcome.value.response, outcome.replayed);\n}\n//#endregion\n//#region ../server/src/api/respond.ts\n/**\n* Turn a handler result — or a thrown `ApiError` — into a web-standard\n* `Response`.\n*\n* This is the whole serialization boundary. A host framework that speaks\n* `Request`/`Response` (SvelteKit, Next route handlers, Hono, Remix) needs only\n* to build an `ApiRequest` and call `runHandler`; one that does not can reuse\n* `toErrorBody` and serialize itself.\n*/\nfunction toResponse(result) {\n\tif (result instanceof Response) return result;\n\tconst { status, body, headers } = result;\n\tif (body === void 0) return new Response(null, {\n\t\tstatus: status ?? 204,\n\t\theaders\n\t});\n\treturn new Response(JSON.stringify(body), {\n\t\tstatus: status ?? 200,\n\t\theaders: {\n\t\t\t\"content-type\": \"application/json\",\n\t\t\t...headers\n\t\t}\n\t});\n}\n/** Run a handler and serialize whatever comes out, including failures. */\nasync function runHandler(handler, req, { fallback, mapError, action, scopeTarget, idempotent }) {\n\tconst fail = (err) => {\n\t\tif (isApiError(err)) return toResponse({\n\t\t\tstatus: err.status,\n\t\t\tbody: toErrorBody(err)\n\t\t});\n\t\tconst mapped = mapError?.(err);\n\t\tif (mapped) return toResponse({\n\t\t\tstatus: mapped.status,\n\t\t\tbody: toErrorBody(mapped)\n\t\t});\n\t\treq.log.error(`[API] ${fallback}`, {\n\t\t\tcomponent: \"api\",\n\t\t\terr: err instanceof Error ? err.stack ?? err.message : String(err)\n\t\t});\n\t\treturn toResponse({\n\t\t\tstatus: 500,\n\t\t\tbody: {\n\t\t\t\tmessage: fallback,\n\t\t\t\tcode: ApiErrorCode.INTERNAL\n\t\t\t}\n\t\t});\n\t};\n\tlet verdict;\n\ttry {\n\t\tconst limiter = req.deps.apiRateLimiter === void 0 ? defaultApiRateLimiter() : req.deps.apiRateLimiter;\n\t\tverdict = await chargeApiRateLimit(req.ctx, limiter);\n\t\tif (verdict && !verdict.allowed) return rateLimitedResponse(verdict);\n\t} catch (err) {\n\t\treturn fail(err);\n\t}\n\tlet res;\n\ttry {\n\t\tif (req.ctx?.apiScope) assertScope(req.ctx, action ?? actionForMethod(req.request.method), scopeTarget ? await scopeTarget(req) : void 0);\n\t\tconst run = async () => {\n\t\t\ttry {\n\t\t\t\treturn toResponse(await handler(req));\n\t\t\t} catch (err) {\n\t\t\t\treturn fail(err);\n\t\t\t}\n\t\t};\n\t\tconst clientKey = idempotent && req.ctx ? readIdempotencyKey(req.request) : null;\n\t\tif (clientKey && req.ctx) {\n\t\t\tconst fingerprint = await requestFingerprint(req.request.method, req.url, await fingerprintBody(req.request));\n\t\t\tres = await runIdempotent({\n\t\t\t\tstore: req.deps.idempotency ?? defaultApiIdempotencyStore(),\n\t\t\t\tcallerId: idempotencyCallerId(req.ctx),\n\t\t\t\tclientKey,\n\t\t\t\tfingerprint\n\t\t\t}, run);\n\t\t} else res = await run();\n\t} catch (err) {\n\t\tres = fail(err);\n\t}\n\treturn withRateLimitHeaders(res, verdict);\n}\n//#endregion\n//#region ../server/src/api/map-core-error.ts\n/**\n* The domain errors this package's own handlers raise, folded into the envelope.\n*\n* A host's `mapError` should call this first and add only its own error types.\n* These rules cannot live solely in a host: the handler that throws them ships\n* from here, so a host that forgot one would serve 500 where every other host\n* serves 503 — the same API answering differently depending on who mounted it.\n*\n* Postgres surfaces a unique-constraint name verbatim, which is useless to an\n* end user, so the constraints this package's handlers can trip are translated\n* here rather than left to each host.\n*/\nvar UNIQUE_CONSTRAINT_MESSAGES = {\n\tprojects_org_name_unique: \"A project with that name already exists in this organization.\",\n\tprojects_org_id_slug_key: \"A project with that name already exists in this organization.\",\n\torgs_slug_key: \"An organization with that slug already exists.\",\n\tdefinitions_pkey: \"A definition with that ID already exists.\"\n};\nfunction friendlyConstraintMessage(raw) {\n\tfor (const [name, msg] of Object.entries(UNIQUE_CONSTRAINT_MESSAGES)) if (raw.includes(name)) return msg;\n\treturn null;\n}\n/**\n* Compute unreachable or serving an unreadable schema is operator-side (503); a\n* schema the parser cannot read is the caller's file (422).\n*/\nfunction mapCoreError(err) {\n\tif (err instanceof SchemaExtractionError) return err.kind === \"unreachable\" || err.kind === \"malformed\" ? new ApiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, err.message) : new ApiError(422, ApiErrorCode.UNPROCESSABLE, err.message);\n\tif (err instanceof ComputeServerUnconfiguredError) return new ApiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, err.message);\n\tif (err instanceof ProviderError) {\n\t\tconst friendly = friendlyConstraintMessage(err.message);\n\t\treturn new ApiError(err.statusCode, codeForStatus(err.statusCode), friendly ?? err.message);\n\t}\n}\n//#endregion\n//#region ../server/src/api/openapi.ts\n/**\n* Builds an OpenAPI 3.1 document for a host's `/api/v1` from its route registry.\n*\n* Shared so every host publishes the same shape: `@selvajs/mcp` reads\n* `operationId`, `x-scope`, `x-internal` and the `Idempotency-Key` parameter\n* from it, and nothing else.\n*\n* Request schemas come from `z.toJSONSchema` over the actual validators, so a\n* renamed body field changes the spec on the next generate. Response schemas\n* are not derived: handlers build payloads from store records with no Zod\n* validator on the way out. They're described structurally (pagination\n* envelope, error envelope) and resource bodies stay open; `returns` adds prose.\n*/\nvar DEFAULT_ERROR_DESCRIPTIONS = {\n\t400: \"Validation failed.\",\n\t401: \"Missing or invalid credentials.\",\n\t403: \"Authenticated, but not permitted to perform this action. For an API token, `details.requiredScope` names the scope that would have passed.\",\n\t404: \"No such resource, or the caller cannot see it.\",\n\t409: \"The request conflicts with the current state.\",\n\t422: \"Well-formed but not processable.\",\n\t429: \"Rate limited. Retry after the interval in `Retry-After`.\",\n\t500: \"Unexpected server error.\",\n\t503: \"A dependency is unconfigured or unreachable. Retry later.\"\n};\nvar DEFAULT_IDEMPOTENCY_KEY_DESCRIPTION = \"A client-chosen key, 1 to 255 characters. Repeating the request with the same key within the retention window replays the first successful response instead of running it again; the replay carries `Idempotency-Replayed: true`. Keys are scoped to the calling token (or user, for a browser session). Reusing a key with a different method, path or body returns `422`. A failed attempt is not kept, so a corrected retry runs. The store is per-process and in-memory: it absorbs retries, does not survive a restart, and is not shared between app instances.\";\nfunction requestBodySchema(schema) {\n\tconst json = z.toJSONSchema(schema, {\n\t\tio: \"input\",\n\t\ttarget: \"draft-2020-12\"\n\t});\n\tdelete json.$schema;\n\treturn json;\n}\nfunction multipartSchema(fields) {\n\tconst properties = {};\n\tconst required = [];\n\tfor (const f of fields) {\n\t\tproperties[f.field] = {\n\t\t\ttype: \"string\",\n\t\t\tdescription: f.description\n\t\t};\n\t\tif (f.required) required.push(f.field);\n\t}\n\treturn required.length ? {\n\t\ttype: \"object\",\n\t\tproperties,\n\t\trequired\n\t} : {\n\t\ttype: \"object\",\n\t\tproperties\n\t};\n}\nfunction responseFor(ep) {\n\tif (ep.response === \"empty\") return { \"204\": { description: ep.returns ?? \"Success. No content.\" } };\n\tconst status = String(ep.status ?? 200);\n\tif (ep.response === \"collection\") return { [status]: {\n\t\tdescription: ep.returns ?? \"A page of results.\",\n\t\tcontent: { \"application/json\": { schema: { $ref: \"#/components/schemas/Page\" } } }\n\t} };\n\tif (ep.response === \"binary\") return { [status]: {\n\t\tdescription: ep.returns ?? \"Binary payload.\",\n\t\tcontent: { [ep.contentType ?? \"application/octet-stream\"]: { schema: {\n\t\t\ttype: \"string\",\n\t\t\tformat: \"binary\"\n\t\t} } }\n\t} };\n\treturn { [status]: {\n\t\tdescription: ep.returns ?? \"Success.\",\n\t\tcontent: { \"application/json\": { schema: { type: \"object\" } } }\n\t} };\n}\nfunction parametersFor(ep) {\n\tconst params = [];\n\tfor (const name of ep.path.matchAll(/\\{(\\w+)\\}/g)) params.push({\n\t\tname: name[1],\n\t\tin: \"path\",\n\t\trequired: true,\n\t\tschema: { type: \"string\" }\n\t});\n\tif (ep.response === \"collection\") params.push({ $ref: \"#/components/parameters/limit\" }, { $ref: \"#/components/parameters/cursor\" }, { $ref: \"#/components/parameters/orderBy\" }, { $ref: \"#/components/parameters/orderDir\" });\n\tfor (const q of ep.query ?? []) params.push({\n\t\tname: q.name,\n\t\tin: \"query\",\n\t\trequired: false,\n\t\tdescription: q.description,\n\t\tschema: { type: \"string\" }\n\t});\n\tif (ep.idempotent) params.push({ $ref: \"#/components/parameters/idempotencyKey\" });\n\treturn params;\n}\nfunction operationFor(ep, errorDescriptions, alwaysErrors) {\n\tconst op = {\n\t\tsummary: ep.summary,\n\t\toperationId: operationId(ep),\n\t\ttags: [tagFor(ep.path)],\n\t\t\"x-scope\": ep.scope\n\t};\n\tif (ep.internal) op[\"x-internal\"] = true;\n\tconst params = parametersFor(ep);\n\tif (params.length) op.parameters = params;\n\tif (ep.requestBody) op.requestBody = {\n\t\trequired: true,\n\t\tcontent: { \"application/json\": { schema: requestBodySchema(ep.requestBody) } }\n\t};\n\telse if (ep.multipart) op.requestBody = {\n\t\trequired: true,\n\t\tcontent: { \"multipart/form-data\": { schema: multipartSchema(ep.multipart) } }\n\t};\n\tconst responses = responseFor(ep);\n\tconst statuses = /* @__PURE__ */ new Set([...ep.errors ?? [], ...alwaysErrors]);\n\tif (ep.idempotent) statuses.add(422);\n\tfor (const status of [...statuses].sort((a, b) => a - b)) responses[String(status)] = {\n\t\tdescription: errorDescriptions[status] ?? \"Error.\",\n\t\tcontent: { \"application/json\": { schema: { $ref: \"#/components/schemas/Error\" } } }\n\t};\n\top.responses = responses;\n\treturn op;\n}\nvar cap = (s) => s.charAt(0).toUpperCase() + s.slice(1);\nvar stem = (s) => s.replace(/\\..*$/, \"\");\nfunction tagFor(path) {\n\treturn cap(stem(path.split(\"/\")[1] ?? \"root\"));\n}\n/** `PATCH /jobs/{id}` → `patchJobsById`. Public contract: clients and MCP tools call by it. */\nfunction operationId(ep) {\n\tconst segments = ep.path.split(\"/\").filter(Boolean).map((s) => s.startsWith(\"{\") ? `By${cap(s.slice(1, -1))}` : cap(stem(s)));\n\treturn ep.method.toLowerCase() + segments.join(\"\");\n}\nfunction buildOpenApiDocument(endpoints, options) {\n\tconst errorDescriptions = {\n\t\t...DEFAULT_ERROR_DESCRIPTIONS,\n\t\t...options.errorDescriptions\n\t};\n\tconst alwaysErrors = options.alwaysErrors ?? [\n\t\t401,\n\t\t403,\n\t\t429,\n\t\t500\n\t];\n\tconst paths = {};\n\tfor (const ep of endpoints) {\n\t\tconst path = `${options.basePath}${ep.path}`;\n\t\t(paths[path] ??= {})[ep.method.toLowerCase()] = operationFor(ep, errorDescriptions, alwaysErrors);\n\t}\n\tconst paginated = endpoints.some((ep) => ep.response === \"collection\");\n\tconst parameters = {};\n\tif (paginated) {\n\t\tparameters.limit = {\n\t\t\tname: \"limit\",\n\t\t\tin: \"query\",\n\t\t\trequired: false,\n\t\t\tdescription: `Page size. Out-of-range values clamp rather than fail, so a client walking a cursor is never stopped by pagination plumbing. Default 50.`,\n\t\t\tschema: {\n\t\t\t\ttype: \"integer\",\n\t\t\t\tminimum: 1,\n\t\t\t\tmaximum: 200\n\t\t\t}\n\t\t};\n\t\tparameters.cursor = {\n\t\t\tname: \"cursor\",\n\t\t\tin: \"query\",\n\t\t\trequired: false,\n\t\t\tdescription: \"An opaque cursor from a previous response's `nextCursor`. Do not construct or parse one.\",\n\t\t\tschema: { type: \"string\" }\n\t\t};\n\t\tparameters.orderBy = {\n\t\t\tname: \"orderBy\",\n\t\t\tin: \"query\",\n\t\t\trequired: false,\n\t\t\tschema: {\n\t\t\t\ttype: \"string\",\n\t\t\t\tenum: [\n\t\t\t\t\t\"createdAt\",\n\t\t\t\t\t\"updatedAt\",\n\t\t\t\t\t\"name\"\n\t\t\t\t]\n\t\t\t}\n\t\t};\n\t\tparameters.orderDir = {\n\t\t\tname: \"orderDir\",\n\t\t\tin: \"query\",\n\t\t\trequired: false,\n\t\t\tschema: {\n\t\t\t\ttype: \"string\",\n\t\t\t\tenum: [\"asc\", \"desc\"]\n\t\t\t}\n\t\t};\n\t}\n\tif (endpoints.some((ep) => ep.idempotent)) parameters.idempotencyKey = {\n\t\tname: \"Idempotency-Key\",\n\t\tin: \"header\",\n\t\trequired: false,\n\t\tdescription: options.idempotencyKeyDescription ?? DEFAULT_IDEMPOTENCY_KEY_DESCRIPTION,\n\t\tschema: {\n\t\t\ttype: \"string\",\n\t\t\tminLength: 1,\n\t\t\tmaxLength: 255\n\t\t}\n\t};\n\tconst schemas = {};\n\tif (paginated) schemas.Page = {\n\t\ttype: \"object\",\n\t\tdescription: \"The envelope every collection returns. `nextCursor` is absent on the last page.\",\n\t\tproperties: {\n\t\t\titems: {\n\t\t\t\ttype: \"array\",\n\t\t\t\titems: { type: \"object\" }\n\t\t\t},\n\t\t\tnextCursor: { type: \"string\" }\n\t\t},\n\t\trequired: [\"items\"]\n\t};\n\tschemas.Error = {\n\t\ttype: \"object\",\n\t\tdescription: \"Every failure carries this shape. Branch on `code`, not on the human-readable `message`.\",\n\t\tproperties: {\n\t\t\tmessage: { type: \"string\" },\n\t\t\tcode: {\n\t\t\t\ttype: \"string\",\n\t\t\t\tenum: Object.values(ApiErrorCode)\n\t\t\t},\n\t\t\tfields: {\n\t\t\t\ttype: \"object\",\n\t\t\t\tdescription: \"Per-field messages, keyed by dotted path. Present on validation failures.\",\n\t\t\t\tadditionalProperties: { type: \"string\" }\n\t\t\t},\n\t\t\tdetails: {\n\t\t\t\ttype: \"object\",\n\t\t\t\tdescription: \"Machine-readable context. A scope refusal carries `requiredScope`, e.g. `write:org:<id>`.\",\n\t\t\t\tadditionalProperties: { type: \"string\" }\n\t\t\t}\n\t\t},\n\t\trequired: [\"message\", \"code\"]\n\t};\n\tObject.assign(schemas, options.schemas);\n\tconst components = { securitySchemes: options.securitySchemes };\n\tif (Object.keys(parameters).length) components.parameters = parameters;\n\tcomponents.schemas = schemas;\n\treturn {\n\t\topenapi: \"3.1.0\",\n\t\tinfo: options.info,\n\t\tservers: [{\n\t\t\turl: \"/\",\n\t\t\tdescription: \"The instance serving this document.\"\n\t\t}],\n\t\tsecurity: options.security,\n\t\tcomponents,\n\t\tpaths\n\t};\n}\n//#endregion\n//#region ../server/src/api/pagination.ts\n/**\n* Query-param parsing for the list pagination contract:\n* `?limit=&cursor=&orderBy=&orderDir=` → `{ items, nextCursor? }`.\n*\n* Every list endpoint parses these identically, so the clamping lives here\n* rather than inline per handler — a handler that clamps differently publishes\n* a different contract under the same documented one, and nothing fails at\n* build time.\n*/\n/**\n* An unparseable or out-of-range `limit` clamps rather than 400s: pagination\n* params are plumbing, and failing a read over one is hostile to clients\n* walking a cursor.\n*/\nfunction parseListOptions(url) {\n\tconst raw = Number(url.searchParams.get(\"limit\") ?? 50);\n\tconst limit = Number.isFinite(raw) ? Math.min(Math.max(Math.trunc(raw), 1), 200) : 50;\n\tconst orderByRaw = url.searchParams.get(\"orderBy\");\n\tconst orderBy = orderByRaw === \"createdAt\" || orderByRaw === \"updatedAt\" || orderByRaw === \"name\" ? orderByRaw : void 0;\n\treturn {\n\t\tlimit,\n\t\tcursor: url.searchParams.get(\"cursor\") ?? void 0,\n\t\torderBy,\n\t\torderDir: url.searchParams.get(\"orderDir\") === \"asc\" ? \"asc\" : void 0\n\t};\n}\n/** `parseListOptions` plus the definition-only `solveCount` ordering. */\nfunction parseDefinitionListOptions(url) {\n\tconst base = parseListOptions(url);\n\tif (url.searchParams.get(\"orderBy\") === \"solveCount\") return {\n\t\t...base,\n\t\torderBy: \"solveCount\"\n\t};\n\treturn base;\n}\n//#endregion\n//#region ../server/src/api/bodies.ts\n/**\n* Request-body validators for the API routes that take JSON.\n*\n* They live apart from their handlers so a spec generator can import them\n* without loading a host's route module — in Selva's case a `+server.ts` imports\n* `./$types`, which only resolves inside a SvelteKit build.\n*\n* **A JSON body accepted by an API route belongs in this file.** Adding one\n* inline is invisible to the generator, so the endpoint documents an empty body.\n* Multipart handlers are the exception — `FormData` has no Zod schema to derive\n* from, so their fields are described in the spec directly.\n*/\nvar SolveBodySchema = z.object({\n\tinputs: z.array(z.unknown()).default([]),\n\tvalues: z.record(z.string(), z.unknown()).default({}),\n\tchannel: z.enum([\"live\", \"draft\"]).default(\"live\"),\n\tversionId: z.string().optional(),\n\t/** Must name this same definition, or the route 400s instead of solving a different one. */\n\tdefinitionUrl: z.string().optional()\n});\nvar CreateProjectBodySchema = z.object({\n\tname: z.string().min(1, \"Project name is required\").max(128).trim(),\n\tdescription: z.string().max(2e3).optional(),\n\tvisibility: ProjectVisibilitySchema.default(\"private\"),\n\tautoJoinOnUpload: z.boolean().optional()\n});\nvar UpdateProjectBodySchema = z.object({\n\tname: z.string().min(1).max(128).trim(),\n\tdescription: z.string().max(2e3).nullish(),\n\tvisibility: ProjectVisibilitySchema,\n\tautoJoinOnUpload: z.boolean()\n}).partial();\nvar AddProjectMemberBodySchema = z.object({\n\tuserId: z.string().min(1, \"userId is required\"),\n\trole: ProjectRoleSchema\n});\nvar UpdateProjectMemberBodySchema = z.object({ role: ProjectRoleSchema });\n/** Platform-scope entries are dropped downstream — an invite only grants org rights. */\nvar FlatPermissionSchema = z.union([PlatformPermissionSchema, OrgPermissionSchema]);\nvar CreateInviteBodySchema = z.object({\n\temail: z.email(\"Valid email is required\").transform((s) => s.toLowerCase().trim()),\n\torgRole: OrgRoleSchema.default(\"member\"),\n\tpermissions: z.array(FlatPermissionSchema).default([])\n});\n/**\n* `apiKey` is tri-state: **omitted** keeps the stored key, **null** clears it, a\n* string replaces it. `.optional().nullable()` — not `.nullish()` — because the\n* two must stay distinguishable after parsing, or a request that just omits the\n* field would silently wipe the stored credential.\n*/\nvar IncomingComputeServerSchema = z.object({\n\tid: z.string().min(1),\n\tlabel: z.string().min(1),\n\tserverUrl: z.string().min(1),\n\tapiKey: z.string().nullable().optional(),\n\ttimeoutMs: z.number().optional(),\n\tretryCount: z.number().optional()\n});\nvar OrgComputePatchBodySchema = z.object({\n\tservers: z.array(IncomingComputeServerSchema),\n\t/** May name any server visible to the org. `null` clears the override; omitted leaves it untouched. */\n\tdefaultServerId: z.string().nullable().optional()\n});\nvar UpdateOrgMemberBodySchema = z.object({\n\trole: OrgRoleSchema.optional(),\n\tpermissions: z.array(z.enum(ALL_ORG_PERMISSIONS)).optional()\n}).refine((b) => b.role !== void 0 || b.permissions !== void 0, { message: \"Provide at least one of role, permissions\" });\nvar CreateApiTokenBodySchema = z.object({\n\tname: z.string().trim().min(1, \"Name is required\").max(100),\n\tscopes: z.array(ApiScopeStringSchema).min(1, \"Pick at least one scope\").max(20),\n\texpiresInDays: z.union(API_TOKEN_LIFETIME_DAYS.map((d) => z.literal(d)))\n});\n//#endregion\n//#region ../server/src/api/responses-schema.ts\n/**\n* Response schemas for the v1 payloads that must not carry a stored secret.\n*\n* Four store types hold a credential next to fields a client legitimately\n* reads: `ShareLink.tokenHash`, `Invite.tokenHash` and `ApiToken.tokenHash` are HMACs of a token,\n* `ComputeServerCommon.apiKey` is a live Rhino.Compute key. Handlers used to\n* strip them by destructuring — `const { tokenHash: _omit, ...rest } = invite`\n* — which works until someone adds a field to the stored type or edits the line\n* away. Nothing fails at build time; the credential just starts appearing in a\n* response.\n*\n* Parsing through these schemas inverts the default: the response carries only\n* what the schema names, so a new field on the stored type is invisible to\n* clients until added here on purpose. Use them via `shaped`/`shapedCollection`\n* in `./route.ts`.\n*\n* These describe **responses**, not stored records — where the two differ (an\n* invite's one-time `acceptUrl`, a share link's `hasToken` sentinel) the\n* response is the authority.\n*/\nvar ShareLinkResponseSchema = z.object({\n\tid: z.string(),\n\tdefinitionId: z.string(),\n\tchannel: z.enum([\"live\", \"draft\"]),\n\tname: z.string().optional(),\n\tcreatedBy: z.string(),\n\tcreatedAt: z.string(),\n\texpiresAt: z.string().nullish(),\n\trevokedAt: z.string().nullish(),\n\tallowSolve: z.boolean(),\n\tmaxSolves: z.number().nullish(),\n\tsolveCount: z.number(),\n\t/** Sentinel replacing `tokenHash`: a token exists, its hash is not yours. */\n\thasToken: z.literal(true)\n});\n/** The mint response. `token` is the plaintext, returned exactly once. */\nvar CreatedShareLinkResponseSchema = z.object({\n\tlink: ShareLinkResponseSchema,\n\ttoken: z.string()\n});\nvar InviteResponseSchema = z.object({\n\tid: z.string(),\n\temail: z.string(),\n\torgId: z.string(),\n\torgRole: z.string(),\n\torgPermissions: z.array(z.string()),\n\tplatformPermissions: z.array(z.string()).default([]),\n\tinvitedBy: z.string(),\n\tcreatedAt: z.string(),\n\texpiresAt: z.string(),\n\tacceptedAt: z.string().optional(),\n\tacceptedByUserId: z.string().optional()\n});\n/**\n* The create response: the invite plus the link to send, built per request.\n*\n* `acceptUrl` is returned whatever `delivery` says — mail is best-effort, and\n* manual sharing is the fallback when it is off or the send failed.\n*/\nvar CreatedInviteResponseSchema = InviteResponseSchema.extend({\n\tacceptUrl: z.string(),\n\tdelivery: z.enum([\n\t\t\"sent\",\n\t\t\"not-configured\",\n\t\t\"failed\"\n\t])\n});\n/**\n* An org-owned compute server. `apiKey` is replaced by `hasApiKey`, so a picker\n* can render \"key set\" without any store decrypting a secret to throw away.\n*/\nvar OrgComputeServerResponseSchema = z.object({\n\tid: z.string(),\n\tlabel: z.string(),\n\tserverUrl: z.string(),\n\tscope: z.literal(\"org\"),\n\townerOrgId: z.string(),\n\ttimeoutMs: z.number().optional(),\n\tretryCount: z.number().optional(),\n\thasApiKey: z.boolean()\n});\n/** A server this org may select but not edit. Never carries a key either. */\nvar ComputeCatalogEntrySchema = z.object({\n\tid: z.string(),\n\tlabel: z.string(),\n\tserverUrl: z.string(),\n\tscope: z.enum([\"platform\", \"org\"]),\n\tsource: z.enum([\"platform\", \"org\"]),\n\ttimeoutMs: z.number().optional(),\n\tretryCount: z.number().optional()\n});\nvar OrgComputeResponseSchema = z.object({\n\tservers: z.array(OrgComputeServerResponseSchema),\n\tdefaultServerId: z.string().nullish(),\n\tglobalDefaultServerId: z.string().nullish(),\n\tcatalog: z.array(ComputeCatalogEntrySchema)\n});\nvar ApiTokenResponseSchema = z.object({\n\tid: z.string(),\n\tuserId: z.string(),\n\tcreatedBy: z.string().nullable(),\n\torgId: z.string(),\n\tname: z.string(),\n\tscopes: z.array(z.string()),\n\tcreatedAt: z.string(),\n\texpiresAt: z.string(),\n\tlastUsedAt: z.string().nullable(),\n\trevokedAt: z.string().nullable(),\n\t/** Scope refusals since midnight UTC, counted in this process only. */\n\trefusedToday: z.number()\n});\n/** The mint response. `secret` is the raw key, returned exactly once. */\nvar CreatedApiTokenResponseSchema = z.object({\n\ttoken: ApiTokenResponseSchema,\n\tsecret: z.string()\n});\n//#endregion\nexport { resolveApiRateLimitConfig as A, idempotencyCallerId as C, chargeApiRateLimit as D, runIdempotent as E, scopeRefusalsToday as F, depsFromConfig as I, assertScope as M, definitionScopeTarget as N, createApiRateLimiter as O, projectScopeTarget as P, createApiIdempotencyStore as S, requestFingerprint as T, parseDefinitionListOptions as _, InviteResponseSchema as a, mapCoreError as b, AddProjectMemberBodySchema as c, CreateProjectBodySchema as d, OrgComputePatchBodySchema as f, UpdateProjectMemberBodySchema as g, UpdateProjectBodySchema as h, CreatedShareLinkResponseSchema as i, withRateLimitHeaders as j, rateLimitedResponse as k, CreateApiTokenBodySchema as l, UpdateOrgMemberBodySchema as m, CreatedApiTokenResponseSchema as n, OrgComputeResponseSchema as o, SolveBodySchema as p, CreatedInviteResponseSchema as r, ShareLinkResponseSchema as s, ApiTokenResponseSchema as t, CreateInviteBodySchema as u, parseListOptions as v, readIdempotencyKey as w, runHandler as x, buildOpenApiDocument as y };\n"],"names":[],"mappings":";;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,MAAM,EAAE,QAAQ,GAAG,EAAE,EAAE,EAAE,MAAM,GAAG,EAAE,EAAE,YAAY,EAAE,kBAAkB,GAAG,MAAM,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,GAAG,OAAO,EAAE,oBAAoB,GAAG,kBAAkB,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,EAAE,EAAE;AACjO,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM;AACxB,CAAC,OAAO;AACR,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI;AACnB,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO;AACzB,EAAE,IAAI;AACN,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI;AACjB,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ;AACzB,EAAE,cAAc,EAAE,IAAI,CAAC,WAAW;AAClC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa;AACnC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW;AAC/B,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU;AAC7B,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO;AACvB,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW;AAC/B,EAAE,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;AACnD,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI,aAAa,EAAE;AAC9C,EAAE,IAAI,EAAE,CAAC,IAAI,KAAK,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;AAC7C,EAAE,MAAM;AACR,EAAE,YAAY,EAAE;AAChB,GAAG,qBAAqB,EAAE,YAAY,EAAE,qBAAqB,IAAI,QAAQ;AACzE,GAAG,gBAAgB,EAAE,YAAY,EAAE,gBAAgB,IAAI;AACvD,GAAG;AACH,EAAE,kBAAkB;AACpB,EAAE,aAAa;AACf,EAAE,YAAY;AACd,EAAE,oBAAoB;AACtB,EAAE,cAAc;AAChB,EAAE,WAAW;AACb,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA,SAAS,eAAe,CAAC,MAAM,EAAE;AACjC,CAAC,OAAO,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,GAAG,MAAM,GAAG,OAAO;AAChE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE;AAC1C,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,IAAI,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE;AACzD,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;AACpC,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,6BAA6B,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;AACrJ;AACA,IAAI,QAAQ,mBAAmB,IAAI,GAAG,EAAE;AACxC,IAAI,MAAM,GAAG,MAAM,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;AAC1E,SAAS,aAAa,CAAC,OAAO,EAAE;AAChC,CAAC,MAAM,GAAG,GAAG,MAAM,EAAE;AACrB,CAAC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;AACpC,CAAC,IAAI,KAAK,EAAE,GAAG,KAAK,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE;AACtC,MAAM,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE;AAC5B,EAAE,GAAG;AACL,EAAE,KAAK,EAAE;AACT,EAAE,CAAC;AACH;AACA;AACA,SAAS,kBAAkB,CAAC,OAAO,EAAE;AACrC,CAAC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;AACpC,CAAC,OAAO,KAAK,EAAE,GAAG,KAAK,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC;AACjD;AACA,SAAS,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE;AAC5C,CAAC,IAAI,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;AACtE,CAAC,IAAI,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;AAC/E,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;AAC1C;AACA;AACA,SAAS,kBAAkB,CAAC,KAAK,GAAG,IAAI,EAAE;AAC1C,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACnD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,KAAK,GAAG,MAAM,EAAE;AAC/C,CAAC,OAAO,OAAO,GAAG,KAAK;AACvB,EAAE,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;AACxC,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE;AACxD,EAAE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC;AACzE,EAAE,MAAM,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI;AAC/F,EAAE,IAAI,CAAC,OAAO,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE;AAClF,EAAE,OAAO;AACT,GAAG,YAAY;AACf,GAAG,SAAS,EAAE,OAAO,CAAC;AACtB,GAAG;AACH,CAAC,CAAC;AACF;AACA;AACA;AACA,IAAI,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC;AAC3C,CAAC,QAAQ,EAAE,GAAG;AACd,CAAC,YAAY,EAAE;AACf,CAAC,CAAC;AACF;AACA;AACA;AACA;AACA,SAAS,yBAAyB,CAAC,GAAG,EAAE,MAAM,EAAE;AAChD,CAAC,OAAO;AACR,EAAE,QAAQ,EAAE,eAAe,CAAC,GAAG,EAAE,gCAAgC,EAAE,sBAAsB,CAAC,QAAQ,EAAE,MAAM,CAAC;AAC3G,EAAE,YAAY,EAAE,kBAAkB,CAAC,GAAG,EAAE,0BAA0B,EAAE,sBAAsB,CAAC,YAAY,EAAE,MAAM;AAC/G,EAAE;AACF;AACA;AACA,SAAS,oBAAoB,CAAC,MAAM,GAAG,sBAAsB,EAAE;AAC/D,CAAC,IAAI,MAAM,CAAC,YAAY,IAAI,CAAC,EAAE,OAAO,IAAI;AAC1C,CAAC,MAAM,KAAK,GAAG,wBAAwB,CAAC,MAAM,CAAC;AAC/C,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY;AAClC,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE;AACnB,EAAE,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC;AACjC,EAAE,OAAO;AACT,GAAG,OAAO,EAAE,MAAM,CAAC,OAAO;AAC1B,GAAG,KAAK;AACR,GAAG,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACnD,GAAG,UAAU,EAAE,MAAM,CAAC;AACtB,GAAG;AACH,CAAC,CAAC,EAAE;AACJ;AACA,IAAI,eAAe;AACnB;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,GAAG;AACjC,CAAC,IAAI,eAAe,KAAK,MAAM,EAAE,eAAe,GAAG,oBAAoB,EAAE;AACzE,CAAC,OAAO,eAAe;AACvB;AACA;AACA;AACA;AACA;AACA,eAAe,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE;AAChD,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,IAAI,CAAC,OAAO,EAAE,OAAO,MAAM;AAC9C,CAAC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AACpD;AACA,SAAS,gBAAgB,CAAC,OAAO,EAAE;AACnC,CAAC,MAAM,OAAO,GAAG;AACjB,EAAE,iBAAiB,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;AAC1C,EAAE,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;AACjD,EAAE;AACF,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC;AAC/E,CAAC,OAAO,OAAO;AACf;AACA;AACA,SAAS,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,CAAC,+CAA+C,EAAE,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE;AAC/H,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC;AACnD,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC;AAC1F,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE;AACvD,EAAE,MAAM,EAAE,GAAG;AACb,EAAE,OAAO,EAAE;AACX,GAAG,cAAc,EAAE,kBAAkB;AACrC,GAAG,GAAG,gBAAgB,CAAC,OAAO;AAC9B;AACA,EAAE,CAAC;AACH;AACA;AACA,SAAS,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE;AAC5C,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG;AACzB,CAAC,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC;AAC1C,CAAC,IAAI;AACL,EAAE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;AACrE,EAAE,OAAO,GAAG;AACZ,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;AACvC,EAAE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;AAC9D,EAAE,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE;AAChC,GAAG,MAAM,EAAE,GAAG,CAAC,MAAM;AACrB,GAAG,UAAU,EAAE,GAAG,CAAC,UAAU;AAC7B,GAAG,OAAO,EAAE;AACZ,GAAG,CAAC;AACJ,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,SAAS,sBAAsB,CAAC,MAAM,EAAE;AACxC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC;AAC/D,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,IAAI,KAAK,CAAC,CAAC;AACjF,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;AACtC,EAAE,GAAG,MAAM;AACX,EAAE,KAAK;AACP,EAAE,OAAO;AACT,EAAE;AACF,EAAE,CAAC;AACH,CAAC,MAAM,OAAO,mBAAmB,IAAI,GAAG,EAAE;AAC1C,CAAC,IAAI,WAAW,GAAG,MAAM,CAAC,iBAAiB;AAC3C,CAAC,SAAS,UAAU,CAAC,GAAG,EAAE,QAAQ,GAAG,CAAC,EAAE;AACxC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;AAChD,EAAE,IAAI,EAAE,eAAe,GAAG,CAAC,IAAI,GAAG,IAAI,WAAW,CAAC,IAAI,OAAO,CAAC,IAAI,IAAI,MAAM,EAAE;AAC9E,EAAE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;AAChH,EAAE,IAAI,eAAe,GAAG,CAAC,EAAE,WAAW,GAAG,GAAG,GAAG,eAAe;AAC9D,EAAE,IAAI,OAAO,CAAC,IAAI,GAAG,MAAM,EAAE;AAC7B,GAAG,MAAM,WAAW,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;AACzH,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1F,EAAE;AACF,CAAC;AACD,CAAC,OAAO;AACR,EAAE,MAAM,EAAE,cAAc;AACxB,EAAE,MAAM,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE;AACrB,GAAG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;AACzB,GAAG,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;AACpC,GAAG,IAAI,QAAQ,KAAK,QAAQ,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO;AACtF,IAAI,KAAK,EAAE,MAAM,QAAQ,CAAC,OAAO;AACjC,IAAI,QAAQ,EAAE;AACd,IAAI;AACJ,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC5C,GAAG,MAAM,OAAO,GAAG,EAAE,EAAE;AACvB,GAAG,MAAM,KAAK,GAAG;AACjB,IAAI,OAAO;AACX,IAAI,SAAS,EAAE;AACf,IAAI;AACJ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC;AAC1B,GAAG,IAAI,eAAe,GAAG,CAAC,IAAI,WAAW,KAAK,MAAM,CAAC,iBAAiB,EAAE,WAAW,GAAG,GAAG,GAAG,eAAe;AAC3G,GAAG,IAAI;AACP,IAAI,MAAM,KAAK,GAAG,MAAM,OAAO;AAC/B,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;AACxC,IAAI,OAAO;AACX,KAAK,KAAK;AACV,KAAK,QAAQ,EAAE;AACf,KAAK;AACL,GAAG,CAAC,CAAC,OAAO,GAAG,EAAE;AACjB,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;AACvD,IAAI,MAAM,GAAG;AACb,GAAG;AACH,EAAE,CAAC;AACH,EAAE,KAAK,GAAG;AACV,GAAG,OAAO,CAAC,KAAK,EAAE;AAClB,GAAG,WAAW,GAAG,MAAM,CAAC,iBAAiB;AACzC,EAAE,CAAC;AACH,EAAE,IAAI,GAAG;AACT,GAAG,OAAO,OAAO,CAAC,IAAI;AACtB,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,2BAA2B,GAAG,sBAAsB;AACxD;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,QAAQ,EAAE,SAAS,EAAE;AAC7C,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AAClC;AACA;AACA,eAAe,gBAAgB,CAAC,GAAG,EAAE;AACrC,CAAC,OAAO;AACR,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM;AACpB,EAAE,OAAO,EAAE,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;AACrC,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,WAAW;AAC7B,EAAE;AACF;AACA;AACA,SAAS,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE;AAC9C,CAAC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;AAC5C,CAAC,IAAI,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,MAAM,CAAC;AAC/D,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE;AAClC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM;AACvB,EAAE;AACF,EAAE,CAAC;AACH;AACA;AACA;AACA,IAAI,sBAAsB,GAAG,iBAAiB;AAC9C;AACA,IAAI,8BAA8B,GAAG,GAAG;AACxC,SAAS,yBAAyB,CAAC,KAAK,GAAG,8BAA8B,EAAE;AAC3E,CAAC,OAAO,sBAAsB,CAAC,EAAE,KAAK,EAAE,CAAC;AACzC;AACA,IAAI,aAAa;AACjB;AACA,SAAS,0BAA0B,GAAG;AACtC,CAAC,OAAO,aAAa,KAAK,yBAAyB,EAAE;AACrD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,GAAG,EAAE;AAClC,CAAC,OAAO,GAAG,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;AAC7E;AACA;AACA,SAAS,kBAAkB,CAAC,OAAO,EAAE;AACrC,CAAC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;AACxD,CAAC,IAAI,GAAG,KAAK,IAAI,EAAE,OAAO,IAAI;AAC9B,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,EAAE,sBAAsB,CAAC,6BAA6B,CAAC,CAAC;AAClJ,CAAC,OAAO,GAAG;AACX;AACA,eAAe,SAAS,CAAC,KAAK,EAAE;AAChC,CAAC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC;AAC5D,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3F;AACA;AACA,eAAe,kBAAkB,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE;AACrD,CAAC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAChG,CAAC,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC;AAC9F,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;AACxD,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;AAChB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;AAC7B,CAAC,OAAO,SAAS,CAAC,KAAK,CAAC;AACxB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,eAAe,CAAC,OAAO,EAAE;AACxC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;AACvI,CAAC,IAAI,IAAI;AACT,CAAC,IAAI;AACL,EAAE,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;AACzC,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;AACtC,CAAC;AACD,CAAC,MAAM,KAAK,GAAG,EAAE;AACjB,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,KAAK,KAAK,QAAQ,GAAG,KAAK,GAAG;AACzF,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI;AAClB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI;AAClB,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC,MAAM,KAAK,CAAC,WAAW,EAAE;AACnD,EAAE,CAAC,CAAC;AACJ,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;AAC7B;AACA,IAAI,aAAa,GAAG,MAAM;AAC1B,CAAC,WAAW;AACZ,CAAC,QAAQ;AACT,CAAC,WAAW,CAAC,WAAW,EAAE,QAAQ,EAAE;AACpC,EAAE,IAAI,CAAC,WAAW,GAAG,WAAW;AAChC,EAAE,IAAI,CAAC,QAAQ,GAAG,QAAQ;AAC1B,CAAC;AACD,CAAC;AACD,SAAS,iBAAiB,CAAC,MAAM,EAAE,WAAW,EAAE;AAChD,CAAC,IAAI,MAAM,KAAK,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,sBAAsB,CAAC,0CAA0C,CAAC,CAAC;AAClJ;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,aAAa,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE;AAC9E,CAAC,IAAI,OAAO;AACZ,CAAC,IAAI;AACL,EAAE,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,YAAY;AAC7E,GAAG,MAAM,GAAG,GAAG,MAAM,EAAE,EAAE;AACzB,GAAG,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC;AAC/C,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC;AACxE,GAAG,OAAO;AACV,IAAI,WAAW;AACf,IAAI;AACJ,IAAI;AACJ,EAAE,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,IAAI,EAAE,GAAG,YAAY,aAAa,CAAC,EAAE,MAAM,GAAG;AAChD,EAAE,iBAAiB,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC;AACjD,EAAE,OAAO,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC;AAChD,CAAC;AACD,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,WAAW,CAAC;AAC1D,CAAC,OAAO,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC;AACpE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,UAAU,CAAC,MAAM,EAAE;AAC5B,CAAC,IAAI,MAAM,YAAY,QAAQ,EAAE,OAAO,MAAM;AAC9C,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM;AACzC,CAAC,IAAI,IAAI,KAAK,MAAM,EAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;AAChD,EAAE,MAAM,EAAE,MAAM,IAAI,GAAG;AACvB,EAAE;AACF,EAAE,CAAC;AACH,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;AAC3C,EAAE,MAAM,EAAE,MAAM,IAAI,GAAG;AACvB,EAAE,OAAO,EAAE;AACX,GAAG,cAAc,EAAE,kBAAkB;AACrC,GAAG,GAAG;AACN;AACA,EAAE,CAAC;AACH;AACA;AACA,eAAe,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE;AACjG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK;AACvB,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,OAAO,UAAU,CAAC;AACzC,GAAG,MAAM,EAAE,GAAG,CAAC,MAAM;AACrB,GAAG,IAAI,EAAE,WAAW,CAAC,GAAG;AACxB,GAAG,CAAC;AACJ,EAAE,MAAM,MAAM,GAAG,QAAQ,GAAG,GAAG,CAAC;AAChC,EAAE,IAAI,MAAM,EAAE,OAAO,UAAU,CAAC;AAChC,GAAG,MAAM,EAAE,MAAM,CAAC,MAAM;AACxB,GAAG,IAAI,EAAE,WAAW,CAAC,MAAM;AAC3B,GAAG,CAAC;AACJ,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE;AACrC,GAAG,SAAS,EAAE,KAAK;AACnB,GAAG,GAAG,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG;AACpE,GAAG,CAAC;AACJ,EAAE,OAAO,UAAU,CAAC;AACpB,GAAG,MAAM,EAAE,GAAG;AACd,GAAG,IAAI,EAAE;AACT,IAAI,OAAO,EAAE,QAAQ;AACrB,IAAI,IAAI,EAAE,YAAY,CAAC;AACvB;AACA,GAAG,CAAC;AACJ,CAAC,CAAC;AACF,CAAC,IAAI,OAAO;AACZ,CAAC,IAAI;AACL,EAAE,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,KAAK,CAAC,GAAG,qBAAqB,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,cAAc;AACxG,EAAE,OAAO,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC;AACtD,EAAE,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,mBAAmB,CAAC,OAAO,CAAC;AACtE,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC;AAClB,CAAC;AACD,CAAC,IAAI,GAAG;AACR,CAAC,IAAI;AACL,EAAE,IAAI,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;AAC3I,EAAE,MAAM,GAAG,GAAG,YAAY;AAC1B,GAAG,IAAI;AACP,IAAI,OAAO,UAAU,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;AACzC,GAAG,CAAC,CAAC,OAAO,GAAG,EAAE;AACjB,IAAI,OAAO,IAAI,CAAC,GAAG,CAAC;AACpB,GAAG;AACH,EAAE,CAAC;AACH,EAAE,MAAM,SAAS,GAAG,UAAU,IAAI,GAAG,CAAC,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI;AAClF,EAAE,IAAI,SAAS,IAAI,GAAG,CAAC,GAAG,EAAE;AAC5B,GAAG,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAChH,GAAG,GAAG,GAAG,MAAM,aAAa,CAAC;AAC7B,IAAI,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,0BAA0B,EAAE;AAC/D,IAAI,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC;AAC1C,IAAI,SAAS;AACb,IAAI;AACJ,IAAI,EAAE,GAAG,CAAC;AACV,EAAE,CAAC,MAAM,GAAG,GAAG,MAAM,GAAG,EAAE;AAC1B,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;AACjB,CAAC;AACD,CAAC,OAAO,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC;AAC1C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,0BAA0B,GAAG;AACjC,CAAC,wBAAwB,EAAE,+DAA+D;AAC1F,CAAC,wBAAwB,EAAE,+DAA+D;AAC1F,CAAC,aAAa,EAAE,gDAAgD;AAChE,CAAC,gBAAgB,EAAE;AACnB,CAAC;AACD,SAAS,yBAAyB,CAAC,GAAG,EAAE;AACxC,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG;AACzG,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA,SAAS,YAAY,CAAC,GAAG,EAAE;AAC3B,CAAC,IAAI,GAAG,YAAY,qBAAqB,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,aAAa,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,GAAG,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC;AACxO,CAAC,IAAI,GAAG,YAAY,8BAA8B,EAAE,OAAO,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,GAAG,CAAC,OAAO,CAAC;AAC3H,CAAC,IAAI,GAAG,YAAY,aAAa,EAAE;AACnC,EAAE,MAAM,QAAQ,GAAG,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC;AACzD,EAAE,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC;AAC7F,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,0BAA0B,GAAG;AACjC,CAAC,GAAG,EAAE,oBAAoB;AAC1B,CAAC,GAAG,EAAE,iCAAiC;AACvC,CAAC,GAAG,EAAE,4IAA4I;AAClJ,CAAC,GAAG,EAAE,gDAAgD;AACtD,CAAC,GAAG,EAAE,+CAA+C;AACrD,CAAC,GAAG,EAAE,kCAAkC;AACxC,CAAC,GAAG,EAAE,0DAA0D;AAChE,CAAC,GAAG,EAAE,0BAA0B;AAChC,CAAC,GAAG,EAAE;AACN,CAAC;AACD,IAAI,mCAAmC,GAAG,uiBAAuiB;AACjlB,SAAS,iBAAiB,CAAC,MAAM,EAAE;AACnC,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE;AACrC,EAAE,EAAE,EAAE,OAAO;AACb,EAAE,MAAM,EAAE;AACV,EAAE,CAAC;AACH,CAAC,OAAO,IAAI,CAAC,OAAO;AACpB,CAAC,OAAO,IAAI;AACZ;AACA,SAAS,eAAe,CAAC,MAAM,EAAE;AACjC,CAAC,MAAM,UAAU,GAAG,EAAE;AACtB,CAAC,MAAM,QAAQ,GAAG,EAAE;AACpB,CAAC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE;AACzB,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG;AACxB,GAAG,IAAI,EAAE,QAAQ;AACjB,GAAG,WAAW,EAAE,CAAC,CAAC;AAClB,GAAG;AACH,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AACxC,CAAC;AACD,CAAC,OAAO,QAAQ,CAAC,MAAM,GAAG;AAC1B,EAAE,IAAI,EAAE,QAAQ;AAChB,EAAE,UAAU;AACZ,EAAE;AACF,EAAE,GAAG;AACL,EAAE,IAAI,EAAE,QAAQ;AAChB,EAAE;AACF,EAAE;AACF;AACA,SAAS,WAAW,CAAC,EAAE,EAAE;AACzB,CAAC,IAAI,EAAE,CAAC,QAAQ,KAAK,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,OAAO,IAAI,sBAAsB,EAAE,EAAE;AACrG,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,MAAM,IAAI,GAAG,CAAC;AACxC,CAAC,IAAI,EAAE,CAAC,QAAQ,KAAK,YAAY,EAAE,OAAO,EAAE,CAAC,MAAM,GAAG;AACtD,EAAE,WAAW,EAAE,EAAE,CAAC,OAAO,IAAI,oBAAoB;AACjD,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,2BAA2B,EAAE,EAAE;AAClF,EAAE,EAAE;AACJ,CAAC,IAAI,EAAE,CAAC,QAAQ,KAAK,QAAQ,EAAE,OAAO,EAAE,CAAC,MAAM,GAAG;AAClD,EAAE,WAAW,EAAE,EAAE,CAAC,OAAO,IAAI,iBAAiB;AAC9C,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,IAAI,0BAA0B,GAAG,EAAE,MAAM,EAAE;AACvE,GAAG,IAAI,EAAE,QAAQ;AACjB,GAAG,MAAM,EAAE;AACX,GAAG,EAAE;AACL,EAAE,EAAE;AACJ,CAAC,OAAO,EAAE,CAAC,MAAM,GAAG;AACpB,EAAE,WAAW,EAAE,EAAE,CAAC,OAAO,IAAI,UAAU;AACvC,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;AAC/D,EAAE,EAAE;AACJ;AACA,SAAS,aAAa,CAAC,EAAE,EAAE;AAC3B,CAAC,MAAM,MAAM,GAAG,EAAE;AAClB,CAAC,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC;AAChE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AACf,EAAE,EAAE,EAAE,MAAM;AACZ,EAAE,QAAQ,EAAE,IAAI;AAChB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ;AAC1B,EAAE,CAAC;AACH,CAAC,IAAI,EAAE,CAAC,QAAQ,KAAK,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,+BAA+B,EAAE,EAAE,EAAE,IAAI,EAAE,gCAAgC,EAAE,EAAE,EAAE,IAAI,EAAE,iCAAiC,EAAE,EAAE,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC;AAChO,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC;AAC7C,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;AACd,EAAE,EAAE,EAAE,OAAO;AACb,EAAE,QAAQ,EAAE,KAAK;AACjB,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW;AAC5B,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ;AAC1B,EAAE,CAAC;AACH,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,wCAAwC,EAAE,CAAC;AACnF,CAAC,OAAO,MAAM;AACd;AACA,SAAS,YAAY,CAAC,EAAE,EAAE,iBAAiB,EAAE,YAAY,EAAE;AAC3D,CAAC,MAAM,EAAE,GAAG;AACZ,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO;AACrB,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;AAC9B,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;AACzB,EAAE,SAAS,EAAE,EAAE,CAAC;AAChB,EAAE;AACF,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,IAAI;AACzC,CAAC,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,CAAC;AACjC,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,GAAG,MAAM;AAC1C,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,GAAG;AACtC,EAAE,QAAQ,EAAE,IAAI;AAChB,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE;AAC9E,EAAE;AACF,MAAM,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,WAAW,GAAG;AACzC,EAAE,QAAQ,EAAE,IAAI;AAChB,EAAE,OAAO,EAAE,EAAE,qBAAqB,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE;AAC7E,EAAE;AACF,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC;AAClC,CAAC,MAAM,QAAQ,mBAAmB,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,IAAI,EAAE,EAAE,GAAG,YAAY,CAAC,CAAC;AAChF,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;AACrC,CAAC,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG;AACvF,EAAE,WAAW,EAAE,iBAAiB,CAAC,MAAM,CAAC,IAAI,QAAQ;AACpD,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,EAAE;AACnF,EAAE;AACF,CAAC,EAAE,CAAC,SAAS,GAAG,SAAS;AACzB,CAAC,OAAO,EAAE;AACV;AACA,IAAI,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AACvD,IAAI,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;AACxC,SAAS,MAAM,CAAC,IAAI,EAAE;AACtB,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC;AAC/C;AACA;AACA,SAAS,WAAW,CAAC,EAAE,EAAE;AACzB,CAAC,MAAM,QAAQ,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9H,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;AACnD;AACA,SAAS,oBAAoB,CAAC,SAAS,EAAE,OAAO,EAAE;AAClD,CAAC,MAAM,iBAAiB,GAAG;AAC3B,EAAE,GAAG,0BAA0B;AAC/B,EAAE,GAAG,OAAO,CAAC;AACb,EAAE;AACF,CAAC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI;AAC9C,EAAE,GAAG;AACL,EAAE,GAAG;AACL,EAAE,GAAG;AACL,EAAE;AACF,EAAE;AACF,CAAC,MAAM,KAAK,GAAG,EAAE;AACjB,CAAC,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE;AAC7B,EAAE,MAAM,IAAI,GAAG,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAC9C,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,EAAE,iBAAiB,EAAE,YAAY,CAAC;AACnG,CAAC;AACD,CAAC,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,KAAK,YAAY,CAAC;AACvE,CAAC,MAAM,UAAU,GAAG,EAAE;AACtB,CAAC,IAAI,SAAS,EAAE;AAChB,EAAE,UAAU,CAAC,KAAK,GAAG;AACrB,GAAG,IAAI,EAAE,OAAO;AAChB,GAAG,EAAE,EAAE,OAAO;AACd,GAAG,QAAQ,EAAE,KAAK;AAClB,GAAG,WAAW,EAAE,CAAC,wIAAwI,CAAC;AAC1J,GAAG,MAAM,EAAE;AACX,IAAI,IAAI,EAAE,SAAS;AACnB,IAAI,OAAO,EAAE,CAAC;AACd,IAAI,OAAO,EAAE;AACb;AACA,GAAG;AACH,EAAE,UAAU,CAAC,MAAM,GAAG;AACtB,GAAG,IAAI,EAAE,QAAQ;AACjB,GAAG,EAAE,EAAE,OAAO;AACd,GAAG,QAAQ,EAAE,KAAK;AAClB,GAAG,WAAW,EAAE,0FAA0F;AAC1G,GAAG,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ;AAC3B,GAAG;AACH,EAAE,UAAU,CAAC,OAAO,GAAG;AACvB,GAAG,IAAI,EAAE,SAAS;AAClB,GAAG,EAAE,EAAE,OAAO;AACd,GAAG,QAAQ,EAAE,KAAK;AAClB,GAAG,MAAM,EAAE;AACX,IAAI,IAAI,EAAE,QAAQ;AAClB,IAAI,IAAI,EAAE;AACV,KAAK,WAAW;AAChB,KAAK,WAAW;AAChB,KAAK;AACL;AACA;AACA,GAAG;AACH,EAAE,UAAU,CAAC,QAAQ,GAAG;AACxB,GAAG,IAAI,EAAE,UAAU;AACnB,GAAG,EAAE,EAAE,OAAO;AACd,GAAG,QAAQ,EAAE,KAAK;AAClB,GAAG,MAAM,EAAE;AACX,IAAI,IAAI,EAAE,QAAQ;AAClB,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM;AACxB;AACA,GAAG;AACH,CAAC;AACD,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,cAAc,GAAG;AACxE,EAAE,IAAI,EAAE,iBAAiB;AACzB,EAAE,EAAE,EAAE,QAAQ;AACd,EAAE,QAAQ,EAAE,KAAK;AACjB,EAAE,WAAW,EAAE,OAAO,CAAC,yBAAyB,IAAI,mCAAmC;AACvF,EAAE,MAAM,EAAE;AACV,GAAG,IAAI,EAAE,QAAQ;AACjB,GAAG,SAAS,EAAE,CAAC;AACf,GAAG,SAAS,EAAE;AACd;AACA,EAAE;AACF,CAAC,MAAM,OAAO,GAAG,EAAE;AACnB,CAAC,IAAI,SAAS,EAAE,OAAO,CAAC,IAAI,GAAG;AAC/B,EAAE,IAAI,EAAE,QAAQ;AAChB,EAAE,WAAW,EAAE,iFAAiF;AAChG,EAAE,UAAU,EAAE;AACd,GAAG,KAAK,EAAE;AACV,IAAI,IAAI,EAAE,OAAO;AACjB,IAAI,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ;AAC3B,IAAI;AACJ,GAAG,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ;AAC/B,GAAG;AACH,EAAE,QAAQ,EAAE,CAAC,OAAO;AACpB,EAAE;AACF,CAAC,OAAO,CAAC,KAAK,GAAG;AACjB,EAAE,IAAI,EAAE,QAAQ;AAChB,EAAE,WAAW,EAAE,0FAA0F;AACzG,EAAE,UAAU,EAAE;AACd,GAAG,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;AAC9B,GAAG,IAAI,EAAE;AACT,IAAI,IAAI,EAAE,QAAQ;AAClB,IAAI,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY;AACpC,IAAI;AACJ,GAAG,MAAM,EAAE;AACX,IAAI,IAAI,EAAE,QAAQ;AAClB,IAAI,WAAW,EAAE,2EAA2E;AAC5F,IAAI,oBAAoB,EAAE,EAAE,IAAI,EAAE,QAAQ;AAC1C,IAAI;AACJ,GAAG,OAAO,EAAE;AACZ,IAAI,IAAI,EAAE,QAAQ;AAClB,IAAI,WAAW,EAAE,2FAA2F;AAC5G,IAAI,oBAAoB,EAAE,EAAE,IAAI,EAAE,QAAQ;AAC1C;AACA,GAAG;AACH,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM;AAC9B,EAAE;AACF,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC;AACxC,CAAC,MAAM,UAAU,GAAG,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE;AAChE,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,UAAU,GAAG,UAAU;AACvE,CAAC,UAAU,CAAC,OAAO,GAAG,OAAO;AAC7B,CAAC,OAAO;AACR,EAAE,OAAO,EAAE,OAAO;AAClB,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI;AACpB,EAAE,OAAO,EAAE,CAAC;AACZ,GAAG,GAAG,EAAE,GAAG;AACX,GAAG,WAAW,EAAE;AAChB,GAAG,CAAC;AACJ,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ;AAC5B,EAAE,UAAU;AACZ,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,CAAC,GAAG,EAAE;AAC/B,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;AACxD,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,EAAE;AACtF,CAAC,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC;AACnD,CAAC,MAAM,OAAO,GAAG,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,MAAM,GAAG,UAAU,GAAG,MAAM;AACxH,CAAC,OAAO;AACR,EAAE,KAAK;AACP,EAAE,MAAM,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM;AAClD,EAAE,OAAO;AACT,EAAE,QAAQ,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,KAAK,GAAG,KAAK,GAAG;AACjE,EAAE;AACF;AACA;AACA,SAAS,0BAA0B,CAAC,GAAG,EAAE;AACzC,CAAC,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC;AACnC,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,YAAY,EAAE,OAAO;AAC9D,EAAE,GAAG,IAAI;AACT,EAAE,OAAO,EAAE;AACX,EAAE;AACF,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;AAC/B,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;AACzC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;AACtD,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;AACnD,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AACjC;AACA,CAAC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ;AACnC,CAAC;AACE,IAAC,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;AACvC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;AACpE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AAC5C,CAAC,UAAU,EAAE,uBAAuB,CAAC,OAAO,CAAC,SAAS,CAAC;AACvD,CAAC,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ;AACvC,CAAC;AACE,IAAC,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;AACvC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;AACxC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE;AAC3C,CAAC,UAAU,EAAE,uBAAuB;AACpC,CAAC,gBAAgB,EAAE,CAAC,CAAC,OAAO;AAC5B,CAAC,CAAC,CAAC,OAAO;AACP,IAAC,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;AAC1C,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,oBAAoB,CAAC;AAChD,CAAC,IAAI,EAAE;AACP,CAAC;AACE,IAAC,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE;AACxE;AACA,IAAI,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,wBAAwB,EAAE,mBAAmB,CAAC,CAAC;AAChF,IAAC,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;AACtC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;AACnF,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC;AACzC,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,EAAE;AACtD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;AAC3C,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AACtB,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AACzB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7B,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AACzC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AACjC,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ;AAChC,CAAC,CAAC;AACC,IAAC,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;AACzC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC;AAC9C;AACA,CAAC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ;AAChD,CAAC;AACE,IAAC,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;AACzC,CAAC,IAAI,EAAE,aAAa,CAAC,QAAQ,EAAE;AAC/B,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,QAAQ;AAC3D,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,MAAM,EAAE,EAAE,OAAO,EAAE,2CAA2C,EAAE;AACrH,IAAC,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;AACxC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;AAC5D,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;AAChF,CAAC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;AACvC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;AACf,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;AACzB,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACnC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AAC5B,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;AAChC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;AAChC,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;AACxB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;AAChC,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;AACvB;AACA,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI;AACzB,CAAC;AACD;AACG,IAAC,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;AAC9C,CAAC,IAAI,EAAE,uBAAuB;AAC9B,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM;AAChB,CAAC;AACE,IAAC,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;AACpC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;AACf,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;AAClB,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;AAClB,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;AACpB,CAAC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AACpC,CAAC,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;AACrD,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AAClC,CAAC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ;AACtC,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,2BAA2B,GAAG,oBAAoB,CAAC,MAAM,CAAC;AAC9D,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC;AAClB,EAAE,MAAM;AACR,EAAE,gBAAgB;AAClB,EAAE;AACF,EAAE;AACF,CAAC;AACD;AACA;AACA;AACA;AACA,IAAI,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;AAC9C,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;AACf,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;AAClB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;AACxB,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;AACvB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AACjC,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AAClC,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO;AACrB,CAAC,CAAC;AACF;AACA,IAAI,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;AACzC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;AACf,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;AAClB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AACpC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AACjC,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ;AAChC,CAAC,CAAC;AACC,IAAC,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;AACxC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC;AACjD,CAAC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;AACtC,CAAC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;AAC5C,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB;AAC3C,CAAC;AACE,IAAC,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;AACtC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;AACf,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;AACnB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AACjC,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;AAClB,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;AACjB,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AAC5B,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AAClC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AACjC;AACA,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM;AACvB,CAAC;AACD;AACG,IAAC,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;AAC7C,CAAC,KAAK,EAAE,sBAAsB;AAC9B,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM;AACjB,CAAC;;;;"}

package/build/server/chunks/chunks/arrow-left.js-CGLntYiz.js

@@ -0,0 +1,15 @@
+import { ai as spread_props } from './server.js-CUv4onuj.js';
+import { I as Icon } from './utils2.js-D4hQ3EdJ.js';
+
+//#region ../../node_modules/.pnpm/@lucide+svelte@1.48.0_svelte@5.57.1_@typescript-eslint+types@8.70.1_/node_modules/@lucide/svelte/dist/icons/arrow-left.svelte
+function Arrow_left($$renderer, $$props) {
+	let { $$slots, $$events, ...props } = $$props;
+	Icon($$renderer, spread_props([props, { icon: {
+		"name": "arrow-left",
+		"size": 24,
+		"node": [["path", { "d": "m12 19-7-7 7-7" }], ["path", { "d": "M19 12H5" }]]
+	} }]));
+}
+
+export { Arrow_left as A };
+//# sourceMappingURL=arrow-left.js-CGLntYiz.js.map

package/build/server/chunks/chunks/arrow-left.js-CGLntYiz.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"arrow-left.js-CGLntYiz.js","sources":["../../../../.svelte-kit/output/server/chunks/arrow-left.js"],"sourcesContent":["import { d as spread_props } from \"./server.js\";\nimport { n as Icon } from \"./utils2.js\";\n//#region ../../node_modules/.pnpm/@lucide+svelte@1.48.0_svelte@5.57.1_@typescript-eslint+types@8.70.1_/node_modules/@lucide/svelte/dist/icons/arrow-left.svelte\nfunction Arrow_left($$renderer, $$props) {\n\tlet { $$slots, $$events, ...props } = $$props;\n\tIcon($$renderer, spread_props([props, { icon: {\n\t\t\"name\": \"arrow-left\",\n\t\t\"size\": 24,\n\t\t\"node\": [[\"path\", { \"d\": \"m12 19-7-7 7-7\" }], [\"path\", { \"d\": \"M19 12H5\" }]]\n\t} }]));\n}\n//#endregion\nexport { Arrow_left as t };\n"],"names":[],"mappings":";;;AAEA;AACA,SAAS,UAAU,CAAC,UAAU,EAAE,OAAO,EAAE;AACzC,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO;AAC9C,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE;AAC/C,EAAE,MAAM,EAAE,YAAY;AACtB,EAAE,MAAM,EAAE,EAAE;AACZ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;AAC7E,EAAE,EAAE,CAAC,CAAC,CAAC;AACP;;;;"}

package/build/server/chunks/chunks/arrow-right.js-DZm-Jah9.js

@@ -0,0 +1,15 @@
+import { ai as spread_props } from './server.js-CUv4onuj.js';
+import { I as Icon } from './utils2.js-D4hQ3EdJ.js';
+
+//#region ../../node_modules/.pnpm/@lucide+svelte@1.48.0_svelte@5.57.1_@typescript-eslint+types@8.70.1_/node_modules/@lucide/svelte/dist/icons/arrow-right.svelte
+function Arrow_right($$renderer, $$props) {
+	let { $$slots, $$events, ...props } = $$props;
+	Icon($$renderer, spread_props([props, { icon: {
+		"name": "arrow-right",
+		"size": 24,
+		"node": [["path", { "d": "M5 12h14" }], ["path", { "d": "m12 5 7 7-7 7" }]]
+	} }]));
+}
+
+export { Arrow_right as A };
+//# sourceMappingURL=arrow-right.js-DZm-Jah9.js.map

package/build/server/chunks/chunks/arrow-right.js-DZm-Jah9.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"arrow-right.js-DZm-Jah9.js","sources":["../../../../.svelte-kit/output/server/chunks/arrow-right.js"],"sourcesContent":["import { d as spread_props } from \"./server.js\";\nimport { n as Icon } from \"./utils2.js\";\n//#region ../../node_modules/.pnpm/@lucide+svelte@1.48.0_svelte@5.57.1_@typescript-eslint+types@8.70.1_/node_modules/@lucide/svelte/dist/icons/arrow-right.svelte\nfunction Arrow_right($$renderer, $$props) {\n\tlet { $$slots, $$events, ...props } = $$props;\n\tIcon($$renderer, spread_props([props, { icon: {\n\t\t\"name\": \"arrow-right\",\n\t\t\"size\": 24,\n\t\t\"node\": [[\"path\", { \"d\": \"M5 12h14\" }], [\"path\", { \"d\": \"m12 5 7 7-7 7\" }]]\n\t} }]));\n}\n//#endregion\nexport { Arrow_right as t };\n"],"names":[],"mappings":";;;AAEA;AACA,SAAS,WAAW,CAAC,UAAU,EAAE,OAAO,EAAE;AAC1C,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO;AAC9C,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE;AAC/C,EAAE,MAAM,EAAE,aAAa;AACvB,EAAE,MAAM,EAAE,EAAE;AACZ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;AAC5E,EAAE,EAAE,CAAC,CAAC,CAAC;AACP;;;;"}

package/build/server/chunks/chunks/auth-bootstrap.server.js-u2EwxMqS.js

@@ -0,0 +1,152 @@
+import { b as private_env } from './shared-server.js-BGs15m2r.js';
+import { S as SYSTEM_CONTEXT, A as ALL_PLATFORM_PERMISSIONS, k as slugify } from './src.js-qWxoV-ql.js';
+import { a as getAuthProvider, g as getLogger, b as getPermissionStore, c as getTenancy, d as getDataProvider, e as getOrganizationProvider, f as getProjectProvider } from './providers.server.js-DNVO4BPz.js';
+import { randomUUID } from 'node:crypto';
+
+//#region src/lib/server/auth-bootstrap.server.ts
+/**
+* Shared post-verification flow used by every IdP-callback route (OAuth,
+* email link, future SAML, …). Order matters:
+*
+*   1. `data.ensureUser` — guarantee a user-data row exists for whatever ID
+*      the auth provider issued. Local-provider creates a JSON row;
+*      Supabase no-ops (its DB trigger has already fired).
+*   2. Bootstrap-admin grant — if no instance_admin exists yet AND the
+*      tenancy/env policy allows it, grant the signing-in user every
+*      platform permission so `/admin` becomes reachable.
+*   3. Single-tenant org seed — create the default Organization + Project
+*      owned by the new admin, mirroring what `/setup` does for password
+*      auth. Without this, org-scoped permissions (manage_projects,
+*      manage_definitions) silently drop because `actingOrgId` resolves to
+*      undefined.
+*
+* Cookie/redirect are the caller's job since they vary by capability (OAuth
+* has refresh tokens, magic-link does sometimes, SAML doesn't).
+*/
+async function bootstrapUserSession(user) {
+	await getDataProvider().ensureUser(SYSTEM_CONTEXT, user.id);
+	const tenancy = getTenancy();
+	const perms = getPermissionStore();
+	const hasAdmin = await perms.hasInstanceAdmin(SYSTEM_CONTEXT);
+	let grantedAdminHere = false;
+	if (!hasAdmin) {
+		if (!shouldBootstrapAdmin(user, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, tenancy)) return;
+		grantedAdminHere = await perms.claimFirstInstanceAdmin(SYSTEM_CONTEXT, user.id, [...ALL_PLATFORM_PERMISSIONS]);
+		if (!grantedAdminHere) return;
+	}
+	if (tenancy !== "single") return;
+	if ((await getOrganizationProvider().listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items.length > 0) return;
+	if (!grantedAdminHere) {
+		if (!(await perms.getFor(SYSTEM_CONTEXT, user.id)).includes("instance_admin")) return;
+	}
+	await ensureSingleTenantDefaultOrg(user);
+}
+/**
+* Seeds the single default Organization + Project that `actingOrgId` needs
+* to resolve, for flows that skip `/setup` (header-auth, OAuth callback,
+* future SAML). No-op outside single-tenant mode and once any org exists.
+* Slug derives from the admin's email/displayName so the URL looks like the
+* deployment rather than a UUID; falls back to `default` for anonymous
+* UPN-only sign-ins.
+*/
+async function ensureSingleTenantDefaultOrg(user) {
+	if (getTenancy() !== "single") return;
+	const orgs = getOrganizationProvider();
+	if ((await orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items.length > 0) return;
+	const orgName = (typeof user.metadata?.displayName === "string" ? user.metadata.displayName : void 0)?.trim() || user.email?.split("@")[0]?.trim() || "Default";
+	const slug = slugify(orgName).length >= 3 ? slugify(orgName) : "default";
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const org = {
+		id: randomUUID(),
+		name: orgName,
+		slug,
+		ownerId: user.id,
+		createdBy: user.id,
+		updatedBy: user.id,
+		createdAt: now,
+		updatedAt: now,
+		deletedAt: null
+	};
+	await orgs.createOrg(SYSTEM_CONTEXT, org);
+	const projects = getProjectProvider();
+	const project = {
+		id: randomUUID(),
+		orgId: org.id,
+		name: "Default",
+		slug: "default",
+		visibility: "public",
+		ownerId: user.id,
+		createdBy: user.id,
+		updatedBy: user.id,
+		autoJoinOnUpload: false,
+		createdAt: now,
+		updatedAt: now,
+		deletedAt: null
+	};
+	await projects.createProject(SYSTEM_CONTEXT, project);
+}
+/**
+* Whether the signing-in user qualifies for the first-admin grant. Pure — no
+* I/O — so the policy is unit-testable.
+*
+* - `tenancy='single'` + no env var → first signer wins (fine for
+*   self-hosted fresh installs).
+* - `tenancy='single'` + env var set → only the named user qualifies.
+* - `tenancy='multi'` → env var REQUIRED; the named user must match the
+*   signer. Without it, the first random signup would become Selva staff.
+*
+* The env var also doubles as the break-glass recovery path when admin is
+* lost to backup restores or migration drift.
+*/
+function shouldBootstrapAdmin(user, configuredEmail, mode) {
+	const expected = configuredEmail?.trim().toLowerCase();
+	if (mode === "multi" && !expected) return false;
+	if (!expected) return true;
+	const actual = user.email?.trim().toLowerCase();
+	return !!actual && actual === expected;
+}
+/**
+* Header-auth variant of `shouldBootstrapAdmin`, used by
+* `wireHeaderAuthBootstrap` to decide whether an unrecognized UPN arriving
+* through the proxy should be auto-allowlisted as the first admin. Operates
+* on the raw UPN/email before any allowlist row exists. For Entra
+* deployments UPN ≈ email; if they differ, the proxy forwards both and we
+* prefer email when present.
+*/
+function shouldBootstrapUpn(upn, email, configuredEmail, mode) {
+	const expected = configuredEmail?.trim().toLowerCase();
+	if (mode === "multi" && !expected) return false;
+	if (!expected) return true;
+	const candidate = (email ?? upn).trim().toLowerCase();
+	return !!candidate && candidate === expected;
+}
+/**
+* Wires a bootstrap-allowlist policy onto the auth provider if it supports
+* header-auth-style first-admin bootstrapping. Idempotent — safe to call on
+* every startup; the provider holds the policy until process exit.
+*
+* Header-auth deployments can't reach `/setup` (no password form, no OAuth
+* callback), so without this the first proxy-authenticated visitor is
+* silently rejected (UPN not in allowlist) and the operator has to
+* hand-write JSON files. With it, the first visit whose UPN/email matches
+* `BOOTSTRAP_INSTANCE_ADMIN_EMAIL` is auto-allowlisted, and the immediately
+* following `bootstrapUserSession` call grants instance_admin.
+*
+* Gated by `hasInstanceAdmin` — once any admin exists, the policy returns
+* false and strict allowlist-only behavior resumes.
+*/
+function wireHeaderAuthBootstrap() {
+	const auth = getAuthProvider();
+	if (!auth.proxyAuth) return;
+	if (typeof auth.setBootstrapAllowlistPolicy !== "function") {
+		if (private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL?.trim()) getLogger().warn("BOOTSTRAP_INSTANCE_ADMIN_EMAIL is set but the installed @selvajs/header-auth-provider does not expose setBootstrapAllowlistPolicy. Upgrade the provider, or hand-seed header-allowlist.json.", { component: "auth-bootstrap" });
+		return;
+	}
+	auth.setBootstrapAllowlistPolicy(async ({ upn, email }) => {
+		if (await getPermissionStore().hasInstanceAdmin(SYSTEM_CONTEXT)) return false;
+		return shouldBootstrapUpn(upn, email, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, getTenancy());
+	});
+}
+
+export { bootstrapUserSession as b, wireHeaderAuthBootstrap as w };
+//# sourceMappingURL=auth-bootstrap.server.js-u2EwxMqS.js.map

package/build/server/chunks/chunks/auth-bootstrap.server.js-u2EwxMqS.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-bootstrap.server.js-u2EwxMqS.js","sources":["../../../../.svelte-kit/output/server/chunks/auth-bootstrap.server.js"],"sourcesContent":["import { t as private_env } from \"./shared-server.js\";\nimport { F as ALL_PLATFORM_PERMISSIONS, P as slugify, t as SYSTEM_CONTEXT } from \"./src.js\";\nimport { S as getTenancy, f as getLogger, g as getPermissionStore, h as getOrganizationProvider, o as getDataProvider, r as getAuthProvider, v as getProjectProvider } from \"./providers.server.js\";\nimport { randomUUID } from \"node:crypto\";\n//#region src/lib/server/auth-bootstrap.server.ts\n/**\n* Shared post-verification flow used by every IdP-callback route (OAuth,\n* email link, future SAML, …). Order matters:\n*\n*   1. `data.ensureUser` — guarantee a user-data row exists for whatever ID\n*      the auth provider issued. Local-provider creates a JSON row;\n*      Supabase no-ops (its DB trigger has already fired).\n*   2. Bootstrap-admin grant — if no instance_admin exists yet AND the\n*      tenancy/env policy allows it, grant the signing-in user every\n*      platform permission so `/admin` becomes reachable.\n*   3. Single-tenant org seed — create the default Organization + Project\n*      owned by the new admin, mirroring what `/setup` does for password\n*      auth. Without this, org-scoped permissions (manage_projects,\n*      manage_definitions) silently drop because `actingOrgId` resolves to\n*      undefined.\n*\n* Cookie/redirect are the caller's job since they vary by capability (OAuth\n* has refresh tokens, magic-link does sometimes, SAML doesn't).\n*/\nasync function bootstrapUserSession(user) {\n\tawait getDataProvider().ensureUser(SYSTEM_CONTEXT, user.id);\n\tconst tenancy = getTenancy();\n\tconst perms = getPermissionStore();\n\tconst hasAdmin = await perms.hasInstanceAdmin(SYSTEM_CONTEXT);\n\tlet grantedAdminHere = false;\n\tif (!hasAdmin) {\n\t\tif (!shouldBootstrapAdmin(user, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, tenancy)) return;\n\t\tgrantedAdminHere = await perms.claimFirstInstanceAdmin(SYSTEM_CONTEXT, user.id, [...ALL_PLATFORM_PERMISSIONS]);\n\t\tif (!grantedAdminHere) return;\n\t}\n\tif (tenancy !== \"single\") return;\n\tif ((await getOrganizationProvider().listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items.length > 0) return;\n\tif (!grantedAdminHere) {\n\t\tif (!(await perms.getFor(SYSTEM_CONTEXT, user.id)).includes(\"instance_admin\")) return;\n\t}\n\tawait ensureSingleTenantDefaultOrg(user);\n}\n/**\n* Seeds the single default Organization + Project that `actingOrgId` needs\n* to resolve, for flows that skip `/setup` (header-auth, OAuth callback,\n* future SAML). No-op outside single-tenant mode and once any org exists.\n* Slug derives from the admin's email/displayName so the URL looks like the\n* deployment rather than a UUID; falls back to `default` for anonymous\n* UPN-only sign-ins.\n*/\nasync function ensureSingleTenantDefaultOrg(user) {\n\tif (getTenancy() !== \"single\") return;\n\tconst orgs = getOrganizationProvider();\n\tif ((await orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items.length > 0) return;\n\tconst orgName = (typeof user.metadata?.displayName === \"string\" ? user.metadata.displayName : void 0)?.trim() || user.email?.split(\"@\")[0]?.trim() || \"Default\";\n\tconst slug = slugify(orgName).length >= 3 ? slugify(orgName) : \"default\";\n\tconst now = (/* @__PURE__ */ new Date()).toISOString();\n\tconst org = {\n\t\tid: randomUUID(),\n\t\tname: orgName,\n\t\tslug,\n\t\townerId: user.id,\n\t\tcreatedBy: user.id,\n\t\tupdatedBy: user.id,\n\t\tcreatedAt: now,\n\t\tupdatedAt: now,\n\t\tdeletedAt: null\n\t};\n\tawait orgs.createOrg(SYSTEM_CONTEXT, org);\n\tconst projects = getProjectProvider();\n\tconst project = {\n\t\tid: randomUUID(),\n\t\torgId: org.id,\n\t\tname: \"Default\",\n\t\tslug: \"default\",\n\t\tvisibility: \"public\",\n\t\townerId: user.id,\n\t\tcreatedBy: user.id,\n\t\tupdatedBy: user.id,\n\t\tautoJoinOnUpload: false,\n\t\tcreatedAt: now,\n\t\tupdatedAt: now,\n\t\tdeletedAt: null\n\t};\n\tawait projects.createProject(SYSTEM_CONTEXT, project);\n}\n/**\n* Whether the signing-in user qualifies for the first-admin grant. Pure — no\n* I/O — so the policy is unit-testable.\n*\n* - `tenancy='single'` + no env var → first signer wins (fine for\n*   self-hosted fresh installs).\n* - `tenancy='single'` + env var set → only the named user qualifies.\n* - `tenancy='multi'` → env var REQUIRED; the named user must match the\n*   signer. Without it, the first random signup would become Selva staff.\n*\n* The env var also doubles as the break-glass recovery path when admin is\n* lost to backup restores or migration drift.\n*/\nfunction shouldBootstrapAdmin(user, configuredEmail, mode) {\n\tconst expected = configuredEmail?.trim().toLowerCase();\n\tif (mode === \"multi\" && !expected) return false;\n\tif (!expected) return true;\n\tconst actual = user.email?.trim().toLowerCase();\n\treturn !!actual && actual === expected;\n}\n/**\n* Header-auth variant of `shouldBootstrapAdmin`, used by\n* `wireHeaderAuthBootstrap` to decide whether an unrecognized UPN arriving\n* through the proxy should be auto-allowlisted as the first admin. Operates\n* on the raw UPN/email before any allowlist row exists. For Entra\n* deployments UPN ≈ email; if they differ, the proxy forwards both and we\n* prefer email when present.\n*/\nfunction shouldBootstrapUpn(upn, email, configuredEmail, mode) {\n\tconst expected = configuredEmail?.trim().toLowerCase();\n\tif (mode === \"multi\" && !expected) return false;\n\tif (!expected) return true;\n\tconst candidate = (email ?? upn).trim().toLowerCase();\n\treturn !!candidate && candidate === expected;\n}\n/**\n* Wires a bootstrap-allowlist policy onto the auth provider if it supports\n* header-auth-style first-admin bootstrapping. Idempotent — safe to call on\n* every startup; the provider holds the policy until process exit.\n*\n* Header-auth deployments can't reach `/setup` (no password form, no OAuth\n* callback), so without this the first proxy-authenticated visitor is\n* silently rejected (UPN not in allowlist) and the operator has to\n* hand-write JSON files. With it, the first visit whose UPN/email matches\n* `BOOTSTRAP_INSTANCE_ADMIN_EMAIL` is auto-allowlisted, and the immediately\n* following `bootstrapUserSession` call grants instance_admin.\n*\n* Gated by `hasInstanceAdmin` — once any admin exists, the policy returns\n* false and strict allowlist-only behavior resumes.\n*/\nfunction wireHeaderAuthBootstrap() {\n\tconst auth = getAuthProvider();\n\tif (!auth.proxyAuth) return;\n\tif (typeof auth.setBootstrapAllowlistPolicy !== \"function\") {\n\t\tif (private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL?.trim()) getLogger().warn(\"BOOTSTRAP_INSTANCE_ADMIN_EMAIL is set but the installed @selvajs/header-auth-provider does not expose setBootstrapAllowlistPolicy. Upgrade the provider, or hand-seed header-allowlist.json.\", { component: \"auth-bootstrap\" });\n\t\treturn;\n\t}\n\tauth.setBootstrapAllowlistPolicy(async ({ upn, email }) => {\n\t\tif (await getPermissionStore().hasInstanceAdmin(SYSTEM_CONTEXT)) return false;\n\t\treturn shouldBootstrapUpn(upn, email, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, getTenancy());\n\t});\n}\n//#endregion\nexport { wireHeaderAuthBootstrap as n, bootstrapUserSession as t };\n"],"names":[],"mappings":";;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,oBAAoB,CAAC,IAAI,EAAE;AAC1C,CAAC,MAAM,eAAe,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAC5D,CAAC,MAAM,OAAO,GAAG,UAAU,EAAE;AAC7B,CAAC,MAAM,KAAK,GAAG,kBAAkB,EAAE;AACnC,CAAC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,cAAc,CAAC;AAC9D,CAAC,IAAI,gBAAgB,GAAG,KAAK;AAC7B,CAAC,IAAI,CAAC,QAAQ,EAAE;AAChB,EAAE,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,WAAW,CAAC,8BAA8B,EAAE,OAAO,CAAC,EAAE;AACxF,EAAE,gBAAgB,GAAG,MAAM,KAAK,CAAC,uBAAuB,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,wBAAwB,CAAC,CAAC;AAChH,EAAE,IAAI,CAAC,gBAAgB,EAAE;AACzB,CAAC;AACD,CAAC,IAAI,OAAO,KAAK,QAAQ,EAAE;AAC3B,CAAC,IAAI,CAAC,MAAM,uBAAuB,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;AAChG,CAAC,IAAI,CAAC,gBAAgB,EAAE;AACxB,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE;AACjF,CAAC;AACD,CAAC,MAAM,4BAA4B,CAAC,IAAI,CAAC;AACzC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,4BAA4B,CAAC,IAAI,EAAE;AAClD,CAAC,IAAI,UAAU,EAAE,KAAK,QAAQ,EAAE;AAChC,CAAC,MAAM,IAAI,GAAG,uBAAuB,EAAE;AACvC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;AAC3E,CAAC,MAAM,OAAO,GAAG,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,WAAW,KAAK,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,GAAG,MAAM,GAAG,IAAI,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS;AAChK,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS;AACzE,CAAC,MAAM,GAAG,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACvD,CAAC,MAAM,GAAG,GAAG;AACb,EAAE,EAAE,EAAE,UAAU,EAAE;AAClB,EAAE,IAAI,EAAE,OAAO;AACf,EAAE,IAAI;AACN,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;AAClB,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;AACpB,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;AACpB,EAAE,SAAS,EAAE,GAAG;AAChB,EAAE,SAAS,EAAE,GAAG;AAChB,EAAE,SAAS,EAAE;AACb,EAAE;AACF,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,CAAC;AAC1C,CAAC,MAAM,QAAQ,GAAG,kBAAkB,EAAE;AACtC,CAAC,MAAM,OAAO,GAAG;AACjB,EAAE,EAAE,EAAE,UAAU,EAAE;AAClB,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE;AACf,EAAE,IAAI,EAAE,SAAS;AACjB,EAAE,IAAI,EAAE,SAAS;AACjB,EAAE,UAAU,EAAE,QAAQ;AACtB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;AAClB,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;AACpB,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;AACpB,EAAE,gBAAgB,EAAE,KAAK;AACzB,EAAE,SAAS,EAAE,GAAG;AAChB,EAAE,SAAS,EAAE,GAAG;AAChB,EAAE,SAAS,EAAE;AACb,EAAE;AACF,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,cAAc,EAAE,OAAO,CAAC;AACtD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,oBAAoB,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE;AAC3D,CAAC,MAAM,QAAQ,GAAG,eAAe,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACvD,CAAC,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,KAAK;AAChD,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI;AAC3B,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AAChD,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,MAAM,KAAK,QAAQ;AACvC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE;AAC/D,CAAC,MAAM,QAAQ,GAAG,eAAe,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACvD,CAAC,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,KAAK;AAChD,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI;AAC3B,CAAC,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACtD,CAAC,OAAO,CAAC,CAAC,SAAS,IAAI,SAAS,KAAK,QAAQ;AAC7C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,uBAAuB,GAAG;AACnC,CAAC,MAAM,IAAI,GAAG,eAAe,EAAE;AAC/B,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;AACtB,CAAC,IAAI,OAAO,IAAI,CAAC,2BAA2B,KAAK,UAAU,EAAE;AAC7D,EAAE,IAAI,WAAW,CAAC,8BAA8B,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,8LAA8L,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC;AAC3S,EAAE;AACF,CAAC;AACD,CAAC,IAAI,CAAC,2BAA2B,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK;AAC5D,EAAE,IAAI,MAAM,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,OAAO,KAAK;AAC/E,EAAE,OAAO,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,CAAC,8BAA8B,EAAE,UAAU,EAAE,CAAC;AACjG,CAAC,CAAC,CAAC;AACH;;;;"}

package/build/server/chunks/chunks/badge.js-BHpX0wbI.js

@@ -0,0 +1,35 @@
+import { aq as element, al as attributes, am as clsx$1, at as bind_props } from './server.js-CUv4onuj.js';
+import { c as cn } from './utils2.js-D4hQ3EdJ.js';
+import { tv } from 'tailwind-variants';
+
+//#region ../ui/dist/components/primitives/badge/badge.svelte
+var badgeVariants = tv({
+	base: "focus-visible:border-ring focus-visible:ring-ring/50 aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive inline-flex w-fit shrink-0 items-center justify-center gap-1 overflow-hidden rounded-full border px-2 py-0.5 text-xs font-medium whitespace-nowrap transition focus-visible:ring-3 [&>svg]:pointer-events-none [&>svg]:size-3",
+	variants: { variant: {
+		default: "bg-primary text-primary-foreground [a&]:hover:bg-primary/90 border-transparent",
+		secondary: "bg-secondary text-secondary-foreground [a&]:hover:bg-secondary/90 border-transparent",
+		destructive: "bg-destructive [a&]:hover:bg-destructive/90 focus-visible:ring-destructive/20 dark:focus-visible:ring-destructive/40 dark:bg-destructive/70 border-transparent text-destructive-foreground",
+		outline: "text-foreground [a&]:hover:bg-accent [a&]:hover:text-accent-foreground"
+	} },
+	defaultVariants: { variant: "default" }
+});
+function Badge($$renderer, $$props) {
+	$$renderer.component(($$renderer) => {
+		let { ref = null, href, class: className, variant = "default", children, $$slots, $$events, ...restProps } = $$props;
+		element($$renderer, href ? "a" : "span", () => {
+			$$renderer.push(`${attributes({
+				"data-slot": "badge",
+				href,
+				class: clsx$1(cn(badgeVariants({ variant }), className)),
+				...restProps
+			})}`);
+		}, () => {
+			children?.($$renderer);
+			$$renderer.push(`<!---->`);
+		});
+		bind_props($$props, { ref });
+	});
+}
+
+export { Badge as B };
+//# sourceMappingURL=badge.js-BHpX0wbI.js.map

package/build/server/chunks/chunks/badge.js-BHpX0wbI.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"badge.js-BHpX0wbI.js","sources":["../../../../.svelte-kit/output/server/chunks/badge.js"],"sourcesContent":["import { O as clsx, i as bind_props, o as element, r as attributes } from \"./server.js\";\nimport { t as cn } from \"./utils2.js\";\nimport { tv } from \"tailwind-variants\";\n//#region ../ui/dist/components/primitives/badge/badge.svelte\nvar badgeVariants = tv({\n\tbase: \"focus-visible:border-ring focus-visible:ring-ring/50 aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive inline-flex w-fit shrink-0 items-center justify-center gap-1 overflow-hidden rounded-full border px-2 py-0.5 text-xs font-medium whitespace-nowrap transition focus-visible:ring-3 [&>svg]:pointer-events-none [&>svg]:size-3\",\n\tvariants: { variant: {\n\t\tdefault: \"bg-primary text-primary-foreground [a&]:hover:bg-primary/90 border-transparent\",\n\t\tsecondary: \"bg-secondary text-secondary-foreground [a&]:hover:bg-secondary/90 border-transparent\",\n\t\tdestructive: \"bg-destructive [a&]:hover:bg-destructive/90 focus-visible:ring-destructive/20 dark:focus-visible:ring-destructive/40 dark:bg-destructive/70 border-transparent text-destructive-foreground\",\n\t\toutline: \"text-foreground [a&]:hover:bg-accent [a&]:hover:text-accent-foreground\"\n\t} },\n\tdefaultVariants: { variant: \"default\" }\n});\nfunction Badge($$renderer, $$props) {\n\t$$renderer.component(($$renderer) => {\n\t\tlet { ref = null, href, class: className, variant = \"default\", children, $$slots, $$events, ...restProps } = $$props;\n\t\telement($$renderer, href ? \"a\" : \"span\", () => {\n\t\t\t$$renderer.push(`${attributes({\n\t\t\t\t\"data-slot\": \"badge\",\n\t\t\t\thref,\n\t\t\t\tclass: clsx(cn(badgeVariants({ variant }), className)),\n\t\t\t\t...restProps\n\t\t\t})}`);\n\t\t}, () => {\n\t\t\tchildren?.($$renderer);\n\t\t\t$$renderer.push(`<!---->`);\n\t\t});\n\t\tbind_props($$props, { ref });\n\t});\n}\n//#endregion\nexport { Badge as t };\n"],"names":["clsx"],"mappings":";;;;AAGA;AACA,IAAI,aAAa,GAAG,EAAE,CAAC;AACvB,CAAC,IAAI,EAAE,2XAA2X;AAClY,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE;AACtB,EAAE,OAAO,EAAE,gFAAgF;AAC3F,EAAE,SAAS,EAAE,sFAAsF;AACnG,EAAE,WAAW,EAAE,4LAA4L;AAC3M,EAAE,OAAO,EAAE;AACX,EAAE,EAAE;AACJ,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,SAAS;AACtC,CAAC,CAAC;AACF,SAAS,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE;AACpC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,UAAU,KAAK;AACtC,EAAE,IAAI,EAAE,GAAG,GAAG,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,GAAG,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,SAAS,EAAE,GAAG,OAAO;AACtH,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,GAAG,GAAG,GAAG,MAAM,EAAE,MAAM;AACjD,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC;AACjC,IAAI,WAAW,EAAE,OAAO;AACxB,IAAI,IAAI;AACR,IAAI,KAAK,EAAEA,MAAI,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;AAC1D,IAAI,GAAG;AACP,IAAI,CAAC,CAAC,CAAC,CAAC;AACR,EAAE,CAAC,EAAE,MAAM;AACX,GAAG,QAAQ,GAAG,UAAU,CAAC;AACzB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;AAC7B,EAAE,CAAC,CAAC;AACJ,EAAE,UAAU,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC;AAC9B,CAAC,CAAC,CAAC;AACH;;;;"}

package/build/server/chunks/chunks/bootHealth.server.js-C6xcXGBk.js

@@ -0,0 +1,90 @@
+import { p as providers, g as getLogger } from './providers.server.js-DNVO4BPz.js';
+import { r as renderThrown } from './definitions.js-niXE0HY4.js';
+
+//#region src/lib/server/bootHealth.server.ts
+var cached = null;
+var inflight = null;
+async function run() {
+	let atRestSecrets = null;
+	const store = providers.data.computeServer;
+	if (typeof store.verifySecrets === "function") try {
+		atRestSecrets = await store.verifySecrets();
+	} catch (err) {
+		getLogger().error("verifySecrets threw — treating as failure", {
+			component: "boot",
+			err: renderThrown(err)
+		});
+		atRestSecrets = {
+			ok: false,
+			plaintextFound: false,
+			failures: [{
+				serverId: "(unknown)",
+				serverLabel: "(unknown)",
+				reason: "key_mismatch",
+				cause: err instanceof Error ? err.message : String(err)
+			}]
+		};
+	}
+	if (atRestSecrets && !atRestSecrets.ok) {
+		for (const f of atRestSecrets.failures) getLogger().error("At-rest secret verification failed for compute server", {
+			component: "boot",
+			serverLabel: f.serverLabel,
+			serverId: f.serverId,
+			reason: f.reason,
+			cause: f.cause
+		});
+		getLogger().error("At-rest secret verification failed. /api/health will return 503. Recover by re-entering the affected apiKeys via /admin/compute, or by restoring the original SELVA_AT_REST_KEY. See docs/Troubleshooting.md.", { component: "boot" });
+	}
+	let schemaVersion = null;
+	const data = providers.data;
+	if (typeof data.verifySchemaVersion === "function") try {
+		schemaVersion = await data.verifySchemaVersion();
+	} catch (err) {
+		getLogger().error("verifySchemaVersion threw — treating as failure", {
+			component: "boot",
+			err: renderThrown(err)
+		});
+		schemaVersion = {
+			ok: false,
+			expected: "(unknown)",
+			actual: null,
+			message: err instanceof Error ? err.message : String(err)
+		};
+	}
+	if (schemaVersion && !schemaVersion.ok) getLogger().error("Database schema handshake failed. /api/health will return 503.", {
+		component: "boot",
+		expected: schemaVersion.expected,
+		actual: schemaVersion.actual ?? "unavailable",
+		detail: schemaVersion.message
+	});
+	return {
+		checkedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		atRestSecrets,
+		schemaVersion
+	};
+}
+/**
+* Runs the underlying checks at most once — subsequent callers receive the
+* same result; in-flight callers share a single promise. Does NOT auto-refresh
+* after an operator fixes the underlying issue — restart the process to
+* re-run the boot check. That's deliberate: boot health represents the state
+* at boot, by definition.
+*/
+function getBootHealth() {
+	if (cached) return Promise.resolve(cached);
+	if (inflight) return inflight;
+	inflight = run().then((result) => {
+		cached = result;
+		inflight = null;
+		return result;
+	});
+	return inflight;
+}
+function isDegraded(report) {
+	if (report.atRestSecrets !== null && !report.atRestSecrets.ok) return true;
+	if (report.schemaVersion !== null && !report.schemaVersion.ok) return true;
+	return false;
+}
+
+export { getBootHealth as g, isDegraded as i };
+//# sourceMappingURL=bootHealth.server.js-C6xcXGBk.js.map

package/build/server/chunks/chunks/bootHealth.server.js-C6xcXGBk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootHealth.server.js-C6xcXGBk.js","sources":["../../../../.svelte-kit/output/server/chunks/bootHealth.server.js"],"sourcesContent":["import { T as providers, f as getLogger } from \"./providers.server.js\";\nimport { l as renderThrown } from \"./definitions.js\";\n//#region src/lib/server/bootHealth.server.ts\nvar cached = null;\nvar inflight = null;\nasync function run() {\n\tlet atRestSecrets = null;\n\tconst store = providers.data.computeServer;\n\tif (typeof store.verifySecrets === \"function\") try {\n\t\tatRestSecrets = await store.verifySecrets();\n\t} catch (err) {\n\t\tgetLogger().error(\"verifySecrets threw — treating as failure\", {\n\t\t\tcomponent: \"boot\",\n\t\t\terr: renderThrown(err)\n\t\t});\n\t\tatRestSecrets = {\n\t\t\tok: false,\n\t\t\tplaintextFound: false,\n\t\t\tfailures: [{\n\t\t\t\tserverId: \"(unknown)\",\n\t\t\t\tserverLabel: \"(unknown)\",\n\t\t\t\treason: \"key_mismatch\",\n\t\t\t\tcause: err instanceof Error ? err.message : String(err)\n\t\t\t}]\n\t\t};\n\t}\n\tif (atRestSecrets && !atRestSecrets.ok) {\n\t\tfor (const f of atRestSecrets.failures) getLogger().error(\"At-rest secret verification failed for compute server\", {\n\t\t\tcomponent: \"boot\",\n\t\t\tserverLabel: f.serverLabel,\n\t\t\tserverId: f.serverId,\n\t\t\treason: f.reason,\n\t\t\tcause: f.cause\n\t\t});\n\t\tgetLogger().error(\"At-rest secret verification failed. /api/health will return 503. Recover by re-entering the affected apiKeys via /admin/compute, or by restoring the original SELVA_AT_REST_KEY. See docs/Troubleshooting.md.\", { component: \"boot\" });\n\t}\n\tlet schemaVersion = null;\n\tconst data = providers.data;\n\tif (typeof data.verifySchemaVersion === \"function\") try {\n\t\tschemaVersion = await data.verifySchemaVersion();\n\t} catch (err) {\n\t\tgetLogger().error(\"verifySchemaVersion threw — treating as failure\", {\n\t\t\tcomponent: \"boot\",\n\t\t\terr: renderThrown(err)\n\t\t});\n\t\tschemaVersion = {\n\t\t\tok: false,\n\t\t\texpected: \"(unknown)\",\n\t\t\tactual: null,\n\t\t\tmessage: err instanceof Error ? err.message : String(err)\n\t\t};\n\t}\n\tif (schemaVersion && !schemaVersion.ok) getLogger().error(\"Database schema handshake failed. /api/health will return 503.\", {\n\t\tcomponent: \"boot\",\n\t\texpected: schemaVersion.expected,\n\t\tactual: schemaVersion.actual ?? \"unavailable\",\n\t\tdetail: schemaVersion.message\n\t});\n\treturn {\n\t\tcheckedAt: (/* @__PURE__ */ new Date()).toISOString(),\n\t\tatRestSecrets,\n\t\tschemaVersion\n\t};\n}\n/**\n* Runs the underlying checks at most once — subsequent callers receive the\n* same result; in-flight callers share a single promise. Does NOT auto-refresh\n* after an operator fixes the underlying issue — restart the process to\n* re-run the boot check. That's deliberate: boot health represents the state\n* at boot, by definition.\n*/\nfunction getBootHealth() {\n\tif (cached) return Promise.resolve(cached);\n\tif (inflight) return inflight;\n\tinflight = run().then((result) => {\n\t\tcached = result;\n\t\tinflight = null;\n\t\treturn result;\n\t});\n\treturn inflight;\n}\nfunction isDegraded(report) {\n\tif (report.atRestSecrets !== null && !report.atRestSecrets.ok) return true;\n\tif (report.schemaVersion !== null && !report.schemaVersion.ok) return true;\n\treturn false;\n}\n//#endregion\nexport { isDegraded as n, getBootHealth as t };\n"],"names":[],"mappings":";;;AAEA;AACA,IAAI,MAAM,GAAG,IAAI;AACjB,IAAI,QAAQ,GAAG,IAAI;AACnB,eAAe,GAAG,GAAG;AACrB,CAAC,IAAI,aAAa,GAAG,IAAI;AACzB,CAAC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa;AAC3C,CAAC,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,UAAU,EAAE,IAAI;AACpD,EAAE,aAAa,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;AAC7C,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,2CAA2C,EAAE;AACjE,GAAG,SAAS,EAAE,MAAM;AACpB,GAAG,GAAG,EAAE,YAAY,CAAC,GAAG;AACxB,GAAG,CAAC;AACJ,EAAE,aAAa,GAAG;AAClB,GAAG,EAAE,EAAE,KAAK;AACZ,GAAG,cAAc,EAAE,KAAK;AACxB,GAAG,QAAQ,EAAE,CAAC;AACd,IAAI,QAAQ,EAAE,WAAW;AACzB,IAAI,WAAW,EAAE,WAAW;AAC5B,IAAI,MAAM,EAAE,cAAc;AAC1B,IAAI,KAAK,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG;AAC1D,IAAI;AACJ,GAAG;AACH,CAAC;AACD,CAAC,IAAI,aAAa,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE;AACzC,EAAE,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,uDAAuD,EAAE;AACrH,GAAG,SAAS,EAAE,MAAM;AACpB,GAAG,WAAW,EAAE,CAAC,CAAC,WAAW;AAC7B,GAAG,QAAQ,EAAE,CAAC,CAAC,QAAQ;AACvB,GAAG,MAAM,EAAE,CAAC,CAAC,MAAM;AACnB,GAAG,KAAK,EAAE,CAAC,CAAC;AACZ,GAAG,CAAC;AACJ,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,+MAA+M,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC3P,CAAC;AACD,CAAC,IAAI,aAAa,GAAG,IAAI;AACzB,CAAC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI;AAC5B,CAAC,IAAI,OAAO,IAAI,CAAC,mBAAmB,KAAK,UAAU,EAAE,IAAI;AACzD,EAAE,aAAa,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE;AAClD,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,iDAAiD,EAAE;AACvE,GAAG,SAAS,EAAE,MAAM;AACpB,GAAG,GAAG,EAAE,YAAY,CAAC,GAAG;AACxB,GAAG,CAAC;AACJ,EAAE,aAAa,GAAG;AAClB,GAAG,EAAE,EAAE,KAAK;AACZ,GAAG,QAAQ,EAAE,WAAW;AACxB,GAAG,MAAM,EAAE,IAAI;AACf,GAAG,OAAO,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG;AAC3D,GAAG;AACH,CAAC;AACD,CAAC,IAAI,aAAa,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,gEAAgE,EAAE;AAC7H,EAAE,SAAS,EAAE,MAAM;AACnB,EAAE,QAAQ,EAAE,aAAa,CAAC,QAAQ;AAClC,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,IAAI,aAAa;AAC/C,EAAE,MAAM,EAAE,aAAa,CAAC;AACxB,EAAE,CAAC;AACH,CAAC,OAAO;AACR,EAAE,SAAS,EAAE,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACvD,EAAE,aAAa;AACf,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,GAAG;AACzB,CAAC,IAAI,MAAM,EAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;AAC3C,CAAC,IAAI,QAAQ,EAAE,OAAO,QAAQ;AAC9B,CAAC,QAAQ,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK;AACnC,EAAE,MAAM,GAAG,MAAM;AACjB,EAAE,QAAQ,GAAG,IAAI;AACjB,EAAE,OAAO,MAAM;AACf,CAAC,CAAC,CAAC;AACH,CAAC,OAAO,QAAQ;AAChB;AACA,SAAS,UAAU,CAAC,MAAM,EAAE;AAC5B,CAAC,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,OAAO,IAAI;AAC3E,CAAC,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,OAAO,IAAI;AAC3E,CAAC,OAAO,KAAK;AACb;;;;"}

package/build/server/chunks/chunks/building-complex.js-CC9FY878.js

@@ -0,0 +1,22 @@
+import { ai as spread_props } from './server.js-CUv4onuj.js';
+import { I as Icon } from './utils2.js-D4hQ3EdJ.js';
+
+//#region ../../node_modules/.pnpm/@lucide+svelte@1.48.0_svelte@5.57.1_@typescript-eslint+types@8.70.1_/node_modules/@lucide/svelte/dist/icons/building-complex.svelte
+function Building_complex($$renderer, $$props) {
+	let { $$slots, $$events, ...props } = $$props;
+	Icon($$renderer, spread_props([props, { icon: {
+		"name": "building-complex",
+		"size": 24,
+		"node": [
+			["path", { "d": "M10 12h4" }],
+			["path", { "d": "M10 8h4" }],
+			["path", { "d": "M14 21v-3a2 2 0 0 0-4 0v3" }],
+			["path", { "d": "M6 10H4a2 2 0 0 0-2 2v7a2 2 0 0 0 2 2h16a2 2 0 0 0 2-2V9a2 2 0 0 0-2-2h-2" }],
+			["path", { "d": "M6 21V5a2 2 0 0 1 2-2h8a2 2 0 0 1 2 2v16" }]
+		],
+		"aliases": ["building-2"]
+	} }]));
+}
+
+export { Building_complex as B };
+//# sourceMappingURL=building-complex.js-CC9FY878.js.map

package/build/server/chunks/chunks/building-complex.js-CC9FY878.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"building-complex.js-CC9FY878.js","sources":["../../../../.svelte-kit/output/server/chunks/building-complex.js"],"sourcesContent":["import { d as spread_props } from \"./server.js\";\nimport { n as Icon } from \"./utils2.js\";\n//#region ../../node_modules/.pnpm/@lucide+svelte@1.48.0_svelte@5.57.1_@typescript-eslint+types@8.70.1_/node_modules/@lucide/svelte/dist/icons/building-complex.svelte\nfunction Building_complex($$renderer, $$props) {\n\tlet { $$slots, $$events, ...props } = $$props;\n\tIcon($$renderer, spread_props([props, { icon: {\n\t\t\"name\": \"building-complex\",\n\t\t\"size\": 24,\n\t\t\"node\": [\n\t\t\t[\"path\", { \"d\": \"M10 12h4\" }],\n\t\t\t[\"path\", { \"d\": \"M10 8h4\" }],\n\t\t\t[\"path\", { \"d\": \"M14 21v-3a2 2 0 0 0-4 0v3\" }],\n\t\t\t[\"path\", { \"d\": \"M6 10H4a2 2 0 0 0-2 2v7a2 2 0 0 0 2 2h16a2 2 0 0 0 2-2V9a2 2 0 0 0-2-2h-2\" }],\n\t\t\t[\"path\", { \"d\": \"M6 21V5a2 2 0 0 1 2-2h8a2 2 0 0 1 2 2v16\" }]\n\t\t],\n\t\t\"aliases\": [\"building-2\"]\n\t} }]));\n}\n//#endregion\nexport { Building_complex as t };\n"],"names":[],"mappings":";;;AAEA;AACA,SAAS,gBAAgB,CAAC,UAAU,EAAE,OAAO,EAAE;AAC/C,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO;AAC9C,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE;AAC/C,EAAE,MAAM,EAAE,kBAAkB;AAC5B,EAAE,MAAM,EAAE,EAAE;AACZ,EAAE,MAAM,EAAE;AACV,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;AAChC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;AAC/B,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,2BAA2B,EAAE,CAAC;AACjD,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,2EAA2E,EAAE,CAAC;AACjG,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,0CAA0C,EAAE;AAC/D,GAAG;AACH,EAAE,SAAS,EAAE,CAAC,YAAY;AAC1B,EAAE,EAAE,CAAC,CAAC,CAAC;AACP;;;;"}