@selvajs/selva 4.20.0-beta.4 → 4.20.0-beta.5

package/build/server/chunks/chunks/computeRateLimit.server.js-CcaCZUeY.js

@@ -0,0 +1,31 @@
+import { b as private_env } from './shared-server.js-BGs15m2r.js';
+import { q as lazyLogger } from './providers.server.js-DNVO4BPz.js';
+import './src.js-qWxoV-ql.js';
+import './schema.js-CCefMgzX.js';
+import 'node:dns/promises';
+import 'node:net';
+import { n as createApiRateLimiter, r as resolveApiRateLimitConfig } from './api.js-BuuiOavj.js';
+import { c as createComputeRateLimiter } from './rate-limit.js-Br3luBbc.js';
+import { h as RATE_LIMIT_MAX_REQUESTS, i as RATE_LIMIT_WINDOW_MS } from './computeLimits.js-Tqunb67H.js';
+
+//#region src/lib/server/computeRateLimit.server.ts
+/**
+* App-wide instance of the compute-solve rate limiter (fixed-window, per-key,
+* process-local; `@selvajs/server`'s `createComputeRateLimiter`), wired with the
+* window + cap from `computeLimits.ts`.
+*
+* Keyed by caller — `user:{userId}` for authenticated solves, `share:{linkId}`
+* for share-token solves so anonymous consumers of one link don't share a
+* bucket with the link's owner.
+*/
+var limiter = createComputeRateLimiter({
+	windowMs: RATE_LIMIT_WINDOW_MS,
+	maxPerWindow: RATE_LIMIT_MAX_REQUESTS
+});
+function checkComputeRateLimit(key) {
+	return limiter.check(key);
+}
+var apiRateLimiter = createApiRateLimiter(resolveApiRateLimitConfig(private_env, lazyLogger));
+
+export { apiRateLimiter as a, checkComputeRateLimit as c };
+//# sourceMappingURL=computeRateLimit.server.js-CcaCZUeY.js.map

package/build/server/chunks/chunks/computeRateLimit.server.js-CcaCZUeY.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"computeRateLimit.server.js-CcaCZUeY.js","sources":["../../../../.svelte-kit/output/server/chunks/computeRateLimit.server.js"],"sourcesContent":["import { t as private_env } from \"./shared-server.js\";\nimport { w as lazyLogger } from \"./providers.server.js\";\nimport \"./compute.js\";\nimport { A as resolveApiRateLimitConfig, O as createApiRateLimiter } from \"./api.js\";\nimport { t as createComputeRateLimiter } from \"./rate-limit.js\";\nimport { c as RATE_LIMIT_WINDOW_MS, s as RATE_LIMIT_MAX_REQUESTS } from \"./computeLimits.js\";\n//#region src/lib/server/computeRateLimit.server.ts\n/**\n* App-wide instance of the compute-solve rate limiter (fixed-window, per-key,\n* process-local; `@selvajs/server`'s `createComputeRateLimiter`), wired with the\n* window + cap from `computeLimits.ts`.\n*\n* Keyed by caller — `user:{userId}` for authenticated solves, `share:{linkId}`\n* for share-token solves so anonymous consumers of one link don't share a\n* bucket with the link's owner.\n*/\nvar limiter = createComputeRateLimiter({\n\twindowMs: RATE_LIMIT_WINDOW_MS,\n\tmaxPerWindow: RATE_LIMIT_MAX_REQUESTS\n});\nfunction checkComputeRateLimit(key) {\n\treturn limiter.check(key);\n}\nvar apiRateLimiter = createApiRateLimiter(resolveApiRateLimitConfig(private_env, lazyLogger));\n//#endregion\nexport { checkComputeRateLimit as n, apiRateLimiter as t };\n"],"names":[],"mappings":";;;;;;;;;;AAMA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,OAAO,GAAG,wBAAwB,CAAC;AACvC,CAAC,QAAQ,EAAE,oBAAoB;AAC/B,CAAC,YAAY,EAAE;AACf,CAAC,CAAC;AACF,SAAS,qBAAqB,CAAC,GAAG,EAAE;AACpC,CAAC,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC;AAC1B;AACG,IAAC,cAAc,GAAG,oBAAoB,CAAC,yBAAyB,CAAC,WAAW,EAAE,UAAU,CAAC;;;;"}

package/build/server/chunks/chunks/copy.js-BpjaehKv.js

@@ -0,0 +1,22 @@
+import { ai as spread_props } from './server.js-CUv4onuj.js';
+import { I as Icon } from './utils2.js-D4hQ3EdJ.js';
+
+//#region ../../node_modules/.pnpm/@lucide+svelte@1.48.0_svelte@5.57.1_@typescript-eslint+types@8.70.1_/node_modules/@lucide/svelte/dist/icons/copy.svelte
+function Copy($$renderer, $$props) {
+	let { $$slots, $$events, ...props } = $$props;
+	Icon($$renderer, spread_props([props, { icon: {
+		"name": "copy",
+		"size": 24,
+		"node": [["rect", {
+			"width": "14",
+			"height": "14",
+			"x": "8",
+			"y": "8",
+			"rx": "2",
+			"ry": "2"
+		}], ["path", { "d": "M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2" }]]
+	} }]));
+}
+
+export { Copy as C };
+//# sourceMappingURL=copy.js-BpjaehKv.js.map

package/build/server/chunks/chunks/copy.js-BpjaehKv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"copy.js-BpjaehKv.js","sources":["../../../../.svelte-kit/output/server/chunks/copy.js"],"sourcesContent":["import { d as spread_props } from \"./server.js\";\nimport { n as Icon } from \"./utils2.js\";\n//#region ../../node_modules/.pnpm/@lucide+svelte@1.48.0_svelte@5.57.1_@typescript-eslint+types@8.70.1_/node_modules/@lucide/svelte/dist/icons/copy.svelte\nfunction Copy($$renderer, $$props) {\n\tlet { $$slots, $$events, ...props } = $$props;\n\tIcon($$renderer, spread_props([props, { icon: {\n\t\t\"name\": \"copy\",\n\t\t\"size\": 24,\n\t\t\"node\": [[\"rect\", {\n\t\t\t\"width\": \"14\",\n\t\t\t\"height\": \"14\",\n\t\t\t\"x\": \"8\",\n\t\t\t\"y\": \"8\",\n\t\t\t\"rx\": \"2\",\n\t\t\t\"ry\": \"2\"\n\t\t}], [\"path\", { \"d\": \"M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2\" }]]\n\t} }]));\n}\n//#endregion\nexport { Copy as t };\n"],"names":[],"mappings":";;;AAEA;AACA,SAAS,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE;AACnC,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO;AAC9C,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE;AAC/C,EAAE,MAAM,EAAE,MAAM;AAChB,EAAE,MAAM,EAAE,EAAE;AACZ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;AACpB,GAAG,OAAO,EAAE,IAAI;AAChB,GAAG,QAAQ,EAAE,IAAI;AACjB,GAAG,GAAG,EAAE,GAAG;AACX,GAAG,GAAG,EAAE,GAAG;AACX,GAAG,IAAI,EAAE,GAAG;AACZ,GAAG,IAAI,EAAE;AACT,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,yDAAyD,EAAE,CAAC;AAClF,EAAE,EAAE,CAAC,CAAC,CAAC;AACP;;;;"}

package/build/server/chunks/chunks/definitions.js-niXE0HY4.js

@@ -0,0 +1,492 @@
+import { S as SYSTEM_CONTEXT, o as outsideTokenOrg, P as ProviderError } from './src.js-qWxoV-ql.js';
+import { c as canView, p as projectAccessInputFromRowsWith } from './access.js-DfErwlEj.js';
+import { f as fetchSchemaFromCompute, N as NoopLogger } from './schema-extraction.js-BPImouBL.js';
+import './schema.js-CCefMgzX.js';
+import { randomUUID } from 'node:crypto';
+
+//#region ../platform/src/definitions/paths.ts
+/**
+* Path-segment safety check. Blocks traversal, separators, NUL, and empty
+* segments. Allowed alphabet `[A-Za-z0-9._-]+` covers GUIDs and sanitized
+* refs. Called by every helper so a malicious `guid` can't escape the
+* `definitions/` prefix.
+*/
+function assertSafeKey(value, label) {
+	if (!value || !/^[A-Za-z0-9._-]+$/.test(value) || value === "." || value === "..") throw new Error(`Unsafe ${label}: ${JSON.stringify(value)}`);
+}
+var definitionPaths = {
+	version: (guid, versionNumber, ext) => {
+		assertSafeKey(guid, "guid");
+		if (!Number.isInteger(versionNumber) || versionNumber < 1) throw new Error(`Unsafe versionNumber: ${versionNumber}`);
+		return `definitions/${guid}/versions/v${versionNumber}.${ext}`;
+	},
+	image: (guid) => {
+		assertSafeKey(guid, "guid");
+		return `definitions/${guid}/cover.webp`;
+	},
+	prefix: (guid) => {
+		assertSafeKey(guid, "guid");
+		return `definitions/${guid}/`;
+	}
+};
+//#endregion
+//#region ../server/src/logging/requestId.ts
+/**
+* Request-id resolution for log correlation. Every record on a request path
+* carries the same `requestId`, so an operator handed one id can reconstruct
+* that request's whole story.
+*
+* Inbound ids are TRUSTED when present. Selva runs behind a reverse proxy
+* (Caddy/nginx) that mints a request id for its own access logs; minting a
+* second one here would split one request across two ids and kill cross-tier
+* correlation. The trade — a direct caller picks their own id — is fine, because
+* the id is only ever a log field and an echoed response header, never an
+* authorization or uniqueness input.
+*
+* That trust is why {@link sanitizeRequestId} exists: an attacker-chosen id is
+* untrusted content. Unbounded or newline-carrying values would let a caller
+* forge log lines (log injection) or bloat every record on the request.
+*/
+/** Header carrying a caller/proxy-supplied id. The de-facto standard spelling. */
+var REQUEST_ID_HEADER = "x-request-id";
+/** Long enough for a UUID or a W3C trace-id, short enough to bound a record. */
+var MAX_REQUEST_ID_LENGTH = 128;
+/**
+* Characters allowed through verbatim. Strict on purpose: UUIDs, ULIDs, hex
+* trace-ids and nginx's `$request_id` all fit. Everything else — whitespace,
+* control chars, quotes, CR/LF — is dropped rather than escaped, since no
+* legitimate id needs them and dropping can't be un-escaped downstream.
+*/
+var UNSAFE_REQUEST_ID_CHARS = /[^A-Za-z0-9._:-]/g;
+/** Returns `null` when nothing usable survives, so the caller generates instead. */
+function sanitizeRequestId(raw) {
+	if (!raw) return null;
+	const cleaned = raw.replace(UNSAFE_REQUEST_ID_CHARS, "").slice(0, MAX_REQUEST_ID_LENGTH);
+	return cleaned.length > 0 ? cleaned : null;
+}
+/**
+* Reuse the proxy's id when it survives sanitization, otherwise mint a UUID.
+*
+* @param generate injectable so tests get deterministic ids
+*/
+function resolveRequestId(headers, generate = randomId) {
+	return sanitizeRequestId(headers.get("x-request-id")) ?? generate();
+}
+/**
+* Render a thrown value into a log field.
+*
+* Not every rejection is an `Error` — provider adapters sometimes reject with a
+* plain `{ message, status }`, which would stringify to a useless
+* `[object Object]` and destroy the only record of the failure. Errors keep
+* their stack; anything else is JSON-serialized, with `String()` as the last
+* resort for cycles and exotic values.
+*
+* A `code` / `statusCode` carried on the error (ComputeError, ProviderError,
+* Node's ECONNREFUSED-style errors) is appended as a `[code=… status=…]` tag —
+* it classifies the failure and stacks alone don't show it.
+*/
+function renderThrown(error) {
+	if (error instanceof Error) {
+		const base = error.stack ?? error.message;
+		const code = error.code;
+		const statusCode = error.statusCode;
+		const tags = [];
+		if (typeof code === "string" || typeof code === "number") tags.push(`code=${code}`);
+		if (typeof statusCode === "number") tags.push(`status=${statusCode}`);
+		return tags.length > 0 ? `${base} [${tags.join(" ")}]` : base;
+	}
+	try {
+		return JSON.stringify(error) ?? String(error);
+	} catch {
+		return String(error);
+	}
+}
+/**
+* `crypto.randomUUID` exists in every runtime Selva targets (Node 22+, workers,
+* modern browsers); the `Math.random` branch only covers non-secure contexts
+* where it is missing. Not a weakness: these ids need to be collision-free
+* enough to correlate logs, never unguessable.
+*/
+function randomId() {
+	const c = globalThis.crypto;
+	if (c && typeof c.randomUUID === "function") return c.randomUUID();
+	return `req-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+}
+//#endregion
+//#region ../server/src/definitions/definition-service.ts
+/**
+* Orchestrates writes spanning IDataProvider + IStorageProvider. Application
+* orchestration, not platform contract — hence not in @selvajs/platform.
+*
+* Methods that write both metadata and blobs order the two so a mid-flight
+* failure leaves a state the API can still serve; those reasons sit inline at
+* each write. `publish` and `updateMeta` flip pointers/metadata only and touch
+* storage not at all.
+*/
+var DefinitionService = class {
+	data;
+	storage;
+	constructor(data, storage) {
+		this.data = data;
+		this.storage = storage;
+	}
+	async create(ctx, input, file, schema) {
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const actor = ctx.userId || input.ownerId;
+		const record = {
+			guid: input.guid,
+			projectId: input.projectId,
+			ownerId: input.ownerId,
+			createdBy: actor,
+			updatedBy: actor,
+			displayName: input.displayName,
+			description: input.description,
+			category: input.category,
+			tags: input.tags,
+			coverImage: input.coverImage,
+			computeServerId: input.computeServerId,
+			status: "pending",
+			solveCount: 0,
+			nextVersionNumber: 2,
+			liveVersionId: null,
+			draftVersionId: null,
+			createdAt: now,
+			updatedAt: now,
+			deletedAt: null
+		};
+		await this.data.definitions.create(ctx, record);
+		const versionId = randomUUID();
+		const fileKey = definitionPaths.version(input.guid, 1, input.fileExt);
+		await this.storage.put(fileKey, file, "application/octet-stream");
+		const version = {
+			id: versionId,
+			definitionId: input.guid,
+			versionNumber: 1,
+			fileExt: input.fileExt,
+			fileKey,
+			originalFilename: input.originalFilename,
+			uploadedBy: actor,
+			uploadedAt: now,
+			schema,
+			schemaExtractedAt: now
+		};
+		await this.data.definitions.createVersion(ctx, version);
+		await this.data.definitions.attachInitialVersion(ctx, input.guid, versionId);
+		return {
+			record: {
+				...record,
+				status: "draft",
+				liveVersionId: versionId,
+				draftVersionId: versionId
+			},
+			version
+		};
+	}
+	/**
+	* Advances the draft pointer only — `live` is unchanged. Use `publish` to
+	* promote.
+	*/
+	async uploadVersion(ctx, guid, file, ext, originalName, schema, changeNote) {
+		const existing = await this.data.definitions.get(ctx, guid);
+		if (!existing) throw new ProviderError(`Definition not found: ${guid}`, 404);
+		const next = await this.data.definitions.reserveNextVersionNumber(ctx, guid);
+		const versionId = randomUUID();
+		const fileKey = definitionPaths.version(guid, next, ext);
+		await this.storage.put(fileKey, file, "application/octet-stream");
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const version = {
+			id: versionId,
+			definitionId: guid,
+			versionNumber: next,
+			fileExt: ext,
+			fileKey,
+			originalFilename: originalName,
+			uploadedBy: ctx.userId || existing.ownerId,
+			uploadedAt: now,
+			changeNote: changeNote?.trim() || void 0,
+			schema,
+			schemaExtractedAt: now
+		};
+		await this.data.definitions.createVersion(ctx, version);
+		await this.data.definitions.setDraftVersion(ctx, guid, versionId);
+		return version;
+	}
+	/**
+	* Moves the live channel to `versionId`, or to the current draft if omitted.
+	* Any version id is accepted, so this rolls backward as well as forward.
+	*/
+	async publish(ctx, guid, versionId) {
+		const existing = await this.data.definitions.get(ctx, guid);
+		if (!existing) throw new ProviderError(`Definition not found: ${guid}`, 404);
+		const target = versionId ?? existing.draftVersionId;
+		if (!target) throw new ProviderError("No version to publish", 400);
+		const version = await this.data.definitions.getVersion(ctx, target);
+		if (!version || version.definitionId !== guid) throw new ProviderError(`Version '${target}' not found for this definition`, 404);
+		await this.data.definitions.setLiveVersion(ctx, guid, target);
+		if (existing.status === "draft" || existing.status === "pending") await this.data.definitions.update(ctx, guid, { status: "published" });
+		return version;
+	}
+	async deleteVersion(ctx, guid, versionId) {
+		const version = await this.data.definitions.getVersion(ctx, versionId);
+		if (!version || version.definitionId !== guid) throw new ProviderError(`Version '${versionId}' not found for this definition`, 404);
+		await this.data.definitions.deleteVersion(ctx, versionId);
+		await this.storage.delete(version.fileKey);
+	}
+	async updateMeta(ctx, guid, patch) {
+		await this.data.definitions.update(ctx, guid, patch);
+	}
+	async saveCoverImage(ctx, guid, imageData) {
+		const path = definitionPaths.image(guid);
+		await this.storage.put(path, imageData, "image/webp");
+		const url = this.storage.getPublicUrl(path);
+		await this.data.definitions.update(ctx, guid, { coverImage: url });
+		return url;
+	}
+	async delete(ctx, guid) {
+		await this.data.definitions.delete(ctx, guid);
+		await this.storage.deletePrefix(definitionPaths.prefix(guid));
+	}
+};
+//#endregion
+//#region ../server/src/definitions/load-for-render.ts
+var DefinitionLoadError = class extends Error {
+	kind;
+	cause;
+	constructor(kind, message, cause) {
+		super(message);
+		this.kind = kind;
+		this.cause = cause;
+		this.name = "DefinitionLoadError";
+	}
+};
+/**
+* The returned loader resolves the `channel` pointer (live/draft) by default.
+* `explicitVersionId` renders an arbitrary historical version instead — the
+* caller MUST gate that behind edit permission, as with the draft channel.
+*/
+function createDefinitionLoader(deps) {
+	const { storage, definitions, projects, resolveServer, getClient, fetchSchema = fetchSchemaFromCompute, computeDebug = false, onWarn, logger = new NoopLogger() } = deps;
+	return async function loadDefinitionForRender(ctx, record, channel, explicitVersionId, options) {
+		const versionId = explicitVersionId ?? (channel === "draft" ? record.draftVersionId : record.liveVersionId);
+		if (!versionId) throw new DefinitionLoadError("data", `Definition '${record.guid}' has no ${channel} version`);
+		const version = await definitions.getVersion(ctx, versionId);
+		if (!version) throw new DefinitionLoadError("data", `version missing for '${record.guid}'`);
+		if (version.definitionId !== record.guid) throw new DefinitionLoadError("data", `version does not belong to '${record.guid}'`);
+		const definitionSource = await storage.get(version.fileKey);
+		if (!definitionSource) throw new DefinitionLoadError("data", `Definition file for '${record.guid}' not found on disk`);
+		const project = await projects.getProject(ctx, record.projectId);
+		let computeServer;
+		try {
+			computeServer = await resolveServer(ctx, project?.orgId ?? null, { definitionPin: record.computeServerId ?? null });
+		} catch (err) {
+			throw new DefinitionLoadError("missing-config", "No compute server configured for this definition", err);
+		}
+		if (options?.skipComputeDefaults) {
+			const cachedSchema = version.schema;
+			if (cachedSchema && isUsableCachedSchema(cachedSchema)) return {
+				version,
+				definitionSource,
+				computeServer,
+				schema: cachedSchema
+			};
+		}
+		let client;
+		try {
+			client = (await getClient(computeServer, { definitionGuid: record.guid })).client;
+		} catch (err) {
+			throw new DefinitionLoadError("connect", `Failed to connect to Rhino Compute server: ${err instanceof Error ? err.message : String(err)}`, err);
+		}
+		try {
+			const cachedSchema = version.schema;
+			const freshCache = cachedSchema && isUsableCachedSchema(cachedSchema) ? cachedSchema : null;
+			const [definition, fetchedSchema] = await Promise.all([client.getIO(definitionSource), freshCache ? Promise.resolve(freshCache) : fetchSchema(definitionSource, computeServer)]);
+			if (!freshCache && fetchedSchema.schemaVersion === "2.15.0") definitions.setVersionSchema(ctx, version.id, fetchedSchema).catch((err) => {
+				if (onWarn) {
+					onWarn(`[loadForRender] schema cache refresh failed for version ${version.id}: ${err instanceof Error ? err.message : String(err)}`);
+					return;
+				}
+				logger.warn("Schema cache refresh failed", {
+					component: "loadForRender",
+					versionId: version.id,
+					err: err instanceof Error ? err.stack ?? err.message : String(err)
+				});
+			});
+			if (!definition) throw new Error(`Failed to get definition IO — server returned undefined`);
+			const ioParseErrors = definition.parseErrors ?? [];
+			const ioLoadErrors = definition.loadErrors ?? [];
+			if (definition.inputs.length === 0 || ioParseErrors.length > 0 || ioLoadErrors.length > 0) {
+				const health = {
+					inputCount: definition.inputs.length,
+					outputCount: definition.outputs?.length,
+					parseErrors: ioParseErrors,
+					loadErrors: ioLoadErrors,
+					loadWarnings: definition.loadWarnings
+				};
+				if (onWarn) onWarn(`[loadForRender] IO health for '${record.guid}':`, JSON.stringify(health));
+				else logger.warn("Definition IO looks unhealthy", {
+					component: "loadForRender",
+					definitionGuid: record.guid,
+					...health
+				});
+				if (computeDebug) {
+					const rawIO = await client.getRawIO(definitionSource).catch((e) => ({ error: String(e) }));
+					const rendered = JSON.stringify(rawIO).slice(0, 3e3);
+					if (onWarn) onWarn("[loadForRender] raw /io:", rendered);
+					else logger.debug("Raw /io wire shape", {
+						component: "loadForRender",
+						definitionGuid: record.guid,
+						rawIO: rendered
+					});
+				}
+			}
+			return {
+				version,
+				definitionSource,
+				computeServer,
+				schema: mergeComputeDefaults(fetchedSchema, definition.inputs)
+			};
+		} catch (err) {
+			if (err instanceof DefinitionLoadError) throw err;
+			throw new DefinitionLoadError("schema", err instanceof Error ? err.message : String(err), err);
+		}
+	};
+}
+/**
+* A cached schema is usable only if it is BOTH the current format version and
+* structurally sound. The version check alone is not enough: a compute server
+* that serialized the schema with the wrong Newtonsoft emits PascalCase keys, so
+* `schemaVersion` reads as undefined while `SchemaVersion` holds the value —
+* and a row cached during that window would otherwise be served forever, long
+* after the server was fixed. See `assertCamelCaseSchema`.
+*/
+function isUsableCachedSchema(schema) {
+	return schema.schemaVersion === "2.15.0" && Array.isArray(schema.inputs);
+}
+function mergeComputeDefaults(schema, computeInputs) {
+	if (!Array.isArray(schema.inputs)) throw new DefinitionLoadError("schema", `Schema has no 'inputs' array (keys: ${Object.keys(schema).slice(0, 12).join(", ")}). A PascalCase shape here means compute serialized it with the wrong Newtonsoft — see assertCamelCaseSchema.`);
+	const byParamId = new Map(computeInputs.map((input) => [input.id, input]));
+	return {
+		...schema,
+		inputs: schema.inputs.map((schemaInput) => {
+			const computeInput = byParamId.get(schemaInput.id);
+			if (computeInput?.paramType === "Color" && computeInput.default !== void 0) {
+				const toHex = (value) => value.toString(16).padStart(2, "0");
+				const parts = String(computeInput.default).split(",").map((s) => parseInt(s.trim(), 10));
+				if (parts.length === 3) computeInput.default = `#${toHex(parts[0])}${toHex(parts[1])}${toHex(parts[2])}`;
+				else if (parts.length === 4) computeInput.default = `#${toHex(parts[1])}${toHex(parts[2])}${toHex(parts[3])}`;
+			}
+			if (computeInput && computeInput.default !== void 0) return {
+				...schemaInput,
+				default: computeInput.default
+			};
+			return schemaInput;
+		})
+	};
+}
+//#endregion
+//#region ../server/src/definitions/visibility.ts
+/**
+* Visibility-filtered definition reads, shared by the library page load and
+* `GET /api/v1/definitions`.
+*
+* **This is a tenancy boundary.** The project scan runs as `SYSTEM_CONTEXT` so
+* cross-org `public` projects are reachable when `ALLOW_CROSS_ORG_PUBLIC` is on;
+* `canView` over the fetched membership rows is the only thing keeping another
+* org's projects out of the result. The definition list itself is then filtered
+* *in the query* via `projectIds`, so the cursor is applied after visibility
+* rather than over a page that gets thinned afterwards.
+*
+* Cost is constant in the number of orgs and projects: three bulk membership
+* reads regardless of N. Anything added here must keep that property — a
+* per-project `await` inside a loop reintroduces the N+1 this replaced.
+*/
+/** Upper bound on the org/project scan. Visibility needs the whole set. */
+var SCAN_LIMIT = 200;
+/**
+* Resolve the caller's accessible project set in a constant number of queries.
+* Platform grants are fetched only for `platform`-visibility projects —
+* `canView` short-circuits before reading them for every other visibility.
+*/
+async function resolveAccessibleProjects(ctx, deps) {
+	const orgs = deps.orgs;
+	const projectStore = deps.projects;
+	const grantStore = deps.platformProjectGrants;
+	const orgIds = (await orgs.listOrgs(SYSTEM_CONTEXT, { limit: SCAN_LIMIT })).items.map((o) => o.id).filter((id) => !outsideTokenOrg(ctx, id));
+	const allProjects = (await Promise.all(orgIds.map((orgId) => projectStore.listProjects(SYSTEM_CONTEXT, orgId, { limit: SCAN_LIMIT })))).flatMap((p) => p.items);
+	const projectIds = allProjects.map((p) => p.id);
+	const platformProjectIds = allProjects.filter((p) => p.visibility === "platform").map((p) => p.id);
+	const [orgMemberByOrgId, memberByProjectId, grantsByProjectId] = await Promise.all([
+		orgs.getOrgMembersFor(SYSTEM_CONTEXT, orgIds, ctx.userId),
+		projectStore.getProjectMembersFor(SYSTEM_CONTEXT, projectIds, ctx.userId),
+		platformProjectIds.length ? grantStore.listByProjects(SYSTEM_CONTEXT, platformProjectIds) : Promise.resolve(/* @__PURE__ */ new Map())
+	]);
+	return {
+		projects: allProjects.filter((project) => canView(projectAccessInputFromRowsWith({ deps }, ctx, project, {
+			member: memberByProjectId.get(project.id) ?? null,
+			orgMember: orgMemberByOrgId.get(project.orgId) ?? null,
+			platformGrants: grantsByProjectId.get(project.id) ?? []
+		}))),
+		allById: new Map(allProjects.map((p) => [p.id, p])),
+		memberByProjectId,
+		orgMemberByOrgId
+	};
+}
+/**
+* `opts.projectId` narrows to one project; a caller who cannot view it gets an
+* empty page rather than a 403, so this never reveals that a project exists.
+*/
+async function listVisibleDefinitions(ctx, opts = {}, deps) {
+	const { projectId, ...listOpts } = opts;
+	const { projects } = await resolveAccessibleProjects(ctx, deps);
+	const scoped = projectId ? projects.filter((p) => p.id === projectId) : projects;
+	const page = await deps.definitionMeta.list(ctx, {
+		...listOpts,
+		projectIds: scoped.map((p) => p.id)
+	});
+	return {
+		items: page.items,
+		nextCursor: page.nextCursor,
+		projects: scoped
+	};
+}
+/**
+* One definition, or `null` when the caller cannot view its project.
+*
+* Returns `null` rather than throwing 403 so callers surface a 404: a public
+* API that answers "forbidden" for a guid the caller cannot see turns
+* `/definitions/{guid}` into a cross-tenant existence oracle.
+*/
+async function getVisibleDefinition(ctx, guid, deps) {
+	const meta = deps.definitionMeta;
+	const projectStore = deps.projects;
+	const record = await meta.get(ctx, guid);
+	if (!record) return null;
+	const project = await projectStore.getProject(SYSTEM_CONTEXT, record.projectId);
+	if (!project || outsideTokenOrg(ctx, project.orgId)) return null;
+	const [orgMembers, projectMembers, grants] = await Promise.all([
+		deps.orgs.getOrgMembersFor(SYSTEM_CONTEXT, [project.orgId], ctx.userId),
+		projectStore.getProjectMembersFor(SYSTEM_CONTEXT, [project.id], ctx.userId),
+		project.visibility === "platform" ? deps.platformProjectGrants.listByProject(SYSTEM_CONTEXT, project.id) : Promise.resolve([])
+	]);
+	return canView(projectAccessInputFromRowsWith({ deps }, ctx, project, {
+		member: projectMembers.get(project.id) ?? null,
+		orgMember: orgMembers.get(project.orgId) ?? null,
+		platformGrants: grants
+	})) ? record : null;
+}
+/**
+* One version of a definition the caller can view, including its cached
+* `schema`. `null` when the definition is invisible, the version is missing, or
+* the version belongs to a different definition — a caller must not be able to
+* read an arbitrary version by pairing it with a guid they can see.
+*/
+async function loadVisibleVersion(ctx, guid, versionId, deps) {
+	const record = await getVisibleDefinition(ctx, guid, deps);
+	if (!record) return null;
+	const version = await deps.definitionMeta.getVersion(ctx, versionId);
+	if (!version || version.definitionId !== record.guid) return null;
+	return version;
+}
+
+export { DefinitionService as D, REQUEST_ID_HEADER as R, resolveRequestId as a, DefinitionLoadError as b, createDefinitionLoader as c, resolveAccessibleProjects as d, loadVisibleVersion as e, definitionPaths as f, getVisibleDefinition as g, listVisibleDefinitions as l, renderThrown as r };
+//# sourceMappingURL=definitions.js-niXE0HY4.js.map

package/build/server/chunks/chunks/definitions.js-niXE0HY4.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"definitions.js-niXE0HY4.js","sources":["../../../../.svelte-kit/output/server/chunks/definitions.js"],"sourcesContent":["import { b as ProviderError, t as SYSTEM_CONTEXT, v as outsideTokenOrg } from \"./src.js\";\nimport { M as canView, a as projectAccessInputFromRowsWith } from \"./access.js\";\nimport { _ as NoopLogger, r as fetchSchemaFromCompute } from \"./schema-extraction.js\";\nimport \"./schema.js\";\nimport { randomUUID } from \"node:crypto\";\n//#region ../platform/src/definitions/paths.ts\n/**\n* Path-segment safety check. Blocks traversal, separators, NUL, and empty\n* segments. Allowed alphabet `[A-Za-z0-9._-]+` covers GUIDs and sanitized\n* refs. Called by every helper so a malicious `guid` can't escape the\n* `definitions/` prefix.\n*/\nfunction assertSafeKey(value, label) {\n\tif (!value || !/^[A-Za-z0-9._-]+$/.test(value) || value === \".\" || value === \"..\") throw new Error(`Unsafe ${label}: ${JSON.stringify(value)}`);\n}\nvar definitionPaths = {\n\tversion: (guid, versionNumber, ext) => {\n\t\tassertSafeKey(guid, \"guid\");\n\t\tif (!Number.isInteger(versionNumber) || versionNumber < 1) throw new Error(`Unsafe versionNumber: ${versionNumber}`);\n\t\treturn `definitions/${guid}/versions/v${versionNumber}.${ext}`;\n\t},\n\timage: (guid) => {\n\t\tassertSafeKey(guid, \"guid\");\n\t\treturn `definitions/${guid}/cover.webp`;\n\t},\n\tprefix: (guid) => {\n\t\tassertSafeKey(guid, \"guid\");\n\t\treturn `definitions/${guid}/`;\n\t}\n};\n//#endregion\n//#region ../server/src/logging/requestId.ts\n/**\n* Request-id resolution for log correlation. Every record on a request path\n* carries the same `requestId`, so an operator handed one id can reconstruct\n* that request's whole story.\n*\n* Inbound ids are TRUSTED when present. Selva runs behind a reverse proxy\n* (Caddy/nginx) that mints a request id for its own access logs; minting a\n* second one here would split one request across two ids and kill cross-tier\n* correlation. The trade — a direct caller picks their own id — is fine, because\n* the id is only ever a log field and an echoed response header, never an\n* authorization or uniqueness input.\n*\n* That trust is why {@link sanitizeRequestId} exists: an attacker-chosen id is\n* untrusted content. Unbounded or newline-carrying values would let a caller\n* forge log lines (log injection) or bloat every record on the request.\n*/\n/** Header carrying a caller/proxy-supplied id. The de-facto standard spelling. */\nvar REQUEST_ID_HEADER = \"x-request-id\";\n/** Long enough for a UUID or a W3C trace-id, short enough to bound a record. */\nvar MAX_REQUEST_ID_LENGTH = 128;\n/**\n* Characters allowed through verbatim. Strict on purpose: UUIDs, ULIDs, hex\n* trace-ids and nginx's `$request_id` all fit. Everything else — whitespace,\n* control chars, quotes, CR/LF — is dropped rather than escaped, since no\n* legitimate id needs them and dropping can't be un-escaped downstream.\n*/\nvar UNSAFE_REQUEST_ID_CHARS = /[^A-Za-z0-9._:-]/g;\n/** Returns `null` when nothing usable survives, so the caller generates instead. */\nfunction sanitizeRequestId(raw) {\n\tif (!raw) return null;\n\tconst cleaned = raw.replace(UNSAFE_REQUEST_ID_CHARS, \"\").slice(0, MAX_REQUEST_ID_LENGTH);\n\treturn cleaned.length > 0 ? cleaned : null;\n}\n/**\n* Reuse the proxy's id when it survives sanitization, otherwise mint a UUID.\n*\n* @param generate injectable so tests get deterministic ids\n*/\nfunction resolveRequestId(headers, generate = randomId) {\n\treturn sanitizeRequestId(headers.get(\"x-request-id\")) ?? generate();\n}\n/**\n* Render a thrown value into a log field.\n*\n* Not every rejection is an `Error` — provider adapters sometimes reject with a\n* plain `{ message, status }`, which would stringify to a useless\n* `[object Object]` and destroy the only record of the failure. Errors keep\n* their stack; anything else is JSON-serialized, with `String()` as the last\n* resort for cycles and exotic values.\n*\n* A `code` / `statusCode` carried on the error (ComputeError, ProviderError,\n* Node's ECONNREFUSED-style errors) is appended as a `[code=… status=…]` tag —\n* it classifies the failure and stacks alone don't show it.\n*/\nfunction renderThrown(error) {\n\tif (error instanceof Error) {\n\t\tconst base = error.stack ?? error.message;\n\t\tconst code = error.code;\n\t\tconst statusCode = error.statusCode;\n\t\tconst tags = [];\n\t\tif (typeof code === \"string\" || typeof code === \"number\") tags.push(`code=${code}`);\n\t\tif (typeof statusCode === \"number\") tags.push(`status=${statusCode}`);\n\t\treturn tags.length > 0 ? `${base} [${tags.join(\" \")}]` : base;\n\t}\n\ttry {\n\t\treturn JSON.stringify(error) ?? String(error);\n\t} catch {\n\t\treturn String(error);\n\t}\n}\n/**\n* `crypto.randomUUID` exists in every runtime Selva targets (Node 22+, workers,\n* modern browsers); the `Math.random` branch only covers non-secure contexts\n* where it is missing. Not a weakness: these ids need to be collision-free\n* enough to correlate logs, never unguessable.\n*/\nfunction randomId() {\n\tconst c = globalThis.crypto;\n\tif (c && typeof c.randomUUID === \"function\") return c.randomUUID();\n\treturn `req-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;\n}\n//#endregion\n//#region ../server/src/definitions/definition-service.ts\n/**\n* Orchestrates writes spanning IDataProvider + IStorageProvider. Application\n* orchestration, not platform contract — hence not in @selvajs/platform.\n*\n* Methods that write both metadata and blobs order the two so a mid-flight\n* failure leaves a state the API can still serve; those reasons sit inline at\n* each write. `publish` and `updateMeta` flip pointers/metadata only and touch\n* storage not at all.\n*/\nvar DefinitionService = class {\n\tdata;\n\tstorage;\n\tconstructor(data, storage) {\n\t\tthis.data = data;\n\t\tthis.storage = storage;\n\t}\n\tasync create(ctx, input, file, schema) {\n\t\tconst now = (/* @__PURE__ */ new Date()).toISOString();\n\t\tconst actor = ctx.userId || input.ownerId;\n\t\tconst record = {\n\t\t\tguid: input.guid,\n\t\t\tprojectId: input.projectId,\n\t\t\townerId: input.ownerId,\n\t\t\tcreatedBy: actor,\n\t\t\tupdatedBy: actor,\n\t\t\tdisplayName: input.displayName,\n\t\t\tdescription: input.description,\n\t\t\tcategory: input.category,\n\t\t\ttags: input.tags,\n\t\t\tcoverImage: input.coverImage,\n\t\t\tcomputeServerId: input.computeServerId,\n\t\t\tstatus: \"pending\",\n\t\t\tsolveCount: 0,\n\t\t\tnextVersionNumber: 2,\n\t\t\tliveVersionId: null,\n\t\t\tdraftVersionId: null,\n\t\t\tcreatedAt: now,\n\t\t\tupdatedAt: now,\n\t\t\tdeletedAt: null\n\t\t};\n\t\tawait this.data.definitions.create(ctx, record);\n\t\tconst versionId = randomUUID();\n\t\tconst fileKey = definitionPaths.version(input.guid, 1, input.fileExt);\n\t\tawait this.storage.put(fileKey, file, \"application/octet-stream\");\n\t\tconst version = {\n\t\t\tid: versionId,\n\t\t\tdefinitionId: input.guid,\n\t\t\tversionNumber: 1,\n\t\t\tfileExt: input.fileExt,\n\t\t\tfileKey,\n\t\t\toriginalFilename: input.originalFilename,\n\t\t\tuploadedBy: actor,\n\t\t\tuploadedAt: now,\n\t\t\tschema,\n\t\t\tschemaExtractedAt: now\n\t\t};\n\t\tawait this.data.definitions.createVersion(ctx, version);\n\t\tawait this.data.definitions.attachInitialVersion(ctx, input.guid, versionId);\n\t\treturn {\n\t\t\trecord: {\n\t\t\t\t...record,\n\t\t\t\tstatus: \"draft\",\n\t\t\t\tliveVersionId: versionId,\n\t\t\t\tdraftVersionId: versionId\n\t\t\t},\n\t\t\tversion\n\t\t};\n\t}\n\t/**\n\t* Advances the draft pointer only — `live` is unchanged. Use `publish` to\n\t* promote.\n\t*/\n\tasync uploadVersion(ctx, guid, file, ext, originalName, schema, changeNote) {\n\t\tconst existing = await this.data.definitions.get(ctx, guid);\n\t\tif (!existing) throw new ProviderError(`Definition not found: ${guid}`, 404);\n\t\tconst next = await this.data.definitions.reserveNextVersionNumber(ctx, guid);\n\t\tconst versionId = randomUUID();\n\t\tconst fileKey = definitionPaths.version(guid, next, ext);\n\t\tawait this.storage.put(fileKey, file, \"application/octet-stream\");\n\t\tconst now = (/* @__PURE__ */ new Date()).toISOString();\n\t\tconst version = {\n\t\t\tid: versionId,\n\t\t\tdefinitionId: guid,\n\t\t\tversionNumber: next,\n\t\t\tfileExt: ext,\n\t\t\tfileKey,\n\t\t\toriginalFilename: originalName,\n\t\t\tuploadedBy: ctx.userId || existing.ownerId,\n\t\t\tuploadedAt: now,\n\t\t\tchangeNote: changeNote?.trim() || void 0,\n\t\t\tschema,\n\t\t\tschemaExtractedAt: now\n\t\t};\n\t\tawait this.data.definitions.createVersion(ctx, version);\n\t\tawait this.data.definitions.setDraftVersion(ctx, guid, versionId);\n\t\treturn version;\n\t}\n\t/**\n\t* Moves the live channel to `versionId`, or to the current draft if omitted.\n\t* Any version id is accepted, so this rolls backward as well as forward.\n\t*/\n\tasync publish(ctx, guid, versionId) {\n\t\tconst existing = await this.data.definitions.get(ctx, guid);\n\t\tif (!existing) throw new ProviderError(`Definition not found: ${guid}`, 404);\n\t\tconst target = versionId ?? existing.draftVersionId;\n\t\tif (!target) throw new ProviderError(\"No version to publish\", 400);\n\t\tconst version = await this.data.definitions.getVersion(ctx, target);\n\t\tif (!version || version.definitionId !== guid) throw new ProviderError(`Version '${target}' not found for this definition`, 404);\n\t\tawait this.data.definitions.setLiveVersion(ctx, guid, target);\n\t\tif (existing.status === \"draft\" || existing.status === \"pending\") await this.data.definitions.update(ctx, guid, { status: \"published\" });\n\t\treturn version;\n\t}\n\tasync deleteVersion(ctx, guid, versionId) {\n\t\tconst version = await this.data.definitions.getVersion(ctx, versionId);\n\t\tif (!version || version.definitionId !== guid) throw new ProviderError(`Version '${versionId}' not found for this definition`, 404);\n\t\tawait this.data.definitions.deleteVersion(ctx, versionId);\n\t\tawait this.storage.delete(version.fileKey);\n\t}\n\tasync updateMeta(ctx, guid, patch) {\n\t\tawait this.data.definitions.update(ctx, guid, patch);\n\t}\n\tasync saveCoverImage(ctx, guid, imageData) {\n\t\tconst path = definitionPaths.image(guid);\n\t\tawait this.storage.put(path, imageData, \"image/webp\");\n\t\tconst url = this.storage.getPublicUrl(path);\n\t\tawait this.data.definitions.update(ctx, guid, { coverImage: url });\n\t\treturn url;\n\t}\n\tasync delete(ctx, guid) {\n\t\tawait this.data.definitions.delete(ctx, guid);\n\t\tawait this.storage.deletePrefix(definitionPaths.prefix(guid));\n\t}\n};\n//#endregion\n//#region ../server/src/definitions/load-for-render.ts\nvar DefinitionLoadError = class extends Error {\n\tkind;\n\tcause;\n\tconstructor(kind, message, cause) {\n\t\tsuper(message);\n\t\tthis.kind = kind;\n\t\tthis.cause = cause;\n\t\tthis.name = \"DefinitionLoadError\";\n\t}\n};\n/**\n* The returned loader resolves the `channel` pointer (live/draft) by default.\n* `explicitVersionId` renders an arbitrary historical version instead — the\n* caller MUST gate that behind edit permission, as with the draft channel.\n*/\nfunction createDefinitionLoader(deps) {\n\tconst { storage, definitions, projects, resolveServer, getClient, fetchSchema = fetchSchemaFromCompute, computeDebug = false, onWarn, logger = new NoopLogger() } = deps;\n\treturn async function loadDefinitionForRender(ctx, record, channel, explicitVersionId, options) {\n\t\tconst versionId = explicitVersionId ?? (channel === \"draft\" ? record.draftVersionId : record.liveVersionId);\n\t\tif (!versionId) throw new DefinitionLoadError(\"data\", `Definition '${record.guid}' has no ${channel} version`);\n\t\tconst version = await definitions.getVersion(ctx, versionId);\n\t\tif (!version) throw new DefinitionLoadError(\"data\", `version missing for '${record.guid}'`);\n\t\tif (version.definitionId !== record.guid) throw new DefinitionLoadError(\"data\", `version does not belong to '${record.guid}'`);\n\t\tconst definitionSource = await storage.get(version.fileKey);\n\t\tif (!definitionSource) throw new DefinitionLoadError(\"data\", `Definition file for '${record.guid}' not found on disk`);\n\t\tconst project = await projects.getProject(ctx, record.projectId);\n\t\tlet computeServer;\n\t\ttry {\n\t\t\tcomputeServer = await resolveServer(ctx, project?.orgId ?? null, { definitionPin: record.computeServerId ?? null });\n\t\t} catch (err) {\n\t\t\tthrow new DefinitionLoadError(\"missing-config\", \"No compute server configured for this definition\", err);\n\t\t}\n\t\tif (options?.skipComputeDefaults) {\n\t\t\tconst cachedSchema = version.schema;\n\t\t\tif (cachedSchema && isUsableCachedSchema(cachedSchema)) return {\n\t\t\t\tversion,\n\t\t\t\tdefinitionSource,\n\t\t\t\tcomputeServer,\n\t\t\t\tschema: cachedSchema\n\t\t\t};\n\t\t}\n\t\tlet client;\n\t\ttry {\n\t\t\tclient = (await getClient(computeServer, { definitionGuid: record.guid })).client;\n\t\t} catch (err) {\n\t\t\tthrow new DefinitionLoadError(\"connect\", `Failed to connect to Rhino Compute server: ${err instanceof Error ? err.message : String(err)}`, err);\n\t\t}\n\t\ttry {\n\t\t\tconst cachedSchema = version.schema;\n\t\t\tconst freshCache = cachedSchema && isUsableCachedSchema(cachedSchema) ? cachedSchema : null;\n\t\t\tconst [definition, fetchedSchema] = await Promise.all([client.getIO(definitionSource), freshCache ? Promise.resolve(freshCache) : fetchSchema(definitionSource, computeServer)]);\n\t\t\tif (!freshCache && fetchedSchema.schemaVersion === \"2.15.0\") definitions.setVersionSchema(ctx, version.id, fetchedSchema).catch((err) => {\n\t\t\t\tif (onWarn) {\n\t\t\t\t\tonWarn(`[loadForRender] schema cache refresh failed for version ${version.id}: ${err instanceof Error ? err.message : String(err)}`);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tlogger.warn(\"Schema cache refresh failed\", {\n\t\t\t\t\tcomponent: \"loadForRender\",\n\t\t\t\t\tversionId: version.id,\n\t\t\t\t\terr: err instanceof Error ? err.stack ?? err.message : String(err)\n\t\t\t\t});\n\t\t\t});\n\t\t\tif (!definition) throw new Error(`Failed to get definition IO — server returned undefined`);\n\t\t\tconst ioParseErrors = definition.parseErrors ?? [];\n\t\t\tconst ioLoadErrors = definition.loadErrors ?? [];\n\t\t\tif (definition.inputs.length === 0 || ioParseErrors.length > 0 || ioLoadErrors.length > 0) {\n\t\t\t\tconst health = {\n\t\t\t\t\tinputCount: definition.inputs.length,\n\t\t\t\t\toutputCount: definition.outputs?.length,\n\t\t\t\t\tparseErrors: ioParseErrors,\n\t\t\t\t\tloadErrors: ioLoadErrors,\n\t\t\t\t\tloadWarnings: definition.loadWarnings\n\t\t\t\t};\n\t\t\t\tif (onWarn) onWarn(`[loadForRender] IO health for '${record.guid}':`, JSON.stringify(health));\n\t\t\t\telse logger.warn(\"Definition IO looks unhealthy\", {\n\t\t\t\t\tcomponent: \"loadForRender\",\n\t\t\t\t\tdefinitionGuid: record.guid,\n\t\t\t\t\t...health\n\t\t\t\t});\n\t\t\t\tif (computeDebug) {\n\t\t\t\t\tconst rawIO = await client.getRawIO(definitionSource).catch((e) => ({ error: String(e) }));\n\t\t\t\t\tconst rendered = JSON.stringify(rawIO).slice(0, 3e3);\n\t\t\t\t\tif (onWarn) onWarn(\"[loadForRender] raw /io:\", rendered);\n\t\t\t\t\telse logger.debug(\"Raw /io wire shape\", {\n\t\t\t\t\t\tcomponent: \"loadForRender\",\n\t\t\t\t\t\tdefinitionGuid: record.guid,\n\t\t\t\t\t\trawIO: rendered\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tversion,\n\t\t\t\tdefinitionSource,\n\t\t\t\tcomputeServer,\n\t\t\t\tschema: mergeComputeDefaults(fetchedSchema, definition.inputs)\n\t\t\t};\n\t\t} catch (err) {\n\t\t\tif (err instanceof DefinitionLoadError) throw err;\n\t\t\tthrow new DefinitionLoadError(\"schema\", err instanceof Error ? err.message : String(err), err);\n\t\t}\n\t};\n}\n/**\n* A cached schema is usable only if it is BOTH the current format version and\n* structurally sound. The version check alone is not enough: a compute server\n* that serialized the schema with the wrong Newtonsoft emits PascalCase keys, so\n* `schemaVersion` reads as undefined while `SchemaVersion` holds the value —\n* and a row cached during that window would otherwise be served forever, long\n* after the server was fixed. See `assertCamelCaseSchema`.\n*/\nfunction isUsableCachedSchema(schema) {\n\treturn schema.schemaVersion === \"2.15.0\" && Array.isArray(schema.inputs);\n}\nfunction mergeComputeDefaults(schema, computeInputs) {\n\tif (!Array.isArray(schema.inputs)) throw new DefinitionLoadError(\"schema\", `Schema has no 'inputs' array (keys: ${Object.keys(schema).slice(0, 12).join(\", \")}). A PascalCase shape here means compute serialized it with the wrong Newtonsoft — see assertCamelCaseSchema.`);\n\tconst byParamId = new Map(computeInputs.map((input) => [input.id, input]));\n\treturn {\n\t\t...schema,\n\t\tinputs: schema.inputs.map((schemaInput) => {\n\t\t\tconst computeInput = byParamId.get(schemaInput.id);\n\t\t\tif (computeInput?.paramType === \"Color\" && computeInput.default !== void 0) {\n\t\t\t\tconst toHex = (value) => value.toString(16).padStart(2, \"0\");\n\t\t\t\tconst parts = String(computeInput.default).split(\",\").map((s) => parseInt(s.trim(), 10));\n\t\t\t\tif (parts.length === 3) computeInput.default = `#${toHex(parts[0])}${toHex(parts[1])}${toHex(parts[2])}`;\n\t\t\t\telse if (parts.length === 4) computeInput.default = `#${toHex(parts[1])}${toHex(parts[2])}${toHex(parts[3])}`;\n\t\t\t}\n\t\t\tif (computeInput && computeInput.default !== void 0) return {\n\t\t\t\t...schemaInput,\n\t\t\t\tdefault: computeInput.default\n\t\t\t};\n\t\t\treturn schemaInput;\n\t\t})\n\t};\n}\n//#endregion\n//#region ../server/src/definitions/visibility.ts\n/**\n* Visibility-filtered definition reads, shared by the library page load and\n* `GET /api/v1/definitions`.\n*\n* **This is a tenancy boundary.** The project scan runs as `SYSTEM_CONTEXT` so\n* cross-org `public` projects are reachable when `ALLOW_CROSS_ORG_PUBLIC` is on;\n* `canView` over the fetched membership rows is the only thing keeping another\n* org's projects out of the result. The definition list itself is then filtered\n* *in the query* via `projectIds`, so the cursor is applied after visibility\n* rather than over a page that gets thinned afterwards.\n*\n* Cost is constant in the number of orgs and projects: three bulk membership\n* reads regardless of N. Anything added here must keep that property — a\n* per-project `await` inside a loop reintroduces the N+1 this replaced.\n*/\n/** Upper bound on the org/project scan. Visibility needs the whole set. */\nvar SCAN_LIMIT = 200;\n/**\n* Resolve the caller's accessible project set in a constant number of queries.\n* Platform grants are fetched only for `platform`-visibility projects —\n* `canView` short-circuits before reading them for every other visibility.\n*/\nasync function resolveAccessibleProjects(ctx, deps) {\n\tconst orgs = deps.orgs;\n\tconst projectStore = deps.projects;\n\tconst grantStore = deps.platformProjectGrants;\n\tconst orgIds = (await orgs.listOrgs(SYSTEM_CONTEXT, { limit: SCAN_LIMIT })).items.map((o) => o.id).filter((id) => !outsideTokenOrg(ctx, id));\n\tconst allProjects = (await Promise.all(orgIds.map((orgId) => projectStore.listProjects(SYSTEM_CONTEXT, orgId, { limit: SCAN_LIMIT })))).flatMap((p) => p.items);\n\tconst projectIds = allProjects.map((p) => p.id);\n\tconst platformProjectIds = allProjects.filter((p) => p.visibility === \"platform\").map((p) => p.id);\n\tconst [orgMemberByOrgId, memberByProjectId, grantsByProjectId] = await Promise.all([\n\t\torgs.getOrgMembersFor(SYSTEM_CONTEXT, orgIds, ctx.userId),\n\t\tprojectStore.getProjectMembersFor(SYSTEM_CONTEXT, projectIds, ctx.userId),\n\t\tplatformProjectIds.length ? grantStore.listByProjects(SYSTEM_CONTEXT, platformProjectIds) : Promise.resolve(/* @__PURE__ */ new Map())\n\t]);\n\treturn {\n\t\tprojects: allProjects.filter((project) => canView(projectAccessInputFromRowsWith({ deps }, ctx, project, {\n\t\t\tmember: memberByProjectId.get(project.id) ?? null,\n\t\t\torgMember: orgMemberByOrgId.get(project.orgId) ?? null,\n\t\t\tplatformGrants: grantsByProjectId.get(project.id) ?? []\n\t\t}))),\n\t\tallById: new Map(allProjects.map((p) => [p.id, p])),\n\t\tmemberByProjectId,\n\t\torgMemberByOrgId\n\t};\n}\n/**\n* `opts.projectId` narrows to one project; a caller who cannot view it gets an\n* empty page rather than a 403, so this never reveals that a project exists.\n*/\nasync function listVisibleDefinitions(ctx, opts = {}, deps) {\n\tconst { projectId, ...listOpts } = opts;\n\tconst { projects } = await resolveAccessibleProjects(ctx, deps);\n\tconst scoped = projectId ? projects.filter((p) => p.id === projectId) : projects;\n\tconst page = await deps.definitionMeta.list(ctx, {\n\t\t...listOpts,\n\t\tprojectIds: scoped.map((p) => p.id)\n\t});\n\treturn {\n\t\titems: page.items,\n\t\tnextCursor: page.nextCursor,\n\t\tprojects: scoped\n\t};\n}\n/**\n* One definition, or `null` when the caller cannot view its project.\n*\n* Returns `null` rather than throwing 403 so callers surface a 404: a public\n* API that answers \"forbidden\" for a guid the caller cannot see turns\n* `/definitions/{guid}` into a cross-tenant existence oracle.\n*/\nasync function getVisibleDefinition(ctx, guid, deps) {\n\tconst meta = deps.definitionMeta;\n\tconst projectStore = deps.projects;\n\tconst record = await meta.get(ctx, guid);\n\tif (!record) return null;\n\tconst project = await projectStore.getProject(SYSTEM_CONTEXT, record.projectId);\n\tif (!project || outsideTokenOrg(ctx, project.orgId)) return null;\n\tconst [orgMembers, projectMembers, grants] = await Promise.all([\n\t\tdeps.orgs.getOrgMembersFor(SYSTEM_CONTEXT, [project.orgId], ctx.userId),\n\t\tprojectStore.getProjectMembersFor(SYSTEM_CONTEXT, [project.id], ctx.userId),\n\t\tproject.visibility === \"platform\" ? deps.platformProjectGrants.listByProject(SYSTEM_CONTEXT, project.id) : Promise.resolve([])\n\t]);\n\treturn canView(projectAccessInputFromRowsWith({ deps }, ctx, project, {\n\t\tmember: projectMembers.get(project.id) ?? null,\n\t\torgMember: orgMembers.get(project.orgId) ?? null,\n\t\tplatformGrants: grants\n\t})) ? record : null;\n}\n/**\n* One version of a definition the caller can view, including its cached\n* `schema`. `null` when the definition is invisible, the version is missing, or\n* the version belongs to a different definition — a caller must not be able to\n* read an arbitrary version by pairing it with a guid they can see.\n*/\nasync function loadVisibleVersion(ctx, guid, versionId, deps) {\n\tconst record = await getVisibleDefinition(ctx, guid, deps);\n\tif (!record) return null;\n\tconst version = await deps.definitionMeta.getVersion(ctx, versionId);\n\tif (!version || version.definitionId !== record.guid) return null;\n\treturn version;\n}\n//#endregion\nexport { DefinitionLoadError as a, REQUEST_ID_HEADER as c, definitionPaths as d, resolveAccessibleProjects as i, renderThrown as l, listVisibleDefinitions as n, createDefinitionLoader as o, loadVisibleVersion as r, DefinitionService as s, getVisibleDefinition as t, resolveRequestId as u };\n"],"names":[],"mappings":";;;;;;AAKA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE;AACrC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAChJ;AACG,IAAC,eAAe,GAAG;AACtB,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,KAAK;AACxC,EAAE,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC;AAC7B,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,sBAAsB,EAAE,aAAa,CAAC,CAAC,CAAC;AACtH,EAAE,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAChE,CAAC,CAAC;AACF,CAAC,KAAK,EAAE,CAAC,IAAI,KAAK;AAClB,EAAE,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC;AAC7B,EAAE,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC;AACzC,CAAC,CAAC;AACF,CAAC,MAAM,EAAE,CAAC,IAAI,KAAK;AACnB,EAAE,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC;AAC7B,EAAE,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;AAC/B,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,iBAAiB,GAAG;AACxB;AACA,IAAI,qBAAqB,GAAG,GAAG;AAC/B;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,uBAAuB,GAAG,mBAAmB;AACjD;AACA,SAAS,iBAAiB,CAAC,GAAG,EAAE;AAChC,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,IAAI;AACtB,CAAC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC;AACzF,CAAC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,GAAG,OAAO,GAAG,IAAI;AAC3C;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,CAAC,OAAO,EAAE,QAAQ,GAAG,QAAQ,EAAE;AACxD,CAAC,OAAO,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,QAAQ,EAAE;AACpE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,YAAY,CAAC,KAAK,EAAE;AAC7B,CAAC,IAAI,KAAK,YAAY,KAAK,EAAE;AAC7B,EAAE,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO;AAC3C,EAAE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI;AACzB,EAAE,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU;AACrC,EAAE,MAAM,IAAI,GAAG,EAAE;AACjB,EAAE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;AACrF,EAAE,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;AACvE,EAAE,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI;AAC/D,CAAC;AACD,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC;AAC/C,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,MAAM,CAAC,KAAK,CAAC;AACtB,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,QAAQ,GAAG;AACpB,CAAC,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM;AAC5B,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,UAAU,EAAE,OAAO,CAAC,CAAC,UAAU,EAAE;AACnE,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AACnF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,iBAAiB,GAAG,MAAM;AAC9B,CAAC,IAAI;AACL,CAAC,OAAO;AACR,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE;AAC5B,EAAE,IAAI,CAAC,IAAI,GAAG,IAAI;AAClB,EAAE,IAAI,CAAC,OAAO,GAAG,OAAO;AACxB,CAAC;AACD,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;AACxC,EAAE,MAAM,GAAG,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACxD,EAAE,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO;AAC3C,EAAE,MAAM,MAAM,GAAG;AACjB,GAAG,IAAI,EAAE,KAAK,CAAC,IAAI;AACnB,GAAG,SAAS,EAAE,KAAK,CAAC,SAAS;AAC7B,GAAG,OAAO,EAAE,KAAK,CAAC,OAAO;AACzB,GAAG,SAAS,EAAE,KAAK;AACnB,GAAG,SAAS,EAAE,KAAK;AACnB,GAAG,WAAW,EAAE,KAAK,CAAC,WAAW;AACjC,GAAG,WAAW,EAAE,KAAK,CAAC,WAAW;AACjC,GAAG,QAAQ,EAAE,KAAK,CAAC,QAAQ;AAC3B,GAAG,IAAI,EAAE,KAAK,CAAC,IAAI;AACnB,GAAG,UAAU,EAAE,KAAK,CAAC,UAAU;AAC/B,GAAG,eAAe,EAAE,KAAK,CAAC,eAAe;AACzC,GAAG,MAAM,EAAE,SAAS;AACpB,GAAG,UAAU,EAAE,CAAC;AAChB,GAAG,iBAAiB,EAAE,CAAC;AACvB,GAAG,aAAa,EAAE,IAAI;AACtB,GAAG,cAAc,EAAE,IAAI;AACvB,GAAG,SAAS,EAAE,GAAG;AACjB,GAAG,SAAS,EAAE,GAAG;AACjB,GAAG,SAAS,EAAE;AACd,GAAG;AACH,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC;AACjD,EAAE,MAAM,SAAS,GAAG,UAAU,EAAE;AAChC,EAAE,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC;AACvE,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,0BAA0B,CAAC;AACnE,EAAE,MAAM,OAAO,GAAG;AAClB,GAAG,EAAE,EAAE,SAAS;AAChB,GAAG,YAAY,EAAE,KAAK,CAAC,IAAI;AAC3B,GAAG,aAAa,EAAE,CAAC;AACnB,GAAG,OAAO,EAAE,KAAK,CAAC,OAAO;AACzB,GAAG,OAAO;AACV,GAAG,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;AAC3C,GAAG,UAAU,EAAE,KAAK;AACpB,GAAG,UAAU,EAAE,GAAG;AAClB,GAAG,MAAM;AACT,GAAG,iBAAiB,EAAE;AACtB,GAAG;AACH,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC;AACzD,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC;AAC9E,EAAE,OAAO;AACT,GAAG,MAAM,EAAE;AACX,IAAI,GAAG,MAAM;AACb,IAAI,MAAM,EAAE,OAAO;AACnB,IAAI,aAAa,EAAE,SAAS;AAC5B,IAAI,cAAc,EAAE;AACpB,IAAI;AACJ,GAAG;AACH,GAAG;AACH,CAAC;AACD;AACA;AACA;AACA;AACA,CAAC,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE;AAC7E,EAAE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC;AAC7D,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,aAAa,CAAC,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC;AAC9E,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC,GAAG,EAAE,IAAI,CAAC;AAC9E,EAAE,MAAM,SAAS,GAAG,UAAU,EAAE;AAChC,EAAE,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;AAC1D,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,0BAA0B,CAAC;AACnE,EAAE,MAAM,GAAG,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACxD,EAAE,MAAM,OAAO,GAAG;AAClB,GAAG,EAAE,EAAE,SAAS;AAChB,GAAG,YAAY,EAAE,IAAI;AACrB,GAAG,aAAa,EAAE,IAAI;AACtB,GAAG,OAAO,EAAE,GAAG;AACf,GAAG,OAAO;AACV,GAAG,gBAAgB,EAAE,YAAY;AACjC,GAAG,UAAU,EAAE,GAAG,CAAC,MAAM,IAAI,QAAQ,CAAC,OAAO;AAC7C,GAAG,UAAU,EAAE,GAAG;AAClB,GAAG,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,MAAM;AAC3C,GAAG,MAAM;AACT,GAAG,iBAAiB,EAAE;AACtB,GAAG;AACH,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC;AACzD,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC;AACnE,EAAE,OAAO,OAAO;AAChB,CAAC;AACD;AACA;AACA;AACA;AACA,CAAC,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE;AACrC,EAAE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC;AAC7D,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,aAAa,CAAC,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC;AAC9E,EAAE,MAAM,MAAM,GAAG,SAAS,IAAI,QAAQ,CAAC,cAAc;AACrD,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,aAAa,CAAC,uBAAuB,EAAE,GAAG,CAAC;AACpE,EAAE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;AACrE,EAAE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,EAAE,MAAM,IAAI,aAAa,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,+BAA+B,CAAC,EAAE,GAAG,CAAC;AAClI,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC;AAC/D,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AAC1I,EAAE,OAAO,OAAO;AAChB,CAAC;AACD,CAAC,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE;AAC3C,EAAE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;AACxE,EAAE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,EAAE,MAAM,IAAI,aAAa,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,+BAA+B,CAAC,EAAE,GAAG,CAAC;AACrI,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC;AAC3D,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;AAC5C,CAAC;AACD,CAAC,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE;AACpC,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC;AACtD,CAAC;AACD,CAAC,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE;AAC5C,EAAE,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC;AAC1C,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,CAAC;AACvD,EAAE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC;AAC7C,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;AACpE,EAAE,OAAO,GAAG;AACZ,CAAC;AACD,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE;AACzB,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC;AAC/C,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAC/D,CAAC;AACD;AACA;AACA;AACG,IAAC,mBAAmB,GAAG,cAAc,KAAK,CAAC;AAC9C,CAAC,IAAI;AACL,CAAC,KAAK;AACN,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE;AACnC,EAAE,KAAK,CAAC,OAAO,CAAC;AAChB,EAAE,IAAI,CAAC,IAAI,GAAG,IAAI;AAClB,EAAE,IAAI,CAAC,KAAK,GAAG,KAAK;AACpB,EAAE,IAAI,CAAC,IAAI,GAAG,qBAAqB;AACnC,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,sBAAsB,CAAC,IAAI,EAAE;AACtC,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,GAAG,sBAAsB,EAAE,YAAY,GAAG,KAAK,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,UAAU,EAAE,EAAE,GAAG,IAAI;AACzK,CAAC,OAAO,eAAe,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE;AACjG,EAAE,MAAM,SAAS,GAAG,iBAAiB,KAAK,OAAO,KAAK,OAAO,GAAG,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC,aAAa,CAAC;AAC7G,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,IAAI,mBAAmB,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;AAChH,EAAE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;AAC9D,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,mBAAmB,CAAC,MAAM,EAAE,CAAC,qBAAqB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC7F,EAAE,IAAI,OAAO,CAAC,YAAY,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,IAAI,mBAAmB,CAAC,MAAM,EAAE,CAAC,4BAA4B,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAChI,EAAE,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;AAC7D,EAAE,IAAI,CAAC,gBAAgB,EAAE,MAAM,IAAI,mBAAmB,CAAC,MAAM,EAAE,CAAC,qBAAqB,EAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AACxH,EAAE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC;AAClE,EAAE,IAAI,aAAa;AACnB,EAAE,IAAI;AACN,GAAG,aAAa,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,eAAe,IAAI,IAAI,EAAE,CAAC;AACtH,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,kDAAkD,EAAE,GAAG,CAAC;AAC3G,EAAE;AACF,EAAE,IAAI,OAAO,EAAE,mBAAmB,EAAE;AACpC,GAAG,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM;AACtC,GAAG,IAAI,YAAY,IAAI,oBAAoB,CAAC,YAAY,CAAC,EAAE,OAAO;AAClE,IAAI,OAAO;AACX,IAAI,gBAAgB;AACpB,IAAI,aAAa;AACjB,IAAI,MAAM,EAAE;AACZ,IAAI;AACJ,EAAE;AACF,EAAE,IAAI,MAAM;AACZ,EAAE,IAAI;AACN,GAAG,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM;AACpF,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,MAAM,IAAI,mBAAmB,CAAC,SAAS,EAAE,CAAC,2CAA2C,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;AAClJ,EAAE;AACF,EAAE,IAAI;AACN,GAAG,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM;AACtC,GAAG,MAAM,UAAU,GAAG,YAAY,IAAI,oBAAoB,CAAC,YAAY,CAAC,GAAG,YAAY,GAAG,IAAI;AAC9F,GAAG,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,WAAW,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC,CAAC;AACnL,GAAG,IAAI,CAAC,UAAU,IAAI,aAAa,CAAC,aAAa,KAAK,QAAQ,EAAE,WAAW,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK;AAC5I,IAAI,IAAI,MAAM,EAAE;AAChB,KAAK,MAAM,CAAC,CAAC,wDAAwD,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACzI,KAAK;AACL,IAAI;AACJ,IAAI,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;AAC/C,KAAK,SAAS,EAAE,eAAe;AAC/B,KAAK,SAAS,EAAE,OAAO,CAAC,EAAE;AAC1B,KAAK,GAAG,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG;AACtE,KAAK,CAAC;AACN,GAAG,CAAC,CAAC;AACL,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,uDAAuD,CAAC,CAAC;AAC9F,GAAG,MAAM,aAAa,GAAG,UAAU,CAAC,WAAW,IAAI,EAAE;AACrD,GAAG,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,IAAI,EAAE;AACnD,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE;AAC9F,IAAI,MAAM,MAAM,GAAG;AACnB,KAAK,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM;AACzC,KAAK,WAAW,EAAE,UAAU,CAAC,OAAO,EAAE,MAAM;AAC5C,KAAK,WAAW,EAAE,aAAa;AAC/B,KAAK,UAAU,EAAE,YAAY;AAC7B,KAAK,YAAY,EAAE,UAAU,CAAC;AAC9B,KAAK;AACL,IAAI,IAAI,MAAM,EAAE,MAAM,CAAC,CAAC,+BAA+B,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AACjG,SAAS,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;AACtD,KAAK,SAAS,EAAE,eAAe;AAC/B,KAAK,cAAc,EAAE,MAAM,CAAC,IAAI;AAChC,KAAK,GAAG;AACR,KAAK,CAAC;AACN,IAAI,IAAI,YAAY,EAAE;AACtB,KAAK,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC/F,KAAK,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;AACzD,KAAK,IAAI,MAAM,EAAE,MAAM,CAAC,0BAA0B,EAAE,QAAQ,CAAC;AAC7D,UAAU,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE;AAC7C,MAAM,SAAS,EAAE,eAAe;AAChC,MAAM,cAAc,EAAE,MAAM,CAAC,IAAI;AACjC,MAAM,KAAK,EAAE;AACb,MAAM,CAAC;AACP,IAAI;AACJ,GAAG;AACH,GAAG,OAAO;AACV,IAAI,OAAO;AACX,IAAI,gBAAgB;AACpB,IAAI,aAAa;AACjB,IAAI,MAAM,EAAE,oBAAoB,CAAC,aAAa,EAAE,UAAU,CAAC,MAAM;AACjE,IAAI;AACJ,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,IAAI,GAAG,YAAY,mBAAmB,EAAE,MAAM,GAAG;AACpD,GAAG,MAAM,IAAI,mBAAmB,CAAC,QAAQ,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC;AACjG,EAAE;AACF,CAAC,CAAC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,oBAAoB,CAAC,MAAM,EAAE;AACtC,CAAC,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;AACzE;AACA,SAAS,oBAAoB,CAAC,MAAM,EAAE,aAAa,EAAE;AACrD,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,IAAI,mBAAmB,CAAC,QAAQ,EAAE,CAAC,oCAAoC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,6GAA6G,CAAC,CAAC;AAC9Q,CAAC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;AAC3E,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,KAAK;AAC7C,GAAG,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;AACrD,GAAG,IAAI,YAAY,EAAE,SAAS,KAAK,OAAO,IAAI,YAAY,CAAC,OAAO,KAAK,MAAM,EAAE;AAC/E,IAAI,MAAM,KAAK,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC;AAChE,IAAI,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;AAC5F,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,YAAY,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5G,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,YAAY,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjH,GAAG;AACH,GAAG,IAAI,YAAY,IAAI,YAAY,CAAC,OAAO,KAAK,MAAM,EAAE,OAAO;AAC/D,IAAI,GAAG,WAAW;AAClB,IAAI,OAAO,EAAE,YAAY,CAAC;AAC1B,IAAI;AACJ,GAAG,OAAO,WAAW;AACrB,EAAE,CAAC;AACH,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,UAAU,GAAG,GAAG;AACpB;AACA;AACA;AACA;AACA;AACA,eAAe,yBAAyB,CAAC,GAAG,EAAE,IAAI,EAAE;AACpD,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI;AACvB,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ;AACnC,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC,qBAAqB;AAC9C,CAAC,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAC7I,CAAC,MAAM,WAAW,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,YAAY,CAAC,YAAY,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;AAChK,CAAC,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC,MAAM,kBAAkB,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AACnG,CAAC,MAAM,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AACpF,EAAE,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC;AAC3D,EAAE,YAAY,CAAC,oBAAoB,CAAC,cAAc,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC;AAC3E,EAAE,kBAAkB,CAAC,MAAM,GAAG,UAAU,CAAC,cAAc,CAAC,cAAc,EAAE,kBAAkB,CAAC,GAAG,OAAO,CAAC,OAAO,iBAAiB,IAAI,GAAG,EAAE;AACvI,EAAE,CAAC;AACH,CAAC,OAAO;AACR,EAAE,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,8BAA8B,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE;AAC3G,GAAG,MAAM,EAAE,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,IAAI;AACpD,GAAG,SAAS,EAAE,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI;AACzD,GAAG,cAAc,EAAE,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI;AACxD,GAAG,CAAC,CAAC,CAAC;AACN,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AACrD,EAAE,iBAAiB;AACnB,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA,eAAe,sBAAsB,CAAC,GAAG,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE;AAC5D,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAI;AACxC,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC;AAChE,CAAC,MAAM,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,GAAG,QAAQ;AACjF,CAAC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE;AAClD,EAAE,GAAG,QAAQ;AACb,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE;AACpC,EAAE,CAAC;AACH,CAAC,OAAO;AACR,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK;AACnB,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU;AAC7B,EAAE,QAAQ,EAAE;AACZ,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,oBAAoB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE;AACrD,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc;AACjC,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ;AACnC,CAAC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC;AACzC,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI;AACzB,CAAC,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC;AAChF,CAAC,IAAI,CAAC,OAAO,IAAI,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,IAAI;AACjE,CAAC,MAAM,CAAC,UAAU,EAAE,cAAc,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AAChE,EAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC;AACzE,EAAE,YAAY,CAAC,oBAAoB,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC;AAC7E,EAAE,OAAO,CAAC,UAAU,KAAK,UAAU,GAAG,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,cAAc,EAAE,OAAO,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,EAAE;AAC/H,EAAE,CAAC;AACH,CAAC,OAAO,OAAO,CAAC,8BAA8B,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE;AACvE,EAAE,MAAM,EAAE,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,IAAI;AAChD,EAAE,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI;AAClD,EAAE,cAAc,EAAE;AAClB,EAAE,CAAC,CAAC,GAAG,MAAM,GAAG,IAAI;AACpB;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;AAC9D,CAAC,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC;AAC3D,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI;AACzB,CAAC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;AACrE,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,YAAY,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,IAAI;AAClE,CAAC,OAAO,OAAO;AACf;;;;"}