@selvajs/selva 4.20.0-beta.6 → 4.20.0-beta.8

package/build/server/chunks/chunks/compute.js-Bb_Yprms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compute.js-Bb_Yprms.js","sources":["../../../../.svelte-kit/output/server/chunks/compute.js"],"sourcesContent":["import \"./src.js\";\nimport { N as ComputeServerUnconfiguredError, O as ApiErrorCode, k as apiError, z as NoopLogger } from \"./access.js\";\nimport { lookup } from \"node:dns/promises\";\nimport { isIP } from \"node:net\";\n//#region ../platform/src/computeServer/types.ts\nfunction isPlatformServer(s) {\n\treturn s.scope === \"platform\";\n}\nfunction isOrgServer(s) {\n\treturn s.scope === \"org\";\n}\n//#endregion\n//#region ../platform/src/computeServer/utils.ts\n/**\n* Servers an org can see in pickers and use for solves:\n* platform servers shared with this org (or `'all'`, or the global default)\n* ∪ org-private servers owned by this org.\n*/\nfunction serversVisibleTo(config, orgId) {\n\treturn config.servers.filter((s) => {\n\t\tif (isPlatformServer(s)) {\n\t\t\tif (s.id === config.defaultServerId) return true;\n\t\t\tif (s.sharedWith === \"all\") return true;\n\t\t\tif (orgId && s.sharedWith.includes(orgId)) return true;\n\t\t\treturn false;\n\t\t}\n\t\treturn !!orgId && s.ownerOrgId === orgId;\n\t});\n}\n/**\n* Resolves the default server id for an org: per-org override, then global\n* default. Returns `undefined` if neither is set or visible.\n*/\nfunction defaultServerIdFor(config, orgId) {\n\tconst visible = serversVisibleTo(config, orgId);\n\tconst visibleIds = new Set(visible.map((s) => s.id));\n\tif (orgId) {\n\t\tconst orgChoice = config.orgDefaults?.[orgId];\n\t\tif (orgChoice && visibleIds.has(orgChoice)) return orgChoice;\n\t}\n\tif (config.defaultServerId && visibleIds.has(config.defaultServerId)) return config.defaultServerId;\n}\nfunction resolveServerForOrg$1(config, orgId, opts = {}) {\n\tconst visible = serversVisibleTo(config, orgId);\n\tif (visible.length === 0) throw new Error(\"No compute servers are configured or visible for this org.\");\n\tif (opts.definitionPin) {\n\t\tconst pinned = visible.find((s) => s.id === opts.definitionPin);\n\t\tif (pinned) return pinned;\n\t}\n\tconst defaultId = defaultServerIdFor(config, orgId);\n\tif (defaultId) {\n\t\tconst found = visible.find((s) => s.id === defaultId);\n\t\tif (found) return found;\n\t}\n\treturn visible[0];\n}\n/**\n* The config as one org may see it: visible servers only, `orgDefaults` reduced\n* to this org's own entry, and `defaultServerId` dropped when the global default\n* is not visible here.\n*\n* Applied inside `getConfig` when `scopeToOrgId` is passed, so an org-facing\n* caller cannot forget the filter and leak other orgs' server URLs or the\n* instance's default choice.\n*/\nfunction scopeConfigToOrg(config, orgId) {\n\tconst servers = serversVisibleTo(config, orgId);\n\tconst visibleIds = new Set(servers.map((s) => s.id));\n\tconst orgDefault = config.orgDefaults?.[orgId];\n\treturn {\n\t\tservers,\n\t\tdefaultServerId: config.defaultServerId && visibleIds.has(config.defaultServerId) ? config.defaultServerId : void 0,\n\t\torgDefaults: orgDefault ? { [orgId]: orgDefault } : {}\n\t};\n}\n/** Lookup by id, ignoring scope or visibility — for admin contexts that display a server outside the visibility filter. */\nfunction findServerById(config, id) {\n\treturn config.servers.find((s) => s.id === id);\n}\nfunction platformServers(config) {\n\treturn config.servers.filter(isPlatformServer);\n}\n//#endregion\n//#region ../server/src/compute/safe-url.ts\n/**\n* SSRF guard for the remote-definition fetch. Without it an authenticated user\n* could submit `http://169.254.169.254/...` (cloud metadata) or any intranet\n* endpoint and the server would fetch it on their behalf.\n*\n* Two layers:\n*\n*   1. `isSafeRemoteDefinitionUrl` — synchronous, DNS-free literal filter.\n*      Rejects the protocol, hostname literals, and every IP *encoding* that\n*      maps to a blocked address: dotted-decimal, integer, octal, hex,\n*      short-form, IPv4-mapped IPv6.\n*   2. `assertSafeRemoteDefinitionUrl` — resolves the hostname and re-checks the\n*      *resolved* IP, catching a public name that points at a private one.\n*\n* Neither is bulletproof against DNS rebinding — the IP can change between our\n* lookup and fetch's own. Closing that needs the caller to connect to the\n* resolved IP directly, a much larger change; these two layers close the\n* bypasses an attacker actually reaches for (literal encodings, and a public\n* name whose record points inward).\n*/\n/**\n* True when `ip` (a normalized IPv4 or IPv6 literal from `isIP`/`dns.lookup`)\n* is loopback, private, link-local, or otherwise must-not-fetch. IPv4-mapped\n* IPv6 (`::ffff:a.b.c.d`) is unwrapped first so the v4 rules apply.\n*/\nfunction isBlockedIp(ip) {\n\tlet addr = ip.toLowerCase();\n\tconst mappedDotted = /^::ffff:(\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})$/.exec(addr);\n\tif (mappedDotted) addr = mappedDotted[1];\n\telse {\n\t\tconst mappedHex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(addr);\n\t\tif (mappedHex) {\n\t\t\tconst hi = parseInt(mappedHex[1], 16);\n\t\t\tconst lo = parseInt(mappedHex[2], 16);\n\t\t\taddr = [\n\t\t\t\thi >> 8 & 255,\n\t\t\t\thi & 255,\n\t\t\t\tlo >> 8 & 255,\n\t\t\t\tlo & 255\n\t\t\t].join(\".\");\n\t\t}\n\t}\n\tif (isIP(addr) === 4) {\n\t\tconst octets = addr.split(\".\").map(Number);\n\t\tif (octets.length !== 4 || octets.some((o) => o > 255)) return true;\n\t\tconst [a, b] = octets;\n\t\tif (a === 0) return true;\n\t\tif (a === 127) return true;\n\t\tif (a === 10) return true;\n\t\tif (a === 192 && b === 168) return true;\n\t\tif (a === 172 && b >= 16 && b <= 31) return true;\n\t\tif (a === 169 && b === 254) return true;\n\t\treturn false;\n\t}\n\tif (addr === \"::1\" || addr === \"::\") return true;\n\tif (/^(fc|fd)[0-9a-f]{0,2}:/.test(addr)) return true;\n\tif (/^fe[89ab][0-9a-f]:/.test(addr)) return true;\n\treturn false;\n}\n/**\n* Parse a bare-IPv4 hostname in any encoding browsers/glibc accept — integer\n* (`2130706433`), octal (`0177.0.0.1`), hex (`0x7f000001`), and short forms\n* (`127.1`) — into canonical dotted-decimal. An already-valid dotted-quad comes\n* back unchanged. Returns null only when the host is not a numeric IPv4 literal\n* at all, i.e. it's a real name — which is what callers use to decide whether\n* DNS resolution is needed.\n*/\nfunction canonicalizeNumericIpv4(host) {\n\tif (isIP(host) === 4) return host;\n\tconst rawParts = host.split(\".\");\n\tif (rawParts.length === 0 || rawParts.length > 4) return null;\n\tconst parseUInt = (s) => {\n\t\tif (s === \"\") return null;\n\t\tlet n;\n\t\tif (/^0x[0-9a-f]+$/i.test(s)) n = parseInt(s, 16);\n\t\telse if (/^0[0-7]+$/.test(s)) n = parseInt(s, 8);\n\t\telse if (/^[0-9]+$/.test(s)) n = parseInt(s, 10);\n\t\telse return null;\n\t\treturn Number.isFinite(n) ? n : null;\n\t};\n\tconst nums = rawParts.map(parseUInt);\n\tif (nums.some((n) => n === null)) return null;\n\tconst parts = nums;\n\tlet value;\n\tswitch (parts.length) {\n\t\tcase 1:\n\t\t\tvalue = parts[0];\n\t\t\tbreak;\n\t\tcase 2:\n\t\t\tif (parts[0] > 255 || parts[1] > 16777215) return null;\n\t\t\tvalue = parts[0] << 24 | parts[1];\n\t\t\tbreak;\n\t\tcase 3:\n\t\t\tif (parts[0] > 255 || parts[1] > 255 || parts[2] > 65535) return null;\n\t\t\tvalue = parts[0] << 24 | parts[1] << 16 | parts[2];\n\t\t\tbreak;\n\t\tdefault:\n\t\t\tif (parts.some((p) => p > 255)) return null;\n\t\t\tvalue = parts[0] << 24 | parts[1] << 16 | parts[2] << 8 | parts[3];\n\t}\n\tvalue = value >>> 0;\n\tif (value > 4294967295) return null;\n\treturn [\n\t\tvalue >>> 24 & 255,\n\t\tvalue >>> 16 & 255,\n\t\tvalue >>> 8 & 255,\n\t\tvalue & 255\n\t].join(\".\");\n}\n/**\n* Synchronous literal pre-filter: rejects bad schemes, loopback hostnames, and\n* any IP literal (in any encoding) that maps to a blocked address. Does NOT\n* perform DNS — a public *name* that points at a private IP passes here and is\n* caught only by `assertSafeRemoteDefinitionUrl`.\n*/\nfunction isSafeRemoteDefinitionUrl(raw) {\n\tlet parsed;\n\ttry {\n\t\tparsed = new URL(raw);\n\t} catch {\n\t\treturn false;\n\t}\n\tif (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") return false;\n\tlet host = parsed.hostname.toLowerCase();\n\tif (!host) return false;\n\tif (host === \"localhost\" || host.endsWith(\".localhost\")) return false;\n\tif (host.startsWith(\"[\") && host.endsWith(\"]\")) host = host.slice(1, -1);\n\tif (isIP(host) === 6) return !isBlockedIp(host);\n\tconst canonical = canonicalizeNumericIpv4(host);\n\tif (canonical) return !isBlockedIp(canonical);\n\treturn true;\n}\n/**\n* True when `raw` targets the link-local range (`169.254.0.0/16`), which\n* carries the cloud metadata service at `169.254.169.254` — the endpoint that\n* hands out a host's own IAM credentials to anything on the box.\n*\n* A far narrower judgement than {@link isSafeRemoteDefinitionUrl}, for the one\n* caller that must tolerate private addresses: an operator's own compute server\n* legitimately lives on `localhost` or a LAN, so blocking RFC1918 there would\n* reject the ordinary self-hosted layout. Nothing legitimate is ever reached\n* over link-local, so this stays blocked with no opt-out.\n*\n* Shares `canonicalizeNumericIpv4`, so the encodings that bypass a naive string\n* comparison — `http://2852039166/`, `http://0251.0376.0251.0376/`,\n* `http://0xa9fea9fe/` — all resolve to the same verdict.\n*/\nfunction isLinkLocalUrl(raw) {\n\tlet host;\n\ttry {\n\t\thost = new URL(raw).hostname.toLowerCase();\n\t} catch {\n\t\treturn false;\n\t}\n\tif (!host) return false;\n\tif (host.startsWith(\"[\") && host.endsWith(\"]\")) host = host.slice(1, -1);\n\tif (isIP(host) === 6) return /^fe[89ab][0-9a-f]:/.test(host);\n\tconst canonical = canonicalizeNumericIpv4(host);\n\tif (!canonical) return false;\n\tconst [a, b] = canonical.split(\".\").map(Number);\n\treturn a === 169 && b === 254;\n}\n/**\n* Full SSRF check: literal pre-filter, then resolve every A/AAAA record and\n* reject if *any* resolved IP is blocked. Returns the original URL on success\n* so callers can `await assertSafeRemoteDefinitionUrl(url)` inline.\n*\n* Every rejection throws the same generic message so the caller gets no oracle;\n* which host was blocked and by which layer is logged server-side instead.\n*/\nasync function assertSafeRemoteDefinitionUrl(raw, logger = new NoopLogger()) {\n\tif (!isSafeRemoteDefinitionUrl(raw)) {\n\t\tlogger.warn(\"Blocked remote definition URL\", {\n\t\t\tcomponent: \"Compute/ssrf\",\n\t\t\treason: \"literal-filter\",\n\t\t\thost: hostOf(raw)\n\t\t});\n\t\tthrow new Error(\"Remote definition URL is not allowed\");\n\t}\n\tconst host = new URL(raw).hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n\tif (isIP(host) !== 0 || canonicalizeNumericIpv4(host)) return raw;\n\tlet resolved;\n\ttry {\n\t\tresolved = await lookup(host, { all: true });\n\t} catch {\n\t\tlogger.warn(\"Blocked remote definition URL\", {\n\t\t\tcomponent: \"Compute/ssrf\",\n\t\t\treason: \"dns-lookup-failed\",\n\t\t\thost\n\t\t});\n\t\tthrow new Error(\"Remote definition URL is not allowed\");\n\t}\n\tif (resolved.length === 0 || resolved.some((r) => isBlockedIp(r.address))) {\n\t\tconst blocked = resolved.filter((r) => isBlockedIp(r.address)).map((r) => r.address);\n\t\tlogger.warn(\"Blocked remote definition URL\", {\n\t\t\tcomponent: \"Compute/ssrf\",\n\t\t\treason: \"resolves-to-blocked-ip\",\n\t\t\thost,\n\t\t\tblockedIps: blocked\n\t\t});\n\t\tthrow new Error(\"Remote definition URL is not allowed\");\n\t}\n\treturn raw;\n}\n/** Best-effort hostname for logging; falls back to a truncated raw string. */\nfunction hostOf(raw) {\n\ttry {\n\t\treturn new URL(raw).hostname;\n\t} catch {\n\t\treturn raw.slice(0, 120);\n\t}\n}\n//#endregion\n//#region ../server/src/compute/remote-definition.ts\n/**\n* Remote-definition fetch: SSRF-guarded, size-capped, timed, and TTL-cached.\n*\n* A solve can reference its `.gh` by remote URL instead of a stored blob, and\n* that URL is attacker-controllable — a share-token caller supplies\n* `definitionUrl`. Hence {@link assertSafeRemoteDefinitionUrl}, the early size\n* cap, and the deadline.\n*/\n/** Once the cache exceeds this many entries, evict the oldest 10 by `fetchedAt`. */\nvar CACHE_MAX_ENTRIES = 50;\nvar CACHE_EVICT_BATCH = 10;\n/**\n* Read a response body into memory, aborting (and throwing) as soon as the\n* running byte total exceeds `maxBytes`. Falls back to `arrayBuffer()` only when\n* the body isn't a readable stream (older fetch impls).\n*/\nasync function readBodyWithCap(response, maxBytes, controller) {\n\tif (!response.body) {\n\t\tconst buffer = await response.arrayBuffer();\n\t\tif (buffer.byteLength > maxBytes) throw new Error(\"Remote definition exceeds size limit\");\n\t\treturn new Uint8Array(buffer);\n\t}\n\tconst reader = response.body.getReader();\n\tconst chunks = [];\n\tlet total = 0;\n\twhile (true) {\n\t\tconst { done, value } = await reader.read();\n\t\tif (done) break;\n\t\ttotal += value.byteLength;\n\t\tif (total > maxBytes) {\n\t\t\tcontroller.abort();\n\t\t\tthrow new Error(\"Remote definition exceeds size limit\");\n\t\t}\n\t\tchunks.push(value);\n\t}\n\tconst out = new Uint8Array(total);\n\tlet offset = 0;\n\tfor (const chunk of chunks) {\n\t\tout.set(chunk, offset);\n\t\toffset += chunk.byteLength;\n\t}\n\treturn out;\n}\n/**\n* Build a remote-definition fetcher owning its own TTL cache. Each fetcher's\n* cache is independent, so one per process shares warm bytes while test fetchers\n* stay isolated.\n*/\nfunction createRemoteDefinitionFetcher(config) {\n\tconst cache = /* @__PURE__ */ new Map();\n\tconst logger = config.logger ?? new NoopLogger();\n\treturn { async load(url) {\n\t\tawait assertSafeRemoteDefinitionUrl(url, logger);\n\t\tconst now = config.now();\n\t\tconst cached = cache.get(url);\n\t\tif (cached && now - cached.fetchedAt < config.cacheTtlMs) return cached.data;\n\t\tconst controller = new AbortController();\n\t\tconst timeout = setTimeout(() => controller.abort(), config.fetchTimeoutMs);\n\t\tlet data;\n\t\ttry {\n\t\t\tconst response = await fetch(url, {\n\t\t\t\tsignal: controller.signal,\n\t\t\t\tredirect: \"error\"\n\t\t\t});\n\t\t\tif (!response.ok) throw new Error(`HTTP ${response.status}: ${response.statusText}`);\n\t\t\tconst declared = Number(response.headers.get(\"content-length\"));\n\t\t\tif (Number.isFinite(declared) && declared > config.maxBytes) throw new Error(\"Remote definition exceeds size limit\");\n\t\t\tdata = await readBodyWithCap(response, config.maxBytes, controller);\n\t\t} finally {\n\t\t\tclearTimeout(timeout);\n\t\t}\n\t\tcache.set(url, {\n\t\t\tdata,\n\t\t\tfetchedAt: now\n\t\t});\n\t\tif (cache.size > CACHE_MAX_ENTRIES) {\n\t\t\tconst entries = Array.from(cache.entries());\n\t\t\tentries.sort((a, b) => a[1].fetchedAt - b[1].fetchedAt);\n\t\t\tfor (let i = 0; i < CACHE_EVICT_BATCH; i++) cache.delete(entries[i][0]);\n\t\t}\n\t\treturn data;\n\t} };\n}\n//#endregion\n//#region ../server/src/compute/resolve-server.ts\n/**\n* Pick the right Rhino.Compute server for an (org, definition) pair.\n*\n* Resolution order, narrowest wins:\n*   1. `definitionPin` if it points at a server visible to `orgId`.\n*   2. `orgDefaults[orgId]` if set and visible.\n*   3. Global `defaultServerId`.\n*\n* The store returns the full config; the visibility predicate runs in the pure\n* helper so callers don't reimplement it. Re-throws the pure helper's \"nothing\n* visible\" failure as a typed `ComputeServerUnconfiguredError`.\n*\n* Reads a key-free config and fetches the `apiKey` only for the server that\n* actually wins, instead of decrypting every configured server's key to use\n* exactly one of them.\n*/\nasync function resolveServerForOrg(ctx, orgId, store, opts = {}) {\n\tconst config = await store.getConfig(ctx);\n\tlet server;\n\ttry {\n\t\tserver = resolveServerForOrg$1(config, orgId, { definitionPin: opts.definitionPin });\n\t} catch (err) {\n\t\tthrow new ComputeServerUnconfiguredError(err instanceof Error ? err.message : void 0);\n\t}\n\tif (!server.hasApiKey) return server;\n\treturn {\n\t\t...server,\n\t\tapiKey: await store.getServerApiKey(ctx, server.id)\n\t};\n}\n//#endregion\n//#region ../server/src/compute/server-config-write.ts\n/**\n* Shared write-path rules for compute server config.\n*\n* Two routes accept a server set: `/api/admin/compute` (platform scope,\n* `manage_compute`) and `/api/v1/orgs/{orgId}/compute` (org scope,\n* `manage_org_compute`). They differ in who may call them, what extra fields\n* they carry (`sharedWith` vs `ownerOrgId`), and how they validate the default\n* selection — but the field validation and the apiKey merge below must behave\n* identically in both, so they live here rather than in either handler.\n*\n* The apiKey merge is why this file exists: if the two copies disagree, a\n* stored credential silently gets cleared or leaked, and nothing fails at\n* build time.\n*/\n/**\n* A stored `serverUrl` is fetched server-side on every status probe, every\n* purge/shutdown action, and every solve, so an unfiltered one is an SSRF\n* primitive handed to whoever holds `manage_compute`. Two rules:\n*\n*   - Scheme allowlist: `http`/`https`. `file:`, `gopher:` and friends are never\n*     a Rhino.Compute endpoint.\n*   - Link-local (`169.254.0.0/16`) is refused. That range carries the cloud\n*     metadata service at `169.254.169.254`, which hands out the host's own IAM\n*     credentials to anything running on the box.\n*\n* **Loopback and RFC1918 are deliberately allowed.** Running compute on\n* `localhost:6500` or a LAN box is the ordinary self-hosted layout, not an\n* attack — most deployments reach their compute server over exactly those\n* addresses. Blocking them by default would break those instances on upgrade\n* and push every operator toward an opt-out flag, and a guard that everyone\n* disables protects nobody. So the check is narrowed to the range where no\n* legitimate compute server ever lives.\n*\n* What this does not stop: a privileged admin pointing the app at an internal\n* host to probe it. That is a real but much weaker concern than credential\n* theft, it needs `manage_compute` already, and it is inseparable from the\n* legitimate case. Revisit if `manage_org_compute` is ever delegated widely on\n* a multi-tenant instance.\n*\n* `isLinkLocalUrl` is reused rather than hand-rolled because a string compare\n* against `169.254.169.254` misses the encodings that reach the same address:\n* `http://2852039166/`, `http://0xa9fea9fe/`, `http://0251.0376.0251.0376/`.\n*/\nfunction assertUsableServerUrl(serverUrl) {\n\tlet parsed;\n\ttry {\n\t\tparsed = new URL(serverUrl);\n\t} catch {\n\t\tapiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid serverUrl: ${serverUrl}`);\n\t}\n\tif (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") apiError(400, ApiErrorCode.VALIDATION_FAILED, `serverUrl must use http or https: ${serverUrl}`);\n\tif (isLinkLocalUrl(serverUrl)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `serverUrl points at the link-local range, which carries the cloud metadata service: ${serverUrl}`);\n}\n/**\n* Validates the scope-independent fields of every submitted server. Throws the\n* first failure as a 400; scope-specific fields (`sharedWith`, `ownerOrgId`)\n* are the caller's business.\n*/\nfunction validateIncomingServers(servers) {\n\tfor (const s of servers) {\n\t\tif (!s.id || typeof s.id !== \"string\") apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Each server needs an id\");\n\t\tif (!s.label || typeof s.label !== \"string\") apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Each server needs a label\");\n\t\tif (!s.serverUrl || typeof s.serverUrl !== \"string\") apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Each server needs a serverUrl\");\n\t\tassertUsableServerUrl(s.serverUrl);\n\t\tif (s.apiKey !== void 0 && s.apiKey !== null && typeof s.apiKey !== \"string\") apiError(400, ApiErrorCode.VALIDATION_FAILED, \"apiKey must be a string, null, or omitted\");\n\t}\n}\n/**\n* The UI never receives stored keys — it sends back `hasApiKey` and omits the\n* field for servers the operator didn't touch. So \"omitted\" cannot mean \"clear\":\n* it has to preserve, or every save through the settings form would wipe the\n* keys of every server the operator left alone. Clearing is explicit (`null`);\n* an empty string is treated as \"not provided\" since that's what an untouched\n* password input submits.\n*/\nfunction resolveApiKey(submitted, storedKey) {\n\tif (submitted === null) return void 0;\n\treturn submitted ? submitted : storedKey;\n}\n/**\n* Builds the id → stored-key lookup the merge reads. The caller passes only the\n* servers in its own scope, so one scope's write can never resolve a key from\n* another's rows.\n*/\nfunction storedKeysById(scopedServers) {\n\treturn new Map(scopedServers.map((s) => [s.id, s.apiKey]));\n}\n//#endregion\nexport { createRemoteDefinitionFetcher as a, defaultServerIdFor as c, scopeConfigToOrg as d, serversVisibleTo as f, resolveServerForOrg as i, findServerById as l, isPlatformServer as m, storedKeysById as n, readBodyWithCap as o, isOrgServer as p, validateIncomingServers as r, assertSafeRemoteDefinitionUrl as s, resolveApiKey as t, platformServers as u };\n"],"names":[],"mappings":";;;;;AAIA;AACA,SAAS,gBAAgB,CAAC,CAAC,EAAE;AAC7B,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,UAAU;AAC9B;AACA,SAAS,WAAW,CAAC,CAAC,EAAE;AACxB,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,KAAK;AACzB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,CAAC,MAAM,EAAE,KAAK,EAAE;AACzC,CAAC,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;AACrC,EAAE,IAAI,gBAAgB,CAAC,CAAC,CAAC,EAAE;AAC3B,GAAG,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,eAAe,EAAE,OAAO,IAAI;AACnD,GAAG,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,EAAE,OAAO,IAAI;AAC1C,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,IAAI;AACzD,GAAG,OAAO,KAAK;AACf,EAAE;AACF,EAAE,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK;AAC1C,CAAC,CAAC,CAAC;AACH;AACA;AACA;AACA;AACA;AACA,SAAS,kBAAkB,CAAC,MAAM,EAAE,KAAK,EAAE;AAC3C,CAAC,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC;AAChD,CAAC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;AACrD,CAAC,IAAI,KAAK,EAAE;AACZ,EAAE,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC;AAC/C,EAAE,IAAI,SAAS,IAAI,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,OAAO,SAAS;AAC9D,CAAC;AACD,CAAC,IAAI,MAAM,CAAC,eAAe,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,OAAO,MAAM,CAAC,eAAe;AACpG;AACA,SAAS,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE;AACzD,CAAC,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC;AAChD,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC;AACxG,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE;AACzB,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,aAAa,CAAC;AACjE,EAAE,IAAI,MAAM,EAAE,OAAO,MAAM;AAC3B,CAAC;AACD,CAAC,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC;AACpD,CAAC,IAAI,SAAS,EAAE;AAChB,EAAE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC;AACvD,EAAE,IAAI,KAAK,EAAE,OAAO,KAAK;AACzB,CAAC;AACD,CAAC,OAAO,OAAO,CAAC,CAAC,CAAC;AAClB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,CAAC,MAAM,EAAE,KAAK,EAAE;AACzC,CAAC,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC;AAChD,CAAC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;AACrD,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC;AAC/C,CAAC,OAAO;AACR,EAAE,OAAO;AACT,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,MAAM,CAAC,eAAe,GAAG,MAAM;AACrH,EAAE,WAAW,EAAE,UAAU,GAAG,EAAE,CAAC,KAAK,GAAG,UAAU,EAAE,GAAG;AACtD,EAAE;AACF;AACA;AACA,SAAS,cAAc,CAAC,MAAM,EAAE,EAAE,EAAE;AACpC,CAAC,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;AAC/C;AACA,SAAS,eAAe,CAAC,MAAM,EAAE;AACjC,CAAC,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC;AAC/C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,WAAW,CAAC,EAAE,EAAE;AACzB,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,WAAW,EAAE;AAC5B,CAAC,MAAM,YAAY,GAAG,+CAA+C,CAAC,IAAI,CAAC,IAAI,CAAC;AAChF,CAAC,IAAI,YAAY,EAAE,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC;AACzC,MAAM;AACN,EAAE,MAAM,SAAS,GAAG,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC;AACzE,EAAE,IAAI,SAAS,EAAE;AACjB,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACxC,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACxC,GAAG,IAAI,GAAG;AACV,IAAI,EAAE,IAAI,CAAC,GAAG,GAAG;AACjB,IAAI,EAAE,GAAG,GAAG;AACZ,IAAI,EAAE,IAAI,CAAC,GAAG,GAAG;AACjB,IAAI,EAAE,GAAG;AACT,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACd,EAAE;AACF,CAAC;AACD,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;AACvB,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;AAC5C,EAAE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,EAAE,OAAO,IAAI;AACrE,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM;AACvB,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,IAAI;AAC1B,EAAE,IAAI,CAAC,KAAK,GAAG,EAAE,OAAO,IAAI;AAC5B,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,OAAO,IAAI;AAC3B,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,OAAO,IAAI;AACzC,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,IAAI;AAClD,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,OAAO,IAAI;AACzC,EAAE,OAAO,KAAK;AACd,CAAC;AACD,CAAC,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI,EAAE,OAAO,IAAI;AACjD,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,IAAI;AACrD,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,IAAI;AACjD,CAAC,OAAO,KAAK;AACb;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,uBAAuB,CAAC,IAAI,EAAE;AACvC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,IAAI;AAClC,CAAC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;AACjC,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,OAAO,IAAI;AAC9D,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK;AAC1B,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,OAAO,IAAI;AAC3B,EAAE,IAAI,CAAC;AACP,EAAE,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC;AACnD,OAAO,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;AAClD,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC;AAClD,OAAO,OAAO,IAAI;AAClB,EAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI;AACtC,CAAC,CAAC;AACF,CAAC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;AACrC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,EAAE,OAAO,IAAI;AAC9C,CAAC,MAAM,KAAK,GAAG,IAAI;AACnB,CAAC,IAAI,KAAK;AACV,CAAC,QAAQ,KAAK,CAAC,MAAM;AACrB,EAAE,KAAK,CAAC;AACR,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC;AACnB,GAAG;AACH,EAAE,KAAK,CAAC;AACR,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,EAAE,OAAO,IAAI;AACzD,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;AACpC,GAAG;AACH,EAAE,KAAK,CAAC;AACR,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,OAAO,IAAI;AACxE,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;AACrD,GAAG;AACH,EAAE;AACF,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,EAAE,OAAO,IAAI;AAC9C,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;AACrE;AACA,CAAC,KAAK,GAAG,KAAK,KAAK,CAAC;AACpB,CAAC,IAAI,KAAK,GAAG,UAAU,EAAE,OAAO,IAAI;AACpC,CAAC,OAAO;AACR,EAAE,KAAK,KAAK,EAAE,GAAG,GAAG;AACpB,EAAE,KAAK,KAAK,EAAE,GAAG,GAAG;AACpB,EAAE,KAAK,KAAK,CAAC,GAAG,GAAG;AACnB,EAAE,KAAK,GAAG;AACV,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,yBAAyB,CAAC,GAAG,EAAE;AACxC,CAAC,IAAI,MAAM;AACX,CAAC,IAAI;AACL,EAAE,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC;AACvB,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD,CAAC,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,OAAO,KAAK;AAC9E,CAAC,IAAI,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE;AACzC,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,KAAK;AACxB,CAAC,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,KAAK;AACtE,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;AACzE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;AAChD,CAAC,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,CAAC;AAChD,CAAC,IAAI,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC;AAC9C,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,GAAG,EAAE;AAC7B,CAAC,IAAI,IAAI;AACT,CAAC,IAAI;AACL,EAAE,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE;AAC5C,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,KAAK;AACxB,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;AACzE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;AAC7D,CAAC,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,CAAC;AAChD,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,KAAK;AAC7B,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;AAChD,CAAC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;AAC9B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,6BAA6B,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,UAAU,EAAE,EAAE;AAC7E,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,EAAE;AACtC,EAAE,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;AAC/C,GAAG,SAAS,EAAE,cAAc;AAC5B,GAAG,MAAM,EAAE,gBAAgB;AAC3B,GAAG,IAAI,EAAE,MAAM,CAAC,GAAG;AACnB,GAAG,CAAC;AACJ,EAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC;AACzD,CAAC;AACD,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;AACzE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG;AAClE,CAAC,IAAI,QAAQ;AACb,CAAC,IAAI;AACL,EAAE,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AAC9C,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;AAC/C,GAAG,SAAS,EAAE,cAAc;AAC5B,GAAG,MAAM,EAAE,mBAAmB;AAC9B,GAAG;AACH,GAAG,CAAC;AACJ,EAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC;AACzD,CAAC;AACD,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE;AAC5E,EAAE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACtF,EAAE,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;AAC/C,GAAG,SAAS,EAAE,cAAc;AAC5B,GAAG,MAAM,EAAE,wBAAwB;AACnC,GAAG,IAAI;AACP,GAAG,UAAU,EAAE;AACf,GAAG,CAAC;AACJ,EAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC;AACzD,CAAC;AACD,CAAC,OAAO,GAAG;AACX;AACA;AACA,SAAS,MAAM,CAAC,GAAG,EAAE;AACrB,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ;AAC9B,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;AAC1B,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,iBAAiB,GAAG,EAAE;AAC1B,IAAI,iBAAiB,GAAG,EAAE;AAC1B;AACA;AACA;AACA;AACA;AACA,eAAe,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE;AAC/D,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;AACrB,EAAE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE;AAC7C,EAAE,IAAI,MAAM,CAAC,UAAU,GAAG,QAAQ,EAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC;AAC3F,EAAE,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC;AAC/B,CAAC;AACD,CAAC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE;AACzC,CAAC,MAAM,MAAM,GAAG,EAAE;AAClB,CAAC,IAAI,KAAK,GAAG,CAAC;AACd,CAAC,OAAO,IAAI,EAAE;AACd,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE;AAC7C,EAAE,IAAI,IAAI,EAAE;AACZ,EAAE,KAAK,IAAI,KAAK,CAAC,UAAU;AAC3B,EAAE,IAAI,KAAK,GAAG,QAAQ,EAAE;AACxB,GAAG,UAAU,CAAC,KAAK,EAAE;AACrB,GAAG,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC;AAC1D,EAAE;AACF,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AACD,CAAC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC;AAClC,CAAC,IAAI,MAAM,GAAG,CAAC;AACf,CAAC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE;AAC7B,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC;AACxB,EAAE,MAAM,IAAI,KAAK,CAAC,UAAU;AAC5B,CAAC;AACD,CAAC,OAAO,GAAG;AACX;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,6BAA6B,CAAC,MAAM,EAAE;AAC/C,CAAC,MAAM,KAAK,mBAAmB,IAAI,GAAG,EAAE;AACxC,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,UAAU,EAAE;AACjD,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,GAAG,EAAE;AAC1B,EAAE,MAAM,6BAA6B,CAAC,GAAG,EAAE,MAAM,CAAC;AAClD,EAAE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE;AAC1B,EAAE,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;AAC/B,EAAE,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,OAAO,MAAM,CAAC,IAAI;AAC9E,EAAE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE;AAC1C,EAAE,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,cAAc,CAAC;AAC7E,EAAE,IAAI,IAAI;AACV,EAAE,IAAI;AACN,GAAG,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;AACrC,IAAI,MAAM,EAAE,UAAU,CAAC,MAAM;AAC7B,IAAI,QAAQ,EAAE;AACd,IAAI,CAAC;AACL,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;AACvF,GAAG,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AAClE,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC;AACvH,GAAG,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC;AACtE,EAAE,CAAC,SAAS;AACZ,GAAG,YAAY,CAAC,OAAO,CAAC;AACxB,EAAE;AACF,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;AACjB,GAAG,IAAI;AACP,GAAG,SAAS,EAAE;AACd,GAAG,CAAC;AACJ,EAAE,IAAI,KAAK,CAAC,IAAI,GAAG,iBAAiB,EAAE;AACtC,GAAG,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;AAC9C,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1D,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,iBAAiB,EAAE,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1E,EAAE;AACF,EAAE,OAAO,IAAI;AACb,CAAC,CAAC,EAAE;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE;AACjE,CAAC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC;AAC1C,CAAC,IAAI,MAAM;AACX,CAAC,IAAI;AACL,EAAE,MAAM,GAAG,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;AACtF,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,MAAM,IAAI,8BAA8B,CAAC,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC;AACvF,CAAC;AACD,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,MAAM;AACrC,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,MAAM,EAAE,MAAM,KAAK,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE;AACpD,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,SAAS,EAAE;AAC1C,CAAC,IAAI,MAAM;AACX,CAAC,IAAI;AACL,EAAE,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC;AAC7B,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC,CAAC;AAClF,CAAC;AACD,CAAC,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,kCAAkC,EAAE,SAAS,CAAC,CAAC,CAAC;AACjK,CAAC,IAAI,cAAc,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,oFAAoF,EAAE,SAAS,CAAC,CAAC,CAAC;AACjL;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,uBAAuB,CAAC,OAAO,EAAE;AAC1C,CAAC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE;AAC1B,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,yBAAyB,CAAC;AACjH,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,2BAA2B,CAAC;AACzH,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,+BAA+B,CAAC;AACrI,EAAE,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC;AACpC,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,2CAA2C,CAAC;AAC1K,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE;AAC7C,CAAC,IAAI,SAAS,KAAK,IAAI,EAAE,OAAO,MAAM;AACtC,CAAC,OAAO,SAAS,GAAG,SAAS,GAAG,SAAS;AACzC;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,aAAa,EAAE;AACvC,CAAC,OAAO,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3D;;;;"}

package/build/server/chunks/chunks/computeLimits.js-pewehyOG.js

@@ -0,0 +1,44 @@
+import { b as private_env } from './shared-server.js-BGs15m2r.js';
+import { k as lazyLogger } from './providers.server.js-BshinptK.js';
+import './src.js-CkFJvvTE.js';
+import { e as resolveComputeLimits } from './access.js-BataxwA1.js';
+import 'node:dns/promises';
+import 'node:net';
+
+//#region src/lib/server/computeLimits.ts
+/**
+* Thin adapter over `@selvajs/server`'s `resolveComputeLimits`: reads SvelteKit's
+* dynamic private env once and re-exports the resolved values as named constants.
+*
+* Uses `$env/dynamic/private`, not bare `process.env`: under `vite dev`, Vite
+* loads `.env` into this module but does NOT mirror it into `process.env`, so a
+* raw `process.env[name]` is undefined in dev and every knob silently falls back
+* to its default regardless of `.env`.
+*
+* Client-side counterparts (in-flight compute throttle, slider debounce) are
+* bundled into the client and can't read env — see `async-throttle.ts` in
+* `@selvajs/solve/client` and the input components.
+*/
+var limits = resolveComputeLimits(private_env, lazyLogger);
+/** The whole resolved object — passed wholesale to `SolveEngine` (`compute/engine.server.ts`). */
+var computeLimits = limits;
+var SOLVE_DEADLINE_MS = limits.solveDeadlineMs;
+var RATE_LIMIT_WINDOW_MS = limits.rateLimitWindowMs;
+var RATE_LIMIT_MAX_REQUESTS = limits.rateLimitMaxRequests;
+var MAX_DEFINITION_FILE_SIZE = limits.maxDefinitionFileSize;
+var MAX_IMAGE_FILE_SIZE = limits.maxImageFileSize;
+var COMPUTE_REQUEST_MAX_BYTES = limits.computeRequestMaxBytes;
+var COMPUTE_RESPONSE_MAX_BYTES = limits.computeResponseMaxBytes;
+var REMOTE_DEFINITION_MAX_BYTES = limits.remoteDefinitionMaxBytes;
+var REMOTE_DEFINITION_FETCH_TIMEOUT_MS = limits.remoteDefinitionFetchTimeoutMs;
+var REMOTE_DEFINITION_CACHE_TTL_MS = limits.remoteDefinitionCacheTtlMs;
+limits.computeReuseDefinitionCache;
+limits.computeServerCachesolve;
+limits.computeCacheErroredSolves;
+limits.computeMaxQueueDepth;
+limits.computeQueueWaitMs;
+var COMPUTE_DEFINITION_CACHE_BYTES = limits.computeDefinitionCacheBytes;
+var COMPUTE_SOLVE_CACHE_BYTES = limits.computeSolveCacheBytes;
+
+export { COMPUTE_DEFINITION_CACHE_BYTES as C, MAX_IMAGE_FILE_SIZE as M, RATE_LIMIT_MAX_REQUESTS as R, SOLVE_DEADLINE_MS as S, RATE_LIMIT_WINDOW_MS as a, MAX_DEFINITION_FILE_SIZE as b, computeLimits as c, COMPUTE_SOLVE_CACHE_BYTES as d, REMOTE_DEFINITION_CACHE_TTL_MS as e, REMOTE_DEFINITION_FETCH_TIMEOUT_MS as f, REMOTE_DEFINITION_MAX_BYTES as g, COMPUTE_RESPONSE_MAX_BYTES as h, COMPUTE_REQUEST_MAX_BYTES as i };
+//# sourceMappingURL=computeLimits.js-pewehyOG.js.map

package/build/server/chunks/chunks/computeLimits.js-pewehyOG.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"computeLimits.js-pewehyOG.js","sources":["../../../../.svelte-kit/output/server/chunks/computeLimits.js"],"sourcesContent":["import { t as private_env } from \"./shared-server.js\";\nimport { w as lazyLogger } from \"./providers.server.js\";\nimport \"./compute.js\";\nimport { L as resolveComputeLimits } from \"./access.js\";\n//#region src/lib/server/computeLimits.ts\n/**\n* Thin adapter over `@selvajs/server`'s `resolveComputeLimits`: reads SvelteKit's\n* dynamic private env once and re-exports the resolved values as named constants.\n*\n* Uses `$env/dynamic/private`, not bare `process.env`: under `vite dev`, Vite\n* loads `.env` into this module but does NOT mirror it into `process.env`, so a\n* raw `process.env[name]` is undefined in dev and every knob silently falls back\n* to its default regardless of `.env`.\n*\n* Client-side counterparts (in-flight compute throttle, slider debounce) are\n* bundled into the client and can't read env — see `async-throttle.ts` in\n* `@selvajs/solve/client` and the input components.\n*/\nvar limits = resolveComputeLimits(private_env, lazyLogger);\n/** The whole resolved object — passed wholesale to `SolveEngine` (`compute/engine.server.ts`). */\nvar computeLimits = limits;\nvar SOLVE_DEADLINE_MS = limits.solveDeadlineMs;\nvar RATE_LIMIT_WINDOW_MS = limits.rateLimitWindowMs;\nvar RATE_LIMIT_MAX_REQUESTS = limits.rateLimitMaxRequests;\nvar MAX_DEFINITION_FILE_SIZE = limits.maxDefinitionFileSize;\nvar MAX_IMAGE_FILE_SIZE = limits.maxImageFileSize;\nvar COMPUTE_REQUEST_MAX_BYTES = limits.computeRequestMaxBytes;\nvar COMPUTE_RESPONSE_MAX_BYTES = limits.computeResponseMaxBytes;\nvar REMOTE_DEFINITION_MAX_BYTES = limits.remoteDefinitionMaxBytes;\nvar REMOTE_DEFINITION_FETCH_TIMEOUT_MS = limits.remoteDefinitionFetchTimeoutMs;\nvar REMOTE_DEFINITION_CACHE_TTL_MS = limits.remoteDefinitionCacheTtlMs;\nlimits.computeReuseDefinitionCache;\nlimits.computeServerCachesolve;\nlimits.computeCacheErroredSolves;\nlimits.computeMaxQueueDepth;\nlimits.computeQueueWaitMs;\nvar COMPUTE_DEFINITION_CACHE_BYTES = limits.computeDefinitionCacheBytes;\nvar COMPUTE_SOLVE_CACHE_BYTES = limits.computeSolveCacheBytes;\n//#endregion\nexport { MAX_DEFINITION_FILE_SIZE as a, RATE_LIMIT_WINDOW_MS as c, REMOTE_DEFINITION_MAX_BYTES as d, SOLVE_DEADLINE_MS as f, COMPUTE_SOLVE_CACHE_BYTES as i, REMOTE_DEFINITION_CACHE_TTL_MS as l, COMPUTE_REQUEST_MAX_BYTES as n, MAX_IMAGE_FILE_SIZE as o, computeLimits as p, COMPUTE_RESPONSE_MAX_BYTES as r, RATE_LIMIT_MAX_REQUESTS as s, COMPUTE_DEFINITION_CACHE_BYTES as t, REMOTE_DEFINITION_FETCH_TIMEOUT_MS as u };\n"],"names":[],"mappings":";;;;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,MAAM,GAAG,oBAAoB,CAAC,WAAW,EAAE,UAAU,CAAC;AAC1D;AACG,IAAC,aAAa,GAAG;AACjB,IAAC,iBAAiB,GAAG,MAAM,CAAC;AAC5B,IAAC,oBAAoB,GAAG,MAAM,CAAC;AAC/B,IAAC,uBAAuB,GAAG,MAAM,CAAC;AAClC,IAAC,wBAAwB,GAAG,MAAM,CAAC;AACnC,IAAC,mBAAmB,GAAG,MAAM,CAAC;AAC9B,IAAC,yBAAyB,GAAG,MAAM,CAAC;AACpC,IAAC,0BAA0B,GAAG,MAAM,CAAC;AACrC,IAAC,2BAA2B,GAAG,MAAM,CAAC;AACtC,IAAC,kCAAkC,GAAG,MAAM,CAAC;AAC7C,IAAC,8BAA8B,GAAG,MAAM,CAAC;AAC5C,MAAM,CAAC,2BAA2B;AAClC,MAAM,CAAC,uBAAuB;AAC9B,MAAM,CAAC,yBAAyB;AAChC,MAAM,CAAC,oBAAoB;AAC3B,MAAM,CAAC,kBAAkB;AACtB,IAAC,8BAA8B,GAAG,MAAM,CAAC;AACzC,IAAC,yBAAyB,GAAG,MAAM,CAAC;;;;"}

package/build/server/chunks/chunks/computeRateLimit.server.js-BfYbihtj.js

@@ -0,0 +1,31 @@
+import { b as private_env } from './shared-server.js-BGs15m2r.js';
+import { k as lazyLogger } from './providers.server.js-BshinptK.js';
+import './src.js-CkFJvvTE.js';
+import './access.js-BataxwA1.js';
+import 'node:dns/promises';
+import 'node:net';
+import { c as createComputeRateLimiter } from './rate-limit.js-Br3luBbc.js';
+import { n as createApiRateLimiter, r as resolveApiRateLimitConfig } from './api.js-CsByc21P.js';
+import { R as RATE_LIMIT_MAX_REQUESTS, a as RATE_LIMIT_WINDOW_MS } from './computeLimits.js-pewehyOG.js';
+
+//#region src/lib/server/computeRateLimit.server.ts
+/**
+* App-wide instance of the compute-solve rate limiter (fixed-window, per-key,
+* process-local; `@selvajs/server`'s `createComputeRateLimiter`), wired with the
+* window + cap from `computeLimits.ts`.
+*
+* Keyed by caller — `user:{userId}` for authenticated solves, `share:{linkId}`
+* for share-token solves so anonymous consumers of one link don't share a
+* bucket with the link's owner.
+*/
+var limiter = createComputeRateLimiter({
+	windowMs: RATE_LIMIT_WINDOW_MS,
+	maxPerWindow: RATE_LIMIT_MAX_REQUESTS
+});
+function checkComputeRateLimit(key) {
+	return limiter.check(key);
+}
+var apiRateLimiter = createApiRateLimiter(resolveApiRateLimitConfig(private_env, lazyLogger));
+
+export { apiRateLimiter as a, checkComputeRateLimit as c };
+//# sourceMappingURL=computeRateLimit.server.js-BfYbihtj.js.map

package/build/server/chunks/chunks/computeRateLimit.server.js-BfYbihtj.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"computeRateLimit.server.js-BfYbihtj.js","sources":["../../../../.svelte-kit/output/server/chunks/computeRateLimit.server.js"],"sourcesContent":["import { t as private_env } from \"./shared-server.js\";\nimport { w as lazyLogger } from \"./providers.server.js\";\nimport \"./compute.js\";\nimport { t as createComputeRateLimiter } from \"./rate-limit.js\";\nimport { A as resolveApiRateLimitConfig, O as createApiRateLimiter } from \"./api.js\";\nimport { c as RATE_LIMIT_WINDOW_MS, s as RATE_LIMIT_MAX_REQUESTS } from \"./computeLimits.js\";\n//#region src/lib/server/computeRateLimit.server.ts\n/**\n* App-wide instance of the compute-solve rate limiter (fixed-window, per-key,\n* process-local; `@selvajs/server`'s `createComputeRateLimiter`), wired with the\n* window + cap from `computeLimits.ts`.\n*\n* Keyed by caller — `user:{userId}` for authenticated solves, `share:{linkId}`\n* for share-token solves so anonymous consumers of one link don't share a\n* bucket with the link's owner.\n*/\nvar limiter = createComputeRateLimiter({\n\twindowMs: RATE_LIMIT_WINDOW_MS,\n\tmaxPerWindow: RATE_LIMIT_MAX_REQUESTS\n});\nfunction checkComputeRateLimit(key) {\n\treturn limiter.check(key);\n}\nvar apiRateLimiter = createApiRateLimiter(resolveApiRateLimitConfig(private_env, lazyLogger));\n//#endregion\nexport { checkComputeRateLimit as n, apiRateLimiter as t };\n"],"names":[],"mappings":";;;;;;;;;;AAMA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,OAAO,GAAG,wBAAwB,CAAC;AACvC,CAAC,QAAQ,EAAE,oBAAoB;AAC/B,CAAC,YAAY,EAAE;AACf,CAAC,CAAC;AACF,SAAS,qBAAqB,CAAC,GAAG,EAAE;AACpC,CAAC,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC;AAC1B;AACG,IAAC,cAAc,GAAG,oBAAoB,CAAC,yBAAyB,CAAC,WAAW,EAAE,UAAU,CAAC;;;;"}

package/build/server/chunks/chunks/definitions.js-BKMI1oEB.js

@@ -0,0 +1,390 @@
+import { t as toSourceDocumentId, P as ProviderError } from './src.js-CkFJvvTE.js';
+import { N as NoopLogger } from './access.js-BataxwA1.js';
+import { f as fetchSchemaFromCompute } from './schema-extraction.js-BC1rATQL.js';
+import { randomUUID } from 'node:crypto';
+
+//#region ../platform/src/definitions/paths.ts
+/**
+* Path-segment safety check. Blocks traversal, separators, NUL, and empty
+* segments. Allowed alphabet `[A-Za-z0-9._-]+` covers GUIDs and sanitized
+* refs. Called by every helper so a malicious `guid` can't escape the
+* `definitions/` prefix.
+*/
+function assertSafeKey(value, label) {
+	if (!value || !/^[A-Za-z0-9._-]+$/.test(value) || value === "." || value === "..") throw new Error(`Unsafe ${label}: ${JSON.stringify(value)}`);
+}
+var definitionPaths = {
+	version: (guid, versionNumber, ext) => {
+		assertSafeKey(guid, "guid");
+		if (!Number.isInteger(versionNumber) || versionNumber < 1) throw new Error(`Unsafe versionNumber: ${versionNumber}`);
+		return `definitions/${guid}/versions/v${versionNumber}.${ext}`;
+	},
+	image: (guid) => {
+		assertSafeKey(guid, "guid");
+		return `definitions/${guid}/cover.webp`;
+	},
+	prefix: (guid) => {
+		assertSafeKey(guid, "guid");
+		return `definitions/${guid}/`;
+	}
+};
+//#endregion
+//#region ../server/src/logging/requestId.ts
+/**
+* Request-id resolution for log correlation. Every record on a request path
+* carries the same `requestId`, so an operator handed one id can reconstruct
+* that request's whole story.
+*
+* Inbound ids are TRUSTED when present. Selva runs behind a reverse proxy
+* (Caddy/nginx) that mints a request id for its own access logs; minting a
+* second one here would split one request across two ids and kill cross-tier
+* correlation. The trade — a direct caller picks their own id — is fine, because
+* the id is only ever a log field and an echoed response header, never an
+* authorization or uniqueness input.
+*
+* That trust is why {@link sanitizeRequestId} exists: an attacker-chosen id is
+* untrusted content. Unbounded or newline-carrying values would let a caller
+* forge log lines (log injection) or bloat every record on the request.
+*/
+/** Header carrying a caller/proxy-supplied id. The de-facto standard spelling. */
+var REQUEST_ID_HEADER = "x-request-id";
+/** Long enough for a UUID or a W3C trace-id, short enough to bound a record. */
+var MAX_REQUEST_ID_LENGTH = 128;
+/**
+* Characters allowed through verbatim. Strict on purpose: UUIDs, ULIDs, hex
+* trace-ids and nginx's `$request_id` all fit. Everything else — whitespace,
+* control chars, quotes, CR/LF — is dropped rather than escaped, since no
+* legitimate id needs them and dropping can't be un-escaped downstream.
+*/
+var UNSAFE_REQUEST_ID_CHARS = /[^A-Za-z0-9._:-]/g;
+/** Returns `null` when nothing usable survives, so the caller generates instead. */
+function sanitizeRequestId(raw) {
+	if (!raw) return null;
+	const cleaned = raw.replace(UNSAFE_REQUEST_ID_CHARS, "").slice(0, MAX_REQUEST_ID_LENGTH);
+	return cleaned.length > 0 ? cleaned : null;
+}
+/**
+* Reuse the proxy's id when it survives sanitization, otherwise mint a UUID.
+*
+* @param generate injectable so tests get deterministic ids
+*/
+function resolveRequestId(headers, generate = randomId) {
+	return sanitizeRequestId(headers.get("x-request-id")) ?? generate();
+}
+/**
+* Render a thrown value into a log field.
+*
+* Not every rejection is an `Error` — provider adapters sometimes reject with a
+* plain `{ message, status }`, which would stringify to a useless
+* `[object Object]` and destroy the only record of the failure. Errors keep
+* their stack; anything else is JSON-serialized, with `String()` as the last
+* resort for cycles and exotic values.
+*
+* A `code` / `statusCode` carried on the error (ComputeError, ProviderError,
+* Node's ECONNREFUSED-style errors) is appended as a `[code=… status=…]` tag —
+* it classifies the failure and stacks alone don't show it.
+*/
+function renderThrown(error) {
+	if (error instanceof Error) {
+		const base = error.stack ?? error.message;
+		const code = error.code;
+		const statusCode = error.statusCode;
+		const tags = [];
+		if (typeof code === "string" || typeof code === "number") tags.push(`code=${code}`);
+		if (typeof statusCode === "number") tags.push(`status=${statusCode}`);
+		return tags.length > 0 ? `${base} [${tags.join(" ")}]` : base;
+	}
+	try {
+		return JSON.stringify(error) ?? String(error);
+	} catch {
+		return String(error);
+	}
+}
+/**
+* `crypto.randomUUID` exists in every runtime Selva targets (Node 22+, workers,
+* modern browsers); the `Math.random` branch only covers non-secure contexts
+* where it is missing. Not a weakness: these ids need to be collision-free
+* enough to correlate logs, never unguessable.
+*/
+function randomId() {
+	const c = globalThis.crypto;
+	if (c && typeof c.randomUUID === "function") return c.randomUUID();
+	return `req-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+}
+//#endregion
+//#region ../server/src/definitions/definition-service.ts
+/**
+* Orchestrates writes spanning IDataProvider + IStorageProvider. Application
+* orchestration, not platform contract — hence not in @selvajs/platform.
+*
+* Methods that write both metadata and blobs order the two so a mid-flight
+* failure leaves a state the API can still serve; those reasons sit inline at
+* each write. `publish` and `updateMeta` flip pointers/metadata only and touch
+* storage not at all.
+*/
+var DefinitionService = class {
+	data;
+	storage;
+	constructor(data, storage) {
+		this.data = data;
+		this.storage = storage;
+	}
+	async create(ctx, input, file, schema) {
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const actor = ctx.userId || input.ownerId;
+		const record = {
+			guid: input.guid,
+			projectId: input.projectId,
+			ownerId: input.ownerId,
+			createdBy: actor,
+			updatedBy: actor,
+			displayName: input.displayName,
+			description: input.description,
+			category: input.category,
+			tags: input.tags,
+			coverImage: input.coverImage,
+			computeServerId: input.computeServerId,
+			status: "pending",
+			solveCount: 0,
+			nextVersionNumber: 2,
+			liveVersionId: null,
+			draftVersionId: null,
+			sourceDocumentId: toSourceDocumentId(schema.documentId) ?? void 0,
+			createdAt: now,
+			updatedAt: now,
+			deletedAt: null
+		};
+		await this.data.definitions.create(ctx, record);
+		const versionId = randomUUID();
+		const fileKey = definitionPaths.version(input.guid, 1, input.fileExt);
+		await this.storage.put(fileKey, file, "application/octet-stream");
+		const version = {
+			id: versionId,
+			definitionId: input.guid,
+			versionNumber: 1,
+			fileExt: input.fileExt,
+			fileKey,
+			originalFilename: input.originalFilename,
+			uploadedBy: actor,
+			uploadedAt: now,
+			schema,
+			schemaExtractedAt: now
+		};
+		await this.data.definitions.createVersion(ctx, version);
+		await this.data.definitions.attachInitialVersion(ctx, input.guid, versionId);
+		return {
+			record: {
+				...record,
+				status: "draft",
+				liveVersionId: versionId,
+				draftVersionId: versionId
+			},
+			version
+		};
+	}
+	/**
+	* Advances the draft pointer only — `live` is unchanged. Use `publish` to
+	* promote.
+	*/
+	async uploadVersion(ctx, guid, file, ext, originalName, schema, changeNote) {
+		const existing = await this.data.definitions.get(ctx, guid);
+		if (!existing) throw new ProviderError(`Definition not found: ${guid}`, 404);
+		const next = await this.data.definitions.reserveNextVersionNumber(ctx, guid);
+		const versionId = randomUUID();
+		const fileKey = definitionPaths.version(guid, next, ext);
+		await this.storage.put(fileKey, file, "application/octet-stream");
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const version = {
+			id: versionId,
+			definitionId: guid,
+			versionNumber: next,
+			fileExt: ext,
+			fileKey,
+			originalFilename: originalName,
+			uploadedBy: ctx.userId || existing.ownerId,
+			uploadedAt: now,
+			changeNote: changeNote?.trim() || void 0,
+			schema,
+			schemaExtractedAt: now
+		};
+		await this.data.definitions.createVersion(ctx, version);
+		await this.data.definitions.setDraftVersion(ctx, guid, versionId);
+		const sourceDocumentId = toSourceDocumentId(schema.documentId);
+		if (sourceDocumentId && sourceDocumentId !== existing.sourceDocumentId) await this.data.definitions.update(ctx, guid, { sourceDocumentId });
+		return version;
+	}
+	/**
+	* Moves the live channel to `versionId`, or to the current draft if omitted.
+	* Any version id is accepted, so this rolls backward as well as forward.
+	*/
+	async publish(ctx, guid, versionId) {
+		const existing = await this.data.definitions.get(ctx, guid);
+		if (!existing) throw new ProviderError(`Definition not found: ${guid}`, 404);
+		const target = versionId ?? existing.draftVersionId;
+		if (!target) throw new ProviderError("No version to publish", 400);
+		const version = await this.data.definitions.getVersion(ctx, target);
+		if (!version || version.definitionId !== guid) throw new ProviderError(`Version '${target}' not found for this definition`, 404);
+		await this.data.definitions.setLiveVersion(ctx, guid, target);
+		if (existing.status === "draft" || existing.status === "pending") await this.data.definitions.update(ctx, guid, { status: "published" });
+		return version;
+	}
+	async deleteVersion(ctx, guid, versionId) {
+		const version = await this.data.definitions.getVersion(ctx, versionId);
+		if (!version || version.definitionId !== guid) throw new ProviderError(`Version '${versionId}' not found for this definition`, 404);
+		await this.data.definitions.deleteVersion(ctx, versionId);
+		await this.storage.delete(version.fileKey);
+	}
+	async updateMeta(ctx, guid, patch) {
+		await this.data.definitions.update(ctx, guid, patch);
+	}
+	async saveCoverImage(ctx, guid, imageData) {
+		const path = definitionPaths.image(guid);
+		await this.storage.put(path, imageData, "image/webp");
+		const url = this.storage.getPublicUrl(path);
+		await this.data.definitions.update(ctx, guid, { coverImage: url });
+		return url;
+	}
+	async delete(ctx, guid) {
+		await this.data.definitions.delete(ctx, guid);
+		await this.storage.deletePrefix(definitionPaths.prefix(guid));
+	}
+};
+//#endregion
+//#region ../server/src/definitions/load-for-render.ts
+var DefinitionLoadError = class extends Error {
+	kind;
+	cause;
+	constructor(kind, message, cause) {
+		super(message);
+		this.kind = kind;
+		this.cause = cause;
+		this.name = "DefinitionLoadError";
+	}
+};
+/**
+* The returned loader resolves the `channel` pointer (live/draft) by default.
+* `explicitVersionId` renders an arbitrary historical version instead — the
+* caller MUST gate that behind edit permission, as with the draft channel.
+*/
+function createDefinitionLoader(deps) {
+	const { storage, definitions, projects, resolveServer, getClient, fetchSchema = fetchSchemaFromCompute, computeDebug = false, onWarn, logger = new NoopLogger() } = deps;
+	return async function loadDefinitionForRender(ctx, record, channel, explicitVersionId, options) {
+		const versionId = explicitVersionId ?? (channel === "draft" ? record.draftVersionId : record.liveVersionId);
+		if (!versionId) throw new DefinitionLoadError("data", `Definition '${record.guid}' has no ${channel} version`);
+		const version = await definitions.getVersion(ctx, versionId);
+		if (!version) throw new DefinitionLoadError("data", `version missing for '${record.guid}'`);
+		if (version.definitionId !== record.guid) throw new DefinitionLoadError("data", `version does not belong to '${record.guid}'`);
+		const definitionSource = await storage.get(version.fileKey);
+		if (!definitionSource) throw new DefinitionLoadError("data", `Definition file for '${record.guid}' not found on disk`);
+		const project = await projects.getProject(ctx, record.projectId);
+		let computeServer;
+		try {
+			computeServer = await resolveServer(ctx, project?.orgId ?? null, { definitionPin: record.computeServerId ?? null });
+		} catch (err) {
+			throw new DefinitionLoadError("missing-config", "No compute server configured for this definition", err);
+		}
+		if (options?.skipComputeDefaults) {
+			const cachedSchema = version.schema;
+			if (cachedSchema && isUsableCachedSchema(cachedSchema)) return {
+				version,
+				definitionSource,
+				computeServer,
+				schema: cachedSchema
+			};
+		}
+		let client;
+		try {
+			client = (await getClient(computeServer, { definitionGuid: record.guid })).client;
+		} catch (err) {
+			throw new DefinitionLoadError("connect", `Failed to connect to Rhino Compute server: ${err instanceof Error ? err.message : String(err)}`, err);
+		}
+		try {
+			const cachedSchema = version.schema;
+			const freshCache = cachedSchema && isUsableCachedSchema(cachedSchema) ? cachedSchema : null;
+			const [definition, fetchedSchema] = await Promise.all([client.getIO(definitionSource), freshCache ? Promise.resolve(freshCache) : fetchSchema(definitionSource, computeServer)]);
+			if (!freshCache && fetchedSchema.schemaVersion === "2.15.0") definitions.setVersionSchema(ctx, version.id, fetchedSchema).catch((err) => {
+				if (onWarn) {
+					onWarn(`[loadForRender] schema cache refresh failed for version ${version.id}: ${err instanceof Error ? err.message : String(err)}`);
+					return;
+				}
+				logger.warn("Schema cache refresh failed", {
+					component: "loadForRender",
+					versionId: version.id,
+					err: err instanceof Error ? err.stack ?? err.message : String(err)
+				});
+			});
+			if (!definition) throw new Error(`Failed to get definition IO — server returned undefined`);
+			const ioParseErrors = definition.parseErrors ?? [];
+			const ioLoadErrors = definition.loadErrors ?? [];
+			if (definition.inputs.length === 0 || ioParseErrors.length > 0 || ioLoadErrors.length > 0) {
+				const health = {
+					inputCount: definition.inputs.length,
+					outputCount: definition.outputs?.length,
+					parseErrors: ioParseErrors,
+					loadErrors: ioLoadErrors,
+					loadWarnings: definition.loadWarnings
+				};
+				if (onWarn) onWarn(`[loadForRender] IO health for '${record.guid}':`, JSON.stringify(health));
+				else logger.warn("Definition IO looks unhealthy", {
+					component: "loadForRender",
+					definitionGuid: record.guid,
+					...health
+				});
+				if (computeDebug) {
+					const rawIO = await client.getRawIO(definitionSource).catch((e) => ({ error: String(e) }));
+					const rendered = JSON.stringify(rawIO).slice(0, 3e3);
+					if (onWarn) onWarn("[loadForRender] raw /io:", rendered);
+					else logger.debug("Raw /io wire shape", {
+						component: "loadForRender",
+						definitionGuid: record.guid,
+						rawIO: rendered
+					});
+				}
+			}
+			return {
+				version,
+				definitionSource,
+				computeServer,
+				schema: mergeComputeDefaults(fetchedSchema, definition.inputs)
+			};
+		} catch (err) {
+			if (err instanceof DefinitionLoadError) throw err;
+			throw new DefinitionLoadError("schema", err instanceof Error ? err.message : String(err), err);
+		}
+	};
+}
+/**
+* A cached schema is usable only if it is BOTH the current format version and
+* structurally sound. The version check alone is not enough: a compute server
+* that serialized the schema with the wrong Newtonsoft emits PascalCase keys, so
+* `schemaVersion` reads as undefined while `SchemaVersion` holds the value —
+* and a row cached during that window would otherwise be served forever, long
+* after the server was fixed. See `assertCamelCaseSchema`.
+*/
+function isUsableCachedSchema(schema) {
+	return schema.schemaVersion === "2.15.0" && Array.isArray(schema.inputs);
+}
+function mergeComputeDefaults(schema, computeInputs) {
+	if (!Array.isArray(schema.inputs)) throw new DefinitionLoadError("schema", `Schema has no 'inputs' array (keys: ${Object.keys(schema).slice(0, 12).join(", ")}). A PascalCase shape here means compute serialized it with the wrong Newtonsoft — see assertCamelCaseSchema.`);
+	const byParamId = new Map(computeInputs.map((input) => [input.id, input]));
+	return {
+		...schema,
+		inputs: schema.inputs.map((schemaInput) => {
+			const computeInput = byParamId.get(schemaInput.id);
+			if (computeInput?.paramType === "Color" && computeInput.default !== void 0) {
+				const toHex = (value) => value.toString(16).padStart(2, "0");
+				const parts = String(computeInput.default).split(",").map((s) => parseInt(s.trim(), 10));
+				if (parts.length === 3) computeInput.default = `#${toHex(parts[0])}${toHex(parts[1])}${toHex(parts[2])}`;
+				else if (parts.length === 4) computeInput.default = `#${toHex(parts[1])}${toHex(parts[2])}${toHex(parts[3])}`;
+			}
+			if (computeInput && computeInput.default !== void 0) return {
+				...schemaInput,
+				default: computeInput.default
+			};
+			return schemaInput;
+		})
+	};
+}
+
+export { DefinitionService as D, REQUEST_ID_HEADER as R, resolveRequestId as a, DefinitionLoadError as b, createDefinitionLoader as c, definitionPaths as d, renderThrown as r };
+//# sourceMappingURL=definitions.js-BKMI1oEB.js.map

package/build/server/chunks/chunks/definitions.js-BKMI1oEB.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"definitions.js-BKMI1oEB.js","sources":["../../../../.svelte-kit/output/server/chunks/definitions.js"],"sourcesContent":["import { S as ProviderError, d as toSourceDocumentId } from \"./src.js\";\nimport { z as NoopLogger } from \"./access.js\";\nimport { r as fetchSchemaFromCompute } from \"./schema-extraction.js\";\nimport \"./visibility.js\";\nimport \"./schema.js\";\nimport { randomUUID } from \"node:crypto\";\n//#region ../platform/src/definitions/paths.ts\n/**\n* Path-segment safety check. Blocks traversal, separators, NUL, and empty\n* segments. Allowed alphabet `[A-Za-z0-9._-]+` covers GUIDs and sanitized\n* refs. Called by every helper so a malicious `guid` can't escape the\n* `definitions/` prefix.\n*/\nfunction assertSafeKey(value, label) {\n\tif (!value || !/^[A-Za-z0-9._-]+$/.test(value) || value === \".\" || value === \"..\") throw new Error(`Unsafe ${label}: ${JSON.stringify(value)}`);\n}\nvar definitionPaths = {\n\tversion: (guid, versionNumber, ext) => {\n\t\tassertSafeKey(guid, \"guid\");\n\t\tif (!Number.isInteger(versionNumber) || versionNumber < 1) throw new Error(`Unsafe versionNumber: ${versionNumber}`);\n\t\treturn `definitions/${guid}/versions/v${versionNumber}.${ext}`;\n\t},\n\timage: (guid) => {\n\t\tassertSafeKey(guid, \"guid\");\n\t\treturn `definitions/${guid}/cover.webp`;\n\t},\n\tprefix: (guid) => {\n\t\tassertSafeKey(guid, \"guid\");\n\t\treturn `definitions/${guid}/`;\n\t}\n};\n//#endregion\n//#region ../server/src/logging/requestId.ts\n/**\n* Request-id resolution for log correlation. Every record on a request path\n* carries the same `requestId`, so an operator handed one id can reconstruct\n* that request's whole story.\n*\n* Inbound ids are TRUSTED when present. Selva runs behind a reverse proxy\n* (Caddy/nginx) that mints a request id for its own access logs; minting a\n* second one here would split one request across two ids and kill cross-tier\n* correlation. The trade — a direct caller picks their own id — is fine, because\n* the id is only ever a log field and an echoed response header, never an\n* authorization or uniqueness input.\n*\n* That trust is why {@link sanitizeRequestId} exists: an attacker-chosen id is\n* untrusted content. Unbounded or newline-carrying values would let a caller\n* forge log lines (log injection) or bloat every record on the request.\n*/\n/** Header carrying a caller/proxy-supplied id. The de-facto standard spelling. */\nvar REQUEST_ID_HEADER = \"x-request-id\";\n/** Long enough for a UUID or a W3C trace-id, short enough to bound a record. */\nvar MAX_REQUEST_ID_LENGTH = 128;\n/**\n* Characters allowed through verbatim. Strict on purpose: UUIDs, ULIDs, hex\n* trace-ids and nginx's `$request_id` all fit. Everything else — whitespace,\n* control chars, quotes, CR/LF — is dropped rather than escaped, since no\n* legitimate id needs them and dropping can't be un-escaped downstream.\n*/\nvar UNSAFE_REQUEST_ID_CHARS = /[^A-Za-z0-9._:-]/g;\n/** Returns `null` when nothing usable survives, so the caller generates instead. */\nfunction sanitizeRequestId(raw) {\n\tif (!raw) return null;\n\tconst cleaned = raw.replace(UNSAFE_REQUEST_ID_CHARS, \"\").slice(0, MAX_REQUEST_ID_LENGTH);\n\treturn cleaned.length > 0 ? cleaned : null;\n}\n/**\n* Reuse the proxy's id when it survives sanitization, otherwise mint a UUID.\n*\n* @param generate injectable so tests get deterministic ids\n*/\nfunction resolveRequestId(headers, generate = randomId) {\n\treturn sanitizeRequestId(headers.get(\"x-request-id\")) ?? generate();\n}\n/**\n* Render a thrown value into a log field.\n*\n* Not every rejection is an `Error` — provider adapters sometimes reject with a\n* plain `{ message, status }`, which would stringify to a useless\n* `[object Object]` and destroy the only record of the failure. Errors keep\n* their stack; anything else is JSON-serialized, with `String()` as the last\n* resort for cycles and exotic values.\n*\n* A `code` / `statusCode` carried on the error (ComputeError, ProviderError,\n* Node's ECONNREFUSED-style errors) is appended as a `[code=… status=…]` tag —\n* it classifies the failure and stacks alone don't show it.\n*/\nfunction renderThrown(error) {\n\tif (error instanceof Error) {\n\t\tconst base = error.stack ?? error.message;\n\t\tconst code = error.code;\n\t\tconst statusCode = error.statusCode;\n\t\tconst tags = [];\n\t\tif (typeof code === \"string\" || typeof code === \"number\") tags.push(`code=${code}`);\n\t\tif (typeof statusCode === \"number\") tags.push(`status=${statusCode}`);\n\t\treturn tags.length > 0 ? `${base} [${tags.join(\" \")}]` : base;\n\t}\n\ttry {\n\t\treturn JSON.stringify(error) ?? String(error);\n\t} catch {\n\t\treturn String(error);\n\t}\n}\n/**\n* `crypto.randomUUID` exists in every runtime Selva targets (Node 22+, workers,\n* modern browsers); the `Math.random` branch only covers non-secure contexts\n* where it is missing. Not a weakness: these ids need to be collision-free\n* enough to correlate logs, never unguessable.\n*/\nfunction randomId() {\n\tconst c = globalThis.crypto;\n\tif (c && typeof c.randomUUID === \"function\") return c.randomUUID();\n\treturn `req-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;\n}\n//#endregion\n//#region ../server/src/definitions/definition-service.ts\n/**\n* Orchestrates writes spanning IDataProvider + IStorageProvider. Application\n* orchestration, not platform contract — hence not in @selvajs/platform.\n*\n* Methods that write both metadata and blobs order the two so a mid-flight\n* failure leaves a state the API can still serve; those reasons sit inline at\n* each write. `publish` and `updateMeta` flip pointers/metadata only and touch\n* storage not at all.\n*/\nvar DefinitionService = class {\n\tdata;\n\tstorage;\n\tconstructor(data, storage) {\n\t\tthis.data = data;\n\t\tthis.storage = storage;\n\t}\n\tasync create(ctx, input, file, schema) {\n\t\tconst now = (/* @__PURE__ */ new Date()).toISOString();\n\t\tconst actor = ctx.userId || input.ownerId;\n\t\tconst record = {\n\t\t\tguid: input.guid,\n\t\t\tprojectId: input.projectId,\n\t\t\townerId: input.ownerId,\n\t\t\tcreatedBy: actor,\n\t\t\tupdatedBy: actor,\n\t\t\tdisplayName: input.displayName,\n\t\t\tdescription: input.description,\n\t\t\tcategory: input.category,\n\t\t\ttags: input.tags,\n\t\t\tcoverImage: input.coverImage,\n\t\t\tcomputeServerId: input.computeServerId,\n\t\t\tstatus: \"pending\",\n\t\t\tsolveCount: 0,\n\t\t\tnextVersionNumber: 2,\n\t\t\tliveVersionId: null,\n\t\t\tdraftVersionId: null,\n\t\t\tsourceDocumentId: toSourceDocumentId(schema.documentId) ?? void 0,\n\t\t\tcreatedAt: now,\n\t\t\tupdatedAt: now,\n\t\t\tdeletedAt: null\n\t\t};\n\t\tawait this.data.definitions.create(ctx, record);\n\t\tconst versionId = randomUUID();\n\t\tconst fileKey = definitionPaths.version(input.guid, 1, input.fileExt);\n\t\tawait this.storage.put(fileKey, file, \"application/octet-stream\");\n\t\tconst version = {\n\t\t\tid: versionId,\n\t\t\tdefinitionId: input.guid,\n\t\t\tversionNumber: 1,\n\t\t\tfileExt: input.fileExt,\n\t\t\tfileKey,\n\t\t\toriginalFilename: input.originalFilename,\n\t\t\tuploadedBy: actor,\n\t\t\tuploadedAt: now,\n\t\t\tschema,\n\t\t\tschemaExtractedAt: now\n\t\t};\n\t\tawait this.data.definitions.createVersion(ctx, version);\n\t\tawait this.data.definitions.attachInitialVersion(ctx, input.guid, versionId);\n\t\treturn {\n\t\t\trecord: {\n\t\t\t\t...record,\n\t\t\t\tstatus: \"draft\",\n\t\t\t\tliveVersionId: versionId,\n\t\t\t\tdraftVersionId: versionId\n\t\t\t},\n\t\t\tversion\n\t\t};\n\t}\n\t/**\n\t* Advances the draft pointer only — `live` is unchanged. Use `publish` to\n\t* promote.\n\t*/\n\tasync uploadVersion(ctx, guid, file, ext, originalName, schema, changeNote) {\n\t\tconst existing = await this.data.definitions.get(ctx, guid);\n\t\tif (!existing) throw new ProviderError(`Definition not found: ${guid}`, 404);\n\t\tconst next = await this.data.definitions.reserveNextVersionNumber(ctx, guid);\n\t\tconst versionId = randomUUID();\n\t\tconst fileKey = definitionPaths.version(guid, next, ext);\n\t\tawait this.storage.put(fileKey, file, \"application/octet-stream\");\n\t\tconst now = (/* @__PURE__ */ new Date()).toISOString();\n\t\tconst version = {\n\t\t\tid: versionId,\n\t\t\tdefinitionId: guid,\n\t\t\tversionNumber: next,\n\t\t\tfileExt: ext,\n\t\t\tfileKey,\n\t\t\toriginalFilename: originalName,\n\t\t\tuploadedBy: ctx.userId || existing.ownerId,\n\t\t\tuploadedAt: now,\n\t\t\tchangeNote: changeNote?.trim() || void 0,\n\t\t\tschema,\n\t\t\tschemaExtractedAt: now\n\t\t};\n\t\tawait this.data.definitions.createVersion(ctx, version);\n\t\tawait this.data.definitions.setDraftVersion(ctx, guid, versionId);\n\t\tconst sourceDocumentId = toSourceDocumentId(schema.documentId);\n\t\tif (sourceDocumentId && sourceDocumentId !== existing.sourceDocumentId) await this.data.definitions.update(ctx, guid, { sourceDocumentId });\n\t\treturn version;\n\t}\n\t/**\n\t* Moves the live channel to `versionId`, or to the current draft if omitted.\n\t* Any version id is accepted, so this rolls backward as well as forward.\n\t*/\n\tasync publish(ctx, guid, versionId) {\n\t\tconst existing = await this.data.definitions.get(ctx, guid);\n\t\tif (!existing) throw new ProviderError(`Definition not found: ${guid}`, 404);\n\t\tconst target = versionId ?? existing.draftVersionId;\n\t\tif (!target) throw new ProviderError(\"No version to publish\", 400);\n\t\tconst version = await this.data.definitions.getVersion(ctx, target);\n\t\tif (!version || version.definitionId !== guid) throw new ProviderError(`Version '${target}' not found for this definition`, 404);\n\t\tawait this.data.definitions.setLiveVersion(ctx, guid, target);\n\t\tif (existing.status === \"draft\" || existing.status === \"pending\") await this.data.definitions.update(ctx, guid, { status: \"published\" });\n\t\treturn version;\n\t}\n\tasync deleteVersion(ctx, guid, versionId) {\n\t\tconst version = await this.data.definitions.getVersion(ctx, versionId);\n\t\tif (!version || version.definitionId !== guid) throw new ProviderError(`Version '${versionId}' not found for this definition`, 404);\n\t\tawait this.data.definitions.deleteVersion(ctx, versionId);\n\t\tawait this.storage.delete(version.fileKey);\n\t}\n\tasync updateMeta(ctx, guid, patch) {\n\t\tawait this.data.definitions.update(ctx, guid, patch);\n\t}\n\tasync saveCoverImage(ctx, guid, imageData) {\n\t\tconst path = definitionPaths.image(guid);\n\t\tawait this.storage.put(path, imageData, \"image/webp\");\n\t\tconst url = this.storage.getPublicUrl(path);\n\t\tawait this.data.definitions.update(ctx, guid, { coverImage: url });\n\t\treturn url;\n\t}\n\tasync delete(ctx, guid) {\n\t\tawait this.data.definitions.delete(ctx, guid);\n\t\tawait this.storage.deletePrefix(definitionPaths.prefix(guid));\n\t}\n};\n//#endregion\n//#region ../server/src/definitions/load-for-render.ts\nvar DefinitionLoadError = class extends Error {\n\tkind;\n\tcause;\n\tconstructor(kind, message, cause) {\n\t\tsuper(message);\n\t\tthis.kind = kind;\n\t\tthis.cause = cause;\n\t\tthis.name = \"DefinitionLoadError\";\n\t}\n};\n/**\n* The returned loader resolves the `channel` pointer (live/draft) by default.\n* `explicitVersionId` renders an arbitrary historical version instead — the\n* caller MUST gate that behind edit permission, as with the draft channel.\n*/\nfunction createDefinitionLoader(deps) {\n\tconst { storage, definitions, projects, resolveServer, getClient, fetchSchema = fetchSchemaFromCompute, computeDebug = false, onWarn, logger = new NoopLogger() } = deps;\n\treturn async function loadDefinitionForRender(ctx, record, channel, explicitVersionId, options) {\n\t\tconst versionId = explicitVersionId ?? (channel === \"draft\" ? record.draftVersionId : record.liveVersionId);\n\t\tif (!versionId) throw new DefinitionLoadError(\"data\", `Definition '${record.guid}' has no ${channel} version`);\n\t\tconst version = await definitions.getVersion(ctx, versionId);\n\t\tif (!version) throw new DefinitionLoadError(\"data\", `version missing for '${record.guid}'`);\n\t\tif (version.definitionId !== record.guid) throw new DefinitionLoadError(\"data\", `version does not belong to '${record.guid}'`);\n\t\tconst definitionSource = await storage.get(version.fileKey);\n\t\tif (!definitionSource) throw new DefinitionLoadError(\"data\", `Definition file for '${record.guid}' not found on disk`);\n\t\tconst project = await projects.getProject(ctx, record.projectId);\n\t\tlet computeServer;\n\t\ttry {\n\t\t\tcomputeServer = await resolveServer(ctx, project?.orgId ?? null, { definitionPin: record.computeServerId ?? null });\n\t\t} catch (err) {\n\t\t\tthrow new DefinitionLoadError(\"missing-config\", \"No compute server configured for this definition\", err);\n\t\t}\n\t\tif (options?.skipComputeDefaults) {\n\t\t\tconst cachedSchema = version.schema;\n\t\t\tif (cachedSchema && isUsableCachedSchema(cachedSchema)) return {\n\t\t\t\tversion,\n\t\t\t\tdefinitionSource,\n\t\t\t\tcomputeServer,\n\t\t\t\tschema: cachedSchema\n\t\t\t};\n\t\t}\n\t\tlet client;\n\t\ttry {\n\t\t\tclient = (await getClient(computeServer, { definitionGuid: record.guid })).client;\n\t\t} catch (err) {\n\t\t\tthrow new DefinitionLoadError(\"connect\", `Failed to connect to Rhino Compute server: ${err instanceof Error ? err.message : String(err)}`, err);\n\t\t}\n\t\ttry {\n\t\t\tconst cachedSchema = version.schema;\n\t\t\tconst freshCache = cachedSchema && isUsableCachedSchema(cachedSchema) ? cachedSchema : null;\n\t\t\tconst [definition, fetchedSchema] = await Promise.all([client.getIO(definitionSource), freshCache ? Promise.resolve(freshCache) : fetchSchema(definitionSource, computeServer)]);\n\t\t\tif (!freshCache && fetchedSchema.schemaVersion === \"2.15.0\") definitions.setVersionSchema(ctx, version.id, fetchedSchema).catch((err) => {\n\t\t\t\tif (onWarn) {\n\t\t\t\t\tonWarn(`[loadForRender] schema cache refresh failed for version ${version.id}: ${err instanceof Error ? err.message : String(err)}`);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tlogger.warn(\"Schema cache refresh failed\", {\n\t\t\t\t\tcomponent: \"loadForRender\",\n\t\t\t\t\tversionId: version.id,\n\t\t\t\t\terr: err instanceof Error ? err.stack ?? err.message : String(err)\n\t\t\t\t});\n\t\t\t});\n\t\t\tif (!definition) throw new Error(`Failed to get definition IO — server returned undefined`);\n\t\t\tconst ioParseErrors = definition.parseErrors ?? [];\n\t\t\tconst ioLoadErrors = definition.loadErrors ?? [];\n\t\t\tif (definition.inputs.length === 0 || ioParseErrors.length > 0 || ioLoadErrors.length > 0) {\n\t\t\t\tconst health = {\n\t\t\t\t\tinputCount: definition.inputs.length,\n\t\t\t\t\toutputCount: definition.outputs?.length,\n\t\t\t\t\tparseErrors: ioParseErrors,\n\t\t\t\t\tloadErrors: ioLoadErrors,\n\t\t\t\t\tloadWarnings: definition.loadWarnings\n\t\t\t\t};\n\t\t\t\tif (onWarn) onWarn(`[loadForRender] IO health for '${record.guid}':`, JSON.stringify(health));\n\t\t\t\telse logger.warn(\"Definition IO looks unhealthy\", {\n\t\t\t\t\tcomponent: \"loadForRender\",\n\t\t\t\t\tdefinitionGuid: record.guid,\n\t\t\t\t\t...health\n\t\t\t\t});\n\t\t\t\tif (computeDebug) {\n\t\t\t\t\tconst rawIO = await client.getRawIO(definitionSource).catch((e) => ({ error: String(e) }));\n\t\t\t\t\tconst rendered = JSON.stringify(rawIO).slice(0, 3e3);\n\t\t\t\t\tif (onWarn) onWarn(\"[loadForRender] raw /io:\", rendered);\n\t\t\t\t\telse logger.debug(\"Raw /io wire shape\", {\n\t\t\t\t\t\tcomponent: \"loadForRender\",\n\t\t\t\t\t\tdefinitionGuid: record.guid,\n\t\t\t\t\t\trawIO: rendered\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tversion,\n\t\t\t\tdefinitionSource,\n\t\t\t\tcomputeServer,\n\t\t\t\tschema: mergeComputeDefaults(fetchedSchema, definition.inputs)\n\t\t\t};\n\t\t} catch (err) {\n\t\t\tif (err instanceof DefinitionLoadError) throw err;\n\t\t\tthrow new DefinitionLoadError(\"schema\", err instanceof Error ? err.message : String(err), err);\n\t\t}\n\t};\n}\n/**\n* A cached schema is usable only if it is BOTH the current format version and\n* structurally sound. The version check alone is not enough: a compute server\n* that serialized the schema with the wrong Newtonsoft emits PascalCase keys, so\n* `schemaVersion` reads as undefined while `SchemaVersion` holds the value —\n* and a row cached during that window would otherwise be served forever, long\n* after the server was fixed. See `assertCamelCaseSchema`.\n*/\nfunction isUsableCachedSchema(schema) {\n\treturn schema.schemaVersion === \"2.15.0\" && Array.isArray(schema.inputs);\n}\nfunction mergeComputeDefaults(schema, computeInputs) {\n\tif (!Array.isArray(schema.inputs)) throw new DefinitionLoadError(\"schema\", `Schema has no 'inputs' array (keys: ${Object.keys(schema).slice(0, 12).join(\", \")}). A PascalCase shape here means compute serialized it with the wrong Newtonsoft — see assertCamelCaseSchema.`);\n\tconst byParamId = new Map(computeInputs.map((input) => [input.id, input]));\n\treturn {\n\t\t...schema,\n\t\tinputs: schema.inputs.map((schemaInput) => {\n\t\t\tconst computeInput = byParamId.get(schemaInput.id);\n\t\t\tif (computeInput?.paramType === \"Color\" && computeInput.default !== void 0) {\n\t\t\t\tconst toHex = (value) => value.toString(16).padStart(2, \"0\");\n\t\t\t\tconst parts = String(computeInput.default).split(\",\").map((s) => parseInt(s.trim(), 10));\n\t\t\t\tif (parts.length === 3) computeInput.default = `#${toHex(parts[0])}${toHex(parts[1])}${toHex(parts[2])}`;\n\t\t\t\telse if (parts.length === 4) computeInput.default = `#${toHex(parts[1])}${toHex(parts[2])}${toHex(parts[3])}`;\n\t\t\t}\n\t\t\tif (computeInput && computeInput.default !== void 0) return {\n\t\t\t\t...schemaInput,\n\t\t\t\tdefault: computeInput.default\n\t\t\t};\n\t\t\treturn schemaInput;\n\t\t})\n\t};\n}\n//#endregion\nexport { renderThrown as a, REQUEST_ID_HEADER as i, createDefinitionLoader as n, resolveRequestId as o, DefinitionService as r, definitionPaths as s, DefinitionLoadError as t };\n"],"names":[],"mappings":";;;;;AAMA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE;AACrC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAChJ;AACG,IAAC,eAAe,GAAG;AACtB,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,KAAK;AACxC,EAAE,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC;AAC7B,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,sBAAsB,EAAE,aAAa,CAAC,CAAC,CAAC;AACtH,EAAE,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAChE,CAAC,CAAC;AACF,CAAC,KAAK,EAAE,CAAC,IAAI,KAAK;AAClB,EAAE,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC;AAC7B,EAAE,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC;AACzC,CAAC,CAAC;AACF,CAAC,MAAM,EAAE,CAAC,IAAI,KAAK;AACnB,EAAE,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC;AAC7B,EAAE,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;AAC/B,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,iBAAiB,GAAG;AACxB;AACA,IAAI,qBAAqB,GAAG,GAAG;AAC/B;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,uBAAuB,GAAG,mBAAmB;AACjD;AACA,SAAS,iBAAiB,CAAC,GAAG,EAAE;AAChC,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,IAAI;AACtB,CAAC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC;AACzF,CAAC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,GAAG,OAAO,GAAG,IAAI;AAC3C;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,CAAC,OAAO,EAAE,QAAQ,GAAG,QAAQ,EAAE;AACxD,CAAC,OAAO,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,QAAQ,EAAE;AACpE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,YAAY,CAAC,KAAK,EAAE;AAC7B,CAAC,IAAI,KAAK,YAAY,KAAK,EAAE;AAC7B,EAAE,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO;AAC3C,EAAE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI;AACzB,EAAE,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU;AACrC,EAAE,MAAM,IAAI,GAAG,EAAE;AACjB,EAAE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;AACrF,EAAE,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;AACvE,EAAE,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI;AAC/D,CAAC;AACD,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC;AAC/C,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,MAAM,CAAC,KAAK,CAAC;AACtB,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,QAAQ,GAAG;AACpB,CAAC,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM;AAC5B,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,UAAU,EAAE,OAAO,CAAC,CAAC,UAAU,EAAE;AACnE,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AACnF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,iBAAiB,GAAG,MAAM;AAC9B,CAAC,IAAI;AACL,CAAC,OAAO;AACR,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE;AAC5B,EAAE,IAAI,CAAC,IAAI,GAAG,IAAI;AAClB,EAAE,IAAI,CAAC,OAAO,GAAG,OAAO;AACxB,CAAC;AACD,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;AACxC,EAAE,MAAM,GAAG,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACxD,EAAE,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO;AAC3C,EAAE,MAAM,MAAM,GAAG;AACjB,GAAG,IAAI,EAAE,KAAK,CAAC,IAAI;AACnB,GAAG,SAAS,EAAE,KAAK,CAAC,SAAS;AAC7B,GAAG,OAAO,EAAE,KAAK,CAAC,OAAO;AACzB,GAAG,SAAS,EAAE,KAAK;AACnB,GAAG,SAAS,EAAE,KAAK;AACnB,GAAG,WAAW,EAAE,KAAK,CAAC,WAAW;AACjC,GAAG,WAAW,EAAE,KAAK,CAAC,WAAW;AACjC,GAAG,QAAQ,EAAE,KAAK,CAAC,QAAQ;AAC3B,GAAG,IAAI,EAAE,KAAK,CAAC,IAAI;AACnB,GAAG,UAAU,EAAE,KAAK,CAAC,UAAU;AAC/B,GAAG,eAAe,EAAE,KAAK,CAAC,eAAe;AACzC,GAAG,MAAM,EAAE,SAAS;AACpB,GAAG,UAAU,EAAE,CAAC;AAChB,GAAG,iBAAiB,EAAE,CAAC;AACvB,GAAG,aAAa,EAAE,IAAI;AACtB,GAAG,cAAc,EAAE,IAAI;AACvB,GAAG,gBAAgB,EAAE,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,MAAM;AACpE,GAAG,SAAS,EAAE,GAAG;AACjB,GAAG,SAAS,EAAE,GAAG;AACjB,GAAG,SAAS,EAAE;AACd,GAAG;AACH,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC;AACjD,EAAE,MAAM,SAAS,GAAG,UAAU,EAAE;AAChC,EAAE,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC;AACvE,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,0BAA0B,CAAC;AACnE,EAAE,MAAM,OAAO,GAAG;AAClB,GAAG,EAAE,EAAE,SAAS;AAChB,GAAG,YAAY,EAAE,KAAK,CAAC,IAAI;AAC3B,GAAG,aAAa,EAAE,CAAC;AACnB,GAAG,OAAO,EAAE,KAAK,CAAC,OAAO;AACzB,GAAG,OAAO;AACV,GAAG,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;AAC3C,GAAG,UAAU,EAAE,KAAK;AACpB,GAAG,UAAU,EAAE,GAAG;AAClB,GAAG,MAAM;AACT,GAAG,iBAAiB,EAAE;AACtB,GAAG;AACH,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC;AACzD,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC;AAC9E,EAAE,OAAO;AACT,GAAG,MAAM,EAAE;AACX,IAAI,GAAG,MAAM;AACb,IAAI,MAAM,EAAE,OAAO;AACnB,IAAI,aAAa,EAAE,SAAS;AAC5B,IAAI,cAAc,EAAE;AACpB,IAAI;AACJ,GAAG;AACH,GAAG;AACH,CAAC;AACD;AACA;AACA;AACA;AACA,CAAC,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE;AAC7E,EAAE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC;AAC7D,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,aAAa,CAAC,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC;AAC9E,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC,GAAG,EAAE,IAAI,CAAC;AAC9E,EAAE,MAAM,SAAS,GAAG,UAAU,EAAE;AAChC,EAAE,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;AAC1D,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,0BAA0B,CAAC;AACnE,EAAE,MAAM,GAAG,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACxD,EAAE,MAAM,OAAO,GAAG;AAClB,GAAG,EAAE,EAAE,SAAS;AAChB,GAAG,YAAY,EAAE,IAAI;AACrB,GAAG,aAAa,EAAE,IAAI;AACtB,GAAG,OAAO,EAAE,GAAG;AACf,GAAG,OAAO;AACV,GAAG,gBAAgB,EAAE,YAAY;AACjC,GAAG,UAAU,EAAE,GAAG,CAAC,MAAM,IAAI,QAAQ,CAAC,OAAO;AAC7C,GAAG,UAAU,EAAE,GAAG;AAClB,GAAG,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,MAAM;AAC3C,GAAG,MAAM;AACT,GAAG,iBAAiB,EAAE;AACtB,GAAG;AACH,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC;AACzD,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC;AACnE,EAAE,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC;AAChE,EAAE,IAAI,gBAAgB,IAAI,gBAAgB,KAAK,QAAQ,CAAC,gBAAgB,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,gBAAgB,EAAE,CAAC;AAC7I,EAAE,OAAO,OAAO;AAChB,CAAC;AACD;AACA;AACA;AACA;AACA,CAAC,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE;AACrC,EAAE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC;AAC7D,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,aAAa,CAAC,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC;AAC9E,EAAE,MAAM,MAAM,GAAG,SAAS,IAAI,QAAQ,CAAC,cAAc;AACrD,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,aAAa,CAAC,uBAAuB,EAAE,GAAG,CAAC;AACpE,EAAE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;AACrE,EAAE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,EAAE,MAAM,IAAI,aAAa,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,+BAA+B,CAAC,EAAE,GAAG,CAAC;AAClI,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC;AAC/D,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AAC1I,EAAE,OAAO,OAAO;AAChB,CAAC;AACD,CAAC,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE;AAC3C,EAAE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;AACxE,EAAE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,EAAE,MAAM,IAAI,aAAa,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,+BAA+B,CAAC,EAAE,GAAG,CAAC;AACrI,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC;AAC3D,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;AAC5C,CAAC;AACD,CAAC,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE;AACpC,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC;AACtD,CAAC;AACD,CAAC,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE;AAC5C,EAAE,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC;AAC1C,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,CAAC;AACvD,EAAE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC;AAC7C,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;AACpE,EAAE,OAAO,GAAG;AACZ,CAAC;AACD,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE;AACzB,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC;AAC/C,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAC/D,CAAC;AACD;AACA;AACA;AACG,IAAC,mBAAmB,GAAG,cAAc,KAAK,CAAC;AAC9C,CAAC,IAAI;AACL,CAAC,KAAK;AACN,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE;AACnC,EAAE,KAAK,CAAC,OAAO,CAAC;AAChB,EAAE,IAAI,CAAC,IAAI,GAAG,IAAI;AAClB,EAAE,IAAI,CAAC,KAAK,GAAG,KAAK;AACpB,EAAE,IAAI,CAAC,IAAI,GAAG,qBAAqB;AACnC,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,sBAAsB,CAAC,IAAI,EAAE;AACtC,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,GAAG,sBAAsB,EAAE,YAAY,GAAG,KAAK,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,UAAU,EAAE,EAAE,GAAG,IAAI;AACzK,CAAC,OAAO,eAAe,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE;AACjG,EAAE,MAAM,SAAS,GAAG,iBAAiB,KAAK,OAAO,KAAK,OAAO,GAAG,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC,aAAa,CAAC;AAC7G,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,IAAI,mBAAmB,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;AAChH,EAAE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;AAC9D,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,mBAAmB,CAAC,MAAM,EAAE,CAAC,qBAAqB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC7F,EAAE,IAAI,OAAO,CAAC,YAAY,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,IAAI,mBAAmB,CAAC,MAAM,EAAE,CAAC,4BAA4B,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAChI,EAAE,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;AAC7D,EAAE,IAAI,CAAC,gBAAgB,EAAE,MAAM,IAAI,mBAAmB,CAAC,MAAM,EAAE,CAAC,qBAAqB,EAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AACxH,EAAE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC;AAClE,EAAE,IAAI,aAAa;AACnB,EAAE,IAAI;AACN,GAAG,aAAa,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,eAAe,IAAI,IAAI,EAAE,CAAC;AACtH,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,kDAAkD,EAAE,GAAG,CAAC;AAC3G,EAAE;AACF,EAAE,IAAI,OAAO,EAAE,mBAAmB,EAAE;AACpC,GAAG,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM;AACtC,GAAG,IAAI,YAAY,IAAI,oBAAoB,CAAC,YAAY,CAAC,EAAE,OAAO;AAClE,IAAI,OAAO;AACX,IAAI,gBAAgB;AACpB,IAAI,aAAa;AACjB,IAAI,MAAM,EAAE;AACZ,IAAI;AACJ,EAAE;AACF,EAAE,IAAI,MAAM;AACZ,EAAE,IAAI;AACN,GAAG,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC,aAAa,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM;AACpF,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,MAAM,IAAI,mBAAmB,CAAC,SAAS,EAAE,CAAC,2CAA2C,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;AAClJ,EAAE;AACF,EAAE,IAAI;AACN,GAAG,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM;AACtC,GAAG,MAAM,UAAU,GAAG,YAAY,IAAI,oBAAoB,CAAC,YAAY,CAAC,GAAG,YAAY,GAAG,IAAI;AAC9F,GAAG,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,WAAW,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC,CAAC;AACnL,GAAG,IAAI,CAAC,UAAU,IAAI,aAAa,CAAC,aAAa,KAAK,QAAQ,EAAE,WAAW,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK;AAC5I,IAAI,IAAI,MAAM,EAAE;AAChB,KAAK,MAAM,CAAC,CAAC,wDAAwD,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACzI,KAAK;AACL,IAAI;AACJ,IAAI,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;AAC/C,KAAK,SAAS,EAAE,eAAe;AAC/B,KAAK,SAAS,EAAE,OAAO,CAAC,EAAE;AAC1B,KAAK,GAAG,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG;AACtE,KAAK,CAAC;AACN,GAAG,CAAC,CAAC;AACL,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,uDAAuD,CAAC,CAAC;AAC9F,GAAG,MAAM,aAAa,GAAG,UAAU,CAAC,WAAW,IAAI,EAAE;AACrD,GAAG,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,IAAI,EAAE;AACnD,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE;AAC9F,IAAI,MAAM,MAAM,GAAG;AACnB,KAAK,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM;AACzC,KAAK,WAAW,EAAE,UAAU,CAAC,OAAO,EAAE,MAAM;AAC5C,KAAK,WAAW,EAAE,aAAa;AAC/B,KAAK,UAAU,EAAE,YAAY;AAC7B,KAAK,YAAY,EAAE,UAAU,CAAC;AAC9B,KAAK;AACL,IAAI,IAAI,MAAM,EAAE,MAAM,CAAC,CAAC,+BAA+B,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AACjG,SAAS,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;AACtD,KAAK,SAAS,EAAE,eAAe;AAC/B,KAAK,cAAc,EAAE,MAAM,CAAC,IAAI;AAChC,KAAK,GAAG;AACR,KAAK,CAAC;AACN,IAAI,IAAI,YAAY,EAAE;AACtB,KAAK,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC/F,KAAK,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;AACzD,KAAK,IAAI,MAAM,EAAE,MAAM,CAAC,0BAA0B,EAAE,QAAQ,CAAC;AAC7D,UAAU,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE;AAC7C,MAAM,SAAS,EAAE,eAAe;AAChC,MAAM,cAAc,EAAE,MAAM,CAAC,IAAI;AACjC,MAAM,KAAK,EAAE;AACb,MAAM,CAAC;AACP,IAAI;AACJ,GAAG;AACH,GAAG,OAAO;AACV,IAAI,OAAO;AACX,IAAI,gBAAgB;AACpB,IAAI,aAAa;AACjB,IAAI,MAAM,EAAE,oBAAoB,CAAC,aAAa,EAAE,UAAU,CAAC,MAAM;AACjE,IAAI;AACJ,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,IAAI,GAAG,YAAY,mBAAmB,EAAE,MAAM,GAAG;AACpD,GAAG,MAAM,IAAI,mBAAmB,CAAC,QAAQ,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC;AACjG,EAAE;AACF,CAAC,CAAC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,oBAAoB,CAAC,MAAM,EAAE;AACtC,CAAC,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;AACzE;AACA,SAAS,oBAAoB,CAAC,MAAM,EAAE,aAAa,EAAE;AACrD,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,IAAI,mBAAmB,CAAC,QAAQ,EAAE,CAAC,oCAAoC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,6GAA6G,CAAC,CAAC;AAC9Q,CAAC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;AAC3E,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,KAAK;AAC7C,GAAG,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;AACrD,GAAG,IAAI,YAAY,EAAE,SAAS,KAAK,OAAO,IAAI,YAAY,CAAC,OAAO,KAAK,MAAM,EAAE;AAC/E,IAAI,MAAM,KAAK,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC;AAChE,IAAI,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;AAC5F,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,YAAY,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5G,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,YAAY,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjH,GAAG;AACH,GAAG,IAAI,YAAY,IAAI,YAAY,CAAC,OAAO,KAAK,MAAM,EAAE,OAAO;AAC/D,IAAI,GAAG,WAAW;AAClB,IAAI,OAAO,EAAE,YAAY,CAAC;AAC1B,IAAI;AACJ,GAAG,OAAO,WAAW;AACrB,EAAE,CAAC;AACH,EAAE;AACF;;;;"}