@selvajs/selva 4.20.0-beta.6 → 4.20.0-beta.8

package/build/server/chunks/chunks/localeContext.svelte.js-CkSHigC9.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"localeContext.svelte.js-CkSHigC9.js","sources":["../../../../.svelte-kit/output/server/chunks/localeContext.svelte.js"],"sourcesContent":["import \"./index-server.js\";\nimport { S as setContext, b as getContext } from \"./server.js\";\nvar VIEWER_MESSAGES = {\n\ten: {\n\t\ttoolsMenu: \"Viewer tools\",\n\t\tswitchToOrthographic: \"Orthographic camera\",\n\t\tswitchToPerspective: \"Perspective camera\",\n\t\tfitToView: \"Fit to view\",\n\t\tviews: \"Views\",\n\t\tmeasure: \"Measure\",\n\t\tgrid: \"Grid\",\n\t\tdisplay: \"Display\",\n\t\tedges: \"Edges\",\n\t\tsceneManager: \"Scene manager\",\n\t\tscreenshot: \"Screenshot\",\n\t\tfullscreen: \"Fullscreen\",\n\t\texitFullscreen: \"Exit fullscreen\",\n\t\tviewTop: \"Top\",\n\t\tviewFront: \"Front\",\n\t\tviewRight: \"Right\",\n\t\tviewBack: \"Back\",\n\t\tviewLeft: \"Left\",\n\t\tviewBottom: \"Bottom\",\n\t\tviewIso: \"Isometric\",\n\t\tlookTechnical: \"Technical\",\n\t\tlookStudio: \"Studio\",\n\t\tlookShowcase: \"Showcase\",\n\t\tlookArctic: \"Arctic\",\n\t\tlookXray: \"X-Ray\",\n\t\tlookLineart: \"Line Art\",\n\t\tlookWireframe: \"Wireframe\",\n\t\tsearchObjects: \"Search objects...\",\n\t\tclearSearch: \"Clear search\",\n\t\texpandLayer: \"Expand layer\",\n\t\tcollapseLayer: \"Collapse layer\",\n\t\texpandAll: \"Expand all\",\n\t\tcollapseAll: \"Collapse all\",\n\t\tshowLayer: \"Show layer\",\n\t\thideLayer: \"Hide layer\",\n\t\tshowObject: \"Show object\",\n\t\thideObject: \"Hide object\",\n\t\tnoObjects: \"No objects\",\n\t\tnoResultsFor: \"No results for \\\"{query}\\\"\",\n\t\tobjectFallbackName: \"Object\",\n\t\tnoMetadata: \"No metadata\",\n\t\tloadingSchema: \"Loading…\",\n\t\tsolveBlocked: \"The definition stopped this solve. No results were produced.\",\n\t\tsolveBlockedTitle: \"Solve stopped\",\n\t\tsolveMessagesTitle: \"Solve messages\",\n\t\tsolveMessagesDescription: \"This solve reported the following. Continue to see the result.\",\n\t\tsolveMessagesConfirm: \"Continue\",\n\t\tsolveMessagesDiscard: \"Discard\",\n\t\tsolveMessagesAbort: \"Abort\",\n\t\tsolveMessagesDismiss: \"Dismiss\",\n\t\tsolveSolving: \"Solving…\",\n\t\tparametersTab: \"Parameters\",\n\t\tmoreTab: \"More\",\n\t\tscrollTabsBack: \"Previous tabs\",\n\t\tscrollTabsForward: \"More tabs\",\n\t\texpandSidePanel: \"Expand {side} panel\",\n\t\tpanelSideLeft: \"left\",\n\t\tpanelSideRight: \"right\",\n\t\ttabNoGroups: \"This tab has no groups configured.\",\n\t\tsolving: \"Solving\",\n\t\tsolvingEllipsis: \"Solving...\",\n\t\tsolvingSubtitle: \"This can take a moment…\",\n\t\tpressToCalculate: \"Press to calculate\",\n\t\tcalculate: \"Calculate\",\n\t\tupToDate: \"Up to date\",\n\t\tmoreActions: \"More actions\",\n\t\tcalculatesFirst: \"Calculates first\",\n\t\terrorCountOne: \"{count} error\",\n\t\terrorCountOther: \"{count} errors\",\n\t\twarningCountOne: \"{count} warning\",\n\t\twarningCountOther: \"{count} warnings\",\n\t\tnoteCountOne: \"{count} note\",\n\t\tnoteCountOther: \"{count} notes\",\n\t\tlastSolveMessagesOne: \"{count} message from the last solve\",\n\t\tlastSolveMessagesOther: \"{count} messages from the last solve\",\n\t\tmessagesTitle: \"Messages\",\n\t\tcopyright: \"by {name} © {year}\",\n\t\tclose: \"Close\",\n\t\ttoggleTheme: \"Toggle theme\",\n\t\terrorTitle: \"Error\",\n\t\tgoHome: \"Go Home\",\n\t\tselectOption: \"Select an option...\",\n\t\tnoOptionsYet: \"No options available yet.\",\n\t\tminValue: \"Minimum value is {min}\",\n\t\tmaxValue: \"Maximum value is {max}\",\n\t\tfineDragHint: \"Hold Shift to drag finely\",\n\t\tmaxLength: \"Maximum {max} characters allowed\",\n\t\tinvalidFormat: \"Invalid format\",\n\t\tinvalidPattern: \"Invalid validation pattern configured\",\n\t\tfileModeUpload: \"Upload\",\n\t\tfileModeUrl: \"URL\",\n\t\tfileUrlLabel: \"File URL\",\n\t\tfetchFile: \"Fetch\",\n\t\tfetchingFile: \"Fetching...\",\n\t\tfileUrlPublic: \"URL must be publicly accessible (no login required).\",\n\t\tchooseFile: \"Choose File or Drag & Drop\",\n\t\tacceptedFormats: \"Accepted formats: {formats}\",\n\t\tuploadedFile: \"Uploaded file ({ext})\",\n\t\tuploadedFileSize: \"Uploaded file ({ext}, {size}MB)\",\n\t\tfileLoaded: \"Loaded {ext} ({size} KB)\",\n\t\turlInvalid: \"Invalid URL — make sure it starts with https://\",\n\t\turlProtocolUnsupported: \"Only http:// and https:// URLs are supported.\",\n\t\turlServerError: \"Server returned {status}. Check the URL is correct and publicly accessible.\",\n\t\tfileFormatNotAccepted: \"File format \\\"{ext}\\\" is not accepted. Allowed: {formats}\",\n\t\tfileTooLarge: \"File too large: {size}MB (max {max}MB).\",\n\t\tfileTooLargeUseUpload: \"Download it and use Upload instead.\",\n\t\tfileReadFailed: \"Failed to read the downloaded file.\",\n\t\turlUnreachable: \"Could not reach \\\"{host}\\\" — the file may not exist, or the server does not allow browser access.\",\n\t\turlUnreachableHint: \"Check that the URL is correct and the file is publicly accessible. If the server requires login, download the file and use the Upload option instead.\",\n\t\turlHintSharePoint: \"SharePoint/OneDrive blocks browser access. Open the file in SharePoint, use \\\"Download\\\" to save it locally, then upload it here.\",\n\t\turlHintGoogleDrive: \"Google Drive blocks browser access. Use \\\"Download\\\" in Google Drive to save the file locally, then upload it here.\",\n\t\turlHintDropbox: \"Dropbox links may block browser access. Try changing \\\"?dl=0\\\" to \\\"?dl=1\\\" in the URL, or download and upload instead.\",\n\t\tunknownError: \"Unknown error\",\n\t\twaitingForData: \"Waiting for data...\",\n\t\twaitingForFiles: \"Waiting for file data...\",\n\t\tfileCount: \"{count} files\",\n\t\tduplicateFilesTitle: \"Duplicate file names detected\",\n\t\tduplicatePathsOne: \"The following path appears more than once:\",\n\t\tduplicatePathsOther: \"The following paths appear more than once:\",\n\t\tduplicateFilesHint: \"Rename outputs in your Grasshopper definition so each file has a unique name.\",\n\t\tdownloadFile: \"Download File\",\n\t\tdownloadFiles: \"Download {count} Files\",\n\t\tdownloading: \"Downloading...\",\n\t\tdownloadFailed: \"Download failed\",\n\t\tcopy: \"Copy\",\n\t\tcopied: \"Copied!\",\n\t\tchartReceiving: \"Receiving chart data...\",\n\t\tchartRenderFailed: \"Failed to render chart\",\n\t\tfullscreenUnavailable: \"Fullscreen unavailable: {error}\",\n\t\texitFullscreenFailed: \"Exit fullscreen failed: {error}\",\n\t\timageViewer: \"image viewer\",\n\t\timageLoading: \"Loading image…\",\n\t\timageUnsupported: \"Unsupported image format: {ext}. Supported: {formats}\",\n\t\timageUnknownFormat: \"(unknown)\",\n\t\timageDecodeFailed: \"Couldn't decode {file}\",\n\t\tpreviousImage: \"Previous image\",\n\t\tnextImage: \"Next image\",\n\t\tzoomHint: \"Hold Ctrl or ⌘ and scroll to zoom\",\n\t\tzoomIn: \"Zoom in\",\n\t\tzoomOut: \"Zoom out\",\n\t\tzoomFit: \"Fit\",\n\t\tzoomActual: \"Actual pixels\",\n\t\tdownloadImage: \"Download image\"\n\t},\n\tde: {\n\t\ttoolsMenu: \"Viewer-Werkzeuge\",\n\t\tswitchToOrthographic: \"Orthografische Kamera\",\n\t\tswitchToPerspective: \"Perspektivische Kamera\",\n\t\tfitToView: \"Ansicht anpassen\",\n\t\tviews: \"Ansichten\",\n\t\tmeasure: \"Messen\",\n\t\tgrid: \"Raster\",\n\t\tdisplay: \"Darstellung\",\n\t\tedges: \"Kanten\",\n\t\tsceneManager: \"Szenen-Manager\",\n\t\tscreenshot: \"Screenshot\",\n\t\tfullscreen: \"Vollbild\",\n\t\texitFullscreen: \"Vollbild beenden\",\n\t\tviewTop: \"Oben\",\n\t\tviewFront: \"Vorne\",\n\t\tviewRight: \"Rechts\",\n\t\tviewBack: \"Hinten\",\n\t\tviewLeft: \"Links\",\n\t\tviewBottom: \"Unten\",\n\t\tviewIso: \"Isometrisch\",\n\t\tlookTechnical: \"Technisch\",\n\t\tlookStudio: \"Studio\",\n\t\tlookShowcase: \"Präsentation\",\n\t\tlookArctic: \"Arktis\",\n\t\tlookXray: \"Röntgen\",\n\t\tlookLineart: \"Strichzeichnung\",\n\t\tlookWireframe: \"Drahtgitter\",\n\t\tsearchObjects: \"Objekte suchen...\",\n\t\tclearSearch: \"Suche löschen\",\n\t\texpandLayer: \"Ebene aufklappen\",\n\t\tcollapseLayer: \"Ebene zuklappen\",\n\t\texpandAll: \"Alle aufklappen\",\n\t\tcollapseAll: \"Alle zuklappen\",\n\t\tshowLayer: \"Ebene einblenden\",\n\t\thideLayer: \"Ebene ausblenden\",\n\t\tshowObject: \"Objekt einblenden\",\n\t\thideObject: \"Objekt ausblenden\",\n\t\tnoObjects: \"Keine Objekte\",\n\t\tnoResultsFor: \"Keine Ergebnisse für „{query}“\",\n\t\tobjectFallbackName: \"Objekt\",\n\t\tnoMetadata: \"Keine Metadaten\",\n\t\tloadingSchema: \"Wird geladen…\",\n\t\tsolveBlocked: \"Die Definition hat diese Berechnung gestoppt. Es wurden keine Ergebnisse erzeugt.\",\n\t\tsolveBlockedTitle: \"Berechnung gestoppt\",\n\t\tsolveMessagesTitle: \"Meldungen zur Berechnung\",\n\t\tsolveMessagesDescription: \"Diese Berechnung hat Folgendes gemeldet. Weiter, um das Ergebnis zu sehen.\",\n\t\tsolveMessagesConfirm: \"Weiter\",\n\t\tsolveMessagesDiscard: \"Verwerfen\",\n\t\tsolveMessagesAbort: \"Abbrechen\",\n\t\tsolveMessagesDismiss: \"Schliessen\",\n\t\tsolveSolving: \"Berechnung läuft…\",\n\t\tparametersTab: \"Parameter\",\n\t\tmoreTab: \"Mehr\",\n\t\tscrollTabsBack: \"Vorherige Tabs\",\n\t\tscrollTabsForward: \"Weitere Tabs\",\n\t\texpandSidePanel: \"{side} Bereich aufklappen\",\n\t\tpanelSideLeft: \"Linken\",\n\t\tpanelSideRight: \"Rechten\",\n\t\ttabNoGroups: \"Für diesen Tab sind keine Gruppen konfiguriert.\",\n\t\tsolving: \"Berechnung läuft\",\n\t\tsolvingEllipsis: \"Berechnung läuft...\",\n\t\tsolvingSubtitle: \"Das kann einen Moment dauern…\",\n\t\tpressToCalculate: \"Berechnen\",\n\t\tcalculate: \"Berechnen\",\n\t\tupToDate: \"Berechnet\",\n\t\tmoreActions: \"Weitere Aktionen\",\n\t\tcalculatesFirst: \"Berechnet zuerst\",\n\t\terrorCountOne: \"{count} Fehler\",\n\t\terrorCountOther: \"{count} Fehler\",\n\t\twarningCountOne: \"{count} Warnung\",\n\t\twarningCountOther: \"{count} Warnungen\",\n\t\tnoteCountOne: \"{count} Hinweis\",\n\t\tnoteCountOther: \"{count} Hinweise\",\n\t\tlastSolveMessagesOne: \"{count} Meldung der letzten Berechnung\",\n\t\tlastSolveMessagesOther: \"{count} Meldungen der letzten Berechnung\",\n\t\tmessagesTitle: \"Meldungen\",\n\t\tcopyright: \"von {name} © {year}\",\n\t\tclose: \"Schliessen\",\n\t\ttoggleTheme: \"Farbschema wechseln\",\n\t\terrorTitle: \"Fehler\",\n\t\tgoHome: \"Zur Startseite\",\n\t\tselectOption: \"Option wählen…\",\n\t\tnoOptionsYet: \"Noch keine Optionen verfügbar.\",\n\t\tminValue: \"Der kleinste erlaubte Wert ist {min}\",\n\t\tmaxValue: \"Der grösste erlaubte Wert ist {max}\",\n\t\tfineDragHint: \"Umschalttaste halten für feine Schritte\",\n\t\tmaxLength: \"Höchstens {max} Zeichen erlaubt\",\n\t\tinvalidFormat: \"Ungültiges Format\",\n\t\tinvalidPattern: \"Ungültiges Prüfmuster hinterlegt\",\n\t\tfileModeUpload: \"Hochladen\",\n\t\tfileModeUrl: \"URL\",\n\t\tfileUrlLabel: \"Datei-URL\",\n\t\tfetchFile: \"Abrufen\",\n\t\tfetchingFile: \"Wird abgerufen…\",\n\t\tfileUrlPublic: \"Die URL muss öffentlich erreichbar sein (ohne Anmeldung).\",\n\t\tchooseFile: \"Datei wählen oder hierher ziehen\",\n\t\tacceptedFormats: \"Erlaubte Formate: {formats}\",\n\t\tuploadedFile: \"Hochgeladene Datei ({ext})\",\n\t\tuploadedFileSize: \"Hochgeladene Datei ({ext}, {size} MB)\",\n\t\tfileLoaded: \"{ext} geladen ({size} KB)\",\n\t\turlInvalid: \"Ungültige URL – sie muss mit https:// beginnen\",\n\t\turlProtocolUnsupported: \"Nur http://- und https://-URLs werden unterstützt.\",\n\t\turlServerError: \"Der Server antwortete mit {status}. Ist die URL korrekt und öffentlich erreichbar?\",\n\t\tfileFormatNotAccepted: \"Dateiformat „{ext}“ ist nicht erlaubt. Erlaubt: {formats}\",\n\t\tfileTooLarge: \"Datei zu gross: {size} MB (höchstens {max} MB).\",\n\t\tfileTooLargeUseUpload: \"Datei herunterladen und stattdessen über „Hochladen“ einfügen.\",\n\t\tfileReadFailed: \"Die heruntergeladene Datei konnte nicht gelesen werden.\",\n\t\turlUnreachable: \"„{host}“ ist nicht erreichbar – die Datei existiert vielleicht nicht, oder der Server erlaubt keinen Zugriff aus dem Browser.\",\n\t\turlUnreachableHint: \"Prüfen, ob die URL stimmt und die Datei öffentlich erreichbar ist. Verlangt der Server eine Anmeldung: Datei herunterladen und über „Hochladen“ einfügen.\",\n\t\turlHintSharePoint: \"SharePoint/OneDrive sperrt den Zugriff aus dem Browser. Datei in SharePoint öffnen, mit „Herunterladen“ lokal speichern und hier hochladen.\",\n\t\turlHintGoogleDrive: \"Google Drive sperrt den Zugriff aus dem Browser. Datei in Google Drive mit „Herunterladen“ lokal speichern und hier hochladen.\",\n\t\turlHintDropbox: \"Dropbox-Links sperren den Zugriff aus dem Browser oft. In der URL „?dl=0“ durch „?dl=1“ ersetzen oder die Datei herunterladen und hochladen.\",\n\t\tunknownError: \"Unbekannter Fehler\",\n\t\twaitingForData: \"Noch keine Daten\",\n\t\twaitingForFiles: \"Noch keine Dateien\",\n\t\tfileCount: \"{count} Dateien\",\n\t\tduplicateFilesTitle: \"Doppelte Dateinamen\",\n\t\tduplicatePathsOne: \"Dieser Pfad kommt mehrfach vor:\",\n\t\tduplicatePathsOther: \"Diese Pfade kommen mehrfach vor:\",\n\t\tduplicateFilesHint: \"Ausgaben in der Grasshopper-Definition umbenennen, damit jede Datei einen eindeutigen Namen hat.\",\n\t\tdownloadFile: \"Datei herunterladen\",\n\t\tdownloadFiles: \"{count} Dateien herunterladen\",\n\t\tdownloading: \"Wird heruntergeladen…\",\n\t\tdownloadFailed: \"Download fehlgeschlagen\",\n\t\tcopy: \"Kopieren\",\n\t\tcopied: \"Kopiert!\",\n\t\tchartReceiving: \"Diagrammdaten werden empfangen…\",\n\t\tchartRenderFailed: \"Diagramm konnte nicht dargestellt werden\",\n\t\tfullscreenUnavailable: \"Vollbild nicht verfügbar: {error}\",\n\t\texitFullscreenFailed: \"Vollbild konnte nicht beendet werden: {error}\",\n\t\timageViewer: \"Bildbetrachter\",\n\t\timageLoading: \"Bild wird geladen…\",\n\t\timageUnsupported: \"Bildformat nicht unterstützt: {ext}. Unterstützt: {formats}\",\n\t\timageUnknownFormat: \"(unbekannt)\",\n\t\timageDecodeFailed: \"{file} konnte nicht gelesen werden\",\n\t\tpreviousImage: \"Vorheriges Bild\",\n\t\tnextImage: \"Nächstes Bild\",\n\t\tzoomHint: \"Zum Zoomen Strg oder ⌘ halten und scrollen\",\n\t\tzoomIn: \"Vergrössern\",\n\t\tzoomOut: \"Verkleinern\",\n\t\tzoomFit: \"Einpassen\",\n\t\tzoomActual: \"Originalgrösse\",\n\t\tdownloadImage: \"Bild herunterladen\"\n\t}\n};\n/** Resolve a catalog for a locale, falling back to English for unknown locales. */\nfunction messagesFor(locale) {\n\treturn VIEWER_MESSAGES[locale ?? \"en\"] ?? VIEWER_MESSAGES[\"en\"];\n}\n/** Layers a host's partial overrides over a full catalog. An `undefined` entry keeps the base string. */\nfunction withOverrides(base, overrides) {\n\tif (!overrides) return base;\n\tconst merged = { ...base };\n\tfor (const [key, value] of Object.entries(overrides)) if (value !== void 0) merged[key] = value;\n\treturn merged;\n}\n/** Fills each `{name}` placeholder from `vars`; an unknown placeholder is left as written. */\nfunction formatMessage(template, vars) {\n\treturn template.replace(/\\{(\\w+)\\}/g, (placeholder, name) => name in vars ? String(vars[name]) : placeholder);\n}\n/** Picks the singular or plural form for `count` and fills its `{count}`. */\nfunction formatCount(count, one, other) {\n\treturn formatMessage(count === 1 ? one : other, { count });\n}\n//#endregion\n//#region ../ui/dist/i18n/localeContext.svelte.js\nvar LOCALE_CONTEXT_KEY = Symbol(\"viewer-locale-context\");\n/**\n* Re-provides the nearest context for a component that takes its own `lang`/`messages` props.\n* Without `lang`, or with the inherited locale, the subtree keeps the overrides an outer provider\n* applied; a different `lang` starts from that locale's catalog, since those overrides were\n* written for another language.\n*/\nfunction layerLocaleContext(getLang, getOverrides) {\n\tconst outer = getLocaleContext();\n\tconst ctx = {\n\t\tget locale() {\n\t\t\treturn getLang() ?? outer.locale;\n\t\t},\n\t\tget messages() {\n\t\t\tconst lang = getLang();\n\t\t\treturn withOverrides(lang === void 0 || lang === outer.locale ? outer.messages : messagesFor(lang), getOverrides?.());\n\t\t}\n\t};\n\tsetContext(LOCALE_CONTEXT_KEY, ctx);\n\treturn ctx;\n}\n/**\n* Falls back to an English-only context when no provider exists (a primitive used in\n* isolation), so consumers never need a null check.\n*/\nfunction getLocaleContext() {\n\treturn getContext(LOCALE_CONTEXT_KEY) ?? {\n\t\tget locale() {\n\t\t\treturn \"en\";\n\t\t},\n\t\tget messages() {\n\t\t\treturn messagesFor(\"en\");\n\t\t}\n\t};\n}\n//#endregion\nexport { formatMessage as i, layerLocaleContext as n, formatCount as r, getLocaleContext as t };\n"],"names":[],"mappings":";;AAEA,IAAI,eAAe,GAAG;AACtB,CAAC,EAAE,EAAE;AACL,EAAE,SAAS,EAAE,cAAc;AAC3B,EAAE,oBAAoB,EAAE,qBAAqB;AAC7C,EAAE,mBAAmB,EAAE,oBAAoB;AAC3C,EAAE,SAAS,EAAE,aAAa;AAC1B,EAAE,KAAK,EAAE,OAAO;AAChB,EAAE,OAAO,EAAE,SAAS;AACpB,EAAE,IAAI,EAAE,MAAM;AACd,EAAE,OAAO,EAAE,SAAS;AACpB,EAAE,KAAK,EAAE,OAAO;AAChB,EAAE,YAAY,EAAE,eAAe;AAC/B,EAAE,UAAU,EAAE,YAAY;AAC1B,EAAE,UAAU,EAAE,YAAY;AAC1B,EAAE,cAAc,EAAE,iBAAiB;AACnC,EAAE,OAAO,EAAE,KAAK;AAChB,EAAE,SAAS,EAAE,OAAO;AACpB,EAAE,SAAS,EAAE,OAAO;AACpB,EAAE,QAAQ,EAAE,MAAM;AAClB,EAAE,QAAQ,EAAE,MAAM;AAClB,EAAE,UAAU,EAAE,QAAQ;AACtB,EAAE,OAAO,EAAE,WAAW;AACtB,EAAE,aAAa,EAAE,WAAW;AAC5B,EAAE,UAAU,EAAE,QAAQ;AACtB,EAAE,YAAY,EAAE,UAAU;AAC1B,EAAE,UAAU,EAAE,QAAQ;AACtB,EAAE,QAAQ,EAAE,OAAO;AACnB,EAAE,WAAW,EAAE,UAAU;AACzB,EAAE,aAAa,EAAE,WAAW;AAC5B,EAAE,aAAa,EAAE,mBAAmB;AACpC,EAAE,WAAW,EAAE,cAAc;AAC7B,EAAE,WAAW,EAAE,cAAc;AAC7B,EAAE,aAAa,EAAE,gBAAgB;AACjC,EAAE,SAAS,EAAE,YAAY;AACzB,EAAE,WAAW,EAAE,cAAc;AAC7B,EAAE,SAAS,EAAE,YAAY;AACzB,EAAE,SAAS,EAAE,YAAY;AACzB,EAAE,UAAU,EAAE,aAAa;AAC3B,EAAE,UAAU,EAAE,aAAa;AAC3B,EAAE,SAAS,EAAE,YAAY;AACzB,EAAE,YAAY,EAAE,4BAA4B;AAC5C,EAAE,kBAAkB,EAAE,QAAQ;AAC9B,EAAE,UAAU,EAAE,aAAa;AAC3B,EAAE,aAAa,EAAE,UAAU;AAC3B,EAAE,YAAY,EAAE,8DAA8D;AAC9E,EAAE,iBAAiB,EAAE,eAAe;AACpC,EAAE,kBAAkB,EAAE,gBAAgB;AACtC,EAAE,wBAAwB,EAAE,gEAAgE;AAC5F,EAAE,oBAAoB,EAAE,UAAU;AAClC,EAAE,oBAAoB,EAAE,SAAS;AACjC,EAAE,kBAAkB,EAAE,OAAO;AAC7B,EAAE,oBAAoB,EAAE,SAAS;AACjC,EAAE,YAAY,EAAE,UAAU;AAC1B,EAAE,aAAa,EAAE,YAAY;AAC7B,EAAE,OAAO,EAAE,MAAM;AACjB,EAAE,cAAc,EAAE,eAAe;AACjC,EAAE,iBAAiB,EAAE,WAAW;AAChC,EAAE,eAAe,EAAE,qBAAqB;AACxC,EAAE,aAAa,EAAE,MAAM;AACvB,EAAE,cAAc,EAAE,OAAO;AACzB,EAAE,WAAW,EAAE,oCAAoC;AACnD,EAAE,OAAO,EAAE,SAAS;AACpB,EAAE,eAAe,EAAE,YAAY;AAC/B,EAAE,eAAe,EAAE,yBAAyB;AAC5C,EAAE,gBAAgB,EAAE,oBAAoB;AACxC,EAAE,SAAS,EAAE,WAAW;AACxB,EAAE,QAAQ,EAAE,YAAY;AACxB,EAAE,WAAW,EAAE,cAAc;AAC7B,EAAE,eAAe,EAAE,kBAAkB;AACrC,EAAE,aAAa,EAAE,eAAe;AAChC,EAAE,eAAe,EAAE,gBAAgB;AACnC,EAAE,eAAe,EAAE,iBAAiB;AACpC,EAAE,iBAAiB,EAAE,kBAAkB;AACvC,EAAE,YAAY,EAAE,cAAc;AAC9B,EAAE,cAAc,EAAE,eAAe;AACjC,EAAE,oBAAoB,EAAE,qCAAqC;AAC7D,EAAE,sBAAsB,EAAE,sCAAsC;AAChE,EAAE,aAAa,EAAE,UAAU;AAC3B,EAAE,SAAS,EAAE,oBAAoB;AACjC,EAAE,KAAK,EAAE,OAAO;AAChB,EAAE,WAAW,EAAE,cAAc;AAC7B,EAAE,UAAU,EAAE,OAAO;AACrB,EAAE,MAAM,EAAE,SAAS;AACnB,EAAE,YAAY,EAAE,qBAAqB;AACrC,EAAE,YAAY,EAAE,2BAA2B;AAC3C,EAAE,QAAQ,EAAE,wBAAwB;AACpC,EAAE,QAAQ,EAAE,wBAAwB;AACpC,EAAE,YAAY,EAAE,2BAA2B;AAC3C,EAAE,SAAS,EAAE,kCAAkC;AAC/C,EAAE,aAAa,EAAE,gBAAgB;AACjC,EAAE,cAAc,EAAE,uCAAuC;AACzD,EAAE,cAAc,EAAE,QAAQ;AAC1B,EAAE,WAAW,EAAE,KAAK;AACpB,EAAE,YAAY,EAAE,UAAU;AAC1B,EAAE,SAAS,EAAE,OAAO;AACpB,EAAE,YAAY,EAAE,aAAa;AAC7B,EAAE,aAAa,EAAE,sDAAsD;AACvE,EAAE,UAAU,EAAE,4BAA4B;AAC1C,EAAE,eAAe,EAAE,6BAA6B;AAChD,EAAE,YAAY,EAAE,uBAAuB;AACvC,EAAE,gBAAgB,EAAE,iCAAiC;AACrD,EAAE,UAAU,EAAE,0BAA0B;AACxC,EAAE,UAAU,EAAE,iDAAiD;AAC/D,EAAE,sBAAsB,EAAE,+CAA+C;AACzE,EAAE,cAAc,EAAE,6EAA6E;AAC/F,EAAE,qBAAqB,EAAE,2DAA2D;AACpF,EAAE,YAAY,EAAE,yCAAyC;AACzD,EAAE,qBAAqB,EAAE,qCAAqC;AAC9D,EAAE,cAAc,EAAE,qCAAqC;AACvD,EAAE,cAAc,EAAE,mGAAmG;AACrH,EAAE,kBAAkB,EAAE,uJAAuJ;AAC7K,EAAE,iBAAiB,EAAE,mIAAmI;AACxJ,EAAE,kBAAkB,EAAE,qHAAqH;AAC3I,EAAE,cAAc,EAAE,yHAAyH;AAC3I,EAAE,YAAY,EAAE,eAAe;AAC/B,EAAE,cAAc,EAAE,qBAAqB;AACvC,EAAE,eAAe,EAAE,0BAA0B;AAC7C,EAAE,SAAS,EAAE,eAAe;AAC5B,EAAE,mBAAmB,EAAE,+BAA+B;AACtD,EAAE,iBAAiB,EAAE,4CAA4C;AACjE,EAAE,mBAAmB,EAAE,4CAA4C;AACnE,EAAE,kBAAkB,EAAE,+EAA+E;AACrG,EAAE,YAAY,EAAE,eAAe;AAC/B,EAAE,aAAa,EAAE,wBAAwB;AACzC,EAAE,WAAW,EAAE,gBAAgB;AAC/B,EAAE,cAAc,EAAE,iBAAiB;AACnC,EAAE,IAAI,EAAE,MAAM;AACd,EAAE,MAAM,EAAE,SAAS;AACnB,EAAE,cAAc,EAAE,yBAAyB;AAC3C,EAAE,iBAAiB,EAAE,wBAAwB;AAC7C,EAAE,qBAAqB,EAAE,iCAAiC;AAC1D,EAAE,oBAAoB,EAAE,iCAAiC;AACzD,EAAE,WAAW,EAAE,cAAc;AAC7B,EAAE,YAAY,EAAE,gBAAgB;AAChC,EAAE,gBAAgB,EAAE,uDAAuD;AAC3E,EAAE,kBAAkB,EAAE,WAAW;AACjC,EAAE,iBAAiB,EAAE,wBAAwB;AAC7C,EAAE,aAAa,EAAE,gBAAgB;AACjC,EAAE,SAAS,EAAE,YAAY;AACzB,EAAE,QAAQ,EAAE,mCAAmC;AAC/C,EAAE,MAAM,EAAE,SAAS;AACnB,EAAE,OAAO,EAAE,UAAU;AACrB,EAAE,OAAO,EAAE,KAAK;AAChB,EAAE,UAAU,EAAE,eAAe;AAC7B,EAAE,aAAa,EAAE;AACjB,EAAE;AACF,CAAC,EAAE,EAAE;AACL,EAAE,SAAS,EAAE,kBAAkB;AAC/B,EAAE,oBAAoB,EAAE,uBAAuB;AAC/C,EAAE,mBAAmB,EAAE,wBAAwB;AAC/C,EAAE,SAAS,EAAE,kBAAkB;AAC/B,EAAE,KAAK,EAAE,WAAW;AACpB,EAAE,OAAO,EAAE,QAAQ;AACnB,EAAE,IAAI,EAAE,QAAQ;AAChB,EAAE,OAAO,EAAE,aAAa;AACxB,EAAE,KAAK,EAAE,QAAQ;AACjB,EAAE,YAAY,EAAE,gBAAgB;AAChC,EAAE,UAAU,EAAE,YAAY;AAC1B,EAAE,UAAU,EAAE,UAAU;AACxB,EAAE,cAAc,EAAE,kBAAkB;AACpC,EAAE,OAAO,EAAE,MAAM;AACjB,EAAE,SAAS,EAAE,OAAO;AACpB,EAAE,SAAS,EAAE,QAAQ;AACrB,EAAE,QAAQ,EAAE,QAAQ;AACpB,EAAE,QAAQ,EAAE,OAAO;AACnB,EAAE,UAAU,EAAE,OAAO;AACrB,EAAE,OAAO,EAAE,aAAa;AACxB,EAAE,aAAa,EAAE,WAAW;AAC5B,EAAE,UAAU,EAAE,QAAQ;AACtB,EAAE,YAAY,EAAE,cAAc;AAC9B,EAAE,UAAU,EAAE,QAAQ;AACtB,EAAE,QAAQ,EAAE,SAAS;AACrB,EAAE,WAAW,EAAE,iBAAiB;AAChC,EAAE,aAAa,EAAE,aAAa;AAC9B,EAAE,aAAa,EAAE,mBAAmB;AACpC,EAAE,WAAW,EAAE,eAAe;AAC9B,EAAE,WAAW,EAAE,kBAAkB;AACjC,EAAE,aAAa,EAAE,iBAAiB;AAClC,EAAE,SAAS,EAAE,iBAAiB;AAC9B,EAAE,WAAW,EAAE,gBAAgB;AAC/B,EAAE,SAAS,EAAE,kBAAkB;AAC/B,EAAE,SAAS,EAAE,kBAAkB;AAC/B,EAAE,UAAU,EAAE,mBAAmB;AACjC,EAAE,UAAU,EAAE,mBAAmB;AACjC,EAAE,SAAS,EAAE,eAAe;AAC5B,EAAE,YAAY,EAAE,gCAAgC;AAChD,EAAE,kBAAkB,EAAE,QAAQ;AAC9B,EAAE,UAAU,EAAE,iBAAiB;AAC/B,EAAE,aAAa,EAAE,eAAe;AAChC,EAAE,YAAY,EAAE,mFAAmF;AACnG,EAAE,iBAAiB,EAAE,qBAAqB;AAC1C,EAAE,kBAAkB,EAAE,0BAA0B;AAChD,EAAE,wBAAwB,EAAE,4EAA4E;AACxG,EAAE,oBAAoB,EAAE,QAAQ;AAChC,EAAE,oBAAoB,EAAE,WAAW;AACnC,EAAE,kBAAkB,EAAE,WAAW;AACjC,EAAE,oBAAoB,EAAE,YAAY;AACpC,EAAE,YAAY,EAAE,mBAAmB;AACnC,EAAE,aAAa,EAAE,WAAW;AAC5B,EAAE,OAAO,EAAE,MAAM;AACjB,EAAE,cAAc,EAAE,gBAAgB;AAClC,EAAE,iBAAiB,EAAE,cAAc;AACnC,EAAE,eAAe,EAAE,2BAA2B;AAC9C,EAAE,aAAa,EAAE,QAAQ;AACzB,EAAE,cAAc,EAAE,SAAS;AAC3B,EAAE,WAAW,EAAE,iDAAiD;AAChE,EAAE,OAAO,EAAE,kBAAkB;AAC7B,EAAE,eAAe,EAAE,qBAAqB;AACxC,EAAE,eAAe,EAAE,+BAA+B;AAClD,EAAE,gBAAgB,EAAE,WAAW;AAC/B,EAAE,SAAS,EAAE,WAAW;AACxB,EAAE,QAAQ,EAAE,WAAW;AACvB,EAAE,WAAW,EAAE,kBAAkB;AACjC,EAAE,eAAe,EAAE,kBAAkB;AACrC,EAAE,aAAa,EAAE,gBAAgB;AACjC,EAAE,eAAe,EAAE,gBAAgB;AACnC,EAAE,eAAe,EAAE,iBAAiB;AACpC,EAAE,iBAAiB,EAAE,mBAAmB;AACxC,EAAE,YAAY,EAAE,iBAAiB;AACjC,EAAE,cAAc,EAAE,kBAAkB;AACpC,EAAE,oBAAoB,EAAE,wCAAwC;AAChE,EAAE,sBAAsB,EAAE,0CAA0C;AACpE,EAAE,aAAa,EAAE,WAAW;AAC5B,EAAE,SAAS,EAAE,qBAAqB;AAClC,EAAE,KAAK,EAAE,YAAY;AACrB,EAAE,WAAW,EAAE,qBAAqB;AACpC,EAAE,UAAU,EAAE,QAAQ;AACtB,EAAE,MAAM,EAAE,gBAAgB;AAC1B,EAAE,YAAY,EAAE,gBAAgB;AAChC,EAAE,YAAY,EAAE,gCAAgC;AAChD,EAAE,QAAQ,EAAE,sCAAsC;AAClD,EAAE,QAAQ,EAAE,qCAAqC;AACjD,EAAE,YAAY,EAAE,yCAAyC;AACzD,EAAE,SAAS,EAAE,iCAAiC;AAC9C,EAAE,aAAa,EAAE,mBAAmB;AACpC,EAAE,cAAc,EAAE,kCAAkC;AACpD,EAAE,cAAc,EAAE,WAAW;AAC7B,EAAE,WAAW,EAAE,KAAK;AACpB,EAAE,YAAY,EAAE,WAAW;AAC3B,EAAE,SAAS,EAAE,SAAS;AACtB,EAAE,YAAY,EAAE,iBAAiB;AACjC,EAAE,aAAa,EAAE,2DAA2D;AAC5E,EAAE,UAAU,EAAE,kCAAkC;AAChD,EAAE,eAAe,EAAE,6BAA6B;AAChD,EAAE,YAAY,EAAE,4BAA4B;AAC5C,EAAE,gBAAgB,EAAE,uCAAuC;AAC3D,EAAE,UAAU,EAAE,2BAA2B;AACzC,EAAE,UAAU,EAAE,gDAAgD;AAC9D,EAAE,sBAAsB,EAAE,oDAAoD;AAC9E,EAAE,cAAc,EAAE,oFAAoF;AACtG,EAAE,qBAAqB,EAAE,2DAA2D;AACpF,EAAE,YAAY,EAAE,iDAAiD;AACjE,EAAE,qBAAqB,EAAE,gEAAgE;AACzF,EAAE,cAAc,EAAE,yDAAyD;AAC3E,EAAE,cAAc,EAAE,+HAA+H;AACjJ,EAAE,kBAAkB,EAAE,2JAA2J;AACjL,EAAE,iBAAiB,EAAE,6IAA6I;AAClK,EAAE,kBAAkB,EAAE,gIAAgI;AACtJ,EAAE,cAAc,EAAE,8IAA8I;AAChK,EAAE,YAAY,EAAE,oBAAoB;AACpC,EAAE,cAAc,EAAE,kBAAkB;AACpC,EAAE,eAAe,EAAE,oBAAoB;AACvC,EAAE,SAAS,EAAE,iBAAiB;AAC9B,EAAE,mBAAmB,EAAE,qBAAqB;AAC5C,EAAE,iBAAiB,EAAE,iCAAiC;AACtD,EAAE,mBAAmB,EAAE,kCAAkC;AACzD,EAAE,kBAAkB,EAAE,kGAAkG;AACxH,EAAE,YAAY,EAAE,qBAAqB;AACrC,EAAE,aAAa,EAAE,+BAA+B;AAChD,EAAE,WAAW,EAAE,uBAAuB;AACtC,EAAE,cAAc,EAAE,yBAAyB;AAC3C,EAAE,IAAI,EAAE,UAAU;AAClB,EAAE,MAAM,EAAE,UAAU;AACpB,EAAE,cAAc,EAAE,iCAAiC;AACnD,EAAE,iBAAiB,EAAE,0CAA0C;AAC/D,EAAE,qBAAqB,EAAE,mCAAmC;AAC5D,EAAE,oBAAoB,EAAE,+CAA+C;AACvE,EAAE,WAAW,EAAE,gBAAgB;AAC/B,EAAE,YAAY,EAAE,oBAAoB;AACpC,EAAE,gBAAgB,EAAE,6DAA6D;AACjF,EAAE,kBAAkB,EAAE,aAAa;AACnC,EAAE,iBAAiB,EAAE,oCAAoC;AACzD,EAAE,aAAa,EAAE,iBAAiB;AAClC,EAAE,SAAS,EAAE,eAAe;AAC5B,EAAE,QAAQ,EAAE,4CAA4C;AACxD,EAAE,MAAM,EAAE,aAAa;AACvB,EAAE,OAAO,EAAE,aAAa;AACxB,EAAE,OAAO,EAAE,WAAW;AACtB,EAAE,UAAU,EAAE,gBAAgB;AAC9B,EAAE,aAAa,EAAE;AACjB;AACA,CAAC;AACD;AACA,SAAS,WAAW,CAAC,MAAM,EAAE;AAC7B,CAAC,OAAO,eAAe,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC;AAChE;AACA;AACA,SAAS,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE;AACxC,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,IAAI;AAC5B,CAAC,MAAM,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE;AAC3B,CAAC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,KAAK,KAAK,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK;AAChG,CAAC,OAAO,MAAM;AACd;AACA;AACA,SAAS,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE;AACvC,CAAC,OAAO,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,IAAI,KAAK,IAAI,IAAI,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,WAAW,CAAC;AAC9G;AACA;AACA,SAAS,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE;AACxC,CAAC,OAAO,aAAa,CAAC,KAAK,KAAK,CAAC,GAAG,GAAG,GAAG,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC;AAC3D;AACA;AACA;AACA,IAAI,kBAAkB,GAAG,MAAM,CAAC,uBAAuB,CAAC;AACxD;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,kBAAkB,CAAC,OAAO,EAAE,YAAY,EAAE;AACnD,CAAC,MAAM,KAAK,GAAG,gBAAgB,EAAE;AACjC,CAAC,MAAM,GAAG,GAAG;AACb,EAAE,IAAI,MAAM,GAAG;AACf,GAAG,OAAO,OAAO,EAAE,IAAI,KAAK,CAAC,MAAM;AACnC,EAAE,CAAC;AACH,EAAE,IAAI,QAAQ,GAAG;AACjB,GAAG,MAAM,IAAI,GAAG,OAAO,EAAE;AACzB,GAAG,OAAO,aAAa,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,YAAY,IAAI,CAAC;AACxH,EAAE;AACF,EAAE;AACF,CAAC,UAAU,CAAC,kBAAkB,EAAE,GAAG,CAAC;AACpC,CAAC,OAAO,GAAG;AACX;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,OAAO,UAAU,CAAC,kBAAkB,CAAC,IAAI;AAC1C,EAAE,IAAI,MAAM,GAAG;AACf,GAAG,OAAO,IAAI;AACd,EAAE,CAAC;AACH,EAAE,IAAI,QAAQ,GAAG;AACjB,GAAG,OAAO,WAAW,CAAC,IAAI,CAAC;AAC3B,EAAE;AACF,EAAE;AACF;;;;"}

package/build/server/chunks/chunks/navigation.js-DY6WRTuH.js

@@ -0,0 +1,2 @@
+import './client.js-2Lg7WJIk.js';
+//# sourceMappingURL=navigation.js-DY6WRTuH.js.map

package/build/server/chunks/chunks/navigation.js-DY6WRTuH.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"navigation.js-DY6WRTuH.js","sources":[],"sourcesContent":[],"names":[],"mappings":""}

package/build/server/chunks/chunks/oauth.js-B1zKax7l.js

@@ -0,0 +1,414 @@
+import { hkdfSync, createHash, createDecipheriv, timingSafeEqual, randomBytes, createCipheriv, createHmac } from 'node:crypto';
+
+//#region ../server/src/oauth/index.ts
+/**
+* OAuth 2.1 for MCP clients and the Grasshopper plugin, with this instance as
+* its own authorization server.
+*
+* The access token is an ordinary API token. The host mints it while the user is
+* signed in, at consent, through the same path as Team → API tokens; this
+* module seals the raw key into the authorization code and hands it over at the
+* token endpoint. So `/mcp` and `/api/v1` keep one credential type.
+*
+* Nothing here is stored. A registered client's id is its own signed metadata,
+* and a code is its own encrypted grant, bound to the issuing origin. The only
+* state is the set of redeemed codes, in the host's memory, so on several
+* replicas a code could be redeemed once per replica within its minute, and only
+* by whoever holds the PKCE verifier.
+*/
+/** The scopes a grant can carry. Each maps to one org-wide API scope. */
+var OAUTH_SCOPES = [
+	"read",
+	"solve",
+	"upload"
+];
+/**
+* All a registered (DCR or CIMD) client can be granted. Its name and redirects
+* are whatever the registrant chose, so `upload`, which puts code on the org's
+* Compute server, stays with the built-in client and a look-alike can't phish for it.
+*/
+var REGISTERED_CLIENT_SCOPES = ["read", "solve"];
+var GRASSHOPPER_CLIENT = {
+	clientId: "selva-grasshopper",
+	name: "Selva for Grasshopper",
+	redirectUris: ["http://127.0.0.1/callback"],
+	builtIn: true,
+	scopes: ["read", "upload"]
+};
+var MCP_PATH = "/mcp";
+var CODE_TTL_MS = 6e4;
+var CLIENT_NAME_MAX = 100;
+var REDIRECT_URIS_MAX = 10;
+var CIMD_TTL_MS = 36e5;
+var CIMD_FAILURE_TTL_MS = 6e4;
+var CIMD_CACHE_MAX = 500;
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]"
+]);
+var OAuthError = class extends Error {
+	error;
+	status;
+	constructor(error, description, status = 400) {
+		super(description);
+		this.error = error;
+		this.status = status;
+		this.name = "OAuthError";
+	}
+	toBody() {
+		return {
+			error: this.error,
+			error_description: this.message
+		};
+	}
+};
+function mcpResourceUrl(origin) {
+	return origin + MCP_PATH;
+}
+function resourceMetadataUrl(origin) {
+	return `${origin}/.well-known/oauth-protected-resource${MCP_PATH}`;
+}
+/** RFC 9728. Claude uses only the first authorization server. */
+function protectedResourceMetadata(origin) {
+	return {
+		resource: mcpResourceUrl(origin),
+		authorization_servers: [origin],
+		scopes_supported: [...REGISTERED_CLIENT_SCOPES],
+		bearer_methods_supported: ["header"]
+	};
+}
+/**
+* RFC 8414. Claude picks Client ID Metadata Documents only when both
+* `client_id_metadata_document_supported` and the `none` auth method appear.
+*/
+function authorizationServerMetadata(origin) {
+	return {
+		issuer: origin,
+		authorization_endpoint: `${origin}/oauth/authorize`,
+		token_endpoint: `${origin}/oauth/token`,
+		registration_endpoint: `${origin}/oauth/register`,
+		response_types_supported: ["code"],
+		grant_types_supported: ["authorization_code"],
+		code_challenge_methods_supported: ["S256"],
+		token_endpoint_auth_methods_supported: ["none"],
+		scopes_supported: [...OAUTH_SCOPES],
+		client_id_metadata_document_supported: true,
+		authorization_response_iss_parameter_supported: true
+	};
+}
+function createOAuthServer(options) {
+	const { origin } = options;
+	const now = options.now ?? Date.now;
+	const signKey = derive(options.secret, "selva-oauth-client");
+	const codeKey = derive(options.secret, `selva-oauth-code:${origin}`);
+	const redeemed = options.redeemedCodes ?? /* @__PURE__ */ new Map();
+	const metadataCache = /* @__PURE__ */ new Map();
+	/** RFC 7591. The client id carries the metadata, signed, so nothing is stored. */
+	function register(input) {
+		try {
+			const meta = input ?? {};
+			const redirectUris = checkRedirectUris(meta.redirect_uris);
+			const name = typeof meta.client_name === "string" ? meta.client_name.trim() : "";
+			const payload = b64(JSON.stringify({
+				n: name.slice(0, CLIENT_NAME_MAX),
+				r: redirectUris,
+				t: now()
+			}));
+			return {
+				status: 201,
+				body: {
+					client_id: `dcr_${payload}.${sign$1(signKey, payload)}`,
+					client_id_issued_at: Math.floor(now() / 1e3),
+					client_name: name || void 0,
+					redirect_uris: redirectUris,
+					grant_types: ["authorization_code"],
+					response_types: ["code"],
+					token_endpoint_auth_method: "none"
+				}
+			};
+		} catch (err) {
+			if (err instanceof OAuthError) return {
+				status: err.status,
+				body: err.toBody()
+			};
+			throw err;
+		}
+	}
+	async function resolveClient(clientId) {
+		if (clientId === "selva-grasshopper") return GRASSHOPPER_CLIENT;
+		if (clientId.startsWith("dcr_")) return registeredClient(clientId);
+		if (clientId.startsWith("https://")) return metadataClient(clientId);
+		throw new OAuthError("invalid_client", "Unknown client.");
+	}
+	function registeredClient(clientId) {
+		const [payload, signature] = clientId.slice(4).split(".");
+		if (!payload || !signature || !safeEqual(signature, sign$1(signKey, payload))) throw new OAuthError("invalid_client", "Unknown client.");
+		const meta = JSON.parse(unb64(payload));
+		return {
+			clientId,
+			name: meta.n || "An MCP client",
+			redirectUris: meta.r,
+			builtIn: false,
+			scopes: REGISTERED_CLIENT_SCOPES
+		};
+	}
+	async function metadataClient(url) {
+		const cached = metadataCache.get(url);
+		if (cached) {
+			if ("client" in cached && now() - cached.at < CIMD_TTL_MS) return cached.client;
+			if ("failure" in cached && now() - cached.at < CIMD_FAILURE_TTL_MS) throw cached.failure;
+		}
+		if (!options.fetchClientMetadata) throw new OAuthError("invalid_client", "This server does not accept URL client ids.");
+		try {
+			const client = await readMetadata(url, options.fetchClientMetadata);
+			remember(url, {
+				at: now(),
+				client
+			});
+			return client;
+		} catch (err) {
+			if (!(err instanceof OAuthError)) throw err;
+			remember(url, {
+				at: now(),
+				failure: err
+			});
+			throw err;
+		}
+	}
+	function remember(url, entry) {
+		if (metadataCache.size >= CIMD_CACHE_MAX) metadataCache.delete(metadataCache.keys().next().value);
+		metadataCache.set(url, entry);
+	}
+	/**
+	* Validates the query `/oauth/authorize` arrives with. An `OAuthError` from a
+	* bad client or redirect URI must be shown, not redirected: the redirect target
+	* is exactly what can't be trusted.
+	*/
+	async function parseAuthorizeRequest(query) {
+		const client = await resolveClient(query.get("client_id") ?? "");
+		const redirectUri = query.get("redirect_uri") ?? "";
+		if (!client.redirectUris.some((r) => redirectMatches(r, redirectUri))) throw new OAuthError("invalid_request", "The redirect URI is not registered for this client.");
+		if (query.get("response_type") !== "code") throw new OAuthError("unsupported_response_type", "Only response_type=code is supported.");
+		const codeChallenge = query.get("code_challenge") ?? "";
+		if (!codeChallenge || query.get("code_challenge_method") !== "S256") throw new OAuthError("invalid_request", "PKCE with code_challenge_method=S256 is required.");
+		const resource = query.get("resource") ?? mcpResourceUrl(origin);
+		if (!isThisResource(resource)) throw new OAuthError("invalid_target", "The resource is not this server.");
+		return {
+			client,
+			redirectUri,
+			state: query.get("state") ?? void 0,
+			codeChallenge,
+			scopes: parseScopes(query.get("scope"), client.scopes),
+			resource
+		};
+	}
+	/** Where to send the browser after consent: the client's redirect URI with a code. */
+	function approve(request, grant) {
+		const code = seal(codeKey, {
+			c: request.client.clientId,
+			r: request.redirectUri,
+			p: request.codeChallenge,
+			x: now() + CODE_TTL_MS,
+			g: grant
+		});
+		return withParams(request.redirectUri, {
+			code,
+			state: request.state,
+			iss: origin
+		});
+	}
+	function deny(request) {
+		return withParams(request.redirectUri, {
+			error: "access_denied",
+			state: request.state,
+			iss: origin
+		});
+	}
+	function exchange(form) {
+		try {
+			if (form.get("grant_type") !== "authorization_code") throw new OAuthError("unsupported_grant_type", "Only authorization_code is supported.");
+			const code = form.get("code") ?? "";
+			const sealed = open(codeKey, code);
+			if (!sealed || sealed.x < now()) throw new OAuthError("invalid_grant", "The code is invalid or expired.");
+			if (sealed.c !== form.get("client_id") || sealed.r !== form.get("redirect_uri")) throw new OAuthError("invalid_grant", "The code was issued to another client.");
+			const verifier = form.get("code_verifier") ?? "";
+			if (!safeEqual(createHash("sha256").update(verifier).digest("base64url"), sealed.p)) throw new OAuthError("invalid_grant", "The code_verifier does not match.");
+			const resource = form.get("resource");
+			if (resource !== null && !isThisResource(resource)) throw new OAuthError("invalid_target", "The resource is not this server.");
+			if (!markRedeemed(code, sealed.x)) throw new OAuthError("invalid_grant", "The code was already used.");
+			const { g } = sealed;
+			return {
+				status: 200,
+				body: {
+					access_token: g.secret,
+					token_type: "Bearer",
+					expires_in: Math.max(0, Math.floor((Date.parse(g.expiresAt) - now()) / 1e3)),
+					scope: g.scopes.join(" ")
+				}
+			};
+		} catch (err) {
+			if (err instanceof OAuthError) return {
+				status: err.status,
+				body: err.toBody()
+			};
+			throw err;
+		}
+	}
+	function markRedeemed(code, expiresAt) {
+		const t = now();
+		for (const [k, x] of redeemed) if (x < t) redeemed.delete(k);
+		const id = createHash("sha256").update(code).digest("base64url");
+		if (redeemed.has(id)) return false;
+		redeemed.set(id, expiresAt);
+		return true;
+	}
+	function isThisResource(resource) {
+		const r = resource.replace(/\/$/, "");
+		return r === origin || r === mcpResourceUrl(origin);
+	}
+	return {
+		register,
+		resolveClient,
+		parseAuthorizeRequest,
+		approve,
+		deny,
+		exchange,
+		protectedResourceMetadata: () => protectedResourceMetadata(origin),
+		authorizationServerMetadata: () => authorizationServerMetadata(origin)
+	};
+}
+/** OAuth scopes to the API scopes a minted token gets. */
+function apiScopesFor(scopes) {
+	return scopes.map((s) => `${s}:all`);
+}
+async function readMetadata(url, fetchClientMetadata) {
+	let doc;
+	try {
+		doc = await fetchClientMetadata(url);
+	} catch {
+		throw new OAuthError("invalid_client", "The client metadata document could not be read.");
+	}
+	if (doc?.client_id !== url) throw new OAuthError("invalid_client", "The metadata document names a different client_id.");
+	return {
+		clientId: url,
+		name: typeof doc.client_name === "string" && doc.client_name.trim() ? doc.client_name.trim().slice(0, CLIENT_NAME_MAX) : new URL(url).host,
+		redirectUris: checkRedirectUris(doc.redirect_uris),
+		builtIn: false,
+		scopes: REGISTERED_CLIENT_SCOPES
+	};
+}
+/**
+* What the request asks for, within what its client may have. A scope outside
+* that is dropped, not refused, so a client that asks for every advertised
+* scope still signs in with what it may have. Asking for none of them means all
+* of them. `read` rides along with `solve`, which the consent page offers as
+* "read and run solves".
+*/
+function parseScopes(raw, allowed) {
+	const asked = (raw ?? "").split(" ").filter((s) => allowed.includes(s));
+	if (!asked.length) return [...allowed];
+	return allowed.filter((s) => asked.includes(s) || s === "read" && asked.includes("solve"));
+}
+/**
+* The access levels a consent page offers for a request, narrowest first. The
+* user may narrow what the client asked for, never widen it. An upload request
+* is offered as asked: narrowing it to read would leave the client unable to
+* do the one thing it signed in for.
+*/
+function consentChoices(scopes) {
+	if (scopes.includes("upload")) return [{
+		access: "upload",
+		scopes: [...scopes]
+	}];
+	const choices = [{
+		access: "read",
+		scopes: ["read"]
+	}];
+	if (scopes.includes("solve")) choices.push({
+		access: "solve",
+		scopes: [...scopes]
+	});
+	return choices;
+}
+function checkRedirectUris(value) {
+	if (!Array.isArray(value) || !value.length || value.length > REDIRECT_URIS_MAX) throw new OAuthError("invalid_redirect_uri", "Give between 1 and 10 redirect_uris.");
+	for (const uri of value) if (typeof uri !== "string" || !isAllowedRedirect(uri)) throw new OAuthError("invalid_redirect_uri", "Redirect URIs must be https, or http on a loopback address.");
+	return value;
+}
+function isAllowedRedirect(uri) {
+	let url;
+	try {
+		url = new URL(uri);
+	} catch {
+		return false;
+	}
+	if (url.hash) return false;
+	return url.protocol === "https:" || url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname);
+}
+/** A redirect to a program on the user's own machine, which any local process can claim. */
+function isLoopbackRedirect(uri) {
+	try {
+		return LOOPBACK_HOSTS.has(new URL(uri).hostname);
+	} catch {
+		return false;
+	}
+}
+/** Exact, except a loopback redirect matches on any port (RFC 8252 §7.3). */
+function redirectMatches(registered, requested) {
+	if (registered === requested) return true;
+	let a, b;
+	try {
+		a = new URL(registered);
+		b = new URL(requested);
+	} catch {
+		return false;
+	}
+	return a.protocol === "http:" && b.protocol === "http:" && LOOPBACK_HOSTS.has(a.hostname) && a.hostname === b.hostname && a.pathname === b.pathname && a.search === b.search && !b.hash && !b.username && !b.password;
+}
+function withParams(uri, params) {
+	const url = new URL(uri);
+	for (const [k, v] of Object.entries(params)) if (v !== void 0) url.searchParams.set(k, v);
+	return url.toString();
+}
+function derive(secret, info) {
+	return Buffer.from(hkdfSync("sha256", secret, "", info, 32));
+}
+function sign$1(key, data) {
+	return createHmac("sha256", key).update(data).digest("base64url");
+}
+function seal(key, value) {
+	const iv = randomBytes(12);
+	const cipher = createCipheriv("aes-256-gcm", key, iv);
+	const body = Buffer.concat([cipher.update(JSON.stringify(value)), cipher.final()]);
+	return Buffer.concat([
+		iv,
+		cipher.getAuthTag(),
+		body
+	]).toString("base64url");
+}
+function open(key, sealed) {
+	try {
+		const raw = Buffer.from(sealed, "base64url");
+		const decipher = createDecipheriv("aes-256-gcm", key, raw.subarray(0, 12));
+		decipher.setAuthTag(raw.subarray(12, 28));
+		const body = Buffer.concat([decipher.update(raw.subarray(28)), decipher.final()]);
+		return JSON.parse(body.toString("utf8"));
+	} catch {
+		return null;
+	}
+}
+function b64(text) {
+	return Buffer.from(text).toString("base64url");
+}
+function unb64(text) {
+	return Buffer.from(text, "base64url").toString("utf8");
+}
+function safeEqual(a, b) {
+	const x = Buffer.from(a);
+	const y = Buffer.from(b);
+	return x.length === y.length && timingSafeEqual(x, y);
+}
+
+export { OAuthError as O, REGISTERED_CLIENT_SCOPES as R, consentChoices as a, apiScopesFor as b, createOAuthServer as c, authorizationServerMetadata as d, isLoopbackRedirect as i, protectedResourceMetadata as p, resourceMetadataUrl as r };
+//# sourceMappingURL=oauth.js-B1zKax7l.js.map

package/build/server/chunks/chunks/oauth.js-B1zKax7l.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js-B1zKax7l.js","sources":["../../../../.svelte-kit/output/server/chunks/oauth.js"],"sourcesContent":["import { createCipheriv, createDecipheriv, createHash, createHmac, hkdfSync, randomBytes, timingSafeEqual } from \"node:crypto\";\n//#region ../server/src/oauth/index.ts\n/**\n* OAuth 2.1 for MCP clients and the Grasshopper plugin, with this instance as\n* its own authorization server.\n*\n* The access token is an ordinary API token. The host mints it while the user is\n* signed in, at consent, through the same path as Team → API tokens; this\n* module seals the raw key into the authorization code and hands it over at the\n* token endpoint. So `/mcp` and `/api/v1` keep one credential type.\n*\n* Nothing here is stored. A registered client's id is its own signed metadata,\n* and a code is its own encrypted grant, bound to the issuing origin. The only\n* state is the set of redeemed codes, in the host's memory, so on several\n* replicas a code could be redeemed once per replica within its minute, and only\n* by whoever holds the PKCE verifier.\n*/\n/** The scopes a grant can carry. Each maps to one org-wide API scope. */\nvar OAUTH_SCOPES = [\n\t\"read\",\n\t\"solve\",\n\t\"upload\"\n];\n/**\n* All a registered (DCR or CIMD) client can be granted. Its name and redirects\n* are whatever the registrant chose, so `upload`, which puts code on the org's\n* Compute server, stays with the built-in client and a look-alike can't phish for it.\n*/\nvar REGISTERED_CLIENT_SCOPES = [\"read\", \"solve\"];\nvar GRASSHOPPER_CLIENT = {\n\tclientId: \"selva-grasshopper\",\n\tname: \"Selva for Grasshopper\",\n\tredirectUris: [\"http://127.0.0.1/callback\"],\n\tbuiltIn: true,\n\tscopes: [\"read\", \"upload\"]\n};\nvar MCP_PATH = \"/mcp\";\nvar CODE_TTL_MS = 6e4;\nvar CLIENT_NAME_MAX = 100;\nvar REDIRECT_URIS_MAX = 10;\nvar CIMD_TTL_MS = 36e5;\nvar CIMD_FAILURE_TTL_MS = 6e4;\nvar CIMD_CACHE_MAX = 500;\nvar LOOPBACK_HOSTS = /* @__PURE__ */ new Set([\n\t\"localhost\",\n\t\"127.0.0.1\",\n\t\"[::1]\"\n]);\nvar OAuthError = class extends Error {\n\terror;\n\tstatus;\n\tconstructor(error, description, status = 400) {\n\t\tsuper(description);\n\t\tthis.error = error;\n\t\tthis.status = status;\n\t\tthis.name = \"OAuthError\";\n\t}\n\ttoBody() {\n\t\treturn {\n\t\t\terror: this.error,\n\t\t\terror_description: this.message\n\t\t};\n\t}\n};\nfunction mcpResourceUrl(origin) {\n\treturn origin + MCP_PATH;\n}\nfunction resourceMetadataUrl(origin) {\n\treturn `${origin}/.well-known/oauth-protected-resource${MCP_PATH}`;\n}\n/** RFC 9728. Claude uses only the first authorization server. */\nfunction protectedResourceMetadata(origin) {\n\treturn {\n\t\tresource: mcpResourceUrl(origin),\n\t\tauthorization_servers: [origin],\n\t\tscopes_supported: [...REGISTERED_CLIENT_SCOPES],\n\t\tbearer_methods_supported: [\"header\"]\n\t};\n}\n/**\n* RFC 8414. Claude picks Client ID Metadata Documents only when both\n* `client_id_metadata_document_supported` and the `none` auth method appear.\n*/\nfunction authorizationServerMetadata(origin) {\n\treturn {\n\t\tissuer: origin,\n\t\tauthorization_endpoint: `${origin}/oauth/authorize`,\n\t\ttoken_endpoint: `${origin}/oauth/token`,\n\t\tregistration_endpoint: `${origin}/oauth/register`,\n\t\tresponse_types_supported: [\"code\"],\n\t\tgrant_types_supported: [\"authorization_code\"],\n\t\tcode_challenge_methods_supported: [\"S256\"],\n\t\ttoken_endpoint_auth_methods_supported: [\"none\"],\n\t\tscopes_supported: [...OAUTH_SCOPES],\n\t\tclient_id_metadata_document_supported: true,\n\t\tauthorization_response_iss_parameter_supported: true\n\t};\n}\nfunction createOAuthServer(options) {\n\tconst { origin } = options;\n\tconst now = options.now ?? Date.now;\n\tconst signKey = derive(options.secret, \"selva-oauth-client\");\n\tconst codeKey = derive(options.secret, `selva-oauth-code:${origin}`);\n\tconst redeemed = options.redeemedCodes ?? /* @__PURE__ */ new Map();\n\tconst metadataCache = /* @__PURE__ */ new Map();\n\t/** RFC 7591. The client id carries the metadata, signed, so nothing is stored. */\n\tfunction register(input) {\n\t\ttry {\n\t\t\tconst meta = input ?? {};\n\t\t\tconst redirectUris = checkRedirectUris(meta.redirect_uris);\n\t\t\tconst name = typeof meta.client_name === \"string\" ? meta.client_name.trim() : \"\";\n\t\t\tconst payload = b64(JSON.stringify({\n\t\t\t\tn: name.slice(0, CLIENT_NAME_MAX),\n\t\t\t\tr: redirectUris,\n\t\t\t\tt: now()\n\t\t\t}));\n\t\t\treturn {\n\t\t\t\tstatus: 201,\n\t\t\t\tbody: {\n\t\t\t\t\tclient_id: `dcr_${payload}.${sign$1(signKey, payload)}`,\n\t\t\t\t\tclient_id_issued_at: Math.floor(now() / 1e3),\n\t\t\t\t\tclient_name: name || void 0,\n\t\t\t\t\tredirect_uris: redirectUris,\n\t\t\t\t\tgrant_types: [\"authorization_code\"],\n\t\t\t\t\tresponse_types: [\"code\"],\n\t\t\t\t\ttoken_endpoint_auth_method: \"none\"\n\t\t\t\t}\n\t\t\t};\n\t\t} catch (err) {\n\t\t\tif (err instanceof OAuthError) return {\n\t\t\t\tstatus: err.status,\n\t\t\t\tbody: err.toBody()\n\t\t\t};\n\t\t\tthrow err;\n\t\t}\n\t}\n\tasync function resolveClient(clientId) {\n\t\tif (clientId === \"selva-grasshopper\") return GRASSHOPPER_CLIENT;\n\t\tif (clientId.startsWith(\"dcr_\")) return registeredClient(clientId);\n\t\tif (clientId.startsWith(\"https://\")) return metadataClient(clientId);\n\t\tthrow new OAuthError(\"invalid_client\", \"Unknown client.\");\n\t}\n\tfunction registeredClient(clientId) {\n\t\tconst [payload, signature] = clientId.slice(4).split(\".\");\n\t\tif (!payload || !signature || !safeEqual(signature, sign$1(signKey, payload))) throw new OAuthError(\"invalid_client\", \"Unknown client.\");\n\t\tconst meta = JSON.parse(unb64(payload));\n\t\treturn {\n\t\t\tclientId,\n\t\t\tname: meta.n || \"An MCP client\",\n\t\t\tredirectUris: meta.r,\n\t\t\tbuiltIn: false,\n\t\t\tscopes: REGISTERED_CLIENT_SCOPES\n\t\t};\n\t}\n\tasync function metadataClient(url) {\n\t\tconst cached = metadataCache.get(url);\n\t\tif (cached) {\n\t\t\tif (\"client\" in cached && now() - cached.at < CIMD_TTL_MS) return cached.client;\n\t\t\tif (\"failure\" in cached && now() - cached.at < CIMD_FAILURE_TTL_MS) throw cached.failure;\n\t\t}\n\t\tif (!options.fetchClientMetadata) throw new OAuthError(\"invalid_client\", \"This server does not accept URL client ids.\");\n\t\ttry {\n\t\t\tconst client = await readMetadata(url, options.fetchClientMetadata);\n\t\t\tremember(url, {\n\t\t\t\tat: now(),\n\t\t\t\tclient\n\t\t\t});\n\t\t\treturn client;\n\t\t} catch (err) {\n\t\t\tif (!(err instanceof OAuthError)) throw err;\n\t\t\tremember(url, {\n\t\t\t\tat: now(),\n\t\t\t\tfailure: err\n\t\t\t});\n\t\t\tthrow err;\n\t\t}\n\t}\n\tfunction remember(url, entry) {\n\t\tif (metadataCache.size >= CIMD_CACHE_MAX) metadataCache.delete(metadataCache.keys().next().value);\n\t\tmetadataCache.set(url, entry);\n\t}\n\t/**\n\t* Validates the query `/oauth/authorize` arrives with. An `OAuthError` from a\n\t* bad client or redirect URI must be shown, not redirected: the redirect target\n\t* is exactly what can't be trusted.\n\t*/\n\tasync function parseAuthorizeRequest(query) {\n\t\tconst client = await resolveClient(query.get(\"client_id\") ?? \"\");\n\t\tconst redirectUri = query.get(\"redirect_uri\") ?? \"\";\n\t\tif (!client.redirectUris.some((r) => redirectMatches(r, redirectUri))) throw new OAuthError(\"invalid_request\", \"The redirect URI is not registered for this client.\");\n\t\tif (query.get(\"response_type\") !== \"code\") throw new OAuthError(\"unsupported_response_type\", \"Only response_type=code is supported.\");\n\t\tconst codeChallenge = query.get(\"code_challenge\") ?? \"\";\n\t\tif (!codeChallenge || query.get(\"code_challenge_method\") !== \"S256\") throw new OAuthError(\"invalid_request\", \"PKCE with code_challenge_method=S256 is required.\");\n\t\tconst resource = query.get(\"resource\") ?? mcpResourceUrl(origin);\n\t\tif (!isThisResource(resource)) throw new OAuthError(\"invalid_target\", \"The resource is not this server.\");\n\t\treturn {\n\t\t\tclient,\n\t\t\tredirectUri,\n\t\t\tstate: query.get(\"state\") ?? void 0,\n\t\t\tcodeChallenge,\n\t\t\tscopes: parseScopes(query.get(\"scope\"), client.scopes),\n\t\t\tresource\n\t\t};\n\t}\n\t/** Where to send the browser after consent: the client's redirect URI with a code. */\n\tfunction approve(request, grant) {\n\t\tconst code = seal(codeKey, {\n\t\t\tc: request.client.clientId,\n\t\t\tr: request.redirectUri,\n\t\t\tp: request.codeChallenge,\n\t\t\tx: now() + CODE_TTL_MS,\n\t\t\tg: grant\n\t\t});\n\t\treturn withParams(request.redirectUri, {\n\t\t\tcode,\n\t\t\tstate: request.state,\n\t\t\tiss: origin\n\t\t});\n\t}\n\tfunction deny(request) {\n\t\treturn withParams(request.redirectUri, {\n\t\t\terror: \"access_denied\",\n\t\t\tstate: request.state,\n\t\t\tiss: origin\n\t\t});\n\t}\n\tfunction exchange(form) {\n\t\ttry {\n\t\t\tif (form.get(\"grant_type\") !== \"authorization_code\") throw new OAuthError(\"unsupported_grant_type\", \"Only authorization_code is supported.\");\n\t\t\tconst code = form.get(\"code\") ?? \"\";\n\t\t\tconst sealed = open(codeKey, code);\n\t\t\tif (!sealed || sealed.x < now()) throw new OAuthError(\"invalid_grant\", \"The code is invalid or expired.\");\n\t\t\tif (sealed.c !== form.get(\"client_id\") || sealed.r !== form.get(\"redirect_uri\")) throw new OAuthError(\"invalid_grant\", \"The code was issued to another client.\");\n\t\t\tconst verifier = form.get(\"code_verifier\") ?? \"\";\n\t\t\tif (!safeEqual(createHash(\"sha256\").update(verifier).digest(\"base64url\"), sealed.p)) throw new OAuthError(\"invalid_grant\", \"The code_verifier does not match.\");\n\t\t\tconst resource = form.get(\"resource\");\n\t\t\tif (resource !== null && !isThisResource(resource)) throw new OAuthError(\"invalid_target\", \"The resource is not this server.\");\n\t\t\tif (!markRedeemed(code, sealed.x)) throw new OAuthError(\"invalid_grant\", \"The code was already used.\");\n\t\t\tconst { g } = sealed;\n\t\t\treturn {\n\t\t\t\tstatus: 200,\n\t\t\t\tbody: {\n\t\t\t\t\taccess_token: g.secret,\n\t\t\t\t\ttoken_type: \"Bearer\",\n\t\t\t\t\texpires_in: Math.max(0, Math.floor((Date.parse(g.expiresAt) - now()) / 1e3)),\n\t\t\t\t\tscope: g.scopes.join(\" \")\n\t\t\t\t}\n\t\t\t};\n\t\t} catch (err) {\n\t\t\tif (err instanceof OAuthError) return {\n\t\t\t\tstatus: err.status,\n\t\t\t\tbody: err.toBody()\n\t\t\t};\n\t\t\tthrow err;\n\t\t}\n\t}\n\tfunction markRedeemed(code, expiresAt) {\n\t\tconst t = now();\n\t\tfor (const [k, x] of redeemed) if (x < t) redeemed.delete(k);\n\t\tconst id = createHash(\"sha256\").update(code).digest(\"base64url\");\n\t\tif (redeemed.has(id)) return false;\n\t\tredeemed.set(id, expiresAt);\n\t\treturn true;\n\t}\n\tfunction isThisResource(resource) {\n\t\tconst r = resource.replace(/\\/$/, \"\");\n\t\treturn r === origin || r === mcpResourceUrl(origin);\n\t}\n\treturn {\n\t\tregister,\n\t\tresolveClient,\n\t\tparseAuthorizeRequest,\n\t\tapprove,\n\t\tdeny,\n\t\texchange,\n\t\tprotectedResourceMetadata: () => protectedResourceMetadata(origin),\n\t\tauthorizationServerMetadata: () => authorizationServerMetadata(origin)\n\t};\n}\n/** OAuth scopes to the API scopes a minted token gets. */\nfunction apiScopesFor(scopes) {\n\treturn scopes.map((s) => `${s}:all`);\n}\nasync function readMetadata(url, fetchClientMetadata) {\n\tlet doc;\n\ttry {\n\t\tdoc = await fetchClientMetadata(url);\n\t} catch {\n\t\tthrow new OAuthError(\"invalid_client\", \"The client metadata document could not be read.\");\n\t}\n\tif (doc?.client_id !== url) throw new OAuthError(\"invalid_client\", \"The metadata document names a different client_id.\");\n\treturn {\n\t\tclientId: url,\n\t\tname: typeof doc.client_name === \"string\" && doc.client_name.trim() ? doc.client_name.trim().slice(0, CLIENT_NAME_MAX) : new URL(url).host,\n\t\tredirectUris: checkRedirectUris(doc.redirect_uris),\n\t\tbuiltIn: false,\n\t\tscopes: REGISTERED_CLIENT_SCOPES\n\t};\n}\n/**\n* What the request asks for, within what its client may have. A scope outside\n* that is dropped, not refused, so a client that asks for every advertised\n* scope still signs in with what it may have. Asking for none of them means all\n* of them. `read` rides along with `solve`, which the consent page offers as\n* \"read and run solves\".\n*/\nfunction parseScopes(raw, allowed) {\n\tconst asked = (raw ?? \"\").split(\" \").filter((s) => allowed.includes(s));\n\tif (!asked.length) return [...allowed];\n\treturn allowed.filter((s) => asked.includes(s) || s === \"read\" && asked.includes(\"solve\"));\n}\n/**\n* The access levels a consent page offers for a request, narrowest first. The\n* user may narrow what the client asked for, never widen it. An upload request\n* is offered as asked: narrowing it to read would leave the client unable to\n* do the one thing it signed in for.\n*/\nfunction consentChoices(scopes) {\n\tif (scopes.includes(\"upload\")) return [{\n\t\taccess: \"upload\",\n\t\tscopes: [...scopes]\n\t}];\n\tconst choices = [{\n\t\taccess: \"read\",\n\t\tscopes: [\"read\"]\n\t}];\n\tif (scopes.includes(\"solve\")) choices.push({\n\t\taccess: \"solve\",\n\t\tscopes: [...scopes]\n\t});\n\treturn choices;\n}\nfunction checkRedirectUris(value) {\n\tif (!Array.isArray(value) || !value.length || value.length > REDIRECT_URIS_MAX) throw new OAuthError(\"invalid_redirect_uri\", \"Give between 1 and 10 redirect_uris.\");\n\tfor (const uri of value) if (typeof uri !== \"string\" || !isAllowedRedirect(uri)) throw new OAuthError(\"invalid_redirect_uri\", \"Redirect URIs must be https, or http on a loopback address.\");\n\treturn value;\n}\nfunction isAllowedRedirect(uri) {\n\tlet url;\n\ttry {\n\t\turl = new URL(uri);\n\t} catch {\n\t\treturn false;\n\t}\n\tif (url.hash) return false;\n\treturn url.protocol === \"https:\" || url.protocol === \"http:\" && LOOPBACK_HOSTS.has(url.hostname);\n}\n/** A redirect to a program on the user's own machine, which any local process can claim. */\nfunction isLoopbackRedirect(uri) {\n\ttry {\n\t\treturn LOOPBACK_HOSTS.has(new URL(uri).hostname);\n\t} catch {\n\t\treturn false;\n\t}\n}\n/** Exact, except a loopback redirect matches on any port (RFC 8252 §7.3). */\nfunction redirectMatches(registered, requested) {\n\tif (registered === requested) return true;\n\tlet a, b;\n\ttry {\n\t\ta = new URL(registered);\n\t\tb = new URL(requested);\n\t} catch {\n\t\treturn false;\n\t}\n\treturn a.protocol === \"http:\" && b.protocol === \"http:\" && LOOPBACK_HOSTS.has(a.hostname) && a.hostname === b.hostname && a.pathname === b.pathname && a.search === b.search && !b.hash && !b.username && !b.password;\n}\nfunction withParams(uri, params) {\n\tconst url = new URL(uri);\n\tfor (const [k, v] of Object.entries(params)) if (v !== void 0) url.searchParams.set(k, v);\n\treturn url.toString();\n}\nfunction derive(secret, info) {\n\treturn Buffer.from(hkdfSync(\"sha256\", secret, \"\", info, 32));\n}\nfunction sign$1(key, data) {\n\treturn createHmac(\"sha256\", key).update(data).digest(\"base64url\");\n}\nfunction seal(key, value) {\n\tconst iv = randomBytes(12);\n\tconst cipher = createCipheriv(\"aes-256-gcm\", key, iv);\n\tconst body = Buffer.concat([cipher.update(JSON.stringify(value)), cipher.final()]);\n\treturn Buffer.concat([\n\t\tiv,\n\t\tcipher.getAuthTag(),\n\t\tbody\n\t]).toString(\"base64url\");\n}\nfunction open(key, sealed) {\n\ttry {\n\t\tconst raw = Buffer.from(sealed, \"base64url\");\n\t\tconst decipher = createDecipheriv(\"aes-256-gcm\", key, raw.subarray(0, 12));\n\t\tdecipher.setAuthTag(raw.subarray(12, 28));\n\t\tconst body = Buffer.concat([decipher.update(raw.subarray(28)), decipher.final()]);\n\t\treturn JSON.parse(body.toString(\"utf8\"));\n\t} catch {\n\t\treturn null;\n\t}\n}\nfunction b64(text) {\n\treturn Buffer.from(text).toString(\"base64url\");\n}\nfunction unb64(text) {\n\treturn Buffer.from(text, \"base64url\").toString(\"utf8\");\n}\nfunction safeEqual(a, b) {\n\tconst x = Buffer.from(a);\n\tconst y = Buffer.from(b);\n\treturn x.length === y.length && timingSafeEqual(x, y);\n}\n//#endregion\nexport { consentChoices as a, protectedResourceMetadata as c, authorizationServerMetadata as i, resourceMetadataUrl as l, REGISTERED_CLIENT_SCOPES as n, createOAuthServer as o, apiScopesFor as r, isLoopbackRedirect as s, OAuthError as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,YAAY,GAAG;AACnB,CAAC,MAAM;AACP,CAAC,OAAO;AACR,CAAC;AACD,CAAC;AACD;AACA;AACA;AACA;AACA;AACG,IAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE,OAAO;AAC/C,IAAI,kBAAkB,GAAG;AACzB,CAAC,QAAQ,EAAE,mBAAmB;AAC9B,CAAC,IAAI,EAAE,uBAAuB;AAC9B,CAAC,YAAY,EAAE,CAAC,2BAA2B,CAAC;AAC5C,CAAC,OAAO,EAAE,IAAI;AACd,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ;AAC1B,CAAC;AACD,IAAI,QAAQ,GAAG,MAAM;AACrB,IAAI,WAAW,GAAG,GAAG;AACrB,IAAI,eAAe,GAAG,GAAG;AACzB,IAAI,iBAAiB,GAAG,EAAE;AAC1B,IAAI,WAAW,GAAG,IAAI;AACtB,IAAI,mBAAmB,GAAG,GAAG;AAC7B,IAAI,cAAc,GAAG,GAAG;AACxB,IAAI,cAAc,mBAAmB,IAAI,GAAG,CAAC;AAC7C,CAAC,WAAW;AACZ,CAAC,WAAW;AACZ,CAAC;AACD,CAAC,CAAC;AACC,IAAC,UAAU,GAAG,cAAc,KAAK,CAAC;AACrC,CAAC,KAAK;AACN,CAAC,MAAM;AACP,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,GAAG,GAAG,EAAE;AAC/C,EAAE,KAAK,CAAC,WAAW,CAAC;AACpB,EAAE,IAAI,CAAC,KAAK,GAAG,KAAK;AACpB,EAAE,IAAI,CAAC,MAAM,GAAG,MAAM;AACtB,EAAE,IAAI,CAAC,IAAI,GAAG,YAAY;AAC1B,CAAC;AACD,CAAC,MAAM,GAAG;AACV,EAAE,OAAO;AACT,GAAG,KAAK,EAAE,IAAI,CAAC,KAAK;AACpB,GAAG,iBAAiB,EAAE,IAAI,CAAC;AAC3B,GAAG;AACH,CAAC;AACD;AACA,SAAS,cAAc,CAAC,MAAM,EAAE;AAChC,CAAC,OAAO,MAAM,GAAG,QAAQ;AACzB;AACA,SAAS,mBAAmB,CAAC,MAAM,EAAE;AACrC,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,qCAAqC,EAAE,QAAQ,CAAC,CAAC;AACnE;AACA;AACA,SAAS,yBAAyB,CAAC,MAAM,EAAE;AAC3C,CAAC,OAAO;AACR,EAAE,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC;AAClC,EAAE,qBAAqB,EAAE,CAAC,MAAM,CAAC;AACjC,EAAE,gBAAgB,EAAE,CAAC,GAAG,wBAAwB,CAAC;AACjD,EAAE,wBAAwB,EAAE,CAAC,QAAQ;AACrC,EAAE;AACF;AACA;AACA;AACA;AACA;AACA,SAAS,2BAA2B,CAAC,MAAM,EAAE;AAC7C,CAAC,OAAO;AACR,EAAE,MAAM,EAAE,MAAM;AAChB,EAAE,sBAAsB,EAAE,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC;AACrD,EAAE,cAAc,EAAE,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC;AACzC,EAAE,qBAAqB,EAAE,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC;AACnD,EAAE,wBAAwB,EAAE,CAAC,MAAM,CAAC;AACpC,EAAE,qBAAqB,EAAE,CAAC,oBAAoB,CAAC;AAC/C,EAAE,gCAAgC,EAAE,CAAC,MAAM,CAAC;AAC5C,EAAE,qCAAqC,EAAE,CAAC,MAAM,CAAC;AACjD,EAAE,gBAAgB,EAAE,CAAC,GAAG,YAAY,CAAC;AACrC,EAAE,qCAAqC,EAAE,IAAI;AAC7C,EAAE,8CAA8C,EAAE;AAClD,EAAE;AACF;AACA,SAAS,iBAAiB,CAAC,OAAO,EAAE;AACpC,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO;AAC3B,CAAC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG;AACpC,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,oBAAoB,CAAC;AAC7D,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC;AACrE,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,oBAAoB,IAAI,GAAG,EAAE;AACpE,CAAC,MAAM,aAAa,mBAAmB,IAAI,GAAG,EAAE;AAChD;AACA,CAAC,SAAS,QAAQ,CAAC,KAAK,EAAE;AAC1B,EAAE,IAAI;AACN,GAAG,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;AAC3B,GAAG,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,aAAa,CAAC;AAC7D,GAAG,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE;AACnF,GAAG,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;AACtC,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC;AACrC,IAAI,CAAC,EAAE,YAAY;AACnB,IAAI,CAAC,EAAE,GAAG;AACV,IAAI,CAAC,CAAC;AACN,GAAG,OAAO;AACV,IAAI,MAAM,EAAE,GAAG;AACf,IAAI,IAAI,EAAE;AACV,KAAK,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAC5D,KAAK,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC;AACjD,KAAK,WAAW,EAAE,IAAI,IAAI,KAAK,CAAC;AAChC,KAAK,aAAa,EAAE,YAAY;AAChC,KAAK,WAAW,EAAE,CAAC,oBAAoB,CAAC;AACxC,KAAK,cAAc,EAAE,CAAC,MAAM,CAAC;AAC7B,KAAK,0BAA0B,EAAE;AACjC;AACA,IAAI;AACJ,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,IAAI,GAAG,YAAY,UAAU,EAAE,OAAO;AACzC,IAAI,MAAM,EAAE,GAAG,CAAC,MAAM;AACtB,IAAI,IAAI,EAAE,GAAG,CAAC,MAAM;AACpB,IAAI;AACJ,GAAG,MAAM,GAAG;AACZ,EAAE;AACF,CAAC;AACD,CAAC,eAAe,aAAa,CAAC,QAAQ,EAAE;AACxC,EAAE,IAAI,QAAQ,KAAK,mBAAmB,EAAE,OAAO,kBAAkB;AACjE,EAAE,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,OAAO,gBAAgB,CAAC,QAAQ,CAAC;AACpE,EAAE,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,OAAO,cAAc,CAAC,QAAQ,CAAC;AACtE,EAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;AAC3D,CAAC;AACD,CAAC,SAAS,gBAAgB,CAAC,QAAQ,EAAE;AACrC,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;AAC3D,EAAE,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;AAC1I,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACzC,EAAE,OAAO;AACT,GAAG,QAAQ;AACX,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,eAAe;AAClC,GAAG,YAAY,EAAE,IAAI,CAAC,CAAC;AACvB,GAAG,OAAO,EAAE,KAAK;AACjB,GAAG,MAAM,EAAE;AACX,GAAG;AACH,CAAC;AACD,CAAC,eAAe,cAAc,CAAC,GAAG,EAAE;AACpC,EAAE,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC;AACvC,EAAE,IAAI,MAAM,EAAE;AACd,GAAG,IAAI,QAAQ,IAAI,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,WAAW,EAAE,OAAO,MAAM,CAAC,MAAM;AAClF,GAAG,IAAI,SAAS,IAAI,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,mBAAmB,EAAE,MAAM,MAAM,CAAC,OAAO;AAC3F,EAAE;AACF,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,6CAA6C,CAAC;AACzH,EAAE,IAAI;AACN,GAAG,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,mBAAmB,CAAC;AACtE,GAAG,QAAQ,CAAC,GAAG,EAAE;AACjB,IAAI,EAAE,EAAE,GAAG,EAAE;AACb,IAAI;AACJ,IAAI,CAAC;AACL,GAAG,OAAO,MAAM;AAChB,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,IAAI,EAAE,GAAG,YAAY,UAAU,CAAC,EAAE,MAAM,GAAG;AAC9C,GAAG,QAAQ,CAAC,GAAG,EAAE;AACjB,IAAI,EAAE,EAAE,GAAG,EAAE;AACb,IAAI,OAAO,EAAE;AACb,IAAI,CAAC;AACL,GAAG,MAAM,GAAG;AACZ,EAAE;AACF,CAAC;AACD,CAAC,SAAS,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE;AAC/B,EAAE,IAAI,aAAa,CAAC,IAAI,IAAI,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;AACnG,EAAE,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC;AAC/B,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,CAAC,eAAe,qBAAqB,CAAC,KAAK,EAAE;AAC7C,EAAE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;AAClE,EAAE,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE;AACrD,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,qDAAqD,CAAC;AACvK,EAAE,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,MAAM,EAAE,MAAM,IAAI,UAAU,CAAC,2BAA2B,EAAE,uCAAuC,CAAC;AACvI,EAAE,MAAM,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE;AACzD,EAAE,IAAI,CAAC,aAAa,IAAI,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,MAAM,EAAE,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,mDAAmD,CAAC;AACnK,EAAE,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,cAAc,CAAC,MAAM,CAAC;AAClE,EAAE,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,kCAAkC,CAAC;AAC3G,EAAE,OAAO;AACT,GAAG,MAAM;AACT,GAAG,WAAW;AACd,GAAG,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM;AACtC,GAAG,aAAa;AAChB,GAAG,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;AACzD,GAAG;AACH,GAAG;AACH,CAAC;AACD;AACA,CAAC,SAAS,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE;AAClC,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE;AAC7B,GAAG,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;AAC7B,GAAG,CAAC,EAAE,OAAO,CAAC,WAAW;AACzB,GAAG,CAAC,EAAE,OAAO,CAAC,aAAa;AAC3B,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,WAAW;AACzB,GAAG,CAAC,EAAE;AACN,GAAG,CAAC;AACJ,EAAE,OAAO,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE;AACzC,GAAG,IAAI;AACP,GAAG,KAAK,EAAE,OAAO,CAAC,KAAK;AACvB,GAAG,GAAG,EAAE;AACR,GAAG,CAAC;AACJ,CAAC;AACD,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE;AACxB,EAAE,OAAO,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE;AACzC,GAAG,KAAK,EAAE,eAAe;AACzB,GAAG,KAAK,EAAE,OAAO,CAAC,KAAK;AACvB,GAAG,GAAG,EAAE;AACR,GAAG,CAAC;AACJ,CAAC;AACD,CAAC,SAAS,QAAQ,CAAC,IAAI,EAAE;AACzB,EAAE,IAAI;AACN,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,oBAAoB,EAAE,MAAM,IAAI,UAAU,CAAC,wBAAwB,EAAE,uCAAuC,CAAC;AAC/I,GAAG,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE;AACtC,GAAG,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC;AACrC,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,GAAG,GAAG,EAAE,EAAE,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,iCAAiC,CAAC;AAC5G,GAAG,IAAI,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,wCAAwC,CAAC;AACnK,GAAG,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE;AACnD,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,mCAAmC,CAAC;AAClK,GAAG,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;AACxC,GAAG,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,kCAAkC,CAAC;AACjI,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,4BAA4B,CAAC;AACzG,GAAG,MAAM,EAAE,CAAC,EAAE,GAAG,MAAM;AACvB,GAAG,OAAO;AACV,IAAI,MAAM,EAAE,GAAG;AACf,IAAI,IAAI,EAAE;AACV,KAAK,YAAY,EAAE,CAAC,CAAC,MAAM;AAC3B,KAAK,UAAU,EAAE,QAAQ;AACzB,KAAK,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC;AACjF,KAAK,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG;AAC7B;AACA,IAAI;AACJ,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,IAAI,GAAG,YAAY,UAAU,EAAE,OAAO;AACzC,IAAI,MAAM,EAAE,GAAG,CAAC,MAAM;AACtB,IAAI,IAAI,EAAE,GAAG,CAAC,MAAM;AACpB,IAAI;AACJ,GAAG,MAAM,GAAG;AACZ,EAAE;AACF,CAAC;AACD,CAAC,SAAS,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE;AACxC,EAAE,MAAM,CAAC,GAAG,GAAG,EAAE;AACjB,EAAE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9D,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;AAClE,EAAE,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,OAAO,KAAK;AACpC,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC;AAC7B,EAAE,OAAO,IAAI;AACb,CAAC;AACD,CAAC,SAAS,cAAc,CAAC,QAAQ,EAAE;AACnC,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;AACvC,EAAE,OAAO,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,cAAc,CAAC,MAAM,CAAC;AACrD,CAAC;AACD,CAAC,OAAO;AACR,EAAE,QAAQ;AACV,EAAE,aAAa;AACf,EAAE,qBAAqB;AACvB,EAAE,OAAO;AACT,EAAE,IAAI;AACN,EAAE,QAAQ;AACV,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC,MAAM,CAAC;AACpE,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC,MAAM;AACvE,EAAE;AACF;AACA;AACA,SAAS,YAAY,CAAC,MAAM,EAAE;AAC9B,CAAC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AACrC;AACA,eAAe,YAAY,CAAC,GAAG,EAAE,mBAAmB,EAAE;AACtD,CAAC,IAAI,GAAG;AACR,CAAC,IAAI;AACL,EAAE,GAAG,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC;AACtC,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,iDAAiD,CAAC;AAC3F,CAAC;AACD,CAAC,IAAI,GAAG,EAAE,SAAS,KAAK,GAAG,EAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,oDAAoD,CAAC;AACzH,CAAC,OAAO;AACR,EAAE,QAAQ,EAAE,GAAG;AACf,EAAE,IAAI,EAAE,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI;AAC5I,EAAE,YAAY,EAAE,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC;AACpD,EAAE,OAAO,EAAE,KAAK;AAChB,EAAE,MAAM,EAAE;AACV,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE;AACnC,CAAC,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;AACvC,CAAC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC3F;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,MAAM,EAAE;AAChC,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;AACxC,EAAE,MAAM,EAAE,QAAQ;AAClB,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM;AACpB,EAAE,CAAC;AACH,CAAC,MAAM,OAAO,GAAG,CAAC;AAClB,EAAE,MAAM,EAAE,MAAM;AAChB,EAAE,MAAM,EAAE,CAAC,MAAM;AACjB,EAAE,CAAC;AACH,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC;AAC5C,EAAE,MAAM,EAAE,OAAO;AACjB,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM;AACpB,EAAE,CAAC;AACH,CAAC,OAAO,OAAO;AACf;AACA,SAAS,iBAAiB,CAAC,KAAK,EAAE;AAClC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,iBAAiB,EAAE,MAAM,IAAI,UAAU,CAAC,sBAAsB,EAAE,sCAAsC,CAAC;AACrK,CAAC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,UAAU,CAAC,sBAAsB,EAAE,6DAA6D,CAAC;AAC7L,CAAC,OAAO,KAAK;AACb;AACA,SAAS,iBAAiB,CAAC,GAAG,EAAE;AAChC,CAAC,IAAI,GAAG;AACR,CAAC,IAAI;AACL,EAAE,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC;AACpB,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK;AAC3B,CAAC,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;AACjG;AACA;AACA,SAAS,kBAAkB,CAAC,GAAG,EAAE;AACjC,CAAC,IAAI;AACL,EAAE,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;AAClD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD;AACA;AACA,SAAS,eAAe,CAAC,UAAU,EAAE,SAAS,EAAE;AAChD,CAAC,IAAI,UAAU,KAAK,SAAS,EAAE,OAAO,IAAI;AAC1C,CAAC,IAAI,CAAC,EAAE,CAAC;AACT,CAAC,IAAI;AACL,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC;AACzB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC;AACxB,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ;AACtN;AACA,SAAS,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE;AACjC,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC;AACzB,CAAC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,KAAK,MAAM,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;AAC1F,CAAC,OAAO,GAAG,CAAC,QAAQ,EAAE;AACtB;AACA,SAAS,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE;AAC9B,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AAC7D;AACA,SAAS,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE;AAC3B,CAAC,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;AAClE;AACA,SAAS,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE;AAC1B,CAAC,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC;AAC3B,CAAC,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC;AACtD,CAAC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;AACnF,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC;AACtB,EAAE,EAAE;AACJ,EAAE,MAAM,CAAC,UAAU,EAAE;AACrB,EAAE;AACF,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;AACzB;AACA,SAAS,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE;AAC3B,CAAC,IAAI;AACL,EAAE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC;AAC9C,EAAE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC5E,EAAE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AAC3C,EAAE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;AACnF,EAAE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,IAAI;AACb,CAAC;AACD;AACA,SAAS,GAAG,CAAC,IAAI,EAAE;AACnB,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;AAC/C;AACA,SAAS,KAAK,CAAC,IAAI,EAAE;AACrB,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;AACvD;AACA,SAAS,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE;AACzB,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AACzB,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AACzB,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC;AACtD;;;;"}

package/build/server/chunks/chunks/openapi.js-C0KGiRVJ.js

@@ -0,0 +1,61 @@
+import { e as buildOpenApiDocument$1 } from './api.js-CsByc21P.js';
+import { V as V1_ENDPOINTS } from './registry.js-w6WuseeX.js';
+
+//#region src/lib/server/api/v1/openapi.ts
+/**
+* Selva's `/api/v1` OpenAPI document: the shared builder from
+* `@selvajs/server/api` over this app's route registry.
+*/
+var ERROR_DESCRIPTIONS = {
+	403: "Authenticated, but not permitted to perform this action. For an API token, `details.requiredScope` names the scope that would have passed.",
+	429: "Rate limited. Retry after the interval in `Retry-After`. API-token callers have a per-token request budget, reported on every response in `RateLimit-Limit` and `RateLimit-Remaining`; solves also draw on the owner’s compute budget.",
+	503: "The compute server is unconfigured or unreachable, or API tokens are unavailable on this server (`API_TOKENS_UNAVAILABLE`)."
+};
+/** Route prefix every endpoint in this registry is served under. */
+var API_BASE_PATH = "/api/v1";
+/**
+* `info.version` describes the API, not the npm package — they move
+* independently on purpose. `/api/v1` is additive-only, so every release
+* publishes the same contract; embedding the package version made the spec
+* drift on every version bump for no API reason.
+*
+* Derived from the base path so the major can't contradict the prefix it's
+* served under: shipping `/api/v2` moves both at once, or neither.
+*/
+var API_VERSION = `${/v(\d+)$/.exec("/api/v1")?.[1] ?? "1"}.0.0`;
+function buildOpenApiDocument(version = API_VERSION) {
+	return buildOpenApiDocument$1(V1_ENDPOINTS, {
+		basePath: API_BASE_PATH,
+		errorDescriptions: ERROR_DESCRIPTIONS,
+		alwaysErrors: [
+			401,
+			403,
+			429,
+			500,
+			503
+		],
+		info: {
+			title: "Selva API",
+			version,
+			description: "The tenant-scoped Selva API. Every endpoint acts as the calling identity and is confined to that identity's organization.\n\n**Stability.** Public endpoints are additive-only within v1: new optional fields and parameters may appear, but nothing is removed, renamed, or changed in type or meaning. A breaking change ships as a new route under `/api/v2` alongside this one. Anything deprecated inside v1 keeps working for a stated window and returns a `Deprecation` header while it does.\n\n**Operations marked `x-internal` carry none of that promise.** They exist to serve the Selva web UI and may change or disappear without notice.\n\n**Existence is never disclosed.** A resource the caller may not see returns `404`, not `403`. `403` means the resource is visible but the action is not allowed.\n\n**No CORS.** `/api/v1` sends no cross-origin headers; it serves same-origin browser requests and non-browser clients holding a token.\n\n**Scopes.** Each operation names the API-token scope it needs as `x-scope`: `read`, `write`, `solve` or `upload`. `write`, `solve` and `upload` each include `read`, and `write` includes `upload`. `upload` allows creating definitions, uploading versions, checking a file's schema before upload and making a version live, and nothing else: it cannot edit metadata, delete or share.\n\nInstance administration lives at `/api/admin`, is session-only, is never reachable with a bearer token, and is not described here.",
+			license: { name: "MIT" }
+		},
+		security: [{ cookieAuth: [] }, { bearerAuth: [] }],
+		securitySchemes: {
+			cookieAuth: {
+				type: "apiKey",
+				in: "cookie",
+				name: "session",
+				description: "Browser session cookie. Same-origin only."
+			},
+			bearerAuth: {
+				type: "http",
+				scheme: "bearer",
+				description: "An API token (`selva_…`), sent as `Authorization: Bearer <token>` and never in the URL. It acts as the user who created it, in one org, narrowed by its scopes. `/api/v1` is the only prefix that accepts one; `/api/admin` never does."
+			}
+		}
+	});
+}
+
+export { buildOpenApiDocument as b };
+//# sourceMappingURL=openapi.js-C0KGiRVJ.js.map

package/build/server/chunks/chunks/openapi.js-C0KGiRVJ.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.js-C0KGiRVJ.js","sources":["../../../../.svelte-kit/output/server/chunks/openapi.js"],"sourcesContent":["import { y as buildOpenApiDocument$1 } from \"./api.js\";\nimport { t as V1_ENDPOINTS } from \"./registry.js\";\n//#region src/lib/server/api/v1/openapi.ts\n/**\n* Selva's `/api/v1` OpenAPI document: the shared builder from\n* `@selvajs/server/api` over this app's route registry.\n*/\nvar ERROR_DESCRIPTIONS = {\n\t403: \"Authenticated, but not permitted to perform this action. For an API token, `details.requiredScope` names the scope that would have passed.\",\n\t429: \"Rate limited. Retry after the interval in `Retry-After`. API-token callers have a per-token request budget, reported on every response in `RateLimit-Limit` and `RateLimit-Remaining`; solves also draw on the owner’s compute budget.\",\n\t503: \"The compute server is unconfigured or unreachable, or API tokens are unavailable on this server (`API_TOKENS_UNAVAILABLE`).\"\n};\n/** Route prefix every endpoint in this registry is served under. */\nvar API_BASE_PATH = \"/api/v1\";\n/**\n* `info.version` describes the API, not the npm package — they move\n* independently on purpose. `/api/v1` is additive-only, so every release\n* publishes the same contract; embedding the package version made the spec\n* drift on every version bump for no API reason.\n*\n* Derived from the base path so the major can't contradict the prefix it's\n* served under: shipping `/api/v2` moves both at once, or neither.\n*/\nvar API_VERSION = `${/v(\\d+)$/.exec(\"/api/v1\")?.[1] ?? \"1\"}.0.0`;\nfunction buildOpenApiDocument(version = API_VERSION) {\n\treturn buildOpenApiDocument$1(V1_ENDPOINTS, {\n\t\tbasePath: API_BASE_PATH,\n\t\terrorDescriptions: ERROR_DESCRIPTIONS,\n\t\talwaysErrors: [\n\t\t\t401,\n\t\t\t403,\n\t\t\t429,\n\t\t\t500,\n\t\t\t503\n\t\t],\n\t\tinfo: {\n\t\t\ttitle: \"Selva API\",\n\t\t\tversion,\n\t\t\tdescription: \"The tenant-scoped Selva API. Every endpoint acts as the calling identity and is confined to that identity's organization.\\n\\n**Stability.** Public endpoints are additive-only within v1: new optional fields and parameters may appear, but nothing is removed, renamed, or changed in type or meaning. A breaking change ships as a new route under `/api/v2` alongside this one. Anything deprecated inside v1 keeps working for a stated window and returns a `Deprecation` header while it does.\\n\\n**Operations marked `x-internal` carry none of that promise.** They exist to serve the Selva web UI and may change or disappear without notice.\\n\\n**Existence is never disclosed.** A resource the caller may not see returns `404`, not `403`. `403` means the resource is visible but the action is not allowed.\\n\\n**No CORS.** `/api/v1` sends no cross-origin headers; it serves same-origin browser requests and non-browser clients holding a token.\\n\\n**Scopes.** Each operation names the API-token scope it needs as `x-scope`: `read`, `write`, `solve` or `upload`. `write`, `solve` and `upload` each include `read`, and `write` includes `upload`. `upload` allows creating definitions, uploading versions, checking a file's schema before upload and making a version live, and nothing else: it cannot edit metadata, delete or share.\\n\\nInstance administration lives at `/api/admin`, is session-only, is never reachable with a bearer token, and is not described here.\",\n\t\t\tlicense: { name: \"MIT\" }\n\t\t},\n\t\tsecurity: [{ cookieAuth: [] }, { bearerAuth: [] }],\n\t\tsecuritySchemes: {\n\t\t\tcookieAuth: {\n\t\t\t\ttype: \"apiKey\",\n\t\t\t\tin: \"cookie\",\n\t\t\t\tname: \"session\",\n\t\t\t\tdescription: \"Browser session cookie. Same-origin only.\"\n\t\t\t},\n\t\t\tbearerAuth: {\n\t\t\t\ttype: \"http\",\n\t\t\t\tscheme: \"bearer\",\n\t\t\t\tdescription: \"An API token (`selva_…`), sent as `Authorization: Bearer <token>` and never in the URL. It acts as the user who created it, in one org, narrowed by its scopes. `/api/v1` is the only prefix that accepts one; `/api/admin` never does.\"\n\t\t\t}\n\t\t}\n\t});\n}\n//#endregion\nexport { buildOpenApiDocument as t };\n"],"names":[],"mappings":";;;AAEA;AACA;AACA;AACA;AACA;AACA,IAAI,kBAAkB,GAAG;AACzB,CAAC,GAAG,EAAE,4IAA4I;AAClJ,CAAC,GAAG,EAAE,wOAAwO;AAC9O,CAAC,GAAG,EAAE;AACN,CAAC;AACD;AACA,IAAI,aAAa,GAAG,SAAS;AAC7B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,WAAW,GAAG,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC;AAChE,SAAS,oBAAoB,CAAC,OAAO,GAAG,WAAW,EAAE;AACrD,CAAC,OAAO,sBAAsB,CAAC,YAAY,EAAE;AAC7C,EAAE,QAAQ,EAAE,aAAa;AACzB,EAAE,iBAAiB,EAAE,kBAAkB;AACvC,EAAE,YAAY,EAAE;AAChB,GAAG,GAAG;AACN,GAAG,GAAG;AACN,GAAG,GAAG;AACN,GAAG,GAAG;AACN,GAAG;AACH,GAAG;AACH,EAAE,IAAI,EAAE;AACR,GAAG,KAAK,EAAE,WAAW;AACrB,GAAG,OAAO;AACV,GAAG,WAAW,EAAE,46CAA46C;AAC57C,GAAG,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK;AACzB,GAAG;AACH,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;AACpD,EAAE,eAAe,EAAE;AACnB,GAAG,UAAU,EAAE;AACf,IAAI,IAAI,EAAE,QAAQ;AAClB,IAAI,EAAE,EAAE,QAAQ;AAChB,IAAI,IAAI,EAAE,SAAS;AACnB,IAAI,WAAW,EAAE;AACjB,IAAI;AACJ,GAAG,UAAU,EAAE;AACf,IAAI,IAAI,EAAE,MAAM;AAChB,IAAI,MAAM,EAAE,QAAQ;AACpB,IAAI,WAAW,EAAE;AACjB;AACA;AACA,EAAE,CAAC;AACH;;;;"}