@selvajs/selva 4.20.0-beta.8 → 4.20.0-beta.9

package/build/server/chunks/entries/endpoints/auth/supabase/callback/_server.ts.js-zC_qkydH.js

@@ -0,0 +1,61 @@
+import { a as getAuthProvider } from '../../../../../chunks/providers.server.js-9bLadXKA.js';
+import { A as ApiErrorCode } from '../../../../../chunks/access.js-BataxwA1.js';
+import { a as apiError } from '../../../../../chunks/api-errors.js-zO_V9BK6.js';
+import { s as safeRedirectTarget } from '../../../../../chunks/redirect.js-2M2qGbv2.js';
+import { s as setSessionCookie, a as setRefreshCookie } from '../../../../../chunks/admin-auth.server.js-BtJ_IOxF.js';
+import { b as bootstrapUserSession } from '../../../../../chunks/auth-bootstrap.server.js-Bbei8vZM.js';
+import { c as consumeOAuthState } from '../../../../../chunks/oauthState.server.js-BVkqxviq.js';
+import { redirect } from '@sveltejs/kit';
+import '../../../../../chunks/shared-server.js-BGs15m2r.js';
+import '../../../../../chunks/src.js-CkFJvvTE.js';
+import 'zod';
+import '../../../../../chunks/definitions.js-Biw0znV5.js';
+import '../../../../../chunks/schema-extraction.js-DtC0djdq.js';
+import '../../../../../chunks/grasshopper.js-Bz6Gi1KD.js';
+import '../../../../../chunks/schema.js-cYn9UGx7.js';
+import 'node:crypto';
+import '../../../../../chunks/compute.js-Bb_Yprms.js';
+import 'node:dns/promises';
+import 'node:net';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '../../../../../chunks/api.js-BtFJkyCg.js';
+import '../../../../../chunks/rate-limit.js-Br3luBbc.js';
+import '../../../../../chunks/api-token-codec.js-DtGv_8ta.js';
+import '../../../../../chunks/token-codec.js-CxK2DiO-.js';
+import 'node:zlib';
+import '../../../../../chunks/tokens.js-D5GADjWd.js';
+import '../../../../../chunks/visibility.js-CmBHwx8m.js';
+import '../../../../../chunks/request-context.js-B7sipZtt.js';
+
+//#region src/routes/auth/supabase/callback/+server.ts
+/**
+* GET /auth/supabase/callback?code=...&redirectTo=/library
+*
+* Completes a Supabase OAuth round-trip. Exchanges the authorization code
+* for a session, sets the session cookie, and redirects to `redirectTo`.
+*
+* Post-verification flow (data-row seeding + first-admin bootstrap) lives in
+* `bootstrapUserSession` so the email-link and OAuth paths follow the same
+* sequence in the same order.
+*/
+var GET = async ({ url, cookies }) => {
+	if (!consumeOAuthState(cookies, url.searchParams.get("selva_state"))) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Sign-in session expired. Please try again.");
+	const code = url.searchParams.get("code");
+	if (!code) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Missing authorization code");
+	const oauth = getAuthProvider().oauth;
+	if (!oauth) apiError(501, ApiErrorCode.INTERNAL, "OAuth is not supported by the configured auth provider.");
+	const result = await oauth.exchangeOAuthCode(code);
+	if (!result) apiError(401, ApiErrorCode.UNAUTHORIZED, "OAuth exchange failed");
+	await bootstrapUserSession(result.user);
+	setSessionCookie(cookies, result.sessionToken);
+	setRefreshCookie(cookies, result.refreshToken);
+	const dest = safeRedirectTarget(url.searchParams.get("redirectTo"), "/library");
+	redirect(303, dest);
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts.js-zC_qkydH.js.map

package/build/server/chunks/entries/endpoints/auth/supabase/callback/_server.ts.js-zC_qkydH.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-zC_qkydH.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/auth/supabase/callback/_server.ts.js"],"sourcesContent":["import { r as getAuthProvider } from \"../../../../../chunks/providers.server.js\";\nimport { O as ApiErrorCode } from \"../../../../../chunks/access.js\";\nimport { t as apiError } from \"../../../../../chunks/api-errors.js\";\nimport { t as safeRedirectTarget } from \"../../../../../chunks/redirect.js\";\nimport { l as setRefreshCookie, u as setSessionCookie } from \"../../../../../chunks/admin-auth.server.js\";\nimport { t as bootstrapUserSession } from \"../../../../../chunks/auth-bootstrap.server.js\";\nimport { t as consumeOAuthState } from \"../../../../../chunks/oauthState.server.js\";\nimport { redirect } from \"@sveltejs/kit\";\n//#region src/routes/auth/supabase/callback/+server.ts\n/**\n* GET /auth/supabase/callback?code=...&redirectTo=/library\n*\n* Completes a Supabase OAuth round-trip. Exchanges the authorization code\n* for a session, sets the session cookie, and redirects to `redirectTo`.\n*\n* Post-verification flow (data-row seeding + first-admin bootstrap) lives in\n* `bootstrapUserSession` so the email-link and OAuth paths follow the same\n* sequence in the same order.\n*/\nvar GET = async ({ url, cookies }) => {\n\tif (!consumeOAuthState(cookies, url.searchParams.get(\"selva_state\"))) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Sign-in session expired. Please try again.\");\n\tconst code = url.searchParams.get(\"code\");\n\tif (!code) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing authorization code\");\n\tconst oauth = getAuthProvider().oauth;\n\tif (!oauth) apiError(501, ApiErrorCode.INTERNAL, \"OAuth is not supported by the configured auth provider.\");\n\tconst result = await oauth.exchangeOAuthCode(code);\n\tif (!result) apiError(401, ApiErrorCode.UNAUTHORIZED, \"OAuth exchange failed\");\n\tawait bootstrapUserSession(result.user);\n\tsetSessionCookie(cookies, result.sessionToken);\n\tsetRefreshCookie(cookies, result.refreshToken);\n\tconst dest = safeRedirectTarget(url.searchParams.get(\"redirectTo\"), \"/library\");\n\tredirect(303, dest);\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK;AACtC,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,4CAA4C,CAAC;AAClK,CAAC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;AAC1C,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,4BAA4B,CAAC;AACvF,CAAC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC,KAAK;AACtC,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,yDAAyD,CAAC;AAC5G,CAAC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC;AACnD,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,uBAAuB,CAAC;AAC/E,CAAC,MAAM,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC;AACxC,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AAC/C,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AAC/C,CAAC,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC;AAChF,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;AACpB;;;;"}

package/build/server/chunks/entries/endpoints/auth/supabase/start/_server.ts.js-YRO1FdWC.js

@@ -0,0 +1,66 @@
+import { a as getAuthProvider } from '../../../../../chunks/providers.server.js-9bLadXKA.js';
+import { A as ApiErrorCode } from '../../../../../chunks/access.js-BataxwA1.js';
+import { a as apiError } from '../../../../../chunks/api-errors.js-zO_V9BK6.js';
+import { i as issueOAuthState } from '../../../../../chunks/oauthState.server.js-BVkqxviq.js';
+import { redirect } from '@sveltejs/kit';
+import '../../../../../chunks/shared-server.js-BGs15m2r.js';
+import '../../../../../chunks/src.js-CkFJvvTE.js';
+import 'zod';
+import '../../../../../chunks/definitions.js-Biw0znV5.js';
+import '../../../../../chunks/schema-extraction.js-DtC0djdq.js';
+import '../../../../../chunks/grasshopper.js-Bz6Gi1KD.js';
+import '../../../../../chunks/schema.js-cYn9UGx7.js';
+import 'node:crypto';
+import '../../../../../chunks/compute.js-Bb_Yprms.js';
+import 'node:dns/promises';
+import 'node:net';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '../../../../../chunks/api.js-BtFJkyCg.js';
+import '../../../../../chunks/rate-limit.js-Br3luBbc.js';
+
+//#region src/routes/auth/supabase/start/+server.ts
+var ALLOWED_PROVIDERS = [
+	"google",
+	"github",
+	"azure",
+	"gitlab"
+];
+function isAllowedProvider(value) {
+	return value !== null && ALLOWED_PROVIDERS.includes(value);
+}
+/**
+* GET /auth/supabase/start?provider=google&redirectTo=/library
+*
+* Initiates an OAuth sign-in via Supabase Auth. The Supabase project must
+* have the named provider enabled in its dashboard. Bounces the browser to
+* the IdP's authorize endpoint; the IdP returns to `/auth/supabase/callback`
+* with a `?code=...`.
+*
+* `redirectTo` is preserved through the round trip via `?redirectTo=...` on
+* the callback URL we hand to Supabase.
+*
+* A CSRF nonce rides along the same way. Supabase owns the real OAuth `state`
+* and doesn't expose it, and `exchangeOAuthCode` takes only `code` — so the
+* nonce is our own, carried on the callback URL and compared against a cookie.
+* Without it the callback accepts an attacker's `?code=` and silently signs the
+* victim into the attacker's account. See `oauthState.server.ts`.
+*/
+var GET = async ({ url, cookies }) => {
+	const provider = url.searchParams.get("provider");
+	if (!isAllowedProvider(provider)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid provider. Allowed: ${ALLOWED_PROVIDERS.join(", ")}`);
+	const oauth = getAuthProvider().oauth;
+	if (!oauth) apiError(501, ApiErrorCode.INTERNAL, "OAuth is not supported by the configured auth provider.");
+	const redirectTo = url.searchParams.get("redirectTo") ?? "/library";
+	const callbackUrl = new URL("/auth/supabase/callback", url.origin);
+	if (redirectTo.startsWith("/")) callbackUrl.searchParams.set("redirectTo", redirectTo);
+	callbackUrl.searchParams.set("selva_state", issueOAuthState(cookies));
+	const authorizationUrl = await oauth.getOAuthAuthorizationUrl(provider, callbackUrl.toString());
+	redirect(303, authorizationUrl);
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts.js-YRO1FdWC.js.map

package/build/server/chunks/entries/endpoints/auth/supabase/start/_server.ts.js-YRO1FdWC.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-YRO1FdWC.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/auth/supabase/start/_server.ts.js"],"sourcesContent":["import { r as getAuthProvider } from \"../../../../../chunks/providers.server.js\";\nimport { O as ApiErrorCode } from \"../../../../../chunks/access.js\";\nimport { t as apiError } from \"../../../../../chunks/api-errors.js\";\nimport { n as issueOAuthState } from \"../../../../../chunks/oauthState.server.js\";\nimport { redirect } from \"@sveltejs/kit\";\n//#region src/routes/auth/supabase/start/+server.ts\nvar ALLOWED_PROVIDERS = [\n\t\"google\",\n\t\"github\",\n\t\"azure\",\n\t\"gitlab\"\n];\nfunction isAllowedProvider(value) {\n\treturn value !== null && ALLOWED_PROVIDERS.includes(value);\n}\n/**\n* GET /auth/supabase/start?provider=google&redirectTo=/library\n*\n* Initiates an OAuth sign-in via Supabase Auth. The Supabase project must\n* have the named provider enabled in its dashboard. Bounces the browser to\n* the IdP's authorize endpoint; the IdP returns to `/auth/supabase/callback`\n* with a `?code=...`.\n*\n* `redirectTo` is preserved through the round trip via `?redirectTo=...` on\n* the callback URL we hand to Supabase.\n*\n* A CSRF nonce rides along the same way. Supabase owns the real OAuth `state`\n* and doesn't expose it, and `exchangeOAuthCode` takes only `code` — so the\n* nonce is our own, carried on the callback URL and compared against a cookie.\n* Without it the callback accepts an attacker's `?code=` and silently signs the\n* victim into the attacker's account. See `oauthState.server.ts`.\n*/\nvar GET = async ({ url, cookies }) => {\n\tconst provider = url.searchParams.get(\"provider\");\n\tif (!isAllowedProvider(provider)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid provider. Allowed: ${ALLOWED_PROVIDERS.join(\", \")}`);\n\tconst oauth = getAuthProvider().oauth;\n\tif (!oauth) apiError(501, ApiErrorCode.INTERNAL, \"OAuth is not supported by the configured auth provider.\");\n\tconst redirectTo = url.searchParams.get(\"redirectTo\") ?? \"/library\";\n\tconst callbackUrl = new URL(\"/auth/supabase/callback\", url.origin);\n\tif (redirectTo.startsWith(\"/\")) callbackUrl.searchParams.set(\"redirectTo\", redirectTo);\n\tcallbackUrl.searchParams.set(\"selva_state\", issueOAuthState(cookies));\n\tconst authorizationUrl = await oauth.getOAuthAuthorizationUrl(provider, callbackUrl.toString());\n\tredirect(303, authorizationUrl);\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAKA;AACA,IAAI,iBAAiB,GAAG;AACxB,CAAC,QAAQ;AACT,CAAC,QAAQ;AACT,CAAC,OAAO;AACR,CAAC;AACD,CAAC;AACD,SAAS,iBAAiB,CAAC,KAAK,EAAE;AAClC,CAAC,OAAO,KAAK,KAAK,IAAI,IAAI,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC;AAC3D;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK;AACtC,CAAC,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC;AAClD,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,2BAA2B,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC9I,CAAC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC,KAAK;AACtC,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,yDAAyD,CAAC;AAC5G,CAAC,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,UAAU;AACpE,CAAC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,yBAAyB,EAAE,GAAG,CAAC,MAAM,CAAC;AACnE,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC;AACvF,CAAC,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC;AACtE,CAAC,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,wBAAwB,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC;AAChG,CAAC,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;AAChC;;;;"}

package/build/server/chunks/entries/endpoints/mcp/_server.ts.js-De83ryc8.js

@@ -0,0 +1,28 @@
+import { h as handleMcp } from '../../../chunks/server3.js-DqcWOcRa.js';
+import '../../../chunks/shared-server.js-BGs15m2r.js';
+import '../../../chunks/oauth.js-B1zKax7l.js';
+import 'node:crypto';
+import '../../../chunks/src.js-CkFJvvTE.js';
+import 'zod';
+import '../../../chunks/server2.js-DE3gOwQ9.js';
+import '../../../chunks/compute.js-Bb_Yprms.js';
+import '../../../chunks/access.js-BataxwA1.js';
+import 'node:dns/promises';
+import 'node:net';
+import '../../../chunks/rate-limit.js-Br3luBbc.js';
+import '@sveltejs/kit';
+import '../../../chunks/traversal.js-C2z6XZbO.js';
+import '../../../chunks/openapi.js-rosSFfGJ.js';
+import '../../../chunks/api.js-BtFJkyCg.js';
+import '../../../chunks/schema-extraction.js-DtC0djdq.js';
+import '../../../chunks/grasshopper.js-Bz6Gi1KD.js';
+import '../../../chunks/schema.js-cYn9UGx7.js';
+import '../../../chunks/registry.js-BuzflpOh.js';
+import 'zod/v4';
+import 'node:process';
+
+//#region src/routes/mcp/+server.ts
+var POST = ({ request, url, fetch }) => handleMcp(request, url.origin, fetch);
+
+export { POST };
+//# sourceMappingURL=_server.ts.js-De83ryc8.js.map

package/build/server/chunks/entries/endpoints/mcp/_server.ts.js-De83ryc8.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-De83ryc8.js","sources":["../../../../../../.svelte-kit/output/server/entries/endpoints/mcp/_server.ts.js"],"sourcesContent":["import { n as handleMcp } from \"../../../chunks/server3.js\";\n//#region src/routes/mcp/+server.ts\nvar POST = ({ request, url, fetch }) => handleMcp(request, url.origin, fetch);\n//#endregion\nexport { POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AACA;AACG,IAAC,IAAI,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK;;;;"}

package/build/server/chunks/entries/hooks.server.js-Ck4_AClg.js

@@ -0,0 +1,377 @@
+import { b as private_env } from '../chunks/shared-server.js-BGs15m2r.js';
+import { S as SYSTEM_CONTEXT } from '../chunks/src.js-CkFJvvTE.js';
+import { p as providers, g as getLogger, h as getErrorReporter, i as flag, j as getEventSink } from '../chunks/providers.server.js-9bLadXKA.js';
+import { a as resolveRequestId, r as renderThrown, R as REQUEST_ID_HEADER } from '../chunks/definitions.js-Biw0znV5.js';
+import { g as isApiError } from '../chunks/access.js-BataxwA1.js';
+import '../chunks/api.js-BtFJkyCg.js';
+import { f as findDeploymentDir, s as startUpdateOutcomeReconciler } from '../chunks/selfUpdate.server.js-CL5hu_sl.js';
+import { b as buildRequestContext } from '../chunks/request-context.js-B7sipZtt.js';
+import { g as getBootHealth } from '../chunks/bootHealth.server.js-C6JXO8yu.js';
+import { i as isCrossSiteFormSubmission, r as resolveApiToken, g as getRefreshToken, s as setSessionCookie, a as setRefreshCookie, c as clearRefreshCookie } from '../chunks/admin-auth.server.js-BtJ_IOxF.js';
+import { a as apiTokenCodec } from '../chunks/token4.server.js-Cc8jf4jk.js';
+import { w as wireHeaderAuthBootstrap, b as bootstrapUserSession } from '../chunks/auth-bootstrap.server.js-Bbei8vZM.js';
+import { M as MCP_PATH } from '../chunks/server3.js-DqcWOcRa.js';
+import { redirect, isHttpError } from '@sveltejs/kit';
+import 'zod';
+import '../chunks/compute.js-Bb_Yprms.js';
+import 'node:dns/promises';
+import 'node:net';
+import '../chunks/schema-extraction.js-DtC0djdq.js';
+import '../chunks/grasshopper.js-Bz6Gi1KD.js';
+import '../chunks/schema.js-cYn9UGx7.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '../chunks/rate-limit.js-Br3luBbc.js';
+import '../chunks/update-outcome.js-Dl8LwqJM.js';
+import '../chunks/api-token-codec.js-DtGv_8ta.js';
+import '../chunks/token-codec.js-CxK2DiO-.js';
+import 'node:zlib';
+import '../chunks/tokens.js-D5GADjWd.js';
+import '../chunks/visibility.js-CmBHwx8m.js';
+import '../chunks/oauth.js-B1zKax7l.js';
+import '../chunks/server2.js-DE3gOwQ9.js';
+import '../chunks/traversal.js-C2z6XZbO.js';
+import '../chunks/openapi.js-rosSFfGJ.js';
+import '../chunks/registry.js-BuzflpOh.js';
+import 'zod/v4';
+import 'node:process';
+
+//#region ../platform/src/userProfile/types.ts
+function emptyProfile(userId) {
+	return {
+		userId,
+		starredDefinitions: [],
+		recentRuns: []
+	};
+}
+//#endregion
+//#region ../server/src/http/security-headers.ts
+/**
+* Apply baseline browser-hardening headers to a response and return it for
+* chaining. Each is a cheap win that needs no UI verification:
+*
+*   - X-Content-Type-Options: nosniff — disables MIME sniffing.
+*   - Referrer-Policy: strict-origin-when-cross-origin — strips path and query
+*     from cross-origin Referer headers. Matches modern browser defaults, but
+*     pins the behavior in case a default drifts.
+*   - Permissions-Policy: opts out of browser APIs Selva-engine apps don't use,
+*     so XSS can't enable them.
+*   - HSTS when `opts.hsts`.
+*   - X-Frame-Options + `frame-ancestors 'none'` when `opts.denyFraming` — the
+*     caller opts in per route, since embeddable app routes must stay framable.
+*
+* **Intentionally NOT set here:**
+*   - A full Content-Security-Policy. Selva-engine apps are built for iframe
+*     embedding, so a strict CSP needs validating against real consumer sites
+*     before it can ship. `denyFraming` sets only the `frame-ancestors`
+*     directive, which constrains nothing else the page loads.
+*   - Cache-Control. Asset-path layout is app policy; set it in the caller.
+*/
+function applySecurityHeaders(response, opts) {
+	response.headers.set("X-Content-Type-Options", "nosniff");
+	response.headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
+	response.headers.set("Permissions-Policy", "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()");
+	if (opts.hsts) response.headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
+	if (opts.denyFraming) {
+		response.headers.set("X-Frame-Options", "DENY");
+		response.headers.set("Content-Security-Policy", "frame-ancestors 'none'");
+	}
+	return response;
+}
+//#endregion
+//#region ../server/src/http/route-classifier.ts
+function createRouteClassifier(config) {
+	const publicPages = new Set(config.publicPages ?? []);
+	const publicPrefixes = config.publicPrefixes ?? [];
+	const publicApis = new Set(config.publicApis ?? []);
+	const selfGatingPrefixes = [...config.selfGatingPrefixes ?? [], ...config.selfGatingPrefix !== void 0 ? [config.selfGatingPrefix] : []];
+	const staticPrefixes = config.staticPrefixes ?? [];
+	const staticPaths = new Set(config.staticPaths ?? []);
+	function isStaticAsset(pathname) {
+		if (staticPaths.has(pathname)) return true;
+		return staticPrefixes.some((p) => pathname.startsWith(p));
+	}
+	function isSelfGatingApiRoute(pathname) {
+		return selfGatingPrefixes.some((p) => pathname.startsWith(p));
+	}
+	function isPublicRoute(pathname) {
+		if (publicPages.has(pathname)) return true;
+		if (publicApis.has(pathname)) return true;
+		if (isSelfGatingApiRoute(pathname)) return true;
+		return publicPrefixes.some((p) => pathname.startsWith(p));
+	}
+	return {
+		isStaticAsset,
+		isSelfGatingApiRoute,
+		isPublicRoute
+	};
+}
+//#endregion
+//#region src/hooks.server.ts
+var OAUTH_TOKEN_PATH = "/oauth/token";
+var headerAuthBootstrapWired = false;
+var bootHealthKicked = false;
+var proxyAuthLoginMissWarned = false;
+var firstRunResolved = false;
+async function isFirstRun() {
+	if (firstRunResolved) return false;
+	const usersPage = await providers.auth.listUsers({ limit: 1 });
+	if (usersPage === null) {
+		firstRunResolved = true;
+		return false;
+	}
+	if (usersPage.items.length === 0) return true;
+	firstRunResolved = true;
+	return false;
+}
+var ensuredUserIds = /* @__PURE__ */ new Set();
+async function ensureUserOnce(userId) {
+	if (ensuredUserIds.has(userId)) return;
+	await providers.data.ensureUser(SYSTEM_CONTEXT, userId);
+	ensuredUserIds.add(userId);
+}
+/**
+* Populate `locals` for a signed-in session: profile, platform permissions and
+* acting org (the user's first membership, or an instance admin's fallback).
+*
+* The four reads are independent and keyed only by `user.id`, so they run in
+* one `Promise.all` as SYSTEM_CONTEXT (`ctx` isn't built yet). `ensureUser` is
+* the local equivalent of Supabase's `handle_new_auth_user` trigger, memoized
+* per process. Racing it against the reads is safe: on a brand-new user's first
+* request they may land before the row is seeded, but each fails soft to empty,
+* the correct state for a user with nothing yet.
+*/
+async function attachSession(event, user, sessionToken) {
+	const [, profile, platformPermissions, membership] = await Promise.all([
+		ensureUserOnce(user.id),
+		providers.data.userProfile.getProfile(SYSTEM_CONTEXT, user.id),
+		providers.data.permissions.getFor(SYSTEM_CONTEXT, user.id),
+		providers.data.orgs.findUserMembership(SYSTEM_CONTEXT, user.id)
+	]);
+	event.locals.user = user;
+	event.locals.profile = profile ?? emptyProfile(user.id);
+	event.locals.ctx = await buildRequestContext({
+		user,
+		sessionToken,
+		platformPermissions,
+		membership: membership?.member ?? null
+	}, { orgs: providers.data.orgs });
+}
+var PUBLIC_PAGE_ROUTES = /* @__PURE__ */ new Set([
+	"/",
+	"/login",
+	"/setup",
+	"/accept-invite"
+]);
+var { isStaticAsset, isSelfGatingApiRoute, isPublicRoute } = createRouteClassifier({
+	publicPages: PUBLIC_PAGE_ROUTES,
+	publicPrefixes: [
+		"/auth/",
+		"/logout",
+		"/docs/"
+	],
+	publicApis: [
+		"/api/health",
+		"/api/health/ready",
+		"/api/v1/openapi.json",
+		MCP_PATH,
+		"/.well-known/oauth-protected-resource",
+		"/.well-known/oauth-protected-resource/mcp",
+		"/.well-known/oauth-authorization-server",
+		"/oauth/register",
+		OAUTH_TOKEN_PATH
+	],
+	selfGatingPrefixes: ["/api/files/", "/api/v1/solve-events"],
+	staticPrefixes: ["/_app/", "/favicon/"],
+	staticPaths: ["/favicon.svg", "/robots.txt"]
+});
+var handle = async ({ event, resolve }) => {
+	event.locals.providers = providers;
+	const requestId = resolveRequestId(event.request.headers);
+	event.locals.requestId = requestId;
+	event.locals.log = getLogger().child({
+		requestId,
+		method: event.request.method,
+		route: event.url.pathname
+	});
+	if (!headerAuthBootstrapWired) {
+		wireHeaderAuthBootstrap();
+		headerAuthBootstrapWired = true;
+	}
+	if (!bootHealthKicked) {
+		bootHealthKicked = true;
+		getBootHealth();
+		const deploymentDir = findDeploymentDir(private_env);
+		if (deploymentDir) startUpdateOutcomeReconciler({
+			deploymentDir,
+			emit: (e) => getEventSink().emit(e),
+			report: (err) => getErrorReporter().capture(err, { tags: { origin: "selfUpdate" } })
+		});
+	}
+	const { pathname } = event.url;
+	if (isCrossSiteFormSubmission(event.request, { exemptPaths: [OAUTH_TOKEN_PATH] })) return applyResponseHeaders(new Response(`Cross-site ${event.request.method} form submissions are forbidden`, { status: 403 }), pathname, requestId);
+	if (isStaticAsset(pathname)) return applyResponseHeaders(await resolve(event), pathname, requestId);
+	if (pathname === "/api/health" || pathname === "/api/health/ready") return applyResponseHeaders(await resolve(event), pathname, requestId);
+	const tokenResult = pathname === "/mcp" ? { kind: "none" } : await resolveApiToken(event.request, {
+		codec: apiTokenCodec(),
+		auth: providers.auth,
+		data: providers.data,
+		flag,
+		log: event.locals.log
+	});
+	if (tokenResult.kind === "rejected") {
+		const { status, code, message } = tokenResult;
+		const headers = { "Content-Type": "application/json" };
+		if (status === 401) headers["WWW-Authenticate"] = "Bearer error=\"invalid_token\"";
+		return applyResponseHeaders(new Response(JSON.stringify({
+			message,
+			code
+		}), {
+			status,
+			headers
+		}), pathname, requestId);
+	}
+	if (tokenResult.kind === "ok") {
+		const { user, ctx, token } = tokenResult;
+		event.locals.log = event.locals.log.child({ tokenId: token.id });
+		event.locals.user = user;
+		event.locals.ctx = ctx;
+		event.locals.profile = await providers.data.userProfile.getProfile(SYSTEM_CONTEXT, user.id) ?? emptyProfile(user.id);
+		return applyResponseHeaders(await resolve(event), pathname, requestId);
+	}
+	const publicRoute = isPublicRoute(pathname);
+	const isJsonApiRoute = pathname.startsWith("/api/");
+	if (!publicRoute) {
+		if (await isFirstRun()) {
+			if (isJsonApiRoute) return applyResponseHeaders(new Response(JSON.stringify({
+				message: "Setup required",
+				code: "SETUP_REQUIRED"
+			}), {
+				status: 503,
+				headers: { "Content-Type": "application/json" }
+			}), pathname, requestId);
+			redirect(303, "/setup");
+		}
+	}
+	if (!publicRoute) {
+		let token = event.cookies.get("admin_session") ?? "";
+		let user = await providers.auth.verifyToken(token);
+		if (!user) {
+			const refreshToken = getRefreshToken(event.cookies);
+			const oauth = providers.auth.oauth;
+			if (refreshToken && oauth) {
+				const refreshed = await oauth.refreshSession(refreshToken);
+				if (refreshed) {
+					setSessionCookie(event.cookies, refreshed.sessionToken);
+					setRefreshCookie(event.cookies, refreshed.refreshToken);
+					token = refreshed.sessionToken;
+					user = await providers.auth.verifyToken(token);
+				} else clearRefreshCookie(event.cookies);
+			}
+		}
+		if (!user && providers.auth.proxyAuth) {
+			user = await providers.auth.proxyAuth.identifyFromHeaders(event.request.headers);
+			if (user) await bootstrapUserSession(user);
+		}
+		if (!user) {
+			if (isJsonApiRoute) return applyResponseHeaders(new Response(JSON.stringify({
+				message: "Your session has expired. Sign in again to continue.",
+				code: "UNAUTHORIZED"
+			}), {
+				status: 401,
+				headers: { "Content-Type": "application/json" }
+			}), pathname, requestId);
+			redirect(303, `/login?redirectTo=${encodeURIComponent(pathname + event.url.search)}`);
+		}
+		await attachSession(event, user, token);
+	} else {
+		const wantsSessionAttach = PUBLIC_PAGE_ROUTES.has(pathname) || isSelfGatingApiRoute(pathname);
+		const token = wantsSessionAttach ? event.cookies.get("admin_session") ?? "" : "";
+		let user = token ? await providers.auth.verifyToken(token) : null;
+		if (!user && wantsSessionAttach && providers.auth.proxyAuth) {
+			user = await providers.auth.proxyAuth.identifyFromHeaders(event.request.headers);
+			if (!user && pathname === "/login" && !proxyAuthLoginMissWarned) {
+				proxyAuthLoginMissWarned = true;
+				const proxyAuth = providers.auth.proxyAuth;
+				const noHeaders = proxyAuth.hasNoIdentityHeaders(event.request.headers);
+				const configured = proxyAuth.configuredHeaderNames.join(", ");
+				if (noHeaders) event.locals.log.warn("/login was hit and NONE of the configured identity headers arrived. The forward-auth proxy is not reaching this process, or is not forwarding the configured headers. See the @selvajs/header-auth-provider README \"Verification\" section.", {
+					component: "HeaderAuth",
+					configuredHeaders: configured
+				});
+				else event.locals.log.warn("/login was hit but the UPN header was missing or the user is not allowlisted. Some headers arrived but identification still failed — check that the UPN header is populated and that the user has been added to header-allowlist.json.", {
+					component: "HeaderAuth",
+					configuredHeaders: configured
+				});
+			}
+		}
+		if (user) await attachSession(event, user, token);
+	}
+	return applyResponseHeaders(await resolve(event), pathname, requestId);
+};
+var FRAME_DENIED_PREFIXES = [
+	"/admin",
+	"/setup",
+	"/login",
+	"/oauth"
+];
+function deniesFraming(pathname) {
+	return FRAME_DENIED_PREFIXES.some((p) => pathname === p || pathname.startsWith(`${p}/`));
+}
+function applyResponseHeaders(response, pathname, requestId) {
+	applySecurityHeaders(response, {
+		hsts: process.env.NODE_ENV === "production",
+		denyFraming: deniesFraming(pathname)
+	});
+	response.headers.set(REQUEST_ID_HEADER, requestId);
+	if (pathname.startsWith("/_app/")) response.headers.set("Cache-Control", "public, max-age=31536000, immutable");
+	else if (pathname.startsWith("/favicon/") || pathname === "/favicon.svg" || pathname === "/robots.txt") response.headers.set("Cache-Control", "public, max-age=604800");
+	return response;
+}
+var handleError = ({ error, status, event }) => {
+	if (isHttpError(error)) {
+		const body = error.body;
+		return {
+			message: body.message,
+			code: body.code,
+			fields: body.fields,
+			details: body.details
+		};
+	}
+	if (isApiError(error)) return {
+		message: error.message,
+		code: error.code,
+		fields: error.fields,
+		details: error.details
+	};
+	if (status === 404) return {
+		message: "Page not found.",
+		code: "NOT_FOUND"
+	};
+	(event.locals.log ?? getLogger().child({
+		method: event.request.method,
+		route: event.url.pathname
+	})).error("Unhandled error", {
+		component: "handleError",
+		status,
+		err: renderThrown(error),
+		cause: error instanceof Error && error.cause ? String(error.cause) : void 0
+	});
+	getErrorReporter().capture(error, {
+		method: event.request.method,
+		route: event.url.pathname,
+		userId: event.locals.ctx?.userId || void 0,
+		orgId: event.locals.ctx?.actingOrgId
+	});
+	return {
+		message: "An unexpected error occurred.",
+		code: "INTERNAL"
+	};
+};
+
+export { handle, handleError, isPublicRoute, isSelfGatingApiRoute, isStaticAsset };
+//# sourceMappingURL=hooks.server.js-Ck4_AClg.js.map

package/build/server/chunks/entries/hooks.server.js-Ck4_AClg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.server.js-Ck4_AClg.js","sources":["../../../../.svelte-kit/output/server/entries/hooks.server.js"],"sourcesContent":["import { t as private_env } from \"../chunks/shared-server.js\";\nimport { t as SYSTEM_CONTEXT } from \"../chunks/src.js\";\nimport { T as providers, f as getLogger, l as getErrorReporter, t as flag, u as getEventSink } from \"../chunks/providers.server.js\";\nimport { a as renderThrown, i as REQUEST_ID_HEADER, o as resolveRequestId } from \"../chunks/definitions.js\";\nimport { j as isApiError } from \"../chunks/access.js\";\nimport \"../chunks/api.js\";\nimport { n as startUpdateOutcomeReconciler, t as findDeploymentDir } from \"../chunks/selfUpdate.server.js\";\nimport { t as buildRequestContext } from \"../chunks/request-context.js\";\nimport { t as getBootHealth } from \"../chunks/bootHealth.server.js\";\nimport { a as getRefreshToken, f as resolveApiToken, l as setRefreshCookie, p as isCrossSiteFormSubmission, r as clearRefreshCookie, u as setSessionCookie } from \"../chunks/admin-auth.server.js\";\nimport { t as apiTokenCodec } from \"../chunks/token4.server.js\";\nimport { n as wireHeaderAuthBootstrap, t as bootstrapUserSession } from \"../chunks/auth-bootstrap.server.js\";\nimport { t as MCP_PATH } from \"../chunks/server3.js\";\nimport { isHttpError, redirect } from \"@sveltejs/kit\";\n//#region ../platform/src/userProfile/types.ts\nfunction emptyProfile(userId) {\n\treturn {\n\t\tuserId,\n\t\tstarredDefinitions: [],\n\t\trecentRuns: []\n\t};\n}\n//#endregion\n//#region ../server/src/http/security-headers.ts\n/**\n* Apply baseline browser-hardening headers to a response and return it for\n* chaining. Each is a cheap win that needs no UI verification:\n*\n*   - X-Content-Type-Options: nosniff — disables MIME sniffing.\n*   - Referrer-Policy: strict-origin-when-cross-origin — strips path and query\n*     from cross-origin Referer headers. Matches modern browser defaults, but\n*     pins the behavior in case a default drifts.\n*   - Permissions-Policy: opts out of browser APIs Selva-engine apps don't use,\n*     so XSS can't enable them.\n*   - HSTS when `opts.hsts`.\n*   - X-Frame-Options + `frame-ancestors 'none'` when `opts.denyFraming` — the\n*     caller opts in per route, since embeddable app routes must stay framable.\n*\n* **Intentionally NOT set here:**\n*   - A full Content-Security-Policy. Selva-engine apps are built for iframe\n*     embedding, so a strict CSP needs validating against real consumer sites\n*     before it can ship. `denyFraming` sets only the `frame-ancestors`\n*     directive, which constrains nothing else the page loads.\n*   - Cache-Control. Asset-path layout is app policy; set it in the caller.\n*/\nfunction applySecurityHeaders(response, opts) {\n\tresponse.headers.set(\"X-Content-Type-Options\", \"nosniff\");\n\tresponse.headers.set(\"Referrer-Policy\", \"strict-origin-when-cross-origin\");\n\tresponse.headers.set(\"Permissions-Policy\", \"accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()\");\n\tif (opts.hsts) response.headers.set(\"Strict-Transport-Security\", \"max-age=31536000; includeSubDomains\");\n\tif (opts.denyFraming) {\n\t\tresponse.headers.set(\"X-Frame-Options\", \"DENY\");\n\t\tresponse.headers.set(\"Content-Security-Policy\", \"frame-ancestors 'none'\");\n\t}\n\treturn response;\n}\n//#endregion\n//#region ../server/src/http/route-classifier.ts\nfunction createRouteClassifier(config) {\n\tconst publicPages = new Set(config.publicPages ?? []);\n\tconst publicPrefixes = config.publicPrefixes ?? [];\n\tconst publicApis = new Set(config.publicApis ?? []);\n\tconst selfGatingPrefixes = [...config.selfGatingPrefixes ?? [], ...config.selfGatingPrefix !== void 0 ? [config.selfGatingPrefix] : []];\n\tconst staticPrefixes = config.staticPrefixes ?? [];\n\tconst staticPaths = new Set(config.staticPaths ?? []);\n\tfunction isStaticAsset(pathname) {\n\t\tif (staticPaths.has(pathname)) return true;\n\t\treturn staticPrefixes.some((p) => pathname.startsWith(p));\n\t}\n\tfunction isSelfGatingApiRoute(pathname) {\n\t\treturn selfGatingPrefixes.some((p) => pathname.startsWith(p));\n\t}\n\tfunction isPublicRoute(pathname) {\n\t\tif (publicPages.has(pathname)) return true;\n\t\tif (publicApis.has(pathname)) return true;\n\t\tif (isSelfGatingApiRoute(pathname)) return true;\n\t\treturn publicPrefixes.some((p) => pathname.startsWith(p));\n\t}\n\treturn {\n\t\tisStaticAsset,\n\t\tisSelfGatingApiRoute,\n\t\tisPublicRoute\n\t};\n}\n//#endregion\n//#region src/hooks.server.ts\nvar OAUTH_TOKEN_PATH = \"/oauth/token\";\nvar headerAuthBootstrapWired = false;\nvar bootHealthKicked = false;\nvar proxyAuthLoginMissWarned = false;\nvar firstRunResolved = false;\nasync function isFirstRun() {\n\tif (firstRunResolved) return false;\n\tconst usersPage = await providers.auth.listUsers({ limit: 1 });\n\tif (usersPage === null) {\n\t\tfirstRunResolved = true;\n\t\treturn false;\n\t}\n\tif (usersPage.items.length === 0) return true;\n\tfirstRunResolved = true;\n\treturn false;\n}\nvar ensuredUserIds = /* @__PURE__ */ new Set();\nasync function ensureUserOnce(userId) {\n\tif (ensuredUserIds.has(userId)) return;\n\tawait providers.data.ensureUser(SYSTEM_CONTEXT, userId);\n\tensuredUserIds.add(userId);\n}\n/**\n* Populate `locals` for a signed-in session: profile, platform permissions and\n* acting org (the user's first membership, or an instance admin's fallback).\n*\n* The four reads are independent and keyed only by `user.id`, so they run in\n* one `Promise.all` as SYSTEM_CONTEXT (`ctx` isn't built yet). `ensureUser` is\n* the local equivalent of Supabase's `handle_new_auth_user` trigger, memoized\n* per process. Racing it against the reads is safe: on a brand-new user's first\n* request they may land before the row is seeded, but each fails soft to empty,\n* the correct state for a user with nothing yet.\n*/\nasync function attachSession(event, user, sessionToken) {\n\tconst [, profile, platformPermissions, membership] = await Promise.all([\n\t\tensureUserOnce(user.id),\n\t\tproviders.data.userProfile.getProfile(SYSTEM_CONTEXT, user.id),\n\t\tproviders.data.permissions.getFor(SYSTEM_CONTEXT, user.id),\n\t\tproviders.data.orgs.findUserMembership(SYSTEM_CONTEXT, user.id)\n\t]);\n\tevent.locals.user = user;\n\tevent.locals.profile = profile ?? emptyProfile(user.id);\n\tevent.locals.ctx = await buildRequestContext({\n\t\tuser,\n\t\tsessionToken,\n\t\tplatformPermissions,\n\t\tmembership: membership?.member ?? null\n\t}, { orgs: providers.data.orgs });\n}\nvar PUBLIC_PAGE_ROUTES = /* @__PURE__ */ new Set([\n\t\"/\",\n\t\"/login\",\n\t\"/setup\",\n\t\"/accept-invite\"\n]);\nvar { isStaticAsset, isSelfGatingApiRoute, isPublicRoute } = createRouteClassifier({\n\tpublicPages: PUBLIC_PAGE_ROUTES,\n\tpublicPrefixes: [\n\t\t\"/auth/\",\n\t\t\"/logout\",\n\t\t\"/docs/\"\n\t],\n\tpublicApis: [\n\t\t\"/api/health\",\n\t\t\"/api/health/ready\",\n\t\t\"/api/v1/openapi.json\",\n\t\tMCP_PATH,\n\t\t\"/.well-known/oauth-protected-resource\",\n\t\t\"/.well-known/oauth-protected-resource/mcp\",\n\t\t\"/.well-known/oauth-authorization-server\",\n\t\t\"/oauth/register\",\n\t\tOAUTH_TOKEN_PATH\n\t],\n\tselfGatingPrefixes: [\"/api/files/\", \"/api/v1/solve-events\"],\n\tstaticPrefixes: [\"/_app/\", \"/favicon/\"],\n\tstaticPaths: [\"/favicon.svg\", \"/robots.txt\"]\n});\nvar handle = async ({ event, resolve }) => {\n\tevent.locals.providers = providers;\n\tconst requestId = resolveRequestId(event.request.headers);\n\tevent.locals.requestId = requestId;\n\tevent.locals.log = getLogger().child({\n\t\trequestId,\n\t\tmethod: event.request.method,\n\t\troute: event.url.pathname\n\t});\n\tif (!headerAuthBootstrapWired) {\n\t\twireHeaderAuthBootstrap();\n\t\theaderAuthBootstrapWired = true;\n\t}\n\tif (!bootHealthKicked) {\n\t\tbootHealthKicked = true;\n\t\tgetBootHealth();\n\t\tconst deploymentDir = findDeploymentDir(private_env);\n\t\tif (deploymentDir) startUpdateOutcomeReconciler({\n\t\t\tdeploymentDir,\n\t\t\temit: (e) => getEventSink().emit(e),\n\t\t\treport: (err) => getErrorReporter().capture(err, { tags: { origin: \"selfUpdate\" } })\n\t\t});\n\t}\n\tconst { pathname } = event.url;\n\tif (isCrossSiteFormSubmission(event.request, { exemptPaths: [OAUTH_TOKEN_PATH] })) return applyResponseHeaders(new Response(`Cross-site ${event.request.method} form submissions are forbidden`, { status: 403 }), pathname, requestId);\n\tif (isStaticAsset(pathname)) return applyResponseHeaders(await resolve(event), pathname, requestId);\n\tif (pathname === \"/api/health\" || pathname === \"/api/health/ready\") return applyResponseHeaders(await resolve(event), pathname, requestId);\n\tconst tokenResult = pathname === \"/mcp\" ? { kind: \"none\" } : await resolveApiToken(event.request, {\n\t\tcodec: apiTokenCodec(),\n\t\tauth: providers.auth,\n\t\tdata: providers.data,\n\t\tflag,\n\t\tlog: event.locals.log\n\t});\n\tif (tokenResult.kind === \"rejected\") {\n\t\tconst { status, code, message } = tokenResult;\n\t\tconst headers = { \"Content-Type\": \"application/json\" };\n\t\tif (status === 401) headers[\"WWW-Authenticate\"] = \"Bearer error=\\\"invalid_token\\\"\";\n\t\treturn applyResponseHeaders(new Response(JSON.stringify({\n\t\t\tmessage,\n\t\t\tcode\n\t\t}), {\n\t\t\tstatus,\n\t\t\theaders\n\t\t}), pathname, requestId);\n\t}\n\tif (tokenResult.kind === \"ok\") {\n\t\tconst { user, ctx, token } = tokenResult;\n\t\tevent.locals.log = event.locals.log.child({ tokenId: token.id });\n\t\tevent.locals.user = user;\n\t\tevent.locals.ctx = ctx;\n\t\tevent.locals.profile = await providers.data.userProfile.getProfile(SYSTEM_CONTEXT, user.id) ?? emptyProfile(user.id);\n\t\treturn applyResponseHeaders(await resolve(event), pathname, requestId);\n\t}\n\tconst publicRoute = isPublicRoute(pathname);\n\tconst isJsonApiRoute = pathname.startsWith(\"/api/\");\n\tif (!publicRoute) {\n\t\tif (await isFirstRun()) {\n\t\t\tif (isJsonApiRoute) return applyResponseHeaders(new Response(JSON.stringify({\n\t\t\t\tmessage: \"Setup required\",\n\t\t\t\tcode: \"SETUP_REQUIRED\"\n\t\t\t}), {\n\t\t\t\tstatus: 503,\n\t\t\t\theaders: { \"Content-Type\": \"application/json\" }\n\t\t\t}), pathname, requestId);\n\t\t\tredirect(303, \"/setup\");\n\t\t}\n\t}\n\tif (!publicRoute) {\n\t\tlet token = event.cookies.get(\"admin_session\") ?? \"\";\n\t\tlet user = await providers.auth.verifyToken(token);\n\t\tif (!user) {\n\t\t\tconst refreshToken = getRefreshToken(event.cookies);\n\t\t\tconst oauth = providers.auth.oauth;\n\t\t\tif (refreshToken && oauth) {\n\t\t\t\tconst refreshed = await oauth.refreshSession(refreshToken);\n\t\t\t\tif (refreshed) {\n\t\t\t\t\tsetSessionCookie(event.cookies, refreshed.sessionToken);\n\t\t\t\t\tsetRefreshCookie(event.cookies, refreshed.refreshToken);\n\t\t\t\t\ttoken = refreshed.sessionToken;\n\t\t\t\t\tuser = await providers.auth.verifyToken(token);\n\t\t\t\t} else clearRefreshCookie(event.cookies);\n\t\t\t}\n\t\t}\n\t\tif (!user && providers.auth.proxyAuth) {\n\t\t\tuser = await providers.auth.proxyAuth.identifyFromHeaders(event.request.headers);\n\t\t\tif (user) await bootstrapUserSession(user);\n\t\t}\n\t\tif (!user) {\n\t\t\tif (isJsonApiRoute) return applyResponseHeaders(new Response(JSON.stringify({\n\t\t\t\tmessage: \"Your session has expired. Sign in again to continue.\",\n\t\t\t\tcode: \"UNAUTHORIZED\"\n\t\t\t}), {\n\t\t\t\tstatus: 401,\n\t\t\t\theaders: { \"Content-Type\": \"application/json\" }\n\t\t\t}), pathname, requestId);\n\t\t\tredirect(303, `/login?redirectTo=${encodeURIComponent(pathname + event.url.search)}`);\n\t\t}\n\t\tawait attachSession(event, user, token);\n\t} else {\n\t\tconst wantsSessionAttach = PUBLIC_PAGE_ROUTES.has(pathname) || isSelfGatingApiRoute(pathname);\n\t\tconst token = wantsSessionAttach ? event.cookies.get(\"admin_session\") ?? \"\" : \"\";\n\t\tlet user = token ? await providers.auth.verifyToken(token) : null;\n\t\tif (!user && wantsSessionAttach && providers.auth.proxyAuth) {\n\t\t\tuser = await providers.auth.proxyAuth.identifyFromHeaders(event.request.headers);\n\t\t\tif (!user && pathname === \"/login\" && !proxyAuthLoginMissWarned) {\n\t\t\t\tproxyAuthLoginMissWarned = true;\n\t\t\t\tconst proxyAuth = providers.auth.proxyAuth;\n\t\t\t\tconst noHeaders = proxyAuth.hasNoIdentityHeaders(event.request.headers);\n\t\t\t\tconst configured = proxyAuth.configuredHeaderNames.join(\", \");\n\t\t\t\tif (noHeaders) event.locals.log.warn(\"/login was hit and NONE of the configured identity headers arrived. The forward-auth proxy is not reaching this process, or is not forwarding the configured headers. See the @selvajs/header-auth-provider README \\\"Verification\\\" section.\", {\n\t\t\t\t\tcomponent: \"HeaderAuth\",\n\t\t\t\t\tconfiguredHeaders: configured\n\t\t\t\t});\n\t\t\t\telse event.locals.log.warn(\"/login was hit but the UPN header was missing or the user is not allowlisted. Some headers arrived but identification still failed — check that the UPN header is populated and that the user has been added to header-allowlist.json.\", {\n\t\t\t\t\tcomponent: \"HeaderAuth\",\n\t\t\t\t\tconfiguredHeaders: configured\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\t\tif (user) await attachSession(event, user, token);\n\t}\n\treturn applyResponseHeaders(await resolve(event), pathname, requestId);\n};\nvar FRAME_DENIED_PREFIXES = [\n\t\"/admin\",\n\t\"/setup\",\n\t\"/login\",\n\t\"/oauth\"\n];\nfunction deniesFraming(pathname) {\n\treturn FRAME_DENIED_PREFIXES.some((p) => pathname === p || pathname.startsWith(`${p}/`));\n}\nfunction applyResponseHeaders(response, pathname, requestId) {\n\tapplySecurityHeaders(response, {\n\t\thsts: process.env.NODE_ENV === \"production\",\n\t\tdenyFraming: deniesFraming(pathname)\n\t});\n\tresponse.headers.set(REQUEST_ID_HEADER, requestId);\n\tif (pathname.startsWith(\"/_app/\")) response.headers.set(\"Cache-Control\", \"public, max-age=31536000, immutable\");\n\telse if (pathname.startsWith(\"/favicon/\") || pathname === \"/favicon.svg\" || pathname === \"/robots.txt\") response.headers.set(\"Cache-Control\", \"public, max-age=604800\");\n\treturn response;\n}\nvar handleError = ({ error, status, event }) => {\n\tif (isHttpError(error)) {\n\t\tconst body = error.body;\n\t\treturn {\n\t\t\tmessage: body.message,\n\t\t\tcode: body.code,\n\t\t\tfields: body.fields,\n\t\t\tdetails: body.details\n\t\t};\n\t}\n\tif (isApiError(error)) return {\n\t\tmessage: error.message,\n\t\tcode: error.code,\n\t\tfields: error.fields,\n\t\tdetails: error.details\n\t};\n\tif (status === 404) return {\n\t\tmessage: \"Page not found.\",\n\t\tcode: \"NOT_FOUND\"\n\t};\n\t(event.locals.log ?? getLogger().child({\n\t\tmethod: event.request.method,\n\t\troute: event.url.pathname\n\t})).error(\"Unhandled error\", {\n\t\tcomponent: \"handleError\",\n\t\tstatus,\n\t\terr: renderThrown(error),\n\t\tcause: error instanceof Error && error.cause ? String(error.cause) : void 0\n\t});\n\tgetErrorReporter().capture(error, {\n\t\tmethod: event.request.method,\n\t\troute: event.url.pathname,\n\t\tuserId: event.locals.ctx?.userId || void 0,\n\t\torgId: event.locals.ctx?.actingOrgId\n\t});\n\treturn {\n\t\tmessage: \"An unexpected error occurred.\",\n\t\tcode: \"INTERNAL\"\n\t};\n};\n//#endregion\nexport { handle, handleError, isPublicRoute, isSelfGatingApiRoute, isStaticAsset };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAcA;AACA,SAAS,YAAY,CAAC,MAAM,EAAE;AAC9B,CAAC,OAAO;AACR,EAAE,MAAM;AACR,EAAE,kBAAkB,EAAE,EAAE;AACxB,EAAE,UAAU,EAAE;AACd,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,oBAAoB,CAAC,QAAQ,EAAE,IAAI,EAAE;AAC9C,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC;AAC1D,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,iCAAiC,CAAC;AAC3E,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,+GAA+G,CAAC;AAC5J,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,qCAAqC,CAAC;AACxG,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE;AACvB,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC;AACjD,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,wBAAwB,CAAC;AAC3E,CAAC;AACD,CAAC,OAAO,QAAQ;AAChB;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,MAAM,EAAE;AACvC,CAAC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;AACtD,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,EAAE;AACnD,CAAC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;AACpD,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAG,MAAM,CAAC,kBAAkB,IAAI,EAAE,EAAE,GAAG,MAAM,CAAC,gBAAgB,KAAK,MAAM,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,EAAE,CAAC;AACxI,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,EAAE;AACnD,CAAC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;AACtD,CAAC,SAAS,aAAa,CAAC,QAAQ,EAAE;AAClC,EAAE,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI;AAC5C,EAAE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AACD,CAAC,SAAS,oBAAoB,CAAC,QAAQ,EAAE;AACzC,EAAE,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AACD,CAAC,SAAS,aAAa,CAAC,QAAQ,EAAE;AAClC,EAAE,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI;AAC5C,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI;AAC3C,EAAE,IAAI,oBAAoB,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI;AACjD,EAAE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AACD,CAAC,OAAO;AACR,EAAE,aAAa;AACf,EAAE,oBAAoB;AACtB,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA,IAAI,gBAAgB,GAAG,cAAc;AACrC,IAAI,wBAAwB,GAAG,KAAK;AACpC,IAAI,gBAAgB,GAAG,KAAK;AAC5B,IAAI,wBAAwB,GAAG,KAAK;AACpC,IAAI,gBAAgB,GAAG,KAAK;AAC5B,eAAe,UAAU,GAAG;AAC5B,CAAC,IAAI,gBAAgB,EAAE,OAAO,KAAK;AACnC,CAAC,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAC/D,CAAC,IAAI,SAAS,KAAK,IAAI,EAAE;AACzB,EAAE,gBAAgB,GAAG,IAAI;AACzB,EAAE,OAAO,KAAK;AACd,CAAC;AACD,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,IAAI;AAC9C,CAAC,gBAAgB,GAAG,IAAI;AACxB,CAAC,OAAO,KAAK;AACb;AACA,IAAI,cAAc,mBAAmB,IAAI,GAAG,EAAE;AAC9C,eAAe,cAAc,CAAC,MAAM,EAAE;AACtC,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;AACjC,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC;AACxD,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;AAC3B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE;AACxD,CAAC,MAAM,GAAG,OAAO,EAAE,mBAAmB,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AACxE,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;AACzB,EAAE,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAChE,EAAE,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAC5D,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE;AAChE,EAAE,CAAC;AACH,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI;AACzB,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;AACxD,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,GAAG,MAAM,mBAAmB,CAAC;AAC9C,EAAE,IAAI;AACN,EAAE,YAAY;AACd,EAAE,mBAAmB;AACrB,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,IAAI;AACpC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;AAClC;AACA,IAAI,kBAAkB,mBAAmB,IAAI,GAAG,CAAC;AACjD,CAAC,GAAG;AACJ,CAAC,QAAQ;AACT,CAAC,QAAQ;AACT,CAAC;AACD,CAAC,CAAC;AACC,IAAC,EAAE,aAAa,EAAE,oBAAoB,EAAE,aAAa,EAAE,GAAG,qBAAqB,CAAC;AACnF,CAAC,WAAW,EAAE,kBAAkB;AAChC,CAAC,cAAc,EAAE;AACjB,EAAE,QAAQ;AACV,EAAE,SAAS;AACX,EAAE;AACF,EAAE;AACF,CAAC,UAAU,EAAE;AACb,EAAE,aAAa;AACf,EAAE,mBAAmB;AACrB,EAAE,sBAAsB;AACxB,EAAE,QAAQ;AACV,EAAE,uCAAuC;AACzC,EAAE,2CAA2C;AAC7C,EAAE,yCAAyC;AAC3C,EAAE,iBAAiB;AACnB,EAAE;AACF,EAAE;AACF,CAAC,kBAAkB,EAAE,CAAC,aAAa,EAAE,sBAAsB,CAAC;AAC5D,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC;AACxC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,aAAa;AAC5C,CAAC;AACE,IAAC,MAAM,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;AAC3C,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,SAAS;AACnC,CAAC,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;AAC1D,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,SAAS;AACnC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,GAAG,SAAS,EAAE,CAAC,KAAK,CAAC;AACtC,EAAE,SAAS;AACX,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;AAC9B,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;AACnB,EAAE,CAAC;AACH,CAAC,IAAI,CAAC,wBAAwB,EAAE;AAChC,EAAE,uBAAuB,EAAE;AAC3B,EAAE,wBAAwB,GAAG,IAAI;AACjC,CAAC;AACD,CAAC,IAAI,CAAC,gBAAgB,EAAE;AACxB,EAAE,gBAAgB,GAAG,IAAI;AACzB,EAAE,aAAa,EAAE;AACjB,EAAE,MAAM,aAAa,GAAG,iBAAiB,CAAC,WAAW,CAAC;AACtD,EAAE,IAAI,aAAa,EAAE,4BAA4B,CAAC;AAClD,GAAG,aAAa;AAChB,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;AACtC,GAAG,MAAM,EAAE,CAAC,GAAG,KAAK,gBAAgB,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;AACtF,GAAG,CAAC;AACJ,CAAC;AACD,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,GAAG;AAC/B,CAAC,IAAI,yBAAyB,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC,EAAE,OAAO,oBAAoB,CAAC,IAAI,QAAQ,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,+BAA+B,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC;AACxO,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,OAAO,oBAAoB,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC;AACpG,CAAC,IAAI,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK,mBAAmB,EAAE,OAAO,oBAAoB,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC;AAC3I,CAAC,MAAM,WAAW,GAAG,QAAQ,KAAK,MAAM,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE;AACnG,EAAE,KAAK,EAAE,aAAa,EAAE;AACxB,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI;AACtB,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI;AACtB,EAAE,IAAI;AACN,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC;AACpB,EAAE,CAAC;AACH,CAAC,IAAI,WAAW,CAAC,IAAI,KAAK,UAAU,EAAE;AACtC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,WAAW;AAC/C,EAAE,MAAM,OAAO,GAAG,EAAE,cAAc,EAAE,kBAAkB,EAAE;AACxD,EAAE,IAAI,MAAM,KAAK,GAAG,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,gCAAgC;AACpF,EAAE,OAAO,oBAAoB,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;AAC1D,GAAG,OAAO;AACV,GAAG;AACH,GAAG,CAAC,EAAE;AACN,GAAG,MAAM;AACT,GAAG;AACH,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC;AAC1B,CAAC;AACD,CAAC,IAAI,WAAW,CAAC,IAAI,KAAK,IAAI,EAAE;AAChC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,WAAW;AAC1C,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;AAClE,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI;AAC1B,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,GAAG,GAAG;AACxB,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;AACtH,EAAE,OAAO,oBAAoB,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC;AACxE,CAAC;AACD,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC,QAAQ,CAAC;AAC5C,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;AACpD,CAAC,IAAI,CAAC,WAAW,EAAE;AACnB,EAAE,IAAI,MAAM,UAAU,EAAE,EAAE;AAC1B,GAAG,IAAI,cAAc,EAAE,OAAO,oBAAoB,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;AAC/E,IAAI,OAAO,EAAE,gBAAgB;AAC7B,IAAI,IAAI,EAAE;AACV,IAAI,CAAC,EAAE;AACP,IAAI,MAAM,EAAE,GAAG;AACf,IAAI,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AACjD,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC;AAC3B,GAAG,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;AAC1B,EAAE;AACF,CAAC;AACD,CAAC,IAAI,CAAC,WAAW,EAAE;AACnB,EAAE,IAAI,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE;AACtD,EAAE,IAAI,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;AACpD,EAAE,IAAI,CAAC,IAAI,EAAE;AACb,GAAG,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC;AACtD,GAAG,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK;AACrC,GAAG,IAAI,YAAY,IAAI,KAAK,EAAE;AAC9B,IAAI,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,YAAY,CAAC;AAC9D,IAAI,IAAI,SAAS,EAAE;AACnB,KAAK,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,CAAC;AAC5D,KAAK,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,CAAC;AAC5D,KAAK,KAAK,GAAG,SAAS,CAAC,YAAY;AACnC,KAAK,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;AACnD,IAAI,CAAC,MAAM,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC;AAC5C,GAAG;AACH,EAAE;AACF,EAAE,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE;AACzC,GAAG,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;AACnF,GAAG,IAAI,IAAI,EAAE,MAAM,oBAAoB,CAAC,IAAI,CAAC;AAC7C,EAAE;AACF,EAAE,IAAI,CAAC,IAAI,EAAE;AACb,GAAG,IAAI,cAAc,EAAE,OAAO,oBAAoB,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;AAC/E,IAAI,OAAO,EAAE,sDAAsD;AACnE,IAAI,IAAI,EAAE;AACV,IAAI,CAAC,EAAE;AACP,IAAI,MAAM,EAAE,GAAG;AACf,IAAI,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AACjD,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC;AAC3B,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACxF,EAAE;AACF,EAAE,MAAM,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC;AACzC,CAAC,CAAC,MAAM;AACR,EAAE,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,oBAAoB,CAAC,QAAQ,CAAC;AAC/F,EAAE,MAAM,KAAK,GAAG,kBAAkB,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,EAAE;AAClF,EAAE,IAAI,IAAI,GAAG,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,IAAI;AACnE,EAAE,IAAI,CAAC,IAAI,IAAI,kBAAkB,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE;AAC/D,GAAG,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;AACnF,GAAG,IAAI,CAAC,IAAI,IAAI,QAAQ,KAAK,QAAQ,IAAI,CAAC,wBAAwB,EAAE;AACpE,IAAI,wBAAwB,GAAG,IAAI;AACnC,IAAI,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS;AAC9C,IAAI,MAAM,SAAS,GAAG,SAAS,CAAC,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;AAC3E,IAAI,MAAM,UAAU,GAAG,SAAS,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;AACjE,IAAI,IAAI,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,8OAA8O,EAAE;AACzR,KAAK,SAAS,EAAE,YAAY;AAC5B,KAAK,iBAAiB,EAAE;AACxB,KAAK,CAAC;AACN,SAAS,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,wOAAwO,EAAE;AACzQ,KAAK,SAAS,EAAE,YAAY;AAC5B,KAAK,iBAAiB,EAAE;AACxB,KAAK,CAAC;AACN,GAAG;AACH,EAAE;AACF,EAAE,IAAI,IAAI,EAAE,MAAM,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC;AACnD,CAAC;AACD,CAAC,OAAO,oBAAoB,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC;AACvE;AACA,IAAI,qBAAqB,GAAG;AAC5B,CAAC,QAAQ;AACT,CAAC,QAAQ;AACT,CAAC,QAAQ;AACT,CAAC;AACD,CAAC;AACD,SAAS,aAAa,CAAC,QAAQ,EAAE;AACjC,CAAC,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,KAAK,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACzF;AACA,SAAS,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE;AAC7D,CAAC,oBAAoB,CAAC,QAAQ,EAAE;AAChC,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;AAC7C,EAAE,WAAW,EAAE,aAAa,CAAC,QAAQ;AACrC,EAAE,CAAC;AACH,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,SAAS,CAAC;AACnD,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,qCAAqC,CAAC;AAChH,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,QAAQ,KAAK,cAAc,IAAI,QAAQ,KAAK,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,wBAAwB,CAAC;AACxK,CAAC,OAAO,QAAQ;AAChB;AACG,IAAC,WAAW,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK;AAChD,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE;AACzB,EAAE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI;AACzB,EAAE,OAAO;AACT,GAAG,OAAO,EAAE,IAAI,CAAC,OAAO;AACxB,GAAG,IAAI,EAAE,IAAI,CAAC,IAAI;AAClB,GAAG,MAAM,EAAE,IAAI,CAAC,MAAM;AACtB,GAAG,OAAO,EAAE,IAAI,CAAC;AACjB,GAAG;AACH,CAAC;AACD,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,OAAO;AAC/B,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO;AACxB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI;AAClB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM;AACtB,EAAE,OAAO,EAAE,KAAK,CAAC;AACjB,EAAE;AACF,CAAC,IAAI,MAAM,KAAK,GAAG,EAAE,OAAO;AAC5B,EAAE,OAAO,EAAE,iBAAiB;AAC5B,EAAE,IAAI,EAAE;AACR,EAAE;AACF,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,SAAS,EAAE,CAAC,KAAK,CAAC;AACxC,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;AAC9B,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;AACnB,EAAE,CAAC,EAAE,KAAK,CAAC,iBAAiB,EAAE;AAC9B,EAAE,SAAS,EAAE,aAAa;AAC1B,EAAE,MAAM;AACR,EAAE,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC;AAC1B,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG;AACvE,EAAE,CAAC;AACH,CAAC,gBAAgB,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE;AACnC,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;AAC9B,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ;AAC3B,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,IAAI,MAAM;AAC5C,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE;AAC3B,EAAE,CAAC;AACH,CAAC,OAAO;AACR,EAAE,OAAO,EAAE,+BAA+B;AAC1C,EAAE,IAAI,EAAE;AACR,EAAE;AACF;;;;"}