@selvajs/selva 4.6.21-beta.1 → 4.7.0-beta.3

package/build/server/chunks/entries/endpoints/api/projects/_server.ts.js-CEtV1j4c.js

@@ -1,97 +0,0 @@
-import { json } from '@sveltejs/kit';
-import { z } from 'zod';
-import { randomUUID } from 'node:crypto';
-import { e as getProjectProvider, P as ProviderError } from '../../../../chunks/providers.server.js-BKhwGvoh.js';
-import { p as requireCanCreateProject } from '../../../../chunks/access.server.js-DmuVt13u.js';
-import { a as apiError, h as handleApiError, t as throwZodError, A as ApiErrorCode } from '../../../../chunks/api-errors.js-CwTBBHWD.js';
-import { s as slugify } from '../../../../chunks/slug.js-BGuFQjqe.js';
-import { l as ProjectVisibilitySchema } from '../../../../chunks/context.js-D8E0GFTw.js';
-import '../../../../chunks/shared-server.js-DaWdgxVh.js';
-import 'node:url';
-import 'node:path';
-import 'node:fs';
-import 'node:fs/promises';
-import '@supabase/supabase-js';
-import '@selvajs/compute/core';
-import '../../../../chunks/schema.js-j3D3emog.js';
-import '../../../../chunks/utils4.js-C-poIiFQ.js';
-
-const MAX_SLUG_ATTEMPTS = 25;
-function isSlugConflict(err) {
-  return err instanceof ProviderError && err.statusCode === 409 && /projects_org_id_slug_key/.test(err.message);
-}
-function isNameConflict(err) {
-  return err instanceof ProviderError && err.statusCode === 409 && /projects_org_name_unique/.test(err.message);
-}
-const CreateProjectBody = z.object({
-  name: z.string().min(1, "Project name is required").max(128).trim(),
-  description: z.string().max(2e3).optional(),
-  visibility: ProjectVisibilitySchema.default("private"),
-  autoJoinOnUpload: z.boolean().optional()
-});
-const GET = async ({ locals }) => {
-  const ctx = locals.ctx;
-  if (!ctx.actingOrgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, "No active organization");
-  try {
-    const page = await getProjectProvider().listProjects(ctx, ctx.actingOrgId, { limit: 200 });
-    return json({ projects: page.items });
-  } catch (err) {
-    handleApiError(err, "Failed to load projects");
-  }
-};
-const POST = async ({ request, locals }) => {
-  const ctx = locals.ctx;
-  if (!ctx.actingOrgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, "No active organization");
-  await requireCanCreateProject(locals, ctx.actingOrgId);
-  const body = await request.json().catch(() => null);
-  const parsed = CreateProjectBody.safeParse(body);
-  if (!parsed.success) throwZodError(parsed.error);
-  const autoJoinOnUpload = parsed.data.autoJoinOnUpload ?? false;
-  if (autoJoinOnUpload && parsed.data.visibility !== "public") {
-    apiError(400, ApiErrorCode.VALIDATION_FAILED, "autoJoinOnUpload requires visibility=public");
-  }
-  const projectStore = getProjectProvider();
-  const baseSlug = slugify(parsed.data.name) || "project";
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  const projectId = randomUUID();
-  for (let attempt = 0; attempt < MAX_SLUG_ATTEMPTS; attempt++) {
-    const slug = attempt === 0 ? baseSlug : `${baseSlug}-${attempt + 1}`;
-    const project = {
-      id: projectId,
-      orgId: ctx.actingOrgId,
-      name: parsed.data.name,
-      slug,
-      description: parsed.data.description,
-      visibility: parsed.data.visibility,
-      ownerId: locals.user.id,
-      createdBy: locals.user.id,
-      updatedBy: locals.user.id,
-      autoJoinOnUpload,
-      createdAt: now,
-      updatedAt: now,
-      deletedAt: null
-    };
-    try {
-      await projectStore.createProject(ctx, project);
-      return json(project, { status: 201 });
-    } catch (err) {
-      if (isNameConflict(err)) {
-        apiError(
-          409,
-          ApiErrorCode.CONFLICT,
-          "A project with that name already exists in this organization."
-        );
-      }
-      if (isSlugConflict(err)) continue;
-      handleApiError(err, "Failed to create project");
-    }
-  }
-  apiError(
-    409,
-    ApiErrorCode.CONFLICT,
-    "Could not pick a unique project slug after several attempts."
-  );
-};
-
-export { GET, POST };
-//# sourceMappingURL=_server.ts.js-CEtV1j4c.js.map

package/build/server/chunks/entries/endpoints/api/projects/_server.ts.js-CEtV1j4c.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"_server.ts.js-CEtV1j4c.js","sources":["../../../../../../../.svelte-kit/output/server/entries/endpoints/api/projects/_server.ts.js"],"sourcesContent":["import { json } from \"@sveltejs/kit\";\nimport { z } from \"zod\";\nimport { randomUUID } from \"node:crypto\";\nimport { m as getProjectProvider, P as ProviderError } from \"../../../../chunks/providers.server.js\";\nimport { p as requireCanCreateProject } from \"../../../../chunks/access.server.js\";\nimport { a as apiError, h as handleApiError, t as throwZodError, A as ApiErrorCode } from \"../../../../chunks/api-errors.js\";\nimport { s as slugify } from \"../../../../chunks/slug.js\";\nimport { m as ProjectVisibilitySchema } from \"../../../../chunks/context.js\";\nconst MAX_SLUG_ATTEMPTS = 25;\nfunction isSlugConflict(err) {\n  return err instanceof ProviderError && err.statusCode === 409 && /projects_org_id_slug_key/.test(err.message);\n}\nfunction isNameConflict(err) {\n  return err instanceof ProviderError && err.statusCode === 409 && /projects_org_name_unique/.test(err.message);\n}\nconst CreateProjectBody = z.object({\n  name: z.string().min(1, \"Project name is required\").max(128).trim(),\n  description: z.string().max(2e3).optional(),\n  visibility: ProjectVisibilitySchema.default(\"private\"),\n  autoJoinOnUpload: z.boolean().optional()\n});\nconst GET = async ({ locals }) => {\n  const ctx = locals.ctx;\n  if (!ctx.actingOrgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"No active organization\");\n  try {\n    const page = await getProjectProvider().listProjects(ctx, ctx.actingOrgId, { limit: 200 });\n    return json({ projects: page.items });\n  } catch (err) {\n    handleApiError(err, \"Failed to load projects\");\n  }\n};\nconst POST = async ({ request, locals }) => {\n  const ctx = locals.ctx;\n  if (!ctx.actingOrgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"No active organization\");\n  await requireCanCreateProject(locals, ctx.actingOrgId);\n  const body = await request.json().catch(() => null);\n  const parsed = CreateProjectBody.safeParse(body);\n  if (!parsed.success) throwZodError(parsed.error);\n  const autoJoinOnUpload = parsed.data.autoJoinOnUpload ?? false;\n  if (autoJoinOnUpload && parsed.data.visibility !== \"public\") {\n    apiError(400, ApiErrorCode.VALIDATION_FAILED, \"autoJoinOnUpload requires visibility=public\");\n  }\n  const projectStore = getProjectProvider();\n  const baseSlug = slugify(parsed.data.name) || \"project\";\n  const now = (/* @__PURE__ */ new Date()).toISOString();\n  const projectId = randomUUID();\n  for (let attempt = 0; attempt < MAX_SLUG_ATTEMPTS; attempt++) {\n    const slug = attempt === 0 ? baseSlug : `${baseSlug}-${attempt + 1}`;\n    const project = {\n      id: projectId,\n      orgId: ctx.actingOrgId,\n      name: parsed.data.name,\n      slug,\n      description: parsed.data.description,\n      visibility: parsed.data.visibility,\n      ownerId: locals.user.id,\n      createdBy: locals.user.id,\n      updatedBy: locals.user.id,\n      autoJoinOnUpload,\n      createdAt: now,\n      updatedAt: now,\n      deletedAt: null\n    };\n    try {\n      await projectStore.createProject(ctx, project);\n      return json(project, { status: 201 });\n    } catch (err) {\n      if (isNameConflict(err)) {\n        apiError(\n          409,\n          ApiErrorCode.CONFLICT,\n          \"A project with that name already exists in this organization.\"\n        );\n      }\n      if (isSlugConflict(err)) continue;\n      handleApiError(err, \"Failed to create project\");\n    }\n  }\n  apiError(\n    409,\n    ApiErrorCode.CONFLICT,\n    \"Could not pick a unique project slug after several attempts.\"\n  );\n};\nexport {\n  GET,\n  POST\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAQA,MAAM,iBAAiB,GAAG,EAAE;AAC5B,SAAS,cAAc,CAAC,GAAG,EAAE;AAC7B,EAAE,OAAO,GAAG,YAAY,aAAa,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;AAC/G;AACA,SAAS,cAAc,CAAC,GAAG,EAAE;AAC7B,EAAE,OAAO,GAAG,YAAY,aAAa,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;AAC/G;AACA,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;AACnC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;AACrE,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AAC7C,EAAE,UAAU,EAAE,uBAAuB,CAAC,OAAO,CAAC,SAAS,CAAC;AACxD,EAAE,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ;AACxC,CAAC,CAAC;AACG,MAAC,GAAG,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK;AAClC,EAAE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACxB,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;AAC/F,EAAE,IAAI;AACN,IAAI,MAAM,IAAI,GAAG,MAAM,kBAAkB,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AAC9F,IAAI,OAAO,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;AACzC,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,cAAc,CAAC,GAAG,EAAE,yBAAyB,CAAC;AAClD,EAAE;AACF;AACK,MAAC,IAAI,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AAC5C,EAAE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACxB,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;AAC/F,EAAE,MAAM,uBAAuB,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC;AACxD,EAAE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;AACrD,EAAE,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC;AAClD,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AAClD,EAAE,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,KAAK;AAChE,EAAE,IAAI,gBAAgB,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE;AAC/D,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,6CAA6C,CAAC;AAChG,EAAE;AACF,EAAE,MAAM,YAAY,GAAG,kBAAkB,EAAE;AAC3C,EAAE,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS;AACzD,EAAE,MAAM,GAAG,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACxD,EAAE,MAAM,SAAS,GAAG,UAAU,EAAE;AAChC,EAAE,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,iBAAiB,EAAE,OAAO,EAAE,EAAE;AAChE,IAAI,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;AACxE,IAAI,MAAM,OAAO,GAAG;AACpB,MAAM,EAAE,EAAE,SAAS;AACnB,MAAM,KAAK,EAAE,GAAG,CAAC,WAAW;AAC5B,MAAM,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;AAC5B,MAAM,IAAI;AACV,MAAM,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;AAC1C,MAAM,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU;AACxC,MAAM,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;AAC7B,MAAM,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;AAC/B,MAAM,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;AAC/B,MAAM,gBAAgB;AACtB,MAAM,SAAS,EAAE,GAAG;AACpB,MAAM,SAAS,EAAE,GAAG;AACpB,MAAM,SAAS,EAAE;AACjB,KAAK;AACL,IAAI,IAAI;AACR,MAAM,MAAM,YAAY,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC;AACpD,MAAM,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC3C,IAAI,CAAC,CAAC,OAAO,GAAG,EAAE;AAClB,MAAM,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE;AAC/B,QAAQ,QAAQ;AAChB,UAAU,GAAG;AACb,UAAU,YAAY,CAAC,QAAQ;AAC/B,UAAU;AACV,SAAS;AACT,MAAM;AACN,MAAM,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE;AAC/B,MAAM,cAAc,CAAC,GAAG,EAAE,0BAA0B,CAAC;AACrD,IAAI;AACJ,EAAE;AACF,EAAE,QAAQ;AACV,IAAI,GAAG;AACP,IAAI,YAAY,CAAC,QAAQ;AACzB,IAAI;AACJ,GAAG;AACH;;;;"}

package/build/server/chunks/entries/endpoints/auth/email/callback/_server.ts.js-DCZuEtwq.js

@@ -1,37 +0,0 @@
-import { redirect } from '@sveltejs/kit';
-import { a as apiError, A as ApiErrorCode } from '../../../../../chunks/api-errors.js-CwTBBHWD.js';
-import { g as getAuthProvider } from '../../../../../chunks/providers.server.js-BKhwGvoh.js';
-import { b as bootstrapUserSession } from '../../../../../chunks/auth-bootstrap.server.js-COYZnscW.js';
-import { s as setSessionCookie, a as setRefreshCookie } from '../../../../../chunks/admin-auth.server.js-BAXmH56n.js';
-import { s as safeRedirectTarget } from '../../../../../chunks/redirect.js-1CZ30qn2.js';
-import '../../../../../chunks/context.js-D8E0GFTw.js';
-import 'zod';
-import '@selvajs/compute/core';
-import '../../../../../chunks/schema.js-j3D3emog.js';
-import '../../../../../chunks/utils4.js-C-poIiFQ.js';
-import '../../../../../chunks/shared-server.js-DaWdgxVh.js';
-import 'node:url';
-import 'node:path';
-import 'node:fs';
-import 'node:crypto';
-import 'node:fs/promises';
-import '@supabase/supabase-js';
-import '../../../../../chunks/slug.js-BGuFQjqe.js';
-
-const GET = async ({ url, cookies }) => {
-  const emailLink = getAuthProvider().emailLink;
-  if (!emailLink) {
-    apiError(501, ApiErrorCode.INTERNAL, "Email sign-in is not supported by this provider.");
-  }
-  const result = await emailLink.verifyMagicLink(url.toString());
-  if (!result)
-    apiError(401, ApiErrorCode.UNAUTHORIZED, "This sign-in link is invalid or has expired.");
-  await bootstrapUserSession(result.user);
-  setSessionCookie(cookies, result.sessionToken);
-  if (result.refreshToken) setRefreshCookie(cookies, result.refreshToken);
-  const dest = safeRedirectTarget(url.searchParams.get("redirectTo"), "/library");
-  redirect(303, dest);
-};
-
-export { GET };
-//# sourceMappingURL=_server.ts.js-DCZuEtwq.js.map

package/build/server/chunks/entries/endpoints/auth/email/callback/_server.ts.js-DCZuEtwq.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"_server.ts.js-DCZuEtwq.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/auth/email/callback/_server.ts.js"],"sourcesContent":["import { redirect } from \"@sveltejs/kit\";\nimport { a as apiError, A as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\nimport { b as getAuthProvider } from \"../../../../../chunks/providers.server.js\";\nimport { b as bootstrapUserSession } from \"../../../../../chunks/auth-bootstrap.server.js\";\nimport { s as setSessionCookie, a as setRefreshCookie } from \"../../../../../chunks/admin-auth.server.js\";\nimport { s as safeRedirectTarget } from \"../../../../../chunks/redirect.js\";\nconst GET = async ({ url, cookies }) => {\n  const emailLink = getAuthProvider().emailLink;\n  if (!emailLink) {\n    apiError(501, ApiErrorCode.INTERNAL, \"Email sign-in is not supported by this provider.\");\n  }\n  const result = await emailLink.verifyMagicLink(url.toString());\n  if (!result)\n    apiError(401, ApiErrorCode.UNAUTHORIZED, \"This sign-in link is invalid or has expired.\");\n  await bootstrapUserSession(result.user);\n  setSessionCookie(cookies, result.sessionToken);\n  if (result.refreshToken) setRefreshCookie(cookies, result.refreshToken);\n  const dest = safeRedirectTarget(url.searchParams.get(\"redirectTo\"), \"/library\");\n  redirect(303, dest);\n};\nexport {\n  GET\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAMK,MAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK;AACxC,EAAE,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC,SAAS;AAC/C,EAAE,IAAI,CAAC,SAAS,EAAE;AAClB,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,kDAAkD,CAAC;AAC5F,EAAE;AACF,EAAE,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;AAChE,EAAE,IAAI,CAAC,MAAM;AACb,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,8CAA8C,CAAC;AAC5F,EAAE,MAAM,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC;AACzC,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AAChD,EAAE,IAAI,MAAM,CAAC,YAAY,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AACzE,EAAE,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC;AACjF,EAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;AACrB;;;;"}

package/build/server/chunks/entries/endpoints/auth/supabase/callback/_server.ts.js-v1m8UM1y.js

@@ -1,38 +0,0 @@
-import { redirect } from '@sveltejs/kit';
-import { a as apiError, A as ApiErrorCode } from '../../../../../chunks/api-errors.js-CwTBBHWD.js';
-import { g as getAuthProvider } from '../../../../../chunks/providers.server.js-BKhwGvoh.js';
-import { b as bootstrapUserSession } from '../../../../../chunks/auth-bootstrap.server.js-COYZnscW.js';
-import { s as setSessionCookie, a as setRefreshCookie } from '../../../../../chunks/admin-auth.server.js-BAXmH56n.js';
-import { s as safeRedirectTarget } from '../../../../../chunks/redirect.js-1CZ30qn2.js';
-import '../../../../../chunks/context.js-D8E0GFTw.js';
-import 'zod';
-import '@selvajs/compute/core';
-import '../../../../../chunks/schema.js-j3D3emog.js';
-import '../../../../../chunks/utils4.js-C-poIiFQ.js';
-import '../../../../../chunks/shared-server.js-DaWdgxVh.js';
-import 'node:url';
-import 'node:path';
-import 'node:fs';
-import 'node:crypto';
-import 'node:fs/promises';
-import '@supabase/supabase-js';
-import '../../../../../chunks/slug.js-BGuFQjqe.js';
-
-const GET = async ({ url, cookies }) => {
-  const code = url.searchParams.get("code");
-  if (!code) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Missing authorization code");
-  const oauth = getAuthProvider().oauth;
-  if (!oauth) {
-    apiError(501, ApiErrorCode.INTERNAL, "OAuth is not supported by the configured auth provider.");
-  }
-  const result = await oauth.exchangeOAuthCode(code);
-  if (!result) apiError(401, ApiErrorCode.UNAUTHORIZED, "OAuth exchange failed");
-  await bootstrapUserSession(result.user);
-  setSessionCookie(cookies, result.sessionToken);
-  setRefreshCookie(cookies, result.refreshToken);
-  const dest = safeRedirectTarget(url.searchParams.get("redirectTo"), "/library");
-  redirect(303, dest);
-};
-
-export { GET };
-//# sourceMappingURL=_server.ts.js-v1m8UM1y.js.map

package/build/server/chunks/entries/endpoints/auth/supabase/callback/_server.ts.js-v1m8UM1y.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"_server.ts.js-v1m8UM1y.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/auth/supabase/callback/_server.ts.js"],"sourcesContent":["import { redirect } from \"@sveltejs/kit\";\nimport { a as apiError, A as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\nimport { b as getAuthProvider } from \"../../../../../chunks/providers.server.js\";\nimport { b as bootstrapUserSession } from \"../../../../../chunks/auth-bootstrap.server.js\";\nimport { s as setSessionCookie, a as setRefreshCookie } from \"../../../../../chunks/admin-auth.server.js\";\nimport { s as safeRedirectTarget } from \"../../../../../chunks/redirect.js\";\nconst GET = async ({ url, cookies }) => {\n  const code = url.searchParams.get(\"code\");\n  if (!code) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing authorization code\");\n  const oauth = getAuthProvider().oauth;\n  if (!oauth) {\n    apiError(501, ApiErrorCode.INTERNAL, \"OAuth is not supported by the configured auth provider.\");\n  }\n  const result = await oauth.exchangeOAuthCode(code);\n  if (!result) apiError(401, ApiErrorCode.UNAUTHORIZED, \"OAuth exchange failed\");\n  await bootstrapUserSession(result.user);\n  setSessionCookie(cookies, result.sessionToken);\n  setRefreshCookie(cookies, result.refreshToken);\n  const dest = safeRedirectTarget(url.searchParams.get(\"redirectTo\"), \"/library\");\n  redirect(303, dest);\n};\nexport {\n  GET\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAMK,MAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK;AACxC,EAAE,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;AAC3C,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,4BAA4B,CAAC;AACxF,EAAE,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC,KAAK;AACvC,EAAE,IAAI,CAAC,KAAK,EAAE;AACd,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,yDAAyD,CAAC;AACnG,EAAE;AACF,EAAE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC;AACpD,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,uBAAuB,CAAC;AAChF,EAAE,MAAM,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC;AACzC,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AAChD,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AAChD,EAAE,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC;AACjF,EAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;AACrB;;;;"}

package/build/server/chunks/entries/endpoints/auth/supabase/start/_server.ts.js-apoe4XPr.js

@@ -1,44 +0,0 @@
-import { redirect } from '@sveltejs/kit';
-import { a as apiError, A as ApiErrorCode } from '../../../../../chunks/api-errors.js-CwTBBHWD.js';
-import { g as getAuthProvider } from '../../../../../chunks/providers.server.js-BKhwGvoh.js';
-import '../../../../../chunks/context.js-D8E0GFTw.js';
-import 'zod';
-import '@selvajs/compute/core';
-import '../../../../../chunks/schema.js-j3D3emog.js';
-import '../../../../../chunks/utils4.js-C-poIiFQ.js';
-import '../../../../../chunks/shared-server.js-DaWdgxVh.js';
-import 'node:url';
-import 'node:path';
-import 'node:fs';
-import 'node:crypto';
-import 'node:fs/promises';
-import '@supabase/supabase-js';
-
-const ALLOWED_PROVIDERS = ["google", "github", "azure", "gitlab"];
-function isAllowedProvider(value) {
-  return value !== null && ALLOWED_PROVIDERS.includes(value);
-}
-const GET = async ({ url }) => {
-  const provider = url.searchParams.get("provider");
-  if (!isAllowedProvider(provider)) {
-    apiError(
-      400,
-      ApiErrorCode.VALIDATION_FAILED,
-      `Invalid provider. Allowed: ${ALLOWED_PROVIDERS.join(", ")}`
-    );
-  }
-  const oauth = getAuthProvider().oauth;
-  if (!oauth) {
-    apiError(501, ApiErrorCode.INTERNAL, "OAuth is not supported by the configured auth provider.");
-  }
-  const redirectTo = url.searchParams.get("redirectTo") ?? "/library";
-  const callbackUrl = new URL("/auth/supabase/callback", url.origin);
-  if (redirectTo.startsWith("/")) {
-    callbackUrl.searchParams.set("redirectTo", redirectTo);
-  }
-  const authorizationUrl = await oauth.getOAuthAuthorizationUrl(provider, callbackUrl.toString());
-  redirect(303, authorizationUrl);
-};
-
-export { GET };
-//# sourceMappingURL=_server.ts.js-apoe4XPr.js.map

package/build/server/chunks/entries/endpoints/auth/supabase/start/_server.ts.js-apoe4XPr.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"_server.ts.js-apoe4XPr.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/auth/supabase/start/_server.ts.js"],"sourcesContent":["import { redirect } from \"@sveltejs/kit\";\nimport { a as apiError, A as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\nimport { b as getAuthProvider } from \"../../../../../chunks/providers.server.js\";\nconst ALLOWED_PROVIDERS = [\"google\", \"github\", \"azure\", \"gitlab\"];\nfunction isAllowedProvider(value) {\n  return value !== null && ALLOWED_PROVIDERS.includes(value);\n}\nconst GET = async ({ url }) => {\n  const provider = url.searchParams.get(\"provider\");\n  if (!isAllowedProvider(provider)) {\n    apiError(\n      400,\n      ApiErrorCode.VALIDATION_FAILED,\n      `Invalid provider. Allowed: ${ALLOWED_PROVIDERS.join(\", \")}`\n    );\n  }\n  const oauth = getAuthProvider().oauth;\n  if (!oauth) {\n    apiError(501, ApiErrorCode.INTERNAL, \"OAuth is not supported by the configured auth provider.\");\n  }\n  const redirectTo = url.searchParams.get(\"redirectTo\") ?? \"/library\";\n  const callbackUrl = new URL(\"/auth/supabase/callback\", url.origin);\n  if (redirectTo.startsWith(\"/\")) {\n    callbackUrl.searchParams.set(\"redirectTo\", redirectTo);\n  }\n  const authorizationUrl = await oauth.getOAuthAuthorizationUrl(provider, callbackUrl.toString());\n  redirect(303, authorizationUrl);\n};\nexport {\n  GET\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAGA,MAAM,iBAAiB,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC;AACjE,SAAS,iBAAiB,CAAC,KAAK,EAAE;AAClC,EAAE,OAAO,KAAK,KAAK,IAAI,IAAI,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC;AAC5D;AACK,MAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,KAAK;AAC/B,EAAE,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC;AACnD,EAAE,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE;AACpC,IAAI,QAAQ;AACZ,MAAM,GAAG;AACT,MAAM,YAAY,CAAC,iBAAiB;AACpC,MAAM,CAAC,2BAA2B,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjE,KAAK;AACL,EAAE;AACF,EAAE,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC,KAAK;AACvC,EAAE,IAAI,CAAC,KAAK,EAAE;AACd,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,yDAAyD,CAAC;AACnG,EAAE;AACF,EAAE,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,UAAU;AACrE,EAAE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,yBAAyB,EAAE,GAAG,CAAC,MAAM,CAAC;AACpE,EAAE,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;AAClC,IAAI,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC;AAC1D,EAAE;AACF,EAAE,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,wBAAwB,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC;AACjG,EAAE,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;AACjC;;;;"}

package/build/server/chunks/entries/hooks.server.js-C-BdJUTh.js

@@ -1,302 +0,0 @@
-import { redirect, isHttpError } from '@sveltejs/kit';
-import { S as SYSTEM_CONTEXT } from '../chunks/context.js-D8E0GFTw.js';
-import { p as providers, f as getErrorReporter, h as getEventSink } from '../chunks/providers.server.js-BKhwGvoh.js';
-import { g as getBootHealth } from '../chunks/bootHealth.server.js-CsYXGGM5.js';
-import { b as private_env } from '../chunks/shared-server.js-DaWdgxVh.js';
-import { f as findDeploymentDir, s as startUpdateOutcomeReconciler } from '../chunks/selfUpdate.server.js-CXejyqIT.js';
-import { w as wireHeaderAuthBootstrap, b as bootstrapUserSession } from '../chunks/auth-bootstrap.server.js-COYZnscW.js';
-import { g as getRefreshToken, s as setSessionCookie, a as setRefreshCookie, c as clearRefreshCookie } from '../chunks/admin-auth.server.js-BAXmH56n.js';
-import 'zod';
-import 'node:url';
-import 'node:path';
-import 'node:fs';
-import 'node:crypto';
-import 'node:fs/promises';
-import '@supabase/supabase-js';
-import '../chunks/update-outcome.js-mUyfVCnt.js';
-import '../chunks/slug.js-BGuFQjqe.js';
-
-function emptyProfile(userId) {
-  return { userId, starredDefinitions: [], recentRuns: [] };
-}
-function applySecurityHeaders(response, opts) {
-  response.headers.set("X-Content-Type-Options", "nosniff");
-  response.headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
-  response.headers.set(
-    "Permissions-Policy",
-    "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()"
-  );
-  if (opts.hsts) {
-    response.headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
-  }
-  return response;
-}
-function createRouteClassifier(config) {
-  const publicPages = new Set(config.publicPages ?? []);
-  const publicPrefixes = config.publicPrefixes ?? [];
-  const publicApis = new Set(config.publicApis ?? []);
-  const selfGatingPrefix = config.selfGatingPrefix;
-  const staticPrefixes = config.staticPrefixes ?? [];
-  const staticPaths = new Set(config.staticPaths ?? []);
-  function isStaticAsset2(pathname) {
-    if (staticPaths.has(pathname)) return true;
-    return staticPrefixes.some((p) => pathname.startsWith(p));
-  }
-  function isSelfGatingApiRoute2(pathname) {
-    return selfGatingPrefix !== void 0 && pathname.startsWith(selfGatingPrefix);
-  }
-  function isPublicRoute2(pathname) {
-    if (publicPages.has(pathname)) return true;
-    if (publicApis.has(pathname)) return true;
-    if (isSelfGatingApiRoute2(pathname)) return true;
-    return publicPrefixes.some((p) => pathname.startsWith(p));
-  }
-  return { isStaticAsset: isStaticAsset2, isSelfGatingApiRoute: isSelfGatingApiRoute2, isPublicRoute: isPublicRoute2 };
-}
-let headerAuthBootstrapWired = false;
-let bootHealthKicked = false;
-let proxyAuthLoginMissWarned = false;
-let firstRunResolved = false;
-async function isFirstRun() {
-  if (firstRunResolved) return false;
-  const usersPage = await providers.auth.listUsers({ limit: 1 });
-  if (usersPage === null) {
-    firstRunResolved = true;
-    return false;
-  }
-  if (usersPage.items.length === 0) return true;
-  firstRunResolved = true;
-  return false;
-}
-const ensuredUserIds = /* @__PURE__ */ new Set();
-async function ensureUserOnce(userId) {
-  if (ensuredUserIds.has(userId)) return;
-  await providers.data.ensureUser(SYSTEM_CONTEXT, userId);
-  ensuredUserIds.add(userId);
-}
-async function buildContext(user, sessionToken, platformPermissions, membership) {
-  let actingOrgId;
-  let orgPermissions = [];
-  if (membership) {
-    actingOrgId = membership.org.id;
-    orgPermissions = membership.member.permissions;
-  }
-  if (!actingOrgId && platformPermissions.includes("instance_admin")) {
-    const firstOrgPage = await providers.data.orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 });
-    const firstOrg = firstOrgPage.items[0];
-    if (firstOrg) actingOrgId = firstOrg.id;
-  }
-  return {
-    userId: user.id,
-    actingOrgId,
-    platformPermissions,
-    orgPermissions,
-    adapterContext: sessionToken ? { sessionToken } : void 0
-  };
-}
-const PUBLIC_PAGE_ROUTES = /* @__PURE__ */ new Set([
-  "/",
-  // landing — guests see it; authed users get redirected by +page.server.ts
-  "/login",
-  "/setup",
-  "/accept-invite"
-]);
-const routeClassifier = createRouteClassifier({
-  publicPages: PUBLIC_PAGE_ROUTES,
-  // `/auth/` covers the OAuth start + callback flow (the user has no session
-  // yet by definition). `/logout` is a form-action page — the action destroys
-  // the session, then redirects.
-  publicPrefixes: ["/auth/", "/logout"],
-  // Endpoints that must answer without a session — currently just the
-  // load-balancer health probe. Anything added here must be safe to expose
-  // to anonymous callers.
-  publicApis: ["/api/health"],
-  // The blob proxy is *self-gating*: `/api/files/[...path]` classifies every
-  // path against the asset-class registry and applies per-class auth itself —
-  // public branding (logo/favicon) serves to anyone, while org/project assets
-  // 401 when no session is attached. So the hook must NOT deny it up front;
-  // the route makes the real decision. This is the ONLY `/api/*` prefix
-  // allowed to carry its own authorization.
-  selfGatingPrefix: "/api/files/",
-  // Static-asset paths SvelteKit/adapter-node serves directly — recognized so
-  // the auth gate doesn't trip and cache-control headers can apply.
-  staticPrefixes: ["/_app/", "/favicon/"],
-  staticPaths: ["/favicon.svg", "/robots.txt"]
-});
-const { isStaticAsset, isSelfGatingApiRoute, isPublicRoute } = routeClassifier;
-const handle = async ({ event, resolve }) => {
-  event.locals.providers = providers;
-  if (!headerAuthBootstrapWired) {
-    wireHeaderAuthBootstrap();
-    headerAuthBootstrapWired = true;
-  }
-  if (!bootHealthKicked) {
-    bootHealthKicked = true;
-    void getBootHealth();
-    const deploymentDir = findDeploymentDir(private_env);
-    if (deploymentDir) {
-      startUpdateOutcomeReconciler({
-        deploymentDir,
-        emit: (e) => getEventSink().emit(e),
-        report: (err) => getErrorReporter().capture(err, { tags: { origin: "selfUpdate" } })
-      });
-    }
-  }
-  const { pathname } = event.url;
-  if (isStaticAsset(pathname)) {
-    return applyResponseHeaders(await resolve(event), pathname);
-  }
-  if (pathname === "/api/health") {
-    return applyResponseHeaders(await resolve(event), pathname);
-  }
-  const publicRoute = isPublicRoute(pathname);
-  const isJsonApiRoute = pathname.startsWith("/api/") || pathname.startsWith("/admin/api/");
-  if (!publicRoute) {
-    if (await isFirstRun()) {
-      if (isJsonApiRoute) {
-        return applyResponseHeaders(
-          new Response(JSON.stringify({ message: "Setup required", code: "SETUP_REQUIRED" }), {
-            status: 503,
-            headers: { "Content-Type": "application/json" }
-          }),
-          pathname
-        );
-      }
-      redirect(303, "/setup");
-    }
-  }
-  const needsAuth = !publicRoute;
-  if (needsAuth) {
-    let token = event.cookies.get("admin_session") ?? "";
-    let user = await providers.auth.verifyToken(token);
-    if (!user) {
-      const refreshToken = getRefreshToken(event.cookies);
-      const oauth = providers.auth.oauth;
-      if (refreshToken && oauth) {
-        const refreshed = await oauth.refreshSession(refreshToken);
-        if (refreshed) {
-          setSessionCookie(event.cookies, refreshed.sessionToken);
-          setRefreshCookie(event.cookies, refreshed.refreshToken);
-          token = refreshed.sessionToken;
-          user = await providers.auth.verifyToken(token);
-        } else {
-          clearRefreshCookie(event.cookies);
-        }
-      }
-    }
-    if (!user && providers.auth.proxyAuth) {
-      user = await providers.auth.proxyAuth.identifyFromHeaders(event.request.headers);
-      if (user) await bootstrapUserSession(user);
-    }
-    if (!user) {
-      if (isJsonApiRoute) {
-        return applyResponseHeaders(
-          new Response(
-            JSON.stringify({
-              message: "Your session has expired. Sign in again to continue.",
-              code: "UNAUTHORIZED"
-            }),
-            {
-              status: 401,
-              headers: { "Content-Type": "application/json" }
-            }
-          ),
-          pathname
-        );
-      }
-      redirect(303, `/login?redirectTo=${encodeURIComponent(pathname)}`);
-    }
-    const [, profile, platformPermissions, membership] = await Promise.all([
-      ensureUserOnce(user.id),
-      providers.data.userProfile.getProfile(SYSTEM_CONTEXT, user.id),
-      providers.data.permissions.getFor(SYSTEM_CONTEXT, user.id),
-      providers.data.orgs.findUserMembership(SYSTEM_CONTEXT, user.id)
-    ]);
-    event.locals.user = user;
-    event.locals.profile = profile ?? emptyProfile(user.id);
-    event.locals.ctx = await buildContext(user, token, platformPermissions, membership);
-  } else {
-    const isPublicPage = PUBLIC_PAGE_ROUTES.has(pathname);
-    const wantsSessionAttach = isPublicPage || isSelfGatingApiRoute(pathname);
-    const token = wantsSessionAttach ? event.cookies.get("admin_session") ?? "" : "";
-    let user = token ? await providers.auth.verifyToken(token) : null;
-    if (!user && wantsSessionAttach && providers.auth.proxyAuth) {
-      user = await providers.auth.proxyAuth.identifyFromHeaders(event.request.headers);
-      if (!user && pathname === "/login" && !proxyAuthLoginMissWarned) {
-        proxyAuthLoginMissWarned = true;
-        const proxyAuth = providers.auth.proxyAuth;
-        const noHeaders = proxyAuth.hasNoIdentityHeaders(event.request.headers);
-        const configured = proxyAuth.configuredHeaderNames.join(", ");
-        if (noHeaders) {
-          console.warn(
-            `[HeaderAuth] /login was hit and NONE of the configured identity headers (${configured}) arrived on the request. The forward-auth proxy is not reaching this process, or it is not forwarding the configured headers. See the @selvajs/header-auth-provider README "Verification" section.`
-          );
-        } else {
-          console.warn(
-            `[HeaderAuth] /login was hit but the UPN header was missing or the user is not allowlisted. Configured headers: ${configured}. Some headers arrived but identification still failed — check that the UPN header is populated and that the user has been added to header-allowlist.json.`
-          );
-        }
-      }
-    }
-    if (user) {
-      const [, profile, platformPermissions, membership] = await Promise.all([
-        ensureUserOnce(user.id),
-        providers.data.userProfile.getProfile(SYSTEM_CONTEXT, user.id),
-        providers.data.permissions.getFor(SYSTEM_CONTEXT, user.id),
-        providers.data.orgs.findUserMembership(SYSTEM_CONTEXT, user.id)
-      ]);
-      event.locals.user = user;
-      event.locals.profile = profile ?? emptyProfile(user.id);
-      event.locals.ctx = await buildContext(user, token, platformPermissions, membership);
-    }
-  }
-  return applyResponseHeaders(await resolve(event), pathname);
-};
-function applyResponseHeaders(response, pathname) {
-  applySecurityHeaders(response, {
-    // eslint-disable-next-line no-restricted-properties -- NODE_ENV is OS-level, set by Node/Vite, not loaded from .env
-    hsts: process.env.NODE_ENV === "production"
-  });
-  if (pathname.startsWith("/_app/")) {
-    response.headers.set("Cache-Control", "public, max-age=31536000, immutable");
-  } else if (pathname.startsWith("/favicon/") || pathname === "/favicon.svg" || pathname === "/robots.txt") {
-    response.headers.set("Cache-Control", "public, max-age=604800");
-  }
-  return response;
-}
-const handleError = ({
-  error,
-  status,
-  event
-}) => {
-  if (isHttpError(error)) {
-    const body = error.body;
-    return { message: body.message, code: body.code, fields: body.fields };
-  }
-  if (status === 404) {
-    return { message: "Page not found.", code: "NOT_FOUND" };
-  }
-  const rendered = error instanceof Error ? error.stack ?? error.message : (() => {
-    try {
-      return JSON.stringify(error);
-    } catch {
-      return String(error);
-    }
-  })();
-  const cause = error instanceof Error && error.cause ? `
-  caused by: ${error.cause}` : "";
-  console.error(
-    `[Unhandled error] ${event.request.method} ${event.url.pathname}
-  ${rendered}${cause}`
-  );
-  getErrorReporter().capture(error, {
-    method: event.request.method,
-    route: event.url.pathname,
-    userId: event.locals.ctx?.userId || void 0,
-    orgId: event.locals.ctx?.actingOrgId
-  });
-  return { message: "An unexpected error occurred.", code: "INTERNAL" };
-};
-
-export { buildContext, handle, handleError, isPublicRoute, isSelfGatingApiRoute, isStaticAsset };
-//# sourceMappingURL=hooks.server.js-C-BdJUTh.js.map

package/build/server/chunks/entries/hooks.server.js-C-BdJUTh.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"hooks.server.js-C-BdJUTh.js","sources":["../../../../.svelte-kit/output/server/entries/hooks.server.js"],"sourcesContent":["import { redirect, isHttpError } from \"@sveltejs/kit\";\nimport { S as SYSTEM_CONTEXT } from \"../chunks/context.js\";\nimport { p as providers, g as getErrorReporter, a as getEventSink } from \"../chunks/providers.server.js\";\nimport { g as getBootHealth } from \"../chunks/bootHealth.server.js\";\nimport { b as private_env } from \"../chunks/shared-server.js\";\nimport { f as findDeploymentDir, s as startUpdateOutcomeReconciler } from \"../chunks/selfUpdate.server.js\";\nimport { w as wireHeaderAuthBootstrap, b as bootstrapUserSession } from \"../chunks/auth-bootstrap.server.js\";\nimport { g as getRefreshToken, s as setSessionCookie, a as setRefreshCookie, c as clearRefreshCookie } from \"../chunks/admin-auth.server.js\";\nfunction emptyProfile(userId) {\n  return { userId, starredDefinitions: [], recentRuns: [] };\n}\nfunction applySecurityHeaders(response, opts) {\n  response.headers.set(\"X-Content-Type-Options\", \"nosniff\");\n  response.headers.set(\"Referrer-Policy\", \"strict-origin-when-cross-origin\");\n  response.headers.set(\n    \"Permissions-Policy\",\n    \"accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()\"\n  );\n  if (opts.hsts) {\n    response.headers.set(\"Strict-Transport-Security\", \"max-age=31536000; includeSubDomains\");\n  }\n  return response;\n}\nfunction createRouteClassifier(config) {\n  const publicPages = new Set(config.publicPages ?? []);\n  const publicPrefixes = config.publicPrefixes ?? [];\n  const publicApis = new Set(config.publicApis ?? []);\n  const selfGatingPrefix = config.selfGatingPrefix;\n  const staticPrefixes = config.staticPrefixes ?? [];\n  const staticPaths = new Set(config.staticPaths ?? []);\n  function isStaticAsset2(pathname) {\n    if (staticPaths.has(pathname)) return true;\n    return staticPrefixes.some((p) => pathname.startsWith(p));\n  }\n  function isSelfGatingApiRoute2(pathname) {\n    return selfGatingPrefix !== void 0 && pathname.startsWith(selfGatingPrefix);\n  }\n  function isPublicRoute2(pathname) {\n    if (publicPages.has(pathname)) return true;\n    if (publicApis.has(pathname)) return true;\n    if (isSelfGatingApiRoute2(pathname)) return true;\n    return publicPrefixes.some((p) => pathname.startsWith(p));\n  }\n  return { isStaticAsset: isStaticAsset2, isSelfGatingApiRoute: isSelfGatingApiRoute2, isPublicRoute: isPublicRoute2 };\n}\nlet headerAuthBootstrapWired = false;\nlet bootHealthKicked = false;\nlet proxyAuthLoginMissWarned = false;\nlet firstRunResolved = false;\nasync function isFirstRun() {\n  if (firstRunResolved) return false;\n  const usersPage = await providers.auth.listUsers({ limit: 1 });\n  if (usersPage === null) {\n    firstRunResolved = true;\n    return false;\n  }\n  if (usersPage.items.length === 0) return true;\n  firstRunResolved = true;\n  return false;\n}\nconst ensuredUserIds = /* @__PURE__ */ new Set();\nasync function ensureUserOnce(userId) {\n  if (ensuredUserIds.has(userId)) return;\n  await providers.data.ensureUser(SYSTEM_CONTEXT, userId);\n  ensuredUserIds.add(userId);\n}\nasync function buildContext(user, sessionToken, platformPermissions, membership) {\n  let actingOrgId;\n  let orgPermissions = [];\n  if (membership) {\n    actingOrgId = membership.org.id;\n    orgPermissions = membership.member.permissions;\n  }\n  if (!actingOrgId && platformPermissions.includes(\"instance_admin\")) {\n    const firstOrgPage = await providers.data.orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 });\n    const firstOrg = firstOrgPage.items[0];\n    if (firstOrg) actingOrgId = firstOrg.id;\n  }\n  return {\n    userId: user.id,\n    actingOrgId,\n    platformPermissions,\n    orgPermissions,\n    adapterContext: sessionToken ? { sessionToken } : void 0\n  };\n}\nconst PUBLIC_PAGE_ROUTES = /* @__PURE__ */ new Set([\n  \"/\",\n  // landing — guests see it; authed users get redirected by +page.server.ts\n  \"/login\",\n  \"/setup\",\n  \"/accept-invite\"\n]);\nconst routeClassifier = createRouteClassifier({\n  publicPages: PUBLIC_PAGE_ROUTES,\n  // `/auth/` covers the OAuth start + callback flow (the user has no session\n  // yet by definition). `/logout` is a form-action page — the action destroys\n  // the session, then redirects.\n  publicPrefixes: [\"/auth/\", \"/logout\"],\n  // Endpoints that must answer without a session — currently just the\n  // load-balancer health probe. Anything added here must be safe to expose\n  // to anonymous callers.\n  publicApis: [\"/api/health\"],\n  // The blob proxy is *self-gating*: `/api/files/[...path]` classifies every\n  // path against the asset-class registry and applies per-class auth itself —\n  // public branding (logo/favicon) serves to anyone, while org/project assets\n  // 401 when no session is attached. So the hook must NOT deny it up front;\n  // the route makes the real decision. This is the ONLY `/api/*` prefix\n  // allowed to carry its own authorization.\n  selfGatingPrefix: \"/api/files/\",\n  // Static-asset paths SvelteKit/adapter-node serves directly — recognized so\n  // the auth gate doesn't trip and cache-control headers can apply.\n  staticPrefixes: [\"/_app/\", \"/favicon/\"],\n  staticPaths: [\"/favicon.svg\", \"/robots.txt\"]\n});\nconst { isStaticAsset, isSelfGatingApiRoute, isPublicRoute } = routeClassifier;\nconst handle = async ({ event, resolve }) => {\n  event.locals.providers = providers;\n  if (!headerAuthBootstrapWired) {\n    wireHeaderAuthBootstrap();\n    headerAuthBootstrapWired = true;\n  }\n  if (!bootHealthKicked) {\n    bootHealthKicked = true;\n    void getBootHealth();\n    const deploymentDir = findDeploymentDir(private_env);\n    if (deploymentDir) {\n      startUpdateOutcomeReconciler({\n        deploymentDir,\n        emit: (e) => getEventSink().emit(e),\n        report: (err) => getErrorReporter().capture(err, { tags: { origin: \"selfUpdate\" } })\n      });\n    }\n  }\n  const { pathname } = event.url;\n  if (isStaticAsset(pathname)) {\n    return applyResponseHeaders(await resolve(event), pathname);\n  }\n  if (pathname === \"/api/health\") {\n    return applyResponseHeaders(await resolve(event), pathname);\n  }\n  const publicRoute = isPublicRoute(pathname);\n  const isJsonApiRoute = pathname.startsWith(\"/api/\") || pathname.startsWith(\"/admin/api/\");\n  if (!publicRoute) {\n    if (await isFirstRun()) {\n      if (isJsonApiRoute) {\n        return applyResponseHeaders(\n          new Response(JSON.stringify({ message: \"Setup required\", code: \"SETUP_REQUIRED\" }), {\n            status: 503,\n            headers: { \"Content-Type\": \"application/json\" }\n          }),\n          pathname\n        );\n      }\n      redirect(303, \"/setup\");\n    }\n  }\n  const needsAuth = !publicRoute;\n  if (needsAuth) {\n    let token = event.cookies.get(\"admin_session\") ?? \"\";\n    let user = await providers.auth.verifyToken(token);\n    if (!user) {\n      const refreshToken = getRefreshToken(event.cookies);\n      const oauth = providers.auth.oauth;\n      if (refreshToken && oauth) {\n        const refreshed = await oauth.refreshSession(refreshToken);\n        if (refreshed) {\n          setSessionCookie(event.cookies, refreshed.sessionToken);\n          setRefreshCookie(event.cookies, refreshed.refreshToken);\n          token = refreshed.sessionToken;\n          user = await providers.auth.verifyToken(token);\n        } else {\n          clearRefreshCookie(event.cookies);\n        }\n      }\n    }\n    if (!user && providers.auth.proxyAuth) {\n      user = await providers.auth.proxyAuth.identifyFromHeaders(event.request.headers);\n      if (user) await bootstrapUserSession(user);\n    }\n    if (!user) {\n      if (isJsonApiRoute) {\n        return applyResponseHeaders(\n          new Response(\n            JSON.stringify({\n              message: \"Your session has expired. Sign in again to continue.\",\n              code: \"UNAUTHORIZED\"\n            }),\n            {\n              status: 401,\n              headers: { \"Content-Type\": \"application/json\" }\n            }\n          ),\n          pathname\n        );\n      }\n      redirect(303, `/login?redirectTo=${encodeURIComponent(pathname)}`);\n    }\n    const [, profile, platformPermissions, membership] = await Promise.all([\n      ensureUserOnce(user.id),\n      providers.data.userProfile.getProfile(SYSTEM_CONTEXT, user.id),\n      providers.data.permissions.getFor(SYSTEM_CONTEXT, user.id),\n      providers.data.orgs.findUserMembership(SYSTEM_CONTEXT, user.id)\n    ]);\n    event.locals.user = user;\n    event.locals.profile = profile ?? emptyProfile(user.id);\n    event.locals.ctx = await buildContext(user, token, platformPermissions, membership);\n  } else {\n    const isPublicPage = PUBLIC_PAGE_ROUTES.has(pathname);\n    const wantsSessionAttach = isPublicPage || isSelfGatingApiRoute(pathname);\n    const token = wantsSessionAttach ? event.cookies.get(\"admin_session\") ?? \"\" : \"\";\n    let user = token ? await providers.auth.verifyToken(token) : null;\n    if (!user && wantsSessionAttach && providers.auth.proxyAuth) {\n      user = await providers.auth.proxyAuth.identifyFromHeaders(event.request.headers);\n      if (!user && pathname === \"/login\" && !proxyAuthLoginMissWarned) {\n        proxyAuthLoginMissWarned = true;\n        const proxyAuth = providers.auth.proxyAuth;\n        const noHeaders = proxyAuth.hasNoIdentityHeaders(event.request.headers);\n        const configured = proxyAuth.configuredHeaderNames.join(\", \");\n        if (noHeaders) {\n          console.warn(\n            `[HeaderAuth] /login was hit and NONE of the configured identity headers (${configured}) arrived on the request. The forward-auth proxy is not reaching this process, or it is not forwarding the configured headers. See the @selvajs/header-auth-provider README \"Verification\" section.`\n          );\n        } else {\n          console.warn(\n            `[HeaderAuth] /login was hit but the UPN header was missing or the user is not allowlisted. Configured headers: ${configured}. Some headers arrived but identification still failed — check that the UPN header is populated and that the user has been added to header-allowlist.json.`\n          );\n        }\n      }\n    }\n    if (user) {\n      const [, profile, platformPermissions, membership] = await Promise.all([\n        ensureUserOnce(user.id),\n        providers.data.userProfile.getProfile(SYSTEM_CONTEXT, user.id),\n        providers.data.permissions.getFor(SYSTEM_CONTEXT, user.id),\n        providers.data.orgs.findUserMembership(SYSTEM_CONTEXT, user.id)\n      ]);\n      event.locals.user = user;\n      event.locals.profile = profile ?? emptyProfile(user.id);\n      event.locals.ctx = await buildContext(user, token, platformPermissions, membership);\n    }\n  }\n  return applyResponseHeaders(await resolve(event), pathname);\n};\nfunction applyResponseHeaders(response, pathname) {\n  applySecurityHeaders(response, {\n    // eslint-disable-next-line no-restricted-properties -- NODE_ENV is OS-level, set by Node/Vite, not loaded from .env\n    hsts: process.env.NODE_ENV === \"production\"\n  });\n  if (pathname.startsWith(\"/_app/\")) {\n    response.headers.set(\"Cache-Control\", \"public, max-age=31536000, immutable\");\n  } else if (pathname.startsWith(\"/favicon/\") || pathname === \"/favicon.svg\" || pathname === \"/robots.txt\") {\n    response.headers.set(\"Cache-Control\", \"public, max-age=604800\");\n  }\n  return response;\n}\nconst handleError = ({\n  error,\n  status,\n  event\n}) => {\n  if (isHttpError(error)) {\n    const body = error.body;\n    return { message: body.message, code: body.code, fields: body.fields };\n  }\n  if (status === 404) {\n    return { message: \"Page not found.\", code: \"NOT_FOUND\" };\n  }\n  const rendered = error instanceof Error ? error.stack ?? error.message : (() => {\n    try {\n      return JSON.stringify(error);\n    } catch {\n      return String(error);\n    }\n  })();\n  const cause = error instanceof Error && error.cause ? `\n  caused by: ${error.cause}` : \"\";\n  console.error(\n    `[Unhandled error] ${event.request.method} ${event.url.pathname}\n  ${rendered}${cause}`\n  );\n  getErrorReporter().capture(error, {\n    method: event.request.method,\n    route: event.url.pathname,\n    userId: event.locals.ctx?.userId || void 0,\n    orgId: event.locals.ctx?.actingOrgId\n  });\n  return { message: \"An unexpected error occurred.\", code: \"INTERNAL\" };\n};\nexport {\n  buildContext,\n  handle,\n  handleError,\n  isPublicRoute,\n  isSelfGatingApiRoute,\n  isStaticAsset\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAQA,SAAS,YAAY,CAAC,MAAM,EAAE;AAC9B,EAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;AAC3D;AACA,SAAS,oBAAoB,CAAC,QAAQ,EAAE,IAAI,EAAE;AAC9C,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC;AAC3D,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,iCAAiC,CAAC;AAC5E,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG;AACtB,IAAI,oBAAoB;AACxB,IAAI;AACJ,GAAG;AACH,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE;AACjB,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,qCAAqC,CAAC;AAC5F,EAAE;AACF,EAAE,OAAO,QAAQ;AACjB;AACA,SAAS,qBAAqB,CAAC,MAAM,EAAE;AACvC,EAAE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;AACvD,EAAE,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,EAAE;AACpD,EAAE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;AACrD,EAAE,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB;AAClD,EAAE,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,EAAE;AACpD,EAAE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;AACvD,EAAE,SAAS,cAAc,CAAC,QAAQ,EAAE;AACpC,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI;AAC9C,IAAI,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAC7D,EAAE;AACF,EAAE,SAAS,qBAAqB,CAAC,QAAQ,EAAE;AAC3C,IAAI,OAAO,gBAAgB,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,gBAAgB,CAAC;AAC/E,EAAE;AACF,EAAE,SAAS,cAAc,CAAC,QAAQ,EAAE;AACpC,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI;AAC9C,IAAI,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI;AAC7C,IAAI,IAAI,qBAAqB,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI;AACpD,IAAI,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAC7D,EAAE;AACF,EAAE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,aAAa,EAAE,cAAc,EAAE;AACtH;AACA,IAAI,wBAAwB,GAAG,KAAK;AACpC,IAAI,gBAAgB,GAAG,KAAK;AAC5B,IAAI,wBAAwB,GAAG,KAAK;AACpC,IAAI,gBAAgB,GAAG,KAAK;AAC5B,eAAe,UAAU,GAAG;AAC5B,EAAE,IAAI,gBAAgB,EAAE,OAAO,KAAK;AACpC,EAAE,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAChE,EAAE,IAAI,SAAS,KAAK,IAAI,EAAE;AAC1B,IAAI,gBAAgB,GAAG,IAAI;AAC3B,IAAI,OAAO,KAAK;AAChB,EAAE;AACF,EAAE,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,IAAI;AAC/C,EAAE,gBAAgB,GAAG,IAAI;AACzB,EAAE,OAAO,KAAK;AACd;AACA,MAAM,cAAc,mBAAmB,IAAI,GAAG,EAAE;AAChD,eAAe,cAAc,CAAC,MAAM,EAAE;AACtC,EAAE,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;AAClC,EAAE,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC;AACzD,EAAE,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;AAC5B;AACA,eAAe,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE,mBAAmB,EAAE,UAAU,EAAE;AACjF,EAAE,IAAI,WAAW;AACjB,EAAE,IAAI,cAAc,GAAG,EAAE;AACzB,EAAE,IAAI,UAAU,EAAE;AAClB,IAAI,WAAW,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE;AACnC,IAAI,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW;AAClD,EAAE;AACF,EAAE,IAAI,CAAC,WAAW,IAAI,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE;AACtE,IAAI,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AACzF,IAAI,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1C,IAAI,IAAI,QAAQ,EAAE,WAAW,GAAG,QAAQ,CAAC,EAAE;AAC3C,EAAE;AACF,EAAE,OAAO;AACT,IAAI,MAAM,EAAE,IAAI,CAAC,EAAE;AACnB,IAAI,WAAW;AACf,IAAI,mBAAmB;AACvB,IAAI,cAAc;AAClB,IAAI,cAAc,EAAE,YAAY,GAAG,EAAE,YAAY,EAAE,GAAG;AACtD,GAAG;AACH;AACA,MAAM,kBAAkB,mBAAmB,IAAI,GAAG,CAAC;AACnD,EAAE,GAAG;AACL;AACA,EAAE,QAAQ;AACV,EAAE,QAAQ;AACV,EAAE;AACF,CAAC,CAAC;AACF,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAC9C,EAAE,WAAW,EAAE,kBAAkB;AACjC;AACA;AACA;AACA,EAAE,cAAc,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;AACvC;AACA;AACA;AACA,EAAE,UAAU,EAAE,CAAC,aAAa,CAAC;AAC7B;AACA;AACA;AACA;AACA;AACA;AACA,EAAE,gBAAgB,EAAE,aAAa;AACjC;AACA;AACA,EAAE,cAAc,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC;AACzC,EAAE,WAAW,EAAE,CAAC,cAAc,EAAE,aAAa;AAC7C,CAAC,CAAC;AACG,MAAC,EAAE,aAAa,EAAE,oBAAoB,EAAE,aAAa,EAAE,GAAG;AAC1D,MAAC,MAAM,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;AAC7C,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,SAAS;AACpC,EAAE,IAAI,CAAC,wBAAwB,EAAE;AACjC,IAAI,uBAAuB,EAAE;AAC7B,IAAI,wBAAwB,GAAG,IAAI;AACnC,EAAE;AACF,EAAE,IAAI,CAAC,gBAAgB,EAAE;AACzB,IAAI,gBAAgB,GAAG,IAAI;AAC3B,IAAI,KAAK,aAAa,EAAE;AACxB,IAAI,MAAM,aAAa,GAAG,iBAAiB,CAAC,WAAW,CAAC;AACxD,IAAI,IAAI,aAAa,EAAE;AACvB,MAAM,4BAA4B,CAAC;AACnC,QAAQ,aAAa;AACrB,QAAQ,IAAI,EAAE,CAAC,CAAC,KAAK,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3C,QAAQ,MAAM,EAAE,CAAC,GAAG,KAAK,gBAAgB,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;AAC3F,OAAO,CAAC;AACR,IAAI;AACJ,EAAE;AACF,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,GAAG;AAChC,EAAE,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE;AAC/B,IAAI,OAAO,oBAAoB,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;AAC/D,EAAE;AACF,EAAE,IAAI,QAAQ,KAAK,aAAa,EAAE;AAClC,IAAI,OAAO,oBAAoB,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;AAC/D,EAAE;AACF,EAAE,MAAM,WAAW,GAAG,aAAa,CAAC,QAAQ,CAAC;AAC7C,EAAE,MAAM,cAAc,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC;AAC3F,EAAE,IAAI,CAAC,WAAW,EAAE;AACpB,IAAI,IAAI,MAAM,UAAU,EAAE,EAAE;AAC5B,MAAM,IAAI,cAAc,EAAE;AAC1B,QAAQ,OAAO,oBAAoB;AACnC,UAAU,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,EAAE;AAC9F,YAAY,MAAM,EAAE,GAAG;AACvB,YAAY,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AACzD,WAAW,CAAC;AACZ,UAAU;AACV,SAAS;AACT,MAAM;AACN,MAAM,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;AAC7B,IAAI;AACJ,EAAE;AACF,EAAE,MAAM,SAAS,GAAG,CAAC,WAAW;AAChC,EAAE,IAAI,SAAS,EAAE;AACjB,IAAI,IAAI,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE;AACxD,IAAI,IAAI,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;AACtD,IAAI,IAAI,CAAC,IAAI,EAAE;AACf,MAAM,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC;AACzD,MAAM,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK;AACxC,MAAM,IAAI,YAAY,IAAI,KAAK,EAAE;AACjC,QAAQ,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,YAAY,CAAC;AAClE,QAAQ,IAAI,SAAS,EAAE;AACvB,UAAU,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,CAAC;AACjE,UAAU,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,CAAC;AACjE,UAAU,KAAK,GAAG,SAAS,CAAC,YAAY;AACxC,UAAU,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;AACxD,QAAQ,CAAC,MAAM;AACf,UAAU,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC;AAC3C,QAAQ;AACR,MAAM;AACN,IAAI;AACJ,IAAI,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE;AAC3C,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;AACtF,MAAM,IAAI,IAAI,EAAE,MAAM,oBAAoB,CAAC,IAAI,CAAC;AAChD,IAAI;AACJ,IAAI,IAAI,CAAC,IAAI,EAAE;AACf,MAAM,IAAI,cAAc,EAAE;AAC1B,QAAQ,OAAO,oBAAoB;AACnC,UAAU,IAAI,QAAQ;AACtB,YAAY,IAAI,CAAC,SAAS,CAAC;AAC3B,cAAc,OAAO,EAAE,sDAAsD;AAC7E,cAAc,IAAI,EAAE;AACpB,aAAa,CAAC;AACd,YAAY;AACZ,cAAc,MAAM,EAAE,GAAG;AACzB,cAAc,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AAC3D;AACA,WAAW;AACX,UAAU;AACV,SAAS;AACT,MAAM;AACN,MAAM,QAAQ,CAAC,GAAG,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACxE,IAAI;AACJ,IAAI,MAAM,GAAG,OAAO,EAAE,mBAAmB,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AAC3E,MAAM,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;AAC7B,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AACpE,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAChE,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE;AACpE,KAAK,CAAC;AACN,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI;AAC5B,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3D,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,mBAAmB,EAAE,UAAU,CAAC;AACvF,EAAE,CAAC,MAAM;AACT,IAAI,MAAM,YAAY,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC;AACzD,IAAI,MAAM,kBAAkB,GAAG,YAAY,IAAI,oBAAoB,CAAC,QAAQ,CAAC;AAC7E,IAAI,MAAM,KAAK,GAAG,kBAAkB,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,EAAE;AACpF,IAAI,IAAI,IAAI,GAAG,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,IAAI;AACrE,IAAI,IAAI,CAAC,IAAI,IAAI,kBAAkB,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE;AACjE,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;AACtF,MAAM,IAAI,CAAC,IAAI,IAAI,QAAQ,KAAK,QAAQ,IAAI,CAAC,wBAAwB,EAAE;AACvE,QAAQ,wBAAwB,GAAG,IAAI;AACvC,QAAQ,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS;AAClD,QAAQ,MAAM,SAAS,GAAG,SAAS,CAAC,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;AAC/E,QAAQ,MAAM,UAAU,GAAG,SAAS,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;AACrE,QAAQ,IAAI,SAAS,EAAE;AACvB,UAAU,OAAO,CAAC,IAAI;AACtB,YAAY,CAAC,yEAAyE,EAAE,UAAU,CAAC,mMAAmM;AACtS,WAAW;AACX,QAAQ,CAAC,MAAM;AACf,UAAU,OAAO,CAAC,IAAI;AACtB,YAAY,CAAC,+GAA+G,EAAE,UAAU,CAAC,0JAA0J;AACnS,WAAW;AACX,QAAQ;AACR,MAAM;AACN,IAAI;AACJ,IAAI,IAAI,IAAI,EAAE;AACd,MAAM,MAAM,GAAG,OAAO,EAAE,mBAAmB,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AAC7E,QAAQ,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;AAC/B,QAAQ,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AACtE,QAAQ,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAClE,QAAQ,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE;AACtE,OAAO,CAAC;AACR,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI;AAC9B,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;AAC7D,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,mBAAmB,EAAE,UAAU,CAAC;AACzF,IAAI;AACJ,EAAE;AACF,EAAE,OAAO,oBAAoB,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;AAC7D;AACA,SAAS,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE;AAClD,EAAE,oBAAoB,CAAC,QAAQ,EAAE;AACjC;AACA,IAAI,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK;AACnC,GAAG,CAAC;AACJ,EAAE,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE;AACrC,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,qCAAqC,CAAC;AAChF,EAAE,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,QAAQ,KAAK,cAAc,IAAI,QAAQ,KAAK,aAAa,EAAE;AAC5G,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,wBAAwB,CAAC;AACnE,EAAE;AACF,EAAE,OAAO,QAAQ;AACjB;AACK,MAAC,WAAW,GAAG,CAAC;AACrB,EAAE,KAAK;AACP,EAAE,MAAM;AACR,EAAE;AACF,CAAC,KAAK;AACN,EAAE,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE;AAC1B,IAAI,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI;AAC3B,IAAI,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;AAC1E,EAAE;AACF,EAAE,IAAI,MAAM,KAAK,GAAG,EAAE;AACtB,IAAI,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE;AAC5D,EAAE;AACF,EAAE,MAAM,QAAQ,GAAG,KAAK,YAAY,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,MAAM;AAClF,IAAI,IAAI;AACR,MAAM,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;AAClC,IAAI,CAAC,CAAC,MAAM;AACZ,MAAM,OAAO,MAAM,CAAC,KAAK,CAAC;AAC1B,IAAI;AACJ,EAAE,CAAC,GAAG;AACN,EAAE,MAAM,KAAK,GAAG,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,KAAK,GAAG;AACxD,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE;AACjC,EAAE,OAAO,CAAC,KAAK;AACf,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ;AACnE,EAAE,EAAE,QAAQ,CAAC,EAAE,KAAK,CAAC;AACrB,GAAG;AACH,EAAE,gBAAgB,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE;AACpC,IAAI,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;AAChC,IAAI,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ;AAC7B,IAAI,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,IAAI,MAAM;AAC9C,IAAI,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE;AAC7B,GAAG,CAAC;AACJ,EAAE,OAAO,EAAE,OAAO,EAAE,+BAA+B,EAAE,IAAI,EAAE,UAAU,EAAE;AACvE;;;;"}