@selvajs/selva 4.8.0-beta.10 → 4.8.0-beta.12

package/build/server/chunks/chunks/bodies.js-DzvLeLhi.js

@@ -1,91 +0,0 @@
-import { P as ProjectVisibilitySchema, b as ProjectRoleSchema, a as ALL_ORG_PERMISSIONS, O as OrgRoleSchema, d as PlatformPermissionSchema, e as OrgPermissionSchema } from './src.js-BYv4z3-l.js';
-import { z } from 'zod';
-
-//#region src/lib/server/api/v1/bodies.ts
-/**
-* Request-body validators for the v1 routes that take JSON.
-*
-* They live here rather than beside their handlers so the OpenAPI generator can
-* import them. A `+server.ts` imports `./$types`, which only resolves inside a
-* SvelteKit build — a spec script cannot load one. With the validators inline,
-* "the spec is derived from Zod" would have meant hand-transcribing them, which
-* is exactly the shape drift the spec is supposed to prevent: a renamed field
-* would validate one way and document another, and nothing would fail.
-*
-* **A JSON body accepted by a v1 route belongs in this file.** Adding one inline
-* is invisible to the generator, so the endpoint documents an empty body.
-* Multipart handlers are the exception — their fields are described in the spec
-* directly, since `FormData` has no Zod schema to derive from.
-*/
-var SolveBodySchema = z.object({
-	inputs: z.array(z.unknown()).default([]),
-	values: z.record(z.string(), z.unknown()).default({}),
-	channel: z.enum(["live", "draft"]).default("live"),
-	versionId: z.string().optional(),
-	/**
-	* Accepted only when it names this same definition. A caller pasting a body
-	* from `/api/v1/compute` should get a clear 400, not a silent solve of a
-	* different definition than the URL names.
-	*/
-	definitionUrl: z.string().optional()
-});
-var CreateProjectBodySchema = z.object({
-	name: z.string().min(1, "Project name is required").max(128).trim(),
-	description: z.string().max(2e3).optional(),
-	visibility: ProjectVisibilitySchema.default("private"),
-	autoJoinOnUpload: z.boolean().optional()
-});
-var UpdateProjectBodySchema = z.object({
-	name: z.string().min(1).max(128).trim(),
-	description: z.string().max(2e3).nullish(),
-	visibility: ProjectVisibilitySchema,
-	autoJoinOnUpload: z.boolean()
-}).partial();
-var AddProjectMemberBodySchema = z.object({
-	userId: z.string().min(1, "userId is required"),
-	role: ProjectRoleSchema
-});
-var UpdateProjectMemberBodySchema = z.object({ role: ProjectRoleSchema });
-/**
-* Invites accept a flat `permissions[]` from the UI; platform-scope entries are
-* dropped downstream, since an invite only grants org rights.
-*/
-var FlatPermissionSchema = z.union([PlatformPermissionSchema, OrgPermissionSchema]);
-var CreateInviteBodySchema = z.object({
-	email: z.email("Valid email is required").transform((s) => s.toLowerCase().trim()),
-	orgRole: OrgRoleSchema.default("member"),
-	permissions: z.array(FlatPermissionSchema).default([])
-});
-/**
-* Replacement set for an org's own compute servers.
-*
-* `apiKey` is tri-state and the distinction is load-bearing: **omitted** keeps
-* the stored key, **null** clears it, and a string replaces it. `.optional()`
-* plus `.nullable()` — not `.nullish()` — because the two must stay
-* distinguishable after parsing; collapsing them would silently wipe a stored
-* credential on any request that left the field out.
-*/
-var IncomingComputeServerSchema = z.object({
-	id: z.string().min(1),
-	label: z.string().min(1),
-	serverUrl: z.string().min(1),
-	apiKey: z.string().nullable().optional(),
-	timeoutMs: z.number().optional(),
-	retryCount: z.number().optional()
-});
-var OrgComputePatchBodySchema = z.object({
-	servers: z.array(IncomingComputeServerSchema),
-	/**
-	* The org's default selection. May name any server visible to the org — a
-	* shared platform server, the global default, or one of its own. `null`
-	* clears the override; omitting it leaves the current one untouched.
-	*/
-	defaultServerId: z.string().nullable().optional()
-});
-var UpdateOrgMemberBodySchema = z.object({
-	role: OrgRoleSchema.optional(),
-	permissions: z.array(z.enum(ALL_ORG_PERMISSIONS)).optional()
-}).refine((b) => b.role !== void 0 || b.permissions !== void 0, { message: "Provide at least one of role, permissions" });
-
-export { AddProjectMemberBodySchema as A, CreateProjectBodySchema as C, OrgComputePatchBodySchema as O, SolveBodySchema as S, UpdateProjectBodySchema as U, UpdateProjectMemberBodySchema as a, UpdateOrgMemberBodySchema as b, CreateInviteBodySchema as c };
-//# sourceMappingURL=bodies.js-DzvLeLhi.js.map

package/build/server/chunks/chunks/bodies.js-DzvLeLhi.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"bodies.js-DzvLeLhi.js","sources":["../../../../.svelte-kit/output/server/chunks/bodies.js"],"sourcesContent":["import { C as OrgRoleSchema, D as PlatformPermissionSchema, S as OrgPermissionSchema, g as ALL_ORG_PERMISSIONS, m as ProjectVisibilitySchema, p as ProjectRoleSchema } from \"./src.js\";\nimport { z } from \"zod\";\n//#region src/lib/server/api/v1/bodies.ts\n/**\n* Request-body validators for the v1 routes that take JSON.\n*\n* They live here rather than beside their handlers so the OpenAPI generator can\n* import them. A `+server.ts` imports `./$types`, which only resolves inside a\n* SvelteKit build — a spec script cannot load one. With the validators inline,\n* \"the spec is derived from Zod\" would have meant hand-transcribing them, which\n* is exactly the shape drift the spec is supposed to prevent: a renamed field\n* would validate one way and document another, and nothing would fail.\n*\n* **A JSON body accepted by a v1 route belongs in this file.** Adding one inline\n* is invisible to the generator, so the endpoint documents an empty body.\n* Multipart handlers are the exception — their fields are described in the spec\n* directly, since `FormData` has no Zod schema to derive from.\n*/\nvar SolveBodySchema = z.object({\n\tinputs: z.array(z.unknown()).default([]),\n\tvalues: z.record(z.string(), z.unknown()).default({}),\n\tchannel: z.enum([\"live\", \"draft\"]).default(\"live\"),\n\tversionId: z.string().optional(),\n\t/**\n\t* Accepted only when it names this same definition. A caller pasting a body\n\t* from `/api/v1/compute` should get a clear 400, not a silent solve of a\n\t* different definition than the URL names.\n\t*/\n\tdefinitionUrl: z.string().optional()\n});\nvar CreateProjectBodySchema = z.object({\n\tname: z.string().min(1, \"Project name is required\").max(128).trim(),\n\tdescription: z.string().max(2e3).optional(),\n\tvisibility: ProjectVisibilitySchema.default(\"private\"),\n\tautoJoinOnUpload: z.boolean().optional()\n});\nvar UpdateProjectBodySchema = z.object({\n\tname: z.string().min(1).max(128).trim(),\n\tdescription: z.string().max(2e3).nullish(),\n\tvisibility: ProjectVisibilitySchema,\n\tautoJoinOnUpload: z.boolean()\n}).partial();\nvar AddProjectMemberBodySchema = z.object({\n\tuserId: z.string().min(1, \"userId is required\"),\n\trole: ProjectRoleSchema\n});\nvar UpdateProjectMemberBodySchema = z.object({ role: ProjectRoleSchema });\n/**\n* Invites accept a flat `permissions[]` from the UI; platform-scope entries are\n* dropped downstream, since an invite only grants org rights.\n*/\nvar FlatPermissionSchema = z.union([PlatformPermissionSchema, OrgPermissionSchema]);\nvar CreateInviteBodySchema = z.object({\n\temail: z.email(\"Valid email is required\").transform((s) => s.toLowerCase().trim()),\n\torgRole: OrgRoleSchema.default(\"member\"),\n\tpermissions: z.array(FlatPermissionSchema).default([])\n});\n/**\n* Replacement set for an org's own compute servers.\n*\n* `apiKey` is tri-state and the distinction is load-bearing: **omitted** keeps\n* the stored key, **null** clears it, and a string replaces it. `.optional()`\n* plus `.nullable()` — not `.nullish()` — because the two must stay\n* distinguishable after parsing; collapsing them would silently wipe a stored\n* credential on any request that left the field out.\n*/\nvar IncomingComputeServerSchema = z.object({\n\tid: z.string().min(1),\n\tlabel: z.string().min(1),\n\tserverUrl: z.string().min(1),\n\tapiKey: z.string().nullable().optional(),\n\ttimeoutMs: z.number().optional(),\n\tretryCount: z.number().optional()\n});\nvar OrgComputePatchBodySchema = z.object({\n\tservers: z.array(IncomingComputeServerSchema),\n\t/**\n\t* The org's default selection. May name any server visible to the org — a\n\t* shared platform server, the global default, or one of its own. `null`\n\t* clears the override; omitting it leaves the current one untouched.\n\t*/\n\tdefaultServerId: z.string().nullable().optional()\n});\nvar UpdateOrgMemberBodySchema = z.object({\n\trole: OrgRoleSchema.optional(),\n\tpermissions: z.array(z.enum(ALL_ORG_PERMISSIONS)).optional()\n}).refine((b) => b.role !== void 0 || b.permissions !== void 0, { message: \"Provide at least one of role, permissions\" });\n//#endregion\nexport { SolveBodySchema as a, UpdateProjectMemberBodySchema as c, OrgComputePatchBodySchema as i, CreateInviteBodySchema as n, UpdateOrgMemberBodySchema as o, CreateProjectBodySchema as r, UpdateProjectBodySchema as s, AddProjectMemberBodySchema as t };\n"],"names":[],"mappings":";;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;AAC/B,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;AACzC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;AACtD,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;AACnD,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AACjC;AACA;AACA;AACA;AACA;AACA,CAAC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ;AACnC,CAAC;AACE,IAAC,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;AACvC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;AACpE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AAC5C,CAAC,UAAU,EAAE,uBAAuB,CAAC,OAAO,CAAC,SAAS,CAAC;AACvD,CAAC,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ;AACvC,CAAC;AACE,IAAC,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;AACvC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;AACxC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE;AAC3C,CAAC,UAAU,EAAE,uBAAuB;AACpC,CAAC,gBAAgB,EAAE,CAAC,CAAC,OAAO;AAC5B,CAAC,CAAC,CAAC,OAAO;AACP,IAAC,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;AAC1C,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,oBAAoB,CAAC;AAChD,CAAC,IAAI,EAAE;AACP,CAAC;AACE,IAAC,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE;AACxE;AACA;AACA;AACA;AACA,IAAI,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,wBAAwB,EAAE,mBAAmB,CAAC,CAAC;AAChF,IAAC,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;AACtC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;AACnF,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC;AACzC,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,EAAE;AACtD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;AAC3C,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AACtB,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AACzB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7B,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AACzC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AACjC,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ;AAChC,CAAC,CAAC;AACC,IAAC,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;AACzC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC;AAC9C;AACA;AACA;AACA;AACA;AACA,CAAC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ;AAChD,CAAC;AACE,IAAC,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;AACzC,CAAC,IAAI,EAAE,aAAa,CAAC,QAAQ,EAAE;AAC/B,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,QAAQ;AAC3D,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,MAAM,EAAE,EAAE,OAAO,EAAE,2CAA2C,EAAE;;;;"}

package/build/server/chunks/chunks/bootHealth.server.js-CEL0mD5n.js

@@ -1,91 +0,0 @@
-import { p as providers, g as getLogger, r as renderThrown } from './providers.server.js-fp7jQgxZ.js';
-
-//#region src/lib/server/bootHealth.server.ts
-var cached = null;
-var inflight = null;
-async function run() {
-	let atRestSecrets = null;
-	const store = providers.data.computeServer;
-	if (typeof store.verifySecrets === "function") try {
-		atRestSecrets = await store.verifySecrets();
-	} catch (err) {
-		getLogger().error("verifySecrets threw — treating as failure", {
-			component: "boot",
-			err: renderThrown(err)
-		});
-		atRestSecrets = {
-			ok: false,
-			plaintextFound: false,
-			failures: [{
-				serverId: "(unknown)",
-				serverLabel: "(unknown)",
-				reason: "key_mismatch",
-				cause: err instanceof Error ? err.message : String(err)
-			}]
-		};
-	}
-	if (atRestSecrets && !atRestSecrets.ok) {
-		for (const f of atRestSecrets.failures) getLogger().error("At-rest secret verification failed for compute server", {
-			component: "boot",
-			serverLabel: f.serverLabel,
-			serverId: f.serverId,
-			reason: f.reason,
-			cause: f.cause
-		});
-		getLogger().error("At-rest secret verification failed. /api/health will return 503. Recover by re-entering the affected apiKeys via /admin/compute, or by restoring the original SELVA_AT_REST_KEY. See docs/Troubleshooting.md.", { component: "boot" });
-	}
-	let schemaVersion = null;
-	const data = providers.data;
-	if (typeof data.verifySchemaVersion === "function") try {
-		schemaVersion = await data.verifySchemaVersion();
-	} catch (err) {
-		getLogger().error("verifySchemaVersion threw — treating as failure", {
-			component: "boot",
-			err: renderThrown(err)
-		});
-		schemaVersion = {
-			ok: false,
-			expected: "(unknown)",
-			actual: null,
-			message: err instanceof Error ? err.message : String(err)
-		};
-	}
-	if (schemaVersion && !schemaVersion.ok) getLogger().error("Database schema handshake failed. /api/health will return 503.", {
-		component: "boot",
-		expected: schemaVersion.expected,
-		actual: schemaVersion.actual ?? "unavailable",
-		detail: schemaVersion.message
-	});
-	return {
-		checkedAt: (/* @__PURE__ */ new Date()).toISOString(),
-		atRestSecrets,
-		schemaVersion
-	};
-}
-/**
-* Returns the cached boot health report. Runs the underlying checks at most
-* once — subsequent callers receive the same result. Safe to call from many
-* routes concurrently; in-flight callers share a single promise.
-*
-* The report does NOT auto-refresh after an operator fixes the underlying
-* issue. Restart the process to re-run the boot check. (Conscious choice:
-* boot health represents the state at boot, by definition.)
-*/
-function getBootHealth() {
-	if (cached) return Promise.resolve(cached);
-	if (inflight) return inflight;
-	inflight = run().then((result) => {
-		cached = result;
-		inflight = null;
-		return result;
-	});
-	return inflight;
-}
-function isDegraded(report) {
-	if (report.atRestSecrets !== null && !report.atRestSecrets.ok) return true;
-	if (report.schemaVersion !== null && !report.schemaVersion.ok) return true;
-	return false;
-}
-
-export { getBootHealth as g, isDegraded as i };
-//# sourceMappingURL=bootHealth.server.js-CEL0mD5n.js.map

package/build/server/chunks/chunks/bootHealth.server.js-CEL0mD5n.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"bootHealth.server.js-CEL0mD5n.js","sources":["../../../../.svelte-kit/output/server/chunks/bootHealth.server.js"],"sourcesContent":["import { C as providers, T as renderThrown, f as getLogger } from \"./providers.server.js\";\n//#region src/lib/server/bootHealth.server.ts\nvar cached = null;\nvar inflight = null;\nasync function run() {\n\tlet atRestSecrets = null;\n\tconst store = providers.data.computeServer;\n\tif (typeof store.verifySecrets === \"function\") try {\n\t\tatRestSecrets = await store.verifySecrets();\n\t} catch (err) {\n\t\tgetLogger().error(\"verifySecrets threw — treating as failure\", {\n\t\t\tcomponent: \"boot\",\n\t\t\terr: renderThrown(err)\n\t\t});\n\t\tatRestSecrets = {\n\t\t\tok: false,\n\t\t\tplaintextFound: false,\n\t\t\tfailures: [{\n\t\t\t\tserverId: \"(unknown)\",\n\t\t\t\tserverLabel: \"(unknown)\",\n\t\t\t\treason: \"key_mismatch\",\n\t\t\t\tcause: err instanceof Error ? err.message : String(err)\n\t\t\t}]\n\t\t};\n\t}\n\tif (atRestSecrets && !atRestSecrets.ok) {\n\t\tfor (const f of atRestSecrets.failures) getLogger().error(\"At-rest secret verification failed for compute server\", {\n\t\t\tcomponent: \"boot\",\n\t\t\tserverLabel: f.serverLabel,\n\t\t\tserverId: f.serverId,\n\t\t\treason: f.reason,\n\t\t\tcause: f.cause\n\t\t});\n\t\tgetLogger().error(\"At-rest secret verification failed. /api/health will return 503. Recover by re-entering the affected apiKeys via /admin/compute, or by restoring the original SELVA_AT_REST_KEY. See docs/Troubleshooting.md.\", { component: \"boot\" });\n\t}\n\tlet schemaVersion = null;\n\tconst data = providers.data;\n\tif (typeof data.verifySchemaVersion === \"function\") try {\n\t\tschemaVersion = await data.verifySchemaVersion();\n\t} catch (err) {\n\t\tgetLogger().error(\"verifySchemaVersion threw — treating as failure\", {\n\t\t\tcomponent: \"boot\",\n\t\t\terr: renderThrown(err)\n\t\t});\n\t\tschemaVersion = {\n\t\t\tok: false,\n\t\t\texpected: \"(unknown)\",\n\t\t\tactual: null,\n\t\t\tmessage: err instanceof Error ? err.message : String(err)\n\t\t};\n\t}\n\tif (schemaVersion && !schemaVersion.ok) getLogger().error(\"Database schema handshake failed. /api/health will return 503.\", {\n\t\tcomponent: \"boot\",\n\t\texpected: schemaVersion.expected,\n\t\tactual: schemaVersion.actual ?? \"unavailable\",\n\t\tdetail: schemaVersion.message\n\t});\n\treturn {\n\t\tcheckedAt: (/* @__PURE__ */ new Date()).toISOString(),\n\t\tatRestSecrets,\n\t\tschemaVersion\n\t};\n}\n/**\n* Returns the cached boot health report. Runs the underlying checks at most\n* once — subsequent callers receive the same result. Safe to call from many\n* routes concurrently; in-flight callers share a single promise.\n*\n* The report does NOT auto-refresh after an operator fixes the underlying\n* issue. Restart the process to re-run the boot check. (Conscious choice:\n* boot health represents the state at boot, by definition.)\n*/\nfunction getBootHealth() {\n\tif (cached) return Promise.resolve(cached);\n\tif (inflight) return inflight;\n\tinflight = run().then((result) => {\n\t\tcached = result;\n\t\tinflight = null;\n\t\treturn result;\n\t});\n\treturn inflight;\n}\nfunction isDegraded(report) {\n\tif (report.atRestSecrets !== null && !report.atRestSecrets.ok) return true;\n\tif (report.schemaVersion !== null && !report.schemaVersion.ok) return true;\n\treturn false;\n}\n//#endregion\nexport { isDegraded as n, getBootHealth as t };\n"],"names":[],"mappings":";;AACA;AACA,IAAI,MAAM,GAAG,IAAI;AACjB,IAAI,QAAQ,GAAG,IAAI;AACnB,eAAe,GAAG,GAAG;AACrB,CAAC,IAAI,aAAa,GAAG,IAAI;AACzB,CAAC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa;AAC3C,CAAC,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,UAAU,EAAE,IAAI;AACpD,EAAE,aAAa,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;AAC7C,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,2CAA2C,EAAE;AACjE,GAAG,SAAS,EAAE,MAAM;AACpB,GAAG,GAAG,EAAE,YAAY,CAAC,GAAG;AACxB,GAAG,CAAC;AACJ,EAAE,aAAa,GAAG;AAClB,GAAG,EAAE,EAAE,KAAK;AACZ,GAAG,cAAc,EAAE,KAAK;AACxB,GAAG,QAAQ,EAAE,CAAC;AACd,IAAI,QAAQ,EAAE,WAAW;AACzB,IAAI,WAAW,EAAE,WAAW;AAC5B,IAAI,MAAM,EAAE,cAAc;AAC1B,IAAI,KAAK,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG;AAC1D,IAAI;AACJ,GAAG;AACH,CAAC;AACD,CAAC,IAAI,aAAa,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE;AACzC,EAAE,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,uDAAuD,EAAE;AACrH,GAAG,SAAS,EAAE,MAAM;AACpB,GAAG,WAAW,EAAE,CAAC,CAAC,WAAW;AAC7B,GAAG,QAAQ,EAAE,CAAC,CAAC,QAAQ;AACvB,GAAG,MAAM,EAAE,CAAC,CAAC,MAAM;AACnB,GAAG,KAAK,EAAE,CAAC,CAAC;AACZ,GAAG,CAAC;AACJ,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,+MAA+M,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC3P,CAAC;AACD,CAAC,IAAI,aAAa,GAAG,IAAI;AACzB,CAAC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI;AAC5B,CAAC,IAAI,OAAO,IAAI,CAAC,mBAAmB,KAAK,UAAU,EAAE,IAAI;AACzD,EAAE,aAAa,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE;AAClD,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,iDAAiD,EAAE;AACvE,GAAG,SAAS,EAAE,MAAM;AACpB,GAAG,GAAG,EAAE,YAAY,CAAC,GAAG;AACxB,GAAG,CAAC;AACJ,EAAE,aAAa,GAAG;AAClB,GAAG,EAAE,EAAE,KAAK;AACZ,GAAG,QAAQ,EAAE,WAAW;AACxB,GAAG,MAAM,EAAE,IAAI;AACf,GAAG,OAAO,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG;AAC3D,GAAG;AACH,CAAC;AACD,CAAC,IAAI,aAAa,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,gEAAgE,EAAE;AAC7H,EAAE,SAAS,EAAE,MAAM;AACnB,EAAE,QAAQ,EAAE,aAAa,CAAC,QAAQ;AAClC,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,IAAI,aAAa;AAC/C,EAAE,MAAM,EAAE,aAAa,CAAC;AACxB,EAAE,CAAC;AACH,CAAC,OAAO;AACR,EAAE,SAAS,EAAE,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACvD,EAAE,aAAa;AACf,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,GAAG;AACzB,CAAC,IAAI,MAAM,EAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;AAC3C,CAAC,IAAI,QAAQ,EAAE,OAAO,QAAQ;AAC9B,CAAC,QAAQ,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK;AACnC,EAAE,MAAM,GAAG,MAAM;AACjB,EAAE,QAAQ,GAAG,IAAI;AACjB,EAAE,OAAO,MAAM;AACf,CAAC,CAAC,CAAC;AACH,CAAC,OAAO,QAAQ;AAChB;AACA,SAAS,UAAU,CAAC,MAAM,EAAE;AAC5B,CAAC,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,OAAO,IAAI;AAC3E,CAAC,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,OAAO,IAAI;AAC3E,CAAC,OAAO,KAAK;AACb;;;;"}

package/build/server/chunks/chunks/client.js-GlRgK4_2.js

@@ -1,59 +0,0 @@
-import { i as index_server_exports } from './index-server.js-DFIilocN.js';
-import './shared.js-D_dBLhOy.js';
-import './exports.js-C83MWXaG.js';
-import './routing.js-D3NKIXme.js';
-import { n as noop } from './server.js-dCqO-ZSb.js';
-import './internal2.js-DEPp3-OG.js';
-import '@sveltejs/kit/internal/server';
-import '@sveltejs/kit/internal';
-
-var is_legacy = noop.toString().includes("$$") || /function \w+\(\) \{\}/.test(noop.toString());
-var placeholder_url = "a:";
-if (is_legacy) {
-	({
-		data: {},
-		form: null,
-		error: null,
-		params: {},
-		route: { id: null },
-		state: {},
-		status: -1,
-		url: new URL(placeholder_url)
-	});
-}
-//#endregion
-//#region ../../node_modules/.pnpm/@sveltejs+kit@2.70.1_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.2.0_svelte_f075b7c16fa9692fcf0544233d562474/node_modules/@sveltejs/kit/src/runtime/client/client.js
-/** @import { RemoteFunctionDataNode, ServerNodesResponse, ServerRedirectNode } from 'types' */
-/** @import { CacheEntry } from './remote-functions/cache.svelte.js' */
-/** @import { Query } from './remote-functions/query/instance.svelte.js' */
-/** @import { LiveQuery } from './remote-functions/query-live/instance.svelte.js' */
-var { onMount, tick } = index_server_exports;
-/**
-* Allows you to navigate programmatically to a given route, with options such as keeping the current element focused.
-* Returns a Promise that resolves when SvelteKit navigates (or fails to navigate, in which case the promise rejects) to the specified `url`.
-*
-* For external URLs, use `window.location = url` instead of calling `goto(url)`.
-*
-* @param {string | URL} url Where to navigate to. Note that if you've set [`config.kit.paths.base`](https://svelte.dev/docs/kit/configuration#paths) and the URL is root-relative, you need to prepend the base path if you want to navigate within the app.
-* @param {Object} [opts] Options related to the navigation
-* @param {boolean} [opts.replaceState] If `true`, will replace the current `history` entry rather than creating a new one with `pushState`
-* @param {boolean} [opts.noScroll] If `true`, the browser will maintain its scroll position rather than scrolling to the top of the page after navigation
-* @param {boolean} [opts.keepFocus] If `true`, the currently focused element will retain focus after navigation. Otherwise, focus will be reset to the body
-* @param {boolean} [opts.invalidateAll] If `true`, all `load` functions of the page will be rerun. See https://svelte.dev/docs/kit/load#rerunning-load-functions for more info on invalidation.
-* @param {Array<string | URL | ((url: URL) => boolean)>} [opts.invalidate] Causes any load functions to re-run if they depend on one of the urls
-* @param {App.PageState} [opts.state] An optional object that will be available as `page.state`
-* @returns {Promise<void>}
-*/
-function goto(url, opts = {}) {
-	throw new Error("Cannot call goto(...) on the server");
-}
-/**
-* Causes all `load` and `query` functions belonging to the currently active page to re-run. Returns a `Promise` that resolves when the page is subsequently updated.
-* @returns {Promise<void>}
-*/
-function invalidateAll() {
-	throw new Error("Cannot call invalidateAll() on the server");
-}
-
-export { goto as g, invalidateAll as i };
-//# sourceMappingURL=client.js-GlRgK4_2.js.map

package/build/server/chunks/chunks/client.js-GlRgK4_2.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.js-GlRgK4_2.js","sources":["../../../../.svelte-kit/output/server/chunks/client.js"],"sourcesContent":["import { t as index_server_exports } from \"./index-server.js\";\nimport { x as noop } from \"./shared.js\";\nimport \"./internal.js\";\nimport \"./exports.js\";\nimport \"./routing.js\";\nimport { Ct as noop$1, N as writable } from \"./server.js\";\nimport \"./paths.js\";\nimport \"@sveltejs/kit/internal\";\nvar PRELOAD_PRIORITIES = {\n\ttap: 1,\n\thover: 2,\n\tviewport: 3,\n\teager: 4,\n\toff: -1,\n\tfalse: -1\n};\n({ ...PRELOAD_PRIORITIES }), PRELOAD_PRIORITIES.hover;\n/** @param {any} value */\nfunction notifiable_store(value) {\n\tconst store = writable(value);\n\tlet ready = true;\n\tfunction notify() {\n\t\tready = true;\n\t\tstore.update((val) => val);\n\t}\n\t/** @param {any} new_value */\n\tfunction set(new_value) {\n\t\tready = false;\n\t\tstore.set(new_value);\n\t}\n\t/** @param {(value: any) => void} run */\n\tfunction subscribe(run) {\n\t\t/** @type {any} */\n\t\tlet old_value;\n\t\treturn store.subscribe((new_value) => {\n\t\t\tif (old_value === void 0 || ready && new_value !== old_value) run(old_value = new_value);\n\t\t});\n\t}\n\treturn {\n\t\tnotify,\n\t\tset,\n\t\tsubscribe\n\t};\n}\nvar updated_listener = { v: noop };\nfunction create_updated_store() {\n\tconst { set, subscribe } = writable(false);\n\treturn {\n\t\tsubscribe,\n\t\tcheck: async () => false\n\t};\n}\n//#endregion\n//#region ../../node_modules/.pnpm/@sveltejs+kit@2.70.1_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.2.0_svelte_f075b7c16fa9692fcf0544233d562474/node_modules/@sveltejs/kit/src/runtime/client/state.svelte.js\nvar page;\nvar navigating;\nvar updated;\nvar is_legacy = noop$1.toString().includes(\"$$\") || /function \\w+\\(\\) \\{\\}/.test(noop$1.toString());\nvar placeholder_url = \"a:\";\nif (is_legacy) {\n\tpage = {\n\t\tdata: {},\n\t\tform: null,\n\t\terror: null,\n\t\tparams: {},\n\t\troute: { id: null },\n\t\tstate: {},\n\t\tstatus: -1,\n\t\turl: new URL(placeholder_url)\n\t};\n\tnavigating = { current: null };\n\tupdated = { current: false };\n} else {\n\tpage = new class Page {\n\t\tdata = {};\n\t\tform = null;\n\t\terror = null;\n\t\tparams = {};\n\t\troute = { id: null };\n\t\tstate = {};\n\t\tstatus = -1;\n\t\turl = new URL(placeholder_url);\n\t}();\n\tnavigating = new class Navigating {\n\t\tcurrent = null;\n\t}();\n\tupdated = new class Updated {\n\t\tcurrent = false;\n\t}();\n\tupdated_listener.v = () => updated.current = true;\n}\n//#endregion\n//#region ../../node_modules/.pnpm/@sveltejs+kit@2.70.1_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.2.0_svelte_f075b7c16fa9692fcf0544233d562474/node_modules/@sveltejs/kit/src/runtime/client/client.js\n/** @import { RemoteFunctionDataNode, ServerNodesResponse, ServerRedirectNode } from 'types' */\n/** @import { CacheEntry } from './remote-functions/cache.svelte.js' */\n/** @import { Query } from './remote-functions/query/instance.svelte.js' */\n/** @import { LiveQuery } from './remote-functions/query-live/instance.svelte.js' */\nvar { onMount, tick } = index_server_exports;\nvar stores = {\n\turl: /* @__PURE__ */ notifiable_store({}),\n\tpage: /* @__PURE__ */ notifiable_store({}),\n\tnavigating: /* @__PURE__ */ writable(null),\n\tupdated: /* @__PURE__ */ create_updated_store()\n};\n/**\n* Allows you to navigate programmatically to a given route, with options such as keeping the current element focused.\n* Returns a Promise that resolves when SvelteKit navigates (or fails to navigate, in which case the promise rejects) to the specified `url`.\n*\n* For external URLs, use `window.location = url` instead of calling `goto(url)`.\n*\n* @param {string | URL} url Where to navigate to. Note that if you've set [`config.kit.paths.base`](https://svelte.dev/docs/kit/configuration#paths) and the URL is root-relative, you need to prepend the base path if you want to navigate within the app.\n* @param {Object} [opts] Options related to the navigation\n* @param {boolean} [opts.replaceState] If `true`, will replace the current `history` entry rather than creating a new one with `pushState`\n* @param {boolean} [opts.noScroll] If `true`, the browser will maintain its scroll position rather than scrolling to the top of the page after navigation\n* @param {boolean} [opts.keepFocus] If `true`, the currently focused element will retain focus after navigation. Otherwise, focus will be reset to the body\n* @param {boolean} [opts.invalidateAll] If `true`, all `load` functions of the page will be rerun. See https://svelte.dev/docs/kit/load#rerunning-load-functions for more info on invalidation.\n* @param {Array<string | URL | ((url: URL) => boolean)>} [opts.invalidate] Causes any load functions to re-run if they depend on one of the urls\n* @param {App.PageState} [opts.state] An optional object that will be available as `page.state`\n* @returns {Promise<void>}\n*/\nfunction goto(url, opts = {}) {\n\tthrow new Error(\"Cannot call goto(...) on the server\");\n}\n/**\n* Causes all `load` and `query` functions belonging to the currently active page to re-run. Returns a `Promise` that resolves when the page is subsequently updated.\n* @returns {Promise<void>}\n*/\nfunction invalidateAll() {\n\tthrow new Error(\"Cannot call invalidateAll() on the server\");\n}\n//#endregion\nexport { page as a, navigating as i, invalidateAll as n, updated as o, stores as r, goto as t };\n"],"names":["noop$1"],"mappings":";;;;;;;;;AAyDA,IAAI,SAAS,GAAGA,IAAM,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAACA,IAAM,CAAC,QAAQ,EAAE,CAAC;AACnG,IAAI,eAAe,GAAG,IAAI;AAC1B,IAAI,SAAS,EAAE;AACf,EAAQ;AACR,EAAE,IAAI,EAAE,EAAE;AACV,EAAE,IAAI,EAAE,IAAI;AACZ,EAAE,KAAK,EAAE,IAAI;AACb,EAAE,MAAM,EAAE,EAAE;AACZ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;AACrB,EAAE,KAAK,EAAE,EAAE;AACX,EAAE,MAAM,EAAE,EAAE;AACZ,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,eAAe;AAC9B,GAAE;AAGF;AAmBA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,oBAAoB;AAO5C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,IAAI,CAAC,GAAG,EAAE,IAAI,GAAG,EAAE,EAAE;AAC9B,CAAC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC;AACvD;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,GAAG;AACzB,CAAC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC;AAC7D;;;;"}

package/build/server/chunks/chunks/compute.js-DVGVezz4.js

@@ -1,284 +0,0 @@
-import './src.js-BYv4z3-l.js';
-import { N as NoopLogger } from './limits.js-I-HAqbOg.js';
-import { lookup } from 'node:dns/promises';
-import { isIP } from 'node:net';
-
-//#region ../server/src/compute/safe-url.ts
-/**
-* SSRF guard for `loadRemoteDefinition`. Without it an authenticated user could
-* submit `http://169.254.169.254/...` (cloud metadata) or any intranet endpoint
-* and the server would fetch it on their behalf.
-*
-* Two layers:
-*
-*   1. `isSafeRemoteDefinitionUrl` — synchronous literal pre-filter. Rejects
-*      protocol, hostname literals, and every IP *encoding* that maps to a
-*      blocked address (dotted-decimal, integer, octal, hex, short-form,
-*      IPv4-mapped IPv6). Fast and DNS-free; safe to call anywhere.
-*
-*   2. `assertSafeRemoteDefinitionUrl` — resolves the hostname via DNS and
-*      re-checks the *resolved* IP. This is the real defense: it catches a
-*      public name that resolves to a private IP, which the literal filter
-*      can't see. Still not bulletproof against rebinding (the IP can change
-*      between this lookup and fetch's own); for that the caller would have to
-*      connect to the resolved IP directly. Connecting by IP is a larger change
-*      — this closes the practical bypasses (literal encodings + a DNS record
-*      that points inward) which is what an attacker actually reaches for.
-*/
-/**
-* True when `ip` (a normalized IPv4 or IPv6 literal from `isIP`/`dns.lookup`)
-* is loopback, private, link-local, or otherwise must-not-fetch. IPv4-mapped
-* IPv6 (`::ffff:a.b.c.d`) is unwrapped to its embedded IPv4 first so the v4
-* rules apply.
-*/
-function isBlockedIp(ip) {
-	let addr = ip.toLowerCase();
-	const mappedDotted = /^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/.exec(addr);
-	if (mappedDotted) addr = mappedDotted[1];
-	else {
-		const mappedHex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(addr);
-		if (mappedHex) {
-			const hi = parseInt(mappedHex[1], 16);
-			const lo = parseInt(mappedHex[2], 16);
-			addr = [
-				hi >> 8 & 255,
-				hi & 255,
-				lo >> 8 & 255,
-				lo & 255
-			].join(".");
-		}
-	}
-	if (isIP(addr) === 4) {
-		const octets = addr.split(".").map(Number);
-		if (octets.length !== 4 || octets.some((o) => o > 255)) return true;
-		const [a, b] = octets;
-		if (a === 0) return true;
-		if (a === 127) return true;
-		if (a === 10) return true;
-		if (a === 192 && b === 168) return true;
-		if (a === 172 && b >= 16 && b <= 31) return true;
-		if (a === 169 && b === 254) return true;
-		return false;
-	}
-	if (addr === "::1" || addr === "::") return true;
-	if (/^(fc|fd)[0-9a-f]{0,2}:/.test(addr)) return true;
-	if (/^fe[89ab][0-9a-f]:/.test(addr)) return true;
-	return false;
-}
-/**
-* Parse a bare-IPv4 hostname in any encoding browsers/glibc accept — integer
-* (`2130706433`), octal (`0177.0.0.1`), hex (`0x7f000001`), and short forms
-* (`127.1`) — into a canonical dotted-decimal string. Returns null when the
-* host is not a numeric IPv4 literal (i.e. it's a real name or already-valid
-* dotted-quad, which callers handle separately).
-*/
-function canonicalizeNumericIpv4(host) {
-	if (isIP(host) === 4) return host;
-	const rawParts = host.split(".");
-	if (rawParts.length === 0 || rawParts.length > 4) return null;
-	const parseUInt = (s) => {
-		if (s === "") return null;
-		let n;
-		if (/^0x[0-9a-f]+$/i.test(s)) n = parseInt(s, 16);
-		else if (/^0[0-7]+$/.test(s)) n = parseInt(s, 8);
-		else if (/^[0-9]+$/.test(s)) n = parseInt(s, 10);
-		else return null;
-		return Number.isFinite(n) ? n : null;
-	};
-	const nums = rawParts.map(parseUInt);
-	if (nums.some((n) => n === null)) return null;
-	const parts = nums;
-	let value;
-	switch (parts.length) {
-		case 1:
-			value = parts[0];
-			break;
-		case 2:
-			if (parts[0] > 255 || parts[1] > 16777215) return null;
-			value = parts[0] << 24 | parts[1];
-			break;
-		case 3:
-			if (parts[0] > 255 || parts[1] > 255 || parts[2] > 65535) return null;
-			value = parts[0] << 24 | parts[1] << 16 | parts[2];
-			break;
-		default:
-			if (parts.some((p) => p > 255)) return null;
-			value = parts[0] << 24 | parts[1] << 16 | parts[2] << 8 | parts[3];
-	}
-	value = value >>> 0;
-	if (value > 4294967295) return null;
-	return [
-		value >>> 24 & 255,
-		value >>> 16 & 255,
-		value >>> 8 & 255,
-		value & 255
-	].join(".");
-}
-/**
-* Synchronous literal pre-filter. Rejects bad schemes, loopback hostnames, and
-* any IP literal (in any encoding) that resolves to a blocked address. Does NOT
-* perform DNS — a public *name* that points at a private IP passes here and is
-* caught by `assertSafeRemoteDefinitionUrl`.
-*/
-function isSafeRemoteDefinitionUrl(raw) {
-	let parsed;
-	try {
-		parsed = new URL(raw);
-	} catch {
-		return false;
-	}
-	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return false;
-	let host = parsed.hostname.toLowerCase();
-	if (!host) return false;
-	if (host === "localhost" || host.endsWith(".localhost")) return false;
-	if (host.startsWith("[") && host.endsWith("]")) host = host.slice(1, -1);
-	if (isIP(host) === 6) return !isBlockedIp(host);
-	const canonical = canonicalizeNumericIpv4(host);
-	if (canonical) return !isBlockedIp(canonical);
-	return true;
-}
-/**
-* Full SSRF check: literal pre-filter, then resolve every A/AAAA record and
-* reject if *any* resolved IP is blocked. Returns the original URL on success
-* so callers can `await assertSafeRemoteDefinitionUrl(url)` inline. Throws on
-* any rejection.
-*/
-async function assertSafeRemoteDefinitionUrl(raw, logger = new NoopLogger()) {
-	if (!isSafeRemoteDefinitionUrl(raw)) {
-		logger.warn("Blocked remote definition URL", {
-			component: "Compute/ssrf",
-			reason: "literal-filter",
-			host: hostOf(raw)
-		});
-		throw new Error("Remote definition URL is not allowed");
-	}
-	const host = new URL(raw).hostname.toLowerCase().replace(/^\[|\]$/g, "");
-	if (isIP(host) !== 0 || canonicalizeNumericIpv4(host)) return raw;
-	let resolved;
-	try {
-		resolved = await lookup(host, { all: true });
-	} catch {
-		logger.warn("Blocked remote definition URL", {
-			component: "Compute/ssrf",
-			reason: "dns-lookup-failed",
-			host
-		});
-		throw new Error("Remote definition URL is not allowed");
-	}
-	if (resolved.length === 0 || resolved.some((r) => isBlockedIp(r.address))) {
-		const blocked = resolved.filter((r) => isBlockedIp(r.address)).map((r) => r.address);
-		logger.warn("Blocked remote definition URL", {
-			component: "Compute/ssrf",
-			reason: "resolves-to-blocked-ip",
-			host,
-			blockedIps: blocked
-		});
-		throw new Error("Remote definition URL is not allowed");
-	}
-	return raw;
-}
-/** Best-effort hostname for logging; falls back to a truncated raw string. */
-function hostOf(raw) {
-	try {
-		return new URL(raw).hostname;
-	} catch {
-		return raw.slice(0, 120);
-	}
-}
-//#endregion
-//#region ../server/src/compute/remote-definition.ts
-/**
-* Remote-definition fetch: SSRF-guarded, size-capped, timed, and TTL-cached.
-*
-* A solve can reference its `.gh` by remote URL instead of a stored blob. That
-* URL is attacker-controllable (a share-token caller supplies `definitionUrl`),
-* so every fetch runs through {@link assertSafeRemoteDefinitionUrl} (literal +
-* DNS host validation, blocking private/loopback/link-local targets and
-* literal-encoding bypasses), streams the body with an early size cap, and
-* bounds the wall time with a deadline.
-*
-* The TTL cache is a per-fetcher `Map<url, {data, fetchedAt}>` so repeated
-* solves of the same remote definition skip the network. It's created by
-* {@link createRemoteDefinitionFetcher} rather than being module-global, so a
-* consuming app can hold one fetcher per process (the app binding does) or
-* several isolated ones (tests) without shared state leaking across them.
-*/
-/** Once the cache exceeds this many entries, evict the oldest 10 by `fetchedAt`. */
-var CACHE_MAX_ENTRIES = 50;
-var CACHE_EVICT_BATCH = 10;
-/**
-* Read a response body into memory, aborting (and throwing) as soon as the
-* running byte total exceeds `maxBytes`. Falls back to `arrayBuffer()` only when
-* the body isn't a readable stream (older fetch impls). Exported for direct use
-* and reuse; the fetcher below wraps it with SSRF + TTL.
-*/
-async function readBodyWithCap(response, maxBytes, controller) {
-	if (!response.body) {
-		const buffer = await response.arrayBuffer();
-		if (buffer.byteLength > maxBytes) throw new Error("Remote definition exceeds size limit");
-		return new Uint8Array(buffer);
-	}
-	const reader = response.body.getReader();
-	const chunks = [];
-	let total = 0;
-	while (true) {
-		const { done, value } = await reader.read();
-		if (done) break;
-		total += value.byteLength;
-		if (total > maxBytes) {
-			controller.abort();
-			throw new Error("Remote definition exceeds size limit");
-		}
-		chunks.push(value);
-	}
-	const out = new Uint8Array(total);
-	let offset = 0;
-	for (const chunk of chunks) {
-		out.set(chunk, offset);
-		offset += chunk.byteLength;
-	}
-	return out;
-}
-/**
-* Build a remote-definition fetcher owning its own TTL cache. Each fetcher's
-* cache is independent, so one per process shares warm bytes while test fetchers
-* stay isolated.
-*/
-function createRemoteDefinitionFetcher(config) {
-	const cache = /* @__PURE__ */ new Map();
-	const logger = config.logger ?? new NoopLogger();
-	return { async load(url) {
-		await assertSafeRemoteDefinitionUrl(url, logger);
-		const now = config.now();
-		const cached = cache.get(url);
-		if (cached && now - cached.fetchedAt < config.cacheTtlMs) return cached.data;
-		const controller = new AbortController();
-		const timeout = setTimeout(() => controller.abort(), config.fetchTimeoutMs);
-		let data;
-		try {
-			const response = await fetch(url, {
-				signal: controller.signal,
-				redirect: "error"
-			});
-			if (!response.ok) throw new Error(`HTTP ${response.status}: ${response.statusText}`);
-			const declared = Number(response.headers.get("content-length"));
-			if (Number.isFinite(declared) && declared > config.maxBytes) throw new Error("Remote definition exceeds size limit");
-			data = await readBodyWithCap(response, config.maxBytes, controller);
-		} finally {
-			clearTimeout(timeout);
-		}
-		cache.set(url, {
-			data,
-			fetchedAt: now
-		});
-		if (cache.size > CACHE_MAX_ENTRIES) {
-			const entries = Array.from(cache.entries());
-			entries.sort((a, b) => a[1].fetchedAt - b[1].fetchedAt);
-			for (let i = 0; i < CACHE_EVICT_BATCH; i++) cache.delete(entries[i][0]);
-		}
-		return data;
-	} };
-}
-
-export { createRemoteDefinitionFetcher as c };
-//# sourceMappingURL=compute.js-DVGVezz4.js.map

package/build/server/chunks/chunks/compute.js-DVGVezz4.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"compute.js-DVGVezz4.js","sources":["../../../../.svelte-kit/output/server/chunks/compute.js"],"sourcesContent":["import \"./src.js\";\nimport { r as NoopLogger } from \"./limits.js\";\nimport { lookup } from \"node:dns/promises\";\nimport { isIP } from \"node:net\";\n//#region ../server/src/compute/safe-url.ts\n/**\n* SSRF guard for `loadRemoteDefinition`. Without it an authenticated user could\n* submit `http://169.254.169.254/...` (cloud metadata) or any intranet endpoint\n* and the server would fetch it on their behalf.\n*\n* Two layers:\n*\n*   1. `isSafeRemoteDefinitionUrl` — synchronous literal pre-filter. Rejects\n*      protocol, hostname literals, and every IP *encoding* that maps to a\n*      blocked address (dotted-decimal, integer, octal, hex, short-form,\n*      IPv4-mapped IPv6). Fast and DNS-free; safe to call anywhere.\n*\n*   2. `assertSafeRemoteDefinitionUrl` — resolves the hostname via DNS and\n*      re-checks the *resolved* IP. This is the real defense: it catches a\n*      public name that resolves to a private IP, which the literal filter\n*      can't see. Still not bulletproof against rebinding (the IP can change\n*      between this lookup and fetch's own); for that the caller would have to\n*      connect to the resolved IP directly. Connecting by IP is a larger change\n*      — this closes the practical bypasses (literal encodings + a DNS record\n*      that points inward) which is what an attacker actually reaches for.\n*/\n/**\n* True when `ip` (a normalized IPv4 or IPv6 literal from `isIP`/`dns.lookup`)\n* is loopback, private, link-local, or otherwise must-not-fetch. IPv4-mapped\n* IPv6 (`::ffff:a.b.c.d`) is unwrapped to its embedded IPv4 first so the v4\n* rules apply.\n*/\nfunction isBlockedIp(ip) {\n\tlet addr = ip.toLowerCase();\n\tconst mappedDotted = /^::ffff:(\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})$/.exec(addr);\n\tif (mappedDotted) addr = mappedDotted[1];\n\telse {\n\t\tconst mappedHex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(addr);\n\t\tif (mappedHex) {\n\t\t\tconst hi = parseInt(mappedHex[1], 16);\n\t\t\tconst lo = parseInt(mappedHex[2], 16);\n\t\t\taddr = [\n\t\t\t\thi >> 8 & 255,\n\t\t\t\thi & 255,\n\t\t\t\tlo >> 8 & 255,\n\t\t\t\tlo & 255\n\t\t\t].join(\".\");\n\t\t}\n\t}\n\tif (isIP(addr) === 4) {\n\t\tconst octets = addr.split(\".\").map(Number);\n\t\tif (octets.length !== 4 || octets.some((o) => o > 255)) return true;\n\t\tconst [a, b] = octets;\n\t\tif (a === 0) return true;\n\t\tif (a === 127) return true;\n\t\tif (a === 10) return true;\n\t\tif (a === 192 && b === 168) return true;\n\t\tif (a === 172 && b >= 16 && b <= 31) return true;\n\t\tif (a === 169 && b === 254) return true;\n\t\treturn false;\n\t}\n\tif (addr === \"::1\" || addr === \"::\") return true;\n\tif (/^(fc|fd)[0-9a-f]{0,2}:/.test(addr)) return true;\n\tif (/^fe[89ab][0-9a-f]:/.test(addr)) return true;\n\treturn false;\n}\n/**\n* Parse a bare-IPv4 hostname in any encoding browsers/glibc accept — integer\n* (`2130706433`), octal (`0177.0.0.1`), hex (`0x7f000001`), and short forms\n* (`127.1`) — into a canonical dotted-decimal string. Returns null when the\n* host is not a numeric IPv4 literal (i.e. it's a real name or already-valid\n* dotted-quad, which callers handle separately).\n*/\nfunction canonicalizeNumericIpv4(host) {\n\tif (isIP(host) === 4) return host;\n\tconst rawParts = host.split(\".\");\n\tif (rawParts.length === 0 || rawParts.length > 4) return null;\n\tconst parseUInt = (s) => {\n\t\tif (s === \"\") return null;\n\t\tlet n;\n\t\tif (/^0x[0-9a-f]+$/i.test(s)) n = parseInt(s, 16);\n\t\telse if (/^0[0-7]+$/.test(s)) n = parseInt(s, 8);\n\t\telse if (/^[0-9]+$/.test(s)) n = parseInt(s, 10);\n\t\telse return null;\n\t\treturn Number.isFinite(n) ? n : null;\n\t};\n\tconst nums = rawParts.map(parseUInt);\n\tif (nums.some((n) => n === null)) return null;\n\tconst parts = nums;\n\tlet value;\n\tswitch (parts.length) {\n\t\tcase 1:\n\t\t\tvalue = parts[0];\n\t\t\tbreak;\n\t\tcase 2:\n\t\t\tif (parts[0] > 255 || parts[1] > 16777215) return null;\n\t\t\tvalue = parts[0] << 24 | parts[1];\n\t\t\tbreak;\n\t\tcase 3:\n\t\t\tif (parts[0] > 255 || parts[1] > 255 || parts[2] > 65535) return null;\n\t\t\tvalue = parts[0] << 24 | parts[1] << 16 | parts[2];\n\t\t\tbreak;\n\t\tdefault:\n\t\t\tif (parts.some((p) => p > 255)) return null;\n\t\t\tvalue = parts[0] << 24 | parts[1] << 16 | parts[2] << 8 | parts[3];\n\t}\n\tvalue = value >>> 0;\n\tif (value > 4294967295) return null;\n\treturn [\n\t\tvalue >>> 24 & 255,\n\t\tvalue >>> 16 & 255,\n\t\tvalue >>> 8 & 255,\n\t\tvalue & 255\n\t].join(\".\");\n}\n/**\n* Synchronous literal pre-filter. Rejects bad schemes, loopback hostnames, and\n* any IP literal (in any encoding) that resolves to a blocked address. Does NOT\n* perform DNS — a public *name* that points at a private IP passes here and is\n* caught by `assertSafeRemoteDefinitionUrl`.\n*/\nfunction isSafeRemoteDefinitionUrl(raw) {\n\tlet parsed;\n\ttry {\n\t\tparsed = new URL(raw);\n\t} catch {\n\t\treturn false;\n\t}\n\tif (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") return false;\n\tlet host = parsed.hostname.toLowerCase();\n\tif (!host) return false;\n\tif (host === \"localhost\" || host.endsWith(\".localhost\")) return false;\n\tif (host.startsWith(\"[\") && host.endsWith(\"]\")) host = host.slice(1, -1);\n\tif (isIP(host) === 6) return !isBlockedIp(host);\n\tconst canonical = canonicalizeNumericIpv4(host);\n\tif (canonical) return !isBlockedIp(canonical);\n\treturn true;\n}\n/**\n* Full SSRF check: literal pre-filter, then resolve every A/AAAA record and\n* reject if *any* resolved IP is blocked. Returns the original URL on success\n* so callers can `await assertSafeRemoteDefinitionUrl(url)` inline. Throws on\n* any rejection.\n*/\nasync function assertSafeRemoteDefinitionUrl(raw, logger = new NoopLogger()) {\n\tif (!isSafeRemoteDefinitionUrl(raw)) {\n\t\tlogger.warn(\"Blocked remote definition URL\", {\n\t\t\tcomponent: \"Compute/ssrf\",\n\t\t\treason: \"literal-filter\",\n\t\t\thost: hostOf(raw)\n\t\t});\n\t\tthrow new Error(\"Remote definition URL is not allowed\");\n\t}\n\tconst host = new URL(raw).hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n\tif (isIP(host) !== 0 || canonicalizeNumericIpv4(host)) return raw;\n\tlet resolved;\n\ttry {\n\t\tresolved = await lookup(host, { all: true });\n\t} catch {\n\t\tlogger.warn(\"Blocked remote definition URL\", {\n\t\t\tcomponent: \"Compute/ssrf\",\n\t\t\treason: \"dns-lookup-failed\",\n\t\t\thost\n\t\t});\n\t\tthrow new Error(\"Remote definition URL is not allowed\");\n\t}\n\tif (resolved.length === 0 || resolved.some((r) => isBlockedIp(r.address))) {\n\t\tconst blocked = resolved.filter((r) => isBlockedIp(r.address)).map((r) => r.address);\n\t\tlogger.warn(\"Blocked remote definition URL\", {\n\t\t\tcomponent: \"Compute/ssrf\",\n\t\t\treason: \"resolves-to-blocked-ip\",\n\t\t\thost,\n\t\t\tblockedIps: blocked\n\t\t});\n\t\tthrow new Error(\"Remote definition URL is not allowed\");\n\t}\n\treturn raw;\n}\n/** Best-effort hostname for logging; falls back to a truncated raw string. */\nfunction hostOf(raw) {\n\ttry {\n\t\treturn new URL(raw).hostname;\n\t} catch {\n\t\treturn raw.slice(0, 120);\n\t}\n}\n//#endregion\n//#region ../server/src/compute/remote-definition.ts\n/**\n* Remote-definition fetch: SSRF-guarded, size-capped, timed, and TTL-cached.\n*\n* A solve can reference its `.gh` by remote URL instead of a stored blob. That\n* URL is attacker-controllable (a share-token caller supplies `definitionUrl`),\n* so every fetch runs through {@link assertSafeRemoteDefinitionUrl} (literal +\n* DNS host validation, blocking private/loopback/link-local targets and\n* literal-encoding bypasses), streams the body with an early size cap, and\n* bounds the wall time with a deadline.\n*\n* The TTL cache is a per-fetcher `Map<url, {data, fetchedAt}>` so repeated\n* solves of the same remote definition skip the network. It's created by\n* {@link createRemoteDefinitionFetcher} rather than being module-global, so a\n* consuming app can hold one fetcher per process (the app binding does) or\n* several isolated ones (tests) without shared state leaking across them.\n*/\n/** Once the cache exceeds this many entries, evict the oldest 10 by `fetchedAt`. */\nvar CACHE_MAX_ENTRIES = 50;\nvar CACHE_EVICT_BATCH = 10;\n/**\n* Read a response body into memory, aborting (and throwing) as soon as the\n* running byte total exceeds `maxBytes`. Falls back to `arrayBuffer()` only when\n* the body isn't a readable stream (older fetch impls). Exported for direct use\n* and reuse; the fetcher below wraps it with SSRF + TTL.\n*/\nasync function readBodyWithCap(response, maxBytes, controller) {\n\tif (!response.body) {\n\t\tconst buffer = await response.arrayBuffer();\n\t\tif (buffer.byteLength > maxBytes) throw new Error(\"Remote definition exceeds size limit\");\n\t\treturn new Uint8Array(buffer);\n\t}\n\tconst reader = response.body.getReader();\n\tconst chunks = [];\n\tlet total = 0;\n\twhile (true) {\n\t\tconst { done, value } = await reader.read();\n\t\tif (done) break;\n\t\ttotal += value.byteLength;\n\t\tif (total > maxBytes) {\n\t\t\tcontroller.abort();\n\t\t\tthrow new Error(\"Remote definition exceeds size limit\");\n\t\t}\n\t\tchunks.push(value);\n\t}\n\tconst out = new Uint8Array(total);\n\tlet offset = 0;\n\tfor (const chunk of chunks) {\n\t\tout.set(chunk, offset);\n\t\toffset += chunk.byteLength;\n\t}\n\treturn out;\n}\n/**\n* Build a remote-definition fetcher owning its own TTL cache. Each fetcher's\n* cache is independent, so one per process shares warm bytes while test fetchers\n* stay isolated.\n*/\nfunction createRemoteDefinitionFetcher(config) {\n\tconst cache = /* @__PURE__ */ new Map();\n\tconst logger = config.logger ?? new NoopLogger();\n\treturn { async load(url) {\n\t\tawait assertSafeRemoteDefinitionUrl(url, logger);\n\t\tconst now = config.now();\n\t\tconst cached = cache.get(url);\n\t\tif (cached && now - cached.fetchedAt < config.cacheTtlMs) return cached.data;\n\t\tconst controller = new AbortController();\n\t\tconst timeout = setTimeout(() => controller.abort(), config.fetchTimeoutMs);\n\t\tlet data;\n\t\ttry {\n\t\t\tconst response = await fetch(url, {\n\t\t\t\tsignal: controller.signal,\n\t\t\t\tredirect: \"error\"\n\t\t\t});\n\t\t\tif (!response.ok) throw new Error(`HTTP ${response.status}: ${response.statusText}`);\n\t\t\tconst declared = Number(response.headers.get(\"content-length\"));\n\t\t\tif (Number.isFinite(declared) && declared > config.maxBytes) throw new Error(\"Remote definition exceeds size limit\");\n\t\t\tdata = await readBodyWithCap(response, config.maxBytes, controller);\n\t\t} finally {\n\t\t\tclearTimeout(timeout);\n\t\t}\n\t\tcache.set(url, {\n\t\t\tdata,\n\t\t\tfetchedAt: now\n\t\t});\n\t\tif (cache.size > CACHE_MAX_ENTRIES) {\n\t\t\tconst entries = Array.from(cache.entries());\n\t\t\tentries.sort((a, b) => a[1].fetchedAt - b[1].fetchedAt);\n\t\t\tfor (let i = 0; i < CACHE_EVICT_BATCH; i++) cache.delete(entries[i][0]);\n\t\t}\n\t\treturn data;\n\t} };\n}\n//#endregion\nexport { createRemoteDefinitionFetcher as t };\n"],"names":[],"mappings":";;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,WAAW,CAAC,EAAE,EAAE;AACzB,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,WAAW,EAAE;AAC5B,CAAC,MAAM,YAAY,GAAG,+CAA+C,CAAC,IAAI,CAAC,IAAI,CAAC;AAChF,CAAC,IAAI,YAAY,EAAE,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC;AACzC,MAAM;AACN,EAAE,MAAM,SAAS,GAAG,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC;AACzE,EAAE,IAAI,SAAS,EAAE;AACjB,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACxC,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACxC,GAAG,IAAI,GAAG;AACV,IAAI,EAAE,IAAI,CAAC,GAAG,GAAG;AACjB,IAAI,EAAE,GAAG,GAAG;AACZ,IAAI,EAAE,IAAI,CAAC,GAAG,GAAG;AACjB,IAAI,EAAE,GAAG;AACT,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACd,EAAE;AACF,CAAC;AACD,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;AACvB,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;AAC5C,EAAE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,EAAE,OAAO,IAAI;AACrE,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM;AACvB,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,IAAI;AAC1B,EAAE,IAAI,CAAC,KAAK,GAAG,EAAE,OAAO,IAAI;AAC5B,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,OAAO,IAAI;AAC3B,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,OAAO,IAAI;AACzC,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,IAAI;AAClD,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,OAAO,IAAI;AACzC,EAAE,OAAO,KAAK;AACd,CAAC;AACD,CAAC,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI,EAAE,OAAO,IAAI;AACjD,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,IAAI;AACrD,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,IAAI;AACjD,CAAC,OAAO,KAAK;AACb;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,uBAAuB,CAAC,IAAI,EAAE;AACvC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,IAAI;AAClC,CAAC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;AACjC,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,OAAO,IAAI;AAC9D,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK;AAC1B,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,OAAO,IAAI;AAC3B,EAAE,IAAI,CAAC;AACP,EAAE,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC;AACnD,OAAO,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;AAClD,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC;AAClD,OAAO,OAAO,IAAI;AAClB,EAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI;AACtC,CAAC,CAAC;AACF,CAAC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;AACrC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,EAAE,OAAO,IAAI;AAC9C,CAAC,MAAM,KAAK,GAAG,IAAI;AACnB,CAAC,IAAI,KAAK;AACV,CAAC,QAAQ,KAAK,CAAC,MAAM;AACrB,EAAE,KAAK,CAAC;AACR,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC;AACnB,GAAG;AACH,EAAE,KAAK,CAAC;AACR,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,EAAE,OAAO,IAAI;AACzD,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;AACpC,GAAG;AACH,EAAE,KAAK,CAAC;AACR,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,OAAO,IAAI;AACxE,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;AACrD,GAAG;AACH,EAAE;AACF,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,EAAE,OAAO,IAAI;AAC9C,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;AACrE;AACA,CAAC,KAAK,GAAG,KAAK,KAAK,CAAC;AACpB,CAAC,IAAI,KAAK,GAAG,UAAU,EAAE,OAAO,IAAI;AACpC,CAAC,OAAO;AACR,EAAE,KAAK,KAAK,EAAE,GAAG,GAAG;AACpB,EAAE,KAAK,KAAK,EAAE,GAAG,GAAG;AACpB,EAAE,KAAK,KAAK,CAAC,GAAG,GAAG;AACnB,EAAE,KAAK,GAAG;AACV,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,yBAAyB,CAAC,GAAG,EAAE;AACxC,CAAC,IAAI,MAAM;AACX,CAAC,IAAI;AACL,EAAE,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC;AACvB,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD,CAAC,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,OAAO,KAAK;AAC9E,CAAC,IAAI,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE;AACzC,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,KAAK;AACxB,CAAC,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,KAAK;AACtE,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;AACzE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;AAChD,CAAC,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,CAAC;AAChD,CAAC,IAAI,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC;AAC9C,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,6BAA6B,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,UAAU,EAAE,EAAE;AAC7E,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,EAAE;AACtC,EAAE,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;AAC/C,GAAG,SAAS,EAAE,cAAc;AAC5B,GAAG,MAAM,EAAE,gBAAgB;AAC3B,GAAG,IAAI,EAAE,MAAM,CAAC,GAAG;AACnB,GAAG,CAAC;AACJ,EAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC;AACzD,CAAC;AACD,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;AACzE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG;AAClE,CAAC,IAAI,QAAQ;AACb,CAAC,IAAI;AACL,EAAE,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AAC9C,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;AAC/C,GAAG,SAAS,EAAE,cAAc;AAC5B,GAAG,MAAM,EAAE,mBAAmB;AAC9B,GAAG;AACH,GAAG,CAAC;AACJ,EAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC;AACzD,CAAC;AACD,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE;AAC5E,EAAE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACtF,EAAE,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;AAC/C,GAAG,SAAS,EAAE,cAAc;AAC5B,GAAG,MAAM,EAAE,wBAAwB;AACnC,GAAG,IAAI;AACP,GAAG,UAAU,EAAE;AACf,GAAG,CAAC;AACJ,EAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC;AACzD,CAAC;AACD,CAAC,OAAO,GAAG;AACX;AACA;AACA,SAAS,MAAM,CAAC,GAAG,EAAE;AACrB,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ;AAC9B,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;AAC1B,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,iBAAiB,GAAG,EAAE;AAC1B,IAAI,iBAAiB,GAAG,EAAE;AAC1B;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE;AAC/D,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;AACrB,EAAE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE;AAC7C,EAAE,IAAI,MAAM,CAAC,UAAU,GAAG,QAAQ,EAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC;AAC3F,EAAE,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC;AAC/B,CAAC;AACD,CAAC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE;AACzC,CAAC,MAAM,MAAM,GAAG,EAAE;AAClB,CAAC,IAAI,KAAK,GAAG,CAAC;AACd,CAAC,OAAO,IAAI,EAAE;AACd,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE;AAC7C,EAAE,IAAI,IAAI,EAAE;AACZ,EAAE,KAAK,IAAI,KAAK,CAAC,UAAU;AAC3B,EAAE,IAAI,KAAK,GAAG,QAAQ,EAAE;AACxB,GAAG,UAAU,CAAC,KAAK,EAAE;AACrB,GAAG,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC;AAC1D,EAAE;AACF,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AACD,CAAC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC;AAClC,CAAC,IAAI,MAAM,GAAG,CAAC;AACf,CAAC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE;AAC7B,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC;AACxB,EAAE,MAAM,IAAI,KAAK,CAAC,UAAU;AAC5B,CAAC;AACD,CAAC,OAAO,GAAG;AACX;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,6BAA6B,CAAC,MAAM,EAAE;AAC/C,CAAC,MAAM,KAAK,mBAAmB,IAAI,GAAG,EAAE;AACxC,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,UAAU,EAAE;AACjD,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,GAAG,EAAE;AAC1B,EAAE,MAAM,6BAA6B,CAAC,GAAG,EAAE,MAAM,CAAC;AAClD,EAAE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE;AAC1B,EAAE,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;AAC/B,EAAE,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,OAAO,MAAM,CAAC,IAAI;AAC9E,EAAE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE;AAC1C,EAAE,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,cAAc,CAAC;AAC7E,EAAE,IAAI,IAAI;AACV,EAAE,IAAI;AACN,GAAG,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;AACrC,IAAI,MAAM,EAAE,UAAU,CAAC,MAAM;AAC7B,IAAI,QAAQ,EAAE;AACd,IAAI,CAAC;AACL,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;AACvF,GAAG,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AAClE,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC;AACvH,GAAG,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC;AACtE,EAAE,CAAC,SAAS;AACZ,GAAG,YAAY,CAAC,OAAO,CAAC;AACxB,EAAE;AACF,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;AACjB,GAAG,IAAI;AACP,GAAG,SAAS,EAAE;AACd,GAAG,CAAC;AACJ,EAAE,IAAI,KAAK,CAAC,IAAI,GAAG,iBAAiB,EAAE;AACtC,GAAG,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;AAC9C,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1D,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,iBAAiB,EAAE,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1E,EAAE;AACF,EAAE,OAAO,IAAI;AACb,CAAC,CAAC,EAAE;AACJ;;;;"}