@selvajs/selva 4.8.0-beta.2 → 4.8.0-beta.3

package/build/server/chunks/chunks/solve.server.js-CLEf-tM-.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"solve.server.js-CLEf-tM-.js","sources":["../../../../.svelte-kit/output/server/chunks/solve.server.js"],"sourcesContent":["import { C as providers, S as lazyLogger, T as renderThrown, j as fetchSchemaFromCompute, v as getSolveMetricSink, y as getStorageProvider } from \"./providers.server.js\";\nimport { l as requireCanEditDefinition, m as requireCanSolve } from \"./access.server.js\";\nimport { a as ComputeServerUnconfiguredError, n as apiError, o as resolveServerForOrg, t as ApiErrorCode } from \"./api-errors.js\";\nimport { r as engine, t as COMPUTE_DEBUG } from \"./engine.server.js\";\nimport { u as createComputeRateLimiter } from \"./admin-auth.server.js\";\nimport { t as createRemoteDefinitionFetcher } from \"./compute.js\";\nimport { c as RATE_LIMIT_WINDOW_MS, d as REMOTE_DEFINITION_MAX_BYTES, l as REMOTE_DEFINITION_CACHE_TTL_MS, s as RATE_LIMIT_MAX_REQUESTS, u as REMOTE_DEFINITION_FETCH_TIMEOUT_MS } from \"./computeLimits.js\";\nimport { isHttpError } from \"@sveltejs/kit\";\n//#region src/lib/server/compute/remoteDefinition.server.ts\n/**\n* App-side binding for the remote-definition fetcher. The fetch itself — SSRF\n* guard, size cap, deadline, TTL cache — lives in `@selvajs/server`\n* (`createRemoteDefinitionFetcher`); this module owns the single app-wide\n* instance, wired with the env-derived limits and the real clock.\n*/\nvar fetcher = createRemoteDefinitionFetcher({\n\tmaxBytes: REMOTE_DEFINITION_MAX_BYTES,\n\tfetchTimeoutMs: REMOTE_DEFINITION_FETCH_TIMEOUT_MS,\n\tcacheTtlMs: REMOTE_DEFINITION_CACHE_TTL_MS,\n\tnow: () => Date.now(),\n\tlogger: lazyLogger\n});\n/** Fetch (or return cached) remote `.gh` bytes. Throws on unsafe host / oversized / timeout. */\nfunction loadRemoteDefinition(url) {\n\treturn fetcher.load(url);\n}\n//#endregion\n//#region src/lib/server/computeRateLimit.server.ts\n/**\n* App-side binding for the compute-solve rate limiter. The limiter itself\n* (fixed-window, per-key, process-local) lives in `@selvajs/server`\n* (`createComputeRateLimiter`); this module owns the single app-wide instance,\n* wired with the window + cap from `computeLimits.ts` (which read the env).\n*\n* Keyed by caller — `user:{userId}` for authenticated solves, `share:{linkId}`\n* for share-token solves so anonymous consumers of one link don't share a\n* bucket with the link's owner.\n*/\nvar limiter = createComputeRateLimiter({\n\twindowMs: RATE_LIMIT_WINDOW_MS,\n\tmaxPerWindow: RATE_LIMIT_MAX_REQUESTS\n});\n/**\n* Check + record one request against `key`. Returns\n* `{ allowed: false, retryAfter }` once the bucket is full.\n*/\nfunction checkComputeRateLimit(key) {\n\treturn limiter.check(key);\n}\n//#endregion\n//#region src/lib/server/compute/solve.server.ts\n/**\n* The body-independent core of a solve request, shared by `POST /api/v1/compute`\n* (share-token and remote-URL capable) and `POST /api/v1/definitions/{guid}/solve`\n* (tenant-scoped, cookie or PAT).\n*\n* **Share-token resolution stays outside this module, in the route.** The caller\n* hands in an already-decided `SolveAccess`; the definition-addressed route only\n* ever constructs the `user` variant, so it cannot inherit the anonymous branch\n* by accident. Adding a token lookup here would silently give it one.\n*\n* What lives here: rate limiting, definition/version resolution, access checks,\n* compute-server routing, schema backfill, the engine call, metric recording and\n* the debug breakdown. What stays in a route: parsing its own body shape and\n* deciding who the caller is.\n*/\n/**\n* Run a solve and return the HTTP response.\n*\n* Throws `HttpError` (via `apiError`) for every refusal, and lets engine/network\n* failures propagate for the caller's outer catch to map — the two routes share\n* that mapping through `mapSolveError`.\n*/\nasync function runSolve(params) {\n\tconst { access, definitionUrl, inputs, values, channel, versionId: explicitVersionId, request, locals, loadStart, prepMarks, concealAccessFailure = false } = params;\n\tconst storage = getStorageProvider();\n\tconst sharedAccess = access.kind === \"share\" ? access : null;\n\tconst solveCtx = access.ctx;\n\tlet prevMark = performance.now();\n\tconst mark = (label) => {\n\t\tprepMarks.push([label, performance.now() - prevMark]);\n\t\tprevMark = performance.now();\n\t};\n\tlet definitionSource;\n\tlet localDefinitionRef = null;\n\tlet localVersionForBackfill = null;\n\tlet solveOrgId = null;\n\tlet definitionPin = null;\n\tlet metricDefinitionId = null;\n\tlet metricVersionId = null;\n\tconst isLocal = definitionUrl.startsWith(\"local:\");\n\tconst guid = isLocal ? definitionUrl.substring(6) : null;\n\tconst recordMetric = (failureKind, extra = {}) => {\n\t\tgetSolveMetricSink().record(solveCtx, {\n\t\t\tdefinitionUrl,\n\t\t\tdefinitionId: metricDefinitionId,\n\t\t\tversionId: metricVersionId,\n\t\t\tchannel,\n\t\t\torgId: solveOrgId,\n\t\t\tdurationMs: extra.durationMs ?? 0,\n\t\t\tok: failureKind === \"ok\",\n\t\t\tfailureKind,\n\t\t\terrorCount: extra.errorCount ?? 0,\n\t\t\twarningCount: extra.warningCount ?? 0\n\t\t}).catch((err) => locals.log.error(\"Solve-metric record failed\", {\n\t\t\tcomponent: \"API/Compute\",\n\t\t\terr: renderThrown(err)\n\t\t}));\n\t};\n\tconst rateLimit = checkComputeRateLimit(access.rateLimitKey);\n\tif (!rateLimit.allowed) {\n\t\trecordMetric(\"rate_limited\");\n\t\tconst retryAfter = rateLimit.retryAfter ?? 1;\n\t\treturn new Response(JSON.stringify({\n\t\t\tmessage: `Too many compute requests. Retry in ${retryAfter}s.`,\n\t\t\tretryAfter\n\t\t}), {\n\t\t\tstatus: 429,\n\t\t\theaders: {\n\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\"Retry-After\": String(retryAfter)\n\t\t\t}\n\t\t});\n\t}\n\tif (isLocal && guid) {\n\t\tlet record;\n\t\ttry {\n\t\t\trecord = await providers.data.definitions.get(solveCtx, guid);\n\t\t} catch (err) {\n\t\t\tlocals.log.error(\"Failed to load local definition\", {\n\t\t\t\tcomponent: \"API/Compute\",\n\t\t\t\tguid,\n\t\t\t\terr: renderThrown(err)\n\t\t\t});\n\t\t\tapiError(404, ApiErrorCode.NOT_FOUND, `Definition '${guid}' not found`);\n\t\t}\n\t\tif (!record) apiError(404, ApiErrorCode.NOT_FOUND, `Definition '${guid}' not found`);\n\t\tmark(\"defRecord\");\n\t\tconst project = await providers.data.projects.getProject(solveCtx, record.projectId);\n\t\tsolveOrgId = project?.orgId ?? null;\n\t\tdefinitionPin = record.computeServerId ?? null;\n\t\tmark(\"project\");\n\t\tif (!sharedAccess) try {\n\t\t\tif (channel === \"draft\" || explicitVersionId) await requireCanEditDefinition(locals, record.projectId, guid, {\n\t\t\t\tproject,\n\t\t\t\tdefinition: record\n\t\t\t});\n\t\t\telse await requireCanSolve(locals, record.projectId, project ?? void 0);\n\t\t} catch (err) {\n\t\t\tif (concealAccessFailure && isHttpError(err) && err.status === 403) apiError(404, ApiErrorCode.NOT_FOUND, `Definition '${guid}' not found`);\n\t\t\tthrow err;\n\t\t}\n\t\tmark(\"access\");\n\t\tconst versionId = explicitVersionId ?? (channel === \"live\" ? record.liveVersionId : record.draftVersionId);\n\t\tif (!versionId) apiError(404, ApiErrorCode.NOT_FOUND, `Definition '${guid}' has no ${channel} version yet`);\n\t\tconst version = await providers.data.definitions.getVersion(solveCtx, versionId);\n\t\tif (!version || version.definitionId !== guid) apiError(404, ApiErrorCode.NOT_FOUND, `Definition '${guid}' version is missing`);\n\t\tlocalVersionForBackfill = {\n\t\t\tid: version.id,\n\t\t\thasSchema: version.schema !== void 0\n\t\t};\n\t\tmetricDefinitionId = guid;\n\t\tmetricVersionId = version.id;\n\t\tmark(\"version\");\n\t\tlocalDefinitionRef = engine.definitionRef(version.id, async () => {\n\t\t\tconst bytes = await storage.get(version.fileKey);\n\t\t\tif (!bytes) throw new Error(`Version blob missing: ${version.fileKey}`);\n\t\t\treturn bytes;\n\t\t});\n\t\tdefinitionSource = localDefinitionRef;\n\t\tmark(\"blob\");\n\t} else {\n\t\ttry {\n\t\t\tdefinitionSource = await loadRemoteDefinition(definitionUrl);\n\t\t} catch (err) {\n\t\t\tlocals.log.error(\"Failed to fetch remote definition\", {\n\t\t\t\tcomponent: \"API/Compute\",\n\t\t\t\tdefinitionUrl,\n\t\t\t\terr: renderThrown(err)\n\t\t\t});\n\t\t\tapiError(400, ApiErrorCode.VALIDATION_FAILED, `Failed to load definition: ${err instanceof Error ? err.message : String(err)}`);\n\t\t}\n\t\tmark(\"remoteDef\");\n\t}\n\tconst defLoadMs = performance.now() - loadStart;\n\tif (sharedAccess) {\n\t\tif (await providers.data.shareLinks.tryIncrementSolveCount(solveCtx, sharedAccess.link.id) === null) {\n\t\t\trecordMetric(\"share_cap\");\n\t\t\tapiError(429, ApiErrorCode.INTERNAL, \"Share link solve cap reached.\");\n\t\t}\n\t\tmark(\"shareCap\");\n\t}\n\tconst serverConfig = await resolveServerForOrg(solveCtx, solveOrgId, { definitionPin });\n\tmark(\"resolveServer\");\n\tif (localVersionForBackfill && !localVersionForBackfill.hasSchema && localDefinitionRef) {\n\t\tconst versionId = localVersionForBackfill.id;\n\t\ttry {\n\t\t\tconst bytes = await localDefinitionRef.load();\n\t\t\tconst schema = await fetchSchemaFromCompute(bytes, serverConfig);\n\t\t\tawait providers.data.definitions.setVersionSchema(solveCtx, versionId, schema);\n\t\t} catch (err) {\n\t\t\tlocals.log.warn(\"Schema backfill failed\", {\n\t\t\t\tcomponent: \"API/Compute\",\n\t\t\t\tversionId,\n\t\t\t\terr: renderThrown(err)\n\t\t\t});\n\t\t}\n\t\tmark(\"schemaBackfill\");\n\t}\n\tconst outcome = await engine.solve({\n\t\tserver: serverConfig,\n\t\tdefinitionSource,\n\t\tdefinitionKey: isLocal ? void 0 : definitionUrl,\n\t\tinputs,\n\t\tvalues,\n\t\tsignal: request.signal,\n\t\tacceptEncoding: request.headers.get(\"accept-encoding\") ?? \"\",\n\t\tdefinitionGuid: guid ?? void 0,\n\t\tloadStartMs: loadStart,\n\t\tdefLoadMs,\n\t\tprepMarks\n\t});\n\tmark(\"solve\");\n\tif (outcome.kind === \"timeout\") recordMetric(\"timeout\", { durationMs: outcome.durationMs });\n\telse if (outcome.kind === \"client_abort\") recordMetric(\"client_abort\", { durationMs: outcome.durationMs });\n\telse if (outcome.kind === \"too_large\") recordMetric(\"too_large\");\n\telse if (outcome.kind === \"shed\") recordMetric(\"shed\", { durationMs: outcome.durationMs });\n\telse if (outcome.kind === \"ok\") {\n\t\trecordMetric(\"ok\", {\n\t\t\tdurationMs: outcome.solveMs,\n\t\t\terrorCount: outcome.errorCount,\n\t\t\twarningCount: outcome.warningCount\n\t\t});\n\t\tif (metricDefinitionId) providers.data.definitions.incrementSolveCount(solveCtx, metricDefinitionId).catch((err) => locals.log.warn(\"solveCount increment failed\", {\n\t\t\tcomponent: \"API/Compute\",\n\t\t\tdefinitionId: metricDefinitionId,\n\t\t\terr: renderThrown(err)\n\t\t}));\n\t\tif (COMPUTE_DEBUG) logDebugBreakdown(locals, request, outcome, defLoadMs, prepMarks);\n\t}\n\treturn engine.toWebResponse(outcome);\n}\n/**\n* Map a thrown solve failure to an HTTP error. Both solve routes share it so\n* they cannot drift on which failures read as \"compute is down\" (503) versus a\n* server bug (500).\n*/\nfunction mapSolveError(err, locals) {\n\tif (isHttpError(err)) throw err;\n\tif (err instanceof ComputeServerUnconfiguredError) apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, err.message);\n\tconst message = err instanceof Error ? err.message : \"Unknown error\";\n\tlocals.log.error(\"Solve request failed\", {\n\t\tcomponent: \"API/Compute\",\n\t\terr: renderThrown(err)\n\t});\n\tif (err instanceof TypeError && message === \"fetch failed\") apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, \"Compute server is unreachable\");\n\tapiError(500, ApiErrorCode.INTERNAL, message);\n}\n/**\n* DEBUG (SELVA_FLAG_COMPUTE_DEBUG): the server-side overhead the solve metric's\n* `durationMs` doesn't capture. `load` = auth + DB + definition fetch; `tree` =\n* input tree build; `serialize` = JSON.stringify of the result. The solve itself\n* is timed separately (see the solve metric's durationMs and [Compute/selva-cache]).\n*/\nfunction logDebugBreakdown(locals, request, outcome, defLoadMs, prepMarks) {\n\tconst { metrics } = outcome.envelope;\n\tlocals.log.debug(\"Solve server-side phase breakdown\", {\n\t\tcomponent: \"Compute/server\",\n\t\tloadMs: Math.round(defLoadMs),\n\t\ttreeBuildMs: Math.round(metrics.treeBuildMs),\n\t\tsolveMs: Math.round(metrics.solveMs),\n\t\tserializeMs: Math.round(metrics.serializeMs),\n\t\tgzipMs: Math.round(metrics.gzipMs),\n\t\tserverTotalMs: Math.round(metrics.serverTotalMs),\n\t\tserializedBytes: metrics.serializedBytes\n\t});\n\tif (metrics.compressedBytes !== null) locals.log.debug(\"Response gzipped\", {\n\t\tcomponent: \"Compute/server\",\n\t\tserializedBytes: metrics.serializedBytes,\n\t\tcompressedBytes: metrics.compressedBytes,\n\t\tratio: Number((metrics.serializedBytes / metrics.compressedBytes).toFixed(1))\n\t});\n\telse {\n\t\tconst acceptEncoding = request.headers.get(\"accept-encoding\") ?? \"\";\n\t\tlocals.log.debug(\"Compression skipped\", {\n\t\t\tcomponent: \"Compute/server\",\n\t\t\tacceptEncoding,\n\t\t\thasAcceptEncoding: acceptEncoding !== \"\"\n\t\t});\n\t}\n\tlocals.log.debug(\"Prep breakdown\", {\n\t\tcomponent: \"Compute/server\",\n\t\t...Object.fromEntries(prepMarks.map(([label, ms]) => [`p_${label}Ms`, Math.round(ms)]))\n\t});\n\tconst db = engine.stats().definitionBytes;\n\tlocals.log.debug(\"Definition byte-cache counters\", {\n\t\tcomponent: \"Compute/def-bytes\",\n\t\thits: db.hits,\n\t\tmisses: db.misses,\n\t\tevictions: db.evictions,\n\t\tentries: db.entries,\n\t\tretainedBytes: db.bytes\n\t});\n}\n//#endregion\nexport { runSolve as n, mapSolveError as t };\n"],"names":[],"mappings":";;;;;;;;;AAQA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,OAAO,GAAG,6BAA6B,CAAC;AAC5C,CAAC,QAAQ,EAAE,2BAA2B;AACtC,CAAC,cAAc,EAAE,kCAAkC;AACnD,CAAC,UAAU,EAAE,8BAA8B;AAC3C,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,GAAG,EAAE;AACtB,CAAC,MAAM,EAAE;AACT,CAAC,CAAC;AACF;AACA,SAAS,oBAAoB,CAAC,GAAG,EAAE;AACnC,CAAC,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;AACzB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,OAAO,GAAG,wBAAwB,CAAC;AACvC,CAAC,QAAQ,EAAE,oBAAoB;AAC/B,CAAC,YAAY,EAAE;AACf,CAAC,CAAC;AACF;AACA;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,GAAG,EAAE;AACpC,CAAC,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC;AAC1B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,QAAQ,CAAC,MAAM,EAAE;AAChC,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,oBAAoB,GAAG,KAAK,EAAE,GAAG,MAAM;AACrK,CAAC,MAAM,OAAO,GAAG,kBAAkB,EAAE;AACrC,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,KAAK,OAAO,GAAG,MAAM,GAAG,IAAI;AAC7D,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG;AAC5B,CAAC,IAAI,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;AACjC,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,KAAK;AACzB,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC;AACvD,EAAE,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;AAC9B,CAAC,CAAC;AACF,CAAC,IAAI,gBAAgB;AACrB,CAAC,IAAI,kBAAkB,GAAG,IAAI;AAC9B,CAAC,IAAI,uBAAuB,GAAG,IAAI;AACnC,CAAC,IAAI,UAAU,GAAG,IAAI;AACtB,CAAC,IAAI,aAAa,GAAG,IAAI;AACzB,CAAC,IAAI,kBAAkB,GAAG,IAAI;AAC9B,CAAC,IAAI,eAAe,GAAG,IAAI;AAC3B,CAAC,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC;AACnD,CAAC,MAAM,IAAI,GAAG,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI;AACzD,CAAC,MAAM,YAAY,GAAG,CAAC,WAAW,EAAE,KAAK,GAAG,EAAE,KAAK;AACnD,EAAE,kBAAkB,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE;AACxC,GAAG,aAAa;AAChB,GAAG,YAAY,EAAE,kBAAkB;AACnC,GAAG,SAAS,EAAE,eAAe;AAC7B,GAAG,OAAO;AACV,GAAG,KAAK,EAAE,UAAU;AACpB,GAAG,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC;AACpC,GAAG,EAAE,EAAE,WAAW,KAAK,IAAI;AAC3B,GAAG,WAAW;AACd,GAAG,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC;AACpC,GAAG,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI;AACvC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,4BAA4B,EAAE;AACnE,GAAG,SAAS,EAAE,aAAa;AAC3B,GAAG,GAAG,EAAE,YAAY,CAAC,GAAG;AACxB,GAAG,CAAC,CAAC;AACL,CAAC,CAAC;AACF,CAAC,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,CAAC,YAAY,CAAC;AAC7D,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE;AACzB,EAAE,YAAY,CAAC,cAAc,CAAC;AAC9B,EAAE,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,IAAI,CAAC;AAC9C,EAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;AACrC,GAAG,OAAO,EAAE,CAAC,oCAAoC,EAAE,UAAU,CAAC,EAAE,CAAC;AACjE,GAAG;AACH,GAAG,CAAC,EAAE;AACN,GAAG,MAAM,EAAE,GAAG;AACd,GAAG,OAAO,EAAE;AACZ,IAAI,cAAc,EAAE,kBAAkB;AACtC,IAAI,aAAa,EAAE,MAAM,CAAC,UAAU;AACpC;AACA,GAAG,CAAC;AACJ,CAAC;AACD,CAAC,IAAI,OAAO,IAAI,IAAI,EAAE;AACtB,EAAE,IAAI,MAAM;AACZ,EAAE,IAAI;AACN,GAAG,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC;AAChE,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,iCAAiC,EAAE;AACvD,IAAI,SAAS,EAAE,aAAa;AAC5B,IAAI,IAAI;AACR,IAAI,GAAG,EAAE,YAAY,CAAC,GAAG;AACzB,IAAI,CAAC;AACL,GAAG,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;AAC1E,EAAE;AACF,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;AACtF,EAAE,IAAI,CAAC,WAAW,CAAC;AACnB,EAAE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC;AACtF,EAAE,UAAU,GAAG,OAAO,EAAE,KAAK,IAAI,IAAI;AACrC,EAAE,aAAa,GAAG,MAAM,CAAC,eAAe,IAAI,IAAI;AAChD,EAAE,IAAI,CAAC,SAAS,CAAC;AACjB,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI;AACzB,GAAG,IAAI,OAAO,KAAK,OAAO,IAAI,iBAAiB,EAAE,MAAM,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE;AAChH,IAAI,OAAO;AACX,IAAI,UAAU,EAAE;AAChB,IAAI,CAAC;AACL,QAAQ,MAAM,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,IAAI,KAAK,CAAC,CAAC;AAC1E,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,IAAI,oBAAoB,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;AAC9I,GAAG,MAAM,GAAG;AACZ,EAAE;AACF,EAAE,IAAI,CAAC,QAAQ,CAAC;AAChB,EAAE,MAAM,SAAS,GAAG,iBAAiB,KAAK,OAAO,KAAK,MAAM,GAAG,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,cAAc,CAAC;AAC5G,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;AAC7G,EAAE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC;AAClF,EAAE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;AACjI,EAAE,uBAAuB,GAAG;AAC5B,GAAG,EAAE,EAAE,OAAO,CAAC,EAAE;AACjB,GAAG,SAAS,EAAE,OAAO,CAAC,MAAM,KAAK;AACjC,GAAG;AACH,EAAE,kBAAkB,GAAG,IAAI;AAC3B,EAAE,eAAe,GAAG,OAAO,CAAC,EAAE;AAC9B,EAAE,IAAI,CAAC,SAAS,CAAC;AACjB,EAAE,kBAAkB,GAAG,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY;AACpE,GAAG,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;AACnD,GAAG,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,sBAAsB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AAC1E,GAAG,OAAO,KAAK;AACf,EAAE,CAAC,CAAC;AACJ,EAAE,gBAAgB,GAAG,kBAAkB;AACvC,EAAE,IAAI,CAAC,MAAM,CAAC;AACd,CAAC,CAAC,MAAM;AACR,EAAE,IAAI;AACN,GAAG,gBAAgB,GAAG,MAAM,oBAAoB,CAAC,aAAa,CAAC;AAC/D,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,mCAAmC,EAAE;AACzD,IAAI,SAAS,EAAE,aAAa;AAC5B,IAAI,aAAa;AACjB,IAAI,GAAG,EAAE,YAAY,CAAC,GAAG;AACzB,IAAI,CAAC;AACL,GAAG,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,2BAA2B,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAClI,EAAE;AACF,EAAE,IAAI,CAAC,WAAW,CAAC;AACnB,CAAC;AACD,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS;AAChD,CAAC,IAAI,YAAY,EAAE;AACnB,EAAE,IAAI,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE;AACvG,GAAG,YAAY,CAAC,WAAW,CAAC;AAC5B,GAAG,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,+BAA+B,CAAC;AACxE,EAAE;AACF,EAAE,IAAI,CAAC,UAAU,CAAC;AAClB,CAAC;AACD,CAAC,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,aAAa,EAAE,CAAC;AACxF,CAAC,IAAI,CAAC,eAAe,CAAC;AACtB,CAAC,IAAI,uBAAuB,IAAI,CAAC,uBAAuB,CAAC,SAAS,IAAI,kBAAkB,EAAE;AAC1F,EAAE,MAAM,SAAS,GAAG,uBAAuB,CAAC,EAAE;AAC9C,EAAE,IAAI;AACN,GAAG,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE;AAChD,GAAG,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,YAAY,CAAC;AACnE,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC;AACjF,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE;AAC7C,IAAI,SAAS,EAAE,aAAa;AAC5B,IAAI,SAAS;AACb,IAAI,GAAG,EAAE,YAAY,CAAC,GAAG;AACzB,IAAI,CAAC;AACL,EAAE;AACF,EAAE,IAAI,CAAC,gBAAgB,CAAC;AACxB,CAAC;AACD,CAAC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC;AACpC,EAAE,MAAM,EAAE,YAAY;AACtB,EAAE,gBAAgB;AAClB,EAAE,aAAa,EAAE,OAAO,GAAG,MAAM,GAAG,aAAa;AACjD,EAAE,MAAM;AACR,EAAE,MAAM;AACR,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM;AACxB,EAAE,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE;AAC9D,EAAE,cAAc,EAAE,IAAI,IAAI,MAAM;AAChC,EAAE,WAAW,EAAE,SAAS;AACxB,EAAE,SAAS;AACX,EAAE;AACF,EAAE,CAAC;AACH,CAAC,IAAI,CAAC,OAAO,CAAC;AACd,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,YAAY,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;AAC5F,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,YAAY,CAAC,cAAc,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;AAC3G,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC;AACjE,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;AAC3F,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE;AACjC,EAAE,YAAY,CAAC,IAAI,EAAE;AACrB,GAAG,UAAU,EAAE,OAAO,CAAC,OAAO;AAC9B,GAAG,UAAU,EAAE,OAAO,CAAC,UAAU;AACjC,GAAG,YAAY,EAAE,OAAO,CAAC;AACzB,GAAG,CAAC;AACJ,EAAE,IAAI,kBAAkB,EAAE,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE;AACrK,GAAG,SAAS,EAAE,aAAa;AAC3B,GAAG,YAAY,EAAE,kBAAkB;AACnC,GAAG,GAAG,EAAE,YAAY,CAAC,GAAG;AACxB,GAAG,CAAC,CAAC;AACL,EAAE,IAAI,aAAa,EAAE,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC;AACtF,CAAC;AACD,CAAC,OAAO,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;AACrC;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE;AACpC,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG;AAChC,CAAC,IAAI,GAAG,YAAY,8BAA8B,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,GAAG,CAAC,OAAO,CAAC;AAChH,CAAC,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,eAAe;AACrE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE;AAC1C,EAAE,SAAS,EAAE,aAAa;AAC1B,EAAE,GAAG,EAAE,YAAY,CAAC,GAAG;AACvB,EAAE,CAAC;AACH,CAAC,IAAI,GAAG,YAAY,SAAS,IAAI,OAAO,KAAK,cAAc,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,+BAA+B,CAAC;AAC7I,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC;AAC9C;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE;AAC3E,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,QAAQ;AACrC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,mCAAmC,EAAE;AACvD,EAAE,SAAS,EAAE,gBAAgB;AAC7B,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;AAC/B,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;AAC9C,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;AACtC,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;AAC9C,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;AACpC,EAAE,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;AAClD,EAAE,eAAe,EAAE,OAAO,CAAC;AAC3B,EAAE,CAAC;AACH,CAAC,IAAI,OAAO,CAAC,eAAe,KAAK,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,kBAAkB,EAAE;AAC5E,EAAE,SAAS,EAAE,gBAAgB;AAC7B,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe;AAC1C,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe;AAC1C,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC;AAC9E,EAAE,CAAC;AACH,MAAM;AACN,EAAE,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE;AACrE,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE;AAC1C,GAAG,SAAS,EAAE,gBAAgB;AAC9B,GAAG,cAAc;AACjB,GAAG,iBAAiB,EAAE,cAAc,KAAK;AACzC,GAAG,CAAC;AACJ,CAAC;AACD,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE;AACpC,EAAE,SAAS,EAAE,gBAAgB;AAC7B,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AACxF,EAAE,CAAC;AACH,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,eAAe;AAC1C,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,gCAAgC,EAAE;AACpD,EAAE,SAAS,EAAE,mBAAmB;AAChC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI;AACf,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM;AACnB,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS;AACzB,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO;AACrB,EAAE,aAAa,EAAE,EAAE,CAAC;AACpB,EAAE,CAAC;AACH;;;;"}

package/build/server/chunks/chunks/src.js-BYv4z3-l.js

@@ -0,0 +1,377 @@
+import { z } from 'zod';
+
+//#region ../platform/src/permissions/types.ts
+/**
+* Platform-scope permissions. Reserved for Selva-staff and instance operators;
+* regular users hold an empty array.
+*
+* - `instance_admin`        — superuser; implies every other permission.
+* - `manage_compute`        — configure the instance-wide Rhino.Compute pool.
+* - `manage_instance_users` — disable/enable any user on the instance.
+* - `manage_updates`        — run system updates.
+*/
+var PlatformPermissionSchema = z.enum([
+	"instance_admin",
+	"manage_compute",
+	"manage_instance_users",
+	"manage_updates"
+]);
+var ALL_PLATFORM_PERMISSIONS = PlatformPermissionSchema.options;
+var RESERVED_SLUG_SET = /* @__PURE__ */ new Set([
+	"o",
+	"api",
+	"admin",
+	"auth",
+	"login",
+	"logout",
+	"setup",
+	"team",
+	"library",
+	"projects",
+	"accept-invite"
+]);
+/**
+* Coerce an arbitrary name into a slug candidate: lowercase, non-alphanumeric
+* runs collapsed to single hyphens, trimmed of edge hyphens, capped at 63 chars.
+* Produces the shape `SlugSchema` validates — but does not itself guarantee
+* validity (a name of all-symbols yields `''`, and reserved words pass through);
+* run the result through `SlugSchema` where a valid slug is required.
+*/
+function slugify(name) {
+	return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 63);
+}
+/** Lowercase alphanumeric with internal hyphens, 3–63 chars, not a reserved word. */
+var SlugSchema = z.string().min(3, "Slug must be at least 3 characters").max(63, "Slug must be at most 63 characters").regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/, "Slug must be lowercase alphanumeric with hyphens (no leading/trailing/consecutive hyphens)").refine((s) => !RESERVED_SLUG_SET.has(s), { message: "Slug is reserved and cannot be used" });
+var OrgRoleSchema = z.enum([
+	"owner",
+	"admin",
+	"member"
+]);
+/**
+* Kinds of org-scoped branding asset. Adding a new kind is a single entry here
+* — the storage path, upload route, store, and UI are all generic over it.
+*/
+var OrgAssetKindSchema = z.enum(["logo", "favicon"]);
+var ALL_ORG_ASSET_KINDS = OrgAssetKindSchema.options;
+/** Org-scope permissions. A user may hold different sets in different orgs. */
+var OrgPermissionSchema = z.enum([
+	"manage_org_members",
+	"manage_org_compute",
+	"manage_definitions",
+	"manage_projects"
+]);
+var ALL_ORG_PERMISSIONS = OrgPermissionSchema.options;
+/** Governance perms — never grantable to `member`. */
+var OWNER_ADMIN_ONLY_PERMISSIONS = ["manage_org_members", "manage_org_compute"];
+var MEMBER_ASSIGNABLE_PERMISSIONS = ALL_ORG_PERMISSIONS.filter((p) => !OWNER_ADMIN_ONLY_PERMISSIONS.includes(p));
+/** Applied when adding a member without an explicit permissions list. */
+var DEFAULT_ORG_PERMISSIONS = {
+	owner: [...ALL_ORG_PERMISSIONS],
+	admin: [...ALL_ORG_PERMISSIONS],
+	member: []
+};
+var CreateOrgSchema = z.object({
+	name: z.string().min(1, "Organization name is required").max(128),
+	slug: SlugSchema
+});
+var UpdateOrgSchema = CreateOrgSchema.partial();
+//#endregion
+//#region ../platform/src/projects/schemas.ts
+var ProjectVisibilitySchema = z.enum([
+	"public",
+	"org",
+	"private",
+	"platform"
+]);
+var ProjectRoleSchema = z.enum([
+	"owner",
+	"editor",
+	"viewer"
+]);
+/** Cross-field check for PATCH flows. Call on the merged post-patch shape. */
+function validateProjectFlags(merged) {
+	const issues = [];
+	if (merged.autoJoinOnUpload && merged.visibility !== "public") issues.push({
+		path: "autoJoinOnUpload",
+		message: "autoJoinOnUpload requires visibility=public"
+	});
+	if (merged.visibility === "platform" && merged.autoJoinOnUpload) issues.push({
+		path: "autoJoinOnUpload",
+		message: "autoJoinOnUpload is not allowed on platform projects"
+	});
+	return issues;
+}
+//#endregion
+//#region ../platform/src/platformProjects/schemas.ts
+var PlatformProjectGranteeTypeSchema = z.enum(["org", "user"]);
+z.object({
+	id: z.string(),
+	projectId: z.string(),
+	granteeType: PlatformProjectGranteeTypeSchema,
+	granteeId: z.string(),
+	canSolve: z.boolean(),
+	createdBy: z.string(),
+	createdAt: z.string()
+});
+//#endregion
+//#region ../platform/src/definitions/types.ts
+var GH_EXTENSIONS = [".gh", ".ghx"];
+var COVER_IMAGE_EXTENSIONS = [
+	".jpg",
+	".jpeg",
+	".png",
+	".webp",
+	".gif"
+];
+[...GH_EXTENSIONS, ...COVER_IMAGE_EXTENSIONS];
+var COVER_IMAGE_CONTENT_TYPES = {
+	".jpg": "image/jpeg",
+	".jpeg": "image/jpeg",
+	".png": "image/png",
+	".webp": "image/webp",
+	".gif": "image/gif"
+};
+/** Project a full record down to the fields v1 publishes. */
+function toDefinitionListItem(r) {
+	return {
+		guid: r.guid,
+		projectId: r.projectId,
+		displayName: r.displayName,
+		description: r.description,
+		category: r.category,
+		tags: r.tags,
+		coverImage: r.coverImage,
+		status: r.status,
+		solveCount: r.solveCount,
+		liveVersionId: r.liveVersionId,
+		updatedAt: r.updatedAt
+	};
+}
+var GuidSchema = z.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "Invalid GUID format");
+var DefinitionStatusSchema = z.enum([
+	"draft",
+	"published",
+	"archived"
+]);
+var DefinitionFileExtSchema = z.enum(["gh", "ghx"]);
+z.object({
+	id: GuidSchema,
+	definitionId: GuidSchema,
+	versionNumber: z.number().int().min(1),
+	fileExt: DefinitionFileExtSchema,
+	fileKey: z.string().min(1),
+	originalFilename: z.string().max(256).optional(),
+	uploadedBy: z.string().min(1),
+	uploadedAt: z.string(),
+	changeNote: z.string().max(1e3).optional(),
+	schema: z.record(z.string(), z.unknown()).optional(),
+	schemaExtractedAt: z.string().optional()
+});
+var DefinitionChannelSchema = z.enum(["live", "draft"]);
+/** HTTP-body validator for new-definition input. */
+var CreateDefinitionInputSchema = z.object({
+	displayName: z.string().min(1, "Display name is required").max(256),
+	description: z.string().max(2e3).optional(),
+	coverImage: z.string().max(2048).optional(),
+	category: z.string().max(128).optional(),
+	tags: z.array(z.string().max(64)).max(20).optional(),
+	projectId: GuidSchema,
+	computeServerId: GuidSchema.optional()
+});
+/**
+* PATCH validator. Field semantics match `DefinitionRecordPatch`:
+* - missing / `undefined` — leave unchanged
+* - `null` — clear (only on nullable fields)
+* - value — set
+*/
+var UpdateMetadataInputSchema = z.object({
+	displayName: z.string().min(1, "Display name is required").max(256).optional(),
+	description: z.string().max(2e3).nullable().optional(),
+	coverImage: z.string().max(2048).nullable().optional(),
+	category: z.string().max(128).nullable().optional(),
+	tags: z.array(z.string().max(64)).max(20).nullable().optional(),
+	projectId: GuidSchema.optional(),
+	computeServerId: GuidSchema.nullable().optional(),
+	solveCacheLimit: z.number().int().min(0).max(1e5).nullable().optional(),
+	status: DefinitionStatusSchema.optional()
+});
+/** Body for `POST /api/definitions/[guid]/publish`. */
+var PublishVersionInputSchema = z.object({ versionId: GuidSchema.optional() }).default({});
+//#endregion
+//#region ../platform/src/shareLinks/schemas.ts
+/**
+* HTTP body for `POST /api/definitions/[guid]/share-links`. The route returns
+* the raw token exactly once.
+*/
+var CreateShareLinkInputSchema = z.object({
+	channel: DefinitionChannelSchema.default("live"),
+	name: z.string().max(128).optional(),
+	allowSolve: z.boolean().default(true),
+	/**
+	* Null explicitly removes the cap. Omitted = apply default — null is the
+	* minter's deliberate "uncap" choice.
+	*/
+	maxSolves: z.number().int().min(1).nullable().optional(),
+	/** Optional ISO timestamp. Resolution compares to `now()`. */
+	expiresAt: z.iso.datetime().nullable().optional()
+});
+//#endregion
+//#region ../platform/src/storage/image.ts
+/**
+* Shared image-transcoding helper for `IStorageProvider` implementations.
+* Cover images are normalized to WebP at upload time (capped at 1200px,
+* quality 85) so storage/bandwidth stays predictable and the viewer path
+* is uniform.
+*
+* `sharp` is loaded via a dynamic import so the platform package has no
+* hard runtime dependency on it — install it in providers that need
+* transcoding (optional peer dependency).
+*/
+var IMAGE_MAX_WIDTH = 1200;
+/** True if the input looks like an image to process — by content type or path extension. */
+function isImageUpload(contentType, storagePath) {
+	if (contentType?.startsWith("image/")) return true;
+	return /\.(webp|png|jpe?g|gif|bmp|tif?f|svg)$/i.test(storagePath);
+}
+/**
+* Rewrite a path's extension to `.webp`. Unchanged if not a recognized image
+* extension. SVG is included: every upload (including SVG) is rasterized to
+* WebP, so a `.svg` input is stored as `.webp` — no vector blob is ever
+* persisted, which keeps the served bytes XSS-free without a sanitizer.
+*/
+function toWebpPath(storagePath) {
+	return storagePath.replace(/\.(png|jpe?g|gif|bmp|tif?f|svg)$/i, ".webp");
+}
+/**
+* If the input is an image, transcode to WebP (capped + re-encoded) and
+* return rewritten bytes/content-type/path. Non-images pass through, so
+* providers can call this unconditionally before `put`.
+*
+* Throws if `sharp` isn't installed — that's a config error, not a fallback.
+*/
+async function transcodeImageIfNeeded(data, contentType, storagePath) {
+	if (!isImageUpload(contentType, storagePath)) return {
+		data,
+		contentType: contentType ?? "application/octet-stream",
+		path: storagePath
+	};
+	const compressed = await (await loadSharp())(Buffer.from(data)).resize({
+		width: IMAGE_MAX_WIDTH,
+		withoutEnlargement: true
+	}).webp({ quality: 85 }).toBuffer();
+	return {
+		data: new Uint8Array(compressed),
+		contentType: "image/webp",
+		path: toWebpPath(storagePath)
+	};
+}
+var cachedSharp = null;
+async function loadSharp() {
+	if (cachedSharp) return cachedSharp;
+	try {
+		const mod = await import('sharp');
+		cachedSharp = mod.default ?? mod;
+		return cachedSharp;
+	} catch (err) {
+		throw new Error("Image transcoding requires `sharp` to be installed. Add it as a dependency in your provider package.", { cause: err });
+	}
+}
+//#endregion
+//#region ../platform/src/storage/assetClasses.ts
+var BRANDING_KINDS = ALL_ORG_ASSET_KINDS.join("|");
+var COVER_EXTS = COVER_IMAGE_EXTENSIONS.map((ext) => ext.replace(/^\./, "").replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|");
+var SAFE_SEGMENT = String.raw`[A-Za-z0-9._-]+`;
+var GUID = String.raw`[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}`;
+/**
+* The closed registry of servable asset classes. Order matters only for
+* readability — patterns are mutually exclusive by prefix. Anything that
+* matches no class is unservable (the route 404s), which keeps the proxy
+* default-deny: a new blob type is opt-in by adding an entry here.
+*/
+var ASSET_CLASSES = [
+	{
+		id: "org-branding",
+		visibility: "public",
+		scope: "none",
+		pattern: new RegExp(String.raw`^orgs\/(${SAFE_SEGMENT})\/branding\/(?:${BRANDING_KINDS})\.webp$`)
+	},
+	{
+		id: "org-private",
+		visibility: "org",
+		scope: "org",
+		pattern: new RegExp(String.raw`^orgs\/(${SAFE_SEGMENT})\/private\/${SAFE_SEGMENT}$`)
+	},
+	{
+		id: "definition-cover",
+		visibility: "project",
+		scope: "project",
+		pattern: new RegExp(String.raw`^definitions\/(${GUID})\/cover\.(?:${COVER_EXTS})$`, "i")
+	}
+];
+/**
+* Reject any path that contains a traversal, empty, or backslash segment
+* *before* it can match a class. The class patterns use a permissive segment
+* alphabet (`[A-Za-z0-9._-]+`) so dotted ids and filenames work, but that
+* alphabet also admits a bare `.` or `..` *as a whole segment* — which would
+* let `orgs/../branding/logo.webp` classify as public branding with `..`
+* captured as the orgId. This mirrors `assertSafeKey` in the path builders:
+* the registry is the read-side gate, those are the write-side gate, and both
+* forbid the same segments so a path that can't be *written* can't be *read*.
+*/
+function hasUnsafeSegment(storagePath) {
+	if (storagePath.includes("\\")) return true;
+	for (const segment of storagePath.split("/")) if (segment === "" || segment === "." || segment === "..") return true;
+	return false;
+}
+/**
+* Classify a storage path into its asset class and scope id, or null when no
+* class matches (or the path is unsafe). Callers — `getPublicUrl` (to pick CDN
+* vs proxy) and the serving route (to pick the auth check) — consult this so
+* URL generation and authorization never drift apart.
+*
+* For `org-branding` the orgId is captured as group 1 but the class is public,
+* so `scopeId` is reported as the captured id only when the class actually
+* authorizes against it (`scope !== 'none'`); public classes report null.
+*/
+function classifyAssetPath(storagePath) {
+	if (hasUnsafeSegment(storagePath)) return null;
+	for (const cls of ASSET_CLASSES) {
+		const m = cls.pattern.exec(storagePath);
+		if (!m) continue;
+		return {
+			class: cls,
+			scopeId: cls.scope === "none" ? null : m[1] ?? null
+		};
+	}
+	return null;
+}
+//#endregion
+//#region ../platform/src/context.ts
+/**
+* For server-internal operations outside any HTTP request (bootstrap,
+* janitors, migrations). Treated as fully authorized.
+*/
+var SYSTEM_CONTEXT = {
+	userId: "",
+	platformPermissions: [...ALL_PLATFORM_PERMISSIONS],
+	orgPermissions: [...ALL_ORG_PERMISSIONS],
+	system: true
+};
+/**
+* Does NOT cross-check `ctx.actingOrgId` — the caller builds a context scoped
+* to the org they're acting on. An org permission against a ctx without
+* `actingOrgId` returns false unless `instance_admin` or `system`.
+*/
+function hasPermission(ctx, permission) {
+	if (ctx.system) return true;
+	if (ctx.platformPermissions.includes("instance_admin")) return true;
+	if (isPlatformPermission(permission)) return ctx.platformPermissions.includes(permission);
+	return ctx.orgPermissions.includes(permission);
+}
+var PLATFORM_PERMISSION_VALUES = new Set(ALL_PLATFORM_PERMISSIONS);
+function isPlatformPermission(p) {
+	return PLATFORM_PERMISSION_VALUES.has(p);
+}
+
+export { ALL_PLATFORM_PERMISSIONS as A, CreateOrgSchema as C, DEFAULT_ORG_PERMISSIONS as D, GuidSchema as G, MEMBER_ASSIGNABLE_PERMISSIONS as M, OrgRoleSchema as O, ProjectVisibilitySchema as P, SYSTEM_CONTEXT as S, UpdateOrgSchema as U, ALL_ORG_PERMISSIONS as a, ProjectRoleSchema as b, classifyAssetPath as c, PlatformPermissionSchema as d, OrgPermissionSchema as e, COVER_IMAGE_CONTENT_TYPES as f, toDefinitionListItem as g, hasPermission as h, GH_EXTENSIONS as i, CreateDefinitionInputSchema as j, UpdateMetadataInputSchema as k, PublishVersionInputSchema as l, CreateShareLinkInputSchema as m, OrgAssetKindSchema as n, OWNER_ADMIN_ONLY_PERMISSIONS as o, slugify as s, transcodeImageIfNeeded as t, validateProjectFlags as v };
+//# sourceMappingURL=src.js-BYv4z3-l.js.map

package/build/server/chunks/chunks/src.js-BYv4z3-l.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"src.js-BYv4z3-l.js","sources":["../../../../.svelte-kit/output/server/chunks/src.js"],"sourcesContent":["import { z } from \"zod\";\n//#region ../platform/src/permissions/types.ts\n/**\n* Platform-scope permissions. Reserved for Selva-staff and instance operators;\n* regular users hold an empty array.\n*\n* - `instance_admin`        — superuser; implies every other permission.\n* - `manage_compute`        — configure the instance-wide Rhino.Compute pool.\n* - `manage_instance_users` — disable/enable any user on the instance.\n* - `manage_updates`        — run system updates.\n*/\nvar PlatformPermissionSchema = z.enum([\n\t\"instance_admin\",\n\t\"manage_compute\",\n\t\"manage_instance_users\",\n\t\"manage_updates\"\n]);\nvar ALL_PLATFORM_PERMISSIONS = PlatformPermissionSchema.options;\nvar RESERVED_SLUG_SET = /* @__PURE__ */ new Set([\n\t\"o\",\n\t\"api\",\n\t\"admin\",\n\t\"auth\",\n\t\"login\",\n\t\"logout\",\n\t\"setup\",\n\t\"team\",\n\t\"library\",\n\t\"projects\",\n\t\"accept-invite\"\n]);\n/**\n* Coerce an arbitrary name into a slug candidate: lowercase, non-alphanumeric\n* runs collapsed to single hyphens, trimmed of edge hyphens, capped at 63 chars.\n* Produces the shape `SlugSchema` validates — but does not itself guarantee\n* validity (a name of all-symbols yields `''`, and reserved words pass through);\n* run the result through `SlugSchema` where a valid slug is required.\n*/\nfunction slugify(name) {\n\treturn name.trim().toLowerCase().replace(/[^a-z0-9]+/g, \"-\").replace(/^-|-$/g, \"\").slice(0, 63);\n}\n/** Lowercase alphanumeric with internal hyphens, 3–63 chars, not a reserved word. */\nvar SlugSchema = z.string().min(3, \"Slug must be at least 3 characters\").max(63, \"Slug must be at most 63 characters\").regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/, \"Slug must be lowercase alphanumeric with hyphens (no leading/trailing/consecutive hyphens)\").refine((s) => !RESERVED_SLUG_SET.has(s), { message: \"Slug is reserved and cannot be used\" });\nvar OrgRoleSchema = z.enum([\n\t\"owner\",\n\t\"admin\",\n\t\"member\"\n]);\n/**\n* Kinds of org-scoped branding asset. Adding a new kind is a single entry here\n* — the storage path, upload route, store, and UI are all generic over it.\n*/\nvar OrgAssetKindSchema = z.enum([\"logo\", \"favicon\"]);\nvar ALL_ORG_ASSET_KINDS = OrgAssetKindSchema.options;\n/** Org-scope permissions. A user may hold different sets in different orgs. */\nvar OrgPermissionSchema = z.enum([\n\t\"manage_org_members\",\n\t\"manage_org_compute\",\n\t\"manage_definitions\",\n\t\"manage_projects\"\n]);\nvar ALL_ORG_PERMISSIONS = OrgPermissionSchema.options;\n/** Governance perms — never grantable to `member`. */\nvar OWNER_ADMIN_ONLY_PERMISSIONS = [\"manage_org_members\", \"manage_org_compute\"];\nvar MEMBER_ASSIGNABLE_PERMISSIONS = ALL_ORG_PERMISSIONS.filter((p) => !OWNER_ADMIN_ONLY_PERMISSIONS.includes(p));\n/** Applied when adding a member without an explicit permissions list. */\nvar DEFAULT_ORG_PERMISSIONS = {\n\towner: [...ALL_ORG_PERMISSIONS],\n\tadmin: [...ALL_ORG_PERMISSIONS],\n\tmember: []\n};\nvar CreateOrgSchema = z.object({\n\tname: z.string().min(1, \"Organization name is required\").max(128),\n\tslug: SlugSchema\n});\nvar UpdateOrgSchema = CreateOrgSchema.partial();\n//#endregion\n//#region ../platform/src/projects/schemas.ts\nvar ProjectVisibilitySchema = z.enum([\n\t\"public\",\n\t\"org\",\n\t\"private\",\n\t\"platform\"\n]);\nvar ProjectRoleSchema = z.enum([\n\t\"owner\",\n\t\"editor\",\n\t\"viewer\"\n]);\n/** Cross-field check for PATCH flows. Call on the merged post-patch shape. */\nfunction validateProjectFlags(merged) {\n\tconst issues = [];\n\tif (merged.autoJoinOnUpload && merged.visibility !== \"public\") issues.push({\n\t\tpath: \"autoJoinOnUpload\",\n\t\tmessage: \"autoJoinOnUpload requires visibility=public\"\n\t});\n\tif (merged.visibility === \"platform\" && merged.autoJoinOnUpload) issues.push({\n\t\tpath: \"autoJoinOnUpload\",\n\t\tmessage: \"autoJoinOnUpload is not allowed on platform projects\"\n\t});\n\treturn issues;\n}\n//#endregion\n//#region ../platform/src/platformProjects/schemas.ts\nvar PlatformProjectGranteeTypeSchema = z.enum([\"org\", \"user\"]);\nz.object({\n\tid: z.string(),\n\tprojectId: z.string(),\n\tgranteeType: PlatformProjectGranteeTypeSchema,\n\tgranteeId: z.string(),\n\tcanSolve: z.boolean(),\n\tcreatedBy: z.string(),\n\tcreatedAt: z.string()\n});\n//#endregion\n//#region ../platform/src/definitions/types.ts\nvar GH_EXTENSIONS = [\".gh\", \".ghx\"];\nvar COVER_IMAGE_EXTENSIONS = [\n\t\".jpg\",\n\t\".jpeg\",\n\t\".png\",\n\t\".webp\",\n\t\".gif\"\n];\n[...GH_EXTENSIONS, ...COVER_IMAGE_EXTENSIONS];\nvar COVER_IMAGE_CONTENT_TYPES = {\n\t\".jpg\": \"image/jpeg\",\n\t\".jpeg\": \"image/jpeg\",\n\t\".png\": \"image/png\",\n\t\".webp\": \"image/webp\",\n\t\".gif\": \"image/gif\"\n};\n/** Project a full record down to the fields v1 publishes. */\nfunction toDefinitionListItem(r) {\n\treturn {\n\t\tguid: r.guid,\n\t\tprojectId: r.projectId,\n\t\tdisplayName: r.displayName,\n\t\tdescription: r.description,\n\t\tcategory: r.category,\n\t\ttags: r.tags,\n\t\tcoverImage: r.coverImage,\n\t\tstatus: r.status,\n\t\tsolveCount: r.solveCount,\n\t\tliveVersionId: r.liveVersionId,\n\t\tupdatedAt: r.updatedAt\n\t};\n}\nvar GuidSchema = z.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, \"Invalid GUID format\");\nvar DefinitionStatusSchema = z.enum([\n\t\"draft\",\n\t\"published\",\n\t\"archived\"\n]);\nvar DefinitionFileExtSchema = z.enum([\"gh\", \"ghx\"]);\nz.object({\n\tid: GuidSchema,\n\tdefinitionId: GuidSchema,\n\tversionNumber: z.number().int().min(1),\n\tfileExt: DefinitionFileExtSchema,\n\tfileKey: z.string().min(1),\n\toriginalFilename: z.string().max(256).optional(),\n\tuploadedBy: z.string().min(1),\n\tuploadedAt: z.string(),\n\tchangeNote: z.string().max(1e3).optional(),\n\tschema: z.record(z.string(), z.unknown()).optional(),\n\tschemaExtractedAt: z.string().optional()\n});\nvar DefinitionChannelSchema = z.enum([\"live\", \"draft\"]);\n/** HTTP-body validator for new-definition input. */\nvar CreateDefinitionInputSchema = z.object({\n\tdisplayName: z.string().min(1, \"Display name is required\").max(256),\n\tdescription: z.string().max(2e3).optional(),\n\tcoverImage: z.string().max(2048).optional(),\n\tcategory: z.string().max(128).optional(),\n\ttags: z.array(z.string().max(64)).max(20).optional(),\n\tprojectId: GuidSchema,\n\tcomputeServerId: GuidSchema.optional()\n});\n/**\n* PATCH validator. Field semantics match `DefinitionRecordPatch`:\n* - missing / `undefined` — leave unchanged\n* - `null` — clear (only on nullable fields)\n* - value — set\n*/\nvar UpdateMetadataInputSchema = z.object({\n\tdisplayName: z.string().min(1, \"Display name is required\").max(256).optional(),\n\tdescription: z.string().max(2e3).nullable().optional(),\n\tcoverImage: z.string().max(2048).nullable().optional(),\n\tcategory: z.string().max(128).nullable().optional(),\n\ttags: z.array(z.string().max(64)).max(20).nullable().optional(),\n\tprojectId: GuidSchema.optional(),\n\tcomputeServerId: GuidSchema.nullable().optional(),\n\tsolveCacheLimit: z.number().int().min(0).max(1e5).nullable().optional(),\n\tstatus: DefinitionStatusSchema.optional()\n});\n/** Body for `POST /api/definitions/[guid]/publish`. */\nvar PublishVersionInputSchema = z.object({ versionId: GuidSchema.optional() }).default({});\n//#endregion\n//#region ../platform/src/shareLinks/schemas.ts\n/**\n* HTTP body for `POST /api/definitions/[guid]/share-links`. The route returns\n* the raw token exactly once.\n*/\nvar CreateShareLinkInputSchema = z.object({\n\tchannel: DefinitionChannelSchema.default(\"live\"),\n\tname: z.string().max(128).optional(),\n\tallowSolve: z.boolean().default(true),\n\t/**\n\t* Null explicitly removes the cap. Omitted = apply default — null is the\n\t* minter's deliberate \"uncap\" choice.\n\t*/\n\tmaxSolves: z.number().int().min(1).nullable().optional(),\n\t/** Optional ISO timestamp. Resolution compares to `now()`. */\n\texpiresAt: z.iso.datetime().nullable().optional()\n});\n//#endregion\n//#region ../platform/src/storage/image.ts\n/**\n* Shared image-transcoding helper for `IStorageProvider` implementations.\n* Cover images are normalized to WebP at upload time (capped at 1200px,\n* quality 85) so storage/bandwidth stays predictable and the viewer path\n* is uniform.\n*\n* `sharp` is loaded via a dynamic import so the platform package has no\n* hard runtime dependency on it — install it in providers that need\n* transcoding (optional peer dependency).\n*/\nvar IMAGE_MAX_WIDTH = 1200;\n/** True if the input looks like an image to process — by content type or path extension. */\nfunction isImageUpload(contentType, storagePath) {\n\tif (contentType?.startsWith(\"image/\")) return true;\n\treturn /\\.(webp|png|jpe?g|gif|bmp|tif?f|svg)$/i.test(storagePath);\n}\n/**\n* Rewrite a path's extension to `.webp`. Unchanged if not a recognized image\n* extension. SVG is included: every upload (including SVG) is rasterized to\n* WebP, so a `.svg` input is stored as `.webp` — no vector blob is ever\n* persisted, which keeps the served bytes XSS-free without a sanitizer.\n*/\nfunction toWebpPath(storagePath) {\n\treturn storagePath.replace(/\\.(png|jpe?g|gif|bmp|tif?f|svg)$/i, \".webp\");\n}\n/**\n* If the input is an image, transcode to WebP (capped + re-encoded) and\n* return rewritten bytes/content-type/path. Non-images pass through, so\n* providers can call this unconditionally before `put`.\n*\n* Throws if `sharp` isn't installed — that's a config error, not a fallback.\n*/\nasync function transcodeImageIfNeeded(data, contentType, storagePath) {\n\tif (!isImageUpload(contentType, storagePath)) return {\n\t\tdata,\n\t\tcontentType: contentType ?? \"application/octet-stream\",\n\t\tpath: storagePath\n\t};\n\tconst compressed = await (await loadSharp())(Buffer.from(data)).resize({\n\t\twidth: IMAGE_MAX_WIDTH,\n\t\twithoutEnlargement: true\n\t}).webp({ quality: 85 }).toBuffer();\n\treturn {\n\t\tdata: new Uint8Array(compressed),\n\t\tcontentType: \"image/webp\",\n\t\tpath: toWebpPath(storagePath)\n\t};\n}\nvar cachedSharp = null;\nasync function loadSharp() {\n\tif (cachedSharp) return cachedSharp;\n\ttry {\n\t\tconst mod = await import(\"sharp\");\n\t\tcachedSharp = mod.default ?? mod;\n\t\treturn cachedSharp;\n\t} catch (err) {\n\t\tthrow new Error(\"Image transcoding requires `sharp` to be installed. Add it as a dependency in your provider package.\", { cause: err });\n\t}\n}\n//#endregion\n//#region ../platform/src/storage/assetClasses.ts\nvar BRANDING_KINDS = ALL_ORG_ASSET_KINDS.join(\"|\");\nvar COVER_EXTS = COVER_IMAGE_EXTENSIONS.map((ext) => ext.replace(/^\\./, \"\").replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\")).join(\"|\");\nvar SAFE_SEGMENT = String.raw`[A-Za-z0-9._-]+`;\nvar GUID = String.raw`[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}`;\n/**\n* The closed registry of servable asset classes. Order matters only for\n* readability — patterns are mutually exclusive by prefix. Anything that\n* matches no class is unservable (the route 404s), which keeps the proxy\n* default-deny: a new blob type is opt-in by adding an entry here.\n*/\nvar ASSET_CLASSES = [\n\t{\n\t\tid: \"org-branding\",\n\t\tvisibility: \"public\",\n\t\tscope: \"none\",\n\t\tpattern: new RegExp(String.raw`^orgs\\/(${SAFE_SEGMENT})\\/branding\\/(?:${BRANDING_KINDS})\\.webp$`)\n\t},\n\t{\n\t\tid: \"org-private\",\n\t\tvisibility: \"org\",\n\t\tscope: \"org\",\n\t\tpattern: new RegExp(String.raw`^orgs\\/(${SAFE_SEGMENT})\\/private\\/${SAFE_SEGMENT}$`)\n\t},\n\t{\n\t\tid: \"definition-cover\",\n\t\tvisibility: \"project\",\n\t\tscope: \"project\",\n\t\tpattern: new RegExp(String.raw`^definitions\\/(${GUID})\\/cover\\.(?:${COVER_EXTS})$`, \"i\")\n\t}\n];\n/**\n* Reject any path that contains a traversal, empty, or backslash segment\n* *before* it can match a class. The class patterns use a permissive segment\n* alphabet (`[A-Za-z0-9._-]+`) so dotted ids and filenames work, but that\n* alphabet also admits a bare `.` or `..` *as a whole segment* — which would\n* let `orgs/../branding/logo.webp` classify as public branding with `..`\n* captured as the orgId. This mirrors `assertSafeKey` in the path builders:\n* the registry is the read-side gate, those are the write-side gate, and both\n* forbid the same segments so a path that can't be *written* can't be *read*.\n*/\nfunction hasUnsafeSegment(storagePath) {\n\tif (storagePath.includes(\"\\\\\")) return true;\n\tfor (const segment of storagePath.split(\"/\")) if (segment === \"\" || segment === \".\" || segment === \"..\") return true;\n\treturn false;\n}\n/**\n* Classify a storage path into its asset class and scope id, or null when no\n* class matches (or the path is unsafe). Callers — `getPublicUrl` (to pick CDN\n* vs proxy) and the serving route (to pick the auth check) — consult this so\n* URL generation and authorization never drift apart.\n*\n* For `org-branding` the orgId is captured as group 1 but the class is public,\n* so `scopeId` is reported as the captured id only when the class actually\n* authorizes against it (`scope !== 'none'`); public classes report null.\n*/\nfunction classifyAssetPath(storagePath) {\n\tif (hasUnsafeSegment(storagePath)) return null;\n\tfor (const cls of ASSET_CLASSES) {\n\t\tconst m = cls.pattern.exec(storagePath);\n\t\tif (!m) continue;\n\t\treturn {\n\t\t\tclass: cls,\n\t\t\tscopeId: cls.scope === \"none\" ? null : m[1] ?? null\n\t\t};\n\t}\n\treturn null;\n}\n//#endregion\n//#region ../platform/src/context.ts\n/**\n* For server-internal operations outside any HTTP request (bootstrap,\n* janitors, migrations). Treated as fully authorized.\n*/\nvar SYSTEM_CONTEXT = {\n\tuserId: \"\",\n\tplatformPermissions: [...ALL_PLATFORM_PERMISSIONS],\n\torgPermissions: [...ALL_ORG_PERMISSIONS],\n\tsystem: true\n};\n/**\n* Does NOT cross-check `ctx.actingOrgId` — the caller builds a context scoped\n* to the org they're acting on. An org permission against a ctx without\n* `actingOrgId` returns false unless `instance_admin` or `system`.\n*/\nfunction hasPermission(ctx, permission) {\n\tif (ctx.system) return true;\n\tif (ctx.platformPermissions.includes(\"instance_admin\")) return true;\n\tif (isPlatformPermission(permission)) return ctx.platformPermissions.includes(permission);\n\treturn ctx.orgPermissions.includes(permission);\n}\nvar PLATFORM_PERMISSION_VALUES = new Set(ALL_PLATFORM_PERMISSIONS);\nfunction isPlatformPermission(p) {\n\treturn PLATFORM_PERMISSION_VALUES.has(p);\n}\n//#endregion\nexport { OrgRoleSchema as C, PlatformPermissionSchema as D, ALL_PLATFORM_PERMISSIONS as E, OrgPermissionSchema as S, slugify as T, CreateOrgSchema as _, CreateShareLinkInputSchema as a, OWNER_ADMIN_ONLY_PERMISSIONS as b, PublishVersionInputSchema as c, GH_EXTENSIONS as d, toDefinitionListItem as f, ALL_ORG_PERMISSIONS as g, validateProjectFlags as h, transcodeImageIfNeeded as i, UpdateMetadataInputSchema as l, ProjectVisibilitySchema as m, hasPermission as n, CreateDefinitionInputSchema as o, ProjectRoleSchema as p, classifyAssetPath as r, GuidSchema as s, SYSTEM_CONTEXT as t, COVER_IMAGE_CONTENT_TYPES as u, DEFAULT_ORG_PERMISSIONS as v, UpdateOrgSchema as w, OrgAssetKindSchema as x, MEMBER_ASSIGNABLE_PERMISSIONS as y };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC,gBAAgB;AACjB,CAAC,gBAAgB;AACjB,CAAC,uBAAuB;AACxB,CAAC;AACD,CAAC;AACE,IAAC,wBAAwB,GAAG,wBAAwB,CAAC;AACxD,IAAI,iBAAiB,mBAAmB,IAAI,GAAG,CAAC;AAChD,CAAC,GAAG;AACJ,CAAC,KAAK;AACN,CAAC,OAAO;AACR,CAAC,MAAM;AACP,CAAC,OAAO;AACR,CAAC,QAAQ;AACT,CAAC,OAAO;AACR,CAAC,MAAM;AACP,CAAC,SAAS;AACV,CAAC,UAAU;AACX,CAAC;AACD,CAAC,CAAC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,OAAO,CAAC,IAAI,EAAE;AACvB,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;AAChG;AACA;AACA,IAAI,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,oCAAoC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,oCAAoC,CAAC,CAAC,KAAK,CAAC,iCAAiC,EAAE,4FAA4F,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC;AACvV,IAAC,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC;AAC3B,CAAC,OAAO;AACR,CAAC,OAAO;AACR,CAAC;AACD,CAAC;AACD;AACA;AACA;AACA;AACG,IAAC,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC;AACnD,IAAI,mBAAmB,GAAG,kBAAkB,CAAC,OAAO;AACpD;AACG,IAAC,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC,oBAAoB;AACrB,CAAC,oBAAoB;AACrB,CAAC,oBAAoB;AACrB,CAAC;AACD,CAAC;AACE,IAAC,mBAAmB,GAAG,mBAAmB,CAAC;AAC9C;AACG,IAAC,4BAA4B,GAAG,CAAC,oBAAoB,EAAE,oBAAoB;AAC3E,IAAC,6BAA6B,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/G;AACG,IAAC,uBAAuB,GAAG;AAC9B,CAAC,KAAK,EAAE,CAAC,GAAG,mBAAmB,CAAC;AAChC,CAAC,KAAK,EAAE,CAAC,GAAG,mBAAmB,CAAC;AAChC,CAAC,MAAM,EAAE;AACT;AACG,IAAC,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;AAC/B,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,+BAA+B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;AAClE,CAAC,IAAI,EAAE;AACP,CAAC;AACE,IAAC,eAAe,GAAG,eAAe,CAAC,OAAO;AAC7C;AACA;AACG,IAAC,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC,QAAQ;AACT,CAAC,KAAK;AACN,CAAC,SAAS;AACV,CAAC;AACD,CAAC;AACE,IAAC,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;AAC/B,CAAC,OAAO;AACR,CAAC,QAAQ;AACT,CAAC;AACD,CAAC;AACD;AACA,SAAS,oBAAoB,CAAC,MAAM,EAAE;AACtC,CAAC,MAAM,MAAM,GAAG,EAAE;AAClB,CAAC,IAAI,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC;AAC5E,EAAE,IAAI,EAAE,kBAAkB;AAC1B,EAAE,OAAO,EAAE;AACX,EAAE,CAAC;AACH,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,IAAI,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC;AAC9E,EAAE,IAAI,EAAE,kBAAkB;AAC1B,EAAE,OAAO,EAAE;AACX,EAAE,CAAC;AACH,CAAC,OAAO,MAAM;AACd;AACA;AACA;AACA,IAAI,gCAAgC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAC9D,CAAC,CAAC,MAAM,CAAC;AACT,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;AACf,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,WAAW,EAAE,gCAAgC;AAC9C,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;AACtB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM;AACpB,CAAC,CAAC;AACF;AACA;AACG,IAAC,aAAa,GAAG,CAAC,KAAK,EAAE,MAAM;AAClC,IAAI,sBAAsB,GAAG;AAC7B,CAAC,MAAM;AACP,CAAC,OAAO;AACR,CAAC,MAAM;AACP,CAAC,OAAO;AACR,CAAC;AACD,CAAC;AACD,CAAC,GAAG,aAAa,EAAE,GAAG,sBAAsB,CAAC;AAC1C,IAAC,yBAAyB,GAAG;AAChC,CAAC,MAAM,EAAE,YAAY;AACrB,CAAC,OAAO,EAAE,YAAY;AACtB,CAAC,MAAM,EAAE,WAAW;AACpB,CAAC,OAAO,EAAE,YAAY;AACtB,CAAC,MAAM,EAAE;AACT;AACA;AACA,SAAS,oBAAoB,CAAC,CAAC,EAAE;AACjC,CAAC,OAAO;AACR,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;AACd,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;AACxB,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW;AAC5B,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW;AAC5B,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ;AACtB,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;AACd,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU;AAC1B,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM;AAClB,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU;AAC1B,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa;AAChC,EAAE,SAAS,EAAE,CAAC,CAAC;AACf,EAAE;AACF;AACG,IAAC,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iEAAiE,EAAE,qBAAqB;AAC1H,IAAI,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC;AACpC,CAAC,OAAO;AACR,CAAC,WAAW;AACZ,CAAC;AACD,CAAC,CAAC;AACF,IAAI,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC,CAAC,MAAM,CAAC;AACT,CAAC,EAAE,EAAE,UAAU;AACf,CAAC,YAAY,EAAE,UAAU;AACzB,CAAC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC,OAAO,EAAE,uBAAuB;AACjC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3B,CAAC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AACjD,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AAC9B,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;AACvB,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AAC3C,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;AACrD,CAAC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ;AACvC,CAAC,CAAC;AACF,IAAI,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACvD;AACG,IAAC,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;AAC3C,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;AACpE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AAC5C,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;AAC5C,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AACzC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;AACrD,CAAC,SAAS,EAAE,UAAU;AACtB,CAAC,eAAe,EAAE,UAAU,CAAC,QAAQ;AACrC,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;AACzC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AAC/E,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AACvD,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AACvD,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AACpD,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AAChE,CAAC,SAAS,EAAE,UAAU,CAAC,QAAQ,EAAE;AACjC,CAAC,eAAe,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AAClD,CAAC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AACxE,CAAC,MAAM,EAAE,sBAAsB,CAAC,QAAQ;AACxC,CAAC;AACD;AACG,IAAC,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE;AACzF;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;AAC1C,CAAC,OAAO,EAAE,uBAAuB,CAAC,OAAO,CAAC,MAAM,CAAC;AACjD,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AACrC,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;AACtC;AACA;AACA;AACA;AACA,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;AACzD;AACA,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ;AAChD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,eAAe,GAAG,IAAI;AAC1B;AACA,SAAS,aAAa,CAAC,WAAW,EAAE,WAAW,EAAE;AACjD,CAAC,IAAI,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI;AACnD,CAAC,OAAO,wCAAwC,CAAC,IAAI,CAAC,WAAW,CAAC;AAClE;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,UAAU,CAAC,WAAW,EAAE;AACjC,CAAC,OAAO,WAAW,CAAC,OAAO,CAAC,mCAAmC,EAAE,OAAO,CAAC;AACzE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,sBAAsB,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE;AACtE,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,OAAO;AACtD,EAAE,IAAI;AACN,EAAE,WAAW,EAAE,WAAW,IAAI,0BAA0B;AACxD,EAAE,IAAI,EAAE;AACR,EAAE;AACF,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,SAAS,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AACxE,EAAE,KAAK,EAAE,eAAe;AACxB,EAAE,kBAAkB,EAAE;AACtB,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;AACpC,CAAC,OAAO;AACR,EAAE,IAAI,EAAE,IAAI,UAAU,CAAC,UAAU,CAAC;AAClC,EAAE,WAAW,EAAE,YAAY;AAC3B,EAAE,IAAI,EAAE,UAAU,CAAC,WAAW;AAC9B,EAAE;AACF;AACA,IAAI,WAAW,GAAG,IAAI;AACtB,eAAe,SAAS,GAAG;AAC3B,CAAC,IAAI,WAAW,EAAE,OAAO,WAAW;AACpC,CAAC,IAAI;AACL,EAAE,MAAM,GAAG,GAAG,MAAM,OAAO,OAAO,CAAC;AACnC,EAAE,WAAW,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG;AAClC,EAAE,OAAO,WAAW;AACpB,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,MAAM,IAAI,KAAK,CAAC,sGAAsG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACzI,CAAC;AACD;AACA;AACA;AACA,IAAI,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;AAClD,IAAI,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;AAC7H,IAAI,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC;AAC9C,IAAI,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,4DAA4D,CAAC;AACnF;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,aAAa,GAAG;AACpB,CAAC;AACD,EAAE,EAAE,EAAE,cAAc;AACpB,EAAE,UAAU,EAAE,QAAQ;AACtB,EAAE,KAAK,EAAE,MAAM;AACf,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC,gBAAgB,EAAE,cAAc,CAAC,QAAQ,CAAC;AAClG,EAAE;AACF,CAAC;AACD,EAAE,EAAE,EAAE,aAAa;AACnB,EAAE,UAAU,EAAE,KAAK;AACnB,EAAE,KAAK,EAAE,KAAK;AACd,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;AACrF,EAAE;AACF,CAAC;AACD,EAAE,EAAE,EAAE,kBAAkB;AACxB,EAAE,UAAU,EAAE,SAAS;AACvB,EAAE,KAAK,EAAE,SAAS;AAClB,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,GAAG;AACzF;AACA,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,CAAC,WAAW,EAAE;AACvC,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,IAAI;AAC5C,CAAC,KAAK,MAAM,OAAO,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,EAAE,OAAO,IAAI;AACrH,CAAC,OAAO,KAAK;AACb;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,WAAW,EAAE;AACxC,CAAC,IAAI,gBAAgB,CAAC,WAAW,CAAC,EAAE,OAAO,IAAI;AAC/C,CAAC,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE;AAClC,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;AACzC,EAAE,IAAI,CAAC,CAAC,EAAE;AACV,EAAE,OAAO;AACT,GAAG,KAAK,EAAE,GAAG;AACb,GAAG,OAAO,EAAE,GAAG,CAAC,KAAK,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;AAClD,GAAG;AACH,CAAC;AACD,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,cAAc,GAAG;AACrB,CAAC,MAAM,EAAE,EAAE;AACX,CAAC,mBAAmB,EAAE,CAAC,GAAG,wBAAwB,CAAC;AACnD,CAAC,cAAc,EAAE,CAAC,GAAG,mBAAmB,CAAC;AACzC,CAAC,MAAM,EAAE;AACT;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE;AACxC,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI;AAC5B,CAAC,IAAI,GAAG,CAAC,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,IAAI;AACpE,CAAC,IAAI,oBAAoB,CAAC,UAAU,CAAC,EAAE,OAAO,GAAG,CAAC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC;AAC1F,CAAC,OAAO,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC;AAC/C;AACA,IAAI,0BAA0B,GAAG,IAAI,GAAG,CAAC,wBAAwB,CAAC;AAClE,SAAS,oBAAoB,CAAC,CAAC,EAAE;AACjC,CAAC,OAAO,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC;AACzC;;;;"}

package/build/server/chunks/chunks/state.js-BpzOuRFU.js

@@ -0,0 +1,76 @@
+import { g as getContext } from './server.js-dCqO-ZSb.js';
+import './client.js-D0nlibvP.js';
+
+//#endregion
+//#region ../../node_modules/.pnpm/@sveltejs+kit@2.70.1_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.2.0_svelte_f075b7c16fa9692fcf0544233d562474/node_modules/@sveltejs/kit/src/runtime/app/state/server.js
+function context() {
+	return getContext("__request__");
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@sveltejs+kit@2.70.1_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.2.0_svelte_f075b7c16fa9692fcf0544233d562474/node_modules/@sveltejs/kit/src/runtime/app/state/index.js
+/**
+* A read-only reactive object with information about the current page, serving several use cases:
+* - retrieving the combined `data` of all pages/layouts anywhere in your component tree (also see [loading data](https://svelte.dev/docs/kit/load))
+* - retrieving the current value of the `form` prop anywhere in your component tree (also see [form actions](https://svelte.dev/docs/kit/form-actions))
+* - retrieving the page state that was set through `goto`, `pushState` or `replaceState` (also see [goto](https://svelte.dev/docs/kit/$app-navigation#goto) and [shallow routing](https://svelte.dev/docs/kit/shallow-routing))
+* - retrieving metadata such as the URL you're on, the current route and its parameters, and whether or not there was an error
+*
+* ```svelte
+* <!--- file: +layout.svelte --->
+* <script>
+* 	import { page } from '$app/state';
+* <\/script>
+*
+* <p>Currently at {page.url.pathname}</p>
+*
+* {#if page.error}
+* 	<span class="red">Problem detected</span>
+* {:else}
+* 	<span class="small">All systems operational</span>
+* {/if}
+* ```
+*
+* Changes to `page` are available exclusively with runes. (The legacy reactivity syntax will not reflect any changes)
+*
+* ```svelte
+* <!--- file: +page.svelte --->
+* <script>
+* 	import { page } from '$app/state';
+* 	const id = $derived(page.params.id); // This will correctly update id for usage on this page
+* 	$: badId = page.params.id; // Do not use; will never update after initial load
+* <\/script>
+* ```
+*
+* On the server, values can only be read during rendering (in other words _not_ in e.g. `load` functions). In the browser, the values can be read at any time.
+*
+* @type {import('@sveltejs/kit').Page}
+*/
+var page = {
+	get data() {
+		return context().page.data;
+	},
+	get error() {
+		return context().page.error;
+	},
+	get form() {
+		return context().page.form;
+	},
+	get params() {
+		return context().page.params;
+	},
+	get route() {
+		return context().page.route;
+	},
+	get state() {
+		return context().page.state;
+	},
+	get status() {
+		return context().page.status;
+	},
+	get url() {
+		return context().page.url;
+	}
+};
+
+export { page as p };
+//# sourceMappingURL=state.js-BpzOuRFU.js.map

package/build/server/chunks/chunks/state.js-BpzOuRFU.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js-BpzOuRFU.js","sources":["../../../../.svelte-kit/output/server/chunks/state.js"],"sourcesContent":["import \"./index-server.js\";\nimport { b as getContext } from \"./server.js\";\nimport { r as stores } from \"./client.js\";\nstores.updated.check;\n//#endregion\n//#region ../../node_modules/.pnpm/@sveltejs+kit@2.70.1_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.2.0_svelte_f075b7c16fa9692fcf0544233d562474/node_modules/@sveltejs/kit/src/runtime/app/state/server.js\nfunction context() {\n\treturn getContext(\"__request__\");\n}\n//#endregion\n//#region ../../node_modules/.pnpm/@sveltejs+kit@2.70.1_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.2.0_svelte_f075b7c16fa9692fcf0544233d562474/node_modules/@sveltejs/kit/src/runtime/app/state/index.js\n/**\n* A read-only reactive object with information about the current page, serving several use cases:\n* - retrieving the combined `data` of all pages/layouts anywhere in your component tree (also see [loading data](https://svelte.dev/docs/kit/load))\n* - retrieving the current value of the `form` prop anywhere in your component tree (also see [form actions](https://svelte.dev/docs/kit/form-actions))\n* - retrieving the page state that was set through `goto`, `pushState` or `replaceState` (also see [goto](https://svelte.dev/docs/kit/$app-navigation#goto) and [shallow routing](https://svelte.dev/docs/kit/shallow-routing))\n* - retrieving metadata such as the URL you're on, the current route and its parameters, and whether or not there was an error\n*\n* ```svelte\n* <!--- file: +layout.svelte --->\n* <script>\n* \timport { page } from '$app/state';\n* <\\/script>\n*\n* <p>Currently at {page.url.pathname}</p>\n*\n* {#if page.error}\n* \t<span class=\"red\">Problem detected</span>\n* {:else}\n* \t<span class=\"small\">All systems operational</span>\n* {/if}\n* ```\n*\n* Changes to `page` are available exclusively with runes. (The legacy reactivity syntax will not reflect any changes)\n*\n* ```svelte\n* <!--- file: +page.svelte --->\n* <script>\n* \timport { page } from '$app/state';\n* \tconst id = $derived(page.params.id); // This will correctly update id for usage on this page\n* \t$: badId = page.params.id; // Do not use; will never update after initial load\n* <\\/script>\n* ```\n*\n* On the server, values can only be read during rendering (in other words _not_ in e.g. `load` functions). In the browser, the values can be read at any time.\n*\n* @type {import('@sveltejs/kit').Page}\n*/\nvar page = {\n\tget data() {\n\t\treturn context().page.data;\n\t},\n\tget error() {\n\t\treturn context().page.error;\n\t},\n\tget form() {\n\t\treturn context().page.form;\n\t},\n\tget params() {\n\t\treturn context().page.params;\n\t},\n\tget route() {\n\t\treturn context().page.route;\n\t},\n\tget state() {\n\t\treturn context().page.state;\n\t},\n\tget status() {\n\t\treturn context().page.status;\n\t},\n\tget url() {\n\t\treturn context().page.url;\n\t}\n};\n//#endregion\nexport { page as t };\n"],"names":[],"mappings":";;;AAIA;AACA;AACA,SAAS,OAAO,GAAG;AACnB,CAAC,OAAO,UAAU,CAAC,aAAa,CAAC;AACjC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,IAAI,GAAG;AACX,CAAC,IAAI,IAAI,GAAG;AACZ,EAAE,OAAO,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI;AAC5B,CAAC,CAAC;AACF,CAAC,IAAI,KAAK,GAAG;AACb,EAAE,OAAO,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK;AAC7B,CAAC,CAAC;AACF,CAAC,IAAI,IAAI,GAAG;AACZ,EAAE,OAAO,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI;AAC5B,CAAC,CAAC;AACF,CAAC,IAAI,MAAM,GAAG;AACd,EAAE,OAAO,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM;AAC9B,CAAC,CAAC;AACF,CAAC,IAAI,KAAK,GAAG;AACb,EAAE,OAAO,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK;AAC7B,CAAC,CAAC;AACF,CAAC,IAAI,KAAK,GAAG;AACb,EAAE,OAAO,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK;AAC7B,CAAC,CAAC;AACF,CAAC,IAAI,MAAM,GAAG;AACd,EAAE,OAAO,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM;AAC9B,CAAC,CAAC;AACF,CAAC,IAAI,GAAG,GAAG;AACX,EAAE,OAAO,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG;AAC3B,CAAC;AACD;;;;"}

package/build/server/chunks/chunks/stores.js-CDeuxrKE.js

@@ -0,0 +1,35 @@
+import { g as getContext } from './server.js-dCqO-ZSb.js';
+import './client.js-D0nlibvP.js';
+
+//#region ../../node_modules/.pnpm/@sveltejs+kit@2.70.1_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.2.0_svelte_f075b7c16fa9692fcf0544233d562474/node_modules/@sveltejs/kit/src/runtime/app/stores.js
+/**
+* A function that returns all of the contextual stores. On the server, this must be called during component initialization.
+* Only use this if you need to defer store subscription until after the component has mounted, for some reason.
+*
+* @deprecated Use `$app/state` instead (requires Svelte 5, [see docs for more info](https://svelte.dev/docs/kit/migrating-to-sveltekit-2#SvelteKit-2.12:-$app-stores-deprecated))
+*/
+var getStores = () => {
+	const stores$1 = getContext("__svelte__");
+	return {
+		/** @type {typeof page} */
+		page: { subscribe: stores$1.page.subscribe },
+		/** @type {typeof navigating} */
+		navigating: { subscribe: stores$1.navigating.subscribe },
+		/** @type {typeof updated} */
+		updated: stores$1.updated
+	};
+};
+/**
+* A readable store whose value contains page data.
+*
+* On the server, this store can only be subscribed to during component initialization. In the browser, it can be subscribed to at any time.
+*
+* @deprecated Use `page` from `$app/state` instead (requires Svelte 5, [see docs for more info](https://svelte.dev/docs/kit/migrating-to-sveltekit-2#SvelteKit-2.12:-$app-stores-deprecated))
+* @type {import('svelte/store').Readable<import('@sveltejs/kit').Page>}
+*/
+var page = { subscribe(fn) {
+	return getStores().page.subscribe(fn);
+} };
+
+export { page as p };
+//# sourceMappingURL=stores.js-CDeuxrKE.js.map

package/build/server/chunks/chunks/stores.js-CDeuxrKE.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stores.js-CDeuxrKE.js","sources":["../../../../.svelte-kit/output/server/chunks/stores.js"],"sourcesContent":["import \"./index-server.js\";\nimport { b as getContext } from \"./server.js\";\nimport \"./client.js\";\n//#region ../../node_modules/.pnpm/@sveltejs+kit@2.70.1_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.2.0_svelte_f075b7c16fa9692fcf0544233d562474/node_modules/@sveltejs/kit/src/runtime/app/stores.js\n/**\n* A function that returns all of the contextual stores. On the server, this must be called during component initialization.\n* Only use this if you need to defer store subscription until after the component has mounted, for some reason.\n*\n* @deprecated Use `$app/state` instead (requires Svelte 5, [see docs for more info](https://svelte.dev/docs/kit/migrating-to-sveltekit-2#SvelteKit-2.12:-$app-stores-deprecated))\n*/\nvar getStores = () => {\n\tconst stores$1 = getContext(\"__svelte__\");\n\treturn {\n\t\t/** @type {typeof page} */\n\t\tpage: { subscribe: stores$1.page.subscribe },\n\t\t/** @type {typeof navigating} */\n\t\tnavigating: { subscribe: stores$1.navigating.subscribe },\n\t\t/** @type {typeof updated} */\n\t\tupdated: stores$1.updated\n\t};\n};\n/**\n* A readable store whose value contains page data.\n*\n* On the server, this store can only be subscribed to during component initialization. In the browser, it can be subscribed to at any time.\n*\n* @deprecated Use `page` from `$app/state` instead (requires Svelte 5, [see docs for more info](https://svelte.dev/docs/kit/migrating-to-sveltekit-2#SvelteKit-2.12:-$app-stores-deprecated))\n* @type {import('svelte/store').Readable<import('@sveltejs/kit').Page>}\n*/\nvar page = { subscribe(fn) {\n\treturn getStores().page.subscribe(fn);\n} };\n//#endregion\nexport { page as t };\n"],"names":[],"mappings":";;;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,SAAS,GAAG,MAAM;AACtB,CAAC,MAAM,QAAQ,GAAG,UAAU,CAAC,YAAY,CAAC;AAC1C,CAAC,OAAO;AACR;AACA,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE;AAC9C;AACA,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE;AAC1D;AACA,EAAE,OAAO,EAAE,QAAQ,CAAC;AACpB,EAAE;AACF,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,IAAI,GAAG,EAAE,SAAS,CAAC,EAAE,EAAE;AAC3B,CAAC,OAAO,SAAS,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;AACtC,CAAC;;;;"}