chore: replace em dashes with hyphens, add no-em-dash rule to CLAUDE.md
Chart Release / chart (push) Successful in 20s
Server Deploy / deploy (push) Failing after 1m52s

This commit is contained in:
mrhid6 committed 2026-09-10 09:18:55 +00:00
1 parent b36a696d0e
commit 6ee203f5e9
172 files changed
+860 -856

No files matched your search

+4 -4
View File
@@ -19,7 +19,7 @@ import (
// consoleConnect godoc
//
// @Summary Open a browser console session
// @Description Mints a one-time session token for the /console/tunnel websocket. Requires a live agent — answers 409 agent_offline otherwise.
// @Description Mints a one-time session token for the /console/tunnel websocket. Requires a live agent - answers 409 agent_offline otherwise.
// @Tags console
// @Accept json
// @Produce json
@@ -109,7 +109,7 @@ func queryIntDefault(r *http.Request, key string, def int) int {
// Every branch here logs. That is deliberate and worth keeping: this handler
// spans four hops (session store, agent dispatch, relay announcement, guacd),
// any of which can fail, and the client is told the same near-useless thing by
// most of them — a 500 that guacamole then reports as an *upstream* error,
// most of them - a 500 that guacamole then reports as an *upstream* error,
// naming the wrong hop entirely. Without a line per branch the only evidence a
// failure leaves is a GIN status code, and with several replicas you cannot
// even tell which process produced it.
@@ -215,7 +215,7 @@ func consoleTunnel(c *gin.Context) {
return
}
// The client is deliberately told nothing specific, so this is the only
// place the real reason exists — a failed dispatch and a relay that was
// place the real reason exists - a failed dispatch and a relay that was
// never announced are the same generic 500 to the browser.
tlog("reject: open relay: %v", err)
c.JSON(http.StatusInternalServerError, gin.H{"error": "could not open relay"})
@@ -286,7 +286,7 @@ func consoleTunnel(c *gin.Context) {
}
// The handshake is where guacd connects onward to the relay, so a
// failure here is guacd reporting it could not reach %s:%d — the hop
// failure here is guacd reporting it could not reach %s:%d - the hop
// that has been hardest to see from either end.
stream := guac.NewStream(conn, guac.SocketTimeout)
if err := stream.Handshake(config); err != nil {
+8 -8
View File
@@ -1631,14 +1631,14 @@
"$ref": "#/components/schemas/models.AlertSettings"
},
"api_token_max_days": {
"description": "APITokenMaxDays caps how long a newly created API token may live.\n\nA pointer for the same reason the retention fields are: absent must mean\nthe default, and the default here is no cap at all — never-expire tokens\nare allowed until an instance decides otherwise, so an upgrade changes\nnothing. Nil or 0 is no cap. A positive value refuses both a longer\nexpiry and a token with no expiry.\n\nIt is a policy on issuance, not on use: raising or lowering it never\ninvalidates a token that already exists.",
"description": "APITokenMaxDays caps how long a newly created API token may live.\n\nA pointer for the same reason the retention fields are: absent must mean\nthe default, and the default here is no cap at all - never-expire tokens\nare allowed until an instance decides otherwise, so an upgrade changes\nnothing. Nil or 0 is no cap. A positive value refuses both a longer\nexpiry and a token with no expiry.\n\nIt is a policy on issuance, not on use: raising or lowering it never\ninvalidates a token that already exists.",
"type": "integer"
},
"instance_id": {
"type": "string"
},
"local_login_enabled": {
"description": "LocalLoginEnabled is a pointer because it is absent on every settings\ndocument written before this feature existed, and a plain bool would read\nabsent as disabled — turning off password login for the entire fleet at\nupgrade. Nil means enabled.",
"description": "LocalLoginEnabled is a pointer because it is absent on every settings\ndocument written before this feature existed, and a plain bool would read\nabsent as disabled - turning off password login for the entire fleet at\nupgrade. Nil means enabled.",
"type": "boolean"
},
"secrets": {
@@ -1970,7 +1970,7 @@
"type": "string"
},
"fixed_in": {
"description": "FixedIn empty means no vendor fix has been published. That is a real and\ncommon state and must never be conflated with \"not vulnerable\" — it is\nthe finding most in need of acceptance, since there is nothing to patch.",
"description": "FixedIn empty means no vendor fix has been published. That is a real and\ncommon state and must never be conflated with \"not vulnerable\" - it is\nthe finding most in need of acceptance, since there is nothing to patch.",
"type": "string"
},
"id": {
@@ -3319,7 +3319,7 @@
},
"/console/connect": {
"post": {
"description": "Mints a one-time session token for the /console/tunnel websocket. Requires a live agent — answers 409 agent_offline otherwise.",
"description": "Mints a one-time session token for the /console/tunnel websocket. Requires a live agent - answers 409 agent_offline otherwise.",
"requestBody": {
"content": {
"application/json": {
@@ -5645,7 +5645,7 @@
},
"/secrets/{group}/values": {
"get": {
"description": "Consumed by Kubernetes External Secrets Operator. Authenticated with a bearer token whose SHA-256 hash is stored in settings — a different credential from an API token, never substitutable for one.",
"description": "Consumed by Kubernetes External Secrets Operator. Authenticated with a bearer token whose SHA-256 hash is stored in settings - a different credential from an API token, never substitutable for one.",
"parameters": [
{
"description": "Secret group name",
@@ -6278,7 +6278,7 @@
},
"/servers/{id}/packages": {
"get": {
"description": "A server that has not reported yet answers reported=false rather than 404 — that is the normal state for the first hour after install.",
"description": "A server that has not reported yet answers reported=false rather than 404 - that is the normal state for the first hour after install.",
"parameters": [
{
"description": "Server ID",
@@ -8627,7 +8627,7 @@
},
"/vulnerabilities": {
"get": {
"description": "Groups findings by CVE, most severe first — the same CVE on forty servers is one decision, not forty rows.",
"description": "Groups findings by CVE, most severe first - the same CVE on forty servers is one decision, not forty rows.",
"parameters": [
{
"description": "Filter by severity",
@@ -8848,7 +8848,7 @@
]
},
"post": {
"description": "Requires a reason and a future expiry. Reopens automatically at expiry — permanent dismissal is never allowed.",
"description": "Requires a reason and a future expiry. Reopens automatically at expiry - permanent dismissal is never allowed.",
"parameters": [
{
"description": "Finding ID",
@@ -19,9 +19,9 @@
`),``,`You can apply a few solutions:`,['Add an `as="..."` prop, to ensure that we render an actual element instead of a "template".',`Render a single element as the child so that we can forward the props onto that element.`].map(e=>` - ${e}`).join(`
`)].join(`
`));let r=lae(e.props??{},o,c),a=ti(e,r,!0);for(let e in r)e.startsWith(`on`)&&(a.props||={},a.props[e]=r[e]);return a}return Array.isArray(s)&&s.length===1?s[0]:s}return ci(a,Object.assign({},o,c),{default:()=>s})}function cae(e){return e.flatMap(e=>e.type===H?cae(e.children):[e])}function lae(...e){if(e.length===0)return{};if(e.length===1)return e[0];let t={},n={};for(let r of e)for(let e in r)e.startsWith(`on`)&&typeof r[e]==`function`?(n[e]??(n[e]=[]),n[e].push(r[e])):t[e]=r[e];if(t.disabled||t[`aria-disabled`])return Object.assign(t,Object.fromEntries(Object.keys(n).map(e=>[e,void 0])));for(let e in n)Object.assign(t,{[e](t,...r){let i=n[e];for(let e of i){if(t instanceof Event&&t.defaultPrevented)return;e(t,...r)}}});return t}function uae(e){let t=Object.assign({},e);for(let e in t)t[e]===void 0&&delete t[e];return t}function Yo(e,t=[]){let n=Object.assign({},e);for(let e of t)e in n&&delete n[e];return n}function dae(e){return e==null?!1:typeof e.type==`string`||typeof e.type==`object`||typeof e.type==`function`}var Xo,fae,Zo=s((()=>{G(),Eo(),Xo=(e=>(e[e.None=0]=`None`,e[e.RenderStrategy=1]=`RenderStrategy`,e[e.Static=2]=`Static`,e))(Xo||{}),fae=(e=>(e[e.Unmount=0]=`Unmount`,e[e.Hidden=1]=`Hidden`,e))(fae||{})})),Qo,$o,es=s((()=>{G(),Zo(),Qo=(e=>(e[e.None=1]=`None`,e[e.Focusable=2]=`Focusable`,e[e.Hidden=4]=`Hidden`,e))(Qo||{}),$o=N({name:`Hidden`,props:{as:{type:[Object,String],default:`div`},features:{type:Number,default:1}},setup(e,{slots:t,attrs:n}){return()=>{let{features:r,...i}=e;return qo({ourProps:{"aria-hidden":(r&2)==2?!0:i[`aria-hidden`]??void 0,hidden:(r&4)==4||void 0,style:{position:`fixed`,top:1,left:1,width:1,height:0,padding:0,margin:-1,overflow:`hidden`,clip:`rect(0, 0, 0, 0)`,whiteSpace:`nowrap`,borderWidth:`0`,...(r&4)==4&&(r&2)!=2&&{display:`none`}}},theirProps:i,slot:{},attrs:n,slots:t,name:`Hidden`})}}})}));function ts(){return dr(rs,null)}function ns(e){ur(rs,e)}var rs,is,as=s((()=>{G(),rs=Symbol(`Context`),is=(e=>(e[e.Open=1]=`Open`,e[e.Closed=2]=`Closed`,e[e.Closing=4]=`Closing`,e[e.Opening=8]=`Opening`,e))(is||{})})),os,ss=s((()=>{os=(e=>(e.Space=` `,e.Enter=`Enter`,e.Escape=`Escape`,e.Backspace=`Backspace`,e.Delete=`Delete`,e.ArrowLeft=`ArrowLeft`,e.ArrowUp=`ArrowUp`,e.ArrowRight=`ArrowRight`,e.ArrowDown=`ArrowDown`,e.Home=`Home`,e.End=`End`,e.PageUp=`PageUp`,e.PageDown=`PageDown`,e.Tab=`Tab`,e))(os||{})}));function pae(e){function t(){document.readyState!==`loading`&&(e(),document.removeEventListener(`DOMContentLoaded`,t))}typeof window<`u`&&typeof document<`u`&&(document.addEventListener(`DOMContentLoaded`,t),t())}var mae=s((()=>{})),cs,hae=s((()=>{mae(),cs=[],pae(()=>{function e(e){e.target instanceof HTMLElement&&e.target!==document.body&&cs[0]!==e.target&&(cs.unshift(e.target),cs=cs.filter(e=>e!=null&&e.isConnected),cs.splice(10))}window.addEventListener(`click`,e,{capture:!0}),window.addEventListener(`mousedown`,e,{capture:!0}),window.addEventListener(`focus`,e,{capture:!0}),document.body.addEventListener(`click`,e,{capture:!0}),document.body.addEventListener(`mousedown`,e,{capture:!0}),document.body.addEventListener(`focus`,e,{capture:!0})})}));function gae(e){throw Error(`Unexpected object: `+e)}function _ae(e,t){let n=t.resolveItems();if(n.length<=0)return null;let r=t.resolveActiveIndex(),i=r??-1;switch(e.focus){case 0:for(let e=0;e<n.length;++e)if(!t.resolveDisabled(n[e],e,n))return e;return r;case 1:i===-1&&(i=n.length);for(let e=i-1;e>=0;--e)if(!t.resolveDisabled(n[e],e,n))return e;return r;case 2:for(let e=i+1;e<n.length;++e)if(!t.resolveDisabled(n[e],e,n))return e;return r;case 3:for(let e=n.length-1;e>=0;--e)if(!t.resolveDisabled(n[e],e,n))return e;return r;case 4:for(let r=0;r<n.length;++r)if(t.resolveId(n[r],r,n)===e.id)return r;return r;case 5:return null;default:gae(e)}}var ls,vae=s((()=>{ls=(e=>(e[e.First=0]=`First`,e[e.Previous=1]=`Previous`,e[e.Next=2]=`Next`,e[e.Last=3]=`Last`,e[e.Specific=4]=`Specific`,e[e.Nothing=5]=`Nothing`,e))(ls||{})}));function yae(e={},t=null,n=[]){for(let[r,i]of Object.entries(e))xae(n,bae(t,r),i);return n}function bae(e,t){return e?e+`[`+t+`]`:t}function xae(e,t,n){if(Array.isArray(n))for(let[r,i]of n.entries())xae(e,bae(t,r.toString()),i);else n instanceof Date?e.push([t,n.toISOString()]):typeof n==`boolean`?e.push([t,n?`1`:`0`]):typeof n==`string`?e.push([t,n]):typeof n==`number`?e.push([t,`${n}`]):n==null?e.push([t,``]):yae(n,t,e)}var Sae=s((()=>{})),Cae=s((()=>{}));function us(e,t,n,r){Oo.isServer||fr(i=>{e??=window,e.addEventListener(t,n,r),i(()=>e.removeEventListener(t,n,r))})}var ds=s((()=>{G(),ko()}));function fs(){let e=A(0);return eae(`keydown`,t=>{t.key===`Tab`&&(e.value=+!!t.shiftKey)}),e}var ps,wae=s((()=>{G(),tae(),ps=(e=>(e[e.Forwards=0]=`Forwards`,e[e.Backwards=1]=`Backwards`,e))(ps||{})}));function Tae(e){if(!e)return new Set;if(typeof e==`function`)return new Set(e());let t=new Set;for(let n of e.value){let e=Co(n);e instanceof HTMLElement&&t.add(e)}return t}function Eae(e){let t=A(cs.slice());return pr( Line truncated
%c💡 Tip:%c Pass a plain object instead — wrapping a proxy inside another proxy may cause weird bugs.
%c💡 Tip:%c Pass a plain object instead - wrapping a proxy inside another proxy may cause weird bugs.
%c🔍 Debug Info:%c The problematic value is shown below:`,`background: #fdd835; color: #000; font-weight: bold; padding: 2px 4px; border-radius: 3px;`,`color: inherit;`,i,`color: #00bfa5; font-weight: bold;`,`color: inherit;`,`color: #03a9f4; font-weight: bold;`,`color: inherit;`,r,e),console.groupCollapsed(`%c📜 Proxy assignment trace`,`color: #9c27b0; font-weight: bold;`),console.trace({value:r,raw:a}),console.groupEnd()),Object.entries(a).forEach(([e,t])=>{let r=n(t,i+1);Reflect.set(a,e,r)||console.warn(`%c🚫 Readonly Property Error:%c Failed to set property "%s" on object.
%c💡 Tip:%c This property is readonly or non-configurable. You cannot unpack a readonly property — the value was not updated.
%c💡 Tip:%c This property is readonly or non-configurable. You cannot unpack a readonly property - the value was not updated.
%c🔍 Debug Info:%c Property: %s | Value: %o | Object: %o`,`background: #f44336; color: #fff; font-weight: bold; padding: 2px 4px; border-radius: 3px;`,`color: inherit;`,e,`color: #00bfa5; font-weight: bold;`,`color: inherit;`,`color: #03a9f4; font-weight: bold;`,`color: inherit;`,e,r,a)}),a)};return n(e)}})),wd,Td=s((()=>{ed(),Zu(),Cd(),wd=e=>{let t=new WeakSet,n=new WeakMap,r=e=>{if(!Qu(e)&&!Array.isArray(e))return e;let i=Sd(e,{depth:1});if(n.has(i))return n.get(i);if(t.has(i))return`[circular]`;if(t.add(i),`$ref`in e){let t=K(e),a=r(t),o=Object.entries(e).filter(([e])=>e!==`$ref`&&e!==`$ref-value`);if(o.length>0&&Qu(a)){let e={...a};for(let[t,n]of o)e[t]=r(n);return n.set(i,e),e}return n.set(i,a),a}if(Array.isArray(e)){let t=e.map(r);return n.set(i,t),t}let a=Object.fromEntries(Object.entries(e).map(([e,t])=>[e,r(t)]));return n.set(i,a),a};return r(e)}})),Ed,Dd,Od=s((()=>{Zu(),Ed=(e,t,n)=>{if(!e&&!t)return;let r=!!e&&Object.keys(e).length>0,i=n||Object.keys(e??{})[0]||``,a=K(e?.[i]);if(a!==void 0)return a;if((!r||!n)&&t!==void 0)return{value:K(t)}},Dd=(e,t,n)=>{if(`content`in e){let r=e.content?.[n??Object.keys(e.content)[0]??``],i=Ed(r?.examples,r?.example,t);if(i!==void 0)return i}if(`examples`in e||`example`in e){let n=Ed(e.examples,e.example,t);if(n!==void 0)return n}let r=K(e);if(`schema`in r&&r.schema){let e=r.schema;if(`default`in e&&e.default!==void 0)return{value:e.default};if(`enum`in e&&e.enum?.[0]!==void 0)return{value:e.enum[0]};if(`examples`in e&&e.examples?.[0]!==void 0)return{value:e.examples[0]};if(`example`in e&&e.example!==void 0)return{value:e.example}}}})),kd,Kve,Ad,qve,jd,Md,Nd=s((()=>{Zu(),Cd(),kd=e=>typeof e==`object`&&!!e&&`$dynamicRef`in e&&typeof e.$dynamicRef==`string`,Kve=e=>`$dynamicAnchor`in e||`$id`in e||`$defs`in e,Ad=new WeakMap,qve=e=>{let t=Sd(e,{depth:1}),n=Ad.get(t);if(n)return n;let r=new Map,i=e=>{if(!e||typeof e!=`object`)return;let t=e.$dynamicAnchor;typeof t==`string`&&!r.has(t)&&r.set(t,K(e,Xu))};i(e);let a=e.$defs;if(a&&typeof a==`object`)for(let e of Object.keys(a))i(a[e]);return Ad.set(t,r),r},jd=(e,t)=>Kve(t)?[...e,t]:e,Md=(e,t)=>{let n=e.startsWith(`#`)?e.slice(1):void 0;if(!(!n||n.startsWith(`/`)))for(let e of t){let t=qve(e).get(n);if(t)return t}}}));function Jve(e){return Rd(e)&&!Pd(e)&&!Bd(e)&&Symbol.asyncIterator in e}function Pd(e){return Array.isArray(e)}function Yve(e){return typeof e==`bigint`}function Fd(e){return typeof e==`boolean`}function Id(e){return e instanceof globalThis.Date}function Xve(e){return typeof e==`function`}function Zve(e){return Rd(e)&&!Pd(e)&&!Bd(e)&&Symbol.iterator in e}function Qve(e){return e===null}function Ld(e){return typeof e==`number`}function Rd(e){return typeof e==`object`&&!!e}function $ve(e){return e instanceof globalThis.RegExp}function zd(e){return typeof e==`string`}function eye(e){return typeof e==`symbol`}function Bd(e){return e instanceof globalThis.Uint8Array}function Vd(e){return e===void 0}var Hd=s((()=>{}));function tye(e){return e.map(e=>Ud(e))}function nye(e){return new Date(e.getTime())}function rye(e){return new Uint8Array(e)}function iye(e){return new RegExp(e.source,e.flags)}function aye(e){let t={};for(let n of Object.getOwnPropertyNames(e))t[n]=Ud(e[n]);for(let n of Object.getOwnPropertySymbols(e))t[n]=Ud(e[n]);return t}function Ud(e){return Pd(e)?tye(e):Id(e)?nye(e):Bd(e)?rye(e):$ve(e)?iye(e):Rd(e)?aye(e):e}function Wd(e){return Ud(e)}var Gd=s((()=>{Hd()}));function Kd(e,t){return Wd(t===void 0?e:{...t,...e})}var qd=s((()=>{Gd()})),oye=s((()=>{qd(),Gd()}));function sye(e){return Zd(e)&&globalThis.Symbol.asyncIterator in e}function cye(e){return Zd(e)&&globalThis.Symbol.iterator in e}function lye(e){return e instanceof globalThis.Promise}function Jd(e){return e instanceof Date&&globalThis.Number.isFinite(e.getTime())}function uye(e){return e instanceof globalThis.Map}function dye(e){return e instanceof globalThis.Set}function fye(e){return globalThis.ArrayBuffer.isView(e)}function Yd(e){return e instanceof globalThis.Uint8Array}function Xd(e,t){return t in e}function Zd(e){return typeof e==`object`&&!!e}function Qd(e){return globalThis.Array.isArray(e)&&!globalThis.ArrayBuffer.isView(e)}function $d(e){return e===void 0}function ef(e){return e===null}function tf(e){return typeof e==`boolean`}function nf(e){return typeof e==`number`}function pye(e){return globalThis.Number.isInteger(e)}function rf(e){return typeof e==`bigint`}function af(e){return typeof e==`string`}function of(e){return typeof e==`function`}function sf(e){return typeof e==`symbol`}function mye(e){return rf(e)||tf(e)||ef(e)||nf(e)||af(e)||sf(e)||$d(e)}var cf=s((()=>{})),lf=s((()=>{cf()})),uf,hye=s((()=>{lf(),(function(e){e.InstanceMode=`default`,e.ExactOptionalPropertyTypes=!1,e.AllowArrayObject=!1,e.AllowNaN=!1,e.AllowNullVoid=!1;function t(t,n){return e.ExactOptionalPropertyTypes?n in t:t[n]!==void 0}e.IsExactOptionalProperty=t;function n(t){let n=Zd(t);return e.AllowArrayObject?n:n&&!Qd(t)}e.IsObjectLike=n;function r(e){retu Line truncated
- The browser URL must be on the same domain as the server URL.
@@ -66,7 +66,7 @@
https://github.com/highlightjs/highlight.js/issues/2277`),i=e,r=t),n===void 0&&(n=!0);let a={code:r,language:i};pe(`before:highlight`,a);let o=a.result?a.result:v(a.language,a.code,n);return o.code=a.code,pe(`after:highlight`,o),o}function v(e,n,i,a){let c=Object.create(null);function u(e,t){return e.keywords[t]}function d(){if(!C.keywords){ce.addText(ue);return}let e=0;C.keywordPatternRe.lastIndex=0;let t=C.keywordPatternRe.exec(ue),n=``;for(;t;){n+=ue.substring(e,t.index);let r=ae.case_insensitive?t[0].toLowerCase():t[0],i=u(C,r);if(i){let[e,a]=i;if(ce.addText(n),n=``,c[r]=(c[r]||0)+1,c[r]<=Ue&&(de+=a),e.startsWith(`_`))n+=t[0];else{let n=ae.classNameAliases[e]||e;m(t[0],n)}}else n+=t[0];e=C.keywordPatternRe.lastIndex,t=C.keywordPatternRe.exec(ue)}n+=ue.substring(e),ce.addText(n)}function f(){if(ue===``)return;let e=null;if(typeof C.subLanguage==`string`){if(!t[C.subLanguage]){ce.addText(ue);return}e=v(C.subLanguage,ue,!0,se[C.subLanguage]),se[C.subLanguage]=e._top}else e=te(ue,C.subLanguage.length?C.subLanguage:null);C.relevance>0&&(de+=e.relevance),ce.__addSublanguage(e._emitter,e.language)}function p(){C.subLanguage==null?d():f(),ue=``}function m(e,t){e!==``&&(ce.startScope(t),ce.addText(e),ce.endScope())}function h(e,t){let n=1,r=t.length-1;for(;n<=r;){if(!e._emit[n]){n++;continue}let r=ae.classNameAliases[e[n]]||e[n],i=t[n];r?m(i,r):(ue=i,d(),ue=``),n++}}function g(e,t){return e.scope&&typeof e.scope==`string`&&ce.openNode(ae.classNameAliases[e.scope]||e.scope),e.beginScope&&(e.beginScope._wrap?(m(ue,ae.classNameAliases[e.beginScope._wrap]||e.beginScope._wrap),ue=``):e.beginScope._multi&&(h(e.beginScope,t),ue=``)),C=Object.create(e,{parent:{value:C}}),C}function _(e,t,n){let i=ee(e.endRe,n);if(i){if(e[`on:end`]){let n=new r(e);e[`on:end`](t,n),n.isMatchIgnored&&(i=!1)}if(i){for(;e.endsParent&&e.parent;)e=e.parent;return e}}if(e.endsWithParent)return _(e.parent,t,n)}function y(e){return C.matcher.regexIndex===0?(ue+=e[0],1):(fe=!0,0)}function b(e){let t=e[0],n=e.rule,i=new r(n),a=[n.__beforeBegin,n[`on:begin`]];for(let n of a)if(n&&(n(e,i),i.isMatchIgnored))return y(t);return n.skip?ue+=t:(n.excludeBegin&&(ue+=t),p(),!n.returnBegin&&!n.excludeBegin&&(ue=t)),g(n,e),n.returnBegin?0:t.length}function ne(e){let t=e[0],r=n.substring(e.index),i=_(C,e,r);if(!i)return He;let a=C;C.endScope&&C.endScope._wrap?(p(),m(t,C.endScope._wrap)):C.endScope&&C.endScope._multi?(p(),h(C.endScope,e)):a.skip?ue+=t:(a.returnEnd||a.excludeEnd||(ue+=t),p(),a.excludeEnd&&(ue=t));do C.scope&&ce.closeNode(),!C.skip&&!C.subLanguage&&(de+=C.relevance),C=C.parent;while(C!==i.parent);return i.starts&&g(i.starts,e),a.returnEnd?0:t.length}function x(){let e=[];for(let t=C;t!==ae;t=t.parent)t.scope&&e.unshift(t.scope);e.forEach(e=>ce.openNode(e))}let re={};function ie(t,r){let a=r&&r[0];if(ue+=t,a==null)return p(),0;if(re.type===`begin`&&r.type===`end`&&re.index===r.index&&a===``){if(ue+=n.slice(r.index,r.index+1),!o){let t=Error(`0 width match regex (${e})`);throw t.languageName=e,t.badRule=re.rule,t}return 1}if(re=r,r.type===`begin`)return b(r);if(r.type===`illegal`&&!i){let e=Error(`Illegal lexeme "`+a+`" for mode "`+(C.scope||`<unnamed>`)+`"`);throw e.mode=C,e}else if(r.type===`end`){let e=ne(r);if(e!==He)return e}if(r.type===`illegal`&&a===``)return ue+=`
`,1;if(T>1e5&&T>r.index*3)throw Error(`potential infinite loop, way more iterations than matches`);return ue+=a,a.length}let ae=le(e);if(!ae)throw Ee(s.replace(`{}`,e)),Error(`Unknown language: "`+e+`"`);let oe=Fe(ae),S=``,C=a||oe,se={},ce=new l.__emitter(l);x();let ue=``,de=0,w=0,T=0,fe=!1;try{if(ae.__emitTokens)ae.__emitTokens(n,ce);else{for(C.matcher.considerAll();;){T++,fe?fe=!1:C.matcher.considerAll(),C.matcher.lastIndex=w;let e=C.matcher.exec(n);if(!e)break;let t=ie(n.substring(w,e.index),e);w=e.index+t}ie(n.substring(w))}return ce.finalize(),S=ce.toHTML(),{language:e,value:S,relevance:de,illegal:!1,_emitter:ce,_top:C}}catch(t){if(t.message&&t.message.includes(`Illegal`))return{language:e,value:Be(n),illegal:!0,relevance:0,_illegalBy:{message:t.message,index:w,context:n.slice(w-100,w+100),mode:t.mode,resultSoFar:S},_emitter:ce};if(o)return{language:e,value:Be(n),illegal:!1,relevance:0,errorRaised:t,_emitter:ce,_top:C};throw t}}function b(e){let t={value:Be(e),illegal:!1,relevance:0,_top:c,_emitter:new l.__emitter(l)};return t._emitter.addText(e),t}function te(e,n){n=n||l.languages||Object.keys(t);let r=b(e),i=n.filter(le).filter(de).map(t=>v(t,e,!1));i.unshift(r);let[a,o]=i.sort((e,t)=>{if(e.relevance!==t.relevance)return t.relevance-e.relevance;if(e.language&&t.language){if(le(e.language).supersetOf===t.language)return 1;if(le(t.language).supersetOf===e.language)return-1}return 0}),s=a;return s.secondBest=o,s}function ne(e,t,n){let r=t&&i[t]||n;e.classList.add(`hljs`),e.classList.add(`language-${r}`)}function x(e){let t=null,n=d(e);if(u(n))return;if(pe(`before:highlightElement`,{el:e,language:n}),e.dataset.highlighted){console.log("Element previously highlighted. To highlight again, first unset `dataset.highlighted`.",e);return}if(e.children.length>0&&(l.ignoreUnescapedHTML||(console.warn(`One of your code blocks includes unescaped HTML. This is a potentially serious security risk.`),console.warn(`https://github.com/highlightjs/highlight.js/wiki/security`),console.warn(`The element with unescaped HTML:`),console.warn(e)),l.throwUnescapedHTML))throw new ze(`One of your code blocks includes unescaped HTML.`,e.innerHTML);t=e;let r=t.textContent,i=n?p(r,{language:n,ignoreIllegals:!0}):te(r);e.innerHTML=i.value,e.dataset.highlighted=`yes`,ne(e,n,i.language),e.result={language:i.language,re:i.relevance,relevance:i.relevance},i.secondBest&&(e.secondBest={language:i.secondBest.language,relevance:i.secondBest.relevance}),pe(`after:highlightElement`,{el:e,result:i,text:r})}function re(e){l=Ve(l,e)}let ie=()=>{S(),Oe(`10.6.0`,`initHighlighting() deprecated. Use highlightAll() now.`)};function ae(){S(),Oe(`10.6.0`,`initHighlightingOnLoad() deprecated. Use highlightAll() now.`)}let oe=!1;function S(){function e(){S()}if(document.readyState===`loading`){oe||window.addEventListener(`DOMContentLoaded`,e,!1),oe=!0;return}document.querySelectorAll(l.cssSelector).forEach(x)}function C(n,r){let i=null;try{i=r(e)}catch(e){if(Ee(`Language definition for '{}' could not be registered.`.replace(`{}`,n)),o)Ee(e);else throw e;i=c}i.name||=n,t[n]=i,i.rawDefinition=r.bind(null,e),i.aliases&&ue(i.aliases,{languageName:n})}function se(e){delete t[e];for(let t of Object.keys(i))i[t]===e&&delete i[t]}function ce(){return Object.keys(t)}function le(e){return e=(e||``).toLowerCase(),t[e]||t[i[e]]}function ue(e,{languageName:t}){typeof e==`string`&&(e=[e]),e.forEach(e=>{i[e.toLowerCase()]=t})}function de(e){let t=le(e);return t&&!t.disableAutodetect}function w(e){e[`before:highlightBlock`]&&!e[`before:highlightElement`]&&(e[`before:highlightElement`]=t=>{e[`before:highlightBlock`](Object.assign({block:t.el},t))}),e[`after:highlightBlock`]&&!e[`after:highlightElement`]&&(e[`after:highlightElement`]=t=>{e[`after:highlightBlock`](Object.assign({block:t.el},t))})}function T(e){w(e),a.push(e)}function fe(e){let t=a.indexOf(e);t!==-1&&a.splice(t,1)}function pe(e,t){let n=e;a.forEach(function(e){e[n]&&e[n](t)})}function D(e){return Oe(`10.7.0`,`highlightBlock will be removed entirely in v12.0`),Oe(`10.7.0`,`Please use highlightElement now.`),x(e)}Object.assign(e,{highlight:p,highlightAuto:te,highlightAll:S,highlightElement:x,highlightBlock:D,configure:re,initHighlighting:ie,initHighlightingOnLoad:ae,registerLanguage:C,unregisterLanguage:se,listLanguages:ce,getLanguage:le,registerAliases:ue,autoDetection:de,inherit:Ve,addPlugin:T,removePlugin:fe}),e.debugMode=function(){o=!1},e.safeMode=function(){o=!0},e.versionString=Re,e.regex={concat:_,lookahead:m,either:y,optional:g,anyNumberOfTimes:h};for(let e in E)typeof E[e]==`object`&&n(E[e]);return Object.assign(e,E),e},Ge=We({});Ge.newInstance=()=>We({}),t.exports=Ge,Ge.HighlightJS=Ge,Ge.default=Ge}))()).default,UR={},nit=`hljs-`,rit=class{constructor(e){this.options=e,this.root={type:`root`,children:[],data:{language:void 0,relevance:0}},this.stack=[this.root]}addText(e){if(e===``)return;let t=this.stack[this.stack.length-1],n=t.children[t.children.length-1];n&&n.type===`text`?n.value+=e:t.chil Line truncated
`},l]}}function Fit(e){let t=gat(e),n=Sat,r=`([\\w-]+|@\\{[\\w-]+\\})`,i=[],a=[],o=function(e){return{className:`string`,begin:`~?`+e+`.*?`+e}},s=function(e,t,n){return{className:e,begin:t,relevance:n}},c={$pattern:/[a-z-]+/,keyword:`and or not only`,attribute:bat.join(` `)},l={begin:`\\(`,end:`\\)`,contains:a,keywords:c,relevance:0};a.push(e.C_LINE_COMMENT_MODE,e.C_BLOCK_COMMENT_MODE,o(`'`),o(`"`),t.CSS_NUMBER_MODE,{begin:`(url|data-uri)\\(`,starts:{className:`string`,end:`[\\)\\n]`,excludeEnd:!0}},t.HEXCOLOR,l,s(`variable`,`@@?[\\w-]+`,10),s(`variable`,`@\\{[\\w-]+\\}`),s(`built_in`,"~?`[^`]*?`"),{className:`attribute`,begin:`[\\w-]+\\s*:`,end:`:`,returnBegin:!0,excludeEnd:!0},t.IMPORTANT,{beginKeywords:`and not`},t.FUNCTION_DISPATCH);let u=a.concat({begin:/\{/,end:/\}/,contains:i}),d={beginKeywords:`when`,endsWithParent:!0,contains:[{beginKeywords:`and not`}].concat(a)},f={begin:`([\\w-]+|@\\{[\\w-]+\\})\\s*:`,returnBegin:!0,end:/[;}]/,relevance:0,contains:[{begin:/-(webkit|moz|ms|o)-/},t.CSS_VARIABLE,{className:`attribute`,begin:`\\b(`+xat.join(`|`)+`)\\b`,end:/(?=:)/,starts:{endsWithParent:!0,illegal:`[<=$]`,relevance:0,contains:a}}]},p={className:`keyword`,begin:`@(import|media|charset|font-face|(-[a-z]+-)?keyframes|supports|document|namespace|page|viewport|host)\\b`,starts:{end:`[;{}]`,keywords:c,returnEnd:!0,contains:a,relevance:0}},m={className:`variable`,variants:[{begin:`@[\\w-]+\\s*:`,relevance:15},{begin:`@[\\w-]+`}],starts:{end:`[;}]`,returnEnd:!0,contains:u}},h={variants:[{begin:`[\\.#:&\\[>]`,end:`[;{}]`},{begin:r,end:/\{/}],returnBegin:!0,returnEnd:!0,illegal:`[<='$"]`,relevance:0,contains:[e.C_LINE_COMMENT_MODE,e.C_BLOCK_COMMENT_MODE,d,s(`keyword`,`all\\b`),s(`variable`,`@\\{[\\w-]+\\}`),{begin:`\\b(`+yat.join(`|`)+`)\\b`,className:`selector-tag`},t.CSS_NUMBER_MODE,s(`selector-tag`,r,0),s(`selector-id`,`#([\\w-]+|@\\{[\\w-]+\\})`),s(`selector-class`,`\\.([\\w-]+|@\\{[\\w-]+\\})`,0),s(`selector-tag`,`&`,0),t.ATTRIBUTE_SELECTOR_MODE,{className:`selector-pseudo`,begin:`:(`+cz.join(`|`)+`)`},{className:`selector-pseudo`,begin:`:(:)?(`+lz.join(`|`)+`)`},{begin:/\(/,end:/\)/,relevance:0,contains:u},{begin:`!important`},t.FUNCTION_DISPATCH]},g={begin:`[\\w-]+:(:)?(${n.join(`|`)})`,returnBegin:!0,contains:[h]};return i.push(e.C_LINE_COMMENT_MODE,e.C_BLOCK_COMMENT_MODE,p,m,g,f,h,d,t.FUNCTION_DISPATCH),{name:`Less`,case_insensitive:!0,illegal:`[=>'/<($"]`,contains:i}}function Iit(e){let t=`\\[=*\\[`,n=`\\]=*\\]`,r={begin:t,end:n,contains:[`self`]},i=[e.COMMENT(`--(?!\\[=*\\[)`,`$`),e.COMMENT(`--\\[=*\\[`,n,{contains:[r],relevance:10})];return{name:`Lua`,aliases:[`pluto`],keywords:{$pattern:e.UNDERSCORE_IDENT_RE,literal:`true false nil`,keyword:`and break do else elseif end for goto if in local not or repeat return then until while`,built_in:`_G _ENV _VERSION __index __newindex __mode __call __metatable __tostring __len __gc __add __sub __mul __div __mod __pow __concat __unm __eq __lt __le assert collectgarbage dofile error getfenv getmetatable ipairs load loadfile loadstring module next pairs pcall print rawequal rawget rawset require select setfenv setmetatable tonumber tostring type unpack xpcall arg self coroutine resume yield status wrap create running debug getupvalue debug sethook getmetatable gethook setmetatable setlocal traceback setfenv getinfo setupvalue getlocal getregistry getfenv io lines write close flush open output type read stderr stdin input stdout popen tmpfile math log max acos huge ldexp pi cos tanh pow deg tan cosh sinh random randomseed frexp ceil floor rad abs sqrt modf asin min mod fmod log10 atan2 exp sin atan os exit setlocale date getenv difftime remove time clock tmpname rename execute package preload loadlib loaded loaders cpath config path seeall string sub upper len gfind rep find match char dump gmatch reverse byte format gsub lower table setn insert getn foreachi maxn foreach concat sort remove`},contains:i.concat([{className:`function`,beginKeywords:`function`,end:`\\)`,contains:[e.inherit(e.TITLE_MODE,{begin:`([_a-zA-Z]\\w*\\.)*([_a-zA-Z]\\w*:)?[_a-zA-Z]\\w*`}),{className:`params`,begin:`\\(`,endsWithParent:!0,contains:i}].concat(i)},e.C_NUMBER_MODE,e.APOS_STRING_MODE,e.QUOTE_STRING_MODE,{className:`string`,begin:t,end:n,contains:[r],relevance:5}])}}function Lit(e){let t={className:`variable`,variants:[{begin:`\\$\\(`+e.UNDERSCORE_IDENT_RE+`\\)`,contains:[e.BACKSLASH_ESCAPE]},{begin:/\$[@%<?\^\+\*]/}]},n={className:`string`,begin:/"/,end:/"/,contains:[e.BACKSLASH_ESCAPE,t]},r={className:`variable`,begin:/\$\([\w-]+\s/,end:/\)/,keywords:{built_in:`subst patsubst strip findstring filter filter-out sort word wordlist firstword lastword dir notdir suffix basename addsuffix addprefix join wildcard realpath abspath error warning shell origin flavor foreach if or and call eval file value`},contains:[t,n]},i={begin:`^`+e.UNDERSCORE_IDENT_RE+`\\s*(?=[:+?]?=)`},a={className:`meta`,begin:/^\.PHONY:/,end:/$/,keywords:{$pattern:/[\.\w]+/,keyword:`.PHONY`}},o={className:`sectLine truncated
]`,m={scope:`string`,variants:[u,l,d,f]},h={scope:`number`,variants:[{begin:`\\b0[bB][01]+(?:_[01]+)*\\b`},{begin:`\\b0[oO][0-7]+(?:_[0-7]+)*\\b`},{begin:`\\b0[xX][\\da-fA-F]+(?:_[\\da-fA-F]+)*\\b`},{begin:`(?:\\b\\d+(?:_\\d+)*(\\.(?:\\d+(?:_\\d+)*))?|\\B\\.\\d+)(?:[eE][+-]?\\d+)?`}],relevance:0},g=[`false`,`null`,`true`],_=`__CLASS__.__DIR__.__FILE__.__FUNCTION__.__COMPILER_HALT_OFFSET__.__LINE__.__METHOD__.__NAMESPACE__.__TRAIT__.die.echo.exit.include.include_once.print.require.require_once.array.abstract.and.as.binary.bool.boolean.break.callable.case.catch.class.clone.const.continue.declare.default.do.double.else.elseif.empty.enddeclare.endfor.endforeach.endif.endswitch.endwhile.enum.eval.extends.final.finally.float.for.foreach.from.global.goto.if.implements.instanceof.insteadof.int.integer.interface.isset.iterable.list.match|0.mixed.new.never.object.or.private.protected.public.readonly.real.return.string.switch.throw.trait.try.unset.use.var.void.while.xor.yield`.split(`.`),v=`Error|0.AppendIterator.ArgumentCountError.ArithmeticError.ArrayIterator.ArrayObject.AssertionError.BadFunctionCallException.BadMethodCallException.CachingIterator.CallbackFilterIterator.CompileError.Countable.DirectoryIterator.DivisionByZeroError.DomainException.EmptyIterator.ErrorException.Exception.FilesystemIterator.FilterIterator.GlobIterator.InfiniteIterator.InvalidArgumentException.IteratorIterator.LengthException.LimitIterator.LogicException.MultipleIterator.NoRewindIterator.OutOfBoundsException.OutOfRangeException.OuterIterator.OverflowException.ParentIterator.ParseError.RangeException.RecursiveArrayIterator.RecursiveCachingIterator.RecursiveCallbackFilterIterator.RecursiveDirectoryIterator.RecursiveFilterIterator.RecursiveIterator.RecursiveIteratorIterator.RecursiveRegexIterator.RecursiveTreeIterator.RegexIterator.RuntimeException.SeekableIterator.SplDoublyLinkedList.SplFileInfo.SplFileObject.SplFixedArray.SplHeap.SplMaxHeap.SplMinHeap.SplObjectStorage.SplObserver.SplPriorityQueue.SplQueue.SplStack.SplSubject.SplTempFileObject.TypeError.UnderflowException.UnexpectedValueException.UnhandledMatchError.ArrayAccess.BackedEnum.Closure.Fiber.Generator.Iterator.IteratorAggregate.Serializable.Stringable.Throwable.Traversable.UnitEnum.WeakReference.WeakMap.Directory.__PHP_Incomplete_Class.parent.php_user_filter.self.static.stdClass`.split(`.`),y={keyword:_,literal:(e=>{let t=[];return e.forEach(e=>{t.push(e),e.toLowerCase()===e?t.push(e.toUpperCase()):t.push(e.toLowerCase())}),t})(g),built_in:v},b=e=>e.map(e=>e.replace(/\|\d+$/,``)),ee={variants:[{match:[/new/,t.concat(p,`+`),t.concat(`(?!`,b(v).join(`\\b|`),`\\b)`),i],scope:{1:`keyword`,4:`title.class`}}]},te=t.concat(r,`\\b(?!\\()`),ne={variants:[{match:[t.concat(/::/,t.lookahead(/(?!class\b)/)),te],scope:{2:`variable.constant`}},{match:[/::/,/class/],scope:{2:`variable.language`}},{match:[i,t.concat(/::/,t.lookahead(/(?!class\b)/)),te],scope:{1:`title.class`,3:`variable.constant`}},{match:[i,t.concat(`::`,t.lookahead(/(?!class\b)/))],scope:{1:`title.class`}},{match:[i,/::/,/class/],scope:{1:`title.class`,3:`variable.language`}}]},x={scope:`attr`,match:t.concat(r,t.lookahead(`:`),t.lookahead(/(?!::)/))},re={relevance:0,begin:/\(/,end:/\)/,keywords:y,contains:[x,o,ne,e.C_BLOCK_COMMENT_MODE,m,h,ee]},ie={relevance:0,match:[/\b/,t.concat(`(?!fn\\b|function\\b|`,b(_).join(`\\b|`),`|`,b(v).join(`\\b|`),`\\b)`),r,t.concat(p,`*`),t.lookahead(/(?=\()/)],scope:{3:`title.function.invoke`},contains:[re]};re.contains.push(ie);let ae=[x,ne,e.C_BLOCK_COMMENT_MODE,m,h,ee],oe={begin:t.concat(/#\[\s*\\?/,t.either(i,a)),beginScope:`meta`,end:/]/,endScope:`meta`,keywords:{literal:g,keyword:[`new`,`array`]},contains:[{begin:/\[/,end:/]/,keywords:{literal:g,keyword:[`new`,`array`]},contains:[`self`,...ae]},...ae,{scope:`meta`,variants:[{match:i},{match:a}]}]};return{case_insensitive:!1,keywords:y,contains:[oe,e.HASH_COMMENT_MODE,e.COMMENT(`//`,`$`),e.COMMENT(`/\\*`,`\\*/`,{contains:[{scope:`doctag`,match:`@[A-Za-z]+`}]}),{match:/__halt_compiler\(\);/,keywords:`__halt_compiler`,starts:{scope:`comment`,end:e.MATCH_NOTHING_RE,contains:[{match:/\?>/,scope:`meta`,endsParent:!0}]}},s,{scope:`variable.language`,match:/\$this\b/},o,ie,ne,{match:[/const/,/\s/,r],scope:{1:`keyword`,3:`variable.constant`}},ee,{scope:`function`,relevance:0,beginKeywords:`fn function`,end:/[;{]/,excludeEnd:!0,illegal:`[$%\\[]`,contains:[{beginKeywords:`use`},e.UNDERSCORE_TITLE_MODE,{begin:`=>`,endsParent:!0},{scope:`params`,begin:`\\(`,end:`\\)`,excludeBegin:!0,excludeEnd:!0,keywords:y,contains:[`self`,oe,o,ne,e.C_BLOCK_COMMENT_MODE,m,h]}]},{scope:`class`,variants:[{beginKeywords:`enum`,illegal:/[($"]/},{beginKeywords:`class interface trait`,illegal:/[:($"]/}],relevance:0,end:/\{/,excludeEnd:!0,contains:[{beginKeywords:`extends implements`},e.UNDERSCORE_TITLE_MODE]},{beginKeywords:`namespace`,relevance:0,end:`;`,illegal:/[.']/,contains:[e.inherit(e.UNDERSCORE_TITLE_MODE,{scope:`title.class`})]},{beginKeywords:`use`,relevance:0,en Line truncated
]`,m={scope:`string`,variants:[u,l,d,f]},h={scope:`number`,variants:[{begin:`\\b0[bB][01]+(?:_[01]+)*\\b`},{begin:`\\b0[oO][0-7]+(?:_[0-7]+)*\\b`},{begin:`\\b0[xX][\\da-fA-F]+(?:_[\\da-fA-F]+)*\\b`},{begin:`(?:\\b\\d+(?:_\\d+)*(\\.(?:\\d+(?:_\\d+)*))?|\\B\\.\\d+)(?:[eE][+-]?\\d+)?`}],relevance:0},g=[`false`,`null`,`true`],_=`__CLASS__.__DIR__.__FILE__.__FUNCTION__.__COMPILER_HALT_OFFSET__.__LINE__.__METHOD__.__NAMESPACE__.__TRAIT__.die.echo.exit.include.include_once.print.require.require_once.array.abstract.and.as.binary.bool.boolean.break.callable.case.catch.class.clone.const.continue.declare.default.do.double.else.elseif.empty.enddeclare.endfor.endforeach.endif.endswitch.endwhile.enum.eval.extends.final.finally.float.for.foreach.from.global.goto.if.implements.instanceof.insteadof.int.integer.interface.isset.iterable.list.match|0.mixed.new.never.object.or.private.protected.public.readonly.real.return.string.switch.throw.trait.try.unset.use.var.void.while.xor.yield`.split(`.`),v=`Error|0.AppendIterator.ArgumentCountError.ArithmeticError.ArrayIterator.ArrayObject.AssertionError.BadFunctionCallException.BadMethodCallException.CachingIterator.CallbackFilterIterator.CompileError.Countable.DirectoryIterator.DivisionByZeroError.DomainException.EmptyIterator.ErrorException.Exception.FilesystemIterator.FilterIterator.GlobIterator.InfiniteIterator.InvalidArgumentException.IteratorIterator.LengthException.LimitIterator.LogicException.MultipleIterator.NoRewindIterator.OutOfBoundsException.OutOfRangeException.OuterIterator.OverflowException.ParentIterator.ParseError.RangeException.RecursiveArrayIterator.RecursiveCachingIterator.RecursiveCallbackFilterIterator.RecursiveDirectoryIterator.RecursiveFilterIterator.RecursiveIterator.RecursiveIteratorIterator.RecursiveRegexIterator.RecursiveTreeIterator.RegexIterator.RuntimeException.SeekableIterator.SplDoublyLinkedList.SplFileInfo.SplFileObject.SplFixedArray.SplHeap.SplMaxHeap.SplMinHeap.SplObjectStorage.SplObserver.SplPriorityQueue.SplQueue.SplStack.SplSubject.SplTempFileObject.TypeError.UnderflowException.UnexpectedValueException.UnhandledMatchError.ArrayAccess.BackedEnum.Closure.Fiber.Generator.Iterator.IteratorAggregate.Serializable.Stringable.Throwable.Traversable.UnitEnum.WeakReference.WeakMap.Directory.__PHP_Incomplete_Class.parent.php_user_filter.self.static.stdClass`.split(`.`),y={keyword:_,literal:(e=>{let t=[];return e.forEach(e=>{t.push(e),e.toLowerCase()===e?t.push(e.toUpperCase()):t.push(e.toLowerCase())}),t})(g),built_in:v},b=e=>e.map(e=>e.replace(/\|\d+$/,``)),ee={variants:[{match:[/new/,t.concat(p,`+`),t.concat(`(?!`,b(v).join(`\\b|`),`\\b)`),i],scope:{1:`keyword`,4:`title.class`}}]},te=t.concat(r,`\\b(?!\\()`),ne={variants:[{match:[t.concat(/::/,t.lookahead(/(?!class\b)/)),te],scope:{2:`variable.constant`}},{match:[/::/,/class/],scope:{2:`variable.language`}},{match:[i,t.concat(/::/,t.lookahead(/(?!class\b)/)),te],scope:{1:`title.class`,3:`variable.constant`}},{match:[i,t.concat(`::`,t.lookahead(/(?!class\b)/))],scope:{1:`title.class`}},{match:[i,/::/,/class/],scope:{1:`title.class`,3:`variable.language`}}]},x={scope:`attr`,match:t.concat(r,t.lookahead(`:`),t.lookahead(/(?!::)/))},re={relevance:0,begin:/\(/,end:/\)/,keywords:y,contains:[x,o,ne,e.C_BLOCK_COMMENT_MODE,m,h,ee]},ie={relevance:0,match:[/\b/,t.concat(`(?!fn\\b|function\\b|`,b(_).join(`\\b|`),`|`,b(v).join(`\\b|`),`\\b)`),r,t.concat(p,`*`),t.lookahead(/(?=\()/)],scope:{3:`title.function.invoke`},contains:[re]};re.contains.push(ie);let ae=[x,ne,e.C_BLOCK_COMMENT_MODE,m,h,ee],oe={begin:t.concat(/#\[\s*\\?/,t.either(i,a)),beginScope:`meta`,end:/]/,endScope:`meta`,keywords:{literal:g,keyword:[`new`,`array`]},contains:[{begin:/\[/,end:/]/,keywords:{literal:g,keyword:[`new`,`array`]},contains:[`self`,...ae]},...ae,{scope:`meta`,variants:[{match:i},{match:a}]}]};return{case_insensitive:!1,keywords:y,contains:[oe,e.HASH_COMMENT_MODE,e.COMMENT(`//`,`$`),e.COMMENT(`/\\*`,`\\*/`,{contains:[{scope:`doctag`,match:`@[A-Za-z]+`}]}),{match:/__halt_compiler\(\);/,keywords:`__halt_compiler`,starts:{scope:`comment`,end:e.MATCH_NOTHING_RE,contains:[{match:/\?>/,scope:`meta`,endsParent:!0}]}},s,{scope:`variable.language`,match:/\$this\b/},o,ie,ne,{match:[/const/,/\s/,r],scope:{1:`keyword`,3:`variable.constant`}},ee,{scope:`function`,relevance:0,beginKeywords:`fn function`,end:/[;{]/,excludeEnd:!0,illegal:`[$%\\[]`,contains:[{beginKeywords:`use`},e.UNDERSCORE_TITLE_MODE,{begin:`=>`,endsParent:!0},{scope:`params`,begin:`\\(`,end:`\\)`,excludeBegin:!0,excludeEnd:!0,keywords:y,contains:[`self`,oe,o,ne,e.C_BLOCK_COMMENT_MODE,m,h]}]},{scope:`class`,variants:[{beginKeywords:`enum`,illegal:/[($"]/},{beginKeywords:`class interface trait`,illegal:/[:($"]/}],relevance:0,end:/\{/,excludeEnd:!0,contains:[{beginKeywords:`extends implements`},e.UNDERSCORE_TITLE_MODE]},{beginKeywords:`namespace`,relevance:0,end:`;`,illegal:/[.']/,contains:[e.inherit(e.UNDERSCORE_TITLE_MODE,{scope:`title.class`})]},{beginKeywords:`use`,relevance:0,en Line truncated
\f\r &/=>`.split(``),`
\f\r "&'/=>\``.split(``)],[`\0
\f\r "&'/<=>`.split(``),`\0
@@ -128,7 +128,7 @@ https://github.com/highlightjs/highlight.js/issues/2277`),i=e,r=t),n===void 0&&(
])`},{atBreak:!0,character:`-`,after:`(?:[ \r
-])`},{atBreak:!0,before:`\\d+`,character:`.`,after:`(?:[ \r
]|$)`},{atBreak:!0,character:`<`,after:`[!/?A-Za-z]`},{character:`<`,after:`[!/?A-Za-z]`,inConstruct:`phrasing`,notInConstruct:cU},{character:`<`,inConstruct:`destinationLiteral`},{atBreak:!0,character:`=`},{atBreak:!0,character:`>`},{character:`>`,inConstruct:`destinationLiteral`},{atBreak:!0,character:`[`},{character:`[`,inConstruct:`phrasing`,notInConstruct:cU},{character:`[`,inConstruct:[`label`,`reference`]},{character:`\\`,after:`[\\r\\n]`,inConstruct:`phrasing`},{character:`]`,inConstruct:[`label`,`reference`]},{atBreak:!0,character:`_`},{character:`_`,inConstruct:`phrasing`,notInConstruct:cU},{atBreak:!0,character:"`"},{character:"`",inConstruct:[`codeFencedLangGraveAccent`,`codeFencedMetaGraveAccent`]},{character:"`",inConstruct:`phrasing`,notInConstruct:cU},{atBreak:!0,character:`~`}],lU={AElig:`Æ`,AMP:`&`,Aacute:`Á`,Abreve:`Ă`,Acirc:`Â`,Acy:`А`,Afr:`𝔄`,Agrave:`À`,Alpha:`Α`,Amacr:`Ā`,And:`⩓`,Aogon:`Ą`,Aopf:`𝔸`,ApplyFunction:`⁡`,Aring:`Å`,Ascr:`𝒜`,Assign:`≔`,Atilde:`Ã`,Auml:`Ä`,Backslash:`∖`,Barv:`⫧`,Barwed:`⌆`,Bcy:`Б`,Because:`∵`,Bernoullis:`ℬ`,Beta:`Β`,Bfr:`𝔅`,Bopf:`𝔹`,Breve:`˘`,Bscr:`ℬ`,Bumpeq:`≎`,CHcy:`Ч`,COPY:`©`,Cacute:`Ć`,Cap:`⋒`,CapitalDifferentialD:`ⅅ`,Cayleys:`ℭ`,Ccaron:`Č`,Ccedil:`Ç`,Ccirc:`Ĉ`,Cconint:`∰`,Cdot:`Ċ`,Cedilla:`¸`,CenterDot:`·`,Cfr:`ℭ`,Chi:`Χ`,CircleDot:`⊙`,CircleMinus:`⊖`,CirclePlus:`⊕`,CircleTimes:`⊗`,ClockwiseContourIntegral:`∲`,CloseCurlyDoubleQuote:`”`,CloseCurlyQuote:`’`,Colon:`∷`,Colone:`⩴`,Congruent:`≡`,Conint:`∯`,ContourIntegral:`∮`,Copf:`ℂ`,Coproduct:`∐`,CounterClockwiseContourIntegral:`∳`,Cross:`⨯`,Cscr:`𝒞`,Cup:`⋓`,CupCap:`≍`,DD:`ⅅ`,DDotrahd:`⤑`,DJcy:`Ђ`,DScy:`Ѕ`,DZcy:`Џ`,Dagger:`‡`,Darr:`↡`,Dashv:`⫤`,Dcaron:`Ď`,Dcy:`Д`,Del:`∇`,Delta:`Δ`,Dfr:`𝔇`,DiacriticalAcute:`´`,DiacriticalDot:`˙`,DiacriticalDoubleAcute:`˝`,DiacriticalGrave:"`",DiacriticalTilde:`˜`,Diamond:`⋄`,DifferentialD:`ⅆ`,Dopf:`𝔻`,Dot:`¨`,DotDot:`⃜`,DotEqual:`≐`,DoubleContourIntegral:`∯`,DoubleDot:`¨`,DoubleDownArrow:`⇓`,DoubleLeftArrow:`⇐`,DoubleLeftRightArrow:`⇔`,DoubleLeftTee:`⫤`,DoubleLongLeftArrow:`⟸`,DoubleLongLeftRightArrow:`⟺`,DoubleLongRightArrow:`⟹`,DoubleRightArrow:`⇒`,DoubleRightTee:`⊨`,DoubleUpArrow:`⇑`,DoubleUpDownArrow:`⇕`,DoubleVerticalBar:`∥`,DownArrow:`↓`,DownArrowBar:`⤓`,DownArrowUpArrow:`⇵`,DownBreve:`̑`,DownLeftRightVector:`⥐`,DownLeftTeeVector:`⥞`,DownLeftVector:`↽`,DownLeftVectorBar:`⥖`,DownRightTeeVector:`⥟`,DownRightVector:`⇁`,DownRightVectorBar:`⥗`,DownTee:`⊤`,DownTeeArrow:`↧`,Downarrow:`⇓`,Dscr:`𝒟`,Dstrok:`Đ`,ENG:`Ŋ`,ETH:`Ð`,Eacute:`É`,Ecaron:`Ě`,Ecirc:`Ê`,Ecy:`Э`,Edot:`Ė`,Efr:`𝔈`,Egrave:`È`,Element:`∈`,Emacr:`Ē`,EmptySmallSquare:`◻`,EmptyVerySmallSquare:`▫`,Eogon:`Ę`,Eopf:`𝔼`,Epsilon:`Ε`,Equal:`⩵`,EqualTilde:`≂`,Equilibrium:`⇌`,Escr:`ℰ`,Esim:`⩳`,Eta:`Η`,Euml:`Ë`,Exists:`∃`,ExponentialE:`ⅇ`,Fcy:`Ф`,Ffr:`𝔉`,FilledSmallSquare:`◼`,FilledVerySmallSquare:`▪`,Fopf:`𝔽`,ForAll:`∀`,Fouriertrf:`ℱ`,Fscr:`ℱ`,GJcy:`Ѓ`,GT:`>`,Gamma:`Γ`,Gammad:`Ϝ`,Gbreve:`Ğ`,Gcedil:`Ģ`,Gcirc:`Ĝ`,Gcy:`Г`,Gdot:`Ġ`,Gfr:`𝔊`,Gg:`⋙`,Gopf:`𝔾`,GreaterEqual:`≥`,GreaterEqualLess:`⋛`,GreaterFullEqual:`≧`,GreaterGreater:`⪢`,GreaterLess:`≷`,GreaterSlantEqual:`⩾`,GreaterTilde:`≳`,Gscr:`𝒢`,Gt:`≫`,HARDcy:`Ъ`,Hacek:`ˇ`,Hat:`^`,Hcirc:`Ĥ`,Hfr:`ℌ`,HilbertSpace:`ℋ`,Hopf:`ℍ`,HorizontalLine:`─`,Hscr:`ℋ`,Hstrok:`Ħ`,HumpDownHump:`≎`,HumpEqual:`≏`,IEcy:`Е`,IJlig:`IJ`,IOcy:`Ё`,Iacute:`Í`,Icirc:`Î`,Icy:`И`,Idot:`İ`,Ifr:`ℑ`,Igrave:`Ì`,Im:`ℑ`,Imacr:`Ī`,ImaginaryI:`ⅈ`,Implies:`⇒`,Int:`∬`,Integral:`∫`,Intersection:`⋂`,InvisibleComma:`⁣`,InvisibleTimes:`⁢`,Iogon:`Į`,Iopf:`𝕀`,Iota:`Ι`,Iscr:`ℐ`,Itilde:`Ĩ`,Iukcy:`І`,Iuml:`Ï`,Jcirc:`Ĵ`,Jcy:`Й`,Jfr:`𝔍`,Jopf:`𝕁`,Jscr:`𝒥`,Jsercy:`Ј`,Jukcy:`Є`,KHcy:`Х`,KJcy:`Ќ`,Kappa:`Κ`,Kcedil:`Ķ`,Kcy:`К`,Kfr:`𝔎`,Kopf:`𝕂`,Kscr:`𝒦`,LJcy:`Љ`,LT:`<`,Lacute:`Ĺ`,Lambda:`Λ`,Lang:`⟪`,Laplacetrf:`ℒ`,Larr:`↞`,Lcaron:`Ľ`,Lcedil:`Ļ`,Lcy:`Л`,LeftAngleBracket:`⟨`,LeftArrow:`←`,LeftArrowBar:`⇤`,LeftArrowRightArrow:`⇆`,LeftCeiling:`⌈`,LeftDoubleBracket:`⟦`,LeftDownTeeVector:`⥡`,LeftDownVector:`⇃`,LeftDownVectorBar:`⥙`,LeftFloor:`⌊`,LeftRightArrow:`↔`,LeftRightVector:`⥎`,LeftTee:`⊣`,LeftTeeArrow:`↤`,LeftTeeVector:`⥚`,LeftTriangle:`⊲`,LeftTriangleBar:`⧏`,LeftTriangleEqual:`⊴`,LeftUpDownVector:`⥑`,LeftUpTeeVector:`⥠`,LeftUpVector:`↿`,LeftUpVectorBar:`⥘`,LeftVector:`↼`,LeftVectorBar:`⥒`,Leftarrow:`⇐`,Leftrightarrow:`⇔`,LessEqualGreater:`⋚`,LessFullEqual:`≦`,LessGreater:`≶`,LessLess:`⪡`,LessSlantEqual:`⩽`,LessTilde:`≲`,Lfr:`𝔏`,Ll:`⋘`,Lleftarrow:`⇚`,Lmidot:`Ŀ`,LongLeftArrow:`⟵`,LongLeftRightArrow:`⟷`,LongRightArrow:`⟶`,Longleftarrow:`⟸`,Longleftrightarrow:`⟺`,Longrightarrow:Line truncated
`,Nfr:`𝔑`,NoBreak:`⁠`,NonBreakingSpace:`\xA0`,Nopf:`ℕ`,Not:`⫬`,NotCongruent:`≢`,NotCupCap:`≭`,NotDoubleVerticalBar:`∦`,NotElement:`∉`,NotEqual:`≠`,NotEqualTilde:`≂̸`,NotExists:`∄`,NotGreater:`≯`,NotGreaterEqual:`≱`,NotGreaterFullEqual:`≧̸`,NotGreaterGreater:`≫̸`,NotGreaterLess:`≹`,NotGreaterSlantEqual:`⩾̸`,NotGreaterTilde:`≵`,NotHumpDownHump:`≎̸`,NotHumpEqual:`≏̸`,NotLeftTriangle:`⋪`,NotLeftTriangleBar:`⧏̸`,NotLeftTriangleEqual:`⋬`,NotLess:`≮`,NotLessEqual:`≰`,NotLessGreater:`≸`,NotLessLess:`≪̸`,NotLessSlantEqual:`⩽̸`,NotLessTilde:`≴`,NotNestedGreaterGreater:`⪢̸`,NotNestedLessLess:`⪡̸`,NotPrecedes:`⊀`,NotPrecedesEqual:`⪯̸`,NotPrecedesSlantEqual:`⋠`,NotReverseElement:`∌`,NotRightTriangle:`⋫`,NotRightTriangleBar:`⧐̸`,NotRightTriangleEqual:`⋭`,NotSquareSubset:`⊏̸`,NotSquareSubsetEqual:`⋢`,NotSquareSuperset:`⊐̸`,NotSquareSupersetEqual:`⋣`,NotSubset:`⊂⃒`,NotSubsetEqual:`⊈`,NotSucceeds:`⊁`,NotSucceedsEqual:`⪰̸`,NotSucceedsSlantEqual:`⋡`,NotSucceedsTilde:`≿̸`,NotSuperset:`⊃⃒`,NotSupersetEqual:`⊉`,NotTilde:`≁`,NotTildeEqual:`≄`,NotTildeFullEqual:`≇`,NotTildeTilde:`≉`,NotVerticalBar:`∤`,Nscr:`𝒩`,Ntilde:`Ñ`,Nu:`Ν`,OElig:`Œ`,Oacute:`Ó`,Ocirc:`Ô`,Ocy:`О`,Odblac:`Ő`,Ofr:`𝔒`,Ograve:`Ò`,Omacr:`Ō`,Omega:`Ω`,Omicron:`Ο`,Oopf:`𝕆`,OpenCurlyDoubleQuote:`“`,OpenCurlyQuote:`‘`,Or:`⩔`,Oscr:`𝒪`,Oslash:`Ø`,Otilde:`Õ`,Otimes:`⨷`,Ouml:`Ö`,OverBar:`‾`,OverBrace:`⏞`,OverBracket:`⎴`,OverParenthesis:`⏜`,PartialD:`∂`,Pcy:`П`,Pfr:`𝔓`,Phi:`Φ`,Pi:`Π`,PlusMinus:`±`,Poincareplane:`ℌ`,Popf:`ℙ`,Pr:`⪻`,Precedes:`≺`,PrecedesEqual:`⪯`,PrecedesSlantEqual:`≼`,PrecedesTilde:`≾`,Prime:`″`,Product:`∏`,Proportion:`∷`,Proportional:`∝`,Pscr:`𝒫`,Psi:`Ψ`,QUOT:`"`,Qfr:`𝔔`,Qopf:`ℚ`,Qscr:`𝒬`,RBarr:`⤐`,REG:`®`,Racute:`Ŕ`,Rang:`⟫`,Rarr:`↠`,Rarrtl:`⤖`,Rcaron:`Ř`,Rcedil:`Ŗ`,Rcy:`Р`,Re:`ℜ`,ReverseElement:`∋`,ReverseEquilibrium:`⇋`,ReverseUpEquilibrium:`⥯`,Rfr:`ℜ`,Rho:`Ρ`,RightAngleBracket:`⟩`,RightArrow:`→`,RightArrowBar:`⇥`,RightArrowLeftArrow:`⇄`,RightCeiling:`⌉`,RightDoubleBracket:`⟧`,RightDownTeeVector:`⥝`,RightDownVector:`⇂`,RightDownVectorBar:`⥕`,RightFloor:`⌋`,RightTee:`⊢`,RightTeeArrow:`↦`,RightTeeVector:`⥛`,RightTriangle:`⊳`,RightTriangleBar:`⧐`,RightTriangleEqual:`⊵`,RightUpDownVector:`⥏`,RightUpTeeVector:`⥜`,RightUpVector:`↾`,RightUpVectorBar:`⥔`,RightVector:`⇀`,RightVectorBar:`⥓`,Rightarrow:`⇒`,Ropf:`ℝ`,RoundImplies:`⥰`,Rrightarrow:`⇛`,Rscr:`ℛ`,Rsh:`↱`,RuleDelayed:`⧴`,SHCHcy:`Щ`,SHcy:`Ш`,SOFTcy:`Ь`,Sacute:`Ś`,Sc:`⪼`,Scaron:`Š`,Scedil:`Ş`,Scirc:`Ŝ`,Scy:`С`,Sfr:`𝔖`,ShortDownArrow:`↓`,ShortLeftArrow:`←`,ShortRightArrow:`→`,ShortUpArrow:`↑`,Sigma:`Σ`,SmallCircle:`∘`,Sopf:`𝕊`,Sqrt:`√`,Square:`□`,SquareIntersection:`⊓`,SquareSubset:`⊏`,SquareSubsetEqual:`⊑`,SquareSuperset:`⊐`,SquareSupersetEqual:`⊒`,SquareUnion:`⊔`,Sscr:`𝒮`,Star:`⋆`,Sub:`⋐`,Subset:`⋐`,SubsetEqual:`⊆`,Succeeds:`≻`,SucceedsEqual:`⪰`,SucceedsSlantEqual:`≽`,SucceedsTilde:`≿`,SuchThat:`∋`,Sum:`∑`,Sup:`⋑`,Superset:`⊃`,SupersetEqual:`⊇`,Supset:`⋑`,THORN:`Þ`,TRADE:`™`,TSHcy:`Ћ`,TScy:`Ц`,Tab:` `,Tau:`Τ`,Tcaron:`Ť`,Tcedil:`Ţ`,Tcy:`Т`,Tfr:`𝔗`,Therefore:`∴`,Theta:`Θ`,ThickSpace:`  `,ThinSpace:` `,Tilde:`∼`,TildeEqual:`≃`,TildeFullEqual:`≅`,TildeTilde:`≈`,Topf:`𝕋`,TripleDot:`⃛`,Tscr:`𝒯`,Tstrok:`Ŧ`,Uacute:`Ú`,Uarr:`↟`,Uarrocir:`⥉`,Ubrcy:`Ў`,Ubreve:`Ŭ`,Ucirc:`Û`,Ucy:`У`,Udblac:`Ű`,Ufr:`𝔘`,Ugrave:`Ù`,Umacr:`Ū`,UnderBar:`_`,UnderBrace:`⏟`,UnderBracket:`⎵`,UnderParenthesis:`⏝`,Union:`⋃`,UnionPlus:`⊎`,Uogon:`Ų`,Uopf:`𝕌`,UpArrow:`↑`,UpArrowBar:`⤒`,UpArrowDownArrow:`⇅`,UpDownArrow:`↕`,UpEquilibrium:`⥮`,UpTee:`⊥`,UpTeeArrow:`↥`,Uparrow:`⇑`,Updownarrow:`⇕`,UpperLeftArrow:`↖`,UpperRightArrow:`↗`,Upsi:`ϒ`,Upsilon:`Υ`,Uring:`Ů`,Uscr:`𝒰`,Utilde:`Ũ`,Uuml:`Ü`,VDash:`⊫`,Vbar:`⫫`,Vcy:`В`,Vdash:`⊩`,Vdashl:`⫦`,Vee:`⋁`,Verbar:`‖`,Vert:`‖`,VerticalBar:`∣`,VerticalLine:`|`,VerticalSeparator:`❘`,VerticalTilde:`≀`,VeryThinSpace:` `,Vfr:`𝔙`,Vopf:`𝕍`,Vscr:`𝒱`,Vvdash:`⊪`,Wcirc:`Ŵ`,Wedge:`⋀`,Wfr:`𝔚`,Wopf:`𝕎`,Wscr:`𝒲`,Xfr:`𝔛`,Xi:`Ξ`,Xopf:`𝕏`,Xscr:`𝒳`,YAcy:`Я`,YIcy:`Ї`,YUcy:`Ю`,Yacute:`Ý`,Ycirc:`Ŷ`,Ycy:`Ы`,Yfr:`𝔜`,Yopf:`𝕐`,Yscr:`𝒴`,Yuml:`Ÿ`,ZHcy:`Ж`,Zacute:`Ź`,Zcaron:`Ž`,Zcy:`З`,Zdot:`Ż`,ZeroWidthSpace:`​`,Zeta:`Ζ`,Zfr:`ℨ`,Zopf:`ℤ`,Zscr:`𝒵`,aacute:`á`,abreve:`ă`,ac:`∾`,acE:`∾̳`,acd:`∿`,acirc:`â`,acute:`´`,acy:`а`,aelig:`æ`,af:`⁡`,afr:`𝔞`,agrave:`à`,alefsym:`ℵ`,aleph:`ℵ`,alpha:`α`,amacr:`ā`,amalg:`⨿`,amp:`&`,and:`∧`,andand:`⩕`,andd:`⩜`,andslope:`⩘`,andv:`⩚`,ang:`∠`,ange:`⦤`,angle:`∠`,angmsd:`∡`,angmsdaa:`⦨`,angmsdab:`⦩`,angmsdac:`⦪`,angmsda Line truncated
`,Nfr:`𝔑`,NoBreak:`⁠`,NonBreakingSpace:`\xA0`,Nopf:`ℕ`,Not:`⫬`,NotCongruent:`≢`,NotCupCap:`≭`,NotDoubleVerticalBar:`∦`,NotElement:`∉`,NotEqual:`≠`,NotEqualTilde:`≂̸`,NotExists:`∄`,NotGreater:`≯`,NotGreaterEqual:`≱`,NotGreaterFullEqual:`≧̸`,NotGreaterGreater:`≫̸`,NotGreaterLess:`≹`,NotGreaterSlantEqual:`⩾̸`,NotGreaterTilde:`≵`,NotHumpDownHump:`≎̸`,NotHumpEqual:`≏̸`,NotLeftTriangle:`⋪`,NotLeftTriangleBar:`⧏̸`,NotLeftTriangleEqual:`⋬`,NotLess:`≮`,NotLessEqual:`≰`,NotLessGreater:`≸`,NotLessLess:`≪̸`,NotLessSlantEqual:`⩽̸`,NotLessTilde:`≴`,NotNestedGreaterGreater:`⪢̸`,NotNestedLessLess:`⪡̸`,NotPrecedes:`⊀`,NotPrecedesEqual:`⪯̸`,NotPrecedesSlantEqual:`⋠`,NotReverseElement:`∌`,NotRightTriangle:`⋫`,NotRightTriangleBar:`⧐̸`,NotRightTriangleEqual:`⋭`,NotSquareSubset:`⊏̸`,NotSquareSubsetEqual:`⋢`,NotSquareSuperset:`⊐̸`,NotSquareSupersetEqual:`⋣`,NotSubset:`⊂⃒`,NotSubsetEqual:`⊈`,NotSucceeds:`⊁`,NotSucceedsEqual:`⪰̸`,NotSucceedsSlantEqual:`⋡`,NotSucceedsTilde:`≿̸`,NotSuperset:`⊃⃒`,NotSupersetEqual:`⊉`,NotTilde:`≁`,NotTildeEqual:`≄`,NotTildeFullEqual:`≇`,NotTildeTilde:`≉`,NotVerticalBar:`∤`,Nscr:`𝒩`,Ntilde:`Ñ`,Nu:`Ν`,OElig:`Œ`,Oacute:`Ó`,Ocirc:`Ô`,Ocy:`О`,Odblac:`Ő`,Ofr:`𝔒`,Ograve:`Ò`,Omacr:`Ō`,Omega:`Ω`,Omicron:`Ο`,Oopf:`𝕆`,OpenCurlyDoubleQuote:`“`,OpenCurlyQuote:`‘`,Or:`⩔`,Oscr:`𝒪`,Oslash:`Ø`,Otilde:`Õ`,Otimes:`⨷`,Ouml:`Ö`,OverBar:`‾`,OverBrace:`⏞`,OverBracket:`⎴`,OverParenthesis:`⏜`,PartialD:`∂`,Pcy:`П`,Pfr:`𝔓`,Phi:`Φ`,Pi:`Π`,PlusMinus:`±`,Poincareplane:`ℌ`,Popf:`ℙ`,Pr:`⪻`,Precedes:`≺`,PrecedesEqual:`⪯`,PrecedesSlantEqual:`≼`,PrecedesTilde:`≾`,Prime:`″`,Product:`∏`,Proportion:`∷`,Proportional:`∝`,Pscr:`𝒫`,Psi:`Ψ`,QUOT:`"`,Qfr:`𝔔`,Qopf:`ℚ`,Qscr:`𝒬`,RBarr:`⤐`,REG:`®`,Racute:`Ŕ`,Rang:`⟫`,Rarr:`↠`,Rarrtl:`⤖`,Rcaron:`Ř`,Rcedil:`Ŗ`,Rcy:`Р`,Re:`ℜ`,ReverseElement:`∋`,ReverseEquilibrium:`⇋`,ReverseUpEquilibrium:`⥯`,Rfr:`ℜ`,Rho:`Ρ`,RightAngleBracket:`⟩`,RightArrow:`→`,RightArrowBar:`⇥`,RightArrowLeftArrow:`⇄`,RightCeiling:`⌉`,RightDoubleBracket:`⟧`,RightDownTeeVector:`⥝`,RightDownVector:`⇂`,RightDownVectorBar:`⥕`,RightFloor:`⌋`,RightTee:`⊢`,RightTeeArrow:`↦`,RightTeeVector:`⥛`,RightTriangle:`⊳`,RightTriangleBar:`⧐`,RightTriangleEqual:`⊵`,RightUpDownVector:`⥏`,RightUpTeeVector:`⥜`,RightUpVector:`↾`,RightUpVectorBar:`⥔`,RightVector:`⇀`,RightVectorBar:`⥓`,Rightarrow:`⇒`,Ropf:`ℝ`,RoundImplies:`⥰`,Rrightarrow:`⇛`,Rscr:`ℛ`,Rsh:`↱`,RuleDelayed:`⧴`,SHCHcy:`Щ`,SHcy:`Ш`,SOFTcy:`Ь`,Sacute:`Ś`,Sc:`⪼`,Scaron:`Š`,Scedil:`Ş`,Scirc:`Ŝ`,Scy:`С`,Sfr:`𝔖`,ShortDownArrow:`↓`,ShortLeftArrow:`←`,ShortRightArrow:`→`,ShortUpArrow:`↑`,Sigma:`Σ`,SmallCircle:`∘`,Sopf:`𝕊`,Sqrt:`√`,Square:`□`,SquareIntersection:`⊓`,SquareSubset:`⊏`,SquareSubsetEqual:`⊑`,SquareSuperset:`⊐`,SquareSupersetEqual:`⊒`,SquareUnion:`⊔`,Sscr:`𝒮`,Star:`⋆`,Sub:`⋐`,Subset:`⋐`,SubsetEqual:`⊆`,Succeeds:`≻`,SucceedsEqual:`⪰`,SucceedsSlantEqual:`≽`,SucceedsTilde:`≿`,SuchThat:`∋`,Sum:`∑`,Sup:`⋑`,Superset:`⊃`,SupersetEqual:`⊇`,Supset:`⋑`,THORN:`Þ`,TRADE:`™`,TSHcy:`Ћ`,TScy:`Ц`,Tab:` `,Tau:`Τ`,Tcaron:`Ť`,Tcedil:`Ţ`,Tcy:`Т`,Tfr:`𝔗`,Therefore:`∴`,Theta:`Θ`,ThickSpace:`  `,ThinSpace:` `,Tilde:`∼`,TildeEqual:`≃`,TildeFullEqual:`≅`,TildeTilde:`≈`,Topf:`𝕋`,TripleDot:`⃛`,Tscr:`𝒯`,Tstrok:`Ŧ`,Uacute:`Ú`,Uarr:`↟`,Uarrocir:`⥉`,Ubrcy:`Ў`,Ubreve:`Ŭ`,Ucirc:`Û`,Ucy:`У`,Udblac:`Ű`,Ufr:`𝔘`,Ugrave:`Ù`,Umacr:`Ū`,UnderBar:`_`,UnderBrace:`⏟`,UnderBracket:`⎵`,UnderParenthesis:`⏝`,Union:`⋃`,UnionPlus:`⊎`,Uogon:`Ų`,Uopf:`𝕌`,UpArrow:`↑`,UpArrowBar:`⤒`,UpArrowDownArrow:`⇅`,UpDownArrow:`↕`,UpEquilibrium:`⥮`,UpTee:`⊥`,UpTeeArrow:`↥`,Uparrow:`⇑`,Updownarrow:`⇕`,UpperLeftArrow:`↖`,UpperRightArrow:`↗`,Upsi:`ϒ`,Upsilon:`Υ`,Uring:`Ů`,Uscr:`𝒰`,Utilde:`Ũ`,Uuml:`Ü`,VDash:`⊫`,Vbar:`⫫`,Vcy:`В`,Vdash:`⊩`,Vdashl:`⫦`,Vee:`⋁`,Verbar:`‖`,Vert:`‖`,VerticalBar:`∣`,VerticalLine:`|`,VerticalSeparator:`❘`,VerticalTilde:`≀`,VeryThinSpace:` `,Vfr:`𝔙`,Vopf:`𝕍`,Vscr:`𝒱`,Vvdash:`⊪`,Wcirc:`Ŵ`,Wedge:`⋀`,Wfr:`𝔚`,Wopf:`𝕎`,Wscr:`𝒲`,Xfr:`𝔛`,Xi:`Ξ`,Xopf:`𝕏`,Xscr:`𝒳`,YAcy:`Я`,YIcy:`Ї`,YUcy:`Ю`,Yacute:`Ý`,Ycirc:`Ŷ`,Ycy:`Ы`,Yfr:`𝔜`,Yopf:`𝕐`,Yscr:`𝒴`,Yuml:`Ÿ`,ZHcy:`Ж`,Zacute:`Ź`,Zcaron:`Ž`,Zcy:`З`,Zdot:`Ż`,ZeroWidthSpace:`​`,Zeta:`Ζ`,Zfr:`ℨ`,Zopf:`ℤ`,Zscr:`𝒵`,aacute:`á`,abreve:`ă`,ac:`∾`,acE:`∾̳`,acd:`∿`,acirc:`â`,acute:`´`,acy:`а`,aelig:`æ`,af:`⁡`,afr:`𝔞`,agrave:`à`,alefsym:`ℵ`,aleph:`ℵ`,alpha:`α`,amacr:`ā`,amalg:`⨿`,amp:`&`,and:`∧`,andand:`⩕`,andd:`⩜`,andslope:`⩘`,andv:`⩚`,ang:`∠`,ange:`⦤`,angle:`∠`,angmsd:`∡`,angmsdaa:`⦨`,angmsdab:`⦩`,angmsdac:`⦪`,angmsda Line truncated
`)}},DW.defaultYaml={explicit:!1,version:`1.2`},DW.defaultTags={"!!":`tag:yaml.org,2002:`}}));function gbt(e){if(/[\x00-\x19\s,[\]{}]/.test(e)){let t=`Anchor must not contain whitespace or control characters: ${JSON.stringify(e)}`;throw Error(t)}return!0}function _bt(e){let t=new Set;return yW(e,{Value(e,n){n.anchor&&t.add(n.anchor)}}),t}function vbt(e,t){for(let n=1;;++n){let r=`${e}${n}`;if(!t.has(r))return r}}function ybt(e,t){let n=[],r=new Map,i=null;return{onAnchor:r=>{n.push(r),i??=_bt(e);let a=vbt(t,i);return i.add(a),a},setAnchors:()=>{for(let e of n){let t=r.get(e);if(typeof t==`object`&&t.anchor&&(hW(t.node)||nW(t.node)))t.node.anchor=t.anchor;else{let t=Error(`Failed to resolve repeated object (this should not happen)`);throw t.source=e,t}}},sourceObjects:r}}var OW=s((()=>{vW(),EW()}));function kW(e,t,n,r){if(r&&typeof r==`object`)if(Array.isArray(r))for(let t=0,n=r.length;t<n;++t){let n=r[t],i=kW(e,r,String(t),n);i===void 0?delete r[t]:i!==n&&(r[t]=i)}else if(r instanceof Map)for(let t of Array.from(r.keys())){let n=r.get(t),i=kW(e,r,t,n);i===void 0?r.delete(t):i!==n&&r.set(t,i)}else if(r instanceof Set)for(let t of Array.from(r)){let n=kW(e,r,t,t);n===void 0?r.delete(t):n!==t&&(r.delete(t),r.add(n))}else for(let[t,n]of Object.entries(r)){let i=kW(e,r,t,n);i===void 0?delete r[t]:i!==n&&(r[t]=i)}return e.call(t,n,r)}var bbt=s((()=>{}));function AW(e,t,n){if(Array.isArray(e))return e.map((e,t)=>AW(e,String(t),n));if(e&&typeof e.toJSON==`function`){if(!n||!_W(e))return e.toJSON(t,n);let r={aliasCount:0,count:1,res:void 0};n.anchors.set(e,r),n.onCreate=e=>{r.res=e,delete n.onCreate};let i=e.toJSON(t,n);return n.onCreate&&n.onCreate(i),i}return typeof e==`bigint`&&!n?.keep?Number(e):e}var jW=s((()=>{vW()})),MW,NW=s((()=>{bbt(),vW(),jW(),MW=class{constructor(e){Object.defineProperty(this,uW,{value:e})}clone(){let e=Object.create(Object.getPrototypeOf(this),Object.getOwnPropertyDescriptors(this));return this.range&&(e.range=this.range.slice()),e}toJS(e,{mapAsMap:t,maxAliasCount:n,onAnchor:r,reviver:i}={}){if(!fW(e))throw TypeError(`A document argument is required`);let a={anchors:new Map,doc:e,keep:!0,mapAsMap:t===!0,mapKeyWarned:!1,maxAliasCount:typeof n==`number`?n:100},o=AW(this,``,a);if(typeof r==`function`)for(let{count:e,res:t}of a.anchors.values())r(t,e);return typeof i==`function`?kW(i,{"":o},``,o):o}}}));function PW(e,t,n){if(dW(t)){let r=t.resolve(e),i=n&&r&&n.get(r);return i?i.count*i.aliasCount:0}else if(nW(t)){let r=0;for(let i of t.items){let t=PW(e,i,n);t>r&&(r=t)}return r}else if(mW(t)){let r=PW(e,t.key,n),i=PW(e,t.value,n);return Math.max(r,i)}return 1}var FW,IW=s((()=>{OW(),EW(),vW(),NW(),jW(),FW=class extends MW{constructor(e){super(iW),this.source=e,Object.defineProperty(this,"tag",{set(){throw Error(`Alias nodes cannot have tags`)}})}resolve(e,t){if(t?.maxAliasCount===0)throw ReferenceError(`Alias resolution is disabled`);let n;t?.aliasResolveCache?n=t.aliasResolveCache:(n=[],yW(e,{Node:(e,t)=>{(dW(t)||_W(t))&&n.push(t)}}),t&&(t.aliasResolveCache=n));let r;for(let e of n){if(e===this)break;e.anchor===this.source&&(r=e)}return r}toJSON(e,t){if(!t)return{source:this.source};let{anchors:n,doc:r,maxAliasCount:i}=t,a=this.resolve(r,t);if(!a){let e=`Unresolved alias (the anchor must be set before the alias): ${this.source}`;throw ReferenceError(e)}let o=n.get(a);if(o||=(AW(a,null,t),n.get(a)),o?.res===void 0)throw ReferenceError(`This should not happen: Alias anchor was not resolved?`);if(i>=0&&(o.count+=1,o.aliasCount===0&&(o.aliasCount=PW(r,a,n)),o.count*o.aliasCount>i))throw ReferenceError(`Excessive alias count indicates a resource exhaustion attack`);return o.res}toString(e,t,n){let r=`*${this.source}`;if(e){if(gbt(this.source),e.options.verifyAliasOrder&&!e.anchors.has(this.source)){let e=`Unresolved alias (the anchor must be set before the alias): ${this.source}`;throw Error(e)}if(e.implicitKey)return`${r} `}return r}}})),LW,RW,zW=s((()=>{vW(),NW(),jW(),LW=e=>!e||typeof e!=`function`&&typeof e!=`object`,RW=class extends MW{constructor(e){super(cW),this.value=e}toJSON(e,t){return t?.keep?this.value:AW(this.value,e,t)}toString(){return String(this.value)}},RW.BLOCK_FOLDED=`BLOCK_FOLDED`,RW.BLOCK_LITERAL=`BLOCK_LITERAL`,RW.PLAIN=`PLAIN`,RW.QUOTE_DOUBLE=`QUOTE_DOUBLE`,RW.QUOTE_SINGLE=`QUOTE_SINGLE`}));function xbt(e,t,n){if(t){let e=n.filter(e=>e.tag===t),r=e.find(e=>!e.format)??e[0];if(!r)throw Error(`Tag ${t} not found`);return r}return n.find(t=>t.identify?.(e)&&!t.format)}function BW(e,t,n){if(fW(e)&&(e=e.contents),rW(e))return e;if(mW(e)){let t=n.schema[oW].createNode?.(n.schema,null,n);return t.items.push(e),t}(e instanceof String||e instanceof Number||e instanceof Boolean||typeof BigInt<`u`&&e instanceof BigInt)&&(e=e.valueOf());let{aliasDuplicateObjects:r,onAnchor:i,onTagObj:a,schema:o,sourceObjects:s}=n,c;if(r&&e&&typeof e==`object`){if(c=s.get(e),c)return c.anchor??=i(e),new FW(c.anchor);c={anchor:null,node:null},s.set(e,c)}t?.startsWith(`!!`)&&(t=Sbt+t.slice(2));let l=xbt Line truncated
`)?KW(n,t):n.includes(`
`)?`
@@ -2360,11 +2360,11 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
version: "1.0.0"`})})})),Q5t,$5t=s((()=>{_e(),K2(),Q5t=T({"x-scalar-watch-mode":E(C({typeComment:`When true, the document is watched for external file changes`}))},{typeName:`XScalarWatchMode`,typeComment:G2(`Whether the document is in watch mode (reloads when the source file changes).`,{language:`yaml`,body:`x-scalar-watch-mode: true`})})})),e7t,t7t=s((()=>{_e(),K2(),e7t=T({"x-tags":E(de(S(),{typeComment:`Ordered list of tag names for this schema object`}))},{typeName:`XTags`,typeComment:G2(`Custom tag ordering hints for schema objects in the sidebar.`,{language:`yaml`,body:`x-tags:
- users
- admin`})})})),n7t=s((()=>{I5t(),R5t(),_e(),K2(),B5t(),H5t(),W5t(),K5t(),J5t(),Z5t(),$5t(),t7t()})),r7t,i7t=s((()=>{_e(),K2(),r7t=T({"x-scalar-selected-server":E(S({typeComment:"The currently selected server. For OpenAPI documents this is the server URL; for AsyncAPI documents this is the server name (key in `document.servers`)."}))},{typeName:`XScalarSelectedServer`,typeComment:G2("The currently selected server for this API description. For OpenAPI documents the value is the server URL; for AsyncAPI documents the value is the server name (key in `document.servers`).",{language:`yaml`,body:`x-scalar-selected-server: https://api.example.com`})})})),a7t=s((()=>{i7t()})),o7t,s7t=s((()=>{_e(),K2(),o7t=T({"x-additionalPropertiesName":E(S({typeComment:`Human-readable label for additional properties on this schema`}))},{typeName:`XAdditionalPropertiesName`,typeComment:G2(`Display name for additional properties on a schema object.`,{language:`yaml`,body:`x-additionalPropertiesName: metadata`})})})),q2,c7t,l7t=s((()=>{_e(),K2(),q2=fe([w(S(),S()),de(S())]),c7t=T({"x-enumDescriptions":E(q2,{typeComment:`Map or list of descriptions keyed by enum value (camelCase spelling)`}),"x-enum-descriptions":E(q2,{typeComment:`Map or list of descriptions keyed by enum value (kebab-case spelling)`})},{typeName:`XEnumDescriptions`,typeComment:G2(`Descriptions for enum values. Keys must match enum values.`,{language:`yaml`,body:`x-enumDescriptions:
other: Other reason`})})})),u7t,d7t=s((()=>{_e(),K2(),u7t=T({"x-enum-varnames":E(de(S(),{typeComment:"Display names for enum values (same order as `enum`)"})),"x-enumNames":E(de(S(),{typeComment:`Alias for x-enum-varnames — display names for enum values`}))},{typeName:`XEnumVarNames`,typeComment:G2(`Display names for enum values. Must match the order of the ${N5t(`enum`)} array.`,{language:`yaml`,body:`enum: [moon, asteroid]
other: Other reason`})})})),u7t,d7t=s((()=>{_e(),K2(),u7t=T({"x-enum-varnames":E(de(S(),{typeComment:"Display names for enum values (same order as `enum`)"})),"x-enumNames":E(de(S(),{typeComment:`Alias for x-enum-varnames - display names for enum values`}))},{typeName:`XEnumVarNames`,typeComment:G2(`Display names for enum values. Must match the order of the ${N5t(`enum`)} array.`,{language:`yaml`,body:`enum: [moon, asteroid]
x-enum-varnames: [Moon, Asteroid]`})})})),f7t,p7t=s((()=>{_e(),K2(),f7t=T({"x-examples":E(w(S(),ce(),{typeComment:`Map of example name to example value`}))},{typeName:`XExamples`,typeComment:G2(`Named examples attached to a schema. Keys are example names; values are the example payloads.`,{language:`yaml`,body:`x-examples:
user:
id: 1
name: Ada`})})})),m7t,h7t=s((()=>{_e(),K2(),m7t=T({"x-variable":E(S({typeComment:`Variable name used for substitution in the API client`}))},{typeName:`XVariable`,typeComment:G2(`References a variable for schema property substitution in the API client.`,{language:`yaml`,body:`x-variable: userId`})})})),g7t=s((()=>{s7t(),l7t(),d7t(),p7t(),h7t()})),_7t,v7t=s((()=>{_e(),_7t=T({propertyName:S({typeComment:`REQUIRED. The name of the property in the payload that will hold the discriminating value. This property SHOULD be required in the payload schema, as the behavior when the property is absent is undefined.`}),mapping:E(w(S(),S(),{typeComment:`An object to hold mappings between payload values and schema names or URI references.`}))},{typeName:`DiscriminatorObject`})})),y7t,b7t=s((()=>{_e(),y7t=T({url:S({typeComment:`REQUIRED. The URI for the target documentation. This MUST be in the form of a URI.`}),description:E(S({typeComment:`A description of the target documentation. CommonMark syntax MAY be used for rich text representation.`}))},{typeName:`ExternalDocumentationObject`})})),x7t,S7t=s((()=>{_e(),x7t=T({$status:E(fe([D(`loading`),D(`error`)]),{typeComment:`Indicates the current status of the reference resolution. Can be either 'loading' while fetching the reference or 'error' if the resolution failed.`}),$global:E(C({typeComment:`Indicates whether this reference should be resolved globally across all documents, rather than just within the current document context.`}))},{typeName:`ReferenceObjectExtensions`})})),C7t,J2,w7t=s((()=>{_e(),C7t=T({$ref:S({typeComment:`REQUIRED. The reference identifier. This MUST be in the form of a URI.`}),summary:E(S({typeComment:`A short summary which by default SHOULD override that of the referenced component. If the referenced object-type does not allow a summary field, then this field has no effect.`})),description:E(S({typeComment:`A description which by default SHOULD override that of the referenced component. CommonMark syntax MAY be used for rich text representation. If the referenced object-type does not allow a description field, then this field has no effect.`}))},{typeName:`ReferenceObject`}),J2=e=>fe([C7t,e])})),T7t,E7t=s((()=>{_e(),T7t=T({name:E(S({typeComment:`Replaces the name of the element/attribute used for the described schema property. When defined within items, it will affect the name of the individual XML elements within the list. When defined alongside type being "array" (outside the items), it will affect the wrapping element if and only if wrapped is true. If wrapped is false, it will be ignored.`})),namespace:E(S({typeComment:`The URI of the namespace definition. Value MUST be in the form of a non-relative URI.`})),prefix:E(S({typeComment:`The prefix to be used for the name.`})),attribute:E(C({typeComment:`Declares whether the property definition translates to an attribute instead of an element. Default value is false.`})),wrapped:E(C({typeComment:`MAY be used only for an array definition. Signifies whether the array is wrapped (for example, <books><book/><book/></books>) or unwrapped (<book/><book/>). Default value is false. The definition takes effect only when defined alongside type being "array" (outside the items).`}))},{typeName:`XMLObject`})})),D7t,O7t,Y2,k7t,X2,A7t,Z2,j7t,Q2,M7t,N7t,P7t,F7t,$2,I7t=s((()=>{_e(),n7t(),g7t(),v7t(),b7t(),w7t(),E7t(),D7t=[z5t,F5t,m7t,f7t,c7t,u7t,o7t,e7t],O7t=T({name:E(S({typeComment:`Schema name (extension).`})),title:E(S({typeComment:`A title for the schema.`})),description:E(S({typeComment:`A description of the schema.`})),default:E(ce({typeComment:`Default value for the schema.`})),enum:E(de(ce(),{typeComment:`Array of allowed values.`,typeName:`JsonSchemaEnum`})),const:E(ce({typeComment:`Constant value that must match exactly.`})),contentMediaType:E(S({typeComment:`Media type for content validation.`})),contentEncoding:E(S({typeComment:`Content encoding.`})),contentSchema:E(J2(me(()=>$2))),deprecated:E(C({typeComment:`Whether the schema is deprecated.`})),discriminator:E(_7t),readOnly:E(C({typeComment:`Whether the schema is read-only.`})),writeOnly:E(C({typeComment:`Whether the schema is write-only.`})),xml:E(T7t),externalDocs:E(y7t),example:E(ce({typeComment:`A free-form field to include an example of an instance for this schema. Deprecated in favor of the JSON Schema examples keyword.`})),examples:E(de(ce(),{typeComment:`An array of examples of valid instances for this schema. This keyword follows the JSON Schema Draft 2020-12 specification.`,typeName:`SchemaExamplesArray`})),allOf:E(de(J2(me(()=>$2)),{typeName:`SchemaObjectAllOf`})),oneOf:E(de(J2(me(()=>$2)),{typeName:`SchemaObjectOneOf`})),anyOf:E(de(J2(me(()=>$2)),{typeName:`SchemaObjectAnyOf`})),not:E(J2(me(()=>$2)))}),Y2=T({multipleOf:E(oe({typeComment:`Number must be a multiple of this value.`})),maximum:E(oe({typeComment:`Maximum value (inclusive).`})),exclusiveMaximum:E(oe({typeComment:`Maximum value (exclusive).`})),minimum:E(oe({typeComment:`MiLine truncated
name: Ada`})})})),m7t,h7t=s((()=>{_e(),K2(),m7t=T({"x-variable":E(S({typeComment:`Variable name used for substitution in the API client`}))},{typeName:`XVariable`,typeComment:G2(`References a variable for schema property substitution in the API client.`,{language:`yaml`,body:`x-variable: userId`})})})),g7t=s((()=>{s7t(),l7t(),d7t(),p7t(),h7t()})),_7t,v7t=s((()=>{_e(),_7t=T({propertyName:S({typeComment:`REQUIRED. The name of the property in the payload that will hold the discriminating value. This property SHOULD be required in the payload schema, as the behavior when the property is absent is undefined.`}),mapping:E(w(S(),S(),{typeComment:`An object to hold mappings between payload values and schema names or URI references.`}))},{typeName:`DiscriminatorObject`})})),y7t,b7t=s((()=>{_e(),y7t=T({url:S({typeComment:`REQUIRED. The URI for the target documentation. This MUST be in the form of a URI.`}),description:E(S({typeComment:`A description of the target documentation. CommonMark syntax MAY be used for rich text representation.`}))},{typeName:`ExternalDocumentationObject`})})),x7t,S7t=s((()=>{_e(),x7t=T({$status:E(fe([D(`loading`),D(`error`)]),{typeComment:`Indicates the current status of the reference resolution. Can be either 'loading' while fetching the reference or 'error' if the resolution failed.`}),$global:E(C({typeComment:`Indicates whether this reference should be resolved globally across all documents, rather than just within the current document context.`}))},{typeName:`ReferenceObjectExtensions`})})),C7t,J2,w7t=s((()=>{_e(),C7t=T({$ref:S({typeComment:`REQUIRED. The reference identifier. This MUST be in the form of a URI.`}),summary:E(S({typeComment:`A short summary which by default SHOULD override that of the referenced component. If the referenced object-type does not allow a summary field, then this field has no effect.`})),description:E(S({typeComment:`A description which by default SHOULD override that of the referenced component. CommonMark syntax MAY be used for rich text representation. If the referenced object-type does not allow a description field, then this field has no effect.`}))},{typeName:`ReferenceObject`}),J2=e=>fe([C7t,e])})),T7t,E7t=s((()=>{_e(),T7t=T({name:E(S({typeComment:`Replaces the name of the element/attribute used for the described schema property. When defined within items, it will affect the name of the individual XML elements within the list. When defined alongside type being "array" (outside the items), it will affect the wrapping element if and only if wrapped is true. If wrapped is false, it will be ignored.`})),namespace:E(S({typeComment:`The URI of the namespace definition. Value MUST be in the form of a non-relative URI.`})),prefix:E(S({typeComment:`The prefix to be used for the name.`})),attribute:E(C({typeComment:`Declares whether the property definition translates to an attribute instead of an element. Default value is false.`})),wrapped:E(C({typeComment:`MAY be used only for an array definition. Signifies whether the array is wrapped (for example, <books><book/><book/></books>) or unwrapped (<book/><book/>). Default value is false. The definition takes effect only when defined alongside type being "array" (outside the items).`}))},{typeName:`XMLObject`})})),D7t,O7t,Y2,k7t,X2,A7t,Z2,j7t,Q2,M7t,N7t,P7t,F7t,$2,I7t=s((()=>{_e(),n7t(),g7t(),v7t(),b7t(),w7t(),E7t(),D7t=[z5t,F5t,m7t,f7t,c7t,u7t,o7t,e7t],O7t=T({name:E(S({typeComment:`Schema name (extension).`})),title:E(S({typeComment:`A title for the schema.`})),description:E(S({typeComment:`A description of the schema.`})),default:E(ce({typeComment:`Default value for the schema.`})),enum:E(de(ce(),{typeComment:`Array of allowed values.`,typeName:`JsonSchemaEnum`})),const:E(ce({typeComment:`Constant value that must match exactly.`})),contentMediaType:E(S({typeComment:`Media type for content validation.`})),contentEncoding:E(S({typeComment:`Content encoding.`})),contentSchema:E(J2(me(()=>$2))),deprecated:E(C({typeComment:`Whether the schema is deprecated.`})),discriminator:E(_7t),readOnly:E(C({typeComment:`Whether the schema is read-only.`})),writeOnly:E(C({typeComment:`Whether the schema is write-only.`})),xml:E(T7t),externalDocs:E(y7t),example:E(ce({typeComment:`A free-form field to include an example of an instance for this schema. Deprecated in favor of the JSON Schema examples keyword.`})),examples:E(de(ce(),{typeComment:`An array of examples of valid instances for this schema. This keyword follows the JSON Schema Draft 2020-12 specification.`,typeName:`SchemaExamplesArray`})),allOf:E(de(J2(me(()=>$2)),{typeName:`SchemaObjectAllOf`})),oneOf:E(de(J2(me(()=>$2)),{typeName:`SchemaObjectOneOf`})),anyOf:E(de(J2(me(()=>$2)),{typeName:`SchemaObjectAnyOf`})),not:E(J2(me(()=>$2)))}),Y2=T({multipleOf:E(oe({typeComment:`Number must be a multiple of this value.`})),maximum:E(oe({typeComment:`Maximum value (inclusive).`})),exclusiveMaximum:E(oe({typeComment:`Maximum value (exclusive).`})),minimum:E(oe({typeComment:`MiLine truncated
`||e===`\r`,Een=e=>e===`{`||e===`[`,Den=(e,t,n)=>{let r;for(let i=n-1;i>t;--i){let t=e[i];if(t===`\r`)return;if(t===`
`)return Oen(r);if(r===void 0)r=t;else if(r[0]===t)r+=t;else return}},Oen=e=>e===void 0?0:e[0]===` `?e.length:e})),Aen,f3,jen,Men,Nen=s((()=>{Aen=(e,t)=>{let n=f3(e,`toPrecision`,t,t);return n===void 0?f3(e,`toExponential`,t,t):n},f3=(e,t,n,r)=>{let i=e[t](r).replace(jen,`$1`).replace(Men,`$1`);return i.length<=n?i:r===1?void 0:f3(e,t,n,r-1)},jen=/(e)\+/iu,Men=/\.?0*($|e)/iu})),Pen,Fen,Ien,Len=s((()=>{Pen=(e,t)=>{if(typeof e!=`string`)throw TypeError(`Input must be a JSON string: ${e}`);Fen(t)},Fen=e=>{if(Ien(e),e<0)throw TypeError(`"maxSize" argument must be positive: ${e}`);if(e<7)throw TypeError(`"maxSize" argument must be at least 7: ${e}`)},Ien=e=>{if(e===void 0)throw TypeError(`"maxSize" argument must be defined`);if(!Number.isInteger(e))throw TypeError(`"maxSize" argument must be an integer: ${e}`)}})),p3,m3,h3,Ren,zen,Ben,Ven,g3,Hen,Uen,Wen,Gen,Ken,qen,Jen=s((()=>{p3=(e,t,n)=>{let r=g3(t,n);return m3(e,t,r)},m3=(e,t,n)=>{if(n>=t)return n;let r=e[n];return r>=Ken&&r<=qen?m3(e,t,n+1):n},h3=(e,t,n)=>{if(n===void 0)return n;let r=g3(t,n);return Ren(e,r)},Ren=(e,t)=>zen(e,t)?t-3:Ben(e,t)?t-2:Ven(e,t)?t-1:t,zen=(e,t)=>t>=3&&e[t-3]>=Hen&&e[t-3]<=Uen,Ben=(e,t)=>t>=2&&e[t-2]>=Wen,Ven=(e,t)=>t>=1&&e[t-1]>=Gen,g3=(e,t)=>t<0||Object.is(t,-0)?Math.max(e+t,0):t,Hen=240,Uen=244,Wen=224,Gen=194,Ken=128,qen=191})),Yen,Xen=s((()=>{Jen(),Yen=(e,t,n)=>{let r=globalThis.Buffer.from(e),i=p3(r,r.length,t),a=h3(r,r.length,n);return i===0&&a>=r.length?r.toString():r.toString(`utf8`,i,a)}})),_3,v3,y3,b3,Zen,x3=s((()=>{_3=55296,v3=56319,y3=56320,b3=57343,Zen=/[\uD800-\uDFFF]/gu})),S3,Qen,$en=s((()=>{x3(),S3=e=>Qen(e)?e.replace(Zen,`�`):e,Qen=e=>{for(let t=0;t<e.length;t+=1){let n=e.codePointAt(t);if(n>=55296&&n<=57343)return!0}return!1}})),C3,etn=s((()=>{x3(),C3=({input:e,targetByteCount:t,firstStartSurrogate:n,lastStartSurrogate:r,firstEndSurrogate:i,lastEndSurrogate:a,increment:o,canBacktrack:s,shift:c,charIndexInit:l})=>{let u=l,d=u,f=0;for(;f<t;u+=o){d=u;let t=e.charCodeAt(u);if(Number.isNaN(t))break;if(t<=127){f+=1;continue}if(t<=2047){f+=2;continue}if(f+=3,t<n||t>r)continue;let s=e.charCodeAt(u+o);Number.isNaN(s)||s<i||s>a||(f+=1,u+=o)}return(s&&f>t?d:u)+c}})),w3,ttn,ntn,rtn=s((()=>{x3(),etn(),w3=(e,t,n)=>t<0||Object.is(t,-0)?ntn(e,t,n):ttn(e,t,n),ttn=(e,t,n)=>C3({input:e,targetByteCount:t,firstStartSurrogate:_3,lastStartSurrogate:v3,firstEndSurrogate:y3,lastEndSurrogate:b3,increment:1,canBacktrack:n,shift:0,charIndexInit:0}),ntn=(e,t,n)=>C3({input:e,targetByteCount:-t,firstStartSurrogate:y3,lastStartSurrogate:b3,firstEndSurrogate:_3,lastEndSurrogate:v3,increment:-1,canBacktrack:!n,shift:1,charIndexInit:e.length-1})})),T3,itn,atn=s((()=>{$en(),rtn(),T3=(e,t,n)=>{let r=w3(e,t,!1),i=itn(e,n);return S3(r===0&&i===void 0?e:e.slice(r,i))},itn=(e,t)=>{if(t===void 0)return t;let n=w3(e,t,!0);return n===e.length?void 0:n}})),otn,stn,E3,ctn,ltn,D3,utn=s((()=>{Jen(),otn=(e,t,n)=>{let{textEncoder:r,textDecoder:i}=stn(),a=ltn(e),{written:o}=r.encodeInto(e,a),s=p3(a,o,t),c=h3(a,o,n),l=c===void 0?o:Math.min(c,o),u=a.subarray(s,l);return i.decode(u)},stn=()=>(E3===void 0&&(E3=new globalThis.TextEncoder,ctn=new globalThis.TextDecoder(`utf8`,{fatal:!1})),{textEncoder:E3,textDecoder:ctn}),ltn=e=>{let t=e.length*3;return t>1e5?new Uint8Array(t):((D3===void 0||D3.length<t)&&(D3=new Uint8Array(t)),D3)}})),dtn,O3,k3,ftn=s((()=>{dtn=(e,t)=>{if(t===void 0)return t;let n=O3(e,t);return n>=e.length*k3?void 0:n},O3=(e,t)=>t<=e.length*-k3?0:t,k3=4})),ptn,mtn,htn,A3,gtn=s((()=>{ptn=(e,t,n)=>{if(typeof e!=`string`)throw TypeError(`First argument must be a string: ${e}`);mtn(t),htn(n)},mtn=e=>{if(e===void 0)throw TypeError(`Second argument is required.`);A3(`Second`,e)},htn=e=>{e!==void 0&&A3(`Third`,e)},A3=(e,t)=>{if(!Number.isInteger(t))throw TypeError(`${e} argument must be an integer: ${t}`)}})),_tn,vtn,j3,ytn=s((()=>{x3(),_tn=e=>{let t=!0,n=0;for(let r=0;r<j3;r+=1){let i=vtn(e,r);i<=127||(t&&=!1,i>2047&&(n+=1))}return{asciiOnly:t,longCharsPercentage:n/j3}},vtn=(e,t)=>{let n=j3-1,r=1-(n-t)/n,i=Math.round(r*(e.length-1));return e.charCodeAt(i)},j3=50})),btn,xtn,Stn,Ctn,wtn,M3,Ttn=s((()=>{Xen(),atn(),utn(),ftn(),$en(),gtn(),ytn(),btn=(e,t,n)=>{if(ptn(e,t,n),e===``)return e;let r=O3(e,t),i=dtn(e,n);return i===void 0&&Object.is(r,0)?S3(e):xtn(e,r,i)},xtn=(e,t,n)=>{if(e.length<=Stn)return T3(e,t,n);let{asciiOnly:r,longCharsPercentage:i}=_tn(e);return r?wtn(e,t,n):i>=Ctn?T3(e,t,n):M3(e,t,n)},Stn=200,Ctn=.4,wtn=(e,t,n)=>`Buffer`in globalThis&&`from`in globalThis.Buffer?Yen(e,t,n):M3(e,t,n),M3=(e,t,n)=>`TextEncoder`in globalThis?otn(e,t,n):T3(e,t,n)})),Etn,Dtn,Otn,ktn,Atn,N3,P3,jtn=s((()=>{Ttn(),Etn=(e,t)=>{let n=JSON.stringify(e),r=btn(ktn(n),0,t-P3.length-N3.length*2),i=`${Dtn(r)}${P3}`;return Atn(i)},Dtn=e=>e.replace(Otn,``),Otn=/(\\|\\u[0-9a-fA-F]{0,3})$/u,ktn=e=>e.slice(N3.length,-N3.length),Atn=e=>`${N3}${e}${N3}`,N3=`"`,P3=`...`})),Mtn,Ntn=s((()=>{Mtn=e=>globalThis.Buffer.byteLength(e)})),F3,Ptn,Ftn,Itn,Ltn,Rtn,ztn,Btn=s((()=>{F3=e=>{let t=e.le Line truncated
Error message: ${Vnn(t)}`,cause:t}),this[ern]=!0,this.text=e}static isInstance(e){return a6.hasMarker(e,l6)}},nrn=`AI_LoadAPIKeyError`,`${nrn}`,rrn=`AI_LoadSettingError`,`${rrn}`,irn=`AI_NoContentGeneratedError`,`${irn}`,arn=`AI_NoSuchModelError`,`${arn}`,orn=`AI_TooManyEmbeddingValuesForCallError`,`${orn}`,d6=`AI_TypeValidationError`,f6=`vercel.ai.error.${d6}`,srn=Symbol.for(f6),p6=class e extends (lrn=a6,crn=srn,lrn){constructor({value:e,cause:t}){super({name:d6,message:`Type validation failed: Value: ${JSON.stringify(e)}.
+5 -5
View File
@@ -70,7 +70,7 @@ func RegisterRoutes(r *gin.Engine) {
apiGroup.GET("/servers", listServers)
// Static segment, registered alongside /servers/:id exactly as
// /servers/new already is — gin resolves statics ahead of wildcards.
// /servers/new already is - gin resolves statics ahead of wildcards.
apiGroup.GET("/servers/tags", listKnownTags)
apiGroup.POST("/servers", createServer)
apiGroup.GET("/servers/new", newServer)
@@ -132,7 +132,7 @@ func RegisterRoutes(r *gin.Engine) {
// handler answers every GET with a hardcoded 405, because a stateless
// server has no session to open the server-to-client SSE stream against.
// That 405 is the protocol-correct response for an MCP server that offers
// no SSE leg — an unregistered GET would 404 instead, which a client reads
// no SSE leg - an unregistered GET would 404 instead, which a client reads
// as "no MCP endpoint here at all" rather than "this one is POST-only".
// This route is not a working GET; it exists solely to produce that 405.
mcpGroup := apiGroup.Group("/mcp", RequireFeature(license.FeatureMCP))
@@ -576,11 +576,11 @@ func getKey(c *gin.Context) {
all, _ := services.GetAssignmentsWithServers(auth.InstanceID(c), id)
// A tag-restricted token may legitimately hold a key that is also
// assigned to a server outside its restriction — the key itself is
// assigned to a server outside its restriction - the key itself is
// still returned above. Only the assignment list is filtered, and
// silently: an assignment whose Server is nil or out of scope is
// dropped rather than kept with the hostname redacted, so the response
// gives no signal — not even a count — of what was removed.
// gives no signal - not even a count - of what was removed.
scope := auth.ServerScope(c)
assignments := make([]services.AssignmentWithServer, 0, len(all))
for _, a := range all {
@@ -778,7 +778,7 @@ func applyUpdates(c *gin.Context) {
// downloads and installs the latest agent. Deliberately not in the generated
// OpenAPI document: it is registered on the bare engine, not under the /api
// group the document's BasePath assumes, so a @Router annotation here would
// publish /api/update — a path that 404s — rather than the real top-level
// publish /api/update - a path that 404s - rather than the real top-level
// /update. It serves a shell script, not JSON, so there is nothing lost by
// leaving it out of a JSON API reference.
func handleUpdateScript(c *gin.Context) {
+1 -1
View File
@@ -14,7 +14,7 @@ import (
//
// /healthz is liveness: the process is up and serving. It touches nothing
// external, because a Mongo outage must not make Kubernetes restart every
// server pod — a restart loop cannot fix someone else's database, and it
// server pod - a restart loop cannot fix someone else's database, and it
// destroys every open command stream and console session on the way.
//
// /readyz is readiness: this pod can serve a request end to end, which needs
+1 -1
View File
@@ -48,7 +48,7 @@ func licenceExempt(c *gin.Context) bool {
// RequireActiveLicense blocks mutating requests when the licence is not valid.
//
// Mounted on the /api group, so a route added tomorrow is gated because of where
// it lives rather than because someone remembered. GET and HEAD always pass —
// it lives rather than because someone remembered. GET and HEAD always pass -
// reading is never blocked.
func RequireActiveLicense() gin.HandlerFunc {
return func(c *gin.Context) {
+4 -4
View File
@@ -20,7 +20,7 @@ import (
const publicStatusRateLimit = 120
// RateLimitPublicStatus counts requests per client address in a one-minute
// fixed window, exactly as RateLimitTokens does — including the part that
// fixed window, exactly as RateLimitTokens does - including the part that
// matters most: when Redis is unavailable it allows rather than denies. A
// status page must survive the outage it exists to report.
func RateLimitPublicStatus() gin.HandlerFunc {
@@ -65,7 +65,7 @@ func RateLimitPublicStatus() gin.HandlerFunc {
//
// It carries no @Router annotation deliberately. openapi.json declares a
// single server of "/api", so a @Router of /public/status/{pageId} would be
// published as /api/public/status/{pageId} — a path that does not exist, and
// published as /api/public/status/{pageId} - a path that does not exist, and
// which would sit behind auth.Middleware if it did. The real address is:
//
// GET {scheme}://{instance-host}/public/status/{pageId}
@@ -116,8 +116,8 @@ func getPublicStatusPage(c *gin.Context) {
// so it is honoured only when the machine that opened the connection is one of
// the configured trusted proxies.
//
// When the resulting host names no slug at all — vantage.acme.com,
// status.acme.com, a bare IP — and the deployment is not cloud, the single
// When the resulting host names no slug at all - vantage.acme.com,
// status.acme.com, a bare IP - and the deployment is not cloud, the single
// instance of that install is used. A self-hosted install has exactly one, and
// without this every self-hosted status page 404s forever. More than one is a
// refusal rather than a guess.
+2 -2
View File
@@ -18,7 +18,7 @@ func runFixture() *models.WorkflowRun {
// A run document names every host it touched, hostname included. A restricted
// caller must see only its own, and must be told some entries are missing
// without being told how many — the targets_restricted precedent.
// without being told how many - the targets_restricted precedent.
func TestScopeRunHidesOutOfScopeServerRuns(t *testing.T) {
got := scopeRun(runFixture(), map[string]bool{"stg-1": true}, true)
if len(got.ServerRuns) != 1 || got.ServerRuns[0].ServerID != "stg-1" {
@@ -45,7 +45,7 @@ func TestScopeRunLeavesUnrestrictedCallerWhole(t *testing.T) {
}
// A restricted caller whose scope happens to cover the whole run must not be
// told anything was hidden — the flag is about disclosure, not about being
// told anything was hidden - the flag is about disclosure, not about being
// restricted in general.
func TestScopeRunNoFlagWhenNothingDropped(t *testing.T) {
got := scopeRun(runFixture(), map[string]bool{"stg-1": true, "prod-1": true}, true)
+1 -1
View File
@@ -11,7 +11,7 @@ import (
"github.com/gin-gonic/gin"
)
// routeScopes maps a registered gin route — "<METHOD> <full path pattern>" — to
// routeScopes maps a registered gin route - "<METHOD> <full path pattern>" - to
// the scope an API token must hold to reach it.
//
// It is keyed on the route pattern rather than declared per route with a
+1 -1
View File
@@ -40,7 +40,7 @@ func secretsReadAuth() gin.HandlerFunc {
// esoGetGroup godoc
//
// @Summary Read a secret group's values (ESO)
// @Description Consumed by Kubernetes External Secrets Operator. Authenticated with a bearer token whose SHA-256 hash is stored in settings — a different credential from an API token, never substitutable for one.
// @Description Consumed by Kubernetes External Secrets Operator. Authenticated with a bearer token whose SHA-256 hash is stored in settings - a different credential from an API token, never substitutable for one.
// @Tags secrets
// @Produce json
// @Param group path string true "Secret group name"
+29 -29
View File
@@ -10,7 +10,7 @@ const (
scoped scopeDecl = iota
// fleetWide: the route deliberately reaches the whole fleet. Every
// fleetWide entry carries a comment giving the reason. It must never mean
// "not scoped yet" — an unresolved gap belongs on a fix list, not here,
// "not scoped yet" - an unresolved gap belongs on a fix list, not here,
// because this value is read as a considered decision.
fleetWide
// exempt: the route touches no server-derived data at all. Every exempt
@@ -38,14 +38,14 @@ const (
// 1. It can only ever check that a DECLARATION EXISTS, never that the handler
// honours it. "POST /api/workflows/:id/run" was declared scoped here while
// services.TriggerWorkflow resolved its targets through the unscoped
// ResolveTargets — a true entry that lied, boot-enforced, for the whole
// ResolveTargets - a true entry that lied, boot-enforced, for the whole
// life of the feature. A declaration is a claim a reviewer must verify,
// not a property this file establishes.
//
// 2. /api/mcp is exempt at route level, and that is the honest answer rather
// than an omission. One route serves roughly twenty tools of very
// different shapes — some read no server data at all, some resolve one
// host, some enumerate the fleet — so no single route-level value could
// different shapes - some read no server data at all, some resolve one
// host, some enumerate the fleet - so no single route-level value could
// be true of all of them. The decision genuinely lives per tool, where
// each tool that touches server data applies auth.ServerScope's selector
// itself, and the registry's own tests are where that is enforced.
@@ -68,8 +68,8 @@ var serverScopedRoutes = map[string]scopeDecl{
"GET /api/servers/new": fleetWide,
"POST /api/servers/new": fleetWide,
// KnownTags aggregates the tag *vocabulary* in use across the fleet — keys
// and the values seen for them — never a server identifier or any other
// KnownTags aggregates the tag *vocabulary* in use across the fleet - keys
// and the values seen for them - never a server identifier or any other
// server attribute, so it does not let a restricted token enumerate which
// hosts exist. Filtering it would mean plumbing a selector through an
// aggregation query for a leak that carries no server identity; ruled
@@ -124,7 +124,7 @@ var serverScopedRoutes = map[string]scopeDecl{
"POST /api/vulnerabilities/rescan": fleetWide,
// Accepting or reopening a finding names the finding, not a server, but a
// finding does belong to one — so a restricted token can accept a finding
// finding does belong to one - so a restricted token can accept a finding
// on a host outside its scope if it learns the finding ID. It cannot learn
// one through this API any more (every listing is now scoped), so this is
// left fleet-wide rather than given a lookup of its own. Owner|admin only.
@@ -143,7 +143,7 @@ var serverScopedRoutes = map[string]scopeDecl{
// assignments whose server passes services.ServerInTokenScope before
// returning it, so a restricted token cannot learn the hostname of an
// out-of-scope server through a key it happens to also hold there. The
// key document itself is still returned unfiltered — a token restricted
// key document itself is still returned unfiltered - a token restricted
// to staging may legitimately hold a key that is also assigned in prod,
// and only the assignment list, not the key's existence, is the leak
// this closes.
@@ -152,7 +152,7 @@ var serverScopedRoutes = map[string]scopeDecl{
// listKeys' services.ListKeys narrows each key's AssignedCount to
// assignments on servers ServerInTokenScope admits, for the same reason
// as getKey above: a nonzero count on a key a restricted token sees
// nothing assigned to in its own scope is itself the leak — it tells the
// nothing assigned to in its own scope is itself the leak - it tells the
// token an assignment exists on a host it must not know about, without
// naming the host.
"GET /api/keys": scoped,
@@ -169,7 +169,7 @@ var serverScopedRoutes = map[string]scopeDecl{
"GET /api/keys/:id/private-key": exempt,
// Deleting a key removes it everywhere it is assigned, including on hosts
// outside a restricted token's scope — the delete is of the key, not of a
// outside a restricted token's scope - the delete is of the key, not of a
// server, and there is no partial delete that leaves a key half-revoked.
// Nothing about which hosts held it is disclosed by the call.
"DELETE /api/keys/:id": fleetWide,
@@ -179,7 +179,7 @@ var serverScopedRoutes = map[string]scopeDecl{
// listWorkflows/getWorkflow narrow Workflow.TargetServerIDs to what the
// caller's scope admits via services.VisibleServerIDs +
// FilterVisibleServerIDs, wrapped in WorkflowResponse so the JSON field
// name is unchanged. TargetTags is left untouched — the tag vocabulary
// name is unchanged. TargetTags is left untouched - the tag vocabulary
// itself is ruled acceptable to expose, unlike a resolved server ID.
// TargetsRestricted is set (with no count) whenever at least one target
// was dropped.
@@ -191,7 +191,7 @@ var serverScopedRoutes = map[string]scopeDecl{
// validate the ID-union-tags target set as a whole through
// services.validateWorkflowTargetScope, which resolves the workflow's
// targets both unscoped and scoped and refuses to save unless they match
// — the same all-or-nothing rule the MCP create_workflow tool applies.
// - the same all-or-nothing rule the MCP create_workflow tool applies.
// Together these mean a restricted token can neither save a workflow
// targeting a host or tag outside its scope (which the scheduler, firing
// as the system, would otherwise run there) nor learn which IDs or tags
@@ -203,12 +203,12 @@ var serverScopedRoutes = map[string]scopeDecl{
// runWorkflow passes auth.ServerScope into services.TriggerWorkflow, which
// resolves through ResolveTargetsScoped. Note the history: this entry read
// scoped for the whole life of the feature while TriggerWorkflow called
// the UNSCOPED ResolveTargets — see this file's header on what this
// the UNSCOPED ResolveTargets - see this file's header on what this
// assertion can and cannot prove.
"POST /api/workflows/:id/run": scoped,
// getRun and listWorkflowRuns narrow WorkflowRun.ServerRuns — each entry
// of which carries a ServerID and a Hostname — to what the caller's scope
// getRun and listWorkflowRuns narrow WorkflowRun.ServerRuns - each entry
// of which carries a ServerID and a Hostname - to what the caller's scope
// admits, setting servers_restricted (a boolean, never a count) when any
// entry was dropped.
"GET /api/runs/:runId": scoped,
@@ -224,7 +224,7 @@ var serverScopedRoutes = map[string]scopeDecl{
// Deleting a workflow and cancelling a run both act on a definition rather
// than on a server, and neither returns server data. Each can
// nevertheless reach a definition whose targets a restricted token cannot
// see — a cancel stops work on out-of-scope hosts. That reach is real but
// see - a cancel stops work on out-of-scope hosts. That reach is real but
// bounded: the caller learns nothing about which hosts are involved (both
// /workflows listings are scoped), and a scope-narrowed variant of
// "cancel this run" would have to either half-cancel a run or refuse one
@@ -236,17 +236,17 @@ var serverScopedRoutes = map[string]scopeDecl{
// Arming a schedule applies no scope check of its own, and that is safe
// only because it has nothing left to check: CreateWorkflow and
// UpdateWorkflow (internal/services/workflows.go) already refuse to save
// a workflow whose resolved targets — TargetServerIDs union TargetTags —
// a workflow whose resolved targets - TargetServerIDs union TargetTags -
// reach outside the acting credential's scope, the same all-or-nothing
// rule the MCP create_workflow tool applies. So a workflow written after
// this check existed had its targets constrained to whichever scope wrote
// it, and the scheduler firing it later with a nil token scope — acting
// as the system, not as any caller — reaches nothing that write didn't
// it, and the scheduler firing it later with a nil token scope - acting
// as the system, not as any caller - reaches nothing that write didn't
// already allow.
//
// This holds only for workflows written after the check was added. Rows
// already in the database were saved under the old, unvalidated rule and
// are never re-validated — neither this route nor the writers re-check an
// are never re-validated - neither this route nor the writers re-check an
// existing row's targets after the fact. A workflow saved before this fix
// with an out-of-scope tag selector still schedules and fires exactly as
// it did before.
@@ -270,17 +270,17 @@ var serverScopedRoutes = map[string]scopeDecl{
// listMonitors/getMonitor redact models.Monitor.Runner to
// models.RunnerRestricted via services.RedactMonitorRunner when it names
// a server outside the caller's scope — Runner is literally a server ID
// a server outside the caller's scope - Runner is literally a server ID
// for an agent-pushed monitor, so left unfiltered it discloses one
// directly. The monitor itself is still returned: a restricted operator
// may legitimately need to see that it exists and is up or down, so only
// the runner field goes neutral. Runner "server" (control-plane-run) is
// never touched — it names no server.
// never touched - it names no server.
"GET /api/monitors": scoped,
"GET /api/monitors/:id": scoped,
// createMonitor/updateMonitor validate the runner — which is a server ID
// for an agent-pushed monitor — through services.validateRunner, resolving
// createMonitor/updateMonitor validate the runner - which is a server ID
// for an agent-pushed monitor - through services.validateRunner, resolving
// with GetServerScoped so a restricted token can neither point a check at
// an out-of-scope agent nor use the not-found answer as an oracle.
"POST /api/monitors": scoped,
@@ -293,7 +293,7 @@ var serverScopedRoutes = map[string]scopeDecl{
"DELETE /api/monitors/:id": fleetWide,
// A monitor's incidents, uptime rollups and recent samples are all about
// the monitored endpoint — status, latency, timestamps — and carry no
// the monitored endpoint - status, latency, timestamps - and carry no
// server identifier at all; the runner is a field of the monitor
// document, which these do not return.
"GET /api/monitors/:id/incidents": exempt,
@@ -302,7 +302,7 @@ var serverScopedRoutes = map[string]scopeDecl{
// ---- notification channels ----
// A channel is an outbound destination — a webhook URL, an SMTP account.
// A channel is an outbound destination - a webhook URL, an SMTP account.
// Nothing about a server reaches these routes.
"GET /api/channels": exempt,
"POST /api/channels": exempt,
@@ -328,7 +328,7 @@ var serverScopedRoutes = map[string]scopeDecl{
// A status page pairs monitor IDs with per-page display names, and every
// public read goes through services.assembleSnapshot, which is the
// redaction boundary — its PublicComponent vocabulary has no field for a
// redaction boundary - its PublicComponent vocabulary has no field for a
// host, URL or runner. These authoring routes handle the page document
// itself and never a server.
"GET /api/status-pages": exempt,
@@ -347,7 +347,7 @@ var serverScopedRoutes = map[string]scopeDecl{
// Audit rows are a record of what people and tokens did, and a row's free
// text detail can name a host in passing ("run <id> triggered", "key
// assigned to web-01"). Filtering the log by tag would mean parsing those
// strings, or dropping every row whose target this token cannot resolve —
// strings, or dropping every row whose target this token cannot resolve -
// which would hide a restricted token's own actions from itself the
// moment a server is renamed or deleted. The log is left whole and
// deliberately so: an audit trail with holes in it is worth less than the
@@ -402,7 +402,7 @@ var serverScopedRoutes = map[string]scopeDecl{
// AssertServerScopeMapComplete refuses to boot when any registered /api route
// is missing from serverScopedRoutes. routes is every /api route the engine
// registered — not a filtered subset — which is the whole point of the
// registered - not a filtered subset - which is the whole point of the
// inversion: a new route is checked by default rather than only when its path
// happens to match a pattern somebody remembered to add.
func AssertServerScopeMapComplete(routes []string) error {
+1 -1
View File
@@ -32,7 +32,7 @@ func registerStatusPageRoutes(g *gin.RouterGroup) {
// statusPageError maps the service errors onto codes once, so ten handlers do
// not each invent their own. services.ErrPageInvalid covers every validation
// failure in the status page and incident services — a missing title or an
// failure in the status page and incident services - a missing title or an
// invalid incident status is a 400, not a 500.
func statusPageError(c *gin.Context, err error) {
switch {
+1 -1
View File
@@ -87,7 +87,7 @@ func createToken(c *gin.Context) {
// A token-authenticated request may only mint a token whose scopes are a
// subset of its own. Role is capped against the creating *user* below (in
// services.CreateAPIToken), but a role cap alone does not confine scopes —
// services.CreateAPIToken), but a role cap alone does not confine scopes -
// without this, a CI token holding only settings:write could mint a token
// holding keys:write and secrets:write, since minting only ever required
// settings:write and never checked what the caller itself could reach. A
+3 -3
View File
@@ -24,7 +24,7 @@ type LimitExceededResponse struct {
}
// LicenceErrorResponse pairs an error with a machine-readable reason rather
// than a code — used only on the two licence rejection paths that predate the
// than a code - used only on the two licence rejection paths that predate the
// error/code convention used everywhere else.
type LicenceErrorResponse struct {
Error string `json:"error"`
@@ -115,7 +115,7 @@ type AgentVersionResponse struct {
}
// WorkflowResponse is a workflow with its TargetServerIDs narrowed to what
// the acting token's scope admits — the explicit field shadows the embedded
// the acting token's scope admits - the explicit field shadows the embedded
// one for JSON marshalling, matching the pattern KeyDetailResponse already
// uses. TargetTags is not filtered: the tag vocabulary itself is ruled
// acceptable to expose, and only the resolved ID list can name a specific
@@ -134,7 +134,7 @@ type WorkflowResponse struct {
// RunResponse is a workflow run with its ServerRuns narrowed to the servers
// the acting token's scope admits. Each models.ServerRun carries both a
// ServerID and a Hostname, so an unfiltered run document names every host it
// touched — the same disclosure WorkflowResponse.TargetServerIDs closes one
// touched - the same disclosure WorkflowResponse.TargetServerIDs closes one
// level up, and the parent of the per-server log routes that were already
// scoped.
//
+5 -5
View File
@@ -29,7 +29,7 @@ type vulnGroup struct {
// listVulnerabilities godoc
//
// @Summary List vulnerabilities
// @Description Groups findings by CVE, most severe first — the same CVE on forty servers is one decision, not forty rows.
// @Description Groups findings by CVE, most severe first - the same CVE on forty servers is one decision, not forty rows.
// @Tags vulnerabilities
// @Produce json
// @Param severity query string false "Filter by severity"
@@ -102,7 +102,7 @@ func groupByCVE(findings []models.VulnFinding) []vulnGroup {
}
// hasFixFromQuery reads ?has_fix=true|false. Anything else, including an empty
// or malformed value, is no filter — a filter nobody asked for must never hide
// or malformed value, is no filter - a filter nobody asked for must never hide
// findings, and the wrong direction here hides the unfixable ones.
func hasFixFromQuery(c *gin.Context) *bool {
switch c.Query("has_fix") {
@@ -199,7 +199,7 @@ type acceptFindingRequest struct {
// acceptFinding godoc
//
// @Summary Accept a finding
// @Description Requires a reason and a future expiry. Reopens automatically at expiry — permanent dismissal is never allowed.
// @Description Requires a reason and a future expiry. Reopens automatically at expiry - permanent dismissal is never allowed.
// @Tags vulnerabilities
// @Accept json
// @Produce json
@@ -221,7 +221,7 @@ func acceptFinding(c *gin.Context) {
// Both rejected deliberately. An acceptance with no reason is a dismissal
// nobody can audit, and one already expired is a permanent dismissal
// wearing an expiry — the graveyard the expiry exists to prevent.
// wearing an expiry - the graveyard the expiry exists to prevent.
if strings.TrimSpace(req.Reason) == "" {
c.JSON(http.StatusBadRequest, gin.H{"error": "a reason is required"})
return
@@ -313,7 +313,7 @@ func listServerVulnerabilities(c *gin.Context) {
// getServerPackages godoc
//
// @Summary Get a server's package inventory
// @Description A server that has not reported yet answers reported=false rather than 404 — that is the normal state for the first hour after install.
// @Description A server that has not reported yet answers reported=false rather than 404 - that is the normal state for the first hour after install.
// @Tags vulnerabilities
// @Produce json
// @Param id path string true "Server ID"
+1 -1
View File
@@ -151,7 +151,7 @@ func controlWorkload(c *gin.Context) {
case errors.Is(err, services.ErrAgentNotConnected):
c.JSON(http.StatusServiceUnavailable, gin.H{"error": err.Error()})
case services.IsWorkloadProtected(err):
// Nothing failed — the agent refused, which is the design. 409, not
// Nothing failed - the agent refused, which is the design. 409, not
// 500, and the reason is carried through.
c.JSON(http.StatusConflict, gin.H{"error": err.Error()})
default: