@selvajs/selva 2.0.7 → 2.0.9

package/build/server/chunks/{_server.ts-CzJ60KtY.js.map → _server.ts-hNeWcDQg.js.map}

@@ -1 +1 @@
-{"version":3,"file":"_server.ts-CzJ60KtY.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/admin/api/compute/status/_server.ts.js"],"sourcesContent":["import { error, json } from \"@sveltejs/kit\";\nimport { g as getComputeServerConfigStore } from \"../../../../../../chunks/providers.server.js\";\nimport \"../../../../../../chunks/context.js\";\nimport { f as findServerById } from \"../../../../../../chunks/utils2.js\";\nimport { r as requireManageCompute } from \"../../../../../../chunks/access.server.js\";\nconst TIMEOUT_MS = 8e3;\nfunction fetchFromServer(serverUrl, apiKey, path) {\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);\n  const headers = {};\n  if (apiKey) headers[\"RhinoComputeKey\"] = apiKey;\n  return fetch(new URL(path, serverUrl).toString(), { signal: controller.signal, headers }).finally(\n    () => clearTimeout(timer)\n  );\n}\nconst GET = async ({ url, locals }) => {\n  requireManageCompute(locals);\n  const serverId = url.searchParams.get(\"serverId\");\n  if (!serverId) throw error(400, \"serverId required\");\n  const config = await getComputeServerConfigStore().getConfig(locals.ctx);\n  const server = findServerById(config, serverId);\n  if (!server) throw error(404, \"Server not found\");\n  try {\n    const [healthRes, versionRes, pluginsRes] = await Promise.all([\n      fetchFromServer(server.serverUrl, server.apiKey, \"/healthcheck\"),\n      fetchFromServer(server.serverUrl, server.apiKey, \"/version\"),\n      fetchFromServer(server.serverUrl, server.apiKey, \"/plugins/gh/installed\")\n    ]);\n    const reachable = healthRes.ok;\n    const version = versionRes.ok ? await versionRes.json() : null;\n    const plugins = pluginsRes.ok ? await pluginsRes.json() : {};\n    const selvaVersion = plugins[\"Selva\"] ?? null;\n    return json({\n      reachable,\n      rhinoVersion: version?.rhino ?? null,\n      computeVersion: version?.compute ?? null,\n      selvaInstalled: selvaVersion !== null,\n      selvaVersion,\n      plugins\n    });\n  } catch {\n    return json({\n      reachable: false,\n      rhinoVersion: null,\n      computeVersion: null,\n      selvaInstalled: false,\n      selvaVersion: null,\n      plugins: {}\n    });\n  }\n};\nexport {\n  GET\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;AAKA,MAAM,UAAU,GAAG,GAAG;AACtB,SAAS,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;AAClD,EAAE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE;AAC1C,EAAE,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,CAAC;AAChE,EAAE,MAAM,OAAO,GAAG,EAAE;AACpB,EAAE,IAAI,MAAM,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,MAAM;AACjD,EAAE,OAAO,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO;AACnG,IAAI,MAAM,YAAY,CAAC,KAAK;AAC5B,GAAG;AACH;AACK,MAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK;AACvC,EAAE,oBAAoB,CAAC,MAAM,CAAC;AAC9B,EAAE,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC;AACnD,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,mBAAmB,CAAC;AACtD,EAAE,MAAM,MAAM,GAAG,MAAM,2BAA2B,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC;AAC1E,EAAE,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC;AACjD,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,kBAAkB,CAAC;AACnD,EAAE,IAAI;AACN,IAAI,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AAClE,MAAM,eAAe,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC;AACtE,MAAM,eAAe,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC;AAClE,MAAM,eAAe,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB;AAC9E,KAAK,CAAC;AACN,IAAI,MAAM,SAAS,GAAG,SAAS,CAAC,EAAE;AAClC,IAAI,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,GAAG,IAAI;AAClE,IAAI,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE;AAChE,IAAI,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI;AACjD,IAAI,OAAO,IAAI,CAAC;AAChB,MAAM,SAAS;AACf,MAAM,YAAY,EAAE,OAAO,EAAE,KAAK,IAAI,IAAI;AAC1C,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,IAAI,IAAI;AAC9C,MAAM,cAAc,EAAE,YAAY,KAAK,IAAI;AAC3C,MAAM,YAAY;AAClB,MAAM;AACN,KAAK,CAAC;AACN,EAAE,CAAC,CAAC,MAAM;AACV,IAAI,OAAO,IAAI,CAAC;AAChB,MAAM,SAAS,EAAE,KAAK;AACtB,MAAM,YAAY,EAAE,IAAI;AACxB,MAAM,cAAc,EAAE,IAAI;AAC1B,MAAM,cAAc,EAAE,KAAK;AAC3B,MAAM,YAAY,EAAE,IAAI;AACxB,MAAM,OAAO,EAAE;AACf,KAAK,CAAC;AACN,EAAE;AACF;;;;"}
+{"version":3,"file":"_server.ts-hNeWcDQg.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/admin/api/compute/status/_server.ts.js"],"sourcesContent":["import { error, json } from \"@sveltejs/kit\";\nimport { g as getComputeServerConfigStore } from \"../../../../../../chunks/providers.server.js\";\nimport \"../../../../../../chunks/context.js\";\nimport { f as findServerById } from \"../../../../../../chunks/utils2.js\";\nimport { r as requireManageCompute } from \"../../../../../../chunks/access.server.js\";\nconst TIMEOUT_MS = 8e3;\nfunction fetchFromServer(serverUrl, apiKey, path) {\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);\n  const headers = {};\n  if (apiKey) headers[\"RhinoComputeKey\"] = apiKey;\n  return fetch(new URL(path, serverUrl).toString(), { signal: controller.signal, headers }).finally(\n    () => clearTimeout(timer)\n  );\n}\nconst GET = async ({ url, locals }) => {\n  requireManageCompute(locals);\n  const serverId = url.searchParams.get(\"serverId\");\n  if (!serverId) throw error(400, \"serverId required\");\n  const config = await getComputeServerConfigStore().getConfig(locals.ctx);\n  const server = findServerById(config, serverId);\n  if (!server) throw error(404, \"Server not found\");\n  try {\n    const [healthRes, versionRes, pluginsRes] = await Promise.all([\n      fetchFromServer(server.serverUrl, server.apiKey, \"/healthcheck\"),\n      fetchFromServer(server.serverUrl, server.apiKey, \"/version\"),\n      fetchFromServer(server.serverUrl, server.apiKey, \"/plugins/gh/installed\")\n    ]);\n    const reachable = healthRes.ok;\n    const version = versionRes.ok ? await versionRes.json() : null;\n    const plugins = pluginsRes.ok ? await pluginsRes.json() : {};\n    const selvaVersion = plugins[\"Selva\"] ?? null;\n    return json({\n      reachable,\n      rhinoVersion: version?.rhino ?? null,\n      computeVersion: version?.compute ?? null,\n      selvaInstalled: selvaVersion !== null,\n      selvaVersion,\n      plugins\n    });\n  } catch {\n    return json({\n      reachable: false,\n      rhinoVersion: null,\n      computeVersion: null,\n      selvaInstalled: false,\n      selvaVersion: null,\n      plugins: {}\n    });\n  }\n};\nexport {\n  GET\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;AAKA,MAAM,UAAU,GAAG,GAAG;AACtB,SAAS,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;AAClD,EAAE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE;AAC1C,EAAE,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,CAAC;AAChE,EAAE,MAAM,OAAO,GAAG,EAAE;AACpB,EAAE,IAAI,MAAM,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,MAAM;AACjD,EAAE,OAAO,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO;AACnG,IAAI,MAAM,YAAY,CAAC,KAAK;AAC5B,GAAG;AACH;AACK,MAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK;AACvC,EAAE,oBAAoB,CAAC,MAAM,CAAC;AAC9B,EAAE,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC;AACnD,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,mBAAmB,CAAC;AACtD,EAAE,MAAM,MAAM,GAAG,MAAM,2BAA2B,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC;AAC1E,EAAE,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC;AACjD,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,kBAAkB,CAAC;AACnD,EAAE,IAAI;AACN,IAAI,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AAClE,MAAM,eAAe,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC;AACtE,MAAM,eAAe,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC;AAClE,MAAM,eAAe,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB;AAC9E,KAAK,CAAC;AACN,IAAI,MAAM,SAAS,GAAG,SAAS,CAAC,EAAE;AAClC,IAAI,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,GAAG,IAAI;AAClE,IAAI,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE;AAChE,IAAI,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI;AACjD,IAAI,OAAO,IAAI,CAAC;AAChB,MAAM,SAAS;AACf,MAAM,YAAY,EAAE,OAAO,EAAE,KAAK,IAAI,IAAI;AAC1C,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,IAAI,IAAI;AAC9C,MAAM,cAAc,EAAE,YAAY,KAAK,IAAI;AAC3C,MAAM,YAAY;AAClB,MAAM;AACN,KAAK,CAAC;AACN,EAAE,CAAC,CAAC,MAAM;AACV,IAAI,OAAO,IAAI,CAAC;AAChB,MAAM,SAAS,EAAE,KAAK;AACtB,MAAM,YAAY,EAAE,IAAI;AACxB,MAAM,cAAc,EAAE,IAAI;AAC1B,MAAM,cAAc,EAAE,KAAK;AAC3B,MAAM,YAAY,EAAE,IAAI;AACxB,MAAM,OAAO,EAAE;AACf,KAAK,CAAC;AACN,EAAE;AACF;;;;"}

package/build/server/chunks/{_server.ts-v9eUA-cx.js → _server.ts-kUn8v9xq.js}

@@ -1,7 +1,7 @@
 import { error, json } from '@sveltejs/kit';
-import { r as definitionService } from './providers.server-Duyx-08B.js';
-import { g as requireEditableDefinition } from './access.server-DVG3xnR_.js';
-import { h as handleApiError } from './api-errors-DGHmIOGJ.js';
+import { r as definitionService } from './providers.server-gJvnJT_K.js';
+import { g as requireEditableDefinition } from './access.server-DGKSuoRH.js';
+import { h as handleApiError } from './api-errors-DSza0CJv.js';
 import { G as GuidSchema } from './context-9tV9WxQ5.js';
 import { e as MAX_IMAGE_FILE_SIZE } from './computeLimits-FIJ-Mzn4.js';
 import './shared-server-DaWdgxVh.js';
@@ -36,4 +36,4 @@ const POST = async ({ params, request, locals }) => {
 };
 
 export { POST };
-//# sourceMappingURL=_server.ts-v9eUA-cx.js.map
+//# sourceMappingURL=_server.ts-kUn8v9xq.js.map

package/build/server/chunks/{_server.ts-v9eUA-cx.js.map → _server.ts-kUn8v9xq.js.map}

@@ -1 +1 @@
-{"version":3,"file":"_server.ts-v9eUA-cx.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/api/definitions/_guid_/image/_server.ts.js"],"sourcesContent":["import { error, json } from \"@sveltejs/kit\";\nimport { j as definitionService } from \"../../../../../../chunks/providers.server.js\";\nimport { g as requireEditableDefinition } from \"../../../../../../chunks/access.server.js\";\nimport { h as handleApiError } from \"../../../../../../chunks/api-errors.js\";\nimport { G as GuidSchema } from \"../../../../../../chunks/context.js\";\nimport { e as MAX_IMAGE_FILE_SIZE } from \"../../../../../../chunks/computeLimits.js\";\nconst POST = async ({ params, request, locals }) => {\n  const guidParsed = GuidSchema.safeParse(params.guid);\n  if (!guidParsed.success) throw error(400, \"Invalid GUID\");\n  const guid = guidParsed.data;\n  const { ctx } = await requireEditableDefinition(locals, guid);\n  const formData = await request.formData();\n  const file = formData.get(\"image\");\n  if (!(file instanceof File) || file.size === 0) {\n    throw error(400, \"Image file is required\");\n  }\n  if (file.size > MAX_IMAGE_FILE_SIZE) {\n    throw error(400, `Image too large. Max size: ${MAX_IMAGE_FILE_SIZE / (1024 * 1024)} MB`);\n  }\n  try {\n    const imageData = new Uint8Array(await file.arrayBuffer());\n    const coverImage = await definitionService.saveCoverImage(ctx, guid, imageData);\n    return json({ success: true, coverImage });\n  } catch (err) {\n    handleApiError(err, \"Failed to upload image\");\n  }\n};\nexport {\n  POST\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;AAMK,MAAC,IAAI,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AACpD,EAAE,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;AACtD,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC;AAC3D,EAAE,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI;AAC9B,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,CAAC,MAAM,EAAE,IAAI,CAAC;AAC/D,EAAE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE;AAC3C,EAAE,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;AACpC,EAAE,IAAI,EAAE,IAAI,YAAY,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE;AAClD,IAAI,MAAM,KAAK,CAAC,GAAG,EAAE,wBAAwB,CAAC;AAC9C,EAAE;AACF,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,mBAAmB,EAAE;AACvC,IAAI,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,2BAA2B,EAAE,mBAAmB,IAAI,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AAC5F,EAAE;AACF,EAAE,IAAI;AACN,IAAI,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;AAC9D,IAAI,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC;AACnF,IAAI,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC9C,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,cAAc,CAAC,GAAG,EAAE,wBAAwB,CAAC;AACjD,EAAE;AACF;;;;"}
+{"version":3,"file":"_server.ts-kUn8v9xq.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/api/definitions/_guid_/image/_server.ts.js"],"sourcesContent":["import { error, json } from \"@sveltejs/kit\";\nimport { k as definitionService } from \"../../../../../../chunks/providers.server.js\";\nimport { g as requireEditableDefinition } from \"../../../../../../chunks/access.server.js\";\nimport { h as handleApiError } from \"../../../../../../chunks/api-errors.js\";\nimport { G as GuidSchema } from \"../../../../../../chunks/context.js\";\nimport { e as MAX_IMAGE_FILE_SIZE } from \"../../../../../../chunks/computeLimits.js\";\nconst POST = async ({ params, request, locals }) => {\n  const guidParsed = GuidSchema.safeParse(params.guid);\n  if (!guidParsed.success) throw error(400, \"Invalid GUID\");\n  const guid = guidParsed.data;\n  const { ctx } = await requireEditableDefinition(locals, guid);\n  const formData = await request.formData();\n  const file = formData.get(\"image\");\n  if (!(file instanceof File) || file.size === 0) {\n    throw error(400, \"Image file is required\");\n  }\n  if (file.size > MAX_IMAGE_FILE_SIZE) {\n    throw error(400, `Image too large. Max size: ${MAX_IMAGE_FILE_SIZE / (1024 * 1024)} MB`);\n  }\n  try {\n    const imageData = new Uint8Array(await file.arrayBuffer());\n    const coverImage = await definitionService.saveCoverImage(ctx, guid, imageData);\n    return json({ success: true, coverImage });\n  } catch (err) {\n    handleApiError(err, \"Failed to upload image\");\n  }\n};\nexport {\n  POST\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;AAMK,MAAC,IAAI,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AACpD,EAAE,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;AACtD,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC;AAC3D,EAAE,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI;AAC9B,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,CAAC,MAAM,EAAE,IAAI,CAAC;AAC/D,EAAE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE;AAC3C,EAAE,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;AACpC,EAAE,IAAI,EAAE,IAAI,YAAY,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE;AAClD,IAAI,MAAM,KAAK,CAAC,GAAG,EAAE,wBAAwB,CAAC;AAC9C,EAAE;AACF,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,mBAAmB,EAAE;AACvC,IAAI,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,2BAA2B,EAAE,mBAAmB,IAAI,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AAC5F,EAAE;AACF,EAAE,IAAI;AACN,IAAI,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;AAC9D,IAAI,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC;AACnF,IAAI,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC9C,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,cAAc,CAAC,GAAG,EAAE,wBAAwB,CAAC;AACjD,EAAE;AACF;;;;"}

package/build/server/chunks/{access.server-DVG3xnR_.js → access.server-DGKSuoRH.js}

@@ -1,7 +1,7 @@
 import { error, redirect } from '@sveltejs/kit';
 import { h as hasPermission, A as ALL_PLATFORM_PERMISSIONS } from './context-9tV9WxQ5.js';
-import { i as getDefinitionMeta, c as getOrganizationProvider, f as flag, h as getProjectProvider, k as getPlatformProjectGrantStore } from './providers.server-Duyx-08B.js';
-import { h as handleApiError } from './api-errors-DGHmIOGJ.js';
+import { i as getDefinitionMeta, c as getOrganizationProvider, f as flag, h as getProjectProvider, k as getPlatformProjectGrantStore } from './providers.server-gJvnJT_K.js';
+import { h as handleApiError } from './api-errors-DSza0CJv.js';
 import 'zod';
 import './shared-server-DaWdgxVh.js';
 import 'node:url';
@@ -20,10 +20,12 @@ function withAdminBypass(platformPermissions, rule) {
   return rule();
 }
 function canView(input) {
-  const { project, member, orgMember, allowCrossOrgPublic, platformPermissions, platformGrants, actingOrgId, userId } = input;
+  const { project, member, orgMember, allowCrossOrgPublic, enablePlatformProjects, platformPermissions, platformGrants, actingOrgId, userId } = input;
   if (!project)
     return false;
   if (project.visibility === "platform") {
+    if (!enablePlatformProjects)
+      return false;
     if (isInstanceAdmin(platformPermissions))
       return true;
     return platformGrants.some((g) => g.granteeType === "user" && g.granteeId === userId || g.granteeType === "org" && g.granteeId === actingOrgId);
@@ -37,10 +39,12 @@ function canView(input) {
   return false;
 }
 function canSolve(input) {
-  const { project, platformPermissions, platformGrants, actingOrgId, userId } = input;
+  const { project, enablePlatformProjects, platformPermissions, platformGrants, actingOrgId, userId } = input;
   if (!project)
     return false;
   if (project.visibility === "platform") {
+    if (!enablePlatformProjects)
+      return false;
     if (isInstanceAdmin(platformPermissions))
       return true;
     return platformGrants.some((g) => g.canSolve && (g.granteeType === "user" && g.granteeId === userId || g.granteeType === "org" && g.granteeId === actingOrgId));
@@ -48,19 +52,28 @@ function canSolve(input) {
   return canView(input);
 }
 function canEdit(input) {
-  const { member, project, platformPermissions } = input;
-  if (project?.visibility === "platform")
+  const { member, project, enablePlatformProjects, platformPermissions } = input;
+  if (project?.visibility === "platform") {
+    if (!enablePlatformProjects)
+      return false;
     return isInstanceAdmin(platformPermissions);
+  }
   return member?.role === "owner" || member?.role === "editor";
 }
 function canManage(input) {
-  if (input.project?.visibility === "platform")
+  if (input.project?.visibility === "platform") {
+    if (!input.enablePlatformProjects)
+      return false;
     return isInstanceAdmin(input.platformPermissions);
+  }
   return input.member?.role === "owner";
 }
 function canEditProjectSettings(input) {
-  if (input.project?.visibility === "platform")
+  if (input.project?.visibility === "platform") {
+    if (!input.enablePlatformProjects)
+      return false;
     return isInstanceAdmin(input.platformPermissions);
+  }
   return input.member?.role === "owner";
 }
 function canChangeVisibilityToPublic(input) {
@@ -68,10 +81,12 @@ function canChangeVisibilityToPublic(input) {
   return role === "owner" || role === "admin";
 }
 function canEditDefinition(input) {
-  const { project, definition, member, userId, platformPermissions } = input;
+  const { project, definition, member, userId, platformPermissions, enablePlatformProjects } = input;
   if (!project || !definition)
     return false;
   if (project.visibility === "platform") {
+    if (!enablePlatformProjects)
+      return false;
     return isInstanceAdmin(platformPermissions);
   }
   if (member?.role === "owner" || member?.role === "editor")
@@ -169,11 +184,14 @@ async function loadProjectOr404(ctx, projectId) {
 }
 async function buildProjectAccessInput(ctx, project, overrides = {}) {
   const allowCrossOrgPublic = flag("ALLOW_CROSS_ORG_PUBLIC");
+  const enablePlatformProjects = flag("ENABLE_PLATFORM_PROJECTS");
   let member = null;
   let orgMember = null;
   let platformGrants = [];
   if (project.visibility === "platform") {
-    platformGrants = await getPlatformProjectGrantStore().listByProject(ctx, project.id);
+    if (enablePlatformProjects) {
+      platformGrants = await getPlatformProjectGrantStore().listByProject(ctx, project.id);
+    }
   } else if (project.visibility === "private") {
     member = await getProjectProvider().getProjectMember(ctx, project.id, ctx.userId);
   } else {
@@ -190,6 +208,7 @@ async function buildProjectAccessInput(ctx, project, overrides = {}) {
     member,
     orgMember,
     allowCrossOrgPublic,
+    enablePlatformProjects,
     platformGrants,
     actingOrgId: ctx.actingOrgId ?? null,
     userId: ctx.userId,
@@ -204,6 +223,7 @@ function projectAccessInputFromRows(ctx, project, rows) {
     member: rows.member ?? null,
     orgMember: rows.orgMember ?? null,
     allowCrossOrgPublic: flag("ALLOW_CROSS_ORG_PUBLIC"),
+    enablePlatformProjects: flag("ENABLE_PLATFORM_PROJECTS"),
     platformGrants: rows.platformGrants ?? [],
     actingOrgId: ctx.actingOrgId ?? null,
     userId: ctx.userId
@@ -327,7 +347,8 @@ async function requireEditableDefinition(locals, guid) {
       definition: record,
       member,
       userId: ctx.userId,
-      platformPermissions: ctx.platformPermissions
+      platformPermissions: ctx.platformPermissions,
+      enablePlatformProjects: flag("ENABLE_PLATFORM_PROJECTS")
     });
   });
   if (!allowed) throw error(403, "You do not have permission to edit this definition.");
@@ -346,7 +367,8 @@ async function requireCanEditDefinition(locals, projectId, definitionGuid) {
       definition,
       member,
       userId: ctx.userId,
-      platformPermissions: ctx.platformPermissions
+      platformPermissions: ctx.platformPermissions,
+      enablePlatformProjects: flag("ENABLE_PLATFORM_PROJECTS")
     });
   });
   if (!allowed) throw error(403, "You do not have permission to edit this definition.");
@@ -386,4 +408,4 @@ const access_server = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defin
 }, Symbol.toStringTag, { value: "Module" }));
 
 export { canEdit as A, access_server as B, requireInstanceAdmin as a, requirePermission as b, requireManageInstanceUsers as c, requireCanEditDefinition as d, requireCanSolve as e, requireCanCreateDefinition as f, requireEditableDefinition as g, requireCanViewProject as h, requireManageOrgMembers as i, requireManageOrgCompute as j, requireCanCreateProject as k, requireCanManage as l, requireCanEditProjectSettings as m, canChangeVisibilityToPublic as n, requireCanManageMembers as o, requireTargetIsOrgMember as p, checkOwnerRemoval as q, requireManageCompute as r, requireCanReclaim as s, assertAnyPlatformPermission as t, assertPagePermission as u, assertManageCompute as v, withAdminBypass as w, assertManageInstanceUsers as x, canView as y, projectAccessInputFromRows as z };
-//# sourceMappingURL=access.server-DVG3xnR_.js.map
+//# sourceMappingURL=access.server-DGKSuoRH.js.map

package/build/server/chunks/access.server-DGKSuoRH.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.server-DGKSuoRH.js","sources":["../../../.svelte-kit/adapter-node/chunks/access.server.js"],"sourcesContent":["import { error, redirect } from \"@sveltejs/kit\";\nimport { h as hasPermission, f as ALL_PLATFORM_PERMISSIONS } from \"./context.js\";\nimport { l as getDefinitionMeta, a as getOrganizationProvider, f as flag, b as getProjectProvider, c as getPlatformProjectGrantStore } from \"./providers.server.js\";\nimport { h as handleApiError } from \"./api-errors.js\";\nfunction isInstanceAdmin(platformPermissions) {\n  return platformPermissions.includes(\"instance_admin\");\n}\nfunction withAdminBypass(platformPermissions, rule) {\n  if (isInstanceAdmin(platformPermissions))\n    return true;\n  return rule();\n}\nfunction canView(input) {\n  const { project, member, orgMember, allowCrossOrgPublic, enablePlatformProjects, platformPermissions, platformGrants, actingOrgId, userId } = input;\n  if (!project)\n    return false;\n  if (project.visibility === \"platform\") {\n    if (!enablePlatformProjects)\n      return false;\n    if (isInstanceAdmin(platformPermissions))\n      return true;\n    return platformGrants.some((g) => g.granteeType === \"user\" && g.granteeId === userId || g.granteeType === \"org\" && g.granteeId === actingOrgId);\n  }\n  if (project.visibility === \"private\")\n    return member !== null;\n  if (project.visibility === \"org\")\n    return orgMember !== null;\n  if (project.visibility === \"public\")\n    return allowCrossOrgPublic ? true : orgMember !== null;\n  return false;\n}\nfunction canSolve(input) {\n  const { project, enablePlatformProjects, platformPermissions, platformGrants, actingOrgId, userId } = input;\n  if (!project)\n    return false;\n  if (project.visibility === \"platform\") {\n    if (!enablePlatformProjects)\n      return false;\n    if (isInstanceAdmin(platformPermissions))\n      return true;\n    return platformGrants.some((g) => g.canSolve && (g.granteeType === \"user\" && g.granteeId === userId || g.granteeType === \"org\" && g.granteeId === actingOrgId));\n  }\n  return canView(input);\n}\nfunction canEdit(input) {\n  const { member, project, enablePlatformProjects, platformPermissions } = input;\n  if (project?.visibility === \"platform\") {\n    if (!enablePlatformProjects)\n      return false;\n    return isInstanceAdmin(platformPermissions);\n  }\n  return member?.role === \"owner\" || member?.role === \"editor\";\n}\nfunction canManage(input) {\n  if (input.project?.visibility === \"platform\") {\n    if (!input.enablePlatformProjects)\n      return false;\n    return isInstanceAdmin(input.platformPermissions);\n  }\n  return input.member?.role === \"owner\";\n}\nfunction canEditProjectSettings(input) {\n  if (input.project?.visibility === \"platform\") {\n    if (!input.enablePlatformProjects)\n      return false;\n    return isInstanceAdmin(input.platformPermissions);\n  }\n  return input.member?.role === \"owner\";\n}\nfunction canChangeVisibilityToPublic(input) {\n  const role = input.orgMember?.role;\n  return role === \"owner\" || role === \"admin\";\n}\nfunction canEditDefinition(input) {\n  const { project, definition, member, userId, platformPermissions, enablePlatformProjects } = input;\n  if (!project || !definition)\n    return false;\n  if (project.visibility === \"platform\") {\n    if (!enablePlatformProjects)\n      return false;\n    return isInstanceAdmin(platformPermissions);\n  }\n  if (member?.role === \"owner\" || member?.role === \"editor\")\n    return true;\n  if (project.autoJoinOnUpload && userId === definition.ownerId)\n    return true;\n  return false;\n}\nfunction canReclaim(input) {\n  const { project, orgMember, actingOrgId } = input;\n  if (!project || !actingOrgId)\n    return false;\n  if (project.visibility === \"platform\")\n    return false;\n  if (actingOrgId !== project.orgId)\n    return false;\n  const role = orgMember?.role;\n  return role === \"owner\" || role === \"admin\";\n}\nfunction canCreateProject(input) {\n  const { orgMember, orgPermissions, actingOrgId, targetOrgId } = input;\n  if (actingOrgId !== targetOrgId)\n    return false;\n  const role = orgMember?.role;\n  if (role === \"owner\" || role === \"admin\")\n    return true;\n  if (role === \"member\" && orgPermissions.includes(\"manage_projects\"))\n    return true;\n  return false;\n}\nfunction checkOwnerRemoval(input) {\n  if (input.target.role !== \"owner\")\n    return \"ok\";\n  const ownerCount = input.allMembers.filter((m) => m.role === \"owner\").length;\n  if (ownerCount <= 1)\n    return \"sole_owner\";\n  if (!input.confirmed)\n    return \"needs_confirm\";\n  return \"ok\";\n}\nconst throwProviderError = handleApiError;\nfunction requireAuthed(locals) {\n  const { user, ctx } = locals;\n  if (!user || !ctx) throw error(401, \"Unauthorized\");\n  return { user, ctx };\n}\nfunction requirePermission(locals, permission) {\n  const { user, ctx } = requireAuthed(locals);\n  if (!hasPermission(ctx, permission)) {\n    throw error(403, `You don't have permission to do this.`);\n  }\n  return user;\n}\nfunction assertPagePermission(locals, permission) {\n  const { user, ctx } = requireAuthed(locals);\n  if (!hasPermission(ctx, permission)) {\n    redirect(303, \"/admin\");\n  }\n  return user;\n}\nconst requireManageInstanceUsers = (locals) => requirePermission(locals, \"manage_instance_users\");\nconst requireManageCompute = (locals) => requirePermission(locals, \"manage_compute\");\nconst requireManageOrgMembers = (locals) => requirePermission(locals, \"manage_org_members\");\nconst requireManageOrgCompute = (locals) => requirePermission(locals, \"manage_org_compute\");\nconst requireManageDefinitions = (locals) => requirePermission(locals, \"manage_definitions\");\nconst requireManageProjects = (locals) => requirePermission(locals, \"manage_projects\");\nconst assertManageInstanceUsers = (locals) => assertPagePermission(locals, \"manage_instance_users\");\nconst assertManageCompute = (locals) => assertPagePermission(locals, \"manage_compute\");\nconst assertManageDefinitions = (locals) => assertPagePermission(locals, \"manage_definitions\");\nconst assertManageProjects = (locals) => assertPagePermission(locals, \"manage_projects\");\nconst requireInstanceAdmin = (locals) => requirePermission(locals, \"instance_admin\");\nfunction requireAnyPlatformPermission(locals) {\n  const { user, ctx } = requireAuthed(locals);\n  const allowed = ALL_PLATFORM_PERMISSIONS.some((p) => hasPermission(ctx, p));\n  if (!allowed) throw error(403, `You don't have permission to do this.`);\n  return user;\n}\nfunction assertAnyPlatformPermission(locals) {\n  const { user, ctx } = requireAuthed(locals);\n  const allowed = ALL_PLATFORM_PERMISSIONS.some((p) => hasPermission(ctx, p));\n  if (!allowed) redirect(303, \"/library\");\n  return user;\n}\nasync function managementBypassOrRun(ctx, check) {\n  if (hasPermission(ctx, \"instance_admin\")) return true;\n  return await check();\n}\nasync function contentCheck(check) {\n  return await check();\n}\nasync function loadProjectOr404(ctx, projectId) {\n  const project = await getProjectProvider().getProject(ctx, projectId);\n  if (!project) throw error(404, \"Project not found\");\n  return project;\n}\nasync function buildProjectAccessInput(ctx, project, overrides = {}) {\n  const allowCrossOrgPublic = flag(\"ALLOW_CROSS_ORG_PUBLIC\");\n  const enablePlatformProjects = flag(\"ENABLE_PLATFORM_PROJECTS\");\n  let member = null;\n  let orgMember = null;\n  let platformGrants = [];\n  if (project.visibility === \"platform\") {\n    if (enablePlatformProjects) {\n      platformGrants = await getPlatformProjectGrantStore().listByProject(ctx, project.id);\n    }\n  } else if (project.visibility === \"private\") {\n    member = await getProjectProvider().getProjectMember(ctx, project.id, ctx.userId);\n  } else {\n    const skipOrgMember = project.visibility === \"public\" && allowCrossOrgPublic;\n    [member, orgMember] = await Promise.all([\n      getProjectProvider().getProjectMember(ctx, project.id, ctx.userId),\n      skipOrgMember ? Promise.resolve(null) : getOrganizationProvider().getOrgMember(ctx, project.orgId, ctx.userId)\n    ]);\n  }\n  return {\n    orgPermissions: ctx.orgPermissions,\n    platformPermissions: ctx.platformPermissions,\n    project,\n    member,\n    orgMember,\n    allowCrossOrgPublic,\n    enablePlatformProjects,\n    platformGrants,\n    actingOrgId: ctx.actingOrgId ?? null,\n    userId: ctx.userId,\n    ...overrides\n  };\n}\nfunction projectAccessInputFromRows(ctx, project, rows) {\n  return {\n    orgPermissions: ctx.orgPermissions,\n    platformPermissions: ctx.platformPermissions,\n    project,\n    member: rows.member ?? null,\n    orgMember: rows.orgMember ?? null,\n    allowCrossOrgPublic: flag(\"ALLOW_CROSS_ORG_PUBLIC\"),\n    enablePlatformProjects: flag(\"ENABLE_PLATFORM_PROJECTS\"),\n    platformGrants: rows.platformGrants ?? [],\n    actingOrgId: ctx.actingOrgId ?? null,\n    userId: ctx.userId\n  };\n}\nasync function requireCanEdit(locals, projectId) {\n  const { user, ctx } = requireAuthed(locals);\n  const allowed = await contentCheck(async () => {\n    const project = await loadProjectOr404(ctx, projectId);\n    return canEdit(await buildProjectAccessInput(ctx, project));\n  });\n  if (!allowed) throw error(403, \"You do not have permission to edit this project.\");\n  return user;\n}\nasync function requireCanCreateDefinition(locals, projectId) {\n  const { user, ctx } = requireAuthed(locals);\n  const project = await loadProjectOr404(ctx, projectId);\n  const allowed = await contentCheck(async () => {\n    if (project.autoJoinOnUpload) return true;\n    return canEdit(await buildProjectAccessInput(ctx, project));\n  });\n  if (!allowed) {\n    throw error(403, \"You do not have permission to upload definitions to this project.\");\n  }\n  return { user, ctx, project };\n}\nasync function requireTargetIsOrgMember(locals, orgId, targetUserId) {\n  const { ctx } = requireAuthed(locals);\n  const member = await getOrganizationProvider().getOrgMember(ctx, orgId, targetUserId);\n  if (!member) {\n    throw error(400, \"User must be a member of this organization to be added to a project.\");\n  }\n}\nasync function requireCanReclaim(locals, projectId) {\n  const { user, ctx } = requireAuthed(locals);\n  const project = await loadProjectOr404(ctx, projectId);\n  const allowed = await managementBypassOrRun(ctx, async () => {\n    const orgMember = await getOrganizationProvider().getOrgMember(ctx, project.orgId, ctx.userId);\n    return canReclaim({\n      project,\n      orgMember,\n      actingOrgId: ctx.actingOrgId ?? null\n    });\n  });\n  if (!allowed) {\n    throw error(403, \"Only org owners or admins of this project’s org can reclaim it.\");\n  }\n  return { user, ctx, project };\n}\nasync function requireCanCreateProject(locals, targetOrgId) {\n  const { user, ctx } = requireAuthed(locals);\n  const allowed = await managementBypassOrRun(ctx, async () => {\n    const orgMember = await getOrganizationProvider().getOrgMember(ctx, targetOrgId, ctx.userId);\n    return canCreateProject({\n      orgPermissions: ctx.orgPermissions,\n      orgMember,\n      actingOrgId: ctx.actingOrgId ?? null,\n      targetOrgId\n    });\n  });\n  if (!allowed) throw error(403, \"You do not have permission to create projects in this org.\");\n  return { user, ctx };\n}\nasync function requireCanManage(locals, projectId) {\n  const { user, ctx } = requireAuthed(locals);\n  const allowed = await managementBypassOrRun(ctx, async () => {\n    const project = await loadProjectOr404(ctx, projectId);\n    return canManage(await buildProjectAccessInput(ctx, project));\n  });\n  if (!allowed) throw error(403, \"Only project owners can manage this project.\");\n  return user;\n}\nasync function requireCanManageMembers(locals, projectId) {\n  const { user, ctx } = requireAuthed(locals);\n  const allowed = await managementBypassOrRun(ctx, async () => {\n    const project = await loadProjectOr404(ctx, projectId);\n    return canManage(await buildProjectAccessInput(ctx, project));\n  });\n  if (!allowed) throw error(403, \"Only project owners can manage members.\");\n  return user;\n}\nasync function requireCanEditProjectSettings(locals, projectId) {\n  const { user, ctx } = requireAuthed(locals);\n  const project = await loadProjectOr404(ctx, projectId);\n  const allowed = await managementBypassOrRun(\n    ctx,\n    async () => canEditProjectSettings(await buildProjectAccessInput(ctx, project))\n  );\n  if (!allowed) throw error(403, \"Only project owners can edit project settings.\");\n  return { user, ctx, project };\n}\nasync function requireCanViewProject(locals, projectId) {\n  const { user, ctx } = requireAuthed(locals);\n  const allowed = await contentCheck(async () => {\n    const project = await loadProjectOr404(ctx, projectId);\n    return canView(await buildProjectAccessInput(ctx, project));\n  });\n  if (!allowed) throw error(403, \"You do not have access to this project.\");\n  return user;\n}\nasync function requireCanSolve(locals, projectId) {\n  const { user, ctx } = requireAuthed(locals);\n  const project = await loadProjectOr404(ctx, projectId);\n  const allowed = await contentCheck(\n    async () => canSolve(await buildProjectAccessInput(ctx, project))\n  );\n  if (!allowed) throw error(403, \"You do not have access to this project.\");\n  return { user, ctx, project };\n}\nasync function requireEditableDefinition(locals, guid) {\n  const { ctx } = requireAuthed(locals);\n  const record = await getDefinitionMeta().get(ctx, guid);\n  if (!record) throw error(404, \"Definition not found\");\n  const allowed = await contentCheck(async () => {\n    const [project, member] = await Promise.all([\n      getProjectProvider().getProject(ctx, record.projectId),\n      getProjectProvider().getProjectMember(ctx, record.projectId, ctx.userId)\n    ]);\n    return canEditDefinition({\n      project,\n      definition: record,\n      member,\n      userId: ctx.userId,\n      platformPermissions: ctx.platformPermissions,\n      enablePlatformProjects: flag(\"ENABLE_PLATFORM_PROJECTS\")\n    });\n  });\n  if (!allowed) throw error(403, \"You do not have permission to edit this definition.\");\n  return { record, ctx };\n}\nasync function requireCanEditDefinition(locals, projectId, definitionGuid) {\n  const { user, ctx } = requireAuthed(locals);\n  const allowed = await contentCheck(async () => {\n    const [project, definition, member] = await Promise.all([\n      getProjectProvider().getProject(ctx, projectId),\n      getDefinitionMeta().get(ctx, definitionGuid),\n      getProjectProvider().getProjectMember(ctx, projectId, ctx.userId)\n    ]);\n    return canEditDefinition({\n      project,\n      definition,\n      member,\n      userId: ctx.userId,\n      platformPermissions: ctx.platformPermissions,\n      enablePlatformProjects: flag(\"ENABLE_PLATFORM_PROJECTS\")\n    });\n  });\n  if (!allowed) throw error(403, \"You do not have permission to edit this definition.\");\n  return user;\n}\nconst access_server = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({\n  __proto__: null,\n  assertAnyPlatformPermission,\n  assertManageCompute,\n  assertManageDefinitions,\n  assertManageInstanceUsers,\n  assertManageProjects,\n  assertPagePermission,\n  projectAccessInputFromRows,\n  requireAnyPlatformPermission,\n  requireCanCreateDefinition,\n  requireCanCreateProject,\n  requireCanEdit,\n  requireCanEditDefinition,\n  requireCanEditProjectSettings,\n  requireCanManage,\n  requireCanManageMembers,\n  requireCanReclaim,\n  requireCanSolve,\n  requireCanViewProject,\n  requireEditableDefinition,\n  requireInstanceAdmin,\n  requireManageCompute,\n  requireManageDefinitions,\n  requireManageInstanceUsers,\n  requireManageOrgCompute,\n  requireManageOrgMembers,\n  requireManageProjects,\n  requirePermission,\n  requireTargetIsOrgMember,\n  throwProviderError\n}, Symbol.toStringTag, { value: \"Module\" }));\nexport {\n  canEdit as A,\n  access_server as B,\n  requireInstanceAdmin as a,\n  requirePermission as b,\n  requireManageInstanceUsers as c,\n  requireCanEditDefinition as d,\n  requireCanSolve as e,\n  requireCanCreateDefinition as f,\n  requireEditableDefinition as g,\n  requireCanViewProject as h,\n  requireManageOrgMembers as i,\n  requireManageOrgCompute as j,\n  requireCanCreateProject as k,\n  requireCanManage as l,\n  requireCanEditProjectSettings as m,\n  canChangeVisibilityToPublic as n,\n  requireCanManageMembers as o,\n  requireTargetIsOrgMember as p,\n  checkOwnerRemoval as q,\n  requireManageCompute as r,\n  requireCanReclaim as s,\n  assertAnyPlatformPermission as t,\n  assertPagePermission as u,\n  assertManageCompute as v,\n  withAdminBypass as w,\n  assertManageInstanceUsers as x,\n  canView as y,\n  projectAccessInputFromRows as z\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;AAIA,SAAS,eAAe,CAAC,mBAAmB,EAAE;AAC9C,EAAE,OAAO,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC;AACvD;AACA,SAAS,eAAe,CAAC,mBAAmB,EAAE,IAAI,EAAE;AACpD,EAAE,IAAI,eAAe,CAAC,mBAAmB,CAAC;AAC1C,IAAI,OAAO,IAAI;AACf,EAAE,OAAO,IAAI,EAAE;AACf;AACA,SAAS,OAAO,CAAC,KAAK,EAAE;AACxB,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,KAAK;AACrJ,EAAE,IAAI,CAAC,OAAO;AACd,IAAI,OAAO,KAAK;AAChB,EAAE,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE;AACzC,IAAI,IAAI,CAAC,sBAAsB;AAC/B,MAAM,OAAO,KAAK;AAClB,IAAI,IAAI,eAAe,CAAC,mBAAmB,CAAC;AAC5C,MAAM,OAAO,IAAI;AACjB,IAAI,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,KAAK,IAAI,CAAC,CAAC,SAAS,KAAK,WAAW,CAAC;AACnJ,EAAE;AACF,EAAE,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;AACtC,IAAI,OAAO,MAAM,KAAK,IAAI;AAC1B,EAAE,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK;AAClC,IAAI,OAAO,SAAS,KAAK,IAAI;AAC7B,EAAE,IAAI,OAAO,CAAC,UAAU,KAAK,QAAQ;AACrC,IAAI,OAAO,mBAAmB,GAAG,IAAI,GAAG,SAAS,KAAK,IAAI;AAC1D,EAAE,OAAO,KAAK;AACd;AACA,SAAS,QAAQ,CAAC,KAAK,EAAE;AACzB,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,KAAK;AAC7G,EAAE,IAAI,CAAC,OAAO;AACd,IAAI,OAAO,KAAK;AAChB,EAAE,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE;AACzC,IAAI,IAAI,CAAC,sBAAsB;AAC/B,MAAM,OAAO,KAAK;AAClB,IAAI,IAAI,eAAe,CAAC,mBAAmB,CAAC;AAC5C,MAAM,OAAO,IAAI;AACjB,IAAI,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,KAAK,IAAI,CAAC,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC;AACnK,EAAE;AACF,EAAE,OAAO,OAAO,CAAC,KAAK,CAAC;AACvB;AACA,SAAS,OAAO,CAAC,KAAK,EAAE;AACxB,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,GAAG,KAAK;AAChF,EAAE,IAAI,OAAO,EAAE,UAAU,KAAK,UAAU,EAAE;AAC1C,IAAI,IAAI,CAAC,sBAAsB;AAC/B,MAAM,OAAO,KAAK;AAClB,IAAI,OAAO,eAAe,CAAC,mBAAmB,CAAC;AAC/C,EAAE;AACF,EAAE,OAAO,MAAM,EAAE,IAAI,KAAK,OAAO,IAAI,MAAM,EAAE,IAAI,KAAK,QAAQ;AAC9D;AACA,SAAS,SAAS,CAAC,KAAK,EAAE;AAC1B,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,UAAU,KAAK,UAAU,EAAE;AAChD,IAAI,IAAI,CAAC,KAAK,CAAC,sBAAsB;AACrC,MAAM,OAAO,KAAK;AAClB,IAAI,OAAO,eAAe,CAAC,KAAK,CAAC,mBAAmB,CAAC;AACrD,EAAE;AACF,EAAE,OAAO,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,OAAO;AACvC;AACA,SAAS,sBAAsB,CAAC,KAAK,EAAE;AACvC,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,UAAU,KAAK,UAAU,EAAE;AAChD,IAAI,IAAI,CAAC,KAAK,CAAC,sBAAsB;AACrC,MAAM,OAAO,KAAK;AAClB,IAAI,OAAO,eAAe,CAAC,KAAK,CAAC,mBAAmB,CAAC;AACrD,EAAE;AACF,EAAE,OAAO,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,OAAO;AACvC;AACA,SAAS,2BAA2B,CAAC,KAAK,EAAE;AAC5C,EAAE,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,EAAE,IAAI;AACpC,EAAE,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO;AAC7C;AACA,SAAS,iBAAiB,CAAC,KAAK,EAAE;AAClC,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,GAAG,KAAK;AACpG,EAAE,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU;AAC7B,IAAI,OAAO,KAAK;AAChB,EAAE,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE;AACzC,IAAI,IAAI,CAAC,sBAAsB;AAC/B,MAAM,OAAO,KAAK;AAClB,IAAI,OAAO,eAAe,CAAC,mBAAmB,CAAC;AAC/C,EAAE;AACF,EAAE,IAAI,MAAM,EAAE,IAAI,KAAK,OAAO,IAAI,MAAM,EAAE,IAAI,KAAK,QAAQ;AAC3D,IAAI,OAAO,IAAI;AACf,EAAE,IAAI,OAAO,CAAC,gBAAgB,IAAI,MAAM,KAAK,UAAU,CAAC,OAAO;AAC/D,IAAI,OAAO,IAAI;AACf,EAAE,OAAO,KAAK;AACd;AACA,SAAS,UAAU,CAAC,KAAK,EAAE;AAC3B,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,KAAK;AACnD,EAAE,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW;AAC9B,IAAI,OAAO,KAAK;AAChB,EAAE,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU;AACvC,IAAI,OAAO,KAAK;AAChB,EAAE,IAAI,WAAW,KAAK,OAAO,CAAC,KAAK;AACnC,IAAI,OAAO,KAAK;AAChB,EAAE,MAAM,IAAI,GAAG,SAAS,EAAE,IAAI;AAC9B,EAAE,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO;AAC7C;AACA,SAAS,gBAAgB,CAAC,KAAK,EAAE;AACjC,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,KAAK;AACvE,EAAE,IAAI,WAAW,KAAK,WAAW;AACjC,IAAI,OAAO,KAAK;AAChB,EAAE,MAAM,IAAI,GAAG,SAAS,EAAE,IAAI;AAC9B,EAAE,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO;AAC1C,IAAI,OAAO,IAAI;AACf,EAAE,IAAI,IAAI,KAAK,QAAQ,IAAI,cAAc,CAAC,QAAQ,CAAC,iBAAiB,CAAC;AACrE,IAAI,OAAO,IAAI;AACf,EAAE,OAAO,KAAK;AACd;AACA,SAAS,iBAAiB,CAAC,KAAK,EAAE;AAClC,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO;AACnC,IAAI,OAAO,IAAI;AACf,EAAE,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,MAAM;AAC9E,EAAE,IAAI,UAAU,IAAI,CAAC;AACrB,IAAI,OAAO,YAAY;AACvB,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS;AACtB,IAAI,OAAO,eAAe;AAC1B,EAAE,OAAO,IAAI;AACb;AACA,MAAM,kBAAkB,GAAG,cAAc;AACzC,SAAS,aAAa,CAAC,MAAM,EAAE;AAC/B,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM;AAC9B,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC;AACrD,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE;AACtB;AACA,SAAS,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE;AAC/C,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE;AACvC,IAAI,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,qCAAqC,CAAC,CAAC;AAC7D,EAAE;AACF,EAAE,OAAO,IAAI;AACb;AACA,SAAS,oBAAoB,CAAC,MAAM,EAAE,UAAU,EAAE;AAClD,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE;AACvC,IAAI,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;AAC3B,EAAE;AACF,EAAE,OAAO,IAAI;AACb;AACK,MAAC,0BAA0B,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,uBAAuB;AAC3F,MAAC,oBAAoB,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,gBAAgB;AAC9E,MAAC,uBAAuB,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,oBAAoB;AACrF,MAAC,uBAAuB,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,oBAAoB;AAC1F,MAAM,wBAAwB,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,oBAAoB,CAAC;AAC5F,MAAM,qBAAqB,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,CAAC;AACjF,MAAC,yBAAyB,GAAG,CAAC,MAAM,KAAK,oBAAoB,CAAC,MAAM,EAAE,uBAAuB;AAC7F,MAAC,mBAAmB,GAAG,CAAC,MAAM,KAAK,oBAAoB,CAAC,MAAM,EAAE,gBAAgB;AACrF,MAAM,uBAAuB,GAAG,CAAC,MAAM,KAAK,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,CAAC;AAC9F,MAAM,oBAAoB,GAAG,CAAC,MAAM,KAAK,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,CAAC;AACnF,MAAC,oBAAoB,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,gBAAgB;AACnF,SAAS,4BAA4B,CAAC,MAAM,EAAE;AAC9C,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AAC7E,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,qCAAqC,CAAC,CAAC;AACzE,EAAE,OAAO,IAAI;AACb;AACA,SAAS,2BAA2B,CAAC,MAAM,EAAE;AAC7C,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AAC7E,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;AACzC,EAAE,OAAO,IAAI;AACb;AACA,eAAe,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE;AACjD,EAAE,IAAI,aAAa,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,OAAO,IAAI;AACvD,EAAE,OAAO,MAAM,KAAK,EAAE;AACtB;AACA,eAAe,YAAY,CAAC,KAAK,EAAE;AACnC,EAAE,OAAO,MAAM,KAAK,EAAE;AACtB;AACA,eAAe,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE;AAChD,EAAE,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;AACvE,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,mBAAmB,CAAC;AACrD,EAAE,OAAO,OAAO;AAChB;AACA,eAAe,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,EAAE;AACrE,EAAE,MAAM,mBAAmB,GAAG,IAAI,CAAC,wBAAwB,CAAC;AAC5D,EAAE,MAAM,sBAAsB,GAAG,IAAI,CAAC,0BAA0B,CAAC;AACjE,EAAE,IAAI,MAAM,GAAG,IAAI;AACnB,EAAE,IAAI,SAAS,GAAG,IAAI;AACtB,EAAE,IAAI,cAAc,GAAG,EAAE;AACzB,EAAE,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE;AACzC,IAAI,IAAI,sBAAsB,EAAE;AAChC,MAAM,cAAc,GAAG,MAAM,4BAA4B,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;AAC1F,IAAI;AACJ,EAAE,CAAC,MAAM,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE;AAC/C,IAAI,MAAM,GAAG,MAAM,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC;AACrF,EAAE,CAAC,MAAM;AACT,IAAI,MAAM,aAAa,GAAG,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,mBAAmB;AAChF,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AAC5C,MAAM,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC;AACxE,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,uBAAuB,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM;AACnH,KAAK,CAAC;AACN,EAAE;AACF,EAAE,OAAO;AACT,IAAI,cAAc,EAAE,GAAG,CAAC,cAAc;AACtC,IAAI,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;AAChD,IAAI,OAAO;AACX,IAAI,MAAM;AACV,IAAI,SAAS;AACb,IAAI,mBAAmB;AACvB,IAAI,sBAAsB;AAC1B,IAAI,cAAc;AAClB,IAAI,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;AACxC,IAAI,MAAM,EAAE,GAAG,CAAC,MAAM;AACtB,IAAI,GAAG;AACP,GAAG;AACH;AACA,SAAS,0BAA0B,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;AACxD,EAAE,OAAO;AACT,IAAI,cAAc,EAAE,GAAG,CAAC,cAAc;AACtC,IAAI,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;AAChD,IAAI,OAAO;AACX,IAAI,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;AAC/B,IAAI,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;AACrC,IAAI,mBAAmB,EAAE,IAAI,CAAC,wBAAwB,CAAC;AACvD,IAAI,sBAAsB,EAAE,IAAI,CAAC,0BAA0B,CAAC;AAC5D,IAAI,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE;AAC7C,IAAI,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;AACxC,IAAI,MAAM,EAAE,GAAG,CAAC;AAChB,GAAG;AACH;AACA,eAAe,cAAc,CAAC,MAAM,EAAE,SAAS,EAAE;AACjD,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,YAAY;AACjD,IAAI,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC;AAC1D,IAAI,OAAO,OAAO,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC/D,EAAE,CAAC,CAAC;AACJ,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,kDAAkD,CAAC;AACpF,EAAE,OAAO,IAAI;AACb;AACA,eAAe,0BAA0B,CAAC,MAAM,EAAE,SAAS,EAAE;AAC7D,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC;AACxD,EAAE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,YAAY;AACjD,IAAI,IAAI,OAAO,CAAC,gBAAgB,EAAE,OAAO,IAAI;AAC7C,IAAI,OAAO,OAAO,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC/D,EAAE,CAAC,CAAC;AACJ,EAAE,IAAI,CAAC,OAAO,EAAE;AAChB,IAAI,MAAM,KAAK,CAAC,GAAG,EAAE,mEAAmE,CAAC;AACzF,EAAE;AACF,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE;AAC/B;AACA,eAAe,wBAAwB,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE;AACrE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AACvC,EAAE,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC;AACvF,EAAE,IAAI,CAAC,MAAM,EAAE;AACf,IAAI,MAAM,KAAK,CAAC,GAAG,EAAE,sEAAsE,CAAC;AAC5F,EAAE;AACF;AACA,eAAe,iBAAiB,CAAC,MAAM,EAAE,SAAS,EAAE;AACpD,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC;AACxD,EAAE,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,YAAY;AAC/D,IAAI,MAAM,SAAS,GAAG,MAAM,uBAAuB,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC;AAClG,IAAI,OAAO,UAAU,CAAC;AACtB,MAAM,OAAO;AACb,MAAM,SAAS;AACf,MAAM,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI;AACtC,KAAK,CAAC;AACN,EAAE,CAAC,CAAC;AACJ,EAAE,IAAI,CAAC,OAAO,EAAE;AAChB,IAAI,MAAM,KAAK,CAAC,GAAG,EAAE,iEAAiE,CAAC;AACvF,EAAE;AACF,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE;AAC/B;AACA,eAAe,uBAAuB,CAAC,MAAM,EAAE,WAAW,EAAE;AAC5D,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,YAAY;AAC/D,IAAI,MAAM,SAAS,GAAG,MAAM,uBAAuB,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC;AAChG,IAAI,OAAO,gBAAgB,CAAC;AAC5B,MAAM,cAAc,EAAE,GAAG,CAAC,cAAc;AACxC,MAAM,SAAS;AACf,MAAM,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;AAC1C,MAAM;AACN,KAAK,CAAC;AACN,EAAE,CAAC,CAAC;AACJ,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,4DAA4D,CAAC;AAC9F,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE;AACtB;AACA,eAAe,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE;AACnD,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,YAAY;AAC/D,IAAI,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC;AAC1D,IAAI,OAAO,SAAS,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AACjE,EAAE,CAAC,CAAC;AACJ,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,8CAA8C,CAAC;AAChF,EAAE,OAAO,IAAI;AACb;AACA,eAAe,uBAAuB,CAAC,MAAM,EAAE,SAAS,EAAE;AAC1D,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,YAAY;AAC/D,IAAI,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC;AAC1D,IAAI,OAAO,SAAS,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AACjE,EAAE,CAAC,CAAC;AACJ,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,yCAAyC,CAAC;AAC3E,EAAE,OAAO,IAAI;AACb;AACA,eAAe,6BAA6B,CAAC,MAAM,EAAE,SAAS,EAAE;AAChE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC;AACxD,EAAE,MAAM,OAAO,GAAG,MAAM,qBAAqB;AAC7C,IAAI,GAAG;AACP,IAAI,YAAY,sBAAsB,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC;AAClF,GAAG;AACH,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,gDAAgD,CAAC;AAClF,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE;AAC/B;AACA,eAAe,qBAAqB,CAAC,MAAM,EAAE,SAAS,EAAE;AACxD,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,YAAY;AACjD,IAAI,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC;AAC1D,IAAI,OAAO,OAAO,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC/D,EAAE,CAAC,CAAC;AACJ,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,yCAAyC,CAAC;AAC3E,EAAE,OAAO,IAAI;AACb;AACA,eAAe,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE;AAClD,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC;AACxD,EAAE,MAAM,OAAO,GAAG,MAAM,YAAY;AACpC,IAAI,YAAY,QAAQ,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC;AACpE,GAAG;AACH,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,yCAAyC,CAAC;AAC3E,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE;AAC/B;AACA,eAAe,yBAAyB,CAAC,MAAM,EAAE,IAAI,EAAE;AACvD,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AACvC,EAAE,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC;AACzD,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,sBAAsB,CAAC;AACvD,EAAE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,YAAY;AACjD,IAAI,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AAChD,MAAM,kBAAkB,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC;AAC5D,MAAM,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM;AAC7E,KAAK,CAAC;AACN,IAAI,OAAO,iBAAiB,CAAC;AAC7B,MAAM,OAAO;AACb,MAAM,UAAU,EAAE,MAAM;AACxB,MAAM,MAAM;AACZ,MAAM,MAAM,EAAE,GAAG,CAAC,MAAM;AACxB,MAAM,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;AAClD,MAAM,sBAAsB,EAAE,IAAI,CAAC,0BAA0B;AAC7D,KAAK,CAAC;AACN,EAAE,CAAC,CAAC;AACJ,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,qDAAqD,CAAC;AACvF,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE;AACxB;AACA,eAAe,wBAAwB,CAAC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE;AAC3E,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,YAAY;AACjD,IAAI,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AAC5D,MAAM,kBAAkB,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;AACrD,MAAM,iBAAiB,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC;AAClD,MAAM,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM;AACtE,KAAK,CAAC;AACN,IAAI,OAAO,iBAAiB,CAAC;AAC7B,MAAM,OAAO;AACb,MAAM,UAAU;AAChB,MAAM,MAAM;AACZ,MAAM,MAAM,EAAE,GAAG,CAAC,MAAM;AACxB,MAAM,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;AAClD,MAAM,sBAAsB,EAAE,IAAI,CAAC,0BAA0B;AAC7D,KAAK,CAAC;AACN,EAAE,CAAC,CAAC;AACJ,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,qDAAqD,CAAC;AACvF,EAAE,OAAO,IAAI;AACb;AACK,MAAC,aAAa,mBAAmB,MAAM,CAAC,MAAM,iBAAiB,MAAM,CAAC,cAAc,CAAC;AAC1F,EAAE,SAAS,EAAE,IAAI;AACjB,EAAE,2BAA2B;AAC7B,EAAE,mBAAmB;AACrB,EAAE,uBAAuB;AACzB,EAAE,yBAAyB;AAC3B,EAAE,oBAAoB;AACtB,EAAE,oBAAoB;AACtB,EAAE,0BAA0B;AAC5B,EAAE,4BAA4B;AAC9B,EAAE,0BAA0B;AAC5B,EAAE,uBAAuB;AACzB,EAAE,cAAc;AAChB,EAAE,wBAAwB;AAC1B,EAAE,6BAA6B;AAC/B,EAAE,gBAAgB;AAClB,EAAE,uBAAuB;AACzB,EAAE,iBAAiB;AACnB,EAAE,eAAe;AACjB,EAAE,qBAAqB;AACvB,EAAE,yBAAyB;AAC3B,EAAE,oBAAoB;AACtB,EAAE,oBAAoB;AACtB,EAAE,wBAAwB;AAC1B,EAAE,0BAA0B;AAC5B,EAAE,uBAAuB;AACzB,EAAE,uBAAuB;AACzB,EAAE,qBAAqB;AACvB,EAAE,iBAAiB;AACnB,EAAE,wBAAwB;AAC1B,EAAE;AACF,CAAC,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;;;;"}

package/build/server/chunks/{api-errors-DGHmIOGJ.js → api-errors-DSza0CJv.js}

@@ -1,6 +1,6 @@
 import { error } from '@sveltejs/kit';
 import './context-9tV9WxQ5.js';
-import { P as ProviderError } from './providers.server-Duyx-08B.js';
+import { P as ProviderError } from './providers.server-gJvnJT_K.js';
 
 function isSvelteKitError(err) {
   return !!err && typeof err === "object" && "status" in err && "body" in err;
@@ -33,4 +33,4 @@ function throwZodError(err) {
 }
 
 export { handleApiError as h, throwZodError as t };
-//# sourceMappingURL=api-errors-DGHmIOGJ.js.map
+//# sourceMappingURL=api-errors-DSza0CJv.js.map

package/build/server/chunks/{api-errors-DGHmIOGJ.js.map → api-errors-DSza0CJv.js.map}

@@ -1 +1 @@
-{"version":3,"file":"api-errors-DGHmIOGJ.js","sources":["../../../.svelte-kit/adapter-node/chunks/api-errors.js"],"sourcesContent":["import { error } from \"@sveltejs/kit\";\nimport \"./context.js\";\nimport { P as ProviderError } from \"./providers.server.js\";\nfunction isSvelteKitError(err) {\n  return !!err && typeof err === \"object\" && \"status\" in err && \"body\" in err;\n}\nconst UNIQUE_CONSTRAINT_MESSAGES = {\n  projects_org_name_unique: \"A project with that name already exists in this organization.\",\n  projects_org_id_slug_key: \"A project with that name already exists in this organization.\",\n  orgs_slug_key: \"An organization with that slug already exists.\",\n  definitions_pkey: \"A definition with that ID already exists.\"\n};\nfunction friendlyConstraintMessage(raw) {\n  for (const [name, msg] of Object.entries(UNIQUE_CONSTRAINT_MESSAGES)) {\n    if (raw.includes(name)) return msg;\n  }\n  return null;\n}\nfunction handleApiError(err, fallback) {\n  if (isSvelteKitError(err)) throw err;\n  if (err instanceof ProviderError) {\n    const friendly = friendlyConstraintMessage(err.message);\n    throw error(err.statusCode, friendly ?? err.message);\n  }\n  console.error(`[API] ${fallback}:`, err);\n  throw error(500, fallback);\n}\nfunction throwZodError(err) {\n  const issue = err.issues[0];\n  const path = issue.path.length ? `${issue.path.join(\".\")}: ` : \"\";\n  throw error(400, `${path}${issue.message}`);\n}\nexport {\n  handleApiError as h,\n  throwZodError as t\n};\n"],"names":[],"mappings":";;;;AAGA,SAAS,gBAAgB,CAAC,GAAG,EAAE;AAC/B,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,QAAQ,IAAI,GAAG,IAAI,MAAM,IAAI,GAAG;AAC7E;AACA,MAAM,0BAA0B,GAAG;AACnC,EAAE,wBAAwB,EAAE,+DAA+D;AAC3F,EAAE,wBAAwB,EAAE,+DAA+D;AAC3F,EAAE,aAAa,EAAE,gDAAgD;AACjE,EAAE,gBAAgB,EAAE;AACpB,CAAC;AACD,SAAS,yBAAyB,CAAC,GAAG,EAAE;AACxC,EAAE,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,EAAE;AACxE,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG;AACtC,EAAE;AACF,EAAE,OAAO,IAAI;AACb;AACA,SAAS,cAAc,CAAC,GAAG,EAAE,QAAQ,EAAE;AACvC,EAAE,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG;AACtC,EAAE,IAAI,GAAG,YAAY,aAAa,EAAE;AACpC,IAAI,MAAM,QAAQ,GAAG,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC;AAC3D,IAAI,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC;AACxD,EAAE;AACF,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;AAC1C,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC;AAC5B;AACA,SAAS,aAAa,CAAC,GAAG,EAAE;AAC5B,EAAE,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC7B,EAAE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE;AACnE,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;AAC7C;;;;"}
+{"version":3,"file":"api-errors-DSza0CJv.js","sources":["../../../.svelte-kit/adapter-node/chunks/api-errors.js"],"sourcesContent":["import { error } from \"@sveltejs/kit\";\nimport \"./context.js\";\nimport { P as ProviderError } from \"./providers.server.js\";\nfunction isSvelteKitError(err) {\n  return !!err && typeof err === \"object\" && \"status\" in err && \"body\" in err;\n}\nconst UNIQUE_CONSTRAINT_MESSAGES = {\n  projects_org_name_unique: \"A project with that name already exists in this organization.\",\n  projects_org_id_slug_key: \"A project with that name already exists in this organization.\",\n  orgs_slug_key: \"An organization with that slug already exists.\",\n  definitions_pkey: \"A definition with that ID already exists.\"\n};\nfunction friendlyConstraintMessage(raw) {\n  for (const [name, msg] of Object.entries(UNIQUE_CONSTRAINT_MESSAGES)) {\n    if (raw.includes(name)) return msg;\n  }\n  return null;\n}\nfunction handleApiError(err, fallback) {\n  if (isSvelteKitError(err)) throw err;\n  if (err instanceof ProviderError) {\n    const friendly = friendlyConstraintMessage(err.message);\n    throw error(err.statusCode, friendly ?? err.message);\n  }\n  console.error(`[API] ${fallback}:`, err);\n  throw error(500, fallback);\n}\nfunction throwZodError(err) {\n  const issue = err.issues[0];\n  const path = issue.path.length ? `${issue.path.join(\".\")}: ` : \"\";\n  throw error(400, `${path}${issue.message}`);\n}\nexport {\n  handleApiError as h,\n  throwZodError as t\n};\n"],"names":[],"mappings":";;;;AAGA,SAAS,gBAAgB,CAAC,GAAG,EAAE;AAC/B,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,QAAQ,IAAI,GAAG,IAAI,MAAM,IAAI,GAAG;AAC7E;AACA,MAAM,0BAA0B,GAAG;AACnC,EAAE,wBAAwB,EAAE,+DAA+D;AAC3F,EAAE,wBAAwB,EAAE,+DAA+D;AAC3F,EAAE,aAAa,EAAE,gDAAgD;AACjE,EAAE,gBAAgB,EAAE;AACpB,CAAC;AACD,SAAS,yBAAyB,CAAC,GAAG,EAAE;AACxC,EAAE,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,EAAE;AACxE,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG;AACtC,EAAE;AACF,EAAE,OAAO,IAAI;AACb;AACA,SAAS,cAAc,CAAC,GAAG,EAAE,QAAQ,EAAE;AACvC,EAAE,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG;AACtC,EAAE,IAAI,GAAG,YAAY,aAAa,EAAE;AACpC,IAAI,MAAM,QAAQ,GAAG,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC;AAC3D,IAAI,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC;AACxD,EAAE;AACF,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;AAC1C,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC;AAC5B;AACA,SAAS,aAAa,CAAC,GAAG,EAAE;AAC5B,EAAE,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC7B,EAAE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE;AACnE,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;AAC7C;;;;"}

package/build/server/chunks/{auth-bootstrap.server-dy8_QSAP.js → auth-bootstrap.server-YBvyz9i1.js}

@@ -1,7 +1,7 @@
 import { b as private_env } from './shared-server-DaWdgxVh.js';
 import { randomUUID } from 'node:crypto';
 import { S as SYSTEM_CONTEXT, A as ALL_PLATFORM_PERMISSIONS } from './context-9tV9WxQ5.js';
-import { g as getAuthProvider, l as getPermissionStore, n as getDataProvider, t as tenancy, c as getOrganizationProvider, h as getProjectProvider } from './providers.server-Duyx-08B.js';
+import { g as getAuthProvider, l as getPermissionStore, n as getDataProvider, t as tenancy, c as getOrganizationProvider, h as getProjectProvider } from './providers.server-gJvnJT_K.js';
 import { s as slugify } from './slug-BGuFQjqe.js';
 
 async function bootstrapUserSession(user) {
@@ -94,4 +94,4 @@ function wireHeaderAuthBootstrap() {
 }
 
 export { bootstrapUserSession as b, wireHeaderAuthBootstrap as w };
-//# sourceMappingURL=auth-bootstrap.server-dy8_QSAP.js.map
+//# sourceMappingURL=auth-bootstrap.server-YBvyz9i1.js.map

package/build/server/chunks/{auth-bootstrap.server-dy8_QSAP.js.map → auth-bootstrap.server-YBvyz9i1.js.map}

@@ -1 +1 @@
-{"version":3,"file":"auth-bootstrap.server-dy8_QSAP.js","sources":["../../../.svelte-kit/adapter-node/chunks/auth-bootstrap.server.js"],"sourcesContent":["import { b as private_env } from \"./shared-server.js\";\nimport { randomUUID } from \"node:crypto\";\nimport { S as SYSTEM_CONTEXT, f as ALL_PLATFORM_PERMISSIONS } from \"./context.js\";\nimport { h as getDataProvider, f as getPermissionStore, t as tenancy, a as getOrganizationProvider, e as getAuthProvider, b as getProjectProvider } from \"./providers.server.js\";\nimport { s as slugify } from \"./slug.js\";\nasync function bootstrapUserSession(user) {\n  await getDataProvider().ensureUser(SYSTEM_CONTEXT, user.id);\n  const perms = getPermissionStore();\n  const hasAdmin = await perms.hasInstanceAdmin(SYSTEM_CONTEXT);\n  let grantedAdminHere = false;\n  if (!hasAdmin) {\n    if (!shouldBootstrapAdmin(user, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, tenancy)) return;\n    await perms.set(SYSTEM_CONTEXT, user.id, [...ALL_PLATFORM_PERMISSIONS]);\n    grantedAdminHere = true;\n  }\n  if (tenancy !== \"single\") return;\n  const orgs = getOrganizationProvider();\n  const existing = await orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 });\n  if (existing.items.length > 0) return;\n  if (!grantedAdminHere) {\n    const userPerms = await perms.getFor(SYSTEM_CONTEXT, user.id);\n    if (!userPerms.includes(\"instance_admin\")) return;\n  }\n  await ensureSingleTenantDefaultOrg(user);\n}\nasync function ensureSingleTenantDefaultOrg(user) {\n  if (tenancy !== \"single\") return;\n  const orgs = getOrganizationProvider();\n  const existing = await orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 });\n  if (existing.items.length > 0) return;\n  const displayName = typeof user.metadata?.displayName === \"string\" ? user.metadata.displayName : void 0;\n  const orgName = displayName?.trim() || user.email?.split(\"@\")[0]?.trim() || \"Default\";\n  const slug = slugify(orgName).length >= 3 ? slugify(orgName) : \"default\";\n  const now = (/* @__PURE__ */ new Date()).toISOString();\n  const org = {\n    id: randomUUID(),\n    name: orgName,\n    slug,\n    ownerId: user.id,\n    createdBy: user.id,\n    updatedBy: user.id,\n    createdAt: now,\n    updatedAt: now,\n    deletedAt: null\n  };\n  await orgs.createOrg(SYSTEM_CONTEXT, org);\n  const projects = getProjectProvider();\n  const project = {\n    id: randomUUID(),\n    orgId: org.id,\n    name: \"Default\",\n    slug: \"default\",\n    visibility: \"public\",\n    ownerId: user.id,\n    createdBy: user.id,\n    updatedBy: user.id,\n    autoJoinOnUpload: false,\n    createdAt: now,\n    updatedAt: now,\n    deletedAt: null\n  };\n  await projects.createProject(SYSTEM_CONTEXT, project);\n}\nfunction shouldBootstrapAdmin(user, configuredEmail, mode) {\n  const expected = configuredEmail?.trim().toLowerCase();\n  if (mode === \"multi\" && !expected) return false;\n  if (!expected) return true;\n  const actual = user.email?.trim().toLowerCase();\n  return !!actual && actual === expected;\n}\nfunction shouldBootstrapUpn(upn, email, configuredEmail, mode) {\n  const expected = configuredEmail?.trim().toLowerCase();\n  if (mode === \"multi\" && !expected) return false;\n  if (!expected) return true;\n  const candidate = (email ?? upn).trim().toLowerCase();\n  return !!candidate && candidate === expected;\n}\nfunction wireHeaderAuthBootstrap() {\n  const auth = getAuthProvider();\n  if (typeof auth.setBootstrapAllowlistPolicy !== \"function\") {\n    if (private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL?.trim()) {\n      console.warn(\n        \"[selva] BOOTSTRAP_INSTANCE_ADMIN_EMAIL is set but the installed @selvajs/header-auth-provider does not expose setBootstrapAllowlistPolicy. Upgrade the provider, or hand-seed header-allowlist.json.\"\n      );\n    }\n    return;\n  }\n  auth.setBootstrapAllowlistPolicy(async ({ upn, email }) => {\n    const hasAdmin = await getPermissionStore().hasInstanceAdmin(SYSTEM_CONTEXT);\n    if (hasAdmin) return false;\n    return shouldBootstrapUpn(upn, email, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, tenancy);\n  });\n}\nexport {\n  bootstrapUserSession as b,\n  wireHeaderAuthBootstrap as w\n};\n"],"names":[],"mappings":";;;;;;AAKA,eAAe,oBAAoB,CAAC,IAAI,EAAE;AAC1C,EAAE,MAAM,eAAe,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAC7D,EAAE,MAAM,KAAK,GAAG,kBAAkB,EAAE;AACpC,EAAE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,cAAc,CAAC;AAC/D,EAAE,IAAI,gBAAgB,GAAG,KAAK;AAC9B,EAAE,IAAI,CAAC,QAAQ,EAAE;AACjB,IAAI,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,WAAW,CAAC,8BAA8B,EAAE,OAAO,CAAC,EAAE;AAC1F,IAAI,MAAM,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,wBAAwB,CAAC,CAAC;AAC3E,IAAI,gBAAgB,GAAG,IAAI;AAC3B,EAAE;AACF,EAAE,IAAI,OAAO,KAAK,QAAQ,EAAE;AAC5B,EAAE,MAAM,IAAI,GAAG,uBAAuB,EAAE;AACxC,EAAE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AACpE,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;AACjC,EAAE,IAAI,CAAC,gBAAgB,EAAE;AACzB,IAAI,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AACjE,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE;AAC/C,EAAE;AACF,EAAE,MAAM,4BAA4B,CAAC,IAAI,CAAC;AAC1C;AACA,eAAe,4BAA4B,CAAC,IAAI,EAAE;AAClD,EAAE,IAAI,OAAO,KAAK,QAAQ,EAAE;AAC5B,EAAE,MAAM,IAAI,GAAG,uBAAuB,EAAE;AACxC,EAAE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AACpE,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;AACjC,EAAE,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,QAAQ,EAAE,WAAW,KAAK,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,GAAG,MAAM;AACzG,EAAE,MAAM,OAAO,GAAG,WAAW,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS;AACvF,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS;AAC1E,EAAE,MAAM,GAAG,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACxD,EAAE,MAAM,GAAG,GAAG;AACd,IAAI,EAAE,EAAE,UAAU,EAAE;AACpB,IAAI,IAAI,EAAE,OAAO;AACjB,IAAI,IAAI;AACR,IAAI,OAAO,EAAE,IAAI,CAAC,EAAE;AACpB,IAAI,SAAS,EAAE,IAAI,CAAC,EAAE;AACtB,IAAI,SAAS,EAAE,IAAI,CAAC,EAAE;AACtB,IAAI,SAAS,EAAE,GAAG;AAClB,IAAI,SAAS,EAAE,GAAG;AAClB,IAAI,SAAS,EAAE;AACf,GAAG;AACH,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,CAAC;AAC3C,EAAE,MAAM,QAAQ,GAAG,kBAAkB,EAAE;AACvC,EAAE,MAAM,OAAO,GAAG;AAClB,IAAI,EAAE,EAAE,UAAU,EAAE;AACpB,IAAI,KAAK,EAAE,GAAG,CAAC,EAAE;AACjB,IAAI,IAAI,EAAE,SAAS;AACnB,IAAI,IAAI,EAAE,SAAS;AACnB,IAAI,UAAU,EAAE,QAAQ;AACxB,IAAI,OAAO,EAAE,IAAI,CAAC,EAAE;AACpB,IAAI,SAAS,EAAE,IAAI,CAAC,EAAE;AACtB,IAAI,SAAS,EAAE,IAAI,CAAC,EAAE;AACtB,IAAI,gBAAgB,EAAE,KAAK;AAC3B,IAAI,SAAS,EAAE,GAAG;AAClB,IAAI,SAAS,EAAE,GAAG;AAClB,IAAI,SAAS,EAAE;AACf,GAAG;AACH,EAAE,MAAM,QAAQ,CAAC,aAAa,CAAC,cAAc,EAAE,OAAO,CAAC;AACvD;AACA,SAAS,oBAAoB,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE;AAC3D,EAAE,MAAM,QAAQ,GAAG,eAAe,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACxD,EAAE,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,KAAK;AACjD,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI;AAC5B,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACjD,EAAE,OAAO,CAAC,CAAC,MAAM,IAAI,MAAM,KAAK,QAAQ;AACxC;AACA,SAAS,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE;AAC/D,EAAE,MAAM,QAAQ,GAAG,eAAe,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACxD,EAAE,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,KAAK;AACjD,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI;AAC5B,EAAE,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACvD,EAAE,OAAO,CAAC,CAAC,SAAS,IAAI,SAAS,KAAK,QAAQ;AAC9C;AACA,SAAS,uBAAuB,GAAG;AACnC,EAAE,MAAM,IAAI,GAAG,eAAe,EAAE;AAChC,EAAE,IAAI,OAAO,IAAI,CAAC,2BAA2B,KAAK,UAAU,EAAE;AAC9D,IAAI,IAAI,WAAW,CAAC,8BAA8B,EAAE,IAAI,EAAE,EAAE;AAC5D,MAAM,OAAO,CAAC,IAAI;AAClB,QAAQ;AACR,OAAO;AACP,IAAI;AACJ,IAAI;AACJ,EAAE;AACF,EAAE,IAAI,CAAC,2BAA2B,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK;AAC7D,IAAI,MAAM,QAAQ,GAAG,MAAM,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,cAAc,CAAC;AAChF,IAAI,IAAI,QAAQ,EAAE,OAAO,KAAK;AAC9B,IAAI,OAAO,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,CAAC,8BAA8B,EAAE,OAAO,CAAC;AAC9F,EAAE,CAAC,CAAC;AACJ;;;;"}
+{"version":3,"file":"auth-bootstrap.server-YBvyz9i1.js","sources":["../../../.svelte-kit/adapter-node/chunks/auth-bootstrap.server.js"],"sourcesContent":["import { b as private_env } from \"./shared-server.js\";\nimport { randomUUID } from \"node:crypto\";\nimport { S as SYSTEM_CONTEXT, f as ALL_PLATFORM_PERMISSIONS } from \"./context.js\";\nimport { i as getDataProvider, h as getPermissionStore, t as tenancy, a as getOrganizationProvider, e as getAuthProvider, b as getProjectProvider } from \"./providers.server.js\";\nimport { s as slugify } from \"./slug.js\";\nasync function bootstrapUserSession(user) {\n  await getDataProvider().ensureUser(SYSTEM_CONTEXT, user.id);\n  const perms = getPermissionStore();\n  const hasAdmin = await perms.hasInstanceAdmin(SYSTEM_CONTEXT);\n  let grantedAdminHere = false;\n  if (!hasAdmin) {\n    if (!shouldBootstrapAdmin(user, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, tenancy)) return;\n    await perms.set(SYSTEM_CONTEXT, user.id, [...ALL_PLATFORM_PERMISSIONS]);\n    grantedAdminHere = true;\n  }\n  if (tenancy !== \"single\") return;\n  const orgs = getOrganizationProvider();\n  const existing = await orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 });\n  if (existing.items.length > 0) return;\n  if (!grantedAdminHere) {\n    const userPerms = await perms.getFor(SYSTEM_CONTEXT, user.id);\n    if (!userPerms.includes(\"instance_admin\")) return;\n  }\n  await ensureSingleTenantDefaultOrg(user);\n}\nasync function ensureSingleTenantDefaultOrg(user) {\n  if (tenancy !== \"single\") return;\n  const orgs = getOrganizationProvider();\n  const existing = await orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 });\n  if (existing.items.length > 0) return;\n  const displayName = typeof user.metadata?.displayName === \"string\" ? user.metadata.displayName : void 0;\n  const orgName = displayName?.trim() || user.email?.split(\"@\")[0]?.trim() || \"Default\";\n  const slug = slugify(orgName).length >= 3 ? slugify(orgName) : \"default\";\n  const now = (/* @__PURE__ */ new Date()).toISOString();\n  const org = {\n    id: randomUUID(),\n    name: orgName,\n    slug,\n    ownerId: user.id,\n    createdBy: user.id,\n    updatedBy: user.id,\n    createdAt: now,\n    updatedAt: now,\n    deletedAt: null\n  };\n  await orgs.createOrg(SYSTEM_CONTEXT, org);\n  const projects = getProjectProvider();\n  const project = {\n    id: randomUUID(),\n    orgId: org.id,\n    name: \"Default\",\n    slug: \"default\",\n    visibility: \"public\",\n    ownerId: user.id,\n    createdBy: user.id,\n    updatedBy: user.id,\n    autoJoinOnUpload: false,\n    createdAt: now,\n    updatedAt: now,\n    deletedAt: null\n  };\n  await projects.createProject(SYSTEM_CONTEXT, project);\n}\nfunction shouldBootstrapAdmin(user, configuredEmail, mode) {\n  const expected = configuredEmail?.trim().toLowerCase();\n  if (mode === \"multi\" && !expected) return false;\n  if (!expected) return true;\n  const actual = user.email?.trim().toLowerCase();\n  return !!actual && actual === expected;\n}\nfunction shouldBootstrapUpn(upn, email, configuredEmail, mode) {\n  const expected = configuredEmail?.trim().toLowerCase();\n  if (mode === \"multi\" && !expected) return false;\n  if (!expected) return true;\n  const candidate = (email ?? upn).trim().toLowerCase();\n  return !!candidate && candidate === expected;\n}\nfunction wireHeaderAuthBootstrap() {\n  const auth = getAuthProvider();\n  if (typeof auth.setBootstrapAllowlistPolicy !== \"function\") {\n    if (private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL?.trim()) {\n      console.warn(\n        \"[selva] BOOTSTRAP_INSTANCE_ADMIN_EMAIL is set but the installed @selvajs/header-auth-provider does not expose setBootstrapAllowlistPolicy. Upgrade the provider, or hand-seed header-allowlist.json.\"\n      );\n    }\n    return;\n  }\n  auth.setBootstrapAllowlistPolicy(async ({ upn, email }) => {\n    const hasAdmin = await getPermissionStore().hasInstanceAdmin(SYSTEM_CONTEXT);\n    if (hasAdmin) return false;\n    return shouldBootstrapUpn(upn, email, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, tenancy);\n  });\n}\nexport {\n  bootstrapUserSession as b,\n  wireHeaderAuthBootstrap as w\n};\n"],"names":[],"mappings":";;;;;;AAKA,eAAe,oBAAoB,CAAC,IAAI,EAAE;AAC1C,EAAE,MAAM,eAAe,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAC7D,EAAE,MAAM,KAAK,GAAG,kBAAkB,EAAE;AACpC,EAAE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,cAAc,CAAC;AAC/D,EAAE,IAAI,gBAAgB,GAAG,KAAK;AAC9B,EAAE,IAAI,CAAC,QAAQ,EAAE;AACjB,IAAI,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,WAAW,CAAC,8BAA8B,EAAE,OAAO,CAAC,EAAE;AAC1F,IAAI,MAAM,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,wBAAwB,CAAC,CAAC;AAC3E,IAAI,gBAAgB,GAAG,IAAI;AAC3B,EAAE;AACF,EAAE,IAAI,OAAO,KAAK,QAAQ,EAAE;AAC5B,EAAE,MAAM,IAAI,GAAG,uBAAuB,EAAE;AACxC,EAAE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AACpE,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;AACjC,EAAE,IAAI,CAAC,gBAAgB,EAAE;AACzB,IAAI,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AACjE,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE;AAC/C,EAAE;AACF,EAAE,MAAM,4BAA4B,CAAC,IAAI,CAAC;AAC1C;AACA,eAAe,4BAA4B,CAAC,IAAI,EAAE;AAClD,EAAE,IAAI,OAAO,KAAK,QAAQ,EAAE;AAC5B,EAAE,MAAM,IAAI,GAAG,uBAAuB,EAAE;AACxC,EAAE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AACpE,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;AACjC,EAAE,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,QAAQ,EAAE,WAAW,KAAK,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,GAAG,MAAM;AACzG,EAAE,MAAM,OAAO,GAAG,WAAW,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS;AACvF,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS;AAC1E,EAAE,MAAM,GAAG,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACxD,EAAE,MAAM,GAAG,GAAG;AACd,IAAI,EAAE,EAAE,UAAU,EAAE;AACpB,IAAI,IAAI,EAAE,OAAO;AACjB,IAAI,IAAI;AACR,IAAI,OAAO,EAAE,IAAI,CAAC,EAAE;AACpB,IAAI,SAAS,EAAE,IAAI,CAAC,EAAE;AACtB,IAAI,SAAS,EAAE,IAAI,CAAC,EAAE;AACtB,IAAI,SAAS,EAAE,GAAG;AAClB,IAAI,SAAS,EAAE,GAAG;AAClB,IAAI,SAAS,EAAE;AACf,GAAG;AACH,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,CAAC;AAC3C,EAAE,MAAM,QAAQ,GAAG,kBAAkB,EAAE;AACvC,EAAE,MAAM,OAAO,GAAG;AAClB,IAAI,EAAE,EAAE,UAAU,EAAE;AACpB,IAAI,KAAK,EAAE,GAAG,CAAC,EAAE;AACjB,IAAI,IAAI,EAAE,SAAS;AACnB,IAAI,IAAI,EAAE,SAAS;AACnB,IAAI,UAAU,EAAE,QAAQ;AACxB,IAAI,OAAO,EAAE,IAAI,CAAC,EAAE;AACpB,IAAI,SAAS,EAAE,IAAI,CAAC,EAAE;AACtB,IAAI,SAAS,EAAE,IAAI,CAAC,EAAE;AACtB,IAAI,gBAAgB,EAAE,KAAK;AAC3B,IAAI,SAAS,EAAE,GAAG;AAClB,IAAI,SAAS,EAAE,GAAG;AAClB,IAAI,SAAS,EAAE;AACf,GAAG;AACH,EAAE,MAAM,QAAQ,CAAC,aAAa,CAAC,cAAc,EAAE,OAAO,CAAC;AACvD;AACA,SAAS,oBAAoB,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE;AAC3D,EAAE,MAAM,QAAQ,GAAG,eAAe,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACxD,EAAE,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,KAAK;AACjD,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI;AAC5B,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACjD,EAAE,OAAO,CAAC,CAAC,MAAM,IAAI,MAAM,KAAK,QAAQ;AACxC;AACA,SAAS,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE;AAC/D,EAAE,MAAM,QAAQ,GAAG,eAAe,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACxD,EAAE,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,KAAK;AACjD,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI;AAC5B,EAAE,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACvD,EAAE,OAAO,CAAC,CAAC,SAAS,IAAI,SAAS,KAAK,QAAQ;AAC9C;AACA,SAAS,uBAAuB,GAAG;AACnC,EAAE,MAAM,IAAI,GAAG,eAAe,EAAE;AAChC,EAAE,IAAI,OAAO,IAAI,CAAC,2BAA2B,KAAK,UAAU,EAAE;AAC9D,IAAI,IAAI,WAAW,CAAC,8BAA8B,EAAE,IAAI,EAAE,EAAE;AAC5D,MAAM,OAAO,CAAC,IAAI;AAClB,QAAQ;AACR,OAAO;AACP,IAAI;AACJ,IAAI;AACJ,EAAE;AACF,EAAE,IAAI,CAAC,2BAA2B,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK;AAC7D,IAAI,MAAM,QAAQ,GAAG,MAAM,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,cAAc,CAAC;AAChF,IAAI,IAAI,QAAQ,EAAE,OAAO,KAAK;AAC9B,IAAI,OAAO,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,CAAC,8BAA8B,EAAE,OAAO,CAAC;AAC9F,EAAE,CAAC,CAAC;AACJ;;;;"}

package/build/server/chunks/{bootHealth.server-DQx_qsNh.js → bootHealth.server-DwPUi_JC.js}

@@ -1,5 +1,5 @@
 import './context-9tV9WxQ5.js';
-import { p as providers, L as LocalComputeServerStore } from './providers.server-Duyx-08B.js';
+import { p as providers, L as LocalComputeServerStore } from './providers.server-gJvnJT_K.js';
 
 let cached = null;
 let inflight = null;
@@ -55,4 +55,4 @@ function isDegraded(report) {
 }
 
 export { getBootHealth as g, isDegraded as i };
-//# sourceMappingURL=bootHealth.server-DQx_qsNh.js.map
+//# sourceMappingURL=bootHealth.server-DwPUi_JC.js.map

package/build/server/chunks/{bootHealth.server-DQx_qsNh.js.map → bootHealth.server-DwPUi_JC.js.map}

@@ -1 +1 @@
-{"version":3,"file":"bootHealth.server-DQx_qsNh.js","sources":["../../../.svelte-kit/adapter-node/chunks/bootHealth.server.js"],"sourcesContent":["import \"./context.js\";\nimport { p as providers, L as LocalComputeServerStore } from \"./providers.server.js\";\nlet cached = null;\nlet inflight = null;\nasync function run() {\n  let atRestSecrets = null;\n  const store = providers.data.computeServer;\n  if (store instanceof LocalComputeServerStore) {\n    try {\n      atRestSecrets = await store.verifySecrets();\n    } catch (err) {\n      console.error(\"[selva][boot] verifySecrets threw — treating as failure\", err);\n      atRestSecrets = {\n        ok: false,\n        plaintextFound: false,\n        failures: [\n          {\n            serverId: \"(unknown)\",\n            serverLabel: \"(unknown)\",\n            reason: \"key_mismatch\",\n            cause: err instanceof Error ? err.message : String(err)\n          }\n        ]\n      };\n    }\n  }\n  if (atRestSecrets && !atRestSecrets.ok) {\n    for (const f of atRestSecrets.failures) {\n      console.error(\n        `[selva][boot] compute server \"${f.serverLabel}\" (${f.serverId}): ${f.reason}${f.cause ? ` — ${f.cause}` : \"\"}`\n      );\n    }\n    console.error(\n      \"[selva][boot] At-rest secret verification failed. /api/health will return 503. Recover by re-entering the affected apiKeys via /admin/compute, or by restoring the original SELVA_AT_REST_KEY. See docs/Troubleshooting.md.\"\n    );\n  }\n  return {\n    checkedAt: (/* @__PURE__ */ new Date()).toISOString(),\n    atRestSecrets\n  };\n}\nfunction getBootHealth() {\n  if (cached) return Promise.resolve(cached);\n  if (inflight) return inflight;\n  inflight = run().then((result) => {\n    cached = result;\n    inflight = null;\n    return result;\n  });\n  return inflight;\n}\nfunction isDegraded(report) {\n  return report.atRestSecrets !== null && !report.atRestSecrets.ok;\n}\nexport {\n  getBootHealth as g,\n  isDegraded as i\n};\n"],"names":[],"mappings":";;;AAEA,IAAI,MAAM,GAAG,IAAI;AACjB,IAAI,QAAQ,GAAG,IAAI;AACnB,eAAe,GAAG,GAAG;AACrB,EAAE,IAAI,aAAa,GAAG,IAAI;AAC1B,EAAE,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa;AAC5C,EAAE,IAAI,KAAK,YAAY,uBAAuB,EAAE;AAChD,IAAI,IAAI;AACR,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;AACjD,IAAI,CAAC,CAAC,OAAO,GAAG,EAAE;AAClB,MAAM,OAAO,CAAC,KAAK,CAAC,yDAAyD,EAAE,GAAG,CAAC;AACnF,MAAM,aAAa,GAAG;AACtB,QAAQ,EAAE,EAAE,KAAK;AACjB,QAAQ,cAAc,EAAE,KAAK;AAC7B,QAAQ,QAAQ,EAAE;AAClB,UAAU;AACV,YAAY,QAAQ,EAAE,WAAW;AACjC,YAAY,WAAW,EAAE,WAAW;AACpC,YAAY,MAAM,EAAE,cAAc;AAClC,YAAY,KAAK,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG;AAClE;AACA;AACA,OAAO;AACP,IAAI;AACJ,EAAE;AACF,EAAE,IAAI,aAAa,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE;AAC1C,IAAI,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,QAAQ,EAAE;AAC5C,MAAM,OAAO,CAAC,KAAK;AACnB,QAAQ,CAAC,8BAA8B,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC;AACtH,OAAO;AACP,IAAI;AACJ,IAAI,OAAO,CAAC,KAAK;AACjB,MAAM;AACN,KAAK;AACL,EAAE;AACF,EAAE,OAAO;AACT,IAAI,SAAS,EAAE,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACzD,IAAI;AACJ,GAAG;AACH;AACA,SAAS,aAAa,GAAG;AACzB,EAAE,IAAI,MAAM,EAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;AAC5C,EAAE,IAAI,QAAQ,EAAE,OAAO,QAAQ;AAC/B,EAAE,QAAQ,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK;AACpC,IAAI,MAAM,GAAG,MAAM;AACnB,IAAI,QAAQ,GAAG,IAAI;AACnB,IAAI,OAAO,MAAM;AACjB,EAAE,CAAC,CAAC;AACJ,EAAE,OAAO,QAAQ;AACjB;AACA,SAAS,UAAU,CAAC,MAAM,EAAE;AAC5B,EAAE,OAAO,MAAM,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE;AAClE;;;;"}
+{"version":3,"file":"bootHealth.server-DwPUi_JC.js","sources":["../../../.svelte-kit/adapter-node/chunks/bootHealth.server.js"],"sourcesContent":["import \"./context.js\";\nimport { p as providers, L as LocalComputeServerStore } from \"./providers.server.js\";\nlet cached = null;\nlet inflight = null;\nasync function run() {\n  let atRestSecrets = null;\n  const store = providers.data.computeServer;\n  if (store instanceof LocalComputeServerStore) {\n    try {\n      atRestSecrets = await store.verifySecrets();\n    } catch (err) {\n      console.error(\"[selva][boot] verifySecrets threw — treating as failure\", err);\n      atRestSecrets = {\n        ok: false,\n        plaintextFound: false,\n        failures: [\n          {\n            serverId: \"(unknown)\",\n            serverLabel: \"(unknown)\",\n            reason: \"key_mismatch\",\n            cause: err instanceof Error ? err.message : String(err)\n          }\n        ]\n      };\n    }\n  }\n  if (atRestSecrets && !atRestSecrets.ok) {\n    for (const f of atRestSecrets.failures) {\n      console.error(\n        `[selva][boot] compute server \"${f.serverLabel}\" (${f.serverId}): ${f.reason}${f.cause ? ` — ${f.cause}` : \"\"}`\n      );\n    }\n    console.error(\n      \"[selva][boot] At-rest secret verification failed. /api/health will return 503. Recover by re-entering the affected apiKeys via /admin/compute, or by restoring the original SELVA_AT_REST_KEY. See docs/Troubleshooting.md.\"\n    );\n  }\n  return {\n    checkedAt: (/* @__PURE__ */ new Date()).toISOString(),\n    atRestSecrets\n  };\n}\nfunction getBootHealth() {\n  if (cached) return Promise.resolve(cached);\n  if (inflight) return inflight;\n  inflight = run().then((result) => {\n    cached = result;\n    inflight = null;\n    return result;\n  });\n  return inflight;\n}\nfunction isDegraded(report) {\n  return report.atRestSecrets !== null && !report.atRestSecrets.ok;\n}\nexport {\n  getBootHealth as g,\n  isDegraded as i\n};\n"],"names":[],"mappings":";;;AAEA,IAAI,MAAM,GAAG,IAAI;AACjB,IAAI,QAAQ,GAAG,IAAI;AACnB,eAAe,GAAG,GAAG;AACrB,EAAE,IAAI,aAAa,GAAG,IAAI;AAC1B,EAAE,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa;AAC5C,EAAE,IAAI,KAAK,YAAY,uBAAuB,EAAE;AAChD,IAAI,IAAI;AACR,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;AACjD,IAAI,CAAC,CAAC,OAAO,GAAG,EAAE;AAClB,MAAM,OAAO,CAAC,KAAK,CAAC,yDAAyD,EAAE,GAAG,CAAC;AACnF,MAAM,aAAa,GAAG;AACtB,QAAQ,EAAE,EAAE,KAAK;AACjB,QAAQ,cAAc,EAAE,KAAK;AAC7B,QAAQ,QAAQ,EAAE;AAClB,UAAU;AACV,YAAY,QAAQ,EAAE,WAAW;AACjC,YAAY,WAAW,EAAE,WAAW;AACpC,YAAY,MAAM,EAAE,cAAc;AAClC,YAAY,KAAK,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG;AAClE;AACA;AACA,OAAO;AACP,IAAI;AACJ,EAAE;AACF,EAAE,IAAI,aAAa,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE;AAC1C,IAAI,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,QAAQ,EAAE;AAC5C,MAAM,OAAO,CAAC,KAAK;AACnB,QAAQ,CAAC,8BAA8B,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC;AACtH,OAAO;AACP,IAAI;AACJ,IAAI,OAAO,CAAC,KAAK;AACjB,MAAM;AACN,KAAK;AACL,EAAE;AACF,EAAE,OAAO;AACT,IAAI,SAAS,EAAE,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACzD,IAAI;AACJ,GAAG;AACH;AACA,SAAS,aAAa,GAAG;AACzB,EAAE,IAAI,MAAM,EAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;AAC5C,EAAE,IAAI,QAAQ,EAAE,OAAO,QAAQ;AAC/B,EAAE,QAAQ,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK;AACpC,IAAI,MAAM,GAAG,MAAM;AACnB,IAAI,QAAQ,GAAG,IAAI;AACnB,IAAI,OAAO,MAAM;AACjB,EAAE,CAAC,CAAC;AACJ,EAAE,OAAO,QAAQ;AACjB;AACA,SAAS,UAAU,CAAC,MAAM,EAAE;AAC5B,EAAE,OAAO,MAAM,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE;AAClE;;;;"}

package/build/server/chunks/{hooks.server-D5z2JKsD.js → hooks.server---blwhkE.js}

@@ -1,8 +1,8 @@
 import { redirect, isHttpError } from '@sveltejs/kit';
 import { S as SYSTEM_CONTEXT } from './context-9tV9WxQ5.js';
-import { p as providers } from './providers.server-Duyx-08B.js';
-import { g as getBootHealth } from './bootHealth.server-DQx_qsNh.js';
-import { w as wireHeaderAuthBootstrap, b as bootstrapUserSession } from './auth-bootstrap.server-dy8_QSAP.js';
+import { p as providers } from './providers.server-gJvnJT_K.js';
+import { g as getBootHealth } from './bootHealth.server-DwPUi_JC.js';
+import { w as wireHeaderAuthBootstrap, b as bootstrapUserSession } from './auth-bootstrap.server-YBvyz9i1.js';
 import { g as getRefreshToken, s as setSessionCookie, a as setRefreshCookie, c as clearRefreshCookie } from './admin-auth.server-CdTfBMI5.js';
 import 'zod';
 import './shared-server-DaWdgxVh.js';
@@ -195,4 +195,4 @@ const handleError = ({
 };
 
 export { handle, handleError, isPublicRoute, isStaticAsset };
-//# sourceMappingURL=hooks.server-D5z2JKsD.js.map
+//# sourceMappingURL=hooks.server---blwhkE.js.map

package/build/server/chunks/{hooks.server-D5z2JKsD.js.map → hooks.server---blwhkE.js.map}

@@ -1 +1 @@
-{"version":3,"file":"hooks.server-D5z2JKsD.js","sources":["../../../.svelte-kit/adapter-node/entries/hooks.server.js"],"sourcesContent":["import { redirect, isHttpError } from \"@sveltejs/kit\";\nimport { S as SYSTEM_CONTEXT } from \"../chunks/context.js\";\nimport { p as providers } from \"../chunks/providers.server.js\";\nimport { g as getBootHealth } from \"../chunks/bootHealth.server.js\";\nimport { w as wireHeaderAuthBootstrap, b as bootstrapUserSession } from \"../chunks/auth-bootstrap.server.js\";\nimport { g as getRefreshToken, s as setSessionCookie, a as setRefreshCookie, h as clearRefreshCookie } from \"../chunks/admin-auth.server.js\";\nfunction emptyProfile(userId) {\n  return { userId, starredDefinitions: [], recentRuns: [] };\n}\nlet headerAuthBootstrapWired = false;\nvoid getBootHealth();\nlet firstRunResolved = false;\nasync function isFirstRun() {\n  if (firstRunResolved) return false;\n  const usersPage = await providers.auth.listUsers({ limit: 1 });\n  if (usersPage === null) {\n    firstRunResolved = true;\n    return false;\n  }\n  if (usersPage.items.length === 0) return true;\n  firstRunResolved = true;\n  return false;\n}\nasync function buildContext(user, sessionToken) {\n  let actingOrgId;\n  let orgPermissions = [];\n  const platformPermissions = await providers.data.permissions.getFor(SYSTEM_CONTEXT, user.id);\n  const membership = await providers.data.orgs.findUserMembership(SYSTEM_CONTEXT, user.id);\n  if (membership) {\n    actingOrgId = membership.org.id;\n    orgPermissions = membership.member.permissions;\n  }\n  if (!actingOrgId && platformPermissions.includes(\"instance_admin\")) {\n    const firstOrgPage = await providers.data.orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 });\n    const firstOrg = firstOrgPage.items[0];\n    if (firstOrg) actingOrgId = firstOrg.id;\n  }\n  return {\n    userId: user.id,\n    actingOrgId,\n    platformPermissions,\n    orgPermissions,\n    adapterContext: sessionToken ? { sessionToken } : void 0\n  };\n}\nconst PUBLIC_PAGE_ROUTES = /* @__PURE__ */ new Set([\n  \"/\",\n  // landing — guests see it; authed users get redirected by +page.server.ts\n  \"/login\",\n  \"/setup\",\n  \"/accept-invite\"\n]);\nconst PUBLIC_PATH_PREFIXES = [\"/auth/\", \"/logout\"];\nconst PUBLIC_API_ROUTES = /* @__PURE__ */ new Set([\"/api/health\"]);\nconst STATIC_ASSET_PREFIXES = [\"/_app/\", \"/favicon/\"];\nconst STATIC_ASSET_PATHS = /* @__PURE__ */ new Set([\"/favicon.svg\", \"/robots.txt\"]);\nfunction isStaticAsset(pathname) {\n  if (STATIC_ASSET_PATHS.has(pathname)) return true;\n  return STATIC_ASSET_PREFIXES.some((p) => pathname.startsWith(p));\n}\nfunction isPublicRoute(pathname) {\n  if (PUBLIC_PAGE_ROUTES.has(pathname)) return true;\n  if (PUBLIC_API_ROUTES.has(pathname)) return true;\n  return PUBLIC_PATH_PREFIXES.some((p) => pathname.startsWith(p));\n}\nconst handle = async ({ event, resolve }) => {\n  event.locals.providers = providers;\n  if (!headerAuthBootstrapWired) {\n    wireHeaderAuthBootstrap();\n    headerAuthBootstrapWired = true;\n  }\n  const { pathname } = event.url;\n  if (isStaticAsset(pathname)) {\n    return applySecurityHeaders(await resolve(event), pathname);\n  }\n  if (pathname === \"/api/health\") {\n    return applySecurityHeaders(await resolve(event), pathname);\n  }\n  const publicRoute = isPublicRoute(pathname);\n  const isJsonApiRoute = pathname.startsWith(\"/api/\") || pathname.startsWith(\"/admin/api/\");\n  if (!publicRoute) {\n    if (await isFirstRun()) {\n      if (isJsonApiRoute) {\n        return applySecurityHeaders(\n          new Response(JSON.stringify({ error: \"Setup required\" }), {\n            status: 503,\n            headers: { \"Content-Type\": \"application/json\" }\n          }),\n          pathname\n        );\n      }\n      redirect(303, \"/setup\");\n    }\n  }\n  const needsAuth = !publicRoute;\n  if (needsAuth) {\n    let token = event.cookies.get(\"admin_session\") ?? \"\";\n    let user = await providers.auth.verifyToken(token);\n    if (!user) {\n      const refreshToken = getRefreshToken(event.cookies);\n      const oauth = providers.auth.oauth;\n      if (refreshToken && oauth) {\n        const refreshed = await oauth.refreshSession(refreshToken);\n        if (refreshed) {\n          setSessionCookie(event.cookies, refreshed.sessionToken);\n          setRefreshCookie(event.cookies, refreshed.refreshToken);\n          token = refreshed.sessionToken;\n          user = await providers.auth.verifyToken(token);\n        } else {\n          clearRefreshCookie(event.cookies);\n        }\n      }\n    }\n    if (!user && providers.auth.proxyAuth) {\n      user = await providers.auth.proxyAuth.identifyFromHeaders(event.request.headers);\n      if (user) await bootstrapUserSession(user);\n    }\n    if (!user) {\n      if (isJsonApiRoute) {\n        return applySecurityHeaders(\n          new Response(JSON.stringify({ error: \"Unauthorized\" }), {\n            status: 401,\n            headers: { \"Content-Type\": \"application/json\" }\n          }),\n          pathname\n        );\n      }\n      redirect(303, `/login?redirectTo=${encodeURIComponent(pathname)}`);\n    }\n    await providers.data.ensureUser(SYSTEM_CONTEXT, user.id);\n    event.locals.user = user;\n    event.locals.profile = await providers.data.userProfile.getProfile(SYSTEM_CONTEXT, user.id) ?? emptyProfile(user.id);\n    event.locals.ctx = await buildContext(user, token);\n  } else {\n    const isPublicPage = PUBLIC_PAGE_ROUTES.has(pathname);\n    const token = isPublicPage ? event.cookies.get(\"admin_session\") ?? \"\" : \"\";\n    let user = token ? await providers.auth.verifyToken(token) : null;\n    if (!user && isPublicPage && providers.auth.proxyAuth) {\n      user = await providers.auth.proxyAuth.identifyFromHeaders(event.request.headers);\n    }\n    if (user) {\n      await providers.data.ensureUser(SYSTEM_CONTEXT, user.id);\n      event.locals.user = user;\n      event.locals.profile = await providers.data.userProfile.getProfile(SYSTEM_CONTEXT, user.id) ?? emptyProfile(user.id);\n      event.locals.ctx = await buildContext(user, token);\n    }\n  }\n  return applySecurityHeaders(await resolve(event), pathname);\n};\nfunction applySecurityHeaders(response, pathname) {\n  response.headers.set(\"X-Content-Type-Options\", \"nosniff\");\n  response.headers.set(\"Referrer-Policy\", \"strict-origin-when-cross-origin\");\n  response.headers.set(\n    \"Permissions-Policy\",\n    \"accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()\"\n  );\n  if (process.env.NODE_ENV === \"production\") {\n    response.headers.set(\"Strict-Transport-Security\", \"max-age=31536000; includeSubDomains\");\n  }\n  if (pathname.startsWith(\"/_app/\")) {\n    response.headers.set(\"Cache-Control\", \"public, max-age=31536000, immutable\");\n  } else if (pathname.startsWith(\"/favicon/\") || pathname === \"/favicon.svg\" || pathname === \"/robots.txt\") {\n    response.headers.set(\"Cache-Control\", \"public, max-age=604800\");\n  }\n  return response;\n}\nconst handleError = ({\n  error,\n  status,\n  event\n}) => {\n  if (isHttpError(error)) {\n    return { message: error.body.message };\n  }\n  if (status === 404) {\n    return { message: \"Page not found.\" };\n  }\n  const cause = error instanceof Error && error.cause ? `\n  caused by: ${error.cause}` : \"\";\n  console.error(\n    `[Unhandled error] ${event.request.method} ${event.url.pathname}\n  ${error}${cause}`\n  );\n  return { message: \"An unexpected error occurred.\" };\n};\nexport {\n  handle,\n  handleError,\n  isPublicRoute,\n  isStaticAsset\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAMA,SAAS,YAAY,CAAC,MAAM,EAAE;AAC9B,EAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;AAC3D;AACA,IAAI,wBAAwB,GAAG,KAAK;AACpC,KAAK,aAAa,EAAE;AACpB,IAAI,gBAAgB,GAAG,KAAK;AAC5B,eAAe,UAAU,GAAG;AAC5B,EAAE,IAAI,gBAAgB,EAAE,OAAO,KAAK;AACpC,EAAE,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAChE,EAAE,IAAI,SAAS,KAAK,IAAI,EAAE;AAC1B,IAAI,gBAAgB,GAAG,IAAI;AAC3B,IAAI,OAAO,KAAK;AAChB,EAAE;AACF,EAAE,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,IAAI;AAC/C,EAAE,gBAAgB,GAAG,IAAI;AACzB,EAAE,OAAO,KAAK;AACd;AACA,eAAe,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE;AAChD,EAAE,IAAI,WAAW;AACjB,EAAE,IAAI,cAAc,GAAG,EAAE;AACzB,EAAE,MAAM,mBAAmB,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAC9F,EAAE,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAC1F,EAAE,IAAI,UAAU,EAAE;AAClB,IAAI,WAAW,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE;AACnC,IAAI,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW;AAClD,EAAE;AACF,EAAE,IAAI,CAAC,WAAW,IAAI,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE;AACtE,IAAI,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AACzF,IAAI,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1C,IAAI,IAAI,QAAQ,EAAE,WAAW,GAAG,QAAQ,CAAC,EAAE;AAC3C,EAAE;AACF,EAAE,OAAO;AACT,IAAI,MAAM,EAAE,IAAI,CAAC,EAAE;AACnB,IAAI,WAAW;AACf,IAAI,mBAAmB;AACvB,IAAI,cAAc;AAClB,IAAI,cAAc,EAAE,YAAY,GAAG,EAAE,YAAY,EAAE,GAAG;AACtD,GAAG;AACH;AACA,MAAM,kBAAkB,mBAAmB,IAAI,GAAG,CAAC;AACnD,EAAE,GAAG;AACL;AACA,EAAE,QAAQ;AACV,EAAE,QAAQ;AACV,EAAE;AACF,CAAC,CAAC;AACF,MAAM,oBAAoB,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC;AAClD,MAAM,iBAAiB,mBAAmB,IAAI,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC;AAClE,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC;AACrD,MAAM,kBAAkB,mBAAmB,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;AACnF,SAAS,aAAa,CAAC,QAAQ,EAAE;AACjC,EAAE,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI;AACnD,EAAE,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAClE;AACA,SAAS,aAAa,CAAC,QAAQ,EAAE;AACjC,EAAE,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI;AACnD,EAAE,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI;AAClD,EAAE,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AACjE;AACK,MAAC,MAAM,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;AAC7C,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,SAAS;AACpC,EAAE,IAAI,CAAC,wBAAwB,EAAE;AACjC,IAAI,uBAAuB,EAAE;AAC7B,IAAI,wBAAwB,GAAG,IAAI;AACnC,EAAE;AACF,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,GAAG;AAChC,EAAE,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE;AAC/B,IAAI,OAAO,oBAAoB,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;AAC/D,EAAE;AACF,EAAE,IAAI,QAAQ,KAAK,aAAa,EAAE;AAClC,IAAI,OAAO,oBAAoB,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;AAC/D,EAAE;AACF,EAAE,MAAM,WAAW,GAAG,aAAa,CAAC,QAAQ,CAAC;AAC7C,EAAE,MAAM,cAAc,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC;AAC3F,EAAE,IAAI,CAAC,WAAW,EAAE;AACpB,IAAI,IAAI,MAAM,UAAU,EAAE,EAAE;AAC5B,MAAM,IAAI,cAAc,EAAE;AAC1B,QAAQ,OAAO,oBAAoB;AACnC,UAAU,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,EAAE;AACpE,YAAY,MAAM,EAAE,GAAG;AACvB,YAAY,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AACzD,WAAW,CAAC;AACZ,UAAU;AACV,SAAS;AACT,MAAM;AACN,MAAM,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;AAC7B,IAAI;AACJ,EAAE;AACF,EAAE,MAAM,SAAS,GAAG,CAAC,WAAW;AAChC,EAAE,IAAI,SAAS,EAAE;AACjB,IAAI,IAAI,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE;AACxD,IAAI,IAAI,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;AACtD,IAAI,IAAI,CAAC,IAAI,EAAE;AACf,MAAM,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC;AACzD,MAAM,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK;AACxC,MAAM,IAAI,YAAY,IAAI,KAAK,EAAE;AACjC,QAAQ,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,YAAY,CAAC;AAClE,QAAQ,IAAI,SAAS,EAAE;AACvB,UAAU,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,CAAC;AACjE,UAAU,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,CAAC;AACjE,UAAU,KAAK,GAAG,SAAS,CAAC,YAAY;AACxC,UAAU,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;AACxD,QAAQ,CAAC,MAAM;AACf,UAAU,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC;AAC3C,QAAQ;AACR,MAAM;AACN,IAAI;AACJ,IAAI,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE;AAC3C,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;AACtF,MAAM,IAAI,IAAI,EAAE,MAAM,oBAAoB,CAAC,IAAI,CAAC;AAChD,IAAI;AACJ,IAAI,IAAI,CAAC,IAAI,EAAE;AACf,MAAM,IAAI,cAAc,EAAE;AAC1B,QAAQ,OAAO,oBAAoB;AACnC,UAAU,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EAAE;AAClE,YAAY,MAAM,EAAE,GAAG;AACvB,YAAY,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AACzD,WAAW,CAAC;AACZ,UAAU;AACV,SAAS;AACT,MAAM;AACN,MAAM,QAAQ,CAAC,GAAG,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACxE,IAAI;AACJ,IAAI,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAC5D,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI;AAC5B,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;AACxH,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC;AACtD,EAAE,CAAC,MAAM;AACT,IAAI,MAAM,YAAY,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC;AACzD,IAAI,MAAM,KAAK,GAAG,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,EAAE;AAC9E,IAAI,IAAI,IAAI,GAAG,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,IAAI;AACrE,IAAI,IAAI,CAAC,IAAI,IAAI,YAAY,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE;AAC3D,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;AACtF,IAAI;AACJ,IAAI,IAAI,IAAI,EAAE;AACd,MAAM,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAC9D,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI;AAC9B,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;AAC1H,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC;AACxD,IAAI;AACJ,EAAE;AACF,EAAE,OAAO,oBAAoB,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;AAC7D;AACA,SAAS,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE;AAClD,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC;AAC3D,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,iCAAiC,CAAC;AAC5E,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG;AACtB,IAAI,oBAAoB;AACxB,IAAI;AACJ,GAAG;AACH,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE;AAC7C,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,qCAAqC,CAAC;AAC5F,EAAE;AACF,EAAE,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE;AACrC,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,qCAAqC,CAAC;AAChF,EAAE,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,QAAQ,KAAK,cAAc,IAAI,QAAQ,KAAK,aAAa,EAAE;AAC5G,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,wBAAwB,CAAC;AACnE,EAAE;AACF,EAAE,OAAO,QAAQ;AACjB;AACK,MAAC,WAAW,GAAG,CAAC;AACrB,EAAE,KAAK;AACP,EAAE,MAAM;AACR,EAAE;AACF,CAAC,KAAK;AACN,EAAE,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE;AAC1B,IAAI,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE;AAC1C,EAAE;AACF,EAAE,IAAI,MAAM,KAAK,GAAG,EAAE;AACtB,IAAI,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE;AACzC,EAAE;AACF,EAAE,MAAM,KAAK,GAAG,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,KAAK,GAAG;AACxD,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE;AACjC,EAAE,OAAO,CAAC,KAAK;AACf,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ;AACnE,EAAE,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC;AAClB,GAAG;AACH,EAAE,OAAO,EAAE,OAAO,EAAE,+BAA+B,EAAE;AACrD;;;;"}
+{"version":3,"file":"hooks.server---blwhkE.js","sources":["../../../.svelte-kit/adapter-node/entries/hooks.server.js"],"sourcesContent":["import { redirect, isHttpError } from \"@sveltejs/kit\";\nimport { S as SYSTEM_CONTEXT } from \"../chunks/context.js\";\nimport { p as providers } from \"../chunks/providers.server.js\";\nimport { g as getBootHealth } from \"../chunks/bootHealth.server.js\";\nimport { w as wireHeaderAuthBootstrap, b as bootstrapUserSession } from \"../chunks/auth-bootstrap.server.js\";\nimport { g as getRefreshToken, s as setSessionCookie, a as setRefreshCookie, h as clearRefreshCookie } from \"../chunks/admin-auth.server.js\";\nfunction emptyProfile(userId) {\n  return { userId, starredDefinitions: [], recentRuns: [] };\n}\nlet headerAuthBootstrapWired = false;\nvoid getBootHealth();\nlet firstRunResolved = false;\nasync function isFirstRun() {\n  if (firstRunResolved) return false;\n  const usersPage = await providers.auth.listUsers({ limit: 1 });\n  if (usersPage === null) {\n    firstRunResolved = true;\n    return false;\n  }\n  if (usersPage.items.length === 0) return true;\n  firstRunResolved = true;\n  return false;\n}\nasync function buildContext(user, sessionToken) {\n  let actingOrgId;\n  let orgPermissions = [];\n  const platformPermissions = await providers.data.permissions.getFor(SYSTEM_CONTEXT, user.id);\n  const membership = await providers.data.orgs.findUserMembership(SYSTEM_CONTEXT, user.id);\n  if (membership) {\n    actingOrgId = membership.org.id;\n    orgPermissions = membership.member.permissions;\n  }\n  if (!actingOrgId && platformPermissions.includes(\"instance_admin\")) {\n    const firstOrgPage = await providers.data.orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 });\n    const firstOrg = firstOrgPage.items[0];\n    if (firstOrg) actingOrgId = firstOrg.id;\n  }\n  return {\n    userId: user.id,\n    actingOrgId,\n    platformPermissions,\n    orgPermissions,\n    adapterContext: sessionToken ? { sessionToken } : void 0\n  };\n}\nconst PUBLIC_PAGE_ROUTES = /* @__PURE__ */ new Set([\n  \"/\",\n  // landing — guests see it; authed users get redirected by +page.server.ts\n  \"/login\",\n  \"/setup\",\n  \"/accept-invite\"\n]);\nconst PUBLIC_PATH_PREFIXES = [\"/auth/\", \"/logout\"];\nconst PUBLIC_API_ROUTES = /* @__PURE__ */ new Set([\"/api/health\"]);\nconst STATIC_ASSET_PREFIXES = [\"/_app/\", \"/favicon/\"];\nconst STATIC_ASSET_PATHS = /* @__PURE__ */ new Set([\"/favicon.svg\", \"/robots.txt\"]);\nfunction isStaticAsset(pathname) {\n  if (STATIC_ASSET_PATHS.has(pathname)) return true;\n  return STATIC_ASSET_PREFIXES.some((p) => pathname.startsWith(p));\n}\nfunction isPublicRoute(pathname) {\n  if (PUBLIC_PAGE_ROUTES.has(pathname)) return true;\n  if (PUBLIC_API_ROUTES.has(pathname)) return true;\n  return PUBLIC_PATH_PREFIXES.some((p) => pathname.startsWith(p));\n}\nconst handle = async ({ event, resolve }) => {\n  event.locals.providers = providers;\n  if (!headerAuthBootstrapWired) {\n    wireHeaderAuthBootstrap();\n    headerAuthBootstrapWired = true;\n  }\n  const { pathname } = event.url;\n  if (isStaticAsset(pathname)) {\n    return applySecurityHeaders(await resolve(event), pathname);\n  }\n  if (pathname === \"/api/health\") {\n    return applySecurityHeaders(await resolve(event), pathname);\n  }\n  const publicRoute = isPublicRoute(pathname);\n  const isJsonApiRoute = pathname.startsWith(\"/api/\") || pathname.startsWith(\"/admin/api/\");\n  if (!publicRoute) {\n    if (await isFirstRun()) {\n      if (isJsonApiRoute) {\n        return applySecurityHeaders(\n          new Response(JSON.stringify({ error: \"Setup required\" }), {\n            status: 503,\n            headers: { \"Content-Type\": \"application/json\" }\n          }),\n          pathname\n        );\n      }\n      redirect(303, \"/setup\");\n    }\n  }\n  const needsAuth = !publicRoute;\n  if (needsAuth) {\n    let token = event.cookies.get(\"admin_session\") ?? \"\";\n    let user = await providers.auth.verifyToken(token);\n    if (!user) {\n      const refreshToken = getRefreshToken(event.cookies);\n      const oauth = providers.auth.oauth;\n      if (refreshToken && oauth) {\n        const refreshed = await oauth.refreshSession(refreshToken);\n        if (refreshed) {\n          setSessionCookie(event.cookies, refreshed.sessionToken);\n          setRefreshCookie(event.cookies, refreshed.refreshToken);\n          token = refreshed.sessionToken;\n          user = await providers.auth.verifyToken(token);\n        } else {\n          clearRefreshCookie(event.cookies);\n        }\n      }\n    }\n    if (!user && providers.auth.proxyAuth) {\n      user = await providers.auth.proxyAuth.identifyFromHeaders(event.request.headers);\n      if (user) await bootstrapUserSession(user);\n    }\n    if (!user) {\n      if (isJsonApiRoute) {\n        return applySecurityHeaders(\n          new Response(JSON.stringify({ error: \"Unauthorized\" }), {\n            status: 401,\n            headers: { \"Content-Type\": \"application/json\" }\n          }),\n          pathname\n        );\n      }\n      redirect(303, `/login?redirectTo=${encodeURIComponent(pathname)}`);\n    }\n    await providers.data.ensureUser(SYSTEM_CONTEXT, user.id);\n    event.locals.user = user;\n    event.locals.profile = await providers.data.userProfile.getProfile(SYSTEM_CONTEXT, user.id) ?? emptyProfile(user.id);\n    event.locals.ctx = await buildContext(user, token);\n  } else {\n    const isPublicPage = PUBLIC_PAGE_ROUTES.has(pathname);\n    const token = isPublicPage ? event.cookies.get(\"admin_session\") ?? \"\" : \"\";\n    let user = token ? await providers.auth.verifyToken(token) : null;\n    if (!user && isPublicPage && providers.auth.proxyAuth) {\n      user = await providers.auth.proxyAuth.identifyFromHeaders(event.request.headers);\n    }\n    if (user) {\n      await providers.data.ensureUser(SYSTEM_CONTEXT, user.id);\n      event.locals.user = user;\n      event.locals.profile = await providers.data.userProfile.getProfile(SYSTEM_CONTEXT, user.id) ?? emptyProfile(user.id);\n      event.locals.ctx = await buildContext(user, token);\n    }\n  }\n  return applySecurityHeaders(await resolve(event), pathname);\n};\nfunction applySecurityHeaders(response, pathname) {\n  response.headers.set(\"X-Content-Type-Options\", \"nosniff\");\n  response.headers.set(\"Referrer-Policy\", \"strict-origin-when-cross-origin\");\n  response.headers.set(\n    \"Permissions-Policy\",\n    \"accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()\"\n  );\n  if (process.env.NODE_ENV === \"production\") {\n    response.headers.set(\"Strict-Transport-Security\", \"max-age=31536000; includeSubDomains\");\n  }\n  if (pathname.startsWith(\"/_app/\")) {\n    response.headers.set(\"Cache-Control\", \"public, max-age=31536000, immutable\");\n  } else if (pathname.startsWith(\"/favicon/\") || pathname === \"/favicon.svg\" || pathname === \"/robots.txt\") {\n    response.headers.set(\"Cache-Control\", \"public, max-age=604800\");\n  }\n  return response;\n}\nconst handleError = ({\n  error,\n  status,\n  event\n}) => {\n  if (isHttpError(error)) {\n    return { message: error.body.message };\n  }\n  if (status === 404) {\n    return { message: \"Page not found.\" };\n  }\n  const cause = error instanceof Error && error.cause ? `\n  caused by: ${error.cause}` : \"\";\n  console.error(\n    `[Unhandled error] ${event.request.method} ${event.url.pathname}\n  ${error}${cause}`\n  );\n  return { message: \"An unexpected error occurred.\" };\n};\nexport {\n  handle,\n  handleError,\n  isPublicRoute,\n  isStaticAsset\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAMA,SAAS,YAAY,CAAC,MAAM,EAAE;AAC9B,EAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;AAC3D;AACA,IAAI,wBAAwB,GAAG,KAAK;AACpC,KAAK,aAAa,EAAE;AACpB,IAAI,gBAAgB,GAAG,KAAK;AAC5B,eAAe,UAAU,GAAG;AAC5B,EAAE,IAAI,gBAAgB,EAAE,OAAO,KAAK;AACpC,EAAE,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAChE,EAAE,IAAI,SAAS,KAAK,IAAI,EAAE;AAC1B,IAAI,gBAAgB,GAAG,IAAI;AAC3B,IAAI,OAAO,KAAK;AAChB,EAAE;AACF,EAAE,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,IAAI;AAC/C,EAAE,gBAAgB,GAAG,IAAI;AACzB,EAAE,OAAO,KAAK;AACd;AACA,eAAe,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE;AAChD,EAAE,IAAI,WAAW;AACjB,EAAE,IAAI,cAAc,GAAG,EAAE;AACzB,EAAE,MAAM,mBAAmB,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAC9F,EAAE,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAC1F,EAAE,IAAI,UAAU,EAAE;AAClB,IAAI,WAAW,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE;AACnC,IAAI,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW;AAClD,EAAE;AACF,EAAE,IAAI,CAAC,WAAW,IAAI,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE;AACtE,IAAI,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AACzF,IAAI,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1C,IAAI,IAAI,QAAQ,EAAE,WAAW,GAAG,QAAQ,CAAC,EAAE;AAC3C,EAAE;AACF,EAAE,OAAO;AACT,IAAI,MAAM,EAAE,IAAI,CAAC,EAAE;AACnB,IAAI,WAAW;AACf,IAAI,mBAAmB;AACvB,IAAI,cAAc;AAClB,IAAI,cAAc,EAAE,YAAY,GAAG,EAAE,YAAY,EAAE,GAAG;AACtD,GAAG;AACH;AACA,MAAM,kBAAkB,mBAAmB,IAAI,GAAG,CAAC;AACnD,EAAE,GAAG;AACL;AACA,EAAE,QAAQ;AACV,EAAE,QAAQ;AACV,EAAE;AACF,CAAC,CAAC;AACF,MAAM,oBAAoB,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC;AAClD,MAAM,iBAAiB,mBAAmB,IAAI,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC;AAClE,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC;AACrD,MAAM,kBAAkB,mBAAmB,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;AACnF,SAAS,aAAa,CAAC,QAAQ,EAAE;AACjC,EAAE,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI;AACnD,EAAE,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAClE;AACA,SAAS,aAAa,CAAC,QAAQ,EAAE;AACjC,EAAE,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI;AACnD,EAAE,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI;AAClD,EAAE,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AACjE;AACK,MAAC,MAAM,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;AAC7C,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,SAAS;AACpC,EAAE,IAAI,CAAC,wBAAwB,EAAE;AACjC,IAAI,uBAAuB,EAAE;AAC7B,IAAI,wBAAwB,GAAG,IAAI;AACnC,EAAE;AACF,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,GAAG;AAChC,EAAE,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE;AAC/B,IAAI,OAAO,oBAAoB,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;AAC/D,EAAE;AACF,EAAE,IAAI,QAAQ,KAAK,aAAa,EAAE;AAClC,IAAI,OAAO,oBAAoB,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;AAC/D,EAAE;AACF,EAAE,MAAM,WAAW,GAAG,aAAa,CAAC,QAAQ,CAAC;AAC7C,EAAE,MAAM,cAAc,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC;AAC3F,EAAE,IAAI,CAAC,WAAW,EAAE;AACpB,IAAI,IAAI,MAAM,UAAU,EAAE,EAAE;AAC5B,MAAM,IAAI,cAAc,EAAE;AAC1B,QAAQ,OAAO,oBAAoB;AACnC,UAAU,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,EAAE;AACpE,YAAY,MAAM,EAAE,GAAG;AACvB,YAAY,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AACzD,WAAW,CAAC;AACZ,UAAU;AACV,SAAS;AACT,MAAM;AACN,MAAM,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;AAC7B,IAAI;AACJ,EAAE;AACF,EAAE,MAAM,SAAS,GAAG,CAAC,WAAW;AAChC,EAAE,IAAI,SAAS,EAAE;AACjB,IAAI,IAAI,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE;AACxD,IAAI,IAAI,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;AACtD,IAAI,IAAI,CAAC,IAAI,EAAE;AACf,MAAM,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC;AACzD,MAAM,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK;AACxC,MAAM,IAAI,YAAY,IAAI,KAAK,EAAE;AACjC,QAAQ,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,YAAY,CAAC;AAClE,QAAQ,IAAI,SAAS,EAAE;AACvB,UAAU,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,CAAC;AACjE,UAAU,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,CAAC;AACjE,UAAU,KAAK,GAAG,SAAS,CAAC,YAAY;AACxC,UAAU,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;AACxD,QAAQ,CAAC,MAAM;AACf,UAAU,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC;AAC3C,QAAQ;AACR,MAAM;AACN,IAAI;AACJ,IAAI,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE;AAC3C,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;AACtF,MAAM,IAAI,IAAI,EAAE,MAAM,oBAAoB,CAAC,IAAI,CAAC;AAChD,IAAI;AACJ,IAAI,IAAI,CAAC,IAAI,EAAE;AACf,MAAM,IAAI,cAAc,EAAE;AAC1B,QAAQ,OAAO,oBAAoB;AACnC,UAAU,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EAAE;AAClE,YAAY,MAAM,EAAE,GAAG;AACvB,YAAY,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AACzD,WAAW,CAAC;AACZ,UAAU;AACV,SAAS;AACT,MAAM;AACN,MAAM,QAAQ,CAAC,GAAG,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACxE,IAAI;AACJ,IAAI,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAC5D,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI;AAC5B,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;AACxH,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC;AACtD,EAAE,CAAC,MAAM;AACT,IAAI,MAAM,YAAY,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC;AACzD,IAAI,MAAM,KAAK,GAAG,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,EAAE;AAC9E,IAAI,IAAI,IAAI,GAAG,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,IAAI;AACrE,IAAI,IAAI,CAAC,IAAI,IAAI,YAAY,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE;AAC3D,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;AACtF,IAAI;AACJ,IAAI,IAAI,IAAI,EAAE;AACd,MAAM,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAC9D,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI;AAC9B,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;AAC1H,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC;AACxD,IAAI;AACJ,EAAE;AACF,EAAE,OAAO,oBAAoB,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;AAC7D;AACA,SAAS,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE;AAClD,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC;AAC3D,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,iCAAiC,CAAC;AAC5E,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG;AACtB,IAAI,oBAAoB;AACxB,IAAI;AACJ,GAAG;AACH,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE;AAC7C,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,qCAAqC,CAAC;AAC5F,EAAE;AACF,EAAE,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE;AACrC,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,qCAAqC,CAAC;AAChF,EAAE,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,QAAQ,KAAK,cAAc,IAAI,QAAQ,KAAK,aAAa,EAAE;AAC5G,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,wBAAwB,CAAC;AACnE,EAAE;AACF,EAAE,OAAO,QAAQ;AACjB;AACK,MAAC,WAAW,GAAG,CAAC;AACrB,EAAE,KAAK;AACP,EAAE,MAAM;AACR,EAAE;AACF,CAAC,KAAK;AACN,EAAE,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE;AAC1B,IAAI,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE;AAC1C,EAAE;AACF,EAAE,IAAI,MAAM,KAAK,GAAG,EAAE;AACtB,IAAI,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE;AACzC,EAAE;AACF,EAAE,MAAM,KAAK,GAAG,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,KAAK,GAAG;AACxD,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE;AACjC,EAAE,OAAO,CAAC,KAAK;AACf,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ;AACnE,EAAE,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC;AAClB,GAAG;AACH,EAAE,OAAO,EAAE,OAAO,EAAE,+BAA+B,EAAE;AACrD;;;;"}

package/build/server/chunks/{permissions.server-qrbshNHz.js → permissions.server-toUY36oB.js}

@@ -1,8 +1,8 @@
-import { l as getPermissionStore } from './providers.server-Duyx-08B.js';
+import { l as getPermissionStore } from './providers.server-gJvnJT_K.js';
 
 async function setUserPlatformPermissions(ctx, userId, permissions) {
   return getPermissionStore().set(ctx, userId, permissions);
 }
 
 export { setUserPlatformPermissions as s };
-//# sourceMappingURL=permissions.server-qrbshNHz.js.map
+//# sourceMappingURL=permissions.server-toUY36oB.js.map

package/build/server/chunks/{permissions.server-qrbshNHz.js.map → permissions.server-toUY36oB.js.map}

@@ -1 +1 @@
-{"version":3,"file":"permissions.server-qrbshNHz.js","sources":["../../../.svelte-kit/adapter-node/chunks/permissions.server.js"],"sourcesContent":["import { f as getPermissionStore } from \"./providers.server.js\";\nasync function setUserPlatformPermissions(ctx, userId, permissions) {\n  return getPermissionStore().set(ctx, userId, permissions);\n}\nexport {\n  setUserPlatformPermissions as s\n};\n"],"names":[],"mappings":";;AACA,eAAe,0BAA0B,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE;AACpE,EAAE,OAAO,kBAAkB,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC;AAC3D;;;;"}
+{"version":3,"file":"permissions.server-toUY36oB.js","sources":["../../../.svelte-kit/adapter-node/chunks/permissions.server.js"],"sourcesContent":["import { h as getPermissionStore } from \"./providers.server.js\";\nasync function setUserPlatformPermissions(ctx, userId, permissions) {\n  return getPermissionStore().set(ctx, userId, permissions);\n}\nexport {\n  setUserPlatformPermissions as s\n};\n"],"names":[],"mappings":";;AACA,eAAe,0BAA0B,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE;AACpE,EAAE,OAAO,kBAAkB,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC;AAC3D;;;;"}

package/build/server/chunks/{providers.server-Duyx-08B.js → providers.server-gJvnJT_K.js}

@@ -4399,6 +4399,7 @@ const defaultConfig = defineConfig((e) => ({
     ALLOW_CROSS_ORG_PUBLIC: envBool(e, "SELVA_FLAG_ALLOW_CROSS_ORG_PUBLIC"),
     ALLOW_ORG_COMPUTE_OVERRIDE: envBool(e, "SELVA_FLAG_ALLOW_ORG_COMPUTE_OVERRIDE"),
     ALLOW_ORG_CREATION: envBool(e, "SELVA_FLAG_ALLOW_ORG_CREATION"),
+    ENABLE_PLATFORM_PROJECTS: envBool(e, "SELVA_FLAG_ENABLE_PLATFORM_PROJECTS"),
     ENABLE_SHARING: envBool(e, "SELVA_FLAG_ENABLE_SHARING")
   },
   branding: {
@@ -4483,4 +4484,4 @@ function getAuditQuery() {
 }
 
 export { LocalComputeServerStore as L, MAX_PAGE_LIMIT as M, ProviderError as P, getAuditQuery as a, branding as b, getOrganizationProvider as c, getInviteStore as d, getUserProfileStore as e, flag as f, getAuthProvider as g, getProjectProvider as h, getDefinitionMeta as i, getComputeServerConfigStore as j, getPlatformProjectGrantStore as k, getPermissionStore as l, getStorageProvider as m, getDataProvider as n, isOrgServer as o, providers as p, isPlatformServer as q, definitionService as r, definitionPaths as s, tenancy as t };
-//# sourceMappingURL=providers.server-Duyx-08B.js.map
+//# sourceMappingURL=providers.server-gJvnJT_K.js.map