@selvajs/selva 4.10.0 → 4.11.0

package/build/server/chunks/entries/endpoints/api/admin/users/_id_/_server.ts.js-OMEo3u0h.js

@@ -0,0 +1,54 @@
+import { S as SYSTEM_CONTEXT, h as hasPermission, d as PlatformPermissionSchema } from '../../../../../../chunks/src.js-C6yJg0vh.js';
+import { b as getPermissionStore, a as getAuthProvider, d as getDataProvider } from '../../../../../../chunks/providers.server.js-DqaQtsNQ.js';
+import { j as requireManageInstanceUsers } from '../../../../../../chunks/access.server.js-C4HiC_D0.js';
+import { a as apiError, t as throwZodError, A as ApiErrorCode } from '../../../../../../chunks/api-errors.js-CWRxx1wB.js';
+import { s as setUserPlatformPermissions } from '../../../../../../chunks/permissions.server.js-DQ6eQqYN.js';
+import { z } from 'zod';
+import '../../../../../../chunks/shared-server.js-D2MyEK0i.js';
+import '../../../../../../chunks/limits.js-B7msNaG3.js';
+import '../../../../../../chunks/schema.js-BeFDxIuz.js';
+import '../../../../../../chunks/core-BQtRL5GE.js-iCpLjXCp.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '@sveltejs/kit';
+import '../../../../../../chunks/utils2.js-DKBV7VcI.js';
+
+//#region src/routes/api/admin/users/[id]/+server.ts
+var UpdatePermissionsBody = z.object({ permissions: z.array(PlatformPermissionSchema) });
+var PATCH = async ({ params, request, locals }) => {
+	requireManageInstanceUsers(locals);
+	const { id } = params;
+	if (!id) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Missing user ID");
+	const body = await request.json().catch(() => null);
+	const parsed = UpdatePermissionsBody.safeParse(body);
+	if (!parsed.success) throwZodError(parsed.error);
+	const platform = parsed.data.permissions;
+	const existingPlatform = await getPermissionStore().getFor(locals.ctx, id);
+	if ((platform.length !== existingPlatform.length || platform.some((p) => !existingPlatform.includes(p)) || existingPlatform.some((p) => !platform.includes(p))) && !hasPermission(locals.ctx, "instance_admin")) apiError(403, ApiErrorCode.FORBIDDEN, "Only a platform admin can change platform-scope permissions");
+	const platformResult = await setUserPlatformPermissions(locals.ctx, id, platform);
+	if (platformResult === "not_found") apiError(404, ApiErrorCode.NOT_FOUND, "User not found");
+	if (platformResult === "not_supported") apiError(501, ApiErrorCode.INTERNAL, "Platform permission updates not supported by this auth provider");
+	if (platformResult === "last_admin") apiError(409, ApiErrorCode.CONFLICT, "Cannot remove the last instance admin. Promote another user to instance admin first.");
+	return new Response(null, { status: 204 });
+};
+var DELETE = async ({ params, locals }) => {
+	requireManageInstanceUsers(locals);
+	const { id } = params;
+	if (!id) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Missing user ID");
+	if ((await getPermissionStore().getFor(locals.ctx, id)).includes("instance_admin")) {
+		if (await getPermissionStore().countInstanceAdminsExcluding(locals.ctx, id) === 0) apiError(409, ApiErrorCode.CONFLICT, "Cannot delete the last instance admin. Promote another user to instance admin first.");
+	}
+	const email = (await getAuthProvider().getUser(id))?.email;
+	const result = await getAuthProvider().deleteUser(id);
+	if (result === "not_found") apiError(404, ApiErrorCode.NOT_FOUND, "User not found");
+	if (result === "not_supported") apiError(501, ApiErrorCode.INTERNAL, "User deletion not supported by this auth provider");
+	await getDataProvider().onUserDeleted(SYSTEM_CONTEXT, id, { email });
+	return new Response(null, { status: 204 });
+};
+
+export { DELETE, PATCH };
+//# sourceMappingURL=_server.ts.js-OMEo3u0h.js.map

package/build/server/chunks/entries/endpoints/api/admin/users/_id_/_server.ts.js-OMEo3u0h.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-OMEo3u0h.js","sources":["../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/admin/users/_id_/_server.ts.js"],"sourcesContent":["import { D as PlatformPermissionSchema, n as hasPermission, t as SYSTEM_CONTEXT } from \"../../../../../../chunks/src.js\";\nimport { h as getPermissionStore, o as getDataProvider, r as getAuthProvider } from \"../../../../../../chunks/providers.server.js\";\nimport { b as requireManageInstanceUsers } from \"../../../../../../chunks/access.server.js\";\nimport { i as throwZodError, n as apiError, t as ApiErrorCode } from \"../../../../../../chunks/api-errors.js\";\nimport \"../../../../../../chunks/auth.server.js\";\nimport { t as setUserPlatformPermissions } from \"../../../../../../chunks/permissions.server.js\";\nimport { z } from \"zod\";\n//#region src/routes/api/admin/users/[id]/+server.ts\nvar UpdatePermissionsBody = z.object({ permissions: z.array(PlatformPermissionSchema) });\nvar PATCH = async ({ params, request, locals }) => {\n\trequireManageInstanceUsers(locals);\n\tconst { id } = params;\n\tif (!id) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing user ID\");\n\tconst body = await request.json().catch(() => null);\n\tconst parsed = UpdatePermissionsBody.safeParse(body);\n\tif (!parsed.success) throwZodError(parsed.error);\n\tconst platform = parsed.data.permissions;\n\tconst existingPlatform = await getPermissionStore().getFor(locals.ctx, id);\n\tif ((platform.length !== existingPlatform.length || platform.some((p) => !existingPlatform.includes(p)) || existingPlatform.some((p) => !platform.includes(p))) && !hasPermission(locals.ctx, \"instance_admin\")) apiError(403, ApiErrorCode.FORBIDDEN, \"Only a platform admin can change platform-scope permissions\");\n\tconst platformResult = await setUserPlatformPermissions(locals.ctx, id, platform);\n\tif (platformResult === \"not_found\") apiError(404, ApiErrorCode.NOT_FOUND, \"User not found\");\n\tif (platformResult === \"not_supported\") apiError(501, ApiErrorCode.INTERNAL, \"Platform permission updates not supported by this auth provider\");\n\tif (platformResult === \"last_admin\") apiError(409, ApiErrorCode.CONFLICT, \"Cannot remove the last instance admin. Promote another user to instance admin first.\");\n\treturn new Response(null, { status: 204 });\n};\nvar DELETE = async ({ params, locals }) => {\n\trequireManageInstanceUsers(locals);\n\tconst { id } = params;\n\tif (!id) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing user ID\");\n\tif ((await getPermissionStore().getFor(locals.ctx, id)).includes(\"instance_admin\")) {\n\t\tif (await getPermissionStore().countInstanceAdminsExcluding(locals.ctx, id) === 0) apiError(409, ApiErrorCode.CONFLICT, \"Cannot delete the last instance admin. Promote another user to instance admin first.\");\n\t}\n\tconst email = (await getAuthProvider().getUser(id))?.email;\n\tconst result = await getAuthProvider().deleteUser(id);\n\tif (result === \"not_found\") apiError(404, ApiErrorCode.NOT_FOUND, \"User not found\");\n\tif (result === \"not_supported\") apiError(501, ApiErrorCode.INTERNAL, \"User deletion not supported by this auth provider\");\n\tawait getDataProvider().onUserDeleted(SYSTEM_CONTEXT, id, { email });\n\treturn new Response(null, { status: 204 });\n};\n//#endregion\nexport { DELETE, PATCH };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAOA;AACA,IAAI,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,CAAC;AACrF,IAAC,KAAK,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AACnD,CAAC,0BAA0B,CAAC,MAAM,CAAC;AACnC,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM;AACtB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;AAC1E,CAAC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;AACpD,CAAC,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC;AACrD,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AACjD,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW;AACzC,CAAC,MAAM,gBAAgB,GAAG,MAAM,kBAAkB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC;AAC3E,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,6DAA6D,CAAC;AACtT,CAAC,MAAM,cAAc,GAAG,MAAM,0BAA0B,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,QAAQ,CAAC;AAClF,CAAC,IAAI,cAAc,KAAK,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gBAAgB,CAAC;AAC5F,CAAC,IAAI,cAAc,KAAK,eAAe,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,iEAAiE,CAAC;AAChJ,CAAC,IAAI,cAAc,KAAK,YAAY,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,sFAAsF,CAAC;AAClK,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC3C;AACG,IAAC,MAAM,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AAC3C,CAAC,0BAA0B,CAAC,MAAM,CAAC;AACnC,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM;AACtB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;AAC1E,CAAC,IAAI,CAAC,MAAM,kBAAkB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE;AACrF,EAAE,IAAI,MAAM,kBAAkB,EAAE,CAAC,4BAA4B,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,sFAAsF,CAAC;AACjN,CAAC;AACD,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,eAAe,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,KAAK;AAC3D,CAAC,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;AACtD,CAAC,IAAI,MAAM,KAAK,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gBAAgB,CAAC;AACpF,CAAC,IAAI,MAAM,KAAK,eAAe,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,mDAAmD,CAAC;AAC1H,CAAC,MAAM,eAAe,EAAE,CAAC,aAAa,CAAC,cAAc,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;AACrE,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC3C;;;;"}

package/build/server/chunks/entries/endpoints/api/admin/users/_id_/disable/_server.ts.js-DmdlqJcO.js

@@ -0,0 +1,46 @@
+import { b as getPermissionStore, a as getAuthProvider } from '../../../../../../../chunks/providers.server.js-DqaQtsNQ.js';
+import { j as requireManageInstanceUsers } from '../../../../../../../chunks/access.server.js-C4HiC_D0.js';
+import { a as apiError, A as ApiErrorCode } from '../../../../../../../chunks/api-errors.js-CWRxx1wB.js';
+import '../../../../../../../chunks/shared-server.js-D2MyEK0i.js';
+import '../../../../../../../chunks/src.js-C6yJg0vh.js';
+import 'zod';
+import '../../../../../../../chunks/limits.js-B7msNaG3.js';
+import '../../../../../../../chunks/schema.js-BeFDxIuz.js';
+import '../../../../../../../chunks/core-BQtRL5GE.js-iCpLjXCp.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '@sveltejs/kit';
+import '../../../../../../../chunks/utils2.js-DKBV7VcI.js';
+
+//#region src/routes/api/admin/users/[id]/disable/+server.ts
+/**
+* POST /api/admin/users/[id]/disable
+*
+* Permissions.md §10 — disabling a user invalidates sessions while preserving
+* identity and attribution. The §2 sole-`instance_admin` invariant is
+* enforced here BEFORE the auth provider disables, by consulting
+* `IPlatformPermissionStore.countInstanceAdminsExcluding`. Auth providers no
+* longer own Selva-specific authorization.
+*
+* No matching enable endpoint today — the auth interface is one-way for v1.
+* Re-enable lands when the spec defines an explicit re-onboarding flow.
+*/
+var POST = async ({ params, locals }) => {
+	requireManageInstanceUsers(locals);
+	const { id } = params;
+	if (!id) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Missing user ID");
+	if ((await getPermissionStore().getFor(locals.ctx, id)).includes("instance_admin")) {
+		if (await getPermissionStore().countInstanceAdminsExcluding(locals.ctx, id) === 0) apiError(409, ApiErrorCode.CONFLICT, "Cannot disable the last instance admin. Promote another user to instance admin first.");
+	}
+	const result = await getAuthProvider().disableUser(id);
+	if (result === "not_found") apiError(404, ApiErrorCode.NOT_FOUND, "User not found");
+	if (result === "not_supported") apiError(501, ApiErrorCode.INTERNAL, "Disabling users is not supported by this auth provider");
+	return new Response(null, { status: 204 });
+};
+
+export { POST };
+//# sourceMappingURL=_server.ts.js-DmdlqJcO.js.map

package/build/server/chunks/entries/endpoints/api/admin/users/_id_/disable/_server.ts.js-DmdlqJcO.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-DmdlqJcO.js","sources":["../../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/admin/users/_id_/disable/_server.ts.js"],"sourcesContent":["import { h as getPermissionStore, r as getAuthProvider } from \"../../../../../../../chunks/providers.server.js\";\nimport { b as requireManageInstanceUsers } from \"../../../../../../../chunks/access.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../../../chunks/api-errors.js\";\nimport \"../../../../../../../chunks/auth.server.js\";\n//#region src/routes/api/admin/users/[id]/disable/+server.ts\n/**\n* POST /api/admin/users/[id]/disable\n*\n* Permissions.md §10 — disabling a user invalidates sessions while preserving\n* identity and attribution. The §2 sole-`instance_admin` invariant is\n* enforced here BEFORE the auth provider disables, by consulting\n* `IPlatformPermissionStore.countInstanceAdminsExcluding`. Auth providers no\n* longer own Selva-specific authorization.\n*\n* No matching enable endpoint today — the auth interface is one-way for v1.\n* Re-enable lands when the spec defines an explicit re-onboarding flow.\n*/\nvar POST = async ({ params, locals }) => {\n\trequireManageInstanceUsers(locals);\n\tconst { id } = params;\n\tif (!id) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing user ID\");\n\tif ((await getPermissionStore().getFor(locals.ctx, id)).includes(\"instance_admin\")) {\n\t\tif (await getPermissionStore().countInstanceAdminsExcluding(locals.ctx, id) === 0) apiError(409, ApiErrorCode.CONFLICT, \"Cannot disable the last instance admin. Promote another user to instance admin first.\");\n\t}\n\tconst result = await getAuthProvider().disableUser(id);\n\tif (result === \"not_found\") apiError(404, ApiErrorCode.NOT_FOUND, \"User not found\");\n\tif (result === \"not_supported\") apiError(501, ApiErrorCode.INTERNAL, \"Disabling users is not supported by this auth provider\");\n\treturn new Response(null, { status: 204 });\n};\n//#endregion\nexport { POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,IAAI,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AACzC,CAAC,0BAA0B,CAAC,MAAM,CAAC;AACnC,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM;AACtB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;AAC1E,CAAC,IAAI,CAAC,MAAM,kBAAkB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE;AACrF,EAAE,IAAI,MAAM,kBAAkB,EAAE,CAAC,4BAA4B,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,uFAAuF,CAAC;AAClN,CAAC;AACD,CAAC,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;AACvD,CAAC,IAAI,MAAM,KAAK,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gBAAgB,CAAC;AACpF,CAAC,IAAI,MAAM,KAAK,eAAe,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,wDAAwD,CAAC;AAC/H,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC3C;;;;"}

package/build/server/chunks/entries/endpoints/api/admin/users/_server.ts.js-QXOvmnPk.js

@@ -0,0 +1,81 @@
+import { h as hasPermission, S as SYSTEM_CONTEXT, d as PlatformPermissionSchema } from '../../../../../chunks/src.js-C6yJg0vh.js';
+import { a as getAuthProvider, e as getOrganizationProvider, b as getPermissionStore } from '../../../../../chunks/providers.server.js-DqaQtsNQ.js';
+import { j as requireManageInstanceUsers } from '../../../../../chunks/access.server.js-C4HiC_D0.js';
+import { a as apiError, t as throwZodError, A as ApiErrorCode, h as handleApiError } from '../../../../../chunks/api-errors.js-CWRxx1wB.js';
+import { l as listAllOrgMembers } from '../../../../../chunks/org-members.server.js-CbmlBRa0.js';
+import { s as setUserPlatformPermissions } from '../../../../../chunks/permissions.server.js-DQ6eQqYN.js';
+import { json } from '@sveltejs/kit';
+import { z } from 'zod';
+import '../../../../../chunks/shared-server.js-D2MyEK0i.js';
+import '../../../../../chunks/limits.js-B7msNaG3.js';
+import '../../../../../chunks/schema.js-BeFDxIuz.js';
+import '../../../../../chunks/core-BQtRL5GE.js-iCpLjXCp.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '../../../../../chunks/utils2.js-DKBV7VcI.js';
+
+//#region src/routes/api/admin/users/+server.ts
+var CreateUserBody = z.object({
+	email: z.string().email("Valid email is required"),
+	permissions: z.array(PlatformPermissionSchema)
+});
+var GET = async ({ locals }) => {
+	requireManageInstanceUsers(locals);
+	const page = await getAuthProvider().listUsers({ limit: 200 });
+	if (page === null) apiError(501, ApiErrorCode.INTERNAL, "User management is not supported by the current auth provider. Configure DATA_PATH (local provider) or check your provider wiring.");
+	const orgId = locals.ctx?.actingOrgId;
+	const orgs = getOrganizationProvider();
+	const userIds = page.items.map((u) => u.id);
+	const platformByUser = await getPermissionStore().getForBatch(locals.ctx, userIds);
+	const memberByUserId = /* @__PURE__ */ new Map();
+	if (orgId) for (const m of await listAllOrgMembers(orgs, orgId)) memberByUserId.set(m.userId, m);
+	const users = page.items.map((u) => {
+		const member = memberByUserId.get(u.id);
+		return {
+			...u,
+			platformPermissions: platformByUser.get(u.id) ?? [],
+			orgRole: member?.role,
+			orgPermissions: member ? [...member.permissions] : []
+		};
+	});
+	return json({ users });
+};
+var POST = async ({ request, locals }) => {
+	requireManageInstanceUsers(locals);
+	const auth = getAuthProvider();
+	const body = await request.json().catch(() => null);
+	const parsed = CreateUserBody.safeParse(body);
+	if (!parsed.success) throwZodError(parsed.error);
+	const { email, permissions: platform } = parsed.data;
+	if (platform.length > 0 && !hasPermission(locals.ctx, "instance_admin")) apiError(403, ApiErrorCode.FORBIDDEN, "Only a platform admin can grant platform-scope permissions");
+	try {
+		let user;
+		if (auth.createUser) user = await auth.createUser(email);
+		else apiError(501, ApiErrorCode.INTERNAL, `${auth.name} cannot create a user directly. Send an invite instead — the recipient sets their own password.`);
+		if (platform.length > 0) await setUserPlatformPermissions(locals.ctx, user.id, platform);
+		const orgId = locals.ctx?.actingOrgId;
+		if (orgId) {
+			const joinedAt = (/* @__PURE__ */ new Date()).toISOString();
+			await getOrganizationProvider().addOrgMember(SYSTEM_CONTEXT, {
+				orgId,
+				userId: user.id,
+				role: "member",
+				permissions: [],
+				joinedAt,
+				updatedAt: joinedAt,
+				updatedBy: locals.user?.id ?? user.id,
+				deletedAt: null
+			});
+		}
+		return json(user, { status: 201 });
+	} catch (err) {
+		handleApiError(err, "Failed to create user");
+	}
+};
+
+export { GET, POST };
+//# sourceMappingURL=_server.ts.js-QXOvmnPk.js.map

package/build/server/chunks/entries/endpoints/api/admin/users/_server.ts.js-QXOvmnPk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-QXOvmnPk.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/admin/users/_server.ts.js"],"sourcesContent":["import { D as PlatformPermissionSchema, n as hasPermission, t as SYSTEM_CONTEXT } from \"../../../../../chunks/src.js\";\nimport { h as getPermissionStore, m as getOrganizationProvider, r as getAuthProvider } from \"../../../../../chunks/providers.server.js\";\nimport { b as requireManageInstanceUsers } from \"../../../../../chunks/access.server.js\";\nimport { i as throwZodError, n as apiError, r as handleApiError, t as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\nimport \"../../../../../chunks/auth.server.js\";\nimport { t as listAllOrgMembers } from \"../../../../../chunks/org-members.server.js\";\nimport { t as setUserPlatformPermissions } from \"../../../../../chunks/permissions.server.js\";\nimport { json } from \"@sveltejs/kit\";\nimport { z } from \"zod\";\n//#region src/routes/api/admin/users/+server.ts\nvar CreateUserBody = z.object({\n\temail: z.string().email(\"Valid email is required\"),\n\tpermissions: z.array(PlatformPermissionSchema)\n});\nvar GET = async ({ locals }) => {\n\trequireManageInstanceUsers(locals);\n\tconst page = await getAuthProvider().listUsers({ limit: 200 });\n\tif (page === null) apiError(501, ApiErrorCode.INTERNAL, \"User management is not supported by the current auth provider. Configure DATA_PATH (local provider) or check your provider wiring.\");\n\tconst orgId = locals.ctx?.actingOrgId;\n\tconst orgs = getOrganizationProvider();\n\tconst userIds = page.items.map((u) => u.id);\n\tconst platformByUser = await getPermissionStore().getForBatch(locals.ctx, userIds);\n\tconst memberByUserId = /* @__PURE__ */ new Map();\n\tif (orgId) for (const m of await listAllOrgMembers(orgs, orgId)) memberByUserId.set(m.userId, m);\n\tconst users = page.items.map((u) => {\n\t\tconst member = memberByUserId.get(u.id);\n\t\treturn {\n\t\t\t...u,\n\t\t\tplatformPermissions: platformByUser.get(u.id) ?? [],\n\t\t\torgRole: member?.role,\n\t\t\torgPermissions: member ? [...member.permissions] : []\n\t\t};\n\t});\n\treturn json({ users });\n};\nvar POST = async ({ request, locals }) => {\n\trequireManageInstanceUsers(locals);\n\tconst auth = getAuthProvider();\n\tconst body = await request.json().catch(() => null);\n\tconst parsed = CreateUserBody.safeParse(body);\n\tif (!parsed.success) throwZodError(parsed.error);\n\tconst { email, permissions: platform } = parsed.data;\n\tif (platform.length > 0 && !hasPermission(locals.ctx, \"instance_admin\")) apiError(403, ApiErrorCode.FORBIDDEN, \"Only a platform admin can grant platform-scope permissions\");\n\ttry {\n\t\tlet user;\n\t\tif (auth.createUser) user = await auth.createUser(email);\n\t\telse apiError(501, ApiErrorCode.INTERNAL, `${auth.name} cannot create a user directly. Send an invite instead — the recipient sets their own password.`);\n\t\tif (platform.length > 0) await setUserPlatformPermissions(locals.ctx, user.id, platform);\n\t\tconst orgId = locals.ctx?.actingOrgId;\n\t\tif (orgId) {\n\t\t\tconst joinedAt = (/* @__PURE__ */ new Date()).toISOString();\n\t\t\tawait getOrganizationProvider().addOrgMember(SYSTEM_CONTEXT, {\n\t\t\t\torgId,\n\t\t\t\tuserId: user.id,\n\t\t\t\trole: \"member\",\n\t\t\t\tpermissions: [],\n\t\t\t\tjoinedAt,\n\t\t\t\tupdatedAt: joinedAt,\n\t\t\t\tupdatedBy: locals.user?.id ?? user.id,\n\t\t\t\tdeletedAt: null\n\t\t\t});\n\t\t}\n\t\treturn json(user, { status: 201 });\n\t} catch (err) {\n\t\thandleApiError(err, \"Failed to create user\");\n\t}\n};\n//#endregion\nexport { GET, POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AASA;AACA,IAAI,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;AAC9B,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC;AACnD,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB;AAC9C,CAAC,CAAC;AACC,IAAC,GAAG,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK;AAChC,CAAC,0BAA0B,CAAC,MAAM,CAAC;AACnC,CAAC,MAAM,IAAI,GAAG,MAAM,eAAe,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AAC/D,CAAC,IAAI,IAAI,KAAK,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,oIAAoI,CAAC;AAC9L,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,WAAW;AACtC,CAAC,MAAM,IAAI,GAAG,uBAAuB,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC,MAAM,cAAc,GAAG,MAAM,kBAAkB,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC;AACnF,CAAC,MAAM,cAAc,mBAAmB,IAAI,GAAG,EAAE;AACjD,CAAC,IAAI,KAAK,EAAE,KAAK,MAAM,CAAC,IAAI,MAAM,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACjG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK;AACrC,EAAE,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AACzC,EAAE,OAAO;AACT,GAAG,GAAG,CAAC;AACP,GAAG,mBAAmB,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE;AACtD,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI;AACxB,GAAG,cAAc,EAAE,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG;AACtD,GAAG;AACH,CAAC,CAAC,CAAC;AACH,CAAC,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC;AACvB;AACG,IAAC,IAAI,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AAC1C,CAAC,0BAA0B,CAAC,MAAM,CAAC;AACnC,CAAC,MAAM,IAAI,GAAG,eAAe,EAAE;AAC/B,CAAC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;AACpD,CAAC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC;AAC9C,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AACjD,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,IAAI;AACrD,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,4DAA4D,CAAC;AAC7K,CAAC,IAAI;AACL,EAAE,IAAI,IAAI;AACV,EAAE,IAAI,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;AAC1D,OAAO,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,+FAA+F,CAAC,CAAC;AAC1J,EAAE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,MAAM,0BAA0B,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC;AAC1F,EAAE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,WAAW;AACvC,EAAE,IAAI,KAAK,EAAE;AACb,GAAG,MAAM,QAAQ,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AAC9D,GAAG,MAAM,uBAAuB,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE;AAChE,IAAI,KAAK;AACT,IAAI,MAAM,EAAE,IAAI,CAAC,EAAE;AACnB,IAAI,IAAI,EAAE,QAAQ;AAClB,IAAI,WAAW,EAAE,EAAE;AACnB,IAAI,QAAQ;AACZ,IAAI,SAAS,EAAE,QAAQ;AACvB,IAAI,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI,CAAC,EAAE;AACzC,IAAI,SAAS,EAAE;AACf,IAAI,CAAC;AACL,EAAE;AACF,EAAE,OAAO,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AACpC,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,cAAc,CAAC,GAAG,EAAE,uBAAuB,CAAC;AAC9C,CAAC;AACD;;;;"}

package/build/server/chunks/entries/endpoints/api/diag/throughput/_server.ts.js-Cgxq99Kb.js

@@ -0,0 +1,60 @@
+import { a as apiError, A as ApiErrorCode } from '../../../../../chunks/api-errors.js-CWRxx1wB.js';
+import { C as COMPUTE_DEBUG } from '../../../../../chunks/engine.server.js-BtRZegHZ.js';
+import { randomFillSync } from 'node:crypto';
+import '../../../../../chunks/src.js-C6yJg0vh.js';
+import 'zod';
+import '../../../../../chunks/providers.server.js-DqaQtsNQ.js';
+import '../../../../../chunks/shared-server.js-D2MyEK0i.js';
+import '../../../../../chunks/limits.js-B7msNaG3.js';
+import '../../../../../chunks/schema.js-BeFDxIuz.js';
+import '../../../../../chunks/core-BQtRL5GE.js-iCpLjXCp.js';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '../../../../../chunks/utils2.js-DKBV7VcI.js';
+import '@sveltejs/kit';
+import '../../../../../chunks/computeLimits.js-C9NHMCCA.js';
+import 'node:dns/promises';
+import 'node:net';
+import 'node:zlib';
+import 'node:util';
+
+//#region src/routes/api/diag/throughput/+server.ts
+var CHUNK_BYTES = 1048576;
+var DEFAULT_MB = 20;
+var MAX_MB = 64;
+var GET = async ({ locals, url }) => {
+	if (!COMPUTE_DEBUG) apiError(404, ApiErrorCode.NOT_FOUND, "Not found");
+	if (!locals.user) apiError(401, ApiErrorCode.UNAUTHORIZED, "Unauthorized");
+	const requested = Number(url.searchParams.get("mb"));
+	const mb = Math.min(MAX_MB, Math.max(1, Number.isFinite(requested) ? requested : DEFAULT_MB));
+	let sentChunks = 0;
+	const start = performance.now();
+	const stream = new ReadableStream({ pull(controller) {
+		if (sentChunks >= mb) {
+			controller.close();
+			const secs = (performance.now() - start) / 1e3;
+			locals.log.debug("Streamed throughput probe (server-side view)", {
+				component: "Compute/diag",
+				megabytes: mb,
+				durationSec: Number(secs.toFixed(1)),
+				throughputMbPerSec: Number((mb / secs).toFixed(1))
+			});
+			return;
+		}
+		const chunk = new Uint8Array(CHUNK_BYTES);
+		randomFillSync(chunk);
+		controller.enqueue(chunk);
+		sentChunks++;
+	} });
+	return new Response(stream, { headers: {
+		"Content-Type": "application/octet-stream",
+		"Content-Length": String(mb * CHUNK_BYTES),
+		"Cache-Control": "no-store"
+	} });
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts.js-Cgxq99Kb.js.map

package/build/server/chunks/entries/endpoints/api/diag/throughput/_server.ts.js-Cgxq99Kb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-Cgxq99Kb.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/diag/throughput/_server.ts.js"],"sourcesContent":["import { n as apiError, t as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\nimport { t as COMPUTE_DEBUG } from \"../../../../../chunks/engine.server.js\";\nimport { randomFillSync } from \"node:crypto\";\n//#region src/routes/api/diag/throughput/+server.ts\nvar CHUNK_BYTES = 1048576;\nvar DEFAULT_MB = 20;\nvar MAX_MB = 64;\nvar GET = async ({ locals, url }) => {\n\tif (!COMPUTE_DEBUG) apiError(404, ApiErrorCode.NOT_FOUND, \"Not found\");\n\tif (!locals.user) apiError(401, ApiErrorCode.UNAUTHORIZED, \"Unauthorized\");\n\tconst requested = Number(url.searchParams.get(\"mb\"));\n\tconst mb = Math.min(MAX_MB, Math.max(1, Number.isFinite(requested) ? requested : DEFAULT_MB));\n\tlet sentChunks = 0;\n\tconst start = performance.now();\n\tconst stream = new ReadableStream({ pull(controller) {\n\t\tif (sentChunks >= mb) {\n\t\t\tcontroller.close();\n\t\t\tconst secs = (performance.now() - start) / 1e3;\n\t\t\tlocals.log.debug(\"Streamed throughput probe (server-side view)\", {\n\t\t\t\tcomponent: \"Compute/diag\",\n\t\t\t\tmegabytes: mb,\n\t\t\t\tdurationSec: Number(secs.toFixed(1)),\n\t\t\t\tthroughputMbPerSec: Number((mb / secs).toFixed(1))\n\t\t\t});\n\t\t\treturn;\n\t\t}\n\t\tconst chunk = new Uint8Array(CHUNK_BYTES);\n\t\trandomFillSync(chunk);\n\t\tcontroller.enqueue(chunk);\n\t\tsentChunks++;\n\t} });\n\treturn new Response(stream, { headers: {\n\t\t\"Content-Type\": \"application/octet-stream\",\n\t\t\"Content-Length\": String(mb * CHUNK_BYTES),\n\t\t\"Cache-Control\": \"no-store\"\n\t} });\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAGA;AACA,IAAI,WAAW,GAAG,OAAO;AACzB,IAAI,UAAU,GAAG,EAAE;AACnB,IAAI,MAAM,GAAG,EAAE;AACZ,IAAC,GAAG,GAAG,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK;AACrC,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,WAAW,CAAC;AACvE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC;AAC3E,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACrD,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,SAAS,GAAG,UAAU,CAAC,CAAC;AAC9F,CAAC,IAAI,UAAU,GAAG,CAAC;AACnB,CAAC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;AAChC,CAAC,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE;AACtD,EAAE,IAAI,UAAU,IAAI,EAAE,EAAE;AACxB,GAAG,UAAU,CAAC,KAAK,EAAE;AACrB,GAAG,MAAM,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG;AACjD,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,8CAA8C,EAAE;AACpE,IAAI,SAAS,EAAE,cAAc;AAC7B,IAAI,SAAS,EAAE,EAAE;AACjB,IAAI,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACxC,IAAI,kBAAkB,EAAE,MAAM,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;AACrD,IAAI,CAAC;AACL,GAAG;AACH,EAAE;AACF,EAAE,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC;AAC3C,EAAE,cAAc,CAAC,KAAK,CAAC;AACvB,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;AAC3B,EAAE,UAAU,EAAE;AACd,CAAC,CAAC,EAAE,CAAC;AACL,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE;AACxC,EAAE,cAAc,EAAE,0BAA0B;AAC5C,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,GAAG,WAAW,CAAC;AAC5C,EAAE,eAAe,EAAE;AACnB,EAAE,EAAE,CAAC;AACL;;;;"}

package/build/server/chunks/entries/endpoints/api/files/_...path_/_server.ts.js-BjWbWAxp.js

@@ -0,0 +1,89 @@
+import { c as classifyAssetPath, G as GuidSchema, f as COVER_IMAGE_CONTENT_TYPES } from '../../../../../chunks/src.js-C6yJg0vh.js';
+import { o as getDefinitionMeta, A as definitionPaths, x as getStorageProvider } from '../../../../../chunks/providers.server.js-DqaQtsNQ.js';
+import { k as requireCanViewProject, l as requireCanViewOrg } from '../../../../../chunks/access.server.js-C4HiC_D0.js';
+import { a as apiError, A as ApiErrorCode } from '../../../../../chunks/api-errors.js-CWRxx1wB.js';
+import 'zod';
+import '../../../../../chunks/shared-server.js-D2MyEK0i.js';
+import '../../../../../chunks/limits.js-B7msNaG3.js';
+import '../../../../../chunks/schema.js-BeFDxIuz.js';
+import '../../../../../chunks/core-BQtRL5GE.js-iCpLjXCp.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '@sveltejs/kit';
+import '../../../../../chunks/utils2.js-DKBV7VcI.js';
+
+//#region src/routes/api/files/[...path]/+server.ts
+/**
+* Authenticated/­public blob proxy. The set of servable paths is the closed
+* asset-class registry (`classifyAssetPath` / `ASSET_CLASSES` in
+* `@selvajs/platform`). Each class declares a visibility; this route maps that
+* visibility to an authorization check:
+*
+*   - `public`  (org branding — logo/favicon): served to anyone, incl.
+*     logged-out visitors, with no auth. Cacheable. The bytes are always a
+*     rasterized WebP, so there is no XSS surface to gate.
+*   - `org`     (org-private blobs, e.g. pricing sheets under
+*     `orgs/{id}/private/*`): `requireCanViewOrg(orgId)`.
+*   - `project` (definition covers): `requireCanViewProject(projectId)` — the
+*     M5 hardening, unchanged.
+*
+* Anything that classifies to no asset class 404s. New blob types are opt-in:
+* add a registry entry with the right visibility — never a generic
+* "is the extension allowed" fallthrough. Authorization lives here (the route),
+* not in the storage layer, per `IStorageProvider`'s contract.
+*
+* Why a single proxy for all three: with the registry, the route is no longer a
+* pile of per-shape branches — it classifies once and dispatches on visibility,
+* so the cover-only contract that this route used to pin now generalizes
+* without re-opening the M5 hole.
+*/
+var CONTENT_TYPE_BY_EXT = {
+	...COVER_IMAGE_CONTENT_TYPES,
+	".pdf": "application/pdf"
+};
+function contentTypeFor(storagePath) {
+	const dot = storagePath.lastIndexOf(".");
+	return CONTENT_TYPE_BY_EXT[dot === -1 ? "" : storagePath.slice(dot).toLowerCase()] ?? "application/octet-stream";
+}
+var GET = async ({ params, locals }) => {
+	const storagePath = params.path;
+	if (!storagePath) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Missing path");
+	const match = classifyAssetPath(storagePath);
+	if (!match) apiError(404, ApiErrorCode.NOT_FOUND, "File not found");
+	let canonicalPath = storagePath;
+	switch (match.class.visibility) {
+		case "public": break;
+		case "org": {
+			if (!locals.ctx) apiError(401, ApiErrorCode.UNAUTHORIZED, "Unauthorized");
+			const orgId = match.scopeId;
+			if (!orgId) apiError(404, ApiErrorCode.NOT_FOUND, "File not found");
+			await requireCanViewOrg(locals, orgId);
+			break;
+		}
+		case "project": {
+			if (!locals.ctx) apiError(401, ApiErrorCode.UNAUTHORIZED, "Unauthorized");
+			const guid = match.scopeId;
+			const guidParsed = GuidSchema.safeParse(guid);
+			if (!guidParsed.success) apiError(404, ApiErrorCode.NOT_FOUND, "File not found");
+			const record = await getDefinitionMeta().get(locals.ctx, guidParsed.data);
+			if (!record) apiError(404, ApiErrorCode.NOT_FOUND, "File not found");
+			await requireCanViewProject(locals, record.projectId);
+			canonicalPath = definitionPaths.image(guidParsed.data);
+			break;
+		}
+	}
+	const bytes = await getStorageProvider().get(canonicalPath);
+	if (!bytes) apiError(404, ApiErrorCode.NOT_FOUND, "File not found");
+	const cacheControl = match.class.visibility === "public" ? "public, max-age=3600" : "private, max-age=3600";
+	return new Response(Buffer.from(bytes), { headers: {
+		"Content-Type": contentTypeFor(canonicalPath),
+		"Cache-Control": cacheControl
+	} });
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts.js-BjWbWAxp.js.map

package/build/server/chunks/entries/endpoints/api/files/_...path_/_server.ts.js-BjWbWAxp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-BjWbWAxp.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/files/_...path_/_server.ts.js"],"sourcesContent":["import { r as classifyAssetPath, s as GuidSchema, u as COVER_IMAGE_CONTENT_TYPES } from \"../../../../../chunks/src.js\";\nimport { R as definitionPaths, s as getDefinitionMeta, y as getStorageProvider } from \"../../../../../chunks/providers.server.js\";\nimport { g as requireCanViewProject, h as requireCanViewOrg } from \"../../../../../chunks/access.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\n//#region src/routes/api/files/[...path]/+server.ts\n/**\n* Authenticated/­public blob proxy. The set of servable paths is the closed\n* asset-class registry (`classifyAssetPath` / `ASSET_CLASSES` in\n* `@selvajs/platform`). Each class declares a visibility; this route maps that\n* visibility to an authorization check:\n*\n*   - `public`  (org branding — logo/favicon): served to anyone, incl.\n*     logged-out visitors, with no auth. Cacheable. The bytes are always a\n*     rasterized WebP, so there is no XSS surface to gate.\n*   - `org`     (org-private blobs, e.g. pricing sheets under\n*     `orgs/{id}/private/*`): `requireCanViewOrg(orgId)`.\n*   - `project` (definition covers): `requireCanViewProject(projectId)` — the\n*     M5 hardening, unchanged.\n*\n* Anything that classifies to no asset class 404s. New blob types are opt-in:\n* add a registry entry with the right visibility — never a generic\n* \"is the extension allowed\" fallthrough. Authorization lives here (the route),\n* not in the storage layer, per `IStorageProvider`'s contract.\n*\n* Why a single proxy for all three: with the registry, the route is no longer a\n* pile of per-shape branches — it classifies once and dispatches on visibility,\n* so the cover-only contract that this route used to pin now generalizes\n* without re-opening the M5 hole.\n*/\nvar CONTENT_TYPE_BY_EXT = {\n\t...COVER_IMAGE_CONTENT_TYPES,\n\t\".pdf\": \"application/pdf\"\n};\nfunction contentTypeFor(storagePath) {\n\tconst dot = storagePath.lastIndexOf(\".\");\n\treturn CONTENT_TYPE_BY_EXT[dot === -1 ? \"\" : storagePath.slice(dot).toLowerCase()] ?? \"application/octet-stream\";\n}\nvar GET = async ({ params, locals }) => {\n\tconst storagePath = params.path;\n\tif (!storagePath) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing path\");\n\tconst match = classifyAssetPath(storagePath);\n\tif (!match) apiError(404, ApiErrorCode.NOT_FOUND, \"File not found\");\n\tlet canonicalPath = storagePath;\n\tswitch (match.class.visibility) {\n\t\tcase \"public\": break;\n\t\tcase \"org\": {\n\t\t\tif (!locals.ctx) apiError(401, ApiErrorCode.UNAUTHORIZED, \"Unauthorized\");\n\t\t\tconst orgId = match.scopeId;\n\t\t\tif (!orgId) apiError(404, ApiErrorCode.NOT_FOUND, \"File not found\");\n\t\t\tawait requireCanViewOrg(locals, orgId);\n\t\t\tbreak;\n\t\t}\n\t\tcase \"project\": {\n\t\t\tif (!locals.ctx) apiError(401, ApiErrorCode.UNAUTHORIZED, \"Unauthorized\");\n\t\t\tconst guid = match.scopeId;\n\t\t\tconst guidParsed = GuidSchema.safeParse(guid);\n\t\t\tif (!guidParsed.success) apiError(404, ApiErrorCode.NOT_FOUND, \"File not found\");\n\t\t\tconst record = await getDefinitionMeta().get(locals.ctx, guidParsed.data);\n\t\t\tif (!record) apiError(404, ApiErrorCode.NOT_FOUND, \"File not found\");\n\t\t\tawait requireCanViewProject(locals, record.projectId);\n\t\t\tcanonicalPath = definitionPaths.image(guidParsed.data);\n\t\t\tbreak;\n\t\t}\n\t}\n\tconst bytes = await getStorageProvider().get(canonicalPath);\n\tif (!bytes) apiError(404, ApiErrorCode.NOT_FOUND, \"File not found\");\n\tconst cacheControl = match.class.visibility === \"public\" ? \"public, max-age=3600\" : \"private, max-age=3600\";\n\treturn new Response(Buffer.from(bytes), { headers: {\n\t\t\"Content-Type\": contentTypeFor(canonicalPath),\n\t\t\"Cache-Control\": cacheControl\n\t} });\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,mBAAmB,GAAG;AAC1B,CAAC,GAAG,yBAAyB;AAC7B,CAAC,MAAM,EAAE;AACT,CAAC;AACD,SAAS,cAAc,CAAC,WAAW,EAAE;AACrC,CAAC,MAAM,GAAG,GAAG,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC;AACzC,CAAC,OAAO,mBAAmB,CAAC,GAAG,KAAK,EAAE,GAAG,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,0BAA0B;AACjH;AACG,IAAC,GAAG,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AACxC,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI;AAChC,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,cAAc,CAAC;AAChF,CAAC,MAAM,KAAK,GAAG,iBAAiB,CAAC,WAAW,CAAC;AAC7C,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gBAAgB,CAAC;AACpE,CAAC,IAAI,aAAa,GAAG,WAAW;AAChC,CAAC,QAAQ,KAAK,CAAC,KAAK,CAAC,UAAU;AAC/B,EAAE,KAAK,QAAQ,EAAE;AACjB,EAAE,KAAK,KAAK,EAAE;AACd,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC;AAC5E,GAAG,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO;AAC9B,GAAG,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gBAAgB,CAAC;AACtE,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC;AACzC,GAAG;AACH,EAAE;AACF,EAAE,KAAK,SAAS,EAAE;AAClB,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC;AAC5E,GAAG,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO;AAC7B,GAAG,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC;AAChD,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gBAAgB,CAAC;AACnF,GAAG,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC;AAC5E,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gBAAgB,CAAC;AACvE,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC;AACxD,GAAG,aAAa,GAAG,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;AACzD,GAAG;AACH,EAAE;AACF;AACA,CAAC,MAAM,KAAK,GAAG,MAAM,kBAAkB,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC;AAC5D,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gBAAgB,CAAC;AACpE,CAAC,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,KAAK,QAAQ,GAAG,sBAAsB,GAAG,uBAAuB;AAC5G,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE;AACpD,EAAE,cAAc,EAAE,cAAc,CAAC,aAAa,CAAC;AAC/C,EAAE,eAAe,EAAE;AACnB,EAAE,EAAE,CAAC;AACL;;;;"}

package/build/server/chunks/entries/endpoints/api/health/_server.ts.js-D0uTBHzm.js

@@ -0,0 +1,57 @@
+import { g as getBootHealth, i as isDegraded } from '../../../../chunks/bootHealth.server.js-CgehUVl0.js';
+import { json } from '@sveltejs/kit';
+import { randomUUID } from 'crypto';
+import { createRequire } from 'module';
+import '../../../../chunks/providers.server.js-DqaQtsNQ.js';
+import '../../../../chunks/shared-server.js-D2MyEK0i.js';
+import '../../../../chunks/src.js-C6yJg0vh.js';
+import 'zod';
+import '../../../../chunks/limits.js-B7msNaG3.js';
+import '../../../../chunks/schema.js-BeFDxIuz.js';
+import '../../../../chunks/core-BQtRL5GE.js-iCpLjXCp.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+
+//#region src/routes/api/health/+server.ts
+var INSTANCE_ID = randomUUID();
+var RUNTIME_VERSION = (() => {
+	try {
+		return createRequire(import.meta.url)("@selvajs/selva/package.json").version;
+	} catch {
+		return null;
+	}
+})();
+/**
+* Health check endpoint for load balancers and orchestration systems.
+* Used by Docker healthchecks, Kubernetes liveness probes, and monitoring tools.
+*
+* The `instanceId` field is a per-boot fingerprint — clients polling after a
+* restart confirm the *new* process is responding (not the old one about to be
+* killed) by watching for the value to change.
+*
+* Returns 503 with `status: "degraded"` when boot-time integrity checks
+* failed (e.g. compute server apiKeys can't be decrypted under the current
+* `SELVA_AT_REST_KEY`). The body lists which servers and why, so an operator
+* curling the endpoint can diagnose without server-log access. The app
+* still serves requests in this state (per-row tolerance) — the 503 is
+* specifically a signal for load balancers / monitoring.
+*/
+var GET = async () => {
+	const boot = await getBootHealth();
+	const degraded = isDegraded(boot);
+	const body = {
+		status: degraded ? "degraded" : "ok",
+		timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+		instanceId: INSTANCE_ID,
+		version: RUNTIME_VERSION,
+		boot
+	};
+	return json(body, { status: degraded ? 503 : 200 });
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts.js-D0uTBHzm.js.map

package/build/server/chunks/entries/endpoints/api/health/_server.ts.js-D0uTBHzm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-D0uTBHzm.js","sources":["../../../../../../../.svelte-kit/output/server/entries/endpoints/api/health/_server.ts.js"],"sourcesContent":["import { n as isDegraded, t as getBootHealth } from \"../../../../chunks/bootHealth.server.js\";\nimport { json } from \"@sveltejs/kit\";\nimport { randomUUID } from \"crypto\";\nimport { createRequire } from \"module\";\n//#region src/routes/api/health/+server.ts\nvar INSTANCE_ID = randomUUID();\nvar RUNTIME_VERSION = (() => {\n\ttry {\n\t\treturn createRequire(import.meta.url)(\"@selvajs/selva/package.json\").version;\n\t} catch {\n\t\treturn null;\n\t}\n})();\n/**\n* Health check endpoint for load balancers and orchestration systems.\n* Used by Docker healthchecks, Kubernetes liveness probes, and monitoring tools.\n*\n* The `instanceId` field is a per-boot fingerprint — clients polling after a\n* restart confirm the *new* process is responding (not the old one about to be\n* killed) by watching for the value to change.\n*\n* Returns 503 with `status: \"degraded\"` when boot-time integrity checks\n* failed (e.g. compute server apiKeys can't be decrypted under the current\n* `SELVA_AT_REST_KEY`). The body lists which servers and why, so an operator\n* curling the endpoint can diagnose without server-log access. The app\n* still serves requests in this state (per-row tolerance) — the 503 is\n* specifically a signal for load balancers / monitoring.\n*/\nvar GET = async () => {\n\tconst boot = await getBootHealth();\n\tconst degraded = isDegraded(boot);\n\tconst body = {\n\t\tstatus: degraded ? \"degraded\" : \"ok\",\n\t\ttimestamp: (/* @__PURE__ */ new Date()).toISOString(),\n\t\tinstanceId: INSTANCE_ID,\n\t\tversion: RUNTIME_VERSION,\n\t\tboot\n\t};\n\treturn json(body, { status: degraded ? 503 : 200 });\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAIA;AACA,IAAI,WAAW,GAAG,UAAU,EAAE;AAC9B,IAAI,eAAe,GAAG,CAAC,MAAM;AAC7B,CAAC,IAAI;AACL,EAAE,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,6BAA6B,CAAC,CAAC,OAAO;AAC9E,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,IAAI;AACb,CAAC;AACD,CAAC,GAAG;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,GAAG,GAAG,YAAY;AACtB,CAAC,MAAM,IAAI,GAAG,MAAM,aAAa,EAAE;AACnC,CAAC,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC;AAClC,CAAC,MAAM,IAAI,GAAG;AACd,EAAE,MAAM,EAAE,QAAQ,GAAG,UAAU,GAAG,IAAI;AACtC,EAAE,SAAS,EAAE,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACvD,EAAE,UAAU,EAAE,WAAW;AACzB,EAAE,OAAO,EAAE,eAAe;AAC1B,EAAE;AACF,EAAE;AACF,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,GAAG,GAAG,GAAG,GAAG,EAAE,CAAC;AACpD;;;;"}

package/build/server/chunks/entries/endpoints/api/health/ready/_server.ts.js-Dcf50Dha.js

@@ -0,0 +1,60 @@
+import { p as providers } from '../../../../../chunks/providers.server.js-DqaQtsNQ.js';
+import { json } from '@sveltejs/kit';
+import '../../../../../chunks/shared-server.js-D2MyEK0i.js';
+import '../../../../../chunks/src.js-C6yJg0vh.js';
+import 'zod';
+import '../../../../../chunks/limits.js-B7msNaG3.js';
+import '../../../../../chunks/schema.js-BeFDxIuz.js';
+import '../../../../../chunks/core-BQtRL5GE.js-iCpLjXCp.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+
+//#region src/routes/api/health/ready/+server.ts
+/**
+* Readiness probe: can this process serve a real route right now?
+*
+* Distinct from the two health endpoints on either side of it:
+*
+*   • `/api/health` is *liveness*. It answers the instant the Node process
+*     boots, before the provider stores have necessarily been touched — so a
+*     200 there does not mean a real request would succeed. That gap is what
+*     let the post-update UI report "back online" while a click a moment later
+*     hit a 502 through the proxy.
+*   • `/api/admin/system/health` is a *diagnostic*. It re-runs live integrity
+*     checks including a ping of the default Rhino.Compute server, so it
+*     reports non-ok whenever an unrelated dependency is down and can take
+*     ~10s. Neither property is acceptable in a probe something waits on.
+*
+* So this route does the smallest thing that proves real request handling: one
+* read through the data provider, the same call the auth hook makes on every
+* gated request. If the provider is wired and its store is reachable, routes
+* serve. It deliberately touches NOTHING external — no compute server, no
+* network — because an unreachable compute server does not make this app
+* unready, and a probe that conflates the two can never go green on a
+* deployment whose compute is down.
+*
+* Public and unauthenticated (the update poller runs it across a restart, when
+* no session is guaranteed) and safe to be: the body carries a boolean and a
+* fixed reason string, never provider data or counts.
+*/
+var GET = async () => {
+	try {
+		await providers.auth.listUsers({ limit: 1 });
+		return json({ ready: true }, { headers: { "Cache-Control": "no-store" } });
+	} catch {
+		return json({
+			ready: false,
+			reason: "data provider unavailable"
+		}, {
+			status: 503,
+			headers: { "Cache-Control": "no-store" }
+		});
+	}
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts.js-Dcf50Dha.js.map

package/build/server/chunks/entries/endpoints/api/health/ready/_server.ts.js-Dcf50Dha.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-Dcf50Dha.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/health/ready/_server.ts.js"],"sourcesContent":["import { C as providers } from \"../../../../../chunks/providers.server.js\";\nimport { json } from \"@sveltejs/kit\";\n//#region src/routes/api/health/ready/+server.ts\n/**\n* Readiness probe: can this process serve a real route right now?\n*\n* Distinct from the two health endpoints on either side of it:\n*\n*   • `/api/health` is *liveness*. It answers the instant the Node process\n*     boots, before the provider stores have necessarily been touched — so a\n*     200 there does not mean a real request would succeed. That gap is what\n*     let the post-update UI report \"back online\" while a click a moment later\n*     hit a 502 through the proxy.\n*   • `/api/admin/system/health` is a *diagnostic*. It re-runs live integrity\n*     checks including a ping of the default Rhino.Compute server, so it\n*     reports non-ok whenever an unrelated dependency is down and can take\n*     ~10s. Neither property is acceptable in a probe something waits on.\n*\n* So this route does the smallest thing that proves real request handling: one\n* read through the data provider, the same call the auth hook makes on every\n* gated request. If the provider is wired and its store is reachable, routes\n* serve. It deliberately touches NOTHING external — no compute server, no\n* network — because an unreachable compute server does not make this app\n* unready, and a probe that conflates the two can never go green on a\n* deployment whose compute is down.\n*\n* Public and unauthenticated (the update poller runs it across a restart, when\n* no session is guaranteed) and safe to be: the body carries a boolean and a\n* fixed reason string, never provider data or counts.\n*/\nvar GET = async () => {\n\ttry {\n\t\tawait providers.auth.listUsers({ limit: 1 });\n\t\treturn json({ ready: true }, { headers: { \"Cache-Control\": \"no-store\" } });\n\t} catch {\n\t\treturn json({\n\t\t\tready: false,\n\t\t\treason: \"data provider unavailable\"\n\t\t}, {\n\t\t\tstatus: 503,\n\t\t\theaders: { \"Cache-Control\": \"no-store\" }\n\t\t});\n\t}\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,GAAG,GAAG,YAAY;AACtB,CAAC,IAAI;AACL,EAAE,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAC9C,EAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC;AAC5E,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,IAAI,CAAC;AACd,GAAG,KAAK,EAAE,KAAK;AACf,GAAG,MAAM,EAAE;AACX,GAAG,EAAE;AACL,GAAG,MAAM,EAAE,GAAG;AACd,GAAG,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU;AACzC,GAAG,CAAC;AACJ,CAAC;AACD;;;;"}

package/build/server/chunks/entries/endpoints/api/v1/compute/_server.ts.js-CGonLl7J.js

@@ -0,0 +1,83 @@
+import { a as apiError, A as ApiErrorCode } from '../../../../../chunks/api-errors.js-CWRxx1wB.js';
+import { h as requireMaxBodySize } from '../../../../../chunks/admin-auth.server.js-CesY-flP.js';
+import { f as COMPUTE_REQUEST_MAX_BYTES } from '../../../../../chunks/computeLimits.js-C9NHMCCA.js';
+import { t as tryResolveShareToken } from '../../../../../chunks/resolve.server.js-D3nseh3P.js';
+import { r as runSolve, m as mapSolveError } from '../../../../../chunks/solve.server.js-D5Hz7sbx.js';
+import '../../../../../chunks/src.js-C6yJg0vh.js';
+import 'zod';
+import '../../../../../chunks/providers.server.js-DqaQtsNQ.js';
+import '../../../../../chunks/shared-server.js-D2MyEK0i.js';
+import '../../../../../chunks/limits.js-B7msNaG3.js';
+import '../../../../../chunks/schema.js-BeFDxIuz.js';
+import '../../../../../chunks/core-BQtRL5GE.js-iCpLjXCp.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '../../../../../chunks/utils2.js-DKBV7VcI.js';
+import '@sveltejs/kit';
+import 'node:dns/promises';
+import 'node:net';
+import '../../../../../chunks/token.server.js-BCOtTlyV.js';
+import '../../../../../chunks/token-codec.js-CxK2DiO-.js';
+import '../../../../../chunks/access.server.js-C4HiC_D0.js';
+import '../../../../../chunks/engine.server.js-BtRZegHZ.js';
+import 'node:zlib';
+import 'node:util';
+import '../../../../../chunks/compute.js-ChjPF7zj.js';
+
+//#region src/routes/api/v1/compute/+server.ts
+var POST = async ({ request, locals, url }) => {
+	requireMaxBodySize(request, COMPUTE_REQUEST_MAX_BYTES);
+	const loadStart = performance.now();
+	const prepMarks = [];
+	let prevMark = performance.now();
+	const mark = (label) => {
+		prepMarks.push([label, performance.now() - prevMark]);
+		prevMark = performance.now();
+	};
+	try {
+		const body = await request.json();
+		mark("body");
+		const { inputs, values } = body;
+		const definitionUrl = body.definitionUrl;
+		const channel = body.channel ?? "live";
+		const explicitVersionId = body.versionId ?? null;
+		if (!inputs || !values || !definitionUrl) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Missing required fields: inputs, values, or definitionUrl");
+		if (channel !== "live" && channel !== "draft") apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid channel: ${channel}. Must be 'live' or 'draft'.`);
+		const isLocal = definitionUrl.startsWith("local:");
+		const guid = isLocal ? definitionUrl.substring(6) : null;
+		const sharedAccess = isLocal && guid && !explicitVersionId ? await tryResolveShareToken(request, url, guid, channel, { requireSolve: true }) : null;
+		mark("shareToken");
+		if (!sharedAccess && (!locals.ctx || !locals.user)) apiError(401, ApiErrorCode.UNAUTHORIZED, "Unauthorized");
+		const access = sharedAccess ? {
+			kind: "share",
+			ctx: sharedAccess.ctx,
+			link: sharedAccess.link,
+			rateLimitKey: `share:${sharedAccess.link.id}`
+		} : {
+			kind: "user",
+			ctx: locals.ctx,
+			rateLimitKey: `user:${locals.user.id}`
+		};
+		return await runSolve({
+			access,
+			definitionUrl,
+			inputs,
+			values,
+			channel,
+			versionId: explicitVersionId,
+			request,
+			locals,
+			loadStart,
+			prepMarks
+		});
+	} catch (err) {
+		mapSolveError(err, locals);
+	}
+};
+
+export { POST };
+//# sourceMappingURL=_server.ts.js-CGonLl7J.js.map