@selvajs/selva 4.11.0 → 4.13.0

package/build/server/chunks/entries/endpoints/api/admin/system/update/_server.ts.js-DNoYUUBX.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-DNoYUUBX.js","sources":["../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/admin/system/update/_server.ts.js"],"sourcesContent":["import { t as private_env } from \"../../../../../../chunks/shared-server.js\";\nimport \"../../../../../../chunks/src.js\";\nimport { E as renderThrown, L as actorFrom, l as getErrorReporter, u as getEventSink } from \"../../../../../../chunks/providers.server.js\";\nimport { w as requirePermission } from \"../../../../../../chunks/access.server.js\";\nimport { n as channelTag, r as readChannel, t as checkForUpdate } from \"../../../../../../chunks/updateCheck.server.js\";\nimport { i as updateStatePath, n as startUpdateOutcomeReconciler, r as updateLogPath, t as findDeploymentDir } from \"../../../../../../chunks/selfUpdate.server.js\";\nimport { json } from \"@sveltejs/kit\";\nimport { join } from \"node:path\";\nimport { readFileSync } from \"node:fs\";\nimport { spawn } from \"child_process\";\nimport { join as join$1 } from \"path\";\nimport { readFileSync as readFileSync$1, writeFileSync } from \"fs\";\n//#region src/lib/server/updateRunner.server.ts\n/**\n* Generates the bash the self-update POST route spawns: a tiny daemonizing\n* launcher plus the runner script that actually stops/updates/starts/health-\n* checks the deployment. Split out of the route file because SvelteKit's\n* route-file validator only allows HTTP-verb exports (and `_`-prefixed ones) —\n* these are plain functions the runner-script contract tests import directly.\n*/\nfunction readRuntimeVersion(dir) {\n\ttry {\n\t\tconst pkg = JSON.parse(readFileSync(join(dir, \"node_modules\", \"@selvajs\", \"selva\", \"package.json\"), \"utf8\"));\n\t\treturn typeof pkg.version === \"string\" ? pkg.version : void 0;\n\t} catch {\n\t\treturn;\n\t}\n}\nfunction shellQuote(s) {\n\treturn `'${s.replace(/'/g, `'\\\\''`)}'`;\n}\nfunction buildLauncher(runnerScript, logPath, prelude = []) {\n\tconst echoes = prelude.map((line) => `echo ${shellQuote(line)}`).join(\"\\n\");\n\treturn `\nLOGFILE=${shellQuote(logPath)}\nRUNNER=/tmp/selva-update-runner.sh\nmkdir -p \"$(dirname \"$LOGFILE\")\"\n: > \"$LOGFILE\"\n\ncat > \"$RUNNER\" <<'__SELVA_RUNNER_EOF__'\n${runnerScript}\n__SELVA_RUNNER_EOF__\nchmod +x \"$RUNNER\"\n\ntrap '' PIPE\nexec > >(tee --output-error=warn-nopipe -a \"$LOGFILE\" 2>/dev/null) 2>&1\n${echoes}\n\n# Daemonize the runner so PM2's tree-kill of selva-compute can't reach it.\n# setsid puts it in a new session; the trailing & + disown + launcher exit\n# leaves the runner with PPID=1 once we're gone. stdin/stdout/stderr are\n# fully detached from this process (and from selva-compute's pipes).\nsetsid bash \"$RUNNER\" </dev/null >>\"$LOGFILE\" 2>&1 &\nRUNNER_PID=$!\ndisown\necho \"[INFO] Update runner started (PID $RUNNER_PID, log: $LOGFILE)\"\n\n# Small pause so the runner has time to print its first line before SSE\n# closes — otherwise the frontend's first poll might see no progress.\nsleep 1\nexit 0\n`;\n}\nfunction buildNpmRunnerScript(npmArgs, versionBefore, ecosystemPath, tag) {\n\tconst npmCommand = [\"npm\", ...npmArgs].map(shellQuote).join(\" \");\n\treturn `#!/bin/bash\nset -o pipefail\nBEFORE=${shellQuote(versionBefore ?? \"\")}\nECOSYSTEM=${shellQuote(ecosystemPath)}\nTAG=${shellQuote(tag)}\n\n# Resolve the deployment-local pm2 explicitly instead of trusting PATH.\n# The runner is re-launched via \\`setsid bash\\` from a tempfile, so it inherits\n# whatever environment the spawning process had. When the update is triggered\n# from the admin UI that happens to include node_modules/.bin; from cron or a\n# bare shell it does not, and every pm2 call below — including the EXIT trap's\n# last-resort restart — fails with \"command not found\" and the app stays dark.\nPM2=\"$(dirname \"$ECOSYSTEM\")/node_modules/.bin/pm2\"\n[ -x \"$PM2\" ] || PM2=pm2\n\n# Waits for selva-compute to leave the transitional 'stopping' state.\n#\n# \\`pm2 stop\\` sends SIGINT and returns without waiting for the process to die.\n# The SvelteKit node adapter then drains in-flight requests before exiting, and\n# PM2 only escalates to SIGKILL after kill_timeout (10s in the scaffolded\n# ecosystem). For that whole window the process table entry has a name and an\n# id but no live pid — \\`pm2 start\\` resolves the name, converts to a restart,\n# finds nothing to restart, and pm2's own table printer crashes on\n# \\`undefined.pm2_env\\`. Polling here keeps the rest of the script out of that\n# window entirely.\n#\n# The drain reliably takes the full timeout when the update was triggered from\n# the admin UI: that page is fed by an SSE stream this very process serves, and\n# an open SSE stream never completes on its own.\n# Prints exactly one word. Callers compare it against 'online' / 'stopping', so\n# a probe that emits two tokens on failure (the inline catch AND a shell\n# fallback both firing) would silently never match either. Node's catch is the\n# single failure path; fd 0 rather than /dev/stdin because the latter isn't a\n# readable pipe everywhere.\napp_status() {\n  \"$PM2\" jlist 2>/dev/null | node -e \"\n    try {\n      const list = JSON.parse(require('fs').readFileSync(0,'utf8'));\n      const app = list.find(p => p.name === 'selva-compute');\n      process.stdout.write(app ? app.pm2_env.status : 'missing');\n    } catch { process.stdout.write('error'); }\n  \" 2>/dev/null\n}\n\nwait_until_stopped() {\n  for i in $(seq 1 20); do\n    STATUS=$(app_status)\n    if [ \"$STATUS\" != \"stopping\" ]; then\n      return 0\n    fi\n    echo \"[INFO] selva-compute still draining (attempt $i/20) — waiting for SIGKILL escalation\"\n    sleep 1\n  done\n  echo \"[WARN] selva-compute stuck in 'stopping' after 20s — continuing anyway\"\n  return 1\n}\n\n# \\`pm2 start <ecosystem>\\` converts to a restart-by-id when an entry of the same\n# name is already in the table. If that entry is stale the restart fails and no\n# amount of retrying the same command helps — the name has to be dropped first\n# so the start registers a fresh process. Deleting a stopped entry is safe: the\n# ecosystem file is the source of truth for how to bring it back.\nstart_app() {\n  if \"$PM2\" start \"$ECOSYSTEM\" --update-env; then\n    return 0\n  fi\n  echo \"[WARN] pm2 start failed — dropping the stale process entry and retrying\"\n  \"$PM2\" delete selva-compute >/dev/null 2>&1 || true\n  \"$PM2\" start \"$ECOSYSTEM\" --update-env\n}\n\n# Last-resort safety net. If the script exits with the app NOT online for\n# any reason (crash, kill -9, network blip, npm hang past timeout), try to\n# bring it back from ecosystem.config.cjs before exiting. Leaving the app\n# down is the worst possible outcome of an update.\non_exit() {\n  CODE=$?\n  STATUS=$(app_status)\n  # A 'stopping' entry is mid-drain, not down. Restarting it now hits the same\n  # dead-id window that brought us here; wait for the entry to settle first.\n  if [ \"$STATUS\" = \"stopping\" ]; then\n    wait_until_stopped\n    STATUS=$(app_status)\n  fi\n  if [ \"$STATUS\" != \"online\" ]; then\n    echo \"[RECOVER] selva-compute is '$STATUS' — starting from ecosystem.config.cjs\"\n    start_app >/dev/null 2>&1 || \\\\\n      echo \"[RECOVER] pm2 start failed — manual intervention required: cd $(dirname \"$ECOSYSTEM\") && ./node_modules/.bin/pm2 delete selva-compute; ./node_modules/.bin/pm2 start ecosystem.config.cjs\"\n  fi\n  # Terminal marker: the restarted app's outcome reconciler greps this to turn\n  # the run into an audit event (selfUpdate.server.ts). Keep the format stable.\n  echo \"[EXIT] code=$CODE\"\n}\ntrap on_exit EXIT\n\n# A killed runner must not look like a finished one.\n#\n# \\`$?\\` inside an EXIT trap reports the last completed command, NOT the signal.\n# When systemd SIGTERMs the whole cgroup, the EXIT trap still runs and records\n# \\`code=0\\` — so deriveOutcome takes the exit-0 success branch and tells the\n# operator \"Updated X → Y. The app is back online.\" while npm never ran and\n# the deployment is unchanged. Catching the signal makes the recorded code\n# truthful; 143/130 are the conventional 128+signal values.\non_signal() {\n  SIG=$1\n  echo \"[FATAL] KILLED: runner received SIG$SIG before finishing.\"\n  echo \"[FATAL] Nothing was installed by this run. If the app is down, recover with:\"\n  echo \"[FATAL]   cd $(dirname \"$ECOSYSTEM\") && pm2 start ecosystem.config.cjs --update-env\"\n  echo \"[FATAL] A systemd-supervised pm2 can do this when 'pm2 update' recycles the daemon.\"\n  exit $2\n}\ntrap 'on_signal TERM 143' TERM\ntrap 'on_signal INT 130' INT\ntrap 'on_signal HUP 129' HUP\n\n# ---------------------------------------------------------------------------\n# 1. Pre-flight: skip the whole cycle if there's nothing to install.\n# ---------------------------------------------------------------------------\n# Without this, clicking \"Update\" on an already-current instance triggers a\n# full stop/install/start cycle and a downtime window for no reason.\necho \"[STEP] Checking npm registry for the '$TAG' channel version\"\nLATEST=$(npm view \"@selvajs/selva@$TAG\" version --silent 2>/dev/null || echo \"\")\nif [ -z \"$LATEST\" ]; then\n  echo \"[WARN] Could not query npm registry — proceeding with update attempt anyway\"\nelif [ -n \"$BEFORE\" ] && [ \"$LATEST\" = \"$BEFORE\" ]; then\n  echo \"[INFO] Already on the '$TAG' channel version ($BEFORE)\"\n  echo \"[DONE] Nothing to do\"\n  exit 0\nelse\n  # May be a forward update OR a revert (target older than installed) — either\n  # way the installed version differs from what this channel publishes.\n  echo \"[INFO] Target ($TAG): $BEFORE → $LATEST\"\nfi\n\n# ---------------------------------------------------------------------------\n# 1b. Node engine pre-flight — BEFORE any downtime.\n# ---------------------------------------------------------------------------\n# npm only treats an engine mismatch as fatal under engine-strict=true, which\n# no deployment sets. So a release requiring a newer Node installs\n# \"successfully\", pm2 starts, and /api/health returns 200 (it touches nothing\n# Node-version specific) — a false green that skips rollback entirely. Warn\n# here so a CLI-driven run sees it too; the admin UI blocks earlier.\nREQUIRED_NODE=$(npm view \"@selvajs/selva@$TAG\" engines.node --silent 2>/dev/null | tr -d '\"' | tr -d \"'\")\nRUNNING_NODE=$(node -p 'process.versions.node' 2>/dev/null)\nif [ -n \"$REQUIRED_NODE\" ] && [ -n \"$RUNNING_NODE\" ]; then\n  # Compare majors only — the ranges we publish are all \\`>=X\\` forms.\n  REQ_MAJOR=$(echo \"$REQUIRED_NODE\" | grep -o '[0-9]\\\\+' | head -1)\n  RUN_MAJOR=$(echo \"$RUNNING_NODE\" | cut -d. -f1)\n  if [ -n \"$REQ_MAJOR\" ] && [ \"$RUN_MAJOR\" -lt \"$REQ_MAJOR\" ] 2>/dev/null; then\n    echo \"[WARN] ENGINE_MISMATCH: @selvajs/selva@$LATEST requires Node $REQUIRED_NODE but this host runs v$RUNNING_NODE\"\n    echo \"[WARN] npm will install it anyway (engine-strict is off) and the health probe will pass,\"\n    echo \"[WARN] but routes using newer Node APIs will fail at request time. Upgrade Node on this host.\"\n  fi\nfi\n\n# ---------------------------------------------------------------------------\n# 2. Resync PM2 daemon if its in-memory version drifted from the CLI on disk.\n# ---------------------------------------------------------------------------\n# After a global pm2 upgrade the daemon keeps running its original version\n# while the CLI moves forward. Process commands then talk to a stale daemon\n# and the symptom is \"stop works, start never lands\". \\`pm2 update\\` dumps\n# processes, kills the daemon, respawns on the current CLI, restores the\n# dump. Doing it before we touch anything keeps the rest of the script\n# talking to a coherent daemon.\necho \"[STEP] Checking PM2 daemon/CLI version sync\"\nPING_OUT=$(\"$PM2\" ping 2>&1)\nif echo \"$PING_OUT\" | grep -q \"out-of-date\"; then\n  # pm2 prints both versions alongside the warning. Which is newer decides\n  # whether \\`pm2 update\\` can help — see the direction check below.\n  DAEMON_V=$(echo \"$PING_OUT\" | sed -e 's/\\\\x1b\\\\[[0-9;]*m//g' \\\\\n    | grep -i \"In memory PM2 version\" | grep -o '[0-9]\\\\+\\\\.[0-9]\\\\+\\\\.[0-9]\\\\+' | head -1)\n  LOCAL_V=$(echo \"$PING_OUT\" | sed -e 's/\\\\x1b\\\\[[0-9;]*m//g' \\\\\n    | grep -i \"Local PM2 version\" | grep -o '[0-9]\\\\+\\\\.[0-9]\\\\+\\\\.[0-9]\\\\+' | head -1)\n  DAEMON_MAJOR=\\${DAEMON_V%%.*}\n  LOCAL_MAJOR=\\${LOCAL_V%%.*}\n\n  # A daemon NEWER than the deployment-local CLI means a foreign global pm2 owns\n  # it. \\`pm2 update\\` would DOWNGRADE the daemon and feed it a dump it can't read,\n  # losing the process table — selva-compute never gets re-registered. That is an\n  # operator problem, not something this script can repair, so stop before we\n  # take the app down.\n  if [ -n \"$DAEMON_MAJOR\" ] && [ -n \"$LOCAL_MAJOR\" ] && [ \"$DAEMON_MAJOR\" -gt \"$LOCAL_MAJOR\" ] 2>/dev/null; then\n    echo \"[FATAL] PM2_SKEW: the running daemon (v$DAEMON_V) is NEWER than this deployment's pm2 (v$LOCAL_V).\"\n    echo \"[FATAL] A global pm2 owns the daemon. Running 'pm2 update' would downgrade it and drop\"\n    echo \"[FATAL] the process table. Resolve manually before updating:\"\n    echo \"[FATAL]   which -a pm2 && pm2 -v && pm2 ping\"\n    echo \"[FATAL] Aborting WITHOUT stopping the app — it is still running.\"\n    exit 8\n  fi\n\n  # Under systemd, \\`pm2 update\\` kills and respawns the daemon. systemd sees its\n  # unit's main process die and, with the default KillMode=control-group,\n  # SIGTERMs everything in the cgroup — including this runner. setsid escapes\n  # PM2's tree-kill but NOT the cgroup, so there is no way to survive it from\n  # here; refuse the resync instead of being killed by it.\n  if grep -qs 'pm2.*\\\\.service' /proc/self/cgroup 2>/dev/null; then\n    echo \"[FATAL] SYSTEMD_PM2: this deployment's PM2 is supervised by systemd, and the daemon\"\n    echo \"[FATAL] needs a resync. Running 'pm2 update' here would restart the systemd unit and\"\n    echo \"[FATAL] kill this runner mid-update. Resync manually from a shell, then retry:\"\n    echo \"[FATAL]   cd $(dirname \"$ECOSYSTEM\") && ./node_modules/.bin/pm2 update\"\n    echo \"[FATAL] Aborting WITHOUT stopping the app — it is still running.\"\n    exit 9\n  fi\n\n  echo \"[STEP] PM2 daemon is out-of-date — running 'pm2 update' to resync\"\n  if ! \"$PM2\" update; then\n    echo \"[FATAL] pm2 update failed — aborting before stopping the running app\"\n    exit 1\n  fi\n  echo \"[INFO] PM2 daemon resynced\"\nfi\n\n# ---------------------------------------------------------------------------\n# 3. Stop selva-compute BEFORE npm rewrites build/.\n# ---------------------------------------------------------------------------\n# SvelteKit's node adapter lazy-imports chunks from build/server/chunks/ on\n# every request. Letting npm rewrite build/ while the old process still\n# serves traffic means in-flight requests hit ERR_MODULE_NOT_FOUND for chunks\n# whose hash just changed under their feet. Stopping first is a brief\n# downtime window (~1-2s longer than restart-in-place) for a much smaller\n# blast radius.\n#\n# This is also where the SSE connection to the frontend dies — selva-compute\n# IS the SSE server. From here on, the user sees output via the log-file\n# polling fallback in the admin UI, not over SSE.\necho \"[STEP] Stopping selva-compute\"\nif ! \"$PM2\" stop selva-compute; then\n  echo \"[WARN] pm2 stop failed — selva-compute may not be running yet. Continuing.\"\nfi\n\n# pm2 stop returns before the process is actually gone. Everything below —\n# npm rewriting build/, then the restart — must happen outside the drain window.\nwait_until_stopped\n\n# ---------------------------------------------------------------------------\n# 4. Run npm update.\n# ---------------------------------------------------------------------------\necho \"[STEP] Updating @selvajs/* packages\"\nif ! ${npmCommand}; then\n  echo \"[FATAL] npm update failed — EXIT trap will restart the previous build\"\n  exit 1\nfi\n\nAFTER=$(node -e \"try{console.log(require('./node_modules/@selvajs/selva/package.json').version)}catch(e){}\" 2>/dev/null)\necho \"[INFO] New @selvajs/selva: \\${AFTER:-unknown}\"\n\nif [ -n \"$BEFORE\" ] && [ \"$BEFORE\" = \"$AFTER\" ]; then\n  echo \"[WARN] No version change ($BEFORE). Your npm cache may be stale.\"\n  echo \"[WARN] Recover with:\"\n  echo \"[WARN]   npm cache clean --force\"\n  echo \"[WARN]   rm -rf node_modules package-lock.json\"\n  echo \"[WARN]   npm install --prefer-online\"\nfi\n\n# ---------------------------------------------------------------------------\n# 5. Start selva-compute with the new build.\n# ---------------------------------------------------------------------------\n# Start from ecosystem.config.cjs, NOT \\`pm2 start selva-compute\\` — the latter\n# requires selva-compute to already be in pm2's in-memory process list, which\n# a \\`pm2 update\\` (step 2) isn't guaranteed to preserve.\necho \"[STEP] Starting selva-compute with new build\"\nif ! start_app; then\n  echo \"[FATAL] pm2 start failed — investigate with \\\\\\`pm2 logs selva-compute\\\\\\`\"\n  exit 2\nfi\n\n# ---------------------------------------------------------------------------\n# 6. Health probe the new process.\n# ---------------------------------------------------------------------------\n# Read PORT from .env the same way scripts/update.sh does, so non-default\n# ports are respected.\nPORT=$(grep \"^PORT=\" .env 2>/dev/null \\\\\n  | head -1 \\\\\n  | cut -d'=' -f2 \\\\\n  | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//' -e 's/^[\"'\"'\"']//' -e 's/[\"'\"'\"']$//' -e 's/[[:space:]]*#.*//')\nPORT=\\${PORT:-3000}\n\necho \"[STEP] Health-probing the new process on port $PORT\"\nHEALTHY=0\nfor i in $(seq 1 15); do\n  sleep 2\n  CODE=$(curl -sS -o /tmp/selva-health.$$ -w \"%{http_code}\" --max-time 5 \"http://localhost:$PORT/api/health\" 2>/dev/null || echo \"000\")\n  if [ \"$CODE\" = \"200\" ]; then\n    HEALTHY=1\n    echo \"[INFO] Health probe passed after \\${i} attempt(s)\"\n    rm -f /tmp/selva-health.$$\n    break\n  fi\n  echo \"[INFO] Probe attempt $i/15: HTTP $CODE — retrying\"\ndone\n\nif [ \"$HEALTHY\" = \"1\" ]; then\n  echo \"[DONE] Update complete\"\n  exit 0\nfi\n\n# ---------------------------------------------------------------------------\n# 7. Rollback path.\n# ---------------------------------------------------------------------------\necho \"[FATAL] New process failed health check after 30s\"\nif [ -f /tmp/selva-health.$$ ]; then\n  echo \"[FATAL] Last response body:\"\n  cat /tmp/selva-health.$$\n  rm -f /tmp/selva-health.$$\nfi\n\nif [ -z \"$BEFORE\" ]; then\n  echo \"[FATAL] No prior version recorded — cannot roll back automatically.\"\n  echo \"[FATAL] EXIT trap will attempt to restart the current build anyway.\"\n  exit 3\nfi\n\necho \"[STEP] Rolling back @selvajs/selva to $BEFORE\"\n\"$PM2\" stop selva-compute >/dev/null 2>&1 || true\nwait_until_stopped >/dev/null 2>&1\n# Restore @selvajs/cli alongside the runtime: the forward step installs both at\n# the channel tag, so reverting only the runtime leaves a version pair that was\n# never released together.\nif ! npm install --save \"@selvajs/cli@$BEFORE\" \"@selvajs/selva@$BEFORE\"; then\n  echo \"[FATAL] Rollback npm install failed — EXIT trap will retry restart.\"\n  exit 4\nfi\n\nstart_app || true\nsleep 3\nROLLBACK_CODE=$(curl -sS -o /dev/null -w \"%{http_code}\" --max-time 5 \"http://localhost:$PORT/api/health\" 2>/dev/null || echo \"000\")\nif [ \"$ROLLBACK_CODE\" = \"200\" ]; then\n  echo \"[DONE] Rolled back to $BEFORE — previous version is online\"\n  exit 5\nfi\n\necho \"[FATAL] Rollback restart also failed health check (HTTP $ROLLBACK_CODE)\"\necho \"[FATAL] Manual recovery required. Check: pm2 logs selva-compute\"\nexit 6\n`;\n}\nfunction npmInstallArgs(channel) {\n\tconst tag = channelTag(channel);\n\treturn [\n\t\t\"install\",\n\t\t\"--save\",\n\t\t\"--prefer-online\",\n\t\t`@selvajs/cli@${tag}`,\n\t\t`@selvajs/selva@${tag}`\n\t];\n}\nfunction detectUpdatePlan(env, channel) {\n\tconst dir = findDeploymentDir(env);\n\treturn dir ? {\n\t\tcwd: dir,\n\t\targs: npmInstallArgs(channel)\n\t} : null;\n}\n//#endregion\n//#region src/routes/api/admin/system/update/+server.ts\nfunction stripAnsi(str) {\n\treturn str.replace(/\\x1B\\[[0-9;]*[mGKHF]/g, \"\");\n}\nvar POST = async ({ locals }) => {\n\trequirePermission(locals, \"instance_admin\");\n\tconst channel = readChannel();\n\tconst plan = detectUpdatePlan(private_env, channel);\n\tif (!plan) return new Response(JSON.stringify({ error: \"Couldn't determine how to update this deployment. Expected node_modules/@selvajs/selva (CLI scaffold) in the cwd or a parent directory.\" }), {\n\t\tstatus: 500,\n\t\theaders: { \"Content-Type\": \"application/json\" }\n\t});\n\tconst versionBefore = readRuntimeVersion(plan.cwd);\n\tconst actorId = locals.ctx ? actorFrom(locals.ctx) : \"system\";\n\tconst pending = {\n\t\tstartedAt: (/* @__PURE__ */ new Date()).toISOString(),\n\t\tactorId,\n\t\tchannel,\n\t\tfromVersion: versionBefore\n\t};\n\ttry {\n\t\twriteFileSync(updateStatePath(plan.cwd), JSON.stringify(pending, null, \"\t\"));\n\t} catch (err) {\n\t\tlocals.log.error(\"Could not persist pending-update state\", {\n\t\t\tcomponent: \"selfUpdate\",\n\t\t\terr: renderThrown(err)\n\t\t});\n\t}\n\tawait getEventSink().emit({\n\t\ttype: \"system.update.started\",\n\t\tchannel,\n\t\tfromVersion: versionBefore,\n\t\tactorId\n\t});\n\tconst stream = new ReadableStream({ start(controller) {\n\t\tconst encoder = new TextEncoder();\n\t\tfunction sendEvent(type, data) {\n\t\t\tconst message = `data: ${JSON.stringify({\n\t\t\t\ttype,\n\t\t\t\t...data\n\t\t\t})}\\n\\n`;\n\t\t\tcontroller.enqueue(encoder.encode(message));\n\t\t}\n\t\ttry {\n\t\t\tconst prelude = [`[INFO] Updating deployment (cwd: ${plan.cwd}, channel: ${channel})`, ...versionBefore ? [`[INFO] Current @selvajs/selva: ${versionBefore}`] : []];\n\t\t\tconst runnerScript = buildNpmRunnerScript(plan.args, versionBefore, join$1(plan.cwd, \"ecosystem.config.cjs\"), channelTag(channel));\n\t\t\tconst cmd = \"bash\";\n\t\t\tconst args = [\"-c\", buildLauncher(runnerScript, updateLogPath(plan.cwd), prelude)];\n\t\t\tconst localBin = join$1(plan.cwd, \"node_modules\", \".bin\");\n\t\t\tconst child = spawn(cmd, args, {\n\t\t\t\tcwd: plan.cwd,\n\t\t\t\tenv: {\n\t\t\t\t\tPATH: `${localBin}:${process.env.PATH ?? \"\"}`,\n\t\t\t\t\tHOME: process.env.HOME,\n\t\t\t\t\tINSTALL_DIR: plan.cwd\n\t\t\t\t},\n\t\t\t\tdetached: true,\n\t\t\t\tstdio: [\n\t\t\t\t\t\"ignore\",\n\t\t\t\t\t\"pipe\",\n\t\t\t\t\t\"pipe\"\n\t\t\t\t]\n\t\t\t});\n\t\t\tchild.unref();\n\t\t\tstartUpdateOutcomeReconciler({\n\t\t\t\tdeploymentDir: plan.cwd,\n\t\t\t\temit: (e) => getEventSink().emit(e),\n\t\t\t\treport: (err) => getErrorReporter().capture(err, { tags: { origin: \"selfUpdate\" } })\n\t\t\t});\n\t\t\tconst timeout = setTimeout(() => {\n\t\t\t\ttry {\n\t\t\t\t\tif (child.pid) process.kill(-child.pid, \"SIGTERM\");\n\t\t\t\t} catch {}\n\t\t\t\tsendEvent(\"log\", { data: \"[FATAL] Update timed out after 15 minutes\" });\n\t\t\t\tsendEvent(\"exit\", { code: -1 });\n\t\t\t\tcontroller.close();\n\t\t\t}, 9e5);\n\t\t\tlet restarting = false;\n\t\t\tchild.stdout.on(\"data\", (data) => {\n\t\t\t\tconst lines = data.toString().split(\"\\n\");\n\t\t\t\tfor (const line of lines) {\n\t\t\t\t\tconst clean = stripAnsi(line).trim();\n\t\t\t\t\tif (clean) if (!restarting && (clean.includes(\"Applying action stopProcessId\") || clean.includes(\"Applying action restartProcessId\"))) {\n\t\t\t\t\t\trestarting = true;\n\t\t\t\t\t\tsendEvent(\"restarting\", { data: clean });\n\t\t\t\t\t} else sendEvent(\"log\", { data: clean });\n\t\t\t\t}\n\t\t\t});\n\t\t\tchild.stderr.on(\"data\", (data) => {\n\t\t\t\tconst lines = data.toString().split(\"\\n\");\n\t\t\t\tfor (const line of lines) {\n\t\t\t\t\tconst clean = stripAnsi(line).trim();\n\t\t\t\t\tif (clean) sendEvent(\"log\", { data: `[ERROR] ${clean}` });\n\t\t\t\t}\n\t\t\t});\n\t\t\tchild.on(\"close\", (code) => {\n\t\t\t\tclearTimeout(timeout);\n\t\t\t\tsendEvent(\"exit\", { code: code ?? -1 });\n\t\t\t\tcontroller.close();\n\t\t\t});\n\t\t\tchild.on(\"error\", (err) => {\n\t\t\t\tclearTimeout(timeout);\n\t\t\t\tsendEvent(\"log\", { data: `[FATAL] ${err.message}` });\n\t\t\t\tsendEvent(\"exit\", { code: -1 });\n\t\t\t\tcontroller.close();\n\t\t\t});\n\t\t} catch (err) {\n\t\t\tsendEvent(\"log\", { data: `[FATAL] Failed to spawn process: ${err}` });\n\t\t\tsendEvent(\"exit\", { code: -1 });\n\t\t\tcontroller.close();\n\t\t}\n\t} });\n\treturn new Response(stream, { headers: {\n\t\t\"Content-Type\": \"text/event-stream\",\n\t\t\"Cache-Control\": \"no-cache\",\n\t\tConnection: \"keep-alive\"\n\t} });\n};\nvar GET = async ({ locals, url, fetch }) => {\n\trequirePermission(locals, \"instance_admin\");\n\tif (url.searchParams.get(\"check\") !== null) return json(await checkForUpdate(fetch, readChannel()), { headers: { \"Cache-Control\": \"no-store\" } });\n\tlet body = \"\";\n\ttry {\n\t\tbody = readFileSync$1(updateLogPath(findDeploymentDir(private_env)), \"utf8\");\n\t} catch {}\n\treturn new Response(body, { headers: {\n\t\t\"Content-Type\": \"text/plain; charset=utf-8\",\n\t\t\"Cache-Control\": \"no-store\"\n\t} });\n};\n//#endregion\nexport { GET, POST };\n"],"names":["readFileSync","join","join$1","readFileSync$1"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAYA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,kBAAkB,CAAC,GAAG,EAAE;AACjC,CAAC,IAAI;AACL,EAAE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAACA,cAAY,CAACC,MAAI,CAAC,GAAG,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;AAC9G,EAAE,OAAO,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,GAAG,GAAG,CAAC,OAAO,GAAG,KAAK,CAAC;AAC/D,CAAC,CAAC,CAAC,MAAM;AACT,EAAE;AACF,CAAC;AACD;AACA,SAAS,UAAU,CAAC,CAAC,EAAE;AACvB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACvC;AACA,SAAS,aAAa,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,EAAE;AAC5D,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;AAC5E,CAAC,OAAO;AACR,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC;AAC7B;AACA;AACA;;AAEA;AACA,EAAE,YAAY;AACd;AACA;;AAEA;AACA;AACA,EAAE,MAAM;;AAER;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA,CAAC;AACD;AACA,SAAS,oBAAoB,CAAC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,GAAG,EAAE;AAC1E,CAAC,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;AACjE,CAAC,OAAO,CAAC;AACT;AACA,OAAO,EAAE,UAAU,CAAC,aAAa,IAAI,EAAE,CAAC;AACxC,UAAU,EAAE,UAAU,CAAC,aAAa,CAAC;AACrC,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC;;AAErB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA,KAAK,EAAE,UAAU,CAAC;AAClB;AACA;AACA;;AAEA;AACA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA,CAAC;AACD;AACA,SAAS,cAAc,CAAC,OAAO,EAAE;AACjC,CAAC,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC;AAChC,CAAC,OAAO;AACR,EAAE,SAAS;AACX,EAAE,QAAQ;AACV,EAAE,iBAAiB;AACnB,EAAE,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;AACvB,EAAE,CAAC,eAAe,EAAE,GAAG,CAAC;AACxB,EAAE;AACF;AACA,SAAS,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE;AACxC,CAAC,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC;AACnC,CAAC,OAAO,GAAG,GAAG;AACd,EAAE,GAAG,EAAE,GAAG;AACV,EAAE,IAAI,EAAE,cAAc,CAAC,OAAO;AAC9B,EAAE,GAAG,IAAI;AACT;AACA;AACA;AACA,SAAS,SAAS,CAAC,GAAG,EAAE;AACxB,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC;AAChD;AACG,IAAC,IAAI,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK;AACjC,CAAC,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,CAAC;AAC5C,CAAC,MAAM,OAAO,GAAG,WAAW,EAAE;AAC9B,CAAC,MAAM,IAAI,GAAG,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC;AACpD,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,yIAAyI,EAAE,CAAC,EAAE;AACtM,EAAE,MAAM,EAAE,GAAG;AACb,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AAC/C,EAAE,CAAC;AACH,CAAC,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC;AACnD,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ;AAC9D,CAAC,MAAM,OAAO,GAAG;AACjB,EAAE,SAAS,EAAE,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACvD,EAAE,OAAO;AACT,EAAE,OAAO;AACT,EAAE,WAAW,EAAE;AACf,EAAE;AACF,CAAC,IAAI;AACL,EAAE,aAAa,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AAC9E,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,wCAAwC,EAAE;AAC7D,GAAG,SAAS,EAAE,YAAY;AAC1B,GAAG,GAAG,EAAE,YAAY,CAAC,GAAG;AACxB,GAAG,CAAC;AACJ,CAAC;AACD,CAAC,MAAM,YAAY,EAAE,CAAC,IAAI,CAAC;AAC3B,EAAE,IAAI,EAAE,uBAAuB;AAC/B,EAAE,OAAO;AACT,EAAE,WAAW,EAAE,aAAa;AAC5B,EAAE;AACF,EAAE,CAAC;AACH,CAAC,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,EAAE,KAAK,CAAC,UAAU,EAAE;AACvD,EAAE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE;AACnC,EAAE,SAAS,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE;AACjC,GAAG,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;AAC3C,IAAI,IAAI;AACR,IAAI,GAAG;AACP,IAAI,CAAC,CAAC,IAAI,CAAC;AACX,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC9C,EAAE;AACF,EAAE,IAAI;AACN,GAAG,MAAM,OAAO,GAAG,CAAC,CAAC,iCAAiC,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,aAAa,GAAG,CAAC,CAAC,+BAA+B,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;AACtK,GAAG,MAAM,YAAY,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,EAAEC,IAAM,CAAC,IAAI,CAAC,GAAG,EAAE,sBAAsB,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;AACrI,GAAG,MAAM,GAAG,GAAG,MAAM;AACrB,GAAG,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,aAAa,CAAC,YAAY,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;AACrF,GAAG,MAAM,QAAQ,GAAGA,IAAM,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,CAAC;AAC5D,GAAG,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;AAClC,IAAI,GAAG,EAAE,IAAI,CAAC,GAAG;AACjB,IAAI,GAAG,EAAE;AACT,KAAK,IAAI,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;AAClD,KAAK,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI;AAC3B,KAAK,WAAW,EAAE,IAAI,CAAC;AACvB,KAAK;AACL,IAAI,QAAQ,EAAE,IAAI;AAClB,IAAI,KAAK,EAAE;AACX,KAAK,QAAQ;AACb,KAAK,MAAM;AACX,KAAK;AACL;AACA,IAAI,CAAC;AACL,GAAG,KAAK,CAAC,KAAK,EAAE;AAChB,GAAG,4BAA4B,CAAC;AAChC,IAAI,aAAa,EAAE,IAAI,CAAC,GAAG;AAC3B,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;AACvC,IAAI,MAAM,EAAE,CAAC,GAAG,KAAK,gBAAgB,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;AACvF,IAAI,CAAC;AACL,GAAG,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM;AACpC,IAAI,IAAI;AACR,KAAK,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC;AACvD,IAAI,CAAC,CAAC,MAAM,CAAC;AACb,IAAI,SAAS,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,2CAA2C,EAAE,CAAC;AAC3E,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;AACnC,IAAI,UAAU,CAAC,KAAK,EAAE;AACtB,GAAG,CAAC,EAAE,GAAG,CAAC;AACV,GAAG,IAAI,UAAU,GAAG,KAAK;AACzB,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,KAAK;AACrC,IAAI,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;AAC7C,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE;AAC9B,KAAK,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE;AACzC,KAAK,IAAI,KAAK,EAAE,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,QAAQ,CAAC,+BAA+B,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,kCAAkC,CAAC,CAAC,EAAE;AAC5I,MAAM,UAAU,GAAG,IAAI;AACvB,MAAM,SAAS,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC9C,KAAK,CAAC,MAAM,SAAS,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7C,IAAI;AACJ,GAAG,CAAC,CAAC;AACL,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,KAAK;AACrC,IAAI,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;AAC7C,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE;AAC9B,KAAK,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE;AACzC,KAAK,IAAI,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;AAC9D,IAAI;AACJ,GAAG,CAAC,CAAC;AACL,GAAG,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK;AAC/B,IAAI,YAAY,CAAC,OAAO,CAAC;AACzB,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC;AAC3C,IAAI,UAAU,CAAC,KAAK,EAAE;AACtB,GAAG,CAAC,CAAC;AACL,GAAG,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,KAAK;AAC9B,IAAI,YAAY,CAAC,OAAO,CAAC;AACzB,IAAI,SAAS,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;AACxD,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;AACnC,IAAI,UAAU,CAAC,KAAK,EAAE;AACtB,GAAG,CAAC,CAAC;AACL,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,SAAS,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;AACxE,GAAG,SAAS,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AAClC,GAAG,UAAU,CAAC,KAAK,EAAE;AACrB,EAAE;AACF,CAAC,CAAC,EAAE,CAAC;AACL,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE;AACxC,EAAE,cAAc,EAAE,mBAAmB;AACrC,EAAE,eAAe,EAAE,UAAU;AAC7B,EAAE,UAAU,EAAE;AACd,EAAE,EAAE,CAAC;AACL;AACG,IAAC,GAAG,GAAG,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK;AAC5C,CAAC,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,CAAC;AAC5C,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,OAAO,IAAI,CAAC,MAAM,cAAc,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC;AAClJ,CAAC,IAAI,IAAI,GAAG,EAAE;AACd,CAAC,IAAI;AACL,EAAE,IAAI,GAAGC,YAAc,CAAC,aAAa,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC;AAC9E,CAAC,CAAC,CAAC,MAAM,CAAC;AACV,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE;AACtC,EAAE,cAAc,EAAE,2BAA2B;AAC7C,EAAE,eAAe,EAAE;AACnB,EAAE,EAAE,CAAC;AACL;;;;"}

package/build/server/chunks/entries/endpoints/api/admin/users/_id_/_server.ts.js-DF6Wt_rm.js

@@ -0,0 +1,52 @@
+import { f as PlatformPermissionSchema, S as SYSTEM_CONTEXT } from '../../../../../../chunks/src.js-B12bUNyu.js';
+import { b as getPermissionStore, a as getAuthProvider, d as getDataProvider, j as getEventSink, t as actorFrom } from '../../../../../../chunks/providers.server.js-BSOw3gYp.js';
+import { k as requireManageInstanceUsers, l as assertCanGrantPlatformPermissions } from '../../../../../../chunks/access.server.js-BkVI6Vou.js';
+import { a as apiError, A as ApiErrorCode } from '../../../../../../chunks/api-errors.js-C9xGTbW6.js';
+import { a as apiRoute, r as requireParams, p as parseBody, n as noContent } from '../../../../../../chunks/http.js-Ko5e-LxL.js';
+import { s as setUserPlatformPermissions } from '../../../../../../chunks/permissions.server.js-DZOQPa29.js';
+import { r as requireCanRemoveInstanceAdmin } from '../../../../../../chunks/instanceAdmins.server.js-0IpII0ZU.js';
+import { z } from 'zod';
+import '../../../../../../chunks/shared-server.js-D2MyEK0i.js';
+import '../../../../../../chunks/schema.js-BeFDxIuz.js';
+import '../../../../../../chunks/core-BQtRL5GE.js-iCpLjXCp.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '@sveltejs/kit';
+
+//#region src/routes/api/admin/users/[id]/+server.ts
+var UpdatePermissionsBody = z.object({ permissions: z.array(PlatformPermissionSchema) });
+var PATCH = apiRoute("Failed to update platform permissions", async ({ params, request, locals }) => {
+	requireManageInstanceUsers(locals);
+	const { id } = requireParams(params, "id");
+	const { permissions: platform } = await parseBody(request, UpdatePermissionsBody);
+	const existingPlatform = await getPermissionStore().getFor(locals.ctx, id);
+	assertCanGrantPlatformPermissions(locals.ctx, platform, existingPlatform);
+	const platformResult = await setUserPlatformPermissions(locals.ctx, id, platform);
+	if (platformResult === "not_found") apiError(404, ApiErrorCode.NOT_FOUND, "User not found");
+	if (platformResult === "not_supported") apiError(501, ApiErrorCode.INTERNAL, "Platform permission updates not supported by this auth provider");
+	if (platformResult === "last_admin") apiError(409, ApiErrorCode.CONFLICT, "Cannot remove the last instance admin. Promote another user to instance admin first.");
+	return noContent();
+});
+var DELETE = apiRoute("Failed to delete user", async ({ params, locals }) => {
+	requireManageInstanceUsers(locals);
+	const { id } = requireParams(params, "id");
+	await requireCanRemoveInstanceAdmin(locals.ctx, id, "delete");
+	const email = (await getAuthProvider().getUser(id))?.email;
+	const result = await getAuthProvider().deleteUser(id);
+	if (result === "not_found") apiError(404, ApiErrorCode.NOT_FOUND, "User not found");
+	if (result === "not_supported") apiError(501, ApiErrorCode.INTERNAL, "User deletion not supported by this auth provider");
+	await getDataProvider().onUserDeleted(SYSTEM_CONTEXT, id, { email });
+	await getEventSink().emit({
+		type: "user.deleted",
+		userId: id,
+		actorId: actorFrom(locals.ctx)
+	});
+	return noContent();
+});
+
+export { DELETE, PATCH };
+//# sourceMappingURL=_server.ts.js-DF6Wt_rm.js.map

package/build/server/chunks/entries/endpoints/api/admin/users/_id_/_server.ts.js-DF6Wt_rm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-DF6Wt_rm.js","sources":["../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/admin/users/_id_/_server.ts.js"],"sourcesContent":["import { k as PlatformPermissionSchema, t as SYSTEM_CONTEXT } from \"../../../../../../chunks/src.js\";\nimport { L as actorFrom, h as getPermissionStore, o as getDataProvider, r as getAuthProvider, u as getEventSink } from \"../../../../../../chunks/providers.server.js\";\nimport { n as assertCanGrantPlatformPermissions, x as requireManageInstanceUsers } from \"../../../../../../chunks/access.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../../chunks/api-errors.js\";\nimport { a as noContent, l as requireParams, o as parseBody, t as apiRoute } from \"../../../../../../chunks/http.js\";\nimport \"../../../../../../chunks/auth.server.js\";\nimport { t as setUserPlatformPermissions } from \"../../../../../../chunks/permissions.server.js\";\nimport { t as requireCanRemoveInstanceAdmin } from \"../../../../../../chunks/instanceAdmins.server.js\";\nimport { z } from \"zod\";\n//#region src/routes/api/admin/users/[id]/+server.ts\nvar UpdatePermissionsBody = z.object({ permissions: z.array(PlatformPermissionSchema) });\nvar PATCH = apiRoute(\"Failed to update platform permissions\", async ({ params, request, locals }) => {\n\trequireManageInstanceUsers(locals);\n\tconst { id } = requireParams(params, \"id\");\n\tconst { permissions: platform } = await parseBody(request, UpdatePermissionsBody);\n\tconst existingPlatform = await getPermissionStore().getFor(locals.ctx, id);\n\tassertCanGrantPlatformPermissions(locals.ctx, platform, existingPlatform);\n\tconst platformResult = await setUserPlatformPermissions(locals.ctx, id, platform);\n\tif (platformResult === \"not_found\") apiError(404, ApiErrorCode.NOT_FOUND, \"User not found\");\n\tif (platformResult === \"not_supported\") apiError(501, ApiErrorCode.INTERNAL, \"Platform permission updates not supported by this auth provider\");\n\tif (platformResult === \"last_admin\") apiError(409, ApiErrorCode.CONFLICT, \"Cannot remove the last instance admin. Promote another user to instance admin first.\");\n\treturn noContent();\n});\nvar DELETE = apiRoute(\"Failed to delete user\", async ({ params, locals }) => {\n\trequireManageInstanceUsers(locals);\n\tconst { id } = requireParams(params, \"id\");\n\tawait requireCanRemoveInstanceAdmin(locals.ctx, id, \"delete\");\n\tconst email = (await getAuthProvider().getUser(id))?.email;\n\tconst result = await getAuthProvider().deleteUser(id);\n\tif (result === \"not_found\") apiError(404, ApiErrorCode.NOT_FOUND, \"User not found\");\n\tif (result === \"not_supported\") apiError(501, ApiErrorCode.INTERNAL, \"User deletion not supported by this auth provider\");\n\tawait getDataProvider().onUserDeleted(SYSTEM_CONTEXT, id, { email });\n\tawait getEventSink().emit({\n\t\ttype: \"user.deleted\",\n\t\tuserId: id,\n\t\tactorId: actorFrom(locals.ctx)\n\t});\n\treturn noContent();\n});\n//#endregion\nexport { DELETE, PATCH };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AASA;AACA,IAAI,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,CAAC;AACrF,IAAC,KAAK,GAAG,QAAQ,CAAC,uCAAuC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AACrG,CAAC,0BAA0B,CAAC,MAAM,CAAC;AACnC,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;AAC3C,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC;AAClF,CAAC,MAAM,gBAAgB,GAAG,MAAM,kBAAkB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC;AAC3E,CAAC,iCAAiC,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,gBAAgB,CAAC;AAC1E,CAAC,MAAM,cAAc,GAAG,MAAM,0BAA0B,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,QAAQ,CAAC;AAClF,CAAC,IAAI,cAAc,KAAK,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gBAAgB,CAAC;AAC5F,CAAC,IAAI,cAAc,KAAK,eAAe,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,iEAAiE,CAAC;AAChJ,CAAC,IAAI,cAAc,KAAK,YAAY,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,sFAAsF,CAAC;AAClK,CAAC,OAAO,SAAS,EAAE;AACnB,CAAC;AACE,IAAC,MAAM,GAAG,QAAQ,CAAC,uBAAuB,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AAC7E,CAAC,0BAA0B,CAAC,MAAM,CAAC;AACnC,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;AAC3C,CAAC,MAAM,6BAA6B,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,QAAQ,CAAC;AAC9D,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,eAAe,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,KAAK;AAC3D,CAAC,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;AACtD,CAAC,IAAI,MAAM,KAAK,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gBAAgB,CAAC;AACpF,CAAC,IAAI,MAAM,KAAK,eAAe,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,mDAAmD,CAAC;AAC1H,CAAC,MAAM,eAAe,EAAE,CAAC,aAAa,CAAC,cAAc,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;AACrE,CAAC,MAAM,YAAY,EAAE,CAAC,IAAI,CAAC;AAC3B,EAAE,IAAI,EAAE,cAAc;AACtB,EAAE,MAAM,EAAE,EAAE;AACZ,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG;AAC/B,EAAE,CAAC;AACH,CAAC,OAAO,SAAS,EAAE;AACnB,CAAC;;;;"}

package/build/server/chunks/entries/endpoints/api/admin/users/_id_/disable/_server.ts.js-C8jurNYS.js

@@ -0,0 +1,61 @@
+import '../../../../../../../chunks/src.js-B12bUNyu.js';
+import { a as getAuthProvider, j as getEventSink, t as actorFrom } from '../../../../../../../chunks/providers.server.js-BSOw3gYp.js';
+import { k as requireManageInstanceUsers } from '../../../../../../../chunks/access.server.js-BkVI6Vou.js';
+import { a as apiError, A as ApiErrorCode } from '../../../../../../../chunks/api-errors.js-C9xGTbW6.js';
+import { a as apiRoute, r as requireParams, n as noContent } from '../../../../../../../chunks/http.js-Ko5e-LxL.js';
+import { s as setUserPlatformPermissions } from '../../../../../../../chunks/permissions.server.js-DZOQPa29.js';
+import { r as requireCanRemoveInstanceAdmin } from '../../../../../../../chunks/instanceAdmins.server.js-0IpII0ZU.js';
+import 'zod';
+import '../../../../../../../chunks/shared-server.js-D2MyEK0i.js';
+import '../../../../../../../chunks/schema.js-BeFDxIuz.js';
+import '../../../../../../../chunks/core-BQtRL5GE.js-iCpLjXCp.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '@sveltejs/kit';
+
+//#region src/routes/api/admin/users/[id]/disable/+server.ts
+/**
+* POST /api/admin/users/[id]/disable
+*
+* Permissions.md §10 — disable preserves identity and attribution. The §2
+* sole-`instance_admin` invariant is enforced here BEFORE the auth provider
+* disables, by consulting
+* `IPlatformPermissionStore.countInstanceAdminsExcluding`. Auth providers no
+* longer own Selva-specific authorization.
+*
+* Cutoff is not instant on every provider, and this route cannot make it so:
+* `sessionRefresh.revokeSession` takes the target's session token, which an
+* admin disabling someone else does not hold. Local and header-auth re-read the
+* user each request, so they cut off on the next one. Supabase keeps accepting
+* an already-issued access token until `revalidateMs` (default 60s) — but its
+* `refreshSession` rejects disabled users, so nothing new can be minted and the
+* window is bounded by the access token's own lifetime, not the 30-day refresh
+* token.
+*
+* No matching enable endpoint today — the auth interface is one-way for v1.
+* Re-enable lands when the spec defines an explicit re-onboarding flow.
+*/
+var POST = apiRoute("Failed to disable user", async ({ params, locals }) => {
+	requireManageInstanceUsers(locals);
+	const { id } = requireParams(params, "id");
+	const { targetIsAdmin } = await requireCanRemoveInstanceAdmin(locals.ctx, id, "disable");
+	if (targetIsAdmin) {
+		if (await setUserPlatformPermissions(locals.ctx, id, []) === "last_admin") apiError(409, ApiErrorCode.CONFLICT, "Cannot disable the last instance admin. Promote another user to instance admin first.");
+	}
+	const result = await getAuthProvider().disableUser(id);
+	if (result === "not_found") apiError(404, ApiErrorCode.NOT_FOUND, "User not found");
+	if (result === "not_supported") apiError(501, ApiErrorCode.INTERNAL, "Disabling users is not supported by this auth provider");
+	await getEventSink().emit({
+		type: "user.disabled",
+		userId: id,
+		actorId: actorFrom(locals.ctx)
+	});
+	return noContent();
+});
+
+export { POST };
+//# sourceMappingURL=_server.ts.js-C8jurNYS.js.map

package/build/server/chunks/entries/endpoints/api/admin/users/_id_/disable/_server.ts.js-C8jurNYS.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-C8jurNYS.js","sources":["../../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/admin/users/_id_/disable/_server.ts.js"],"sourcesContent":["import \"../../../../../../../chunks/src.js\";\nimport { L as actorFrom, r as getAuthProvider, u as getEventSink } from \"../../../../../../../chunks/providers.server.js\";\nimport { x as requireManageInstanceUsers } from \"../../../../../../../chunks/access.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../../../chunks/api-errors.js\";\nimport { a as noContent, l as requireParams, t as apiRoute } from \"../../../../../../../chunks/http.js\";\nimport \"../../../../../../../chunks/auth.server.js\";\nimport { t as setUserPlatformPermissions } from \"../../../../../../../chunks/permissions.server.js\";\nimport { t as requireCanRemoveInstanceAdmin } from \"../../../../../../../chunks/instanceAdmins.server.js\";\n//#region src/routes/api/admin/users/[id]/disable/+server.ts\n/**\n* POST /api/admin/users/[id]/disable\n*\n* Permissions.md §10 — disable preserves identity and attribution. The §2\n* sole-`instance_admin` invariant is enforced here BEFORE the auth provider\n* disables, by consulting\n* `IPlatformPermissionStore.countInstanceAdminsExcluding`. Auth providers no\n* longer own Selva-specific authorization.\n*\n* Cutoff is not instant on every provider, and this route cannot make it so:\n* `sessionRefresh.revokeSession` takes the target's session token, which an\n* admin disabling someone else does not hold. Local and header-auth re-read the\n* user each request, so they cut off on the next one. Supabase keeps accepting\n* an already-issued access token until `revalidateMs` (default 60s) — but its\n* `refreshSession` rejects disabled users, so nothing new can be minted and the\n* window is bounded by the access token's own lifetime, not the 30-day refresh\n* token.\n*\n* No matching enable endpoint today — the auth interface is one-way for v1.\n* Re-enable lands when the spec defines an explicit re-onboarding flow.\n*/\nvar POST = apiRoute(\"Failed to disable user\", async ({ params, locals }) => {\n\trequireManageInstanceUsers(locals);\n\tconst { id } = requireParams(params, \"id\");\n\tconst { targetIsAdmin } = await requireCanRemoveInstanceAdmin(locals.ctx, id, \"disable\");\n\tif (targetIsAdmin) {\n\t\tif (await setUserPlatformPermissions(locals.ctx, id, []) === \"last_admin\") apiError(409, ApiErrorCode.CONFLICT, \"Cannot disable the last instance admin. Promote another user to instance admin first.\");\n\t}\n\tconst result = await getAuthProvider().disableUser(id);\n\tif (result === \"not_found\") apiError(404, ApiErrorCode.NOT_FOUND, \"User not found\");\n\tif (result === \"not_supported\") apiError(501, ApiErrorCode.INTERNAL, \"Disabling users is not supported by this auth provider\");\n\tawait getEventSink().emit({\n\t\ttype: \"user.disabled\",\n\t\tuserId: id,\n\t\tactorId: actorFrom(locals.ctx)\n\t});\n\treturn noContent();\n});\n//#endregion\nexport { POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAQA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,IAAI,GAAG,QAAQ,CAAC,wBAAwB,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AAC5E,CAAC,0BAA0B,CAAC,MAAM,CAAC;AACnC,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;AAC3C,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,6BAA6B,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,SAAS,CAAC;AACzF,CAAC,IAAI,aAAa,EAAE;AACpB,EAAE,IAAI,MAAM,0BAA0B,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,YAAY,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,uFAAuF,CAAC;AAC1M,CAAC;AACD,CAAC,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;AACvD,CAAC,IAAI,MAAM,KAAK,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gBAAgB,CAAC;AACpF,CAAC,IAAI,MAAM,KAAK,eAAe,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,wDAAwD,CAAC;AAC/H,CAAC,MAAM,YAAY,EAAE,CAAC,IAAI,CAAC;AAC3B,EAAE,IAAI,EAAE,eAAe;AACvB,EAAE,MAAM,EAAE,EAAE;AACZ,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG;AAC/B,EAAE,CAAC;AACH,CAAC,OAAO,SAAS,EAAE;AACnB,CAAC;;;;"}

package/build/server/chunks/entries/endpoints/api/admin/users/_server.ts.js-DymvjhAR.js

@@ -0,0 +1,78 @@
+import { f as PlatformPermissionSchema, S as SYSTEM_CONTEXT } from '../../../../../chunks/src.js-B12bUNyu.js';
+import { a as getAuthProvider, e as getOrganizationProvider, b as getPermissionStore, j as getEventSink, t as actorFrom } from '../../../../../chunks/providers.server.js-BSOw3gYp.js';
+import { k as requireManageInstanceUsers, l as assertCanGrantPlatformPermissions } from '../../../../../chunks/access.server.js-BkVI6Vou.js';
+import { a as apiError, A as ApiErrorCode } from '../../../../../chunks/api-errors.js-C9xGTbW6.js';
+import { a as apiRoute, p as parseBody, c as created } from '../../../../../chunks/http.js-Ko5e-LxL.js';
+import { l as listAllOrgMembers } from '../../../../../chunks/org-members.server.js-6cGEao6w.js';
+import { s as setUserPlatformPermissions } from '../../../../../chunks/permissions.server.js-DZOQPa29.js';
+import { json } from '@sveltejs/kit';
+import { z } from 'zod';
+import '../../../../../chunks/shared-server.js-D2MyEK0i.js';
+import '../../../../../chunks/schema.js-BeFDxIuz.js';
+import '../../../../../chunks/core-BQtRL5GE.js-iCpLjXCp.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+
+//#region src/routes/api/admin/users/+server.ts
+var CreateUserBody = z.object({
+	email: z.string().email("Valid email is required"),
+	permissions: z.array(PlatformPermissionSchema)
+});
+var GET = apiRoute("Failed to list users", async ({ locals }) => {
+	requireManageInstanceUsers(locals);
+	const page = await getAuthProvider().listUsers({ limit: 200 });
+	if (page === null) apiError(501, ApiErrorCode.INTERNAL, "User management is not supported by the current auth provider. Configure DATA_PATH (local provider) or check your provider wiring.");
+	const orgId = locals.ctx?.actingOrgId;
+	const orgs = getOrganizationProvider();
+	const userIds = page.items.map((u) => u.id);
+	const platformByUser = await getPermissionStore().getForBatch(locals.ctx, userIds);
+	const memberByUserId = /* @__PURE__ */ new Map();
+	if (orgId) for (const m of await listAllOrgMembers(orgs, orgId)) memberByUserId.set(m.userId, m);
+	const users = page.items.map((u) => {
+		const member = memberByUserId.get(u.id);
+		return {
+			...u,
+			platformPermissions: platformByUser.get(u.id) ?? [],
+			orgRole: member?.role,
+			orgPermissions: member ? [...member.permissions] : []
+		};
+	});
+	return json({ users });
+});
+var POST = apiRoute("Failed to create user", async ({ request, locals }) => {
+	requireManageInstanceUsers(locals);
+	const auth = getAuthProvider();
+	const { email, permissions: platform } = await parseBody(request, CreateUserBody);
+	assertCanGrantPlatformPermissions(locals.ctx, platform);
+	let user;
+	if (auth.createUser) user = await auth.createUser(email);
+	else apiError(501, ApiErrorCode.INTERNAL, `${auth.name} cannot create a user directly. Send an invite instead — the recipient sets their own password.`);
+	await getEventSink().emit({
+		type: "user.created",
+		userId: user.id,
+		actorId: actorFrom(locals.ctx)
+	});
+	if (platform.length > 0) await setUserPlatformPermissions(locals.ctx, user.id, platform);
+	const orgId = locals.ctx?.actingOrgId;
+	if (orgId) {
+		const joinedAt = (/* @__PURE__ */ new Date()).toISOString();
+		await getOrganizationProvider().addOrgMember(SYSTEM_CONTEXT, {
+			orgId,
+			userId: user.id,
+			role: "member",
+			permissions: [],
+			joinedAt,
+			updatedAt: joinedAt,
+			updatedBy: locals.user?.id ?? user.id,
+			deletedAt: null
+		});
+	}
+	return created(user);
+});
+
+export { GET, POST };
+//# sourceMappingURL=_server.ts.js-DymvjhAR.js.map

package/build/server/chunks/entries/endpoints/api/admin/users/_server.ts.js-DymvjhAR.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-DymvjhAR.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/admin/users/_server.ts.js"],"sourcesContent":["import { k as PlatformPermissionSchema, t as SYSTEM_CONTEXT } from \"../../../../../chunks/src.js\";\nimport { L as actorFrom, h as getPermissionStore, m as getOrganizationProvider, r as getAuthProvider, u as getEventSink } from \"../../../../../chunks/providers.server.js\";\nimport { n as assertCanGrantPlatformPermissions, x as requireManageInstanceUsers } from \"../../../../../chunks/access.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\nimport { o as parseBody, r as created, t as apiRoute } from \"../../../../../chunks/http.js\";\nimport \"../../../../../chunks/auth.server.js\";\nimport { t as listAllOrgMembers } from \"../../../../../chunks/org-members.server.js\";\nimport { t as setUserPlatformPermissions } from \"../../../../../chunks/permissions.server.js\";\nimport { json } from \"@sveltejs/kit\";\nimport { z } from \"zod\";\n//#region src/routes/api/admin/users/+server.ts\nvar CreateUserBody = z.object({\n\temail: z.string().email(\"Valid email is required\"),\n\tpermissions: z.array(PlatformPermissionSchema)\n});\nvar GET = apiRoute(\"Failed to list users\", async ({ locals }) => {\n\trequireManageInstanceUsers(locals);\n\tconst page = await getAuthProvider().listUsers({ limit: 200 });\n\tif (page === null) apiError(501, ApiErrorCode.INTERNAL, \"User management is not supported by the current auth provider. Configure DATA_PATH (local provider) or check your provider wiring.\");\n\tconst orgId = locals.ctx?.actingOrgId;\n\tconst orgs = getOrganizationProvider();\n\tconst userIds = page.items.map((u) => u.id);\n\tconst platformByUser = await getPermissionStore().getForBatch(locals.ctx, userIds);\n\tconst memberByUserId = /* @__PURE__ */ new Map();\n\tif (orgId) for (const m of await listAllOrgMembers(orgs, orgId)) memberByUserId.set(m.userId, m);\n\tconst users = page.items.map((u) => {\n\t\tconst member = memberByUserId.get(u.id);\n\t\treturn {\n\t\t\t...u,\n\t\t\tplatformPermissions: platformByUser.get(u.id) ?? [],\n\t\t\torgRole: member?.role,\n\t\t\torgPermissions: member ? [...member.permissions] : []\n\t\t};\n\t});\n\treturn json({ users });\n});\nvar POST = apiRoute(\"Failed to create user\", async ({ request, locals }) => {\n\trequireManageInstanceUsers(locals);\n\tconst auth = getAuthProvider();\n\tconst { email, permissions: platform } = await parseBody(request, CreateUserBody);\n\tassertCanGrantPlatformPermissions(locals.ctx, platform);\n\tlet user;\n\tif (auth.createUser) user = await auth.createUser(email);\n\telse apiError(501, ApiErrorCode.INTERNAL, `${auth.name} cannot create a user directly. Send an invite instead — the recipient sets their own password.`);\n\tawait getEventSink().emit({\n\t\ttype: \"user.created\",\n\t\tuserId: user.id,\n\t\tactorId: actorFrom(locals.ctx)\n\t});\n\tif (platform.length > 0) await setUserPlatformPermissions(locals.ctx, user.id, platform);\n\tconst orgId = locals.ctx?.actingOrgId;\n\tif (orgId) {\n\t\tconst joinedAt = (/* @__PURE__ */ new Date()).toISOString();\n\t\tawait getOrganizationProvider().addOrgMember(SYSTEM_CONTEXT, {\n\t\t\torgId,\n\t\t\tuserId: user.id,\n\t\t\trole: \"member\",\n\t\t\tpermissions: [],\n\t\t\tjoinedAt,\n\t\t\tupdatedAt: joinedAt,\n\t\t\tupdatedBy: locals.user?.id ?? user.id,\n\t\t\tdeletedAt: null\n\t\t});\n\t}\n\treturn created(user);\n});\n//#endregion\nexport { GET, POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAUA;AACA,IAAI,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;AAC9B,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC;AACnD,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB;AAC9C,CAAC,CAAC;AACC,IAAC,GAAG,GAAG,QAAQ,CAAC,sBAAsB,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AACjE,CAAC,0BAA0B,CAAC,MAAM,CAAC;AACnC,CAAC,MAAM,IAAI,GAAG,MAAM,eAAe,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AAC/D,CAAC,IAAI,IAAI,KAAK,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,oIAAoI,CAAC;AAC9L,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,WAAW;AACtC,CAAC,MAAM,IAAI,GAAG,uBAAuB,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC,MAAM,cAAc,GAAG,MAAM,kBAAkB,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC;AACnF,CAAC,MAAM,cAAc,mBAAmB,IAAI,GAAG,EAAE;AACjD,CAAC,IAAI,KAAK,EAAE,KAAK,MAAM,CAAC,IAAI,MAAM,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACjG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK;AACrC,EAAE,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AACzC,EAAE,OAAO;AACT,GAAG,GAAG,CAAC;AACP,GAAG,mBAAmB,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE;AACtD,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI;AACxB,GAAG,cAAc,EAAE,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG;AACtD,GAAG;AACH,CAAC,CAAC,CAAC;AACH,CAAC,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC;AACvB,CAAC;AACE,IAAC,IAAI,GAAG,QAAQ,CAAC,uBAAuB,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AAC5E,CAAC,0BAA0B,CAAC,MAAM,CAAC;AACnC,CAAC,MAAM,IAAI,GAAG,eAAe,EAAE;AAC/B,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC;AAClF,CAAC,iCAAiC,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC;AACxD,CAAC,IAAI,IAAI;AACT,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;AACzD,MAAM,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,+FAA+F,CAAC,CAAC;AACzJ,CAAC,MAAM,YAAY,EAAE,CAAC,IAAI,CAAC;AAC3B,EAAE,IAAI,EAAE,cAAc;AACtB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;AACjB,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG;AAC/B,EAAE,CAAC;AACH,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,MAAM,0BAA0B,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC;AACzF,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,WAAW;AACtC,CAAC,IAAI,KAAK,EAAE;AACZ,EAAE,MAAM,QAAQ,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AAC7D,EAAE,MAAM,uBAAuB,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE;AAC/D,GAAG,KAAK;AACR,GAAG,MAAM,EAAE,IAAI,CAAC,EAAE;AAClB,GAAG,IAAI,EAAE,QAAQ;AACjB,GAAG,WAAW,EAAE,EAAE;AAClB,GAAG,QAAQ;AACX,GAAG,SAAS,EAAE,QAAQ;AACtB,GAAG,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI,CAAC,EAAE;AACxC,GAAG,SAAS,EAAE;AACd,GAAG,CAAC;AACJ,CAAC;AACD,CAAC,OAAO,OAAO,CAAC,IAAI,CAAC;AACrB,CAAC;;;;"}

package/build/server/chunks/entries/endpoints/api/diag/throughput/_server.ts.js-DKVXMxKt.js

@@ -0,0 +1,58 @@
+import { a as apiError, A as ApiErrorCode } from '../../../../../chunks/api-errors.js-C9xGTbW6.js';
+import { C as COMPUTE_DEBUG } from '../../../../../chunks/engine.server.js-mhYrAc3B.js';
+import { randomFillSync } from 'node:crypto';
+import '../../../../../chunks/src.js-B12bUNyu.js';
+import 'zod';
+import '../../../../../chunks/providers.server.js-BSOw3gYp.js';
+import '../../../../../chunks/shared-server.js-D2MyEK0i.js';
+import '../../../../../chunks/schema.js-BeFDxIuz.js';
+import '../../../../../chunks/core-BQtRL5GE.js-iCpLjXCp.js';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '@sveltejs/kit';
+import '../../../../../chunks/computeLimits.js-DPlUBeVz.js';
+import 'node:dns/promises';
+import 'node:net';
+import 'node:zlib';
+import 'node:util';
+
+//#region src/routes/api/diag/throughput/+server.ts
+var CHUNK_BYTES = 1048576;
+var DEFAULT_MB = 20;
+var MAX_MB = 64;
+var GET = async ({ locals, url }) => {
+	if (!COMPUTE_DEBUG) apiError(404, ApiErrorCode.NOT_FOUND, "Not found");
+	if (!locals.user) apiError(401, ApiErrorCode.UNAUTHORIZED, "Unauthorized");
+	const requested = Number(url.searchParams.get("mb"));
+	const mb = Math.min(MAX_MB, Math.max(1, Number.isFinite(requested) ? requested : DEFAULT_MB));
+	let sentChunks = 0;
+	const start = performance.now();
+	const stream = new ReadableStream({ pull(controller) {
+		if (sentChunks >= mb) {
+			controller.close();
+			const secs = (performance.now() - start) / 1e3;
+			locals.log.debug("Streamed throughput probe (server-side view)", {
+				component: "Compute/diag",
+				megabytes: mb,
+				durationSec: Number(secs.toFixed(1)),
+				throughputMbPerSec: Number((mb / secs).toFixed(1))
+			});
+			return;
+		}
+		const chunk = new Uint8Array(CHUNK_BYTES);
+		randomFillSync(chunk);
+		controller.enqueue(chunk);
+		sentChunks++;
+	} });
+	return new Response(stream, { headers: {
+		"Content-Type": "application/octet-stream",
+		"Content-Length": String(mb * CHUNK_BYTES),
+		"Cache-Control": "no-store"
+	} });
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts.js-DKVXMxKt.js.map

package/build/server/chunks/entries/endpoints/api/diag/throughput/_server.ts.js-DKVXMxKt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-DKVXMxKt.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/diag/throughput/_server.ts.js"],"sourcesContent":["import { n as apiError, t as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\nimport { t as COMPUTE_DEBUG } from \"../../../../../chunks/engine.server.js\";\nimport { randomFillSync } from \"node:crypto\";\n//#region src/routes/api/diag/throughput/+server.ts\nvar CHUNK_BYTES = 1048576;\nvar DEFAULT_MB = 20;\nvar MAX_MB = 64;\nvar GET = async ({ locals, url }) => {\n\tif (!COMPUTE_DEBUG) apiError(404, ApiErrorCode.NOT_FOUND, \"Not found\");\n\tif (!locals.user) apiError(401, ApiErrorCode.UNAUTHORIZED, \"Unauthorized\");\n\tconst requested = Number(url.searchParams.get(\"mb\"));\n\tconst mb = Math.min(MAX_MB, Math.max(1, Number.isFinite(requested) ? requested : DEFAULT_MB));\n\tlet sentChunks = 0;\n\tconst start = performance.now();\n\tconst stream = new ReadableStream({ pull(controller) {\n\t\tif (sentChunks >= mb) {\n\t\t\tcontroller.close();\n\t\t\tconst secs = (performance.now() - start) / 1e3;\n\t\t\tlocals.log.debug(\"Streamed throughput probe (server-side view)\", {\n\t\t\t\tcomponent: \"Compute/diag\",\n\t\t\t\tmegabytes: mb,\n\t\t\t\tdurationSec: Number(secs.toFixed(1)),\n\t\t\t\tthroughputMbPerSec: Number((mb / secs).toFixed(1))\n\t\t\t});\n\t\t\treturn;\n\t\t}\n\t\tconst chunk = new Uint8Array(CHUNK_BYTES);\n\t\trandomFillSync(chunk);\n\t\tcontroller.enqueue(chunk);\n\t\tsentChunks++;\n\t} });\n\treturn new Response(stream, { headers: {\n\t\t\"Content-Type\": \"application/octet-stream\",\n\t\t\"Content-Length\": String(mb * CHUNK_BYTES),\n\t\t\"Cache-Control\": \"no-store\"\n\t} });\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAGA;AACA,IAAI,WAAW,GAAG,OAAO;AACzB,IAAI,UAAU,GAAG,EAAE;AACnB,IAAI,MAAM,GAAG,EAAE;AACZ,IAAC,GAAG,GAAG,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK;AACrC,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,WAAW,CAAC;AACvE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC;AAC3E,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACrD,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,SAAS,GAAG,UAAU,CAAC,CAAC;AAC9F,CAAC,IAAI,UAAU,GAAG,CAAC;AACnB,CAAC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;AAChC,CAAC,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE;AACtD,EAAE,IAAI,UAAU,IAAI,EAAE,EAAE;AACxB,GAAG,UAAU,CAAC,KAAK,EAAE;AACrB,GAAG,MAAM,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG;AACjD,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,8CAA8C,EAAE;AACpE,IAAI,SAAS,EAAE,cAAc;AAC7B,IAAI,SAAS,EAAE,EAAE;AACjB,IAAI,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACxC,IAAI,kBAAkB,EAAE,MAAM,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;AACrD,IAAI,CAAC;AACL,GAAG;AACH,EAAE;AACF,EAAE,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC;AAC3C,EAAE,cAAc,CAAC,KAAK,CAAC;AACvB,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;AAC3B,EAAE,UAAU,EAAE;AACd,CAAC,CAAC,EAAE,CAAC;AACL,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE;AACxC,EAAE,cAAc,EAAE,0BAA0B;AAC5C,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,GAAG,WAAW,CAAC;AAC5C,EAAE,eAAe,EAAE;AACnB,EAAE,EAAE,CAAC;AACL;;;;"}

package/build/server/chunks/entries/endpoints/api/files/_...path_/_server.ts.js-DtiAglAN.js

@@ -0,0 +1,87 @@
+import { c as classifyAssetPath, G as GuidSchema, i as COVER_IMAGE_CONTENT_TYPES } from '../../../../../chunks/src.js-B12bUNyu.js';
+import { o as getDefinitionMeta, I as definitionPaths, A as getStorageProvider } from '../../../../../chunks/providers.server.js-BSOw3gYp.js';
+import { m as requireCanViewProject, n as requireCanViewOrg } from '../../../../../chunks/access.server.js-BkVI6Vou.js';
+import { a as apiError, A as ApiErrorCode } from '../../../../../chunks/api-errors.js-C9xGTbW6.js';
+import 'zod';
+import '../../../../../chunks/shared-server.js-D2MyEK0i.js';
+import '../../../../../chunks/schema.js-BeFDxIuz.js';
+import '../../../../../chunks/core-BQtRL5GE.js-iCpLjXCp.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '@sveltejs/kit';
+
+//#region src/routes/api/files/[...path]/+server.ts
+/**
+* Authenticated/­public blob proxy. The set of servable paths is the closed
+* asset-class registry (`classifyAssetPath` / `ASSET_CLASSES` in
+* `@selvajs/platform`). Each class declares a visibility; this route maps that
+* visibility to an authorization check:
+*
+*   - `public`  (org branding — logo/favicon): served to anyone, incl.
+*     logged-out visitors, with no auth. Cacheable. The bytes are always a
+*     rasterized WebP, so there is no XSS surface to gate.
+*   - `org`     (org-private blobs, e.g. pricing sheets under
+*     `orgs/{id}/private/*`): `requireCanViewOrg(orgId)`.
+*   - `project` (definition covers): `requireCanViewProject(projectId)` — the
+*     M5 hardening, unchanged.
+*
+* Anything that classifies to no asset class 404s. New blob types are opt-in:
+* add a registry entry with the right visibility — never a generic
+* "is the extension allowed" fallthrough. Authorization lives here (the route),
+* not in the storage layer, per `IStorageProvider`'s contract.
+*
+* Why a single proxy for all three: with the registry, the route is no longer a
+* pile of per-shape branches — it classifies once and dispatches on visibility,
+* so the cover-only contract that this route used to pin now generalizes
+* without re-opening the M5 hole.
+*/
+var CONTENT_TYPE_BY_EXT = {
+	...COVER_IMAGE_CONTENT_TYPES,
+	".pdf": "application/pdf"
+};
+function contentTypeFor(storagePath) {
+	const dot = storagePath.lastIndexOf(".");
+	return CONTENT_TYPE_BY_EXT[dot === -1 ? "" : storagePath.slice(dot).toLowerCase()] ?? "application/octet-stream";
+}
+var GET = async ({ params, locals }) => {
+	const storagePath = params.path;
+	if (!storagePath) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Missing path");
+	const match = classifyAssetPath(storagePath);
+	if (!match) apiError(404, ApiErrorCode.NOT_FOUND, "File not found");
+	let canonicalPath = storagePath;
+	switch (match.class.visibility) {
+		case "public": break;
+		case "org": {
+			if (!locals.ctx) apiError(401, ApiErrorCode.UNAUTHORIZED, "Unauthorized");
+			const orgId = match.scopeId;
+			if (!orgId) apiError(404, ApiErrorCode.NOT_FOUND, "File not found");
+			await requireCanViewOrg(locals, orgId);
+			break;
+		}
+		case "project": {
+			if (!locals.ctx) apiError(401, ApiErrorCode.UNAUTHORIZED, "Unauthorized");
+			const guid = match.scopeId;
+			const guidParsed = GuidSchema.safeParse(guid);
+			if (!guidParsed.success) apiError(404, ApiErrorCode.NOT_FOUND, "File not found");
+			const record = await getDefinitionMeta().get(locals.ctx, guidParsed.data);
+			if (!record) apiError(404, ApiErrorCode.NOT_FOUND, "File not found");
+			await requireCanViewProject(locals, record.projectId);
+			canonicalPath = definitionPaths.image(guidParsed.data);
+			break;
+		}
+	}
+	const bytes = await getStorageProvider().get(canonicalPath);
+	if (!bytes) apiError(404, ApiErrorCode.NOT_FOUND, "File not found");
+	const cacheControl = match.class.visibility === "public" ? "public, max-age=3600" : "private, max-age=3600";
+	return new Response(Buffer.from(bytes), { headers: {
+		"Content-Type": contentTypeFor(canonicalPath),
+		"Cache-Control": cacheControl
+	} });
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts.js-DtiAglAN.js.map

package/build/server/chunks/entries/endpoints/api/files/_...path_/_server.ts.js-DtiAglAN.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-DtiAglAN.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/files/_...path_/_server.ts.js"],"sourcesContent":["import { a as classifyAssetPath, f as COVER_IMAGE_CONTENT_TYPES, l as GuidSchema } from \"../../../../../chunks/src.js\";\nimport { G as definitionPaths, b as getStorageProvider, s as getDefinitionMeta } from \"../../../../../chunks/providers.server.js\";\nimport { _ as requireCanViewProject, g as requireCanViewOrg } from \"../../../../../chunks/access.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\n//#region src/routes/api/files/[...path]/+server.ts\n/**\n* Authenticated/­public blob proxy. The set of servable paths is the closed\n* asset-class registry (`classifyAssetPath` / `ASSET_CLASSES` in\n* `@selvajs/platform`). Each class declares a visibility; this route maps that\n* visibility to an authorization check:\n*\n*   - `public`  (org branding — logo/favicon): served to anyone, incl.\n*     logged-out visitors, with no auth. Cacheable. The bytes are always a\n*     rasterized WebP, so there is no XSS surface to gate.\n*   - `org`     (org-private blobs, e.g. pricing sheets under\n*     `orgs/{id}/private/*`): `requireCanViewOrg(orgId)`.\n*   - `project` (definition covers): `requireCanViewProject(projectId)` — the\n*     M5 hardening, unchanged.\n*\n* Anything that classifies to no asset class 404s. New blob types are opt-in:\n* add a registry entry with the right visibility — never a generic\n* \"is the extension allowed\" fallthrough. Authorization lives here (the route),\n* not in the storage layer, per `IStorageProvider`'s contract.\n*\n* Why a single proxy for all three: with the registry, the route is no longer a\n* pile of per-shape branches — it classifies once and dispatches on visibility,\n* so the cover-only contract that this route used to pin now generalizes\n* without re-opening the M5 hole.\n*/\nvar CONTENT_TYPE_BY_EXT = {\n\t...COVER_IMAGE_CONTENT_TYPES,\n\t\".pdf\": \"application/pdf\"\n};\nfunction contentTypeFor(storagePath) {\n\tconst dot = storagePath.lastIndexOf(\".\");\n\treturn CONTENT_TYPE_BY_EXT[dot === -1 ? \"\" : storagePath.slice(dot).toLowerCase()] ?? \"application/octet-stream\";\n}\nvar GET = async ({ params, locals }) => {\n\tconst storagePath = params.path;\n\tif (!storagePath) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing path\");\n\tconst match = classifyAssetPath(storagePath);\n\tif (!match) apiError(404, ApiErrorCode.NOT_FOUND, \"File not found\");\n\tlet canonicalPath = storagePath;\n\tswitch (match.class.visibility) {\n\t\tcase \"public\": break;\n\t\tcase \"org\": {\n\t\t\tif (!locals.ctx) apiError(401, ApiErrorCode.UNAUTHORIZED, \"Unauthorized\");\n\t\t\tconst orgId = match.scopeId;\n\t\t\tif (!orgId) apiError(404, ApiErrorCode.NOT_FOUND, \"File not found\");\n\t\t\tawait requireCanViewOrg(locals, orgId);\n\t\t\tbreak;\n\t\t}\n\t\tcase \"project\": {\n\t\t\tif (!locals.ctx) apiError(401, ApiErrorCode.UNAUTHORIZED, \"Unauthorized\");\n\t\t\tconst guid = match.scopeId;\n\t\t\tconst guidParsed = GuidSchema.safeParse(guid);\n\t\t\tif (!guidParsed.success) apiError(404, ApiErrorCode.NOT_FOUND, \"File not found\");\n\t\t\tconst record = await getDefinitionMeta().get(locals.ctx, guidParsed.data);\n\t\t\tif (!record) apiError(404, ApiErrorCode.NOT_FOUND, \"File not found\");\n\t\t\tawait requireCanViewProject(locals, record.projectId);\n\t\t\tcanonicalPath = definitionPaths.image(guidParsed.data);\n\t\t\tbreak;\n\t\t}\n\t}\n\tconst bytes = await getStorageProvider().get(canonicalPath);\n\tif (!bytes) apiError(404, ApiErrorCode.NOT_FOUND, \"File not found\");\n\tconst cacheControl = match.class.visibility === \"public\" ? \"public, max-age=3600\" : \"private, max-age=3600\";\n\treturn new Response(Buffer.from(bytes), { headers: {\n\t\t\"Content-Type\": contentTypeFor(canonicalPath),\n\t\t\"Cache-Control\": cacheControl\n\t} });\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,mBAAmB,GAAG;AAC1B,CAAC,GAAG,yBAAyB;AAC7B,CAAC,MAAM,EAAE;AACT,CAAC;AACD,SAAS,cAAc,CAAC,WAAW,EAAE;AACrC,CAAC,MAAM,GAAG,GAAG,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC;AACzC,CAAC,OAAO,mBAAmB,CAAC,GAAG,KAAK,EAAE,GAAG,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,0BAA0B;AACjH;AACG,IAAC,GAAG,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AACxC,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI;AAChC,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,cAAc,CAAC;AAChF,CAAC,MAAM,KAAK,GAAG,iBAAiB,CAAC,WAAW,CAAC;AAC7C,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gBAAgB,CAAC;AACpE,CAAC,IAAI,aAAa,GAAG,WAAW;AAChC,CAAC,QAAQ,KAAK,CAAC,KAAK,CAAC,UAAU;AAC/B,EAAE,KAAK,QAAQ,EAAE;AACjB,EAAE,KAAK,KAAK,EAAE;AACd,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC;AAC5E,GAAG,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO;AAC9B,GAAG,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gBAAgB,CAAC;AACtE,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC;AACzC,GAAG;AACH,EAAE;AACF,EAAE,KAAK,SAAS,EAAE;AAClB,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC;AAC5E,GAAG,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO;AAC7B,GAAG,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC;AAChD,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gBAAgB,CAAC;AACnF,GAAG,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC;AAC5E,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gBAAgB,CAAC;AACvE,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC;AACxD,GAAG,aAAa,GAAG,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;AACzD,GAAG;AACH,EAAE;AACF;AACA,CAAC,MAAM,KAAK,GAAG,MAAM,kBAAkB,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC;AAC5D,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gBAAgB,CAAC;AACpE,CAAC,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,KAAK,QAAQ,GAAG,sBAAsB,GAAG,uBAAuB;AAC5G,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE;AACpD,EAAE,cAAc,EAAE,cAAc,CAAC,aAAa,CAAC;AAC/C,EAAE,eAAe,EAAE;AACnB,EAAE,EAAE,CAAC;AACL;;;;"}

package/build/server/chunks/entries/endpoints/api/health/_server.ts.js-DwXYmEJL.js

@@ -0,0 +1,56 @@
+import { g as getBootHealth, i as isDegraded } from '../../../../chunks/bootHealth.server.js-Bt3mvZRa.js';
+import { json } from '@sveltejs/kit';
+import { randomUUID } from 'crypto';
+import { createRequire } from 'module';
+import '../../../../chunks/providers.server.js-BSOw3gYp.js';
+import '../../../../chunks/shared-server.js-D2MyEK0i.js';
+import '../../../../chunks/src.js-B12bUNyu.js';
+import 'zod';
+import '../../../../chunks/schema.js-BeFDxIuz.js';
+import '../../../../chunks/core-BQtRL5GE.js-iCpLjXCp.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+
+//#region src/routes/api/health/+server.ts
+var INSTANCE_ID = randomUUID();
+var RUNTIME_VERSION = (() => {
+	try {
+		return createRequire(import.meta.url)("@selvajs/selva/package.json").version;
+	} catch {
+		return null;
+	}
+})();
+/**
+* Health check endpoint for load balancers and orchestration systems.
+* Used by Docker healthchecks, Kubernetes liveness probes, and monitoring tools.
+*
+* The `instanceId` field is a per-boot fingerprint — clients polling after a
+* restart confirm the *new* process is responding (not the old one about to be
+* killed) by watching for the value to change.
+*
+* Returns 503 with `status: "degraded"` when boot-time integrity checks
+* failed (e.g. compute server apiKeys can't be decrypted under the current
+* `SELVA_AT_REST_KEY`). The body lists which servers and why, so an operator
+* curling the endpoint can diagnose without server-log access. The app
+* still serves requests in this state (per-row tolerance) — the 503 is
+* specifically a signal for load balancers / monitoring.
+*/
+var GET = async () => {
+	const boot = await getBootHealth();
+	const degraded = isDegraded(boot);
+	const body = {
+		status: degraded ? "degraded" : "ok",
+		timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+		instanceId: INSTANCE_ID,
+		version: RUNTIME_VERSION,
+		boot
+	};
+	return json(body, { status: degraded ? 503 : 200 });
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts.js-DwXYmEJL.js.map

package/build/server/chunks/entries/endpoints/api/health/_server.ts.js-DwXYmEJL.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-DwXYmEJL.js","sources":["../../../../../../../.svelte-kit/output/server/entries/endpoints/api/health/_server.ts.js"],"sourcesContent":["import { n as isDegraded, t as getBootHealth } from \"../../../../chunks/bootHealth.server.js\";\nimport { json } from \"@sveltejs/kit\";\nimport { randomUUID } from \"crypto\";\nimport { createRequire } from \"module\";\n//#region src/routes/api/health/+server.ts\nvar INSTANCE_ID = randomUUID();\nvar RUNTIME_VERSION = (() => {\n\ttry {\n\t\treturn createRequire(import.meta.url)(\"@selvajs/selva/package.json\").version;\n\t} catch {\n\t\treturn null;\n\t}\n})();\n/**\n* Health check endpoint for load balancers and orchestration systems.\n* Used by Docker healthchecks, Kubernetes liveness probes, and monitoring tools.\n*\n* The `instanceId` field is a per-boot fingerprint — clients polling after a\n* restart confirm the *new* process is responding (not the old one about to be\n* killed) by watching for the value to change.\n*\n* Returns 503 with `status: \"degraded\"` when boot-time integrity checks\n* failed (e.g. compute server apiKeys can't be decrypted under the current\n* `SELVA_AT_REST_KEY`). The body lists which servers and why, so an operator\n* curling the endpoint can diagnose without server-log access. The app\n* still serves requests in this state (per-row tolerance) — the 503 is\n* specifically a signal for load balancers / monitoring.\n*/\nvar GET = async () => {\n\tconst boot = await getBootHealth();\n\tconst degraded = isDegraded(boot);\n\tconst body = {\n\t\tstatus: degraded ? \"degraded\" : \"ok\",\n\t\ttimestamp: (/* @__PURE__ */ new Date()).toISOString(),\n\t\tinstanceId: INSTANCE_ID,\n\t\tversion: RUNTIME_VERSION,\n\t\tboot\n\t};\n\treturn json(body, { status: degraded ? 503 : 200 });\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAIA;AACA,IAAI,WAAW,GAAG,UAAU,EAAE;AAC9B,IAAI,eAAe,GAAG,CAAC,MAAM;AAC7B,CAAC,IAAI;AACL,EAAE,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,6BAA6B,CAAC,CAAC,OAAO;AAC9E,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,IAAI;AACb,CAAC;AACD,CAAC,GAAG;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,GAAG,GAAG,YAAY;AACtB,CAAC,MAAM,IAAI,GAAG,MAAM,aAAa,EAAE;AACnC,CAAC,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC;AAClC,CAAC,MAAM,IAAI,GAAG;AACd,EAAE,MAAM,EAAE,QAAQ,GAAG,UAAU,GAAG,IAAI;AACtC,EAAE,SAAS,EAAE,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACvD,EAAE,UAAU,EAAE,WAAW;AACzB,EAAE,OAAO,EAAE,eAAe;AAC1B,EAAE;AACF,EAAE;AACF,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,GAAG,GAAG,GAAG,GAAG,EAAE,CAAC;AACpD;;;;"}

package/build/server/chunks/entries/endpoints/api/health/ready/_server.ts.js-iaUXey0e.js

@@ -0,0 +1,59 @@
+import { p as providers } from '../../../../../chunks/providers.server.js-BSOw3gYp.js';
+import { json } from '@sveltejs/kit';
+import '../../../../../chunks/shared-server.js-D2MyEK0i.js';
+import '../../../../../chunks/src.js-B12bUNyu.js';
+import 'zod';
+import '../../../../../chunks/schema.js-BeFDxIuz.js';
+import '../../../../../chunks/core-BQtRL5GE.js-iCpLjXCp.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+
+//#region src/routes/api/health/ready/+server.ts
+/**
+* Readiness probe: can this process serve a real route right now?
+*
+* Distinct from the two health endpoints on either side of it:
+*
+*   • `/api/health` is *liveness*. It answers the instant the Node process
+*     boots, before the provider stores have necessarily been touched — so a
+*     200 there does not mean a real request would succeed. That gap is what
+*     let the post-update UI report "back online" while a click a moment later
+*     hit a 502 through the proxy.
+*   • `/api/admin/system/health` is a *diagnostic*. It re-runs live integrity
+*     checks including a ping of the default Rhino.Compute server, so it
+*     reports non-ok whenever an unrelated dependency is down and can take
+*     ~10s. Neither property is acceptable in a probe something waits on.
+*
+* So this route does the smallest thing that proves real request handling: one
+* read through the data provider, the same call the auth hook makes on every
+* gated request. If the provider is wired and its store is reachable, routes
+* serve. It deliberately touches NOTHING external — no compute server, no
+* network — because an unreachable compute server does not make this app
+* unready, and a probe that conflates the two can never go green on a
+* deployment whose compute is down.
+*
+* Public and unauthenticated (the update poller runs it across a restart, when
+* no session is guaranteed) and safe to be: the body carries a boolean and a
+* fixed reason string, never provider data or counts.
+*/
+var GET = async () => {
+	try {
+		await providers.auth.listUsers({ limit: 1 });
+		return json({ ready: true }, { headers: { "Cache-Control": "no-store" } });
+	} catch {
+		return json({
+			ready: false,
+			reason: "data provider unavailable"
+		}, {
+			status: 503,
+			headers: { "Cache-Control": "no-store" }
+		});
+	}
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts.js-iaUXey0e.js.map