@selvajs/selva 4.12.0 → 4.13.1

package/build/server/chunks/entries/endpoints/api/v1/projects/_id_/reclaim/_server.ts.js-DalPfc2w.js

@@ -0,0 +1,49 @@
+import '../../../../../../../chunks/src.js-B12bUNyu.js';
+import { f as getProjectProvider, j as getEventSink, t as actorFrom } from '../../../../../../../chunks/providers.server.js-CDqkW_tD.js';
+import { G as requireCanReclaim } from '../../../../../../../chunks/access.server.js-D97gA9Wx.js';
+import { a as apiRoute, r as requireParams, c as created } from '../../../../../../../chunks/http.js-C3NaIXq1.js';
+import 'zod';
+import '../../../../../../../chunks/shared-server.js-BZy9KN6u.js';
+import '../../../../../../../chunks/schema.js-BVfByvmD.js';
+import '../../../../../../../chunks/core-BQtRL5GE.js-B9MmO4om.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '../../../../../../../chunks/api-errors.js-_5LnpWlS.js';
+import '@sveltejs/kit';
+
+//#region src/routes/api/v1/projects/[id]/reclaim/+server.ts
+/**
+* Org owner/admin escape hatch. Adds the actor as a co-owner and does NOT
+* demote the existing owner. Idempotent: reclaiming twice is a no-op, because
+* `addProjectMember` reactivates a soft-deleted row in place.
+*/
+var POST = apiRoute("Failed to reclaim project", async ({ params, locals }) => {
+	const { id } = requireParams(params, "id");
+	const { user, ctx, project } = await requireCanReclaim(locals, id);
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const member = {
+		projectId: id,
+		userId: user.id,
+		role: "owner",
+		joinedAt: now,
+		updatedAt: now,
+		updatedBy: ctx.userId || user.id,
+		deletedAt: null
+	};
+	await getProjectProvider().addProjectMember(ctx, member);
+	await getEventSink().emit({
+		type: "project.reclaimed",
+		projectId: id,
+		orgId: project.orgId,
+		actorId: actorFrom(ctx),
+		priorVisibility: project.visibility
+	});
+	return created({ member });
+});
+
+export { POST };
+//# sourceMappingURL=_server.ts.js-DalPfc2w.js.map

package/build/server/chunks/entries/endpoints/api/v1/projects/_id_/reclaim/_server.ts.js-DalPfc2w.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-DalPfc2w.js","sources":["../../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/v1/projects/_id_/reclaim/_server.ts.js"],"sourcesContent":["import \"../../../../../../../chunks/src.js\";\nimport { L as actorFrom, _ as getProjectProvider, u as getEventSink } from \"../../../../../../../chunks/providers.server.js\";\nimport { m as requireCanReclaim } from \"../../../../../../../chunks/access.server.js\";\nimport { l as requireParams, r as created, t as apiRoute } from \"../../../../../../../chunks/http.js\";\nimport \"../../../../../../../chunks/route.js\";\n//#region src/routes/api/v1/projects/[id]/reclaim/+server.ts\n/**\n* Org owner/admin escape hatch. Adds the actor as a co-owner and does NOT\n* demote the existing owner. Idempotent: reclaiming twice is a no-op, because\n* `addProjectMember` reactivates a soft-deleted row in place.\n*/\nvar POST = apiRoute(\"Failed to reclaim project\", async ({ params, locals }) => {\n\tconst { id } = requireParams(params, \"id\");\n\tconst { user, ctx, project } = await requireCanReclaim(locals, id);\n\tconst now = (/* @__PURE__ */ new Date()).toISOString();\n\tconst member = {\n\t\tprojectId: id,\n\t\tuserId: user.id,\n\t\trole: \"owner\",\n\t\tjoinedAt: now,\n\t\tupdatedAt: now,\n\t\tupdatedBy: ctx.userId || user.id,\n\t\tdeletedAt: null\n\t};\n\tawait getProjectProvider().addProjectMember(ctx, member);\n\tawait getEventSink().emit({\n\t\ttype: \"project.reclaimed\",\n\t\tprojectId: id,\n\t\torgId: project.orgId,\n\t\tactorId: actorFrom(ctx),\n\t\tpriorVisibility: project.visibility\n\t});\n\treturn created({ member });\n});\n//#endregion\nexport { POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAKA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,IAAI,GAAG,QAAQ,CAAC,2BAA2B,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AAC/E,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;AAC3C,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,EAAE,CAAC;AACnE,CAAC,MAAM,GAAG,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACvD,CAAC,MAAM,MAAM,GAAG;AAChB,EAAE,SAAS,EAAE,EAAE;AACf,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;AACjB,EAAE,IAAI,EAAE,OAAO;AACf,EAAE,QAAQ,EAAE,GAAG;AACf,EAAE,SAAS,EAAE,GAAG;AAChB,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE;AAClC,EAAE,SAAS,EAAE;AACb,EAAE;AACF,CAAC,MAAM,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC;AACzD,CAAC,MAAM,YAAY,EAAE,CAAC,IAAI,CAAC;AAC3B,EAAE,IAAI,EAAE,mBAAmB;AAC3B,EAAE,SAAS,EAAE,EAAE;AACf,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK;AACtB,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC;AACzB,EAAE,eAAe,EAAE,OAAO,CAAC;AAC3B,EAAE,CAAC;AACH,CAAC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;;;;"}

package/build/server/chunks/entries/endpoints/api/v1/projects/_server.ts.js-DO4hjl9Q.js

@@ -0,0 +1,67 @@
+import { h as hasPermission, v as validateProjectFlags } from '../../../../../chunks/src.js-B12bUNyu.js';
+import { f as getProjectProvider } from '../../../../../chunks/providers.server.js-CDqkW_tD.js';
+import { y as requireCanCreateProject } from '../../../../../chunks/access.server.js-D97gA9Wx.js';
+import { a as apiError, A as ApiErrorCode } from '../../../../../chunks/api-errors.js-_5LnpWlS.js';
+import { a as apiRoute, b as requireCaller, d as collection, p as parseBody, c as created } from '../../../../../chunks/http.js-C3NaIXq1.js';
+import { c as createProjectWithUniqueSlug } from '../../../../../chunks/createProject.server.js-BZ_Vw25L.js';
+import { r as resolveAccessibleProjects } from '../../../../../chunks/visibility.server.js-gZNXes6B.js';
+import { a as parseListOptions } from '../../../../../chunks/pagination.server.js-CtQ_3Is9.js';
+import { C as CreateProjectBodySchema } from '../../../../../chunks/bodies.js-C9rGU8lD.js';
+import { randomUUID } from 'node:crypto';
+import 'zod';
+import '../../../../../chunks/shared-server.js-BZy9KN6u.js';
+import '../../../../../chunks/schema.js-BVfByvmD.js';
+import '../../../../../chunks/core-BQtRL5GE.js-B9MmO4om.js';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '@sveltejs/kit';
+
+//#region src/routes/api/v1/projects/+server.ts
+var GET = apiRoute("Failed to list projects", async ({ locals, url }) => {
+	const { ctx } = requireCaller(locals);
+	const { projects } = await resolveAccessibleProjects(ctx);
+	const { limit, cursor } = parseListOptions(url);
+	const start = cursor ? Number(cursor) : 0;
+	if (!Number.isInteger(start) || start < 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Invalid cursor");
+	const items = projects.slice(start, start + (limit ?? projects.length));
+	const nextIndex = start + items.length;
+	return collection({
+		items,
+		nextCursor: nextIndex < projects.length ? String(nextIndex) : void 0
+	});
+});
+var POST = apiRoute("Failed to create project", async ({ request, locals }) => {
+	const ctx = locals.ctx;
+	if (!ctx.actingOrgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, "No active organization");
+	await requireCanCreateProject(locals, ctx.actingOrgId);
+	const input = await parseBody(request, CreateProjectBodySchema);
+	if (input.visibility === "platform" && !hasPermission(ctx, "instance_admin")) apiError(403, ApiErrorCode.FORBIDDEN, "Only a platform admin can create a project with platform visibility.");
+	const autoJoinOnUpload = input.autoJoinOnUpload ?? false;
+	const flagIssues = validateProjectFlags({
+		visibility: input.visibility,
+		autoJoinOnUpload
+	});
+	if (flagIssues.length > 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, flagIssues.map((i) => `${i.path}: ${i.message}`).join("; "));
+	const project = await createProjectWithUniqueSlug(getProjectProvider(), {
+		id: randomUUID(),
+		orgId: ctx.actingOrgId,
+		name: input.name,
+		description: input.description,
+		visibility: input.visibility,
+		ownerId: locals.user.id,
+		createdBy: locals.user.id,
+		updatedBy: locals.user.id,
+		autoJoinOnUpload
+	}, {
+		writeCtx: ctx,
+		fallbackSlug: "project",
+		conflictScope: "this organization"
+	});
+	return created(project);
+});
+
+export { GET, POST };
+//# sourceMappingURL=_server.ts.js-DO4hjl9Q.js.map

package/build/server/chunks/entries/endpoints/api/v1/projects/_server.ts.js-DO4hjl9Q.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-DO4hjl9Q.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/v1/projects/_server.ts.js"],"sourcesContent":["import { _ as validateProjectFlags, r as hasPermission } from \"../../../../../chunks/src.js\";\nimport { _ as getProjectProvider } from \"../../../../../chunks/providers.server.js\";\nimport { u as requireCanCreateProject } from \"../../../../../chunks/access.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\nimport { c as requireCaller, n as collection, o as parseBody, r as created, t as apiRoute } from \"../../../../../chunks/http.js\";\nimport { t as createProjectWithUniqueSlug } from \"../../../../../chunks/createProject.server.js\";\nimport { i as resolveAccessibleProjects } from \"../../../../../chunks/visibility.server.js\";\nimport { n as parseListOptions } from \"../../../../../chunks/pagination.server.js\";\nimport \"../../../../../chunks/route.js\";\nimport { r as CreateProjectBodySchema } from \"../../../../../chunks/bodies.js\";\nimport { randomUUID } from \"node:crypto\";\n//#region src/routes/api/v1/projects/+server.ts\nvar GET = apiRoute(\"Failed to list projects\", async ({ locals, url }) => {\n\tconst { ctx } = requireCaller(locals);\n\tconst { projects } = await resolveAccessibleProjects(ctx);\n\tconst { limit, cursor } = parseListOptions(url);\n\tconst start = cursor ? Number(cursor) : 0;\n\tif (!Number.isInteger(start) || start < 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Invalid cursor\");\n\tconst items = projects.slice(start, start + (limit ?? projects.length));\n\tconst nextIndex = start + items.length;\n\treturn collection({\n\t\titems,\n\t\tnextCursor: nextIndex < projects.length ? String(nextIndex) : void 0\n\t});\n});\nvar POST = apiRoute(\"Failed to create project\", async ({ request, locals }) => {\n\tconst ctx = locals.ctx;\n\tif (!ctx.actingOrgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"No active organization\");\n\tawait requireCanCreateProject(locals, ctx.actingOrgId);\n\tconst input = await parseBody(request, CreateProjectBodySchema);\n\tif (input.visibility === \"platform\" && !hasPermission(ctx, \"instance_admin\")) apiError(403, ApiErrorCode.FORBIDDEN, \"Only a platform admin can create a project with platform visibility.\");\n\tconst autoJoinOnUpload = input.autoJoinOnUpload ?? false;\n\tconst flagIssues = validateProjectFlags({\n\t\tvisibility: input.visibility,\n\t\tautoJoinOnUpload\n\t});\n\tif (flagIssues.length > 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, flagIssues.map((i) => `${i.path}: ${i.message}`).join(\"; \"));\n\tconst project = await createProjectWithUniqueSlug(getProjectProvider(), {\n\t\tid: randomUUID(),\n\t\torgId: ctx.actingOrgId,\n\t\tname: input.name,\n\t\tdescription: input.description,\n\t\tvisibility: input.visibility,\n\t\townerId: locals.user.id,\n\t\tcreatedBy: locals.user.id,\n\t\tupdatedBy: locals.user.id,\n\t\tautoJoinOnUpload\n\t}, {\n\t\twriteCtx: ctx,\n\t\tfallbackSlug: \"project\",\n\t\tconflictScope: \"this organization\"\n\t});\n\treturn created(project);\n});\n//#endregion\nexport { GET, POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAWA;AACG,IAAC,GAAG,GAAG,QAAQ,CAAC,yBAAyB,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK;AACzE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AACtC,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC;AAC1D,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC;AAChD,CAAC,MAAM,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;AAC1C,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;AAC3G,CAAC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,IAAI,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;AACxE,CAAC,MAAM,SAAS,GAAG,KAAK,GAAG,KAAK,CAAC,MAAM;AACvC,CAAC,OAAO,UAAU,CAAC;AACnB,EAAE,KAAK;AACP,EAAE,UAAU,EAAE,SAAS,GAAG,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,KAAK;AACrE,EAAE,CAAC;AACH,CAAC;AACE,IAAC,IAAI,GAAG,QAAQ,CAAC,0BAA0B,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AAC/E,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACvB,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;AAC9F,CAAC,MAAM,uBAAuB,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC;AACvD,CAAC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,uBAAuB,CAAC;AAChE,CAAC,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,sEAAsE,CAAC;AAC5L,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,IAAI,KAAK;AACzD,CAAC,MAAM,UAAU,GAAG,oBAAoB,CAAC;AACzC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU;AAC9B,EAAE;AACF,EAAE,CAAC;AACH,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtI,CAAC,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC,kBAAkB,EAAE,EAAE;AACzE,EAAE,EAAE,EAAE,UAAU,EAAE;AAClB,EAAE,KAAK,EAAE,GAAG,CAAC,WAAW;AACxB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI;AAClB,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW;AAChC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU;AAC9B,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;AACzB,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;AAC3B,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;AAC3B,EAAE;AACF,EAAE,EAAE;AACJ,EAAE,QAAQ,EAAE,GAAG;AACf,EAAE,YAAY,EAAE,SAAS;AACzB,EAAE,aAAa,EAAE;AACjB,EAAE,CAAC;AACH,CAAC,OAAO,OAAO,CAAC,OAAO,CAAC;AACxB,CAAC;;;;"}

package/build/server/chunks/entries/endpoints/auth/email/callback/_server.ts.js-BJxKE1QT.js

@@ -0,0 +1,43 @@
+import { a as getAuthProvider } from '../../../../../chunks/providers.server.js-CDqkW_tD.js';
+import { a as apiError, A as ApiErrorCode } from '../../../../../chunks/api-errors.js-_5LnpWlS.js';
+import { s as setSessionCookie, a as setRefreshCookie } from '../../../../../chunks/admin-auth.server.js-C7pxKNG5.js';
+import { s as safeRedirectTarget } from '../../../../../chunks/redirect.js-2M2qGbv2.js';
+import { b as bootstrapUserSession } from '../../../../../chunks/auth-bootstrap.server.js-CozuZjpz.js';
+import { redirect } from '@sveltejs/kit';
+import '../../../../../chunks/shared-server.js-BZy9KN6u.js';
+import '../../../../../chunks/src.js-B12bUNyu.js';
+import 'zod';
+import '../../../../../chunks/schema.js-BVfByvmD.js';
+import '../../../../../chunks/core-BQtRL5GE.js-B9MmO4om.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import 'node:dns/promises';
+import 'node:net';
+
+//#region src/routes/auth/email/callback/+server.ts
+/**
+* GET /auth/email/callback?token_hash=...&type=...&redirectTo=/library
+*
+* The user clicked the magic link in their inbox. Hand the full URL to the
+* adapter (it knows its own token format), set cookies on success, redirect
+* to the destination. Mirrors `/auth/supabase/callback` but capability-named
+* — this route doesn't know which IdP brokered the email.
+*/
+var GET = async ({ url, cookies }) => {
+	const emailLink = getAuthProvider().emailLink;
+	if (!emailLink) apiError(501, ApiErrorCode.INTERNAL, "Email sign-in is not supported by this provider.");
+	const result = await emailLink.verifyMagicLink(url.toString());
+	if (!result) apiError(401, ApiErrorCode.UNAUTHORIZED, "This sign-in link is invalid or has expired.");
+	await bootstrapUserSession(result.user);
+	setSessionCookie(cookies, result.sessionToken);
+	if (result.refreshToken) setRefreshCookie(cookies, result.refreshToken);
+	const dest = safeRedirectTarget(url.searchParams.get("redirectTo"), "/library");
+	redirect(303, dest);
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts.js-BJxKE1QT.js.map

package/build/server/chunks/entries/endpoints/auth/email/callback/_server.ts.js-BJxKE1QT.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-BJxKE1QT.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/auth/email/callback/_server.ts.js"],"sourcesContent":["import { r as getAuthProvider } from \"../../../../../chunks/providers.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\nimport { l as setRefreshCookie, u as setSessionCookie } from \"../../../../../chunks/admin-auth.server.js\";\nimport \"../../../../../chunks/auth.server.js\";\nimport { t as safeRedirectTarget } from \"../../../../../chunks/redirect.js\";\nimport { t as bootstrapUserSession } from \"../../../../../chunks/auth-bootstrap.server.js\";\nimport { redirect } from \"@sveltejs/kit\";\n//#region src/routes/auth/email/callback/+server.ts\n/**\n* GET /auth/email/callback?token_hash=...&type=...&redirectTo=/library\n*\n* The user clicked the magic link in their inbox. Hand the full URL to the\n* adapter (it knows its own token format), set cookies on success, redirect\n* to the destination. Mirrors `/auth/supabase/callback` but capability-named\n* — this route doesn't know which IdP brokered the email.\n*/\nvar GET = async ({ url, cookies }) => {\n\tconst emailLink = getAuthProvider().emailLink;\n\tif (!emailLink) apiError(501, ApiErrorCode.INTERNAL, \"Email sign-in is not supported by this provider.\");\n\tconst result = await emailLink.verifyMagicLink(url.toString());\n\tif (!result) apiError(401, ApiErrorCode.UNAUTHORIZED, \"This sign-in link is invalid or has expired.\");\n\tawait bootstrapUserSession(result.user);\n\tsetSessionCookie(cookies, result.sessionToken);\n\tif (result.refreshToken) setRefreshCookie(cookies, result.refreshToken);\n\tconst dest = safeRedirectTarget(url.searchParams.get(\"redirectTo\"), \"/library\");\n\tredirect(303, dest);\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAOA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK;AACtC,CAAC,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC,SAAS;AAC9C,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,kDAAkD,CAAC;AACzG,CAAC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;AAC/D,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,8CAA8C,CAAC;AACtG,CAAC,MAAM,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC;AACxC,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AAC/C,CAAC,IAAI,MAAM,CAAC,YAAY,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AACxE,CAAC,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC;AAChF,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;AACpB;;;;"}

package/build/server/chunks/entries/endpoints/auth/supabase/callback/_server.ts.js-CZPEkNP1.js

@@ -0,0 +1,47 @@
+import { a as getAuthProvider } from '../../../../../chunks/providers.server.js-CDqkW_tD.js';
+import { a as apiError, A as ApiErrorCode } from '../../../../../chunks/api-errors.js-_5LnpWlS.js';
+import { s as setSessionCookie, a as setRefreshCookie } from '../../../../../chunks/admin-auth.server.js-C7pxKNG5.js';
+import { s as safeRedirectTarget } from '../../../../../chunks/redirect.js-2M2qGbv2.js';
+import { b as bootstrapUserSession } from '../../../../../chunks/auth-bootstrap.server.js-CozuZjpz.js';
+import { redirect } from '@sveltejs/kit';
+import '../../../../../chunks/shared-server.js-BZy9KN6u.js';
+import '../../../../../chunks/src.js-B12bUNyu.js';
+import 'zod';
+import '../../../../../chunks/schema.js-BVfByvmD.js';
+import '../../../../../chunks/core-BQtRL5GE.js-B9MmO4om.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import 'node:dns/promises';
+import 'node:net';
+
+//#region src/routes/auth/supabase/callback/+server.ts
+/**
+* GET /auth/supabase/callback?code=...&redirectTo=/library
+*
+* Completes a Supabase OAuth round-trip. Exchanges the authorization code
+* for a session, sets the session cookie, and redirects to `redirectTo`.
+*
+* Post-verification flow (data-row seeding + first-admin bootstrap) lives in
+* `bootstrapUserSession` so the email-link and OAuth paths follow the same
+* sequence in the same order.
+*/
+var GET = async ({ url, cookies }) => {
+	const code = url.searchParams.get("code");
+	if (!code) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Missing authorization code");
+	const oauth = getAuthProvider().oauth;
+	if (!oauth) apiError(501, ApiErrorCode.INTERNAL, "OAuth is not supported by the configured auth provider.");
+	const result = await oauth.exchangeOAuthCode(code);
+	if (!result) apiError(401, ApiErrorCode.UNAUTHORIZED, "OAuth exchange failed");
+	await bootstrapUserSession(result.user);
+	setSessionCookie(cookies, result.sessionToken);
+	setRefreshCookie(cookies, result.refreshToken);
+	const dest = safeRedirectTarget(url.searchParams.get("redirectTo"), "/library");
+	redirect(303, dest);
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts.js-CZPEkNP1.js.map

package/build/server/chunks/entries/endpoints/auth/supabase/callback/_server.ts.js-CZPEkNP1.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-CZPEkNP1.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/auth/supabase/callback/_server.ts.js"],"sourcesContent":["import { r as getAuthProvider } from \"../../../../../chunks/providers.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\nimport { l as setRefreshCookie, u as setSessionCookie } from \"../../../../../chunks/admin-auth.server.js\";\nimport \"../../../../../chunks/auth.server.js\";\nimport { t as safeRedirectTarget } from \"../../../../../chunks/redirect.js\";\nimport { t as bootstrapUserSession } from \"../../../../../chunks/auth-bootstrap.server.js\";\nimport { redirect } from \"@sveltejs/kit\";\n//#region src/routes/auth/supabase/callback/+server.ts\n/**\n* GET /auth/supabase/callback?code=...&redirectTo=/library\n*\n* Completes a Supabase OAuth round-trip. Exchanges the authorization code\n* for a session, sets the session cookie, and redirects to `redirectTo`.\n*\n* Post-verification flow (data-row seeding + first-admin bootstrap) lives in\n* `bootstrapUserSession` so the email-link and OAuth paths follow the same\n* sequence in the same order.\n*/\nvar GET = async ({ url, cookies }) => {\n\tconst code = url.searchParams.get(\"code\");\n\tif (!code) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing authorization code\");\n\tconst oauth = getAuthProvider().oauth;\n\tif (!oauth) apiError(501, ApiErrorCode.INTERNAL, \"OAuth is not supported by the configured auth provider.\");\n\tconst result = await oauth.exchangeOAuthCode(code);\n\tif (!result) apiError(401, ApiErrorCode.UNAUTHORIZED, \"OAuth exchange failed\");\n\tawait bootstrapUserSession(result.user);\n\tsetSessionCookie(cookies, result.sessionToken);\n\tsetRefreshCookie(cookies, result.refreshToken);\n\tconst dest = safeRedirectTarget(url.searchParams.get(\"redirectTo\"), \"/library\");\n\tredirect(303, dest);\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAOA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK;AACtC,CAAC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;AAC1C,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,4BAA4B,CAAC;AACvF,CAAC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC,KAAK;AACtC,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,yDAAyD,CAAC;AAC5G,CAAC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC;AACnD,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,uBAAuB,CAAC;AAC/E,CAAC,MAAM,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC;AACxC,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AAC/C,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AAC/C,CAAC,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC;AAChF,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;AACpB;;;;"}

package/build/server/chunks/entries/endpoints/auth/supabase/start/_server.ts.js-COXYYajy.js

@@ -0,0 +1,50 @@
+import { a as getAuthProvider } from '../../../../../chunks/providers.server.js-CDqkW_tD.js';
+import { a as apiError, A as ApiErrorCode } from '../../../../../chunks/api-errors.js-_5LnpWlS.js';
+import { redirect } from '@sveltejs/kit';
+import '../../../../../chunks/shared-server.js-BZy9KN6u.js';
+import '../../../../../chunks/src.js-B12bUNyu.js';
+import 'zod';
+import '../../../../../chunks/schema.js-BVfByvmD.js';
+import '../../../../../chunks/core-BQtRL5GE.js-B9MmO4om.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+
+//#region src/routes/auth/supabase/start/+server.ts
+var ALLOWED_PROVIDERS = [
+	"google",
+	"github",
+	"azure",
+	"gitlab"
+];
+function isAllowedProvider(value) {
+	return value !== null && ALLOWED_PROVIDERS.includes(value);
+}
+/**
+* GET /auth/supabase/start?provider=google&redirectTo=/library
+*
+* Initiates an OAuth sign-in via Supabase Auth. The Supabase project must
+* have the named provider enabled in its dashboard. Bounces the browser to
+* the IdP's authorize endpoint; the IdP returns to `/auth/supabase/callback`
+* with a `?code=...`.
+*
+* `redirectTo` is preserved through the round trip via `?redirectTo=...` on
+* the callback URL we hand to Supabase.
+*/
+var GET = async ({ url }) => {
+	const provider = url.searchParams.get("provider");
+	if (!isAllowedProvider(provider)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid provider. Allowed: ${ALLOWED_PROVIDERS.join(", ")}`);
+	const oauth = getAuthProvider().oauth;
+	if (!oauth) apiError(501, ApiErrorCode.INTERNAL, "OAuth is not supported by the configured auth provider.");
+	const redirectTo = url.searchParams.get("redirectTo") ?? "/library";
+	const callbackUrl = new URL("/auth/supabase/callback", url.origin);
+	if (redirectTo.startsWith("/")) callbackUrl.searchParams.set("redirectTo", redirectTo);
+	const authorizationUrl = await oauth.getOAuthAuthorizationUrl(provider, callbackUrl.toString());
+	redirect(303, authorizationUrl);
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts.js-COXYYajy.js.map

package/build/server/chunks/entries/endpoints/auth/supabase/start/_server.ts.js-COXYYajy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-COXYYajy.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/auth/supabase/start/_server.ts.js"],"sourcesContent":["import { r as getAuthProvider } from \"../../../../../chunks/providers.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\nimport \"../../../../../chunks/auth.server.js\";\nimport { redirect } from \"@sveltejs/kit\";\n//#region src/routes/auth/supabase/start/+server.ts\nvar ALLOWED_PROVIDERS = [\n\t\"google\",\n\t\"github\",\n\t\"azure\",\n\t\"gitlab\"\n];\nfunction isAllowedProvider(value) {\n\treturn value !== null && ALLOWED_PROVIDERS.includes(value);\n}\n/**\n* GET /auth/supabase/start?provider=google&redirectTo=/library\n*\n* Initiates an OAuth sign-in via Supabase Auth. The Supabase project must\n* have the named provider enabled in its dashboard. Bounces the browser to\n* the IdP's authorize endpoint; the IdP returns to `/auth/supabase/callback`\n* with a `?code=...`.\n*\n* `redirectTo` is preserved through the round trip via `?redirectTo=...` on\n* the callback URL we hand to Supabase.\n*/\nvar GET = async ({ url }) => {\n\tconst provider = url.searchParams.get(\"provider\");\n\tif (!isAllowedProvider(provider)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid provider. Allowed: ${ALLOWED_PROVIDERS.join(\", \")}`);\n\tconst oauth = getAuthProvider().oauth;\n\tif (!oauth) apiError(501, ApiErrorCode.INTERNAL, \"OAuth is not supported by the configured auth provider.\");\n\tconst redirectTo = url.searchParams.get(\"redirectTo\") ?? \"/library\";\n\tconst callbackUrl = new URL(\"/auth/supabase/callback\", url.origin);\n\tif (redirectTo.startsWith(\"/\")) callbackUrl.searchParams.set(\"redirectTo\", redirectTo);\n\tconst authorizationUrl = await oauth.getOAuthAuthorizationUrl(provider, callbackUrl.toString());\n\tredirect(303, authorizationUrl);\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;AAIA;AACA,IAAI,iBAAiB,GAAG;AACxB,CAAC,QAAQ;AACT,CAAC,QAAQ;AACT,CAAC,OAAO;AACR,CAAC;AACD,CAAC;AACD,SAAS,iBAAiB,CAAC,KAAK,EAAE;AAClC,CAAC,OAAO,KAAK,KAAK,IAAI,IAAI,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC;AAC3D;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,KAAK;AAC7B,CAAC,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC;AAClD,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,2BAA2B,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC9I,CAAC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC,KAAK;AACtC,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,yDAAyD,CAAC;AAC5G,CAAC,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,UAAU;AACpE,CAAC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,yBAAyB,EAAE,GAAG,CAAC,MAAM,CAAC;AACnE,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC;AACvF,CAAC,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,wBAAwB,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC;AAChG,CAAC,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;AAChC;;;;"}

package/build/server/chunks/entries/hooks.server.js-BTOetvC4.js

@@ -0,0 +1,313 @@
+import { b as private_env } from '../chunks/shared-server.js-BZy9KN6u.js';
+import { S as SYSTEM_CONTEXT } from '../chunks/src.js-B12bUNyu.js';
+import { p as providers, h as resolveRequestId, g as getLogger, r as renderThrown, i as getErrorReporter, R as REQUEST_ID_HEADER, j as getEventSink } from '../chunks/providers.server.js-CDqkW_tD.js';
+import { g as getRefreshToken, s as setSessionCookie, a as setRefreshCookie, c as clearRefreshCookie } from '../chunks/admin-auth.server.js-C7pxKNG5.js';
+import { f as findDeploymentDir, s as startUpdateOutcomeReconciler } from '../chunks/selfUpdate.server.js-BSA0Yo-w.js';
+import { g as getBootHealth } from '../chunks/bootHealth.server.js-BYg1Kkbr.js';
+import { w as wireHeaderAuthBootstrap, b as bootstrapUserSession } from '../chunks/auth-bootstrap.server.js-CozuZjpz.js';
+import { redirect, isHttpError } from '@sveltejs/kit';
+import 'zod';
+import '../chunks/schema.js-BVfByvmD.js';
+import '../chunks/core-BQtRL5GE.js-B9MmO4om.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import 'node:dns/promises';
+import 'node:net';
+import '../chunks/update-outcome.js-Djn7e2VC.js';
+
+//#region ../platform/src/userProfile/types.ts
+function emptyProfile(userId) {
+	return {
+		userId,
+		starredDefinitions: [],
+		recentRuns: []
+	};
+}
+//#endregion
+//#region ../server/src/http/security-headers.ts
+/**
+* Apply baseline browser-hardening headers to a response and return it for
+* chaining. Each is a cheap win that needs no UI verification:
+*
+*   - X-Content-Type-Options: nosniff — disables MIME sniffing.
+*   - Referrer-Policy: strict-origin-when-cross-origin — strips path and query
+*     from cross-origin Referer headers. Matches modern browser defaults, but
+*     pins the behavior in case a default drifts.
+*   - Permissions-Policy: opts out of browser APIs Selva-engine apps don't use,
+*     so XSS can't enable them.
+*   - HSTS when `opts.hsts`.
+*
+* **Intentionally NOT set here:**
+*   - Content-Security-Policy + frame-ancestors. Selva-engine apps are built
+*     for iframe embedding, so a strict CSP needs validating against real
+*     consumer sites before it can ship.
+*   - X-Frame-Options. Same iframe-embedding constraint.
+*   - Cache-Control. Asset-path layout is app policy; set it in the caller.
+*/
+function applySecurityHeaders(response, opts) {
+	response.headers.set("X-Content-Type-Options", "nosniff");
+	response.headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
+	response.headers.set("Permissions-Policy", "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()");
+	if (opts.hsts) response.headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
+	return response;
+}
+//#endregion
+//#region ../server/src/http/route-classifier.ts
+function createRouteClassifier(config) {
+	const publicPages = new Set(config.publicPages ?? []);
+	const publicPrefixes = config.publicPrefixes ?? [];
+	const publicApis = new Set(config.publicApis ?? []);
+	const selfGatingPrefix = config.selfGatingPrefix;
+	const staticPrefixes = config.staticPrefixes ?? [];
+	const staticPaths = new Set(config.staticPaths ?? []);
+	function isStaticAsset(pathname) {
+		if (staticPaths.has(pathname)) return true;
+		return staticPrefixes.some((p) => pathname.startsWith(p));
+	}
+	function isSelfGatingApiRoute(pathname) {
+		return selfGatingPrefix !== void 0 && pathname.startsWith(selfGatingPrefix);
+	}
+	function isPublicRoute(pathname) {
+		if (publicPages.has(pathname)) return true;
+		if (publicApis.has(pathname)) return true;
+		if (isSelfGatingApiRoute(pathname)) return true;
+		return publicPrefixes.some((p) => pathname.startsWith(p));
+	}
+	return {
+		isStaticAsset,
+		isSelfGatingApiRoute,
+		isPublicRoute
+	};
+}
+//#endregion
+//#region src/hooks.server.ts
+var headerAuthBootstrapWired = false;
+var bootHealthKicked = false;
+var proxyAuthLoginMissWarned = false;
+var firstRunResolved = false;
+async function isFirstRun() {
+	if (firstRunResolved) return false;
+	const usersPage = await providers.auth.listUsers({ limit: 1 });
+	if (usersPage === null) {
+		firstRunResolved = true;
+		return false;
+	}
+	if (usersPage.items.length === 0) return true;
+	firstRunResolved = true;
+	return false;
+}
+var ensuredUserIds = /* @__PURE__ */ new Set();
+async function ensureUserOnce(userId) {
+	if (ensuredUserIds.has(userId)) return;
+	await providers.data.ensureUser(SYSTEM_CONTEXT, userId);
+	ensuredUserIds.add(userId);
+}
+/**
+* Builds a per-request context from an authenticated user: resolves active-org
+* membership and its OrgPermissions.
+*
+* Active-org resolution: single tenancy picks the deployment's one org; multi
+* tenancy picks the first org the user belongs to (URL-prefix resolution via
+* `/o/{slug}/...` will replace this once routes are tenant-namespaced).
+*
+* Exported for tests: the fixture's `actAs()` mirrors this logic, so a direct
+* test pins the production function against drift.
+*/
+async function buildContext(user, sessionToken, platformPermissions, membership) {
+	let actingOrgId;
+	let orgPermissions = [];
+	if (membership) {
+		actingOrgId = membership.org.id;
+		orgPermissions = membership.member.permissions;
+	}
+	if (!actingOrgId && platformPermissions.includes("instance_admin")) {
+		const firstOrg = (await providers.data.orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items[0];
+		if (firstOrg) actingOrgId = firstOrg.id;
+	}
+	return {
+		userId: user.id,
+		actingOrgId,
+		platformPermissions,
+		orgPermissions,
+		adapterContext: sessionToken ? { sessionToken } : void 0
+	};
+}
+var PUBLIC_PAGE_ROUTES = /* @__PURE__ */ new Set([
+	"/",
+	"/login",
+	"/setup",
+	"/accept-invite"
+]);
+var { isStaticAsset, isSelfGatingApiRoute, isPublicRoute } = createRouteClassifier({
+	publicPages: PUBLIC_PAGE_ROUTES,
+	publicPrefixes: [
+		"/auth/",
+		"/logout",
+		"/docs/"
+	],
+	publicApis: ["/api/health", "/api/health/ready"],
+	selfGatingPrefix: "/api/files/",
+	staticPrefixes: ["/_app/", "/favicon/"],
+	staticPaths: ["/favicon.svg", "/robots.txt"]
+});
+var handle = async ({ event, resolve }) => {
+	event.locals.providers = providers;
+	const requestId = resolveRequestId(event.request.headers);
+	event.locals.requestId = requestId;
+	event.locals.log = getLogger().child({
+		requestId,
+		method: event.request.method,
+		route: event.url.pathname
+	});
+	if (!headerAuthBootstrapWired) {
+		wireHeaderAuthBootstrap();
+		headerAuthBootstrapWired = true;
+	}
+	if (!bootHealthKicked) {
+		bootHealthKicked = true;
+		getBootHealth();
+		const deploymentDir = findDeploymentDir(private_env);
+		if (deploymentDir) startUpdateOutcomeReconciler({
+			deploymentDir,
+			emit: (e) => getEventSink().emit(e),
+			report: (err) => getErrorReporter().capture(err, { tags: { origin: "selfUpdate" } })
+		});
+	}
+	const { pathname } = event.url;
+	if (isStaticAsset(pathname)) return applyResponseHeaders(await resolve(event), pathname, requestId);
+	if (pathname === "/api/health" || pathname === "/api/health/ready") return applyResponseHeaders(await resolve(event), pathname, requestId);
+	const publicRoute = isPublicRoute(pathname);
+	const isJsonApiRoute = pathname.startsWith("/api/");
+	if (!publicRoute) {
+		if (await isFirstRun()) {
+			if (isJsonApiRoute) return applyResponseHeaders(new Response(JSON.stringify({
+				message: "Setup required",
+				code: "SETUP_REQUIRED"
+			}), {
+				status: 503,
+				headers: { "Content-Type": "application/json" }
+			}), pathname, requestId);
+			redirect(303, "/setup");
+		}
+	}
+	if (!publicRoute) {
+		let token = event.cookies.get("admin_session") ?? "";
+		let user = await providers.auth.verifyToken(token);
+		if (!user) {
+			const refreshToken = getRefreshToken(event.cookies);
+			const oauth = providers.auth.oauth;
+			if (refreshToken && oauth) {
+				const refreshed = await oauth.refreshSession(refreshToken);
+				if (refreshed) {
+					setSessionCookie(event.cookies, refreshed.sessionToken);
+					setRefreshCookie(event.cookies, refreshed.refreshToken);
+					token = refreshed.sessionToken;
+					user = await providers.auth.verifyToken(token);
+				} else clearRefreshCookie(event.cookies);
+			}
+		}
+		if (!user && providers.auth.proxyAuth) {
+			user = await providers.auth.proxyAuth.identifyFromHeaders(event.request.headers);
+			if (user) await bootstrapUserSession(user);
+		}
+		if (!user) {
+			if (isJsonApiRoute) return applyResponseHeaders(new Response(JSON.stringify({
+				message: "Your session has expired. Sign in again to continue.",
+				code: "UNAUTHORIZED"
+			}), {
+				status: 401,
+				headers: { "Content-Type": "application/json" }
+			}), pathname, requestId);
+			redirect(303, `/login?redirectTo=${encodeURIComponent(pathname)}`);
+		}
+		const [, profile, platformPermissions, membership] = await Promise.all([
+			ensureUserOnce(user.id),
+			providers.data.userProfile.getProfile(SYSTEM_CONTEXT, user.id),
+			providers.data.permissions.getFor(SYSTEM_CONTEXT, user.id),
+			providers.data.orgs.findUserMembership(SYSTEM_CONTEXT, user.id)
+		]);
+		event.locals.user = user;
+		event.locals.profile = profile ?? emptyProfile(user.id);
+		event.locals.ctx = await buildContext(user, token, platformPermissions, membership);
+	} else {
+		const wantsSessionAttach = PUBLIC_PAGE_ROUTES.has(pathname) || isSelfGatingApiRoute(pathname);
+		const token = wantsSessionAttach ? event.cookies.get("admin_session") ?? "" : "";
+		let user = token ? await providers.auth.verifyToken(token) : null;
+		if (!user && wantsSessionAttach && providers.auth.proxyAuth) {
+			user = await providers.auth.proxyAuth.identifyFromHeaders(event.request.headers);
+			if (!user && pathname === "/login" && !proxyAuthLoginMissWarned) {
+				proxyAuthLoginMissWarned = true;
+				const proxyAuth = providers.auth.proxyAuth;
+				const noHeaders = proxyAuth.hasNoIdentityHeaders(event.request.headers);
+				const configured = proxyAuth.configuredHeaderNames.join(", ");
+				if (noHeaders) event.locals.log.warn("/login was hit and NONE of the configured identity headers arrived. The forward-auth proxy is not reaching this process, or is not forwarding the configured headers. See the @selvajs/header-auth-provider README \"Verification\" section.", {
+					component: "HeaderAuth",
+					configuredHeaders: configured
+				});
+				else event.locals.log.warn("/login was hit but the UPN header was missing or the user is not allowlisted. Some headers arrived but identification still failed — check that the UPN header is populated and that the user has been added to header-allowlist.json.", {
+					component: "HeaderAuth",
+					configuredHeaders: configured
+				});
+			}
+		}
+		if (user) {
+			const [, profile, platformPermissions, membership] = await Promise.all([
+				ensureUserOnce(user.id),
+				providers.data.userProfile.getProfile(SYSTEM_CONTEXT, user.id),
+				providers.data.permissions.getFor(SYSTEM_CONTEXT, user.id),
+				providers.data.orgs.findUserMembership(SYSTEM_CONTEXT, user.id)
+			]);
+			event.locals.user = user;
+			event.locals.profile = profile ?? emptyProfile(user.id);
+			event.locals.ctx = await buildContext(user, token, platformPermissions, membership);
+		}
+	}
+	return applyResponseHeaders(await resolve(event), pathname, requestId);
+};
+function applyResponseHeaders(response, pathname, requestId) {
+	applySecurityHeaders(response, { hsts: process.env.NODE_ENV === "production" });
+	response.headers.set(REQUEST_ID_HEADER, requestId);
+	if (pathname.startsWith("/_app/")) response.headers.set("Cache-Control", "public, max-age=31536000, immutable");
+	else if (pathname.startsWith("/favicon/") || pathname === "/favicon.svg" || pathname === "/robots.txt") response.headers.set("Cache-Control", "public, max-age=604800");
+	return response;
+}
+var handleError = ({ error, status, event }) => {
+	if (isHttpError(error)) {
+		const body = error.body;
+		return {
+			message: body.message,
+			code: body.code,
+			fields: body.fields
+		};
+	}
+	if (status === 404) return {
+		message: "Page not found.",
+		code: "NOT_FOUND"
+	};
+	(event.locals.log ?? getLogger().child({
+		method: event.request.method,
+		route: event.url.pathname
+	})).error("Unhandled error", {
+		component: "handleError",
+		status,
+		err: renderThrown(error),
+		cause: error instanceof Error && error.cause ? String(error.cause) : void 0
+	});
+	getErrorReporter().capture(error, {
+		method: event.request.method,
+		route: event.url.pathname,
+		userId: event.locals.ctx?.userId || void 0,
+		orgId: event.locals.ctx?.actingOrgId
+	});
+	return {
+		message: "An unexpected error occurred.",
+		code: "INTERNAL"
+	};
+};
+
+export { buildContext, handle, handleError, isPublicRoute, isSelfGatingApiRoute, isStaticAsset };
+//# sourceMappingURL=hooks.server.js-BTOetvC4.js.map