@selvajs/selva 4.13.0 → 4.14.0

package/build/server/chunks/entries/endpoints/api/v1/projects/_id_/members/_userId_/_server.ts.js-C2Kkq179.js

@@ -0,0 +1,64 @@
+import '../../../../../../../../chunks/src.js-B12bUNyu.js';
+import { f as getProjectProvider } from '../../../../../../../../chunks/providers.server.js-n7DF9bkc.js';
+import { D as requireCanManage, F as checkOwnerRemoval } from '../../../../../../../../chunks/access.server.js-BUiuIuUH.js';
+import { a as apiError, A as ApiErrorCode } from '../../../../../../../../chunks/api-errors.js-ZUI_rSV_.js';
+import { a as apiRoute, r as requireParams, p as parseBody, n as noContent } from '../../../../../../../../chunks/http.js-DTur24v9.js';
+import { a as UpdateProjectMemberBodySchema } from '../../../../../../../../chunks/bodies.js-C9rGU8lD.js';
+import 'zod';
+import '../../../../../../../../chunks/shared-server.js-BZy9KN6u.js';
+import '../../../../../../../../chunks/schema.js-BVfByvmD.js';
+import '../../../../../../../../chunks/core-BQtRL5GE.js-B9MmO4om.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '@sveltejs/kit';
+
+//#region src/routes/api/v1/projects/[id]/members/[userId]/+server.ts
+var PATCH = apiRoute("Failed to update role", async ({ params, request, url, locals }) => {
+	const { id, userId } = requireParams(params, "id", "userId");
+	await requireCanManage(locals, id, "members");
+	const { role } = await parseBody(request, UpdateProjectMemberBodySchema);
+	const ctx = locals.ctx;
+	const projects = getProjectProvider();
+	if (role !== "owner") {
+		const target = await projects.getProjectMember(ctx, id, userId);
+		if (target?.role === "owner") {
+			const page = await projects.listProjectMembers(ctx, id, { limit: 200 });
+			const decision = checkOwnerRemoval({
+				target: { role: target.role },
+				allMembers: page.items.map((m) => ({ role: m.role })),
+				confirmed: url.searchParams.get("confirm") === "true"
+			});
+			if (decision === "sole_owner") apiError(409, ApiErrorCode.CONFLICT, "Cannot demote the sole owner of a project. Assign another owner first, or use reclaim to add a co-owner.");
+			if (decision === "needs_confirm") apiError(409, ApiErrorCode.CONFLICT, "Demoting another project owner requires explicit confirmation. Retry with ?confirm=true.");
+		}
+	}
+	await projects.updateProjectMemberRole(ctx, id, userId, role);
+	return noContent();
+});
+var DELETE = apiRoute("Failed to remove member", async ({ params, url, locals }) => {
+	const { id, userId } = requireParams(params, "id", "userId");
+	await requireCanManage(locals, id, "members");
+	const ctx = locals.ctx;
+	const projects = getProjectProvider();
+	const target = await projects.getProjectMember(ctx, id, userId);
+	if (!target) return noContent();
+	if (target.role === "owner") {
+		const page = await projects.listProjectMembers(ctx, id, { limit: 200 });
+		const decision = checkOwnerRemoval({
+			target: { role: target.role },
+			allMembers: page.items.map((m) => ({ role: m.role })),
+			confirmed: url.searchParams.get("confirm") === "true"
+		});
+		if (decision === "sole_owner") apiError(409, ApiErrorCode.CONFLICT, "Cannot remove the sole owner of a project. Assign another owner first, or use reclaim to add a co-owner.");
+		if (decision === "needs_confirm") apiError(409, ApiErrorCode.CONFLICT, "Removing another project owner requires explicit confirmation. Retry with ?confirm=true.");
+	}
+	await projects.removeProjectMember(ctx, id, userId);
+	return noContent();
+});
+
+export { DELETE, PATCH };
+//# sourceMappingURL=_server.ts.js-C2Kkq179.js.map

package/build/server/chunks/entries/endpoints/api/v1/projects/_id_/members/_userId_/_server.ts.js-C2Kkq179.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-C2Kkq179.js","sources":["../../../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/v1/projects/_id_/members/_userId_/_server.ts.js"],"sourcesContent":["import \"../../../../../../../../chunks/src.js\";\nimport { _ as getProjectProvider } from \"../../../../../../../../chunks/providers.server.js\";\nimport { M as checkOwnerRemoval, p as requireCanManage } from \"../../../../../../../../chunks/access.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../../../../chunks/api-errors.js\";\nimport { a as noContent, l as requireParams, o as parseBody, t as apiRoute } from \"../../../../../../../../chunks/http.js\";\nimport \"../../../../../../../../chunks/route.js\";\nimport { c as UpdateProjectMemberBodySchema } from \"../../../../../../../../chunks/bodies.js\";\n//#region src/routes/api/v1/projects/[id]/members/[userId]/+server.ts\nvar PATCH = apiRoute(\"Failed to update role\", async ({ params, request, url, locals }) => {\n\tconst { id, userId } = requireParams(params, \"id\", \"userId\");\n\tawait requireCanManage(locals, id, \"members\");\n\tconst { role } = await parseBody(request, UpdateProjectMemberBodySchema);\n\tconst ctx = locals.ctx;\n\tconst projects = getProjectProvider();\n\tif (role !== \"owner\") {\n\t\tconst target = await projects.getProjectMember(ctx, id, userId);\n\t\tif (target?.role === \"owner\") {\n\t\t\tconst page = await projects.listProjectMembers(ctx, id, { limit: 200 });\n\t\t\tconst decision = checkOwnerRemoval({\n\t\t\t\ttarget: { role: target.role },\n\t\t\t\tallMembers: page.items.map((m) => ({ role: m.role })),\n\t\t\t\tconfirmed: url.searchParams.get(\"confirm\") === \"true\"\n\t\t\t});\n\t\t\tif (decision === \"sole_owner\") apiError(409, ApiErrorCode.CONFLICT, \"Cannot demote the sole owner of a project. Assign another owner first, or use reclaim to add a co-owner.\");\n\t\t\tif (decision === \"needs_confirm\") apiError(409, ApiErrorCode.CONFLICT, \"Demoting another project owner requires explicit confirmation. Retry with ?confirm=true.\");\n\t\t}\n\t}\n\tawait projects.updateProjectMemberRole(ctx, id, userId, role);\n\treturn noContent();\n});\nvar DELETE = apiRoute(\"Failed to remove member\", async ({ params, url, locals }) => {\n\tconst { id, userId } = requireParams(params, \"id\", \"userId\");\n\tawait requireCanManage(locals, id, \"members\");\n\tconst ctx = locals.ctx;\n\tconst projects = getProjectProvider();\n\tconst target = await projects.getProjectMember(ctx, id, userId);\n\tif (!target) return noContent();\n\tif (target.role === \"owner\") {\n\t\tconst page = await projects.listProjectMembers(ctx, id, { limit: 200 });\n\t\tconst decision = checkOwnerRemoval({\n\t\t\ttarget: { role: target.role },\n\t\t\tallMembers: page.items.map((m) => ({ role: m.role })),\n\t\t\tconfirmed: url.searchParams.get(\"confirm\") === \"true\"\n\t\t});\n\t\tif (decision === \"sole_owner\") apiError(409, ApiErrorCode.CONFLICT, \"Cannot remove the sole owner of a project. Assign another owner first, or use reclaim to add a co-owner.\");\n\t\tif (decision === \"needs_confirm\") apiError(409, ApiErrorCode.CONFLICT, \"Removing another project owner requires explicit confirmation. Retry with ?confirm=true.\");\n\t}\n\tawait projects.removeProjectMember(ctx, id, userId);\n\treturn noContent();\n});\n//#endregion\nexport { DELETE, PATCH };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAOA;AACG,IAAC,KAAK,GAAG,QAAQ,CAAC,uBAAuB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK;AAC1F,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC;AAC7D,CAAC,MAAM,gBAAgB,CAAC,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC;AAC9C,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,6BAA6B,CAAC;AACzE,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACvB,CAAC,MAAM,QAAQ,GAAG,kBAAkB,EAAE;AACtC,CAAC,IAAI,IAAI,KAAK,OAAO,EAAE;AACvB,EAAE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC;AACjE,EAAE,IAAI,MAAM,EAAE,IAAI,KAAK,OAAO,EAAE;AAChC,GAAG,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AAC1E,GAAG,MAAM,QAAQ,GAAG,iBAAiB,CAAC;AACtC,IAAI,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;AACjC,IAAI,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACzD,IAAI,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK;AACnD,IAAI,CAAC;AACL,GAAG,IAAI,QAAQ,KAAK,YAAY,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,0GAA0G,CAAC;AAClL,GAAG,IAAI,QAAQ,KAAK,eAAe,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,0FAA0F,CAAC;AACrK,EAAE;AACF,CAAC;AACD,CAAC,MAAM,QAAQ,CAAC,uBAAuB,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC;AAC9D,CAAC,OAAO,SAAS,EAAE;AACnB,CAAC;AACE,IAAC,MAAM,GAAG,QAAQ,CAAC,yBAAyB,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK;AACpF,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC;AAC7D,CAAC,MAAM,gBAAgB,CAAC,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC;AAC9C,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACvB,CAAC,MAAM,QAAQ,GAAG,kBAAkB,EAAE;AACtC,CAAC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC;AAChE,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,SAAS,EAAE;AAChC,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE;AAC9B,EAAE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACzE,EAAE,MAAM,QAAQ,GAAG,iBAAiB,CAAC;AACrC,GAAG,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;AAChC,GAAG,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACxD,GAAG,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK;AAClD,GAAG,CAAC;AACJ,EAAE,IAAI,QAAQ,KAAK,YAAY,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,0GAA0G,CAAC;AACjL,EAAE,IAAI,QAAQ,KAAK,eAAe,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,0FAA0F,CAAC;AACpK,CAAC;AACD,CAAC,MAAM,QAAQ,CAAC,mBAAmB,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC;AACpD,CAAC,OAAO,SAAS,EAAE;AACnB,CAAC;;;;"}

package/build/server/chunks/entries/endpoints/api/v1/projects/_id_/reclaim/_server.ts.js-BbdVFaKX.js

@@ -0,0 +1,49 @@
+import '../../../../../../../chunks/src.js-B12bUNyu.js';
+import { f as getProjectProvider, j as getEventSink, t as actorFrom } from '../../../../../../../chunks/providers.server.js-n7DF9bkc.js';
+import { G as requireCanReclaim } from '../../../../../../../chunks/access.server.js-BUiuIuUH.js';
+import { a as apiRoute, r as requireParams, c as created } from '../../../../../../../chunks/http.js-DTur24v9.js';
+import 'zod';
+import '../../../../../../../chunks/shared-server.js-BZy9KN6u.js';
+import '../../../../../../../chunks/schema.js-BVfByvmD.js';
+import '../../../../../../../chunks/core-BQtRL5GE.js-B9MmO4om.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '../../../../../../../chunks/api-errors.js-ZUI_rSV_.js';
+import '@sveltejs/kit';
+
+//#region src/routes/api/v1/projects/[id]/reclaim/+server.ts
+/**
+* Org owner/admin escape hatch. Adds the actor as a co-owner and does NOT
+* demote the existing owner. Idempotent: reclaiming twice is a no-op, because
+* `addProjectMember` reactivates a soft-deleted row in place.
+*/
+var POST = apiRoute("Failed to reclaim project", async ({ params, locals }) => {
+	const { id } = requireParams(params, "id");
+	const { user, ctx, project } = await requireCanReclaim(locals, id);
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const member = {
+		projectId: id,
+		userId: user.id,
+		role: "owner",
+		joinedAt: now,
+		updatedAt: now,
+		updatedBy: ctx.userId || user.id,
+		deletedAt: null
+	};
+	await getProjectProvider().addProjectMember(ctx, member);
+	await getEventSink().emit({
+		type: "project.reclaimed",
+		projectId: id,
+		orgId: project.orgId,
+		actorId: actorFrom(ctx),
+		priorVisibility: project.visibility
+	});
+	return created({ member });
+});
+
+export { POST };
+//# sourceMappingURL=_server.ts.js-BbdVFaKX.js.map

package/build/server/chunks/entries/endpoints/api/v1/projects/_id_/reclaim/_server.ts.js-BbdVFaKX.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-BbdVFaKX.js","sources":["../../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/v1/projects/_id_/reclaim/_server.ts.js"],"sourcesContent":["import \"../../../../../../../chunks/src.js\";\nimport { L as actorFrom, _ as getProjectProvider, u as getEventSink } from \"../../../../../../../chunks/providers.server.js\";\nimport { m as requireCanReclaim } from \"../../../../../../../chunks/access.server.js\";\nimport { l as requireParams, r as created, t as apiRoute } from \"../../../../../../../chunks/http.js\";\nimport \"../../../../../../../chunks/route.js\";\n//#region src/routes/api/v1/projects/[id]/reclaim/+server.ts\n/**\n* Org owner/admin escape hatch. Adds the actor as a co-owner and does NOT\n* demote the existing owner. Idempotent: reclaiming twice is a no-op, because\n* `addProjectMember` reactivates a soft-deleted row in place.\n*/\nvar POST = apiRoute(\"Failed to reclaim project\", async ({ params, locals }) => {\n\tconst { id } = requireParams(params, \"id\");\n\tconst { user, ctx, project } = await requireCanReclaim(locals, id);\n\tconst now = (/* @__PURE__ */ new Date()).toISOString();\n\tconst member = {\n\t\tprojectId: id,\n\t\tuserId: user.id,\n\t\trole: \"owner\",\n\t\tjoinedAt: now,\n\t\tupdatedAt: now,\n\t\tupdatedBy: ctx.userId || user.id,\n\t\tdeletedAt: null\n\t};\n\tawait getProjectProvider().addProjectMember(ctx, member);\n\tawait getEventSink().emit({\n\t\ttype: \"project.reclaimed\",\n\t\tprojectId: id,\n\t\torgId: project.orgId,\n\t\tactorId: actorFrom(ctx),\n\t\tpriorVisibility: project.visibility\n\t});\n\treturn created({ member });\n});\n//#endregion\nexport { POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAKA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,IAAI,GAAG,QAAQ,CAAC,2BAA2B,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AAC/E,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;AAC3C,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,EAAE,CAAC;AACnE,CAAC,MAAM,GAAG,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACvD,CAAC,MAAM,MAAM,GAAG;AAChB,EAAE,SAAS,EAAE,EAAE;AACf,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;AACjB,EAAE,IAAI,EAAE,OAAO;AACf,EAAE,QAAQ,EAAE,GAAG;AACf,EAAE,SAAS,EAAE,GAAG;AAChB,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE;AAClC,EAAE,SAAS,EAAE;AACb,EAAE;AACF,CAAC,MAAM,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC;AACzD,CAAC,MAAM,YAAY,EAAE,CAAC,IAAI,CAAC;AAC3B,EAAE,IAAI,EAAE,mBAAmB;AAC3B,EAAE,SAAS,EAAE,EAAE;AACf,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK;AACtB,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC;AACzB,EAAE,eAAe,EAAE,OAAO,CAAC;AAC3B,EAAE,CAAC;AACH,CAAC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;;;;"}

package/build/server/chunks/entries/endpoints/api/v1/projects/_server.ts.js-C3lgJZZz.js

@@ -0,0 +1,67 @@
+import { h as hasPermission, v as validateProjectFlags } from '../../../../../chunks/src.js-B12bUNyu.js';
+import { f as getProjectProvider } from '../../../../../chunks/providers.server.js-n7DF9bkc.js';
+import { y as requireCanCreateProject } from '../../../../../chunks/access.server.js-BUiuIuUH.js';
+import { a as apiError, A as ApiErrorCode } from '../../../../../chunks/api-errors.js-ZUI_rSV_.js';
+import { a as apiRoute, b as requireCaller, d as collection, p as parseBody, c as created } from '../../../../../chunks/http.js-DTur24v9.js';
+import { c as createProjectWithUniqueSlug } from '../../../../../chunks/createProject.server.js-BC-_Zf0u.js';
+import { r as resolveAccessibleProjects } from '../../../../../chunks/visibility.server.js-B-Sv27CW.js';
+import { a as parseListOptions } from '../../../../../chunks/pagination.server.js-CtQ_3Is9.js';
+import { C as CreateProjectBodySchema } from '../../../../../chunks/bodies.js-C9rGU8lD.js';
+import { randomUUID } from 'node:crypto';
+import 'zod';
+import '../../../../../chunks/shared-server.js-BZy9KN6u.js';
+import '../../../../../chunks/schema.js-BVfByvmD.js';
+import '../../../../../chunks/core-BQtRL5GE.js-B9MmO4om.js';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '@sveltejs/kit';
+
+//#region src/routes/api/v1/projects/+server.ts
+var GET = apiRoute("Failed to list projects", async ({ locals, url }) => {
+	const { ctx } = requireCaller(locals);
+	const { projects } = await resolveAccessibleProjects(ctx);
+	const { limit, cursor } = parseListOptions(url);
+	const start = cursor ? Number(cursor) : 0;
+	if (!Number.isInteger(start) || start < 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Invalid cursor");
+	const items = projects.slice(start, start + (limit ?? projects.length));
+	const nextIndex = start + items.length;
+	return collection({
+		items,
+		nextCursor: nextIndex < projects.length ? String(nextIndex) : void 0
+	});
+});
+var POST = apiRoute("Failed to create project", async ({ request, locals }) => {
+	const ctx = locals.ctx;
+	if (!ctx.actingOrgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, "No active organization");
+	await requireCanCreateProject(locals, ctx.actingOrgId);
+	const input = await parseBody(request, CreateProjectBodySchema);
+	if (input.visibility === "platform" && !hasPermission(ctx, "instance_admin")) apiError(403, ApiErrorCode.FORBIDDEN, "Only a platform admin can create a project with platform visibility.");
+	const autoJoinOnUpload = input.autoJoinOnUpload ?? false;
+	const flagIssues = validateProjectFlags({
+		visibility: input.visibility,
+		autoJoinOnUpload
+	});
+	if (flagIssues.length > 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, flagIssues.map((i) => `${i.path}: ${i.message}`).join("; "));
+	const project = await createProjectWithUniqueSlug(getProjectProvider(), {
+		id: randomUUID(),
+		orgId: ctx.actingOrgId,
+		name: input.name,
+		description: input.description,
+		visibility: input.visibility,
+		ownerId: locals.user.id,
+		createdBy: locals.user.id,
+		updatedBy: locals.user.id,
+		autoJoinOnUpload
+	}, {
+		writeCtx: ctx,
+		fallbackSlug: "project",
+		conflictScope: "this organization"
+	});
+	return created(project);
+});
+
+export { GET, POST };
+//# sourceMappingURL=_server.ts.js-C3lgJZZz.js.map

package/build/server/chunks/entries/endpoints/api/v1/projects/_server.ts.js-C3lgJZZz.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-C3lgJZZz.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/v1/projects/_server.ts.js"],"sourcesContent":["import { _ as validateProjectFlags, r as hasPermission } from \"../../../../../chunks/src.js\";\nimport { _ as getProjectProvider } from \"../../../../../chunks/providers.server.js\";\nimport { u as requireCanCreateProject } from \"../../../../../chunks/access.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\nimport { c as requireCaller, n as collection, o as parseBody, r as created, t as apiRoute } from \"../../../../../chunks/http.js\";\nimport { t as createProjectWithUniqueSlug } from \"../../../../../chunks/createProject.server.js\";\nimport { i as resolveAccessibleProjects } from \"../../../../../chunks/visibility.server.js\";\nimport { n as parseListOptions } from \"../../../../../chunks/pagination.server.js\";\nimport \"../../../../../chunks/route.js\";\nimport { r as CreateProjectBodySchema } from \"../../../../../chunks/bodies.js\";\nimport { randomUUID } from \"node:crypto\";\n//#region src/routes/api/v1/projects/+server.ts\nvar GET = apiRoute(\"Failed to list projects\", async ({ locals, url }) => {\n\tconst { ctx } = requireCaller(locals);\n\tconst { projects } = await resolveAccessibleProjects(ctx);\n\tconst { limit, cursor } = parseListOptions(url);\n\tconst start = cursor ? Number(cursor) : 0;\n\tif (!Number.isInteger(start) || start < 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Invalid cursor\");\n\tconst items = projects.slice(start, start + (limit ?? projects.length));\n\tconst nextIndex = start + items.length;\n\treturn collection({\n\t\titems,\n\t\tnextCursor: nextIndex < projects.length ? String(nextIndex) : void 0\n\t});\n});\nvar POST = apiRoute(\"Failed to create project\", async ({ request, locals }) => {\n\tconst ctx = locals.ctx;\n\tif (!ctx.actingOrgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"No active organization\");\n\tawait requireCanCreateProject(locals, ctx.actingOrgId);\n\tconst input = await parseBody(request, CreateProjectBodySchema);\n\tif (input.visibility === \"platform\" && !hasPermission(ctx, \"instance_admin\")) apiError(403, ApiErrorCode.FORBIDDEN, \"Only a platform admin can create a project with platform visibility.\");\n\tconst autoJoinOnUpload = input.autoJoinOnUpload ?? false;\n\tconst flagIssues = validateProjectFlags({\n\t\tvisibility: input.visibility,\n\t\tautoJoinOnUpload\n\t});\n\tif (flagIssues.length > 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, flagIssues.map((i) => `${i.path}: ${i.message}`).join(\"; \"));\n\tconst project = await createProjectWithUniqueSlug(getProjectProvider(), {\n\t\tid: randomUUID(),\n\t\torgId: ctx.actingOrgId,\n\t\tname: input.name,\n\t\tdescription: input.description,\n\t\tvisibility: input.visibility,\n\t\townerId: locals.user.id,\n\t\tcreatedBy: locals.user.id,\n\t\tupdatedBy: locals.user.id,\n\t\tautoJoinOnUpload\n\t}, {\n\t\twriteCtx: ctx,\n\t\tfallbackSlug: \"project\",\n\t\tconflictScope: \"this organization\"\n\t});\n\treturn created(project);\n});\n//#endregion\nexport { GET, POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAWA;AACG,IAAC,GAAG,GAAG,QAAQ,CAAC,yBAAyB,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK;AACzE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AACtC,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC;AAC1D,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC;AAChD,CAAC,MAAM,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;AAC1C,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;AAC3G,CAAC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,IAAI,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;AACxE,CAAC,MAAM,SAAS,GAAG,KAAK,GAAG,KAAK,CAAC,MAAM;AACvC,CAAC,OAAO,UAAU,CAAC;AACnB,EAAE,KAAK;AACP,EAAE,UAAU,EAAE,SAAS,GAAG,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,KAAK;AACrE,EAAE,CAAC;AACH,CAAC;AACE,IAAC,IAAI,GAAG,QAAQ,CAAC,0BAA0B,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AAC/E,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACvB,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;AAC9F,CAAC,MAAM,uBAAuB,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC;AACvD,CAAC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,uBAAuB,CAAC;AAChE,CAAC,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,sEAAsE,CAAC;AAC5L,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,IAAI,KAAK;AACzD,CAAC,MAAM,UAAU,GAAG,oBAAoB,CAAC;AACzC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU;AAC9B,EAAE;AACF,EAAE,CAAC;AACH,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtI,CAAC,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC,kBAAkB,EAAE,EAAE;AACzE,EAAE,EAAE,EAAE,UAAU,EAAE;AAClB,EAAE,KAAK,EAAE,GAAG,CAAC,WAAW;AACxB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI;AAClB,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW;AAChC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU;AAC9B,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;AACzB,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;AAC3B,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;AAC3B,EAAE;AACF,EAAE,EAAE;AACJ,EAAE,QAAQ,EAAE,GAAG;AACf,EAAE,YAAY,EAAE,SAAS;AACzB,EAAE,aAAa,EAAE;AACjB,EAAE,CAAC;AACH,CAAC,OAAO,OAAO,CAAC,OAAO,CAAC;AACxB,CAAC;;;;"}

package/build/server/chunks/entries/endpoints/auth/email/callback/_server.ts.js-CdGIfwbB.js

@@ -0,0 +1,43 @@
+import { a as getAuthProvider } from '../../../../../chunks/providers.server.js-n7DF9bkc.js';
+import { a as apiError, A as ApiErrorCode } from '../../../../../chunks/api-errors.js-ZUI_rSV_.js';
+import { s as setSessionCookie, a as setRefreshCookie } from '../../../../../chunks/admin-auth.server.js-CL3zHgVM.js';
+import { s as safeRedirectTarget } from '../../../../../chunks/redirect.js-2M2qGbv2.js';
+import { b as bootstrapUserSession } from '../../../../../chunks/auth-bootstrap.server.js-bwuRda0V.js';
+import { redirect } from '@sveltejs/kit';
+import '../../../../../chunks/shared-server.js-BZy9KN6u.js';
+import '../../../../../chunks/src.js-B12bUNyu.js';
+import 'zod';
+import '../../../../../chunks/schema.js-BVfByvmD.js';
+import '../../../../../chunks/core-BQtRL5GE.js-B9MmO4om.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import 'node:dns/promises';
+import 'node:net';
+
+//#region src/routes/auth/email/callback/+server.ts
+/**
+* GET /auth/email/callback?token_hash=...&type=...&redirectTo=/library
+*
+* The user clicked the magic link in their inbox. Hand the full URL to the
+* adapter (it knows its own token format), set cookies on success, redirect
+* to the destination. Mirrors `/auth/supabase/callback` but capability-named
+* — this route doesn't know which IdP brokered the email.
+*/
+var GET = async ({ url, cookies }) => {
+	const emailLink = getAuthProvider().emailLink;
+	if (!emailLink) apiError(501, ApiErrorCode.INTERNAL, "Email sign-in is not supported by this provider.");
+	const result = await emailLink.verifyMagicLink(url.toString());
+	if (!result) apiError(401, ApiErrorCode.UNAUTHORIZED, "This sign-in link is invalid or has expired.");
+	await bootstrapUserSession(result.user);
+	setSessionCookie(cookies, result.sessionToken);
+	if (result.refreshToken) setRefreshCookie(cookies, result.refreshToken);
+	const dest = safeRedirectTarget(url.searchParams.get("redirectTo"), "/library");
+	redirect(303, dest);
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts.js-CdGIfwbB.js.map

package/build/server/chunks/entries/endpoints/auth/email/callback/_server.ts.js-CdGIfwbB.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-CdGIfwbB.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/auth/email/callback/_server.ts.js"],"sourcesContent":["import { r as getAuthProvider } from \"../../../../../chunks/providers.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\nimport { l as setRefreshCookie, u as setSessionCookie } from \"../../../../../chunks/admin-auth.server.js\";\nimport \"../../../../../chunks/auth.server.js\";\nimport { t as safeRedirectTarget } from \"../../../../../chunks/redirect.js\";\nimport { t as bootstrapUserSession } from \"../../../../../chunks/auth-bootstrap.server.js\";\nimport { redirect } from \"@sveltejs/kit\";\n//#region src/routes/auth/email/callback/+server.ts\n/**\n* GET /auth/email/callback?token_hash=...&type=...&redirectTo=/library\n*\n* The user clicked the magic link in their inbox. Hand the full URL to the\n* adapter (it knows its own token format), set cookies on success, redirect\n* to the destination. Mirrors `/auth/supabase/callback` but capability-named\n* — this route doesn't know which IdP brokered the email.\n*/\nvar GET = async ({ url, cookies }) => {\n\tconst emailLink = getAuthProvider().emailLink;\n\tif (!emailLink) apiError(501, ApiErrorCode.INTERNAL, \"Email sign-in is not supported by this provider.\");\n\tconst result = await emailLink.verifyMagicLink(url.toString());\n\tif (!result) apiError(401, ApiErrorCode.UNAUTHORIZED, \"This sign-in link is invalid or has expired.\");\n\tawait bootstrapUserSession(result.user);\n\tsetSessionCookie(cookies, result.sessionToken);\n\tif (result.refreshToken) setRefreshCookie(cookies, result.refreshToken);\n\tconst dest = safeRedirectTarget(url.searchParams.get(\"redirectTo\"), \"/library\");\n\tredirect(303, dest);\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAOA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK;AACtC,CAAC,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC,SAAS;AAC9C,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,kDAAkD,CAAC;AACzG,CAAC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;AAC/D,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,8CAA8C,CAAC;AACtG,CAAC,MAAM,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC;AACxC,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AAC/C,CAAC,IAAI,MAAM,CAAC,YAAY,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AACxE,CAAC,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC;AAChF,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;AACpB;;;;"}

package/build/server/chunks/entries/endpoints/auth/supabase/callback/_server.ts.js-PZw9sYoV.js

@@ -0,0 +1,47 @@
+import { a as getAuthProvider } from '../../../../../chunks/providers.server.js-n7DF9bkc.js';
+import { a as apiError, A as ApiErrorCode } from '../../../../../chunks/api-errors.js-ZUI_rSV_.js';
+import { s as setSessionCookie, a as setRefreshCookie } from '../../../../../chunks/admin-auth.server.js-CL3zHgVM.js';
+import { s as safeRedirectTarget } from '../../../../../chunks/redirect.js-2M2qGbv2.js';
+import { b as bootstrapUserSession } from '../../../../../chunks/auth-bootstrap.server.js-bwuRda0V.js';
+import { redirect } from '@sveltejs/kit';
+import '../../../../../chunks/shared-server.js-BZy9KN6u.js';
+import '../../../../../chunks/src.js-B12bUNyu.js';
+import 'zod';
+import '../../../../../chunks/schema.js-BVfByvmD.js';
+import '../../../../../chunks/core-BQtRL5GE.js-B9MmO4om.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import 'node:dns/promises';
+import 'node:net';
+
+//#region src/routes/auth/supabase/callback/+server.ts
+/**
+* GET /auth/supabase/callback?code=...&redirectTo=/library
+*
+* Completes a Supabase OAuth round-trip. Exchanges the authorization code
+* for a session, sets the session cookie, and redirects to `redirectTo`.
+*
+* Post-verification flow (data-row seeding + first-admin bootstrap) lives in
+* `bootstrapUserSession` so the email-link and OAuth paths follow the same
+* sequence in the same order.
+*/
+var GET = async ({ url, cookies }) => {
+	const code = url.searchParams.get("code");
+	if (!code) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Missing authorization code");
+	const oauth = getAuthProvider().oauth;
+	if (!oauth) apiError(501, ApiErrorCode.INTERNAL, "OAuth is not supported by the configured auth provider.");
+	const result = await oauth.exchangeOAuthCode(code);
+	if (!result) apiError(401, ApiErrorCode.UNAUTHORIZED, "OAuth exchange failed");
+	await bootstrapUserSession(result.user);
+	setSessionCookie(cookies, result.sessionToken);
+	setRefreshCookie(cookies, result.refreshToken);
+	const dest = safeRedirectTarget(url.searchParams.get("redirectTo"), "/library");
+	redirect(303, dest);
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts.js-PZw9sYoV.js.map

package/build/server/chunks/entries/endpoints/auth/supabase/callback/_server.ts.js-PZw9sYoV.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-PZw9sYoV.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/auth/supabase/callback/_server.ts.js"],"sourcesContent":["import { r as getAuthProvider } from \"../../../../../chunks/providers.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\nimport { l as setRefreshCookie, u as setSessionCookie } from \"../../../../../chunks/admin-auth.server.js\";\nimport \"../../../../../chunks/auth.server.js\";\nimport { t as safeRedirectTarget } from \"../../../../../chunks/redirect.js\";\nimport { t as bootstrapUserSession } from \"../../../../../chunks/auth-bootstrap.server.js\";\nimport { redirect } from \"@sveltejs/kit\";\n//#region src/routes/auth/supabase/callback/+server.ts\n/**\n* GET /auth/supabase/callback?code=...&redirectTo=/library\n*\n* Completes a Supabase OAuth round-trip. Exchanges the authorization code\n* for a session, sets the session cookie, and redirects to `redirectTo`.\n*\n* Post-verification flow (data-row seeding + first-admin bootstrap) lives in\n* `bootstrapUserSession` so the email-link and OAuth paths follow the same\n* sequence in the same order.\n*/\nvar GET = async ({ url, cookies }) => {\n\tconst code = url.searchParams.get(\"code\");\n\tif (!code) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing authorization code\");\n\tconst oauth = getAuthProvider().oauth;\n\tif (!oauth) apiError(501, ApiErrorCode.INTERNAL, \"OAuth is not supported by the configured auth provider.\");\n\tconst result = await oauth.exchangeOAuthCode(code);\n\tif (!result) apiError(401, ApiErrorCode.UNAUTHORIZED, \"OAuth exchange failed\");\n\tawait bootstrapUserSession(result.user);\n\tsetSessionCookie(cookies, result.sessionToken);\n\tsetRefreshCookie(cookies, result.refreshToken);\n\tconst dest = safeRedirectTarget(url.searchParams.get(\"redirectTo\"), \"/library\");\n\tredirect(303, dest);\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAOA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK;AACtC,CAAC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;AAC1C,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,4BAA4B,CAAC;AACvF,CAAC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC,KAAK;AACtC,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,yDAAyD,CAAC;AAC5G,CAAC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC;AACnD,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,uBAAuB,CAAC;AAC/E,CAAC,MAAM,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC;AACxC,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AAC/C,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AAC/C,CAAC,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC;AAChF,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;AACpB;;;;"}

package/build/server/chunks/entries/endpoints/auth/supabase/start/_server.ts.js-Un9WRshf.js

@@ -0,0 +1,50 @@
+import { a as getAuthProvider } from '../../../../../chunks/providers.server.js-n7DF9bkc.js';
+import { a as apiError, A as ApiErrorCode } from '../../../../../chunks/api-errors.js-ZUI_rSV_.js';
+import { redirect } from '@sveltejs/kit';
+import '../../../../../chunks/shared-server.js-BZy9KN6u.js';
+import '../../../../../chunks/src.js-B12bUNyu.js';
+import 'zod';
+import '../../../../../chunks/schema.js-BVfByvmD.js';
+import '../../../../../chunks/core-BQtRL5GE.js-B9MmO4om.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+
+//#region src/routes/auth/supabase/start/+server.ts
+var ALLOWED_PROVIDERS = [
+	"google",
+	"github",
+	"azure",
+	"gitlab"
+];
+function isAllowedProvider(value) {
+	return value !== null && ALLOWED_PROVIDERS.includes(value);
+}
+/**
+* GET /auth/supabase/start?provider=google&redirectTo=/library
+*
+* Initiates an OAuth sign-in via Supabase Auth. The Supabase project must
+* have the named provider enabled in its dashboard. Bounces the browser to
+* the IdP's authorize endpoint; the IdP returns to `/auth/supabase/callback`
+* with a `?code=...`.
+*
+* `redirectTo` is preserved through the round trip via `?redirectTo=...` on
+* the callback URL we hand to Supabase.
+*/
+var GET = async ({ url }) => {
+	const provider = url.searchParams.get("provider");
+	if (!isAllowedProvider(provider)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid provider. Allowed: ${ALLOWED_PROVIDERS.join(", ")}`);
+	const oauth = getAuthProvider().oauth;
+	if (!oauth) apiError(501, ApiErrorCode.INTERNAL, "OAuth is not supported by the configured auth provider.");
+	const redirectTo = url.searchParams.get("redirectTo") ?? "/library";
+	const callbackUrl = new URL("/auth/supabase/callback", url.origin);
+	if (redirectTo.startsWith("/")) callbackUrl.searchParams.set("redirectTo", redirectTo);
+	const authorizationUrl = await oauth.getOAuthAuthorizationUrl(provider, callbackUrl.toString());
+	redirect(303, authorizationUrl);
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts.js-Un9WRshf.js.map

package/build/server/chunks/entries/endpoints/auth/supabase/start/_server.ts.js-Un9WRshf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-Un9WRshf.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/auth/supabase/start/_server.ts.js"],"sourcesContent":["import { r as getAuthProvider } from \"../../../../../chunks/providers.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\nimport \"../../../../../chunks/auth.server.js\";\nimport { redirect } from \"@sveltejs/kit\";\n//#region src/routes/auth/supabase/start/+server.ts\nvar ALLOWED_PROVIDERS = [\n\t\"google\",\n\t\"github\",\n\t\"azure\",\n\t\"gitlab\"\n];\nfunction isAllowedProvider(value) {\n\treturn value !== null && ALLOWED_PROVIDERS.includes(value);\n}\n/**\n* GET /auth/supabase/start?provider=google&redirectTo=/library\n*\n* Initiates an OAuth sign-in via Supabase Auth. The Supabase project must\n* have the named provider enabled in its dashboard. Bounces the browser to\n* the IdP's authorize endpoint; the IdP returns to `/auth/supabase/callback`\n* with a `?code=...`.\n*\n* `redirectTo` is preserved through the round trip via `?redirectTo=...` on\n* the callback URL we hand to Supabase.\n*/\nvar GET = async ({ url }) => {\n\tconst provider = url.searchParams.get(\"provider\");\n\tif (!isAllowedProvider(provider)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid provider. Allowed: ${ALLOWED_PROVIDERS.join(\", \")}`);\n\tconst oauth = getAuthProvider().oauth;\n\tif (!oauth) apiError(501, ApiErrorCode.INTERNAL, \"OAuth is not supported by the configured auth provider.\");\n\tconst redirectTo = url.searchParams.get(\"redirectTo\") ?? \"/library\";\n\tconst callbackUrl = new URL(\"/auth/supabase/callback\", url.origin);\n\tif (redirectTo.startsWith(\"/\")) callbackUrl.searchParams.set(\"redirectTo\", redirectTo);\n\tconst authorizationUrl = await oauth.getOAuthAuthorizationUrl(provider, callbackUrl.toString());\n\tredirect(303, authorizationUrl);\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;AAIA;AACA,IAAI,iBAAiB,GAAG;AACxB,CAAC,QAAQ;AACT,CAAC,QAAQ;AACT,CAAC,OAAO;AACR,CAAC;AACD,CAAC;AACD,SAAS,iBAAiB,CAAC,KAAK,EAAE;AAClC,CAAC,OAAO,KAAK,KAAK,IAAI,IAAI,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC;AAC3D;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,KAAK;AAC7B,CAAC,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC;AAClD,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,2BAA2B,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC9I,CAAC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC,KAAK;AACtC,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,yDAAyD,CAAC;AAC5G,CAAC,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,UAAU;AACpE,CAAC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,yBAAyB,EAAE,GAAG,CAAC,MAAM,CAAC;AACnE,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC;AACvF,CAAC,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,wBAAwB,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC;AAChG,CAAC,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;AAChC;;;;"}

package/build/server/chunks/entries/endpoints/docs/api/openapi.yaml/_server.ts.js-I_diP87U.js

@@ -0,0 +1,11 @@
+//#region openapi/v1.yaml?raw
+var v1_default = "# Generated from the Zod validators and the route registry in\n# src/lib/server/api/v1/. Do not edit by hand — `pnpm test` fails when this\n# file drifts from the code. Regenerate with `pnpm openapi:generate`.\nopenapi: \"3.1.0\"\ninfo:\n  title: Selva API\n  version: \"1.0.0\"\n  description: \"The tenant-scoped Selva API. Every endpoint acts as the calling identity and is confined to that identity's organization.\\n\\n**Stability.** Public endpoints are additive-only within v1: new optional fields and parameters may appear, but nothing is removed, renamed, or changed in type or meaning. A breaking change ships as a new route under `/api/v2` alongside this one. Anything deprecated inside v1 keeps working for a stated window and returns a `Deprecation` header while it does.\\n\\n**Operations marked `x-internal` carry none of that promise.** They exist to serve the Selva web UI and may change or disappear without notice.\\n\\n**Existence is never disclosed.** A resource the caller may not see returns `404`, not `403`. `403` means the resource is visible but the action is not allowed.\\n\\n**No CORS.** `/api/v1` sends no cross-origin headers; it serves same-origin browser requests and non-browser clients holding a token.\\n\\nInstance administration lives at `/api/admin`, is session-only, is never reachable with a bearer token, and is not described here.\"\n  license:\n    name: MIT\nservers:\n  - url: /\n    description: The Selva instance serving this document.\nsecurity:\n  - cookieAuth: []\n  - bearerAuth: []\ncomponents:\n  securitySchemes:\n    cookieAuth:\n      type: apiKey\n      in: cookie\n      name: session\n      description: Browser session cookie. Same-origin only.\n    bearerAuth:\n      type: http\n      scheme: bearer\n      description: \"A personal access token. `/api/v1` is the only prefix that accepts one — `/api/admin` never does.\"\n  parameters:\n    limit:\n      name: limit\n      in: query\n      required: false\n      description: \"Page size. Out-of-range values clamp rather than fail, so a client walking a cursor is never stopped by pagination plumbing. Default 50.\"\n      schema:\n        type: integer\n        minimum: 1\n        maximum: 200\n    cursor:\n      name: cursor\n      in: query\n      required: false\n      description: \"An opaque cursor from a previous response's `nextCursor`. Do not construct or parse one.\"\n      schema:\n        type: string\n    orderBy:\n      name: orderBy\n      in: query\n      required: false\n      schema:\n        type: string\n        enum:\n          - createdAt\n          - updatedAt\n          - name\n    orderDir:\n      name: orderDir\n      in: query\n      required: false\n      schema:\n        type: string\n        enum:\n          - asc\n          - desc\n  schemas:\n    Page:\n      type: object\n      description: \"The envelope every collection returns. `nextCursor` is absent on the last page.\"\n      properties:\n        items:\n          type: array\n          items:\n            type: object\n        nextCursor:\n          type: string\n      required:\n        - items\n    Error:\n      type: object\n      description: \"Every failure carries this shape. Branch on `code`, not on the human-readable `message`.\"\n      properties:\n        message:\n          type: string\n        code:\n          type: string\n          enum:\n            - VALIDATION_FAILED\n            - UNAUTHORIZED\n            - FORBIDDEN\n            - NOT_FOUND\n            - CONFLICT\n            - UNPROCESSABLE\n            - COMPUTE_UNAVAILABLE\n            - SETUP_REQUIRED\n            - INTERNAL\n        fields:\n          type: object\n          description: \"Per-field messages, keyed by dotted path. Present on validation failures.\"\n          additionalProperties:\n            type: string\n      required:\n        - message\n        - code\npaths:\n  /api/v1/me:\n    get:\n      summary: \"The calling identity, its acting org, and its effective permissions.\"\n      operationId: getMe\n      tags:\n        - Me\n      responses:\n        \"200\":\n          description: Success.\n          content:\n            application/json:\n              schema:\n                type: object\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n  \"/api/v1/me/starred/{guid}\":\n    put:\n      summary: Star a definition. Idempotent.\n      operationId: putMeStarredByGuid\n      tags:\n        - Me\n      parameters:\n        - name: guid\n          in: path\n          required: true\n          schema:\n            type: string\n      responses:\n        \"204\":\n          description: Success. No content.\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"404\":\n          description: \"No such resource, or the caller cannot see it.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n    delete:\n      summary: Unstar a definition. Idempotent.\n      operationId: deleteMeStarredByGuid\n      tags:\n        - Me\n      parameters:\n        - name: guid\n          in: path\n          required: true\n          schema:\n            type: string\n      responses:\n        \"204\":\n          description: Success. No content.\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n  /api/v1/definitions:\n    get:\n      summary: List definitions the caller can see.\n      operationId: getDefinitions\n      tags:\n        - Definitions\n      parameters:\n        - $ref: \"#/components/parameters/limit\"\n        - $ref: \"#/components/parameters/cursor\"\n        - $ref: \"#/components/parameters/orderBy\"\n        - $ref: \"#/components/parameters/orderDir\"\n        - name: projectId\n          in: query\n          required: false\n          description: Restrict to one project.\n          schema:\n            type: string\n        - name: status\n          in: query\n          required: false\n          description: \"One of `draft`, `published`, `archived`.\"\n          schema:\n            type: string\n      responses:\n        \"200\":\n          description: A page of results.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Page\"\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n    post:\n      summary: Create a definition from a Grasshopper file.\n      operationId: postDefinitions\n      tags:\n        - Definitions\n      requestBody:\n        required: true\n        content:\n          multipart/form-data:\n            schema:\n              type: object\n              properties:\n                file:\n                  type: string\n                  description: \"The `.gh` or `.ghx` file.\"\n                projectId:\n                  type: string\n                  description: Owning project.\n                displayName:\n                  type: string\n                  description: Human-readable name.\n                description:\n                  type: string\n                  description: Long description.\n                category:\n                  type: string\n                  description: Grouping label.\n                tags:\n                  type: string\n                  description: Comma-separated tags.\n                image:\n                  type: string\n                  description: Cover image.\n                computeServerId:\n                  type: string\n                  description: Pin to a compute server.\n              required:\n                - file\n                - projectId\n                - displayName\n      responses:\n        \"201\":\n          description: Success.\n          content:\n            application/json:\n              schema:\n                type: object\n        \"400\":\n          description: Validation failed.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"403\":\n          description: \"Authenticated, but not permitted to perform this action.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"422\":\n          description: Well-formed but not processable.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"503\":\n          description: The compute server is unconfigured or unreachable.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n  \"/api/v1/definitions/{guid}\":\n    get:\n      summary: Definition record plus its live and draft version summaries.\n      operationId: getDefinitionsByGuid\n      tags:\n        - Definitions\n      parameters:\n        - name: guid\n          in: path\n          required: true\n          schema:\n            type: string\n      responses:\n        \"200\":\n          description: Success.\n          content:\n            application/json:\n              schema:\n                type: object\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"404\":\n          description: \"No such resource, or the caller cannot see it.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n    patch:\n      summary: Update definition metadata.\n      operationId: patchDefinitionsByGuid\n      tags:\n        - Definitions\n      parameters:\n        - name: guid\n          in: path\n          required: true\n          schema:\n            type: string\n      responses:\n        \"204\":\n          description: Success. No content.\n        \"400\":\n          description: Validation failed.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"404\":\n          description: \"No such resource, or the caller cannot see it.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n    delete:\n      summary: Soft-delete a definition.\n      operationId: deleteDefinitionsByGuid\n      tags:\n        - Definitions\n      parameters:\n        - name: guid\n          in: path\n          required: true\n          schema:\n            type: string\n      responses:\n        \"204\":\n          description: Success. No content.\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"404\":\n          description: \"No such resource, or the caller cannot see it.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n  \"/api/v1/definitions/{guid}/solve\":\n    post:\n      summary: Solve a definition. The primary action of the API.\n      operationId: postDefinitionsByGuidSolve\n      tags:\n        - Definitions\n      parameters:\n        - name: guid\n          in: path\n          required: true\n          schema:\n            type: string\n        - name: Idempotency-Key\n          in: header\n          required: false\n          description: \"A client-chosen key. Repeating a request with the same key within the retention window replays the first response instead of solving again; the replay carries `Idempotency-Replayed: true`. The store is per-process and in-memory — it absorbs retries, it is not a durable result cache, and it does not survive a restart or a second app instance.\"\n          schema:\n            type: string\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              type: object\n              properties:\n                inputs:\n                  default: []\n                  type: array\n                  items: {}\n                values:\n                  default: {}\n                  type: object\n                  propertyNames:\n                    type: string\n                  additionalProperties: {}\n                channel:\n                  default: live\n                  type: string\n                  enum:\n                    - live\n                    - draft\n                versionId:\n                  type: string\n                definitionUrl:\n                  type: string\n      responses:\n        \"200\":\n          description: Success.\n          content:\n            application/json:\n              schema:\n                type: object\n        \"400\":\n          description: Validation failed.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"404\":\n          description: \"No such resource, or the caller cannot see it.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"429\":\n          description: \"Rate limited. Retry after the interval in `Retry-After`.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"503\":\n          description: The compute server is unconfigured or unreachable.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n  \"/api/v1/definitions/{guid}/schema\":\n    get:\n      summary: \"The live version's UI schema. 404 when nothing is published.\"\n      operationId: getDefinitionsByGuidSchema\n      tags:\n        - Definitions\n      parameters:\n        - name: guid\n          in: path\n          required: true\n          schema:\n            type: string\n      responses:\n        \"200\":\n          description: Success.\n          content:\n            application/json:\n              schema:\n                type: object\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"404\":\n          description: \"No such resource, or the caller cannot see it.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n  \"/api/v1/definitions/{guid}/versions\":\n    get:\n      summary: \"List versions, newest first.\"\n      operationId: getDefinitionsByGuidVersions\n      tags:\n        - Definitions\n      parameters:\n        - name: guid\n          in: path\n          required: true\n          schema:\n            type: string\n        - $ref: \"#/components/parameters/limit\"\n        - $ref: \"#/components/parameters/cursor\"\n        - $ref: \"#/components/parameters/orderBy\"\n        - $ref: \"#/components/parameters/orderDir\"\n      responses:\n        \"200\":\n          description: A page of results.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Page\"\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"404\":\n          description: \"No such resource, or the caller cannot see it.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n    post:\n      summary: Upload a new version.\n      operationId: postDefinitionsByGuidVersions\n      tags:\n        - Definitions\n      parameters:\n        - name: guid\n          in: path\n          required: true\n          schema:\n            type: string\n      requestBody:\n        required: true\n        content:\n          multipart/form-data:\n            schema:\n              type: object\n              properties:\n                file:\n                  type: string\n                  description: \"The `.gh` or `.ghx` file.\"\n                changeNote:\n                  type: string\n                  description: Truncated to 1000 characters.\n              required:\n                - file\n      responses:\n        \"201\":\n          description: Success.\n          content:\n            application/json:\n              schema:\n                type: object\n        \"400\":\n          description: Validation failed.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"404\":\n          description: \"No such resource, or the caller cannot see it.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"422\":\n          description: Well-formed but not processable.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"503\":\n          description: The compute server is unconfigured or unreachable.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n  \"/api/v1/definitions/{guid}/versions/{versionId}\":\n    get:\n      summary: \"One version, without its cached schema.\"\n      operationId: getDefinitionsByGuidVersionsByVersionId\n      tags:\n        - Definitions\n      parameters:\n        - name: guid\n          in: path\n          required: true\n          schema:\n            type: string\n        - name: versionId\n          in: path\n          required: true\n          schema:\n            type: string\n      responses:\n        \"200\":\n          description: Success.\n          content:\n            application/json:\n              schema:\n                type: object\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"404\":\n          description: \"No such resource, or the caller cannot see it.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n    delete:\n      summary: Delete a version. 409 when it is the live or draft pointer.\n      operationId: deleteDefinitionsByGuidVersionsByVersionId\n      tags:\n        - Definitions\n      parameters:\n        - name: guid\n          in: path\n          required: true\n          schema:\n            type: string\n        - name: versionId\n          in: path\n          required: true\n          schema:\n            type: string\n      responses:\n        \"204\":\n          description: Success. No content.\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"404\":\n          description: \"No such resource, or the caller cannot see it.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"409\":\n          description: The request conflicts with the current state.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n  \"/api/v1/definitions/{guid}/versions/{versionId}/schema\":\n    get:\n      summary: \"That version's cached UI schema. No compute round-trip.\"\n      operationId: getDefinitionsByGuidVersionsByVersionIdSchema\n      tags:\n        - Definitions\n      parameters:\n        - name: guid\n          in: path\n          required: true\n          schema:\n            type: string\n        - name: versionId\n          in: path\n          required: true\n          schema:\n            type: string\n      responses:\n        \"200\":\n          description: Success.\n          content:\n            application/json:\n              schema:\n                type: object\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"404\":\n          description: \"No such resource, or the caller cannot see it.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n  \"/api/v1/definitions/{guid}/publish\":\n    post:\n      summary: Promote a version to live.\n      operationId: postDefinitionsByGuidPublish\n      tags:\n        - Definitions\n      parameters:\n        - name: guid\n          in: path\n          required: true\n          schema:\n            type: string\n      responses:\n        \"200\":\n          description: Success.\n          content:\n            application/json:\n              schema:\n                type: object\n        \"400\":\n          description: Validation failed.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"404\":\n          description: \"No such resource, or the caller cannot see it.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n  \"/api/v1/definitions/{guid}/image\":\n    post:\n      summary: Upload a cover image.\n      operationId: postDefinitionsByGuidImage\n      tags:\n        - Definitions\n      parameters:\n        - name: guid\n          in: path\n          required: true\n          schema:\n            type: string\n      requestBody:\n        required: true\n        content:\n          multipart/form-data:\n            schema:\n              type: object\n              properties:\n                image:\n                  type: string\n                  description: \"PNG, JPEG, WebP or GIF.\"\n              required:\n                - image\n      responses:\n        \"200\":\n          description: Success.\n          content:\n            application/json:\n              schema:\n                type: object\n        \"400\":\n          description: Validation failed.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"404\":\n          description: \"No such resource, or the caller cannot see it.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n  \"/api/v1/definitions/{guid}/share-links\":\n    get:\n      summary: List share links. 404 when sharing is disabled on the instance.\n      operationId: getDefinitionsByGuidShare-links\n      tags:\n        - Definitions\n      parameters:\n        - name: guid\n          in: path\n          required: true\n          schema:\n            type: string\n        - $ref: \"#/components/parameters/limit\"\n        - $ref: \"#/components/parameters/cursor\"\n        - $ref: \"#/components/parameters/orderBy\"\n        - $ref: \"#/components/parameters/orderDir\"\n      responses:\n        \"200\":\n          description: A page of results.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Page\"\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"404\":\n          description: \"No such resource, or the caller cannot see it.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n    post:\n      summary: Create a share link. The raw token is returned once and never again.\n      operationId: postDefinitionsByGuidShare-links\n      tags:\n        - Definitions\n      parameters:\n        - name: guid\n          in: path\n          required: true\n          schema:\n            type: string\n      responses:\n        \"201\":\n          description: Success.\n          content:\n            application/json:\n              schema:\n                type: object\n        \"400\":\n          description: Validation failed.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"404\":\n          description: \"No such resource, or the caller cannot see it.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n  \"/api/v1/definitions/{guid}/share-links/{linkId}\":\n    delete:\n      summary: Revoke a share link.\n      operationId: deleteDefinitionsByGuidShare-linksByLinkId\n      tags:\n        - Definitions\n      parameters:\n        - name: guid\n          in: path\n          required: true\n          schema:\n            type: string\n        - name: linkId\n          in: path\n          required: true\n          schema:\n            type: string\n      responses:\n        \"204\":\n          description: Success. No content.\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"404\":\n          description: \"No such resource, or the caller cannot see it.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n  /api/v1/projects:\n    get:\n      summary: List projects the caller can view.\n      operationId: getProjects\n      tags:\n        - Projects\n      parameters:\n        - $ref: \"#/components/parameters/limit\"\n        - $ref: \"#/components/parameters/cursor\"\n        - $ref: \"#/components/parameters/orderBy\"\n        - $ref: \"#/components/parameters/orderDir\"\n      responses:\n        \"200\":\n          description: A page of results.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Page\"\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n    post:\n      summary: Create a project.\n      operationId: postProjects\n      tags:\n        - Projects\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              type: object\n              properties:\n                name:\n                  type: string\n                  minLength: 1\n                  maxLength: 128\n                description:\n                  type: string\n                  maxLength: 2000\n                visibility:\n                  default: private\n                  type: string\n                  enum:\n                    - public\n                    - org\n                    - private\n                    - platform\n                autoJoinOnUpload:\n                  type: boolean\n              required:\n                - name\n      responses:\n        \"201\":\n          description: Success.\n          content:\n            application/json:\n              schema:\n                type: object\n        \"400\":\n          description: Validation failed.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"403\":\n          description: \"Authenticated, but not permitted to perform this action.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"409\":\n          description: The request conflicts with the current state.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n  \"/api/v1/projects/{id}\":\n    get:\n      summary: \"Project record plus the caller's effective role and capabilities.\"\n      operationId: getProjectsById\n      tags:\n        - Projects\n      parameters:\n        - name: id\n          in: path\n          required: true\n          schema:\n            type: string\n      responses:\n        \"200\":\n          description: Success.\n          content:\n            application/json:\n              schema:\n                type: object\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"404\":\n          description: \"No such resource, or the caller cannot see it.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n    patch:\n      summary: Update project settings. Owner-only.\n      operationId: patchProjectsById\n      tags:\n        - Projects\n      parameters:\n        - name: id\n          in: path\n          required: true\n          schema:\n            type: string\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              type: object\n              properties:\n                name:\n                  type: string\n                  minLength: 1\n                  maxLength: 128\n                description:\n                  anyOf:\n                    - type: string\n                      maxLength: 2000\n                    - type: \"null\"\n                visibility:\n                  type: string\n                  enum:\n                    - public\n                    - org\n                    - private\n                    - platform\n                autoJoinOnUpload:\n                  type: boolean\n      responses:\n        \"204\":\n          description: Success. No content.\n        \"400\":\n          description: Validation failed.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"403\":\n          description: \"Authenticated, but not permitted to perform this action.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"404\":\n          description: \"No such resource, or the caller cannot see it.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"409\":\n          description: The request conflicts with the current state.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n    delete:\n      summary: Delete a project.\n      operationId: deleteProjectsById\n      tags:\n        - Projects\n      parameters:\n        - name: id\n          in: path\n          required: true\n          schema:\n            type: string\n      responses:\n        \"204\":\n          description: Success. No content.\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"403\":\n          description: \"Authenticated, but not permitted to perform this action.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"404\":\n          description: \"No such resource, or the caller cannot see it.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n  \"/api/v1/projects/{id}/members\":\n    get:\n      summary: List project members.\n      operationId: getProjectsByIdMembers\n      tags:\n        - Projects\n      parameters:\n        - name: id\n          in: path\n          required: true\n          schema:\n            type: string\n        - $ref: \"#/components/parameters/limit\"\n        - $ref: \"#/components/parameters/cursor\"\n        - $ref: \"#/components/parameters/orderBy\"\n        - $ref: \"#/components/parameters/orderDir\"\n      responses:\n        \"200\":\n          description: A page of results.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Page\"\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"403\":\n          description: \"Authenticated, but not permitted to perform this action.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"404\":\n          description: \"No such resource, or the caller cannot see it.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n    post:\n      summary: Add a member. The target must already belong to the org.\n      operationId: postProjectsByIdMembers\n      tags:\n        - Projects\n      parameters:\n        - name: id\n          in: path\n          required: true\n          schema:\n            type: string\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              type: object\n              properties:\n                userId:\n                  type: string\n                  minLength: 1\n                role:\n                  type: string\n                  enum:\n                    - owner\n                    - editor\n                    - viewer\n              required:\n                - userId\n                - role\n      responses:\n        \"201\":\n          description: Success.\n          content:\n            application/json:\n              schema:\n                type: object\n        \"400\":\n          description: Validation failed.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"403\":\n          description: \"Authenticated, but not permitted to perform this action.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"404\":\n          description: \"No such resource, or the caller cannot see it.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n  \"/api/v1/projects/{id}/members/{userId}\":\n    patch:\n      summary: Change a member role.\n      operationId: patchProjectsByIdMembersByUserId\n      tags:\n        - Projects\n      parameters:\n        - name: id\n          in: path\n          required: true\n          schema:\n            type: string\n        - name: userId\n          in: path\n          required: true\n          schema:\n            type: string\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              type: object\n              properties:\n                role:\n                  type: string\n                  enum:\n                    - owner\n                    - editor\n                    - viewer\n              required:\n                - role\n      responses:\n        \"204\":\n          description: Success. No content.\n        \"400\":\n          description: Validation failed.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"403\":\n          description: \"Authenticated, but not permitted to perform this action.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"404\":\n          description: \"No such resource, or the caller cannot see it.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"409\":\n          description: The request conflicts with the current state.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n    delete:\n      summary: Remove a member. Idempotent.\n      operationId: deleteProjectsByIdMembersByUserId\n      tags:\n        - Projects\n      parameters:\n        - name: id\n          in: path\n          required: true\n          schema:\n            type: string\n        - name: userId\n          in: path\n          required: true\n          schema:\n            type: string\n        - name: confirm\n          in: query\n          required: false\n          description: \"Set to `true` to remove a co-owner; without it the call returns 409.\"\n          schema:\n            type: string\n      responses:\n        \"204\":\n          description: Success. No content.\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"403\":\n          description: \"Authenticated, but not permitted to perform this action.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"404\":\n          description: \"No such resource, or the caller cannot see it.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"409\":\n          description: The request conflicts with the current state.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n  \"/api/v1/projects/{id}/reclaim\":\n    post:\n      summary: Claim ownership of an unowned project.\n      operationId: postProjectsByIdReclaim\n      tags:\n        - Projects\n      parameters:\n        - name: id\n          in: path\n          required: true\n          schema:\n            type: string\n      responses:\n        \"201\":\n          description: Success.\n          content:\n            application/json:\n              schema:\n                type: object\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"403\":\n          description: \"Authenticated, but not permitted to perform this action.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"404\":\n          description: \"No such resource, or the caller cannot see it.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"409\":\n          description: The request conflicts with the current state.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n  \"/api/v1/orgs/{orgId}\":\n    get:\n      summary: \"Org record. The org must be the caller's acting org.\"\n      operationId: getOrgsByOrgId\n      tags:\n        - Orgs\n      parameters:\n        - name: orgId\n          in: path\n          required: true\n          schema:\n            type: string\n      responses:\n        \"200\":\n          description: Success.\n          content:\n            application/json:\n              schema:\n                type: object\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"403\":\n          description: \"Authenticated, but not permitted to perform this action.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"404\":\n          description: \"No such resource, or the caller cannot see it.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n  \"/api/v1/orgs/{orgId}/members\":\n    get:\n      summary: List org members.\n      operationId: getOrgsByOrgIdMembers\n      tags:\n        - Orgs\n      parameters:\n        - name: orgId\n          in: path\n          required: true\n          schema:\n            type: string\n        - $ref: \"#/components/parameters/limit\"\n        - $ref: \"#/components/parameters/cursor\"\n        - $ref: \"#/components/parameters/orderBy\"\n        - $ref: \"#/components/parameters/orderDir\"\n      responses:\n        \"200\":\n          description: A page of results.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Page\"\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"403\":\n          description: \"Authenticated, but not permitted to perform this action.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n  \"/api/v1/orgs/{orgId}/members/{userId}\":\n    patch:\n      summary: Change an org role or permission set. The sole owner cannot be demoted.\n      operationId: patchOrgsByOrgIdMembersByUserId\n      tags:\n        - Orgs\n      parameters:\n        - name: orgId\n          in: path\n          required: true\n          schema:\n            type: string\n        - name: userId\n          in: path\n          required: true\n          schema:\n            type: string\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              type: object\n              properties:\n                role:\n                  type: string\n                  enum:\n                    - owner\n                    - admin\n                    - member\n                permissions:\n                  type: array\n                  items:\n                    type: string\n                    enum:\n                      - manage_org_members\n                      - manage_org_compute\n                      - manage_definitions\n                      - manage_projects\n      responses:\n        \"204\":\n          description: Success. No content.\n        \"400\":\n          description: Validation failed.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"403\":\n          description: \"Authenticated, but not permitted to perform this action.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"404\":\n          description: \"No such resource, or the caller cannot see it.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"409\":\n          description: The request conflicts with the current state.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n    delete:\n      summary: Remove an org member. The sole owner cannot be removed.\n      operationId: deleteOrgsByOrgIdMembersByUserId\n      tags:\n        - Orgs\n      parameters:\n        - name: orgId\n          in: path\n          required: true\n          schema:\n            type: string\n        - name: userId\n          in: path\n          required: true\n          schema:\n            type: string\n      responses:\n        \"204\":\n          description: Success. No content.\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"403\":\n          description: \"Authenticated, but not permitted to perform this action.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"404\":\n          description: \"No such resource, or the caller cannot see it.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"409\":\n          description: The request conflicts with the current state.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n  \"/api/v1/orgs/{orgId}/invites\":\n    get:\n      summary: List pending invites.\n      operationId: getOrgsByOrgIdInvites\n      tags:\n        - Orgs\n      parameters:\n        - name: orgId\n          in: path\n          required: true\n          schema:\n            type: string\n        - $ref: \"#/components/parameters/limit\"\n        - $ref: \"#/components/parameters/cursor\"\n        - $ref: \"#/components/parameters/orderBy\"\n        - $ref: \"#/components/parameters/orderDir\"\n      responses:\n        \"200\":\n          description: A page of results.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Page\"\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"403\":\n          description: \"Authenticated, but not permitted to perform this action.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n    post:\n      summary: Invite someone to the org. The accept URL is returned once.\n      operationId: postOrgsByOrgIdInvites\n      tags:\n        - Orgs\n      parameters:\n        - name: orgId\n          in: path\n          required: true\n          schema:\n            type: string\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              type: object\n              properties:\n                email:\n                  type: string\n                  format: email\n                  pattern: \"^(?!\\\\.)(?!.*\\\\.\\\\.)([A-Za-z0-9_'+\\\\-\\\\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\\\\-]*\\\\.)+[A-Za-z]{2,}$\"\n                orgRole:\n                  default: member\n                  type: string\n                  enum:\n                    - owner\n                    - admin\n                    - member\n                permissions:\n                  default: []\n                  type: array\n                  items:\n                    anyOf:\n                      - type: string\n                        enum:\n                          - instance_admin\n                          - manage_compute\n                          - manage_instance_users\n                          - manage_updates\n                      - type: string\n                        enum:\n                          - manage_org_members\n                          - manage_org_compute\n                          - manage_definitions\n                          - manage_projects\n              required:\n                - email\n      responses:\n        \"201\":\n          description: Success.\n          content:\n            application/json:\n              schema:\n                type: object\n        \"400\":\n          description: Validation failed.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"403\":\n          description: \"Authenticated, but not permitted to perform this action.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"409\":\n          description: The request conflicts with the current state.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n  \"/api/v1/orgs/{orgId}/invites/{id}\":\n    delete:\n      summary: Revoke an invite.\n      operationId: deleteOrgsByOrgIdInvitesById\n      tags:\n        - Orgs\n      parameters:\n        - name: orgId\n          in: path\n          required: true\n          schema:\n            type: string\n        - name: id\n          in: path\n          required: true\n          schema:\n            type: string\n      responses:\n        \"204\":\n          description: Success. No content.\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"403\":\n          description: \"Authenticated, but not permitted to perform this action.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"404\":\n          description: \"No such resource, or the caller cannot see it.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n  \"/api/v1/orgs/{orgId}/invites/{id}/resend\":\n    post:\n      summary: \"Re-send an invite. Issues a replacement and revokes the original, so the previous link stops working.\"\n      operationId: postOrgsByOrgIdInvitesByIdResend\n      tags:\n        - Orgs\n      parameters:\n        - name: orgId\n          in: path\n          required: true\n          schema:\n            type: string\n        - name: id\n          in: path\n          required: true\n          schema:\n            type: string\n      responses:\n        \"201\":\n          description: Success.\n          content:\n            application/json:\n              schema:\n                type: object\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"403\":\n          description: \"Authenticated, but not permitted to perform this action.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"404\":\n          description: \"No such resource, or the caller cannot see it.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"409\":\n          description: The request conflicts with the current state.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n  \"/api/v1/orgs/{orgId}/compute\":\n    get:\n      summary: Org compute-server overrides and the shared catalog.\n      operationId: getOrgsByOrgIdCompute\n      tags:\n        - Orgs\n      x-internal: true\n      parameters:\n        - name: orgId\n          in: path\n          required: true\n          schema:\n            type: string\n      responses:\n        \"200\":\n          description: Success.\n          content:\n            application/json:\n              schema:\n                type: object\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"403\":\n          description: \"Authenticated, but not permitted to perform this action.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n    patch:\n      summary: Replace the org compute-server overrides.\n      operationId: patchOrgsByOrgIdCompute\n      tags:\n        - Orgs\n      x-internal: true\n      parameters:\n        - name: orgId\n          in: path\n          required: true\n          schema:\n            type: string\n      requestBody:\n        required: true\n        content:\n          application/json:\n            schema:\n              type: object\n              properties:\n                servers:\n                  type: array\n                  items:\n                    type: object\n                    properties:\n                      id:\n                        type: string\n                        minLength: 1\n                      label:\n                        type: string\n                        minLength: 1\n                      serverUrl:\n                        type: string\n                        minLength: 1\n                      apiKey:\n                        anyOf:\n                          - type: string\n                          - type: \"null\"\n                      timeoutMs:\n                        type: number\n                      retryCount:\n                        type: number\n                    required:\n                      - id\n                      - label\n                      - serverUrl\n                defaultServerId:\n                  anyOf:\n                    - type: string\n                    - type: \"null\"\n              required:\n                - servers\n      responses:\n        \"204\":\n          description: Success. No content.\n        \"400\":\n          description: Validation failed.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"403\":\n          description: \"Authenticated, but not permitted to perform this action.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n  \"/api/v1/orgs/{orgId}/assets/{kind}\":\n    post:\n      summary: Upload an org branding asset.\n      operationId: postOrgsByOrgIdAssetsByKind\n      tags:\n        - Orgs\n      x-internal: true\n      parameters:\n        - name: orgId\n          in: path\n          required: true\n          schema:\n            type: string\n        - name: kind\n          in: path\n          required: true\n          schema:\n            type: string\n      requestBody:\n        required: true\n        content:\n          multipart/form-data:\n            schema:\n              type: object\n              properties:\n                image:\n                  type: string\n                  description: \"PNG, JPEG, WebP, GIF or SVG.\"\n              required:\n                - image\n      responses:\n        \"200\":\n          description: Success.\n          content:\n            application/json:\n              schema:\n                type: object\n        \"400\":\n          description: Validation failed.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"403\":\n          description: \"Authenticated, but not permitted to perform this action.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"404\":\n          description: \"No such resource, or the caller cannot see it.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n    delete:\n      summary: Remove an org branding asset.\n      operationId: deleteOrgsByOrgIdAssetsByKind\n      tags:\n        - Orgs\n      x-internal: true\n      parameters:\n        - name: orgId\n          in: path\n          required: true\n          schema:\n            type: string\n        - name: kind\n          in: path\n          required: true\n          schema:\n            type: string\n      responses:\n        \"204\":\n          description: Success. No content.\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"403\":\n          description: \"Authenticated, but not permitted to perform this action.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"404\":\n          description: \"No such resource, or the caller cannot see it.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n  /api/v1/compute:\n    post:\n      summary: \"Generic solve, including remote definition URLs and share-token access.\"\n      operationId: postCompute\n      tags:\n        - Compute\n      x-internal: true\n      responses:\n        \"200\":\n          description: Success.\n          content:\n            application/json:\n              schema:\n                type: object\n        \"400\":\n          description: Validation failed.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"404\":\n          description: \"No such resource, or the caller cannot see it.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"429\":\n          description: \"Rate limited. Retry after the interval in `Retry-After`.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"503\":\n          description: The compute server is unconfigured or unreachable.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n  /api/v1/compute/schema:\n    post:\n      summary: Extract UI schemas from an uploaded file before it becomes a definition.\n      operationId: postComputeSchema\n      tags:\n        - Compute\n      x-internal: true\n      parameters:\n        - name: projectId\n          in: query\n          required: false\n          description: Project the file will belong to.\n          schema:\n            type: string\n        - name: computeServerId\n          in: query\n          required: false\n          description: Pin to a compute server.\n          schema:\n            type: string\n      requestBody:\n        required: true\n        content:\n          multipart/form-data:\n            schema:\n              type: object\n              properties:\n                file:\n                  type: string\n                  description: \"The `.gh` or `.ghx` file.\"\n              required:\n                - file\n      responses:\n        \"200\":\n          description: Success.\n          content:\n            application/json:\n              schema:\n                type: object\n        \"400\":\n          description: Validation failed.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"401\":\n          description: Missing or invalid credentials.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"403\":\n          description: \"Authenticated, but not permitted to perform this action.\"\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"422\":\n          description: Well-formed but not processable.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"500\":\n          description: Unexpected server error.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n        \"503\":\n          description: The compute server is unconfigured or unreachable.\n          content:\n            application/json:\n              schema:\n                $ref: \"#/components/schemas/Error\"\n";
+//#endregion
+//#region src/routes/docs/api/openapi.yaml/+server.ts
+var GET = async () => new Response(v1_default, { headers: {
+	"Content-Type": "application/yaml; charset=utf-8",
+	"Cache-Control": "public, max-age=300"
+} });
+
+export { GET };
+//# sourceMappingURL=_server.ts.js-I_diP87U.js.map