@selvajs/selva 4.13.1 → 4.14.1

package/build/server/chunks/chunks/relativeTime.js-Bfz-SNbM.js

@@ -0,0 +1,14 @@
+//#region src/lib/format/relativeTime.ts
+/** Relative timestamp — "2m ago", "3h ago", "5d ago" — for recent-activity rows. */
+function formatRelative(iso) {
+	const diff = Date.now() - new Date(iso).getTime();
+	const m = Math.floor(diff / 6e4);
+	if (m < 1) return "just now";
+	if (m < 60) return `${m}m ago`;
+	const h = Math.floor(m / 60);
+	if (h < 24) return `${h}h ago`;
+	return `${Math.floor(h / 24)}d ago`;
+}
+
+export { formatRelative as f };
+//# sourceMappingURL=relativeTime.js-Bfz-SNbM.js.map

package/build/server/chunks/chunks/relativeTime.js-Bfz-SNbM.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relativeTime.js-Bfz-SNbM.js","sources":["../../../../.svelte-kit/output/server/chunks/relativeTime.js"],"sourcesContent":["//#region src/lib/format/relativeTime.ts\n/** Relative timestamp — \"2m ago\", \"3h ago\", \"5d ago\" — for recent-activity rows. */\nfunction formatRelative(iso) {\n\tconst diff = Date.now() - new Date(iso).getTime();\n\tconst m = Math.floor(diff / 6e4);\n\tif (m < 1) return \"just now\";\n\tif (m < 60) return `${m}m ago`;\n\tconst h = Math.floor(m / 60);\n\tif (h < 24) return `${h}h ago`;\n\treturn `${Math.floor(h / 24)}d ago`;\n}\n//#endregion\nexport { formatRelative as t };\n"],"names":[],"mappings":"AAAA;AACA;AACA,SAAS,cAAc,CAAC,GAAG,EAAE;AAC7B,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE;AAClD,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,GAAG,CAAC;AACjC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,UAAU;AAC7B,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC;AAC/B,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC;AAC7B,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC;AAC/B,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC;AACpC;;;;"}

package/build/server/chunks/chunks/resolve.server.js-sX7S-0Pg.js

@@ -0,0 +1,63 @@
+import { S as SYSTEM_CONTEXT } from './src.js-B12bUNyu.js';
+import { p as providers, o as getDefinitionMeta, f as getProjectProvider, k as flag } from './providers.server.js-n7DF9bkc.js';
+import { h as hashToken, l as looksLikeShareToken } from './token.server.js-qEsa9y7f.js';
+import { error } from '@sveltejs/kit';
+
+//#region src/lib/server/shareLinks/resolve.server.ts
+/**
+* Extract a candidate share-link token from the request.
+*   - `?token=share_…` query param (most embeddable)
+*   - `Authorization: Bearer share_…` header (server-to-server)
+*
+* Returns the raw token string, or null when none present. Does NOT validate.
+*/
+function readShareToken(request, url) {
+	if (!flag("ENABLE_SHARING")) return null;
+	const q = url.searchParams.get("token");
+	if (q && looksLikeShareToken(q)) return q;
+	const auth = request.headers.get("authorization");
+	if (auth?.startsWith("Bearer ")) {
+		const candidate = auth.slice(7).trim();
+		if (looksLikeShareToken(candidate)) return candidate;
+	}
+	return null;
+}
+/**
+* Run before user-based auth on definition-scoped routes. Returns the
+* resolved link + a synthetic ctx on success.
+*
+* Throws only when a token is *present but invalid* for the current request
+* (wrong definition, wrong channel, expired, revoked, view-only when solve
+* was requested) — those are deliberate 401/403/429 responses to a
+* misbehaving consumer. When no token is present at all, returns null and
+* the caller falls through to the user-based auth gate.
+*/
+async function tryResolveShareToken(request, url, requestedDefinitionId, requestedChannel, opts) {
+	const raw = readShareToken(request, url);
+	if (!raw) return null;
+	const tokenHash = hashToken(raw);
+	const link = await providers.data.shareLinks.getByTokenHash(SYSTEM_CONTEXT, tokenHash);
+	if (!link) throw error(401, "Invalid or revoked share token.");
+	if (link.expiresAt && new Date(link.expiresAt).getTime() <= Date.now()) throw error(401, "Share token has expired.");
+	if (link.definitionId !== requestedDefinitionId) throw error(403, "Share token is not valid for this definition.");
+	if (link.channel !== requestedChannel) throw error(403, `Share token is for the '${link.channel}' channel only.`);
+	if (opts.requireSolve && !link.allowSolve) throw error(403, "Share token grants view-only access.");
+	const def = await getDefinitionMeta().get(SYSTEM_CONTEXT, link.definitionId);
+	if (!def) throw error(401, "Share token target no longer exists.");
+	const project = await getProjectProvider().getProject(SYSTEM_CONTEXT, def.projectId);
+	if (!project) throw error(401, "Share token target no longer exists.");
+	return {
+		link,
+		ctx: {
+			userId: `share:${link.id}`,
+			actingOrgId: project.orgId,
+			platformPermissions: [],
+			orgPermissions: [],
+			system: true,
+			shareLinkId: link.id
+		}
+	};
+}
+
+export { tryResolveShareToken as t };
+//# sourceMappingURL=resolve.server.js-sX7S-0Pg.js.map

package/build/server/chunks/chunks/resolve.server.js-sX7S-0Pg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.server.js-sX7S-0Pg.js","sources":["../../../../.svelte-kit/output/server/chunks/resolve.server.js"],"sourcesContent":["import { t as SYSTEM_CONTEXT } from \"./src.js\";\nimport { _ as getProjectProvider, s as getDefinitionMeta, t as flag, w as providers } from \"./providers.server.js\";\nimport { n as looksLikeShareToken, t as hashToken } from \"./token.server.js\";\nimport { error } from \"@sveltejs/kit\";\n//#region src/lib/server/shareLinks/resolve.server.ts\n/**\n* Extract a candidate share-link token from the request.\n*   - `?token=share_…` query param (most embeddable)\n*   - `Authorization: Bearer share_…` header (server-to-server)\n*\n* Returns the raw token string, or null when none present. Does NOT validate.\n*/\nfunction readShareToken(request, url) {\n\tif (!flag(\"ENABLE_SHARING\")) return null;\n\tconst q = url.searchParams.get(\"token\");\n\tif (q && looksLikeShareToken(q)) return q;\n\tconst auth = request.headers.get(\"authorization\");\n\tif (auth?.startsWith(\"Bearer \")) {\n\t\tconst candidate = auth.slice(7).trim();\n\t\tif (looksLikeShareToken(candidate)) return candidate;\n\t}\n\treturn null;\n}\n/**\n* Run before user-based auth on definition-scoped routes. Returns the\n* resolved link + a synthetic ctx on success.\n*\n* Throws only when a token is *present but invalid* for the current request\n* (wrong definition, wrong channel, expired, revoked, view-only when solve\n* was requested) — those are deliberate 401/403/429 responses to a\n* misbehaving consumer. When no token is present at all, returns null and\n* the caller falls through to the user-based auth gate.\n*/\nasync function tryResolveShareToken(request, url, requestedDefinitionId, requestedChannel, opts) {\n\tconst raw = readShareToken(request, url);\n\tif (!raw) return null;\n\tconst tokenHash = hashToken(raw);\n\tconst link = await providers.data.shareLinks.getByTokenHash(SYSTEM_CONTEXT, tokenHash);\n\tif (!link) throw error(401, \"Invalid or revoked share token.\");\n\tif (link.expiresAt && new Date(link.expiresAt).getTime() <= Date.now()) throw error(401, \"Share token has expired.\");\n\tif (link.definitionId !== requestedDefinitionId) throw error(403, \"Share token is not valid for this definition.\");\n\tif (link.channel !== requestedChannel) throw error(403, `Share token is for the '${link.channel}' channel only.`);\n\tif (opts.requireSolve && !link.allowSolve) throw error(403, \"Share token grants view-only access.\");\n\tconst def = await getDefinitionMeta().get(SYSTEM_CONTEXT, link.definitionId);\n\tif (!def) throw error(401, \"Share token target no longer exists.\");\n\tconst project = await getProjectProvider().getProject(SYSTEM_CONTEXT, def.projectId);\n\tif (!project) throw error(401, \"Share token target no longer exists.\");\n\treturn {\n\t\tlink,\n\t\tctx: {\n\t\t\tuserId: `share:${link.id}`,\n\t\t\tactingOrgId: project.orgId,\n\t\t\tplatformPermissions: [],\n\t\t\torgPermissions: [],\n\t\t\tsystem: true,\n\t\t\tshareLinkId: link.id\n\t\t}\n\t};\n}\n//#endregion\nexport { tryResolveShareToken as t };\n"],"names":[],"mappings":";;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE;AACtC,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,OAAO,IAAI;AACzC,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;AACxC,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;AAC1C,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;AAClD,CAAC,IAAI,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE;AAClC,EAAE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;AACxC,EAAE,IAAI,mBAAmB,CAAC,SAAS,CAAC,EAAE,OAAO,SAAS;AACtD,CAAC;AACD,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,oBAAoB,CAAC,OAAO,EAAE,GAAG,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,IAAI,EAAE;AACjG,CAAC,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC;AACzC,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,IAAI;AACtB,CAAC,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC;AACjC,CAAC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,cAAc,EAAE,SAAS,CAAC;AACvF,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,iCAAiC,CAAC;AAC/D,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,0BAA0B,CAAC;AACrH,CAAC,IAAI,IAAI,CAAC,YAAY,KAAK,qBAAqB,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,+CAA+C,CAAC;AACnH,CAAC,IAAI,IAAI,CAAC,OAAO,KAAK,gBAAgB,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,wBAAwB,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;AAClH,CAAC,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,sCAAsC,CAAC;AACpG,CAAC,MAAM,GAAG,GAAG,MAAM,iBAAiB,EAAE,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC;AAC7E,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,sCAAsC,CAAC;AACnE,CAAC,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,GAAG,CAAC,SAAS,CAAC;AACrF,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,sCAAsC,CAAC;AACvE,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE,GAAG,EAAE;AACP,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;AAC7B,GAAG,WAAW,EAAE,OAAO,CAAC,KAAK;AAC7B,GAAG,mBAAmB,EAAE,EAAE;AAC1B,GAAG,cAAc,EAAE,EAAE;AACrB,GAAG,MAAM,EAAE,IAAI;AACf,GAAG,WAAW,EAAE,IAAI,CAAC;AACrB;AACA,EAAE;AACF;;;;"}

package/build/server/chunks/chunks/responses.js-C3TpfP9h.js

@@ -0,0 +1,103 @@
+import { z } from 'zod';
+
+//#region src/lib/server/api/v1/responses.ts
+/**
+* Response schemas for the v1 payloads that must not carry a stored secret.
+*
+* Three store types hold a credential next to fields a client legitimately
+* reads: `ShareLink.tokenHash` and `Invite.tokenHash` are HMACs of a token,
+* `ComputeServerCommon.apiKey` is a live Rhino.Compute key. Handlers used to
+* strip them by destructuring — `const { tokenHash: _omit, ...rest } = invite`
+* — which works until someone adds a field to the stored type or edits the line
+* away. Nothing fails at build time; the credential just starts appearing in a
+* response.
+*
+* Parsing through these schemas inverts the default: the response carries only
+* what the schema names, so a new field on the stored type is invisible to
+* clients until added here on purpose. Use them via `shaped`/`shapedCollection`
+* in `./route.ts`.
+*
+* These describe **responses**, not stored records — where the two differ (an
+* invite's one-time `acceptUrl`, a share link's `hasToken` sentinel) the
+* response is the authority.
+*/
+var ShareLinkResponseSchema = z.object({
+	id: z.string(),
+	definitionId: z.string(),
+	channel: z.enum(["live", "draft"]),
+	name: z.string().optional(),
+	createdBy: z.string(),
+	createdAt: z.string(),
+	expiresAt: z.string().nullish(),
+	revokedAt: z.string().nullish(),
+	allowSolve: z.boolean(),
+	maxSolves: z.number().nullish(),
+	solveCount: z.number(),
+	/** Sentinel replacing `tokenHash`: a token exists, its hash is not yours. */
+	hasToken: z.literal(true)
+});
+/** The mint response. `token` is the plaintext, returned exactly once. */
+var CreatedShareLinkResponseSchema = z.object({
+	link: ShareLinkResponseSchema,
+	token: z.string()
+});
+var InviteResponseSchema = z.object({
+	id: z.string(),
+	email: z.string(),
+	orgId: z.string(),
+	orgRole: z.string(),
+	orgPermissions: z.array(z.string()),
+	platformPermissions: z.array(z.string()).default([]),
+	invitedBy: z.string(),
+	createdAt: z.string(),
+	expiresAt: z.string(),
+	acceptedAt: z.string().optional(),
+	acceptedByUserId: z.string().optional()
+});
+/**
+* The create response: the invite plus the link to send, built per request.
+*
+* `acceptUrl` is returned whatever `delivery` says — mail is best-effort, and
+* manual sharing is the fallback when it is off or the send failed.
+*/
+var CreatedInviteResponseSchema = InviteResponseSchema.extend({
+	acceptUrl: z.string(),
+	delivery: z.enum([
+		"sent",
+		"not-configured",
+		"failed"
+	])
+});
+/**
+* An org-owned compute server. `apiKey` is replaced by `hasApiKey`, so a picker
+* can render "key set" without any store decrypting a secret to throw away.
+*/
+var OrgComputeServerResponseSchema = z.object({
+	id: z.string(),
+	label: z.string(),
+	serverUrl: z.string(),
+	scope: z.literal("org"),
+	ownerOrgId: z.string(),
+	timeoutMs: z.number().optional(),
+	retryCount: z.number().optional(),
+	hasApiKey: z.boolean()
+});
+/** A server this org may select but not edit. Never carries a key either. */
+var ComputeCatalogEntrySchema = z.object({
+	id: z.string(),
+	label: z.string(),
+	serverUrl: z.string(),
+	scope: z.enum(["platform", "org"]),
+	source: z.enum(["platform", "org"]),
+	timeoutMs: z.number().optional(),
+	retryCount: z.number().optional()
+});
+var OrgComputeResponseSchema = z.object({
+	servers: z.array(OrgComputeServerResponseSchema),
+	defaultServerId: z.string().nullish(),
+	globalDefaultServerId: z.string().nullish(),
+	catalog: z.array(ComputeCatalogEntrySchema)
+});
+
+export { CreatedShareLinkResponseSchema as C, InviteResponseSchema as I, OrgComputeResponseSchema as O, ShareLinkResponseSchema as S, CreatedInviteResponseSchema as a };
+//# sourceMappingURL=responses.js-C3TpfP9h.js.map

package/build/server/chunks/chunks/responses.js-C3TpfP9h.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"responses.js-C3TpfP9h.js","sources":["../../../../.svelte-kit/output/server/chunks/responses.js"],"sourcesContent":["import { z } from \"zod\";\n//#region src/lib/server/api/v1/responses.ts\n/**\n* Response schemas for the v1 payloads that must not carry a stored secret.\n*\n* Three store types hold a credential next to fields a client legitimately\n* reads: `ShareLink.tokenHash` and `Invite.tokenHash` are HMACs of a token,\n* `ComputeServerCommon.apiKey` is a live Rhino.Compute key. Handlers used to\n* strip them by destructuring — `const { tokenHash: _omit, ...rest } = invite`\n* — which works until someone adds a field to the stored type or edits the line\n* away. Nothing fails at build time; the credential just starts appearing in a\n* response.\n*\n* Parsing through these schemas inverts the default: the response carries only\n* what the schema names, so a new field on the stored type is invisible to\n* clients until added here on purpose. Use them via `shaped`/`shapedCollection`\n* in `./route.ts`.\n*\n* These describe **responses**, not stored records — where the two differ (an\n* invite's one-time `acceptUrl`, a share link's `hasToken` sentinel) the\n* response is the authority.\n*/\nvar ShareLinkResponseSchema = z.object({\n\tid: z.string(),\n\tdefinitionId: z.string(),\n\tchannel: z.enum([\"live\", \"draft\"]),\n\tname: z.string().optional(),\n\tcreatedBy: z.string(),\n\tcreatedAt: z.string(),\n\texpiresAt: z.string().nullish(),\n\trevokedAt: z.string().nullish(),\n\tallowSolve: z.boolean(),\n\tmaxSolves: z.number().nullish(),\n\tsolveCount: z.number(),\n\t/** Sentinel replacing `tokenHash`: a token exists, its hash is not yours. */\n\thasToken: z.literal(true)\n});\n/** The mint response. `token` is the plaintext, returned exactly once. */\nvar CreatedShareLinkResponseSchema = z.object({\n\tlink: ShareLinkResponseSchema,\n\ttoken: z.string()\n});\nvar InviteResponseSchema = z.object({\n\tid: z.string(),\n\temail: z.string(),\n\torgId: z.string(),\n\torgRole: z.string(),\n\torgPermissions: z.array(z.string()),\n\tplatformPermissions: z.array(z.string()).default([]),\n\tinvitedBy: z.string(),\n\tcreatedAt: z.string(),\n\texpiresAt: z.string(),\n\tacceptedAt: z.string().optional(),\n\tacceptedByUserId: z.string().optional()\n});\n/**\n* The create response: the invite plus the link to send, built per request.\n*\n* `acceptUrl` is returned whatever `delivery` says — mail is best-effort, and\n* manual sharing is the fallback when it is off or the send failed.\n*/\nvar CreatedInviteResponseSchema = InviteResponseSchema.extend({\n\tacceptUrl: z.string(),\n\tdelivery: z.enum([\n\t\t\"sent\",\n\t\t\"not-configured\",\n\t\t\"failed\"\n\t])\n});\n/**\n* An org-owned compute server. `apiKey` is replaced by `hasApiKey`, so a picker\n* can render \"key set\" without any store decrypting a secret to throw away.\n*/\nvar OrgComputeServerResponseSchema = z.object({\n\tid: z.string(),\n\tlabel: z.string(),\n\tserverUrl: z.string(),\n\tscope: z.literal(\"org\"),\n\townerOrgId: z.string(),\n\ttimeoutMs: z.number().optional(),\n\tretryCount: z.number().optional(),\n\thasApiKey: z.boolean()\n});\n/** A server this org may select but not edit. Never carries a key either. */\nvar ComputeCatalogEntrySchema = z.object({\n\tid: z.string(),\n\tlabel: z.string(),\n\tserverUrl: z.string(),\n\tscope: z.enum([\"platform\", \"org\"]),\n\tsource: z.enum([\"platform\", \"org\"]),\n\ttimeoutMs: z.number().optional(),\n\tretryCount: z.number().optional()\n});\nvar OrgComputeResponseSchema = z.object({\n\tservers: z.array(OrgComputeServerResponseSchema),\n\tdefaultServerId: z.string().nullish(),\n\tglobalDefaultServerId: z.string().nullish(),\n\tcatalog: z.array(ComputeCatalogEntrySchema)\n});\n//#endregion\nexport { ShareLinkResponseSchema as a, OrgComputeResponseSchema as i, CreatedShareLinkResponseSchema as n, InviteResponseSchema as r, CreatedInviteResponseSchema as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;AACvC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;AACf,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;AACzB,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACnC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AAC5B,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;AAChC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;AAChC,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;AACxB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;AAChC,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;AACvB;AACA,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI;AACzB,CAAC;AACD;AACG,IAAC,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;AAC9C,CAAC,IAAI,EAAE,uBAAuB;AAC9B,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM;AAChB,CAAC;AACE,IAAC,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;AACpC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;AACf,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;AAClB,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;AAClB,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;AACpB,CAAC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AACpC,CAAC,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;AACrD,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AAClC,CAAC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ;AACtC,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,2BAA2B,GAAG,oBAAoB,CAAC,MAAM,CAAC;AAC9D,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC;AAClB,EAAE,MAAM;AACR,EAAE,gBAAgB;AAClB,EAAE;AACF,EAAE;AACF,CAAC;AACD;AACA;AACA;AACA;AACA,IAAI,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;AAC9C,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;AACf,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;AAClB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;AACxB,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;AACvB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AACjC,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AAClC,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO;AACrB,CAAC,CAAC;AACF;AACA,IAAI,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;AACzC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;AACf,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;AAClB,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;AACtB,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AACpC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;AACjC,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ;AAChC,CAAC,CAAC;AACC,IAAC,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;AACxC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC;AACjD,CAAC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;AACtC,CAAC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;AAC5C,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB;AAC3C,CAAC;;;;"}

package/build/server/chunks/chunks/route.js-Dhz_lPCp.js

@@ -0,0 +1,4 @@
+import './src.js-B12bUNyu.js';
+import './providers.server.js-n7DF9bkc.js';
+import '@sveltejs/kit';
+//# sourceMappingURL=route.js-Dhz_lPCp.js.map

package/build/server/chunks/chunks/route.js-Dhz_lPCp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.js-Dhz_lPCp.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;"}

package/build/server/chunks/chunks/selfUpdate.server.js-l0l1xNus.js

@@ -0,0 +1,149 @@
+import { g as getLogger, r as renderThrown } from './providers.server.js-n7DF9bkc.js';
+import { d as deriveOutcome } from './update-outcome.js-D6m3udZN.js';
+import { join } from 'node:path';
+import { existsSync, readFileSync, rmSync } from 'node:fs';
+
+//#region src/lib/server/selfUpdate.server.ts
+/**
+* Durable log/state paths for the update runner, plus post-restart
+* reconciliation of the update's outcome into the audit event log.
+*
+* The process that launches an update is killed mid-update (`pm2 stop
+* selva-compute` is a step of the update itself), so only the
+* `system.update.started` event can be emitted synchronously by the POST
+* handler. The terminal event (`finished` / `rolled_back` / `failed`) is
+* derived AFTER the app is back up: the POST persists a pending-update state
+* file next to the log, and the reconciler here polls the log until the
+* runner's `[EXIT] code=N` marker appears, classifies it via `deriveOutcome`,
+* emits the matching event, and consumes the state file. Kicked from both the
+* POST (covers the no-restart "already up to date" path) and the first request
+* after boot (covers the real update path, where the emitting process is new).
+*/
+function isDeploymentDir(dir) {
+	return existsSync(join(dir, "node_modules", "@selvajs", "selva", "package.json"));
+}
+function findDeploymentDir(env) {
+	if (env.INSTALL_DIR && isDeploymentDir(env.INSTALL_DIR)) return env.INSTALL_DIR;
+	let dir = process.cwd();
+	for (let i = 0; i < 6; i++) {
+		if (isDeploymentDir(dir)) return dir;
+		const parent = join(dir, "..");
+		if (parent === dir) break;
+		dir = parent;
+	}
+	return null;
+}
+/**
+* Where the update runner mirrors all its output. Lives in the deployment dir
+* so it survives reboots; the `/tmp` fallback only applies outside a
+* deployment (dev), where no update can actually run.
+*/
+function updateLogPath(deploymentDir) {
+	return deploymentDir ? join(deploymentDir, "selva-update.log") : "/tmp/selva-update.log";
+}
+/** Pending-update marker consumed by the reconciler. Sits next to the log. */
+function updateStatePath(deploymentDir) {
+	return join(deploymentDir, "selva-update-state.json");
+}
+/**
+* One reconciliation attempt. Reads the pending-update state file; if the log
+* carries the runner's terminal `[EXIT] code=N` marker, classifies the outcome,
+* emits the terminal audit event, reports rollback/failure to the error
+* tracker, and deletes the state file (exactly-once across restarts — the
+* state file is the emission token).
+*/
+async function reconcileUpdateOutcome(deps) {
+	const statePath = updateStatePath(deps.deploymentDir);
+	let state;
+	try {
+		state = JSON.parse(readFileSync(statePath, "utf8"));
+	} catch {
+		return "no_pending_update";
+	}
+	let logs = "";
+	try {
+		logs = readFileSync(updateLogPath(deps.deploymentDir), "utf8");
+	} catch {}
+	const exitMatch = /\[EXIT\] code=(\d+)/.exec(logs);
+	if (!exitMatch) return "still_running";
+	const exitCode = Number(exitMatch[1]);
+	const outcome = deriveOutcome(exitCode, logs);
+	const base = {
+		fromVersion: state.fromVersion ?? outcome.from,
+		toVersion: outcome.to,
+		actorId: state.actorId
+	};
+	let event;
+	if (outcome.severity === "critical") event = {
+		type: "system.update.failed",
+		...base,
+		detail: outcome.title
+	};
+	else if (exitCode === 5 || logs.includes("Rolled back")) event = {
+		type: "system.update.rolled_back",
+		...base,
+		detail: outcome.title
+	};
+	else if (outcome.severity === "success" || outcome.severity === "info") event = {
+		type: "system.update.finished",
+		...base
+	};
+	else event = {
+		type: "system.update.finished",
+		...base,
+		detail: outcome.title
+	};
+	await deps.emit(event);
+	if (event.type !== "system.update.finished") deps.report(/* @__PURE__ */ new Error(`[selfUpdate] ${outcome.title}`));
+	try {
+		rmSync(statePath);
+	} catch {}
+	return "reconciled";
+}
+var POLL_MS = 15e3;
+var MAX_POLLS = 80;
+var reconcilerActive = false;
+/**
+* Idempotent: safe to call on every boot and on every update POST — exits
+* immediately when no state file exists and never runs twice concurrently.
+*/
+function startUpdateOutcomeReconciler(deps) {
+	if (reconcilerActive) return;
+	if (!existsSync(updateStatePath(deps.deploymentDir))) return;
+	reconcilerActive = true;
+	let polls = 0;
+	const timer = setInterval(() => {
+		(async () => {
+			polls += 1;
+			let result;
+			try {
+				result = await reconcileUpdateOutcome(deps);
+			} catch (err) {
+				getLogger().error("Outcome reconciliation failed", {
+					component: "selfUpdate",
+					err: renderThrown(err)
+				});
+				result = "still_running";
+			}
+			if (result === "still_running" && polls < MAX_POLLS) return;
+			if (result === "still_running") try {
+				const statePath = updateStatePath(deps.deploymentDir);
+				const state = JSON.parse(readFileSync(statePath, "utf8"));
+				await deps.emit({
+					type: "system.update.failed",
+					fromVersion: state.fromVersion,
+					actorId: state.actorId,
+					detail: "No terminal marker in the update log within 20 minutes."
+				});
+				deps.report(/* @__PURE__ */ new Error("[selfUpdate] update never reached a terminal state"));
+				rmSync(statePath);
+			} catch {}
+			clearInterval(timer);
+			reconcilerActive = false;
+		})();
+	}, POLL_MS);
+	timer.unref?.();
+}
+
+export { updateStatePath as a, findDeploymentDir as f, startUpdateOutcomeReconciler as s, updateLogPath as u };
+//# sourceMappingURL=selfUpdate.server.js-l0l1xNus.js.map

package/build/server/chunks/chunks/selfUpdate.server.js-l0l1xNus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"selfUpdate.server.js-l0l1xNus.js","sources":["../../../../.svelte-kit/output/server/chunks/selfUpdate.server.js"],"sourcesContent":["import { E as renderThrown, f as getLogger } from \"./providers.server.js\";\nimport { t as deriveOutcome } from \"./update-outcome.js\";\nimport { join } from \"node:path\";\nimport { existsSync, readFileSync, rmSync } from \"node:fs\";\n//#region src/lib/server/selfUpdate.server.ts\n/**\n* Durable log/state paths for the update runner, plus post-restart\n* reconciliation of the update's outcome into the audit event log.\n*\n* The process that launches an update is killed mid-update (`pm2 stop\n* selva-compute` is a step of the update itself), so only the\n* `system.update.started` event can be emitted synchronously by the POST\n* handler. The terminal event (`finished` / `rolled_back` / `failed`) is\n* derived AFTER the app is back up: the POST persists a pending-update state\n* file next to the log, and the reconciler here polls the log until the\n* runner's `[EXIT] code=N` marker appears, classifies it via `deriveOutcome`,\n* emits the matching event, and consumes the state file. Kicked from both the\n* POST (covers the no-restart \"already up to date\" path) and the first request\n* after boot (covers the real update path, where the emitting process is new).\n*/\nfunction isDeploymentDir(dir) {\n\treturn existsSync(join(dir, \"node_modules\", \"@selvajs\", \"selva\", \"package.json\"));\n}\nfunction findDeploymentDir(env) {\n\tif (env.INSTALL_DIR && isDeploymentDir(env.INSTALL_DIR)) return env.INSTALL_DIR;\n\tlet dir = process.cwd();\n\tfor (let i = 0; i < 6; i++) {\n\t\tif (isDeploymentDir(dir)) return dir;\n\t\tconst parent = join(dir, \"..\");\n\t\tif (parent === dir) break;\n\t\tdir = parent;\n\t}\n\treturn null;\n}\n/**\n* Where the update runner mirrors all its output. Lives in the deployment dir\n* so it survives reboots; the `/tmp` fallback only applies outside a\n* deployment (dev), where no update can actually run.\n*/\nfunction updateLogPath(deploymentDir) {\n\treturn deploymentDir ? join(deploymentDir, \"selva-update.log\") : \"/tmp/selva-update.log\";\n}\n/** Pending-update marker consumed by the reconciler. Sits next to the log. */\nfunction updateStatePath(deploymentDir) {\n\treturn join(deploymentDir, \"selva-update-state.json\");\n}\n/**\n* One reconciliation attempt. Reads the pending-update state file; if the log\n* carries the runner's terminal `[EXIT] code=N` marker, classifies the outcome,\n* emits the terminal audit event, reports rollback/failure to the error\n* tracker, and deletes the state file (exactly-once across restarts — the\n* state file is the emission token).\n*/\nasync function reconcileUpdateOutcome(deps) {\n\tconst statePath = updateStatePath(deps.deploymentDir);\n\tlet state;\n\ttry {\n\t\tstate = JSON.parse(readFileSync(statePath, \"utf8\"));\n\t} catch {\n\t\treturn \"no_pending_update\";\n\t}\n\tlet logs = \"\";\n\ttry {\n\t\tlogs = readFileSync(updateLogPath(deps.deploymentDir), \"utf8\");\n\t} catch {}\n\tconst exitMatch = /\\[EXIT\\] code=(\\d+)/.exec(logs);\n\tif (!exitMatch) return \"still_running\";\n\tconst exitCode = Number(exitMatch[1]);\n\tconst outcome = deriveOutcome(exitCode, logs);\n\tconst base = {\n\t\tfromVersion: state.fromVersion ?? outcome.from,\n\t\ttoVersion: outcome.to,\n\t\tactorId: state.actorId\n\t};\n\tlet event;\n\tif (outcome.severity === \"critical\") event = {\n\t\ttype: \"system.update.failed\",\n\t\t...base,\n\t\tdetail: outcome.title\n\t};\n\telse if (exitCode === 5 || logs.includes(\"Rolled back\")) event = {\n\t\ttype: \"system.update.rolled_back\",\n\t\t...base,\n\t\tdetail: outcome.title\n\t};\n\telse if (outcome.severity === \"success\" || outcome.severity === \"info\") event = {\n\t\ttype: \"system.update.finished\",\n\t\t...base\n\t};\n\telse event = {\n\t\ttype: \"system.update.finished\",\n\t\t...base,\n\t\tdetail: outcome.title\n\t};\n\tawait deps.emit(event);\n\tif (event.type !== \"system.update.finished\") deps.report(/* @__PURE__ */ new Error(`[selfUpdate] ${outcome.title}`));\n\ttry {\n\t\trmSync(statePath);\n\t} catch {}\n\treturn \"reconciled\";\n}\nvar POLL_MS = 15e3;\nvar MAX_POLLS = 80;\nvar reconcilerActive = false;\n/**\n* Idempotent: safe to call on every boot and on every update POST — exits\n* immediately when no state file exists and never runs twice concurrently.\n*/\nfunction startUpdateOutcomeReconciler(deps) {\n\tif (reconcilerActive) return;\n\tif (!existsSync(updateStatePath(deps.deploymentDir))) return;\n\treconcilerActive = true;\n\tlet polls = 0;\n\tconst timer = setInterval(() => {\n\t\t(async () => {\n\t\t\tpolls += 1;\n\t\t\tlet result;\n\t\t\ttry {\n\t\t\t\tresult = await reconcileUpdateOutcome(deps);\n\t\t\t} catch (err) {\n\t\t\t\tgetLogger().error(\"Outcome reconciliation failed\", {\n\t\t\t\t\tcomponent: \"selfUpdate\",\n\t\t\t\t\terr: renderThrown(err)\n\t\t\t\t});\n\t\t\t\tresult = \"still_running\";\n\t\t\t}\n\t\t\tif (result === \"still_running\" && polls < MAX_POLLS) return;\n\t\t\tif (result === \"still_running\") try {\n\t\t\t\tconst statePath = updateStatePath(deps.deploymentDir);\n\t\t\t\tconst state = JSON.parse(readFileSync(statePath, \"utf8\"));\n\t\t\t\tawait deps.emit({\n\t\t\t\t\ttype: \"system.update.failed\",\n\t\t\t\t\tfromVersion: state.fromVersion,\n\t\t\t\t\tactorId: state.actorId,\n\t\t\t\t\tdetail: \"No terminal marker in the update log within 20 minutes.\"\n\t\t\t\t});\n\t\t\t\tdeps.report(/* @__PURE__ */ new Error(\"[selfUpdate] update never reached a terminal state\"));\n\t\t\t\trmSync(statePath);\n\t\t\t} catch {}\n\t\t\tclearInterval(timer);\n\t\t\treconcilerActive = false;\n\t\t})();\n\t}, POLL_MS);\n\ttimer.unref?.();\n}\n//#endregion\nexport { updateStatePath as i, startUpdateOutcomeReconciler as n, updateLogPath as r, findDeploymentDir as t };\n"],"names":[],"mappings":";;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,eAAe,CAAC,GAAG,EAAE;AAC9B,CAAC,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;AAClF;AACA,SAAS,iBAAiB,CAAC,GAAG,EAAE;AAChC,CAAC,IAAI,GAAG,CAAC,WAAW,IAAI,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,CAAC,WAAW;AAChF,CAAC,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;AACxB,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE;AAC7B,EAAE,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG;AACtC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC;AAChC,EAAE,IAAI,MAAM,KAAK,GAAG,EAAE;AACtB,EAAE,GAAG,GAAG,MAAM;AACd,CAAC;AACD,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,aAAa,EAAE;AACtC,CAAC,OAAO,aAAa,GAAG,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC,GAAG,uBAAuB;AACzF;AACA;AACA,SAAS,eAAe,CAAC,aAAa,EAAE;AACxC,CAAC,OAAO,IAAI,CAAC,aAAa,EAAE,yBAAyB,CAAC;AACtD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,sBAAsB,CAAC,IAAI,EAAE;AAC5C,CAAC,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC;AACtD,CAAC,IAAI,KAAK;AACV,CAAC,IAAI;AACL,EAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,mBAAmB;AAC5B,CAAC;AACD,CAAC,IAAI,IAAI,GAAG,EAAE;AACd,CAAC,IAAI;AACL,EAAE,IAAI,GAAG,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;AAChE,CAAC,CAAC,CAAC,MAAM,CAAC;AACV,CAAC,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;AACnD,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,eAAe;AACvC,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC;AAC9C,CAAC,MAAM,IAAI,GAAG;AACd,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,OAAO,CAAC,IAAI;AAChD,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE;AACvB,EAAE,OAAO,EAAE,KAAK,CAAC;AACjB,EAAE;AACF,CAAC,IAAI,KAAK;AACV,CAAC,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU,EAAE,KAAK,GAAG;AAC9C,EAAE,IAAI,EAAE,sBAAsB;AAC9B,EAAE,GAAG,IAAI;AACT,EAAE,MAAM,EAAE,OAAO,CAAC;AAClB,EAAE;AACF,MAAM,IAAI,QAAQ,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,KAAK,GAAG;AAClE,EAAE,IAAI,EAAE,2BAA2B;AACnC,EAAE,GAAG,IAAI;AACT,EAAE,MAAM,EAAE,OAAO,CAAC;AAClB,EAAE;AACF,MAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,EAAE,KAAK,GAAG;AACjF,EAAE,IAAI,EAAE,wBAAwB;AAChC,EAAE,GAAG;AACL,EAAE;AACF,MAAM,KAAK,GAAG;AACd,EAAE,IAAI,EAAE,wBAAwB;AAChC,EAAE,GAAG,IAAI;AACT,EAAE,MAAM,EAAE,OAAO,CAAC;AAClB,EAAE;AACF,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;AACvB,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,wBAAwB,EAAE,IAAI,CAAC,MAAM,iBAAiB,IAAI,KAAK,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACrH,CAAC,IAAI;AACL,EAAE,MAAM,CAAC,SAAS,CAAC;AACnB,CAAC,CAAC,CAAC,MAAM,CAAC;AACV,CAAC,OAAO,YAAY;AACpB;AACA,IAAI,OAAO,GAAG,IAAI;AAClB,IAAI,SAAS,GAAG,EAAE;AAClB,IAAI,gBAAgB,GAAG,KAAK;AAC5B;AACA;AACA;AACA;AACA,SAAS,4BAA4B,CAAC,IAAI,EAAE;AAC5C,CAAC,IAAI,gBAAgB,EAAE;AACvB,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE;AACvD,CAAC,gBAAgB,GAAG,IAAI;AACxB,CAAC,IAAI,KAAK,GAAG,CAAC;AACd,CAAC,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM;AACjC,EAAE,CAAC,YAAY;AACf,GAAG,KAAK,IAAI,CAAC;AACb,GAAG,IAAI,MAAM;AACb,GAAG,IAAI;AACP,IAAI,MAAM,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC;AAC/C,GAAG,CAAC,CAAC,OAAO,GAAG,EAAE;AACjB,IAAI,SAAS,EAAE,CAAC,KAAK,CAAC,+BAA+B,EAAE;AACvD,KAAK,SAAS,EAAE,YAAY;AAC5B,KAAK,GAAG,EAAE,YAAY,CAAC,GAAG;AAC1B,KAAK,CAAC;AACN,IAAI,MAAM,GAAG,eAAe;AAC5B,GAAG;AACH,GAAG,IAAI,MAAM,KAAK,eAAe,IAAI,KAAK,GAAG,SAAS,EAAE;AACxD,GAAG,IAAI,MAAM,KAAK,eAAe,EAAE,IAAI;AACvC,IAAI,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC;AACzD,IAAI,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AAC7D,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC;AACpB,KAAK,IAAI,EAAE,sBAAsB;AACjC,KAAK,WAAW,EAAE,KAAK,CAAC,WAAW;AACnC,KAAK,OAAO,EAAE,KAAK,CAAC,OAAO;AAC3B,KAAK,MAAM,EAAE;AACb,KAAK,CAAC;AACN,IAAI,IAAI,CAAC,MAAM,iBAAiB,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;AAChG,IAAI,MAAM,CAAC,SAAS,CAAC;AACrB,GAAG,CAAC,CAAC,MAAM,CAAC;AACZ,GAAG,aAAa,CAAC,KAAK,CAAC;AACvB,GAAG,gBAAgB,GAAG,KAAK;AAC3B,EAAE,CAAC,GAAG;AACN,CAAC,CAAC,EAAE,OAAO,CAAC;AACZ,CAAC,KAAK,CAAC,KAAK,IAAI;AAChB;;;;"}

package/build/server/chunks/chunks/serverConfigWrite.js-BVh1F9pd.js

@@ -0,0 +1,80 @@
+import { a as apiError, A as ApiErrorCode } from './api-errors.js-ZUI_rSV_.js';
+import { e as evictComputeClient } from './engine.server.js-Ci7yj84d.js';
+
+//#region src/lib/server/compute/evictChangedServers.ts
+/**
+* The client cache keys on server `id`, so a rotated `serverUrl`/`apiKey` keeps
+* the same key with stale connection details — it won't age out on its own. The
+* config-write path must evict explicitly: this diffs the previous scoped server
+* set against the next one and drops the warm client for every server whose
+* connection details changed or that was removed. Unchanged servers are untouched.
+*/
+/**
+* `prev` and `next` are the scoped server sets before/after the write.
+*/
+function evictChangedServers(prev, next) {
+	const nextById = new Map(next.map((s) => [s.id, s]));
+	for (const before of prev) if (!nextById.has(before.id)) evictComputeClient(before.id);
+	const prevById = new Map(prev.map((s) => [s.id, s]));
+	for (const after of next) {
+		const before = prevById.get(after.id);
+		if (before && (before.serverUrl !== after.serverUrl || before.apiKey !== after.apiKey)) evictComputeClient(after.id);
+	}
+}
+//#endregion
+//#region src/lib/server/compute/serverConfigWrite.ts
+/**
+* Shared write-path rules for compute server config.
+*
+* Two routes accept a server set: `/api/admin/compute` (platform scope,
+* `manage_compute`) and `/api/v1/orgs/{orgId}/compute` (org scope,
+* `manage_org_compute`). They differ in who may call them, what extra fields
+* they carry (`sharedWith` vs `ownerOrgId`), and how they validate the default
+* selection — but the field validation and the apiKey merge below must behave
+* identically in both, so they live here rather than in either handler.
+*
+* The apiKey merge is why this file exists: if the two copies disagree, a
+* stored credential silently gets cleared or leaked, and nothing fails at
+* build time.
+*/
+/**
+* Validates the scope-independent fields of every submitted server. Throws the
+* first failure as a 400; scope-specific fields (`sharedWith`, `ownerOrgId`)
+* are the caller's business.
+*/
+function validateIncomingServers(servers) {
+	for (const s of servers) {
+		if (!s.id || typeof s.id !== "string") apiError(400, ApiErrorCode.VALIDATION_FAILED, "Each server needs an id");
+		if (!s.label || typeof s.label !== "string") apiError(400, ApiErrorCode.VALIDATION_FAILED, "Each server needs a label");
+		if (!s.serverUrl || typeof s.serverUrl !== "string") apiError(400, ApiErrorCode.VALIDATION_FAILED, "Each server needs a serverUrl");
+		try {
+			new URL(s.serverUrl);
+		} catch {
+			apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid serverUrl: ${s.serverUrl}`);
+		}
+		if (s.apiKey !== void 0 && s.apiKey !== null && typeof s.apiKey !== "string") apiError(400, ApiErrorCode.VALIDATION_FAILED, "apiKey must be a string, null, or omitted");
+	}
+}
+/**
+* The UI never receives stored keys — it sends back `hasApiKey` and omits the
+* field for servers the operator didn't touch. So "omitted" cannot mean "clear":
+* it has to preserve, or every save through the settings form would wipe the
+* keys of every server the operator left alone. Clearing is explicit (`null`);
+* an empty string is treated as "not provided" since that's what an untouched
+* password input submits.
+*/
+function resolveApiKey(submitted, storedKey) {
+	if (submitted === null) return void 0;
+	return submitted ? submitted : storedKey;
+}
+/**
+* Builds the id → stored-key lookup the merge reads. The caller passes only the
+* servers in its own scope, so one scope's write can never resolve a key from
+* another's rows.
+*/
+function storedKeysById(scopedServers) {
+	return new Map(scopedServers.map((s) => [s.id, s.apiKey]));
+}
+
+export { evictChangedServers as e, resolveApiKey as r, storedKeysById as s, validateIncomingServers as v };
+//# sourceMappingURL=serverConfigWrite.js-BVh1F9pd.js.map

package/build/server/chunks/chunks/serverConfigWrite.js-BVh1F9pd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serverConfigWrite.js-BVh1F9pd.js","sources":["../../../../.svelte-kit/output/server/chunks/serverConfigWrite.js"],"sourcesContent":["import { n as apiError, t as ApiErrorCode } from \"./api-errors.js\";\nimport { i as evictComputeClient } from \"./engine.server.js\";\n//#region src/lib/server/compute/evictChangedServers.ts\n/**\n* The client cache keys on server `id`, so a rotated `serverUrl`/`apiKey` keeps\n* the same key with stale connection details — it won't age out on its own. The\n* config-write path must evict explicitly: this diffs the previous scoped server\n* set against the next one and drops the warm client for every server whose\n* connection details changed or that was removed. Unchanged servers are untouched.\n*/\n/**\n* `prev` and `next` are the scoped server sets before/after the write.\n*/\nfunction evictChangedServers(prev, next) {\n\tconst nextById = new Map(next.map((s) => [s.id, s]));\n\tfor (const before of prev) if (!nextById.has(before.id)) evictComputeClient(before.id);\n\tconst prevById = new Map(prev.map((s) => [s.id, s]));\n\tfor (const after of next) {\n\t\tconst before = prevById.get(after.id);\n\t\tif (before && (before.serverUrl !== after.serverUrl || before.apiKey !== after.apiKey)) evictComputeClient(after.id);\n\t}\n}\n//#endregion\n//#region src/lib/server/compute/serverConfigWrite.ts\n/**\n* Shared write-path rules for compute server config.\n*\n* Two routes accept a server set: `/api/admin/compute` (platform scope,\n* `manage_compute`) and `/api/v1/orgs/{orgId}/compute` (org scope,\n* `manage_org_compute`). They differ in who may call them, what extra fields\n* they carry (`sharedWith` vs `ownerOrgId`), and how they validate the default\n* selection — but the field validation and the apiKey merge below must behave\n* identically in both, so they live here rather than in either handler.\n*\n* The apiKey merge is why this file exists: if the two copies disagree, a\n* stored credential silently gets cleared or leaked, and nothing fails at\n* build time.\n*/\n/**\n* Validates the scope-independent fields of every submitted server. Throws the\n* first failure as a 400; scope-specific fields (`sharedWith`, `ownerOrgId`)\n* are the caller's business.\n*/\nfunction validateIncomingServers(servers) {\n\tfor (const s of servers) {\n\t\tif (!s.id || typeof s.id !== \"string\") apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Each server needs an id\");\n\t\tif (!s.label || typeof s.label !== \"string\") apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Each server needs a label\");\n\t\tif (!s.serverUrl || typeof s.serverUrl !== \"string\") apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Each server needs a serverUrl\");\n\t\ttry {\n\t\t\tnew URL(s.serverUrl);\n\t\t} catch {\n\t\t\tapiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid serverUrl: ${s.serverUrl}`);\n\t\t}\n\t\tif (s.apiKey !== void 0 && s.apiKey !== null && typeof s.apiKey !== \"string\") apiError(400, ApiErrorCode.VALIDATION_FAILED, \"apiKey must be a string, null, or omitted\");\n\t}\n}\n/**\n* The UI never receives stored keys — it sends back `hasApiKey` and omits the\n* field for servers the operator didn't touch. So \"omitted\" cannot mean \"clear\":\n* it has to preserve, or every save through the settings form would wipe the\n* keys of every server the operator left alone. Clearing is explicit (`null`);\n* an empty string is treated as \"not provided\" since that's what an untouched\n* password input submits.\n*/\nfunction resolveApiKey(submitted, storedKey) {\n\tif (submitted === null) return void 0;\n\treturn submitted ? submitted : storedKey;\n}\n/**\n* Builds the id → stored-key lookup the merge reads. The caller passes only the\n* servers in its own scope, so one scope's write can never resolve a key from\n* another's rows.\n*/\nfunction storedKeysById(scopedServers) {\n\treturn new Map(scopedServers.map((s) => [s.id, s.apiKey]));\n}\n//#endregion\nexport { evictChangedServers as i, storedKeysById as n, validateIncomingServers as r, resolveApiKey as t };\n"],"names":[],"mappings":";;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE;AACzC,CAAC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;AACvF,CAAC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE;AAC3B,EAAE,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;AACvC,EAAE,IAAI,MAAM,KAAK,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;AACtH,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,uBAAuB,CAAC,OAAO,EAAE;AAC1C,CAAC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE;AAC1B,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,yBAAyB,CAAC;AACjH,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,2BAA2B,CAAC;AACzH,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,+BAA+B,CAAC;AACrI,EAAE,IAAI;AACN,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACvB,EAAE,CAAC,CAAC,MAAM;AACV,GAAG,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,mBAAmB,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AACrF,EAAE;AACF,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,2CAA2C,CAAC;AAC1K,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE;AAC7C,CAAC,IAAI,SAAS,KAAK,IAAI,EAAE,OAAO,MAAM;AACtC,CAAC,OAAO,SAAS,GAAG,SAAS,GAAG,SAAS;AACzC;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,aAAa,EAAE;AACvC,CAAC,OAAO,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3D;;;;"}