@selvajs/selva 4.14.1 → 4.15.0

package/build/server/chunks/chunks/http.js-85jjtEx2.js

@@ -0,0 +1,172 @@
+import { h as handleApiError, a as apiError, A as ApiErrorCode, t as throwZodError } from './api-errors.js-D-tV7sBR.js';
+import { json } from '@sveltejs/kit';
+
+//#region src/lib/server/api/http.ts
+/**
+* The shared shape of an API route handler: validate the path, parse the body,
+* do the work, serialize. Before these helpers existed, every handler spelled
+* all four out, and the boilerplate had already drifted — path params were
+* validated two different ways, and list endpoints hand-rolled pagination
+* clamps that disagreed with each other.
+*
+* The rule these helpers enforce: **a route handler parses, guards, delegates
+* and serializes — nothing else.** Anything two endpoints must agree on lives
+* here or in `@selvajs/server`, never copied into both.
+*
+* Scope-neutral on purpose. `/api/v1/*` and `/api/admin/*` are siblings over
+* one core, so a rule that lands here reaches both; when these lived under
+* `api/v1/` the admin routes could not receive one and hand-rolled their own
+* `if (!id)` preamble and per-handler `try/catch` instead. `api/v1/route.ts`
+* re-exports everything for the v1 handlers that already import from there.
+*/
+/**
+* The authenticated caller, or 401. Returns the narrowed pair so callers don't
+* need `locals.ctx!` — if you have the result, the context exists.
+*
+* Guards in `access.server.ts` do their own 401 as a side effect of checking a
+* permission. This is for handlers that need an identity without a permission
+* check — the `/me` routes, and reads whose authorization is a visibility filter.
+*/
+function requireCaller(locals) {
+	if (!locals.ctx || !locals.user) apiError(401, ApiErrorCode.UNAUTHORIZED, "Unauthorized");
+	return {
+		ctx: locals.ctx,
+		user: locals.user
+	};
+}
+/**
+* Read required path params, 400ing on any that is missing or blank.
+*
+* SvelteKit types every param as `string`, but a route can be reached with an
+* empty segment — this catches that instead of letting a stale non-null
+* assertion paper over it.
+*
+* Does **not** validate format — a guid-shaped param still goes through
+* `GuidSchema` where the route cares. Replaces the `if (!id) apiError(...)`
+* preamble, not the schema check.
+*/
+function requireParams(params, ...names) {
+	const out = {};
+	const missing = [];
+	for (const name of names) {
+		const value = params[name];
+		if (!value) {
+			missing.push(name);
+			continue;
+		}
+		out[name] = value;
+	}
+	if (missing.length) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Missing path parameter${missing.length > 1 ? "s" : ""}: ${missing.join(", ")}`);
+	return out;
+}
+/**
+* Read a path param through a Zod schema, 400ing on a bad value.
+*
+* The format-checking counterpart to `requireParams` — for guids, enum-shaped
+* segments, anything where "present" isn't the same as "valid".
+*/
+function parseParam(value, schema, name) {
+	const parsed = schema.safeParse(value);
+	if (!parsed.success) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid or missing ${name}`);
+	return parsed.data;
+}
+/**
+* Parse and validate a JSON body. A malformed body becomes `null` rather than
+* throwing, so it fails the schema as a validation error — broken JSON gets a
+* 400 naming the problem, not a 500 from `request.json()`.
+*
+* `missingAs` covers endpoints whose fields are all optional: passing `{}` lets
+* an empty body mean "no changes" instead of a validation failure.
+*/
+async function parseBody(request, schema, { missingAs } = {}) {
+	const raw = await request.json().catch(() => null);
+	const parsed = schema.safeParse(raw ?? missingAs ?? null);
+	if (!parsed.success) throwZodError(parsed.error);
+	return parsed.data;
+}
+/**
+* Pull a required file out of a multipart body and check its size and, where
+* given, its extension. Caps themselves stay in `admin-config`; this only
+* applies them.
+*
+* A second line of defence, not the first: `requireMaxBodySize` rejects an
+* oversized request before it's buffered. This catches a file that's
+* individually too large inside a request that isn't.
+*/
+function requireUpload(form, field, { maxBytes, extensions, contentTypes, label = "File" }) {
+	const file = form.get(field);
+	if (!(file instanceof File) || file.size === 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, `A ${label.toLowerCase()} is required`);
+	const extension = file.name.slice(file.name.lastIndexOf(".")).toLowerCase();
+	if (extensions && !extensions.includes(extension)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `File type not allowed. Allowed: ${extensions.join(", ")}`);
+	if (contentTypes && !contentTypes.allowed.has(file.type)) apiError(400, ApiErrorCode.VALIDATION_FAILED, contentTypes.message);
+	if (file.size > maxBytes) apiError(400, ApiErrorCode.VALIDATION_FAILED, `${label} too large. Max size: ${maxBytes / 1048576} MB`);
+	return {
+		file,
+		extension
+	};
+}
+/** A multipart text field, trimmed and length-capped. Absent stays `undefined`. */
+function formText(form, field, { maxLength } = {}) {
+	const raw = form.get(field);
+	if (typeof raw !== "string") return void 0;
+	const trimmed = raw.trim();
+	if (!trimmed) return void 0;
+	return maxLength ? trimmed.slice(0, maxLength) : trimmed;
+}
+/** A paginated collection. The one envelope every v1 list endpoint returns. */
+function collection(page) {
+	return json({
+		items: page.items,
+		nextCursor: page.nextCursor
+	});
+}
+/** A created resource. */
+function created(body) {
+	return json(body, { status: 201 });
+}
+/** A successful mutation with nothing to say. */
+function noContent() {
+	return new Response(null, { status: 204 });
+}
+/**
+* Serialize a payload through an explicit response schema.
+*
+* **This is what keeps a secret from reaching a client by accident.** Several
+* responses are store records with a credential removed — `tokenHash` on a
+* share link or invite, `apiKey` on an org compute server. Parsing through a
+* schema means the response carries only what the schema names, so a new field
+* on the stored type is invisible until someone adds it here deliberately. See
+* `responses.ts`.
+*/
+function shaped(schema, payload, status = 200) {
+	return json(schema.parse(payload), { status });
+}
+/** `shaped`, mapped over a page of records. */
+function shapedCollection(schema, page) {
+	return json({
+		items: page.items.map((item) => schema.parse(item)),
+		nextCursor: page.nextCursor
+	});
+}
+/**
+* Wrap a handler so an unhandled error becomes a structured API error.
+*
+* Every route used to end in the same `try { … } catch (err) { handleApiError(
+* err, '…') }`. A handler that forgot it surfaced a raw 500 with a provider
+* message in it, with nothing flagging the omission.
+*
+* `fallback` is required — the message used when the error carries none of its
+* own, and "something went wrong" tells a caller nothing.
+*/
+function apiRoute(fallback, handler) {
+	return async (event) => {
+		try {
+			return await handler(event);
+		} catch (err) {
+			handleApiError(err, fallback, event.locals.log);
+		}
+	};
+}
+
+export { apiRoute as a, requireCaller as b, created as c, collection as d, requireUpload as e, formText as f, parseParam as g, shaped as h, noContent as n, parseBody as p, requireParams as r, shapedCollection as s };
+//# sourceMappingURL=http.js-85jjtEx2.js.map

package/build/server/chunks/chunks/http.js-85jjtEx2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js-85jjtEx2.js","sources":["../../../../.svelte-kit/output/server/chunks/http.js"],"sourcesContent":["import { i as throwZodError, n as apiError, r as handleApiError, t as ApiErrorCode } from \"./api-errors.js\";\nimport { json } from \"@sveltejs/kit\";\n//#region src/lib/server/api/http.ts\n/**\n* The shared shape of an API route handler: validate the path, parse the body,\n* do the work, serialize. Before these helpers existed, every handler spelled\n* all four out, and the boilerplate had already drifted — path params were\n* validated two different ways, and list endpoints hand-rolled pagination\n* clamps that disagreed with each other.\n*\n* The rule these helpers enforce: **a route handler parses, guards, delegates\n* and serializes — nothing else.** Anything two endpoints must agree on lives\n* here or in `@selvajs/server`, never copied into both.\n*\n* Scope-neutral on purpose. `/api/v1/*` and `/api/admin/*` are siblings over\n* one core, so a rule that lands here reaches both; when these lived under\n* `api/v1/` the admin routes could not receive one and hand-rolled their own\n* `if (!id)` preamble and per-handler `try/catch` instead. `api/v1/route.ts`\n* re-exports everything for the v1 handlers that already import from there.\n*/\n/**\n* The authenticated caller, or 401. Returns the narrowed pair so callers don't\n* need `locals.ctx!` — if you have the result, the context exists.\n*\n* Guards in `access.server.ts` do their own 401 as a side effect of checking a\n* permission. This is for handlers that need an identity without a permission\n* check — the `/me` routes, and reads whose authorization is a visibility filter.\n*/\nfunction requireCaller(locals) {\n\tif (!locals.ctx || !locals.user) apiError(401, ApiErrorCode.UNAUTHORIZED, \"Unauthorized\");\n\treturn {\n\t\tctx: locals.ctx,\n\t\tuser: locals.user\n\t};\n}\n/**\n* Read required path params, 400ing on any that is missing or blank.\n*\n* SvelteKit types every param as `string`, but a route can be reached with an\n* empty segment — this catches that instead of letting a stale non-null\n* assertion paper over it.\n*\n* Does **not** validate format — a guid-shaped param still goes through\n* `GuidSchema` where the route cares. Replaces the `if (!id) apiError(...)`\n* preamble, not the schema check.\n*/\nfunction requireParams(params, ...names) {\n\tconst out = {};\n\tconst missing = [];\n\tfor (const name of names) {\n\t\tconst value = params[name];\n\t\tif (!value) {\n\t\t\tmissing.push(name);\n\t\t\tcontinue;\n\t\t}\n\t\tout[name] = value;\n\t}\n\tif (missing.length) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Missing path parameter${missing.length > 1 ? \"s\" : \"\"}: ${missing.join(\", \")}`);\n\treturn out;\n}\n/**\n* Read a path param through a Zod schema, 400ing on a bad value.\n*\n* The format-checking counterpart to `requireParams` — for guids, enum-shaped\n* segments, anything where \"present\" isn't the same as \"valid\".\n*/\nfunction parseParam(value, schema, name) {\n\tconst parsed = schema.safeParse(value);\n\tif (!parsed.success) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid or missing ${name}`);\n\treturn parsed.data;\n}\n/**\n* Parse and validate a JSON body. A malformed body becomes `null` rather than\n* throwing, so it fails the schema as a validation error — broken JSON gets a\n* 400 naming the problem, not a 500 from `request.json()`.\n*\n* `missingAs` covers endpoints whose fields are all optional: passing `{}` lets\n* an empty body mean \"no changes\" instead of a validation failure.\n*/\nasync function parseBody(request, schema, { missingAs } = {}) {\n\tconst raw = await request.json().catch(() => null);\n\tconst parsed = schema.safeParse(raw ?? missingAs ?? null);\n\tif (!parsed.success) throwZodError(parsed.error);\n\treturn parsed.data;\n}\n/**\n* Pull a required file out of a multipart body and check its size and, where\n* given, its extension. Caps themselves stay in `admin-config`; this only\n* applies them.\n*\n* A second line of defence, not the first: `requireMaxBodySize` rejects an\n* oversized request before it's buffered. This catches a file that's\n* individually too large inside a request that isn't.\n*/\nfunction requireUpload(form, field, { maxBytes, extensions, contentTypes, label = \"File\" }) {\n\tconst file = form.get(field);\n\tif (!(file instanceof File) || file.size === 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, `A ${label.toLowerCase()} is required`);\n\tconst extension = file.name.slice(file.name.lastIndexOf(\".\")).toLowerCase();\n\tif (extensions && !extensions.includes(extension)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `File type not allowed. Allowed: ${extensions.join(\", \")}`);\n\tif (contentTypes && !contentTypes.allowed.has(file.type)) apiError(400, ApiErrorCode.VALIDATION_FAILED, contentTypes.message);\n\tif (file.size > maxBytes) apiError(400, ApiErrorCode.VALIDATION_FAILED, `${label} too large. Max size: ${maxBytes / 1048576} MB`);\n\treturn {\n\t\tfile,\n\t\textension\n\t};\n}\n/** A multipart text field, trimmed and length-capped. Absent stays `undefined`. */\nfunction formText(form, field, { maxLength } = {}) {\n\tconst raw = form.get(field);\n\tif (typeof raw !== \"string\") return void 0;\n\tconst trimmed = raw.trim();\n\tif (!trimmed) return void 0;\n\treturn maxLength ? trimmed.slice(0, maxLength) : trimmed;\n}\n/** A paginated collection. The one envelope every v1 list endpoint returns. */\nfunction collection(page) {\n\treturn json({\n\t\titems: page.items,\n\t\tnextCursor: page.nextCursor\n\t});\n}\n/** A created resource. */\nfunction created(body) {\n\treturn json(body, { status: 201 });\n}\n/** A successful mutation with nothing to say. */\nfunction noContent() {\n\treturn new Response(null, { status: 204 });\n}\n/**\n* Serialize a payload through an explicit response schema.\n*\n* **This is what keeps a secret from reaching a client by accident.** Several\n* responses are store records with a credential removed — `tokenHash` on a\n* share link or invite, `apiKey` on an org compute server. Parsing through a\n* schema means the response carries only what the schema names, so a new field\n* on the stored type is invisible until someone adds it here deliberately. See\n* `responses.ts`.\n*/\nfunction shaped(schema, payload, status = 200) {\n\treturn json(schema.parse(payload), { status });\n}\n/** `shaped`, mapped over a page of records. */\nfunction shapedCollection(schema, page) {\n\treturn json({\n\t\titems: page.items.map((item) => schema.parse(item)),\n\t\tnextCursor: page.nextCursor\n\t});\n}\n/**\n* Wrap a handler so an unhandled error becomes a structured API error.\n*\n* Every route used to end in the same `try { … } catch (err) { handleApiError(\n* err, '…') }`. A handler that forgot it surfaced a raw 500 with a provider\n* message in it, with nothing flagging the omission.\n*\n* `fallback` is required — the message used when the error carries none of its\n* own, and \"something went wrong\" tells a caller nothing.\n*/\nfunction apiRoute(fallback, handler) {\n\treturn async (event) => {\n\t\ttry {\n\t\t\treturn await handler(event);\n\t\t} catch (err) {\n\t\t\thandleApiError(err, fallback, event.locals.log);\n\t\t}\n\t};\n}\n//#endregion\nexport { noContent as a, requireCaller as c, shaped as d, shapedCollection as f, formText as i, requireParams as l, collection as n, parseBody as o, created as r, parseParam as s, apiRoute as t, requireUpload as u };\n"],"names":[],"mappings":";;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,MAAM,EAAE;AAC/B,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC;AAC1F,CAAC,OAAO;AACR,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG;AACjB,EAAE,IAAI,EAAE,MAAM,CAAC;AACf,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,MAAM,EAAE,GAAG,KAAK,EAAE;AACzC,CAAC,MAAM,GAAG,GAAG,EAAE;AACf,CAAC,MAAM,OAAO,GAAG,EAAE;AACnB,CAAC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE;AAC3B,EAAE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;AAC5B,EAAE,IAAI,CAAC,KAAK,EAAE;AACd,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;AACrB,GAAG;AACH,EAAE;AACF,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK;AACnB,CAAC;AACD,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,sBAAsB,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACnJ,CAAC,OAAO,GAAG;AACX;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;AACzC,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;AACvC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC,CAAC;AACjG,CAAC,OAAO,MAAM,CAAC,IAAI;AACnB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE;AAC9D,CAAC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;AACnD,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,SAAS,IAAI,IAAI,CAAC;AAC1D,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AACjD,CAAC,OAAO,MAAM,CAAC,IAAI;AACnB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,GAAG,MAAM,EAAE,EAAE;AAC5F,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;AAC7B,CAAC,IAAI,EAAE,IAAI,YAAY,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,YAAY,CAAC,CAAC;AACtI,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE;AAC5E,CAAC,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,gCAAgC,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC7J,CAAC,IAAI,YAAY,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,YAAY,CAAC,OAAO,CAAC;AAC9H,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,EAAE,KAAK,CAAC,sBAAsB,EAAE,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;AAClI,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE;AACF,EAAE;AACF;AACA;AACA,SAAS,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE;AACnD,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;AAC5B,CAAC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,OAAO,MAAM;AAC3C,CAAC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE;AAC3B,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,MAAM;AAC5B,CAAC,OAAO,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,OAAO;AACzD;AACA;AACA,SAAS,UAAU,CAAC,IAAI,EAAE;AAC1B,CAAC,OAAO,IAAI,CAAC;AACb,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK;AACnB,EAAE,UAAU,EAAE,IAAI,CAAC;AACnB,EAAE,CAAC;AACH;AACA;AACA,SAAS,OAAO,CAAC,IAAI,EAAE;AACvB,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AACnC;AACA;AACA,SAAS,SAAS,GAAG;AACrB,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC3C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,GAAG,EAAE;AAC/C,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC;AAC/C;AACA;AACA,SAAS,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE;AACxC,CAAC,OAAO,IAAI,CAAC;AACb,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACrD,EAAE,UAAU,EAAE,IAAI,CAAC;AACnB,EAAE,CAAC;AACH;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE;AACrC,CAAC,OAAO,OAAO,KAAK,KAAK;AACzB,EAAE,IAAI;AACN,GAAG,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC;AAC9B,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,cAAc,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC;AAClD,EAAE;AACF,CAAC,CAAC;AACF;;;;"}

package/build/server/chunks/chunks/instanceAdmins.server.js-CJTPkLyu.js

@@ -0,0 +1,23 @@
+import { h as hasPermission } from './src.js-B12bUNyu.js';
+import { b as getPermissionStore } from './providers.server.js-CGtbhqJ3.js';
+import { a as apiError, A as ApiErrorCode } from './api-errors.js-D-tV7sBR.js';
+
+//#region src/lib/server/admin/instanceAdmins.server.ts
+/**
+* Shared preconditions for the two routes that remove an instance admin's
+* access — `DELETE /api/admin/users/[id]` and its `disable` sibling. Both used
+* to carry their own copy; the copies agreed, which is exactly how they would
+* have drifted.
+*
+* `verb` is spliced into the 409 message ("Cannot delete/disable the last…").
+*/
+async function requireCanRemoveInstanceAdmin(ctx, targetUserId, verb) {
+	const targetIsAdmin = (await getPermissionStore().getFor(ctx, targetUserId)).includes("instance_admin");
+	if (!targetIsAdmin) return { targetIsAdmin };
+	if (!hasPermission(ctx, "instance_admin")) apiError(403, ApiErrorCode.FORBIDDEN, `Only a platform admin can ${verb} another platform admin.`);
+	if (await getPermissionStore().countInstanceAdminsExcluding(ctx, targetUserId) === 0) apiError(409, ApiErrorCode.CONFLICT, `Cannot ${verb} the last instance admin. Promote another user to instance admin first.`);
+	return { targetIsAdmin };
+}
+
+export { requireCanRemoveInstanceAdmin as r };
+//# sourceMappingURL=instanceAdmins.server.js-CJTPkLyu.js.map

package/build/server/chunks/chunks/instanceAdmins.server.js-CJTPkLyu.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instanceAdmins.server.js-CJTPkLyu.js","sources":["../../../../.svelte-kit/output/server/chunks/instanceAdmins.server.js"],"sourcesContent":["import { r as hasPermission } from \"./src.js\";\nimport { g as getPermissionStore } from \"./providers.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"./api-errors.js\";\n//#region src/lib/server/admin/instanceAdmins.server.ts\n/**\n* Shared preconditions for the two routes that remove an instance admin's\n* access — `DELETE /api/admin/users/[id]` and its `disable` sibling. Both used\n* to carry their own copy; the copies agreed, which is exactly how they would\n* have drifted.\n*\n* `verb` is spliced into the 409 message (\"Cannot delete/disable the last…\").\n*/\nasync function requireCanRemoveInstanceAdmin(ctx, targetUserId, verb) {\n\tconst targetIsAdmin = (await getPermissionStore().getFor(ctx, targetUserId)).includes(\"instance_admin\");\n\tif (!targetIsAdmin) return { targetIsAdmin };\n\tif (!hasPermission(ctx, \"instance_admin\")) apiError(403, ApiErrorCode.FORBIDDEN, `Only a platform admin can ${verb} another platform admin.`);\n\tif (await getPermissionStore().countInstanceAdminsExcluding(ctx, targetUserId) === 0) apiError(409, ApiErrorCode.CONFLICT, `Cannot ${verb} the last instance admin. Promote another user to instance admin first.`);\n\treturn { targetIsAdmin };\n}\n//#endregion\nexport { requireCanRemoveInstanceAdmin as t };\n"],"names":[],"mappings":";;;;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,6BAA6B,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE;AACtE,CAAC,MAAM,aAAa,GAAG,CAAC,MAAM,kBAAkB,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,QAAQ,CAAC,gBAAgB,CAAC;AACxG,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE;AAC7C,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,0BAA0B,EAAE,IAAI,CAAC,wBAAwB,CAAC,CAAC;AAC9I,CAAC,IAAI,MAAM,kBAAkB,EAAE,CAAC,4BAA4B,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,uEAAuE,CAAC,CAAC;AACpN,CAAC,OAAO,EAAE,aAAa,EAAE;AACzB;;;;"}

package/build/server/chunks/chunks/internal.js-D-PIqUmO.js.map

@@ -1 +1 @@
-{"version":3,"file":"internal.js-D-PIqUmO.js","sources":["../../../../.svelte-kit/output/server/chunks/internal.js"],"sourcesContent":["//#region ../../node_modules/.pnpm/@sveltejs+kit@2.70.2_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.3.0_svelte_0723e11b23f2da6f9905c693588154ab/node_modules/@sveltejs/kit/src/runtime/app/paths/internal/server.js\nvar base = \"\";\nvar assets = base;\nvar app_dir = \"_app\";\nvar initial = {\n\tbase,\n\tassets\n};\n/**\n* `base` could be overridden during rendering to be relative;\n* this one's the original non-relative base path\n*/\nvar initial_base = initial.base;\n/**\n* @param {{ base: string, assets: string }} paths\n*/\nfunction override(paths) {\n\tbase = paths.base;\n\tassets = paths.assets;\n}\nfunction reset() {\n\tbase = initial.base;\n\tassets = initial.assets;\n}\n/** @param {string} path */\nfunction set_assets(path) {\n\tassets = initial.assets = path;\n}\n//#endregion\n//#region ../../node_modules/.pnpm/@sveltejs+kit@2.70.2_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.3.0_svelte_0723e11b23f2da6f9905c693588154ab/node_modules/@sveltejs/kit/src/runtime/app/env/internal.js\nvar version = \"1787245402268\";\nvar prerendering = false;\nfunction set_building() {}\nfunction set_prerendering() {\n\tprerendering = true;\n}\n//#endregion\nexport { app_dir as a, initial_base as c, set_assets as d, version as i, override as l, set_building as n, assets as o, set_prerendering as r, base as s, prerendering as t, reset as u };\n"],"names":[],"mappings":"AAAA;AACG,IAAC,IAAI,GAAG;AACR,IAAC,MAAM,GAAG;AACV,IAAC,OAAO,GAAG;AACd,IAAI,OAAO,GAAG;AACd,CAAC,IAAI;AACL,CAAC;AACD,CAAC;AACD;AACA;AACA;AACA;AACG,IAAC,YAAY,GAAG,OAAO,CAAC;AAC3B;AACA;AACA;AACA,SAAS,QAAQ,CAAC,KAAK,EAAE;AACzB,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI;AAClB,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM;AACtB;AACA,SAAS,KAAK,GAAG;AACjB,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI;AACpB,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM;AACxB;;;;"}
+{"version":3,"file":"internal.js-D-PIqUmO.js","sources":["../../../../.svelte-kit/output/server/chunks/internal.js"],"sourcesContent":["//#region ../../node_modules/.pnpm/@sveltejs+kit@2.70.2_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.3.0_svelte_0723e11b23f2da6f9905c693588154ab/node_modules/@sveltejs/kit/src/runtime/app/paths/internal/server.js\nvar base = \"\";\nvar assets = base;\nvar app_dir = \"_app\";\nvar initial = {\n\tbase,\n\tassets\n};\n/**\n* `base` could be overridden during rendering to be relative;\n* this one's the original non-relative base path\n*/\nvar initial_base = initial.base;\n/**\n* @param {{ base: string, assets: string }} paths\n*/\nfunction override(paths) {\n\tbase = paths.base;\n\tassets = paths.assets;\n}\nfunction reset() {\n\tbase = initial.base;\n\tassets = initial.assets;\n}\n/** @param {string} path */\nfunction set_assets(path) {\n\tassets = initial.assets = path;\n}\n//#endregion\n//#region ../../node_modules/.pnpm/@sveltejs+kit@2.70.2_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.3.0_svelte_0723e11b23f2da6f9905c693588154ab/node_modules/@sveltejs/kit/src/runtime/app/env/internal.js\nvar version = \"1787306144885\";\nvar prerendering = false;\nfunction set_building() {}\nfunction set_prerendering() {\n\tprerendering = true;\n}\n//#endregion\nexport { app_dir as a, initial_base as c, set_assets as d, version as i, override as l, set_building as n, assets as o, set_prerendering as r, base as s, prerendering as t, reset as u };\n"],"names":[],"mappings":"AAAA;AACG,IAAC,IAAI,GAAG;AACR,IAAC,MAAM,GAAG;AACV,IAAC,OAAO,GAAG;AACd,IAAI,OAAO,GAAG;AACd,CAAC,IAAI;AACL,CAAC;AACD,CAAC;AACD;AACA;AACA;AACA;AACG,IAAC,YAAY,GAAG,OAAO,CAAC;AAC3B;AACA;AACA;AACA,SAAS,QAAQ,CAAC,KAAK,EAAE;AACzB,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI;AAClB,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM;AACtB;AACA,SAAS,KAAK,GAAG;AACjB,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI;AACpB,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM;AACxB;;;;"}

package/build/server/chunks/chunks/internal2.js-DITt-077.js

@@ -0,0 +1,224 @@
+import { S as render, a as setContext, T as derived } from './server.js-fxznQVe4.js';
+import { a as asClassComponent$1 } from './legacy-client.js-B6XuTI3b.js';
+
+//#region \0virtual:__sveltekit/server
+var read_implementation = null;
+function set_read_implementation(fn) {
+	read_implementation = fn;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/svelte@5.56.9_@typescript-eslint+types@8.67.0/node_modules/svelte/src/legacy/legacy-server.js
+/** @import { SvelteComponent } from '../index.js' */
+/** @import { Csp } from '#server' */
+/** @typedef {{ head: string, html: string, css: { code: string, map: null }; hashes?: { script: `sha256-${string}`[] } }} LegacyRenderResult */
+/**
+* Takes a Svelte 5 component and returns a Svelte 4 compatible component constructor.
+*
+* @deprecated Use this only as a temporary solution to migrate your imperative component code to Svelte 5.
+*
+* @template {Record<string, any>} Props
+* @template {Record<string, any>} Exports
+* @template {Record<string, any>} Events
+* @template {Record<string, any>} Slots
+*
+* @param {SvelteComponent<Props, Events, Slots>} component
+* @returns {typeof SvelteComponent<Props, Events, Slots> & Exports}
+*/
+function asClassComponent(component) {
+	const component_constructor = asClassComponent$1(component);
+	/** @type {(props?: {}, opts?: { $$slots?: {}; context?: Map<any, any>; csp?: Csp; transformError?: (error: unknown) => unknown }) => LegacyRenderResult & PromiseLike<LegacyRenderResult> } */
+	const _render = (props, { context, csp, transformError } = {}) => {
+		const result = render(component, {
+			props,
+			context,
+			csp,
+			transformError
+		});
+		const munged = Object.defineProperties({}, {
+			css: { value: {
+				code: "",
+				map: null
+			} },
+			head: { get: () => result.head },
+			html: { get: () => result.body },
+			then: { 
+			/**
+			* this is not type-safe, but honestly it's the best I can do right now, and it's a straightforward function.
+			*
+			* @template TResult1
+			* @template [TResult2=never]
+			* @param { (value: LegacyRenderResult) => TResult1 } onfulfilled
+			* @param { (reason: unknown) => TResult2 } onrejected
+			*/
+value: (onfulfilled, onrejected) => {
+				{
+					const user_result = onfulfilled({
+						css: munged.css,
+						head: munged.head,
+						html: munged.html
+					});
+					return Promise.resolve(user_result);
+				}
+			} }
+		});
+		return munged;
+	};
+	component_constructor.render = _render;
+	return component_constructor;
+}
+//#endregion
+//#region .svelte-kit/generated/root.svelte
+function Root($$renderer, $$props) {
+	$$renderer.component(($$renderer) => {
+		let { stores, page, constructors, components = [], form, data_0 = null, data_1 = null, data_2 = null } = $$props;
+		setContext("__svelte__", stores);
+		stores.page.set(page);
+		const Pyramid_2 = derived(() => constructors[2]);
+		if (constructors[1]) {
+			$$renderer.push("<!--[0-->");
+			const Pyramid_0 = constructors[0];
+			if (Pyramid_0) {
+				$$renderer.push("<!--[-->");
+				Pyramid_0($$renderer, {
+					data: data_0,
+					form,
+					params: page.params,
+					children: ($$renderer) => {
+						if (constructors[2]) {
+							$$renderer.push("<!--[0-->");
+							const Pyramid_1 = constructors[1];
+							if (Pyramid_1) {
+								$$renderer.push("<!--[-->");
+								Pyramid_1($$renderer, {
+									data: data_1,
+									form,
+									params: page.params,
+									children: ($$renderer) => {
+										if (Pyramid_2()) {
+											$$renderer.push("<!--[-->");
+											Pyramid_2()($$renderer, {
+												data: data_2,
+												form,
+												params: page.params
+											});
+											$$renderer.push("<!--]-->");
+										} else {
+											$$renderer.push("<!--[!-->");
+											$$renderer.push("<!--]-->");
+										}
+									},
+									$$slots: { default: true }
+								});
+								$$renderer.push("<!--]-->");
+							} else {
+								$$renderer.push("<!--[!-->");
+								$$renderer.push("<!--]-->");
+							}
+						} else {
+							$$renderer.push("<!--[-1-->");
+							const Pyramid_1 = constructors[1];
+							if (Pyramid_1) {
+								$$renderer.push("<!--[-->");
+								Pyramid_1($$renderer, {
+									data: data_1,
+									form,
+									params: page.params
+								});
+								$$renderer.push("<!--]-->");
+							} else {
+								$$renderer.push("<!--[!-->");
+								$$renderer.push("<!--]-->");
+							}
+						}
+						$$renderer.push(`<!--]-->`);
+					},
+					$$slots: { default: true }
+				});
+				$$renderer.push("<!--]-->");
+			} else {
+				$$renderer.push("<!--[!-->");
+				$$renderer.push("<!--]-->");
+			}
+		} else {
+			$$renderer.push("<!--[-1-->");
+			const Pyramid_0 = constructors[0];
+			if (Pyramid_0) {
+				$$renderer.push("<!--[-->");
+				Pyramid_0($$renderer, {
+					data: data_0,
+					form,
+					params: page.params
+				});
+				$$renderer.push("<!--]-->");
+			} else {
+				$$renderer.push("<!--[!-->");
+				$$renderer.push("<!--]-->");
+			}
+		}
+		$$renderer.push(`<!--]--> `);
+		$$renderer.push("<!--[-1-->");
+		$$renderer.push(`<!--]-->`);
+	});
+}
+//#endregion
+//#region .svelte-kit/generated/root.js
+var root_default = asClassComponent(Root);
+//#endregion
+//#region .svelte-kit/generated/shared/error-template.js
+var error_template_default = ({ status, message }) => "<!doctype html>\n<html lang=\"en\">\n	<head>\n		<meta charset=\"utf-8\" />\n		<title>" + message + "</title>\n\n		<style>\n			body {\n				--bg: white;\n				--fg: #222;\n				--divider: #ccc;\n				background: var(--bg);\n				color: var(--fg);\n				font-family:\n					system-ui,\n					-apple-system,\n					BlinkMacSystemFont,\n					'Segoe UI',\n					Roboto,\n					Oxygen,\n					Ubuntu,\n					Cantarell,\n					'Open Sans',\n					'Helvetica Neue',\n					sans-serif;\n				display: flex;\n				align-items: center;\n				justify-content: center;\n				height: 100vh;\n				margin: 0;\n			}\n\n			.error {\n				display: flex;\n				align-items: center;\n				max-width: 32rem;\n				margin: 0 1rem;\n			}\n\n			.status {\n				font-weight: 200;\n				font-size: 3rem;\n				line-height: 1;\n				position: relative;\n				top: -0.05rem;\n			}\n\n			.message {\n				border-left: 1px solid var(--divider);\n				padding: 0 0 0 1rem;\n				margin: 0 0 0 1rem;\n				min-height: 2.5rem;\n				display: flex;\n				align-items: center;\n			}\n\n			.message h1 {\n				font-weight: 400;\n				font-size: 1em;\n				margin: 0;\n			}\n\n			@media (prefers-color-scheme: dark) {\n				body {\n					--bg: #222;\n					--fg: #ddd;\n					--divider: #666;\n				}\n			}\n		</style>\n	</head>\n	<body>\n		<div class=\"error\">\n			<span class=\"status\">" + status + "</span>\n			<div class=\"message\">\n				<h1>" + message + "</h1>\n			</div>\n		</div>\n	</body>\n</html>\n";
+//#endregion
+//#region .svelte-kit/generated/server/internal.js
+var options = {
+	app_template_contains_nonce: false,
+	async: false,
+	csp: {
+		"mode": "auto",
+		"directives": {
+			"upgrade-insecure-requests": false,
+			"block-all-mixed-content": false
+		},
+		"reportOnly": {
+			"upgrade-insecure-requests": false,
+			"block-all-mixed-content": false
+		}
+	},
+	csrf_check_origin: true,
+	csrf_trusted_origins: [],
+	embedded: false,
+	env_public_prefix: "PUBLIC_",
+	env_private_prefix: "",
+	hash_routing: false,
+	hooks: null,
+	preload_strategy: "modulepreload",
+	root: root_default,
+	service_worker: false,
+	service_worker_options: void 0,
+	server_error_boundaries: false,
+	templates: {
+		app: ({ head, body, assets, nonce, env }) => "<!doctype html>\n<html lang=\"en\">\n	<head>\n		<meta charset=\"utf-8\" />\n		<meta content=\"width=device-width, initial-scale=1\" name=\"viewport\" />\n		<link rel=\"icon\" type=\"image/png\" href=\"/favicon/favicon-96x96.png\" sizes=\"96x96\" />\n		<link rel=\"icon\" type=\"image/svg+xml\" href=\"/favicon/favicon.svg\" />\n		<link rel=\"shortcut icon\" href=\"/favicon/favicon.ico\" />\n		<link rel=\"apple-touch-icon\" sizes=\"180x180\" href=\"/favicon/apple-touch-icon.png\" />\n		<meta name=\"apple-mobile-web-app-title\" content=\"Selva\" />\n		<link rel=\"manifest\" href=\"/favicon/site.webmanifest\" crossorigin=\"use-credentials\" />\n		" + head + "\n	</head>\n	<body data-sveltekit-preload-data=\"hover\">\n		<div style=\"display: contents\">" + body + "</div>\n	</body>\n</html>\n",
+		error: error_template_default
+	},
+	version_hash: "lcsxkt"
+};
+async function get_hooks() {
+	let handle;
+	let handleFetch;
+	let handleError;
+	let handleValidationError;
+	let init;
+	({handle, handleFetch, handleError, handleValidationError, init} = await import('../entries/hooks.server.js-Dt1oAZte.js'));
+	let reroute;
+	let transport;
+	return {
+		handle,
+		handleFetch,
+		handleError,
+		handleValidationError,
+		init,
+		reroute,
+		transport
+	};
+}
+
+export { get_hooks as g, options as o, read_implementation as r, set_read_implementation as s };
+//# sourceMappingURL=internal2.js-DITt-077.js.map

package/build/server/chunks/chunks/internal2.js-DITt-077.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal2.js-DITt-077.js","sources":["../../../../.svelte-kit/output/server/chunks/internal2.js"],"sourcesContent":["import \"./index-server.js\";\nimport \"./internal.js\";\nimport { S as setContext, a as derived, it as async_mode_flag, u as render } from \"./server.js\";\nimport { t as asClassComponent$1 } from \"./legacy-client.js\";\n//#region \\0virtual:__sveltekit/server\nvar read_implementation = null;\nfunction set_read_implementation(fn) {\n\tread_implementation = fn;\n}\nfunction set_manifest(_) {}\n//#endregion\n//#region ../../node_modules/.pnpm/svelte@5.56.9_@typescript-eslint+types@8.67.0/node_modules/svelte/src/legacy/legacy-server.js\n/** @import { SvelteComponent } from '../index.js' */\n/** @import { Csp } from '#server' */\n/** @typedef {{ head: string, html: string, css: { code: string, map: null }; hashes?: { script: `sha256-${string}`[] } }} LegacyRenderResult */\n/**\n* Takes a Svelte 5 component and returns a Svelte 4 compatible component constructor.\n*\n* @deprecated Use this only as a temporary solution to migrate your imperative component code to Svelte 5.\n*\n* @template {Record<string, any>} Props\n* @template {Record<string, any>} Exports\n* @template {Record<string, any>} Events\n* @template {Record<string, any>} Slots\n*\n* @param {SvelteComponent<Props, Events, Slots>} component\n* @returns {typeof SvelteComponent<Props, Events, Slots> & Exports}\n*/\nfunction asClassComponent(component) {\n\tconst component_constructor = asClassComponent$1(component);\n\t/** @type {(props?: {}, opts?: { $$slots?: {}; context?: Map<any, any>; csp?: Csp; transformError?: (error: unknown) => unknown }) => LegacyRenderResult & PromiseLike<LegacyRenderResult> } */\n\tconst _render = (props, { context, csp, transformError } = {}) => {\n\t\tconst result = render(component, {\n\t\t\tprops,\n\t\t\tcontext,\n\t\t\tcsp,\n\t\t\ttransformError\n\t\t});\n\t\tconst munged = Object.defineProperties({}, {\n\t\t\tcss: { value: {\n\t\t\t\tcode: \"\",\n\t\t\t\tmap: null\n\t\t\t} },\n\t\t\thead: { get: () => result.head },\n\t\t\thtml: { get: () => result.body },\n\t\t\tthen: { \n\t\t\t/**\n\t\t\t* this is not type-safe, but honestly it's the best I can do right now, and it's a straightforward function.\n\t\t\t*\n\t\t\t* @template TResult1\n\t\t\t* @template [TResult2=never]\n\t\t\t* @param { (value: LegacyRenderResult) => TResult1 } onfulfilled\n\t\t\t* @param { (reason: unknown) => TResult2 } onrejected\n\t\t\t*/\nvalue: (onfulfilled, onrejected) => {\n\t\t\t\tif (!async_mode_flag) {\n\t\t\t\t\tconst user_result = onfulfilled({\n\t\t\t\t\t\tcss: munged.css,\n\t\t\t\t\t\thead: munged.head,\n\t\t\t\t\t\thtml: munged.html\n\t\t\t\t\t});\n\t\t\t\t\treturn Promise.resolve(user_result);\n\t\t\t\t}\n\t\t\t\treturn result.then((result) => {\n\t\t\t\t\treturn onfulfilled({\n\t\t\t\t\t\tcss: munged.css,\n\t\t\t\t\t\thead: result.head,\n\t\t\t\t\t\thtml: result.body,\n\t\t\t\t\t\thashes: result.hashes\n\t\t\t\t\t});\n\t\t\t\t}, onrejected);\n\t\t\t} }\n\t\t});\n\t\treturn munged;\n\t};\n\tcomponent_constructor.render = _render;\n\treturn component_constructor;\n}\n//#endregion\n//#region .svelte-kit/generated/root.svelte\nfunction Root($$renderer, $$props) {\n\t$$renderer.component(($$renderer) => {\n\t\tlet { stores, page, constructors, components = [], form, data_0 = null, data_1 = null, data_2 = null } = $$props;\n\t\tsetContext(\"__svelte__\", stores);\n\t\tstores.page.set(page);\n\t\tconst Pyramid_2 = derived(() => constructors[2]);\n\t\tif (constructors[1]) {\n\t\t\t$$renderer.push(\"<!--[0-->\");\n\t\t\tconst Pyramid_0 = constructors[0];\n\t\t\tif (Pyramid_0) {\n\t\t\t\t$$renderer.push(\"<!--[-->\");\n\t\t\t\tPyramid_0($$renderer, {\n\t\t\t\t\tdata: data_0,\n\t\t\t\t\tform,\n\t\t\t\t\tparams: page.params,\n\t\t\t\t\tchildren: ($$renderer) => {\n\t\t\t\t\t\tif (constructors[2]) {\n\t\t\t\t\t\t\t$$renderer.push(\"<!--[0-->\");\n\t\t\t\t\t\t\tconst Pyramid_1 = constructors[1];\n\t\t\t\t\t\t\tif (Pyramid_1) {\n\t\t\t\t\t\t\t\t$$renderer.push(\"<!--[-->\");\n\t\t\t\t\t\t\t\tPyramid_1($$renderer, {\n\t\t\t\t\t\t\t\t\tdata: data_1,\n\t\t\t\t\t\t\t\t\tform,\n\t\t\t\t\t\t\t\t\tparams: page.params,\n\t\t\t\t\t\t\t\t\tchildren: ($$renderer) => {\n\t\t\t\t\t\t\t\t\t\tif (Pyramid_2()) {\n\t\t\t\t\t\t\t\t\t\t\t$$renderer.push(\"<!--[-->\");\n\t\t\t\t\t\t\t\t\t\t\tPyramid_2()($$renderer, {\n\t\t\t\t\t\t\t\t\t\t\t\tdata: data_2,\n\t\t\t\t\t\t\t\t\t\t\t\tform,\n\t\t\t\t\t\t\t\t\t\t\t\tparams: page.params\n\t\t\t\t\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\t\t\t\t\t$$renderer.push(\"<!--]-->\");\n\t\t\t\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\t\t\t\t$$renderer.push(\"<!--[!-->\");\n\t\t\t\t\t\t\t\t\t\t\t$$renderer.push(\"<!--]-->\");\n\t\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t$$slots: { default: true }\n\t\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\t\t$$renderer.push(\"<!--]-->\");\n\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\t$$renderer.push(\"<!--[!-->\");\n\t\t\t\t\t\t\t\t$$renderer.push(\"<!--]-->\");\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t$$renderer.push(\"<!--[-1-->\");\n\t\t\t\t\t\t\tconst Pyramid_1 = constructors[1];\n\t\t\t\t\t\t\tif (Pyramid_1) {\n\t\t\t\t\t\t\t\t$$renderer.push(\"<!--[-->\");\n\t\t\t\t\t\t\t\tPyramid_1($$renderer, {\n\t\t\t\t\t\t\t\t\tdata: data_1,\n\t\t\t\t\t\t\t\t\tform,\n\t\t\t\t\t\t\t\t\tparams: page.params\n\t\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\t\t$$renderer.push(\"<!--]-->\");\n\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\t$$renderer.push(\"<!--[!-->\");\n\t\t\t\t\t\t\t\t$$renderer.push(\"<!--]-->\");\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t\t$$renderer.push(`<!--]-->`);\n\t\t\t\t\t},\n\t\t\t\t\t$$slots: { default: true }\n\t\t\t\t});\n\t\t\t\t$$renderer.push(\"<!--]-->\");\n\t\t\t} else {\n\t\t\t\t$$renderer.push(\"<!--[!-->\");\n\t\t\t\t$$renderer.push(\"<!--]-->\");\n\t\t\t}\n\t\t} else {\n\t\t\t$$renderer.push(\"<!--[-1-->\");\n\t\t\tconst Pyramid_0 = constructors[0];\n\t\t\tif (Pyramid_0) {\n\t\t\t\t$$renderer.push(\"<!--[-->\");\n\t\t\t\tPyramid_0($$renderer, {\n\t\t\t\t\tdata: data_0,\n\t\t\t\t\tform,\n\t\t\t\t\tparams: page.params\n\t\t\t\t});\n\t\t\t\t$$renderer.push(\"<!--]-->\");\n\t\t\t} else {\n\t\t\t\t$$renderer.push(\"<!--[!-->\");\n\t\t\t\t$$renderer.push(\"<!--]-->\");\n\t\t\t}\n\t\t}\n\t\t$$renderer.push(`<!--]--> `);\n\t\t$$renderer.push(\"<!--[-1-->\");\n\t\t$$renderer.push(`<!--]-->`);\n\t});\n}\n//#endregion\n//#region .svelte-kit/generated/root.js\nvar root_default = asClassComponent(Root);\n//#endregion\n//#region .svelte-kit/generated/shared/error-template.js\nvar error_template_default = ({ status, message }) => \"<!doctype html>\\n<html lang=\\\"en\\\">\\n\t<head>\\n\t\t<meta charset=\\\"utf-8\\\" />\\n\t\t<title>\" + message + \"</title>\\n\\n\t\t<style>\\n\t\t\tbody {\\n\t\t\t\t--bg: white;\\n\t\t\t\t--fg: #222;\\n\t\t\t\t--divider: #ccc;\\n\t\t\t\tbackground: var(--bg);\\n\t\t\t\tcolor: var(--fg);\\n\t\t\t\tfont-family:\\n\t\t\t\t\tsystem-ui,\\n\t\t\t\t\t-apple-system,\\n\t\t\t\t\tBlinkMacSystemFont,\\n\t\t\t\t\t'Segoe UI',\\n\t\t\t\t\tRoboto,\\n\t\t\t\t\tOxygen,\\n\t\t\t\t\tUbuntu,\\n\t\t\t\t\tCantarell,\\n\t\t\t\t\t'Open Sans',\\n\t\t\t\t\t'Helvetica Neue',\\n\t\t\t\t\tsans-serif;\\n\t\t\t\tdisplay: flex;\\n\t\t\t\talign-items: center;\\n\t\t\t\tjustify-content: center;\\n\t\t\t\theight: 100vh;\\n\t\t\t\tmargin: 0;\\n\t\t\t}\\n\\n\t\t\t.error {\\n\t\t\t\tdisplay: flex;\\n\t\t\t\talign-items: center;\\n\t\t\t\tmax-width: 32rem;\\n\t\t\t\tmargin: 0 1rem;\\n\t\t\t}\\n\\n\t\t\t.status {\\n\t\t\t\tfont-weight: 200;\\n\t\t\t\tfont-size: 3rem;\\n\t\t\t\tline-height: 1;\\n\t\t\t\tposition: relative;\\n\t\t\t\ttop: -0.05rem;\\n\t\t\t}\\n\\n\t\t\t.message {\\n\t\t\t\tborder-left: 1px solid var(--divider);\\n\t\t\t\tpadding: 0 0 0 1rem;\\n\t\t\t\tmargin: 0 0 0 1rem;\\n\t\t\t\tmin-height: 2.5rem;\\n\t\t\t\tdisplay: flex;\\n\t\t\t\talign-items: center;\\n\t\t\t}\\n\\n\t\t\t.message h1 {\\n\t\t\t\tfont-weight: 400;\\n\t\t\t\tfont-size: 1em;\\n\t\t\t\tmargin: 0;\\n\t\t\t}\\n\\n\t\t\t@media (prefers-color-scheme: dark) {\\n\t\t\t\tbody {\\n\t\t\t\t\t--bg: #222;\\n\t\t\t\t\t--fg: #ddd;\\n\t\t\t\t\t--divider: #666;\\n\t\t\t\t}\\n\t\t\t}\\n\t\t</style>\\n\t</head>\\n\t<body>\\n\t\t<div class=\\\"error\\\">\\n\t\t\t<span class=\\\"status\\\">\" + status + \"</span>\\n\t\t\t<div class=\\\"message\\\">\\n\t\t\t\t<h1>\" + message + \"</h1>\\n\t\t\t</div>\\n\t\t</div>\\n\t</body>\\n</html>\\n\";\n//#endregion\n//#region .svelte-kit/generated/server/internal.js\nvar options = {\n\tapp_template_contains_nonce: false,\n\tasync: false,\n\tcsp: {\n\t\t\"mode\": \"auto\",\n\t\t\"directives\": {\n\t\t\t\"upgrade-insecure-requests\": false,\n\t\t\t\"block-all-mixed-content\": false\n\t\t},\n\t\t\"reportOnly\": {\n\t\t\t\"upgrade-insecure-requests\": false,\n\t\t\t\"block-all-mixed-content\": false\n\t\t}\n\t},\n\tcsrf_check_origin: true,\n\tcsrf_trusted_origins: [],\n\tembedded: false,\n\tenv_public_prefix: \"PUBLIC_\",\n\tenv_private_prefix: \"\",\n\thash_routing: false,\n\thooks: null,\n\tpreload_strategy: \"modulepreload\",\n\troot: root_default,\n\tservice_worker: false,\n\tservice_worker_options: void 0,\n\tserver_error_boundaries: false,\n\ttemplates: {\n\t\tapp: ({ head, body, assets, nonce, env }) => \"<!doctype html>\\n<html lang=\\\"en\\\">\\n\t<head>\\n\t\t<meta charset=\\\"utf-8\\\" />\\n\t\t<meta content=\\\"width=device-width, initial-scale=1\\\" name=\\\"viewport\\\" />\\n\t\t<link rel=\\\"icon\\\" type=\\\"image/png\\\" href=\\\"/favicon/favicon-96x96.png\\\" sizes=\\\"96x96\\\" />\\n\t\t<link rel=\\\"icon\\\" type=\\\"image/svg+xml\\\" href=\\\"/favicon/favicon.svg\\\" />\\n\t\t<link rel=\\\"shortcut icon\\\" href=\\\"/favicon/favicon.ico\\\" />\\n\t\t<link rel=\\\"apple-touch-icon\\\" sizes=\\\"180x180\\\" href=\\\"/favicon/apple-touch-icon.png\\\" />\\n\t\t<meta name=\\\"apple-mobile-web-app-title\\\" content=\\\"Selva\\\" />\\n\t\t<link rel=\\\"manifest\\\" href=\\\"/favicon/site.webmanifest\\\" crossorigin=\\\"use-credentials\\\" />\\n\t\t\" + head + \"\\n\t</head>\\n\t<body data-sveltekit-preload-data=\\\"hover\\\">\\n\t\t<div style=\\\"display: contents\\\">\" + body + \"</div>\\n\t</body>\\n</html>\\n\",\n\t\terror: error_template_default\n\t},\n\tversion_hash: \"lcsxkt\"\n};\nasync function get_hooks() {\n\tlet handle;\n\tlet handleFetch;\n\tlet handleError;\n\tlet handleValidationError;\n\tlet init;\n\t({handle, handleFetch, handleError, handleValidationError, init} = await import(\"../entries/hooks.server.js\"));\n\tlet reroute;\n\tlet transport;\n\treturn {\n\t\thandle,\n\t\thandleFetch,\n\t\thandleError,\n\t\thandleValidationError,\n\t\tinit,\n\t\treroute,\n\t\ttransport\n\t};\n}\n//#endregion\nexport { set_read_implementation as a, set_manifest as i, options as n, read_implementation as r, get_hooks as t };\n"],"names":[],"mappings":";;;AAIA;AACG,IAAC,mBAAmB,GAAG;AAC1B,SAAS,uBAAuB,CAAC,EAAE,EAAE;AACrC,CAAC,mBAAmB,GAAG,EAAE;AACzB;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,CAAC,SAAS,EAAE;AACrC,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,CAAC,SAAS,CAAC;AAC5D;AACA,CAAC,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,KAAK;AACnE,EAAE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE;AACnC,GAAG,KAAK;AACR,GAAG,OAAO;AACV,GAAG,GAAG;AACN,GAAG;AACH,GAAG,CAAC;AACJ,EAAE,MAAM,MAAM,GAAG,MAAM,CAAC,gBAAgB,CAAC,EAAE,EAAE;AAC7C,GAAG,GAAG,EAAE,EAAE,KAAK,EAAE;AACjB,IAAI,IAAI,EAAE,EAAE;AACZ,IAAI,GAAG,EAAE;AACT,IAAI,EAAE;AACN,GAAG,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC,IAAI,EAAE;AACnC,GAAG,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC,IAAI,EAAE;AACnC,GAAG,IAAI,EAAE;AACT;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,KAAK,EAAE,CAAC,WAAW,EAAE,UAAU,KAAK;AACpC,IAA0B;AAC1B,KAAK,MAAM,WAAW,GAAG,WAAW,CAAC;AACrC,MAAM,GAAG,EAAE,MAAM,CAAC,GAAG;AACrB,MAAM,IAAI,EAAE,MAAM,CAAC,IAAI;AACvB,MAAM,IAAI,EAAE,MAAM,CAAC;AACnB,MAAM,CAAC;AACP,KAAK,OAAO,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;AACxC,IAAI;AASJ,GAAG,CAAC;AACJ,GAAG,CAAC;AACJ,EAAE,OAAO,MAAM;AACf,CAAC,CAAC;AACF,CAAC,qBAAqB,CAAC,MAAM,GAAG,OAAO;AACvC,CAAC,OAAO,qBAAqB;AAC7B;AACA;AACA;AACA,SAAS,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE;AACnC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,UAAU,KAAK;AACtC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,OAAO;AAClH,EAAE,UAAU,CAAC,YAAY,EAAE,MAAM,CAAC;AAClC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;AACvB,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;AAClD,EAAE,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE;AACvB,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;AAC/B,GAAG,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC;AACpC,GAAG,IAAI,SAAS,EAAE;AAClB,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AAC/B,IAAI,SAAS,CAAC,UAAU,EAAE;AAC1B,KAAK,IAAI,EAAE,MAAM;AACjB,KAAK,IAAI;AACT,KAAK,MAAM,EAAE,IAAI,CAAC,MAAM;AACxB,KAAK,QAAQ,EAAE,CAAC,UAAU,KAAK;AAC/B,MAAM,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE;AAC3B,OAAO,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;AACnC,OAAO,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC;AACxC,OAAO,IAAI,SAAS,EAAE;AACtB,QAAQ,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AACnC,QAAQ,SAAS,CAAC,UAAU,EAAE;AAC9B,SAAS,IAAI,EAAE,MAAM;AACrB,SAAS,IAAI;AACb,SAAS,MAAM,EAAE,IAAI,CAAC,MAAM;AAC5B,SAAS,QAAQ,EAAE,CAAC,UAAU,KAAK;AACnC,UAAU,IAAI,SAAS,EAAE,EAAE;AAC3B,WAAW,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AACtC,WAAW,SAAS,EAAE,CAAC,UAAU,EAAE;AACnC,YAAY,IAAI,EAAE,MAAM;AACxB,YAAY,IAAI;AAChB,YAAY,MAAM,EAAE,IAAI,CAAC;AACzB,YAAY,CAAC;AACb,WAAW,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AACtC,UAAU,CAAC,MAAM;AACjB,WAAW,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;AACvC,WAAW,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AACtC,UAAU;AACV,SAAS,CAAC;AACV,SAAS,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI;AACjC,SAAS,CAAC;AACV,QAAQ,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AACnC,OAAO,CAAC,MAAM;AACd,QAAQ,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;AACpC,QAAQ,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AACnC,OAAO;AACP,MAAM,CAAC,MAAM;AACb,OAAO,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;AACpC,OAAO,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC;AACxC,OAAO,IAAI,SAAS,EAAE;AACtB,QAAQ,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AACnC,QAAQ,SAAS,CAAC,UAAU,EAAE;AAC9B,SAAS,IAAI,EAAE,MAAM;AACrB,SAAS,IAAI;AACb,SAAS,MAAM,EAAE,IAAI,CAAC;AACtB,SAAS,CAAC;AACV,QAAQ,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AACnC,OAAO,CAAC,MAAM;AACd,QAAQ,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;AACpC,QAAQ,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AACnC,OAAO;AACP,MAAM;AACN,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;AACjC,KAAK,CAAC;AACN,KAAK,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI;AAC7B,KAAK,CAAC;AACN,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AAC/B,GAAG,CAAC,MAAM;AACV,IAAI,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;AAChC,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AAC/B,GAAG;AACH,EAAE,CAAC,MAAM;AACT,GAAG,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;AAChC,GAAG,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC;AACpC,GAAG,IAAI,SAAS,EAAE;AAClB,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AAC/B,IAAI,SAAS,CAAC,UAAU,EAAE;AAC1B,KAAK,IAAI,EAAE,MAAM;AACjB,KAAK,IAAI;AACT,KAAK,MAAM,EAAE,IAAI,CAAC;AAClB,KAAK,CAAC;AACN,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AAC/B,GAAG,CAAC,MAAM;AACV,IAAI,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;AAChC,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AAC/B,GAAG;AACH,EAAE;AACF,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC;AAC9B,EAAE,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;AAC/B,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;AAC7B,CAAC,CAAC,CAAC;AACH;AACA;AACA;AACA,IAAI,YAAY,GAAG,gBAAgB,CAAC,IAAI,CAAC;AACzC;AACA;AACA,IAAI,sBAAsB,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,uFAAuF,GAAG,OAAO,GAAG,2rCAA2rC,GAAG,MAAM,GAAG,+CAA+C,GAAG,OAAO,GAAG,iDAAiD;AAC98C;AACA;AACG,IAAC,OAAO,GAAG;AACd,CAAC,2BAA2B,EAAE,KAAK;AACnC,CAAC,KAAK,EAAE,KAAK;AACb,CAAC,GAAG,EAAE;AACN,EAAE,MAAM,EAAE,MAAM;AAChB,EAAE,YAAY,EAAE;AAChB,GAAG,2BAA2B,EAAE,KAAK;AACrC,GAAG,yBAAyB,EAAE;AAC9B,GAAG;AACH,EAAE,YAAY,EAAE;AAChB,GAAG,2BAA2B,EAAE,KAAK;AACrC,GAAG,yBAAyB,EAAE;AAC9B;AACA,EAAE;AACF,CAAC,iBAAiB,EAAE,IAAI;AACxB,CAAC,oBAAoB,EAAE,EAAE;AACzB,CAAC,QAAQ,EAAE,KAAK;AAChB,CAAC,iBAAiB,EAAE,SAAS;AAC7B,CAAC,kBAAkB,EAAE,EAAE;AACvB,CAAC,YAAY,EAAE,KAAK;AACpB,CAAC,KAAK,EAAE,IAAI;AACZ,CAAC,gBAAgB,EAAE,eAAe;AAClC,CAAC,IAAI,EAAE,YAAY;AACnB,CAAC,cAAc,EAAE,KAAK;AACtB,CAAC,sBAAsB,EAAE,MAAM;AAC/B,CAAC,uBAAuB,EAAE,KAAK;AAC/B,CAAC,SAAS,EAAE;AACZ,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,4oBAA4oB,GAAG,IAAI,GAAG,gGAAgG,GAAG,IAAI,GAAG,6BAA6B;AAC50B,EAAE,KAAK,EAAE;AACT,EAAE;AACF,CAAC,YAAY,EAAE;AACf;AACA,eAAe,SAAS,GAAG;AAC3B,CAAC,IAAI,MAAM;AACX,CAAC,IAAI,WAAW;AAChB,CAAC,IAAI,WAAW;AAChB,CAAC,IAAI,qBAAqB;AAC1B,CAAC,IAAI,IAAI;AACT,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,qBAAqB,EAAE,IAAI,CAAC,GAAG,MAAM,OAAO,wCAA4B,CAAC;AAC9G,CAAC,IAAI,OAAO;AACZ,CAAC,IAAI,SAAS;AACd,CAAC,OAAO;AACR,EAAE,MAAM;AACR,EAAE,WAAW;AACb,EAAE,WAAW;AACb,EAAE,qBAAqB;AACvB,EAAE,IAAI;AACN,EAAE,OAAO;AACT,EAAE;AACF,EAAE;AACF;;;;"}

package/build/server/chunks/chunks/lookup.server.js-bQcvnig-.js

@@ -0,0 +1,28 @@
+import { u as getInviteStore } from './providers.server.js-CGtbhqJ3.js';
+
+//#region src/lib/server/invites/lookup.server.ts
+/**
+* Find an invite by id, confirming it belongs to `orgId`.
+*
+* `manage_org_members` is org-scoped, so a permitted caller must not reach an
+* invite in another org. Neither store scopes `revoke()` by acting org, so
+* every route that mutates an invite by id has to establish ownership first —
+* hence one shared paged scan rather than a copy per route.
+*/
+async function findPendingInviteInOrg(ctx, orgId, id) {
+	const store = getInviteStore();
+	let cursor;
+	do {
+		const page = await store.listByOrg(ctx, orgId, {
+			limit: 200,
+			cursor
+		});
+		const match = page.items.find((i) => i.id === id);
+		if (match) return match;
+		cursor = page.nextCursor ?? void 0;
+	} while (cursor);
+	return null;
+}
+
+export { findPendingInviteInOrg as f };
+//# sourceMappingURL=lookup.server.js-bQcvnig-.js.map

package/build/server/chunks/chunks/lookup.server.js-bQcvnig-.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lookup.server.js-bQcvnig-.js","sources":["../../../../.svelte-kit/output/server/chunks/lookup.server.js"],"sourcesContent":["import { d as getInviteStore } from \"./providers.server.js\";\n//#region src/lib/server/invites/lookup.server.ts\n/**\n* Find an invite by id, confirming it belongs to `orgId`.\n*\n* `manage_org_members` is org-scoped, so a permitted caller must not reach an\n* invite in another org. Neither store scopes `revoke()` by acting org, so\n* every route that mutates an invite by id has to establish ownership first —\n* hence one shared paged scan rather than a copy per route.\n*/\nasync function findPendingInviteInOrg(ctx, orgId, id) {\n\tconst store = getInviteStore();\n\tlet cursor;\n\tdo {\n\t\tconst page = await store.listByOrg(ctx, orgId, {\n\t\t\tlimit: 200,\n\t\t\tcursor\n\t\t});\n\t\tconst match = page.items.find((i) => i.id === id);\n\t\tif (match) return match;\n\t\tcursor = page.nextCursor ?? void 0;\n\t} while (cursor);\n\treturn null;\n}\n//#endregion\nexport { findPendingInviteInOrg as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,sBAAsB,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE;AACtD,CAAC,MAAM,KAAK,GAAG,cAAc,EAAE;AAC/B,CAAC,IAAI,MAAM;AACX,CAAC,GAAG;AACJ,EAAE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE;AACjD,GAAG,KAAK,EAAE,GAAG;AACb,GAAG;AACH,GAAG,CAAC;AACJ,EAAE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;AACnD,EAAE,IAAI,KAAK,EAAE,OAAO,KAAK;AACzB,EAAE,MAAM,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM;AACpC,CAAC,CAAC,QAAQ,MAAM;AAChB,CAAC,OAAO,IAAI;AACZ;;;;"}

package/build/server/chunks/chunks/navigation.js-CrY61HFP.js

@@ -0,0 +1,2 @@
+import './client.js-DgveY-J7.js';
+//# sourceMappingURL=navigation.js-CrY61HFP.js.map

package/build/server/chunks/chunks/navigation.js-CrY61HFP.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"navigation.js-CrY61HFP.js","sources":[],"sourcesContent":[],"names":[],"mappings":""}

package/build/server/chunks/chunks/oauthState.server.js-DX7ZmU2E.js

@@ -0,0 +1,59 @@
+import { b as private_env } from './shared-server.js-BZy9KN6u.js';
+import { timingSafeEqual, randomBytes } from 'node:crypto';
+
+//#region src/lib/server/auth/oauthState.server.ts
+/**
+* CSRF `state` for the OAuth round trip.
+*
+* `/auth/supabase/callback` is a GET that mints and sets a session cookie.
+* SvelteKit's built-in CSRF origin check covers form POSTs, not GETs, so
+* without a state nonce the callback accepts a `?code=` from anywhere. The
+* attack is login CSRF: the attacker starts their own OAuth flow, captures
+* their `code`, and induces the victim's browser to load the callback with it.
+* The victim is now silently signed into the attacker's account, and everything
+* they do there is visible to the attacker.
+*
+* The nonce lives in a short-lived cookie rather than server memory so it
+* survives a multi-instance deployment without a shared store — the browser
+* that started the flow is the only one that can finish it. `SameSite=Lax` is
+* required, not `Strict`: the IdP redirects back cross-site, and `Strict` would
+* withhold the cookie on exactly the request that needs it.
+*
+* `exchangeOAuthCode` takes only `code` — the adapter enforces neither `state`
+* nor PKCE — so this app-layer check is the only thing standing between the
+* callback and a replayed authorization code.
+*/
+var STATE_COOKIE_NAME = "oauth_state";
+var STATE_MAX_AGE_S = 600;
+/**
+* Mint a nonce, store it in the cookie, and return it for the caller to hand
+* to the IdP as `state`.
+*/
+function issueOAuthState(cookies) {
+	const state = randomBytes(32).toString("base64url");
+	cookies.set(STATE_COOKIE_NAME, state, {
+		path: "/",
+		httpOnly: true,
+		sameSite: "lax",
+		secure: process.env.NODE_ENV === "production" && private_env.ALLOW_INSECURE_COOKIES !== "true",
+		maxAge: STATE_MAX_AGE_S
+	});
+	return state;
+}
+/**
+* Compare the callback's `state` against the cookie and clear the cookie either
+* way — a nonce is single-use, so a failed attempt must not leave a live one
+* behind for a retry.
+*/
+function consumeOAuthState(cookies, submitted) {
+	const expected = cookies.get(STATE_COOKIE_NAME);
+	cookies.delete(STATE_COOKIE_NAME, { path: "/" });
+	if (!expected || !submitted) return false;
+	const a = Buffer.from(expected);
+	const b = Buffer.from(submitted);
+	if (a.length !== b.length) return false;
+	return timingSafeEqual(a, b);
+}
+
+export { consumeOAuthState as c, issueOAuthState as i };
+//# sourceMappingURL=oauthState.server.js-DX7ZmU2E.js.map

package/build/server/chunks/chunks/oauthState.server.js-DX7ZmU2E.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthState.server.js-DX7ZmU2E.js","sources":["../../../../.svelte-kit/output/server/chunks/oauthState.server.js"],"sourcesContent":["import { t as private_env } from \"./shared-server.js\";\nimport { randomBytes, timingSafeEqual } from \"node:crypto\";\n//#region src/lib/server/auth/oauthState.server.ts\n/**\n* CSRF `state` for the OAuth round trip.\n*\n* `/auth/supabase/callback` is a GET that mints and sets a session cookie.\n* SvelteKit's built-in CSRF origin check covers form POSTs, not GETs, so\n* without a state nonce the callback accepts a `?code=` from anywhere. The\n* attack is login CSRF: the attacker starts their own OAuth flow, captures\n* their `code`, and induces the victim's browser to load the callback with it.\n* The victim is now silently signed into the attacker's account, and everything\n* they do there is visible to the attacker.\n*\n* The nonce lives in a short-lived cookie rather than server memory so it\n* survives a multi-instance deployment without a shared store — the browser\n* that started the flow is the only one that can finish it. `SameSite=Lax` is\n* required, not `Strict`: the IdP redirects back cross-site, and `Strict` would\n* withhold the cookie on exactly the request that needs it.\n*\n* `exchangeOAuthCode` takes only `code` — the adapter enforces neither `state`\n* nor PKCE — so this app-layer check is the only thing standing between the\n* callback and a replayed authorization code.\n*/\nvar STATE_COOKIE_NAME = \"oauth_state\";\nvar STATE_MAX_AGE_S = 600;\n/**\n* Mint a nonce, store it in the cookie, and return it for the caller to hand\n* to the IdP as `state`.\n*/\nfunction issueOAuthState(cookies) {\n\tconst state = randomBytes(32).toString(\"base64url\");\n\tcookies.set(STATE_COOKIE_NAME, state, {\n\t\tpath: \"/\",\n\t\thttpOnly: true,\n\t\tsameSite: \"lax\",\n\t\tsecure: process.env.NODE_ENV === \"production\" && private_env.ALLOW_INSECURE_COOKIES !== \"true\",\n\t\tmaxAge: STATE_MAX_AGE_S\n\t});\n\treturn state;\n}\n/**\n* Compare the callback's `state` against the cookie and clear the cookie either\n* way — a nonce is single-use, so a failed attempt must not leave a live one\n* behind for a retry.\n*/\nfunction consumeOAuthState(cookies, submitted) {\n\tconst expected = cookies.get(STATE_COOKIE_NAME);\n\tcookies.delete(STATE_COOKIE_NAME, { path: \"/\" });\n\tif (!expected || !submitted) return false;\n\tconst a = Buffer.from(expected);\n\tconst b = Buffer.from(submitted);\n\tif (a.length !== b.length) return false;\n\treturn timingSafeEqual(a, b);\n}\n//#endregion\nexport { issueOAuthState as n, consumeOAuthState as t };\n"],"names":[],"mappings":";;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,iBAAiB,GAAG,aAAa;AACrC,IAAI,eAAe,GAAG,GAAG;AACzB;AACA;AACA;AACA;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;AACpD,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE;AACvC,EAAE,IAAI,EAAE,GAAG;AACX,EAAE,QAAQ,EAAE,IAAI;AAChB,EAAE,QAAQ,EAAE,KAAK;AACjB,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,WAAW,CAAC,sBAAsB,KAAK,MAAM;AAChG,EAAE,MAAM,EAAE;AACV,EAAE,CAAC;AACH,CAAC,OAAO,KAAK;AACb;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE;AAC/C,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;AAChD,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACjD,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,OAAO,KAAK;AAC1C,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;AAChC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;AACjC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,OAAO,KAAK;AACxC,CAAC,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC;AAC7B;;;;"}