@selvajs/selva 4.14.1 → 4.15.0

package/build/server/chunks/entries/hooks.server.js-DkaJFT25.js

@@ -1,313 +0,0 @@
-import { b as private_env } from '../chunks/shared-server.js-BZy9KN6u.js';
-import { S as SYSTEM_CONTEXT } from '../chunks/src.js-B12bUNyu.js';
-import { p as providers, h as resolveRequestId, g as getLogger, r as renderThrown, i as getErrorReporter, R as REQUEST_ID_HEADER, j as getEventSink } from '../chunks/providers.server.js-n7DF9bkc.js';
-import { g as getRefreshToken, s as setSessionCookie, a as setRefreshCookie, c as clearRefreshCookie } from '../chunks/admin-auth.server.js-CL3zHgVM.js';
-import { f as findDeploymentDir, s as startUpdateOutcomeReconciler } from '../chunks/selfUpdate.server.js-l0l1xNus.js';
-import { g as getBootHealth } from '../chunks/bootHealth.server.js-CeRzqAl8.js';
-import { w as wireHeaderAuthBootstrap, b as bootstrapUserSession } from '../chunks/auth-bootstrap.server.js-bwuRda0V.js';
-import { redirect, isHttpError } from '@sveltejs/kit';
-import 'zod';
-import '../chunks/schema.js-BVfByvmD.js';
-import '../chunks/core-BQtRL5GE.js-B9MmO4om.js';
-import 'node:crypto';
-import 'node:url';
-import 'node:path';
-import 'node:fs';
-import 'node:fs/promises';
-import '@supabase/supabase-js';
-import 'node:dns/promises';
-import 'node:net';
-import '../chunks/update-outcome.js-D6m3udZN.js';
-
-//#region ../platform/src/userProfile/types.ts
-function emptyProfile(userId) {
-	return {
-		userId,
-		starredDefinitions: [],
-		recentRuns: []
-	};
-}
-//#endregion
-//#region ../server/src/http/security-headers.ts
-/**
-* Apply baseline browser-hardening headers to a response and return it for
-* chaining. Each is a cheap win that needs no UI verification:
-*
-*   - X-Content-Type-Options: nosniff — disables MIME sniffing.
-*   - Referrer-Policy: strict-origin-when-cross-origin — strips path and query
-*     from cross-origin Referer headers. Matches modern browser defaults, but
-*     pins the behavior in case a default drifts.
-*   - Permissions-Policy: opts out of browser APIs Selva-engine apps don't use,
-*     so XSS can't enable them.
-*   - HSTS when `opts.hsts`.
-*
-* **Intentionally NOT set here:**
-*   - Content-Security-Policy + frame-ancestors. Selva-engine apps are built
-*     for iframe embedding, so a strict CSP needs validating against real
-*     consumer sites before it can ship.
-*   - X-Frame-Options. Same iframe-embedding constraint.
-*   - Cache-Control. Asset-path layout is app policy; set it in the caller.
-*/
-function applySecurityHeaders(response, opts) {
-	response.headers.set("X-Content-Type-Options", "nosniff");
-	response.headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
-	response.headers.set("Permissions-Policy", "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()");
-	if (opts.hsts) response.headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
-	return response;
-}
-//#endregion
-//#region ../server/src/http/route-classifier.ts
-function createRouteClassifier(config) {
-	const publicPages = new Set(config.publicPages ?? []);
-	const publicPrefixes = config.publicPrefixes ?? [];
-	const publicApis = new Set(config.publicApis ?? []);
-	const selfGatingPrefix = config.selfGatingPrefix;
-	const staticPrefixes = config.staticPrefixes ?? [];
-	const staticPaths = new Set(config.staticPaths ?? []);
-	function isStaticAsset(pathname) {
-		if (staticPaths.has(pathname)) return true;
-		return staticPrefixes.some((p) => pathname.startsWith(p));
-	}
-	function isSelfGatingApiRoute(pathname) {
-		return selfGatingPrefix !== void 0 && pathname.startsWith(selfGatingPrefix);
-	}
-	function isPublicRoute(pathname) {
-		if (publicPages.has(pathname)) return true;
-		if (publicApis.has(pathname)) return true;
-		if (isSelfGatingApiRoute(pathname)) return true;
-		return publicPrefixes.some((p) => pathname.startsWith(p));
-	}
-	return {
-		isStaticAsset,
-		isSelfGatingApiRoute,
-		isPublicRoute
-	};
-}
-//#endregion
-//#region src/hooks.server.ts
-var headerAuthBootstrapWired = false;
-var bootHealthKicked = false;
-var proxyAuthLoginMissWarned = false;
-var firstRunResolved = false;
-async function isFirstRun() {
-	if (firstRunResolved) return false;
-	const usersPage = await providers.auth.listUsers({ limit: 1 });
-	if (usersPage === null) {
-		firstRunResolved = true;
-		return false;
-	}
-	if (usersPage.items.length === 0) return true;
-	firstRunResolved = true;
-	return false;
-}
-var ensuredUserIds = /* @__PURE__ */ new Set();
-async function ensureUserOnce(userId) {
-	if (ensuredUserIds.has(userId)) return;
-	await providers.data.ensureUser(SYSTEM_CONTEXT, userId);
-	ensuredUserIds.add(userId);
-}
-/**
-* Builds a per-request context from an authenticated user: resolves active-org
-* membership and its OrgPermissions.
-*
-* Active-org resolution: single tenancy picks the deployment's one org; multi
-* tenancy picks the first org the user belongs to (URL-prefix resolution via
-* `/o/{slug}/...` will replace this once routes are tenant-namespaced).
-*
-* Exported for tests: the fixture's `actAs()` mirrors this logic, so a direct
-* test pins the production function against drift.
-*/
-async function buildContext(user, sessionToken, platformPermissions, membership) {
-	let actingOrgId;
-	let orgPermissions = [];
-	if (membership) {
-		actingOrgId = membership.org.id;
-		orgPermissions = membership.member.permissions;
-	}
-	if (!actingOrgId && platformPermissions.includes("instance_admin")) {
-		const firstOrg = (await providers.data.orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items[0];
-		if (firstOrg) actingOrgId = firstOrg.id;
-	}
-	return {
-		userId: user.id,
-		actingOrgId,
-		platformPermissions,
-		orgPermissions,
-		adapterContext: sessionToken ? { sessionToken } : void 0
-	};
-}
-var PUBLIC_PAGE_ROUTES = /* @__PURE__ */ new Set([
-	"/",
-	"/login",
-	"/setup",
-	"/accept-invite"
-]);
-var { isStaticAsset, isSelfGatingApiRoute, isPublicRoute } = createRouteClassifier({
-	publicPages: PUBLIC_PAGE_ROUTES,
-	publicPrefixes: [
-		"/auth/",
-		"/logout",
-		"/docs/"
-	],
-	publicApis: ["/api/health", "/api/health/ready"],
-	selfGatingPrefix: "/api/files/",
-	staticPrefixes: ["/_app/", "/favicon/"],
-	staticPaths: ["/favicon.svg", "/robots.txt"]
-});
-var handle = async ({ event, resolve }) => {
-	event.locals.providers = providers;
-	const requestId = resolveRequestId(event.request.headers);
-	event.locals.requestId = requestId;
-	event.locals.log = getLogger().child({
-		requestId,
-		method: event.request.method,
-		route: event.url.pathname
-	});
-	if (!headerAuthBootstrapWired) {
-		wireHeaderAuthBootstrap();
-		headerAuthBootstrapWired = true;
-	}
-	if (!bootHealthKicked) {
-		bootHealthKicked = true;
-		getBootHealth();
-		const deploymentDir = findDeploymentDir(private_env);
-		if (deploymentDir) startUpdateOutcomeReconciler({
-			deploymentDir,
-			emit: (e) => getEventSink().emit(e),
-			report: (err) => getErrorReporter().capture(err, { tags: { origin: "selfUpdate" } })
-		});
-	}
-	const { pathname } = event.url;
-	if (isStaticAsset(pathname)) return applyResponseHeaders(await resolve(event), pathname, requestId);
-	if (pathname === "/api/health" || pathname === "/api/health/ready") return applyResponseHeaders(await resolve(event), pathname, requestId);
-	const publicRoute = isPublicRoute(pathname);
-	const isJsonApiRoute = pathname.startsWith("/api/");
-	if (!publicRoute) {
-		if (await isFirstRun()) {
-			if (isJsonApiRoute) return applyResponseHeaders(new Response(JSON.stringify({
-				message: "Setup required",
-				code: "SETUP_REQUIRED"
-			}), {
-				status: 503,
-				headers: { "Content-Type": "application/json" }
-			}), pathname, requestId);
-			redirect(303, "/setup");
-		}
-	}
-	if (!publicRoute) {
-		let token = event.cookies.get("admin_session") ?? "";
-		let user = await providers.auth.verifyToken(token);
-		if (!user) {
-			const refreshToken = getRefreshToken(event.cookies);
-			const oauth = providers.auth.oauth;
-			if (refreshToken && oauth) {
-				const refreshed = await oauth.refreshSession(refreshToken);
-				if (refreshed) {
-					setSessionCookie(event.cookies, refreshed.sessionToken);
-					setRefreshCookie(event.cookies, refreshed.refreshToken);
-					token = refreshed.sessionToken;
-					user = await providers.auth.verifyToken(token);
-				} else clearRefreshCookie(event.cookies);
-			}
-		}
-		if (!user && providers.auth.proxyAuth) {
-			user = await providers.auth.proxyAuth.identifyFromHeaders(event.request.headers);
-			if (user) await bootstrapUserSession(user);
-		}
-		if (!user) {
-			if (isJsonApiRoute) return applyResponseHeaders(new Response(JSON.stringify({
-				message: "Your session has expired. Sign in again to continue.",
-				code: "UNAUTHORIZED"
-			}), {
-				status: 401,
-				headers: { "Content-Type": "application/json" }
-			}), pathname, requestId);
-			redirect(303, `/login?redirectTo=${encodeURIComponent(pathname)}`);
-		}
-		const [, profile, platformPermissions, membership] = await Promise.all([
-			ensureUserOnce(user.id),
-			providers.data.userProfile.getProfile(SYSTEM_CONTEXT, user.id),
-			providers.data.permissions.getFor(SYSTEM_CONTEXT, user.id),
-			providers.data.orgs.findUserMembership(SYSTEM_CONTEXT, user.id)
-		]);
-		event.locals.user = user;
-		event.locals.profile = profile ?? emptyProfile(user.id);
-		event.locals.ctx = await buildContext(user, token, platformPermissions, membership);
-	} else {
-		const wantsSessionAttach = PUBLIC_PAGE_ROUTES.has(pathname) || isSelfGatingApiRoute(pathname);
-		const token = wantsSessionAttach ? event.cookies.get("admin_session") ?? "" : "";
-		let user = token ? await providers.auth.verifyToken(token) : null;
-		if (!user && wantsSessionAttach && providers.auth.proxyAuth) {
-			user = await providers.auth.proxyAuth.identifyFromHeaders(event.request.headers);
-			if (!user && pathname === "/login" && !proxyAuthLoginMissWarned) {
-				proxyAuthLoginMissWarned = true;
-				const proxyAuth = providers.auth.proxyAuth;
-				const noHeaders = proxyAuth.hasNoIdentityHeaders(event.request.headers);
-				const configured = proxyAuth.configuredHeaderNames.join(", ");
-				if (noHeaders) event.locals.log.warn("/login was hit and NONE of the configured identity headers arrived. The forward-auth proxy is not reaching this process, or is not forwarding the configured headers. See the @selvajs/header-auth-provider README \"Verification\" section.", {
-					component: "HeaderAuth",
-					configuredHeaders: configured
-				});
-				else event.locals.log.warn("/login was hit but the UPN header was missing or the user is not allowlisted. Some headers arrived but identification still failed — check that the UPN header is populated and that the user has been added to header-allowlist.json.", {
-					component: "HeaderAuth",
-					configuredHeaders: configured
-				});
-			}
-		}
-		if (user) {
-			const [, profile, platformPermissions, membership] = await Promise.all([
-				ensureUserOnce(user.id),
-				providers.data.userProfile.getProfile(SYSTEM_CONTEXT, user.id),
-				providers.data.permissions.getFor(SYSTEM_CONTEXT, user.id),
-				providers.data.orgs.findUserMembership(SYSTEM_CONTEXT, user.id)
-			]);
-			event.locals.user = user;
-			event.locals.profile = profile ?? emptyProfile(user.id);
-			event.locals.ctx = await buildContext(user, token, platformPermissions, membership);
-		}
-	}
-	return applyResponseHeaders(await resolve(event), pathname, requestId);
-};
-function applyResponseHeaders(response, pathname, requestId) {
-	applySecurityHeaders(response, { hsts: process.env.NODE_ENV === "production" });
-	response.headers.set(REQUEST_ID_HEADER, requestId);
-	if (pathname.startsWith("/_app/")) response.headers.set("Cache-Control", "public, max-age=31536000, immutable");
-	else if (pathname.startsWith("/favicon/") || pathname === "/favicon.svg" || pathname === "/robots.txt") response.headers.set("Cache-Control", "public, max-age=604800");
-	return response;
-}
-var handleError = ({ error, status, event }) => {
-	if (isHttpError(error)) {
-		const body = error.body;
-		return {
-			message: body.message,
-			code: body.code,
-			fields: body.fields
-		};
-	}
-	if (status === 404) return {
-		message: "Page not found.",
-		code: "NOT_FOUND"
-	};
-	(event.locals.log ?? getLogger().child({
-		method: event.request.method,
-		route: event.url.pathname
-	})).error("Unhandled error", {
-		component: "handleError",
-		status,
-		err: renderThrown(error),
-		cause: error instanceof Error && error.cause ? String(error.cause) : void 0
-	});
-	getErrorReporter().capture(error, {
-		method: event.request.method,
-		route: event.url.pathname,
-		userId: event.locals.ctx?.userId || void 0,
-		orgId: event.locals.ctx?.actingOrgId
-	});
-	return {
-		message: "An unexpected error occurred.",
-		code: "INTERNAL"
-	};
-};
-
-export { buildContext, handle, handleError, isPublicRoute, isSelfGatingApiRoute, isStaticAsset };
-//# sourceMappingURL=hooks.server.js-DkaJFT25.js.map

package/build/server/chunks/entries/hooks.server.js-DkaJFT25.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"hooks.server.js-DkaJFT25.js","sources":["../../../../.svelte-kit/output/server/entries/hooks.server.js"],"sourcesContent":["import { t as private_env } from \"../chunks/shared-server.js\";\nimport { t as SYSTEM_CONTEXT } from \"../chunks/src.js\";\nimport { D as resolveRequestId, E as renderThrown, T as REQUEST_ID_HEADER, f as getLogger, l as getErrorReporter, u as getEventSink, w as providers } from \"../chunks/providers.server.js\";\nimport { a as getRefreshToken, l as setRefreshCookie, r as clearRefreshCookie, u as setSessionCookie } from \"../chunks/admin-auth.server.js\";\nimport { n as startUpdateOutcomeReconciler, t as findDeploymentDir } from \"../chunks/selfUpdate.server.js\";\nimport { t as getBootHealth } from \"../chunks/bootHealth.server.js\";\nimport { n as wireHeaderAuthBootstrap, t as bootstrapUserSession } from \"../chunks/auth-bootstrap.server.js\";\nimport { isHttpError, redirect } from \"@sveltejs/kit\";\n//#region ../platform/src/userProfile/types.ts\nfunction emptyProfile(userId) {\n\treturn {\n\t\tuserId,\n\t\tstarredDefinitions: [],\n\t\trecentRuns: []\n\t};\n}\n//#endregion\n//#region ../server/src/http/security-headers.ts\n/**\n* Apply baseline browser-hardening headers to a response and return it for\n* chaining. Each is a cheap win that needs no UI verification:\n*\n*   - X-Content-Type-Options: nosniff — disables MIME sniffing.\n*   - Referrer-Policy: strict-origin-when-cross-origin — strips path and query\n*     from cross-origin Referer headers. Matches modern browser defaults, but\n*     pins the behavior in case a default drifts.\n*   - Permissions-Policy: opts out of browser APIs Selva-engine apps don't use,\n*     so XSS can't enable them.\n*   - HSTS when `opts.hsts`.\n*\n* **Intentionally NOT set here:**\n*   - Content-Security-Policy + frame-ancestors. Selva-engine apps are built\n*     for iframe embedding, so a strict CSP needs validating against real\n*     consumer sites before it can ship.\n*   - X-Frame-Options. Same iframe-embedding constraint.\n*   - Cache-Control. Asset-path layout is app policy; set it in the caller.\n*/\nfunction applySecurityHeaders(response, opts) {\n\tresponse.headers.set(\"X-Content-Type-Options\", \"nosniff\");\n\tresponse.headers.set(\"Referrer-Policy\", \"strict-origin-when-cross-origin\");\n\tresponse.headers.set(\"Permissions-Policy\", \"accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()\");\n\tif (opts.hsts) response.headers.set(\"Strict-Transport-Security\", \"max-age=31536000; includeSubDomains\");\n\treturn response;\n}\n//#endregion\n//#region ../server/src/http/route-classifier.ts\nfunction createRouteClassifier(config) {\n\tconst publicPages = new Set(config.publicPages ?? []);\n\tconst publicPrefixes = config.publicPrefixes ?? [];\n\tconst publicApis = new Set(config.publicApis ?? []);\n\tconst selfGatingPrefix = config.selfGatingPrefix;\n\tconst staticPrefixes = config.staticPrefixes ?? [];\n\tconst staticPaths = new Set(config.staticPaths ?? []);\n\tfunction isStaticAsset(pathname) {\n\t\tif (staticPaths.has(pathname)) return true;\n\t\treturn staticPrefixes.some((p) => pathname.startsWith(p));\n\t}\n\tfunction isSelfGatingApiRoute(pathname) {\n\t\treturn selfGatingPrefix !== void 0 && pathname.startsWith(selfGatingPrefix);\n\t}\n\tfunction isPublicRoute(pathname) {\n\t\tif (publicPages.has(pathname)) return true;\n\t\tif (publicApis.has(pathname)) return true;\n\t\tif (isSelfGatingApiRoute(pathname)) return true;\n\t\treturn publicPrefixes.some((p) => pathname.startsWith(p));\n\t}\n\treturn {\n\t\tisStaticAsset,\n\t\tisSelfGatingApiRoute,\n\t\tisPublicRoute\n\t};\n}\n//#endregion\n//#region src/hooks.server.ts\nvar headerAuthBootstrapWired = false;\nvar bootHealthKicked = false;\nvar proxyAuthLoginMissWarned = false;\nvar firstRunResolved = false;\nasync function isFirstRun() {\n\tif (firstRunResolved) return false;\n\tconst usersPage = await providers.auth.listUsers({ limit: 1 });\n\tif (usersPage === null) {\n\t\tfirstRunResolved = true;\n\t\treturn false;\n\t}\n\tif (usersPage.items.length === 0) return true;\n\tfirstRunResolved = true;\n\treturn false;\n}\nvar ensuredUserIds = /* @__PURE__ */ new Set();\nasync function ensureUserOnce(userId) {\n\tif (ensuredUserIds.has(userId)) return;\n\tawait providers.data.ensureUser(SYSTEM_CONTEXT, userId);\n\tensuredUserIds.add(userId);\n}\n/**\n* Builds a per-request context from an authenticated user: resolves active-org\n* membership and its OrgPermissions.\n*\n* Active-org resolution: single tenancy picks the deployment's one org; multi\n* tenancy picks the first org the user belongs to (URL-prefix resolution via\n* `/o/{slug}/...` will replace this once routes are tenant-namespaced).\n*\n* Exported for tests: the fixture's `actAs()` mirrors this logic, so a direct\n* test pins the production function against drift.\n*/\nasync function buildContext(user, sessionToken, platformPermissions, membership) {\n\tlet actingOrgId;\n\tlet orgPermissions = [];\n\tif (membership) {\n\t\tactingOrgId = membership.org.id;\n\t\torgPermissions = membership.member.permissions;\n\t}\n\tif (!actingOrgId && platformPermissions.includes(\"instance_admin\")) {\n\t\tconst firstOrg = (await providers.data.orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items[0];\n\t\tif (firstOrg) actingOrgId = firstOrg.id;\n\t}\n\treturn {\n\t\tuserId: user.id,\n\t\tactingOrgId,\n\t\tplatformPermissions,\n\t\torgPermissions,\n\t\tadapterContext: sessionToken ? { sessionToken } : void 0\n\t};\n}\nvar PUBLIC_PAGE_ROUTES = /* @__PURE__ */ new Set([\n\t\"/\",\n\t\"/login\",\n\t\"/setup\",\n\t\"/accept-invite\"\n]);\nvar { isStaticAsset, isSelfGatingApiRoute, isPublicRoute } = createRouteClassifier({\n\tpublicPages: PUBLIC_PAGE_ROUTES,\n\tpublicPrefixes: [\n\t\t\"/auth/\",\n\t\t\"/logout\",\n\t\t\"/docs/\"\n\t],\n\tpublicApis: [\"/api/health\", \"/api/health/ready\"],\n\tselfGatingPrefix: \"/api/files/\",\n\tstaticPrefixes: [\"/_app/\", \"/favicon/\"],\n\tstaticPaths: [\"/favicon.svg\", \"/robots.txt\"]\n});\nvar handle = async ({ event, resolve }) => {\n\tevent.locals.providers = providers;\n\tconst requestId = resolveRequestId(event.request.headers);\n\tevent.locals.requestId = requestId;\n\tevent.locals.log = getLogger().child({\n\t\trequestId,\n\t\tmethod: event.request.method,\n\t\troute: event.url.pathname\n\t});\n\tif (!headerAuthBootstrapWired) {\n\t\twireHeaderAuthBootstrap();\n\t\theaderAuthBootstrapWired = true;\n\t}\n\tif (!bootHealthKicked) {\n\t\tbootHealthKicked = true;\n\t\tgetBootHealth();\n\t\tconst deploymentDir = findDeploymentDir(private_env);\n\t\tif (deploymentDir) startUpdateOutcomeReconciler({\n\t\t\tdeploymentDir,\n\t\t\temit: (e) => getEventSink().emit(e),\n\t\t\treport: (err) => getErrorReporter().capture(err, { tags: { origin: \"selfUpdate\" } })\n\t\t});\n\t}\n\tconst { pathname } = event.url;\n\tif (isStaticAsset(pathname)) return applyResponseHeaders(await resolve(event), pathname, requestId);\n\tif (pathname === \"/api/health\" || pathname === \"/api/health/ready\") return applyResponseHeaders(await resolve(event), pathname, requestId);\n\tconst publicRoute = isPublicRoute(pathname);\n\tconst isJsonApiRoute = pathname.startsWith(\"/api/\");\n\tif (!publicRoute) {\n\t\tif (await isFirstRun()) {\n\t\t\tif (isJsonApiRoute) return applyResponseHeaders(new Response(JSON.stringify({\n\t\t\t\tmessage: \"Setup required\",\n\t\t\t\tcode: \"SETUP_REQUIRED\"\n\t\t\t}), {\n\t\t\t\tstatus: 503,\n\t\t\t\theaders: { \"Content-Type\": \"application/json\" }\n\t\t\t}), pathname, requestId);\n\t\t\tredirect(303, \"/setup\");\n\t\t}\n\t}\n\tif (!publicRoute) {\n\t\tlet token = event.cookies.get(\"admin_session\") ?? \"\";\n\t\tlet user = await providers.auth.verifyToken(token);\n\t\tif (!user) {\n\t\t\tconst refreshToken = getRefreshToken(event.cookies);\n\t\t\tconst oauth = providers.auth.oauth;\n\t\t\tif (refreshToken && oauth) {\n\t\t\t\tconst refreshed = await oauth.refreshSession(refreshToken);\n\t\t\t\tif (refreshed) {\n\t\t\t\t\tsetSessionCookie(event.cookies, refreshed.sessionToken);\n\t\t\t\t\tsetRefreshCookie(event.cookies, refreshed.refreshToken);\n\t\t\t\t\ttoken = refreshed.sessionToken;\n\t\t\t\t\tuser = await providers.auth.verifyToken(token);\n\t\t\t\t} else clearRefreshCookie(event.cookies);\n\t\t\t}\n\t\t}\n\t\tif (!user && providers.auth.proxyAuth) {\n\t\t\tuser = await providers.auth.proxyAuth.identifyFromHeaders(event.request.headers);\n\t\t\tif (user) await bootstrapUserSession(user);\n\t\t}\n\t\tif (!user) {\n\t\t\tif (isJsonApiRoute) return applyResponseHeaders(new Response(JSON.stringify({\n\t\t\t\tmessage: \"Your session has expired. Sign in again to continue.\",\n\t\t\t\tcode: \"UNAUTHORIZED\"\n\t\t\t}), {\n\t\t\t\tstatus: 401,\n\t\t\t\theaders: { \"Content-Type\": \"application/json\" }\n\t\t\t}), pathname, requestId);\n\t\t\tredirect(303, `/login?redirectTo=${encodeURIComponent(pathname)}`);\n\t\t}\n\t\tconst [, profile, platformPermissions, membership] = await Promise.all([\n\t\t\tensureUserOnce(user.id),\n\t\t\tproviders.data.userProfile.getProfile(SYSTEM_CONTEXT, user.id),\n\t\t\tproviders.data.permissions.getFor(SYSTEM_CONTEXT, user.id),\n\t\t\tproviders.data.orgs.findUserMembership(SYSTEM_CONTEXT, user.id)\n\t\t]);\n\t\tevent.locals.user = user;\n\t\tevent.locals.profile = profile ?? emptyProfile(user.id);\n\t\tevent.locals.ctx = await buildContext(user, token, platformPermissions, membership);\n\t} else {\n\t\tconst wantsSessionAttach = PUBLIC_PAGE_ROUTES.has(pathname) || isSelfGatingApiRoute(pathname);\n\t\tconst token = wantsSessionAttach ? event.cookies.get(\"admin_session\") ?? \"\" : \"\";\n\t\tlet user = token ? await providers.auth.verifyToken(token) : null;\n\t\tif (!user && wantsSessionAttach && providers.auth.proxyAuth) {\n\t\t\tuser = await providers.auth.proxyAuth.identifyFromHeaders(event.request.headers);\n\t\t\tif (!user && pathname === \"/login\" && !proxyAuthLoginMissWarned) {\n\t\t\t\tproxyAuthLoginMissWarned = true;\n\t\t\t\tconst proxyAuth = providers.auth.proxyAuth;\n\t\t\t\tconst noHeaders = proxyAuth.hasNoIdentityHeaders(event.request.headers);\n\t\t\t\tconst configured = proxyAuth.configuredHeaderNames.join(\", \");\n\t\t\t\tif (noHeaders) event.locals.log.warn(\"/login was hit and NONE of the configured identity headers arrived. The forward-auth proxy is not reaching this process, or is not forwarding the configured headers. See the @selvajs/header-auth-provider README \\\"Verification\\\" section.\", {\n\t\t\t\t\tcomponent: \"HeaderAuth\",\n\t\t\t\t\tconfiguredHeaders: configured\n\t\t\t\t});\n\t\t\t\telse event.locals.log.warn(\"/login was hit but the UPN header was missing or the user is not allowlisted. Some headers arrived but identification still failed — check that the UPN header is populated and that the user has been added to header-allowlist.json.\", {\n\t\t\t\t\tcomponent: \"HeaderAuth\",\n\t\t\t\t\tconfiguredHeaders: configured\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\t\tif (user) {\n\t\t\tconst [, profile, platformPermissions, membership] = await Promise.all([\n\t\t\t\tensureUserOnce(user.id),\n\t\t\t\tproviders.data.userProfile.getProfile(SYSTEM_CONTEXT, user.id),\n\t\t\t\tproviders.data.permissions.getFor(SYSTEM_CONTEXT, user.id),\n\t\t\t\tproviders.data.orgs.findUserMembership(SYSTEM_CONTEXT, user.id)\n\t\t\t]);\n\t\t\tevent.locals.user = user;\n\t\t\tevent.locals.profile = profile ?? emptyProfile(user.id);\n\t\t\tevent.locals.ctx = await buildContext(user, token, platformPermissions, membership);\n\t\t}\n\t}\n\treturn applyResponseHeaders(await resolve(event), pathname, requestId);\n};\nfunction applyResponseHeaders(response, pathname, requestId) {\n\tapplySecurityHeaders(response, { hsts: process.env.NODE_ENV === \"production\" });\n\tresponse.headers.set(REQUEST_ID_HEADER, requestId);\n\tif (pathname.startsWith(\"/_app/\")) response.headers.set(\"Cache-Control\", \"public, max-age=31536000, immutable\");\n\telse if (pathname.startsWith(\"/favicon/\") || pathname === \"/favicon.svg\" || pathname === \"/robots.txt\") response.headers.set(\"Cache-Control\", \"public, max-age=604800\");\n\treturn response;\n}\nvar handleError = ({ error, status, event }) => {\n\tif (isHttpError(error)) {\n\t\tconst body = error.body;\n\t\treturn {\n\t\t\tmessage: body.message,\n\t\t\tcode: body.code,\n\t\t\tfields: body.fields\n\t\t};\n\t}\n\tif (status === 404) return {\n\t\tmessage: \"Page not found.\",\n\t\tcode: \"NOT_FOUND\"\n\t};\n\t(event.locals.log ?? getLogger().child({\n\t\tmethod: event.request.method,\n\t\troute: event.url.pathname\n\t})).error(\"Unhandled error\", {\n\t\tcomponent: \"handleError\",\n\t\tstatus,\n\t\terr: renderThrown(error),\n\t\tcause: error instanceof Error && error.cause ? String(error.cause) : void 0\n\t});\n\tgetErrorReporter().capture(error, {\n\t\tmethod: event.request.method,\n\t\troute: event.url.pathname,\n\t\tuserId: event.locals.ctx?.userId || void 0,\n\t\torgId: event.locals.ctx?.actingOrgId\n\t});\n\treturn {\n\t\tmessage: \"An unexpected error occurred.\",\n\t\tcode: \"INTERNAL\"\n\t};\n};\n//#endregion\nexport { buildContext, handle, handleError, isPublicRoute, isSelfGatingApiRoute, isStaticAsset };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAQA;AACA,SAAS,YAAY,CAAC,MAAM,EAAE;AAC9B,CAAC,OAAO;AACR,EAAE,MAAM;AACR,EAAE,kBAAkB,EAAE,EAAE;AACxB,EAAE,UAAU,EAAE;AACd,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,oBAAoB,CAAC,QAAQ,EAAE,IAAI,EAAE;AAC9C,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC;AAC1D,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,iCAAiC,CAAC;AAC3E,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,+GAA+G,CAAC;AAC5J,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,qCAAqC,CAAC;AACxG,CAAC,OAAO,QAAQ;AAChB;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,MAAM,EAAE;AACvC,CAAC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;AACtD,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,EAAE;AACnD,CAAC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;AACpD,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB;AACjD,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,EAAE;AACnD,CAAC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;AACtD,CAAC,SAAS,aAAa,CAAC,QAAQ,EAAE;AAClC,EAAE,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI;AAC5C,EAAE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AACD,CAAC,SAAS,oBAAoB,CAAC,QAAQ,EAAE;AACzC,EAAE,OAAO,gBAAgB,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,gBAAgB,CAAC;AAC7E,CAAC;AACD,CAAC,SAAS,aAAa,CAAC,QAAQ,EAAE;AAClC,EAAE,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI;AAC5C,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI;AAC3C,EAAE,IAAI,oBAAoB,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI;AACjD,EAAE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AACD,CAAC,OAAO;AACR,EAAE,aAAa;AACf,EAAE,oBAAoB;AACtB,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA,IAAI,wBAAwB,GAAG,KAAK;AACpC,IAAI,gBAAgB,GAAG,KAAK;AAC5B,IAAI,wBAAwB,GAAG,KAAK;AACpC,IAAI,gBAAgB,GAAG,KAAK;AAC5B,eAAe,UAAU,GAAG;AAC5B,CAAC,IAAI,gBAAgB,EAAE,OAAO,KAAK;AACnC,CAAC,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAC/D,CAAC,IAAI,SAAS,KAAK,IAAI,EAAE;AACzB,EAAE,gBAAgB,GAAG,IAAI;AACzB,EAAE,OAAO,KAAK;AACd,CAAC;AACD,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,IAAI;AAC9C,CAAC,gBAAgB,GAAG,IAAI;AACxB,CAAC,OAAO,KAAK;AACb;AACA,IAAI,cAAc,mBAAmB,IAAI,GAAG,EAAE;AAC9C,eAAe,cAAc,CAAC,MAAM,EAAE;AACtC,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;AACjC,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC;AACxD,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;AAC3B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE,mBAAmB,EAAE,UAAU,EAAE;AACjF,CAAC,IAAI,WAAW;AAChB,CAAC,IAAI,cAAc,GAAG,EAAE;AACxB,CAAC,IAAI,UAAU,EAAE;AACjB,EAAE,WAAW,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE;AACjC,EAAE,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW;AAChD,CAAC;AACD,CAAC,IAAI,CAAC,WAAW,IAAI,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE;AACrE,EAAE,MAAM,QAAQ,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AAC9F,EAAE,IAAI,QAAQ,EAAE,WAAW,GAAG,QAAQ,CAAC,EAAE;AACzC,CAAC;AACD,CAAC,OAAO;AACR,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;AACjB,EAAE,WAAW;AACb,EAAE,mBAAmB;AACrB,EAAE,cAAc;AAChB,EAAE,cAAc,EAAE,YAAY,GAAG,EAAE,YAAY,EAAE,GAAG;AACpD,EAAE;AACF;AACA,IAAI,kBAAkB,mBAAmB,IAAI,GAAG,CAAC;AACjD,CAAC,GAAG;AACJ,CAAC,QAAQ;AACT,CAAC,QAAQ;AACT,CAAC;AACD,CAAC,CAAC;AACC,IAAC,EAAE,aAAa,EAAE,oBAAoB,EAAE,aAAa,EAAE,GAAG,qBAAqB,CAAC;AACnF,CAAC,WAAW,EAAE,kBAAkB;AAChC,CAAC,cAAc,EAAE;AACjB,EAAE,QAAQ;AACV,EAAE,SAAS;AACX,EAAE;AACF,EAAE;AACF,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE,mBAAmB,CAAC;AACjD,CAAC,gBAAgB,EAAE,aAAa;AAChC,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC;AACxC,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,aAAa;AAC5C,CAAC;AACE,IAAC,MAAM,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;AAC3C,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,SAAS;AACnC,CAAC,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;AAC1D,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,SAAS;AACnC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,GAAG,SAAS,EAAE,CAAC,KAAK,CAAC;AACtC,EAAE,SAAS;AACX,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;AAC9B,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;AACnB,EAAE,CAAC;AACH,CAAC,IAAI,CAAC,wBAAwB,EAAE;AAChC,EAAE,uBAAuB,EAAE;AAC3B,EAAE,wBAAwB,GAAG,IAAI;AACjC,CAAC;AACD,CAAC,IAAI,CAAC,gBAAgB,EAAE;AACxB,EAAE,gBAAgB,GAAG,IAAI;AACzB,EAAE,aAAa,EAAE;AACjB,EAAE,MAAM,aAAa,GAAG,iBAAiB,CAAC,WAAW,CAAC;AACtD,EAAE,IAAI,aAAa,EAAE,4BAA4B,CAAC;AAClD,GAAG,aAAa;AAChB,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;AACtC,GAAG,MAAM,EAAE,CAAC,GAAG,KAAK,gBAAgB,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;AACtF,GAAG,CAAC;AACJ,CAAC;AACD,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,GAAG;AAC/B,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,OAAO,oBAAoB,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC;AACpG,CAAC,IAAI,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK,mBAAmB,EAAE,OAAO,oBAAoB,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC;AAC3I,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC,QAAQ,CAAC;AAC5C,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;AACpD,CAAC,IAAI,CAAC,WAAW,EAAE;AACnB,EAAE,IAAI,MAAM,UAAU,EAAE,EAAE;AAC1B,GAAG,IAAI,cAAc,EAAE,OAAO,oBAAoB,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;AAC/E,IAAI,OAAO,EAAE,gBAAgB;AAC7B,IAAI,IAAI,EAAE;AACV,IAAI,CAAC,EAAE;AACP,IAAI,MAAM,EAAE,GAAG;AACf,IAAI,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AACjD,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC;AAC3B,GAAG,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;AAC1B,EAAE;AACF,CAAC;AACD,CAAC,IAAI,CAAC,WAAW,EAAE;AACnB,EAAE,IAAI,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE;AACtD,EAAE,IAAI,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;AACpD,EAAE,IAAI,CAAC,IAAI,EAAE;AACb,GAAG,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC;AACtD,GAAG,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK;AACrC,GAAG,IAAI,YAAY,IAAI,KAAK,EAAE;AAC9B,IAAI,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,YAAY,CAAC;AAC9D,IAAI,IAAI,SAAS,EAAE;AACnB,KAAK,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,CAAC;AAC5D,KAAK,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,CAAC;AAC5D,KAAK,KAAK,GAAG,SAAS,CAAC,YAAY;AACnC,KAAK,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;AACnD,IAAI,CAAC,MAAM,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC;AAC5C,GAAG;AACH,EAAE;AACF,EAAE,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE;AACzC,GAAG,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;AACnF,GAAG,IAAI,IAAI,EAAE,MAAM,oBAAoB,CAAC,IAAI,CAAC;AAC7C,EAAE;AACF,EAAE,IAAI,CAAC,IAAI,EAAE;AACb,GAAG,IAAI,cAAc,EAAE,OAAO,oBAAoB,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;AAC/E,IAAI,OAAO,EAAE,sDAAsD;AACnE,IAAI,IAAI,EAAE;AACV,IAAI,CAAC,EAAE;AACP,IAAI,MAAM,EAAE,GAAG;AACf,IAAI,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AACjD,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC;AAC3B,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACrE,EAAE;AACF,EAAE,MAAM,GAAG,OAAO,EAAE,mBAAmB,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AACzE,GAAG,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;AAC1B,GAAG,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AACjE,GAAG,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAC7D,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE;AACjE,GAAG,CAAC;AACJ,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI;AAC1B,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;AACzD,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,mBAAmB,EAAE,UAAU,CAAC;AACrF,CAAC,CAAC,MAAM;AACR,EAAE,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,oBAAoB,CAAC,QAAQ,CAAC;AAC/F,EAAE,MAAM,KAAK,GAAG,kBAAkB,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,EAAE;AAClF,EAAE,IAAI,IAAI,GAAG,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,IAAI;AACnE,EAAE,IAAI,CAAC,IAAI,IAAI,kBAAkB,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE;AAC/D,GAAG,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;AACnF,GAAG,IAAI,CAAC,IAAI,IAAI,QAAQ,KAAK,QAAQ,IAAI,CAAC,wBAAwB,EAAE;AACpE,IAAI,wBAAwB,GAAG,IAAI;AACnC,IAAI,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS;AAC9C,IAAI,MAAM,SAAS,GAAG,SAAS,CAAC,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;AAC3E,IAAI,MAAM,UAAU,GAAG,SAAS,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;AACjE,IAAI,IAAI,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,8OAA8O,EAAE;AACzR,KAAK,SAAS,EAAE,YAAY;AAC5B,KAAK,iBAAiB,EAAE;AACxB,KAAK,CAAC;AACN,SAAS,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,wOAAwO,EAAE;AACzQ,KAAK,SAAS,EAAE,YAAY;AAC5B,KAAK,iBAAiB,EAAE;AACxB,KAAK,CAAC;AACN,GAAG;AACH,EAAE;AACF,EAAE,IAAI,IAAI,EAAE;AACZ,GAAG,MAAM,GAAG,OAAO,EAAE,mBAAmB,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AAC1E,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3B,IAAI,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAClE,IAAI,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAC9D,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE;AAClE,IAAI,CAAC;AACL,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI;AAC3B,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;AAC1D,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,mBAAmB,EAAE,UAAU,CAAC;AACtF,EAAE;AACF,CAAC;AACD,CAAC,OAAO,oBAAoB,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC;AACvE;AACA,SAAS,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE;AAC7D,CAAC,oBAAoB,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;AAChF,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,SAAS,CAAC;AACnD,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,qCAAqC,CAAC;AAChH,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,QAAQ,KAAK,cAAc,IAAI,QAAQ,KAAK,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,wBAAwB,CAAC;AACxK,CAAC,OAAO,QAAQ;AAChB;AACG,IAAC,WAAW,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK;AAChD,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE;AACzB,EAAE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI;AACzB,EAAE,OAAO;AACT,GAAG,OAAO,EAAE,IAAI,CAAC,OAAO;AACxB,GAAG,IAAI,EAAE,IAAI,CAAC,IAAI;AAClB,GAAG,MAAM,EAAE,IAAI,CAAC;AAChB,GAAG;AACH,CAAC;AACD,CAAC,IAAI,MAAM,KAAK,GAAG,EAAE,OAAO;AAC5B,EAAE,OAAO,EAAE,iBAAiB;AAC5B,EAAE,IAAI,EAAE;AACR,EAAE;AACF,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,SAAS,EAAE,CAAC,KAAK,CAAC;AACxC,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;AAC9B,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;AACnB,EAAE,CAAC,EAAE,KAAK,CAAC,iBAAiB,EAAE;AAC9B,EAAE,SAAS,EAAE,aAAa;AAC1B,EAAE,MAAM;AACR,EAAE,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC;AAC1B,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG;AACvE,EAAE,CAAC;AACH,CAAC,gBAAgB,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE;AACnC,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;AAC9B,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ;AAC3B,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,IAAI,MAAM;AAC5C,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE;AAC3B,EAAE,CAAC;AACH,CAAC,OAAO;AACR,EAAE,OAAO,EAAE,+BAA+B;AAC1C,EAAE,IAAI,EAAE;AACR,EAAE;AACF;;;;"}

package/build/server/chunks/entries/pages/_error.svelte.js-B0k_AdL1.js

@@ -1,36 +0,0 @@
-import 'clsx';
-import { p as page } from '../../chunks/state.js-DE7Wux-S.js';
-import { E as ErrorScreen } from '../../chunks/ErrorScreen.js-DhXSfajf.js';
-import '../../chunks/server.js-fxznQVe4.js';
-import '../../chunks/uneval.js-sOjdN_Ot.js';
-import '../../chunks/client.js-B5zjaxEd.js';
-import '../../chunks/index-server.js-gS5cdWCH.js';
-import '../../chunks/shared.js-JbueMana.js';
-import '@sveltejs/kit/internal';
-import '../../chunks/exports.js-CPkIuisC.js';
-import '../../chunks/routing.js-C2Q7p_y3.js';
-import '../../chunks/internal2.js-qTBwxhwo.js';
-import '../../chunks/legacy-client.js-B6XuTI3b.js';
-import '../../chunks/events.js-DCr2n6fH.js';
-import '@sveltejs/kit/internal/server';
-import '../../chunks/utils2.js-RqmNbcNh.js';
-import 'tailwind-merge';
-import '../../chunks/button.js-DbB0dwmm.js';
-import 'tailwind-variants';
-import '../../chunks/circle-alert.js-DflREk0J.js';
-import '../../chunks/card-content.js-DO1tWfLJ.js';
-import '../../chunks/card-title.js-D5QL4vvE.js';
-
-//#region src/routes/+error.svelte
-function _error($$renderer, $$props) {
-	$$renderer.component(($$renderer) => {
-		ErrorScreen($$renderer, {
-			status: page.status,
-			message: page.error?.message,
-			details: page.error && typeof page.error === "object" && "details" in page.error ? page.error.details : void 0
-		});
-	});
-}
-
-export { _error as default };
-//# sourceMappingURL=_error.svelte.js-B0k_AdL1.js.map

package/build/server/chunks/entries/pages/_error.svelte.js-B0k_AdL1.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"_error.svelte.js-B0k_AdL1.js","sources":["../../../../../.svelte-kit/output/server/entries/pages/_error.svelte.js"],"sourcesContent":["import \"../../chunks/server.js\";\nimport { t as page } from \"../../chunks/state.js\";\nimport { t as ErrorScreen } from \"../../chunks/ErrorScreen.js\";\n//#region src/routes/+error.svelte\nfunction _error($$renderer, $$props) {\n\t$$renderer.component(($$renderer) => {\n\t\tErrorScreen($$renderer, {\n\t\t\tstatus: page.status,\n\t\t\tmessage: page.error?.message,\n\t\t\tdetails: page.error && typeof page.error === \"object\" && \"details\" in page.error ? page.error.details : void 0\n\t\t});\n\t});\n}\n//#endregion\nexport { _error as default };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAGA;AACA,SAAS,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE;AACrC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,UAAU,KAAK;AACtC,EAAE,WAAW,CAAC,UAAU,EAAE;AAC1B,GAAG,MAAM,EAAE,IAAI,CAAC,MAAM;AACtB,GAAG,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO;AAC/B,GAAG,OAAO,EAAE,IAAI,CAAC,KAAK,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,SAAS,IAAI,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG;AAC3G,GAAG,CAAC;AACJ,CAAC,CAAC,CAAC;AACH;;;;"}

package/build/server/chunks/entries/pages/_layout.server.ts.js-DJMEsu4b.js

@@ -1,34 +0,0 @@
-import { k as flag, a as getAuthProvider, l as getBranding } from '../../chunks/providers.server.js-n7DF9bkc.js';
-
-//#region src/routes/+layout.server.ts
-var load = async ({ locals }) => {
-	return {
-		branding: getBranding(),
-		hasProxyAuth: Boolean(getAuthProvider().proxyAuth),
-		user: locals.user ? {
-			id: locals.user.id,
-			email: locals.user.email,
-			platformPermissions: locals.ctx?.platformPermissions ?? []
-		} : null,
-		profile: locals.profile ? {
-			userId: locals.profile.userId,
-			displayName: locals.profile.displayName,
-			starredDefinitions: locals.profile.starredDefinitions,
-			recentRuns: locals.profile.recentRuns
-		} : null,
-		ctx: locals.ctx ? {
-			orgId: locals.ctx.actingOrgId,
-			platformPermissions: locals.ctx.platformPermissions,
-			orgPermissions: locals.ctx.orgPermissions
-		} : null,
-		flags: { enableSharing: flag("ENABLE_SHARING") }
-	};
-};
-
-var _layout_server_ts = /*#__PURE__*/Object.freeze({
-	__proto__: null,
-	load: load
-});
-
-export { _layout_server_ts as _ };
-//# sourceMappingURL=_layout.server.ts.js-DJMEsu4b.js.map

package/build/server/chunks/entries/pages/_layout.server.ts.js-DJMEsu4b.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"_layout.server.ts.js-DJMEsu4b.js","sources":["../../../../../.svelte-kit/output/server/entries/pages/_layout.server.ts.js"],"sourcesContent":["import { i as getBranding, r as getAuthProvider, t as flag } from \"../../chunks/providers.server.js\";\n//#region src/routes/+layout.server.ts\nvar load = async ({ locals }) => {\n\treturn {\n\t\tbranding: getBranding(),\n\t\thasProxyAuth: Boolean(getAuthProvider().proxyAuth),\n\t\tuser: locals.user ? {\n\t\t\tid: locals.user.id,\n\t\t\temail: locals.user.email,\n\t\t\tplatformPermissions: locals.ctx?.platformPermissions ?? []\n\t\t} : null,\n\t\tprofile: locals.profile ? {\n\t\t\tuserId: locals.profile.userId,\n\t\t\tdisplayName: locals.profile.displayName,\n\t\t\tstarredDefinitions: locals.profile.starredDefinitions,\n\t\t\trecentRuns: locals.profile.recentRuns\n\t\t} : null,\n\t\tctx: locals.ctx ? {\n\t\t\torgId: locals.ctx.actingOrgId,\n\t\t\tplatformPermissions: locals.ctx.platformPermissions,\n\t\t\torgPermissions: locals.ctx.orgPermissions\n\t\t} : null,\n\t\tflags: { enableSharing: flag(\"ENABLE_SHARING\") }\n\t};\n};\n//#endregion\nexport { load };\n"],"names":[],"mappings":";;AACA;AACA,IAAI,IAAI,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK;AACjC,CAAC,OAAO;AACR,EAAE,QAAQ,EAAE,WAAW,EAAE;AACzB,EAAE,YAAY,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,SAAS,CAAC;AACpD,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,GAAG;AACtB,GAAG,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;AACrB,GAAG,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;AAC3B,GAAG,mBAAmB,EAAE,MAAM,CAAC,GAAG,EAAE,mBAAmB,IAAI;AAC3D,GAAG,GAAG,IAAI;AACV,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,GAAG;AAC5B,GAAG,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;AAChC,GAAG,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;AAC1C,GAAG,kBAAkB,EAAE,MAAM,CAAC,OAAO,CAAC,kBAAkB;AACxD,GAAG,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC;AAC9B,GAAG,GAAG,IAAI;AACV,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,GAAG;AACpB,GAAG,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW;AAChC,GAAG,mBAAmB,EAAE,MAAM,CAAC,GAAG,CAAC,mBAAmB;AACtD,GAAG,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC;AAC9B,GAAG,GAAG,IAAI;AACV,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC;AAChD,EAAE;AACF,CAAC;;;;;;;;;"}

package/build/server/chunks/entries/pages/_page.server.ts.js-BStGbWwT.js

@@ -1,52 +0,0 @@
-import { r as renderThrown } from '../../chunks/providers.server.js-n7DF9bkc.js';
-import { l as listVisibleDefinitions } from '../../chunks/visibility.server.js-B-Sv27CW.js';
-
-//#region src/routes/+page.server.ts
-/** Dashboard rows, newest-first, capped so the page stays one screen. */
-var STARRED_LIMIT = 6;
-var RECENT_LIMIT = 5;
-/**
-* Anonymous visitors get the branded splash and no query at all — the landing
-* page is public, so this load must stay cheap and side-effect free for them.
-*/
-var load = async ({ locals }) => {
-	if (!locals.user || !locals.profile) return { dashboard: null };
-	const profile = locals.profile;
-	try {
-		const { items, projects } = await listVisibleDefinitions(locals.ctx, {
-			limit: 200,
-			statuses: ["published"]
-		});
-		const starredIds = new Set(profile.starredDefinitions);
-		const byGuid = new Map(items.map((r) => [r.guid, r]));
-		const seen = /* @__PURE__ */ new Set();
-		const recentRuns = profile.recentRuns.filter((run) => {
-			if (!byGuid.has(run.definitionId) || seen.has(run.definitionId)) return false;
-			seen.add(run.definitionId);
-			return true;
-		}).slice(0, RECENT_LIMIT);
-		return { dashboard: {
-			starred: items.filter((r) => starredIds.has(r.guid)).slice(0, STARRED_LIMIT),
-			recentRuns,
-			projects: Object.fromEntries(projects.map((p) => [p.id, {
-				id: p.id,
-				name: p.name
-			}])),
-			visibleCount: items.length
-		} };
-	} catch (err) {
-		locals.log.error("Failed to load dashboard", {
-			component: "Landing",
-			err: renderThrown(err)
-		});
-		return { dashboard: null };
-	}
-};
-
-var _page_server_ts = /*#__PURE__*/Object.freeze({
-	__proto__: null,
-	load: load
-});
-
-export { _page_server_ts as _ };
-//# sourceMappingURL=_page.server.ts.js-BStGbWwT.js.map

package/build/server/chunks/entries/pages/_page.server.ts.js-BStGbWwT.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"_page.server.ts.js-BStGbWwT.js","sources":["../../../../../.svelte-kit/output/server/entries/pages/_page.server.ts.js"],"sourcesContent":["import { E as renderThrown } from \"../../chunks/providers.server.js\";\nimport { n as listVisibleDefinitions } from \"../../chunks/visibility.server.js\";\n//#region src/routes/+page.server.ts\n/** Dashboard rows, newest-first, capped so the page stays one screen. */\nvar STARRED_LIMIT = 6;\nvar RECENT_LIMIT = 5;\n/**\n* Anonymous visitors get the branded splash and no query at all — the landing\n* page is public, so this load must stay cheap and side-effect free for them.\n*/\nvar load = async ({ locals }) => {\n\tif (!locals.user || !locals.profile) return { dashboard: null };\n\tconst profile = locals.profile;\n\ttry {\n\t\tconst { items, projects } = await listVisibleDefinitions(locals.ctx, {\n\t\t\tlimit: 200,\n\t\t\tstatuses: [\"published\"]\n\t\t});\n\t\tconst starredIds = new Set(profile.starredDefinitions);\n\t\tconst byGuid = new Map(items.map((r) => [r.guid, r]));\n\t\tconst seen = /* @__PURE__ */ new Set();\n\t\tconst recentRuns = profile.recentRuns.filter((run) => {\n\t\t\tif (!byGuid.has(run.definitionId) || seen.has(run.definitionId)) return false;\n\t\t\tseen.add(run.definitionId);\n\t\t\treturn true;\n\t\t}).slice(0, RECENT_LIMIT);\n\t\treturn { dashboard: {\n\t\t\tstarred: items.filter((r) => starredIds.has(r.guid)).slice(0, STARRED_LIMIT),\n\t\t\trecentRuns,\n\t\t\tprojects: Object.fromEntries(projects.map((p) => [p.id, {\n\t\t\t\tid: p.id,\n\t\t\t\tname: p.name\n\t\t\t}])),\n\t\t\tvisibleCount: items.length\n\t\t} };\n\t} catch (err) {\n\t\tlocals.log.error(\"Failed to load dashboard\", {\n\t\t\tcomponent: \"Landing\",\n\t\t\terr: renderThrown(err)\n\t\t});\n\t\treturn { dashboard: null };\n\t}\n};\n//#endregion\nexport { load };\n"],"names":[],"mappings":";;;AAEA;AACA;AACA,IAAI,aAAa,GAAG,CAAC;AACrB,IAAI,YAAY,GAAG,CAAC;AACpB;AACA;AACA;AACA;AACA,IAAI,IAAI,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK;AACjC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE;AAChE,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO;AAC/B,CAAC,IAAI;AACL,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,sBAAsB,CAAC,MAAM,CAAC,GAAG,EAAE;AACvE,GAAG,KAAK,EAAE,GAAG;AACb,GAAG,QAAQ,EAAE,CAAC,WAAW;AACzB,GAAG,CAAC;AACJ,EAAE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC;AACxD,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACvD,EAAE,MAAM,IAAI,mBAAmB,IAAI,GAAG,EAAE;AACxC,EAAE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK;AACxD,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,OAAO,KAAK;AAChF,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC;AAC7B,GAAG,OAAO,IAAI;AACd,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC;AAC3B,EAAE,OAAO,EAAE,SAAS,EAAE;AACtB,GAAG,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC;AAC/E,GAAG,UAAU;AACb,GAAG,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;AAC3D,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE;AACZ,IAAI,IAAI,EAAE,CAAC,CAAC;AACZ,IAAI,CAAC,CAAC,CAAC;AACP,GAAG,YAAY,EAAE,KAAK,CAAC;AACvB,GAAG,EAAE;AACL,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE;AAC/C,GAAG,SAAS,EAAE,SAAS;AACvB,GAAG,GAAG,EAAE,YAAY,CAAC,GAAG;AACxB,GAAG,CAAC;AACJ,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE;AAC5B,CAAC;AACD,CAAC;;;;;;;;;"}