@selvajs/selva 4.16.1 → 4.16.3

package/build/server/chunks/chunks/mail.js-DBcv4_kB.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mail.js-DBcv4_kB.js","sources":["../../../../.svelte-kit/output/server/chunks/mail.js"],"sourcesContent":["import { d as spread_props } from \"./server.js\";\nimport { n as Icon } from \"./utils2.js\";\n//#region ../../node_modules/.pnpm/@lucide+svelte@1.35.0_svelte@5.56.10_@typescript-eslint+types@8.68.0_/node_modules/@lucide/svelte/dist/icons/mail.svelte\nfunction Mail($$renderer, $$props) {\n\tlet { $$slots, $$events, ...props } = $$props;\n\tIcon($$renderer, spread_props([\n\t\t{ name: \"mail\" },\n\t\tprops,\n\t\t{ iconNode: [[\"path\", { \"d\": \"m22 7-8.991 5.727a2 2 0 0 1-2.009 0L2 7\" }], [\"rect\", {\n\t\t\t\"x\": \"2\",\n\t\t\t\"y\": \"4\",\n\t\t\t\"width\": \"20\",\n\t\t\t\"height\": \"16\",\n\t\t\t\"rx\": \"2\"\n\t\t}]] }\n\t]));\n}\n//#endregion\nexport { Mail as t };\n"],"names":[],"mappings":";;;AAEA;AACA,SAAS,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE;AACnC,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO;AAC9C,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC;AAC/B,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;AAClB,EAAE,KAAK;AACP,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,yCAAyC,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE;AACtF,GAAG,GAAG,EAAE,GAAG;AACX,GAAG,GAAG,EAAE,GAAG;AACX,GAAG,OAAO,EAAE,IAAI;AAChB,GAAG,QAAQ,EAAE,IAAI;AACjB,GAAG,IAAI,EAAE;AACT,GAAG,CAAC,CAAC;AACL,EAAE,CAAC,CAAC;AACJ;;;;"}

package/build/server/chunks/chunks/minus.js-DLSGAa75.js

@@ -0,0 +1,15 @@
+import { Z as spread_props } from './server.js-CBJ8EHJf.js';
+import { I as Icon } from './utils2.js-BwimZ5qo.js';
+
+//#region ../../node_modules/.pnpm/@lucide+svelte@1.35.0_svelte@5.56.10_@typescript-eslint+types@8.68.0_/node_modules/@lucide/svelte/dist/icons/minus.svelte
+function Minus($$renderer, $$props) {
+	let { $$slots, $$events, ...props } = $$props;
+	Icon($$renderer, spread_props([
+		{ name: "minus" },
+		props,
+		{ iconNode: [["path", { "d": "M5 12h14" }]] }
+	]));
+}
+
+export { Minus as M };
+//# sourceMappingURL=minus.js-DLSGAa75.js.map

package/build/server/chunks/chunks/minus.js-DLSGAa75.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"minus.js-DLSGAa75.js","sources":["../../../../.svelte-kit/output/server/chunks/minus.js"],"sourcesContent":["import { d as spread_props } from \"./server.js\";\nimport { n as Icon } from \"./utils2.js\";\n//#region ../../node_modules/.pnpm/@lucide+svelte@1.35.0_svelte@5.56.10_@typescript-eslint+types@8.68.0_/node_modules/@lucide/svelte/dist/icons/minus.svelte\nfunction Minus($$renderer, $$props) {\n\tlet { $$slots, $$events, ...props } = $$props;\n\tIcon($$renderer, spread_props([\n\t\t{ name: \"minus\" },\n\t\tprops,\n\t\t{ iconNode: [[\"path\", { \"d\": \"M5 12h14\" }]] }\n\t]));\n}\n//#endregion\nexport { Minus as t };\n"],"names":[],"mappings":";;;AAEA;AACA,SAAS,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE;AACpC,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO;AAC9C,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC;AAC/B,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;AACnB,EAAE,KAAK;AACP,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;AAC7C,EAAE,CAAC,CAAC;AACJ;;;;"}

package/build/server/chunks/chunks/navigation.js-CD_2z_-J.js

@@ -0,0 +1,2 @@
+import './client.js-B6kyzbcb.js';
+//# sourceMappingURL=navigation.js-CD_2z_-J.js.map

package/build/server/chunks/chunks/navigation.js-CD_2z_-J.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"navigation.js-CD_2z_-J.js","sources":[],"sourcesContent":[],"names":[],"mappings":""}

package/build/server/chunks/chunks/oauthState.server.js-1v2BaCiv.js

@@ -0,0 +1,53 @@
+import { b as private_env } from './shared-server.js-DRWlV0So.js';
+import { timingSafeEqual, randomBytes } from 'node:crypto';
+
+//#region src/lib/server/auth/oauthState.server.ts
+/**
+* CSRF `state` for the OAuth round trip.
+*
+* `/auth/supabase/callback` is a GET that sets a session cookie. SvelteKit's
+* CSRF check covers form POSTs, not GETs, so without this nonce the callback
+* would accept a `?code=` from anywhere — an attacker starts their own OAuth
+* flow, captures the code, and gets the victim's browser to load the callback
+* with it, silently signing the victim into the attacker's account.
+*
+* The nonce lives in a cookie, not server memory, so it survives a
+* multi-instance deployment without a shared store. `SameSite=Lax`, not
+* `Strict`: the IdP redirect back is cross-site, and `Strict` would withhold
+* the cookie on exactly the request that needs it.
+*
+* `exchangeOAuthCode` takes only `code` — the adapter enforces neither `state`
+* nor PKCE — so this is the only thing standing between the callback and a
+* replayed authorization code.
+*/
+var STATE_COOKIE_NAME = "oauth_state";
+var STATE_MAX_AGE_S = 600;
+/** Mint a nonce, store it in the cookie, and return it to hand to the IdP as `state`. */
+function issueOAuthState(cookies) {
+	const state = randomBytes(32).toString("base64url");
+	cookies.set(STATE_COOKIE_NAME, state, {
+		path: "/",
+		httpOnly: true,
+		sameSite: "lax",
+		secure: process.env.NODE_ENV === "production" && private_env.ALLOW_INSECURE_COOKIES !== "true",
+		maxAge: STATE_MAX_AGE_S
+	});
+	return state;
+}
+/**
+* Compares the callback's `state` against the cookie and clears the cookie
+* either way — a nonce is single-use, so a failed attempt must not leave a
+* live one behind for a retry.
+*/
+function consumeOAuthState(cookies, submitted) {
+	const expected = cookies.get(STATE_COOKIE_NAME);
+	cookies.delete(STATE_COOKIE_NAME, { path: "/" });
+	if (!expected || !submitted) return false;
+	const a = Buffer.from(expected);
+	const b = Buffer.from(submitted);
+	if (a.length !== b.length) return false;
+	return timingSafeEqual(a, b);
+}
+
+export { consumeOAuthState as c, issueOAuthState as i };
+//# sourceMappingURL=oauthState.server.js-1v2BaCiv.js.map

package/build/server/chunks/chunks/oauthState.server.js-1v2BaCiv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthState.server.js-1v2BaCiv.js","sources":["../../../../.svelte-kit/output/server/chunks/oauthState.server.js"],"sourcesContent":["import { t as private_env } from \"./shared-server.js\";\nimport { randomBytes, timingSafeEqual } from \"node:crypto\";\n//#region src/lib/server/auth/oauthState.server.ts\n/**\n* CSRF `state` for the OAuth round trip.\n*\n* `/auth/supabase/callback` is a GET that sets a session cookie. SvelteKit's\n* CSRF check covers form POSTs, not GETs, so without this nonce the callback\n* would accept a `?code=` from anywhere — an attacker starts their own OAuth\n* flow, captures the code, and gets the victim's browser to load the callback\n* with it, silently signing the victim into the attacker's account.\n*\n* The nonce lives in a cookie, not server memory, so it survives a\n* multi-instance deployment without a shared store. `SameSite=Lax`, not\n* `Strict`: the IdP redirect back is cross-site, and `Strict` would withhold\n* the cookie on exactly the request that needs it.\n*\n* `exchangeOAuthCode` takes only `code` — the adapter enforces neither `state`\n* nor PKCE — so this is the only thing standing between the callback and a\n* replayed authorization code.\n*/\nvar STATE_COOKIE_NAME = \"oauth_state\";\nvar STATE_MAX_AGE_S = 600;\n/** Mint a nonce, store it in the cookie, and return it to hand to the IdP as `state`. */\nfunction issueOAuthState(cookies) {\n\tconst state = randomBytes(32).toString(\"base64url\");\n\tcookies.set(STATE_COOKIE_NAME, state, {\n\t\tpath: \"/\",\n\t\thttpOnly: true,\n\t\tsameSite: \"lax\",\n\t\tsecure: process.env.NODE_ENV === \"production\" && private_env.ALLOW_INSECURE_COOKIES !== \"true\",\n\t\tmaxAge: STATE_MAX_AGE_S\n\t});\n\treturn state;\n}\n/**\n* Compares the callback's `state` against the cookie and clears the cookie\n* either way — a nonce is single-use, so a failed attempt must not leave a\n* live one behind for a retry.\n*/\nfunction consumeOAuthState(cookies, submitted) {\n\tconst expected = cookies.get(STATE_COOKIE_NAME);\n\tcookies.delete(STATE_COOKIE_NAME, { path: \"/\" });\n\tif (!expected || !submitted) return false;\n\tconst a = Buffer.from(expected);\n\tconst b = Buffer.from(submitted);\n\tif (a.length !== b.length) return false;\n\treturn timingSafeEqual(a, b);\n}\n//#endregion\nexport { issueOAuthState as n, consumeOAuthState as t };\n"],"names":[],"mappings":";;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,iBAAiB,GAAG,aAAa;AACrC,IAAI,eAAe,GAAG,GAAG;AACzB;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;AACpD,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE;AACvC,EAAE,IAAI,EAAE,GAAG;AACX,EAAE,QAAQ,EAAE,IAAI;AAChB,EAAE,QAAQ,EAAE,KAAK;AACjB,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,WAAW,CAAC,sBAAsB,KAAK,MAAM;AAChG,EAAE,MAAM,EAAE;AACV,EAAE,CAAC;AACH,CAAC,OAAO,KAAK;AACb;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE;AAC/C,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;AAChD,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACjD,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,OAAO,KAAK;AAC1C,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;AAChC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;AACjC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,OAAO,KAAK;AACxC,CAAC,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC;AAC7B;;;;"}

package/build/server/chunks/chunks/package.js-D9xXD1Q_.js

@@ -0,0 +1,82 @@
+var package_default = {
+	name: "@selvajs/selva",
+	version: "4.16.3",
+	description: "Selva — self-contained Grasshopper-driven web app. Install, configure via .env, deploy.",
+	license: "MIT",
+	author: "VektorNode",
+	homepage: "https://selva.dev",
+	bugs: "https://github.com/VektorNode/selva/issues",
+	keywords: [
+		"grasshopper",
+		"rhino",
+		"rhino-compute",
+		"parametric-design",
+		"web-app",
+		"sveltekit"
+	],
+	publishConfig: { "access": "public" },
+	repository: {
+		"type": "git",
+		"url": "git+https://github.com/VektorNode/selva.git",
+		"directory": "packages/selva"
+	},
+	type: "module",
+	main: "./build/index.js",
+	files: ["build", "templates"],
+	engines: { "node": ">=24.0.0" },
+	scripts: {
+		"dev": "vite dev",
+		"build": "rimraf build && vite build && node ./scripts/generate-templates.js",
+		"preview": "vite preview",
+		"start": "node build/index.js",
+		"clean": "rimraf build templates",
+		"prepare": "svelte-kit sync || echo ''",
+		"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
+		"test": "vitest run",
+		"test:watch": "vitest",
+		"openapi:generate": "node scripts/generate-openapi.js",
+		"test:e2e": "playwright test",
+		"lint": "eslint .",
+		"lint:types": "eslint . --config eslint.typed.config.js"
+	},
+	dependencies: {
+		"@lucide/svelte": "catalog:",
+		"@supabase/supabase-js": "^2.112.4",
+		"@sveltejs/kit": "catalog:",
+		"bits-ui": "catalog:",
+		"clsx": "catalog:",
+		"mode-watcher": "catalog:",
+		"nodemailer": "^9.0.6",
+		"pino": "^10.3.1",
+		"sharp": "catalog:",
+		"tailwind-merge": "catalog:",
+		"tailwind-variants": "catalog:",
+		"three": "catalog:",
+		"zod": "catalog:"
+	},
+	optionalDependencies: { "@sentry/node": "^10.71.0" },
+	devDependencies: {
+		"@playwright/test": "catalog:",
+		"@selvajs/compute": "workspace:*",
+		"@selvajs/config": "workspace:*",
+		"@selvajs/header-auth-provider": "workspace:*",
+		"@selvajs/local-provider": "workspace:*",
+		"@selvajs/notifications": "workspace:*",
+		"@selvajs/platform": "workspace:*",
+		"@selvajs/schemas": "workspace:*",
+		"@selvajs/server": "workspace:*",
+		"@selvajs/solve": "workspace:*",
+		"@selvajs/supabase-provider": "workspace:*",
+		"@selvajs/ui": "workspace:*",
+		"@selvajs/visualization": "workspace:*",
+		"@sveltejs/adapter-node": "^5.5.4",
+		"@types/nodemailer": "^8.0.1",
+		"@types/three": "catalog:",
+		"rimraf": "catalog:",
+		"tw-animate-css": "catalog:",
+		"vitest": "catalog:"
+	}
+};
+
+export { package_default as p };
+//# sourceMappingURL=package.js-D9xXD1Q_.js.map

package/build/server/chunks/chunks/package.js-D9xXD1Q_.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package.js-D9xXD1Q_.js","sources":["../../../../.svelte-kit/output/server/chunks/package.js"],"sourcesContent":["var package_default = {\n\tname: \"@selvajs/selva\",\n\tversion: \"4.16.3\",\n\tdescription: \"Selva — self-contained Grasshopper-driven web app. Install, configure via .env, deploy.\",\n\tlicense: \"MIT\",\n\tauthor: \"VektorNode\",\n\thomepage: \"https://selva.dev\",\n\tbugs: \"https://github.com/VektorNode/selva/issues\",\n\tkeywords: [\n\t\t\"grasshopper\",\n\t\t\"rhino\",\n\t\t\"rhino-compute\",\n\t\t\"parametric-design\",\n\t\t\"web-app\",\n\t\t\"sveltekit\"\n\t],\n\tpublishConfig: { \"access\": \"public\" },\n\trepository: {\n\t\t\"type\": \"git\",\n\t\t\"url\": \"git+https://github.com/VektorNode/selva.git\",\n\t\t\"directory\": \"packages/selva\"\n\t},\n\ttype: \"module\",\n\tmain: \"./build/index.js\",\n\tfiles: [\"build\", \"templates\"],\n\tengines: { \"node\": \">=24.0.0\" },\n\tscripts: {\n\t\t\"dev\": \"vite dev\",\n\t\t\"build\": \"rimraf build && vite build && node ./scripts/generate-templates.js\",\n\t\t\"preview\": \"vite preview\",\n\t\t\"start\": \"node build/index.js\",\n\t\t\"clean\": \"rimraf build templates\",\n\t\t\"prepare\": \"svelte-kit sync || echo ''\",\n\t\t\"check\": \"svelte-kit sync && svelte-check --tsconfig ./tsconfig.json\",\n\t\t\"test\": \"vitest run\",\n\t\t\"test:watch\": \"vitest\",\n\t\t\"openapi:generate\": \"node scripts/generate-openapi.js\",\n\t\t\"test:e2e\": \"playwright test\",\n\t\t\"lint\": \"eslint .\",\n\t\t\"lint:types\": \"eslint . --config eslint.typed.config.js\"\n\t},\n\tdependencies: {\n\t\t\"@lucide/svelte\": \"catalog:\",\n\t\t\"@supabase/supabase-js\": \"^2.112.4\",\n\t\t\"@sveltejs/kit\": \"catalog:\",\n\t\t\"bits-ui\": \"catalog:\",\n\t\t\"clsx\": \"catalog:\",\n\t\t\"mode-watcher\": \"catalog:\",\n\t\t\"nodemailer\": \"^9.0.6\",\n\t\t\"pino\": \"^10.3.1\",\n\t\t\"sharp\": \"catalog:\",\n\t\t\"tailwind-merge\": \"catalog:\",\n\t\t\"tailwind-variants\": \"catalog:\",\n\t\t\"three\": \"catalog:\",\n\t\t\"zod\": \"catalog:\"\n\t},\n\toptionalDependencies: { \"@sentry/node\": \"^10.71.0\" },\n\tdevDependencies: {\n\t\t\"@playwright/test\": \"catalog:\",\n\t\t\"@selvajs/compute\": \"workspace:*\",\n\t\t\"@selvajs/config\": \"workspace:*\",\n\t\t\"@selvajs/header-auth-provider\": \"workspace:*\",\n\t\t\"@selvajs/local-provider\": \"workspace:*\",\n\t\t\"@selvajs/notifications\": \"workspace:*\",\n\t\t\"@selvajs/platform\": \"workspace:*\",\n\t\t\"@selvajs/schemas\": \"workspace:*\",\n\t\t\"@selvajs/server\": \"workspace:*\",\n\t\t\"@selvajs/solve\": \"workspace:*\",\n\t\t\"@selvajs/supabase-provider\": \"workspace:*\",\n\t\t\"@selvajs/ui\": \"workspace:*\",\n\t\t\"@selvajs/visualization\": \"workspace:*\",\n\t\t\"@sveltejs/adapter-node\": \"^5.5.4\",\n\t\t\"@types/nodemailer\": \"^8.0.1\",\n\t\t\"@types/three\": \"catalog:\",\n\t\t\"rimraf\": \"catalog:\",\n\t\t\"tw-animate-css\": \"catalog:\",\n\t\t\"vitest\": \"catalog:\"\n\t}\n};\n//#endregion\nexport { package_default as t };\n"],"names":[],"mappings":"AAAG,IAAC,eAAe,GAAG;AACtB,CAAC,IAAI,EAAE,gBAAgB;AACvB,CAAC,OAAO,EAAE,QAAQ;AAClB,CAAC,WAAW,EAAE,yFAAyF;AACvG,CAAC,OAAO,EAAE,KAAK;AACf,CAAC,MAAM,EAAE,YAAY;AACrB,CAAC,QAAQ,EAAE,mBAAmB;AAC9B,CAAC,IAAI,EAAE,4CAA4C;AACnD,CAAC,QAAQ,EAAE;AACX,EAAE,aAAa;AACf,EAAE,OAAO;AACT,EAAE,eAAe;AACjB,EAAE,mBAAmB;AACrB,EAAE,SAAS;AACX,EAAE;AACF,EAAE;AACF,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;AACtC,CAAC,UAAU,EAAE;AACb,EAAE,MAAM,EAAE,KAAK;AACf,EAAE,KAAK,EAAE,6CAA6C;AACtD,EAAE,WAAW,EAAE;AACf,EAAE;AACF,CAAC,IAAI,EAAE,QAAQ;AACf,CAAC,IAAI,EAAE,kBAAkB;AACzB,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC;AAC9B,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE;AAChC,CAAC,OAAO,EAAE;AACV,EAAE,KAAK,EAAE,UAAU;AACnB,EAAE,OAAO,EAAE,oEAAoE;AAC/E,EAAE,SAAS,EAAE,cAAc;AAC3B,EAAE,OAAO,EAAE,qBAAqB;AAChC,EAAE,OAAO,EAAE,wBAAwB;AACnC,EAAE,SAAS,EAAE,4BAA4B;AACzC,EAAE,OAAO,EAAE,4DAA4D;AACvE,EAAE,MAAM,EAAE,YAAY;AACtB,EAAE,YAAY,EAAE,QAAQ;AACxB,EAAE,kBAAkB,EAAE,kCAAkC;AACxD,EAAE,UAAU,EAAE,iBAAiB;AAC/B,EAAE,MAAM,EAAE,UAAU;AACpB,EAAE,YAAY,EAAE;AAChB,EAAE;AACF,CAAC,YAAY,EAAE;AACf,EAAE,gBAAgB,EAAE,UAAU;AAC9B,EAAE,uBAAuB,EAAE,UAAU;AACrC,EAAE,eAAe,EAAE,UAAU;AAC7B,EAAE,SAAS,EAAE,UAAU;AACvB,EAAE,MAAM,EAAE,UAAU;AACpB,EAAE,cAAc,EAAE,UAAU;AAC5B,EAAE,YAAY,EAAE,QAAQ;AACxB,EAAE,MAAM,EAAE,SAAS;AACnB,EAAE,OAAO,EAAE,UAAU;AACrB,EAAE,gBAAgB,EAAE,UAAU;AAC9B,EAAE,mBAAmB,EAAE,UAAU;AACjC,EAAE,OAAO,EAAE,UAAU;AACrB,EAAE,KAAK,EAAE;AACT,EAAE;AACF,CAAC,oBAAoB,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE;AACrD,CAAC,eAAe,EAAE;AAClB,EAAE,kBAAkB,EAAE,UAAU;AAChC,EAAE,kBAAkB,EAAE,aAAa;AACnC,EAAE,iBAAiB,EAAE,aAAa;AAClC,EAAE,+BAA+B,EAAE,aAAa;AAChD,EAAE,yBAAyB,EAAE,aAAa;AAC1C,EAAE,wBAAwB,EAAE,aAAa;AACzC,EAAE,mBAAmB,EAAE,aAAa;AACpC,EAAE,kBAAkB,EAAE,aAAa;AACnC,EAAE,iBAAiB,EAAE,aAAa;AAClC,EAAE,gBAAgB,EAAE,aAAa;AACjC,EAAE,4BAA4B,EAAE,aAAa;AAC7C,EAAE,aAAa,EAAE,aAAa;AAC9B,EAAE,wBAAwB,EAAE,aAAa;AACzC,EAAE,wBAAwB,EAAE,QAAQ;AACpC,EAAE,mBAAmB,EAAE,QAAQ;AAC/B,EAAE,cAAc,EAAE,UAAU;AAC5B,EAAE,QAAQ,EAAE,UAAU;AACtB,EAAE,gBAAgB,EAAE,UAAU;AAC9B,EAAE,QAAQ,EAAE;AACZ;AACA;;;;"}

package/build/server/chunks/chunks/paths.js-CG3tmqeo.js

@@ -0,0 +1,19 @@
+import { i as initial_base, b as base } from './internal.js-ClJtIfiy.js';
+import { i as resolve_route, c as add_data_suffix } from './routing.js-B9B7X1Lv.js';
+import './internal2.js-DjTYEpjQ.js';
+import { try_get_request_store } from '@sveltejs/kit/internal/server';
+
+//#region ../../node_modules/.pnpm/@sveltejs+kit@2.70.3_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.3.0_svelte_6dbd42ec51b8723a187faa28ad6e895a/node_modules/@sveltejs/kit/src/runtime/app/paths/server.js
+/** @type {import('./client.js').resolve} */
+function resolve(id, params) {
+	if (!id.startsWith("/")) throw new Error(`Cannot use \`resolve(...)\` with a non-absolute pathname or route ID (got "${id}"). \`resolve\` is only for internal pathnames and route IDs; external URLs should be used directly.`);
+	const resolved = resolve_route(id, params);
+	{
+		const store = try_get_request_store();
+		if (store && !store.state.prerendering?.fallback) return ((store.event.isDataRequest ? add_data_suffix(store.event.url.pathname) : store.event.url.pathname).slice(initial_base.length).split("/").slice(2).map(() => "..").join("/") || ".") + resolved;
+	}
+	return base + resolved;
+}
+
+export { resolve as r };
+//# sourceMappingURL=paths.js-CG3tmqeo.js.map

package/build/server/chunks/chunks/paths.js-CG3tmqeo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js-CG3tmqeo.js","sources":["../../../../.svelte-kit/output/server/chunks/paths.js"],"sourcesContent":["import { c as initial_base, s as base } from \"./internal.js\";\nimport { n as resolve_route, u as add_data_suffix } from \"./routing.js\";\nimport \"./internal2.js\";\nimport { try_get_request_store } from \"@sveltejs/kit/internal/server\";\n//#region ../../node_modules/.pnpm/@sveltejs+kit@2.70.3_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.3.0_svelte_6dbd42ec51b8723a187faa28ad6e895a/node_modules/@sveltejs/kit/src/runtime/app/paths/server.js\n/** @type {import('./client.js').resolve} */\nfunction resolve(id, params) {\n\tif (!id.startsWith(\"/\")) throw new Error(`Cannot use \\`resolve(...)\\` with a non-absolute pathname or route ID (got \"${id}\"). \\`resolve\\` is only for internal pathnames and route IDs; external URLs should be used directly.`);\n\tconst resolved = resolve_route(id, params);\n\t{\n\t\tconst store = try_get_request_store();\n\t\tif (store && !store.state.prerendering?.fallback) return ((store.event.isDataRequest ? add_data_suffix(store.event.url.pathname) : store.event.url.pathname).slice(initial_base.length).split(\"/\").slice(2).map(() => \"..\").join(\"/\") || \".\") + resolved;\n\t}\n\treturn base + resolved;\n}\n//#endregion\nexport { resolve as t };\n"],"names":[],"mappings":";;;;;AAIA;AACA;AACA,SAAS,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE;AAC7B,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,2EAA2E,EAAE,EAAE,CAAC,oGAAoG,CAAC,CAAC;AACjO,CAAC,MAAM,QAAQ,GAAG,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC;AAC3C,CAAC;AACD,EAAE,MAAM,KAAK,GAAG,qBAAqB,EAAE;AACvC,EAAE,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,QAAQ;AAC1P,CAAC;AACD,CAAC,OAAO,IAAI,GAAG,QAAQ;AACvB;;;;"}

package/build/server/chunks/chunks/permissions.server.js-kixnKedb.js

@@ -0,0 +1,24 @@
+import './src.js-Cf1j97Z6.js';
+import { b as getPermissionStore, i as getEventSink } from './providers.server.js-DM2FuS6c.js';
+import { a as actorFrom } from './access.js-CoycZfKB.js';
+
+//#region src/lib/server/permissions.server.ts
+/**
+* Permission read/write seam over `IPlatformPermissionStore`. Reads happen
+* via `locals.ctx.platformPermissions` (set once in `hooks.server.ts`);
+* writes funnel through this module so any future change (caching,
+* invalidation, audit hooks) is one-file.
+*/
+async function setUserPlatformPermissions(ctx, userId, permissions) {
+	const result = await getPermissionStore().set(ctx, userId, permissions);
+	if (result === "ok") await getEventSink().emit({
+		type: "platform_permissions.changed",
+		userId,
+		permissions,
+		actorId: actorFrom(ctx)
+	});
+	return result;
+}
+
+export { setUserPlatformPermissions as s };
+//# sourceMappingURL=permissions.server.js-kixnKedb.js.map

package/build/server/chunks/chunks/permissions.server.js-kixnKedb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.server.js-kixnKedb.js","sources":["../../../../.svelte-kit/output/server/chunks/permissions.server.js"],"sourcesContent":["import \"./src.js\";\nimport { g as getPermissionStore, u as getEventSink } from \"./providers.server.js\";\nimport { R as actorFrom } from \"./access.js\";\n//#region src/lib/server/permissions.server.ts\n/**\n* Permission read/write seam over `IPlatformPermissionStore`. Reads happen\n* via `locals.ctx.platformPermissions` (set once in `hooks.server.ts`);\n* writes funnel through this module so any future change (caching,\n* invalidation, audit hooks) is one-file.\n*/\nasync function setUserPlatformPermissions(ctx, userId, permissions) {\n\tconst result = await getPermissionStore().set(ctx, userId, permissions);\n\tif (result === \"ok\") await getEventSink().emit({\n\t\ttype: \"platform_permissions.changed\",\n\t\tuserId,\n\t\tpermissions,\n\t\tactorId: actorFrom(ctx)\n\t});\n\treturn result;\n}\n//#endregion\nexport { setUserPlatformPermissions as t };\n"],"names":[],"mappings":";;;;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,0BAA0B,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE;AACpE,CAAC,MAAM,MAAM,GAAG,MAAM,kBAAkB,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC;AACxE,CAAC,IAAI,MAAM,KAAK,IAAI,EAAE,MAAM,YAAY,EAAE,CAAC,IAAI,CAAC;AAChD,EAAE,IAAI,EAAE,8BAA8B;AACtC,EAAE,MAAM;AACR,EAAE,WAAW;AACb,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG;AACxB,EAAE,CAAC;AACH,CAAC,OAAO,MAAM;AACd;;;;"}

package/build/server/chunks/chunks/plus.js-CRKcxobD.js

@@ -0,0 +1,15 @@
+import { Z as spread_props } from './server.js-CBJ8EHJf.js';
+import { I as Icon } from './utils2.js-BwimZ5qo.js';
+
+//#region ../../node_modules/.pnpm/@lucide+svelte@1.35.0_svelte@5.56.10_@typescript-eslint+types@8.68.0_/node_modules/@lucide/svelte/dist/icons/plus.svelte
+function Plus($$renderer, $$props) {
+	let { $$slots, $$events, ...props } = $$props;
+	Icon($$renderer, spread_props([
+		{ name: "plus" },
+		props,
+		{ iconNode: [["path", { "d": "M5 12h14" }], ["path", { "d": "M12 5v14" }]] }
+	]));
+}
+
+export { Plus as P };
+//# sourceMappingURL=plus.js-CRKcxobD.js.map

package/build/server/chunks/chunks/plus.js-CRKcxobD.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plus.js-CRKcxobD.js","sources":["../../../../.svelte-kit/output/server/chunks/plus.js"],"sourcesContent":["import { d as spread_props } from \"./server.js\";\nimport { n as Icon } from \"./utils2.js\";\n//#region ../../node_modules/.pnpm/@lucide+svelte@1.35.0_svelte@5.56.10_@typescript-eslint+types@8.68.0_/node_modules/@lucide/svelte/dist/icons/plus.svelte\nfunction Plus($$renderer, $$props) {\n\tlet { $$slots, $$events, ...props } = $$props;\n\tIcon($$renderer, spread_props([\n\t\t{ name: \"plus\" },\n\t\tprops,\n\t\t{ iconNode: [[\"path\", { \"d\": \"M5 12h14\" }], [\"path\", { \"d\": \"M12 5v14\" }]] }\n\t]));\n}\n//#endregion\nexport { Plus as t };\n"],"names":[],"mappings":";;;AAEA;AACA,SAAS,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE;AACnC,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO;AAC9C,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC;AAC/B,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;AAClB,EAAE,KAAK;AACP,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;AAC5E,EAAE,CAAC,CAAC;AACJ;;;;"}

package/build/server/chunks/chunks/projects.js-C7uLgeYM.js

@@ -0,0 +1,47 @@
+import { s as slugify, P as ProviderError } from './src.js-Cf1j97Z6.js';
+import { h as apiError, b as ApiErrorCode } from './access.js-CoycZfKB.js';
+
+//#region ../server/src/projects/create-project.ts
+var MAX_SLUG_ATTEMPTS = 25;
+function isSlugConflict(err) {
+	return err instanceof ProviderError && err.statusCode === 409 && /projects_org_id_slug_key/.test(err.message);
+}
+function isNameConflict(err) {
+	return err instanceof ProviderError && err.statusCode === 409 && /projects_org_name_unique/.test(err.message);
+}
+/**
+* Create a project, retrying on slug collision.
+*
+* The retry is not a nicety: the caller may not be able to *see* a colliding
+* project under RLS, so a pre-flight `getProjectBySlug` cannot decide it — the
+* unique index is the only source of truth.
+*
+* `/api/v1/projects` and `/api/admin/projects` both create projects and both
+* carried a copy of this loop. The copies had already drifted on three points
+* (error re-throw, slug stem, flag validation), which is what makes this the
+* one place in the access surface where duplication caused real divergence.
+*/
+async function createProjectWithUniqueSlug(store, draft, { writeCtx, fallbackSlug, conflictScope }) {
+	const baseSlug = slugify(draft.name) || fallbackSlug;
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	for (let attempt = 0; attempt < MAX_SLUG_ATTEMPTS; attempt++) {
+		const project = {
+			...draft,
+			slug: attempt === 0 ? baseSlug : `${baseSlug}-${attempt + 1}`,
+			createdAt: now,
+			updatedAt: now,
+			deletedAt: null
+		};
+		try {
+			await store.createProject(writeCtx, project);
+			return project;
+		} catch (err) {
+			if (isNameConflict(err)) apiError(409, ApiErrorCode.CONFLICT, `A project with that name already exists in ${conflictScope}.`);
+			if (!isSlugConflict(err)) throw err;
+		}
+	}
+	apiError(409, ApiErrorCode.CONFLICT, "Could not pick a unique project slug after several attempts.");
+}
+
+export { createProjectWithUniqueSlug as c };
+//# sourceMappingURL=projects.js-C7uLgeYM.js.map

package/build/server/chunks/chunks/projects.js-C7uLgeYM.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projects.js-C7uLgeYM.js","sources":["../../../../.svelte-kit/output/server/chunks/projects.js"],"sourcesContent":["import { D as slugify, i as ProviderError } from \"./src.js\";\nimport { M as ApiErrorCode, N as apiError } from \"./access.js\";\n//#region ../server/src/projects/create-project.ts\nvar MAX_SLUG_ATTEMPTS = 25;\nfunction isSlugConflict(err) {\n\treturn err instanceof ProviderError && err.statusCode === 409 && /projects_org_id_slug_key/.test(err.message);\n}\nfunction isNameConflict(err) {\n\treturn err instanceof ProviderError && err.statusCode === 409 && /projects_org_name_unique/.test(err.message);\n}\n/**\n* Create a project, retrying on slug collision.\n*\n* The retry is not a nicety: the caller may not be able to *see* a colliding\n* project under RLS, so a pre-flight `getProjectBySlug` cannot decide it — the\n* unique index is the only source of truth.\n*\n* `/api/v1/projects` and `/api/admin/projects` both create projects and both\n* carried a copy of this loop. The copies had already drifted on three points\n* (error re-throw, slug stem, flag validation), which is what makes this the\n* one place in the access surface where duplication caused real divergence.\n*/\nasync function createProjectWithUniqueSlug(store, draft, { writeCtx, fallbackSlug, conflictScope }) {\n\tconst baseSlug = slugify(draft.name) || fallbackSlug;\n\tconst now = (/* @__PURE__ */ new Date()).toISOString();\n\tfor (let attempt = 0; attempt < MAX_SLUG_ATTEMPTS; attempt++) {\n\t\tconst project = {\n\t\t\t...draft,\n\t\t\tslug: attempt === 0 ? baseSlug : `${baseSlug}-${attempt + 1}`,\n\t\t\tcreatedAt: now,\n\t\t\tupdatedAt: now,\n\t\t\tdeletedAt: null\n\t\t};\n\t\ttry {\n\t\t\tawait store.createProject(writeCtx, project);\n\t\t\treturn project;\n\t\t} catch (err) {\n\t\t\tif (isNameConflict(err)) apiError(409, ApiErrorCode.CONFLICT, `A project with that name already exists in ${conflictScope}.`);\n\t\t\tif (!isSlugConflict(err)) throw err;\n\t\t}\n\t}\n\tapiError(409, ApiErrorCode.CONFLICT, \"Could not pick a unique project slug after several attempts.\");\n}\n//#endregion\nexport { createProjectWithUniqueSlug as t };\n"],"names":[],"mappings":";;;AAEA;AACA,IAAI,iBAAiB,GAAG,EAAE;AAC1B,SAAS,cAAc,CAAC,GAAG,EAAE;AAC7B,CAAC,OAAO,GAAG,YAAY,aAAa,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;AAC9G;AACA,SAAS,cAAc,CAAC,GAAG,EAAE;AAC7B,CAAC,OAAO,GAAG,YAAY,aAAa,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;AAC9G;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,2BAA2B,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,EAAE;AACpG,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,YAAY;AACrD,CAAC,MAAM,GAAG,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACvD,CAAC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,iBAAiB,EAAE,OAAO,EAAE,EAAE;AAC/D,EAAE,MAAM,OAAO,GAAG;AAClB,GAAG,GAAG,KAAK;AACX,GAAG,IAAI,EAAE,OAAO,KAAK,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;AAChE,GAAG,SAAS,EAAE,GAAG;AACjB,GAAG,SAAS,EAAE,GAAG;AACjB,GAAG,SAAS,EAAE;AACd,GAAG;AACH,EAAE,IAAI;AACN,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC;AAC/C,GAAG,OAAO,OAAO;AACjB,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,2CAA2C,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;AAChI,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG;AACtC,EAAE;AACF,CAAC;AACD,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,8DAA8D,CAAC;AACrG;;;;"}