@selvajs/selva 4.18.1 → 4.19.0

package/build/server/chunks/entries/endpoints/api/v1/solve-events/_server.ts.js-3g1FgHne.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"_server.ts.js-3g1FgHne.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/v1/solve-events/_server.ts.js"],"sourcesContent":["import { r as getSolveEventBus } from \"../../../../../chunks/token.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\nimport { n as liveOwnerKey } from \"../../../../../chunks/liveSolve.server.js\";\n//#region src/lib/server/solveEvents/sse.server.ts\n/** Comment frames keep idle proxies from closing the connection. */\nvar HEARTBEAT_MS = 2e4;\n/**\n* The SSE response for one browser stream: registers it on the bus, frames each event as\n* `event: solve`, and unregisters when the client goes. Null when another owner holds `streamId`.\n*/\nfunction openSolveEventStream(args) {\n\tconst { bus, streamId, ownerKey, signal } = args;\n\tconst encoder = new TextEncoder();\n\tlet write = () => {};\n\tconst unsubscribe = bus.openStream(streamId, ownerKey, (event) => write(event));\n\tif (!unsubscribe) return null;\n\tlet close = () => {};\n\tconst body = new ReadableStream({\n\t\tstart(controller) {\n\t\t\tlet eventId = 0;\n\t\t\tlet closed = false;\n\t\t\tconst send = (chunk) => {\n\t\t\t\ttry {\n\t\t\t\t\tcontroller.enqueue(encoder.encode(chunk));\n\t\t\t\t} catch {\n\t\t\t\t\tclose();\n\t\t\t\t}\n\t\t\t};\n\t\t\twrite = (event) => send(`id: ${++eventId}\\nevent: solve\\ndata: ${JSON.stringify(event)}\\n\\n`);\n\t\t\tconst heartbeat = setInterval(() => send(\": ping\\n\\n\"), HEARTBEAT_MS);\n\t\t\tclose = () => {\n\t\t\t\tif (closed) return;\n\t\t\t\tclosed = true;\n\t\t\t\tclearInterval(heartbeat);\n\t\t\t\tunsubscribe();\n\t\t\t\ttry {\n\t\t\t\t\tcontroller.close();\n\t\t\t\t} catch {}\n\t\t\t};\n\t\t\tsignal.addEventListener(\"abort\", close, { once: true });\n\t\t\tif (signal.aborted) close();\n\t\t\tsend(`event: ready\\ndata: ${JSON.stringify({ streamId })}\\n\\n`);\n\t\t},\n\t\tcancel() {\n\t\t\tclose();\n\t\t}\n\t});\n\treturn new Response(body, { headers: {\n\t\t\"Content-Type\": \"text/event-stream\",\n\t\t\"Cache-Control\": \"no-cache, no-transform\",\n\t\tConnection: \"keep-alive\",\n\t\t\"X-Accel-Buffering\": \"no\"\n\t} });\n}\n//#endregion\n//#region src/routes/api/v1/solve-events/+server.ts\nvar STREAM_ID = /^[A-Za-z0-9_-]{16,64}$/;\nvar GET = async ({ url, locals, request }) => {\n\tconst ownerKey = liveOwnerKey(locals.user?.id);\n\tif (!ownerKey) apiError(401, ApiErrorCode.UNAUTHORIZED, \"Unauthorized\");\n\tconst streamId = url.searchParams.get(\"streamId\") ?? \"\";\n\tif (!STREAM_ID.test(streamId)) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"streamId must be 16-64 URL-safe characters\");\n\tconst response = openSolveEventStream({\n\t\tbus: getSolveEventBus(),\n\t\tstreamId,\n\t\townerKey,\n\t\tsignal: request.signal\n\t});\n\tif (!response) apiError(409, ApiErrorCode.CONFLICT, \"streamId is in use\");\n\treturn response;\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAGA;AACA;AACA,IAAI,YAAY,GAAG,GAAG;AACtB;AACA;AACA;AACA;AACA,SAAS,oBAAoB,CAAC,IAAI,EAAE;AACpC,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI;AACjD,CAAC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE;AAClC,CAAC,IAAI,KAAK,GAAG,MAAM,CAAC,CAAC;AACrB,CAAC,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,IAAI;AAC9B,CAAC,IAAI,KAAK,GAAG,MAAM,CAAC,CAAC;AACrB,CAAC,MAAM,IAAI,GAAG,IAAI,cAAc,CAAC;AACjC,EAAE,KAAK,CAAC,UAAU,EAAE;AACpB,GAAG,IAAI,OAAO,GAAG,CAAC;AAClB,GAAG,IAAI,MAAM,GAAG,KAAK;AACrB,GAAG,MAAM,IAAI,GAAG,CAAC,KAAK,KAAK;AAC3B,IAAI,IAAI;AACR,KAAK,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9C,IAAI,CAAC,CAAC,MAAM;AACZ,KAAK,KAAK,EAAE;AACZ,IAAI;AACJ,GAAG,CAAC;AACJ,GAAG,KAAK,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,sBAAsB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;AAChG,GAAG,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;AACxE,GAAG,KAAK,GAAG,MAAM;AACjB,IAAI,IAAI,MAAM,EAAE;AAChB,IAAI,MAAM,GAAG,IAAI;AACjB,IAAI,aAAa,CAAC,SAAS,CAAC;AAC5B,IAAI,WAAW,EAAE;AACjB,IAAI,IAAI;AACR,KAAK,UAAU,CAAC,KAAK,EAAE;AACvB,IAAI,CAAC,CAAC,MAAM,CAAC;AACb,GAAG,CAAC;AACJ,GAAG,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC1D,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE;AAC9B,GAAG,IAAI,CAAC,CAAC,oBAAoB,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAClE,EAAE,CAAC;AACH,EAAE,MAAM,GAAG;AACX,GAAG,KAAK,EAAE;AACV,EAAE;AACF,EAAE,CAAC;AACH,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE;AACtC,EAAE,cAAc,EAAE,mBAAmB;AACrC,EAAE,eAAe,EAAE,wBAAwB;AAC3C,EAAE,UAAU,EAAE,YAAY;AAC1B,EAAE,mBAAmB,EAAE;AACvB,EAAE,EAAE,CAAC;AACL;AACA;AACA;AACA,IAAI,SAAS,GAAG,wBAAwB;AACrC,IAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK;AAC9C,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AAC/C,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC;AACxE,CAAC,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE;AACxD,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,4CAA4C,CAAC;AAC3H,CAAC,MAAM,QAAQ,GAAG,oBAAoB,CAAC;AACvC,EAAE,GAAG,EAAE,gBAAgB,EAAE;AACzB,EAAE,QAAQ;AACV,EAAE,QAAQ;AACV,EAAE,MAAM,EAAE,OAAO,CAAC;AAClB,EAAE,CAAC;AACH,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,oBAAoB,CAAC;AAC1E,CAAC,OAAO,QAAQ;AAChB;;;;"}

package/build/server/chunks/entries/endpoints/api/v1/solve-events/_solveId_/_server.ts.js-Ck-DL0fZ.js

@@ -1,59 +0,0 @@
-import { v as verifySolveToken, g as getSolveEventBus } from '../../../../../../chunks/token.server.js-BPIjr3vT.js';
-import { i as requireMaxBodySize } from '../../../../../../chunks/admin-auth.server.js-I3ZwmT--.js';
-import { a as apiError, A as ApiErrorCode } from '../../../../../../chunks/api-errors.js-4HDFN7ny.js';
-import { json } from '@sveltejs/kit';
-import '../../../../../../chunks/shared-server.js-BGs15m2r.js';
-import 'node:crypto';
-import '../../../../../../chunks/src.js-Cf1j97Z6.js';
-import 'zod';
-import '../../../../../../chunks/definitions.js-DK6GL3vh.js';
-import '../../../../../../chunks/access.js-DFbcJ7ZG.js';
-import '../../../../../../chunks/schema.js-YChb_4u9.js';
-import '../../../../../../chunks/api.js-BF_dHNnR.js';
-import 'node:dns/promises';
-import 'node:net';
-
-function readBearer(request) {
-	const auth = request.headers.get("authorization");
-	return auth?.startsWith("Bearer ") ? auth.slice(7).trim() : null;
-}
-/**
-* The events in a callback body, in order. `seq` and `solveId` are the bus's to stamp, so any the
-* plugin sent are ignored. `now` stands in for a missing `at`.
-*/
-function parseCallbackEvents(body, now) {
-	const raw = body?.events;
-	if (!Array.isArray(raw)) return [];
-	return raw.slice(0, 256).flatMap((entry) => {
-		if (!entry || typeof entry !== "object") return [];
-		const e = entry;
-		if (typeof e.type !== "string" || !e.type) return [];
-		const payload = e.payload && typeof e.payload === "object" && !Array.isArray(e.payload) ? e.payload : void 0;
-		return [{
-			type: e.type,
-			at: typeof e.at === "string" ? e.at : now,
-			...payload ? { payload } : {}
-		}];
-	});
-}
-//#endregion
-//#region src/routes/api/v1/solve-events/[solveId]/+server.ts
-var MAX_BODY_BYTES = 262144;
-var SOLVE_ID = /^[A-Za-z0-9-]{8,64}$/;
-var POST = async ({ params, request }) => {
-	requireMaxBodySize(request, MAX_BODY_BYTES);
-	const { solveId } = params;
-	if (!SOLVE_ID.test(solveId) || !verifySolveToken(solveId, readBearer(request))) apiError(401, ApiErrorCode.UNAUTHORIZED, "Invalid solve token");
-	const bus = getSolveEventBus();
-	if (!bus.isOpen(solveId)) apiError(410, ApiErrorCode.NOT_FOUND, "Solve is no longer open");
-	let body;
-	try {
-		body = await request.json();
-	} catch {
-		apiError(400, ApiErrorCode.VALIDATION_FAILED, "Body must be JSON");
-	}
-	return json(bus.publish(solveId, parseCallbackEvents(body, (/* @__PURE__ */ new Date()).toISOString())));
-};
-
-export { POST };
-//# sourceMappingURL=_server.ts.js-Ck-DL0fZ.js.map

package/build/server/chunks/entries/endpoints/api/v1/solve-events/_solveId_/_server.ts.js-Ck-DL0fZ.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"_server.ts.js-Ck-DL0fZ.js","sources":["../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/v1/solve-events/_solveId_/_server.ts.js"],"sourcesContent":["import { n as verifySolveToken, r as getSolveEventBus } from \"../../../../../../chunks/token.server.js\";\nimport { c as requireMaxBodySize } from \"../../../../../../chunks/admin-auth.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../../chunks/api-errors.js\";\nimport { json } from \"@sveltejs/kit\";\nfunction readBearer(request) {\n\tconst auth = request.headers.get(\"authorization\");\n\treturn auth?.startsWith(\"Bearer \") ? auth.slice(7).trim() : null;\n}\n/**\n* The events in a callback body, in order. `seq` and `solveId` are the bus's to stamp, so any the\n* plugin sent are ignored. `now` stands in for a missing `at`.\n*/\nfunction parseCallbackEvents(body, now) {\n\tconst raw = body?.events;\n\tif (!Array.isArray(raw)) return [];\n\treturn raw.slice(0, 256).flatMap((entry) => {\n\t\tif (!entry || typeof entry !== \"object\") return [];\n\t\tconst e = entry;\n\t\tif (typeof e.type !== \"string\" || !e.type) return [];\n\t\tconst payload = e.payload && typeof e.payload === \"object\" && !Array.isArray(e.payload) ? e.payload : void 0;\n\t\treturn [{\n\t\t\ttype: e.type,\n\t\t\tat: typeof e.at === \"string\" ? e.at : now,\n\t\t\t...payload ? { payload } : {}\n\t\t}];\n\t});\n}\n//#endregion\n//#region src/routes/api/v1/solve-events/[solveId]/+server.ts\nvar MAX_BODY_BYTES = 262144;\nvar SOLVE_ID = /^[A-Za-z0-9-]{8,64}$/;\nvar POST = async ({ params, request }) => {\n\trequireMaxBodySize(request, MAX_BODY_BYTES);\n\tconst { solveId } = params;\n\tif (!SOLVE_ID.test(solveId) || !verifySolveToken(solveId, readBearer(request))) apiError(401, ApiErrorCode.UNAUTHORIZED, \"Invalid solve token\");\n\tconst bus = getSolveEventBus();\n\tif (!bus.isOpen(solveId)) apiError(410, ApiErrorCode.NOT_FOUND, \"Solve is no longer open\");\n\tlet body;\n\ttry {\n\t\tbody = await request.json();\n\t} catch {\n\t\tapiError(400, ApiErrorCode.VALIDATION_FAILED, \"Body must be JSON\");\n\t}\n\treturn json(bus.publish(solveId, parseCallbackEvents(body, (/* @__PURE__ */ new Date()).toISOString())));\n};\n//#endregion\nexport { POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;AAIA,SAAS,UAAU,CAAC,OAAO,EAAE;AAC7B,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;AAClD,CAAC,OAAO,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI;AACjE;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE;AACxC,CAAC,MAAM,GAAG,GAAG,IAAI,EAAE,MAAM;AACzB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE;AACnC,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK;AAC7C,EAAE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,OAAO,EAAE;AACpD,EAAE,MAAM,CAAC,GAAG,KAAK;AACjB,EAAE,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE;AACtD,EAAE,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,GAAG,MAAM;AAC9G,EAAE,OAAO,CAAC;AACV,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI;AACf,GAAG,EAAE,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG;AAC5C,GAAG,GAAG,OAAO,GAAG,EAAE,OAAO,EAAE,GAAG;AAC9B,GAAG,CAAC;AACJ,CAAC,CAAC,CAAC;AACH;AACA;AACA;AACA,IAAI,cAAc,GAAG,MAAM;AAC3B,IAAI,QAAQ,GAAG,sBAAsB;AAClC,IAAC,IAAI,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK;AAC1C,CAAC,kBAAkB,CAAC,OAAO,EAAE,cAAc,CAAC;AAC5C,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM;AAC3B,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,qBAAqB,CAAC;AAChJ,CAAC,MAAM,GAAG,GAAG,gBAAgB,EAAE;AAC/B,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,yBAAyB,CAAC;AAC3F,CAAC,IAAI,IAAI;AACT,CAAC,IAAI;AACL,EAAE,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE;AAC7B,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;AACpE,CAAC;AACD,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;AACzG;;;;"}

package/build/server/chunks/entries/endpoints/auth/email/callback/_server.ts.js-CO7Zpgk_.js

@@ -1,46 +0,0 @@
-import { a as getAuthProvider } from '../../../../../chunks/providers.server.js-DQ1uVPlR.js';
-import { s as setSessionCookie, a as setRefreshCookie } from '../../../../../chunks/admin-auth.server.js-I3ZwmT--.js';
-import { a as apiError, A as ApiErrorCode } from '../../../../../chunks/api-errors.js-4HDFN7ny.js';
-import { s as safeRedirectTarget } from '../../../../../chunks/redirect.js-2M2qGbv2.js';
-import { b as bootstrapUserSession } from '../../../../../chunks/auth-bootstrap.server.js-Z3bHapez.js';
-import { redirect } from '@sveltejs/kit';
-import '../../../../../chunks/shared-server.js-BGs15m2r.js';
-import '../../../../../chunks/src.js-Cf1j97Z6.js';
-import 'zod';
-import '../../../../../chunks/definitions.js-DK6GL3vh.js';
-import '../../../../../chunks/access.js-DFbcJ7ZG.js';
-import '../../../../../chunks/schema.js-YChb_4u9.js';
-import 'node:crypto';
-import '../../../../../chunks/limits.js-chQOq2eQ.js';
-import 'node:url';
-import 'node:path';
-import 'node:fs';
-import 'node:fs/promises';
-import '@supabase/supabase-js';
-import '../../../../../chunks/api.js-BF_dHNnR.js';
-import 'node:dns/promises';
-import 'node:net';
-
-//#region src/routes/auth/email/callback/+server.ts
-/**
-* GET /auth/email/callback?token_hash=...&type=...&redirectTo=/library
-*
-* The user clicked the magic link in their inbox. Hand the full URL to the
-* adapter (it knows its own token format), set cookies on success, redirect
-* to the destination. Mirrors `/auth/supabase/callback` but capability-named
-* — this route doesn't know which IdP brokered the email.
-*/
-var GET = async ({ url, cookies }) => {
-	const emailLink = getAuthProvider().emailLink;
-	if (!emailLink) apiError(501, ApiErrorCode.INTERNAL, "Email sign-in is not supported by this provider.");
-	const result = await emailLink.verifyMagicLink(url.toString());
-	if (!result) apiError(401, ApiErrorCode.UNAUTHORIZED, "This sign-in link is invalid or has expired.");
-	await bootstrapUserSession(result.user);
-	setSessionCookie(cookies, result.sessionToken);
-	if (result.refreshToken) setRefreshCookie(cookies, result.refreshToken);
-	const dest = safeRedirectTarget(url.searchParams.get("redirectTo"), "/library");
-	redirect(303, dest);
-};
-
-export { GET };
-//# sourceMappingURL=_server.ts.js-CO7Zpgk_.js.map

package/build/server/chunks/entries/endpoints/auth/email/callback/_server.ts.js-CO7Zpgk_.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"_server.ts.js-CO7Zpgk_.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/auth/email/callback/_server.ts.js"],"sourcesContent":["import { r as getAuthProvider } from \"../../../../../chunks/providers.server.js\";\nimport { l as setRefreshCookie, u as setSessionCookie } from \"../../../../../chunks/admin-auth.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\nimport { t as safeRedirectTarget } from \"../../../../../chunks/redirect.js\";\nimport { t as bootstrapUserSession } from \"../../../../../chunks/auth-bootstrap.server.js\";\nimport { redirect } from \"@sveltejs/kit\";\n//#region src/routes/auth/email/callback/+server.ts\n/**\n* GET /auth/email/callback?token_hash=...&type=...&redirectTo=/library\n*\n* The user clicked the magic link in their inbox. Hand the full URL to the\n* adapter (it knows its own token format), set cookies on success, redirect\n* to the destination. Mirrors `/auth/supabase/callback` but capability-named\n* — this route doesn't know which IdP brokered the email.\n*/\nvar GET = async ({ url, cookies }) => {\n\tconst emailLink = getAuthProvider().emailLink;\n\tif (!emailLink) apiError(501, ApiErrorCode.INTERNAL, \"Email sign-in is not supported by this provider.\");\n\tconst result = await emailLink.verifyMagicLink(url.toString());\n\tif (!result) apiError(401, ApiErrorCode.UNAUTHORIZED, \"This sign-in link is invalid or has expired.\");\n\tawait bootstrapUserSession(result.user);\n\tsetSessionCookie(cookies, result.sessionToken);\n\tif (result.refreshToken) setRefreshCookie(cookies, result.refreshToken);\n\tconst dest = safeRedirectTarget(url.searchParams.get(\"redirectTo\"), \"/library\");\n\tredirect(303, dest);\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAMA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK;AACtC,CAAC,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC,SAAS;AAC9C,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,kDAAkD,CAAC;AACzG,CAAC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;AAC/D,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,8CAA8C,CAAC;AACtG,CAAC,MAAM,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC;AACxC,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AAC/C,CAAC,IAAI,MAAM,CAAC,YAAY,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AACxE,CAAC,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC;AAChF,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;AACpB;;;;"}

package/build/server/chunks/entries/endpoints/auth/supabase/callback/_server.ts.js-jkRjDejp.js

@@ -1,52 +0,0 @@
-import { a as getAuthProvider } from '../../../../../chunks/providers.server.js-DQ1uVPlR.js';
-import { s as setSessionCookie, a as setRefreshCookie } from '../../../../../chunks/admin-auth.server.js-I3ZwmT--.js';
-import { a as apiError, A as ApiErrorCode } from '../../../../../chunks/api-errors.js-4HDFN7ny.js';
-import { s as safeRedirectTarget } from '../../../../../chunks/redirect.js-2M2qGbv2.js';
-import { b as bootstrapUserSession } from '../../../../../chunks/auth-bootstrap.server.js-Z3bHapez.js';
-import { c as consumeOAuthState } from '../../../../../chunks/oauthState.server.js-BVkqxviq.js';
-import { redirect } from '@sveltejs/kit';
-import '../../../../../chunks/shared-server.js-BGs15m2r.js';
-import '../../../../../chunks/src.js-Cf1j97Z6.js';
-import 'zod';
-import '../../../../../chunks/definitions.js-DK6GL3vh.js';
-import '../../../../../chunks/access.js-DFbcJ7ZG.js';
-import '../../../../../chunks/schema.js-YChb_4u9.js';
-import 'node:crypto';
-import '../../../../../chunks/limits.js-chQOq2eQ.js';
-import 'node:url';
-import 'node:path';
-import 'node:fs';
-import 'node:fs/promises';
-import '@supabase/supabase-js';
-import '../../../../../chunks/api.js-BF_dHNnR.js';
-import 'node:dns/promises';
-import 'node:net';
-
-//#region src/routes/auth/supabase/callback/+server.ts
-/**
-* GET /auth/supabase/callback?code=...&redirectTo=/library
-*
-* Completes a Supabase OAuth round-trip. Exchanges the authorization code
-* for a session, sets the session cookie, and redirects to `redirectTo`.
-*
-* Post-verification flow (data-row seeding + first-admin bootstrap) lives in
-* `bootstrapUserSession` so the email-link and OAuth paths follow the same
-* sequence in the same order.
-*/
-var GET = async ({ url, cookies }) => {
-	if (!consumeOAuthState(cookies, url.searchParams.get("selva_state"))) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Sign-in session expired. Please try again.");
-	const code = url.searchParams.get("code");
-	if (!code) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Missing authorization code");
-	const oauth = getAuthProvider().oauth;
-	if (!oauth) apiError(501, ApiErrorCode.INTERNAL, "OAuth is not supported by the configured auth provider.");
-	const result = await oauth.exchangeOAuthCode(code);
-	if (!result) apiError(401, ApiErrorCode.UNAUTHORIZED, "OAuth exchange failed");
-	await bootstrapUserSession(result.user);
-	setSessionCookie(cookies, result.sessionToken);
-	setRefreshCookie(cookies, result.refreshToken);
-	const dest = safeRedirectTarget(url.searchParams.get("redirectTo"), "/library");
-	redirect(303, dest);
-};
-
-export { GET };
-//# sourceMappingURL=_server.ts.js-jkRjDejp.js.map

package/build/server/chunks/entries/endpoints/auth/supabase/callback/_server.ts.js-jkRjDejp.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"_server.ts.js-jkRjDejp.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/auth/supabase/callback/_server.ts.js"],"sourcesContent":["import { r as getAuthProvider } from \"../../../../../chunks/providers.server.js\";\nimport { l as setRefreshCookie, u as setSessionCookie } from \"../../../../../chunks/admin-auth.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\nimport { t as safeRedirectTarget } from \"../../../../../chunks/redirect.js\";\nimport { t as bootstrapUserSession } from \"../../../../../chunks/auth-bootstrap.server.js\";\nimport { t as consumeOAuthState } from \"../../../../../chunks/oauthState.server.js\";\nimport { redirect } from \"@sveltejs/kit\";\n//#region src/routes/auth/supabase/callback/+server.ts\n/**\n* GET /auth/supabase/callback?code=...&redirectTo=/library\n*\n* Completes a Supabase OAuth round-trip. Exchanges the authorization code\n* for a session, sets the session cookie, and redirects to `redirectTo`.\n*\n* Post-verification flow (data-row seeding + first-admin bootstrap) lives in\n* `bootstrapUserSession` so the email-link and OAuth paths follow the same\n* sequence in the same order.\n*/\nvar GET = async ({ url, cookies }) => {\n\tif (!consumeOAuthState(cookies, url.searchParams.get(\"selva_state\"))) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Sign-in session expired. Please try again.\");\n\tconst code = url.searchParams.get(\"code\");\n\tif (!code) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing authorization code\");\n\tconst oauth = getAuthProvider().oauth;\n\tif (!oauth) apiError(501, ApiErrorCode.INTERNAL, \"OAuth is not supported by the configured auth provider.\");\n\tconst result = await oauth.exchangeOAuthCode(code);\n\tif (!result) apiError(401, ApiErrorCode.UNAUTHORIZED, \"OAuth exchange failed\");\n\tawait bootstrapUserSession(result.user);\n\tsetSessionCookie(cookies, result.sessionToken);\n\tsetRefreshCookie(cookies, result.refreshToken);\n\tconst dest = safeRedirectTarget(url.searchParams.get(\"redirectTo\"), \"/library\");\n\tredirect(303, dest);\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAOA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK;AACtC,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,4CAA4C,CAAC;AAClK,CAAC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;AAC1C,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,4BAA4B,CAAC;AACvF,CAAC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC,KAAK;AACtC,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,yDAAyD,CAAC;AAC5G,CAAC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC;AACnD,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,uBAAuB,CAAC;AAC/E,CAAC,MAAM,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC;AACxC,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AAC/C,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AAC/C,CAAC,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC;AAChF,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;AACpB;;;;"}

package/build/server/chunks/entries/endpoints/auth/supabase/start/_server.ts.js-B2X9bb98.js

@@ -1,63 +0,0 @@
-import { a as getAuthProvider } from '../../../../../chunks/providers.server.js-DQ1uVPlR.js';
-import { a as apiError, A as ApiErrorCode } from '../../../../../chunks/api-errors.js-4HDFN7ny.js';
-import { i as issueOAuthState } from '../../../../../chunks/oauthState.server.js-BVkqxviq.js';
-import { redirect } from '@sveltejs/kit';
-import '../../../../../chunks/shared-server.js-BGs15m2r.js';
-import '../../../../../chunks/src.js-Cf1j97Z6.js';
-import 'zod';
-import '../../../../../chunks/definitions.js-DK6GL3vh.js';
-import '../../../../../chunks/access.js-DFbcJ7ZG.js';
-import '../../../../../chunks/schema.js-YChb_4u9.js';
-import 'node:crypto';
-import '../../../../../chunks/limits.js-chQOq2eQ.js';
-import 'node:url';
-import 'node:path';
-import 'node:fs';
-import 'node:fs/promises';
-import '@supabase/supabase-js';
-import '../../../../../chunks/api.js-BF_dHNnR.js';
-import 'node:dns/promises';
-import 'node:net';
-
-//#region src/routes/auth/supabase/start/+server.ts
-var ALLOWED_PROVIDERS = [
-	"google",
-	"github",
-	"azure",
-	"gitlab"
-];
-function isAllowedProvider(value) {
-	return value !== null && ALLOWED_PROVIDERS.includes(value);
-}
-/**
-* GET /auth/supabase/start?provider=google&redirectTo=/library
-*
-* Initiates an OAuth sign-in via Supabase Auth. The Supabase project must
-* have the named provider enabled in its dashboard. Bounces the browser to
-* the IdP's authorize endpoint; the IdP returns to `/auth/supabase/callback`
-* with a `?code=...`.
-*
-* `redirectTo` is preserved through the round trip via `?redirectTo=...` on
-* the callback URL we hand to Supabase.
-*
-* A CSRF nonce rides along the same way. Supabase owns the real OAuth `state`
-* and doesn't expose it, and `exchangeOAuthCode` takes only `code` — so the
-* nonce is our own, carried on the callback URL and compared against a cookie.
-* Without it the callback accepts an attacker's `?code=` and silently signs the
-* victim into the attacker's account. See `oauthState.server.ts`.
-*/
-var GET = async ({ url, cookies }) => {
-	const provider = url.searchParams.get("provider");
-	if (!isAllowedProvider(provider)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid provider. Allowed: ${ALLOWED_PROVIDERS.join(", ")}`);
-	const oauth = getAuthProvider().oauth;
-	if (!oauth) apiError(501, ApiErrorCode.INTERNAL, "OAuth is not supported by the configured auth provider.");
-	const redirectTo = url.searchParams.get("redirectTo") ?? "/library";
-	const callbackUrl = new URL("/auth/supabase/callback", url.origin);
-	if (redirectTo.startsWith("/")) callbackUrl.searchParams.set("redirectTo", redirectTo);
-	callbackUrl.searchParams.set("selva_state", issueOAuthState(cookies));
-	const authorizationUrl = await oauth.getOAuthAuthorizationUrl(provider, callbackUrl.toString());
-	redirect(303, authorizationUrl);
-};
-
-export { GET };
-//# sourceMappingURL=_server.ts.js-B2X9bb98.js.map

package/build/server/chunks/entries/endpoints/auth/supabase/start/_server.ts.js-B2X9bb98.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"_server.ts.js-B2X9bb98.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/auth/supabase/start/_server.ts.js"],"sourcesContent":["import { r as getAuthProvider } from \"../../../../../chunks/providers.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\nimport { n as issueOAuthState } from \"../../../../../chunks/oauthState.server.js\";\nimport { redirect } from \"@sveltejs/kit\";\n//#region src/routes/auth/supabase/start/+server.ts\nvar ALLOWED_PROVIDERS = [\n\t\"google\",\n\t\"github\",\n\t\"azure\",\n\t\"gitlab\"\n];\nfunction isAllowedProvider(value) {\n\treturn value !== null && ALLOWED_PROVIDERS.includes(value);\n}\n/**\n* GET /auth/supabase/start?provider=google&redirectTo=/library\n*\n* Initiates an OAuth sign-in via Supabase Auth. The Supabase project must\n* have the named provider enabled in its dashboard. Bounces the browser to\n* the IdP's authorize endpoint; the IdP returns to `/auth/supabase/callback`\n* with a `?code=...`.\n*\n* `redirectTo` is preserved through the round trip via `?redirectTo=...` on\n* the callback URL we hand to Supabase.\n*\n* A CSRF nonce rides along the same way. Supabase owns the real OAuth `state`\n* and doesn't expose it, and `exchangeOAuthCode` takes only `code` — so the\n* nonce is our own, carried on the callback URL and compared against a cookie.\n* Without it the callback accepts an attacker's `?code=` and silently signs the\n* victim into the attacker's account. See `oauthState.server.ts`.\n*/\nvar GET = async ({ url, cookies }) => {\n\tconst provider = url.searchParams.get(\"provider\");\n\tif (!isAllowedProvider(provider)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid provider. Allowed: ${ALLOWED_PROVIDERS.join(\", \")}`);\n\tconst oauth = getAuthProvider().oauth;\n\tif (!oauth) apiError(501, ApiErrorCode.INTERNAL, \"OAuth is not supported by the configured auth provider.\");\n\tconst redirectTo = url.searchParams.get(\"redirectTo\") ?? \"/library\";\n\tconst callbackUrl = new URL(\"/auth/supabase/callback\", url.origin);\n\tif (redirectTo.startsWith(\"/\")) callbackUrl.searchParams.set(\"redirectTo\", redirectTo);\n\tcallbackUrl.searchParams.set(\"selva_state\", issueOAuthState(cookies));\n\tconst authorizationUrl = await oauth.getOAuthAuthorizationUrl(provider, callbackUrl.toString());\n\tredirect(303, authorizationUrl);\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAIA;AACA,IAAI,iBAAiB,GAAG;AACxB,CAAC,QAAQ;AACT,CAAC,QAAQ;AACT,CAAC,OAAO;AACR,CAAC;AACD,CAAC;AACD,SAAS,iBAAiB,CAAC,KAAK,EAAE;AAClC,CAAC,OAAO,KAAK,KAAK,IAAI,IAAI,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC;AAC3D;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK;AACtC,CAAC,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC;AAClD,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,2BAA2B,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC9I,CAAC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC,KAAK;AACtC,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,yDAAyD,CAAC;AAC5G,CAAC,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,UAAU;AACpE,CAAC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,yBAAyB,EAAE,GAAG,CAAC,MAAM,CAAC;AACnE,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC;AACvF,CAAC,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC;AACtE,CAAC,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,wBAAwB,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC;AAChG,CAAC,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;AAChC;;;;"}

package/build/server/chunks/entries/hooks.server.js-BXvNmUf9.js

@@ -1,336 +0,0 @@
-import { b as private_env } from '../chunks/shared-server.js-BGs15m2r.js';
-import { S as SYSTEM_CONTEXT } from '../chunks/src.js-Cf1j97Z6.js';
-import { p as providers, g as getLogger, h as getErrorReporter, i as getEventSink } from '../chunks/providers.server.js-DQ1uVPlR.js';
-import { a as resolveRequestId, r as renderThrown, R as REQUEST_ID_HEADER } from '../chunks/definitions.js-DK6GL3vh.js';
-import { e as isApiError } from '../chunks/access.js-DFbcJ7ZG.js';
-import '../chunks/api.js-BF_dHNnR.js';
-import { g as getRefreshToken, s as setSessionCookie, a as setRefreshCookie, c as clearRefreshCookie } from '../chunks/admin-auth.server.js-I3ZwmT--.js';
-import { f as findDeploymentDir, s as startUpdateOutcomeReconciler } from '../chunks/selfUpdate.server.js-B_lTx07q.js';
-import { g as getBootHealth } from '../chunks/bootHealth.server.js-CsuNMcI6.js';
-import { w as wireHeaderAuthBootstrap, b as bootstrapUserSession } from '../chunks/auth-bootstrap.server.js-Z3bHapez.js';
-import { redirect, isHttpError } from '@sveltejs/kit';
-import 'zod';
-import '../chunks/limits.js-chQOq2eQ.js';
-import 'node:crypto';
-import 'node:url';
-import 'node:path';
-import 'node:fs';
-import 'node:fs/promises';
-import '@supabase/supabase-js';
-import '../chunks/schema.js-YChb_4u9.js';
-import '../chunks/update-outcome.js-Dl8LwqJM.js';
-
-//#region ../platform/src/userProfile/types.ts
-function emptyProfile(userId) {
-	return {
-		userId,
-		starredDefinitions: [],
-		recentRuns: []
-	};
-}
-//#endregion
-//#region ../server/src/http/security-headers.ts
-/**
-* Apply baseline browser-hardening headers to a response and return it for
-* chaining. Each is a cheap win that needs no UI verification:
-*
-*   - X-Content-Type-Options: nosniff — disables MIME sniffing.
-*   - Referrer-Policy: strict-origin-when-cross-origin — strips path and query
-*     from cross-origin Referer headers. Matches modern browser defaults, but
-*     pins the behavior in case a default drifts.
-*   - Permissions-Policy: opts out of browser APIs Selva-engine apps don't use,
-*     so XSS can't enable them.
-*   - HSTS when `opts.hsts`.
-*   - X-Frame-Options + `frame-ancestors 'none'` when `opts.denyFraming` — the
-*     caller opts in per route, since embeddable app routes must stay framable.
-*
-* **Intentionally NOT set here:**
-*   - A full Content-Security-Policy. Selva-engine apps are built for iframe
-*     embedding, so a strict CSP needs validating against real consumer sites
-*     before it can ship. `denyFraming` sets only the `frame-ancestors`
-*     directive, which constrains nothing else the page loads.
-*   - Cache-Control. Asset-path layout is app policy; set it in the caller.
-*/
-function applySecurityHeaders(response, opts) {
-	response.headers.set("X-Content-Type-Options", "nosniff");
-	response.headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
-	response.headers.set("Permissions-Policy", "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()");
-	if (opts.hsts) response.headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
-	if (opts.denyFraming) {
-		response.headers.set("X-Frame-Options", "DENY");
-		response.headers.set("Content-Security-Policy", "frame-ancestors 'none'");
-	}
-	return response;
-}
-//#endregion
-//#region ../server/src/http/route-classifier.ts
-function createRouteClassifier(config) {
-	const publicPages = new Set(config.publicPages ?? []);
-	const publicPrefixes = config.publicPrefixes ?? [];
-	const publicApis = new Set(config.publicApis ?? []);
-	const selfGatingPrefixes = [...config.selfGatingPrefixes ?? [], ...config.selfGatingPrefix !== void 0 ? [config.selfGatingPrefix] : []];
-	const staticPrefixes = config.staticPrefixes ?? [];
-	const staticPaths = new Set(config.staticPaths ?? []);
-	function isStaticAsset(pathname) {
-		if (staticPaths.has(pathname)) return true;
-		return staticPrefixes.some((p) => pathname.startsWith(p));
-	}
-	function isSelfGatingApiRoute(pathname) {
-		return selfGatingPrefixes.some((p) => pathname.startsWith(p));
-	}
-	function isPublicRoute(pathname) {
-		if (publicPages.has(pathname)) return true;
-		if (publicApis.has(pathname)) return true;
-		if (isSelfGatingApiRoute(pathname)) return true;
-		return publicPrefixes.some((p) => pathname.startsWith(p));
-	}
-	return {
-		isStaticAsset,
-		isSelfGatingApiRoute,
-		isPublicRoute
-	};
-}
-//#endregion
-//#region src/hooks.server.ts
-var headerAuthBootstrapWired = false;
-var bootHealthKicked = false;
-var proxyAuthLoginMissWarned = false;
-var firstRunResolved = false;
-async function isFirstRun() {
-	if (firstRunResolved) return false;
-	const usersPage = await providers.auth.listUsers({ limit: 1 });
-	if (usersPage === null) {
-		firstRunResolved = true;
-		return false;
-	}
-	if (usersPage.items.length === 0) return true;
-	firstRunResolved = true;
-	return false;
-}
-var ensuredUserIds = /* @__PURE__ */ new Set();
-async function ensureUserOnce(userId) {
-	if (ensuredUserIds.has(userId)) return;
-	await providers.data.ensureUser(SYSTEM_CONTEXT, userId);
-	ensuredUserIds.add(userId);
-}
-/**
-* Builds a per-request context from an authenticated user: resolves active-org
-* membership and its OrgPermissions.
-*
-* Active-org resolution: single tenancy picks the deployment's one org; multi
-* tenancy picks the first org the user belongs to (URL-prefix resolution via
-* `/o/{slug}/...` will replace this once routes are tenant-namespaced).
-*
-* Exported for tests: the fixture's `actAs()` mirrors this logic, so a direct
-* test pins the production function against drift.
-*/
-async function buildContext(user, sessionToken, platformPermissions, membership) {
-	let actingOrgId;
-	let orgPermissions = [];
-	if (membership) {
-		actingOrgId = membership.org.id;
-		orgPermissions = membership.member.permissions;
-	}
-	if (!actingOrgId && platformPermissions.includes("instance_admin")) {
-		const firstOrg = (await providers.data.orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items[0];
-		if (firstOrg) actingOrgId = firstOrg.id;
-	}
-	return {
-		userId: user.id,
-		actingOrgId,
-		platformPermissions,
-		orgPermissions,
-		adapterContext: sessionToken ? { sessionToken } : void 0
-	};
-}
-var PUBLIC_PAGE_ROUTES = /* @__PURE__ */ new Set([
-	"/",
-	"/login",
-	"/setup",
-	"/accept-invite"
-]);
-var { isStaticAsset, isSelfGatingApiRoute, isPublicRoute } = createRouteClassifier({
-	publicPages: PUBLIC_PAGE_ROUTES,
-	publicPrefixes: [
-		"/auth/",
-		"/logout",
-		"/docs/"
-	],
-	publicApis: ["/api/health", "/api/health/ready"],
-	selfGatingPrefixes: ["/api/files/", "/api/v1/solve-events"],
-	staticPrefixes: ["/_app/", "/favicon/"],
-	staticPaths: ["/favicon.svg", "/robots.txt"]
-});
-var handle = async ({ event, resolve }) => {
-	event.locals.providers = providers;
-	const requestId = resolveRequestId(event.request.headers);
-	event.locals.requestId = requestId;
-	event.locals.log = getLogger().child({
-		requestId,
-		method: event.request.method,
-		route: event.url.pathname
-	});
-	if (!headerAuthBootstrapWired) {
-		wireHeaderAuthBootstrap();
-		headerAuthBootstrapWired = true;
-	}
-	if (!bootHealthKicked) {
-		bootHealthKicked = true;
-		getBootHealth();
-		const deploymentDir = findDeploymentDir(private_env);
-		if (deploymentDir) startUpdateOutcomeReconciler({
-			deploymentDir,
-			emit: (e) => getEventSink().emit(e),
-			report: (err) => getErrorReporter().capture(err, { tags: { origin: "selfUpdate" } })
-		});
-	}
-	const { pathname } = event.url;
-	if (isStaticAsset(pathname)) return applyResponseHeaders(await resolve(event), pathname, requestId);
-	if (pathname === "/api/health" || pathname === "/api/health/ready") return applyResponseHeaders(await resolve(event), pathname, requestId);
-	const publicRoute = isPublicRoute(pathname);
-	const isJsonApiRoute = pathname.startsWith("/api/");
-	if (!publicRoute) {
-		if (await isFirstRun()) {
-			if (isJsonApiRoute) return applyResponseHeaders(new Response(JSON.stringify({
-				message: "Setup required",
-				code: "SETUP_REQUIRED"
-			}), {
-				status: 503,
-				headers: { "Content-Type": "application/json" }
-			}), pathname, requestId);
-			redirect(303, "/setup");
-		}
-	}
-	if (!publicRoute) {
-		let token = event.cookies.get("admin_session") ?? "";
-		let user = await providers.auth.verifyToken(token);
-		if (!user) {
-			const refreshToken = getRefreshToken(event.cookies);
-			const oauth = providers.auth.oauth;
-			if (refreshToken && oauth) {
-				const refreshed = await oauth.refreshSession(refreshToken);
-				if (refreshed) {
-					setSessionCookie(event.cookies, refreshed.sessionToken);
-					setRefreshCookie(event.cookies, refreshed.refreshToken);
-					token = refreshed.sessionToken;
-					user = await providers.auth.verifyToken(token);
-				} else clearRefreshCookie(event.cookies);
-			}
-		}
-		if (!user && providers.auth.proxyAuth) {
-			user = await providers.auth.proxyAuth.identifyFromHeaders(event.request.headers);
-			if (user) await bootstrapUserSession(user);
-		}
-		if (!user) {
-			if (isJsonApiRoute) return applyResponseHeaders(new Response(JSON.stringify({
-				message: "Your session has expired. Sign in again to continue.",
-				code: "UNAUTHORIZED"
-			}), {
-				status: 401,
-				headers: { "Content-Type": "application/json" }
-			}), pathname, requestId);
-			redirect(303, `/login?redirectTo=${encodeURIComponent(pathname)}`);
-		}
-		const [, profile, platformPermissions, membership] = await Promise.all([
-			ensureUserOnce(user.id),
-			providers.data.userProfile.getProfile(SYSTEM_CONTEXT, user.id),
-			providers.data.permissions.getFor(SYSTEM_CONTEXT, user.id),
-			providers.data.orgs.findUserMembership(SYSTEM_CONTEXT, user.id)
-		]);
-		event.locals.user = user;
-		event.locals.profile = profile ?? emptyProfile(user.id);
-		event.locals.ctx = await buildContext(user, token, platformPermissions, membership);
-	} else {
-		const wantsSessionAttach = PUBLIC_PAGE_ROUTES.has(pathname) || isSelfGatingApiRoute(pathname);
-		const token = wantsSessionAttach ? event.cookies.get("admin_session") ?? "" : "";
-		let user = token ? await providers.auth.verifyToken(token) : null;
-		if (!user && wantsSessionAttach && providers.auth.proxyAuth) {
-			user = await providers.auth.proxyAuth.identifyFromHeaders(event.request.headers);
-			if (!user && pathname === "/login" && !proxyAuthLoginMissWarned) {
-				proxyAuthLoginMissWarned = true;
-				const proxyAuth = providers.auth.proxyAuth;
-				const noHeaders = proxyAuth.hasNoIdentityHeaders(event.request.headers);
-				const configured = proxyAuth.configuredHeaderNames.join(", ");
-				if (noHeaders) event.locals.log.warn("/login was hit and NONE of the configured identity headers arrived. The forward-auth proxy is not reaching this process, or is not forwarding the configured headers. See the @selvajs/header-auth-provider README \"Verification\" section.", {
-					component: "HeaderAuth",
-					configuredHeaders: configured
-				});
-				else event.locals.log.warn("/login was hit but the UPN header was missing or the user is not allowlisted. Some headers arrived but identification still failed — check that the UPN header is populated and that the user has been added to header-allowlist.json.", {
-					component: "HeaderAuth",
-					configuredHeaders: configured
-				});
-			}
-		}
-		if (user) {
-			const [, profile, platformPermissions, membership] = await Promise.all([
-				ensureUserOnce(user.id),
-				providers.data.userProfile.getProfile(SYSTEM_CONTEXT, user.id),
-				providers.data.permissions.getFor(SYSTEM_CONTEXT, user.id),
-				providers.data.orgs.findUserMembership(SYSTEM_CONTEXT, user.id)
-			]);
-			event.locals.user = user;
-			event.locals.profile = profile ?? emptyProfile(user.id);
-			event.locals.ctx = await buildContext(user, token, platformPermissions, membership);
-		}
-	}
-	return applyResponseHeaders(await resolve(event), pathname, requestId);
-};
-var FRAME_DENIED_PREFIXES = [
-	"/admin",
-	"/setup",
-	"/login"
-];
-function deniesFraming(pathname) {
-	return FRAME_DENIED_PREFIXES.some((p) => pathname === p || pathname.startsWith(`${p}/`));
-}
-function applyResponseHeaders(response, pathname, requestId) {
-	applySecurityHeaders(response, {
-		hsts: process.env.NODE_ENV === "production",
-		denyFraming: deniesFraming(pathname)
-	});
-	response.headers.set(REQUEST_ID_HEADER, requestId);
-	if (pathname.startsWith("/_app/")) response.headers.set("Cache-Control", "public, max-age=31536000, immutable");
-	else if (pathname.startsWith("/favicon/") || pathname === "/favicon.svg" || pathname === "/robots.txt") response.headers.set("Cache-Control", "public, max-age=604800");
-	return response;
-}
-var handleError = ({ error, status, event }) => {
-	if (isHttpError(error)) {
-		const body = error.body;
-		return {
-			message: body.message,
-			code: body.code,
-			fields: body.fields
-		};
-	}
-	if (isApiError(error)) return {
-		message: error.message,
-		code: error.code,
-		fields: error.fields
-	};
-	if (status === 404) return {
-		message: "Page not found.",
-		code: "NOT_FOUND"
-	};
-	(event.locals.log ?? getLogger().child({
-		method: event.request.method,
-		route: event.url.pathname
-	})).error("Unhandled error", {
-		component: "handleError",
-		status,
-		err: renderThrown(error),
-		cause: error instanceof Error && error.cause ? String(error.cause) : void 0
-	});
-	getErrorReporter().capture(error, {
-		method: event.request.method,
-		route: event.url.pathname,
-		userId: event.locals.ctx?.userId || void 0,
-		orgId: event.locals.ctx?.actingOrgId
-	});
-	return {
-		message: "An unexpected error occurred.",
-		code: "INTERNAL"
-	};
-};
-
-export { buildContext, handle, handleError, isPublicRoute, isSelfGatingApiRoute, isStaticAsset };
-//# sourceMappingURL=hooks.server.js-BXvNmUf9.js.map