@selvajs/selva 4.20.0-beta.0 → 4.20.0-beta.1

package/build/server/chunks/chunks/admin-auth.server.js-cTHF0WiI.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-auth.server.js-cTHF0WiI.js","sources":["../../../../.svelte-kit/output/server/chunks/admin-auth.server.js"],"sourcesContent":["import { t as private_env } from \"./shared-server.js\";\nimport { _ as narrowApiTokenContext, t as SYSTEM_CONTEXT } from \"./src.js\";\nimport { M as ApiErrorCode } from \"./access.js\";\nimport { r as looksLikeApiToken } from \"./api-token-codec.js\";\nimport { error } from \"@sveltejs/kit\";\n/** Each limiter owns its own bucket `Map`, so distinct key-spaces don't collide. */\nfunction createComputeRateLimiter(config) {\n\tconst { windowMs, maxPerWindow } = config;\n\tconst maxKeys = Math.max(1, Math.floor(config.maxKeys ?? 1e5));\n\tconst sweepIntervalMs = Math.max(0, Math.floor(config.sweepIntervalMs ?? windowMs));\n\tconst resolvedConfig = Object.freeze({\n\t\t...config,\n\t\tmaxKeys,\n\t\tsweepIntervalMs\n\t});\n\tconst buckets = /* @__PURE__ */ new Map();\n\tlet nextSweepAt = Number.POSITIVE_INFINITY;\n\t/**\n\t* Drop dead buckets, then enforce the hard cap. Runs at most once per\n\t* `sweepIntervalMs` — except when the cap is already breached, which must be\n\t* enforced on the spot regardless of the sweep clock.\n\t*\n\t* `headroom` is how many buckets the caller is about to insert. The cap is\n\t* enforced against the post-insert size, so `maxKeys` is a true ceiling rather\n\t* than one the very next write steps over.\n\t*/\n\tfunction maybeSweep(now, headroom = 0) {\n\t\tconst budget = Math.max(0, maxKeys - headroom);\n\t\tif (!(sweepIntervalMs > 0 && now >= nextSweepAt) && buckets.size <= budget) return;\n\t\tfor (const [key, entry] of buckets) if (now > entry.resetAt) buckets.delete(key);\n\t\tif (sweepIntervalMs > 0) nextSweepAt = now + sweepIntervalMs;\n\t\tif (buckets.size > budget) {\n\t\t\tconst byResetAsc = [...buckets.entries()].sort((a, b) => a[1].resetAt - b[1].resetAt);\n\t\t\tfor (let i = 0; i < byResetAsc.length - budget; i++) buckets.delete(byResetAsc[i][0]);\n\t\t}\n\t}\n\treturn {\n\t\tconfig: resolvedConfig,\n\t\tcheck(key) {\n\t\t\tconst now = Date.now();\n\t\t\tmaybeSweep(now, buckets.has(key) ? 0 : 1);\n\t\t\tconst entry = buckets.get(key);\n\t\t\tif (!entry || now > entry.resetAt) {\n\t\t\t\tbuckets.set(key, {\n\t\t\t\t\tcount: 1,\n\t\t\t\t\tresetAt: now + windowMs\n\t\t\t\t});\n\t\t\t\tif (sweepIntervalMs > 0 && nextSweepAt === Number.POSITIVE_INFINITY) nextSweepAt = now + sweepIntervalMs;\n\t\t\t\treturn { allowed: true };\n\t\t\t}\n\t\t\tif (entry.count >= maxPerWindow) return {\n\t\t\t\tallowed: false,\n\t\t\t\tretryAfter: Math.ceil((entry.resetAt - now) / 1e3)\n\t\t\t};\n\t\t\tentry.count += 1;\n\t\t\treturn { allowed: true };\n\t\t},\n\t\tpeek(key) {\n\t\t\tconst now = Date.now();\n\t\t\tmaybeSweep(now);\n\t\t\tconst entry = buckets.get(key);\n\t\t\tif (!entry || now > entry.resetAt) return { allowed: true };\n\t\t\tif (entry.count >= maxPerWindow) return {\n\t\t\t\tallowed: false,\n\t\t\t\tretryAfter: Math.ceil((entry.resetAt - now) / 1e3)\n\t\t\t};\n\t\t\treturn { allowed: true };\n\t\t},\n\t\tclear(key) {\n\t\t\tbuckets.delete(key);\n\t\t},\n\t\tcount(key) {\n\t\t\tconst entry = buckets.get(key);\n\t\t\tif (!entry || Date.now() > entry.resetAt) return 0;\n\t\t\treturn entry.count;\n\t\t},\n\t\treset() {\n\t\t\tbuckets.clear();\n\t\t\tnextSweepAt = Number.POSITIVE_INFINITY;\n\t\t},\n\t\tsize() {\n\t\t\treturn buckets.size;\n\t\t}\n\t};\n}\n//#endregion\n//#region ../server/src/http/body-size.ts\n/**\n* True when the request's declared `Content-Length` exceeds `maxBytes`. Call it\n* BEFORE reading the body, so a huge payload aimed at a small-body endpoint\n* can't burn memory; the route maps `true` to its transport's 413.\n*\n* This is the per-route lower bound. A global limit (e.g. adapter-node's\n* `BODY_SIZE_LIMIT`) has to clear the largest legitimate upload, so every small\n* JSON endpoint would otherwise inherit that ceiling.\n*\n* Requests without `Content-Length` (chunked encoding) slip past this check —\n* the global limit is the backstop there.\n*/\nfunction declaredBodySizeExceeds(headers, maxBytes) {\n\tconst declared = Number(headers.get(\"content-length\"));\n\treturn Number.isFinite(declared) && declared > maxBytes;\n}\n//#endregion\n//#region ../server/src/http/login-rate-limit.ts\n/**\n* Login rate limiting: two buckets per attempt, because neither dimension\n* covers the other.\n*\n*   - **Per-address** bounds one client hammering the form. It is only\n*     meaningful when the host resolves a real client address. Behind a reverse\n*     proxy that is not configured to forward one, every request reports the\n*     socket peer — `127.0.0.1` for all of them — which collapses the whole key\n*     space into a single bucket: five failed logins from anywhere lock out the\n*     entire instance, and only a success clears it, which nobody can now\n*     reach. That failure is completely silent, hence\n*     {@link addressKeysCollapsed}.\n*   - **Per-account** bounds a targeted guessing attack, which address limiting\n*     does not: an attacker spread across many source IPs contends with no\n*     shared counter at all, leaving password-hash cost as the only real bound\n*     on online guessing.\n*\n* An attempt must clear both and a failure charges both. A success clears the\n* account bucket and the calling address's — a *different* address that failed\n* against the same account keeps its own penalty.\n*\n* The flow counts failures rather than attempts: `check` gates without spending\n* budget, `recordFailure` spends, and `clear` forgives. A successful login\n* therefore costs nothing, so an ordinary user typing one wrong password never\n* walks toward a lockout.\n*/\n/** Loopback in the three spellings a Node server actually reports. */\nvar LOOPBACK = /* @__PURE__ */ new Set([\n\t\"127.0.0.1\",\n\t\"::1\",\n\t\"::ffff:127.0.0.1\"\n]);\n/** Normalized so case tricks (`Alice@` vs `alice@`) share one bucket. */\nfunction accountKey(email) {\n\treturn `account:${email.trim().toLowerCase()}`;\n}\nfunction createLoginRateLimiter(config = {}) {\n\tconst windowMs = config.windowMs ?? 9e5;\n\tconst byAddress = createComputeRateLimiter({\n\t\twindowMs,\n\t\tmaxPerWindow: config.maxPerAddress ?? 5\n\t});\n\tconst byAccount = createComputeRateLimiter({\n\t\twindowMs,\n\t\tmaxPerWindow: config.maxPerAccount ?? 20\n\t});\n\treturn {\n\t\tcheck(address, email) {\n\t\t\tconst address_ = byAddress.peek(address);\n\t\t\tif (!address_.allowed || !email) return address_;\n\t\t\treturn byAccount.peek(accountKey(email));\n\t\t},\n\t\trecordFailure(address, email) {\n\t\t\tbyAddress.check(address);\n\t\t\tif (email) byAccount.check(accountKey(email));\n\t\t},\n\t\tclear(address, email) {\n\t\t\tbyAddress.clear(address);\n\t\t\tif (email) byAccount.clear(accountKey(email));\n\t\t},\n\t\treset() {\n\t\t\tbyAddress.reset();\n\t\t\tbyAccount.reset();\n\t\t}\n\t};\n}\n/**\n* Whether per-address limiting has degenerated into one shared bucket.\n*\n* True when the host reports a loopback address for a request it did not\n* originate — which means it sits behind a proxy and is reading the socket peer\n* instead of a forwarded client address. The host decides what to do about it;\n* warning once at startup is enough, and warning per request is not.\n*\n* `addressHeaderConfigured` is the host's answer to \"am I reading a forwarded\n* header at all\", since which header and how many hops to trust are deployment\n* config that no package can resolve for it.\n*/\nfunction addressKeysCollapsed(address, addressHeaderConfigured) {\n\tif (addressHeaderConfigured) return false;\n\treturn LOOPBACK.has(address);\n}\n//#endregion\n//#region ../server/src/http/request-context.ts\n/**\n* One request's identity: the acting org and the permissions held there.\n*\n* Every sign-in path builds through here (cookie, forward-auth, API token, and\n* any host app's own hook), so they can't drift on what a context contains.\n*/\nasync function buildRequestContext(input, deps) {\n\tconst { user, platformPermissions, membership, sessionToken, pinOrg } = input;\n\tlet actingOrgId = membership?.orgId;\n\tconst orgPermissions = membership ? [...membership.permissions] : [];\n\tif (!actingOrgId && !pinOrg && platformPermissions.includes(\"instance_admin\")) {\n\t\tconst firstOrg = (await deps.orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items[0];\n\t\tif (firstOrg) actingOrgId = firstOrg.id;\n\t}\n\treturn {\n\t\tuserId: user.id,\n\t\tactingOrgId,\n\t\tplatformPermissions,\n\t\torgPermissions,\n\t\tadapterContext: sessionToken ? { sessionToken } : void 0\n\t};\n}\n//#endregion\n//#region ../server/src/http/api-token.ts\n/** `lastUsedAt` is written at most this often per token, so a busy key isn't a write per request. */\nvar LAST_USED_WRITE_INTERVAL_MS = 3e5;\nvar UNAUTHORIZED = {\n\tkind: \"rejected\",\n\tstatus: 401,\n\tcode: ApiErrorCode.UNAUTHORIZED,\n\tmessage: \"This API token is invalid, expired or revoked.\"\n};\nvar UNAVAILABLE = {\n\tkind: \"rejected\",\n\tstatus: 503,\n\tcode: ApiErrorCode.API_TOKENS_UNAVAILABLE,\n\tmessage: \"API tokens are not available on this server.\"\n};\n/**\n* Authenticate a request by its `Authorization: Bearer selva_…` header.\n*\n* Call it before any cookie or proxy sign-in. Once a `selva_` key is sent the\n* outcome is final: a bad key gets 401 even if a valid session cookie rides\n* along, because running the request as the cookie's user would hide the\n* broken key and act as someone else.\n*\n* The owner is re-checked on every request (disabled, still a member of the\n* token's org), then their live context is narrowed to the token's scopes.\n*/\nasync function resolveApiToken(request, deps, { pathPrefix = \"/api/v1/\" } = {}) {\n\tconst url = new URL(request.url);\n\tfor (const value of url.searchParams.values()) if (looksLikeApiToken(value)) return {\n\t\tkind: \"rejected\",\n\t\tstatus: 400,\n\t\tcode: ApiErrorCode.VALIDATION_FAILED,\n\t\tmessage: \"API tokens go in the Authorization header, never the URL. URLs end up in logs and browser history; revoke this key.\"\n\t};\n\tconst raw = bearerOf(request);\n\tif (!raw?.startsWith(\"selva_\")) return { kind: \"none\" };\n\tif (!url.pathname.startsWith(pathPrefix)) return {\n\t\tkind: \"rejected\",\n\t\tstatus: 403,\n\t\tcode: ApiErrorCode.FORBIDDEN,\n\t\tmessage: `API tokens only work under ${pathPrefix}.`\n\t};\n\tconst store = deps.data.apiTokens;\n\tif (!deps.codec || !store) return UNAVAILABLE;\n\tconst delegated = deps.auth.delegatedSession;\n\tif (delegated && !(await delegated.status()).ok) return UNAVAILABLE;\n\tif (!deps.codec.hasValidChecksum(raw)) return UNAUTHORIZED;\n\tconst token = await store.getByTokenHash(SYSTEM_CONTEXT, deps.codec.hashToken(raw));\n\tif (!token) return UNAUTHORIZED;\n\tconst [user, member] = await Promise.all([deps.auth.getUser(token.userId), deps.data.orgs.getOrgMember(SYSTEM_CONTEXT, token.orgId, token.userId)]);\n\tif (!user || user.disabled || !member) return UNAUTHORIZED;\n\tlet ctx = narrowApiTokenContext(await buildRequestContext({\n\t\tuser,\n\t\tplatformPermissions: [],\n\t\tmembership: member,\n\t\tpinOrg: true\n\t}, { orgs: deps.data.orgs }), token);\n\tif (delegated) {\n\t\tconst sessionToken = await delegated.mint(user.id, { orgId: token.orgId });\n\t\tctx = {\n\t\t\t...ctx,\n\t\t\tadapterContext: { sessionToken }\n\t\t};\n\t}\n\tconst now = deps.now?.() ?? Date.now();\n\tif (!token.lastUsedAt || now - Date.parse(token.lastUsedAt) >= LAST_USED_WRITE_INTERVAL_MS) store.touchLastUsed(SYSTEM_CONTEXT, token.id, new Date(now).toISOString()).catch((err) => {\n\t\tdeps.log?.warn(\"Failed to record API token use\", {\n\t\t\tcomponent: \"apiToken\",\n\t\t\ttokenId: token.id,\n\t\t\terr: err instanceof Error ? err.message : String(err)\n\t\t});\n\t});\n\treturn {\n\t\tkind: \"ok\",\n\t\tuser,\n\t\tctx,\n\t\ttoken\n\t};\n}\nfunction bearerOf(request) {\n\tconst header = request.headers.get(\"authorization\");\n\tif (!header) return null;\n\tconst match = /^Bearer\\s+(\\S+)\\s*$/i.exec(header);\n\treturn match ? match[1] : null;\n}\n//#endregion\n//#region src/lib/server/admin-auth.server.ts\nvar SESSION_COOKIE_NAME = \"admin_session\";\nvar SESSION_MAX_AGE_MS = 288e5;\nvar REFRESH_COOKIE_NAME = \"admin_refresh\";\nvar REFRESH_MAX_AGE_MS = 2592e6;\nvar loginRateLimiter = createLoginRateLimiter();\nfunction checkRateLimit(ip, email) {\n\treturn loginRateLimiter.check(ip, email);\n}\nfunction recordFailedAttempt(ip, email) {\n\tloginRateLimiter.recordFailure(ip, email);\n}\nfunction clearRateLimit(ip, email) {\n\tloginRateLimiter.clear(ip, email);\n}\nvar addressWarningIssued = false;\nfunction warnIfAddressKeysCollapse(ip, log) {\n\tif (addressWarningIssued) return;\n\tif (!private_env.ORIGIN) return;\n\tif (!addressKeysCollapsed(ip, Boolean(private_env.ADDRESS_HEADER))) return;\n\taddressWarningIssued = true;\n\tlog.warn(\"Login rate limiting is keyed to the loopback address for every request. The app is behind a proxy but ADDRESS_HEADER is unset, so getClientAddress() returns the socket peer and all clients share one bucket — five failed logins lock out the whole instance. Set ADDRESS_HEADER=X-Forwarded-For and XFF_DEPTH to your proxy count (see .env.example).\", { component: \"auth/rate-limit\" });\n}\nfunction setSessionCookie(cookies, sessionToken) {\n\tconst isSecure = process.env.NODE_ENV === \"production\" && private_env.ALLOW_INSECURE_COOKIES !== \"true\";\n\tcookies.set(SESSION_COOKIE_NAME, sessionToken, {\n\t\tpath: \"/\",\n\t\thttpOnly: true,\n\t\tsameSite: \"lax\",\n\t\tsecure: isSecure,\n\t\tmaxAge: SESSION_MAX_AGE_MS / 1e3\n\t});\n}\n/** Call before `destroySession` — logout needs the token to revoke it provider-side. */\nfunction getSessionToken(cookies) {\n\treturn cookies.get(SESSION_COOKIE_NAME);\n}\nfunction destroySession(cookies) {\n\tcookies.delete(SESSION_COOKIE_NAME, { path: \"/\" });\n\tcookies.delete(REFRESH_COOKIE_NAME, { path: \"/\" });\n}\n/**\n* Refresh-token cookie for the OAuth/Supabase flow — `hooks.server.ts`'s\n* session-refresh middleware swaps an expired access token for a fresh one\n* using this. Local/HMAC sessions don't need it.\n*/\nfunction setRefreshCookie(cookies, refreshToken) {\n\tconst isSecure = process.env.NODE_ENV === \"production\" && private_env.ALLOW_INSECURE_COOKIES !== \"true\";\n\tcookies.set(REFRESH_COOKIE_NAME, refreshToken, {\n\t\tpath: \"/\",\n\t\thttpOnly: true,\n\t\tsameSite: \"lax\",\n\t\tsecure: isSecure,\n\t\tmaxAge: REFRESH_MAX_AGE_MS / 1e3\n\t});\n}\nfunction getRefreshToken(cookies) {\n\treturn cookies.get(REFRESH_COOKIE_NAME);\n}\nfunction clearRefreshCookie(cookies) {\n\tcookies.delete(REFRESH_COOKIE_NAME, { path: \"/\" });\n}\n/**\n* Rejects a request whose declared `Content-Length` exceeds `maxBytes` — a\n* per-route lower bound under the global adapter-node `BODY_SIZE_LIMIT`\n* (which must stay high enough for 50MB .gh uploads). Throws 413 before the\n* body is read; see `declaredBodySizeExceeds` for the chunked-encoding caveat.\n*/\nfunction requireMaxBodySize(request, maxBytes) {\n\tif (declaredBodySizeExceeds(request.headers, maxBytes)) throw error(413, `Request body exceeds the limit for this endpoint.`);\n}\n//#endregion\nexport { getRefreshToken as a, requireMaxBodySize as c, warnIfAddressKeysCollapse as d, resolveApiToken as f, destroySession as i, setRefreshCookie as l, createComputeRateLimiter as m, clearRateLimit as n, getSessionToken as o, buildRequestContext as p, clearRefreshCookie as r, recordFailedAttempt as s, checkRateLimit as t, setSessionCookie as u };\n"],"names":[],"mappings":";;;;;;AAKA;AACA,SAAS,wBAAwB,CAAC,MAAM,EAAE;AAC1C,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM;AAC1C,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC;AAC/D,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,IAAI,QAAQ,CAAC,CAAC;AACpF,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;AACtC,EAAE,GAAG,MAAM;AACX,EAAE,OAAO;AACT,EAAE;AACF,EAAE,CAAC;AACH,CAAC,MAAM,OAAO,mBAAmB,IAAI,GAAG,EAAE;AAC1C,CAAC,IAAI,WAAW,GAAG,MAAM,CAAC,iBAAiB;AAC3C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,SAAS,UAAU,CAAC,GAAG,EAAE,QAAQ,GAAG,CAAC,EAAE;AACxC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;AAChD,EAAE,IAAI,EAAE,eAAe,GAAG,CAAC,IAAI,GAAG,IAAI,WAAW,CAAC,IAAI,OAAO,CAAC,IAAI,IAAI,MAAM,EAAE;AAC9E,EAAE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;AAClF,EAAE,IAAI,eAAe,GAAG,CAAC,EAAE,WAAW,GAAG,GAAG,GAAG,eAAe;AAC9D,EAAE,IAAI,OAAO,CAAC,IAAI,GAAG,MAAM,EAAE;AAC7B,GAAG,MAAM,UAAU,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AACxF,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxF,EAAE;AACF,CAAC;AACD,CAAC,OAAO;AACR,EAAE,MAAM,EAAE,cAAc;AACxB,EAAE,KAAK,CAAC,GAAG,EAAE;AACb,GAAG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;AACzB,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC5C,GAAG,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;AACjC,GAAG,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE;AACtC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE;AACrB,KAAK,KAAK,EAAE,CAAC;AACb,KAAK,OAAO,EAAE,GAAG,GAAG;AACpB,KAAK,CAAC;AACN,IAAI,IAAI,eAAe,GAAG,CAAC,IAAI,WAAW,KAAK,MAAM,CAAC,iBAAiB,EAAE,WAAW,GAAG,GAAG,GAAG,eAAe;AAC5G,IAAI,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;AAC5B,GAAG;AACH,GAAG,IAAI,KAAK,CAAC,KAAK,IAAI,YAAY,EAAE,OAAO;AAC3C,IAAI,OAAO,EAAE,KAAK;AAClB,IAAI,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,IAAI,GAAG;AACrD,IAAI;AACJ,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC;AACnB,GAAG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;AAC3B,EAAE,CAAC;AACH,EAAE,IAAI,CAAC,GAAG,EAAE;AACZ,GAAG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;AACzB,GAAG,UAAU,CAAC,GAAG,CAAC;AAClB,GAAG,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;AACjC,GAAG,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;AAC9D,GAAG,IAAI,KAAK,CAAC,KAAK,IAAI,YAAY,EAAE,OAAO;AAC3C,IAAI,OAAO,EAAE,KAAK;AAClB,IAAI,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,IAAI,GAAG;AACrD,IAAI;AACJ,GAAG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;AAC3B,EAAE,CAAC;AACH,EAAE,KAAK,CAAC,GAAG,EAAE;AACb,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;AACtB,EAAE,CAAC;AACH,EAAE,KAAK,CAAC,GAAG,EAAE;AACb,GAAG,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;AACjC,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC;AACrD,GAAG,OAAO,KAAK,CAAC,KAAK;AACrB,EAAE,CAAC;AACH,EAAE,KAAK,GAAG;AACV,GAAG,OAAO,CAAC,KAAK,EAAE;AAClB,GAAG,WAAW,GAAG,MAAM,CAAC,iBAAiB;AACzC,EAAE,CAAC;AACH,EAAE,IAAI,GAAG;AACT,GAAG,OAAO,OAAO,CAAC,IAAI;AACtB,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,uBAAuB,CAAC,OAAO,EAAE,QAAQ,EAAE;AACpD,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AACvD,CAAC,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,QAAQ;AACxD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,QAAQ,mBAAmB,IAAI,GAAG,CAAC;AACvC,CAAC,WAAW;AACZ,CAAC,KAAK;AACN,CAAC;AACD,CAAC,CAAC;AACF;AACA,SAAS,UAAU,CAAC,KAAK,EAAE;AAC3B,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AAC/C;AACA,SAAS,sBAAsB,CAAC,MAAM,GAAG,EAAE,EAAE;AAC7C,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,GAAG;AACxC,CAAC,MAAM,SAAS,GAAG,wBAAwB,CAAC;AAC5C,EAAE,QAAQ;AACV,EAAE,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI;AACxC,EAAE,CAAC;AACH,CAAC,MAAM,SAAS,GAAG,wBAAwB,CAAC;AAC5C,EAAE,QAAQ;AACV,EAAE,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI;AACxC,EAAE,CAAC;AACH,CAAC,OAAO;AACR,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE;AACxB,GAAG,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;AAC3C,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,OAAO,QAAQ;AACnD,GAAG,OAAO,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;AAC3C,EAAE,CAAC;AACH,EAAE,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE;AAChC,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;AAC3B,GAAG,IAAI,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;AAChD,EAAE,CAAC;AACH,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE;AACxB,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;AAC3B,GAAG,IAAI,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;AAChD,EAAE,CAAC;AACH,EAAE,KAAK,GAAG;AACV,GAAG,SAAS,CAAC,KAAK,EAAE;AACpB,GAAG,SAAS,CAAC,KAAK,EAAE;AACpB,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,oBAAoB,CAAC,OAAO,EAAE,uBAAuB,EAAE;AAChE,CAAC,IAAI,uBAAuB,EAAE,OAAO,KAAK;AAC1C,CAAC,OAAO,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;AAC7B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,mBAAmB,CAAC,KAAK,EAAE,IAAI,EAAE;AAChD,CAAC,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,KAAK;AAC9E,CAAC,IAAI,WAAW,GAAG,UAAU,EAAE,KAAK;AACpC,CAAC,MAAM,cAAc,GAAG,UAAU,GAAG,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,EAAE;AACrE,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,IAAI,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE;AAChF,EAAE,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AACpF,EAAE,IAAI,QAAQ,EAAE,WAAW,GAAG,QAAQ,CAAC,EAAE;AACzC,CAAC;AACD,CAAC,OAAO;AACR,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;AACjB,EAAE,WAAW;AACb,EAAE,mBAAmB;AACrB,EAAE,cAAc;AAChB,EAAE,cAAc,EAAE,YAAY,GAAG,EAAE,YAAY,EAAE,GAAG;AACpD,EAAE;AACF;AACA;AACA;AACA;AACA,IAAI,2BAA2B,GAAG,GAAG;AACrC,IAAI,YAAY,GAAG;AACnB,CAAC,IAAI,EAAE,UAAU;AACjB,CAAC,MAAM,EAAE,GAAG;AACZ,CAAC,IAAI,EAAE,YAAY,CAAC,YAAY;AAChC,CAAC,OAAO,EAAE;AACV,CAAC;AACD,IAAI,WAAW,GAAG;AAClB,CAAC,IAAI,EAAE,UAAU;AACjB,CAAC,MAAM,EAAE,GAAG;AACZ,CAAC,IAAI,EAAE,YAAY,CAAC,sBAAsB;AAC1C,CAAC,OAAO,EAAE;AACV,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,UAAU,GAAG,UAAU,EAAE,GAAG,EAAE,EAAE;AAChF,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;AACjC,CAAC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,OAAO;AACrF,EAAE,IAAI,EAAE,UAAU;AAClB,EAAE,MAAM,EAAE,GAAG;AACb,EAAE,IAAI,EAAE,YAAY,CAAC,iBAAiB;AACtC,EAAE,OAAO,EAAE;AACX,EAAE;AACF,CAAC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC;AAC9B,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE;AACxD,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,OAAO;AAClD,EAAE,IAAI,EAAE,UAAU;AAClB,EAAE,MAAM,EAAE,GAAG;AACb,EAAE,IAAI,EAAE,YAAY,CAAC,SAAS;AAC9B,EAAE,OAAO,EAAE,CAAC,2BAA2B,EAAE,UAAU,CAAC,CAAC;AACrD,EAAE;AACF,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS;AAClC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,OAAO,WAAW;AAC9C,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB;AAC7C,CAAC,IAAI,SAAS,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,WAAW;AACpE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,YAAY;AAC3D,CAAC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;AACpF,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,YAAY;AAChC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;AACpJ,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,OAAO,YAAY;AAC3D,CAAC,IAAI,GAAG,GAAG,qBAAqB,CAAC,MAAM,mBAAmB,CAAC;AAC3D,EAAE,IAAI;AACN,EAAE,mBAAmB,EAAE,EAAE;AACzB,EAAE,UAAU,EAAE,MAAM;AACpB,EAAE,MAAM,EAAE;AACV,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC;AACrC,CAAC,IAAI,SAAS,EAAE;AAChB,EAAE,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;AAC5E,EAAE,GAAG,GAAG;AACR,GAAG,GAAG,GAAG;AACT,GAAG,cAAc,EAAE,EAAE,YAAY;AACjC,GAAG;AACH,CAAC;AACD,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE;AACvC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,2BAA2B,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK;AACvL,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,gCAAgC,EAAE;AACnD,GAAG,SAAS,EAAE,UAAU;AACxB,GAAG,OAAO,EAAE,KAAK,CAAC,EAAE;AACpB,GAAG,GAAG,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG;AACvD,GAAG,CAAC;AACJ,CAAC,CAAC,CAAC;AACH,CAAC,OAAO;AACR,EAAE,IAAI,EAAE,IAAI;AACZ,EAAE,IAAI;AACN,EAAE,GAAG;AACL,EAAE;AACF,EAAE;AACF;AACA,SAAS,QAAQ,CAAC,OAAO,EAAE;AAC3B,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;AACpD,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI;AACzB,CAAC,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC;AAClD,CAAC,OAAO,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI;AAC/B;AACA;AACA;AACA,IAAI,mBAAmB,GAAG,eAAe;AACzC,IAAI,kBAAkB,GAAG,KAAK;AAC9B,IAAI,mBAAmB,GAAG,eAAe;AACzC,IAAI,kBAAkB,GAAG,MAAM;AAC/B,IAAI,gBAAgB,GAAG,sBAAsB,EAAE;AAC/C,SAAS,cAAc,CAAC,EAAE,EAAE,KAAK,EAAE;AACnC,CAAC,OAAO,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC;AACzC;AACA,SAAS,mBAAmB,CAAC,EAAE,EAAE,KAAK,EAAE;AACxC,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,KAAK,CAAC;AAC1C;AACA,SAAS,cAAc,CAAC,EAAE,EAAE,KAAK,EAAE;AACnC,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC;AAClC;AACA,IAAI,oBAAoB,GAAG,KAAK;AAChC,SAAS,yBAAyB,CAAC,EAAE,EAAE,GAAG,EAAE;AAC5C,CAAC,IAAI,oBAAoB,EAAE;AAC3B,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE;AAC1B,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAAE,EAAE,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,EAAE;AACrE,CAAC,oBAAoB,GAAG,IAAI;AAC5B,CAAC,GAAG,CAAC,IAAI,CAAC,0VAA0V,EAAE,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;AACvY;AACA,SAAS,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE;AACjD,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,WAAW,CAAC,sBAAsB,KAAK,MAAM;AACxG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,YAAY,EAAE;AAChD,EAAE,IAAI,EAAE,GAAG;AACX,EAAE,QAAQ,EAAE,IAAI;AAChB,EAAE,QAAQ,EAAE,KAAK;AACjB,EAAE,MAAM,EAAE,QAAQ;AAClB,EAAE,MAAM,EAAE,kBAAkB,GAAG;AAC/B,EAAE,CAAC;AACH;AACA;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AACxC;AACA,SAAS,cAAc,CAAC,OAAO,EAAE;AACjC,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACnD,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACnD;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE;AACjD,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,WAAW,CAAC,sBAAsB,KAAK,MAAM;AACxG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,YAAY,EAAE;AAChD,EAAE,IAAI,EAAE,GAAG;AACX,EAAE,QAAQ,EAAE,IAAI;AAChB,EAAE,QAAQ,EAAE,KAAK;AACjB,EAAE,MAAM,EAAE,QAAQ;AAClB,EAAE,MAAM,EAAE,kBAAkB,GAAG;AAC/B,EAAE,CAAC;AACH;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AACxC;AACA,SAAS,kBAAkB,CAAC,OAAO,EAAE;AACrC,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACnD;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,kBAAkB,CAAC,OAAO,EAAE,QAAQ,EAAE;AAC/C,CAAC,IAAI,uBAAuB,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,iDAAiD,CAAC,CAAC;AAC9H;;;;"}

package/build/server/chunks/chunks/api-errors.js-D22nCtri.js

@@ -0,0 +1,69 @@
+import { P as ProviderError } from './src.js-bYgw0r8C.js';
+import { r as renderThrown } from './definitions.js-BCLhFUqp.js';
+import { d as isApiError, S as SchemaExtractionError, A as ApiErrorCode } from './access.js-CVIHaHje.js';
+import { C as ComputeServerUnconfiguredError } from './api.js-CQUUF_Xg.js';
+import 'node:dns/promises';
+import 'node:net';
+import { error, isHttpError } from '@sveltejs/kit';
+
+//#region src/lib/server/api-errors.ts
+/**
+* Thin wrapper over SvelteKit's `error()` that forces the `{ message, code }`
+* envelope. Use instead of `error(status, 'message string')` so every error
+* carries a code.
+*/
+function apiError(status, code, message, fields, details) {
+	throw error(status, {
+		message,
+		code,
+		...fields && { fields },
+		...details && { details }
+	});
+}
+/** Default code for a given HTTP status, used when mapping opaque errors. */
+function codeForStatus(status) {
+	switch (status) {
+		case 400: return ApiErrorCode.VALIDATION_FAILED;
+		case 401: return ApiErrorCode.UNAUTHORIZED;
+		case 403: return ApiErrorCode.FORBIDDEN;
+		case 404: return ApiErrorCode.NOT_FOUND;
+		case 409: return ApiErrorCode.CONFLICT;
+		case 422: return ApiErrorCode.UNPROCESSABLE;
+		case 503: return ApiErrorCode.COMPUTE_UNAVAILABLE;
+		default: return ApiErrorCode.INTERNAL;
+	}
+}
+var UNIQUE_CONSTRAINT_MESSAGES = {
+	projects_org_name_unique: "A project with that name already exists in this organization.",
+	projects_org_id_slug_key: "A project with that name already exists in this organization.",
+	orgs_slug_key: "An organization with that slug already exists.",
+	definitions_pkey: "A definition with that ID already exists."
+};
+function friendlyConstraintMessage(raw) {
+	for (const [name, msg] of Object.entries(UNIQUE_CONSTRAINT_MESSAGES)) if (raw.includes(name)) return msg;
+	return null;
+}
+/** Normalizes any error raised inside an API handler to a structured SvelteKit HTTP error. */
+function handleApiError(err, fallback, log) {
+	if (isHttpError(err)) throw err;
+	if (isApiError(err)) apiError(err.status, err.code, err.message, err.fields, err.details);
+	if (err instanceof SchemaExtractionError) {
+		if (err.kind === "unreachable" || err.kind === "malformed") apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, err.message);
+		apiError(422, ApiErrorCode.UNPROCESSABLE, err.message);
+	}
+	if (err instanceof ComputeServerUnconfiguredError) apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, err.message);
+	if (err instanceof ProviderError) {
+		const friendly = friendlyConstraintMessage(err.message);
+		apiError(err.statusCode, codeForStatus(err.statusCode), friendly ?? err.message);
+	}
+	const rendered = renderThrown(err);
+	if (log) log.error(`[API] ${fallback}`, {
+		component: "api",
+		err: rendered
+	});
+	else console.error(`[API] ${fallback}:`, rendered);
+	apiError(500, ApiErrorCode.INTERNAL, fallback);
+}
+
+export { apiError as a, handleApiError as h };
+//# sourceMappingURL=api-errors.js-D22nCtri.js.map

package/build/server/chunks/chunks/api-errors.js-D22nCtri.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-errors.js-D22nCtri.js","sources":["../../../../.svelte-kit/output/server/chunks/api-errors.js"],"sourcesContent":["import { b as ProviderError } from \"./src.js\";\nimport { l as renderThrown } from \"./definitions.js\";\nimport { D as SchemaExtractionError, F as isApiError, M as ApiErrorCode } from \"./access.js\";\nimport { b as ComputeServerUnconfiguredError } from \"./api.js\";\nimport \"./compute.js\";\nimport { error, isHttpError } from \"@sveltejs/kit\";\n//#region src/lib/server/api-errors.ts\n/**\n* Thin wrapper over SvelteKit's `error()` that forces the `{ message, code }`\n* envelope. Use instead of `error(status, 'message string')` so every error\n* carries a code.\n*/\nfunction apiError(status, code, message, fields, details) {\n\tthrow error(status, {\n\t\tmessage,\n\t\tcode,\n\t\t...fields && { fields },\n\t\t...details && { details }\n\t});\n}\n/** Default code for a given HTTP status, used when mapping opaque errors. */\nfunction codeForStatus(status) {\n\tswitch (status) {\n\t\tcase 400: return ApiErrorCode.VALIDATION_FAILED;\n\t\tcase 401: return ApiErrorCode.UNAUTHORIZED;\n\t\tcase 403: return ApiErrorCode.FORBIDDEN;\n\t\tcase 404: return ApiErrorCode.NOT_FOUND;\n\t\tcase 409: return ApiErrorCode.CONFLICT;\n\t\tcase 422: return ApiErrorCode.UNPROCESSABLE;\n\t\tcase 503: return ApiErrorCode.COMPUTE_UNAVAILABLE;\n\t\tdefault: return ApiErrorCode.INTERNAL;\n\t}\n}\nvar UNIQUE_CONSTRAINT_MESSAGES = {\n\tprojects_org_name_unique: \"A project with that name already exists in this organization.\",\n\tprojects_org_id_slug_key: \"A project with that name already exists in this organization.\",\n\torgs_slug_key: \"An organization with that slug already exists.\",\n\tdefinitions_pkey: \"A definition with that ID already exists.\"\n};\nfunction friendlyConstraintMessage(raw) {\n\tfor (const [name, msg] of Object.entries(UNIQUE_CONSTRAINT_MESSAGES)) if (raw.includes(name)) return msg;\n\treturn null;\n}\n/** Normalizes any error raised inside an API handler to a structured SvelteKit HTTP error. */\nfunction handleApiError(err, fallback, log) {\n\tif (isHttpError(err)) throw err;\n\tif (isApiError(err)) apiError(err.status, err.code, err.message, err.fields, err.details);\n\tif (err instanceof SchemaExtractionError) {\n\t\tif (err.kind === \"unreachable\" || err.kind === \"malformed\") apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, err.message);\n\t\tapiError(422, ApiErrorCode.UNPROCESSABLE, err.message);\n\t}\n\tif (err instanceof ComputeServerUnconfiguredError) apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, err.message);\n\tif (err instanceof ProviderError) {\n\t\tconst friendly = friendlyConstraintMessage(err.message);\n\t\tapiError(err.statusCode, codeForStatus(err.statusCode), friendly ?? err.message);\n\t}\n\tconst rendered = renderThrown(err);\n\tif (log) log.error(`[API] ${fallback}`, {\n\t\tcomponent: \"api\",\n\t\terr: rendered\n\t});\n\telse console.error(`[API] ${fallback}:`, rendered);\n\tapiError(500, ApiErrorCode.INTERNAL, fallback);\n}\n//#endregion\nexport { handleApiError as n, apiError as t };\n"],"names":[],"mappings":";;;;;;;;AAMA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;AAC1D,CAAC,MAAM,KAAK,CAAC,MAAM,EAAE;AACrB,EAAE,OAAO;AACT,EAAE,IAAI;AACN,EAAE,GAAG,MAAM,IAAI,EAAE,MAAM,EAAE;AACzB,EAAE,GAAG,OAAO,IAAI,EAAE,OAAO;AACzB,EAAE,CAAC;AACH;AACA;AACA,SAAS,aAAa,CAAC,MAAM,EAAE;AAC/B,CAAC,QAAQ,MAAM;AACf,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,iBAAiB;AACjD,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,YAAY;AAC5C,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,SAAS;AACzC,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,SAAS;AACzC,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,QAAQ;AACxC,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,aAAa;AAC7C,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,mBAAmB;AACnD,EAAE,SAAS,OAAO,YAAY,CAAC,QAAQ;AACvC;AACA;AACA,IAAI,0BAA0B,GAAG;AACjC,CAAC,wBAAwB,EAAE,+DAA+D;AAC1F,CAAC,wBAAwB,EAAE,+DAA+D;AAC1F,CAAC,aAAa,EAAE,gDAAgD;AAChE,CAAC,gBAAgB,EAAE;AACnB,CAAC;AACD,SAAS,yBAAyB,CAAC,GAAG,EAAE;AACxC,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG;AACzG,CAAC,OAAO,IAAI;AACZ;AACA;AACA,SAAS,cAAc,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE;AAC5C,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG;AAChC,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC;AAC1F,CAAC,IAAI,GAAG,YAAY,qBAAqB,EAAE;AAC3C,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,GAAG,CAAC,OAAO,CAAC;AAC1H,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC;AACxD,CAAC;AACD,CAAC,IAAI,GAAG,YAAY,8BAA8B,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,GAAG,CAAC,OAAO,CAAC;AAChH,CAAC,IAAI,GAAG,YAAY,aAAa,EAAE;AACnC,EAAE,MAAM,QAAQ,GAAG,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC;AACzD,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC;AAClF,CAAC;AACD,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC;AACnC,CAAC,IAAI,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE;AACzC,EAAE,SAAS,EAAE,KAAK;AAClB,EAAE,GAAG,EAAE;AACP,EAAE,CAAC;AACH,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;AACnD,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC;AAC/C;;;;"}

package/build/server/chunks/chunks/api.js-CQUUF_Xg.js

@@ -0,0 +1,466 @@
+import { d as ProjectVisibilitySchema, e as ProjectRoleSchema, f as PlatformPermissionSchema, O as OrgPermissionSchema, g as OrgRoleSchema, a as ALL_ORG_PERMISSIONS, i as API_TOKEN_LIFETIME_DAYS, j as ApiScopeStringSchema, s as scopeAllows, P as ProviderError } from './src.js-bYgw0r8C.js';
+import { b as apiError, A as ApiErrorCode, d as isApiError, N as NoopEventSink, i as isFlagEnabled, S as SchemaExtractionError, e as ApiError, g as codeForStatus } from './access.js-CVIHaHje.js';
+import { z } from 'zod';
+
+//#region ../server/src/api/deps.ts
+/**
+* Everything an API handler talks to, as one injected value.
+*
+* Handlers used to reach module-global getters (`getProjectProvider()`,
+* `getDefinitionService()`, …) from the Selva app's composition root — 77 call
+* sites across the v1 routes. That welded them to one app's boot: a second app
+* on a different provider set could not call them at all.
+*
+* Most fields are sub-stores of `IDataProvider`, so a host that already built a
+* `SelvaConfig` gets them via `depsFromConfig`. `services` stays host-defined:
+* `DefinitionService` and friends are composed rather than resolved, and a host
+* may supply its own.
+*/
+/**
+* Build deps from a resolved `SelvaConfig`, plus whatever services and token
+* codecs the host composed on top. The hoisted fields are aliases into `data`,
+* not copies.
+*
+* `services` stays positional — every existing caller passes it there — and
+* `tokens` arrives in an options object rather than as a third positional, so
+* the two composed bags cannot be swapped at a call site.
+*/
+function depsFromConfig(config, services = {}, { tokens = {}, uploadLimits, evictComputeClient = () => {}, notifications, instanceName = "Selva", apiTokenSettingsPath = "/settings/tokens" } = {}) {
+	const { data } = config;
+	return {
+		auth: config.auth,
+		storage: config.storage,
+		data,
+		orgs: data.orgs,
+		projects: data.projects,
+		definitionMeta: data.definitions,
+		computeServer: data.computeServer,
+		userProfile: data.userProfile,
+		shareLinks: data.shareLinks,
+		invites: data.invites,
+		permissions: data.permissions,
+		platformProjectGrants: data.platformProjectGrants,
+		events: config.events ?? new NoopEventSink(),
+		flag: (name) => isFlagEnabled(config, name),
+		tokens,
+		uploadLimits: {
+			maxDefinitionFileSize: uploadLimits?.maxDefinitionFileSize ?? 52428800,
+			maxImageFileSize: uploadLimits?.maxImageFileSize ?? 10485760
+		},
+		evictComputeClient,
+		notifications,
+		instanceName,
+		apiTokenSettingsPath,
+		services
+	};
+}
+//#endregion
+//#region ../server/src/api/scope.ts
+/** The default action for a method: reads are `read`, everything else `write`. */
+function actionForMethod(method) {
+	return method === "GET" || method === "HEAD" ? "read" : "write";
+}
+/**
+* Refuse an API-token request its scopes don't cover, with 403 naming the
+* scope that would have passed. Browser sessions always pass.
+*
+* `runHandler` calls this for every mounted route. A route that builds its own
+* `Response` must call it itself.
+*/
+function assertScope(ctx, action, target) {
+	if (!ctx?.apiScope || scopeAllows(ctx, action, target)) return;
+	recordRefusal(ctx.apiScope.tokenId);
+	apiError(403, ApiErrorCode.FORBIDDEN, `This API token doesn't allow ${action} here.`, void 0, { requiredScope: requiredScope(ctx, action, target) });
+}
+var refusals = /* @__PURE__ */ new Map();
+var utcDay = () => (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+function recordRefusal(tokenId) {
+	const day = utcDay();
+	const entry = refusals.get(tokenId);
+	if (entry?.day === day) entry.count++;
+	else refusals.set(tokenId, {
+		day,
+		count: 1
+	});
+}
+/** Scope refusals for `tokenId` since midnight UTC, in this process. */
+function scopeRefusalsToday(tokenId) {
+	const entry = refusals.get(tokenId);
+	return entry?.day === utcDay() ? entry.count : 0;
+}
+function requiredScope(ctx, action, target) {
+	if (target?.projectId) return `${action}:project:${target.projectId}`;
+	if (target?.definitionId) return `${action}:definition:${target.definitionId}`;
+	return `${action}:org:${ctx.actingOrgId}`;
+}
+/** Scope target for routes addressed by a project id param. */
+function projectScopeTarget(param = "id") {
+	return (req) => ({ projectId: req.params[param] });
+}
+/**
+* Scope target for routes addressed by a definition guid param. Loads the
+* record so a project-scoped key reaches the definitions inside its project.
+*/
+function definitionScopeTarget(param = "guid") {
+	return async (req) => {
+		const definitionId = req.params[param];
+		if (!definitionId || !req.ctx) return { definitionId };
+		return {
+			definitionId,
+			projectId: (await req.deps.definitionMeta.get(req.ctx, definitionId))?.projectId
+		};
+	};
+}
+//#endregion
+//#region ../server/src/api/respond.ts
+/**
+* Turn a handler result — or a thrown `ApiError` — into a web-standard
+* `Response`.
+*
+* This is the whole serialization boundary. A host framework that speaks
+* `Request`/`Response` (SvelteKit, Next route handlers, Hono, Remix) needs only
+* to build an `ApiRequest` and call `runHandler`; one that does not can reuse
+* `toErrorBody` and serialize itself.
+*/
+function toErrorBody(err) {
+	const body = {
+		message: err.message,
+		code: err.code
+	};
+	if (err.fields) body.fields = err.fields;
+	if (err.details) body.details = err.details;
+	return body;
+}
+function toResponse(result) {
+	if (result instanceof Response) return result;
+	const { status, body, headers } = result;
+	if (body === void 0) return new Response(null, {
+		status: status ?? 204,
+		headers
+	});
+	return new Response(JSON.stringify(body), {
+		status: status ?? 200,
+		headers: {
+			"content-type": "application/json",
+			...headers
+		}
+	});
+}
+/** Run a handler and serialize whatever comes out, including failures. */
+async function runHandler(handler, req, { fallback, mapError, action, scopeTarget }) {
+	try {
+		if (req.ctx?.apiScope) assertScope(req.ctx, action ?? actionForMethod(req.request.method), scopeTarget ? await scopeTarget(req) : void 0);
+		return toResponse(await handler(req));
+	} catch (err) {
+		if (isApiError(err)) return toResponse({
+			status: err.status,
+			body: toErrorBody(err)
+		});
+		const mapped = mapError?.(err);
+		if (mapped) return toResponse({
+			status: mapped.status,
+			body: toErrorBody(mapped)
+		});
+		req.log.error(`[API] ${fallback}`, {
+			component: "api",
+			err: err instanceof Error ? err.stack ?? err.message : String(err)
+		});
+		return toResponse({
+			status: 500,
+			body: {
+				message: fallback,
+				code: ApiErrorCode.INTERNAL
+			}
+		});
+	}
+}
+//#endregion
+//#region ../server/src/compute/errors.ts
+/**
+* Compute error types, kept in a leaf module with no imports.
+*
+* Separate from the function that throws them on purpose: an error mapper needs
+* nothing but the class to `instanceof` against, and importing it from beside
+* the throw site drags that module's dependencies into every mapper. Anything
+* an error mapper imports belongs here.
+*/
+/**
+* Thrown when no compute server is configured or visible for the org — a
+* misconfiguration an operator must fix in `/admin/compute`, not a bug. Routes
+* map this to 503 instead of letting the pure helper's plain `Error` surface as
+* a generic 500.
+*/
+var ComputeServerUnconfiguredError = class extends Error {
+	constructor(message = "No compute server configured. Ask an admin to add one in /admin/compute.") {
+		super(message);
+		this.name = "ComputeServerUnconfiguredError";
+	}
+};
+//#endregion
+//#region ../server/src/api/map-core-error.ts
+/**
+* The domain errors this package's own handlers raise, folded into the envelope.
+*
+* A host's `mapError` should call this first and add only its own error types.
+* These rules cannot live solely in a host: the handler that throws them ships
+* from here, so a host that forgot one would serve 500 where every other host
+* serves 503 — the same API answering differently depending on who mounted it.
+*
+* Postgres surfaces a unique-constraint name verbatim, which is useless to an
+* end user, so the constraints this package's handlers can trip are translated
+* here rather than left to each host.
+*/
+var UNIQUE_CONSTRAINT_MESSAGES = {
+	projects_org_name_unique: "A project with that name already exists in this organization.",
+	projects_org_id_slug_key: "A project with that name already exists in this organization.",
+	orgs_slug_key: "An organization with that slug already exists.",
+	definitions_pkey: "A definition with that ID already exists."
+};
+function friendlyConstraintMessage(raw) {
+	for (const [name, msg] of Object.entries(UNIQUE_CONSTRAINT_MESSAGES)) if (raw.includes(name)) return msg;
+	return null;
+}
+/**
+* Compute unreachable or serving an unreadable schema is operator-side (503); a
+* schema the parser cannot read is the caller's file (422).
+*/
+function mapCoreError(err) {
+	if (err instanceof SchemaExtractionError) return err.kind === "unreachable" || err.kind === "malformed" ? new ApiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, err.message) : new ApiError(422, ApiErrorCode.UNPROCESSABLE, err.message);
+	if (err instanceof ComputeServerUnconfiguredError) return new ApiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, err.message);
+	if (err instanceof ProviderError) {
+		const friendly = friendlyConstraintMessage(err.message);
+		return new ApiError(err.statusCode, codeForStatus(err.statusCode), friendly ?? err.message);
+	}
+}
+//#endregion
+//#region ../server/src/api/pagination.ts
+/**
+* Query-param parsing for the list pagination contract:
+* `?limit=&cursor=&orderBy=&orderDir=` → `{ items, nextCursor? }`.
+*
+* Every list endpoint parses these identically, so the clamping lives here
+* rather than inline per handler — a handler that clamps differently publishes
+* a different contract under the same documented one, and nothing fails at
+* build time.
+*/
+/**
+* An unparseable or out-of-range `limit` clamps rather than 400s: pagination
+* params are plumbing, and failing a read over one is hostile to clients
+* walking a cursor.
+*/
+function parseListOptions(url) {
+	const raw = Number(url.searchParams.get("limit") ?? 50);
+	const limit = Number.isFinite(raw) ? Math.min(Math.max(Math.trunc(raw), 1), 200) : 50;
+	const orderByRaw = url.searchParams.get("orderBy");
+	const orderBy = orderByRaw === "createdAt" || orderByRaw === "updatedAt" || orderByRaw === "name" ? orderByRaw : void 0;
+	return {
+		limit,
+		cursor: url.searchParams.get("cursor") ?? void 0,
+		orderBy,
+		orderDir: url.searchParams.get("orderDir") === "asc" ? "asc" : void 0
+	};
+}
+/** `parseListOptions` plus the definition-only `solveCount` ordering. */
+function parseDefinitionListOptions(url) {
+	const base = parseListOptions(url);
+	if (url.searchParams.get("orderBy") === "solveCount") return {
+		...base,
+		orderBy: "solveCount"
+	};
+	return base;
+}
+//#endregion
+//#region ../server/src/api/bodies.ts
+/**
+* Request-body validators for the API routes that take JSON.
+*
+* They live apart from their handlers so a spec generator can import them
+* without loading a host's route module — in Selva's case a `+server.ts` imports
+* `./$types`, which only resolves inside a SvelteKit build.
+*
+* **A JSON body accepted by an API route belongs in this file.** Adding one
+* inline is invisible to the generator, so the endpoint documents an empty body.
+* Multipart handlers are the exception — `FormData` has no Zod schema to derive
+* from, so their fields are described in the spec directly.
+*/
+var SolveBodySchema = z.object({
+	inputs: z.array(z.unknown()).default([]),
+	values: z.record(z.string(), z.unknown()).default({}),
+	channel: z.enum(["live", "draft"]).default("live"),
+	versionId: z.string().optional(),
+	/** Must name this same definition, or the route 400s instead of solving a different one. */
+	definitionUrl: z.string().optional()
+});
+var CreateProjectBodySchema = z.object({
+	name: z.string().min(1, "Project name is required").max(128).trim(),
+	description: z.string().max(2e3).optional(),
+	visibility: ProjectVisibilitySchema.default("private"),
+	autoJoinOnUpload: z.boolean().optional()
+});
+var UpdateProjectBodySchema = z.object({
+	name: z.string().min(1).max(128).trim(),
+	description: z.string().max(2e3).nullish(),
+	visibility: ProjectVisibilitySchema,
+	autoJoinOnUpload: z.boolean()
+}).partial();
+var AddProjectMemberBodySchema = z.object({
+	userId: z.string().min(1, "userId is required"),
+	role: ProjectRoleSchema
+});
+var UpdateProjectMemberBodySchema = z.object({ role: ProjectRoleSchema });
+/** Platform-scope entries are dropped downstream — an invite only grants org rights. */
+var FlatPermissionSchema = z.union([PlatformPermissionSchema, OrgPermissionSchema]);
+var CreateInviteBodySchema = z.object({
+	email: z.email("Valid email is required").transform((s) => s.toLowerCase().trim()),
+	orgRole: OrgRoleSchema.default("member"),
+	permissions: z.array(FlatPermissionSchema).default([])
+});
+/**
+* `apiKey` is tri-state: **omitted** keeps the stored key, **null** clears it, a
+* string replaces it. `.optional().nullable()` — not `.nullish()` — because the
+* two must stay distinguishable after parsing, or a request that just omits the
+* field would silently wipe the stored credential.
+*/
+var IncomingComputeServerSchema = z.object({
+	id: z.string().min(1),
+	label: z.string().min(1),
+	serverUrl: z.string().min(1),
+	apiKey: z.string().nullable().optional(),
+	timeoutMs: z.number().optional(),
+	retryCount: z.number().optional()
+});
+var OrgComputePatchBodySchema = z.object({
+	servers: z.array(IncomingComputeServerSchema),
+	/** May name any server visible to the org. `null` clears the override; omitted leaves it untouched. */
+	defaultServerId: z.string().nullable().optional()
+});
+var UpdateOrgMemberBodySchema = z.object({
+	role: OrgRoleSchema.optional(),
+	permissions: z.array(z.enum(ALL_ORG_PERMISSIONS)).optional()
+}).refine((b) => b.role !== void 0 || b.permissions !== void 0, { message: "Provide at least one of role, permissions" });
+var CreateApiTokenBodySchema = z.object({
+	name: z.string().trim().min(1, "Name is required").max(100),
+	scopes: z.array(ApiScopeStringSchema).min(1, "Pick at least one scope").max(20),
+	expiresInDays: z.union(API_TOKEN_LIFETIME_DAYS.map((d) => z.literal(d)))
+});
+//#endregion
+//#region ../server/src/api/responses-schema.ts
+/**
+* Response schemas for the v1 payloads that must not carry a stored secret.
+*
+* Four store types hold a credential next to fields a client legitimately
+* reads: `ShareLink.tokenHash`, `Invite.tokenHash` and `ApiToken.tokenHash` are HMACs of a token,
+* `ComputeServerCommon.apiKey` is a live Rhino.Compute key. Handlers used to
+* strip them by destructuring — `const { tokenHash: _omit, ...rest } = invite`
+* — which works until someone adds a field to the stored type or edits the line
+* away. Nothing fails at build time; the credential just starts appearing in a
+* response.
+*
+* Parsing through these schemas inverts the default: the response carries only
+* what the schema names, so a new field on the stored type is invisible to
+* clients until added here on purpose. Use them via `shaped`/`shapedCollection`
+* in `./route.ts`.
+*
+* These describe **responses**, not stored records — where the two differ (an
+* invite's one-time `acceptUrl`, a share link's `hasToken` sentinel) the
+* response is the authority.
+*/
+var ShareLinkResponseSchema = z.object({
+	id: z.string(),
+	definitionId: z.string(),
+	channel: z.enum(["live", "draft"]),
+	name: z.string().optional(),
+	createdBy: z.string(),
+	createdAt: z.string(),
+	expiresAt: z.string().nullish(),
+	revokedAt: z.string().nullish(),
+	allowSolve: z.boolean(),
+	maxSolves: z.number().nullish(),
+	solveCount: z.number(),
+	/** Sentinel replacing `tokenHash`: a token exists, its hash is not yours. */
+	hasToken: z.literal(true)
+});
+/** The mint response. `token` is the plaintext, returned exactly once. */
+var CreatedShareLinkResponseSchema = z.object({
+	link: ShareLinkResponseSchema,
+	token: z.string()
+});
+var InviteResponseSchema = z.object({
+	id: z.string(),
+	email: z.string(),
+	orgId: z.string(),
+	orgRole: z.string(),
+	orgPermissions: z.array(z.string()),
+	platformPermissions: z.array(z.string()).default([]),
+	invitedBy: z.string(),
+	createdAt: z.string(),
+	expiresAt: z.string(),
+	acceptedAt: z.string().optional(),
+	acceptedByUserId: z.string().optional()
+});
+/**
+* The create response: the invite plus the link to send, built per request.
+*
+* `acceptUrl` is returned whatever `delivery` says — mail is best-effort, and
+* manual sharing is the fallback when it is off or the send failed.
+*/
+var CreatedInviteResponseSchema = InviteResponseSchema.extend({
+	acceptUrl: z.string(),
+	delivery: z.enum([
+		"sent",
+		"not-configured",
+		"failed"
+	])
+});
+/**
+* An org-owned compute server. `apiKey` is replaced by `hasApiKey`, so a picker
+* can render "key set" without any store decrypting a secret to throw away.
+*/
+var OrgComputeServerResponseSchema = z.object({
+	id: z.string(),
+	label: z.string(),
+	serverUrl: z.string(),
+	scope: z.literal("org"),
+	ownerOrgId: z.string(),
+	timeoutMs: z.number().optional(),
+	retryCount: z.number().optional(),
+	hasApiKey: z.boolean()
+});
+/** A server this org may select but not edit. Never carries a key either. */
+var ComputeCatalogEntrySchema = z.object({
+	id: z.string(),
+	label: z.string(),
+	serverUrl: z.string(),
+	scope: z.enum(["platform", "org"]),
+	source: z.enum(["platform", "org"]),
+	timeoutMs: z.number().optional(),
+	retryCount: z.number().optional()
+});
+var OrgComputeResponseSchema = z.object({
+	servers: z.array(OrgComputeServerResponseSchema),
+	defaultServerId: z.string().nullish(),
+	globalDefaultServerId: z.string().nullish(),
+	catalog: z.array(ComputeCatalogEntrySchema)
+});
+var ApiTokenResponseSchema = z.object({
+	id: z.string(),
+	userId: z.string(),
+	createdBy: z.string().nullable(),
+	orgId: z.string(),
+	name: z.string(),
+	scopes: z.array(z.string()),
+	createdAt: z.string(),
+	expiresAt: z.string(),
+	lastUsedAt: z.string().nullable(),
+	revokedAt: z.string().nullable(),
+	/** Scope refusals since midnight UTC, counted in this process only. */
+	refusedToday: z.number()
+});
+/** The mint response. `secret` is the raw key, returned exactly once. */
+var CreatedApiTokenResponseSchema = z.object({
+	token: ApiTokenResponseSchema,
+	secret: z.string()
+});
+
+export { AddProjectMemberBodySchema as A, ComputeServerUnconfiguredError as C, InviteResponseSchema as I, OrgComputePatchBodySchema as O, SolveBodySchema as S, UpdateProjectBodySchema as U, CreateProjectBodySchema as a, UpdateProjectMemberBodySchema as b, UpdateOrgMemberBodySchema as c, CreateInviteBodySchema as d, CreateApiTokenBodySchema as e, parseListOptions as f, ShareLinkResponseSchema as g, CreatedShareLinkResponseSchema as h, OrgComputeResponseSchema as i, CreatedInviteResponseSchema as j, ApiTokenResponseSchema as k, CreatedApiTokenResponseSchema as l, assertScope as m, depsFromConfig as n, mapCoreError as o, parseDefinitionListOptions as p, definitionScopeTarget as q, runHandler as r, scopeRefusalsToday as s, projectScopeTarget as t };
+//# sourceMappingURL=api.js-CQUUF_Xg.js.map