@selvajs/selva 4.20.0-beta.0 → 4.20.0-beta.1

package/build/server/chunks/entries/endpoints/api/v1/projects/_server.ts.js-CLovy5ot.js

@@ -0,0 +1,41 @@
+import { J as listProjects, K as createProject } from '../../../../../chunks/handlers.js-Bu22Krku.js';
+import { m as mount } from '../../../../../chunks/sveltekit.js-DzlaWFdW.js';
+import '../../../../../chunks/src.js-bYgw0r8C.js';
+import 'zod';
+import '../../../../../chunks/providers.server.js-BQkh28e-.js';
+import '../../../../../chunks/shared-server.js-BGs15m2r.js';
+import '../../../../../chunks/definitions.js-BCLhFUqp.js';
+import '../../../../../chunks/access.js-CVIHaHje.js';
+import '../../../../../chunks/schema.js-CPjRq84j.js';
+import 'node:crypto';
+import '../../../../../chunks/limits.js-WY6OKyVE.js';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '../../../../../chunks/types.js-B_zdqlv_.js';
+import '../../../../../chunks/api.js-CQUUF_Xg.js';
+import '../../../../../chunks/request.js-CT_6hfb_.js';
+import '../../../../../chunks/compute.js-BW2oAgzt.js';
+import 'node:dns/promises';
+import 'node:net';
+import '../../../../../chunks/evict-changed-servers.js-whgDVM5R.js';
+import '../../../../../chunks/projects.js-B46ve1wo.js';
+import '../../../../../chunks/engine.server.js-B-Eq00J5.js';
+import '../../../../../chunks/computeLimits.js-BqSpuf4I.js';
+import 'node:zlib';
+import 'node:util';
+import '../../../../../chunks/token2.server.js-dXKS8zg3.js';
+import '../../../../../chunks/token-codec.js-CxK2DiO-.js';
+import '../../../../../chunks/token3.server.js-D3PjQp9U.js';
+import '../../../../../chunks/token4.server.js-DOLrxUoz.js';
+import '../../../../../chunks/api-token-codec.js-BEHsbOP6.js';
+import '@sveltejs/kit';
+
+//#region src/routes/api/v1/projects/+server.ts
+var GET = mount("Failed to list projects", listProjects);
+var POST = mount("Failed to create project", createProject);
+
+export { GET, POST };
+//# sourceMappingURL=_server.ts.js-CLovy5ot.js.map

package/build/server/chunks/entries/endpoints/api/v1/projects/_server.ts.js-CLovy5ot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-CLovy5ot.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/v1/projects/_server.ts.js"],"sourcesContent":["import { d as createProject, m as listProjects } from \"../../../../../chunks/handlers.js\";\nimport { t as mount } from \"../../../../../chunks/sveltekit.js\";\n//#region src/routes/api/v1/projects/+server.ts\nvar GET = mount(\"Failed to list projects\", listProjects);\nvar POST = mount(\"Failed to create project\", createProject);\n//#endregion\nexport { GET, POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA;AACG,IAAC,GAAG,GAAG,KAAK,CAAC,yBAAyB,EAAE,YAAY;AACpD,IAAC,IAAI,GAAG,KAAK,CAAC,0BAA0B,EAAE,aAAa;;;;"}

package/build/server/chunks/entries/endpoints/api/v1/solve/_solveId_/cancel/_server.ts.js-BUwReKOe.js

@@ -0,0 +1,28 @@
+import { A as ApiErrorCode } from '../../../../../../../chunks/access.js-CVIHaHje.js';
+import { m as assertScope } from '../../../../../../../chunks/api.js-CQUUF_Xg.js';
+import { g as getSolveEventBus } from '../../../../../../../chunks/token.server.js-BYt3vaGK.js';
+import { a as apiError } from '../../../../../../../chunks/api-errors.js-D22nCtri.js';
+import { d as asHttpError } from '../../../../../../../chunks/access2.server.js-BkKZqWVl.js';
+import { l as liveOwnerKey } from '../../../../../../../chunks/liveSolve.server.js-zNfYPVuT.js';
+import '../../../../../../../chunks/src.js-bYgw0r8C.js';
+import 'zod';
+import '../../../../../../../chunks/schema.js-CPjRq84j.js';
+import '../../../../../../../chunks/shared-server.js-BGs15m2r.js';
+import 'node:crypto';
+import '../../../../../../../chunks/definitions.js-BCLhFUqp.js';
+import 'node:dns/promises';
+import 'node:net';
+import '@sveltejs/kit';
+import '../../../../../../../chunks/outcome-H5XjAroQ.js-C2sjNdmP.js';
+
+//#region src/routes/api/v1/solve/[solveId]/cancel/+server.ts
+var POST = async ({ params, locals }) => {
+	const ownerKey = liveOwnerKey(locals.user?.id);
+	if (!ownerKey) apiError(401, ApiErrorCode.UNAUTHORIZED, "Unauthorized");
+	await asHttpError(() => assertScope(locals.ctx, "solve"));
+	if (!getSolveEventBus().requestAbort(params.solveId, ownerKey)) apiError(404, ApiErrorCode.NOT_FOUND, "No such running solve");
+	return new Response(null, { status: 204 });
+};
+
+export { POST };
+//# sourceMappingURL=_server.ts.js-BUwReKOe.js.map

package/build/server/chunks/entries/endpoints/api/v1/solve/_solveId_/cancel/_server.ts.js-BUwReKOe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-BUwReKOe.js","sources":["../../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/v1/solve/_solveId_/cancel/_server.ts.js"],"sourcesContent":["import { M as ApiErrorCode } from \"../../../../../../../chunks/access.js\";\nimport { S as assertScope } from \"../../../../../../../chunks/api.js\";\nimport { r as getSolveEventBus } from \"../../../../../../../chunks/token.server.js\";\nimport { t as apiError } from \"../../../../../../../chunks/api-errors.js\";\nimport { t as asHttpError } from \"../../../../../../../chunks/access2.server.js\";\nimport { n as liveOwnerKey } from \"../../../../../../../chunks/liveSolve.server.js\";\n//#region src/routes/api/v1/solve/[solveId]/cancel/+server.ts\nvar POST = async ({ params, locals }) => {\n\tconst ownerKey = liveOwnerKey(locals.user?.id);\n\tif (!ownerKey) apiError(401, ApiErrorCode.UNAUTHORIZED, \"Unauthorized\");\n\tawait asHttpError(() => assertScope(locals.ctx, \"solve\"));\n\tif (!getSolveEventBus().requestAbort(params.solveId, ownerKey)) apiError(404, ApiErrorCode.NOT_FOUND, \"No such running solve\");\n\treturn new Response(null, { status: 204 });\n};\n//#endregion\nexport { POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAMA;AACG,IAAC,IAAI,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AACzC,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AAC/C,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC;AACxE,CAAC,MAAM,WAAW,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC1D,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,uBAAuB,CAAC;AAC/H,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC3C;;;;"}

package/build/server/chunks/entries/endpoints/api/v1/solve-events/_server.ts.js-DTFfmEv8.js

@@ -0,0 +1,89 @@
+import { A as ApiErrorCode } from '../../../../../chunks/access.js-CVIHaHje.js';
+import { m as assertScope } from '../../../../../chunks/api.js-CQUUF_Xg.js';
+import { g as getSolveEventBus } from '../../../../../chunks/token.server.js-BYt3vaGK.js';
+import { a as apiError } from '../../../../../chunks/api-errors.js-D22nCtri.js';
+import { d as asHttpError } from '../../../../../chunks/access2.server.js-BkKZqWVl.js';
+import { l as liveOwnerKey } from '../../../../../chunks/liveSolve.server.js-zNfYPVuT.js';
+import '../../../../../chunks/src.js-bYgw0r8C.js';
+import 'zod';
+import '../../../../../chunks/schema.js-CPjRq84j.js';
+import '../../../../../chunks/shared-server.js-BGs15m2r.js';
+import 'node:crypto';
+import '../../../../../chunks/definitions.js-BCLhFUqp.js';
+import 'node:dns/promises';
+import 'node:net';
+import '@sveltejs/kit';
+import '../../../../../chunks/outcome-H5XjAroQ.js-C2sjNdmP.js';
+
+//#region src/lib/server/solveEvents/sse.server.ts
+/** Comment frames keep idle proxies from closing the connection. */
+var HEARTBEAT_MS = 2e4;
+/**
+* The SSE response for one browser stream: registers it on the bus, frames each event as
+* `event: solve`, and unregisters when the client goes. Null when another owner holds `streamId`.
+*/
+function openSolveEventStream(args) {
+	const { bus, streamId, ownerKey, signal } = args;
+	const encoder = new TextEncoder();
+	let write = () => {};
+	const unsubscribe = bus.openStream(streamId, ownerKey, (event) => write(event));
+	if (!unsubscribe) return null;
+	let close = () => {};
+	const body = new ReadableStream({
+		start(controller) {
+			let eventId = 0;
+			let closed = false;
+			const send = (chunk) => {
+				try {
+					controller.enqueue(encoder.encode(chunk));
+				} catch {
+					close();
+				}
+			};
+			write = (event) => send(`id: ${++eventId}\nevent: solve\ndata: ${JSON.stringify(event)}\n\n`);
+			const heartbeat = setInterval(() => send(": ping\n\n"), HEARTBEAT_MS);
+			close = () => {
+				if (closed) return;
+				closed = true;
+				clearInterval(heartbeat);
+				unsubscribe();
+				try {
+					controller.close();
+				} catch {}
+			};
+			signal.addEventListener("abort", close, { once: true });
+			if (signal.aborted) close();
+			send(`event: ready\ndata: ${JSON.stringify({ streamId })}\n\n`);
+		},
+		cancel() {
+			close();
+		}
+	});
+	return new Response(body, { headers: {
+		"Content-Type": "text/event-stream",
+		"Cache-Control": "no-cache, no-transform",
+		Connection: "keep-alive",
+		"X-Accel-Buffering": "no"
+	} });
+}
+//#endregion
+//#region src/routes/api/v1/solve-events/+server.ts
+var STREAM_ID = /^[A-Za-z0-9_-]{16,64}$/;
+var GET = async ({ url, locals, request }) => {
+	const ownerKey = liveOwnerKey(locals.user?.id);
+	if (!ownerKey) apiError(401, ApiErrorCode.UNAUTHORIZED, "Unauthorized");
+	await asHttpError(() => assertScope(locals.ctx, "read"));
+	const streamId = url.searchParams.get("streamId") ?? "";
+	if (!STREAM_ID.test(streamId)) apiError(400, ApiErrorCode.VALIDATION_FAILED, "streamId must be 16-64 URL-safe characters");
+	const response = openSolveEventStream({
+		bus: getSolveEventBus(),
+		streamId,
+		ownerKey,
+		signal: request.signal
+	});
+	if (!response) apiError(409, ApiErrorCode.CONFLICT, "streamId is in use");
+	return response;
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts.js-DTFfmEv8.js.map

package/build/server/chunks/entries/endpoints/api/v1/solve-events/_server.ts.js-DTFfmEv8.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-DTFfmEv8.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/v1/solve-events/_server.ts.js"],"sourcesContent":["import { M as ApiErrorCode } from \"../../../../../chunks/access.js\";\nimport { S as assertScope } from \"../../../../../chunks/api.js\";\nimport { r as getSolveEventBus } from \"../../../../../chunks/token.server.js\";\nimport { t as apiError } from \"../../../../../chunks/api-errors.js\";\nimport { t as asHttpError } from \"../../../../../chunks/access2.server.js\";\nimport { n as liveOwnerKey } from \"../../../../../chunks/liveSolve.server.js\";\n//#region src/lib/server/solveEvents/sse.server.ts\n/** Comment frames keep idle proxies from closing the connection. */\nvar HEARTBEAT_MS = 2e4;\n/**\n* The SSE response for one browser stream: registers it on the bus, frames each event as\n* `event: solve`, and unregisters when the client goes. Null when another owner holds `streamId`.\n*/\nfunction openSolveEventStream(args) {\n\tconst { bus, streamId, ownerKey, signal } = args;\n\tconst encoder = new TextEncoder();\n\tlet write = () => {};\n\tconst unsubscribe = bus.openStream(streamId, ownerKey, (event) => write(event));\n\tif (!unsubscribe) return null;\n\tlet close = () => {};\n\tconst body = new ReadableStream({\n\t\tstart(controller) {\n\t\t\tlet eventId = 0;\n\t\t\tlet closed = false;\n\t\t\tconst send = (chunk) => {\n\t\t\t\ttry {\n\t\t\t\t\tcontroller.enqueue(encoder.encode(chunk));\n\t\t\t\t} catch {\n\t\t\t\t\tclose();\n\t\t\t\t}\n\t\t\t};\n\t\t\twrite = (event) => send(`id: ${++eventId}\\nevent: solve\\ndata: ${JSON.stringify(event)}\\n\\n`);\n\t\t\tconst heartbeat = setInterval(() => send(\": ping\\n\\n\"), HEARTBEAT_MS);\n\t\t\tclose = () => {\n\t\t\t\tif (closed) return;\n\t\t\t\tclosed = true;\n\t\t\t\tclearInterval(heartbeat);\n\t\t\t\tunsubscribe();\n\t\t\t\ttry {\n\t\t\t\t\tcontroller.close();\n\t\t\t\t} catch {}\n\t\t\t};\n\t\t\tsignal.addEventListener(\"abort\", close, { once: true });\n\t\t\tif (signal.aborted) close();\n\t\t\tsend(`event: ready\\ndata: ${JSON.stringify({ streamId })}\\n\\n`);\n\t\t},\n\t\tcancel() {\n\t\t\tclose();\n\t\t}\n\t});\n\treturn new Response(body, { headers: {\n\t\t\"Content-Type\": \"text/event-stream\",\n\t\t\"Cache-Control\": \"no-cache, no-transform\",\n\t\tConnection: \"keep-alive\",\n\t\t\"X-Accel-Buffering\": \"no\"\n\t} });\n}\n//#endregion\n//#region src/routes/api/v1/solve-events/+server.ts\nvar STREAM_ID = /^[A-Za-z0-9_-]{16,64}$/;\nvar GET = async ({ url, locals, request }) => {\n\tconst ownerKey = liveOwnerKey(locals.user?.id);\n\tif (!ownerKey) apiError(401, ApiErrorCode.UNAUTHORIZED, \"Unauthorized\");\n\tawait asHttpError(() => assertScope(locals.ctx, \"read\"));\n\tconst streamId = url.searchParams.get(\"streamId\") ?? \"\";\n\tif (!STREAM_ID.test(streamId)) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"streamId must be 16-64 URL-safe characters\");\n\tconst response = openSolveEventStream({\n\t\tbus: getSolveEventBus(),\n\t\tstreamId,\n\t\townerKey,\n\t\tsignal: request.signal\n\t});\n\tif (!response) apiError(409, ApiErrorCode.CONFLICT, \"streamId is in use\");\n\treturn response;\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAMA;AACA;AACA,IAAI,YAAY,GAAG,GAAG;AACtB;AACA;AACA;AACA;AACA,SAAS,oBAAoB,CAAC,IAAI,EAAE;AACpC,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI;AACjD,CAAC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE;AAClC,CAAC,IAAI,KAAK,GAAG,MAAM,CAAC,CAAC;AACrB,CAAC,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,IAAI;AAC9B,CAAC,IAAI,KAAK,GAAG,MAAM,CAAC,CAAC;AACrB,CAAC,MAAM,IAAI,GAAG,IAAI,cAAc,CAAC;AACjC,EAAE,KAAK,CAAC,UAAU,EAAE;AACpB,GAAG,IAAI,OAAO,GAAG,CAAC;AAClB,GAAG,IAAI,MAAM,GAAG,KAAK;AACrB,GAAG,MAAM,IAAI,GAAG,CAAC,KAAK,KAAK;AAC3B,IAAI,IAAI;AACR,KAAK,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9C,IAAI,CAAC,CAAC,MAAM;AACZ,KAAK,KAAK,EAAE;AACZ,IAAI;AACJ,GAAG,CAAC;AACJ,GAAG,KAAK,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,sBAAsB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;AAChG,GAAG,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;AACxE,GAAG,KAAK,GAAG,MAAM;AACjB,IAAI,IAAI,MAAM,EAAE;AAChB,IAAI,MAAM,GAAG,IAAI;AACjB,IAAI,aAAa,CAAC,SAAS,CAAC;AAC5B,IAAI,WAAW,EAAE;AACjB,IAAI,IAAI;AACR,KAAK,UAAU,CAAC,KAAK,EAAE;AACvB,IAAI,CAAC,CAAC,MAAM,CAAC;AACb,GAAG,CAAC;AACJ,GAAG,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC1D,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE;AAC9B,GAAG,IAAI,CAAC,CAAC,oBAAoB,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAClE,EAAE,CAAC;AACH,EAAE,MAAM,GAAG;AACX,GAAG,KAAK,EAAE;AACV,EAAE;AACF,EAAE,CAAC;AACH,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE;AACtC,EAAE,cAAc,EAAE,mBAAmB;AACrC,EAAE,eAAe,EAAE,wBAAwB;AAC3C,EAAE,UAAU,EAAE,YAAY;AAC1B,EAAE,mBAAmB,EAAE;AACvB,EAAE,EAAE,CAAC;AACL;AACA;AACA;AACA,IAAI,SAAS,GAAG,wBAAwB;AACrC,IAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK;AAC9C,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AAC/C,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC;AACxE,CAAC,MAAM,WAAW,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AACzD,CAAC,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE;AACxD,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,4CAA4C,CAAC;AAC3H,CAAC,MAAM,QAAQ,GAAG,oBAAoB,CAAC;AACvC,EAAE,GAAG,EAAE,gBAAgB,EAAE;AACzB,EAAE,QAAQ;AACV,EAAE,QAAQ;AACV,EAAE,MAAM,EAAE,OAAO,CAAC;AAClB,EAAE,CAAC;AACH,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,oBAAoB,CAAC;AAC1E,CAAC,OAAO,QAAQ;AAChB;;;;"}

package/build/server/chunks/entries/endpoints/api/v1/solve-events/_solveId_/_server.ts.js-DS5BF1os.js

@@ -0,0 +1,62 @@
+import { A as ApiErrorCode } from '../../../../../../chunks/access.js-CVIHaHje.js';
+import { v as verifySolveToken, g as getSolveEventBus } from '../../../../../../chunks/token.server.js-BYt3vaGK.js';
+import { k as requireMaxBodySize } from '../../../../../../chunks/admin-auth.server.js-cTHF0WiI.js';
+import { a as apiError } from '../../../../../../chunks/api-errors.js-D22nCtri.js';
+import { json } from '@sveltejs/kit';
+import '../../../../../../chunks/src.js-bYgw0r8C.js';
+import 'zod';
+import '../../../../../../chunks/schema.js-CPjRq84j.js';
+import '../../../../../../chunks/shared-server.js-BGs15m2r.js';
+import 'node:crypto';
+import '../../../../../../chunks/api-token-codec.js-BEHsbOP6.js';
+import '../../../../../../chunks/token-codec.js-CxK2DiO-.js';
+import 'node:zlib';
+import '../../../../../../chunks/definitions.js-BCLhFUqp.js';
+import '../../../../../../chunks/api.js-CQUUF_Xg.js';
+import 'node:dns/promises';
+import 'node:net';
+
+function readBearer(request) {
+	const auth = request.headers.get("authorization");
+	return auth?.startsWith("Bearer ") ? auth.slice(7).trim() : null;
+}
+/**
+* The events in a callback body, in order. `seq` and `solveId` are the bus's to stamp, so any the
+* plugin sent are ignored. `now` stands in for a missing `at`.
+*/
+function parseCallbackEvents(body, now) {
+	const raw = body?.events;
+	if (!Array.isArray(raw)) return [];
+	return raw.slice(0, 256).flatMap((entry) => {
+		if (!entry || typeof entry !== "object") return [];
+		const e = entry;
+		if (typeof e.type !== "string" || !e.type) return [];
+		const payload = e.payload && typeof e.payload === "object" && !Array.isArray(e.payload) ? e.payload : void 0;
+		return [{
+			type: e.type,
+			at: typeof e.at === "string" ? e.at : now,
+			...payload ? { payload } : {}
+		}];
+	});
+}
+//#endregion
+//#region src/routes/api/v1/solve-events/[solveId]/+server.ts
+var MAX_BODY_BYTES = 262144;
+var SOLVE_ID = /^[A-Za-z0-9-]{8,64}$/;
+var POST = async ({ params, request }) => {
+	requireMaxBodySize(request, MAX_BODY_BYTES);
+	const { solveId } = params;
+	if (!SOLVE_ID.test(solveId) || !verifySolveToken(solveId, readBearer(request))) apiError(401, ApiErrorCode.UNAUTHORIZED, "Invalid solve token");
+	const bus = getSolveEventBus();
+	if (!bus.isOpen(solveId)) apiError(410, ApiErrorCode.NOT_FOUND, "Solve is no longer open");
+	let body;
+	try {
+		body = await request.json();
+	} catch {
+		apiError(400, ApiErrorCode.VALIDATION_FAILED, "Body must be JSON");
+	}
+	return json(bus.publish(solveId, parseCallbackEvents(body, (/* @__PURE__ */ new Date()).toISOString())));
+};
+
+export { POST };
+//# sourceMappingURL=_server.ts.js-DS5BF1os.js.map

package/build/server/chunks/entries/endpoints/api/v1/solve-events/_solveId_/_server.ts.js-DS5BF1os.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-DS5BF1os.js","sources":["../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/v1/solve-events/_solveId_/_server.ts.js"],"sourcesContent":["import { M as ApiErrorCode } from \"../../../../../../chunks/access.js\";\nimport { n as verifySolveToken, r as getSolveEventBus } from \"../../../../../../chunks/token.server.js\";\nimport { c as requireMaxBodySize } from \"../../../../../../chunks/admin-auth.server.js\";\nimport { t as apiError } from \"../../../../../../chunks/api-errors.js\";\nimport { json } from \"@sveltejs/kit\";\nfunction readBearer(request) {\n\tconst auth = request.headers.get(\"authorization\");\n\treturn auth?.startsWith(\"Bearer \") ? auth.slice(7).trim() : null;\n}\n/**\n* The events in a callback body, in order. `seq` and `solveId` are the bus's to stamp, so any the\n* plugin sent are ignored. `now` stands in for a missing `at`.\n*/\nfunction parseCallbackEvents(body, now) {\n\tconst raw = body?.events;\n\tif (!Array.isArray(raw)) return [];\n\treturn raw.slice(0, 256).flatMap((entry) => {\n\t\tif (!entry || typeof entry !== \"object\") return [];\n\t\tconst e = entry;\n\t\tif (typeof e.type !== \"string\" || !e.type) return [];\n\t\tconst payload = e.payload && typeof e.payload === \"object\" && !Array.isArray(e.payload) ? e.payload : void 0;\n\t\treturn [{\n\t\t\ttype: e.type,\n\t\t\tat: typeof e.at === \"string\" ? e.at : now,\n\t\t\t...payload ? { payload } : {}\n\t\t}];\n\t});\n}\n//#endregion\n//#region src/routes/api/v1/solve-events/[solveId]/+server.ts\nvar MAX_BODY_BYTES = 262144;\nvar SOLVE_ID = /^[A-Za-z0-9-]{8,64}$/;\nvar POST = async ({ params, request }) => {\n\trequireMaxBodySize(request, MAX_BODY_BYTES);\n\tconst { solveId } = params;\n\tif (!SOLVE_ID.test(solveId) || !verifySolveToken(solveId, readBearer(request))) apiError(401, ApiErrorCode.UNAUTHORIZED, \"Invalid solve token\");\n\tconst bus = getSolveEventBus();\n\tif (!bus.isOpen(solveId)) apiError(410, ApiErrorCode.NOT_FOUND, \"Solve is no longer open\");\n\tlet body;\n\ttry {\n\t\tbody = await request.json();\n\t} catch {\n\t\tapiError(400, ApiErrorCode.VALIDATION_FAILED, \"Body must be JSON\");\n\t}\n\treturn json(bus.publish(solveId, parseCallbackEvents(body, (/* @__PURE__ */ new Date()).toISOString())));\n};\n//#endregion\nexport { POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAKA,SAAS,UAAU,CAAC,OAAO,EAAE;AAC7B,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;AAClD,CAAC,OAAO,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI;AACjE;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE;AACxC,CAAC,MAAM,GAAG,GAAG,IAAI,EAAE,MAAM;AACzB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE;AACnC,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK;AAC7C,EAAE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,OAAO,EAAE;AACpD,EAAE,MAAM,CAAC,GAAG,KAAK;AACjB,EAAE,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE;AACtD,EAAE,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,GAAG,MAAM;AAC9G,EAAE,OAAO,CAAC;AACV,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI;AACf,GAAG,EAAE,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG;AAC5C,GAAG,GAAG,OAAO,GAAG,EAAE,OAAO,EAAE,GAAG;AAC9B,GAAG,CAAC;AACJ,CAAC,CAAC,CAAC;AACH;AACA;AACA;AACA,IAAI,cAAc,GAAG,MAAM;AAC3B,IAAI,QAAQ,GAAG,sBAAsB;AAClC,IAAC,IAAI,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK;AAC1C,CAAC,kBAAkB,CAAC,OAAO,EAAE,cAAc,CAAC;AAC5C,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM;AAC3B,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,qBAAqB,CAAC;AAChJ,CAAC,MAAM,GAAG,GAAG,gBAAgB,EAAE;AAC/B,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,yBAAyB,CAAC;AAC3F,CAAC,IAAI,IAAI;AACT,CAAC,IAAI;AACL,EAAE,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE;AAC7B,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;AACpE,CAAC;AACD,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;AACzG;;;;"}

package/build/server/chunks/entries/endpoints/auth/email/callback/_server.ts.js-Df6Y9qMu.js

@@ -0,0 +1,49 @@
+import { a as getAuthProvider } from '../../../../../chunks/providers.server.js-BQkh28e-.js';
+import { A as ApiErrorCode } from '../../../../../chunks/access.js-CVIHaHje.js';
+import { s as setSessionCookie, a as setRefreshCookie } from '../../../../../chunks/admin-auth.server.js-cTHF0WiI.js';
+import { a as apiError } from '../../../../../chunks/api-errors.js-D22nCtri.js';
+import { s as safeRedirectTarget } from '../../../../../chunks/redirect.js-2M2qGbv2.js';
+import { b as bootstrapUserSession } from '../../../../../chunks/auth-bootstrap.server.js-C-OChNxp.js';
+import { redirect } from '@sveltejs/kit';
+import '../../../../../chunks/shared-server.js-BGs15m2r.js';
+import '../../../../../chunks/src.js-bYgw0r8C.js';
+import 'zod';
+import '../../../../../chunks/definitions.js-BCLhFUqp.js';
+import '../../../../../chunks/schema.js-CPjRq84j.js';
+import 'node:crypto';
+import '../../../../../chunks/limits.js-WY6OKyVE.js';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '../../../../../chunks/api-token-codec.js-BEHsbOP6.js';
+import '../../../../../chunks/token-codec.js-CxK2DiO-.js';
+import 'node:zlib';
+import '../../../../../chunks/api.js-CQUUF_Xg.js';
+import 'node:dns/promises';
+import 'node:net';
+
+//#region src/routes/auth/email/callback/+server.ts
+/**
+* GET /auth/email/callback?token_hash=...&type=...&redirectTo=/library
+*
+* The user clicked the magic link in their inbox. Hand the full URL to the
+* adapter (it knows its own token format), set cookies on success, redirect
+* to the destination. Mirrors `/auth/supabase/callback` but capability-named
+* — this route doesn't know which IdP brokered the email.
+*/
+var GET = async ({ url, cookies }) => {
+	const emailLink = getAuthProvider().emailLink;
+	if (!emailLink) apiError(501, ApiErrorCode.INTERNAL, "Email sign-in is not supported by this provider.");
+	const result = await emailLink.verifyMagicLink(url.toString());
+	if (!result) apiError(401, ApiErrorCode.UNAUTHORIZED, "This sign-in link is invalid or has expired.");
+	await bootstrapUserSession(result.user);
+	setSessionCookie(cookies, result.sessionToken);
+	if (result.refreshToken) setRefreshCookie(cookies, result.refreshToken);
+	const dest = safeRedirectTarget(url.searchParams.get("redirectTo"), "/library");
+	redirect(303, dest);
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts.js-Df6Y9qMu.js.map

package/build/server/chunks/entries/endpoints/auth/email/callback/_server.ts.js-Df6Y9qMu.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-Df6Y9qMu.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/auth/email/callback/_server.ts.js"],"sourcesContent":["import { r as getAuthProvider } from \"../../../../../chunks/providers.server.js\";\nimport { M as ApiErrorCode } from \"../../../../../chunks/access.js\";\nimport { l as setRefreshCookie, u as setSessionCookie } from \"../../../../../chunks/admin-auth.server.js\";\nimport { t as apiError } from \"../../../../../chunks/api-errors.js\";\nimport { t as safeRedirectTarget } from \"../../../../../chunks/redirect.js\";\nimport { t as bootstrapUserSession } from \"../../../../../chunks/auth-bootstrap.server.js\";\nimport { redirect } from \"@sveltejs/kit\";\n//#region src/routes/auth/email/callback/+server.ts\n/**\n* GET /auth/email/callback?token_hash=...&type=...&redirectTo=/library\n*\n* The user clicked the magic link in their inbox. Hand the full URL to the\n* adapter (it knows its own token format), set cookies on success, redirect\n* to the destination. Mirrors `/auth/supabase/callback` but capability-named\n* — this route doesn't know which IdP brokered the email.\n*/\nvar GET = async ({ url, cookies }) => {\n\tconst emailLink = getAuthProvider().emailLink;\n\tif (!emailLink) apiError(501, ApiErrorCode.INTERNAL, \"Email sign-in is not supported by this provider.\");\n\tconst result = await emailLink.verifyMagicLink(url.toString());\n\tif (!result) apiError(401, ApiErrorCode.UNAUTHORIZED, \"This sign-in link is invalid or has expired.\");\n\tawait bootstrapUserSession(result.user);\n\tsetSessionCookie(cookies, result.sessionToken);\n\tif (result.refreshToken) setRefreshCookie(cookies, result.refreshToken);\n\tconst dest = safeRedirectTarget(url.searchParams.get(\"redirectTo\"), \"/library\");\n\tredirect(303, dest);\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAOA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK;AACtC,CAAC,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC,SAAS;AAC9C,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,kDAAkD,CAAC;AACzG,CAAC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;AAC/D,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,8CAA8C,CAAC;AACtG,CAAC,MAAM,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC;AACxC,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AAC/C,CAAC,IAAI,MAAM,CAAC,YAAY,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AACxE,CAAC,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC;AAChF,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;AACpB;;;;"}

package/build/server/chunks/entries/endpoints/auth/supabase/callback/_server.ts.js-CmUhL03j.js

@@ -0,0 +1,55 @@
+import { a as getAuthProvider } from '../../../../../chunks/providers.server.js-BQkh28e-.js';
+import { A as ApiErrorCode } from '../../../../../chunks/access.js-CVIHaHje.js';
+import { s as setSessionCookie, a as setRefreshCookie } from '../../../../../chunks/admin-auth.server.js-cTHF0WiI.js';
+import { a as apiError } from '../../../../../chunks/api-errors.js-D22nCtri.js';
+import { s as safeRedirectTarget } from '../../../../../chunks/redirect.js-2M2qGbv2.js';
+import { b as bootstrapUserSession } from '../../../../../chunks/auth-bootstrap.server.js-C-OChNxp.js';
+import { c as consumeOAuthState } from '../../../../../chunks/oauthState.server.js-BVkqxviq.js';
+import { redirect } from '@sveltejs/kit';
+import '../../../../../chunks/shared-server.js-BGs15m2r.js';
+import '../../../../../chunks/src.js-bYgw0r8C.js';
+import 'zod';
+import '../../../../../chunks/definitions.js-BCLhFUqp.js';
+import '../../../../../chunks/schema.js-CPjRq84j.js';
+import 'node:crypto';
+import '../../../../../chunks/limits.js-WY6OKyVE.js';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '../../../../../chunks/api-token-codec.js-BEHsbOP6.js';
+import '../../../../../chunks/token-codec.js-CxK2DiO-.js';
+import 'node:zlib';
+import '../../../../../chunks/api.js-CQUUF_Xg.js';
+import 'node:dns/promises';
+import 'node:net';
+
+//#region src/routes/auth/supabase/callback/+server.ts
+/**
+* GET /auth/supabase/callback?code=...&redirectTo=/library
+*
+* Completes a Supabase OAuth round-trip. Exchanges the authorization code
+* for a session, sets the session cookie, and redirects to `redirectTo`.
+*
+* Post-verification flow (data-row seeding + first-admin bootstrap) lives in
+* `bootstrapUserSession` so the email-link and OAuth paths follow the same
+* sequence in the same order.
+*/
+var GET = async ({ url, cookies }) => {
+	if (!consumeOAuthState(cookies, url.searchParams.get("selva_state"))) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Sign-in session expired. Please try again.");
+	const code = url.searchParams.get("code");
+	if (!code) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Missing authorization code");
+	const oauth = getAuthProvider().oauth;
+	if (!oauth) apiError(501, ApiErrorCode.INTERNAL, "OAuth is not supported by the configured auth provider.");
+	const result = await oauth.exchangeOAuthCode(code);
+	if (!result) apiError(401, ApiErrorCode.UNAUTHORIZED, "OAuth exchange failed");
+	await bootstrapUserSession(result.user);
+	setSessionCookie(cookies, result.sessionToken);
+	setRefreshCookie(cookies, result.refreshToken);
+	const dest = safeRedirectTarget(url.searchParams.get("redirectTo"), "/library");
+	redirect(303, dest);
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts.js-CmUhL03j.js.map

package/build/server/chunks/entries/endpoints/auth/supabase/callback/_server.ts.js-CmUhL03j.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-CmUhL03j.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/auth/supabase/callback/_server.ts.js"],"sourcesContent":["import { r as getAuthProvider } from \"../../../../../chunks/providers.server.js\";\nimport { M as ApiErrorCode } from \"../../../../../chunks/access.js\";\nimport { l as setRefreshCookie, u as setSessionCookie } from \"../../../../../chunks/admin-auth.server.js\";\nimport { t as apiError } from \"../../../../../chunks/api-errors.js\";\nimport { t as safeRedirectTarget } from \"../../../../../chunks/redirect.js\";\nimport { t as bootstrapUserSession } from \"../../../../../chunks/auth-bootstrap.server.js\";\nimport { t as consumeOAuthState } from \"../../../../../chunks/oauthState.server.js\";\nimport { redirect } from \"@sveltejs/kit\";\n//#region src/routes/auth/supabase/callback/+server.ts\n/**\n* GET /auth/supabase/callback?code=...&redirectTo=/library\n*\n* Completes a Supabase OAuth round-trip. Exchanges the authorization code\n* for a session, sets the session cookie, and redirects to `redirectTo`.\n*\n* Post-verification flow (data-row seeding + first-admin bootstrap) lives in\n* `bootstrapUserSession` so the email-link and OAuth paths follow the same\n* sequence in the same order.\n*/\nvar GET = async ({ url, cookies }) => {\n\tif (!consumeOAuthState(cookies, url.searchParams.get(\"selva_state\"))) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Sign-in session expired. Please try again.\");\n\tconst code = url.searchParams.get(\"code\");\n\tif (!code) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing authorization code\");\n\tconst oauth = getAuthProvider().oauth;\n\tif (!oauth) apiError(501, ApiErrorCode.INTERNAL, \"OAuth is not supported by the configured auth provider.\");\n\tconst result = await oauth.exchangeOAuthCode(code);\n\tif (!result) apiError(401, ApiErrorCode.UNAUTHORIZED, \"OAuth exchange failed\");\n\tawait bootstrapUserSession(result.user);\n\tsetSessionCookie(cookies, result.sessionToken);\n\tsetRefreshCookie(cookies, result.refreshToken);\n\tconst dest = safeRedirectTarget(url.searchParams.get(\"redirectTo\"), \"/library\");\n\tredirect(303, dest);\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK;AACtC,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,4CAA4C,CAAC;AAClK,CAAC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;AAC1C,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,4BAA4B,CAAC;AACvF,CAAC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC,KAAK;AACtC,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,yDAAyD,CAAC;AAC5G,CAAC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC;AACnD,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,uBAAuB,CAAC;AAC/E,CAAC,MAAM,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC;AACxC,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AAC/C,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AAC/C,CAAC,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC;AAChF,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;AACpB;;;;"}

package/build/server/chunks/entries/endpoints/auth/supabase/start/_server.ts.js-DzivAU5j.js

@@ -0,0 +1,63 @@
+import { a as getAuthProvider } from '../../../../../chunks/providers.server.js-BQkh28e-.js';
+import { A as ApiErrorCode } from '../../../../../chunks/access.js-CVIHaHje.js';
+import { a as apiError } from '../../../../../chunks/api-errors.js-D22nCtri.js';
+import { i as issueOAuthState } from '../../../../../chunks/oauthState.server.js-BVkqxviq.js';
+import { redirect } from '@sveltejs/kit';
+import '../../../../../chunks/shared-server.js-BGs15m2r.js';
+import '../../../../../chunks/src.js-bYgw0r8C.js';
+import 'zod';
+import '../../../../../chunks/definitions.js-BCLhFUqp.js';
+import '../../../../../chunks/schema.js-CPjRq84j.js';
+import 'node:crypto';
+import '../../../../../chunks/limits.js-WY6OKyVE.js';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '../../../../../chunks/api.js-CQUUF_Xg.js';
+import 'node:dns/promises';
+import 'node:net';
+
+//#region src/routes/auth/supabase/start/+server.ts
+var ALLOWED_PROVIDERS = [
+	"google",
+	"github",
+	"azure",
+	"gitlab"
+];
+function isAllowedProvider(value) {
+	return value !== null && ALLOWED_PROVIDERS.includes(value);
+}
+/**
+* GET /auth/supabase/start?provider=google&redirectTo=/library
+*
+* Initiates an OAuth sign-in via Supabase Auth. The Supabase project must
+* have the named provider enabled in its dashboard. Bounces the browser to
+* the IdP's authorize endpoint; the IdP returns to `/auth/supabase/callback`
+* with a `?code=...`.
+*
+* `redirectTo` is preserved through the round trip via `?redirectTo=...` on
+* the callback URL we hand to Supabase.
+*
+* A CSRF nonce rides along the same way. Supabase owns the real OAuth `state`
+* and doesn't expose it, and `exchangeOAuthCode` takes only `code` — so the
+* nonce is our own, carried on the callback URL and compared against a cookie.
+* Without it the callback accepts an attacker's `?code=` and silently signs the
+* victim into the attacker's account. See `oauthState.server.ts`.
+*/
+var GET = async ({ url, cookies }) => {
+	const provider = url.searchParams.get("provider");
+	if (!isAllowedProvider(provider)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid provider. Allowed: ${ALLOWED_PROVIDERS.join(", ")}`);
+	const oauth = getAuthProvider().oauth;
+	if (!oauth) apiError(501, ApiErrorCode.INTERNAL, "OAuth is not supported by the configured auth provider.");
+	const redirectTo = url.searchParams.get("redirectTo") ?? "/library";
+	const callbackUrl = new URL("/auth/supabase/callback", url.origin);
+	if (redirectTo.startsWith("/")) callbackUrl.searchParams.set("redirectTo", redirectTo);
+	callbackUrl.searchParams.set("selva_state", issueOAuthState(cookies));
+	const authorizationUrl = await oauth.getOAuthAuthorizationUrl(provider, callbackUrl.toString());
+	redirect(303, authorizationUrl);
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts.js-DzivAU5j.js.map

package/build/server/chunks/entries/endpoints/auth/supabase/start/_server.ts.js-DzivAU5j.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-DzivAU5j.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/auth/supabase/start/_server.ts.js"],"sourcesContent":["import { r as getAuthProvider } from \"../../../../../chunks/providers.server.js\";\nimport { M as ApiErrorCode } from \"../../../../../chunks/access.js\";\nimport { t as apiError } from \"../../../../../chunks/api-errors.js\";\nimport { n as issueOAuthState } from \"../../../../../chunks/oauthState.server.js\";\nimport { redirect } from \"@sveltejs/kit\";\n//#region src/routes/auth/supabase/start/+server.ts\nvar ALLOWED_PROVIDERS = [\n\t\"google\",\n\t\"github\",\n\t\"azure\",\n\t\"gitlab\"\n];\nfunction isAllowedProvider(value) {\n\treturn value !== null && ALLOWED_PROVIDERS.includes(value);\n}\n/**\n* GET /auth/supabase/start?provider=google&redirectTo=/library\n*\n* Initiates an OAuth sign-in via Supabase Auth. The Supabase project must\n* have the named provider enabled in its dashboard. Bounces the browser to\n* the IdP's authorize endpoint; the IdP returns to `/auth/supabase/callback`\n* with a `?code=...`.\n*\n* `redirectTo` is preserved through the round trip via `?redirectTo=...` on\n* the callback URL we hand to Supabase.\n*\n* A CSRF nonce rides along the same way. Supabase owns the real OAuth `state`\n* and doesn't expose it, and `exchangeOAuthCode` takes only `code` — so the\n* nonce is our own, carried on the callback URL and compared against a cookie.\n* Without it the callback accepts an attacker's `?code=` and silently signs the\n* victim into the attacker's account. See `oauthState.server.ts`.\n*/\nvar GET = async ({ url, cookies }) => {\n\tconst provider = url.searchParams.get(\"provider\");\n\tif (!isAllowedProvider(provider)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid provider. Allowed: ${ALLOWED_PROVIDERS.join(\", \")}`);\n\tconst oauth = getAuthProvider().oauth;\n\tif (!oauth) apiError(501, ApiErrorCode.INTERNAL, \"OAuth is not supported by the configured auth provider.\");\n\tconst redirectTo = url.searchParams.get(\"redirectTo\") ?? \"/library\";\n\tconst callbackUrl = new URL(\"/auth/supabase/callback\", url.origin);\n\tif (redirectTo.startsWith(\"/\")) callbackUrl.searchParams.set(\"redirectTo\", redirectTo);\n\tcallbackUrl.searchParams.set(\"selva_state\", issueOAuthState(cookies));\n\tconst authorizationUrl = await oauth.getOAuthAuthorizationUrl(provider, callbackUrl.toString());\n\tredirect(303, authorizationUrl);\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAKA;AACA,IAAI,iBAAiB,GAAG;AACxB,CAAC,QAAQ;AACT,CAAC,QAAQ;AACT,CAAC,OAAO;AACR,CAAC;AACD,CAAC;AACD,SAAS,iBAAiB,CAAC,KAAK,EAAE;AAClC,CAAC,OAAO,KAAK,KAAK,IAAI,IAAI,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC;AAC3D;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK;AACtC,CAAC,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC;AAClD,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,2BAA2B,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC9I,CAAC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC,KAAK;AACtC,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,yDAAyD,CAAC;AAC5G,CAAC,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,UAAU;AACpE,CAAC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,yBAAyB,EAAE,GAAG,CAAC,MAAM,CAAC;AACnE,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC;AACvF,CAAC,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC;AACtE,CAAC,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,wBAAwB,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC;AAChG,CAAC,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;AAChC;;;;"}