@selvajs/selva 4.20.0-beta.0 → 4.20.0-beta.10

package/build/server/chunks/entries/endpoints/api/v1/solve/_solveId_/cancel/_server.ts.js-Bww7Fr_A.js

@@ -1,28 +0,0 @@
-import { A as ApiErrorCode } from '../../../../../../../chunks/access.js-DVAGPd2H.js';
-import { f as assertScope } from '../../../../../../../chunks/api.js-Cv6E39MW.js';
-import { g as getSolveEventBus } from '../../../../../../../chunks/token.server.js-BYt3vaGK.js';
-import { a as apiError } from '../../../../../../../chunks/api-errors.js-B3KJbNmV.js';
-import { d as asHttpError } from '../../../../../../../chunks/access2.server.js-BkDOERUa.js';
-import { l as liveOwnerKey } from '../../../../../../../chunks/liveSolve.server.js-zNfYPVuT.js';
-import '../../../../../../../chunks/src.js-DubgTP8X.js';
-import 'zod';
-import '../../../../../../../chunks/schema.js-CPjRq84j.js';
-import '../../../../../../../chunks/shared-server.js-BGs15m2r.js';
-import 'node:crypto';
-import '../../../../../../../chunks/definitions.js-BE-Zf2cL.js';
-import 'node:dns/promises';
-import 'node:net';
-import '@sveltejs/kit';
-import '../../../../../../../chunks/outcome-H5XjAroQ.js-C2sjNdmP.js';
-
-//#region src/routes/api/v1/solve/[solveId]/cancel/+server.ts
-var POST = async ({ params, locals }) => {
-	const ownerKey = liveOwnerKey(locals.user?.id);
-	if (!ownerKey) apiError(401, ApiErrorCode.UNAUTHORIZED, "Unauthorized");
-	await asHttpError(() => assertScope(locals.ctx, "solve"));
-	if (!getSolveEventBus().requestAbort(params.solveId, ownerKey)) apiError(404, ApiErrorCode.NOT_FOUND, "No such running solve");
-	return new Response(null, { status: 204 });
-};
-
-export { POST };
-//# sourceMappingURL=_server.ts.js-Bww7Fr_A.js.map

package/build/server/chunks/entries/endpoints/api/v1/solve/_solveId_/cancel/_server.ts.js-Bww7Fr_A.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"_server.ts.js-Bww7Fr_A.js","sources":["../../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/v1/solve/_solveId_/cancel/_server.ts.js"],"sourcesContent":["import { M as ApiErrorCode } from \"../../../../../../../chunks/access.js\";\nimport { S as assertScope } from \"../../../../../../../chunks/api.js\";\nimport { r as getSolveEventBus } from \"../../../../../../../chunks/token.server.js\";\nimport { t as apiError } from \"../../../../../../../chunks/api-errors.js\";\nimport { t as asHttpError } from \"../../../../../../../chunks/access2.server.js\";\nimport { n as liveOwnerKey } from \"../../../../../../../chunks/liveSolve.server.js\";\n//#region src/routes/api/v1/solve/[solveId]/cancel/+server.ts\nvar POST = async ({ params, locals }) => {\n\tconst ownerKey = liveOwnerKey(locals.user?.id);\n\tif (!ownerKey) apiError(401, ApiErrorCode.UNAUTHORIZED, \"Unauthorized\");\n\tawait asHttpError(() => assertScope(locals.ctx, \"solve\"));\n\tif (!getSolveEventBus().requestAbort(params.solveId, ownerKey)) apiError(404, ApiErrorCode.NOT_FOUND, \"No such running solve\");\n\treturn new Response(null, { status: 204 });\n};\n//#endregion\nexport { POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAMA;AACG,IAAC,IAAI,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AACzC,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AAC/C,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC;AACxE,CAAC,MAAM,WAAW,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC1D,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,uBAAuB,CAAC;AAC/H,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC3C;;;;"}

package/build/server/chunks/entries/endpoints/api/v1/solve-events/_server.ts.js-B4CH0Q9Q.js

@@ -1,89 +0,0 @@
-import { A as ApiErrorCode } from '../../../../../chunks/access.js-DVAGPd2H.js';
-import { f as assertScope } from '../../../../../chunks/api.js-Cv6E39MW.js';
-import { g as getSolveEventBus } from '../../../../../chunks/token.server.js-BYt3vaGK.js';
-import { a as apiError } from '../../../../../chunks/api-errors.js-B3KJbNmV.js';
-import { d as asHttpError } from '../../../../../chunks/access2.server.js-BkDOERUa.js';
-import { l as liveOwnerKey } from '../../../../../chunks/liveSolve.server.js-zNfYPVuT.js';
-import '../../../../../chunks/src.js-DubgTP8X.js';
-import 'zod';
-import '../../../../../chunks/schema.js-CPjRq84j.js';
-import '../../../../../chunks/shared-server.js-BGs15m2r.js';
-import 'node:crypto';
-import '../../../../../chunks/definitions.js-BE-Zf2cL.js';
-import 'node:dns/promises';
-import 'node:net';
-import '@sveltejs/kit';
-import '../../../../../chunks/outcome-H5XjAroQ.js-C2sjNdmP.js';
-
-//#region src/lib/server/solveEvents/sse.server.ts
-/** Comment frames keep idle proxies from closing the connection. */
-var HEARTBEAT_MS = 2e4;
-/**
-* The SSE response for one browser stream: registers it on the bus, frames each event as
-* `event: solve`, and unregisters when the client goes. Null when another owner holds `streamId`.
-*/
-function openSolveEventStream(args) {
-	const { bus, streamId, ownerKey, signal } = args;
-	const encoder = new TextEncoder();
-	let write = () => {};
-	const unsubscribe = bus.openStream(streamId, ownerKey, (event) => write(event));
-	if (!unsubscribe) return null;
-	let close = () => {};
-	const body = new ReadableStream({
-		start(controller) {
-			let eventId = 0;
-			let closed = false;
-			const send = (chunk) => {
-				try {
-					controller.enqueue(encoder.encode(chunk));
-				} catch {
-					close();
-				}
-			};
-			write = (event) => send(`id: ${++eventId}\nevent: solve\ndata: ${JSON.stringify(event)}\n\n`);
-			const heartbeat = setInterval(() => send(": ping\n\n"), HEARTBEAT_MS);
-			close = () => {
-				if (closed) return;
-				closed = true;
-				clearInterval(heartbeat);
-				unsubscribe();
-				try {
-					controller.close();
-				} catch {}
-			};
-			signal.addEventListener("abort", close, { once: true });
-			if (signal.aborted) close();
-			send(`event: ready\ndata: ${JSON.stringify({ streamId })}\n\n`);
-		},
-		cancel() {
-			close();
-		}
-	});
-	return new Response(body, { headers: {
-		"Content-Type": "text/event-stream",
-		"Cache-Control": "no-cache, no-transform",
-		Connection: "keep-alive",
-		"X-Accel-Buffering": "no"
-	} });
-}
-//#endregion
-//#region src/routes/api/v1/solve-events/+server.ts
-var STREAM_ID = /^[A-Za-z0-9_-]{16,64}$/;
-var GET = async ({ url, locals, request }) => {
-	const ownerKey = liveOwnerKey(locals.user?.id);
-	if (!ownerKey) apiError(401, ApiErrorCode.UNAUTHORIZED, "Unauthorized");
-	await asHttpError(() => assertScope(locals.ctx, "read"));
-	const streamId = url.searchParams.get("streamId") ?? "";
-	if (!STREAM_ID.test(streamId)) apiError(400, ApiErrorCode.VALIDATION_FAILED, "streamId must be 16-64 URL-safe characters");
-	const response = openSolveEventStream({
-		bus: getSolveEventBus(),
-		streamId,
-		ownerKey,
-		signal: request.signal
-	});
-	if (!response) apiError(409, ApiErrorCode.CONFLICT, "streamId is in use");
-	return response;
-};
-
-export { GET };
-//# sourceMappingURL=_server.ts.js-B4CH0Q9Q.js.map

package/build/server/chunks/entries/endpoints/api/v1/solve-events/_server.ts.js-B4CH0Q9Q.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"_server.ts.js-B4CH0Q9Q.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/v1/solve-events/_server.ts.js"],"sourcesContent":["import { M as ApiErrorCode } from \"../../../../../chunks/access.js\";\nimport { S as assertScope } from \"../../../../../chunks/api.js\";\nimport { r as getSolveEventBus } from \"../../../../../chunks/token.server.js\";\nimport { t as apiError } from \"../../../../../chunks/api-errors.js\";\nimport { t as asHttpError } from \"../../../../../chunks/access2.server.js\";\nimport { n as liveOwnerKey } from \"../../../../../chunks/liveSolve.server.js\";\n//#region src/lib/server/solveEvents/sse.server.ts\n/** Comment frames keep idle proxies from closing the connection. */\nvar HEARTBEAT_MS = 2e4;\n/**\n* The SSE response for one browser stream: registers it on the bus, frames each event as\n* `event: solve`, and unregisters when the client goes. Null when another owner holds `streamId`.\n*/\nfunction openSolveEventStream(args) {\n\tconst { bus, streamId, ownerKey, signal } = args;\n\tconst encoder = new TextEncoder();\n\tlet write = () => {};\n\tconst unsubscribe = bus.openStream(streamId, ownerKey, (event) => write(event));\n\tif (!unsubscribe) return null;\n\tlet close = () => {};\n\tconst body = new ReadableStream({\n\t\tstart(controller) {\n\t\t\tlet eventId = 0;\n\t\t\tlet closed = false;\n\t\t\tconst send = (chunk) => {\n\t\t\t\ttry {\n\t\t\t\t\tcontroller.enqueue(encoder.encode(chunk));\n\t\t\t\t} catch {\n\t\t\t\t\tclose();\n\t\t\t\t}\n\t\t\t};\n\t\t\twrite = (event) => send(`id: ${++eventId}\\nevent: solve\\ndata: ${JSON.stringify(event)}\\n\\n`);\n\t\t\tconst heartbeat = setInterval(() => send(\": ping\\n\\n\"), HEARTBEAT_MS);\n\t\t\tclose = () => {\n\t\t\t\tif (closed) return;\n\t\t\t\tclosed = true;\n\t\t\t\tclearInterval(heartbeat);\n\t\t\t\tunsubscribe();\n\t\t\t\ttry {\n\t\t\t\t\tcontroller.close();\n\t\t\t\t} catch {}\n\t\t\t};\n\t\t\tsignal.addEventListener(\"abort\", close, { once: true });\n\t\t\tif (signal.aborted) close();\n\t\t\tsend(`event: ready\\ndata: ${JSON.stringify({ streamId })}\\n\\n`);\n\t\t},\n\t\tcancel() {\n\t\t\tclose();\n\t\t}\n\t});\n\treturn new Response(body, { headers: {\n\t\t\"Content-Type\": \"text/event-stream\",\n\t\t\"Cache-Control\": \"no-cache, no-transform\",\n\t\tConnection: \"keep-alive\",\n\t\t\"X-Accel-Buffering\": \"no\"\n\t} });\n}\n//#endregion\n//#region src/routes/api/v1/solve-events/+server.ts\nvar STREAM_ID = /^[A-Za-z0-9_-]{16,64}$/;\nvar GET = async ({ url, locals, request }) => {\n\tconst ownerKey = liveOwnerKey(locals.user?.id);\n\tif (!ownerKey) apiError(401, ApiErrorCode.UNAUTHORIZED, \"Unauthorized\");\n\tawait asHttpError(() => assertScope(locals.ctx, \"read\"));\n\tconst streamId = url.searchParams.get(\"streamId\") ?? \"\";\n\tif (!STREAM_ID.test(streamId)) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"streamId must be 16-64 URL-safe characters\");\n\tconst response = openSolveEventStream({\n\t\tbus: getSolveEventBus(),\n\t\tstreamId,\n\t\townerKey,\n\t\tsignal: request.signal\n\t});\n\tif (!response) apiError(409, ApiErrorCode.CONFLICT, \"streamId is in use\");\n\treturn response;\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAMA;AACA;AACA,IAAI,YAAY,GAAG,GAAG;AACtB;AACA;AACA;AACA;AACA,SAAS,oBAAoB,CAAC,IAAI,EAAE;AACpC,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI;AACjD,CAAC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE;AAClC,CAAC,IAAI,KAAK,GAAG,MAAM,CAAC,CAAC;AACrB,CAAC,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,IAAI;AAC9B,CAAC,IAAI,KAAK,GAAG,MAAM,CAAC,CAAC;AACrB,CAAC,MAAM,IAAI,GAAG,IAAI,cAAc,CAAC;AACjC,EAAE,KAAK,CAAC,UAAU,EAAE;AACpB,GAAG,IAAI,OAAO,GAAG,CAAC;AAClB,GAAG,IAAI,MAAM,GAAG,KAAK;AACrB,GAAG,MAAM,IAAI,GAAG,CAAC,KAAK,KAAK;AAC3B,IAAI,IAAI;AACR,KAAK,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9C,IAAI,CAAC,CAAC,MAAM;AACZ,KAAK,KAAK,EAAE;AACZ,IAAI;AACJ,GAAG,CAAC;AACJ,GAAG,KAAK,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,sBAAsB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;AAChG,GAAG,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;AACxE,GAAG,KAAK,GAAG,MAAM;AACjB,IAAI,IAAI,MAAM,EAAE;AAChB,IAAI,MAAM,GAAG,IAAI;AACjB,IAAI,aAAa,CAAC,SAAS,CAAC;AAC5B,IAAI,WAAW,EAAE;AACjB,IAAI,IAAI;AACR,KAAK,UAAU,CAAC,KAAK,EAAE;AACvB,IAAI,CAAC,CAAC,MAAM,CAAC;AACb,GAAG,CAAC;AACJ,GAAG,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC1D,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE;AAC9B,GAAG,IAAI,CAAC,CAAC,oBAAoB,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAClE,EAAE,CAAC;AACH,EAAE,MAAM,GAAG;AACX,GAAG,KAAK,EAAE;AACV,EAAE;AACF,EAAE,CAAC;AACH,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE;AACtC,EAAE,cAAc,EAAE,mBAAmB;AACrC,EAAE,eAAe,EAAE,wBAAwB;AAC3C,EAAE,UAAU,EAAE,YAAY;AAC1B,EAAE,mBAAmB,EAAE;AACvB,EAAE,EAAE,CAAC;AACL;AACA;AACA;AACA,IAAI,SAAS,GAAG,wBAAwB;AACrC,IAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK;AAC9C,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AAC/C,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC;AACxE,CAAC,MAAM,WAAW,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AACzD,CAAC,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE;AACxD,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,4CAA4C,CAAC;AAC3H,CAAC,MAAM,QAAQ,GAAG,oBAAoB,CAAC;AACvC,EAAE,GAAG,EAAE,gBAAgB,EAAE;AACzB,EAAE,QAAQ;AACV,EAAE,QAAQ;AACV,EAAE,MAAM,EAAE,OAAO,CAAC;AAClB,EAAE,CAAC;AACH,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,oBAAoB,CAAC;AAC1E,CAAC,OAAO,QAAQ;AAChB;;;;"}

package/build/server/chunks/entries/endpoints/api/v1/solve-events/_solveId_/_server.ts.js-DydGXQPk.js

@@ -1,62 +0,0 @@
-import { A as ApiErrorCode } from '../../../../../../chunks/access.js-DVAGPd2H.js';
-import { v as verifySolveToken, g as getSolveEventBus } from '../../../../../../chunks/token.server.js-BYt3vaGK.js';
-import { k as requireMaxBodySize } from '../../../../../../chunks/admin-auth.server.js-BuecoIeA.js';
-import { a as apiError } from '../../../../../../chunks/api-errors.js-B3KJbNmV.js';
-import { json } from '@sveltejs/kit';
-import '../../../../../../chunks/src.js-DubgTP8X.js';
-import 'zod';
-import '../../../../../../chunks/schema.js-CPjRq84j.js';
-import '../../../../../../chunks/shared-server.js-BGs15m2r.js';
-import 'node:crypto';
-import '../../../../../../chunks/api-token-codec.js-BEHsbOP6.js';
-import '../../../../../../chunks/token-codec.js-CxK2DiO-.js';
-import 'node:zlib';
-import '../../../../../../chunks/definitions.js-BE-Zf2cL.js';
-import '../../../../../../chunks/api.js-Cv6E39MW.js';
-import 'node:dns/promises';
-import 'node:net';
-
-function readBearer(request) {
-	const auth = request.headers.get("authorization");
-	return auth?.startsWith("Bearer ") ? auth.slice(7).trim() : null;
-}
-/**
-* The events in a callback body, in order. `seq` and `solveId` are the bus's to stamp, so any the
-* plugin sent are ignored. `now` stands in for a missing `at`.
-*/
-function parseCallbackEvents(body, now) {
-	const raw = body?.events;
-	if (!Array.isArray(raw)) return [];
-	return raw.slice(0, 256).flatMap((entry) => {
-		if (!entry || typeof entry !== "object") return [];
-		const e = entry;
-		if (typeof e.type !== "string" || !e.type) return [];
-		const payload = e.payload && typeof e.payload === "object" && !Array.isArray(e.payload) ? e.payload : void 0;
-		return [{
-			type: e.type,
-			at: typeof e.at === "string" ? e.at : now,
-			...payload ? { payload } : {}
-		}];
-	});
-}
-//#endregion
-//#region src/routes/api/v1/solve-events/[solveId]/+server.ts
-var MAX_BODY_BYTES = 262144;
-var SOLVE_ID = /^[A-Za-z0-9-]{8,64}$/;
-var POST = async ({ params, request }) => {
-	requireMaxBodySize(request, MAX_BODY_BYTES);
-	const { solveId } = params;
-	if (!SOLVE_ID.test(solveId) || !verifySolveToken(solveId, readBearer(request))) apiError(401, ApiErrorCode.UNAUTHORIZED, "Invalid solve token");
-	const bus = getSolveEventBus();
-	if (!bus.isOpen(solveId)) apiError(410, ApiErrorCode.NOT_FOUND, "Solve is no longer open");
-	let body;
-	try {
-		body = await request.json();
-	} catch {
-		apiError(400, ApiErrorCode.VALIDATION_FAILED, "Body must be JSON");
-	}
-	return json(bus.publish(solveId, parseCallbackEvents(body, (/* @__PURE__ */ new Date()).toISOString())));
-};
-
-export { POST };
-//# sourceMappingURL=_server.ts.js-DydGXQPk.js.map

package/build/server/chunks/entries/endpoints/api/v1/solve-events/_solveId_/_server.ts.js-DydGXQPk.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"_server.ts.js-DydGXQPk.js","sources":["../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/v1/solve-events/_solveId_/_server.ts.js"],"sourcesContent":["import { M as ApiErrorCode } from \"../../../../../../chunks/access.js\";\nimport { n as verifySolveToken, r as getSolveEventBus } from \"../../../../../../chunks/token.server.js\";\nimport { c as requireMaxBodySize } from \"../../../../../../chunks/admin-auth.server.js\";\nimport { t as apiError } from \"../../../../../../chunks/api-errors.js\";\nimport { json } from \"@sveltejs/kit\";\nfunction readBearer(request) {\n\tconst auth = request.headers.get(\"authorization\");\n\treturn auth?.startsWith(\"Bearer \") ? auth.slice(7).trim() : null;\n}\n/**\n* The events in a callback body, in order. `seq` and `solveId` are the bus's to stamp, so any the\n* plugin sent are ignored. `now` stands in for a missing `at`.\n*/\nfunction parseCallbackEvents(body, now) {\n\tconst raw = body?.events;\n\tif (!Array.isArray(raw)) return [];\n\treturn raw.slice(0, 256).flatMap((entry) => {\n\t\tif (!entry || typeof entry !== \"object\") return [];\n\t\tconst e = entry;\n\t\tif (typeof e.type !== \"string\" || !e.type) return [];\n\t\tconst payload = e.payload && typeof e.payload === \"object\" && !Array.isArray(e.payload) ? e.payload : void 0;\n\t\treturn [{\n\t\t\ttype: e.type,\n\t\t\tat: typeof e.at === \"string\" ? e.at : now,\n\t\t\t...payload ? { payload } : {}\n\t\t}];\n\t});\n}\n//#endregion\n//#region src/routes/api/v1/solve-events/[solveId]/+server.ts\nvar MAX_BODY_BYTES = 262144;\nvar SOLVE_ID = /^[A-Za-z0-9-]{8,64}$/;\nvar POST = async ({ params, request }) => {\n\trequireMaxBodySize(request, MAX_BODY_BYTES);\n\tconst { solveId } = params;\n\tif (!SOLVE_ID.test(solveId) || !verifySolveToken(solveId, readBearer(request))) apiError(401, ApiErrorCode.UNAUTHORIZED, \"Invalid solve token\");\n\tconst bus = getSolveEventBus();\n\tif (!bus.isOpen(solveId)) apiError(410, ApiErrorCode.NOT_FOUND, \"Solve is no longer open\");\n\tlet body;\n\ttry {\n\t\tbody = await request.json();\n\t} catch {\n\t\tapiError(400, ApiErrorCode.VALIDATION_FAILED, \"Body must be JSON\");\n\t}\n\treturn json(bus.publish(solveId, parseCallbackEvents(body, (/* @__PURE__ */ new Date()).toISOString())));\n};\n//#endregion\nexport { POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAKA,SAAS,UAAU,CAAC,OAAO,EAAE;AAC7B,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;AAClD,CAAC,OAAO,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI;AACjE;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE;AACxC,CAAC,MAAM,GAAG,GAAG,IAAI,EAAE,MAAM;AACzB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE;AACnC,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK;AAC7C,EAAE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,OAAO,EAAE;AACpD,EAAE,MAAM,CAAC,GAAG,KAAK;AACjB,EAAE,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE;AACtD,EAAE,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,GAAG,MAAM;AAC9G,EAAE,OAAO,CAAC;AACV,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI;AACf,GAAG,EAAE,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG;AAC5C,GAAG,GAAG,OAAO,GAAG,EAAE,OAAO,EAAE,GAAG;AAC9B,GAAG,CAAC;AACJ,CAAC,CAAC,CAAC;AACH;AACA;AACA;AACA,IAAI,cAAc,GAAG,MAAM;AAC3B,IAAI,QAAQ,GAAG,sBAAsB;AAClC,IAAC,IAAI,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK;AAC1C,CAAC,kBAAkB,CAAC,OAAO,EAAE,cAAc,CAAC;AAC5C,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM;AAC3B,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,qBAAqB,CAAC;AAChJ,CAAC,MAAM,GAAG,GAAG,gBAAgB,EAAE;AAC/B,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,yBAAyB,CAAC;AAC3F,CAAC,IAAI,IAAI;AACT,CAAC,IAAI;AACL,EAAE,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE;AAC7B,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;AACpE,CAAC;AACD,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;AACzG;;;;"}

package/build/server/chunks/entries/endpoints/auth/email/callback/_server.ts.js-D0_7wZ6c.js

@@ -1,49 +0,0 @@
-import { a as getAuthProvider } from '../../../../../chunks/providers.server.js-ChZPXW9c.js';
-import { A as ApiErrorCode } from '../../../../../chunks/access.js-DVAGPd2H.js';
-import { s as setSessionCookie, a as setRefreshCookie } from '../../../../../chunks/admin-auth.server.js-BuecoIeA.js';
-import { a as apiError } from '../../../../../chunks/api-errors.js-B3KJbNmV.js';
-import { s as safeRedirectTarget } from '../../../../../chunks/redirect.js-2M2qGbv2.js';
-import { b as bootstrapUserSession } from '../../../../../chunks/auth-bootstrap.server.js-VpEomuJH.js';
-import { redirect } from '@sveltejs/kit';
-import '../../../../../chunks/shared-server.js-BGs15m2r.js';
-import '../../../../../chunks/src.js-DubgTP8X.js';
-import 'zod';
-import '../../../../../chunks/definitions.js-BE-Zf2cL.js';
-import '../../../../../chunks/schema.js-CPjRq84j.js';
-import 'node:crypto';
-import '../../../../../chunks/limits.js-CXt-o5p8.js';
-import 'node:url';
-import 'node:path';
-import 'node:fs';
-import 'node:fs/promises';
-import '@supabase/supabase-js';
-import '../../../../../chunks/api-token-codec.js-BEHsbOP6.js';
-import '../../../../../chunks/token-codec.js-CxK2DiO-.js';
-import 'node:zlib';
-import '../../../../../chunks/api.js-Cv6E39MW.js';
-import 'node:dns/promises';
-import 'node:net';
-
-//#region src/routes/auth/email/callback/+server.ts
-/**
-* GET /auth/email/callback?token_hash=...&type=...&redirectTo=/library
-*
-* The user clicked the magic link in their inbox. Hand the full URL to the
-* adapter (it knows its own token format), set cookies on success, redirect
-* to the destination. Mirrors `/auth/supabase/callback` but capability-named
-* — this route doesn't know which IdP brokered the email.
-*/
-var GET = async ({ url, cookies }) => {
-	const emailLink = getAuthProvider().emailLink;
-	if (!emailLink) apiError(501, ApiErrorCode.INTERNAL, "Email sign-in is not supported by this provider.");
-	const result = await emailLink.verifyMagicLink(url.toString());
-	if (!result) apiError(401, ApiErrorCode.UNAUTHORIZED, "This sign-in link is invalid or has expired.");
-	await bootstrapUserSession(result.user);
-	setSessionCookie(cookies, result.sessionToken);
-	if (result.refreshToken) setRefreshCookie(cookies, result.refreshToken);
-	const dest = safeRedirectTarget(url.searchParams.get("redirectTo"), "/library");
-	redirect(303, dest);
-};
-
-export { GET };
-//# sourceMappingURL=_server.ts.js-D0_7wZ6c.js.map

package/build/server/chunks/entries/endpoints/auth/email/callback/_server.ts.js-D0_7wZ6c.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"_server.ts.js-D0_7wZ6c.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/auth/email/callback/_server.ts.js"],"sourcesContent":["import { r as getAuthProvider } from \"../../../../../chunks/providers.server.js\";\nimport { M as ApiErrorCode } from \"../../../../../chunks/access.js\";\nimport { l as setRefreshCookie, u as setSessionCookie } from \"../../../../../chunks/admin-auth.server.js\";\nimport { t as apiError } from \"../../../../../chunks/api-errors.js\";\nimport { t as safeRedirectTarget } from \"../../../../../chunks/redirect.js\";\nimport { t as bootstrapUserSession } from \"../../../../../chunks/auth-bootstrap.server.js\";\nimport { redirect } from \"@sveltejs/kit\";\n//#region src/routes/auth/email/callback/+server.ts\n/**\n* GET /auth/email/callback?token_hash=...&type=...&redirectTo=/library\n*\n* The user clicked the magic link in their inbox. Hand the full URL to the\n* adapter (it knows its own token format), set cookies on success, redirect\n* to the destination. Mirrors `/auth/supabase/callback` but capability-named\n* — this route doesn't know which IdP brokered the email.\n*/\nvar GET = async ({ url, cookies }) => {\n\tconst emailLink = getAuthProvider().emailLink;\n\tif (!emailLink) apiError(501, ApiErrorCode.INTERNAL, \"Email sign-in is not supported by this provider.\");\n\tconst result = await emailLink.verifyMagicLink(url.toString());\n\tif (!result) apiError(401, ApiErrorCode.UNAUTHORIZED, \"This sign-in link is invalid or has expired.\");\n\tawait bootstrapUserSession(result.user);\n\tsetSessionCookie(cookies, result.sessionToken);\n\tif (result.refreshToken) setRefreshCookie(cookies, result.refreshToken);\n\tconst dest = safeRedirectTarget(url.searchParams.get(\"redirectTo\"), \"/library\");\n\tredirect(303, dest);\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAOA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK;AACtC,CAAC,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC,SAAS;AAC9C,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,kDAAkD,CAAC;AACzG,CAAC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;AAC/D,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,8CAA8C,CAAC;AACtG,CAAC,MAAM,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC;AACxC,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AAC/C,CAAC,IAAI,MAAM,CAAC,YAAY,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AACxE,CAAC,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC;AAChF,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;AACpB;;;;"}

package/build/server/chunks/entries/endpoints/auth/supabase/callback/_server.ts.js-DrdqjC1E.js

@@ -1,55 +0,0 @@
-import { a as getAuthProvider } from '../../../../../chunks/providers.server.js-ChZPXW9c.js';
-import { A as ApiErrorCode } from '../../../../../chunks/access.js-DVAGPd2H.js';
-import { s as setSessionCookie, a as setRefreshCookie } from '../../../../../chunks/admin-auth.server.js-BuecoIeA.js';
-import { a as apiError } from '../../../../../chunks/api-errors.js-B3KJbNmV.js';
-import { s as safeRedirectTarget } from '../../../../../chunks/redirect.js-2M2qGbv2.js';
-import { b as bootstrapUserSession } from '../../../../../chunks/auth-bootstrap.server.js-VpEomuJH.js';
-import { c as consumeOAuthState } from '../../../../../chunks/oauthState.server.js-BVkqxviq.js';
-import { redirect } from '@sveltejs/kit';
-import '../../../../../chunks/shared-server.js-BGs15m2r.js';
-import '../../../../../chunks/src.js-DubgTP8X.js';
-import 'zod';
-import '../../../../../chunks/definitions.js-BE-Zf2cL.js';
-import '../../../../../chunks/schema.js-CPjRq84j.js';
-import 'node:crypto';
-import '../../../../../chunks/limits.js-CXt-o5p8.js';
-import 'node:url';
-import 'node:path';
-import 'node:fs';
-import 'node:fs/promises';
-import '@supabase/supabase-js';
-import '../../../../../chunks/api-token-codec.js-BEHsbOP6.js';
-import '../../../../../chunks/token-codec.js-CxK2DiO-.js';
-import 'node:zlib';
-import '../../../../../chunks/api.js-Cv6E39MW.js';
-import 'node:dns/promises';
-import 'node:net';
-
-//#region src/routes/auth/supabase/callback/+server.ts
-/**
-* GET /auth/supabase/callback?code=...&redirectTo=/library
-*
-* Completes a Supabase OAuth round-trip. Exchanges the authorization code
-* for a session, sets the session cookie, and redirects to `redirectTo`.
-*
-* Post-verification flow (data-row seeding + first-admin bootstrap) lives in
-* `bootstrapUserSession` so the email-link and OAuth paths follow the same
-* sequence in the same order.
-*/
-var GET = async ({ url, cookies }) => {
-	if (!consumeOAuthState(cookies, url.searchParams.get("selva_state"))) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Sign-in session expired. Please try again.");
-	const code = url.searchParams.get("code");
-	if (!code) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Missing authorization code");
-	const oauth = getAuthProvider().oauth;
-	if (!oauth) apiError(501, ApiErrorCode.INTERNAL, "OAuth is not supported by the configured auth provider.");
-	const result = await oauth.exchangeOAuthCode(code);
-	if (!result) apiError(401, ApiErrorCode.UNAUTHORIZED, "OAuth exchange failed");
-	await bootstrapUserSession(result.user);
-	setSessionCookie(cookies, result.sessionToken);
-	setRefreshCookie(cookies, result.refreshToken);
-	const dest = safeRedirectTarget(url.searchParams.get("redirectTo"), "/library");
-	redirect(303, dest);
-};
-
-export { GET };
-//# sourceMappingURL=_server.ts.js-DrdqjC1E.js.map

package/build/server/chunks/entries/endpoints/auth/supabase/callback/_server.ts.js-DrdqjC1E.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"_server.ts.js-DrdqjC1E.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/auth/supabase/callback/_server.ts.js"],"sourcesContent":["import { r as getAuthProvider } from \"../../../../../chunks/providers.server.js\";\nimport { M as ApiErrorCode } from \"../../../../../chunks/access.js\";\nimport { l as setRefreshCookie, u as setSessionCookie } from \"../../../../../chunks/admin-auth.server.js\";\nimport { t as apiError } from \"../../../../../chunks/api-errors.js\";\nimport { t as safeRedirectTarget } from \"../../../../../chunks/redirect.js\";\nimport { t as bootstrapUserSession } from \"../../../../../chunks/auth-bootstrap.server.js\";\nimport { t as consumeOAuthState } from \"../../../../../chunks/oauthState.server.js\";\nimport { redirect } from \"@sveltejs/kit\";\n//#region src/routes/auth/supabase/callback/+server.ts\n/**\n* GET /auth/supabase/callback?code=...&redirectTo=/library\n*\n* Completes a Supabase OAuth round-trip. Exchanges the authorization code\n* for a session, sets the session cookie, and redirects to `redirectTo`.\n*\n* Post-verification flow (data-row seeding + first-admin bootstrap) lives in\n* `bootstrapUserSession` so the email-link and OAuth paths follow the same\n* sequence in the same order.\n*/\nvar GET = async ({ url, cookies }) => {\n\tif (!consumeOAuthState(cookies, url.searchParams.get(\"selva_state\"))) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Sign-in session expired. Please try again.\");\n\tconst code = url.searchParams.get(\"code\");\n\tif (!code) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing authorization code\");\n\tconst oauth = getAuthProvider().oauth;\n\tif (!oauth) apiError(501, ApiErrorCode.INTERNAL, \"OAuth is not supported by the configured auth provider.\");\n\tconst result = await oauth.exchangeOAuthCode(code);\n\tif (!result) apiError(401, ApiErrorCode.UNAUTHORIZED, \"OAuth exchange failed\");\n\tawait bootstrapUserSession(result.user);\n\tsetSessionCookie(cookies, result.sessionToken);\n\tsetRefreshCookie(cookies, result.refreshToken);\n\tconst dest = safeRedirectTarget(url.searchParams.get(\"redirectTo\"), \"/library\");\n\tredirect(303, dest);\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK;AACtC,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,4CAA4C,CAAC;AAClK,CAAC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;AAC1C,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,4BAA4B,CAAC;AACvF,CAAC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC,KAAK;AACtC,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,yDAAyD,CAAC;AAC5G,CAAC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC;AACnD,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,uBAAuB,CAAC;AAC/E,CAAC,MAAM,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC;AACxC,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AAC/C,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AAC/C,CAAC,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC;AAChF,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;AACpB;;;;"}

package/build/server/chunks/entries/endpoints/auth/supabase/start/_server.ts.js-BmvoAwMm.js

@@ -1,63 +0,0 @@
-import { a as getAuthProvider } from '../../../../../chunks/providers.server.js-ChZPXW9c.js';
-import { A as ApiErrorCode } from '../../../../../chunks/access.js-DVAGPd2H.js';
-import { a as apiError } from '../../../../../chunks/api-errors.js-B3KJbNmV.js';
-import { i as issueOAuthState } from '../../../../../chunks/oauthState.server.js-BVkqxviq.js';
-import { redirect } from '@sveltejs/kit';
-import '../../../../../chunks/shared-server.js-BGs15m2r.js';
-import '../../../../../chunks/src.js-DubgTP8X.js';
-import 'zod';
-import '../../../../../chunks/definitions.js-BE-Zf2cL.js';
-import '../../../../../chunks/schema.js-CPjRq84j.js';
-import 'node:crypto';
-import '../../../../../chunks/limits.js-CXt-o5p8.js';
-import 'node:url';
-import 'node:path';
-import 'node:fs';
-import 'node:fs/promises';
-import '@supabase/supabase-js';
-import '../../../../../chunks/api.js-Cv6E39MW.js';
-import 'node:dns/promises';
-import 'node:net';
-
-//#region src/routes/auth/supabase/start/+server.ts
-var ALLOWED_PROVIDERS = [
-	"google",
-	"github",
-	"azure",
-	"gitlab"
-];
-function isAllowedProvider(value) {
-	return value !== null && ALLOWED_PROVIDERS.includes(value);
-}
-/**
-* GET /auth/supabase/start?provider=google&redirectTo=/library
-*
-* Initiates an OAuth sign-in via Supabase Auth. The Supabase project must
-* have the named provider enabled in its dashboard. Bounces the browser to
-* the IdP's authorize endpoint; the IdP returns to `/auth/supabase/callback`
-* with a `?code=...`.
-*
-* `redirectTo` is preserved through the round trip via `?redirectTo=...` on
-* the callback URL we hand to Supabase.
-*
-* A CSRF nonce rides along the same way. Supabase owns the real OAuth `state`
-* and doesn't expose it, and `exchangeOAuthCode` takes only `code` — so the
-* nonce is our own, carried on the callback URL and compared against a cookie.
-* Without it the callback accepts an attacker's `?code=` and silently signs the
-* victim into the attacker's account. See `oauthState.server.ts`.
-*/
-var GET = async ({ url, cookies }) => {
-	const provider = url.searchParams.get("provider");
-	if (!isAllowedProvider(provider)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid provider. Allowed: ${ALLOWED_PROVIDERS.join(", ")}`);
-	const oauth = getAuthProvider().oauth;
-	if (!oauth) apiError(501, ApiErrorCode.INTERNAL, "OAuth is not supported by the configured auth provider.");
-	const redirectTo = url.searchParams.get("redirectTo") ?? "/library";
-	const callbackUrl = new URL("/auth/supabase/callback", url.origin);
-	if (redirectTo.startsWith("/")) callbackUrl.searchParams.set("redirectTo", redirectTo);
-	callbackUrl.searchParams.set("selva_state", issueOAuthState(cookies));
-	const authorizationUrl = await oauth.getOAuthAuthorizationUrl(provider, callbackUrl.toString());
-	redirect(303, authorizationUrl);
-};
-
-export { GET };
-//# sourceMappingURL=_server.ts.js-BmvoAwMm.js.map

package/build/server/chunks/entries/endpoints/auth/supabase/start/_server.ts.js-BmvoAwMm.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"_server.ts.js-BmvoAwMm.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/auth/supabase/start/_server.ts.js"],"sourcesContent":["import { r as getAuthProvider } from \"../../../../../chunks/providers.server.js\";\nimport { M as ApiErrorCode } from \"../../../../../chunks/access.js\";\nimport { t as apiError } from \"../../../../../chunks/api-errors.js\";\nimport { n as issueOAuthState } from \"../../../../../chunks/oauthState.server.js\";\nimport { redirect } from \"@sveltejs/kit\";\n//#region src/routes/auth/supabase/start/+server.ts\nvar ALLOWED_PROVIDERS = [\n\t\"google\",\n\t\"github\",\n\t\"azure\",\n\t\"gitlab\"\n];\nfunction isAllowedProvider(value) {\n\treturn value !== null && ALLOWED_PROVIDERS.includes(value);\n}\n/**\n* GET /auth/supabase/start?provider=google&redirectTo=/library\n*\n* Initiates an OAuth sign-in via Supabase Auth. The Supabase project must\n* have the named provider enabled in its dashboard. Bounces the browser to\n* the IdP's authorize endpoint; the IdP returns to `/auth/supabase/callback`\n* with a `?code=...`.\n*\n* `redirectTo` is preserved through the round trip via `?redirectTo=...` on\n* the callback URL we hand to Supabase.\n*\n* A CSRF nonce rides along the same way. Supabase owns the real OAuth `state`\n* and doesn't expose it, and `exchangeOAuthCode` takes only `code` — so the\n* nonce is our own, carried on the callback URL and compared against a cookie.\n* Without it the callback accepts an attacker's `?code=` and silently signs the\n* victim into the attacker's account. See `oauthState.server.ts`.\n*/\nvar GET = async ({ url, cookies }) => {\n\tconst provider = url.searchParams.get(\"provider\");\n\tif (!isAllowedProvider(provider)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid provider. Allowed: ${ALLOWED_PROVIDERS.join(\", \")}`);\n\tconst oauth = getAuthProvider().oauth;\n\tif (!oauth) apiError(501, ApiErrorCode.INTERNAL, \"OAuth is not supported by the configured auth provider.\");\n\tconst redirectTo = url.searchParams.get(\"redirectTo\") ?? \"/library\";\n\tconst callbackUrl = new URL(\"/auth/supabase/callback\", url.origin);\n\tif (redirectTo.startsWith(\"/\")) callbackUrl.searchParams.set(\"redirectTo\", redirectTo);\n\tcallbackUrl.searchParams.set(\"selva_state\", issueOAuthState(cookies));\n\tconst authorizationUrl = await oauth.getOAuthAuthorizationUrl(provider, callbackUrl.toString());\n\tredirect(303, authorizationUrl);\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAKA;AACA,IAAI,iBAAiB,GAAG;AACxB,CAAC,QAAQ;AACT,CAAC,QAAQ;AACT,CAAC,OAAO;AACR,CAAC;AACD,CAAC;AACD,SAAS,iBAAiB,CAAC,KAAK,EAAE;AAClC,CAAC,OAAO,KAAK,KAAK,IAAI,IAAI,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC;AAC3D;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK;AACtC,CAAC,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC;AAClD,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,2BAA2B,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC9I,CAAC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC,KAAK;AACtC,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,yDAAyD,CAAC;AAC5G,CAAC,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,UAAU;AACpE,CAAC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,yBAAyB,EAAE,GAAG,CAAC,MAAM,CAAC;AACnE,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC;AACvF,CAAC,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC;AACtE,CAAC,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,wBAAwB,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC;AAChG,CAAC,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;AAChC;;;;"}