@selvajs/selva 4.20.0-beta.13 → 4.20.0-beta.14

package/build/server/chunks/chunks/api.js-CWQeuHWw.js

@@ -0,0 +1,1165 @@
+import { e as ProjectVisibilitySchema, f as ProjectRoleSchema, g as PlatformPermissionSchema, O as OrgPermissionSchema, i as OrgRoleSchema, a as ALL_ORG_PERMISSIONS, j as API_TOKEN_LIFETIME_DAYS, k as ApiScopeStringSchema, s as scopeAllows, P as ProviderError, o as outsideTokenOrg } from './src.js-BQFsdJf3.js';
+import { d as apiError, f as ApiError, A as ApiErrorCode, t as toErrorBody, g as isApiError, i as isFlagEnabled, h as readNonNegativeInt, j as readPositiveInt, C as ComputeServerUnconfiguredError, k as codeForStatus } from './access.js-DbWaEG7Y.js';
+import { N as NoopEventSink, S as SchemaExtractionError } from './schema-extraction.js-DxFeK69H.js';
+import { c as createComputeRateLimiter } from './rate-limit.js-Br3luBbc.js';
+import { createHash } from 'node:crypto';
+import { z } from 'zod';
+
+/**
+* `T` is whatever the caller replays. It must not be a `Response` — a body can
+* only be read once, so the solve route stores a serialized snapshot instead.
+*/
+function createIdempotencyStore(config) {
+	const ttlMs = Math.max(0, Math.floor(config.ttlMs));
+	const maxKeys = Math.max(1, Math.floor(config.maxKeys ?? 1e4));
+	const sweepIntervalMs = Math.max(0, Math.floor(config.sweepIntervalMs ?? ttlMs));
+	const resolvedConfig = Object.freeze({
+		...config,
+		ttlMs,
+		maxKeys,
+		sweepIntervalMs
+	});
+	const entries = /* @__PURE__ */ new Map();
+	let nextSweepAt = Number.POSITIVE_INFINITY;
+	function maybeSweep(now, headroom = 0) {
+		const budget = Math.max(0, maxKeys - headroom);
+		if (!(sweepIntervalMs > 0 && now >= nextSweepAt) && entries.size <= budget) return;
+		for (const [key, entry] of entries) if (entry.expiresAt !== null && now > entry.expiresAt) entries.delete(key);
+		if (sweepIntervalMs > 0) nextSweepAt = now + sweepIntervalMs;
+		if (entries.size > budget) {
+			const byExpiryAsc = [...entries.entries()].sort((a, b) => (a[1].expiresAt ?? Infinity) - (b[1].expiresAt ?? Infinity));
+			for (let i = 0; i < byExpiryAsc.length - budget; i++) entries.delete(byExpiryAsc[i][0]);
+		}
+	}
+	return {
+		config: resolvedConfig,
+		async run(key, fn) {
+			const now = Date.now();
+			const existing = entries.get(key);
+			if (existing && (existing.expiresAt === null || now <= existing.expiresAt)) return {
+				value: await existing.promise,
+				replayed: true
+			};
+			maybeSweep(now, entries.has(key) ? 0 : 1);
+			const promise = fn();
+			const entry = {
+				promise,
+				expiresAt: null
+			};
+			entries.set(key, entry);
+			if (sweepIntervalMs > 0 && nextSweepAt === Number.POSITIVE_INFINITY) nextSweepAt = now + sweepIntervalMs;
+			try {
+				const value = await promise;
+				entry.expiresAt = Date.now() + ttlMs;
+				return {
+					value,
+					replayed: false
+				};
+			} catch (err) {
+				if (entries.get(key) === entry) entries.delete(key);
+				throw err;
+			}
+		},
+		reset() {
+			entries.clear();
+			nextSweepAt = Number.POSITIVE_INFINITY;
+		},
+		size() {
+			return entries.size;
+		}
+	};
+}
+// ../server/src/api/deps.ts
+/**
+* Everything an API handler talks to, as one injected value.
+*
+* Handlers used to reach module-global getters (`getProjectProvider()`,
+* `getDefinitionService()`, …) from the Selva app's composition root — 77 call
+* sites across the v1 routes. That welded them to one app's boot: a second app
+* on a different provider set could not call them at all.
+*
+* Most fields are sub-stores of `IDataProvider`, so a host that already built a
+* `SelvaConfig` gets them via `depsFromConfig`. `services` stays host-defined:
+* `DefinitionService` and friends are composed rather than resolved, and a host
+* may supply its own.
+*/
+/**
+* Build deps from a resolved `SelvaConfig`, plus whatever services and token
+* codecs the host composed on top. The hoisted fields are aliases into `data`,
+* not copies.
+*
+* `services` stays positional — every existing caller passes it there — and
+* `tokens` arrives in an options object rather than as a third positional, so
+* the two composed bags cannot be swapped at a call site.
+*/
+function depsFromConfig(config, services = {}, { tokens = {}, uploadLimits, evictComputeClient = () => {}, notifications, instanceName = "Selva", apiTokenSettingsPath = "/settings/tokens", apiRateLimiter, idempotency } = {}) {
+	const { data } = config;
+	return {
+		auth: config.auth,
+		storage: config.storage,
+		data,
+		orgs: data.orgs,
+		projects: data.projects,
+		definitionMeta: data.definitions,
+		computeServer: data.computeServer,
+		userProfile: data.userProfile,
+		shareLinks: data.shareLinks,
+		invites: data.invites,
+		permissions: data.permissions,
+		platformProjectGrants: data.platformProjectGrants,
+		events: config.events ?? new NoopEventSink(),
+		flag: (name) => isFlagEnabled(config, name),
+		tokens,
+		uploadLimits: {
+			maxDefinitionFileSize: uploadLimits?.maxDefinitionFileSize ?? 52428800,
+			maxImageFileSize: uploadLimits?.maxImageFileSize ?? 10485760
+		},
+		evictComputeClient,
+		notifications,
+		instanceName,
+		apiTokenSettingsPath,
+		apiRateLimiter,
+		idempotency,
+		services
+	};
+}
+// ../server/src/api/request.ts
+/**
+* The authenticated caller, or a 401.
+*
+* `ctx` and `user` are optional on `ApiRequest` because a host builds one for
+* anonymous requests too (share-token solves reach handlers with a `ctx` and no
+* `user`). Every handler that needs an identity narrows it here rather than
+* asserting the fields non-null, so the unauthenticated path fails as a denial
+* instead of a crash.
+*/
+function requireCaller(req) {
+	if (!req.ctx || !req.user) apiError(401, ApiErrorCode.UNAUTHORIZED, "Unauthorized");
+	return {
+		ctx: req.ctx,
+		user: req.user
+	};
+}
+/**
+* Fail with a Zod error's messages, one per field.
+*
+* The top-level `message` names the first problem so a human reading the
+* response learns something without parsing `fields`.
+*/
+function throwZodError(err) {
+	const fields = {};
+	for (const issue of err.issues) {
+		const key = issue.path.length ? issue.path.join(".") : "_";
+		if (!(key in fields)) fields[key] = issue.message;
+	}
+	const first = err.issues[0];
+	const path = first.path.length ? `${first.path.join(".")}: ` : "";
+	apiError(400, ApiErrorCode.VALIDATION_FAILED, `${path}${first.message}`, fields);
+}
+/**
+* Read required path params, 400ing on any that is missing or blank.
+*
+* A router types every param as `string`, but a route can be reached with an
+* empty segment — this catches that instead of letting a stale non-null
+* assertion paper over it.
+*
+* Does **not** validate format — a guid-shaped param still goes through a
+* schema where the route cares. Replaces the `if (!id) apiError(...)` preamble,
+* not the schema check.
+*/
+function requireParams(params, ...names) {
+	const out = {};
+	const missing = [];
+	for (const name of names) {
+		const value = params[name];
+		if (!value) {
+			missing.push(name);
+			continue;
+		}
+		out[name] = value;
+	}
+	if (missing.length) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Missing path parameter${missing.length > 1 ? "s" : ""}: ${missing.join(", ")}`);
+	return out;
+}
+/**
+* Read a path param through a Zod schema, 400ing on a bad value.
+*
+* The format-checking counterpart to `requireParams` — for guids, enum-shaped
+* segments, anything where "present" isn't the same as "valid".
+*/
+function parseParam(value, schema, name) {
+	const parsed = schema.safeParse(value);
+	if (!parsed.success) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid or missing ${name}`);
+	return parsed.data;
+}
+/**
+* Parse and validate a JSON body. A malformed body becomes `null` rather than
+* throwing, so it fails the schema as a validation error — broken JSON gets a
+* 400 naming the problem, not a 500 from `request.json()`.
+*
+* `missingAs` covers endpoints whose fields are all optional: passing `{}` lets
+* an empty body mean "no changes" instead of a validation failure.
+*/
+async function parseBody(request, schema, { missingAs } = {}) {
+	const raw = await request.json().catch(() => null);
+	const parsed = schema.safeParse(raw ?? missingAs ?? null);
+	if (!parsed.success) throwZodError(parsed.error);
+	return parsed.data;
+}
+var parsedForms = /* @__PURE__ */ new WeakMap();
+/**
+* The request's form body, parsed once: the idempotency fingerprint reads it
+* before the handler does, and a definition upload is too large to buffer twice.
+* On an idempotent route, `request.formData()` throws: the body is already used.
+*/
+function readForm(request) {
+	let form = parsedForms.get(request);
+	if (!form) parsedForms.set(request, form = request.formData());
+	return form;
+}
+/**
+* Pull a required file out of a multipart body and check its size and, where
+* given, its extension.
+*
+* A second line of defence, not the first: a host's body-size guard should
+* reject an oversized request before it is buffered. This catches a file that
+* is individually too large inside a request that isn't.
+*
+* Caps are passed in rather than read here — they are deployment config, and a
+* package that resolved them would pin every host to one source of truth.
+*/
+function requireUpload(form, field, { maxBytes, extensions, contentTypes, label = "File" }) {
+	const file = form.get(field);
+	if (!(file instanceof File) || file.size === 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, `A ${label.toLowerCase()} is required`);
+	const extension = file.name.slice(file.name.lastIndexOf(".")).toLowerCase();
+	if (extensions && !extensions.includes(extension)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `File type not allowed. Allowed: ${extensions.join(", ")}`);
+	if (contentTypes && !contentTypes.allowed.has(file.type)) apiError(400, ApiErrorCode.VALIDATION_FAILED, contentTypes.message);
+	if (file.size > maxBytes) apiError(400, ApiErrorCode.VALIDATION_FAILED, `${label} too large. Max size: ${maxBytes / 1048576} MB`);
+	return {
+		file,
+		extension
+	};
+}
+/** A multipart text field, trimmed and length-capped. Absent stays `undefined`. */
+function formText(form, field, { maxLength } = {}) {
+	const raw = form.get(field);
+	if (typeof raw !== "string") return void 0;
+	const trimmed = raw.trim();
+	if (!trimmed) return void 0;
+	return maxLength ? trimmed.slice(0, maxLength) : trimmed;
+}
+// ../server/src/api/scope.ts
+/** The default action for a method: reads are `read`, everything else `write`. */
+function actionForMethod(method) {
+	return method === "GET" || method === "HEAD" ? "read" : "write";
+}
+/**
+* Refuse an API-token request its scopes don't cover, with 403 naming the
+* scope that would have passed. Browser sessions always pass.
+*
+* `runHandler` calls this for every mounted route. A route that builds its own
+* `Response` must call it itself.
+*/
+function assertScope(ctx, action, target) {
+	if (!ctx?.apiScope || scopeAllows(ctx, action, target)) return;
+	recordRefusal(ctx.apiScope.tokenId);
+	apiError(403, ApiErrorCode.FORBIDDEN, `This API token doesn't allow ${action} here.`, void 0, { requiredScope: requiredScope(ctx, action, target) });
+}
+var refusals = /* @__PURE__ */ new Map();
+var utcDay = () => (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+function recordRefusal(tokenId) {
+	const day = utcDay();
+	const entry = refusals.get(tokenId);
+	if (entry?.day === day) entry.count++;
+	else refusals.set(tokenId, {
+		day,
+		count: 1
+	});
+}
+/** Scope refusals for `tokenId` since midnight UTC, in this process. */
+function scopeRefusalsToday(tokenId) {
+	const entry = refusals.get(tokenId);
+	return entry?.day === utcDay() ? entry.count : 0;
+}
+function requiredScope(ctx, action, target) {
+	if (target?.projectId) return `${action}:project:${target.projectId}`;
+	if (target?.definitionId) return `${action}:definition:${target.definitionId}`;
+	return `${action}:org:${ctx.actingOrgId}`;
+}
+/** Scope target for routes addressed by a project id param. */
+function projectScopeTarget(param = "id") {
+	return (req) => ({ projectId: req.params[param] });
+}
+/**
+* Scope target for routes addressed by a definition guid param. Loads the
+* record so a project-scoped key reaches the definitions inside its project.
+*
+* A definition outside the key's org resolves like a missing one: otherwise the
+* 403 detail would confirm the guid exists and name its project.
+*/
+function definitionScopeTarget(param = "guid") {
+	return async (req) => {
+		const definitionId = req.params[param];
+		if (!definitionId || !req.ctx) return { definitionId };
+		const record = await req.deps.definitionMeta.get(req.ctx, definitionId);
+		const project = record ? await req.deps.projects.getProject(req.ctx, record.projectId) : null;
+		if (!project || outsideTokenOrg(req.ctx, project.orgId)) return { definitionId };
+		return {
+			definitionId,
+			projectId: project.id
+		};
+	};
+}
+// ../server/src/api/rate-limit.ts
+var DEFAULT_API_RATE_LIMIT = Object.freeze({
+	windowMs: 6e4,
+	maxPerWindow: 600
+});
+/**
+* Read `API_TOKEN_RATE_LIMIT_MAX` (requests per window, `0` = off) and
+* `API_TOKEN_RATE_LIMIT_WINDOW_MS` from an injected env map.
+*/
+function resolveApiRateLimitConfig(env, logger) {
+	return {
+		windowMs: readPositiveInt(env, "API_TOKEN_RATE_LIMIT_WINDOW_MS", DEFAULT_API_RATE_LIMIT.windowMs, logger),
+		maxPerWindow: readNonNegativeInt(env, "API_TOKEN_RATE_LIMIT_MAX", DEFAULT_API_RATE_LIMIT.maxPerWindow, logger)
+	};
+}
+/** Process-local fixed-window limiter. Returns `null` when `maxPerWindow` is 0. */
+function createApiRateLimiter(config = DEFAULT_API_RATE_LIMIT) {
+	if (config.maxPerWindow <= 0) return null;
+	const inner = createComputeRateLimiter(config);
+	const limit = config.maxPerWindow;
+	return { hit(key) {
+		const result = inner.check(key);
+		return {
+			allowed: result.allowed,
+			limit,
+			remaining: Math.max(0, limit - inner.count(key)),
+			retryAfter: result.retryAfter
+		};
+	} };
+}
+var sharedDefault$1;
+/**
+* The limiter `depsFromConfig` wires when the host passes none. One per
+* process: deps are rebuilt per request, and a limiter per request counts
+* nothing.
+*/
+function defaultApiRateLimiter() {
+	if (sharedDefault$1 === void 0) sharedDefault$1 = createApiRateLimiter();
+	return sharedDefault$1;
+}
+/**
+* Charge one request to the caller's token. `undefined` for a session caller
+* or when no limiter is wired.
+*/
+async function chargeApiRateLimit(ctx, limiter) {
+	if (!ctx?.apiScope || !limiter) return void 0;
+	return limiter.hit(`token:${ctx.apiScope.tokenId}`);
+}
+function rateLimitHeaders(verdict) {
+	const headers = {
+		"RateLimit-Limit": String(verdict.limit),
+		"RateLimit-Remaining": String(verdict.remaining)
+	};
+	if (!verdict.allowed) headers["Retry-After"] = String(verdict.retryAfter ?? 1);
+	return headers;
+}
+/** The 429 envelope, with `Retry-After` and the `RateLimit-*` headers. */
+function rateLimitedResponse(verdict, message = `Too many requests for this API token. Retry in ${verdict.retryAfter ?? 1}s.`) {
+	const retryAfter = String(verdict.retryAfter ?? 1);
+	const err = new ApiError(429, ApiErrorCode.RATE_LIMITED, message, void 0, { retryAfter });
+	return new Response(JSON.stringify(toErrorBody(err)), {
+		status: 429,
+		headers: {
+			"content-type": "application/json",
+			...rateLimitHeaders(verdict)
+		}
+	});
+}
+/** Stamp the `RateLimit-*` headers onto a response. No-op without a verdict. */
+function withRateLimitHeaders(res, verdict) {
+	if (!verdict) return res;
+	const headers = rateLimitHeaders(verdict);
+	try {
+		for (const [k, v] of Object.entries(headers)) res.headers.set(k, v);
+		return res;
+	} catch {
+		const copy = new Headers(res.headers);
+		for (const [k, v] of Object.entries(headers)) copy.set(k, v);
+		return new Response(res.body, {
+			status: res.status,
+			statusText: res.statusText,
+			headers: copy
+		});
+	}
+}
+// ../server/src/api/idempotency-http.ts
+/**
+* The HTTP layer over {@link createIdempotencyStore}: how a replayed response
+* is keyed, snapshotted, and identified on the wire.
+*
+* The store itself is generic over `T` and knows nothing about requests. This
+* is the part two hosts must agree on to implement the same `Idempotency-Key`
+* contract, and the part each would otherwise reinvent:
+*
+*   - **The key namespaces by caller.** `Idempotency-Key` is client-chosen, so
+*     two tenants can pick the same string. Without the caller in the key one
+*     would replay the other's result — that is the whole security property
+*     here, and a host that got it wrong would leak across tenants with
+*     nothing failing at build time.
+*   - **The response round-trips through a snapshot.** A `Response` body reads
+*     exactly once, so storing the object itself replays an empty body.
+*   - **A replay says so**, via `Idempotency-Replayed`. A client that cannot
+*     tell a replay from a fresh run cannot tell a successful retry from a
+*     second execution.
+*
+* How long a response stays replayable is *not* here: that trades a client's
+* retry window against serving a stale result after the underlying resource
+* moves, and only the host knows its own deadlines.
+*/
+/** Header stamped on a replayed response, so a client can distinguish one. */
+var IDEMPOTENCY_REPLAYED_HEADER = "Idempotency-Replayed";
+/**
+* Namespace a client-chosen key by its caller.
+*
+* `callerId` should be the narrowest identity available — a token id rather
+* than a user id where the host issues per-token credentials, so two tokens
+* held by one user do not share replays.
+*/
+function idempotencyKey(callerId, clientKey) {
+	return `${callerId} ${clientKey}`;
+}
+/** Flatten a response so it can be replayed. Consumes the body. */
+async function toStoredResponse(res) {
+	return {
+		status: res.status,
+		headers: [...res.headers.entries()],
+		body: await res.arrayBuffer()
+	};
+}
+/** Rebuild a live `Response` from a snapshot, marking it when it is a replay. */
+function fromStoredResponse(stored, replayed) {
+	const headers = new Headers(stored.headers);
+	if (replayed) headers.set(IDEMPOTENCY_REPLAYED_HEADER, "true");
+	return new Response(stored.body, {
+		status: stored.status,
+		headers
+	});
+}
+// ../server/src/api/idempotency.ts
+/**
+* `Idempotency-Key` for mounted routes that opt in with `idempotent: true`.
+*
+* Built on the generic store (`../compute/idempotency.ts`) and the wire
+* contract (`./idempotency-http.ts`). The store absorbs in-flight and near-term
+* retries in this process; it is not a durable record. A create that must never duplicate also needs the key on
+* the created row under a unique constraint, written in the same transaction.
+*
+* Each entry carries a fingerprint of method, path, query and body, so a client that
+* reuses a key for a different request gets 422 instead of someone else's
+* replay. Only responses below 400 are kept: a failed attempt frees the key so
+* a corrected retry can run.
+*/
+var IDEMPOTENCY_KEY_HEADER = "Idempotency-Key";
+/** Covers a client's retry-on-timeout window without turning into a result cache. */
+var DEFAULT_API_IDEMPOTENCY_TTL_MS = 3e5;
+function createApiIdempotencyStore(ttlMs = DEFAULT_API_IDEMPOTENCY_TTL_MS) {
+	return createIdempotencyStore({ ttlMs });
+}
+var sharedDefault;
+/** The store `depsFromConfig` wires when the host passes none. One per process. */
+function defaultApiIdempotencyStore() {
+	return sharedDefault ??= createApiIdempotencyStore();
+}
+/**
+* The narrowest identity a key is namespaced by: the token for a token
+* request, so two keys of one user never share replays, else the user.
+*/
+function idempotencyCallerId(ctx) {
+	return ctx.apiScope ? `token:${ctx.apiScope.tokenId}` : `user:${ctx.userId}`;
+}
+/** Read and validate the client's key. `null` when the header is absent. */
+function readIdempotencyKey(request) {
+	const key = request.headers.get(IDEMPOTENCY_KEY_HEADER);
+	if (key === null) return null;
+	if (key.length === 0 || key.length > 255) apiError(400, ApiErrorCode.VALIDATION_FAILED, `${IDEMPOTENCY_KEY_HEADER} must be 1 to 255 characters.`);
+	return key;
+}
+async function sha256Hex(bytes) {
+	const digest = await crypto.subtle.digest("SHA-256", bytes);
+	return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("");
+}
+/** SHA-256 over method, path with query, and body, hex. */
+async function requestFingerprint(method, url, body) {
+	const head = new TextEncoder().encode(`${method.toUpperCase()} ${url.pathname}${url.search}\n`);
+	const tail = typeof body === "string" ? new TextEncoder().encode(body) : new Uint8Array(body);
+	const bytes = new Uint8Array(head.length + tail.length);
+	bytes.set(head);
+	bytes.set(tail, head.length);
+	return sha256Hex(bytes);
+}
+async function fileSha256Hex(file) {
+	const hash = createHash("sha256");
+	for await (const chunk of file.stream()) hash.update(chunk);
+	return hash.digest("hex");
+}
+/**
+* The body `requestFingerprint` should hash. The handler can still read it: a
+* JSON body comes from a clone, a form through `readForm`, which parses it once
+* for both.
+*
+* Multipart is canonicalized to its fields and file contents: clients pick a
+* fresh random boundary per request, so the raw bytes of an identical retry
+* never match.
+*/
+async function fingerprintBody(request) {
+	if (!(request.headers.get("content-type") ?? "").toLowerCase().startsWith("multipart/form-data")) return request.clone().arrayBuffer();
+	let form;
+	try {
+		form = await readForm(request);
+	} catch {
+		return "malformed multipart";
+	}
+	const parts = [];
+	for (const [name, value] of form) parts.push([name, typeof value === "string" ? value : {
+		file: value.name,
+		type: value.type,
+		sha256: await fileSha256Hex(value)
+	}]);
+	return JSON.stringify(parts);
+}
+var NotReplayable = class {
+	fingerprint;
+	response;
+	constructor(fingerprint, response) {
+		this.fingerprint = fingerprint;
+		this.response = response;
+	}
+};
+function assertSameRequest(stored, fingerprint) {
+	if (stored !== fingerprint) apiError(422, ApiErrorCode.UNPROCESSABLE, `This ${IDEMPOTENCY_KEY_HEADER} was already used for a different request.`);
+}
+/**
+* Run `fn` once per `(callerId, clientKey)`, replaying its response to repeats
+* with `Idempotency-Replayed: true`. Throws 422 when the key was used for a
+* different request. Errors `fn` throws propagate and free the key.
+*/
+async function runIdempotent({ store, callerId, clientKey, fingerprint }, fn) {
+	let outcome;
+	try {
+		outcome = await store.run(idempotencyKey(callerId, clientKey), async () => {
+			const res = await fn();
+			const response = await toStoredResponse(res);
+			if (res.status >= 400) throw new NotReplayable(fingerprint, response);
+			return {
+				fingerprint,
+				response
+			};
+		});
+	} catch (err) {
+		if (!(err instanceof NotReplayable)) throw err;
+		assertSameRequest(err.fingerprint, fingerprint);
+		return fromStoredResponse(err.response, false);
+	}
+	assertSameRequest(outcome.value.fingerprint, fingerprint);
+	return fromStoredResponse(outcome.value.response, outcome.replayed);
+}
+// ../server/src/api/respond.ts
+/**
+* Turn a handler result — or a thrown `ApiError` — into a web-standard
+* `Response`.
+*
+* This is the whole serialization boundary. A host framework that speaks
+* `Request`/`Response` (SvelteKit, Next route handlers, Hono, Remix) needs only
+* to build an `ApiRequest` and call `runHandler`; one that does not can reuse
+* `toErrorBody` and serialize itself.
+*/
+function toResponse(result) {
+	if (result instanceof Response) return result;
+	const { status, body, headers } = result;
+	if (body === void 0) return new Response(null, {
+		status: status ?? 204,
+		headers
+	});
+	return new Response(JSON.stringify(body), {
+		status: status ?? 200,
+		headers: {
+			"content-type": "application/json",
+			...headers
+		}
+	});
+}
+/** Run a handler and serialize whatever comes out, including failures. */
+async function runHandler(handler, req, { fallback, mapError, action, scopeTarget, anyScope, idempotent }) {
+	const fail = (err) => {
+		if (isApiError(err)) return toResponse({
+			status: err.status,
+			body: toErrorBody(err)
+		});
+		const mapped = mapError?.(err);
+		if (mapped) return toResponse({
+			status: mapped.status,
+			body: toErrorBody(mapped)
+		});
+		req.log.error(`[API] ${fallback}`, {
+			component: "api",
+			err: err instanceof Error ? err.stack ?? err.message : String(err)
+		});
+		return toResponse({
+			status: 500,
+			body: {
+				message: fallback,
+				code: ApiErrorCode.INTERNAL
+			}
+		});
+	};
+	let verdict;
+	try {
+		const limiter = req.deps.apiRateLimiter === void 0 ? defaultApiRateLimiter() : req.deps.apiRateLimiter;
+		verdict = await chargeApiRateLimit(req.ctx, limiter);
+		if (verdict && !verdict.allowed) return rateLimitedResponse(verdict);
+	} catch (err) {
+		return fail(err);
+	}
+	let res;
+	try {
+		if (req.ctx?.apiScope && !anyScope) assertScope(req.ctx, action ?? actionForMethod(req.request.method), scopeTarget ? await scopeTarget(req) : void 0);
+		const run = async () => {
+			try {
+				return toResponse(await handler(req));
+			} catch (err) {
+				return fail(err);
+			}
+		};
+		const clientKey = idempotent && req.ctx ? readIdempotencyKey(req.request) : null;
+		if (clientKey && req.ctx) {
+			const fingerprint = await requestFingerprint(req.request.method, req.url, await fingerprintBody(req.request));
+			res = await runIdempotent({
+				store: req.deps.idempotency ?? defaultApiIdempotencyStore(),
+				callerId: idempotencyCallerId(req.ctx),
+				clientKey,
+				fingerprint
+			}, run);
+		} else res = await run();
+	} catch (err) {
+		res = fail(err);
+	}
+	return withRateLimitHeaders(res, verdict);
+}
+// ../server/src/api/map-core-error.ts
+/**
+* The domain errors this package's own handlers raise, folded into the envelope.
+*
+* A host's `mapError` should call this first and add only its own error types.
+* These rules cannot live solely in a host: the handler that throws them ships
+* from here, so a host that forgot one would serve 500 where every other host
+* serves 503 — the same API answering differently depending on who mounted it.
+*
+* Postgres surfaces a unique-constraint name verbatim, which is useless to an
+* end user, so the constraints this package's handlers can trip are translated
+* here rather than left to each host.
+*/
+var UNIQUE_CONSTRAINT_MESSAGES = {
+	projects_org_name_unique: "A project with that name already exists in this organization.",
+	projects_org_id_slug_key: "A project with that name already exists in this organization.",
+	orgs_slug_key: "An organization with that slug already exists.",
+	definitions_pkey: "A definition with that ID already exists."
+};
+function friendlyConstraintMessage(raw) {
+	for (const [name, msg] of Object.entries(UNIQUE_CONSTRAINT_MESSAGES)) if (raw.includes(name)) return msg;
+	return null;
+}
+/**
+* Compute unreachable or serving an unreadable schema is operator-side (503); a
+* schema the parser cannot read is the caller's file (422).
+*/
+function mapCoreError(err) {
+	if (err instanceof SchemaExtractionError) return err.kind === "unreachable" || err.kind === "malformed" ? new ApiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, err.message) : new ApiError(422, ApiErrorCode.UNPROCESSABLE, err.message);
+	if (err instanceof ComputeServerUnconfiguredError) return new ApiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, err.message);
+	if (err instanceof ProviderError) {
+		const friendly = friendlyConstraintMessage(err.message);
+		return new ApiError(err.statusCode, codeForStatus(err.statusCode), friendly ?? err.message);
+	}
+}
+// ../server/src/api/openapi.ts
+/**
+* Builds an OpenAPI 3.1 document for a host's `/api/v1` from its route registry.
+*
+* Shared so every host publishes the same shape: `@selvajs/mcp` reads
+* `operationId`, `x-scope`, `x-internal` and the `Idempotency-Key` parameter
+* from it, and nothing else.
+*
+* Request schemas come from `z.toJSONSchema` over the actual validators, so a
+* renamed body field changes the spec on the next generate. Response schemas
+* are not derived: handlers build payloads from store records with no Zod
+* validator on the way out. They're described structurally (pagination
+* envelope, error envelope) and resource bodies stay open; `returns` adds prose.
+*/
+var DEFAULT_ERROR_DESCRIPTIONS = {
+	400: "Validation failed.",
+	401: "Missing or invalid credentials.",
+	403: "Authenticated, but not permitted to perform this action. For an API token, `details.requiredScope` names the scope that would have passed.",
+	404: "No such resource, or the caller cannot see it.",
+	409: "The request conflicts with the current state.",
+	422: "Well-formed but not processable.",
+	429: "Rate limited. Retry after the interval in `Retry-After`.",
+	500: "Unexpected server error.",
+	503: "A dependency is unconfigured or unreachable. Retry later."
+};
+var DEFAULT_IDEMPOTENCY_KEY_DESCRIPTION = "A client-chosen key, 1 to 255 characters. Repeating the request with the same key within the retention window replays the first successful response instead of running it again; the replay carries `Idempotency-Replayed: true`. Keys are scoped to the calling token (or user, for a browser session). Reusing a key with a different method, path or body returns `422`. A failed attempt is not kept, so a corrected retry runs. The store is per-process and in-memory: it absorbs retries, does not survive a restart, and is not shared between app instances.";
+function requestBodySchema(schema) {
+	const json = z.toJSONSchema(schema, {
+		io: "input",
+		target: "draft-2020-12"
+	});
+	delete json.$schema;
+	return json;
+}
+function multipartSchema(fields) {
+	const properties = {};
+	const required = [];
+	for (const f of fields) {
+		properties[f.field] = {
+			type: "string",
+			description: f.description
+		};
+		if (f.required) required.push(f.field);
+	}
+	return required.length ? {
+		type: "object",
+		properties,
+		required
+	} : {
+		type: "object",
+		properties
+	};
+}
+function responseFor(ep) {
+	if (ep.response === "empty") return { "204": { description: ep.returns ?? "Success. No content." } };
+	const status = String(ep.status ?? 200);
+	if (ep.response === "collection") return { [status]: {
+		description: ep.returns ?? "A page of results.",
+		content: { "application/json": { schema: { $ref: "#/components/schemas/Page" } } }
+	} };
+	if (ep.response === "binary") return { [status]: {
+		description: ep.returns ?? "Binary payload.",
+		content: { [ep.contentType ?? "application/octet-stream"]: { schema: {
+			type: "string",
+			format: "binary"
+		} } }
+	} };
+	return { [status]: {
+		description: ep.returns ?? "Success.",
+		content: { "application/json": { schema: { type: "object" } } }
+	} };
+}
+function parametersFor(ep) {
+	const params = [];
+	for (const name of ep.path.matchAll(/\{(\w+)\}/g)) params.push({
+		name: name[1],
+		in: "path",
+		required: true,
+		schema: { type: "string" }
+	});
+	if (ep.response === "collection") params.push({ $ref: "#/components/parameters/limit" }, { $ref: "#/components/parameters/cursor" }, { $ref: "#/components/parameters/orderBy" }, { $ref: "#/components/parameters/orderDir" });
+	for (const q of ep.query ?? []) params.push({
+		name: q.name,
+		in: "query",
+		required: false,
+		description: q.description,
+		schema: { type: "string" }
+	});
+	if (ep.idempotent) params.push({ $ref: "#/components/parameters/idempotencyKey" });
+	return params;
+}
+function operationFor(ep, errorDescriptions, alwaysErrors) {
+	const op = {
+		summary: ep.summary,
+		operationId: operationId(ep),
+		tags: [tagFor(ep.path)],
+		"x-scope": ep.scope
+	};
+	if (ep.internal) op["x-internal"] = true;
+	const params = parametersFor(ep);
+	if (params.length) op.parameters = params;
+	if (ep.requestBody) op.requestBody = {
+		required: true,
+		content: { "application/json": { schema: requestBodySchema(ep.requestBody) } }
+	};
+	else if (ep.multipart) op.requestBody = {
+		required: true,
+		content: { "multipart/form-data": { schema: multipartSchema(ep.multipart) } }
+	};
+	const responses = responseFor(ep);
+	const statuses = /* @__PURE__ */ new Set([...ep.errors ?? [], ...alwaysErrors]);
+	if (ep.idempotent) statuses.add(422);
+	for (const status of [...statuses].sort((a, b) => a - b)) responses[String(status)] = {
+		description: errorDescriptions[status] ?? "Error.",
+		content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } }
+	};
+	op.responses = responses;
+	return op;
+}
+var cap = (s) => s.charAt(0).toUpperCase() + s.slice(1);
+var stem = (s) => s.replace(/\..*$/, "");
+function tagFor(path) {
+	return cap(stem(path.split("/")[1] ?? "root"));
+}
+/** `PATCH /jobs/{id}` → `patchJobsById`. Public contract: clients and MCP tools call by it. */
+function operationId(ep) {
+	const segments = ep.path.split("/").filter(Boolean).map((s) => s.startsWith("{") ? `By${cap(s.slice(1, -1))}` : cap(stem(s)));
+	return ep.method.toLowerCase() + segments.join("");
+}
+function buildOpenApiDocument(endpoints, options) {
+	const errorDescriptions = {
+		...DEFAULT_ERROR_DESCRIPTIONS,
+		...options.errorDescriptions
+	};
+	const alwaysErrors = options.alwaysErrors ?? [
+		401,
+		403,
+		429,
+		500
+	];
+	const paths = {};
+	for (const ep of endpoints) {
+		const path = `${options.basePath}${ep.path}`;
+		(paths[path] ??= {})[ep.method.toLowerCase()] = operationFor(ep, errorDescriptions, alwaysErrors);
+	}
+	const paginated = endpoints.some((ep) => ep.response === "collection");
+	const parameters = {};
+	if (paginated) {
+		parameters.limit = {
+			name: "limit",
+			in: "query",
+			required: false,
+			description: `Page size. Out-of-range values clamp rather than fail, so a client walking a cursor is never stopped by pagination plumbing. Default 50.`,
+			schema: {
+				type: "integer",
+				minimum: 1,
+				maximum: 200
+			}
+		};
+		parameters.cursor = {
+			name: "cursor",
+			in: "query",
+			required: false,
+			description: "An opaque cursor from a previous response's `nextCursor`. Do not construct or parse one.",
+			schema: { type: "string" }
+		};
+		parameters.orderBy = {
+			name: "orderBy",
+			in: "query",
+			required: false,
+			schema: {
+				type: "string",
+				enum: [
+					"createdAt",
+					"updatedAt",
+					"name"
+				]
+			}
+		};
+		parameters.orderDir = {
+			name: "orderDir",
+			in: "query",
+			required: false,
+			schema: {
+				type: "string",
+				enum: ["asc", "desc"]
+			}
+		};
+	}
+	if (endpoints.some((ep) => ep.idempotent)) parameters.idempotencyKey = {
+		name: "Idempotency-Key",
+		in: "header",
+		required: false,
+		description: options.idempotencyKeyDescription ?? DEFAULT_IDEMPOTENCY_KEY_DESCRIPTION,
+		schema: {
+			type: "string",
+			minLength: 1,
+			maxLength: 255
+		}
+	};
+	const schemas = {};
+	if (paginated) schemas.Page = {
+		type: "object",
+		description: "The envelope every collection returns. `nextCursor` is absent on the last page.",
+		properties: {
+			items: {
+				type: "array",
+				items: { type: "object" }
+			},
+			nextCursor: { type: "string" }
+		},
+		required: ["items"]
+	};
+	schemas.Error = {
+		type: "object",
+		description: "Every failure carries this shape. Branch on `code`, not on the human-readable `message`.",
+		properties: {
+			message: { type: "string" },
+			code: {
+				type: "string",
+				enum: Object.values(ApiErrorCode)
+			},
+			fields: {
+				type: "object",
+				description: "Per-field messages, keyed by dotted path. Present on validation failures.",
+				additionalProperties: { type: "string" }
+			},
+			details: {
+				type: "object",
+				description: "Machine-readable context. A scope refusal carries `requiredScope`, e.g. `write:org:<id>`.",
+				additionalProperties: { type: "string" }
+			}
+		},
+		required: ["message", "code"]
+	};
+	Object.assign(schemas, options.schemas);
+	const components = { securitySchemes: options.securitySchemes };
+	if (Object.keys(parameters).length) components.parameters = parameters;
+	components.schemas = schemas;
+	return {
+		openapi: "3.1.0",
+		info: options.info,
+		servers: [{
+			url: "/",
+			description: "The instance serving this document."
+		}],
+		security: options.security,
+		components,
+		paths
+	};
+}
+// ../server/src/api/pagination.ts
+/**
+* Query-param parsing for the list pagination contract:
+* `?limit=&cursor=&orderBy=&orderDir=` → `{ items, nextCursor? }`.
+*
+* Every list endpoint parses these identically, so the clamping lives here
+* rather than inline per handler — a handler that clamps differently publishes
+* a different contract under the same documented one, and nothing fails at
+* build time.
+*/
+/**
+* An unparseable or out-of-range `limit` clamps rather than 400s: pagination
+* params are plumbing, and failing a read over one is hostile to clients
+* walking a cursor.
+*/
+function parseListOptions(url) {
+	const raw = Number(url.searchParams.get("limit") ?? 50);
+	const limit = Number.isFinite(raw) ? Math.min(Math.max(Math.trunc(raw), 1), 200) : 50;
+	const orderByRaw = url.searchParams.get("orderBy");
+	const orderBy = orderByRaw === "createdAt" || orderByRaw === "updatedAt" || orderByRaw === "name" ? orderByRaw : void 0;
+	return {
+		limit,
+		cursor: url.searchParams.get("cursor") ?? void 0,
+		orderBy,
+		orderDir: url.searchParams.get("orderDir") === "asc" ? "asc" : void 0
+	};
+}
+/** `parseListOptions` plus the definition-only `solveCount` ordering. */
+function parseDefinitionListOptions(url) {
+	const base = parseListOptions(url);
+	if (url.searchParams.get("orderBy") === "solveCount") return {
+		...base,
+		orderBy: "solveCount"
+	};
+	return base;
+}
+// ../server/src/api/bodies.ts
+/**
+* Request-body validators for the API routes that take JSON.
+*
+* They live apart from their handlers so a spec generator can import them
+* without loading a host's route module — in Selva's case a `+server.ts` imports
+* `./$types`, which only resolves inside a SvelteKit build.
+*
+* **A JSON body accepted by an API route belongs in this file.** Adding one
+* inline is invisible to the generator, so the endpoint documents an empty body.
+* Multipart handlers are the exception — `FormData` has no Zod schema to derive
+* from, so their fields are described in the spec directly.
+*/
+var SolveBodySchema = z.object({
+	inputs: z.array(z.unknown()).default([]),
+	values: z.record(z.string(), z.unknown()).default({}),
+	channel: z.enum(["live", "draft"]).default("live"),
+	versionId: z.string().optional(),
+	/** Must name this same definition, or the route 400s instead of solving a different one. */
+	definitionUrl: z.string().optional()
+});
+var CreateProjectBodySchema = z.object({
+	name: z.string().min(1, "Project name is required").max(128).trim(),
+	description: z.string().max(2e3).optional(),
+	visibility: ProjectVisibilitySchema.default("private"),
+	autoJoinOnUpload: z.boolean().optional()
+});
+var UpdateProjectBodySchema = z.object({
+	name: z.string().min(1).max(128).trim(),
+	description: z.string().max(2e3).nullish(),
+	visibility: ProjectVisibilitySchema,
+	autoJoinOnUpload: z.boolean()
+}).partial();
+var AddProjectMemberBodySchema = z.object({
+	userId: z.string().min(1, "userId is required"),
+	role: ProjectRoleSchema
+});
+var UpdateProjectMemberBodySchema = z.object({ role: ProjectRoleSchema });
+/** Platform-scope entries are dropped downstream — an invite only grants org rights. */
+var FlatPermissionSchema = z.union([PlatformPermissionSchema, OrgPermissionSchema]);
+var CreateInviteBodySchema = z.object({
+	email: z.email("Valid email is required").transform((s) => s.toLowerCase().trim()),
+	orgRole: OrgRoleSchema.default("member"),
+	permissions: z.array(FlatPermissionSchema).default([])
+});
+/**
+* `apiKey` is tri-state: **omitted** keeps the stored key, **null** clears it, a
+* string replaces it. `.optional().nullable()` — not `.nullish()` — because the
+* two must stay distinguishable after parsing, or a request that just omits the
+* field would silently wipe the stored credential.
+*/
+var IncomingComputeServerSchema = z.object({
+	id: z.string().min(1),
+	label: z.string().min(1),
+	serverUrl: z.string().min(1),
+	apiKey: z.string().nullable().optional(),
+	timeoutMs: z.number().optional(),
+	retryCount: z.number().optional()
+});
+var OrgComputePatchBodySchema = z.object({
+	servers: z.array(IncomingComputeServerSchema),
+	/** May name any server visible to the org. `null` clears the override; omitted leaves it untouched. */
+	defaultServerId: z.string().nullable().optional()
+});
+var UpdateOrgMemberBodySchema = z.object({
+	role: OrgRoleSchema.optional(),
+	permissions: z.array(z.enum(ALL_ORG_PERMISSIONS)).optional()
+}).refine((b) => b.role !== void 0 || b.permissions !== void 0, { message: "Provide at least one of role, permissions" });
+var CreateApiTokenBodySchema = z.object({
+	name: z.string().trim().min(1, "Name is required").max(100),
+	scopes: z.array(ApiScopeStringSchema).min(1, "Pick at least one scope").max(20),
+	expiresInDays: z.union(API_TOKEN_LIFETIME_DAYS.map((d) => z.literal(d)))
+});
+// ../server/src/api/responses-schema.ts
+/**
+* Response schemas for the v1 payloads that must not carry a stored secret.
+*
+* Four store types hold a credential next to fields a client legitimately
+* reads: `ShareLink.tokenHash`, `Invite.tokenHash` and `ApiToken.tokenHash` are HMACs of a token,
+* `ComputeServerCommon.apiKey` is a live Rhino.Compute key. Handlers used to
+* strip them by destructuring — `const { tokenHash: _omit, ...rest } = invite`
+* — which works until someone adds a field to the stored type or edits the line
+* away. Nothing fails at build time; the credential just starts appearing in a
+* response.
+*
+* Parsing through these schemas inverts the default: the response carries only
+* what the schema names, so a new field on the stored type is invisible to
+* clients until added here on purpose. Use them via `shaped`/`shapedCollection`
+* in `./route.ts`.
+*
+* These describe **responses**, not stored records — where the two differ (an
+* invite's one-time `acceptUrl`, a share link's `hasToken` sentinel) the
+* response is the authority.
+*/
+var ShareLinkResponseSchema = z.object({
+	id: z.string(),
+	definitionId: z.string(),
+	channel: z.enum(["live", "draft"]),
+	name: z.string().optional(),
+	createdBy: z.string(),
+	createdAt: z.string(),
+	expiresAt: z.string().nullish(),
+	revokedAt: z.string().nullish(),
+	allowSolve: z.boolean(),
+	maxSolves: z.number().nullish(),
+	solveCount: z.number(),
+	/** Sentinel replacing `tokenHash`: a token exists, its hash is not yours. */
+	hasToken: z.literal(true)
+});
+/** The mint response. `token` is the plaintext, returned exactly once. */
+var CreatedShareLinkResponseSchema = z.object({
+	link: ShareLinkResponseSchema,
+	token: z.string()
+});
+var InviteResponseSchema = z.object({
+	id: z.string(),
+	email: z.string(),
+	orgId: z.string(),
+	orgRole: z.string(),
+	orgPermissions: z.array(z.string()),
+	platformPermissions: z.array(z.string()).default([]),
+	invitedBy: z.string(),
+	createdAt: z.string(),
+	expiresAt: z.string(),
+	acceptedAt: z.string().optional(),
+	acceptedByUserId: z.string().optional()
+});
+/**
+* The create response: the invite plus the link to send, built per request.
+*
+* `acceptUrl` is returned whatever `delivery` says — mail is best-effort, and
+* manual sharing is the fallback when it is off or the send failed.
+*/
+var CreatedInviteResponseSchema = InviteResponseSchema.extend({
+	acceptUrl: z.string(),
+	delivery: z.enum([
+		"sent",
+		"not-configured",
+		"failed"
+	])
+});
+/**
+* An org-owned compute server. `apiKey` is replaced by `hasApiKey`, so a picker
+* can render "key set" without any store decrypting a secret to throw away.
+*/
+var OrgComputeServerResponseSchema = z.object({
+	id: z.string(),
+	label: z.string(),
+	serverUrl: z.string(),
+	scope: z.literal("org"),
+	ownerOrgId: z.string(),
+	timeoutMs: z.number().optional(),
+	retryCount: z.number().optional(),
+	hasApiKey: z.boolean()
+});
+/** A server this org may select but not edit. Never carries a key either. */
+var ComputeCatalogEntrySchema = z.object({
+	id: z.string(),
+	label: z.string(),
+	serverUrl: z.string(),
+	scope: z.enum(["platform", "org"]),
+	source: z.enum(["platform", "org"]),
+	timeoutMs: z.number().optional(),
+	retryCount: z.number().optional()
+});
+var OrgComputeResponseSchema = z.object({
+	servers: z.array(OrgComputeServerResponseSchema),
+	defaultServerId: z.string().nullish(),
+	globalDefaultServerId: z.string().nullish(),
+	catalog: z.array(ComputeCatalogEntrySchema)
+});
+var ApiTokenResponseSchema = z.object({
+	id: z.string(),
+	userId: z.string(),
+	createdBy: z.string().nullable(),
+	orgId: z.string(),
+	name: z.string(),
+	scopes: z.array(z.string()),
+	createdAt: z.string(),
+	expiresAt: z.string(),
+	lastUsedAt: z.string().nullable(),
+	revokedAt: z.string().nullable(),
+	/** Scope refusals since midnight UTC, counted in this process only. */
+	refusedToday: z.number()
+});
+/** The mint response. `secret` is the raw key, returned exactly once. */
+var CreatedApiTokenResponseSchema = z.object({
+	token: ApiTokenResponseSchema,
+	secret: z.string()
+});
+
+export { AddProjectMemberBodySchema as A, rateLimitedResponse as B, CreateProjectBodySchema as C, withRateLimitHeaders as D, runHandler as E, depsFromConfig as F, mapCoreError as G, definitionScopeTarget as H, InviteResponseSchema as I, readIdempotencyKey as J, runIdempotent as K, requestFingerprint as L, idempotencyCallerId as M, createApiIdempotencyStore as N, OrgComputePatchBodySchema as O, projectScopeTarget as P, SolveBodySchema as S, UpdateProjectBodySchema as U, UpdateProjectMemberBodySchema as a, UpdateOrgMemberBodySchema as b, CreateInviteBodySchema as c, CreateApiTokenBodySchema as d, buildOpenApiDocument as e, readForm as f, requireUpload as g, formText as h, parseParam as i, parseBody as j, assertScope as k, parseListOptions as l, ShareLinkResponseSchema as m, CreatedShareLinkResponseSchema as n, requireParams as o, parseDefinitionListOptions as p, OrgComputeResponseSchema as q, requireCaller as r, scopeRefusalsToday as s, throwZodError as t, CreatedInviteResponseSchema as u, ApiTokenResponseSchema as v, CreatedApiTokenResponseSchema as w, createApiRateLimiter as x, resolveApiRateLimitConfig as y, chargeApiRateLimit as z };
+//# sourceMappingURL=api.js-CWQeuHWw.js.map