@selvajs/selva 4.20.0-beta.13 → 4.20.0-beta.15

package/build/server/chunks/chunks/state.js-DUDWVFo9.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"state.js-DUDWVFo9.js","sources":["../../../../.svelte-kit/output/server/chunks/state.js"],"sourcesContent":["import \"./index-server.js\";\nimport { b as getContext } from \"./server.js\";\nimport \"./client.js\";\n// ../../node_modules/.pnpm/@sveltejs+kit@2.70.3_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.3.1_svelte_47ca0476217d3a67b8821de8a7850a17/node_modules/@sveltejs/kit/src/runtime/app/state/server.js\nfunction context() {\n\treturn getContext(\"__request__\");\n}\n// ../../node_modules/.pnpm/@sveltejs+kit@2.70.3_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.3.1_svelte_47ca0476217d3a67b8821de8a7850a17/node_modules/@sveltejs/kit/src/runtime/app/state/index.js\n/**\n* A read-only reactive object with information about the current page, serving several use cases:\n* - retrieving the combined `data` of all pages/layouts anywhere in your component tree (also see [loading data](https://svelte.dev/docs/kit/load))\n* - retrieving the current value of the `form` prop anywhere in your component tree (also see [form actions](https://svelte.dev/docs/kit/form-actions))\n* - retrieving the page state that was set through `goto`, `pushState` or `replaceState` (also see [goto](https://svelte.dev/docs/kit/$app-navigation#goto) and [shallow routing](https://svelte.dev/docs/kit/shallow-routing))\n* - retrieving metadata such as the URL you're on, the current route and its parameters, and whether or not there was an error\n*\n* ```svelte\n* <!--- file: +layout.svelte --->\n* <script>\n* \timport { page } from '$app/state';\n* <\\/script>\n*\n* <p>Currently at {page.url.pathname}</p>\n*\n* {#if page.error}\n* \t<span class=\"red\">Problem detected</span>\n* {:else}\n* \t<span class=\"small\">All systems operational</span>\n* {/if}\n* ```\n*\n* Changes to `page` are available exclusively with runes. (The legacy reactivity syntax will not reflect any changes)\n*\n* ```svelte\n* <!--- file: +page.svelte --->\n* <script>\n* \timport { page } from '$app/state';\n* \tconst id = $derived(page.params.id); // This will correctly update id for usage on this page\n* \t$: badId = page.params.id; // Do not use; will never update after initial load\n* <\\/script>\n* ```\n*\n* On the server, values can only be read during rendering (in other words _not_ in e.g. `load` functions). In the browser, the values can be read at any time.\n*\n* @type {import('@sveltejs/kit').Page}\n*/\nvar page = {\n\tget data() {\n\t\treturn context().page.data;\n\t},\n\tget error() {\n\t\treturn context().page.error;\n\t},\n\tget form() {\n\t\treturn context().page.form;\n\t},\n\tget params() {\n\t\treturn context().page.params;\n\t},\n\tget route() {\n\t\treturn context().page.route;\n\t},\n\tget state() {\n\t\treturn context().page.state;\n\t},\n\tget status() {\n\t\treturn context().page.status;\n\t},\n\tget url() {\n\t\treturn context().page.url;\n\t}\n};\nexport { page as t };\n"],"names":[],"mappings":";;;AAGA;AACA,SAAS,OAAO,GAAG;AACnB,CAAC,OAAO,UAAU,CAAC,aAAa,CAAC;AACjC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,IAAI,GAAG;AACX,CAAC,IAAI,IAAI,GAAG;AACZ,EAAE,OAAO,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI;AAC5B,CAAC,CAAC;AACF,CAAC,IAAI,KAAK,GAAG;AACb,EAAE,OAAO,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK;AAC7B,CAAC,CAAC;AACF,CAAC,IAAI,IAAI,GAAG;AACZ,EAAE,OAAO,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI;AAC5B,CAAC,CAAC;AACF,CAAC,IAAI,MAAM,GAAG;AACd,EAAE,OAAO,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM;AAC9B,CAAC,CAAC;AACF,CAAC,IAAI,KAAK,GAAG;AACb,EAAE,OAAO,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK;AAC7B,CAAC,CAAC;AACF,CAAC,IAAI,KAAK,GAAG;AACb,EAAE,OAAO,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK;AAC7B,CAAC,CAAC;AACF,CAAC,IAAI,MAAM,GAAG;AACd,EAAE,OAAO,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM;AAC9B,CAAC,CAAC;AACF,CAAC,IAAI,GAAG,GAAG;AACX,EAAE,OAAO,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG;AAC3B,CAAC;AACD;;;;"}

package/build/server/chunks/chunks/stores.js-MbQQwrsF.js

@@ -1,35 +0,0 @@
-import { g as getContext } from './server.js-Bn3s-cVB.js';
-import './client.js-C8E6Qrko.js';
-
-// ../../node_modules/.pnpm/@sveltejs+kit@2.70.3_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.3.1_svelte_47ca0476217d3a67b8821de8a7850a17/node_modules/@sveltejs/kit/src/runtime/app/stores.js
-/**
-* A function that returns all of the contextual stores. On the server, this must be called during component initialization.
-* Only use this if you need to defer store subscription until after the component has mounted, for some reason.
-*
-* @deprecated Use `$app/state` instead (requires Svelte 5, [see docs for more info](https://svelte.dev/docs/kit/migrating-to-sveltekit-2#SvelteKit-2.12:-$app-stores-deprecated))
-*/
-var getStores = () => {
-	const stores$1 = getContext("__svelte__");
-	return {
-		/** @type {typeof page} */
-		page: { subscribe: stores$1.page.subscribe },
-		/** @type {typeof navigating} */
-		navigating: { subscribe: stores$1.navigating.subscribe },
-		/** @type {typeof updated} */
-		updated: stores$1.updated
-	};
-};
-/**
-* A readable store whose value contains page data.
-*
-* On the server, this store can only be subscribed to during component initialization. In the browser, it can be subscribed to at any time.
-*
-* @deprecated Use `page` from `$app/state` instead (requires Svelte 5, [see docs for more info](https://svelte.dev/docs/kit/migrating-to-sveltekit-2#SvelteKit-2.12:-$app-stores-deprecated))
-* @type {import('svelte/store').Readable<import('@sveltejs/kit').Page>}
-*/
-var page = { subscribe(fn) {
-	return getStores().page.subscribe(fn);
-} };
-
-export { page as p };
-//# sourceMappingURL=stores.js-MbQQwrsF.js.map

package/build/server/chunks/chunks/stores.js-MbQQwrsF.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"stores.js-MbQQwrsF.js","sources":["../../../../.svelte-kit/output/server/chunks/stores.js"],"sourcesContent":["import \"./index-server.js\";\nimport { b as getContext } from \"./server.js\";\nimport \"./client.js\";\n// ../../node_modules/.pnpm/@sveltejs+kit@2.70.3_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.3.1_svelte_47ca0476217d3a67b8821de8a7850a17/node_modules/@sveltejs/kit/src/runtime/app/stores.js\n/**\n* A function that returns all of the contextual stores. On the server, this must be called during component initialization.\n* Only use this if you need to defer store subscription until after the component has mounted, for some reason.\n*\n* @deprecated Use `$app/state` instead (requires Svelte 5, [see docs for more info](https://svelte.dev/docs/kit/migrating-to-sveltekit-2#SvelteKit-2.12:-$app-stores-deprecated))\n*/\nvar getStores = () => {\n\tconst stores$1 = getContext(\"__svelte__\");\n\treturn {\n\t\t/** @type {typeof page} */\n\t\tpage: { subscribe: stores$1.page.subscribe },\n\t\t/** @type {typeof navigating} */\n\t\tnavigating: { subscribe: stores$1.navigating.subscribe },\n\t\t/** @type {typeof updated} */\n\t\tupdated: stores$1.updated\n\t};\n};\n/**\n* A readable store whose value contains page data.\n*\n* On the server, this store can only be subscribed to during component initialization. In the browser, it can be subscribed to at any time.\n*\n* @deprecated Use `page` from `$app/state` instead (requires Svelte 5, [see docs for more info](https://svelte.dev/docs/kit/migrating-to-sveltekit-2#SvelteKit-2.12:-$app-stores-deprecated))\n* @type {import('svelte/store').Readable<import('@sveltejs/kit').Page>}\n*/\nvar page = { subscribe(fn) {\n\treturn getStores().page.subscribe(fn);\n} };\nexport { page as t };\n"],"names":[],"mappings":";;;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,SAAS,GAAG,MAAM;AACtB,CAAC,MAAM,QAAQ,GAAG,UAAU,CAAC,YAAY,CAAC;AAC1C,CAAC,OAAO;AACR;AACA,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE;AAC9C;AACA,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE;AAC1D;AACA,EAAE,OAAO,EAAE,QAAQ,CAAC;AACpB,EAAE;AACF,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,IAAI,GAAG,EAAE,SAAS,CAAC,EAAE,EAAE;AAC3B,CAAC,OAAO,SAAS,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;AACtC,CAAC;;;;"}

package/build/server/chunks/chunks/sveltekit.js-CbVs04xQ.js

@@ -1,102 +0,0 @@
-import { m as getBranding, n as getNotificationProvider, o as getOrgAssetService, q as getDefinitionService } from './providers.server.js-DkEGnykl.js';
-import { f as ApiError, k as codeForStatus } from './access.js-DbWaEG7Y.js';
-import { o as chargeApiRateLimit, q as rateLimitedResponse, w as withRateLimitHeaders, t as runHandler, u as depsFromConfig, v as mapCoreError } from './api.js-BPQNKNcW.js';
-import { e as evictComputeClient } from './engine.server.js-CWoRi_z0.js';
-import { M as MAX_IMAGE_FILE_SIZE, b as MAX_DEFINITION_FILE_SIZE } from './computeLimits.js-Bm6rd23g.js';
-import { s as shareLinkCodec } from './token2.server.js-Dv9oGmUn.js';
-import { a as apiRateLimiter } from './computeRateLimit.server.js-CZrK5Z1p.js';
-import { i as inviteCodec } from './token3.server.js-CHgzJAXs.js';
-import { a as apiTokenCodec } from './token4.server.js-2COCjTDd.js';
-import { isHttpError, json } from '@sveltejs/kit';
-
-// src/lib/server/api/sveltekit.ts
-/**
-* The SvelteKit binding for the transport-free handlers in `@selvajs/server/api`.
-*
-* The only file in the app that knows both worlds: it turns a `RequestEvent`
-* into an `ApiRequest` and folds this app's domain errors into the shared
-* envelope. A handler mounted through here names no framework, so the same
-* handler runs under Next or Hono behind a sibling adapter roughly this size.
-*/
-/**
-* This app's own errors, folded into the shared envelope.
-*
-* SvelteKit's `HttpError` is the only one left here — everything else the v1
-* handlers throw ships from `@selvajs/server`, so `mapCoreError` owns those
-* rules and a second host gets the same statuses without copying them.
-*/
-function mapAppError(err) {
-	if (isHttpError(err)) {
-		const body = err.body;
-		if (typeof body === "string") return new ApiError(err.status, codeForStatus(err.status), body);
-		return new ApiError(err.status, body?.code ?? codeForStatus(err.status), body?.message ?? "Request failed", body?.fields, body?.details);
-	}
-	return mapCoreError(err);
-}
-function buildDeps(event) {
-	return depsFromConfig(event.locals.providers, {
-		definitions: getDefinitionService(),
-		orgAssets: getOrgAssetService()
-	}, {
-		tokens: {
-			shareLinks: shareLinkCodec(),
-			invites: inviteCodec(),
-			apiTokens: apiTokenCodec()
-		},
-		uploadLimits: {
-			maxDefinitionFileSize: MAX_DEFINITION_FILE_SIZE,
-			maxImageFileSize: MAX_IMAGE_FILE_SIZE
-		},
-		evictComputeClient,
-		notifications: getNotificationProvider(),
-		instanceName: getBranding().name,
-		apiTokenSettingsPath: "/team/tokens",
-		apiRateLimiter
-	});
-}
-function toApiRequest(event) {
-	return {
-		ctx: event.locals.ctx,
-		user: event.locals.user,
-		profile: event.locals.profile,
-		log: event.locals.log,
-		params: event.params,
-		url: event.url,
-		request: event.request,
-		deps: buildDeps(event)
-	};
-}
-/**
-* Mount a transport-free handler as a SvelteKit `RequestHandler`.
-*
-* Routes addressed by a project or definition pass `scopeTarget`, so a key
-* scoped to that project or definition can reach them; solve routes pass
-* `action: 'solve'`; creates pass `idempotent: true`.
-*/
-function mount(fallback, handler, opts = {}) {
-	return (event) => runHandler(handler, toApiRequest(event), {
-		fallback,
-		mapError: mapAppError,
-		...opts
-	});
-}
-/**
-* The per-token rate limit for a route that builds its own `Response` instead
-* of going through `mount`: charged before the handler runs, and `RateLimit-*`
-* on every token response, thrown errors included.
-*/
-function withApiRateLimit(handler) {
-	return async (event) => {
-		const verdict = await chargeApiRateLimit(event.locals.ctx, apiRateLimiter);
-		if (verdict && !verdict.allowed) return rateLimitedResponse(verdict);
-		try {
-			return withRateLimitHeaders(await handler(event), verdict);
-		} catch (err) {
-			if (!verdict || !isHttpError(err)) throw err;
-			return withRateLimitHeaders(json(err.body, { status: err.status }), verdict);
-		}
-	};
-}
-
-export { mount as m, toApiRequest as t, withApiRateLimit as w };
-//# sourceMappingURL=sveltekit.js-CbVs04xQ.js.map

package/build/server/chunks/chunks/sveltekit.js-CbVs04xQ.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sveltekit.js-CbVs04xQ.js","sources":["../../../../.svelte-kit/output/server/chunks/sveltekit.js"],"sourcesContent":["import { c as getDefinitionService, i as getBranding, m as getOrgAssetService, p as getNotificationProvider } from \"./providers.server.js\";\nimport { A as codeForStatus, D as ApiError } from \"./access.js\";\nimport { D as chargeApiRateLimit, I as depsFromConfig, b as mapCoreError, j as withRateLimitHeaders, k as rateLimitedResponse, x as runHandler } from \"./api.js\";\nimport { o as evictComputeClient } from \"./engine.server.js\";\nimport { a as MAX_DEFINITION_FILE_SIZE, o as MAX_IMAGE_FILE_SIZE } from \"./computeLimits.js\";\nimport { r as shareLinkCodec } from \"./token2.server.js\";\nimport { t as apiRateLimiter } from \"./computeRateLimit.server.js\";\nimport { n as inviteCodec } from \"./token3.server.js\";\nimport { t as apiTokenCodec } from \"./token4.server.js\";\nimport { isHttpError, json } from \"@sveltejs/kit\";\n// src/lib/server/api/sveltekit.ts\n/**\n* The SvelteKit binding for the transport-free handlers in `@selvajs/server/api`.\n*\n* The only file in the app that knows both worlds: it turns a `RequestEvent`\n* into an `ApiRequest` and folds this app's domain errors into the shared\n* envelope. A handler mounted through here names no framework, so the same\n* handler runs under Next or Hono behind a sibling adapter roughly this size.\n*/\n/**\n* This app's own errors, folded into the shared envelope.\n*\n* SvelteKit's `HttpError` is the only one left here — everything else the v1\n* handlers throw ships from `@selvajs/server`, so `mapCoreError` owns those\n* rules and a second host gets the same statuses without copying them.\n*/\nfunction mapAppError(err) {\n\tif (isHttpError(err)) {\n\t\tconst body = err.body;\n\t\tif (typeof body === \"string\") return new ApiError(err.status, codeForStatus(err.status), body);\n\t\treturn new ApiError(err.status, body?.code ?? codeForStatus(err.status), body?.message ?? \"Request failed\", body?.fields, body?.details);\n\t}\n\treturn mapCoreError(err);\n}\nfunction buildDeps(event) {\n\treturn depsFromConfig(event.locals.providers, {\n\t\tdefinitions: getDefinitionService(),\n\t\torgAssets: getOrgAssetService()\n\t}, {\n\t\ttokens: {\n\t\t\tshareLinks: shareLinkCodec(),\n\t\t\tinvites: inviteCodec(),\n\t\t\tapiTokens: apiTokenCodec()\n\t\t},\n\t\tuploadLimits: {\n\t\t\tmaxDefinitionFileSize: MAX_DEFINITION_FILE_SIZE,\n\t\t\tmaxImageFileSize: MAX_IMAGE_FILE_SIZE\n\t\t},\n\t\tevictComputeClient,\n\t\tnotifications: getNotificationProvider(),\n\t\tinstanceName: getBranding().name,\n\t\tapiTokenSettingsPath: \"/team/tokens\",\n\t\tapiRateLimiter\n\t});\n}\nfunction toApiRequest(event) {\n\treturn {\n\t\tctx: event.locals.ctx,\n\t\tuser: event.locals.user,\n\t\tprofile: event.locals.profile,\n\t\tlog: event.locals.log,\n\t\tparams: event.params,\n\t\turl: event.url,\n\t\trequest: event.request,\n\t\tdeps: buildDeps(event)\n\t};\n}\n/**\n* Mount a transport-free handler as a SvelteKit `RequestHandler`.\n*\n* Routes addressed by a project or definition pass `scopeTarget`, so a key\n* scoped to that project or definition can reach them; solve routes pass\n* `action: 'solve'`; creates pass `idempotent: true`.\n*/\nfunction mount(fallback, handler, opts = {}) {\n\treturn (event) => runHandler(handler, toApiRequest(event), {\n\t\tfallback,\n\t\tmapError: mapAppError,\n\t\t...opts\n\t});\n}\n/**\n* The per-token rate limit for a route that builds its own `Response` instead\n* of going through `mount`: charged before the handler runs, and `RateLimit-*`\n* on every token response, thrown errors included.\n*/\nfunction withApiRateLimit(handler) {\n\treturn async (event) => {\n\t\tconst verdict = await chargeApiRateLimit(event.locals.ctx, apiRateLimiter);\n\t\tif (verdict && !verdict.allowed) return rateLimitedResponse(verdict);\n\t\ttry {\n\t\t\treturn withRateLimitHeaders(await handler(event), verdict);\n\t\t} catch (err) {\n\t\t\tif (!verdict || !isHttpError(err)) throw err;\n\t\t\treturn withRateLimitHeaders(json(err.body, { status: err.status }), verdict);\n\t\t}\n\t};\n}\nexport { toApiRequest as n, withApiRateLimit as r, mount as t };\n"],"names":[],"mappings":";;;;;;;;;;;AAUA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,WAAW,CAAC,GAAG,EAAE;AAC1B,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE;AACvB,EAAE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI;AACvB,EAAE,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC;AAChG,EAAE,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,IAAI,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC;AAC1I,CAAC;AACD,CAAC,OAAO,YAAY,CAAC,GAAG,CAAC;AACzB;AACA,SAAS,SAAS,CAAC,KAAK,EAAE;AAC1B,CAAC,OAAO,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE;AAC/C,EAAE,WAAW,EAAE,oBAAoB,EAAE;AACrC,EAAE,SAAS,EAAE,kBAAkB;AAC/B,EAAE,EAAE;AACJ,EAAE,MAAM,EAAE;AACV,GAAG,UAAU,EAAE,cAAc,EAAE;AAC/B,GAAG,OAAO,EAAE,WAAW,EAAE;AACzB,GAAG,SAAS,EAAE,aAAa;AAC3B,GAAG;AACH,EAAE,YAAY,EAAE;AAChB,GAAG,qBAAqB,EAAE,wBAAwB;AAClD,GAAG,gBAAgB,EAAE;AACrB,GAAG;AACH,EAAE,kBAAkB;AACpB,EAAE,aAAa,EAAE,uBAAuB,EAAE;AAC1C,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,IAAI;AAClC,EAAE,oBAAoB,EAAE,cAAc;AACtC,EAAE;AACF,EAAE,CAAC;AACH;AACA,SAAS,YAAY,CAAC,KAAK,EAAE;AAC7B,CAAC,OAAO;AACR,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG;AACvB,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;AACzB,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;AAC/B,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG;AACvB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM;AACtB,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG;AAChB,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO;AACxB,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK;AACvB,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE;AAC7C,CAAC,OAAO,CAAC,KAAK,KAAK,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE;AAC5D,EAAE,QAAQ;AACV,EAAE,QAAQ,EAAE,WAAW;AACvB,EAAE,GAAG;AACL,EAAE,CAAC;AACH;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,CAAC,OAAO,EAAE;AACnC,CAAC,OAAO,OAAO,KAAK,KAAK;AACzB,EAAE,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,cAAc,CAAC;AAC5E,EAAE,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,mBAAmB,CAAC,OAAO,CAAC;AACtE,EAAE,IAAI;AACN,GAAG,OAAO,oBAAoB,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;AAC7D,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG;AAC/C,GAAG,OAAO,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC;AAC/E,EAAE;AACF,CAAC,CAAC;AACF;;;;"}

package/build/server/chunks/chunks/token2.server.js-Dv9oGmUn.js

@@ -1,50 +0,0 @@
-import { b as private_env } from './shared-server.js-CJsQadj4.js';
-import { c as createTokenCodec } from './token-codec.js-CxK2DiO-.js';
-import './src.js-BQFsdJf3.js';
-import './access.js-DbWaEG7Y.js';
-
-// src/lib/server/shareLinks/token.server.ts
-/**
-* Share-link token primitives — thin binding over `@selvajs/server/tokens`'s
-* `createTokenCodec`, which hashes tokens at rest with an instance-wide HMAC
-* secret and enforces the ≥32-char secret minimum.
-*
-* ## Format
-*   raw    = `share_<base64url(32 random bytes)>`
-*   hash   = base64url( HMAC-SHA256(SELVA_HMAC_KEY, raw) )
-*
-* Rotating `SELVA_HMAC_KEY` invalidates every existing share link.
-*/
-var TOKEN_PREFIX = "share_";
-var cached = null;
-function getCodec() {
-	const secret = private_env.SELVA_HMAC_KEY;
-	if (!secret) throw new Error("Missing required env var: SELVA_HMAC_KEY. See packages/selva/.env.example for setup instructions.");
-	if (cached?.secret !== secret) cached = {
-		secret,
-		codec: createTokenCodec({
-			prefix: TOKEN_PREFIX,
-			secret
-		})
-	};
-	return cached.codec;
-}
-/**
-* The codec itself, for the composition root to put on `SelvaDeps.tokens`.
-* Handlers take their codec injected rather than importing this module — that
-* keeps them free of `$env` and lets a second host supply its own secret.
-*/
-function shareLinkCodec() {
-	return getCodec();
-}
-/** Hash a raw token to its store-side representation. */
-function hashToken(raw) {
-	return getCodec().hashToken(raw);
-}
-/** Recognize our own token format on inbound requests. */
-function looksLikeShareToken(value) {
-	return value.startsWith(TOKEN_PREFIX);
-}
-
-export { hashToken as h, looksLikeShareToken as l, shareLinkCodec as s };
-//# sourceMappingURL=token2.server.js-Dv9oGmUn.js.map

package/build/server/chunks/chunks/token2.server.js-Dv9oGmUn.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"token2.server.js-Dv9oGmUn.js","sources":["../../../../.svelte-kit/output/server/chunks/token2.server.js"],"sourcesContent":["import { t as private_env } from \"./shared-server.js\";\nimport { t as createTokenCodec } from \"./token-codec.js\";\nimport \"./tokens.js\";\n// src/lib/server/shareLinks/token.server.ts\n/**\n* Share-link token primitives — thin binding over `@selvajs/server/tokens`'s\n* `createTokenCodec`, which hashes tokens at rest with an instance-wide HMAC\n* secret and enforces the ≥32-char secret minimum.\n*\n* ## Format\n*   raw    = `share_<base64url(32 random bytes)>`\n*   hash   = base64url( HMAC-SHA256(SELVA_HMAC_KEY, raw) )\n*\n* Rotating `SELVA_HMAC_KEY` invalidates every existing share link.\n*/\nvar TOKEN_PREFIX = \"share_\";\nvar cached = null;\nfunction getCodec() {\n\tconst secret = private_env.SELVA_HMAC_KEY;\n\tif (!secret) throw new Error(\"Missing required env var: SELVA_HMAC_KEY. See packages/selva/.env.example for setup instructions.\");\n\tif (cached?.secret !== secret) cached = {\n\t\tsecret,\n\t\tcodec: createTokenCodec({\n\t\t\tprefix: TOKEN_PREFIX,\n\t\t\tsecret\n\t\t})\n\t};\n\treturn cached.codec;\n}\n/**\n* The codec itself, for the composition root to put on `SelvaDeps.tokens`.\n* Handlers take their codec injected rather than importing this module — that\n* keeps them free of `$env` and lets a second host supply its own secret.\n*/\nfunction shareLinkCodec() {\n\treturn getCodec();\n}\n/** Hash a raw token to its store-side representation. */\nfunction hashToken(raw) {\n\treturn getCodec().hashToken(raw);\n}\n/** Recognize our own token format on inbound requests. */\nfunction looksLikeShareToken(value) {\n\treturn value.startsWith(TOKEN_PREFIX);\n}\nexport { looksLikeShareToken as n, shareLinkCodec as r, hashToken as t };\n"],"names":[],"mappings":";;;;;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,YAAY,GAAG,QAAQ;AAC3B,IAAI,MAAM,GAAG,IAAI;AACjB,SAAS,QAAQ,GAAG;AACpB,CAAC,MAAM,MAAM,GAAG,WAAW,CAAC,cAAc;AAC1C,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,KAAK,CAAC,mGAAmG,CAAC;AAClI,CAAC,IAAI,MAAM,EAAE,MAAM,KAAK,MAAM,EAAE,MAAM,GAAG;AACzC,EAAE,MAAM;AACR,EAAE,KAAK,EAAE,gBAAgB,CAAC;AAC1B,GAAG,MAAM,EAAE,YAAY;AACvB,GAAG;AACH,GAAG;AACH,EAAE;AACF,CAAC,OAAO,MAAM,CAAC,KAAK;AACpB;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,GAAG;AAC1B,CAAC,OAAO,QAAQ,EAAE;AAClB;AACA;AACA,SAAS,SAAS,CAAC,GAAG,EAAE;AACxB,CAAC,OAAO,QAAQ,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC;AACjC;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE;AACpC,CAAC,OAAO,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;AACtC;;;;"}

package/build/server/chunks/chunks/token3.server.js-CHgzJAXs.js

@@ -1,41 +0,0 @@
-import { b as private_env } from './shared-server.js-CJsQadj4.js';
-import { c as createTokenCodec } from './token-codec.js-CxK2DiO-.js';
-import './src.js-BQFsdJf3.js';
-import './access.js-DbWaEG7Y.js';
-
-// src/lib/server/invites/token.server.ts
-/**
-* Invite-token primitives — thin binding over `@selvajs/server/tokens`'s
-* `createTokenCodec`, mirroring the share-link design.
-*
-* ## Format
-*   raw    = `invite_<base64url(32 random bytes)>`
-*   hash   = base64url( HMAC-SHA256(SELVA_HMAC_KEY, raw) )
-*
-* Rotating `SELVA_HMAC_KEY` invalidates every pending invite.
-*/
-var TOKEN_PREFIX = "invite_";
-var cached = null;
-function getCodec() {
-	const secret = private_env.SELVA_HMAC_KEY;
-	if (!secret) throw new Error("Missing required env var: SELVA_HMAC_KEY. Generate with: openssl rand -base64 32");
-	if (cached?.secret !== secret) cached = {
-		secret,
-		codec: createTokenCodec({
-			prefix: TOKEN_PREFIX,
-			secret
-		})
-	};
-	return cached.codec;
-}
-/** The codec itself, for the composition root to put on `SelvaDeps.tokens`. */
-function inviteCodec() {
-	return getCodec();
-}
-/** Hash a raw token to its store-side representation. */
-function hashToken(raw) {
-	return getCodec().hashToken(raw);
-}
-
-export { hashToken as h, inviteCodec as i };
-//# sourceMappingURL=token3.server.js-CHgzJAXs.js.map

package/build/server/chunks/chunks/token3.server.js-CHgzJAXs.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"token3.server.js-CHgzJAXs.js","sources":["../../../../.svelte-kit/output/server/chunks/token3.server.js"],"sourcesContent":["import { t as private_env } from \"./shared-server.js\";\nimport { t as createTokenCodec } from \"./token-codec.js\";\nimport \"./tokens.js\";\n// src/lib/server/invites/token.server.ts\n/**\n* Invite-token primitives — thin binding over `@selvajs/server/tokens`'s\n* `createTokenCodec`, mirroring the share-link design.\n*\n* ## Format\n*   raw    = `invite_<base64url(32 random bytes)>`\n*   hash   = base64url( HMAC-SHA256(SELVA_HMAC_KEY, raw) )\n*\n* Rotating `SELVA_HMAC_KEY` invalidates every pending invite.\n*/\nvar TOKEN_PREFIX = \"invite_\";\nvar cached = null;\nfunction getCodec() {\n\tconst secret = private_env.SELVA_HMAC_KEY;\n\tif (!secret) throw new Error(\"Missing required env var: SELVA_HMAC_KEY. Generate with: openssl rand -base64 32\");\n\tif (cached?.secret !== secret) cached = {\n\t\tsecret,\n\t\tcodec: createTokenCodec({\n\t\t\tprefix: TOKEN_PREFIX,\n\t\t\tsecret\n\t\t})\n\t};\n\treturn cached.codec;\n}\n/** The codec itself, for the composition root to put on `SelvaDeps.tokens`. */\nfunction inviteCodec() {\n\treturn getCodec();\n}\n/** Hash a raw token to its store-side representation. */\nfunction hashToken(raw) {\n\treturn getCodec().hashToken(raw);\n}\nexport { inviteCodec as n, hashToken as t };\n"],"names":[],"mappings":";;;;;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,YAAY,GAAG,SAAS;AAC5B,IAAI,MAAM,GAAG,IAAI;AACjB,SAAS,QAAQ,GAAG;AACpB,CAAC,MAAM,MAAM,GAAG,WAAW,CAAC,cAAc;AAC1C,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC;AACjH,CAAC,IAAI,MAAM,EAAE,MAAM,KAAK,MAAM,EAAE,MAAM,GAAG;AACzC,EAAE,MAAM;AACR,EAAE,KAAK,EAAE,gBAAgB,CAAC;AAC1B,GAAG,MAAM,EAAE,YAAY;AACvB,GAAG;AACH,GAAG;AACH,EAAE;AACF,CAAC,OAAO,MAAM,CAAC,KAAK;AACpB;AACA;AACA,SAAS,WAAW,GAAG;AACvB,CAAC,OAAO,QAAQ,EAAE;AAClB;AACA;AACA,SAAS,SAAS,CAAC,GAAG,EAAE;AACxB,CAAC,OAAO,QAAQ,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC;AACjC;;;;"}

package/build/server/chunks/chunks/token4.server.js-2COCjTDd.js

@@ -1,24 +0,0 @@
-import { b as private_env } from './shared-server.js-CJsQadj4.js';
-import { c as createApiTokenCodec } from './api-token-codec.js--hQdn1xG.js';
-import './src.js-BQFsdJf3.js';
-import './access.js-DbWaEG7Y.js';
-
-// src/lib/server/apiTokens/token.server.ts
-var cached = null;
-/**
-* Undefined without a usable SELVA_HMAC_KEY (missing or too short): token
-* requests then get 503 and sign-in keeps working. It runs on every request, so
-* it must not throw.
-*/
-function apiTokenCodec() {
-	const secret = private_env.SELVA_HMAC_KEY;
-	if (!secret || secret.length < 32) return void 0;
-	if (cached?.secret !== secret) cached = {
-		secret,
-		codec: createApiTokenCodec(secret)
-	};
-	return cached.codec;
-}
-
-export { apiTokenCodec as a };
-//# sourceMappingURL=token4.server.js-2COCjTDd.js.map

package/build/server/chunks/chunks/token4.server.js-2COCjTDd.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"token4.server.js-2COCjTDd.js","sources":["../../../../.svelte-kit/output/server/chunks/token4.server.js"],"sourcesContent":["import { t as private_env } from \"./shared-server.js\";\nimport { n as createApiTokenCodec } from \"./api-token-codec.js\";\nimport \"./tokens.js\";\n// src/lib/server/apiTokens/token.server.ts\nvar cached = null;\n/**\n* Undefined without a usable SELVA_HMAC_KEY (missing or too short): token\n* requests then get 503 and sign-in keeps working. It runs on every request, so\n* it must not throw.\n*/\nfunction apiTokenCodec() {\n\tconst secret = private_env.SELVA_HMAC_KEY;\n\tif (!secret || secret.length < 32) return void 0;\n\tif (cached?.secret !== secret) cached = {\n\t\tsecret,\n\t\tcodec: createApiTokenCodec(secret)\n\t};\n\treturn cached.codec;\n}\nexport { apiTokenCodec as t };\n"],"names":[],"mappings":";;;;;AAGA;AACA,IAAI,MAAM,GAAG,IAAI;AACjB;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,GAAG;AACzB,CAAC,MAAM,MAAM,GAAG,WAAW,CAAC,cAAc;AAC1C,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,OAAO,MAAM;AACjD,CAAC,IAAI,MAAM,EAAE,MAAM,KAAK,MAAM,EAAE,MAAM,GAAG;AACzC,EAAE,MAAM;AACR,EAAE,KAAK,EAAE,mBAAmB,CAAC,MAAM;AACnC,EAAE;AACF,CAAC,OAAO,MAAM,CAAC,KAAK;AACpB;;;;"}

package/build/server/chunks/chunks/tokens.js-C1iFCpCz.js

@@ -1,25 +0,0 @@
-import { p as parseApiScope, h as hasPermission } from './src.js-BQFsdJf3.js';
-import { c as canCreateDefinitionInOrg } from './visibility.js-DHIz9MAP.js';
-
-// ../server/src/tokens/api-token-holder.ts
-/**
-* May `ctx` hold a key with `scopes` in its acting org? Without a host policy:
-*
-* - `manage_api_tokens` holds any key.
-* - A key that only reads and uploads needs only the right to create a
-*   definition in one project of the org. It can do nothing the owner's
-*   browser session can't.
-*
-* A scope this version can't parse counts as broad, so it needs
-* `manage_api_tokens`.
-*/
-async function canHoldApiTokens(ctx, scopes, { policy, deps }) {
-	const parsed = scopes.map(parseApiScope).filter((s) => s !== null);
-	if (policy) return policy(ctx, parsed);
-	if (hasPermission(ctx, "manage_api_tokens")) return true;
-	if (!(parsed.length > 0 && parsed.length === scopes.length && parsed.every((s) => s.action === "read" || s.action === "upload")) || !ctx.actingOrgId) return false;
-	return canCreateDefinitionInOrg(ctx, ctx.actingOrgId, deps);
-}
-
-export { canHoldApiTokens as c };
-//# sourceMappingURL=tokens.js-C1iFCpCz.js.map

package/build/server/chunks/chunks/tokens.js-C1iFCpCz.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"tokens.js-C1iFCpCz.js","sources":["../../../../.svelte-kit/output/server/chunks/tokens.js"],"sourcesContent":["import { O as parseApiScope, r as hasPermission } from \"./src.js\";\nimport { t as canCreateDefinitionInOrg } from \"./visibility.js\";\n// ../server/src/tokens/api-token-holder.ts\n/**\n* May `ctx` hold a key with `scopes` in its acting org? Without a host policy:\n*\n* - `manage_api_tokens` holds any key.\n* - A key that only reads and uploads needs only the right to create a\n*   definition in one project of the org. It can do nothing the owner's\n*   browser session can't.\n*\n* A scope this version can't parse counts as broad, so it needs\n* `manage_api_tokens`.\n*/\nasync function canHoldApiTokens(ctx, scopes, { policy, deps }) {\n\tconst parsed = scopes.map(parseApiScope).filter((s) => s !== null);\n\tif (policy) return policy(ctx, parsed);\n\tif (hasPermission(ctx, \"manage_api_tokens\")) return true;\n\tif (!(parsed.length > 0 && parsed.length === scopes.length && parsed.every((s) => s.action === \"read\" || s.action === \"upload\")) || !ctx.actingOrgId) return false;\n\treturn canCreateDefinitionInOrg(ctx, ctx.actingOrgId, deps);\n}\nexport { canHoldApiTokens as t };\n"],"names":[],"mappings":";;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;AAC/D,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AACnE,CAAC,IAAI,MAAM,EAAE,OAAO,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC;AACvC,CAAC,IAAI,aAAa,CAAC,GAAG,EAAE,mBAAmB,CAAC,EAAE,OAAO,IAAI;AACzD,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,KAAK;AACnK,CAAC,OAAO,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC;AAC5D;;;;"}

package/build/server/chunks/chunks/visibility.js-DHIz9MAP.js

@@ -1,198 +0,0 @@
-import { S as SYSTEM_CONTEXT, o as outsideTokenOrg, s as scopeAllows } from './src.js-BQFsdJf3.js';
-import { c as canCreateDefinition, p as projectAccessInputFromRowsWith, a as canView, b as canEditDefinition } from './access.js-DbWaEG7Y.js';
-
-// ../server/src/definitions/visibility.ts
-/**
-* Visibility-filtered definition reads, shared by the library page load and
-* `GET /api/v1/definitions`.
-*
-* **This is a tenancy boundary.** The project scan runs as `SYSTEM_CONTEXT` so
-* cross-org `public` projects are reachable when `ALLOW_CROSS_ORG_PUBLIC` is on;
-* `canView` over the fetched membership rows is the only thing keeping another
-* org's projects out of the result. The definition list itself is then filtered
-* *in the query* via `projectIds`, so the cursor is applied after visibility
-* rather than over a page that gets thinned afterwards.
-*
-* Cost is constant in the number of orgs and projects: three bulk membership
-* reads regardless of N. Anything added here must keep that property — a
-* per-project `await` inside a loop reintroduces the N+1 this replaced.
-*/
-/** Upper bound on the org/project scan. Visibility needs the whole set. */
-var SCAN_LIMIT = 200;
-/**
-* Resolve the caller's accessible project set in a constant number of queries.
-* Platform grants are fetched only for `platform`-visibility projects —
-* `canView` short-circuits before reading them for every other visibility.
-*/
-async function resolveAccessibleProjects(ctx, deps) {
-	const orgs = deps.orgs;
-	const projectStore = deps.projects;
-	const grantStore = deps.platformProjectGrants;
-	const orgIds = (await orgs.listOrgs(SYSTEM_CONTEXT, { limit: SCAN_LIMIT })).items.map((o) => o.id).filter((id) => !outsideTokenOrg(ctx, id));
-	const allProjects = (await Promise.all(orgIds.map((orgId) => projectStore.listProjects(SYSTEM_CONTEXT, orgId, { limit: SCAN_LIMIT })))).flatMap((p) => p.items);
-	const projectIds = allProjects.map((p) => p.id);
-	const platformProjectIds = allProjects.filter((p) => p.visibility === "platform").map((p) => p.id);
-	const [orgMemberByOrgId, memberByProjectId, grantsByProjectId] = await Promise.all([
-		orgs.getOrgMembersFor(SYSTEM_CONTEXT, orgIds, ctx.userId),
-		projectStore.getProjectMembersFor(SYSTEM_CONTEXT, projectIds, ctx.userId),
-		platformProjectIds.length ? grantStore.listByProjects(SYSTEM_CONTEXT, platformProjectIds) : Promise.resolve(/* @__PURE__ */ new Map())
-	]);
-	return {
-		projects: allProjects.filter((project) => canView(projectAccessInputFromRowsWith({ deps }, ctx, project, {
-			member: memberByProjectId.get(project.id) ?? null,
-			orgMember: orgMemberByOrgId.get(project.orgId) ?? null,
-			platformGrants: grantsByProjectId.get(project.id) ?? []
-		}))),
-		allById: new Map(allProjects.map((p) => [p.id, p])),
-		memberByProjectId,
-		orgMemberByOrgId,
-		grantsByProjectId
-	};
-}
-/**
-* Whether the caller may create a definition in at least one project of
-* `orgId`, by the same rule `requireCanCreateDefinition` applies. Reads the
-* org's projects a page at a time and stops at the first that passes.
-*/
-async function canCreateDefinitionInOrg(ctx, orgId, deps) {
-	const orgMember = (await deps.orgs.getOrgMembersFor(SYSTEM_CONTEXT, [orgId], ctx.userId)).get(orgId) ?? null;
-	let cursor;
-	do {
-		const page = await deps.projects.listProjects(SYSTEM_CONTEXT, orgId, {
-			limit: SCAN_LIMIT,
-			cursor
-		});
-		const platformIds = page.items.filter((p) => p.visibility === "platform").map((p) => p.id);
-		const [members, grants] = await Promise.all([deps.projects.getProjectMembersFor(SYSTEM_CONTEXT, page.items.map((p) => p.id), ctx.userId), platformIds.length ? deps.platformProjectGrants.listByProjects(SYSTEM_CONTEXT, platformIds) : Promise.resolve(/* @__PURE__ */ new Map())]);
-		if (page.items.some((project) => canCreateDefinition(projectAccessInputFromRowsWith({ deps }, ctx, project, {
-			member: members.get(project.id) ?? null,
-			orgMember,
-			platformGrants: grants.get(project.id) ?? []
-		})))) return true;
-		cursor = page.nextCursor;
-	} while (cursor);
-	return false;
-}
-/**
-* `opts.projectId` narrows to one project; a caller who cannot view it gets an
-* empty page rather than a 403, so this never reveals that a project exists.
-*/
-async function listVisibleDefinitions(ctx, opts = {}, deps) {
-	const { projectId, ...listOpts } = opts;
-	const { projects } = await resolveAccessibleProjects(ctx, deps);
-	const scoped = projectId ? projects.filter((p) => p.id === projectId) : projects;
-	const page = await deps.definitionMeta.list(ctx, {
-		...listOpts,
-		projectIds: scoped.map((p) => p.id)
-	});
-	return {
-		items: page.items,
-		nextCursor: page.nextCursor,
-		projects: scoped
-	};
-}
-/**
-* Editable definitions whose `sourceDocumentId` is `documentId`: the ones the
-* caller could upload a new version of, by {@link mayUploadToDefinition}.
-*
-* Commons projects are scanned too, since a caller owns their own uploads there
-* without edit rights on the project; rows they can't edit are dropped after
-* the query, so a page can come back short while `nextCursor` stays valid.
-*/
-async function listEditableDefinitionsByDocument(ctx, documentId, opts, deps) {
-	const { projectId, ...listOpts } = opts;
-	const set = await resolveAccessibleProjects(ctx, deps);
-	const rowsFor = (project) => ({
-		member: set.memberByProjectId.get(project.id) ?? null,
-		orgMember: set.orgMemberByOrgId.get(project.orgId) ?? null,
-		platformGrants: set.grantsByProjectId.get(project.id) ?? []
-	});
-	const candidates = set.projects.filter((p) => (!projectId || p.id === projectId) && canCreateDefinition(projectAccessInputFromRowsWith({ deps }, ctx, p, rowsFor(p))));
-	const page = await deps.definitionMeta.list(ctx, {
-		...listOpts,
-		sourceDocumentId: documentId,
-		projectIds: candidates.map((p) => p.id)
-	});
-	return {
-		items: page.items.filter((record) => {
-			const project = set.allById.get(record.projectId);
-			return project ? mayUploadToDefinition(ctx, {
-				record,
-				project,
-				...rowsFor(project)
-			}, deps) : false;
-		}),
-		nextCursor: page.nextCursor
-	};
-}
-/**
-* One definition, or `null` when the caller cannot view its project.
-*
-* Returns `null` rather than throwing 403 so callers surface a 404: a public
-* API that answers "forbidden" for a guid the caller cannot see turns
-* `/definitions/{guid}` into a cross-tenant existence oracle.
-*/
-async function getVisibleDefinition(ctx, guid, deps) {
-	return (await loadVisibleDefinition(ctx, guid, deps))?.record ?? null;
-}
-/** {@link getVisibleDefinition} with the rows it read, for a second rule over the same caller. */
-async function loadVisibleDefinition(ctx, guid, deps) {
-	const meta = deps.definitionMeta;
-	const projectStore = deps.projects;
-	const record = await meta.get(ctx, guid);
-	if (!record) return null;
-	const project = await projectStore.getProject(SYSTEM_CONTEXT, record.projectId);
-	if (!project || outsideTokenOrg(ctx, project.orgId)) return null;
-	const [orgMembers, projectMembers, grants] = await Promise.all([
-		deps.orgs.getOrgMembersFor(SYSTEM_CONTEXT, [project.orgId], ctx.userId),
-		projectStore.getProjectMembersFor(SYSTEM_CONTEXT, [project.id], ctx.userId),
-		project.visibility === "platform" ? deps.platformProjectGrants.listByProject(SYSTEM_CONTEXT, project.id) : Promise.resolve([])
-	]);
-	const member = projectMembers.get(project.id) ?? null;
-	const orgMember = orgMembers.get(project.orgId) ?? null;
-	return canView(projectAccessInputFromRowsWith({ deps }, ctx, project, {
-		member,
-		orgMember,
-		platformGrants: grants
-	})) ? {
-		record,
-		project,
-		member,
-		orgMember
-	} : null;
-}
-/**
-* May the caller upload a version of this definition and make one live? The
-* rule `requireEditableDefinition` applies, and for an API token its `upload`
-* scope on the definition, which is what those routes check.
-*/
-function mayUploadToDefinition(ctx, { record, project, member, orgMember }, deps) {
-	return scopeAllows(ctx, "upload", {
-		definitionId: record.guid,
-		projectId: project.id
-	}) && canEditDefinition({
-		project,
-		definition: record,
-		member,
-		orgMember,
-		userId: ctx.userId,
-		platformPermissions: ctx.platformPermissions,
-		enablePlatformProjects: deps.flag("ENABLE_PLATFORM_PROJECTS")
-	});
-}
-/**
-* One version of a definition the caller can view, including its cached
-* `schema`. `null` when the definition is invisible, the version is missing, or
-* the version belongs to a different definition — a caller must not be able to
-* read an arbitrary version by pairing it with a guid they can see.
-*/
-async function loadVisibleVersion(ctx, guid, versionId, deps) {
-	const record = await getVisibleDefinition(ctx, guid, deps);
-	if (!record) return null;
-	const version = await deps.definitionMeta.getVersion(ctx, versionId);
-	if (!version || version.definitionId !== record.guid) return null;
-	return version;
-}
-
-export { listVisibleDefinitions as a, loadVisibleDefinition as b, canCreateDefinitionInOrg as c, loadVisibleVersion as d, getVisibleDefinition as g, listEditableDefinitionsByDocument as l, mayUploadToDefinition as m, resolveAccessibleProjects as r };
-//# sourceMappingURL=visibility.js-DHIz9MAP.js.map

package/build/server/chunks/chunks/visibility.js-DHIz9MAP.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"visibility.js-DHIz9MAP.js","sources":["../../../../.svelte-kit/output/server/chunks/visibility.js"],"sourcesContent":["import { b as outsideTokenOrg, t as SYSTEM_CONTEXT, x as scopeAllows } from \"./src.js\";\nimport { H as canCreateDefinition, W as canEditDefinition, a as projectAccessInputFromRowsWith, q as canView } from \"./access.js\";\n// ../server/src/definitions/visibility.ts\n/**\n* Visibility-filtered definition reads, shared by the library page load and\n* `GET /api/v1/definitions`.\n*\n* **This is a tenancy boundary.** The project scan runs as `SYSTEM_CONTEXT` so\n* cross-org `public` projects are reachable when `ALLOW_CROSS_ORG_PUBLIC` is on;\n* `canView` over the fetched membership rows is the only thing keeping another\n* org's projects out of the result. The definition list itself is then filtered\n* *in the query* via `projectIds`, so the cursor is applied after visibility\n* rather than over a page that gets thinned afterwards.\n*\n* Cost is constant in the number of orgs and projects: three bulk membership\n* reads regardless of N. Anything added here must keep that property — a\n* per-project `await` inside a loop reintroduces the N+1 this replaced.\n*/\n/** Upper bound on the org/project scan. Visibility needs the whole set. */\nvar SCAN_LIMIT = 200;\n/**\n* Resolve the caller's accessible project set in a constant number of queries.\n* Platform grants are fetched only for `platform`-visibility projects —\n* `canView` short-circuits before reading them for every other visibility.\n*/\nasync function resolveAccessibleProjects(ctx, deps) {\n\tconst orgs = deps.orgs;\n\tconst projectStore = deps.projects;\n\tconst grantStore = deps.platformProjectGrants;\n\tconst orgIds = (await orgs.listOrgs(SYSTEM_CONTEXT, { limit: SCAN_LIMIT })).items.map((o) => o.id).filter((id) => !outsideTokenOrg(ctx, id));\n\tconst allProjects = (await Promise.all(orgIds.map((orgId) => projectStore.listProjects(SYSTEM_CONTEXT, orgId, { limit: SCAN_LIMIT })))).flatMap((p) => p.items);\n\tconst projectIds = allProjects.map((p) => p.id);\n\tconst platformProjectIds = allProjects.filter((p) => p.visibility === \"platform\").map((p) => p.id);\n\tconst [orgMemberByOrgId, memberByProjectId, grantsByProjectId] = await Promise.all([\n\t\torgs.getOrgMembersFor(SYSTEM_CONTEXT, orgIds, ctx.userId),\n\t\tprojectStore.getProjectMembersFor(SYSTEM_CONTEXT, projectIds, ctx.userId),\n\t\tplatformProjectIds.length ? grantStore.listByProjects(SYSTEM_CONTEXT, platformProjectIds) : Promise.resolve(/* @__PURE__ */ new Map())\n\t]);\n\treturn {\n\t\tprojects: allProjects.filter((project) => canView(projectAccessInputFromRowsWith({ deps }, ctx, project, {\n\t\t\tmember: memberByProjectId.get(project.id) ?? null,\n\t\t\torgMember: orgMemberByOrgId.get(project.orgId) ?? null,\n\t\t\tplatformGrants: grantsByProjectId.get(project.id) ?? []\n\t\t}))),\n\t\tallById: new Map(allProjects.map((p) => [p.id, p])),\n\t\tmemberByProjectId,\n\t\torgMemberByOrgId,\n\t\tgrantsByProjectId\n\t};\n}\n/**\n* Whether the caller may create a definition in at least one project of\n* `orgId`, by the same rule `requireCanCreateDefinition` applies. Reads the\n* org's projects a page at a time and stops at the first that passes.\n*/\nasync function canCreateDefinitionInOrg(ctx, orgId, deps) {\n\tconst orgMember = (await deps.orgs.getOrgMembersFor(SYSTEM_CONTEXT, [orgId], ctx.userId)).get(orgId) ?? null;\n\tlet cursor;\n\tdo {\n\t\tconst page = await deps.projects.listProjects(SYSTEM_CONTEXT, orgId, {\n\t\t\tlimit: SCAN_LIMIT,\n\t\t\tcursor\n\t\t});\n\t\tconst platformIds = page.items.filter((p) => p.visibility === \"platform\").map((p) => p.id);\n\t\tconst [members, grants] = await Promise.all([deps.projects.getProjectMembersFor(SYSTEM_CONTEXT, page.items.map((p) => p.id), ctx.userId), platformIds.length ? deps.platformProjectGrants.listByProjects(SYSTEM_CONTEXT, platformIds) : Promise.resolve(/* @__PURE__ */ new Map())]);\n\t\tif (page.items.some((project) => canCreateDefinition(projectAccessInputFromRowsWith({ deps }, ctx, project, {\n\t\t\tmember: members.get(project.id) ?? null,\n\t\t\torgMember,\n\t\t\tplatformGrants: grants.get(project.id) ?? []\n\t\t})))) return true;\n\t\tcursor = page.nextCursor;\n\t} while (cursor);\n\treturn false;\n}\n/**\n* `opts.projectId` narrows to one project; a caller who cannot view it gets an\n* empty page rather than a 403, so this never reveals that a project exists.\n*/\nasync function listVisibleDefinitions(ctx, opts = {}, deps) {\n\tconst { projectId, ...listOpts } = opts;\n\tconst { projects } = await resolveAccessibleProjects(ctx, deps);\n\tconst scoped = projectId ? projects.filter((p) => p.id === projectId) : projects;\n\tconst page = await deps.definitionMeta.list(ctx, {\n\t\t...listOpts,\n\t\tprojectIds: scoped.map((p) => p.id)\n\t});\n\treturn {\n\t\titems: page.items,\n\t\tnextCursor: page.nextCursor,\n\t\tprojects: scoped\n\t};\n}\n/**\n* Editable definitions whose `sourceDocumentId` is `documentId`: the ones the\n* caller could upload a new version of, by {@link mayUploadToDefinition}.\n*\n* Commons projects are scanned too, since a caller owns their own uploads there\n* without edit rights on the project; rows they can't edit are dropped after\n* the query, so a page can come back short while `nextCursor` stays valid.\n*/\nasync function listEditableDefinitionsByDocument(ctx, documentId, opts, deps) {\n\tconst { projectId, ...listOpts } = opts;\n\tconst set = await resolveAccessibleProjects(ctx, deps);\n\tconst rowsFor = (project) => ({\n\t\tmember: set.memberByProjectId.get(project.id) ?? null,\n\t\torgMember: set.orgMemberByOrgId.get(project.orgId) ?? null,\n\t\tplatformGrants: set.grantsByProjectId.get(project.id) ?? []\n\t});\n\tconst candidates = set.projects.filter((p) => (!projectId || p.id === projectId) && canCreateDefinition(projectAccessInputFromRowsWith({ deps }, ctx, p, rowsFor(p))));\n\tconst page = await deps.definitionMeta.list(ctx, {\n\t\t...listOpts,\n\t\tsourceDocumentId: documentId,\n\t\tprojectIds: candidates.map((p) => p.id)\n\t});\n\treturn {\n\t\titems: page.items.filter((record) => {\n\t\t\tconst project = set.allById.get(record.projectId);\n\t\t\treturn project ? mayUploadToDefinition(ctx, {\n\t\t\t\trecord,\n\t\t\t\tproject,\n\t\t\t\t...rowsFor(project)\n\t\t\t}, deps) : false;\n\t\t}),\n\t\tnextCursor: page.nextCursor\n\t};\n}\n/**\n* One definition, or `null` when the caller cannot view its project.\n*\n* Returns `null` rather than throwing 403 so callers surface a 404: a public\n* API that answers \"forbidden\" for a guid the caller cannot see turns\n* `/definitions/{guid}` into a cross-tenant existence oracle.\n*/\nasync function getVisibleDefinition(ctx, guid, deps) {\n\treturn (await loadVisibleDefinition(ctx, guid, deps))?.record ?? null;\n}\n/** {@link getVisibleDefinition} with the rows it read, for a second rule over the same caller. */\nasync function loadVisibleDefinition(ctx, guid, deps) {\n\tconst meta = deps.definitionMeta;\n\tconst projectStore = deps.projects;\n\tconst record = await meta.get(ctx, guid);\n\tif (!record) return null;\n\tconst project = await projectStore.getProject(SYSTEM_CONTEXT, record.projectId);\n\tif (!project || outsideTokenOrg(ctx, project.orgId)) return null;\n\tconst [orgMembers, projectMembers, grants] = await Promise.all([\n\t\tdeps.orgs.getOrgMembersFor(SYSTEM_CONTEXT, [project.orgId], ctx.userId),\n\t\tprojectStore.getProjectMembersFor(SYSTEM_CONTEXT, [project.id], ctx.userId),\n\t\tproject.visibility === \"platform\" ? deps.platformProjectGrants.listByProject(SYSTEM_CONTEXT, project.id) : Promise.resolve([])\n\t]);\n\tconst member = projectMembers.get(project.id) ?? null;\n\tconst orgMember = orgMembers.get(project.orgId) ?? null;\n\treturn canView(projectAccessInputFromRowsWith({ deps }, ctx, project, {\n\t\tmember,\n\t\torgMember,\n\t\tplatformGrants: grants\n\t})) ? {\n\t\trecord,\n\t\tproject,\n\t\tmember,\n\t\torgMember\n\t} : null;\n}\n/**\n* May the caller upload a version of this definition and make one live? The\n* rule `requireEditableDefinition` applies, and for an API token its `upload`\n* scope on the definition, which is what those routes check.\n*/\nfunction mayUploadToDefinition(ctx, { record, project, member, orgMember }, deps) {\n\treturn scopeAllows(ctx, \"upload\", {\n\t\tdefinitionId: record.guid,\n\t\tprojectId: project.id\n\t}) && canEditDefinition({\n\t\tproject,\n\t\tdefinition: record,\n\t\tmember,\n\t\torgMember,\n\t\tuserId: ctx.userId,\n\t\tplatformPermissions: ctx.platformPermissions,\n\t\tenablePlatformProjects: deps.flag(\"ENABLE_PLATFORM_PROJECTS\")\n\t});\n}\n/**\n* One version of a definition the caller can view, including its cached\n* `schema`. `null` when the definition is invisible, the version is missing, or\n* the version belongs to a different definition — a caller must not be able to\n* read an arbitrary version by pairing it with a guid they can see.\n*/\nasync function loadVisibleVersion(ctx, guid, versionId, deps) {\n\tconst record = await getVisibleDefinition(ctx, guid, deps);\n\tif (!record) return null;\n\tconst version = await deps.definitionMeta.getVersion(ctx, versionId);\n\tif (!version || version.definitionId !== record.guid) return null;\n\treturn version;\n}\nexport { loadVisibleDefinition as a, resolveAccessibleProjects as c, listVisibleDefinitions as i, getVisibleDefinition as n, loadVisibleVersion as o, listEditableDefinitionsByDocument as r, mayUploadToDefinition as s, canCreateDefinitionInOrg as t };\n"],"names":[],"mappings":";;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,UAAU,GAAG,GAAG;AACpB;AACA;AACA;AACA;AACA;AACA,eAAe,yBAAyB,CAAC,GAAG,EAAE,IAAI,EAAE;AACpD,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI;AACvB,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ;AACnC,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC,qBAAqB;AAC9C,CAAC,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAC7I,CAAC,MAAM,WAAW,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,YAAY,CAAC,YAAY,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;AAChK,CAAC,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC,MAAM,kBAAkB,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AACnG,CAAC,MAAM,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AACpF,EAAE,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC;AAC3D,EAAE,YAAY,CAAC,oBAAoB,CAAC,cAAc,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC;AAC3E,EAAE,kBAAkB,CAAC,MAAM,GAAG,UAAU,CAAC,cAAc,CAAC,cAAc,EAAE,kBAAkB,CAAC,GAAG,OAAO,CAAC,OAAO,iBAAiB,IAAI,GAAG,EAAE;AACvI,EAAE,CAAC;AACH,CAAC,OAAO;AACR,EAAE,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,8BAA8B,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE;AAC3G,GAAG,MAAM,EAAE,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,IAAI;AACpD,GAAG,SAAS,EAAE,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI;AACzD,GAAG,cAAc,EAAE,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI;AACxD,GAAG,CAAC,CAAC,CAAC;AACN,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AACrD,EAAE,iBAAiB;AACnB,EAAE,gBAAgB;AAClB,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,wBAAwB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE;AAC1D,CAAC,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI;AAC7G,CAAC,IAAI,MAAM;AACX,CAAC,GAAG;AACJ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,cAAc,EAAE,KAAK,EAAE;AACvE,GAAG,KAAK,EAAE,UAAU;AACpB,GAAG;AACH,GAAG,CAAC;AACJ,EAAE,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AAC5F,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,cAAc,CAAC,cAAc,EAAE,WAAW,CAAC,GAAG,OAAO,CAAC,OAAO,iBAAiB,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;AACtR,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,mBAAmB,CAAC,8BAA8B,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE;AAC9G,GAAG,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,IAAI;AAC1C,GAAG,SAAS;AACZ,GAAG,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI;AAC7C,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI;AACnB,EAAE,MAAM,GAAG,IAAI,CAAC,UAAU;AAC1B,CAAC,CAAC,QAAQ,MAAM;AAChB,CAAC,OAAO,KAAK;AACb;AACA;AACA;AACA;AACA;AACA,eAAe,sBAAsB,CAAC,GAAG,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE;AAC5D,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAI;AACxC,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC;AAChE,CAAC,MAAM,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,GAAG,QAAQ;AACjF,CAAC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE;AAClD,EAAE,GAAG,QAAQ;AACb,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE;AACpC,EAAE,CAAC;AACH,CAAC,OAAO;AACR,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK;AACnB,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU;AAC7B,EAAE,QAAQ,EAAE;AACZ,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,iCAAiC,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE;AAC9E,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAI;AACxC,CAAC,MAAM,GAAG,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC;AACvD,CAAC,MAAM,OAAO,GAAG,CAAC,OAAO,MAAM;AAC/B,EAAE,MAAM,EAAE,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,IAAI;AACvD,EAAE,SAAS,EAAE,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI;AAC5D,EAAE,cAAc,EAAE,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI;AAC3D,EAAE,CAAC;AACH,CAAC,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS,KAAK,mBAAmB,CAAC,8BAA8B,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvK,CAAC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE;AAClD,EAAE,GAAG,QAAQ;AACb,EAAE,gBAAgB,EAAE,UAAU;AAC9B,EAAE,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE;AACxC,EAAE,CAAC;AACH,CAAC,OAAO;AACR,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK;AACvC,GAAG,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC;AACpD,GAAG,OAAO,OAAO,GAAG,qBAAqB,CAAC,GAAG,EAAE;AAC/C,IAAI,MAAM;AACV,IAAI,OAAO;AACX,IAAI,GAAG,OAAO,CAAC,OAAO;AACtB,IAAI,EAAE,IAAI,CAAC,GAAG,KAAK;AACnB,EAAE,CAAC,CAAC;AACJ,EAAE,UAAU,EAAE,IAAI,CAAC;AACnB,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,oBAAoB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE;AACrD,CAAC,OAAO,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,MAAM,IAAI,IAAI;AACtE;AACA;AACA,eAAe,qBAAqB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE;AACtD,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc;AACjC,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ;AACnC,CAAC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC;AACzC,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI;AACzB,CAAC,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC;AAChF,CAAC,IAAI,CAAC,OAAO,IAAI,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,IAAI;AACjE,CAAC,MAAM,CAAC,UAAU,EAAE,cAAc,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AAChE,EAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC;AACzE,EAAE,YAAY,CAAC,oBAAoB,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC;AAC7E,EAAE,OAAO,CAAC,UAAU,KAAK,UAAU,GAAG,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,cAAc,EAAE,OAAO,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,EAAE;AAC/H,EAAE,CAAC;AACH,CAAC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,IAAI;AACtD,CAAC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI;AACxD,CAAC,OAAO,OAAO,CAAC,8BAA8B,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE;AACvE,EAAE,MAAM;AACR,EAAE,SAAS;AACX,EAAE,cAAc,EAAE;AAClB,EAAE,CAAC,CAAC,GAAG;AACP,EAAE,MAAM;AACR,EAAE,OAAO;AACT,EAAE,MAAM;AACR,EAAE;AACF,EAAE,GAAG,IAAI;AACT;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE;AAClF,CAAC,OAAO,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE;AACnC,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI;AAC3B,EAAE,SAAS,EAAE,OAAO,CAAC;AACrB,EAAE,CAAC,IAAI,iBAAiB,CAAC;AACzB,EAAE,OAAO;AACT,EAAE,UAAU,EAAE,MAAM;AACpB,EAAE,MAAM;AACR,EAAE,SAAS;AACX,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM;AACpB,EAAE,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;AAC9C,EAAE,sBAAsB,EAAE,IAAI,CAAC,IAAI,CAAC,0BAA0B;AAC9D,EAAE,CAAC;AACH;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;AAC9D,CAAC,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC;AAC3D,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI;AACzB,CAAC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;AACrE,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,YAAY,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,IAAI;AAClE,CAAC,OAAO,OAAO;AACf;;;;"}

package/build/server/chunks/entries/endpoints/.well-known/oauth-authorization-server/_server.ts.js-BpMnVHeu.js

@@ -1,18 +0,0 @@
-import { d as authorizationServerMetadata } from '../../../../chunks/oauth.js-BQQQPw3V.js';
-import { D as DISCOVERY_HEADERS } from '../../../../chunks/server2.js-C2WwvMlU.js';
-import { json } from '@sveltejs/kit';
-import 'node:crypto';
-import '../../../../chunks/shared-server.js-CJsQadj4.js';
-import '../../../../chunks/compute.js-srroNvr-.js';
-import '../../../../chunks/src.js-BQFsdJf3.js';
-import 'zod';
-import '../../../../chunks/access.js-DbWaEG7Y.js';
-import 'node:dns/promises';
-import 'node:net';
-import '../../../../chunks/rate-limit.js-Br3luBbc.js';
-
-// src/routes/.well-known/oauth-authorization-server/+server.ts
-var GET = ({ url }) => json(authorizationServerMetadata(url.origin), { headers: DISCOVERY_HEADERS });
-
-export { GET };
-//# sourceMappingURL=_server.ts.js-BpMnVHeu.js.map

package/build/server/chunks/entries/endpoints/.well-known/oauth-authorization-server/_server.ts.js-BpMnVHeu.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"_server.ts.js-BpMnVHeu.js","sources":["../../../../../../../.svelte-kit/output/server/entries/endpoints/.well-known/oauth-authorization-server/_server.ts.js"],"sourcesContent":["import { a as authorizationServerMetadata } from \"../../../../chunks/oauth.js\";\nimport { t as DISCOVERY_HEADERS } from \"../../../../chunks/server2.js\";\nimport { json } from \"@sveltejs/kit\";\n// src/routes/.well-known/oauth-authorization-server/+server.ts\nvar GET = ({ url }) => json(authorizationServerMetadata(url.origin), { headers: DISCOVERY_HEADERS });\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;AAGA;AACG,IAAC,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE;;;;"}

package/build/server/chunks/entries/endpoints/.well-known/oauth-protected-resource/_server.ts.js-BYo_zjAf.js

@@ -1,18 +0,0 @@
-import { p as protectedResourceMetadata } from '../../../../chunks/oauth.js-BQQQPw3V.js';
-import { D as DISCOVERY_HEADERS } from '../../../../chunks/server2.js-C2WwvMlU.js';
-import { json } from '@sveltejs/kit';
-import 'node:crypto';
-import '../../../../chunks/shared-server.js-CJsQadj4.js';
-import '../../../../chunks/compute.js-srroNvr-.js';
-import '../../../../chunks/src.js-BQFsdJf3.js';
-import 'zod';
-import '../../../../chunks/access.js-DbWaEG7Y.js';
-import 'node:dns/promises';
-import 'node:net';
-import '../../../../chunks/rate-limit.js-Br3luBbc.js';
-
-// src/routes/.well-known/oauth-protected-resource/+server.ts
-var GET = ({ url }) => json(protectedResourceMetadata(url.origin), { headers: DISCOVERY_HEADERS });
-
-export { GET };
-//# sourceMappingURL=_server.ts.js-BYo_zjAf.js.map

package/build/server/chunks/entries/endpoints/.well-known/oauth-protected-resource/_server.ts.js-BYo_zjAf.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"_server.ts.js-BYo_zjAf.js","sources":["../../../../../../../.svelte-kit/output/server/entries/endpoints/.well-known/oauth-protected-resource/_server.ts.js"],"sourcesContent":["import { l as protectedResourceMetadata } from \"../../../../chunks/oauth.js\";\nimport { t as DISCOVERY_HEADERS } from \"../../../../chunks/server2.js\";\nimport { json } from \"@sveltejs/kit\";\n// src/routes/.well-known/oauth-protected-resource/+server.ts\nvar GET = ({ url }) => json(protectedResourceMetadata(url.origin), { headers: DISCOVERY_HEADERS });\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;AAGA;AACG,IAAC,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE;;;;"}