@selvajs/selva 4.20.0-beta.3 → 4.20.0-beta.4

package/build/server/chunks/entries/endpoints/api/admin/projects/_id_/_server.ts.js-sbp0wVnw.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-sbp0wVnw.js","sources":["../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/admin/projects/_id_/_server.ts.js"],"sourcesContent":["import { F as slugify, t as SYSTEM_CONTEXT } from \"../../../../../../chunks/src.js\";\nimport { v as getProjectProvider } from \"../../../../../../chunks/providers.server.js\";\nimport { v as requireInstanceAdmin } from \"../../../../../../chunks/access.js\";\nimport { u as ApiErrorCode } from \"../../../../../../chunks/schema-extraction.js\";\nimport { a as requireParams, n as parseBody } from \"../../../../../../chunks/request.js\";\nimport { t as apiError } from \"../../../../../../chunks/api-errors.js\";\nimport \"../../../../../../chunks/access2.server.js\";\nimport { r as noContent, t as apiRoute } from \"../../../../../../chunks/http.js\";\nimport { json } from \"@sveltejs/kit\";\nimport { z } from \"zod\";\n//#region src/routes/api/admin/projects/[id]/+server.ts\nvar UpdatePlatformProjectBody = z.object({\n\tname: z.string().min(1).max(128).trim(),\n\tdescription: z.string().max(2e3).nullish()\n}).partial();\nasync function loadPlatformProjectOr404(id) {\n\tconst project = await getProjectProvider().getProject(SYSTEM_CONTEXT, id);\n\tif (!project || project.visibility !== \"platform\") apiError(404, ApiErrorCode.NOT_FOUND, \"Platform project not found\");\n\treturn project;\n}\nvar GET = apiRoute(\"Failed to load platform project\", async ({ params, locals }) => {\n\trequireInstanceAdmin(locals);\n\tconst { id } = requireParams(params, \"id\");\n\treturn json(await loadPlatformProjectOr404(id));\n});\nvar PATCH = apiRoute(\"Failed to update platform project\", async ({ params, request, locals }) => {\n\trequireInstanceAdmin(locals);\n\tconst { id } = requireParams(params, \"id\");\n\tconst input = await parseBody(request, UpdatePlatformProjectBody);\n\tawait loadPlatformProjectOr404(id);\n\tconst patch = {};\n\tif (input.name !== void 0) {\n\t\tpatch.name = input.name;\n\t\tpatch.slug = slugify(input.name);\n\t}\n\tif (input.description !== void 0) patch.description = input.description ?? void 0;\n\tawait getProjectProvider().updateProject(SYSTEM_CONTEXT, id, patch);\n\treturn noContent();\n});\nvar DELETE = apiRoute(\"Failed to delete platform project\", async ({ params, locals }) => {\n\trequireInstanceAdmin(locals);\n\tconst { id } = requireParams(params, \"id\");\n\tawait loadPlatformProjectOr404(id);\n\tawait getProjectProvider().deleteProject(SYSTEM_CONTEXT, id);\n\treturn noContent();\n});\n//#endregion\nexport { DELETE, GET, PATCH };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAUA;AACA,IAAI,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;AACzC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;AACxC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO;AACzC,CAAC,CAAC,CAAC,OAAO,EAAE;AACZ,eAAe,wBAAwB,CAAC,EAAE,EAAE;AAC5C,CAAC,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,EAAE,CAAC;AAC1E,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,4BAA4B,CAAC;AACvH,CAAC,OAAO,OAAO;AACf;AACG,IAAC,GAAG,GAAG,QAAQ,CAAC,iCAAiC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AACpF,CAAC,oBAAoB,CAAC,MAAM,CAAC;AAC7B,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;AAC3C,CAAC,OAAO,IAAI,CAAC,MAAM,wBAAwB,CAAC,EAAE,CAAC,CAAC;AAChD,CAAC;AACE,IAAC,KAAK,GAAG,QAAQ,CAAC,mCAAmC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AACjG,CAAC,oBAAoB,CAAC,MAAM,CAAC;AAC7B,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;AAC3C,CAAC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,yBAAyB,CAAC;AAClE,CAAC,MAAM,wBAAwB,CAAC,EAAE,CAAC;AACnC,CAAC,MAAM,KAAK,GAAG,EAAE;AACjB,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE;AAC5B,EAAE,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI;AACzB,EAAE,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;AAClC,CAAC;AACD,CAAC,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,EAAE,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC;AAClF,CAAC,MAAM,kBAAkB,EAAE,CAAC,aAAa,CAAC,cAAc,EAAE,EAAE,EAAE,KAAK,CAAC;AACpE,CAAC,OAAO,SAAS,EAAE;AACnB,CAAC;AACE,IAAC,MAAM,GAAG,QAAQ,CAAC,mCAAmC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AACzF,CAAC,oBAAoB,CAAC,MAAM,CAAC;AAC7B,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;AAC3C,CAAC,MAAM,wBAAwB,CAAC,EAAE,CAAC;AACnC,CAAC,MAAM,kBAAkB,EAAE,CAAC,aAAa,CAAC,cAAc,EAAE,EAAE,CAAC;AAC7D,CAAC,OAAO,SAAS,EAAE;AACnB,CAAC;;;;"}

package/build/server/chunks/entries/endpoints/api/admin/projects/_id_/grants/_grantId_/_server.ts.js-TcHNZ6Ua.js

@@ -0,0 +1,35 @@
+import { S as SYSTEM_CONTEXT } from '../../../../../../../../chunks/src.js-bYgw0r8C.js';
+import { j as flag, s as getPlatformProjectGrantStore } from '../../../../../../../../chunks/providers.server.js-CpbKkjkR.js';
+import { h as requireInstanceAdmin } from '../../../../../../../../chunks/access.js-BIDQ4aL-.js';
+import { A as ApiErrorCode } from '../../../../../../../../chunks/schema-extraction.js-B-qWNPpJ.js';
+import { r as requireParams } from '../../../../../../../../chunks/request.js-BBBMO7VG.js';
+import { a as apiError } from '../../../../../../../../chunks/api-errors.js-DAYH9H49.js';
+import '../../../../../../../../chunks/api.js-DGA_Gpu6.js';
+import '@sveltejs/kit';
+import { a as apiRoute, n as noContent } from '../../../../../../../../chunks/http.js-Bg9NQgYu.js';
+import 'zod';
+import '../../../../../../../../chunks/shared-server.js-BGs15m2r.js';
+import '../../../../../../../../chunks/definitions.js-sU8j2oCu.js';
+import '../../../../../../../../chunks/schema.js-6Jx4Hhzv.js';
+import 'node:crypto';
+import '../../../../../../../../chunks/utils2.js-C9XYOWak.js';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import 'node:dns/promises';
+import 'node:net';
+import '../../../../../../../../chunks/rate-limit.js-Br3luBbc.js';
+
+//#region src/routes/api/admin/projects/[id]/grants/[grantId]/+server.ts
+var DELETE = apiRoute("Failed to revoke grant", async ({ params, locals }) => {
+	requireInstanceAdmin(locals);
+	if (!flag("ENABLE_PLATFORM_PROJECTS")) apiError(404, ApiErrorCode.NOT_FOUND, "Not found");
+	const { grantId } = requireParams(params, "grantId");
+	await getPlatformProjectGrantStore().delete(SYSTEM_CONTEXT, grantId);
+	return noContent();
+});
+
+export { DELETE };
+//# sourceMappingURL=_server.ts.js-TcHNZ6Ua.js.map

package/build/server/chunks/entries/endpoints/api/admin/projects/_id_/grants/_grantId_/_server.ts.js-TcHNZ6Ua.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-TcHNZ6Ua.js","sources":["../../../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/admin/projects/_id_/grants/_grantId_/_server.ts.js"],"sourcesContent":["import { t as SYSTEM_CONTEXT } from \"../../../../../../../../chunks/src.js\";\nimport { _ as getPlatformProjectGrantStore, t as flag } from \"../../../../../../../../chunks/providers.server.js\";\nimport { v as requireInstanceAdmin } from \"../../../../../../../../chunks/access.js\";\nimport { u as ApiErrorCode } from \"../../../../../../../../chunks/schema-extraction.js\";\nimport { a as requireParams } from \"../../../../../../../../chunks/request.js\";\nimport { t as apiError } from \"../../../../../../../../chunks/api-errors.js\";\nimport \"../../../../../../../../chunks/access2.server.js\";\nimport { r as noContent, t as apiRoute } from \"../../../../../../../../chunks/http.js\";\n//#region src/routes/api/admin/projects/[id]/grants/[grantId]/+server.ts\nvar DELETE = apiRoute(\"Failed to revoke grant\", async ({ params, locals }) => {\n\trequireInstanceAdmin(locals);\n\tif (!flag(\"ENABLE_PLATFORM_PROJECTS\")) apiError(404, ApiErrorCode.NOT_FOUND, \"Not found\");\n\tconst { grantId } = requireParams(params, \"grantId\");\n\tawait getPlatformProjectGrantStore().delete(SYSTEM_CONTEXT, grantId);\n\treturn noContent();\n});\n//#endregion\nexport { DELETE };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAQA;AACG,IAAC,MAAM,GAAG,QAAQ,CAAC,wBAAwB,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AAC9E,CAAC,oBAAoB,CAAC,MAAM,CAAC;AAC7B,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,WAAW,CAAC;AAC1F,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC;AACrD,CAAC,MAAM,4BAA4B,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC;AACrE,CAAC,OAAO,SAAS,EAAE;AACnB,CAAC;;;;"}

package/build/server/chunks/entries/endpoints/api/admin/projects/_id_/grants/_server.ts.js-Cy6nvnOU.js

@@ -0,0 +1,66 @@
+import { S as SYSTEM_CONTEXT } from '../../../../../../../chunks/src.js-bYgw0r8C.js';
+import { s as getPlatformProjectGrantStore, e as getOrganizationProvider, n as getUserProfileStore, j as flag, f as getProjectProvider } from '../../../../../../../chunks/providers.server.js-CpbKkjkR.js';
+import { h as requireInstanceAdmin } from '../../../../../../../chunks/access.js-BIDQ4aL-.js';
+import { A as ApiErrorCode } from '../../../../../../../chunks/schema-extraction.js-B-qWNPpJ.js';
+import { r as requireParams, p as parseBody } from '../../../../../../../chunks/request.js-BBBMO7VG.js';
+import { a as apiError } from '../../../../../../../chunks/api-errors.js-DAYH9H49.js';
+import '../../../../../../../chunks/api.js-DGA_Gpu6.js';
+import { json } from '@sveltejs/kit';
+import { a as apiRoute, c as created } from '../../../../../../../chunks/http.js-Bg9NQgYu.js';
+import { z } from 'zod';
+import { randomUUID } from 'node:crypto';
+import '../../../../../../../chunks/shared-server.js-BGs15m2r.js';
+import '../../../../../../../chunks/definitions.js-sU8j2oCu.js';
+import '../../../../../../../chunks/schema.js-6Jx4Hhzv.js';
+import '../../../../../../../chunks/utils2.js-C9XYOWak.js';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import 'node:dns/promises';
+import 'node:net';
+import '../../../../../../../chunks/rate-limit.js-Br3luBbc.js';
+
+//#region src/routes/api/admin/projects/[id]/grants/+server.ts
+var CreateGrantBody = z.object({
+	granteeType: z.enum(["org", "user"]),
+	granteeId: z.string().min(1),
+	canSolve: z.boolean()
+});
+async function assertPlatformProject(id) {
+	if (!flag("ENABLE_PLATFORM_PROJECTS")) apiError(404, ApiErrorCode.NOT_FOUND, "Not found");
+	const project = await getProjectProvider().getProject(SYSTEM_CONTEXT, id);
+	if (!project || project.visibility !== "platform") apiError(404, ApiErrorCode.NOT_FOUND, "Platform project not found");
+	return project;
+}
+var GET = apiRoute("Failed to list grants", async ({ params, locals }) => {
+	requireInstanceAdmin(locals);
+	const { id } = requireParams(params, "id");
+	await assertPlatformProject(id);
+	const grants = await getPlatformProjectGrantStore().listByProject(SYSTEM_CONTEXT, id);
+	return json({ grants });
+});
+var POST = apiRoute("Failed to create grant", async ({ params, request, locals }) => {
+	const user = requireInstanceAdmin(locals);
+	const { id } = requireParams(params, "id");
+	const input = await parseBody(request, CreateGrantBody);
+	await assertPlatformProject(id);
+	if (input.granteeType === "org") {
+		if (!await getOrganizationProvider().getOrg(SYSTEM_CONTEXT, input.granteeId)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Organization '${input.granteeId}' not found`);
+	} else if (!await getUserProfileStore().getProfile(SYSTEM_CONTEXT, input.granteeId)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `User '${input.granteeId}' not found`);
+	const grant = {
+		id: randomUUID(),
+		projectId: id,
+		granteeType: input.granteeType,
+		granteeId: input.granteeId,
+		canSolve: input.canSolve,
+		createdBy: user.id,
+		createdAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+	await getPlatformProjectGrantStore().create(SYSTEM_CONTEXT, grant);
+	return created(grant);
+});
+
+export { GET, POST };
+//# sourceMappingURL=_server.ts.js-Cy6nvnOU.js.map

package/build/server/chunks/entries/endpoints/api/admin/projects/_id_/grants/_server.ts.js-Cy6nvnOU.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-Cy6nvnOU.js","sources":["../../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/admin/projects/_id_/grants/_server.ts.js"],"sourcesContent":["import { t as SYSTEM_CONTEXT } from \"../../../../../../../chunks/src.js\";\nimport { C as getUserProfileStore, _ as getPlatformProjectGrantStore, h as getOrganizationProvider, t as flag, v as getProjectProvider } from \"../../../../../../../chunks/providers.server.js\";\nimport { v as requireInstanceAdmin } from \"../../../../../../../chunks/access.js\";\nimport { u as ApiErrorCode } from \"../../../../../../../chunks/schema-extraction.js\";\nimport { a as requireParams, n as parseBody } from \"../../../../../../../chunks/request.js\";\nimport { t as apiError } from \"../../../../../../../chunks/api-errors.js\";\nimport \"../../../../../../../chunks/access2.server.js\";\nimport { n as created, t as apiRoute } from \"../../../../../../../chunks/http.js\";\nimport { json } from \"@sveltejs/kit\";\nimport { z } from \"zod\";\nimport { randomUUID } from \"node:crypto\";\n//#region src/routes/api/admin/projects/[id]/grants/+server.ts\nvar CreateGrantBody = z.object({\n\tgranteeType: z.enum([\"org\", \"user\"]),\n\tgranteeId: z.string().min(1),\n\tcanSolve: z.boolean()\n});\nasync function assertPlatformProject(id) {\n\tif (!flag(\"ENABLE_PLATFORM_PROJECTS\")) apiError(404, ApiErrorCode.NOT_FOUND, \"Not found\");\n\tconst project = await getProjectProvider().getProject(SYSTEM_CONTEXT, id);\n\tif (!project || project.visibility !== \"platform\") apiError(404, ApiErrorCode.NOT_FOUND, \"Platform project not found\");\n\treturn project;\n}\nvar GET = apiRoute(\"Failed to list grants\", async ({ params, locals }) => {\n\trequireInstanceAdmin(locals);\n\tconst { id } = requireParams(params, \"id\");\n\tawait assertPlatformProject(id);\n\tconst grants = await getPlatformProjectGrantStore().listByProject(SYSTEM_CONTEXT, id);\n\treturn json({ grants });\n});\nvar POST = apiRoute(\"Failed to create grant\", async ({ params, request, locals }) => {\n\tconst user = requireInstanceAdmin(locals);\n\tconst { id } = requireParams(params, \"id\");\n\tconst input = await parseBody(request, CreateGrantBody);\n\tawait assertPlatformProject(id);\n\tif (input.granteeType === \"org\") {\n\t\tif (!await getOrganizationProvider().getOrg(SYSTEM_CONTEXT, input.granteeId)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Organization '${input.granteeId}' not found`);\n\t} else if (!await getUserProfileStore().getProfile(SYSTEM_CONTEXT, input.granteeId)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `User '${input.granteeId}' not found`);\n\tconst grant = {\n\t\tid: randomUUID(),\n\t\tprojectId: id,\n\t\tgranteeType: input.granteeType,\n\t\tgranteeId: input.granteeId,\n\t\tcanSolve: input.canSolve,\n\t\tcreatedBy: user.id,\n\t\tcreatedAt: (/* @__PURE__ */ new Date()).toISOString()\n\t};\n\tawait getPlatformProjectGrantStore().create(SYSTEM_CONTEXT, grant);\n\treturn created(grant);\n});\n//#endregion\nexport { GET, POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAWA;AACA,IAAI,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;AAC/B,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AACrC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7B,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO;AACpB,CAAC,CAAC;AACF,eAAe,qBAAqB,CAAC,EAAE,EAAE;AACzC,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,WAAW,CAAC;AAC1F,CAAC,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,EAAE,CAAC;AAC1E,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,4BAA4B,CAAC;AACvH,CAAC,OAAO,OAAO;AACf;AACG,IAAC,GAAG,GAAG,QAAQ,CAAC,uBAAuB,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AAC1E,CAAC,oBAAoB,CAAC,MAAM,CAAC;AAC7B,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;AAC3C,CAAC,MAAM,qBAAqB,CAAC,EAAE,CAAC;AAChC,CAAC,MAAM,MAAM,GAAG,MAAM,4BAA4B,EAAE,CAAC,aAAa,CAAC,cAAc,EAAE,EAAE,CAAC;AACtF,CAAC,OAAO,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;AACxB,CAAC;AACE,IAAC,IAAI,GAAG,QAAQ,CAAC,wBAAwB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AACrF,CAAC,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAM,CAAC;AAC1C,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;AAC3C,CAAC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC;AACxD,CAAC,MAAM,qBAAqB,CAAC,EAAE,CAAC;AAChC,CAAC,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,EAAE;AAClC,EAAE,IAAI,CAAC,MAAM,uBAAuB,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,cAAc,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;AAC5K,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,mBAAmB,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;AAC1K,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,EAAE,EAAE,UAAU,EAAE;AAClB,EAAE,SAAS,EAAE,EAAE;AACf,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW;AAChC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS;AAC5B,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ;AAC1B,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;AACpB,EAAE,SAAS,EAAE,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW;AACrD,EAAE;AACF,CAAC,MAAM,4BAA4B,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,CAAC;AACnE,CAAC,OAAO,OAAO,CAAC,KAAK,CAAC;AACtB,CAAC;;;;"}

package/build/server/chunks/entries/endpoints/api/admin/projects/_server.ts.js-BS9H2y_Y.js

@@ -0,0 +1,81 @@
+import { S as SYSTEM_CONTEXT } from '../../../../../chunks/src.js-bYgw0r8C.js';
+import { j as flag, e as getOrganizationProvider, f as getProjectProvider } from '../../../../../chunks/providers.server.js-CpbKkjkR.js';
+import { h as requireInstanceAdmin } from '../../../../../chunks/access.js-BIDQ4aL-.js';
+import { A as ApiErrorCode } from '../../../../../chunks/schema-extraction.js-B-qWNPpJ.js';
+import { p as parseBody } from '../../../../../chunks/request.js-BBBMO7VG.js';
+import { a as apiError } from '../../../../../chunks/api-errors.js-DAYH9H49.js';
+import '../../../../../chunks/api.js-DGA_Gpu6.js';
+import { json } from '@sveltejs/kit';
+import { a as apiRoute, c as created } from '../../../../../chunks/http.js-Bg9NQgYu.js';
+import { c as createProjectWithUniqueSlug } from '../../../../../chunks/projects.js-CsA1nWwa.js';
+import { z } from 'zod';
+import { randomUUID } from 'node:crypto';
+import '../../../../../chunks/shared-server.js-BGs15m2r.js';
+import '../../../../../chunks/definitions.js-sU8j2oCu.js';
+import '../../../../../chunks/schema.js-6Jx4Hhzv.js';
+import '../../../../../chunks/utils2.js-C9XYOWak.js';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import 'node:dns/promises';
+import 'node:net';
+import '../../../../../chunks/rate-limit.js-Br3luBbc.js';
+
+//#region src/routes/api/admin/projects/+server.ts
+var CreatePlatformProjectBody = z.object({
+	name: z.string().min(1, "Project name is required").max(128).trim(),
+	description: z.string().max(2e3).optional(),
+	/**
+	* Org that physically hosts the project. Storage routing and compute
+	* resolution use this — but org membership in this org does NOT grant
+	* access. Visibility = 'platform' overrides those defaults.
+	*
+	* If omitted, the platform admin's first available org is used.
+	*/
+	orgId: z.string().uuid().optional()
+});
+/**
+* §4a — list every platform-visibility project on the instance. Uses
+* `SYSTEM_CONTEXT` because admin reads cross every org boundary; the route is
+* gated on `instance_admin`.
+*/
+var GET = apiRoute("Failed to list platform projects", async ({ locals }) => {
+	requireInstanceAdmin(locals);
+	if (!flag("ENABLE_PLATFORM_PROJECTS")) apiError(404, ApiErrorCode.NOT_FOUND, "Not found");
+	const orgs = await getOrganizationProvider().listOrgs(SYSTEM_CONTEXT, { limit: 1e3 });
+	const all = [];
+	for (const org of orgs.items) {
+		const page = await getProjectProvider().listProjects(SYSTEM_CONTEXT, org.id, { limit: 1e3 });
+		for (const p of page.items) if (p.visibility === "platform") all.push(p);
+	}
+	return json({ projects: all });
+});
+var POST = apiRoute("Failed to create platform project", async ({ request, locals }) => {
+	const user = requireInstanceAdmin(locals);
+	if (!flag("ENABLE_PLATFORM_PROJECTS")) apiError(404, ApiErrorCode.NOT_FOUND, "Not found");
+	const input = await parseBody(request, CreatePlatformProjectBody);
+	const hostOrgId = input.orgId ?? locals.ctx.actingOrgId;
+	if (!hostOrgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, "A host orgId is required (no active organization in context).");
+	if (!await getOrganizationProvider().getOrg(SYSTEM_CONTEXT, hostOrgId)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Host organization '${hostOrgId}' not found.`);
+	const project = await createProjectWithUniqueSlug(getProjectProvider(), {
+		id: randomUUID(),
+		orgId: hostOrgId,
+		name: input.name,
+		description: input.description,
+		visibility: "platform",
+		ownerId: user.id,
+		createdBy: user.id,
+		updatedBy: user.id,
+		autoJoinOnUpload: false
+	}, {
+		writeCtx: SYSTEM_CONTEXT,
+		fallbackSlug: "platform-project",
+		conflictScope: "the host organization"
+	});
+	return created(project);
+});
+
+export { GET, POST };
+//# sourceMappingURL=_server.ts.js-BS9H2y_Y.js.map

package/build/server/chunks/entries/endpoints/api/admin/projects/_server.ts.js-BS9H2y_Y.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-BS9H2y_Y.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/admin/projects/_server.ts.js"],"sourcesContent":["import { t as SYSTEM_CONTEXT } from \"../../../../../chunks/src.js\";\nimport { h as getOrganizationProvider, t as flag, v as getProjectProvider } from \"../../../../../chunks/providers.server.js\";\nimport { v as requireInstanceAdmin } from \"../../../../../chunks/access.js\";\nimport { u as ApiErrorCode } from \"../../../../../chunks/schema-extraction.js\";\nimport { n as parseBody } from \"../../../../../chunks/request.js\";\nimport { t as apiError } from \"../../../../../chunks/api-errors.js\";\nimport \"../../../../../chunks/access2.server.js\";\nimport { n as created, t as apiRoute } from \"../../../../../chunks/http.js\";\nimport { t as createProjectWithUniqueSlug } from \"../../../../../chunks/projects.js\";\nimport { json } from \"@sveltejs/kit\";\nimport { z } from \"zod\";\nimport { randomUUID } from \"node:crypto\";\n//#region src/routes/api/admin/projects/+server.ts\nvar CreatePlatformProjectBody = z.object({\n\tname: z.string().min(1, \"Project name is required\").max(128).trim(),\n\tdescription: z.string().max(2e3).optional(),\n\t/**\n\t* Org that physically hosts the project. Storage routing and compute\n\t* resolution use this — but org membership in this org does NOT grant\n\t* access. Visibility = 'platform' overrides those defaults.\n\t*\n\t* If omitted, the platform admin's first available org is used.\n\t*/\n\torgId: z.string().uuid().optional()\n});\n/**\n* §4a — list every platform-visibility project on the instance. Uses\n* `SYSTEM_CONTEXT` because admin reads cross every org boundary; the route is\n* gated on `instance_admin`.\n*/\nvar GET = apiRoute(\"Failed to list platform projects\", async ({ locals }) => {\n\trequireInstanceAdmin(locals);\n\tif (!flag(\"ENABLE_PLATFORM_PROJECTS\")) apiError(404, ApiErrorCode.NOT_FOUND, \"Not found\");\n\tconst orgs = await getOrganizationProvider().listOrgs(SYSTEM_CONTEXT, { limit: 1e3 });\n\tconst all = [];\n\tfor (const org of orgs.items) {\n\t\tconst page = await getProjectProvider().listProjects(SYSTEM_CONTEXT, org.id, { limit: 1e3 });\n\t\tfor (const p of page.items) if (p.visibility === \"platform\") all.push(p);\n\t}\n\treturn json({ projects: all });\n});\nvar POST = apiRoute(\"Failed to create platform project\", async ({ request, locals }) => {\n\tconst user = requireInstanceAdmin(locals);\n\tif (!flag(\"ENABLE_PLATFORM_PROJECTS\")) apiError(404, ApiErrorCode.NOT_FOUND, \"Not found\");\n\tconst input = await parseBody(request, CreatePlatformProjectBody);\n\tconst hostOrgId = input.orgId ?? locals.ctx.actingOrgId;\n\tif (!hostOrgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"A host orgId is required (no active organization in context).\");\n\tif (!await getOrganizationProvider().getOrg(SYSTEM_CONTEXT, hostOrgId)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Host organization '${hostOrgId}' not found.`);\n\tconst project = await createProjectWithUniqueSlug(getProjectProvider(), {\n\t\tid: randomUUID(),\n\t\torgId: hostOrgId,\n\t\tname: input.name,\n\t\tdescription: input.description,\n\t\tvisibility: \"platform\",\n\t\townerId: user.id,\n\t\tcreatedBy: user.id,\n\t\tupdatedBy: user.id,\n\t\tautoJoinOnUpload: false\n\t}, {\n\t\twriteCtx: SYSTEM_CONTEXT,\n\t\tfallbackSlug: \"platform-project\",\n\t\tconflictScope: \"the host organization\"\n\t});\n\treturn created(project);\n});\n//#endregion\nexport { GET, POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAYA;AACA,IAAI,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;AACzC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;AACpE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AAC5C;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ;AAClC,CAAC,CAAC;AACF;AACA;AACA;AACA;AACA;AACG,IAAC,GAAG,GAAG,QAAQ,CAAC,kCAAkC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AAC7E,CAAC,oBAAoB,CAAC,MAAM,CAAC;AAC7B,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,WAAW,CAAC;AAC1F,CAAC,MAAM,IAAI,GAAG,MAAM,uBAAuB,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACtF,CAAC,MAAM,GAAG,GAAG,EAAE;AACf,CAAC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,EAAE;AAC/B,EAAE,MAAM,IAAI,GAAG,MAAM,kBAAkB,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AAC9F,EAAE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,UAAU,KAAK,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1E,CAAC;AACD,CAAC,OAAO,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;AAC/B,CAAC;AACE,IAAC,IAAI,GAAG,QAAQ,CAAC,mCAAmC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AACxF,CAAC,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAM,CAAC;AAC1C,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,WAAW,CAAC;AAC1F,CAAC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,yBAAyB,CAAC;AAClE,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,WAAW;AACxD,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,+DAA+D,CAAC;AAC/H,CAAC,IAAI,CAAC,MAAM,uBAAuB,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,mBAAmB,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC;AACrK,CAAC,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC,kBAAkB,EAAE,EAAE;AACzE,EAAE,EAAE,EAAE,UAAU,EAAE;AAClB,EAAE,KAAK,EAAE,SAAS;AAClB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI;AAClB,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW;AAChC,EAAE,UAAU,EAAE,UAAU;AACxB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;AAClB,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;AACpB,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;AACpB,EAAE,gBAAgB,EAAE;AACpB,EAAE,EAAE;AACJ,EAAE,QAAQ,EAAE,cAAc;AAC1B,EAAE,YAAY,EAAE,kBAAkB;AAClC,EAAE,aAAa,EAAE;AACjB,EAAE,CAAC;AACH,CAAC,OAAO,OAAO,CAAC,OAAO,CAAC;AACxB,CAAC;;;;"}

package/build/server/chunks/entries/endpoints/api/admin/system/health/_server.ts.js-DIPbPfVe.js

@@ -0,0 +1,364 @@
+import { b as private_env } from '../../../../../../chunks/shared-server.js-BGs15m2r.js';
+import '../../../../../../chunks/src.js-bYgw0r8C.js';
+import { p as providers, r as getComputeServerConfigStore, L as LocalComputeServerStore } from '../../../../../../chunks/providers.server.js-CpbKkjkR.js';
+import { f as findServerById } from '../../../../../../chunks/utils2.js-C9XYOWak.js';
+import { b as requirePermission } from '../../../../../../chunks/access.js-BIDQ4aL-.js';
+import { h } from '../../../../../../chunks/schema.js-6Jx4Hhzv.js';
+import '../../../../../../chunks/api.js-DGA_Gpu6.js';
+import { json } from '@sveltejs/kit';
+import { randomUUID } from 'node:crypto';
+import { resolve, join } from 'node:path';
+import { mkdir, writeFile, unlink } from 'node:fs/promises';
+import 'zod';
+import '../../../../../../chunks/definitions.js-sU8j2oCu.js';
+import '../../../../../../chunks/schema-extraction.js-B-qWNPpJ.js';
+import 'node:url';
+import 'node:fs';
+import '@supabase/supabase-js';
+import '../../../../../../chunks/rate-limit.js-Br3luBbc.js';
+
+//#region ../server/src/ops/deploymentConfig.ts
+/**
+* Parse a `BODY_SIZE_LIMIT` the way adapter-node does, so this agrees with the
+* thing that actually rejects the request.
+*
+* The quirk is load-bearing: adapter-node reads only the LAST character as the
+* suffix, so `60mb` parses as the digits `60m` and happens to mean 60 MB, while
+* `60xy` silently becomes NaN. Returns bytes, or null when the value is one
+* adapter-node can't use.
+*/
+function parseBodySizeLimit(raw) {
+	if (raw == null || raw === "") return null;
+	const value = String(raw).trim();
+	if (value === "") return null;
+	const multiplier = {
+		K: 1024,
+		M: 1048576,
+		G: 1073741824
+	}[value.at(-1).toUpperCase()] ?? 1;
+	const bytes = Number(multiplier !== 1 ? value.slice(0, -1) : value) * multiplier;
+	if (!Number.isFinite(bytes) || bytes <= 0) return null;
+	return bytes;
+}
+/** The app's own default for COMPUTE_REQUEST_MAX_BYTES (compute/limits.ts). */
+var COMPUTE_REQUEST_DEFAULT_BYTES = 268435456;
+var asMb = (bytes) => `${Math.round(bytes / 1048576)} MB`;
+/**
+* BODY_SIZE_LIMIT has to clear the compute request cap, or adapter-node's global
+* backstop rejects the upload first — with a non-JSON body the app never sees
+* and cannot log. Unset is the dangerous case, not a neutral one: adapter-node
+* falls back to 512 KB, so every upload 413s on a deployment that looks fine.
+*/
+function checkBodySizeLimit(env) {
+	const base = {
+		id: "body-size-limit",
+		label: "Upload size limit"
+	};
+	const raw = env.BODY_SIZE_LIMIT;
+	const requestCap = Number(env.COMPUTE_REQUEST_MAX_BYTES) || COMPUTE_REQUEST_DEFAULT_BYTES;
+	if (raw == null || raw === "") return {
+		...base,
+		verdict: "fail",
+		summary: "BODY_SIZE_LIMIT is unset — adapter-node falls back to 512 KB, so uploads over that fail with an opaque 413 no app log records.",
+		remediation: `Set BODY_SIZE_LIMIT to at least ${asMb(requestCap)} (the compute request cap) and restart.`
+	};
+	const bytes = parseBodySizeLimit(raw);
+	if (bytes === null) return {
+		...base,
+		verdict: "fail",
+		summary: `BODY_SIZE_LIMIT="${raw}" — adapter-node cannot parse this and throws on boot.`,
+		remediation: "Use a byte count or a single K/M/G suffix, e.g. \"256M\"."
+	};
+	if (bytes < requestCap) return {
+		...base,
+		verdict: "warn",
+		summary: `BODY_SIZE_LIMIT=${raw} (${asMb(bytes)}) is below COMPUTE_REQUEST_MAX_BYTES (${asMb(requestCap)}) — the global cap rejects first, making the compute cap dead config.`,
+		remediation: `Raise BODY_SIZE_LIMIT to at least ${asMb(requestCap)} and restart.`
+	};
+	return {
+		...base,
+		verdict: "ok",
+		summary: `BODY_SIZE_LIMIT=${raw} clears the compute request cap.`
+	};
+}
+/**
+* `ADDRESS_HEADER` / `XFF_DEPTH` are read by adapter-node, not by Selva, and
+* unset they are invisible: nothing fails, nothing logs, and the deployment
+* looks healthy.
+*
+* What actually happens is that `getClientAddress()` returns the socket peer,
+* which behind a reverse proxy is the proxy — `127.0.0.1` for every request
+* from every user. Login rate limiting keys on that, so the whole instance
+* shares one bucket: five failed logins from anywhere return 429 to everyone,
+* and only a *successful* login clears a bucket, which nobody can then reach.
+*
+* `ORIGIN` is the proxy tell. It is only needed when the app is served under a
+* public URL it can't derive from its own socket, so its presence means a proxy
+* is terminating requests. Without it we say nothing: on a directly-reachable
+* app these settings are a footgun, since `X-Forwarded-For` is client-supplied
+* and anyone could then pick their own rate-limit bucket.
+*/
+function checkClientAddress(env) {
+	const base = {
+		id: "client-address",
+		label: "Client IP behind proxy"
+	};
+	const header = env.ADDRESS_HEADER;
+	const depth = env.XFF_DEPTH;
+	if (!env.ORIGIN) return {
+		...base,
+		verdict: "ok",
+		summary: "ADDRESS_HEADER is not needed — ORIGIN is unset, so no reverse proxy is in play."
+	};
+	if (!header) return {
+		...base,
+		verdict: "fail",
+		summary: "ADDRESS_HEADER is unset while ORIGIN is set — every request looks like it came from the proxy, so all users share ONE login rate-limit bucket. Five failed logins from anyone locks out the whole instance for 15 minutes.",
+		remediation: "Set ADDRESS_HEADER=X-Forwarded-For and XFF_DEPTH=<number of proxies>, then restart. To count your proxies, see docs/self-hosting/deployment/reverse-proxy.md."
+	};
+	if (header.toLowerCase() === "x-forwarded-for" && !depth) return {
+		...base,
+		verdict: "warn",
+		summary: `ADDRESS_HEADER=${header} but XFF_DEPTH is unset. X-Forwarded-For is a client-appendable list, so a caller can prepend fake entries — adapter-node needs the proxy count to know which entry is real.`,
+		remediation: "Set XFF_DEPTH=1 for a single reverse proxy, 2 if a CDN or load balancer sits in front of it. Unsure? docs/self-hosting/deployment/reverse-proxy.md shows how to read the header the app actually receives."
+	};
+	if (depth !== void 0 && !/^[1-9][0-9]*$/.test(depth)) return {
+		...base,
+		verdict: "fail",
+		summary: `XFF_DEPTH="${depth}" is not a positive integer.`,
+		remediation: "It counts proxies from the outside in — use 1 for a single reverse proxy."
+	};
+	return {
+		...base,
+		verdict: "ok",
+		summary: `ADDRESS_HEADER=${header}${depth ? ` (XFF_DEPTH=${depth})` : ""}.`
+	};
+}
+/** Every deployment-config rule, in report order. */
+function checkDeploymentConfig(env) {
+	return [checkClientAddress(env), checkBodySizeLimit(env)];
+}
+//#endregion
+//#region src/routes/api/admin/system/health/+server.ts
+function atRestSecretsCheck(report) {
+	const base = {
+		id: "at-rest-secrets",
+		label: "Compute server secrets"
+	};
+	if (report === null) return {
+		...base,
+		status: "not_applicable",
+		summary: "The active data provider does not encrypt secrets at this layer — nothing to verify."
+	};
+	if (report.ok) return {
+		...base,
+		status: "ok",
+		summary: "All stored compute server API keys decrypt under the current SELVA_AT_REST_KEY."
+	};
+	const failed = report.failures.map((f) => `"${f.serverLabel}" (${f.reason}${f.cause ? `: ${f.cause}` : ""})`).join(", ");
+	const plaintext = report.plaintextFound;
+	return {
+		...base,
+		status: "degraded",
+		summary: `${report.failures.length} compute server key(s) could not be loaded: ${failed}.`,
+		remediation: plaintext ? "A key is stored in plaintext on disk — re-enter it via /admin/compute so it is encrypted." : "The stored ciphertext does not match the current SELVA_AT_REST_KEY (rotated key or restored backup). Re-enter the affected keys via /admin/compute, or restore the original SELVA_AT_REST_KEY, then run this check again."
+	};
+}
+function schemaVersionCheck(report) {
+	const base = {
+		id: "schema-version",
+		label: "Database schema"
+	};
+	if (report === null) return {
+		...base,
+		status: "not_applicable",
+		summary: "The active data provider migrates with the app — there is no separate schema to verify."
+	};
+	if (report.ok) return {
+		...base,
+		status: "ok",
+		summary: `Database migration head ${report.actual} satisfies the app's expected ${report.expected}.`
+	};
+	return {
+		...base,
+		status: "degraded",
+		summary: report.message ?? `Database migration head ${report.actual ?? "unavailable"} is behind the app's expected ${report.expected}.`,
+		remediation: "Sync the provider migrations into your Supabase project and run `npx supabase db push`, then restart the app. `selva doctor` runs the same check from the CLI."
+	};
+}
+/** API tokens on a provider with row security need a signing key Supabase trusts. */
+async function delegatedSessionCheck() {
+	const base = {
+		id: "api-token-sessions",
+		label: "API token sessions"
+	};
+	const delegated = providers.auth.delegatedSession;
+	if (!delegated) return {
+		...base,
+		status: "not_applicable",
+		summary: "The active auth provider needs no signed sessions for API tokens."
+	};
+	const status = await delegated.status();
+	if (status.ok) return {
+		...base,
+		status: "ok",
+		summary: "API tokens can act as their owners."
+	};
+	return {
+		...base,
+		status: "degraded",
+		summary: `API tokens are off: ${status.message}`,
+		remediation: "Set SUPABASE_JWT_SIGNING_KEY to the private ES256 JWK your Supabase project signs with (see the Supabase provider docs), then restart. Browser sign-in is unaffected."
+	};
+}
+var COMPUTE_PING_TIMEOUT_MS = 8e3;
+/**
+* Ping the global default compute server's liveness root (`GET /` — the
+* rhino.compute proxy has no `/healthcheck` route). We probe the default
+* specifically because that's the server every solve falls back to;
+* a degraded default breaks the baseline for all orgs. Org-private and
+* non-default platform servers are out of scope here — they have their own
+* per-server status probe at /api/admin/compute/status.
+*/
+async function computeReachabilityCheck(locals) {
+	const base = {
+		id: "compute-reachable",
+		label: "Default compute server"
+	};
+	let config;
+	try {
+		config = await getComputeServerConfigStore().getConfig(locals.ctx);
+	} catch (err) {
+		return {
+			...base,
+			status: "error",
+			summary: `Could not read compute config: ${err instanceof Error ? err.message : String(err)}`
+		};
+	}
+	const server = config.defaultServerId ? findServerById(config, config.defaultServerId) : void 0;
+	if (!server) return {
+		...base,
+		status: "not_applicable",
+		summary: "No default compute server is configured — nothing to reach.",
+		remediation: "Add a server and set it as default in /admin/compute."
+	};
+	const apiKey = server.hasApiKey ? await getComputeServerConfigStore().getServerApiKey(locals.ctx, server.id) : void 0;
+	const stats = new h(server.serverUrl, apiKey ?? void 0);
+	try {
+		if (await stats.isServerOnline(COMPUTE_PING_TIMEOUT_MS)) return {
+			...base,
+			status: "ok",
+			summary: `"${server.label}" is reachable.`
+		};
+		return {
+			...base,
+			status: "degraded",
+			summary: `"${server.label}" did not respond within ${COMPUTE_PING_TIMEOUT_MS / 1e3}s or answered with an error.`,
+			remediation: `Confirm the Rhino.Compute host is running, ${server.serverUrl} is correct, and the API key in /admin/compute is valid.`
+		};
+	} finally {
+		await stats.dispose();
+	}
+}
+/**
+* Write + delete a temp file under DATA_PATH to prove the local provider can
+* still persist. The JSON stores read-modify-write without a fallback, so a
+* full disk or a permission change (e.g. ownership drift after a restore)
+* corrupts data on the next write — catch it here while it's still just a
+* failed health check.
+*/
+async function dataPathWritableCheck() {
+	const base = {
+		id: "data-path-writable",
+		label: "Data path writable"
+	};
+	if (!(providers.data.computeServer instanceof LocalComputeServerStore)) return {
+		...base,
+		status: "not_applicable",
+		summary: "The active data provider does not persist to a local DATA_PATH."
+	};
+	const dataPath = private_env.DATA_PATH;
+	if (!dataPath) return {
+		...base,
+		status: "error",
+		summary: "DATA_PATH is unset but the local provider is active.",
+		remediation: "Set DATA_PATH in .env and restart."
+	};
+	const absolute = resolve(dataPath);
+	const probe = join(absolute, `.health-probe-${randomUUID()}`);
+	try {
+		await mkdir(absolute, { recursive: true });
+		await writeFile(probe, "ok");
+		await unlink(probe);
+		return {
+			...base,
+			status: "ok",
+			summary: `DATA_PATH (${dataPath}) is writable.`
+		};
+	} catch (err) {
+		return {
+			...base,
+			status: "degraded",
+			summary: `DATA_PATH (${dataPath}) is not writable: ${err instanceof Error ? err.message : String(err)}.`,
+			remediation: "Check free disk space and that the directory is owned by the user running the app (`df -h`, `ls -la`)."
+		};
+	}
+}
+/**
+* Deployment-config rules run against the live process env, which is what
+* adapter-node itself read at boot — not a re-parse of `.env`, so a var
+* overridden by the service manager is judged as it actually applies.
+*
+* A `fail` maps to `error` rather than `degraded`: these are the same verdicts
+* that exit `selva doctor` non-zero, and the panel should not soften them.
+*/
+function deploymentConfigChecks() {
+	return checkDeploymentConfig(private_env).map((finding) => ({
+		id: finding.id,
+		label: finding.label,
+		status: finding.verdict === "fail" ? "error" : finding.verdict === "warn" ? "degraded" : "ok",
+		summary: finding.summary,
+		remediation: finding.remediation
+	}));
+}
+var GET = async ({ locals }) => {
+	requirePermission(locals, "instance_admin");
+	const checks = [];
+	const store = providers.data.computeServer;
+	if (typeof store.verifySecrets === "function") try {
+		checks.push(atRestSecretsCheck(await store.verifySecrets()));
+	} catch (err) {
+		checks.push({
+			id: "at-rest-secrets",
+			label: "Compute server secrets",
+			status: "error",
+			summary: `Verification threw: ${err instanceof Error ? err.message : String(err)}`,
+			remediation: "Check server logs (`pm2 logs selva-compute`) for the underlying error."
+		});
+	}
+	else checks.push(atRestSecretsCheck(null));
+	const data = providers.data;
+	if (typeof data.verifySchemaVersion === "function") checks.push(schemaVersionCheck(await data.verifySchemaVersion()));
+	else checks.push(schemaVersionCheck(null));
+	checks.push(...await Promise.all([
+		computeReachabilityCheck(locals),
+		dataPathWritableCheck(),
+		delegatedSessionCheck()
+	]));
+	checks.push(...deploymentConfigChecks());
+	const rank = {
+		ok: 0,
+		not_applicable: 0,
+		degraded: 2,
+		error: 3
+	};
+	const overall = checks.reduce((worst, c) => rank[c.status] > rank[worst] ? c.status : worst, "ok");
+	return json({
+		overall,
+		checkedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		checks
+	});
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts.js-DIPbPfVe.js.map