@selvajs/selva 4.3.4 → 4.4.0

package/build/server/chunks/_server.ts-C4BxZ2rC.js

@@ -0,0 +1,162 @@
+import { json } from '@sveltejs/kit';
+import { randomUUID } from 'node:crypto';
+import { mkdir, writeFile, unlink } from 'node:fs/promises';
+import { resolve, join } from 'node:path';
+import { p as private_env } from './shared-server-C3WdcJCQ.js';
+import './context-BJnJL8ES.js';
+import { f as findServerById } from './utils2-UQQTHTw-.js';
+import { t as providers, L as LocalComputeServerStore, c as getComputeServerConfigStore } from './providers.server-BYk2ehLM.js';
+import { z as requirePermission } from './access.server-BueyYEoY.js';
+import 'zod';
+import 'node:url';
+import 'node:fs';
+import '@supabase/supabase-js';
+import './api-errors-BckwXK7Q.js';
+import '@selvajs/compute/core';
+
+function atRestSecretsCheck(report) {
+  const base = { id: "at-rest-secrets", label: "Compute server secrets" };
+  if (report === null) {
+    return {
+      ...base,
+      status: "not_applicable",
+      summary: "The active data provider does not encrypt secrets at this layer — nothing to verify."
+    };
+  }
+  if (report.ok) {
+    return {
+      ...base,
+      status: "ok",
+      summary: "All stored compute server API keys decrypt under the current SELVA_AT_REST_KEY."
+    };
+  }
+  const failed = report.failures.map((f) => `"${f.serverLabel}" (${f.reason}${f.cause ? `: ${f.cause}` : ""})`).join(", ");
+  const plaintext = report.plaintextFound;
+  return {
+    ...base,
+    status: "degraded",
+    summary: `${report.failures.length} compute server key(s) could not be loaded: ${failed}.`,
+    remediation: plaintext ? "A key is stored in plaintext on disk — re-enter it via /admin/compute so it is encrypted." : "The stored ciphertext does not match the current SELVA_AT_REST_KEY (rotated key or restored backup). Re-enter the affected keys via /admin/compute, or restore the original SELVA_AT_REST_KEY, then run this check again."
+  };
+}
+const COMPUTE_PING_TIMEOUT_MS = 8e3;
+async function computeReachabilityCheck(locals) {
+  const base = { id: "compute-reachable", label: "Default compute server" };
+  let config;
+  try {
+    config = await getComputeServerConfigStore().getConfig(locals.ctx);
+  } catch (err) {
+    return {
+      ...base,
+      status: "error",
+      summary: `Could not read compute config: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  const server = config.defaultServerId ? findServerById(config, config.defaultServerId) : void 0;
+  if (!server) {
+    return {
+      ...base,
+      status: "not_applicable",
+      summary: "No default compute server is configured — nothing to reach.",
+      remediation: "Add a server and set it as default in /admin/compute."
+    };
+  }
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), COMPUTE_PING_TIMEOUT_MS);
+  try {
+    const headers = {};
+    if (server.apiKey) headers["RhinoComputeKey"] = server.apiKey;
+    const res = await fetch(new URL("/healthcheck", server.serverUrl).toString(), {
+      signal: controller.signal,
+      headers
+    });
+    if (res.ok) {
+      return { ...base, status: "ok", summary: `"${server.label}" answered /healthcheck (200).` };
+    }
+    return {
+      ...base,
+      status: "degraded",
+      summary: `"${server.label}" responded ${res.status} to /healthcheck.`,
+      remediation: res.status === 401 || res.status === 403 ? "Authentication rejected — verify the API key in /admin/compute." : "The server is reachable but unhealthy. Check the Rhino.Compute host."
+    };
+  } catch (err) {
+    const aborted = err instanceof Error && err.name === "AbortError";
+    return {
+      ...base,
+      status: "degraded",
+      summary: aborted ? `"${server.label}" did not respond within ${COMPUTE_PING_TIMEOUT_MS / 1e3}s.` : `"${server.label}" is unreachable: ${err instanceof Error ? err.message : String(err)}.`,
+      remediation: `Confirm the Rhino.Compute host is running and ${server.serverUrl} is correct.`
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function dataPathWritableCheck() {
+  const base = { id: "data-path-writable", label: "Data path writable" };
+  if (!(providers.data.computeServer instanceof LocalComputeServerStore)) {
+    return {
+      ...base,
+      status: "not_applicable",
+      summary: "The active data provider does not persist to a local DATA_PATH."
+    };
+  }
+  const dataPath = private_env.DATA_PATH;
+  if (!dataPath) {
+    return {
+      ...base,
+      status: "error",
+      summary: "DATA_PATH is unset but the local provider is active.",
+      remediation: "Set DATA_PATH in .env and restart."
+    };
+  }
+  const absolute = resolve(dataPath);
+  const probe = join(absolute, `.health-probe-${randomUUID()}`);
+  try {
+    await mkdir(absolute, { recursive: true });
+    await writeFile(probe, "ok");
+    await unlink(probe);
+    return { ...base, status: "ok", summary: `DATA_PATH (${dataPath}) is writable.` };
+  } catch (err) {
+    return {
+      ...base,
+      status: "degraded",
+      summary: `DATA_PATH (${dataPath}) is not writable: ${err instanceof Error ? err.message : String(err)}.`,
+      remediation: "Check free disk space and that the directory is owned by the user running the app (`df -h`, `ls -la`)."
+    };
+  }
+}
+const GET = async ({ locals }) => {
+  requirePermission(locals, "instance_admin");
+  const checks = [];
+  const store = providers.data.computeServer;
+  if (store instanceof LocalComputeServerStore) {
+    try {
+      checks.push(atRestSecretsCheck(await store.verifySecrets()));
+    } catch (err) {
+      checks.push({
+        id: "at-rest-secrets",
+        label: "Compute server secrets",
+        status: "error",
+        summary: `Verification threw: ${err instanceof Error ? err.message : String(err)}`,
+        remediation: "Check server logs (`pm2 logs selva-compute`) for the underlying error."
+      });
+    }
+  } else {
+    checks.push(atRestSecretsCheck(null));
+  }
+  checks.push(...await Promise.all([computeReachabilityCheck(locals), dataPathWritableCheck()]));
+  const rank = {
+    ok: 0,
+    not_applicable: 0,
+    degraded: 2,
+    error: 3
+  };
+  const overall = checks.reduce(
+    (worst, c) => rank[c.status] > rank[worst] ? c.status : worst,
+    "ok"
+  );
+  return json({ overall, checkedAt: (/* @__PURE__ */ new Date()).toISOString(), checks });
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts-C4BxZ2rC.js.map

package/build/server/chunks/_server.ts-C4BxZ2rC.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-C4BxZ2rC.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/admin/api/system/health/_server.ts.js"],"sourcesContent":["import { json } from \"@sveltejs/kit\";\nimport { randomUUID } from \"node:crypto\";\nimport { mkdir, writeFile, unlink } from \"node:fs/promises\";\nimport { resolve, join } from \"node:path\";\nimport { p as private_env } from \"../../../../../../chunks/shared-server.js\";\nimport \"../../../../../../chunks/context.js\";\nimport { f as findServerById } from \"../../../../../../chunks/utils2.js\";\nimport { t as providers, L as LocalComputeServerStore, c as getComputeServerConfigStore } from \"../../../../../../chunks/providers.server.js\";\nimport { z as requirePermission } from \"../../../../../../chunks/access.server.js\";\nfunction atRestSecretsCheck(report) {\n  const base = { id: \"at-rest-secrets\", label: \"Compute server secrets\" };\n  if (report === null) {\n    return {\n      ...base,\n      status: \"not_applicable\",\n      summary: \"The active data provider does not encrypt secrets at this layer — nothing to verify.\"\n    };\n  }\n  if (report.ok) {\n    return {\n      ...base,\n      status: \"ok\",\n      summary: \"All stored compute server API keys decrypt under the current SELVA_AT_REST_KEY.\"\n    };\n  }\n  const failed = report.failures.map((f) => `\"${f.serverLabel}\" (${f.reason}${f.cause ? `: ${f.cause}` : \"\"})`).join(\", \");\n  const plaintext = report.plaintextFound;\n  return {\n    ...base,\n    status: \"degraded\",\n    summary: `${report.failures.length} compute server key(s) could not be loaded: ${failed}.`,\n    remediation: plaintext ? \"A key is stored in plaintext on disk — re-enter it via /admin/compute so it is encrypted.\" : \"The stored ciphertext does not match the current SELVA_AT_REST_KEY (rotated key or restored backup). Re-enter the affected keys via /admin/compute, or restore the original SELVA_AT_REST_KEY, then run this check again.\"\n  };\n}\nconst COMPUTE_PING_TIMEOUT_MS = 8e3;\nasync function computeReachabilityCheck(locals) {\n  const base = { id: \"compute-reachable\", label: \"Default compute server\" };\n  let config;\n  try {\n    config = await getComputeServerConfigStore().getConfig(locals.ctx);\n  } catch (err) {\n    return {\n      ...base,\n      status: \"error\",\n      summary: `Could not read compute config: ${err instanceof Error ? err.message : String(err)}`\n    };\n  }\n  const server = config.defaultServerId ? findServerById(config, config.defaultServerId) : void 0;\n  if (!server) {\n    return {\n      ...base,\n      status: \"not_applicable\",\n      summary: \"No default compute server is configured — nothing to reach.\",\n      remediation: \"Add a server and set it as default in /admin/compute.\"\n    };\n  }\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(), COMPUTE_PING_TIMEOUT_MS);\n  try {\n    const headers = {};\n    if (server.apiKey) headers[\"RhinoComputeKey\"] = server.apiKey;\n    const res = await fetch(new URL(\"/healthcheck\", server.serverUrl).toString(), {\n      signal: controller.signal,\n      headers\n    });\n    if (res.ok) {\n      return { ...base, status: \"ok\", summary: `\"${server.label}\" answered /healthcheck (200).` };\n    }\n    return {\n      ...base,\n      status: \"degraded\",\n      summary: `\"${server.label}\" responded ${res.status} to /healthcheck.`,\n      remediation: res.status === 401 || res.status === 403 ? \"Authentication rejected — verify the API key in /admin/compute.\" : \"The server is reachable but unhealthy. Check the Rhino.Compute host.\"\n    };\n  } catch (err) {\n    const aborted = err instanceof Error && err.name === \"AbortError\";\n    return {\n      ...base,\n      status: \"degraded\",\n      summary: aborted ? `\"${server.label}\" did not respond within ${COMPUTE_PING_TIMEOUT_MS / 1e3}s.` : `\"${server.label}\" is unreachable: ${err instanceof Error ? err.message : String(err)}.`,\n      remediation: `Confirm the Rhino.Compute host is running and ${server.serverUrl} is correct.`\n    };\n  } finally {\n    clearTimeout(timer);\n  }\n}\nasync function dataPathWritableCheck() {\n  const base = { id: \"data-path-writable\", label: \"Data path writable\" };\n  if (!(providers.data.computeServer instanceof LocalComputeServerStore)) {\n    return {\n      ...base,\n      status: \"not_applicable\",\n      summary: \"The active data provider does not persist to a local DATA_PATH.\"\n    };\n  }\n  const dataPath = private_env.DATA_PATH;\n  if (!dataPath) {\n    return {\n      ...base,\n      status: \"error\",\n      summary: \"DATA_PATH is unset but the local provider is active.\",\n      remediation: \"Set DATA_PATH in .env and restart.\"\n    };\n  }\n  const absolute = resolve(dataPath);\n  const probe = join(absolute, `.health-probe-${randomUUID()}`);\n  try {\n    await mkdir(absolute, { recursive: true });\n    await writeFile(probe, \"ok\");\n    await unlink(probe);\n    return { ...base, status: \"ok\", summary: `DATA_PATH (${dataPath}) is writable.` };\n  } catch (err) {\n    return {\n      ...base,\n      status: \"degraded\",\n      summary: `DATA_PATH (${dataPath}) is not writable: ${err instanceof Error ? err.message : String(err)}.`,\n      remediation: \"Check free disk space and that the directory is owned by the user running the app (`df -h`, `ls -la`).\"\n    };\n  }\n}\nconst GET = async ({ locals }) => {\n  requirePermission(locals, \"instance_admin\");\n  const checks = [];\n  const store = providers.data.computeServer;\n  if (store instanceof LocalComputeServerStore) {\n    try {\n      checks.push(atRestSecretsCheck(await store.verifySecrets()));\n    } catch (err) {\n      checks.push({\n        id: \"at-rest-secrets\",\n        label: \"Compute server secrets\",\n        status: \"error\",\n        summary: `Verification threw: ${err instanceof Error ? err.message : String(err)}`,\n        remediation: \"Check server logs (`pm2 logs selva-compute`) for the underlying error.\"\n      });\n    }\n  } else {\n    checks.push(atRestSecretsCheck(null));\n  }\n  checks.push(...await Promise.all([computeReachabilityCheck(locals), dataPathWritableCheck()]));\n  const rank = {\n    ok: 0,\n    not_applicable: 0,\n    degraded: 2,\n    error: 3\n  };\n  const overall = checks.reduce(\n    (worst, c) => rank[c.status] > rank[worst] ? c.status : worst,\n    \"ok\"\n  );\n  return json({ overall, checkedAt: (/* @__PURE__ */ new Date()).toISOString(), checks });\n};\nexport {\n  GET\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;AASA,SAAS,kBAAkB,CAAC,MAAM,EAAE;AACpC,EAAE,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,wBAAwB,EAAE;AACzE,EAAE,IAAI,MAAM,KAAK,IAAI,EAAE;AACvB,IAAI,OAAO;AACX,MAAM,GAAG,IAAI;AACb,MAAM,MAAM,EAAE,gBAAgB;AAC9B,MAAM,OAAO,EAAE;AACf,KAAK;AACL,EAAE;AACF,EAAE,IAAI,MAAM,CAAC,EAAE,EAAE;AACjB,IAAI,OAAO;AACX,MAAM,GAAG,IAAI;AACb,MAAM,MAAM,EAAE,IAAI;AAClB,MAAM,OAAO,EAAE;AACf,KAAK;AACL,EAAE;AACF,EAAE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;AAC1H,EAAE,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc;AACzC,EAAE,OAAO;AACT,IAAI,GAAG,IAAI;AACX,IAAI,MAAM,EAAE,UAAU;AACtB,IAAI,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,4CAA4C,EAAE,MAAM,CAAC,CAAC,CAAC;AAC9F,IAAI,WAAW,EAAE,SAAS,GAAG,2FAA2F,GAAG;AAC3H,GAAG;AACH;AACA,MAAM,uBAAuB,GAAG,GAAG;AACnC,eAAe,wBAAwB,CAAC,MAAM,EAAE;AAChD,EAAE,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,wBAAwB,EAAE;AAC3E,EAAE,IAAI,MAAM;AACZ,EAAE,IAAI;AACN,IAAI,MAAM,GAAG,MAAM,2BAA2B,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC;AACtE,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,OAAO;AACX,MAAM,GAAG,IAAI;AACb,MAAM,MAAM,EAAE,OAAO;AACrB,MAAM,OAAO,EAAE,CAAC,+BAA+B,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;AAClG,KAAK;AACL,EAAE;AACF,EAAE,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,eAAe,CAAC,GAAG,MAAM;AACjG,EAAE,IAAI,CAAC,MAAM,EAAE;AACf,IAAI,OAAO;AACX,MAAM,GAAG,IAAI;AACb,MAAM,MAAM,EAAE,gBAAgB;AAC9B,MAAM,OAAO,EAAE,6DAA6D;AAC5E,MAAM,WAAW,EAAE;AACnB,KAAK;AACL,EAAE;AACF,EAAE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE;AAC1C,EAAE,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,UAAU,CAAC,KAAK,EAAE,EAAE,uBAAuB,CAAC;AAC7E,EAAE,IAAI;AACN,IAAI,MAAM,OAAO,GAAG,EAAE;AACtB,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,MAAM,CAAC,MAAM;AACjE,IAAI,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,EAAE;AAClF,MAAM,MAAM,EAAE,UAAU,CAAC,MAAM;AAC/B,MAAM;AACN,KAAK,CAAC;AACN,IAAI,IAAI,GAAG,CAAC,EAAE,EAAE;AAChB,MAAM,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,8BAA8B,CAAC,EAAE;AACjG,IAAI;AACJ,IAAI,OAAO;AACX,MAAM,GAAG,IAAI;AACb,MAAM,MAAM,EAAE,UAAU;AACxB,MAAM,OAAO,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC;AAC3E,MAAM,WAAW,EAAE,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,GAAG,iEAAiE,GAAG;AAClI,KAAK;AACL,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY;AACrE,IAAI,OAAO;AACX,MAAM,GAAG,IAAI;AACb,MAAM,MAAM,EAAE,UAAU;AACxB,MAAM,OAAO,EAAE,OAAO,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,uBAAuB,GAAG,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACjM,MAAM,WAAW,EAAE,CAAC,8CAA8C,EAAE,MAAM,CAAC,SAAS,CAAC,YAAY;AACjG,KAAK;AACL,EAAE,CAAC,SAAS;AACZ,IAAI,YAAY,CAAC,KAAK,CAAC;AACvB,EAAE;AACF;AACA,eAAe,qBAAqB,GAAG;AACvC,EAAE,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,oBAAoB,EAAE;AACxE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,aAAa,YAAY,uBAAuB,CAAC,EAAE;AAC1E,IAAI,OAAO;AACX,MAAM,GAAG,IAAI;AACb,MAAM,MAAM,EAAE,gBAAgB;AAC9B,MAAM,OAAO,EAAE;AACf,KAAK;AACL,EAAE;AACF,EAAE,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS;AACxC,EAAE,IAAI,CAAC,QAAQ,EAAE;AACjB,IAAI,OAAO;AACX,MAAM,GAAG,IAAI;AACb,MAAM,MAAM,EAAE,OAAO;AACrB,MAAM,OAAO,EAAE,sDAAsD;AACrE,MAAM,WAAW,EAAE;AACnB,KAAK;AACL,EAAE;AACF,EAAE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;AACpC,EAAE,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;AAC/D,EAAE,IAAI;AACN,IAAI,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC9C,IAAI,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC;AAChC,IAAI,MAAM,MAAM,CAAC,KAAK,CAAC;AACvB,IAAI,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC,cAAc,CAAC,EAAE;AACrF,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,OAAO;AACX,MAAM,GAAG,IAAI;AACb,MAAM,MAAM,EAAE,UAAU;AACxB,MAAM,OAAO,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC,mBAAmB,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC9G,MAAM,WAAW,EAAE;AACnB,KAAK;AACL,EAAE;AACF;AACK,MAAC,GAAG,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK;AAClC,EAAE,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,CAAC;AAC7C,EAAE,MAAM,MAAM,GAAG,EAAE;AACnB,EAAE,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa;AAC5C,EAAE,IAAI,KAAK,YAAY,uBAAuB,EAAE;AAChD,IAAI,IAAI;AACR,MAAM,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;AAClE,IAAI,CAAC,CAAC,OAAO,GAAG,EAAE;AAClB,MAAM,MAAM,CAAC,IAAI,CAAC;AAClB,QAAQ,EAAE,EAAE,iBAAiB;AAC7B,QAAQ,KAAK,EAAE,wBAAwB;AACvC,QAAQ,MAAM,EAAE,OAAO;AACvB,QAAQ,OAAO,EAAE,CAAC,oBAAoB,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1F,QAAQ,WAAW,EAAE;AACrB,OAAO,CAAC;AACR,IAAI;AACJ,EAAE,CAAC,MAAM;AACT,IAAI,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;AACzC,EAAE;AACF,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC;AAChG,EAAE,MAAM,IAAI,GAAG;AACf,IAAI,EAAE,EAAE,CAAC;AACT,IAAI,cAAc,EAAE,CAAC;AACrB,IAAI,QAAQ,EAAE,CAAC;AACf,IAAI,KAAK,EAAE;AACX,GAAG;AACH,EAAE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM;AAC/B,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,KAAK;AACjE,IAAI;AACJ,GAAG;AACH,EAAE,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC;AACzF;;;;"}

package/build/server/chunks/_server.ts-C4lve0n9.js

@@ -0,0 +1,108 @@
+import { error, json } from '@sveltejs/kit';
+import { z } from 'zod';
+import { a as getAuthProvider, k as getOrganizationProvider, l as getPermissionStore } from './providers.server-BYk2ehLM.js';
+import { w as requireManageInstanceUsers } from './access.server-BueyYEoY.js';
+import { s as setUserPlatformPermissions } from './permissions.server-D1KUdeD1.js';
+import { t as throwZodError, h as handleApiError } from './api-errors-BckwXK7Q.js';
+import { S as SYSTEM_CONTEXT, j as hasPermission, M as MEMBER_ASSIGNABLE_PERMISSIONS, P as PlatformPermissionSchema, d as OrgPermissionSchema } from './context-BJnJL8ES.js';
+import { f as flattenPermissions, s as splitFlatPermissions } from './permissions-compat.server-G174xsh6.js';
+import './shared-server-C3WdcJCQ.js';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:crypto';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '@selvajs/compute/core';
+import './utils2-UQQTHTw-.js';
+
+const FlatPermissionSchema = z.union([PlatformPermissionSchema, OrgPermissionSchema]);
+const BaseUserBody = z.object({
+  email: z.string().email("Valid email is required"),
+  permissions: z.array(FlatPermissionSchema)
+});
+const PasswordUserBody = BaseUserBody.extend({
+  password: z.string().min(8, "Password must be at least 8 characters").optional()
+});
+const GET = async ({ locals }) => {
+  requireManageInstanceUsers(locals);
+  const page = await getAuthProvider().listUsers({ limit: 200 });
+  if (page === null) {
+    throw error(
+      501,
+      "User management is not supported by the current auth provider. Configure DATA_PATH (local provider) or check your provider wiring."
+    );
+  }
+  const orgId = locals.ctx?.actingOrgId;
+  const orgs = getOrganizationProvider();
+  const userIds = page.items.map((u) => u.id);
+  const platformByUser = await getPermissionStore().getForBatch(locals.ctx, userIds);
+  const flattened = await Promise.all(
+    page.items.map(async (u) => {
+      let orgPerms = [];
+      if (orgId) {
+        const member = await orgs.getOrgMember(SYSTEM_CONTEXT, orgId, u.id);
+        orgPerms = member?.permissions ?? [];
+      }
+      const platformPerms = platformByUser.get(u.id) ?? [];
+      return {
+        ...u,
+        platformPermissions: platformPerms,
+        permissions: flattenPermissions(
+          platformPerms,
+          orgPerms
+        )
+      };
+    })
+  );
+  return json(flattened);
+};
+const POST = async ({ request, locals }) => {
+  requireManageInstanceUsers(locals);
+  const auth = getAuthProvider();
+  const body = await request.json().catch(() => null);
+  const parsed = PasswordUserBody.safeParse(body);
+  if (!parsed.success) throwZodError(parsed.error);
+  const { email, password, permissions } = parsed.data;
+  const { platform, org } = splitFlatPermissions(permissions);
+  if (platform.length > 0 && !hasPermission(locals.ctx, "instance_admin")) {
+    throw error(403, "Only a platform admin can grant platform-scope permissions");
+  }
+  try {
+    let user;
+    if (auth.passwordAuth) {
+      if (!password) throw error(400, "Password is required");
+      user = await auth.passwordAuth.createUserWithPassword(email, password);
+    } else if (auth.createUser) {
+      user = await auth.createUser(email);
+    } else {
+      throw error(
+        501,
+        `User creation is not supported by ${auth.name}. Users are managed externally.`
+      );
+    }
+    if (platform.length > 0) {
+      await setUserPlatformPermissions(locals.ctx, user.id, platform);
+    }
+    const orgId = locals.ctx?.actingOrgId;
+    if (orgId) {
+      const joinedAt = (/* @__PURE__ */ new Date()).toISOString();
+      await getOrganizationProvider().addOrgMember(SYSTEM_CONTEXT, {
+        orgId,
+        userId: user.id,
+        role: "member",
+        permissions: org.filter((p) => MEMBER_ASSIGNABLE_PERMISSIONS.includes(p)),
+        joinedAt,
+        updatedAt: joinedAt,
+        updatedBy: locals.user?.id ?? user.id,
+        deletedAt: null
+      });
+    }
+    return json(user, { status: 201 });
+  } catch (err) {
+    handleApiError(err, "Failed to create user");
+  }
+};
+
+export { GET, POST };
+//# sourceMappingURL=_server.ts-C4lve0n9.js.map

package/build/server/chunks/_server.ts-C4lve0n9.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-C4lve0n9.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/admin/api/users/_server.ts.js"],"sourcesContent":["import { error, json } from \"@sveltejs/kit\";\nimport { z } from \"zod\";\nimport { a as getAuthProvider, k as getOrganizationProvider, l as getPermissionStore } from \"../../../../../chunks/providers.server.js\";\nimport { w as requireManageInstanceUsers } from \"../../../../../chunks/access.server.js\";\nimport { s as setUserPlatformPermissions } from \"../../../../../chunks/permissions.server.js\";\nimport { t as throwZodError, h as handleApiError } from \"../../../../../chunks/api-errors.js\";\nimport { P as PlatformPermissionSchema, d as OrgPermissionSchema, S as SYSTEM_CONTEXT, j as hasPermission, M as MEMBER_ASSIGNABLE_PERMISSIONS } from \"../../../../../chunks/context.js\";\nimport { f as flattenPermissions, s as splitFlatPermissions } from \"../../../../../chunks/permissions-compat.server.js\";\nconst FlatPermissionSchema = z.union([PlatformPermissionSchema, OrgPermissionSchema]);\nconst BaseUserBody = z.object({\n  email: z.string().email(\"Valid email is required\"),\n  permissions: z.array(FlatPermissionSchema)\n});\nconst PasswordUserBody = BaseUserBody.extend({\n  password: z.string().min(8, \"Password must be at least 8 characters\").optional()\n});\nconst GET = async ({ locals }) => {\n  requireManageInstanceUsers(locals);\n  const page = await getAuthProvider().listUsers({ limit: 200 });\n  if (page === null) {\n    throw error(\n      501,\n      \"User management is not supported by the current auth provider. Configure DATA_PATH (local provider) or check your provider wiring.\"\n    );\n  }\n  const orgId = locals.ctx?.actingOrgId;\n  const orgs = getOrganizationProvider();\n  const userIds = page.items.map((u) => u.id);\n  const platformByUser = await getPermissionStore().getForBatch(locals.ctx, userIds);\n  const flattened = await Promise.all(\n    page.items.map(async (u) => {\n      let orgPerms = [];\n      if (orgId) {\n        const member = await orgs.getOrgMember(SYSTEM_CONTEXT, orgId, u.id);\n        orgPerms = member?.permissions ?? [];\n      }\n      const platformPerms = platformByUser.get(u.id) ?? [];\n      return {\n        ...u,\n        platformPermissions: platformPerms,\n        permissions: flattenPermissions(\n          platformPerms,\n          orgPerms\n        )\n      };\n    })\n  );\n  return json(flattened);\n};\nconst POST = async ({ request, locals }) => {\n  requireManageInstanceUsers(locals);\n  const auth = getAuthProvider();\n  const body = await request.json().catch(() => null);\n  const parsed = PasswordUserBody.safeParse(body);\n  if (!parsed.success) throwZodError(parsed.error);\n  const { email, password, permissions } = parsed.data;\n  const { platform, org } = splitFlatPermissions(permissions);\n  if (platform.length > 0 && !hasPermission(locals.ctx, \"instance_admin\")) {\n    throw error(403, \"Only a platform admin can grant platform-scope permissions\");\n  }\n  try {\n    let user;\n    if (auth.passwordAuth) {\n      if (!password) throw error(400, \"Password is required\");\n      user = await auth.passwordAuth.createUserWithPassword(email, password);\n    } else if (auth.createUser) {\n      user = await auth.createUser(email);\n    } else {\n      throw error(\n        501,\n        `User creation is not supported by ${auth.name}. Users are managed externally.`\n      );\n    }\n    if (platform.length > 0) {\n      await setUserPlatformPermissions(locals.ctx, user.id, platform);\n    }\n    const orgId = locals.ctx?.actingOrgId;\n    if (orgId) {\n      const joinedAt = (/* @__PURE__ */ new Date()).toISOString();\n      await getOrganizationProvider().addOrgMember(SYSTEM_CONTEXT, {\n        orgId,\n        userId: user.id,\n        role: \"member\",\n        permissions: org.filter((p) => MEMBER_ASSIGNABLE_PERMISSIONS.includes(p)),\n        joinedAt,\n        updatedAt: joinedAt,\n        updatedBy: locals.user?.id ?? user.id,\n        deletedAt: null\n      });\n    }\n    return json(user, { status: 201 });\n  } catch (err) {\n    handleApiError(err, \"Failed to create user\");\n  }\n};\nexport {\n  GET,\n  POST\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAQA,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,wBAAwB,EAAE,mBAAmB,CAAC,CAAC;AACrF,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;AAC9B,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC;AACpD,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB;AAC3C,CAAC,CAAC;AACF,MAAM,gBAAgB,GAAG,YAAY,CAAC,MAAM,CAAC;AAC7C,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,wCAAwC,CAAC,CAAC,QAAQ;AAChF,CAAC,CAAC;AACG,MAAC,GAAG,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK;AAClC,EAAE,0BAA0B,CAAC,MAAM,CAAC;AACpC,EAAE,MAAM,IAAI,GAAG,MAAM,eAAe,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AAChE,EAAE,IAAI,IAAI,KAAK,IAAI,EAAE;AACrB,IAAI,MAAM,KAAK;AACf,MAAM,GAAG;AACT,MAAM;AACN,KAAK;AACL,EAAE;AACF,EAAE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,WAAW;AACvC,EAAE,MAAM,IAAI,GAAG,uBAAuB,EAAE;AACxC,EAAE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AAC7C,EAAE,MAAM,cAAc,GAAG,MAAM,kBAAkB,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC;AACpF,EAAE,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG;AACrC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK;AAChC,MAAM,IAAI,QAAQ,GAAG,EAAE;AACvB,MAAM,IAAI,KAAK,EAAE;AACjB,QAAQ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;AAC3E,QAAQ,QAAQ,GAAG,MAAM,EAAE,WAAW,IAAI,EAAE;AAC5C,MAAM;AACN,MAAM,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE;AAC1D,MAAM,OAAO;AACb,QAAQ,GAAG,CAAC;AACZ,QAAQ,mBAAmB,EAAE,aAAa;AAC1C,QAAQ,WAAW,EAAE,kBAAkB;AACvC,UAAU,aAAa;AACvB,UAAU;AACV;AACA,OAAO;AACP,IAAI,CAAC;AACL,GAAG;AACH,EAAE,OAAO,IAAI,CAAC,SAAS,CAAC;AACxB;AACK,MAAC,IAAI,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AAC5C,EAAE,0BAA0B,CAAC,MAAM,CAAC;AACpC,EAAE,MAAM,IAAI,GAAG,eAAe,EAAE;AAChC,EAAE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;AACrD,EAAE,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC;AACjD,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AAClD,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC,IAAI;AACtD,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,oBAAoB,CAAC,WAAW,CAAC;AAC7D,EAAE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE;AAC3E,IAAI,MAAM,KAAK,CAAC,GAAG,EAAE,4DAA4D,CAAC;AAClF,EAAE;AACF,EAAE,IAAI;AACN,IAAI,IAAI,IAAI;AACZ,IAAI,IAAI,IAAI,CAAC,YAAY,EAAE;AAC3B,MAAM,IAAI,CAAC,QAAQ,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,sBAAsB,CAAC;AAC7D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC;AAC5E,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE;AAChC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;AACzC,IAAI,CAAC,MAAM;AACX,MAAM,MAAM,KAAK;AACjB,QAAQ,GAAG;AACX,QAAQ,CAAC,kCAAkC,EAAE,IAAI,CAAC,IAAI,CAAC,+BAA+B;AACtF,OAAO;AACP,IAAI;AACJ,IAAI,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;AAC7B,MAAM,MAAM,0BAA0B,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC;AACrE,IAAI;AACJ,IAAI,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,WAAW;AACzC,IAAI,IAAI,KAAK,EAAE;AACf,MAAM,MAAM,QAAQ,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACjE,MAAM,MAAM,uBAAuB,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE;AACnE,QAAQ,KAAK;AACb,QAAQ,MAAM,EAAE,IAAI,CAAC,EAAE;AACvB,QAAQ,IAAI,EAAE,QAAQ;AACtB,QAAQ,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACjF,QAAQ,QAAQ;AAChB,QAAQ,SAAS,EAAE,QAAQ;AAC3B,QAAQ,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI,CAAC,EAAE;AAC7C,QAAQ,SAAS,EAAE;AACnB,OAAO,CAAC;AACR,IAAI;AACJ,IAAI,OAAO,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AACtC,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,cAAc,CAAC,GAAG,EAAE,uBAAuB,CAAC;AAChD,EAAE;AACF;;;;"}

package/build/server/chunks/_server.ts-C8hNi-NM.js

@@ -0,0 +1,88 @@
+import { error, json } from '@sveltejs/kit';
+import { z } from 'zod';
+import { randomUUID } from 'node:crypto';
+import { n as getProjectProvider, P as ProviderError } from './providers.server-BYk2ehLM.js';
+import { j as requireCanCreateProject } from './access.server-BueyYEoY.js';
+import { h as handleApiError, t as throwZodError } from './api-errors-BckwXK7Q.js';
+import { s as slugify } from './slug-BGuFQjqe.js';
+import { g as ProjectVisibilitySchema } from './context-BJnJL8ES.js';
+import './shared-server-C3WdcJCQ.js';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '@selvajs/compute/core';
+import './utils2-UQQTHTw-.js';
+
+const MAX_SLUG_ATTEMPTS = 25;
+function isSlugConflict(err) {
+  return err instanceof ProviderError && err.statusCode === 409 && /projects_org_id_slug_key/.test(err.message);
+}
+function isNameConflict(err) {
+  return err instanceof ProviderError && err.statusCode === 409 && /projects_org_name_unique/.test(err.message);
+}
+const CreateProjectBody = z.object({
+  name: z.string().min(1, "Project name is required").max(128).trim(),
+  description: z.string().max(2e3).optional(),
+  visibility: ProjectVisibilitySchema.default("private"),
+  autoJoinOnUpload: z.boolean().optional()
+});
+const GET = async ({ locals }) => {
+  const ctx = locals.ctx;
+  if (!ctx.actingOrgId) throw error(400, "No active organization");
+  try {
+    const page = await getProjectProvider().listProjects(ctx, ctx.actingOrgId, { limit: 200 });
+    return json({ projects: page.items });
+  } catch (err) {
+    handleApiError(err, "Failed to load projects");
+  }
+};
+const POST = async ({ request, locals }) => {
+  const ctx = locals.ctx;
+  if (!ctx.actingOrgId) throw error(400, "No active organization");
+  await requireCanCreateProject(locals, ctx.actingOrgId);
+  const body = await request.json().catch(() => null);
+  const parsed = CreateProjectBody.safeParse(body);
+  if (!parsed.success) throwZodError(parsed.error);
+  const autoJoinOnUpload = parsed.data.autoJoinOnUpload ?? false;
+  if (autoJoinOnUpload && parsed.data.visibility !== "public") {
+    throw error(400, "autoJoinOnUpload requires visibility=public");
+  }
+  const projectStore = getProjectProvider();
+  const baseSlug = slugify(parsed.data.name) || "project";
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const projectId = randomUUID();
+  for (let attempt = 0; attempt < MAX_SLUG_ATTEMPTS; attempt++) {
+    const slug = attempt === 0 ? baseSlug : `${baseSlug}-${attempt + 1}`;
+    const project = {
+      id: projectId,
+      orgId: ctx.actingOrgId,
+      name: parsed.data.name,
+      slug,
+      description: parsed.data.description,
+      visibility: parsed.data.visibility,
+      ownerId: locals.user.id,
+      createdBy: locals.user.id,
+      updatedBy: locals.user.id,
+      autoJoinOnUpload,
+      createdAt: now,
+      updatedAt: now,
+      deletedAt: null
+    };
+    try {
+      await projectStore.createProject(ctx, project);
+      return json(project, { status: 201 });
+    } catch (err) {
+      if (isNameConflict(err)) {
+        throw error(409, "A project with that name already exists in this organization.");
+      }
+      if (isSlugConflict(err)) continue;
+      handleApiError(err, "Failed to create project");
+    }
+  }
+  throw error(409, "Could not pick a unique project slug after several attempts.");
+};
+
+export { GET, POST };
+//# sourceMappingURL=_server.ts-C8hNi-NM.js.map

package/build/server/chunks/_server.ts-C8hNi-NM.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-C8hNi-NM.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/api/projects/_server.ts.js"],"sourcesContent":["import { error, json } from \"@sveltejs/kit\";\nimport { z } from \"zod\";\nimport { randomUUID } from \"node:crypto\";\nimport { n as getProjectProvider, P as ProviderError } from \"../../../../chunks/providers.server.js\";\nimport { j as requireCanCreateProject } from \"../../../../chunks/access.server.js\";\nimport { h as handleApiError, t as throwZodError } from \"../../../../chunks/api-errors.js\";\nimport { s as slugify } from \"../../../../chunks/slug.js\";\nimport { g as ProjectVisibilitySchema } from \"../../../../chunks/context.js\";\nconst MAX_SLUG_ATTEMPTS = 25;\nfunction isSlugConflict(err) {\n  return err instanceof ProviderError && err.statusCode === 409 && /projects_org_id_slug_key/.test(err.message);\n}\nfunction isNameConflict(err) {\n  return err instanceof ProviderError && err.statusCode === 409 && /projects_org_name_unique/.test(err.message);\n}\nconst CreateProjectBody = z.object({\n  name: z.string().min(1, \"Project name is required\").max(128).trim(),\n  description: z.string().max(2e3).optional(),\n  visibility: ProjectVisibilitySchema.default(\"private\"),\n  autoJoinOnUpload: z.boolean().optional()\n});\nconst GET = async ({ locals }) => {\n  const ctx = locals.ctx;\n  if (!ctx.actingOrgId) throw error(400, \"No active organization\");\n  try {\n    const page = await getProjectProvider().listProjects(ctx, ctx.actingOrgId, { limit: 200 });\n    return json({ projects: page.items });\n  } catch (err) {\n    handleApiError(err, \"Failed to load projects\");\n  }\n};\nconst POST = async ({ request, locals }) => {\n  const ctx = locals.ctx;\n  if (!ctx.actingOrgId) throw error(400, \"No active organization\");\n  await requireCanCreateProject(locals, ctx.actingOrgId);\n  const body = await request.json().catch(() => null);\n  const parsed = CreateProjectBody.safeParse(body);\n  if (!parsed.success) throwZodError(parsed.error);\n  const autoJoinOnUpload = parsed.data.autoJoinOnUpload ?? false;\n  if (autoJoinOnUpload && parsed.data.visibility !== \"public\") {\n    throw error(400, \"autoJoinOnUpload requires visibility=public\");\n  }\n  const projectStore = getProjectProvider();\n  const baseSlug = slugify(parsed.data.name) || \"project\";\n  const now = (/* @__PURE__ */ new Date()).toISOString();\n  const projectId = randomUUID();\n  for (let attempt = 0; attempt < MAX_SLUG_ATTEMPTS; attempt++) {\n    const slug = attempt === 0 ? baseSlug : `${baseSlug}-${attempt + 1}`;\n    const project = {\n      id: projectId,\n      orgId: ctx.actingOrgId,\n      name: parsed.data.name,\n      slug,\n      description: parsed.data.description,\n      visibility: parsed.data.visibility,\n      ownerId: locals.user.id,\n      createdBy: locals.user.id,\n      updatedBy: locals.user.id,\n      autoJoinOnUpload,\n      createdAt: now,\n      updatedAt: now,\n      deletedAt: null\n    };\n    try {\n      await projectStore.createProject(ctx, project);\n      return json(project, { status: 201 });\n    } catch (err) {\n      if (isNameConflict(err)) {\n        throw error(409, \"A project with that name already exists in this organization.\");\n      }\n      if (isSlugConflict(err)) continue;\n      handleApiError(err, \"Failed to create project\");\n    }\n  }\n  throw error(409, \"Could not pick a unique project slug after several attempts.\");\n};\nexport {\n  GET,\n  POST\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAQA,MAAM,iBAAiB,GAAG,EAAE;AAC5B,SAAS,cAAc,CAAC,GAAG,EAAE;AAC7B,EAAE,OAAO,GAAG,YAAY,aAAa,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;AAC/G;AACA,SAAS,cAAc,CAAC,GAAG,EAAE;AAC7B,EAAE,OAAO,GAAG,YAAY,aAAa,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;AAC/G;AACA,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;AACnC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;AACrE,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AAC7C,EAAE,UAAU,EAAE,uBAAuB,CAAC,OAAO,CAAC,SAAS,CAAC;AACxD,EAAE,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ;AACxC,CAAC,CAAC;AACG,MAAC,GAAG,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK;AAClC,EAAE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACxB,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,wBAAwB,CAAC;AAClE,EAAE,IAAI;AACN,IAAI,MAAM,IAAI,GAAG,MAAM,kBAAkB,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AAC9F,IAAI,OAAO,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;AACzC,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,cAAc,CAAC,GAAG,EAAE,yBAAyB,CAAC;AAClD,EAAE;AACF;AACK,MAAC,IAAI,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AAC5C,EAAE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACxB,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,wBAAwB,CAAC;AAClE,EAAE,MAAM,uBAAuB,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC;AACxD,EAAE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;AACrD,EAAE,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC;AAClD,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AAClD,EAAE,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,KAAK;AAChE,EAAE,IAAI,gBAAgB,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE;AAC/D,IAAI,MAAM,KAAK,CAAC,GAAG,EAAE,6CAA6C,CAAC;AACnE,EAAE;AACF,EAAE,MAAM,YAAY,GAAG,kBAAkB,EAAE;AAC3C,EAAE,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS;AACzD,EAAE,MAAM,GAAG,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACxD,EAAE,MAAM,SAAS,GAAG,UAAU,EAAE;AAChC,EAAE,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,iBAAiB,EAAE,OAAO,EAAE,EAAE;AAChE,IAAI,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;AACxE,IAAI,MAAM,OAAO,GAAG;AACpB,MAAM,EAAE,EAAE,SAAS;AACnB,MAAM,KAAK,EAAE,GAAG,CAAC,WAAW;AAC5B,MAAM,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;AAC5B,MAAM,IAAI;AACV,MAAM,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;AAC1C,MAAM,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU;AACxC,MAAM,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;AAC7B,MAAM,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;AAC/B,MAAM,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;AAC/B,MAAM,gBAAgB;AACtB,MAAM,SAAS,EAAE,GAAG;AACpB,MAAM,SAAS,EAAE,GAAG;AACpB,MAAM,SAAS,EAAE;AACjB,KAAK;AACL,IAAI,IAAI;AACR,MAAM,MAAM,YAAY,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC;AACpD,MAAM,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC3C,IAAI,CAAC,CAAC,OAAO,GAAG,EAAE;AAClB,MAAM,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE;AAC/B,QAAQ,MAAM,KAAK,CAAC,GAAG,EAAE,+DAA+D,CAAC;AACzF,MAAM;AACN,MAAM,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE;AAC/B,MAAM,cAAc,CAAC,GAAG,EAAE,0BAA0B,CAAC;AACrD,IAAI;AACJ,EAAE;AACF,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,8DAA8D,CAAC;AAClF;;;;"}

package/build/server/chunks/_server.ts-CFmfnLGv.js

@@ -0,0 +1,83 @@
+import { error, json } from '@sveltejs/kit';
+import { z } from 'zod';
+import { M as MEMBER_ASSIGNABLE_PERMISSIONS, A as ALL_ORG_PERMISSIONS, e as OrgRoleSchema } from './context-BJnJL8ES.js';
+import { k as getOrganizationProvider } from './providers.server-BYk2ehLM.js';
+import { y as requireManageOrgMembers } from './access.server-BueyYEoY.js';
+import { t as throwZodError, h as handleApiError } from './api-errors-BckwXK7Q.js';
+import './shared-server-C3WdcJCQ.js';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:crypto';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '@selvajs/compute/core';
+import './utils2-UQQTHTw-.js';
+
+const PERMISSIONS_SCHEMA = z.array(
+  z.enum(ALL_ORG_PERMISSIONS)
+);
+const PatchSchema = z.object({
+  role: OrgRoleSchema.optional(),
+  permissions: PERMISSIONS_SCHEMA.optional()
+}).refine((b) => b.role !== void 0 || b.permissions !== void 0, {
+  message: "Provide at least one of role, permissions"
+});
+const PATCH = async ({ params, request, locals }) => {
+  const { orgId, userId } = params;
+  if (!orgId || !userId) throw error(400, "Missing org ID or user ID");
+  requireManageOrgMembers(locals);
+  const ctx = locals.ctx;
+  if (ctx.actingOrgId !== orgId) {
+    throw error(403, "Acting org does not match the target org.");
+  }
+  const body = await request.json().catch(() => null);
+  const parsed = PatchSchema.safeParse(body);
+  if (!parsed.success) throwZodError(parsed.error);
+  const patch = parsed.data;
+  const orgs = getOrganizationProvider();
+  const [actorMember, target] = await Promise.all([
+    orgs.getOrgMember(ctx, orgId, ctx.userId),
+    orgs.getOrgMember(ctx, orgId, userId)
+  ]);
+  if (!target) throw error(404, "Member not found in this organization.");
+  if (!actorMember) throw error(403, "You are not a member of this organization.");
+  if (patch.role !== void 0 && patch.role !== target.role) {
+    if (actorMember.role !== "owner") {
+      throw error(403, "Only the org owner can change roles.");
+    }
+    if (target.role === "owner" && patch.role !== "owner") {
+      const page = await orgs.listOrgMembers(ctx, orgId, { limit: 200 });
+      const otherOwners = page.items.filter(
+        (m) => m.role === "owner" && m.userId !== target.userId && !m.deletedAt
+      );
+      if (otherOwners.length === 0) {
+        throw error(
+          409,
+          "Cannot demote the sole owner of this organization. Promote another member to owner first."
+        );
+      }
+    }
+    await orgs.updateOrgMemberRole(ctx, orgId, userId, patch.role);
+  }
+  if (patch.permissions !== void 0) {
+    const effectiveRole = patch.role ?? target.role;
+    const valid = effectiveRole === "member" ? new Set(MEMBER_ASSIGNABLE_PERMISSIONS) : new Set(ALL_ORG_PERMISSIONS);
+    const invalid = patch.permissions.filter((p) => !valid.has(p));
+    if (invalid.length > 0) {
+      throw error(
+        400,
+        `Permissions [${invalid.join(", ")}] cannot be assigned to a ${effectiveRole}.`
+      );
+    }
+    try {
+      await orgs.updateOrgMemberPermissions(ctx, orgId, userId, patch.permissions);
+    } catch (err) {
+      handleApiError(err, "Failed to update permissions");
+    }
+  }
+  return json({ success: true });
+};
+
+export { PATCH };
+//# sourceMappingURL=_server.ts-CFmfnLGv.js.map

package/build/server/chunks/_server.ts-CFmfnLGv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-CFmfnLGv.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/api/orgs/_orgId_/members/_userId_/_server.ts.js"],"sourcesContent":["import { error, json } from \"@sveltejs/kit\";\nimport { z } from \"zod\";\nimport { A as ALL_ORG_PERMISSIONS, e as OrgRoleSchema, M as MEMBER_ASSIGNABLE_PERMISSIONS } from \"../../../../../../../chunks/context.js\";\nimport { k as getOrganizationProvider } from \"../../../../../../../chunks/providers.server.js\";\nimport { y as requireManageOrgMembers } from \"../../../../../../../chunks/access.server.js\";\nimport { t as throwZodError, h as handleApiError } from \"../../../../../../../chunks/api-errors.js\";\nconst PERMISSIONS_SCHEMA = z.array(\n  z.enum(ALL_ORG_PERMISSIONS)\n);\nconst PatchSchema = z.object({\n  role: OrgRoleSchema.optional(),\n  permissions: PERMISSIONS_SCHEMA.optional()\n}).refine((b) => b.role !== void 0 || b.permissions !== void 0, {\n  message: \"Provide at least one of role, permissions\"\n});\nconst PATCH = async ({ params, request, locals }) => {\n  const { orgId, userId } = params;\n  if (!orgId || !userId) throw error(400, \"Missing org ID or user ID\");\n  requireManageOrgMembers(locals);\n  const ctx = locals.ctx;\n  if (ctx.actingOrgId !== orgId) {\n    throw error(403, \"Acting org does not match the target org.\");\n  }\n  const body = await request.json().catch(() => null);\n  const parsed = PatchSchema.safeParse(body);\n  if (!parsed.success) throwZodError(parsed.error);\n  const patch = parsed.data;\n  const orgs = getOrganizationProvider();\n  const [actorMember, target] = await Promise.all([\n    orgs.getOrgMember(ctx, orgId, ctx.userId),\n    orgs.getOrgMember(ctx, orgId, userId)\n  ]);\n  if (!target) throw error(404, \"Member not found in this organization.\");\n  if (!actorMember) throw error(403, \"You are not a member of this organization.\");\n  if (patch.role !== void 0 && patch.role !== target.role) {\n    if (actorMember.role !== \"owner\") {\n      throw error(403, \"Only the org owner can change roles.\");\n    }\n    if (target.role === \"owner\" && patch.role !== \"owner\") {\n      const page = await orgs.listOrgMembers(ctx, orgId, { limit: 200 });\n      const otherOwners = page.items.filter(\n        (m) => m.role === \"owner\" && m.userId !== target.userId && !m.deletedAt\n      );\n      if (otherOwners.length === 0) {\n        throw error(\n          409,\n          \"Cannot demote the sole owner of this organization. Promote another member to owner first.\"\n        );\n      }\n    }\n    await orgs.updateOrgMemberRole(ctx, orgId, userId, patch.role);\n  }\n  if (patch.permissions !== void 0) {\n    const effectiveRole = patch.role ?? target.role;\n    const valid = effectiveRole === \"member\" ? new Set(MEMBER_ASSIGNABLE_PERMISSIONS) : new Set(ALL_ORG_PERMISSIONS);\n    const invalid = patch.permissions.filter((p) => !valid.has(p));\n    if (invalid.length > 0) {\n      throw error(\n        400,\n        `Permissions [${invalid.join(\", \")}] cannot be assigned to a ${effectiveRole}.`\n      );\n    }\n    try {\n      await orgs.updateOrgMemberPermissions(ctx, orgId, userId, patch.permissions);\n    } catch (err) {\n      handleApiError(err, \"Failed to update permissions\");\n    }\n  }\n  return json({ success: true });\n};\nexport {\n  PATCH\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAMA,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK;AAClC,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB;AAC5B,CAAC;AACD,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;AAC7B,EAAE,IAAI,EAAE,aAAa,CAAC,QAAQ,EAAE;AAChC,EAAE,WAAW,EAAE,kBAAkB,CAAC,QAAQ;AAC1C,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,MAAM,EAAE;AAChE,EAAE,OAAO,EAAE;AACX,CAAC,CAAC;AACG,MAAC,KAAK,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AACrD,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM;AAClC,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,2BAA2B,CAAC;AACtE,EAAE,uBAAuB,CAAC,MAAM,CAAC;AACjC,EAAE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACxB,EAAE,IAAI,GAAG,CAAC,WAAW,KAAK,KAAK,EAAE;AACjC,IAAI,MAAM,KAAK,CAAC,GAAG,EAAE,2CAA2C,CAAC;AACjE,EAAE;AACF,EAAE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;AACrD,EAAE,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC;AAC5C,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AAClD,EAAE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI;AAC3B,EAAE,MAAM,IAAI,GAAG,uBAAuB,EAAE;AACxC,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AAClD,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC;AAC7C,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM;AACxC,GAAG,CAAC;AACJ,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,wCAAwC,CAAC;AACzE,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,4CAA4C,CAAC;AAClF,EAAE,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE;AAC3D,IAAI,IAAI,WAAW,CAAC,IAAI,KAAK,OAAO,EAAE;AACtC,MAAM,MAAM,KAAK,CAAC,GAAG,EAAE,sCAAsC,CAAC;AAC9D,IAAI;AACJ,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE;AAC3D,MAAM,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACxE,MAAM,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM;AAC3C,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;AACtE,OAAO;AACP,MAAM,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE;AACpC,QAAQ,MAAM,KAAK;AACnB,UAAU,GAAG;AACb,UAAU;AACV,SAAS;AACT,MAAM;AACN,IAAI;AACJ,IAAI,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;AAClE,EAAE;AACF,EAAE,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM,EAAE;AACpC,IAAI,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI;AACnD,IAAI,MAAM,KAAK,GAAG,aAAa,KAAK,QAAQ,GAAG,IAAI,GAAG,CAAC,6BAA6B,CAAC,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC;AACpH,IAAI,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAClE,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE;AAC5B,MAAM,MAAM,KAAK;AACjB,QAAQ,GAAG;AACX,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,0BAA0B,EAAE,aAAa,CAAC,CAAC;AACtF,OAAO;AACP,IAAI;AACJ,IAAI,IAAI;AACR,MAAM,MAAM,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC;AAClF,IAAI,CAAC,CAAC,OAAO,GAAG,EAAE;AAClB,MAAM,cAAc,CAAC,GAAG,EAAE,8BAA8B,CAAC;AACzD,IAAI;AACJ,EAAE;AACF,EAAE,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAChC;;;;"}

package/build/server/chunks/_server.ts-CVgSO8yh.js

@@ -0,0 +1,72 @@
+import { error, json } from '@sveltejs/kit';
+import { randomUUID } from 'node:crypto';
+import { z } from 'zod';
+import { j as getInviteStore } from './providers.server-BYk2ehLM.js';
+import { y as requireManageOrgMembers } from './access.server-BueyYEoY.js';
+import { h as handleApiError, t as throwZodError } from './api-errors-BckwXK7Q.js';
+import { M as MEMBER_ASSIGNABLE_PERMISSIONS, D as DEFAULT_ORG_PERMISSIONS, e as OrgRoleSchema, P as PlatformPermissionSchema, d as OrgPermissionSchema } from './context-BJnJL8ES.js';
+import { s as splitFlatPermissions } from './permissions-compat.server-G174xsh6.js';
+import { m as mintRawToken, h as hashToken } from './token.server2-CaWL-Isp.js';
+import './shared-server-C3WdcJCQ.js';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '@selvajs/compute/core';
+import './utils2-UQQTHTw-.js';
+
+const FlatPermissionSchema = z.union([PlatformPermissionSchema, OrgPermissionSchema]);
+const CreateBody = z.object({
+  email: z.string().email("Valid email is required").transform((s) => s.toLowerCase().trim()),
+  orgRole: OrgRoleSchema.default("member"),
+  permissions: z.array(FlatPermissionSchema).default([])
+});
+const INVITE_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
+const GET = async ({ locals }) => {
+  requireManageOrgMembers(locals);
+  const ctx = locals.ctx;
+  if (!ctx.actingOrgId) throw error(400, "No active organization");
+  try {
+    const page = await getInviteStore().listByOrg(ctx, ctx.actingOrgId, { limit: 200 });
+    const items = page.items.map(({ tokenHash: _omit, ...rest }) => rest);
+    return json(items);
+  } catch (err) {
+    handleApiError(err, "Failed to list invites");
+  }
+};
+const POST = async ({ request, locals, url }) => {
+  requireManageOrgMembers(locals);
+  const ctx = locals.ctx;
+  const user = locals.user;
+  if (!ctx.actingOrgId) throw error(400, "No active organization");
+  const body = await request.json().catch(() => null);
+  const parsed = CreateBody.safeParse(body);
+  if (!parsed.success) throwZodError(parsed.error);
+  try {
+    const { org: submittedOrgPerms } = splitFlatPermissions(parsed.data.permissions);
+    const orgPermissions = parsed.data.orgRole === "member" ? submittedOrgPerms.filter((p) => MEMBER_ASSIGNABLE_PERMISSIONS.includes(p)) : [...DEFAULT_ORG_PERMISSIONS[parsed.data.orgRole]];
+    const rawToken = mintRawToken();
+    const now = /* @__PURE__ */ new Date();
+    const invite = {
+      id: randomUUID(),
+      tokenHash: hashToken(rawToken),
+      email: parsed.data.email,
+      orgId: ctx.actingOrgId,
+      orgRole: parsed.data.orgRole,
+      orgPermissions,
+      invitedBy: user.id,
+      createdAt: now.toISOString(),
+      expiresAt: new Date(now.getTime() + INVITE_TTL_MS).toISOString()
+    };
+    await getInviteStore().create(ctx, invite);
+    const acceptUrl = `${url.origin}/accept-invite?token=${rawToken}`;
+    const { tokenHash: _omit, ...inviteForClient } = invite;
+    return json({ invite: inviteForClient, acceptUrl }, { status: 201 });
+  } catch (err) {
+    handleApiError(err, "Failed to create invite");
+  }
+};
+
+export { GET, POST };
+//# sourceMappingURL=_server.ts-CVgSO8yh.js.map

package/build/server/chunks/_server.ts-CVgSO8yh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-CVgSO8yh.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/api/invites/_server.ts.js"],"sourcesContent":["import { error, json } from \"@sveltejs/kit\";\nimport { randomUUID } from \"node:crypto\";\nimport { z } from \"zod\";\nimport { j as getInviteStore } from \"../../../../chunks/providers.server.js\";\nimport { y as requireManageOrgMembers } from \"../../../../chunks/access.server.js\";\nimport { h as handleApiError, t as throwZodError } from \"../../../../chunks/api-errors.js\";\nimport { P as PlatformPermissionSchema, d as OrgPermissionSchema, e as OrgRoleSchema, M as MEMBER_ASSIGNABLE_PERMISSIONS, D as DEFAULT_ORG_PERMISSIONS } from \"../../../../chunks/context.js\";\nimport { s as splitFlatPermissions } from \"../../../../chunks/permissions-compat.server.js\";\nimport { m as mintRawToken, h as hashToken } from \"../../../../chunks/token.server2.js\";\nconst FlatPermissionSchema = z.union([PlatformPermissionSchema, OrgPermissionSchema]);\nconst CreateBody = z.object({\n  email: z.string().email(\"Valid email is required\").transform((s) => s.toLowerCase().trim()),\n  orgRole: OrgRoleSchema.default(\"member\"),\n  permissions: z.array(FlatPermissionSchema).default([])\n});\nconst INVITE_TTL_MS = 7 * 24 * 60 * 60 * 1e3;\nconst GET = async ({ locals }) => {\n  requireManageOrgMembers(locals);\n  const ctx = locals.ctx;\n  if (!ctx.actingOrgId) throw error(400, \"No active organization\");\n  try {\n    const page = await getInviteStore().listByOrg(ctx, ctx.actingOrgId, { limit: 200 });\n    const items = page.items.map(({ tokenHash: _omit, ...rest }) => rest);\n    return json(items);\n  } catch (err) {\n    handleApiError(err, \"Failed to list invites\");\n  }\n};\nconst POST = async ({ request, locals, url }) => {\n  requireManageOrgMembers(locals);\n  const ctx = locals.ctx;\n  const user = locals.user;\n  if (!ctx.actingOrgId) throw error(400, \"No active organization\");\n  const body = await request.json().catch(() => null);\n  const parsed = CreateBody.safeParse(body);\n  if (!parsed.success) throwZodError(parsed.error);\n  try {\n    const { org: submittedOrgPerms } = splitFlatPermissions(parsed.data.permissions);\n    const orgPermissions = parsed.data.orgRole === \"member\" ? submittedOrgPerms.filter((p) => MEMBER_ASSIGNABLE_PERMISSIONS.includes(p)) : [...DEFAULT_ORG_PERMISSIONS[parsed.data.orgRole]];\n    const rawToken = mintRawToken();\n    const now = /* @__PURE__ */ new Date();\n    const invite = {\n      id: randomUUID(),\n      tokenHash: hashToken(rawToken),\n      email: parsed.data.email,\n      orgId: ctx.actingOrgId,\n      orgRole: parsed.data.orgRole,\n      orgPermissions,\n      invitedBy: user.id,\n      createdAt: now.toISOString(),\n      expiresAt: new Date(now.getTime() + INVITE_TTL_MS).toISOString()\n    };\n    await getInviteStore().create(ctx, invite);\n    const acceptUrl = `${url.origin}/accept-invite?token=${rawToken}`;\n    const { tokenHash: _omit, ...inviteForClient } = invite;\n    return json({ invite: inviteForClient, acceptUrl }, { status: 201 });\n  } catch (err) {\n    handleApiError(err, \"Failed to create invite\");\n  }\n};\nexport {\n  GET,\n  POST\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AASA,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,wBAAwB,EAAE,mBAAmB,CAAC,CAAC;AACrF,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;AAC5B,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;AAC7F,EAAE,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC;AAC1C,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,EAAE;AACvD,CAAC,CAAC;AACF,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG;AACvC,MAAC,GAAG,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK;AAClC,EAAE,uBAAuB,CAAC,MAAM,CAAC;AACjC,EAAE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACxB,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,wBAAwB,CAAC;AAClE,EAAE,IAAI;AACN,IAAI,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACvF,IAAI,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,KAAK,IAAI,CAAC;AACzE,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC;AACtB,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,cAAc,CAAC,GAAG,EAAE,wBAAwB,CAAC;AACjD,EAAE;AACF;AACK,MAAC,IAAI,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK;AACjD,EAAE,uBAAuB,CAAC,MAAM,CAAC;AACjC,EAAE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACxB,EAAE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI;AAC1B,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,wBAAwB,CAAC;AAClE,EAAE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;AACrD,EAAE,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC;AAC3C,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AAClD,EAAE,IAAI;AACN,IAAI,MAAM,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;AACpF,IAAI,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,uBAAuB,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC5L,IAAI,MAAM,QAAQ,GAAG,YAAY,EAAE;AACnC,IAAI,MAAM,GAAG,mBAAmB,IAAI,IAAI,EAAE;AAC1C,IAAI,MAAM,MAAM,GAAG;AACnB,MAAM,EAAE,EAAE,UAAU,EAAE;AACtB,MAAM,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC;AACpC,MAAM,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;AAC9B,MAAM,KAAK,EAAE,GAAG,CAAC,WAAW;AAC5B,MAAM,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO;AAClC,MAAM,cAAc;AACpB,MAAM,SAAS,EAAE,IAAI,CAAC,EAAE;AACxB,MAAM,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;AAClC,MAAM,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,CAAC,WAAW;AACpE,KAAK;AACL,IAAI,MAAM,cAAc,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC;AAC9C,IAAI,MAAM,SAAS,GAAG,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC;AACrE,IAAI,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,eAAe,EAAE,GAAG,MAAM;AAC3D,IAAI,OAAO,IAAI,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AACxE,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,cAAc,CAAC,GAAG,EAAE,yBAAyB,CAAC;AAClD,EAAE;AACF;;;;"}