@selvajs/selva 4.3.5 → 4.5.0

package/build/server/chunks/_server.ts-CMHRHdCD.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-CMHRHdCD.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/api/projects/_id_/_server.ts.js"],"sourcesContent":["import { error, json } from \"@sveltejs/kit\";\nimport { z } from \"zod\";\nimport { n as getProjectProvider, k as getOrganizationProvider } from \"../../../../../chunks/providers.server.js\";\nimport { m as requireCanManage, l as requireCanEditProjectSettings, B as withAdminBypass, f as canChangeVisibilityToPublic } from \"../../../../../chunks/access.server.js\";\nimport { h as handleApiError, t as throwZodError } from \"../../../../../chunks/api-errors.js\";\nimport { s as slugify } from \"../../../../../chunks/slug.js\";\nimport { g as ProjectVisibilitySchema, v as validateProjectFlags } from \"../../../../../chunks/context.js\";\nconst UpdateProjectBody = z.object({\n  name: z.string().min(1).max(128).trim(),\n  description: z.string().max(2e3).nullish(),\n  visibility: ProjectVisibilitySchema,\n  autoJoinOnUpload: z.boolean()\n}).partial();\nconst PATCH = async ({ params, request, locals }) => {\n  const { id } = params;\n  if (!id) throw error(400, \"Missing project ID\");\n  const { ctx, project: existing } = await requireCanEditProjectSettings(locals, id);\n  const body = await request.json().catch(() => null);\n  const parsed = UpdateProjectBody.safeParse(body);\n  if (!parsed.success) throwZodError(parsed.error);\n  if (parsed.data.visibility !== void 0 && parsed.data.visibility === \"public\" && existing.visibility !== \"public\") {\n    const orgMember = await getOrganizationProvider().getOrgMember(ctx, existing.orgId, ctx.userId);\n    const passes = withAdminBypass(\n      ctx.platformPermissions,\n      () => canChangeVisibilityToPublic({ orgMember })\n    );\n    if (!passes) {\n      throw error(403, \"Only org owners or admins can make a project public.\");\n    }\n  }\n  const mergedVisibility = parsed.data.visibility ?? existing.visibility;\n  const mergedAutoJoin = parsed.data.autoJoinOnUpload ?? existing.autoJoinOnUpload;\n  const flagIssues = validateProjectFlags({\n    visibility: mergedVisibility,\n    autoJoinOnUpload: mergedAutoJoin\n  });\n  if (flagIssues.length > 0) {\n    throw error(400, flagIssues.map((i) => `${i.path}: ${i.message}`).join(\"; \"));\n  }\n  const patch = {};\n  if (parsed.data.name !== void 0) {\n    patch.name = parsed.data.name;\n    patch.slug = slugify(parsed.data.name);\n  }\n  if (parsed.data.description !== void 0) {\n    patch.description = parsed.data.description ?? void 0;\n  }\n  if (parsed.data.visibility !== void 0) patch.visibility = parsed.data.visibility;\n  if (parsed.data.autoJoinOnUpload !== void 0) {\n    patch.autoJoinOnUpload = parsed.data.autoJoinOnUpload;\n  }\n  try {\n    await getProjectProvider().updateProject(ctx, id, patch);\n    return json({ success: true });\n  } catch (err) {\n    handleApiError(err, \"Failed to update project\");\n  }\n};\nconst DELETE = async ({ params, locals }) => {\n  const { id } = params;\n  if (!id) throw error(400, \"Missing project ID\");\n  await requireCanManage(locals, id);\n  const ctx = locals.ctx;\n  try {\n    await getProjectProvider().deleteProject(ctx, id);\n    return json({ success: true });\n  } catch (err) {\n    handleApiError(err, \"Failed to delete project\");\n  }\n};\nexport {\n  DELETE,\n  PATCH\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAOA,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;AACnC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;AACzC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE;AAC5C,EAAE,UAAU,EAAE,uBAAuB;AACrC,EAAE,gBAAgB,EAAE,CAAC,CAAC,OAAO;AAC7B,CAAC,CAAC,CAAC,OAAO,EAAE;AACP,MAAC,KAAK,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AACrD,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM;AACvB,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,oBAAoB,CAAC;AACjD,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,6BAA6B,CAAC,MAAM,EAAE,EAAE,CAAC;AACpF,EAAE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;AACrD,EAAE,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC;AAClD,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AAClD,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,KAAK,QAAQ,EAAE;AACpH,IAAI,MAAM,SAAS,GAAG,MAAM,uBAAuB,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC;AACnG,IAAI,MAAM,MAAM,GAAG,eAAe;AAClC,MAAM,GAAG,CAAC,mBAAmB;AAC7B,MAAM,MAAM,2BAA2B,CAAC,EAAE,SAAS,EAAE;AACrD,KAAK;AACL,IAAI,IAAI,CAAC,MAAM,EAAE;AACjB,MAAM,MAAM,KAAK,CAAC,GAAG,EAAE,sDAAsD,CAAC;AAC9E,IAAI;AACJ,EAAE;AACF,EAAE,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU;AACxE,EAAE,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,QAAQ,CAAC,gBAAgB;AAClF,EAAE,MAAM,UAAU,GAAG,oBAAoB,CAAC;AAC1C,IAAI,UAAU,EAAE,gBAAgB;AAChC,IAAI,gBAAgB,EAAE;AACtB,GAAG,CAAC;AACJ,EAAE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE;AAC7B,IAAI,MAAM,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjF,EAAE;AACF,EAAE,MAAM,KAAK,GAAG,EAAE;AAClB,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE;AACnC,IAAI,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI;AACjC,IAAI,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;AAC1C,EAAE;AACF,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,MAAM,EAAE;AAC1C,IAAI,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,MAAM;AACzD,EAAE;AACF,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,MAAM,EAAE,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU;AAClF,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,gBAAgB,KAAK,MAAM,EAAE;AAC/C,IAAI,KAAK,CAAC,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB;AACzD,EAAE;AACF,EAAE,IAAI;AACN,IAAI,MAAM,kBAAkB,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC;AAC5D,IAAI,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAClC,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,cAAc,CAAC,GAAG,EAAE,0BAA0B,CAAC;AACnD,EAAE;AACF;AACK,MAAC,MAAM,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AAC7C,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM;AACvB,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,oBAAoB,CAAC;AACjD,EAAE,MAAM,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC;AACpC,EAAE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACxB,EAAE,IAAI;AACN,IAAI,MAAM,kBAAkB,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,CAAC;AACrD,IAAI,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAClC,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,cAAc,CAAC,GAAG,EAAE,0BAA0B,CAAC;AACnD,EAAE;AACF;;;;"}

package/build/server/chunks/_server.ts-Ca_OJJFC.js

@@ -0,0 +1,39 @@
+import { error, json } from '@sveltejs/kit';
+import { f as flag, u as providers } from './providers.server-C3fQ7ZdV.js';
+import { t as requireEditableDefinition } from './access.server-CAPd1-c2.js';
+import { h as handleApiError } from './api-errors-BhVEeWTV.js';
+import { G as GuidSchema } from './context-BJnJL8ES.js';
+import './shared-server-C3WdcJCQ.js';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:crypto';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import 'zod';
+import '@selvajs/compute/core';
+import './utils2-BqfluBM6.js';
+
+const DELETE = async ({ params, locals }) => {
+  if (!flag("ENABLE_SHARING")) {
+    throw error(404, "Share links are disabled on this instance (ENABLE_SHARING).");
+  }
+  const guidParsed = GuidSchema.safeParse(params.guid);
+  if (!guidParsed.success) throw error(400, "Invalid or missing GUID");
+  const linkParsed = GuidSchema.safeParse(params.linkId);
+  if (!linkParsed.success) throw error(400, "Invalid or missing link ID");
+  const { ctx } = await requireEditableDefinition(locals, guidParsed.data);
+  try {
+    const existing = await providers.data.shareLinks.getById(ctx, linkParsed.data);
+    if (!existing || existing.definitionId !== guidParsed.data) {
+      throw error(404, "Share link not found.");
+    }
+    await providers.data.shareLinks.revoke(ctx, linkParsed.data);
+    return json({ success: true });
+  } catch (err) {
+    handleApiError(err, "Failed to revoke share link");
+  }
+};
+
+export { DELETE };
+//# sourceMappingURL=_server.ts-Ca_OJJFC.js.map

package/build/server/chunks/_server.ts-Ca_OJJFC.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-Ca_OJJFC.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/api/definitions/_guid_/share-links/_linkId_/_server.ts.js"],"sourcesContent":["import { error, json } from \"@sveltejs/kit\";\nimport { f as flag, u as providers } from \"../../../../../../../chunks/providers.server.js\";\nimport { t as requireEditableDefinition } from \"../../../../../../../chunks/access.server.js\";\nimport { h as handleApiError } from \"../../../../../../../chunks/api-errors.js\";\nimport { G as GuidSchema } from \"../../../../../../../chunks/context.js\";\nconst DELETE = async ({ params, locals }) => {\n  if (!flag(\"ENABLE_SHARING\")) {\n    throw error(404, \"Share links are disabled on this instance (ENABLE_SHARING).\");\n  }\n  const guidParsed = GuidSchema.safeParse(params.guid);\n  if (!guidParsed.success) throw error(400, \"Invalid or missing GUID\");\n  const linkParsed = GuidSchema.safeParse(params.linkId);\n  if (!linkParsed.success) throw error(400, \"Invalid or missing link ID\");\n  const { ctx } = await requireEditableDefinition(locals, guidParsed.data);\n  try {\n    const existing = await providers.data.shareLinks.getById(ctx, linkParsed.data);\n    if (!existing || existing.definitionId !== guidParsed.data) {\n      throw error(404, \"Share link not found.\");\n    }\n    await providers.data.shareLinks.revoke(ctx, linkParsed.data);\n    return json({ success: true });\n  } catch (err) {\n    handleApiError(err, \"Failed to revoke share link\");\n  }\n};\nexport {\n  DELETE\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAKK,MAAC,MAAM,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AAC7C,EAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE;AAC/B,IAAI,MAAM,KAAK,CAAC,GAAG,EAAE,6DAA6D,CAAC;AACnF,EAAE;AACF,EAAE,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;AACtD,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,yBAAyB,CAAC;AACtE,EAAE,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;AACxD,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,4BAA4B,CAAC;AACzE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC;AAC1E,EAAE,IAAI;AACN,IAAI,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC;AAClF,IAAI,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,YAAY,KAAK,UAAU,CAAC,IAAI,EAAE;AAChE,MAAM,MAAM,KAAK,CAAC,GAAG,EAAE,uBAAuB,CAAC;AAC/C,IAAI;AACJ,IAAI,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC;AAChE,IAAI,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAClC,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,cAAc,CAAC,GAAG,EAAE,6BAA6B,CAAC;AACtD,EAAE;AACF;;;;"}

package/build/server/chunks/_server.ts-Cc-srcRk.js

@@ -0,0 +1,33 @@
+import { error, redirect } from '@sveltejs/kit';
+import { a as getAuthProvider } from './providers.server-C3fQ7ZdV.js';
+import { b as bootstrapUserSession } from './auth-bootstrap.server-DKc9-3PR.js';
+import { h as setSessionCookie, f as setRefreshCookie, s as safeRedirectTarget } from './admin-auth.server-45kKyH82.js';
+import './shared-server-C3WdcJCQ.js';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import './context-BJnJL8ES.js';
+import 'zod';
+import 'node:crypto';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import './slug-BGuFQjqe.js';
+
+const GET = async ({ url, cookies }) => {
+  const code = url.searchParams.get("code");
+  if (!code) throw error(400, "Missing authorization code");
+  const oauth = getAuthProvider().oauth;
+  if (!oauth) {
+    throw error(501, "OAuth is not supported by the configured auth provider.");
+  }
+  const result = await oauth.exchangeOAuthCode(code);
+  if (!result) throw error(401, "OAuth exchange failed");
+  await bootstrapUserSession(result.user);
+  setSessionCookie(cookies, result.sessionToken);
+  setRefreshCookie(cookies, result.refreshToken);
+  const dest = safeRedirectTarget(url.searchParams.get("redirectTo"), "/library");
+  redirect(303, dest);
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts-Cc-srcRk.js.map

package/build/server/chunks/_server.ts-Cc-srcRk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-Cc-srcRk.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/auth/supabase/callback/_server.ts.js"],"sourcesContent":["import { error, redirect } from \"@sveltejs/kit\";\nimport { a as getAuthProvider } from \"../../../../../chunks/providers.server.js\";\nimport { b as bootstrapUserSession } from \"../../../../../chunks/auth-bootstrap.server.js\";\nimport { h as setSessionCookie, f as setRefreshCookie, s as safeRedirectTarget } from \"../../../../../chunks/admin-auth.server.js\";\nconst GET = async ({ url, cookies }) => {\n  const code = url.searchParams.get(\"code\");\n  if (!code) throw error(400, \"Missing authorization code\");\n  const oauth = getAuthProvider().oauth;\n  if (!oauth) {\n    throw error(501, \"OAuth is not supported by the configured auth provider.\");\n  }\n  const result = await oauth.exchangeOAuthCode(code);\n  if (!result) throw error(401, \"OAuth exchange failed\");\n  await bootstrapUserSession(result.user);\n  setSessionCookie(cookies, result.sessionToken);\n  setRefreshCookie(cookies, result.refreshToken);\n  const dest = safeRedirectTarget(url.searchParams.get(\"redirectTo\"), \"/library\");\n  redirect(303, dest);\n};\nexport {\n  GET\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;AAIK,MAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK;AACxC,EAAE,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;AAC3C,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,4BAA4B,CAAC;AAC3D,EAAE,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC,KAAK;AACvC,EAAE,IAAI,CAAC,KAAK,EAAE;AACd,IAAI,MAAM,KAAK,CAAC,GAAG,EAAE,yDAAyD,CAAC;AAC/E,EAAE;AACF,EAAE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC;AACpD,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,uBAAuB,CAAC;AACxD,EAAE,MAAM,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC;AACzC,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AAChD,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AAChD,EAAE,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC;AACjF,EAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;AACrB;;;;"}

package/build/server/chunks/_server.ts-Cg1WgIQn.js

@@ -0,0 +1,31 @@
+import { error, json } from '@sveltejs/kit';
+import { f as flag, m as getPlatformProjectGrantStore } from './providers.server-C3fQ7ZdV.js';
+import { u as requireInstanceAdmin } from './access.server-CAPd1-c2.js';
+import { h as handleApiError } from './api-errors-BhVEeWTV.js';
+import { S as SYSTEM_CONTEXT } from './context-BJnJL8ES.js';
+import './shared-server-C3WdcJCQ.js';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:crypto';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import 'zod';
+import '@selvajs/compute/core';
+import './utils2-BqfluBM6.js';
+
+const DELETE = async ({ params, locals }) => {
+  requireInstanceAdmin(locals);
+  if (!flag("ENABLE_PLATFORM_PROJECTS")) throw error(404, "Not found");
+  const { grantId } = params;
+  if (!grantId) throw error(400, "Missing grant ID");
+  try {
+    await getPlatformProjectGrantStore().delete(SYSTEM_CONTEXT, grantId);
+    return json({ success: true });
+  } catch (err) {
+    handleApiError(err, "Failed to revoke grant");
+  }
+};
+
+export { DELETE };
+//# sourceMappingURL=_server.ts-Cg1WgIQn.js.map

package/build/server/chunks/_server.ts-Cg1WgIQn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-Cg1WgIQn.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/admin/api/projects/_id_/grants/_grantId_/_server.ts.js"],"sourcesContent":["import { error, json } from \"@sveltejs/kit\";\nimport { f as flag, m as getPlatformProjectGrantStore } from \"../../../../../../../../chunks/providers.server.js\";\nimport { u as requireInstanceAdmin } from \"../../../../../../../../chunks/access.server.js\";\nimport { h as handleApiError } from \"../../../../../../../../chunks/api-errors.js\";\nimport { S as SYSTEM_CONTEXT } from \"../../../../../../../../chunks/context.js\";\nconst DELETE = async ({ params, locals }) => {\n  requireInstanceAdmin(locals);\n  if (!flag(\"ENABLE_PLATFORM_PROJECTS\")) throw error(404, \"Not found\");\n  const { grantId } = params;\n  if (!grantId) throw error(400, \"Missing grant ID\");\n  try {\n    await getPlatformProjectGrantStore().delete(SYSTEM_CONTEXT, grantId);\n    return json({ success: true });\n  } catch (err) {\n    handleApiError(err, \"Failed to revoke grant\");\n  }\n};\nexport {\n  DELETE\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAKK,MAAC,MAAM,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AAC7C,EAAE,oBAAoB,CAAC,MAAM,CAAC;AAC9B,EAAE,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC;AACtE,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM;AAC5B,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,kBAAkB,CAAC;AACpD,EAAE,IAAI;AACN,IAAI,MAAM,4BAA4B,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC;AACxE,IAAI,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAClC,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,cAAc,CAAC,GAAG,EAAE,wBAAwB,CAAC;AACjD,EAAE;AACF;;;;"}

package/build/server/chunks/_server.ts-Cg6LtEov.js

@@ -0,0 +1,36 @@
+import { error, redirect } from '@sveltejs/kit';
+import { a as getAuthProvider } from './providers.server-C3fQ7ZdV.js';
+import './shared-server-C3WdcJCQ.js';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import './context-BJnJL8ES.js';
+import 'zod';
+import 'node:crypto';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+
+const ALLOWED_PROVIDERS = ["google", "github", "azure", "gitlab"];
+function isAllowedProvider(value) {
+  return value !== null && ALLOWED_PROVIDERS.includes(value);
+}
+const GET = async ({ url }) => {
+  const provider = url.searchParams.get("provider");
+  if (!isAllowedProvider(provider)) {
+    throw error(400, `Invalid provider. Allowed: ${ALLOWED_PROVIDERS.join(", ")}`);
+  }
+  const oauth = getAuthProvider().oauth;
+  if (!oauth) {
+    throw error(501, "OAuth is not supported by the configured auth provider.");
+  }
+  const redirectTo = url.searchParams.get("redirectTo") ?? "/library";
+  const callbackUrl = new URL("/auth/supabase/callback", url.origin);
+  if (redirectTo.startsWith("/")) {
+    callbackUrl.searchParams.set("redirectTo", redirectTo);
+  }
+  const authorizationUrl = await oauth.getOAuthAuthorizationUrl(provider, callbackUrl.toString());
+  redirect(303, authorizationUrl);
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts-Cg6LtEov.js.map

package/build/server/chunks/_server.ts-Cg6LtEov.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-Cg6LtEov.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/auth/supabase/start/_server.ts.js"],"sourcesContent":["import { error, redirect } from \"@sveltejs/kit\";\nimport { a as getAuthProvider } from \"../../../../../chunks/providers.server.js\";\nconst ALLOWED_PROVIDERS = [\"google\", \"github\", \"azure\", \"gitlab\"];\nfunction isAllowedProvider(value) {\n  return value !== null && ALLOWED_PROVIDERS.includes(value);\n}\nconst GET = async ({ url }) => {\n  const provider = url.searchParams.get(\"provider\");\n  if (!isAllowedProvider(provider)) {\n    throw error(400, `Invalid provider. Allowed: ${ALLOWED_PROVIDERS.join(\", \")}`);\n  }\n  const oauth = getAuthProvider().oauth;\n  if (!oauth) {\n    throw error(501, \"OAuth is not supported by the configured auth provider.\");\n  }\n  const redirectTo = url.searchParams.get(\"redirectTo\") ?? \"/library\";\n  const callbackUrl = new URL(\"/auth/supabase/callback\", url.origin);\n  if (redirectTo.startsWith(\"/\")) {\n    callbackUrl.searchParams.set(\"redirectTo\", redirectTo);\n  }\n  const authorizationUrl = await oauth.getOAuthAuthorizationUrl(provider, callbackUrl.toString());\n  redirect(303, authorizationUrl);\n};\nexport {\n  GET\n};\n"],"names":[],"mappings":";;;;;;;;;;;;AAEA,MAAM,iBAAiB,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC;AACjE,SAAS,iBAAiB,CAAC,KAAK,EAAE;AAClC,EAAE,OAAO,KAAK,KAAK,IAAI,IAAI,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC;AAC5D;AACK,MAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,KAAK;AAC/B,EAAE,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC;AACnD,EAAE,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE;AACpC,IAAI,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,2BAA2B,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClF,EAAE;AACF,EAAE,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC,KAAK;AACvC,EAAE,IAAI,CAAC,KAAK,EAAE;AACd,IAAI,MAAM,KAAK,CAAC,GAAG,EAAE,yDAAyD,CAAC;AAC/E,EAAE;AACF,EAAE,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,UAAU;AACrE,EAAE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,yBAAyB,EAAE,GAAG,CAAC,MAAM,CAAC;AACpE,EAAE,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;AAClC,IAAI,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC;AAC1D,EAAE;AACF,EAAE,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,wBAAwB,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC;AACjG,EAAE,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;AACjC;;;;"}

package/build/server/chunks/_server.ts-CpsGzKQC.js

@@ -0,0 +1,83 @@
+import { error, json } from '@sveltejs/kit';
+import { z } from 'zod';
+import { M as MEMBER_ASSIGNABLE_PERMISSIONS, A as ALL_ORG_PERMISSIONS, e as OrgRoleSchema } from './context-BJnJL8ES.js';
+import { k as getOrganizationProvider } from './providers.server-C3fQ7ZdV.js';
+import { y as requireManageOrgMembers } from './access.server-CAPd1-c2.js';
+import { t as throwZodError, h as handleApiError } from './api-errors-BhVEeWTV.js';
+import './shared-server-C3WdcJCQ.js';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:crypto';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '@selvajs/compute/core';
+import './utils2-BqfluBM6.js';
+
+const PERMISSIONS_SCHEMA = z.array(
+  z.enum(ALL_ORG_PERMISSIONS)
+);
+const PatchSchema = z.object({
+  role: OrgRoleSchema.optional(),
+  permissions: PERMISSIONS_SCHEMA.optional()
+}).refine((b) => b.role !== void 0 || b.permissions !== void 0, {
+  message: "Provide at least one of role, permissions"
+});
+const PATCH = async ({ params, request, locals }) => {
+  const { orgId, userId } = params;
+  if (!orgId || !userId) throw error(400, "Missing org ID or user ID");
+  requireManageOrgMembers(locals);
+  const ctx = locals.ctx;
+  if (ctx.actingOrgId !== orgId) {
+    throw error(403, "Acting org does not match the target org.");
+  }
+  const body = await request.json().catch(() => null);
+  const parsed = PatchSchema.safeParse(body);
+  if (!parsed.success) throwZodError(parsed.error);
+  const patch = parsed.data;
+  const orgs = getOrganizationProvider();
+  const [actorMember, target] = await Promise.all([
+    orgs.getOrgMember(ctx, orgId, ctx.userId),
+    orgs.getOrgMember(ctx, orgId, userId)
+  ]);
+  if (!target) throw error(404, "Member not found in this organization.");
+  if (!actorMember) throw error(403, "You are not a member of this organization.");
+  if (patch.role !== void 0 && patch.role !== target.role) {
+    if (actorMember.role !== "owner") {
+      throw error(403, "Only the org owner can change roles.");
+    }
+    if (target.role === "owner" && patch.role !== "owner") {
+      const page = await orgs.listOrgMembers(ctx, orgId, { limit: 200 });
+      const otherOwners = page.items.filter(
+        (m) => m.role === "owner" && m.userId !== target.userId && !m.deletedAt
+      );
+      if (otherOwners.length === 0) {
+        throw error(
+          409,
+          "Cannot demote the sole owner of this organization. Promote another member to owner first."
+        );
+      }
+    }
+    await orgs.updateOrgMemberRole(ctx, orgId, userId, patch.role);
+  }
+  if (patch.permissions !== void 0) {
+    const effectiveRole = patch.role ?? target.role;
+    const valid = effectiveRole === "member" ? new Set(MEMBER_ASSIGNABLE_PERMISSIONS) : new Set(ALL_ORG_PERMISSIONS);
+    const invalid = patch.permissions.filter((p) => !valid.has(p));
+    if (invalid.length > 0) {
+      throw error(
+        400,
+        `Permissions [${invalid.join(", ")}] cannot be assigned to a ${effectiveRole}.`
+      );
+    }
+    try {
+      await orgs.updateOrgMemberPermissions(ctx, orgId, userId, patch.permissions);
+    } catch (err) {
+      handleApiError(err, "Failed to update permissions");
+    }
+  }
+  return json({ success: true });
+};
+
+export { PATCH };
+//# sourceMappingURL=_server.ts-CpsGzKQC.js.map

package/build/server/chunks/_server.ts-CpsGzKQC.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-CpsGzKQC.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/api/orgs/_orgId_/members/_userId_/_server.ts.js"],"sourcesContent":["import { error, json } from \"@sveltejs/kit\";\nimport { z } from \"zod\";\nimport { A as ALL_ORG_PERMISSIONS, e as OrgRoleSchema, M as MEMBER_ASSIGNABLE_PERMISSIONS } from \"../../../../../../../chunks/context.js\";\nimport { k as getOrganizationProvider } from \"../../../../../../../chunks/providers.server.js\";\nimport { y as requireManageOrgMembers } from \"../../../../../../../chunks/access.server.js\";\nimport { t as throwZodError, h as handleApiError } from \"../../../../../../../chunks/api-errors.js\";\nconst PERMISSIONS_SCHEMA = z.array(\n  z.enum(ALL_ORG_PERMISSIONS)\n);\nconst PatchSchema = z.object({\n  role: OrgRoleSchema.optional(),\n  permissions: PERMISSIONS_SCHEMA.optional()\n}).refine((b) => b.role !== void 0 || b.permissions !== void 0, {\n  message: \"Provide at least one of role, permissions\"\n});\nconst PATCH = async ({ params, request, locals }) => {\n  const { orgId, userId } = params;\n  if (!orgId || !userId) throw error(400, \"Missing org ID or user ID\");\n  requireManageOrgMembers(locals);\n  const ctx = locals.ctx;\n  if (ctx.actingOrgId !== orgId) {\n    throw error(403, \"Acting org does not match the target org.\");\n  }\n  const body = await request.json().catch(() => null);\n  const parsed = PatchSchema.safeParse(body);\n  if (!parsed.success) throwZodError(parsed.error);\n  const patch = parsed.data;\n  const orgs = getOrganizationProvider();\n  const [actorMember, target] = await Promise.all([\n    orgs.getOrgMember(ctx, orgId, ctx.userId),\n    orgs.getOrgMember(ctx, orgId, userId)\n  ]);\n  if (!target) throw error(404, \"Member not found in this organization.\");\n  if (!actorMember) throw error(403, \"You are not a member of this organization.\");\n  if (patch.role !== void 0 && patch.role !== target.role) {\n    if (actorMember.role !== \"owner\") {\n      throw error(403, \"Only the org owner can change roles.\");\n    }\n    if (target.role === \"owner\" && patch.role !== \"owner\") {\n      const page = await orgs.listOrgMembers(ctx, orgId, { limit: 200 });\n      const otherOwners = page.items.filter(\n        (m) => m.role === \"owner\" && m.userId !== target.userId && !m.deletedAt\n      );\n      if (otherOwners.length === 0) {\n        throw error(\n          409,\n          \"Cannot demote the sole owner of this organization. Promote another member to owner first.\"\n        );\n      }\n    }\n    await orgs.updateOrgMemberRole(ctx, orgId, userId, patch.role);\n  }\n  if (patch.permissions !== void 0) {\n    const effectiveRole = patch.role ?? target.role;\n    const valid = effectiveRole === \"member\" ? new Set(MEMBER_ASSIGNABLE_PERMISSIONS) : new Set(ALL_ORG_PERMISSIONS);\n    const invalid = patch.permissions.filter((p) => !valid.has(p));\n    if (invalid.length > 0) {\n      throw error(\n        400,\n        `Permissions [${invalid.join(\", \")}] cannot be assigned to a ${effectiveRole}.`\n      );\n    }\n    try {\n      await orgs.updateOrgMemberPermissions(ctx, orgId, userId, patch.permissions);\n    } catch (err) {\n      handleApiError(err, \"Failed to update permissions\");\n    }\n  }\n  return json({ success: true });\n};\nexport {\n  PATCH\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAMA,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK;AAClC,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB;AAC5B,CAAC;AACD,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;AAC7B,EAAE,IAAI,EAAE,aAAa,CAAC,QAAQ,EAAE;AAChC,EAAE,WAAW,EAAE,kBAAkB,CAAC,QAAQ;AAC1C,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,MAAM,EAAE;AAChE,EAAE,OAAO,EAAE;AACX,CAAC,CAAC;AACG,MAAC,KAAK,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AACrD,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM;AAClC,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,2BAA2B,CAAC;AACtE,EAAE,uBAAuB,CAAC,MAAM,CAAC;AACjC,EAAE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACxB,EAAE,IAAI,GAAG,CAAC,WAAW,KAAK,KAAK,EAAE;AACjC,IAAI,MAAM,KAAK,CAAC,GAAG,EAAE,2CAA2C,CAAC;AACjE,EAAE;AACF,EAAE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;AACrD,EAAE,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC;AAC5C,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AAClD,EAAE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI;AAC3B,EAAE,MAAM,IAAI,GAAG,uBAAuB,EAAE;AACxC,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AAClD,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC;AAC7C,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM;AACxC,GAAG,CAAC;AACJ,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,wCAAwC,CAAC;AACzE,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,4CAA4C,CAAC;AAClF,EAAE,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE;AAC3D,IAAI,IAAI,WAAW,CAAC,IAAI,KAAK,OAAO,EAAE;AACtC,MAAM,MAAM,KAAK,CAAC,GAAG,EAAE,sCAAsC,CAAC;AAC9D,IAAI;AACJ,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE;AAC3D,MAAM,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACxE,MAAM,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM;AAC3C,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;AACtE,OAAO;AACP,MAAM,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE;AACpC,QAAQ,MAAM,KAAK;AACnB,UAAU,GAAG;AACb,UAAU;AACV,SAAS;AACT,MAAM;AACN,IAAI;AACJ,IAAI,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;AAClE,EAAE;AACF,EAAE,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM,EAAE;AACpC,IAAI,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI;AACnD,IAAI,MAAM,KAAK,GAAG,aAAa,KAAK,QAAQ,GAAG,IAAI,GAAG,CAAC,6BAA6B,CAAC,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC;AACpH,IAAI,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAClE,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE;AAC5B,MAAM,MAAM,KAAK;AACjB,QAAQ,GAAG;AACX,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,0BAA0B,EAAE,aAAa,CAAC,CAAC;AACtF,OAAO;AACP,IAAI;AACJ,IAAI,IAAI;AACR,MAAM,MAAM,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC;AAClF,IAAI,CAAC,CAAC,OAAO,GAAG,EAAE;AAClB,MAAM,cAAc,CAAC,GAAG,EAAE,8BAA8B,CAAC;AACzD,IAAI;AACJ,EAAE;AACF,EAAE,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAChC;;;;"}

package/build/server/chunks/_server.ts-D2Qb9pui.js

@@ -0,0 +1,51 @@
+import { error } from '@sveltejs/kit';
+import { h as getDefinitionMeta, d as definitionPaths, p as getStorageProvider } from './providers.server-C3fQ7ZdV.js';
+import { G as GuidSchema } from './context-BJnJL8ES.js';
+import { s as requireCanViewProject } from './access.server-CAPd1-c2.js';
+import './shared-server-C3WdcJCQ.js';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:crypto';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import 'zod';
+import './api-errors-BhVEeWTV.js';
+import '@selvajs/compute/core';
+import './utils2-BqfluBM6.js';
+
+const ALLOWED_EXTENSIONS = {
+  ".webp": "image/webp",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".png": "image/png",
+  ".gif": "image/gif"
+};
+const COVER_PATH_PATTERN = /^definitions\/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\/cover\.([a-z]+)$/i;
+const GET = async ({ params, locals }) => {
+  const storagePath = params.path;
+  if (!storagePath) throw error(400, "Missing path");
+  const match = COVER_PATH_PATTERN.exec(storagePath);
+  if (!match) throw error(404, "File not found");
+  const [, guid, rawExt] = match;
+  const ext = `.${rawExt.toLowerCase()}`;
+  if (!ALLOWED_EXTENSIONS[ext]) throw error(404, "File not found");
+  const guidParsed = GuidSchema.safeParse(guid);
+  if (!guidParsed.success) throw error(404, "File not found");
+  if (!locals.ctx) throw error(401, "Unauthorized");
+  const record = await getDefinitionMeta().get(locals.ctx, guidParsed.data);
+  if (!record) throw error(404, "File not found");
+  await requireCanViewProject(locals, record.projectId);
+  const canonicalPath = definitionPaths.image(guidParsed.data);
+  const bytes = await getStorageProvider().get(canonicalPath);
+  if (!bytes) throw error(404, "File not found");
+  return new Response(Buffer.from(bytes), {
+    headers: {
+      "Content-Type": ALLOWED_EXTENSIONS[ext],
+      "Cache-Control": "private, max-age=3600"
+    }
+  });
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts-D2Qb9pui.js.map

package/build/server/chunks/_server.ts-D2Qb9pui.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-D2Qb9pui.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/api/files/_...path_/_server.ts.js"],"sourcesContent":["import { error } from \"@sveltejs/kit\";\nimport { h as getDefinitionMeta, d as definitionPaths, p as getStorageProvider } from \"../../../../../chunks/providers.server.js\";\nimport { G as GuidSchema } from \"../../../../../chunks/context.js\";\nimport { s as requireCanViewProject } from \"../../../../../chunks/access.server.js\";\nconst ALLOWED_EXTENSIONS = {\n  \".webp\": \"image/webp\",\n  \".jpg\": \"image/jpeg\",\n  \".jpeg\": \"image/jpeg\",\n  \".png\": \"image/png\",\n  \".gif\": \"image/gif\"\n};\nconst COVER_PATH_PATTERN = /^definitions\\/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\\/cover\\.([a-z]+)$/i;\nconst GET = async ({ params, locals }) => {\n  const storagePath = params.path;\n  if (!storagePath) throw error(400, \"Missing path\");\n  const match = COVER_PATH_PATTERN.exec(storagePath);\n  if (!match) throw error(404, \"File not found\");\n  const [, guid, rawExt] = match;\n  const ext = `.${rawExt.toLowerCase()}`;\n  if (!ALLOWED_EXTENSIONS[ext]) throw error(404, \"File not found\");\n  const guidParsed = GuidSchema.safeParse(guid);\n  if (!guidParsed.success) throw error(404, \"File not found\");\n  if (!locals.ctx) throw error(401, \"Unauthorized\");\n  const record = await getDefinitionMeta().get(locals.ctx, guidParsed.data);\n  if (!record) throw error(404, \"File not found\");\n  await requireCanViewProject(locals, record.projectId);\n  const canonicalPath = definitionPaths.image(guidParsed.data);\n  const bytes = await getStorageProvider().get(canonicalPath);\n  if (!bytes) throw error(404, \"File not found\");\n  return new Response(Buffer.from(bytes), {\n    headers: {\n      \"Content-Type\": ALLOWED_EXTENSIONS[ext],\n      \"Cache-Control\": \"private, max-age=3600\"\n    }\n  });\n};\nexport {\n  GET\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAIA,MAAM,kBAAkB,GAAG;AAC3B,EAAE,OAAO,EAAE,YAAY;AACvB,EAAE,MAAM,EAAE,YAAY;AACtB,EAAE,OAAO,EAAE,YAAY;AACvB,EAAE,MAAM,EAAE,WAAW;AACrB,EAAE,MAAM,EAAE;AACV,CAAC;AACD,MAAM,kBAAkB,GAAG,iGAAiG;AACvH,MAAC,GAAG,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AAC1C,EAAE,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI;AACjC,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC;AACpD,EAAE,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC;AACpD,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC;AAChD,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC,GAAG,KAAK;AAChC,EAAE,MAAM,GAAG,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;AACxC,EAAE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC;AAClE,EAAE,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC;AAC/C,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC;AAC7D,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC;AACnD,EAAE,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC;AAC3E,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC;AACjD,EAAE,MAAM,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC;AACvD,EAAE,MAAM,aAAa,GAAG,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;AAC9D,EAAE,MAAM,KAAK,GAAG,MAAM,kBAAkB,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC;AAC7D,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC;AAChD,EAAE,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;AAC1C,IAAI,OAAO,EAAE;AACb,MAAM,cAAc,EAAE,kBAAkB,CAAC,GAAG,CAAC;AAC7C,MAAM,eAAe,EAAE;AACvB;AACA,GAAG,CAAC;AACJ;;;;"}

package/build/server/chunks/_server.ts-DEBzt_W2.js

@@ -0,0 +1,86 @@
+import { json, error } from '@sveltejs/kit';
+import { c as getComputeServerConfigStore } from './providers.server-C3fQ7ZdV.js';
+import { v as requireManageCompute } from './access.server-CAPd1-c2.js';
+import './context-BJnJL8ES.js';
+import { p as platformServers } from './utils2-BqfluBM6.js';
+import './shared-server-C3WdcJCQ.js';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:crypto';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import './api-errors-BhVEeWTV.js';
+import '@selvajs/compute/core';
+import 'zod';
+
+const GET = async ({ locals }) => {
+  requireManageCompute(locals);
+  try {
+    const config = await getComputeServerConfigStore().getConfig(locals.ctx);
+    const servers = platformServers(config).map(
+      ({ apiKey, ...rest }) => ({
+        ...rest,
+        hasApiKey: !!apiKey
+      })
+    );
+    return json({
+      servers,
+      defaultServerId: config.defaultServerId
+    });
+  } catch (err) {
+    console.error("[Compute GET] Failed:", err);
+    throw error(500, "Failed to load compute config");
+  }
+};
+const PUT = async ({ request, locals }) => {
+  requireManageCompute(locals);
+  const body = await request.json().catch(() => null);
+  if (!body || typeof body !== "object") throw error(400, "Invalid request body");
+  const incoming = body;
+  if (!Array.isArray(incoming.servers)) throw error(400, "servers must be an array");
+  for (const s of incoming.servers) {
+    if (!s.id || typeof s.id !== "string") throw error(400, "Each server needs an id");
+    if (!s.label || typeof s.label !== "string") throw error(400, "Each server needs a label");
+    if (!s.serverUrl || typeof s.serverUrl !== "string")
+      throw error(400, "Each server needs a serverUrl");
+    try {
+      new URL(s.serverUrl);
+    } catch {
+      throw error(400, `Invalid serverUrl: ${s.serverUrl}`);
+    }
+    if (s.sharedWith !== "all" && !Array.isArray(s.sharedWith)) {
+      throw error(400, 'sharedWith must be "all" or an array of org ids');
+    }
+    if (Array.isArray(s.sharedWith) && s.sharedWith.some((x) => typeof x !== "string")) {
+      throw error(400, "sharedWith array must contain strings");
+    }
+    if (s.apiKey !== void 0 && s.apiKey !== null && typeof s.apiKey !== "string")
+      throw error(400, "apiKey must be a string, null, or omitted");
+  }
+  if (incoming.defaultServerId) {
+    const found = incoming.servers.find((s) => s.id === incoming.defaultServerId);
+    if (!found) throw error(400, "defaultServerId must reference one of the submitted servers");
+  }
+  try {
+    const provider = getComputeServerConfigStore();
+    const existing = await provider.getConfig(locals.ctx);
+    const storedKeyById = new Map(platformServers(existing).map((s) => [s.id, s.apiKey]));
+    const next = incoming.servers.map(
+      ({ apiKey, sharedWith, ...rest }) => ({
+        ...rest,
+        scope: "platform",
+        sharedWith: sharedWith === "all" ? "all" : [...sharedWith],
+        apiKey: apiKey === null ? void 0 : apiKey ? apiKey : storedKeyById.get(rest.id)
+      })
+    );
+    await provider.savePlatformServers(locals.ctx, next, incoming.defaultServerId);
+    return new Response(null, { status: 204 });
+  } catch (err) {
+    console.error("[Compute PUT] Failed:", err);
+    throw error(500, "Failed to save compute config");
+  }
+};
+
+export { GET, PUT };
+//# sourceMappingURL=_server.ts-DEBzt_W2.js.map

package/build/server/chunks/_server.ts-DEBzt_W2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-DEBzt_W2.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/admin/api/compute/_server.ts.js"],"sourcesContent":["import { json, error } from \"@sveltejs/kit\";\nimport { c as getComputeServerConfigStore } from \"../../../../../chunks/providers.server.js\";\nimport { v as requireManageCompute } from \"../../../../../chunks/access.server.js\";\nimport \"../../../../../chunks/context.js\";\nimport { p as platformServers } from \"../../../../../chunks/utils2.js\";\nconst GET = async ({ locals }) => {\n  requireManageCompute(locals);\n  try {\n    const config = await getComputeServerConfigStore().getConfig(locals.ctx);\n    const servers = platformServers(config).map(\n      ({ apiKey, ...rest }) => ({\n        ...rest,\n        hasApiKey: !!apiKey\n      })\n    );\n    return json({\n      servers,\n      defaultServerId: config.defaultServerId\n    });\n  } catch (err) {\n    console.error(\"[Compute GET] Failed:\", err);\n    throw error(500, \"Failed to load compute config\");\n  }\n};\nconst PUT = async ({ request, locals }) => {\n  requireManageCompute(locals);\n  const body = await request.json().catch(() => null);\n  if (!body || typeof body !== \"object\") throw error(400, \"Invalid request body\");\n  const incoming = body;\n  if (!Array.isArray(incoming.servers)) throw error(400, \"servers must be an array\");\n  for (const s of incoming.servers) {\n    if (!s.id || typeof s.id !== \"string\") throw error(400, \"Each server needs an id\");\n    if (!s.label || typeof s.label !== \"string\") throw error(400, \"Each server needs a label\");\n    if (!s.serverUrl || typeof s.serverUrl !== \"string\")\n      throw error(400, \"Each server needs a serverUrl\");\n    try {\n      new URL(s.serverUrl);\n    } catch {\n      throw error(400, `Invalid serverUrl: ${s.serverUrl}`);\n    }\n    if (s.sharedWith !== \"all\" && !Array.isArray(s.sharedWith)) {\n      throw error(400, 'sharedWith must be \"all\" or an array of org ids');\n    }\n    if (Array.isArray(s.sharedWith) && s.sharedWith.some((x) => typeof x !== \"string\")) {\n      throw error(400, \"sharedWith array must contain strings\");\n    }\n    if (s.apiKey !== void 0 && s.apiKey !== null && typeof s.apiKey !== \"string\")\n      throw error(400, \"apiKey must be a string, null, or omitted\");\n  }\n  if (incoming.defaultServerId) {\n    const found = incoming.servers.find((s) => s.id === incoming.defaultServerId);\n    if (!found) throw error(400, \"defaultServerId must reference one of the submitted servers\");\n  }\n  try {\n    const provider = getComputeServerConfigStore();\n    const existing = await provider.getConfig(locals.ctx);\n    const storedKeyById = new Map(platformServers(existing).map((s) => [s.id, s.apiKey]));\n    const next = incoming.servers.map(\n      ({ apiKey, sharedWith, ...rest }) => ({\n        ...rest,\n        scope: \"platform\",\n        sharedWith: sharedWith === \"all\" ? \"all\" : [...sharedWith],\n        apiKey: apiKey === null ? void 0 : apiKey ? apiKey : storedKeyById.get(rest.id)\n      })\n    );\n    await provider.savePlatformServers(locals.ctx, next, incoming.defaultServerId);\n    return new Response(null, { status: 204 });\n  } catch (err) {\n    console.error(\"[Compute PUT] Failed:\", err);\n    throw error(500, \"Failed to save compute config\");\n  }\n};\nexport {\n  GET,\n  PUT\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAKK,MAAC,GAAG,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK;AAClC,EAAE,oBAAoB,CAAC,MAAM,CAAC;AAC9B,EAAE,IAAI;AACN,IAAI,MAAM,MAAM,GAAG,MAAM,2BAA2B,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC;AAC5E,IAAI,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,GAAG;AAC/C,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,MAAM;AAChC,QAAQ,GAAG,IAAI;AACf,QAAQ,SAAS,EAAE,CAAC,CAAC;AACrB,OAAO;AACP,KAAK;AACL,IAAI,OAAO,IAAI,CAAC;AAChB,MAAM,OAAO;AACb,MAAM,eAAe,EAAE,MAAM,CAAC;AAC9B,KAAK,CAAC;AACN,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC;AAC/C,IAAI,MAAM,KAAK,CAAC,GAAG,EAAE,+BAA+B,CAAC;AACrD,EAAE;AACF;AACK,MAAC,GAAG,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AAC3C,EAAE,oBAAoB,CAAC,MAAM,CAAC;AAC9B,EAAE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;AACrD,EAAE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,sBAAsB,CAAC;AACjF,EAAE,MAAM,QAAQ,GAAG,IAAI;AACvB,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,0BAA0B,CAAC;AACpF,EAAE,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE;AACpC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,yBAAyB,CAAC;AACtF,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,2BAA2B,CAAC;AAC9F,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;AACvD,MAAM,MAAM,KAAK,CAAC,GAAG,EAAE,+BAA+B,CAAC;AACvD,IAAI,IAAI;AACR,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1B,IAAI,CAAC,CAAC,MAAM;AACZ,MAAM,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,mBAAmB,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AAC3D,IAAI;AACJ,IAAI,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE;AAChE,MAAM,MAAM,KAAK,CAAC,GAAG,EAAE,iDAAiD,CAAC;AACzE,IAAI;AACJ,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE;AACxF,MAAM,MAAM,KAAK,CAAC,GAAG,EAAE,uCAAuC,CAAC;AAC/D,IAAI;AACJ,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;AAChF,MAAM,MAAM,KAAK,CAAC,GAAG,EAAE,2CAA2C,CAAC;AACnE,EAAE;AACF,EAAE,IAAI,QAAQ,CAAC,eAAe,EAAE;AAChC,IAAI,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,eAAe,CAAC;AACjF,IAAI,IAAI,CAAC,KAAK,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,6DAA6D,CAAC;AAC/F,EAAE;AACF,EAAE,IAAI;AACN,IAAI,MAAM,QAAQ,GAAG,2BAA2B,EAAE;AAClD,IAAI,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC;AACzD,IAAI,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AACzF,IAAI,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG;AACrC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,MAAM;AAC5C,QAAQ,GAAG,IAAI;AACf,QAAQ,KAAK,EAAE,UAAU;AACzB,QAAQ,UAAU,EAAE,UAAU,KAAK,KAAK,GAAG,KAAK,GAAG,CAAC,GAAG,UAAU,CAAC;AAClE,QAAQ,MAAM,EAAE,MAAM,KAAK,IAAI,GAAG,KAAK,CAAC,GAAG,MAAM,GAAG,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;AACtF,OAAO;AACP,KAAK;AACL,IAAI,MAAM,QAAQ,CAAC,mBAAmB,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,eAAe,CAAC;AAClF,IAAI,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC9C,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC;AAC/C,IAAI,MAAM,KAAK,CAAC,GAAG,EAAE,+BAA+B,CAAC;AACrD,EAAE;AACF;;;;"}

package/build/server/chunks/_server.ts-DRlwVsIx.js

@@ -0,0 +1,162 @@
+import { json } from '@sveltejs/kit';
+import { randomUUID } from 'node:crypto';
+import { mkdir, writeFile, unlink } from 'node:fs/promises';
+import { resolve, join } from 'node:path';
+import { p as private_env } from './shared-server-C3WdcJCQ.js';
+import './context-BJnJL8ES.js';
+import { f as findServerById } from './utils2-BqfluBM6.js';
+import { u as providers, L as LocalComputeServerStore, c as getComputeServerConfigStore } from './providers.server-C3fQ7ZdV.js';
+import { z as requirePermission } from './access.server-CAPd1-c2.js';
+import 'zod';
+import 'node:url';
+import 'node:fs';
+import '@supabase/supabase-js';
+import './api-errors-BhVEeWTV.js';
+import '@selvajs/compute/core';
+
+function atRestSecretsCheck(report) {
+  const base = { id: "at-rest-secrets", label: "Compute server secrets" };
+  if (report === null) {
+    return {
+      ...base,
+      status: "not_applicable",
+      summary: "The active data provider does not encrypt secrets at this layer — nothing to verify."
+    };
+  }
+  if (report.ok) {
+    return {
+      ...base,
+      status: "ok",
+      summary: "All stored compute server API keys decrypt under the current SELVA_AT_REST_KEY."
+    };
+  }
+  const failed = report.failures.map((f) => `"${f.serverLabel}" (${f.reason}${f.cause ? `: ${f.cause}` : ""})`).join(", ");
+  const plaintext = report.plaintextFound;
+  return {
+    ...base,
+    status: "degraded",
+    summary: `${report.failures.length} compute server key(s) could not be loaded: ${failed}.`,
+    remediation: plaintext ? "A key is stored in plaintext on disk — re-enter it via /admin/compute so it is encrypted." : "The stored ciphertext does not match the current SELVA_AT_REST_KEY (rotated key or restored backup). Re-enter the affected keys via /admin/compute, or restore the original SELVA_AT_REST_KEY, then run this check again."
+  };
+}
+const COMPUTE_PING_TIMEOUT_MS = 8e3;
+async function computeReachabilityCheck(locals) {
+  const base = { id: "compute-reachable", label: "Default compute server" };
+  let config;
+  try {
+    config = await getComputeServerConfigStore().getConfig(locals.ctx);
+  } catch (err) {
+    return {
+      ...base,
+      status: "error",
+      summary: `Could not read compute config: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  const server = config.defaultServerId ? findServerById(config, config.defaultServerId) : void 0;
+  if (!server) {
+    return {
+      ...base,
+      status: "not_applicable",
+      summary: "No default compute server is configured — nothing to reach.",
+      remediation: "Add a server and set it as default in /admin/compute."
+    };
+  }
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), COMPUTE_PING_TIMEOUT_MS);
+  try {
+    const headers = {};
+    if (server.apiKey) headers["RhinoComputeKey"] = server.apiKey;
+    const res = await fetch(new URL("/healthcheck", server.serverUrl).toString(), {
+      signal: controller.signal,
+      headers
+    });
+    if (res.ok) {
+      return { ...base, status: "ok", summary: `"${server.label}" answered /healthcheck (200).` };
+    }
+    return {
+      ...base,
+      status: "degraded",
+      summary: `"${server.label}" responded ${res.status} to /healthcheck.`,
+      remediation: res.status === 401 || res.status === 403 ? "Authentication rejected — verify the API key in /admin/compute." : "The server is reachable but unhealthy. Check the Rhino.Compute host."
+    };
+  } catch (err) {
+    const aborted = err instanceof Error && err.name === "AbortError";
+    return {
+      ...base,
+      status: "degraded",
+      summary: aborted ? `"${server.label}" did not respond within ${COMPUTE_PING_TIMEOUT_MS / 1e3}s.` : `"${server.label}" is unreachable: ${err instanceof Error ? err.message : String(err)}.`,
+      remediation: `Confirm the Rhino.Compute host is running and ${server.serverUrl} is correct.`
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function dataPathWritableCheck() {
+  const base = { id: "data-path-writable", label: "Data path writable" };
+  if (!(providers.data.computeServer instanceof LocalComputeServerStore)) {
+    return {
+      ...base,
+      status: "not_applicable",
+      summary: "The active data provider does not persist to a local DATA_PATH."
+    };
+  }
+  const dataPath = private_env.DATA_PATH;
+  if (!dataPath) {
+    return {
+      ...base,
+      status: "error",
+      summary: "DATA_PATH is unset but the local provider is active.",
+      remediation: "Set DATA_PATH in .env and restart."
+    };
+  }
+  const absolute = resolve(dataPath);
+  const probe = join(absolute, `.health-probe-${randomUUID()}`);
+  try {
+    await mkdir(absolute, { recursive: true });
+    await writeFile(probe, "ok");
+    await unlink(probe);
+    return { ...base, status: "ok", summary: `DATA_PATH (${dataPath}) is writable.` };
+  } catch (err) {
+    return {
+      ...base,
+      status: "degraded",
+      summary: `DATA_PATH (${dataPath}) is not writable: ${err instanceof Error ? err.message : String(err)}.`,
+      remediation: "Check free disk space and that the directory is owned by the user running the app (`df -h`, `ls -la`)."
+    };
+  }
+}
+const GET = async ({ locals }) => {
+  requirePermission(locals, "instance_admin");
+  const checks = [];
+  const store = providers.data.computeServer;
+  if (store instanceof LocalComputeServerStore) {
+    try {
+      checks.push(atRestSecretsCheck(await store.verifySecrets()));
+    } catch (err) {
+      checks.push({
+        id: "at-rest-secrets",
+        label: "Compute server secrets",
+        status: "error",
+        summary: `Verification threw: ${err instanceof Error ? err.message : String(err)}`,
+        remediation: "Check server logs (`pm2 logs selva-compute`) for the underlying error."
+      });
+    }
+  } else {
+    checks.push(atRestSecretsCheck(null));
+  }
+  checks.push(...await Promise.all([computeReachabilityCheck(locals), dataPathWritableCheck()]));
+  const rank = {
+    ok: 0,
+    not_applicable: 0,
+    degraded: 2,
+    error: 3
+  };
+  const overall = checks.reduce(
+    (worst, c) => rank[c.status] > rank[worst] ? c.status : worst,
+    "ok"
+  );
+  return json({ overall, checkedAt: (/* @__PURE__ */ new Date()).toISOString(), checks });
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts-DRlwVsIx.js.map