@selvajs/selva 4.4.0 → 4.5.1

package/build/server/chunks/{api-errors-BckwXK7Q.js → api-errors-BrqxD-El.js}

@@ -1,8 +1,8 @@
-import { error } from '@sveltejs/kit';
+import { error, isHttpError } from '@sveltejs/kit';
 import './context-BJnJL8ES.js';
-import { P as ProviderError, c as getComputeServerConfigStore } from './providers.server-BYk2ehLM.js';
+import { P as ProviderError, c as getComputeServerConfigStore } from './providers.server-C3fQ7ZdV.js';
 import { camelcaseKeys } from '@selvajs/compute/core';
-import { r as resolveServerForOrg$1 } from './utils2-UQQTHTw-.js';
+import { r as resolveServerForOrg$1 } from './utils2-BqfluBM6.js';
 
 class SchemaExtractionError extends Error {
   constructor(kind, message) {
@@ -61,8 +61,39 @@ async function resolveServerForOrg(ctx, orgId, opts = {}) {
     throw new ComputeServerUnconfiguredError(err instanceof Error ? err.message : void 0);
   }
 }
-function isSvelteKitError(err) {
-  return !!err && typeof err === "object" && "status" in err && "body" in err;
+const ApiErrorCode = {
+  VALIDATION_FAILED: "VALIDATION_FAILED",
+  UNAUTHORIZED: "UNAUTHORIZED",
+  FORBIDDEN: "FORBIDDEN",
+  NOT_FOUND: "NOT_FOUND",
+  CONFLICT: "CONFLICT",
+  UNPROCESSABLE: "UNPROCESSABLE",
+  COMPUTE_UNAVAILABLE: "COMPUTE_UNAVAILABLE",
+  SETUP_REQUIRED: "SETUP_REQUIRED",
+  INTERNAL: "INTERNAL"
+};
+function apiError(status, code, message, fields) {
+  throw error(status, fields ? { message, code, fields } : { message, code });
+}
+function codeForStatus(status) {
+  switch (status) {
+    case 400:
+      return ApiErrorCode.VALIDATION_FAILED;
+    case 401:
+      return ApiErrorCode.UNAUTHORIZED;
+    case 403:
+      return ApiErrorCode.FORBIDDEN;
+    case 404:
+      return ApiErrorCode.NOT_FOUND;
+    case 409:
+      return ApiErrorCode.CONFLICT;
+    case 422:
+      return ApiErrorCode.UNPROCESSABLE;
+    case 503:
+      return ApiErrorCode.COMPUTE_UNAVAILABLE;
+    default:
+      return ApiErrorCode.INTERNAL;
+  }
 }
 const UNIQUE_CONSTRAINT_MESSAGES = {
   projects_org_name_unique: "A project with that name already exists in this organization.",
@@ -77,25 +108,33 @@ function friendlyConstraintMessage(raw) {
   return null;
 }
 function handleApiError(err, fallback) {
-  if (isSvelteKitError(err)) throw err;
+  if (isHttpError(err)) throw err;
   if (err instanceof SchemaExtractionError) {
-    throw error(err.kind === "unreachable" ? 503 : 422, err.message);
+    if (err.kind === "unreachable") {
+      apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, err.message);
+    }
+    apiError(422, ApiErrorCode.UNPROCESSABLE, err.message);
   }
   if (err instanceof ComputeServerUnconfiguredError) {
-    throw error(503, err.message);
+    apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, err.message);
   }
   if (err instanceof ProviderError) {
     const friendly = friendlyConstraintMessage(err.message);
-    throw error(err.statusCode, friendly ?? err.message);
+    apiError(err.statusCode, codeForStatus(err.statusCode), friendly ?? err.message);
   }
   console.error(`[API] ${fallback}:`, err);
-  throw error(500, fallback);
+  apiError(500, ApiErrorCode.INTERNAL, fallback);
 }
 function throwZodError(err) {
-  const issue = err.issues[0];
-  const path = issue.path.length ? `${issue.path.join(".")}: ` : "";
-  throw error(400, `${path}${issue.message}`);
+  const fields = {};
+  for (const issue of err.issues) {
+    const key = issue.path.length ? issue.path.join(".") : "_";
+    if (!(key in fields)) fields[key] = issue.message;
+  }
+  const first = err.issues[0];
+  const path = first.path.length ? `${first.path.join(".")}: ` : "";
+  apiError(400, ApiErrorCode.VALIDATION_FAILED, `${path}${first.message}`, fields);
 }
 
-export { ComputeServerUnconfiguredError as C, fetchSchemaFromCompute as f, handleApiError as h, resolveServerForOrg as r, throwZodError as t };
-//# sourceMappingURL=api-errors-BckwXK7Q.js.map
+export { ApiErrorCode as A, ComputeServerUnconfiguredError as C, apiError as a, fetchSchemaFromCompute as f, handleApiError as h, resolveServerForOrg as r, throwZodError as t };
+//# sourceMappingURL=api-errors-BrqxD-El.js.map

package/build/server/chunks/api-errors-BrqxD-El.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-errors-BrqxD-El.js","sources":["../../../.svelte-kit/adapter-node/chunks/api-errors.js"],"sourcesContent":["import { error, isHttpError } from \"@sveltejs/kit\";\nimport \"./context.js\";\nimport { c as getComputeServerConfigStore, P as ProviderError } from \"./providers.server.js\";\nimport { camelcaseKeys } from \"@selvajs/compute/core\";\nimport { r as resolveServerForOrg$1 } from \"./utils2.js\";\nclass SchemaExtractionError extends Error {\n  constructor(kind, message) {\n    super(message);\n    this.kind = kind;\n    this.name = \"SchemaExtractionError\";\n  }\n  kind;\n}\nasync function fetchSchemaFromCompute(definitionBytes, server) {\n  const schemaUrl = new URL(\"/grasshopper/schema\", server.serverUrl).toString();\n  const formData = new FormData();\n  const blob = new Blob([new Uint8Array(definitionBytes)], { type: \"application/octet-stream\" });\n  formData.append(\"file\", blob, \"definition.gh\");\n  const headers = {};\n  if (server.apiKey) {\n    headers[\"RhinoComputeKey\"] = server.apiKey;\n  }\n  let response;\n  try {\n    response = await fetch(schemaUrl, { method: \"POST\", headers, body: formData });\n  } catch (err) {\n    throw new SchemaExtractionError(\n      \"unreachable\",\n      `Compute server is unreachable: ${err instanceof Error ? err.message : String(err)}`\n    );\n  }\n  if (!response.ok) {\n    throw new SchemaExtractionError(\n      \"unreachable\",\n      `Schema endpoint returned ${response.status}: ${response.statusText}`\n    );\n  }\n  const raw = await response.json();\n  const results = camelcaseKeys(Array.isArray(raw) ? raw : [raw]);\n  const schemas = results.flatMap((r) => r.schemas ?? []);\n  if (schemas.length === 0) {\n    throw new SchemaExtractionError(\n      \"invalid\",\n      'No schemas found in definition.\\n\\nIn Grasshopper, verify a Context Bake component with the output name \"Schema\" is present and wired to the solver.'\n    );\n  }\n  return schemas[0];\n}\nclass ComputeServerUnconfiguredError extends Error {\n  constructor(message = \"No compute server configured. Ask an admin to add one in /admin/compute.\") {\n    super(message);\n    this.name = \"ComputeServerUnconfiguredError\";\n  }\n}\nasync function resolveServerForOrg(ctx, orgId, opts = {}) {\n  const config = await getComputeServerConfigStore().getConfig(ctx);\n  try {\n    return resolveServerForOrg$1(config, orgId, { definitionPin: opts.definitionPin });\n  } catch (err) {\n    throw new ComputeServerUnconfiguredError(err instanceof Error ? err.message : void 0);\n  }\n}\nconst ApiErrorCode = {\n  VALIDATION_FAILED: \"VALIDATION_FAILED\",\n  UNAUTHORIZED: \"UNAUTHORIZED\",\n  FORBIDDEN: \"FORBIDDEN\",\n  NOT_FOUND: \"NOT_FOUND\",\n  CONFLICT: \"CONFLICT\",\n  UNPROCESSABLE: \"UNPROCESSABLE\",\n  COMPUTE_UNAVAILABLE: \"COMPUTE_UNAVAILABLE\",\n  SETUP_REQUIRED: \"SETUP_REQUIRED\",\n  INTERNAL: \"INTERNAL\"\n};\nfunction apiError(status, code, message, fields) {\n  throw error(status, fields ? { message, code, fields } : { message, code });\n}\nfunction codeForStatus(status) {\n  switch (status) {\n    case 400:\n      return ApiErrorCode.VALIDATION_FAILED;\n    case 401:\n      return ApiErrorCode.UNAUTHORIZED;\n    case 403:\n      return ApiErrorCode.FORBIDDEN;\n    case 404:\n      return ApiErrorCode.NOT_FOUND;\n    case 409:\n      return ApiErrorCode.CONFLICT;\n    case 422:\n      return ApiErrorCode.UNPROCESSABLE;\n    case 503:\n      return ApiErrorCode.COMPUTE_UNAVAILABLE;\n    default:\n      return ApiErrorCode.INTERNAL;\n  }\n}\nconst UNIQUE_CONSTRAINT_MESSAGES = {\n  projects_org_name_unique: \"A project with that name already exists in this organization.\",\n  projects_org_id_slug_key: \"A project with that name already exists in this organization.\",\n  orgs_slug_key: \"An organization with that slug already exists.\",\n  definitions_pkey: \"A definition with that ID already exists.\"\n};\nfunction friendlyConstraintMessage(raw) {\n  for (const [name, msg] of Object.entries(UNIQUE_CONSTRAINT_MESSAGES)) {\n    if (raw.includes(name)) return msg;\n  }\n  return null;\n}\nfunction handleApiError(err, fallback) {\n  if (isHttpError(err)) throw err;\n  if (err instanceof SchemaExtractionError) {\n    if (err.kind === \"unreachable\") {\n      apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, err.message);\n    }\n    apiError(422, ApiErrorCode.UNPROCESSABLE, err.message);\n  }\n  if (err instanceof ComputeServerUnconfiguredError) {\n    apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, err.message);\n  }\n  if (err instanceof ProviderError) {\n    const friendly = friendlyConstraintMessage(err.message);\n    apiError(err.statusCode, codeForStatus(err.statusCode), friendly ?? err.message);\n  }\n  console.error(`[API] ${fallback}:`, err);\n  apiError(500, ApiErrorCode.INTERNAL, fallback);\n}\nfunction throwZodError(err) {\n  const fields = {};\n  for (const issue of err.issues) {\n    const key = issue.path.length ? issue.path.join(\".\") : \"_\";\n    if (!(key in fields)) fields[key] = issue.message;\n  }\n  const first = err.issues[0];\n  const path = first.path.length ? `${first.path.join(\".\")}: ` : \"\";\n  apiError(400, ApiErrorCode.VALIDATION_FAILED, `${path}${first.message}`, fields);\n}\nexport {\n  ApiErrorCode as A,\n  ComputeServerUnconfiguredError as C,\n  apiError as a,\n  fetchSchemaFromCompute as f,\n  handleApiError as h,\n  resolveServerForOrg as r,\n  throwZodError as t\n};\n"],"names":[],"mappings":";;;;;;AAKA,MAAM,qBAAqB,SAAS,KAAK,CAAC;AAC1C,EAAE,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE;AAC7B,IAAI,KAAK,CAAC,OAAO,CAAC;AAClB,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI;AACpB,IAAI,IAAI,CAAC,IAAI,GAAG,uBAAuB;AACvC,EAAE;AACF,EAAE,IAAI;AACN;AACA,eAAe,sBAAsB,CAAC,eAAe,EAAE,MAAM,EAAE;AAC/D,EAAE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE;AAC/E,EAAE,MAAM,QAAQ,GAAG,IAAI,QAAQ,EAAE;AACjC,EAAE,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,CAAC,IAAI,UAAU,CAAC,eAAe,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC;AAChG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,eAAe,CAAC;AAChD,EAAE,MAAM,OAAO,GAAG,EAAE;AACpB,EAAE,IAAI,MAAM,CAAC,MAAM,EAAE;AACrB,IAAI,OAAO,CAAC,iBAAiB,CAAC,GAAG,MAAM,CAAC,MAAM;AAC9C,EAAE;AACF,EAAE,IAAI,QAAQ;AACd,EAAE,IAAI;AACN,IAAI,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAClF,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,MAAM,IAAI,qBAAqB;AACnC,MAAM,aAAa;AACnB,MAAM,CAAC,+BAA+B,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;AACzF,KAAK;AACL,EAAE;AACF,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;AACpB,IAAI,MAAM,IAAI,qBAAqB;AACnC,MAAM,aAAa;AACnB,MAAM,CAAC,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,UAAU,CAAC;AAC1E,KAAK;AACL,EAAE;AACF,EAAE,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE;AACnC,EAAE,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;AACjE,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;AACzD,EAAE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE;AAC5B,IAAI,MAAM,IAAI,qBAAqB;AACnC,MAAM,SAAS;AACf,MAAM;AACN,KAAK;AACL,EAAE;AACF,EAAE,OAAO,OAAO,CAAC,CAAC,CAAC;AACnB;AACA,MAAM,8BAA8B,SAAS,KAAK,CAAC;AACnD,EAAE,WAAW,CAAC,OAAO,GAAG,0EAA0E,EAAE;AACpG,IAAI,KAAK,CAAC,OAAO,CAAC;AAClB,IAAI,IAAI,CAAC,IAAI,GAAG,gCAAgC;AAChD,EAAE;AACF;AACA,eAAe,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE;AAC1D,EAAE,MAAM,MAAM,GAAG,MAAM,2BAA2B,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC;AACnE,EAAE,IAAI;AACN,IAAI,OAAO,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;AACtF,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,MAAM,IAAI,8BAA8B,CAAC,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC;AACzF,EAAE;AACF;AACK,MAAC,YAAY,GAAG;AACrB,EAAE,iBAAiB,EAAE,mBAAmB;AACxC,EAAE,YAAY,EAAE,cAAc;AAC9B,EAAE,SAAS,EAAE,WAAW;AACxB,EAAE,SAAS,EAAE,WAAW;AACxB,EAAE,QAAQ,EAAE,UAAU;AACtB,EAAE,aAAa,EAAE,eAAe;AAChC,EAAE,mBAAmB,EAAE,qBAAqB;AAC5C,EAAE,cAAc,EAAE,gBAAgB;AAClC,EAAE,QAAQ,EAAE;AACZ;AACA,SAAS,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE;AACjD,EAAE,MAAM,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC7E;AACA,SAAS,aAAa,CAAC,MAAM,EAAE;AAC/B,EAAE,QAAQ,MAAM;AAChB,IAAI,KAAK,GAAG;AACZ,MAAM,OAAO,YAAY,CAAC,iBAAiB;AAC3C,IAAI,KAAK,GAAG;AACZ,MAAM,OAAO,YAAY,CAAC,YAAY;AACtC,IAAI,KAAK,GAAG;AACZ,MAAM,OAAO,YAAY,CAAC,SAAS;AACnC,IAAI,KAAK,GAAG;AACZ,MAAM,OAAO,YAAY,CAAC,SAAS;AACnC,IAAI,KAAK,GAAG;AACZ,MAAM,OAAO,YAAY,CAAC,QAAQ;AAClC,IAAI,KAAK,GAAG;AACZ,MAAM,OAAO,YAAY,CAAC,aAAa;AACvC,IAAI,KAAK,GAAG;AACZ,MAAM,OAAO,YAAY,CAAC,mBAAmB;AAC7C,IAAI;AACJ,MAAM,OAAO,YAAY,CAAC,QAAQ;AAClC;AACA;AACA,MAAM,0BAA0B,GAAG;AACnC,EAAE,wBAAwB,EAAE,+DAA+D;AAC3F,EAAE,wBAAwB,EAAE,+DAA+D;AAC3F,EAAE,aAAa,EAAE,gDAAgD;AACjE,EAAE,gBAAgB,EAAE;AACpB,CAAC;AACD,SAAS,yBAAyB,CAAC,GAAG,EAAE;AACxC,EAAE,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,EAAE;AACxE,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG;AACtC,EAAE;AACF,EAAE,OAAO,IAAI;AACb;AACA,SAAS,cAAc,CAAC,GAAG,EAAE,QAAQ,EAAE;AACvC,EAAE,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG;AACjC,EAAE,IAAI,GAAG,YAAY,qBAAqB,EAAE;AAC5C,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,EAAE;AACpC,MAAM,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,GAAG,CAAC,OAAO,CAAC;AAClE,IAAI;AACJ,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC;AAC1D,EAAE;AACF,EAAE,IAAI,GAAG,YAAY,8BAA8B,EAAE;AACrD,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,GAAG,CAAC,OAAO,CAAC;AAChE,EAAE;AACF,EAAE,IAAI,GAAG,YAAY,aAAa,EAAE;AACpC,IAAI,MAAM,QAAQ,GAAG,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC;AAC3D,IAAI,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC;AACpF,EAAE;AACF,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;AAC1C,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC;AAChD;AACA,SAAS,aAAa,CAAC,GAAG,EAAE;AAC5B,EAAE,MAAM,MAAM,GAAG,EAAE;AACnB,EAAE,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE;AAClC,IAAI,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG;AAC9D,IAAI,IAAI,EAAE,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO;AACrD,EAAE;AACF,EAAE,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC7B,EAAE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE;AACnE,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC;AAClF;;;;"}

package/build/server/chunks/{auth-bootstrap.server-BOTw9HkY.js → auth-bootstrap.server-DKc9-3PR.js}

@@ -1,7 +1,7 @@
 import { p as private_env } from './shared-server-C3WdcJCQ.js';
 import { randomUUID } from 'node:crypto';
 import { S as SYSTEM_CONTEXT, a as ALL_PLATFORM_PERMISSIONS } from './context-BJnJL8ES.js';
-import { a as getAuthProvider, l as getPermissionStore, p as getTenancy, e as getDataProvider, k as getOrganizationProvider, n as getProjectProvider } from './providers.server-BYk2ehLM.js';
+import { a as getAuthProvider, l as getPermissionStore, q as getTenancy, e as getDataProvider, k as getOrganizationProvider, n as getProjectProvider } from './providers.server-C3fQ7ZdV.js';
 import { s as slugify } from './slug-BGuFQjqe.js';
 
 async function bootstrapUserSession(user) {
@@ -96,4 +96,4 @@ function wireHeaderAuthBootstrap() {
 }
 
 export { bootstrapUserSession as b, wireHeaderAuthBootstrap as w };
-//# sourceMappingURL=auth-bootstrap.server-BOTw9HkY.js.map
+//# sourceMappingURL=auth-bootstrap.server-DKc9-3PR.js.map

package/build/server/chunks/{auth-bootstrap.server-BOTw9HkY.js.map → auth-bootstrap.server-DKc9-3PR.js.map}

@@ -1 +1 @@
-{"version":3,"file":"auth-bootstrap.server-BOTw9HkY.js","sources":["../../../.svelte-kit/adapter-node/chunks/auth-bootstrap.server.js"],"sourcesContent":["import { p as private_env } from \"./shared-server.js\";\nimport { randomUUID } from \"node:crypto\";\nimport { S as SYSTEM_CONTEXT, a as ALL_PLATFORM_PERMISSIONS } from \"./context.js\";\nimport { e as getDataProvider, p as getTenancy, l as getPermissionStore, k as getOrganizationProvider, a as getAuthProvider, n as getProjectProvider } from \"./providers.server.js\";\nimport { s as slugify } from \"./slug.js\";\nasync function bootstrapUserSession(user) {\n  await getDataProvider().ensureUser(SYSTEM_CONTEXT, user.id);\n  const tenancy = getTenancy();\n  const perms = getPermissionStore();\n  const hasAdmin = await perms.hasInstanceAdmin(SYSTEM_CONTEXT);\n  let grantedAdminHere = false;\n  if (!hasAdmin) {\n    if (!shouldBootstrapAdmin(user, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, tenancy)) return;\n    await perms.set(SYSTEM_CONTEXT, user.id, [...ALL_PLATFORM_PERMISSIONS]);\n    grantedAdminHere = true;\n  }\n  if (tenancy !== \"single\") return;\n  const orgs = getOrganizationProvider();\n  const existing = await orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 });\n  if (existing.items.length > 0) return;\n  if (!grantedAdminHere) {\n    const userPerms = await perms.getFor(SYSTEM_CONTEXT, user.id);\n    if (!userPerms.includes(\"instance_admin\")) return;\n  }\n  await ensureSingleTenantDefaultOrg(user);\n}\nasync function ensureSingleTenantDefaultOrg(user) {\n  if (getTenancy() !== \"single\") return;\n  const orgs = getOrganizationProvider();\n  const existing = await orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 });\n  if (existing.items.length > 0) return;\n  const displayName = typeof user.metadata?.displayName === \"string\" ? user.metadata.displayName : void 0;\n  const orgName = displayName?.trim() || user.email?.split(\"@\")[0]?.trim() || \"Default\";\n  const slug = slugify(orgName).length >= 3 ? slugify(orgName) : \"default\";\n  const now = (/* @__PURE__ */ new Date()).toISOString();\n  const org = {\n    id: randomUUID(),\n    name: orgName,\n    slug,\n    ownerId: user.id,\n    createdBy: user.id,\n    updatedBy: user.id,\n    createdAt: now,\n    updatedAt: now,\n    deletedAt: null\n  };\n  await orgs.createOrg(SYSTEM_CONTEXT, org);\n  const projects = getProjectProvider();\n  const project = {\n    id: randomUUID(),\n    orgId: org.id,\n    name: \"Default\",\n    slug: \"default\",\n    visibility: \"public\",\n    ownerId: user.id,\n    createdBy: user.id,\n    updatedBy: user.id,\n    autoJoinOnUpload: false,\n    createdAt: now,\n    updatedAt: now,\n    deletedAt: null\n  };\n  await projects.createProject(SYSTEM_CONTEXT, project);\n}\nfunction shouldBootstrapAdmin(user, configuredEmail, mode) {\n  const expected = configuredEmail?.trim().toLowerCase();\n  if (mode === \"multi\" && !expected) return false;\n  if (!expected) return true;\n  const actual = user.email?.trim().toLowerCase();\n  return !!actual && actual === expected;\n}\nfunction shouldBootstrapUpn(upn, email, configuredEmail, mode) {\n  const expected = configuredEmail?.trim().toLowerCase();\n  if (mode === \"multi\" && !expected) return false;\n  if (!expected) return true;\n  const candidate = (email ?? upn).trim().toLowerCase();\n  return !!candidate && candidate === expected;\n}\nfunction wireHeaderAuthBootstrap() {\n  const auth = getAuthProvider();\n  if (!auth.proxyAuth) return;\n  if (typeof auth.setBootstrapAllowlistPolicy !== \"function\") {\n    if (private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL?.trim()) {\n      console.warn(\n        \"[selva] BOOTSTRAP_INSTANCE_ADMIN_EMAIL is set but the installed @selvajs/header-auth-provider does not expose setBootstrapAllowlistPolicy. Upgrade the provider, or hand-seed header-allowlist.json.\"\n      );\n    }\n    return;\n  }\n  auth.setBootstrapAllowlistPolicy(async ({ upn, email }) => {\n    const hasAdmin = await getPermissionStore().hasInstanceAdmin(SYSTEM_CONTEXT);\n    if (hasAdmin) return false;\n    return shouldBootstrapUpn(upn, email, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, getTenancy());\n  });\n}\nexport {\n  bootstrapUserSession as b,\n  wireHeaderAuthBootstrap as w\n};\n"],"names":[],"mappings":";;;;;;AAKA,eAAe,oBAAoB,CAAC,IAAI,EAAE;AAC1C,EAAE,MAAM,eAAe,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAC7D,EAAE,MAAM,OAAO,GAAG,UAAU,EAAE;AAC9B,EAAE,MAAM,KAAK,GAAG,kBAAkB,EAAE;AACpC,EAAE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,cAAc,CAAC;AAC/D,EAAE,IAAI,gBAAgB,GAAG,KAAK;AAC9B,EAAE,IAAI,CAAC,QAAQ,EAAE;AACjB,IAAI,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,WAAW,CAAC,8BAA8B,EAAE,OAAO,CAAC,EAAE;AAC1F,IAAI,MAAM,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,wBAAwB,CAAC,CAAC;AAC3E,IAAI,gBAAgB,GAAG,IAAI;AAC3B,EAAE;AACF,EAAE,IAAI,OAAO,KAAK,QAAQ,EAAE;AAC5B,EAAE,MAAM,IAAI,GAAG,uBAAuB,EAAE;AACxC,EAAE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AACpE,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;AACjC,EAAE,IAAI,CAAC,gBAAgB,EAAE;AACzB,IAAI,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AACjE,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE;AAC/C,EAAE;AACF,EAAE,MAAM,4BAA4B,CAAC,IAAI,CAAC;AAC1C;AACA,eAAe,4BAA4B,CAAC,IAAI,EAAE;AAClD,EAAE,IAAI,UAAU,EAAE,KAAK,QAAQ,EAAE;AACjC,EAAE,MAAM,IAAI,GAAG,uBAAuB,EAAE;AACxC,EAAE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AACpE,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;AACjC,EAAE,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,QAAQ,EAAE,WAAW,KAAK,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,GAAG,MAAM;AACzG,EAAE,MAAM,OAAO,GAAG,WAAW,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS;AACvF,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS;AAC1E,EAAE,MAAM,GAAG,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACxD,EAAE,MAAM,GAAG,GAAG;AACd,IAAI,EAAE,EAAE,UAAU,EAAE;AACpB,IAAI,IAAI,EAAE,OAAO;AACjB,IAAI,IAAI;AACR,IAAI,OAAO,EAAE,IAAI,CAAC,EAAE;AACpB,IAAI,SAAS,EAAE,IAAI,CAAC,EAAE;AACtB,IAAI,SAAS,EAAE,IAAI,CAAC,EAAE;AACtB,IAAI,SAAS,EAAE,GAAG;AAClB,IAAI,SAAS,EAAE,GAAG;AAClB,IAAI,SAAS,EAAE;AACf,GAAG;AACH,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,CAAC;AAC3C,EAAE,MAAM,QAAQ,GAAG,kBAAkB,EAAE;AACvC,EAAE,MAAM,OAAO,GAAG;AAClB,IAAI,EAAE,EAAE,UAAU,EAAE;AACpB,IAAI,KAAK,EAAE,GAAG,CAAC,EAAE;AACjB,IAAI,IAAI,EAAE,SAAS;AACnB,IAAI,IAAI,EAAE,SAAS;AACnB,IAAI,UAAU,EAAE,QAAQ;AACxB,IAAI,OAAO,EAAE,IAAI,CAAC,EAAE;AACpB,IAAI,SAAS,EAAE,IAAI,CAAC,EAAE;AACtB,IAAI,SAAS,EAAE,IAAI,CAAC,EAAE;AACtB,IAAI,gBAAgB,EAAE,KAAK;AAC3B,IAAI,SAAS,EAAE,GAAG;AAClB,IAAI,SAAS,EAAE,GAAG;AAClB,IAAI,SAAS,EAAE;AACf,GAAG;AACH,EAAE,MAAM,QAAQ,CAAC,aAAa,CAAC,cAAc,EAAE,OAAO,CAAC;AACvD;AACA,SAAS,oBAAoB,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE;AAC3D,EAAE,MAAM,QAAQ,GAAG,eAAe,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACxD,EAAE,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,KAAK;AACjD,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI;AAC5B,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACjD,EAAE,OAAO,CAAC,CAAC,MAAM,IAAI,MAAM,KAAK,QAAQ;AACxC;AACA,SAAS,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE;AAC/D,EAAE,MAAM,QAAQ,GAAG,eAAe,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACxD,EAAE,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,KAAK;AACjD,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI;AAC5B,EAAE,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACvD,EAAE,OAAO,CAAC,CAAC,SAAS,IAAI,SAAS,KAAK,QAAQ;AAC9C;AACA,SAAS,uBAAuB,GAAG;AACnC,EAAE,MAAM,IAAI,GAAG,eAAe,EAAE;AAChC,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;AACvB,EAAE,IAAI,OAAO,IAAI,CAAC,2BAA2B,KAAK,UAAU,EAAE;AAC9D,IAAI,IAAI,WAAW,CAAC,8BAA8B,EAAE,IAAI,EAAE,EAAE;AAC5D,MAAM,OAAO,CAAC,IAAI;AAClB,QAAQ;AACR,OAAO;AACP,IAAI;AACJ,IAAI;AACJ,EAAE;AACF,EAAE,IAAI,CAAC,2BAA2B,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK;AAC7D,IAAI,MAAM,QAAQ,GAAG,MAAM,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,cAAc,CAAC;AAChF,IAAI,IAAI,QAAQ,EAAE,OAAO,KAAK;AAC9B,IAAI,OAAO,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,CAAC,8BAA8B,EAAE,UAAU,EAAE,CAAC;AACnG,EAAE,CAAC,CAAC;AACJ;;;;"}
+{"version":3,"file":"auth-bootstrap.server-DKc9-3PR.js","sources":["../../../.svelte-kit/adapter-node/chunks/auth-bootstrap.server.js"],"sourcesContent":["import { p as private_env } from \"./shared-server.js\";\nimport { randomUUID } from \"node:crypto\";\nimport { S as SYSTEM_CONTEXT, a as ALL_PLATFORM_PERMISSIONS } from \"./context.js\";\nimport { e as getDataProvider, q as getTenancy, l as getPermissionStore, k as getOrganizationProvider, a as getAuthProvider, n as getProjectProvider } from \"./providers.server.js\";\nimport { s as slugify } from \"./slug.js\";\nasync function bootstrapUserSession(user) {\n  await getDataProvider().ensureUser(SYSTEM_CONTEXT, user.id);\n  const tenancy = getTenancy();\n  const perms = getPermissionStore();\n  const hasAdmin = await perms.hasInstanceAdmin(SYSTEM_CONTEXT);\n  let grantedAdminHere = false;\n  if (!hasAdmin) {\n    if (!shouldBootstrapAdmin(user, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, tenancy)) return;\n    await perms.set(SYSTEM_CONTEXT, user.id, [...ALL_PLATFORM_PERMISSIONS]);\n    grantedAdminHere = true;\n  }\n  if (tenancy !== \"single\") return;\n  const orgs = getOrganizationProvider();\n  const existing = await orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 });\n  if (existing.items.length > 0) return;\n  if (!grantedAdminHere) {\n    const userPerms = await perms.getFor(SYSTEM_CONTEXT, user.id);\n    if (!userPerms.includes(\"instance_admin\")) return;\n  }\n  await ensureSingleTenantDefaultOrg(user);\n}\nasync function ensureSingleTenantDefaultOrg(user) {\n  if (getTenancy() !== \"single\") return;\n  const orgs = getOrganizationProvider();\n  const existing = await orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 });\n  if (existing.items.length > 0) return;\n  const displayName = typeof user.metadata?.displayName === \"string\" ? user.metadata.displayName : void 0;\n  const orgName = displayName?.trim() || user.email?.split(\"@\")[0]?.trim() || \"Default\";\n  const slug = slugify(orgName).length >= 3 ? slugify(orgName) : \"default\";\n  const now = (/* @__PURE__ */ new Date()).toISOString();\n  const org = {\n    id: randomUUID(),\n    name: orgName,\n    slug,\n    ownerId: user.id,\n    createdBy: user.id,\n    updatedBy: user.id,\n    createdAt: now,\n    updatedAt: now,\n    deletedAt: null\n  };\n  await orgs.createOrg(SYSTEM_CONTEXT, org);\n  const projects = getProjectProvider();\n  const project = {\n    id: randomUUID(),\n    orgId: org.id,\n    name: \"Default\",\n    slug: \"default\",\n    visibility: \"public\",\n    ownerId: user.id,\n    createdBy: user.id,\n    updatedBy: user.id,\n    autoJoinOnUpload: false,\n    createdAt: now,\n    updatedAt: now,\n    deletedAt: null\n  };\n  await projects.createProject(SYSTEM_CONTEXT, project);\n}\nfunction shouldBootstrapAdmin(user, configuredEmail, mode) {\n  const expected = configuredEmail?.trim().toLowerCase();\n  if (mode === \"multi\" && !expected) return false;\n  if (!expected) return true;\n  const actual = user.email?.trim().toLowerCase();\n  return !!actual && actual === expected;\n}\nfunction shouldBootstrapUpn(upn, email, configuredEmail, mode) {\n  const expected = configuredEmail?.trim().toLowerCase();\n  if (mode === \"multi\" && !expected) return false;\n  if (!expected) return true;\n  const candidate = (email ?? upn).trim().toLowerCase();\n  return !!candidate && candidate === expected;\n}\nfunction wireHeaderAuthBootstrap() {\n  const auth = getAuthProvider();\n  if (!auth.proxyAuth) return;\n  if (typeof auth.setBootstrapAllowlistPolicy !== \"function\") {\n    if (private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL?.trim()) {\n      console.warn(\n        \"[selva] BOOTSTRAP_INSTANCE_ADMIN_EMAIL is set but the installed @selvajs/header-auth-provider does not expose setBootstrapAllowlistPolicy. Upgrade the provider, or hand-seed header-allowlist.json.\"\n      );\n    }\n    return;\n  }\n  auth.setBootstrapAllowlistPolicy(async ({ upn, email }) => {\n    const hasAdmin = await getPermissionStore().hasInstanceAdmin(SYSTEM_CONTEXT);\n    if (hasAdmin) return false;\n    return shouldBootstrapUpn(upn, email, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, getTenancy());\n  });\n}\nexport {\n  bootstrapUserSession as b,\n  wireHeaderAuthBootstrap as w\n};\n"],"names":[],"mappings":";;;;;;AAKA,eAAe,oBAAoB,CAAC,IAAI,EAAE;AAC1C,EAAE,MAAM,eAAe,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAC7D,EAAE,MAAM,OAAO,GAAG,UAAU,EAAE;AAC9B,EAAE,MAAM,KAAK,GAAG,kBAAkB,EAAE;AACpC,EAAE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,cAAc,CAAC;AAC/D,EAAE,IAAI,gBAAgB,GAAG,KAAK;AAC9B,EAAE,IAAI,CAAC,QAAQ,EAAE;AACjB,IAAI,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,WAAW,CAAC,8BAA8B,EAAE,OAAO,CAAC,EAAE;AAC1F,IAAI,MAAM,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,wBAAwB,CAAC,CAAC;AAC3E,IAAI,gBAAgB,GAAG,IAAI;AAC3B,EAAE;AACF,EAAE,IAAI,OAAO,KAAK,QAAQ,EAAE;AAC5B,EAAE,MAAM,IAAI,GAAG,uBAAuB,EAAE;AACxC,EAAE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AACpE,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;AACjC,EAAE,IAAI,CAAC,gBAAgB,EAAE;AACzB,IAAI,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AACjE,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE;AAC/C,EAAE;AACF,EAAE,MAAM,4BAA4B,CAAC,IAAI,CAAC;AAC1C;AACA,eAAe,4BAA4B,CAAC,IAAI,EAAE;AAClD,EAAE,IAAI,UAAU,EAAE,KAAK,QAAQ,EAAE;AACjC,EAAE,MAAM,IAAI,GAAG,uBAAuB,EAAE;AACxC,EAAE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AACpE,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;AACjC,EAAE,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,QAAQ,EAAE,WAAW,KAAK,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,GAAG,MAAM;AACzG,EAAE,MAAM,OAAO,GAAG,WAAW,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS;AACvF,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS;AAC1E,EAAE,MAAM,GAAG,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACxD,EAAE,MAAM,GAAG,GAAG;AACd,IAAI,EAAE,EAAE,UAAU,EAAE;AACpB,IAAI,IAAI,EAAE,OAAO;AACjB,IAAI,IAAI;AACR,IAAI,OAAO,EAAE,IAAI,CAAC,EAAE;AACpB,IAAI,SAAS,EAAE,IAAI,CAAC,EAAE;AACtB,IAAI,SAAS,EAAE,IAAI,CAAC,EAAE;AACtB,IAAI,SAAS,EAAE,GAAG;AAClB,IAAI,SAAS,EAAE,GAAG;AAClB,IAAI,SAAS,EAAE;AACf,GAAG;AACH,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,CAAC;AAC3C,EAAE,MAAM,QAAQ,GAAG,kBAAkB,EAAE;AACvC,EAAE,MAAM,OAAO,GAAG;AAClB,IAAI,EAAE,EAAE,UAAU,EAAE;AACpB,IAAI,KAAK,EAAE,GAAG,CAAC,EAAE;AACjB,IAAI,IAAI,EAAE,SAAS;AACnB,IAAI,IAAI,EAAE,SAAS;AACnB,IAAI,UAAU,EAAE,QAAQ;AACxB,IAAI,OAAO,EAAE,IAAI,CAAC,EAAE;AACpB,IAAI,SAAS,EAAE,IAAI,CAAC,EAAE;AACtB,IAAI,SAAS,EAAE,IAAI,CAAC,EAAE;AACtB,IAAI,gBAAgB,EAAE,KAAK;AAC3B,IAAI,SAAS,EAAE,GAAG;AAClB,IAAI,SAAS,EAAE,GAAG;AAClB,IAAI,SAAS,EAAE;AACf,GAAG;AACH,EAAE,MAAM,QAAQ,CAAC,aAAa,CAAC,cAAc,EAAE,OAAO,CAAC;AACvD;AACA,SAAS,oBAAoB,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE;AAC3D,EAAE,MAAM,QAAQ,GAAG,eAAe,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACxD,EAAE,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,KAAK;AACjD,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI;AAC5B,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACjD,EAAE,OAAO,CAAC,CAAC,MAAM,IAAI,MAAM,KAAK,QAAQ;AACxC;AACA,SAAS,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE;AAC/D,EAAE,MAAM,QAAQ,GAAG,eAAe,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACxD,EAAE,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,KAAK;AACjD,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI;AAC5B,EAAE,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACvD,EAAE,OAAO,CAAC,CAAC,SAAS,IAAI,SAAS,KAAK,QAAQ;AAC9C;AACA,SAAS,uBAAuB,GAAG;AACnC,EAAE,MAAM,IAAI,GAAG,eAAe,EAAE;AAChC,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;AACvB,EAAE,IAAI,OAAO,IAAI,CAAC,2BAA2B,KAAK,UAAU,EAAE;AAC9D,IAAI,IAAI,WAAW,CAAC,8BAA8B,EAAE,IAAI,EAAE,EAAE;AAC5D,MAAM,OAAO,CAAC,IAAI;AAClB,QAAQ;AACR,OAAO;AACP,IAAI;AACJ,IAAI;AACJ,EAAE;AACF,EAAE,IAAI,CAAC,2BAA2B,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK;AAC7D,IAAI,MAAM,QAAQ,GAAG,MAAM,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,cAAc,CAAC;AAChF,IAAI,IAAI,QAAQ,EAAE,OAAO,KAAK;AAC9B,IAAI,OAAO,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,CAAC,8BAA8B,EAAE,UAAU,EAAE,CAAC;AACnG,EAAE,CAAC,CAAC;AACJ;;;;"}

package/build/server/chunks/{bootHealth.server-BwEi-Qp8.js → bootHealth.server-IPXOSqqQ.js}

@@ -1,5 +1,5 @@
 import './context-BJnJL8ES.js';
-import { t as providers, L as LocalComputeServerStore } from './providers.server-BYk2ehLM.js';
+import { u as providers, L as LocalComputeServerStore } from './providers.server-C3fQ7ZdV.js';
 
 let cached = null;
 let inflight = null;
@@ -55,4 +55,4 @@ function isDegraded(report) {
 }
 
 export { getBootHealth as g, isDegraded as i };
-//# sourceMappingURL=bootHealth.server-BwEi-Qp8.js.map
+//# sourceMappingURL=bootHealth.server-IPXOSqqQ.js.map

package/build/server/chunks/{bootHealth.server-BwEi-Qp8.js.map → bootHealth.server-IPXOSqqQ.js.map}

@@ -1 +1 @@
-{"version":3,"file":"bootHealth.server-BwEi-Qp8.js","sources":["../../../.svelte-kit/adapter-node/chunks/bootHealth.server.js"],"sourcesContent":["import \"./context.js\";\nimport { t as providers, L as LocalComputeServerStore } from \"./providers.server.js\";\nlet cached = null;\nlet inflight = null;\nasync function run() {\n  let atRestSecrets = null;\n  const store = providers.data.computeServer;\n  if (store instanceof LocalComputeServerStore) {\n    try {\n      atRestSecrets = await store.verifySecrets();\n    } catch (err) {\n      console.error(\"[selva][boot] verifySecrets threw — treating as failure\", err);\n      atRestSecrets = {\n        ok: false,\n        plaintextFound: false,\n        failures: [\n          {\n            serverId: \"(unknown)\",\n            serverLabel: \"(unknown)\",\n            reason: \"key_mismatch\",\n            cause: err instanceof Error ? err.message : String(err)\n          }\n        ]\n      };\n    }\n  }\n  if (atRestSecrets && !atRestSecrets.ok) {\n    for (const f of atRestSecrets.failures) {\n      console.error(\n        `[selva][boot] compute server \"${f.serverLabel}\" (${f.serverId}): ${f.reason}${f.cause ? ` — ${f.cause}` : \"\"}`\n      );\n    }\n    console.error(\n      \"[selva][boot] At-rest secret verification failed. /api/health will return 503. Recover by re-entering the affected apiKeys via /admin/compute, or by restoring the original SELVA_AT_REST_KEY. See docs/Troubleshooting.md.\"\n    );\n  }\n  return {\n    checkedAt: (/* @__PURE__ */ new Date()).toISOString(),\n    atRestSecrets\n  };\n}\nfunction getBootHealth() {\n  if (cached) return Promise.resolve(cached);\n  if (inflight) return inflight;\n  inflight = run().then((result) => {\n    cached = result;\n    inflight = null;\n    return result;\n  });\n  return inflight;\n}\nfunction isDegraded(report) {\n  return report.atRestSecrets !== null && !report.atRestSecrets.ok;\n}\nexport {\n  getBootHealth as g,\n  isDegraded as i\n};\n"],"names":[],"mappings":";;;AAEA,IAAI,MAAM,GAAG,IAAI;AACjB,IAAI,QAAQ,GAAG,IAAI;AACnB,eAAe,GAAG,GAAG;AACrB,EAAE,IAAI,aAAa,GAAG,IAAI;AAC1B,EAAE,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa;AAC5C,EAAE,IAAI,KAAK,YAAY,uBAAuB,EAAE;AAChD,IAAI,IAAI;AACR,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;AACjD,IAAI,CAAC,CAAC,OAAO,GAAG,EAAE;AAClB,MAAM,OAAO,CAAC,KAAK,CAAC,yDAAyD,EAAE,GAAG,CAAC;AACnF,MAAM,aAAa,GAAG;AACtB,QAAQ,EAAE,EAAE,KAAK;AACjB,QAAQ,cAAc,EAAE,KAAK;AAC7B,QAAQ,QAAQ,EAAE;AAClB,UAAU;AACV,YAAY,QAAQ,EAAE,WAAW;AACjC,YAAY,WAAW,EAAE,WAAW;AACpC,YAAY,MAAM,EAAE,cAAc;AAClC,YAAY,KAAK,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG;AAClE;AACA;AACA,OAAO;AACP,IAAI;AACJ,EAAE;AACF,EAAE,IAAI,aAAa,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE;AAC1C,IAAI,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,QAAQ,EAAE;AAC5C,MAAM,OAAO,CAAC,KAAK;AACnB,QAAQ,CAAC,8BAA8B,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC;AACtH,OAAO;AACP,IAAI;AACJ,IAAI,OAAO,CAAC,KAAK;AACjB,MAAM;AACN,KAAK;AACL,EAAE;AACF,EAAE,OAAO;AACT,IAAI,SAAS,EAAE,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACzD,IAAI;AACJ,GAAG;AACH;AACA,SAAS,aAAa,GAAG;AACzB,EAAE,IAAI,MAAM,EAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;AAC5C,EAAE,IAAI,QAAQ,EAAE,OAAO,QAAQ;AAC/B,EAAE,QAAQ,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK;AACpC,IAAI,MAAM,GAAG,MAAM;AACnB,IAAI,QAAQ,GAAG,IAAI;AACnB,IAAI,OAAO,MAAM;AACjB,EAAE,CAAC,CAAC;AACJ,EAAE,OAAO,QAAQ;AACjB;AACA,SAAS,UAAU,CAAC,MAAM,EAAE;AAC5B,EAAE,OAAO,MAAM,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE;AAClE;;;;"}
+{"version":3,"file":"bootHealth.server-IPXOSqqQ.js","sources":["../../../.svelte-kit/adapter-node/chunks/bootHealth.server.js"],"sourcesContent":["import \"./context.js\";\nimport { u as providers, L as LocalComputeServerStore } from \"./providers.server.js\";\nlet cached = null;\nlet inflight = null;\nasync function run() {\n  let atRestSecrets = null;\n  const store = providers.data.computeServer;\n  if (store instanceof LocalComputeServerStore) {\n    try {\n      atRestSecrets = await store.verifySecrets();\n    } catch (err) {\n      console.error(\"[selva][boot] verifySecrets threw — treating as failure\", err);\n      atRestSecrets = {\n        ok: false,\n        plaintextFound: false,\n        failures: [\n          {\n            serverId: \"(unknown)\",\n            serverLabel: \"(unknown)\",\n            reason: \"key_mismatch\",\n            cause: err instanceof Error ? err.message : String(err)\n          }\n        ]\n      };\n    }\n  }\n  if (atRestSecrets && !atRestSecrets.ok) {\n    for (const f of atRestSecrets.failures) {\n      console.error(\n        `[selva][boot] compute server \"${f.serverLabel}\" (${f.serverId}): ${f.reason}${f.cause ? ` — ${f.cause}` : \"\"}`\n      );\n    }\n    console.error(\n      \"[selva][boot] At-rest secret verification failed. /api/health will return 503. Recover by re-entering the affected apiKeys via /admin/compute, or by restoring the original SELVA_AT_REST_KEY. See docs/Troubleshooting.md.\"\n    );\n  }\n  return {\n    checkedAt: (/* @__PURE__ */ new Date()).toISOString(),\n    atRestSecrets\n  };\n}\nfunction getBootHealth() {\n  if (cached) return Promise.resolve(cached);\n  if (inflight) return inflight;\n  inflight = run().then((result) => {\n    cached = result;\n    inflight = null;\n    return result;\n  });\n  return inflight;\n}\nfunction isDegraded(report) {\n  return report.atRestSecrets !== null && !report.atRestSecrets.ok;\n}\nexport {\n  getBootHealth as g,\n  isDegraded as i\n};\n"],"names":[],"mappings":";;;AAEA,IAAI,MAAM,GAAG,IAAI;AACjB,IAAI,QAAQ,GAAG,IAAI;AACnB,eAAe,GAAG,GAAG;AACrB,EAAE,IAAI,aAAa,GAAG,IAAI;AAC1B,EAAE,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa;AAC5C,EAAE,IAAI,KAAK,YAAY,uBAAuB,EAAE;AAChD,IAAI,IAAI;AACR,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;AACjD,IAAI,CAAC,CAAC,OAAO,GAAG,EAAE;AAClB,MAAM,OAAO,CAAC,KAAK,CAAC,yDAAyD,EAAE,GAAG,CAAC;AACnF,MAAM,aAAa,GAAG;AACtB,QAAQ,EAAE,EAAE,KAAK;AACjB,QAAQ,cAAc,EAAE,KAAK;AAC7B,QAAQ,QAAQ,EAAE;AAClB,UAAU;AACV,YAAY,QAAQ,EAAE,WAAW;AACjC,YAAY,WAAW,EAAE,WAAW;AACpC,YAAY,MAAM,EAAE,cAAc;AAClC,YAAY,KAAK,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG;AAClE;AACA;AACA,OAAO;AACP,IAAI;AACJ,EAAE;AACF,EAAE,IAAI,aAAa,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE;AAC1C,IAAI,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,QAAQ,EAAE;AAC5C,MAAM,OAAO,CAAC,KAAK;AACnB,QAAQ,CAAC,8BAA8B,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC;AACtH,OAAO;AACP,IAAI;AACJ,IAAI,OAAO,CAAC,KAAK;AACjB,MAAM;AACN,KAAK;AACL,EAAE;AACF,EAAE,OAAO;AACT,IAAI,SAAS,EAAE,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACzD,IAAI;AACJ,GAAG;AACH;AACA,SAAS,aAAa,GAAG;AACzB,EAAE,IAAI,MAAM,EAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;AAC5C,EAAE,IAAI,QAAQ,EAAE,OAAO,QAAQ;AAC/B,EAAE,QAAQ,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK;AACpC,IAAI,MAAM,GAAG,MAAM;AACnB,IAAI,QAAQ,GAAG,IAAI;AACnB,IAAI,OAAO,MAAM;AACjB,EAAE,CAAC,CAAC;AACJ,EAAE,OAAO,QAAQ;AACjB;AACA,SAAS,UAAU,CAAC,MAAM,EAAE;AAC5B,EAAE,OAAO,MAAM,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE;AAClE;;;;"}

package/build/server/chunks/{computeLimits-DPO6NbLd.js → computeLimits-DnJ77wR9.js}

@@ -12,9 +12,9 @@ const MB = 1024 * 1024;
 const MAX_SOLVE_DURATION_MS = readPositiveInt("MAX_SOLVE_DURATION_MS", 1e5);
 const RATE_LIMIT_WINDOW_MS = readPositiveInt("COMPUTE_RATE_LIMIT_WINDOW_MS", 1e5);
 const RATE_LIMIT_MAX_REQUESTS = readPositiveInt("COMPUTE_RATE_LIMIT_MAX", 120);
-const MAX_GH_FILE_SIZE = readPositiveInt("MAX_GH_FILE_SIZE_BYTES", 50 * MB);
+const MAX_GH_FILE_SIZE = readPositiveInt("MAX_GH_FILE_SIZE_BYTES", 300 * MB);
 const MAX_IMAGE_FILE_SIZE = readPositiveInt("MAX_IMAGE_FILE_SIZE_BYTES", 10 * MB);
-const COMPUTE_REQUEST_MAX_BYTES = readPositiveInt("COMPUTE_REQUEST_MAX_BYTES", 210 * MB);
+const COMPUTE_REQUEST_MAX_BYTES = readPositiveInt("COMPUTE_REQUEST_MAX_BYTES", 300 * MB);
 const COMPUTE_RESPONSE_MAX_BYTES = readPositiveInt("COMPUTE_RESPONSE_MAX_BYTES", 300 * MB);
 const REMOTE_DEFINITION_MAX_BYTES = MAX_GH_FILE_SIZE;
 const REMOTE_DEFINITION_FETCH_TIMEOUT_MS = readPositiveInt(
@@ -24,4 +24,4 @@ const REMOTE_DEFINITION_FETCH_TIMEOUT_MS = readPositiveInt(
 const DEFINITION_CACHE_TTL_MS = readPositiveInt("DEFINITION_CACHE_TTL_MS", 5 * 60 * 1e3);
 
 export { COMPUTE_REQUEST_MAX_BYTES as C, DEFINITION_CACHE_TTL_MS as D, MAX_GH_FILE_SIZE as M, RATE_LIMIT_MAX_REQUESTS as R, COMPUTE_RESPONSE_MAX_BYTES as a, MAX_IMAGE_FILE_SIZE as b, MAX_SOLVE_DURATION_MS as c, RATE_LIMIT_WINDOW_MS as d, REMOTE_DEFINITION_FETCH_TIMEOUT_MS as e, REMOTE_DEFINITION_MAX_BYTES as f };
-//# sourceMappingURL=computeLimits-DPO6NbLd.js.map
+//# sourceMappingURL=computeLimits-DnJ77wR9.js.map

package/build/server/chunks/computeLimits-DnJ77wR9.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"computeLimits-DnJ77wR9.js","sources":["../../../.svelte-kit/adapter-node/chunks/computeLimits.js"],"sourcesContent":["function readPositiveInt(name, fallback) {\n  const raw = process.env[name];\n  if (!raw) return fallback;\n  const parsed = Number(raw);\n  if (!Number.isFinite(parsed) || parsed <= 0) {\n    console.warn(`[computeLimits] Invalid ${name}=${raw}, falling back to ${fallback}`);\n    return fallback;\n  }\n  return Math.floor(parsed);\n}\nconst MB = 1024 * 1024;\nconst MAX_SOLVE_DURATION_MS = readPositiveInt(\"MAX_SOLVE_DURATION_MS\", 1e5);\nconst RATE_LIMIT_WINDOW_MS = readPositiveInt(\"COMPUTE_RATE_LIMIT_WINDOW_MS\", 1e5);\nconst RATE_LIMIT_MAX_REQUESTS = readPositiveInt(\"COMPUTE_RATE_LIMIT_MAX\", 120);\nconst MAX_GH_FILE_SIZE = readPositiveInt(\"MAX_GH_FILE_SIZE_BYTES\", 300 * MB);\nconst MAX_IMAGE_FILE_SIZE = readPositiveInt(\"MAX_IMAGE_FILE_SIZE_BYTES\", 10 * MB);\nconst COMPUTE_REQUEST_MAX_BYTES = readPositiveInt(\"COMPUTE_REQUEST_MAX_BYTES\", 300 * MB);\nconst COMPUTE_RESPONSE_MAX_BYTES = readPositiveInt(\"COMPUTE_RESPONSE_MAX_BYTES\", 300 * MB);\nconst REMOTE_DEFINITION_MAX_BYTES = MAX_GH_FILE_SIZE;\nconst REMOTE_DEFINITION_FETCH_TIMEOUT_MS = readPositiveInt(\n  \"REMOTE_DEFINITION_FETCH_TIMEOUT_MS\",\n  3e4\n);\nconst DEFINITION_CACHE_TTL_MS = readPositiveInt(\"DEFINITION_CACHE_TTL_MS\", 5 * 60 * 1e3);\nexport {\n  COMPUTE_REQUEST_MAX_BYTES as C,\n  DEFINITION_CACHE_TTL_MS as D,\n  MAX_GH_FILE_SIZE as M,\n  RATE_LIMIT_MAX_REQUESTS as R,\n  COMPUTE_RESPONSE_MAX_BYTES as a,\n  MAX_IMAGE_FILE_SIZE as b,\n  MAX_SOLVE_DURATION_MS as c,\n  RATE_LIMIT_WINDOW_MS as d,\n  REMOTE_DEFINITION_FETCH_TIMEOUT_MS as e,\n  REMOTE_DEFINITION_MAX_BYTES as f\n};\n"],"names":[],"mappings":"AAAA,SAAS,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE;AACzC,EAAE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;AAC/B,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,QAAQ;AAC3B,EAAE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC;AAC5B,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE;AAC/C,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,wBAAwB,EAAE,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC,CAAC;AACvF,IAAI,OAAO,QAAQ;AACnB,EAAE;AACF,EAAE,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;AAC3B;AACA,MAAM,EAAE,GAAG,IAAI,GAAG,IAAI;AACjB,MAAC,qBAAqB,GAAG,eAAe,CAAC,uBAAuB,EAAE,GAAG;AACrE,MAAC,oBAAoB,GAAG,eAAe,CAAC,8BAA8B,EAAE,GAAG;AAC3E,MAAC,uBAAuB,GAAG,eAAe,CAAC,wBAAwB,EAAE,GAAG;AACxE,MAAC,gBAAgB,GAAG,eAAe,CAAC,wBAAwB,EAAE,GAAG,GAAG,EAAE;AACtE,MAAC,mBAAmB,GAAG,eAAe,CAAC,2BAA2B,EAAE,EAAE,GAAG,EAAE;AAC3E,MAAC,yBAAyB,GAAG,eAAe,CAAC,2BAA2B,EAAE,GAAG,GAAG,EAAE;AAClF,MAAC,0BAA0B,GAAG,eAAe,CAAC,4BAA4B,EAAE,GAAG,GAAG,EAAE;AACpF,MAAC,2BAA2B,GAAG;AAC/B,MAAC,kCAAkC,GAAG,eAAe;AAC1D,EAAE,oCAAoC;AACtC,EAAE;AACF;AACK,MAAC,uBAAuB,GAAG,eAAe,CAAC,yBAAyB,EAAE,CAAC,GAAG,EAAE,GAAG,GAAG;;;;"}

package/build/server/chunks/{hooks.server-BHmZpgdz.js → hooks.server-BZKLAgww.js}

@@ -1,8 +1,8 @@
 import { redirect, isHttpError } from '@sveltejs/kit';
 import { S as SYSTEM_CONTEXT } from './context-BJnJL8ES.js';
-import { t as providers } from './providers.server-BYk2ehLM.js';
-import { g as getBootHealth } from './bootHealth.server-BwEi-Qp8.js';
-import { w as wireHeaderAuthBootstrap, b as bootstrapUserSession } from './auth-bootstrap.server-BOTw9HkY.js';
+import { u as providers } from './providers.server-C3fQ7ZdV.js';
+import { g as getBootHealth } from './bootHealth.server-IPXOSqqQ.js';
+import { w as wireHeaderAuthBootstrap, b as bootstrapUserSession } from './auth-bootstrap.server-DKc9-3PR.js';
 import { g as getRefreshToken, h as setSessionCookie, f as setRefreshCookie, b as clearRefreshCookie } from './admin-auth.server-45kKyH82.js';
 import 'zod';
 import './shared-server-C3WdcJCQ.js';
@@ -97,7 +97,7 @@ const handle = async ({ event, resolve }) => {
     if (await isFirstRun()) {
       if (isJsonApiRoute) {
         return applySecurityHeaders(
-          new Response(JSON.stringify({ error: "Setup required" }), {
+          new Response(JSON.stringify({ message: "Setup required", code: "SETUP_REQUIRED" }), {
             status: 503,
             headers: { "Content-Type": "application/json" }
           }),
@@ -133,7 +133,7 @@ const handle = async ({ event, resolve }) => {
     if (!user) {
       if (isJsonApiRoute) {
         return applySecurityHeaders(
-          new Response(JSON.stringify({ error: "Unauthorized" }), {
+          new Response(JSON.stringify({ message: "Unauthorized", code: "UNAUTHORIZED" }), {
             status: 401,
             headers: { "Content-Type": "application/json" }
           }),
@@ -200,10 +200,11 @@ const handleError = ({
   event
 }) => {
   if (isHttpError(error)) {
-    return { message: error.body.message };
+    const body = error.body;
+    return { message: body.message, code: body.code, fields: body.fields };
   }
   if (status === 404) {
-    return { message: "Page not found." };
+    return { message: "Page not found.", code: "NOT_FOUND" };
   }
   const rendered = error instanceof Error ? error.stack ?? error.message : (() => {
     try {
@@ -218,8 +219,8 @@ const handleError = ({
     `[Unhandled error] ${event.request.method} ${event.url.pathname}
   ${rendered}${cause}`
   );
-  return { message: "An unexpected error occurred." };
+  return { message: "An unexpected error occurred.", code: "INTERNAL" };
 };
 
 export { handle, handleError, isPublicRoute, isStaticAsset };
-//# sourceMappingURL=hooks.server-BHmZpgdz.js.map
+//# sourceMappingURL=hooks.server-BZKLAgww.js.map

package/build/server/chunks/hooks.server-BZKLAgww.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.server-BZKLAgww.js","sources":["../../../.svelte-kit/adapter-node/entries/hooks.server.js"],"sourcesContent":["import { redirect, isHttpError } from \"@sveltejs/kit\";\nimport { S as SYSTEM_CONTEXT } from \"../chunks/context.js\";\nimport { u as providers } from \"../chunks/providers.server.js\";\nimport { g as getBootHealth } from \"../chunks/bootHealth.server.js\";\nimport { w as wireHeaderAuthBootstrap, b as bootstrapUserSession } from \"../chunks/auth-bootstrap.server.js\";\nimport { g as getRefreshToken, h as setSessionCookie, f as setRefreshCookie, b as clearRefreshCookie } from \"../chunks/admin-auth.server.js\";\nfunction emptyProfile(userId) {\n  return { userId, starredDefinitions: [], recentRuns: [] };\n}\nlet headerAuthBootstrapWired = false;\nlet bootHealthKicked = false;\nlet proxyAuthLoginMissWarned = false;\nlet firstRunResolved = false;\nasync function isFirstRun() {\n  if (firstRunResolved) return false;\n  const usersPage = await providers.auth.listUsers({ limit: 1 });\n  if (usersPage === null) {\n    firstRunResolved = true;\n    return false;\n  }\n  if (usersPage.items.length === 0) return true;\n  firstRunResolved = true;\n  return false;\n}\nasync function buildContext(user, sessionToken) {\n  let actingOrgId;\n  let orgPermissions = [];\n  const platformPermissions = await providers.data.permissions.getFor(SYSTEM_CONTEXT, user.id);\n  const membership = await providers.data.orgs.findUserMembership(SYSTEM_CONTEXT, user.id);\n  if (membership) {\n    actingOrgId = membership.org.id;\n    orgPermissions = membership.member.permissions;\n  }\n  if (!actingOrgId && platformPermissions.includes(\"instance_admin\")) {\n    const firstOrgPage = await providers.data.orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 });\n    const firstOrg = firstOrgPage.items[0];\n    if (firstOrg) actingOrgId = firstOrg.id;\n  }\n  return {\n    userId: user.id,\n    actingOrgId,\n    platformPermissions,\n    orgPermissions,\n    adapterContext: sessionToken ? { sessionToken } : void 0\n  };\n}\nconst PUBLIC_PAGE_ROUTES = /* @__PURE__ */ new Set([\n  \"/\",\n  // landing — guests see it; authed users get redirected by +page.server.ts\n  \"/login\",\n  \"/setup\",\n  \"/accept-invite\"\n]);\nconst PUBLIC_PATH_PREFIXES = [\"/auth/\", \"/logout\"];\nconst PUBLIC_API_ROUTES = /* @__PURE__ */ new Set([\"/api/health\"]);\nconst STATIC_ASSET_PREFIXES = [\"/_app/\", \"/favicon/\"];\nconst STATIC_ASSET_PATHS = /* @__PURE__ */ new Set([\"/favicon.svg\", \"/robots.txt\"]);\nfunction isStaticAsset(pathname) {\n  if (STATIC_ASSET_PATHS.has(pathname)) return true;\n  return STATIC_ASSET_PREFIXES.some((p) => pathname.startsWith(p));\n}\nfunction isPublicRoute(pathname) {\n  if (PUBLIC_PAGE_ROUTES.has(pathname)) return true;\n  if (PUBLIC_API_ROUTES.has(pathname)) return true;\n  return PUBLIC_PATH_PREFIXES.some((p) => pathname.startsWith(p));\n}\nconst handle = async ({ event, resolve }) => {\n  event.locals.providers = providers;\n  if (!headerAuthBootstrapWired) {\n    wireHeaderAuthBootstrap();\n    headerAuthBootstrapWired = true;\n  }\n  if (!bootHealthKicked) {\n    bootHealthKicked = true;\n    void getBootHealth();\n  }\n  const { pathname } = event.url;\n  if (isStaticAsset(pathname)) {\n    return applySecurityHeaders(await resolve(event), pathname);\n  }\n  if (pathname === \"/api/health\") {\n    return applySecurityHeaders(await resolve(event), pathname);\n  }\n  const publicRoute = isPublicRoute(pathname);\n  const isJsonApiRoute = pathname.startsWith(\"/api/\") || pathname.startsWith(\"/admin/api/\");\n  if (!publicRoute) {\n    if (await isFirstRun()) {\n      if (isJsonApiRoute) {\n        return applySecurityHeaders(\n          new Response(JSON.stringify({ message: \"Setup required\", code: \"SETUP_REQUIRED\" }), {\n            status: 503,\n            headers: { \"Content-Type\": \"application/json\" }\n          }),\n          pathname\n        );\n      }\n      redirect(303, \"/setup\");\n    }\n  }\n  const needsAuth = !publicRoute;\n  if (needsAuth) {\n    let token = event.cookies.get(\"admin_session\") ?? \"\";\n    let user = await providers.auth.verifyToken(token);\n    if (!user) {\n      const refreshToken = getRefreshToken(event.cookies);\n      const oauth = providers.auth.oauth;\n      if (refreshToken && oauth) {\n        const refreshed = await oauth.refreshSession(refreshToken);\n        if (refreshed) {\n          setSessionCookie(event.cookies, refreshed.sessionToken);\n          setRefreshCookie(event.cookies, refreshed.refreshToken);\n          token = refreshed.sessionToken;\n          user = await providers.auth.verifyToken(token);\n        } else {\n          clearRefreshCookie(event.cookies);\n        }\n      }\n    }\n    if (!user && providers.auth.proxyAuth) {\n      user = await providers.auth.proxyAuth.identifyFromHeaders(event.request.headers);\n      if (user) await bootstrapUserSession(user);\n    }\n    if (!user) {\n      if (isJsonApiRoute) {\n        return applySecurityHeaders(\n          new Response(JSON.stringify({ message: \"Unauthorized\", code: \"UNAUTHORIZED\" }), {\n            status: 401,\n            headers: { \"Content-Type\": \"application/json\" }\n          }),\n          pathname\n        );\n      }\n      redirect(303, `/login?redirectTo=${encodeURIComponent(pathname)}`);\n    }\n    await providers.data.ensureUser(SYSTEM_CONTEXT, user.id);\n    event.locals.user = user;\n    event.locals.profile = await providers.data.userProfile.getProfile(SYSTEM_CONTEXT, user.id) ?? emptyProfile(user.id);\n    event.locals.ctx = await buildContext(user, token);\n  } else {\n    const isPublicPage = PUBLIC_PAGE_ROUTES.has(pathname);\n    const token = isPublicPage ? event.cookies.get(\"admin_session\") ?? \"\" : \"\";\n    let user = token ? await providers.auth.verifyToken(token) : null;\n    if (!user && isPublicPage && providers.auth.proxyAuth) {\n      user = await providers.auth.proxyAuth.identifyFromHeaders(event.request.headers);\n      if (!user && pathname === \"/login\" && !proxyAuthLoginMissWarned) {\n        proxyAuthLoginMissWarned = true;\n        const proxyAuth = providers.auth.proxyAuth;\n        const noHeaders = proxyAuth.hasNoIdentityHeaders(event.request.headers);\n        const configured = proxyAuth.configuredHeaderNames.join(\", \");\n        if (noHeaders) {\n          console.warn(\n            `[HeaderAuth] /login was hit and NONE of the configured identity headers (${configured}) arrived on the request. The forward-auth proxy is not reaching this process, or it is not forwarding the configured headers. See the @selvajs/header-auth-provider README \"Verification\" section.`\n          );\n        } else {\n          console.warn(\n            `[HeaderAuth] /login was hit but the UPN header was missing or the user is not allowlisted. Configured headers: ${configured}. Some headers arrived but identification still failed — check that the UPN header is populated and that the user has been added to header-allowlist.json.`\n          );\n        }\n      }\n    }\n    if (user) {\n      await providers.data.ensureUser(SYSTEM_CONTEXT, user.id);\n      event.locals.user = user;\n      event.locals.profile = await providers.data.userProfile.getProfile(SYSTEM_CONTEXT, user.id) ?? emptyProfile(user.id);\n      event.locals.ctx = await buildContext(user, token);\n    }\n  }\n  return applySecurityHeaders(await resolve(event), pathname);\n};\nfunction applySecurityHeaders(response, pathname) {\n  response.headers.set(\"X-Content-Type-Options\", \"nosniff\");\n  response.headers.set(\"Referrer-Policy\", \"strict-origin-when-cross-origin\");\n  response.headers.set(\n    \"Permissions-Policy\",\n    \"accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()\"\n  );\n  if (process.env.NODE_ENV === \"production\") {\n    response.headers.set(\"Strict-Transport-Security\", \"max-age=31536000; includeSubDomains\");\n  }\n  if (pathname.startsWith(\"/_app/\")) {\n    response.headers.set(\"Cache-Control\", \"public, max-age=31536000, immutable\");\n  } else if (pathname.startsWith(\"/favicon/\") || pathname === \"/favicon.svg\" || pathname === \"/robots.txt\") {\n    response.headers.set(\"Cache-Control\", \"public, max-age=604800\");\n  }\n  return response;\n}\nconst handleError = ({\n  error,\n  status,\n  event\n}) => {\n  if (isHttpError(error)) {\n    const body = error.body;\n    return { message: body.message, code: body.code, fields: body.fields };\n  }\n  if (status === 404) {\n    return { message: \"Page not found.\", code: \"NOT_FOUND\" };\n  }\n  const rendered = error instanceof Error ? error.stack ?? error.message : (() => {\n    try {\n      return JSON.stringify(error);\n    } catch {\n      return String(error);\n    }\n  })();\n  const cause = error instanceof Error && error.cause ? `\n  caused by: ${error.cause}` : \"\";\n  console.error(\n    `[Unhandled error] ${event.request.method} ${event.url.pathname}\n  ${rendered}${cause}`\n  );\n  return { message: \"An unexpected error occurred.\", code: \"INTERNAL\" };\n};\nexport {\n  handle,\n  handleError,\n  isPublicRoute,\n  isStaticAsset\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAMA,SAAS,YAAY,CAAC,MAAM,EAAE;AAC9B,EAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;AAC3D;AACA,IAAI,wBAAwB,GAAG,KAAK;AACpC,IAAI,gBAAgB,GAAG,KAAK;AAC5B,IAAI,wBAAwB,GAAG,KAAK;AACpC,IAAI,gBAAgB,GAAG,KAAK;AAC5B,eAAe,UAAU,GAAG;AAC5B,EAAE,IAAI,gBAAgB,EAAE,OAAO,KAAK;AACpC,EAAE,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAChE,EAAE,IAAI,SAAS,KAAK,IAAI,EAAE;AAC1B,IAAI,gBAAgB,GAAG,IAAI;AAC3B,IAAI,OAAO,KAAK;AAChB,EAAE;AACF,EAAE,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,IAAI;AAC/C,EAAE,gBAAgB,GAAG,IAAI;AACzB,EAAE,OAAO,KAAK;AACd;AACA,eAAe,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE;AAChD,EAAE,IAAI,WAAW;AACjB,EAAE,IAAI,cAAc,GAAG,EAAE;AACzB,EAAE,MAAM,mBAAmB,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAC9F,EAAE,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAC1F,EAAE,IAAI,UAAU,EAAE;AAClB,IAAI,WAAW,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE;AACnC,IAAI,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW;AAClD,EAAE;AACF,EAAE,IAAI,CAAC,WAAW,IAAI,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE;AACtE,IAAI,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AACzF,IAAI,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1C,IAAI,IAAI,QAAQ,EAAE,WAAW,GAAG,QAAQ,CAAC,EAAE;AAC3C,EAAE;AACF,EAAE,OAAO;AACT,IAAI,MAAM,EAAE,IAAI,CAAC,EAAE;AACnB,IAAI,WAAW;AACf,IAAI,mBAAmB;AACvB,IAAI,cAAc;AAClB,IAAI,cAAc,EAAE,YAAY,GAAG,EAAE,YAAY,EAAE,GAAG;AACtD,GAAG;AACH;AACA,MAAM,kBAAkB,mBAAmB,IAAI,GAAG,CAAC;AACnD,EAAE,GAAG;AACL;AACA,EAAE,QAAQ;AACV,EAAE,QAAQ;AACV,EAAE;AACF,CAAC,CAAC;AACF,MAAM,oBAAoB,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC;AAClD,MAAM,iBAAiB,mBAAmB,IAAI,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC;AAClE,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC;AACrD,MAAM,kBAAkB,mBAAmB,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;AACnF,SAAS,aAAa,CAAC,QAAQ,EAAE;AACjC,EAAE,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI;AACnD,EAAE,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAClE;AACA,SAAS,aAAa,CAAC,QAAQ,EAAE;AACjC,EAAE,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI;AACnD,EAAE,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI;AAClD,EAAE,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AACjE;AACK,MAAC,MAAM,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;AAC7C,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,SAAS;AACpC,EAAE,IAAI,CAAC,wBAAwB,EAAE;AACjC,IAAI,uBAAuB,EAAE;AAC7B,IAAI,wBAAwB,GAAG,IAAI;AACnC,EAAE;AACF,EAAE,IAAI,CAAC,gBAAgB,EAAE;AACzB,IAAI,gBAAgB,GAAG,IAAI;AAC3B,IAAI,KAAK,aAAa,EAAE;AACxB,EAAE;AACF,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,GAAG;AAChC,EAAE,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE;AAC/B,IAAI,OAAO,oBAAoB,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;AAC/D,EAAE;AACF,EAAE,IAAI,QAAQ,KAAK,aAAa,EAAE;AAClC,IAAI,OAAO,oBAAoB,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;AAC/D,EAAE;AACF,EAAE,MAAM,WAAW,GAAG,aAAa,CAAC,QAAQ,CAAC;AAC7C,EAAE,MAAM,cAAc,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC;AAC3F,EAAE,IAAI,CAAC,WAAW,EAAE;AACpB,IAAI,IAAI,MAAM,UAAU,EAAE,EAAE;AAC5B,MAAM,IAAI,cAAc,EAAE;AAC1B,QAAQ,OAAO,oBAAoB;AACnC,UAAU,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,EAAE;AAC9F,YAAY,MAAM,EAAE,GAAG;AACvB,YAAY,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AACzD,WAAW,CAAC;AACZ,UAAU;AACV,SAAS;AACT,MAAM;AACN,MAAM,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;AAC7B,IAAI;AACJ,EAAE;AACF,EAAE,MAAM,SAAS,GAAG,CAAC,WAAW;AAChC,EAAE,IAAI,SAAS,EAAE;AACjB,IAAI,IAAI,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE;AACxD,IAAI,IAAI,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;AACtD,IAAI,IAAI,CAAC,IAAI,EAAE;AACf,MAAM,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC;AACzD,MAAM,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK;AACxC,MAAM,IAAI,YAAY,IAAI,KAAK,EAAE;AACjC,QAAQ,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,YAAY,CAAC;AAClE,QAAQ,IAAI,SAAS,EAAE;AACvB,UAAU,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,CAAC;AACjE,UAAU,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,CAAC;AACjE,UAAU,KAAK,GAAG,SAAS,CAAC,YAAY;AACxC,UAAU,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;AACxD,QAAQ,CAAC,MAAM;AACf,UAAU,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC;AAC3C,QAAQ;AACR,MAAM;AACN,IAAI;AACJ,IAAI,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE;AAC3C,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;AACtF,MAAM,IAAI,IAAI,EAAE,MAAM,oBAAoB,CAAC,IAAI,CAAC;AAChD,IAAI;AACJ,IAAI,IAAI,CAAC,IAAI,EAAE;AACf,MAAM,IAAI,cAAc,EAAE;AAC1B,QAAQ,OAAO,oBAAoB;AACnC,UAAU,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,EAAE;AAC1F,YAAY,MAAM,EAAE,GAAG;AACvB,YAAY,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AACzD,WAAW,CAAC;AACZ,UAAU;AACV,SAAS;AACT,MAAM;AACN,MAAM,QAAQ,CAAC,GAAG,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACxE,IAAI;AACJ,IAAI,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAC5D,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI;AAC5B,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;AACxH,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC;AACtD,EAAE,CAAC,MAAM;AACT,IAAI,MAAM,YAAY,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC;AACzD,IAAI,MAAM,KAAK,GAAG,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,EAAE;AAC9E,IAAI,IAAI,IAAI,GAAG,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,IAAI;AACrE,IAAI,IAAI,CAAC,IAAI,IAAI,YAAY,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE;AAC3D,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;AACtF,MAAM,IAAI,CAAC,IAAI,IAAI,QAAQ,KAAK,QAAQ,IAAI,CAAC,wBAAwB,EAAE;AACvE,QAAQ,wBAAwB,GAAG,IAAI;AACvC,QAAQ,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS;AAClD,QAAQ,MAAM,SAAS,GAAG,SAAS,CAAC,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;AAC/E,QAAQ,MAAM,UAAU,GAAG,SAAS,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;AACrE,QAAQ,IAAI,SAAS,EAAE;AACvB,UAAU,OAAO,CAAC,IAAI;AACtB,YAAY,CAAC,yEAAyE,EAAE,UAAU,CAAC,mMAAmM;AACtS,WAAW;AACX,QAAQ,CAAC,MAAM;AACf,UAAU,OAAO,CAAC,IAAI;AACtB,YAAY,CAAC,+GAA+G,EAAE,UAAU,CAAC,0JAA0J;AACnS,WAAW;AACX,QAAQ;AACR,MAAM;AACN,IAAI;AACJ,IAAI,IAAI,IAAI,EAAE;AACd,MAAM,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAC9D,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI;AAC9B,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;AAC1H,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC;AACxD,IAAI;AACJ,EAAE;AACF,EAAE,OAAO,oBAAoB,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;AAC7D;AACA,SAAS,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE;AAClD,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC;AAC3D,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,iCAAiC,CAAC;AAC5E,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG;AACtB,IAAI,oBAAoB;AACxB,IAAI;AACJ,GAAG;AACH,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE;AAC7C,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,qCAAqC,CAAC;AAC5F,EAAE;AACF,EAAE,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE;AACrC,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,qCAAqC,CAAC;AAChF,EAAE,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,QAAQ,KAAK,cAAc,IAAI,QAAQ,KAAK,aAAa,EAAE;AAC5G,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,wBAAwB,CAAC;AACnE,EAAE;AACF,EAAE,OAAO,QAAQ;AACjB;AACK,MAAC,WAAW,GAAG,CAAC;AACrB,EAAE,KAAK;AACP,EAAE,MAAM;AACR,EAAE;AACF,CAAC,KAAK;AACN,EAAE,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE;AAC1B,IAAI,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI;AAC3B,IAAI,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;AAC1E,EAAE;AACF,EAAE,IAAI,MAAM,KAAK,GAAG,EAAE;AACtB,IAAI,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE;AAC5D,EAAE;AACF,EAAE,MAAM,QAAQ,GAAG,KAAK,YAAY,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,MAAM;AAClF,IAAI,IAAI;AACR,MAAM,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;AAClC,IAAI,CAAC,CAAC,MAAM;AACZ,MAAM,OAAO,MAAM,CAAC,KAAK,CAAC;AAC1B,IAAI;AACJ,EAAE,CAAC,GAAG;AACN,EAAE,MAAM,KAAK,GAAG,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,KAAK,GAAG;AACxD,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE;AACjC,EAAE,OAAO,CAAC,KAAK;AACf,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ;AACnE,EAAE,EAAE,QAAQ,CAAC,EAAE,KAAK,CAAC;AACrB,GAAG;AACH,EAAE,OAAO,EAAE,OAAO,EAAE,+BAA+B,EAAE,IAAI,EAAE,UAAU,EAAE;AACvE;;;;"}

package/build/server/chunks/{package-CGdqH7nx.js → package-K5EkWw87.js}

@@ -1,5 +1,5 @@
 const name = "@selvajs/selva";
-const version = "4.4.0";
+const version = "4.5.1";
 const description = "Selva — self-contained Grasshopper-driven web app. Install, configure via .env, deploy.";
 const license = "MIT";
 const publishConfig = { "access": "public" };
@@ -26,4 +26,4 @@ const pkg = {
 };
 
 export { pkg as p };
-//# sourceMappingURL=package-CGdqH7nx.js.map
+//# sourceMappingURL=package-K5EkWw87.js.map

package/build/server/chunks/{package-CGdqH7nx.js.map → package-K5EkWw87.js.map}

@@ -1 +1 @@
-{"version":3,"file":"package-CGdqH7nx.js","sources":["../../../.svelte-kit/adapter-node/chunks/package.js"],"sourcesContent":["const name = \"@selvajs/selva\";\nconst version = \"4.4.0\";\nconst description = \"Selva — self-contained Grasshopper-driven web app. Install, configure via .env, deploy.\";\nconst license = \"MIT\";\nconst publishConfig = { \"access\": \"public\" };\nconst type = \"module\";\nconst main = \"./build/index.js\";\nconst files = [\"build\", \"templates\"];\nconst engines = { \"node\": \">=20.6.0\" };\nconst scripts = { \"dev\": \"vite dev\", \"build\": \"rimraf build && vite build && node ./scripts/generate-templates.js\", \"preview\": \"vite preview\", \"start\": \"node build/index.js\", \"clean\": \"rimraf build templates\", \"prepare\": \"svelte-kit sync || echo ''\", \"check\": \"svelte-kit sync && svelte-check --tsconfig ./tsconfig.json\", \"type-check\": \"tsc --noEmit\", \"test\": \"vitest run\", \"test:watch\": \"vitest\", \"test:e2e\": \"playwright test\" };\nconst dependencies = { \"@lucide/svelte\": \"catalog:\", \"@selvajs/compute\": \"catalog:\", \"@supabase/supabase-js\": \"^2.104.1\", \"@sveltejs/kit\": \"catalog:\", \"bits-ui\": \"^2.18.0\", \"clsx\": \"catalog:\", \"mode-watcher\": \"catalog:\", \"rhino3dm\": \"8.17.0\", \"sharp\": \"^0.34.5\", \"tailwind-merge\": \"catalog:\", \"tailwind-variants\": \"^3.2.2\", \"three\": \"catalog:\", \"zod\": \"^4.3.6\" };\nconst devDependencies = { \"@selvajs/config\": \"workspace:*\", \"@selvajs/header-auth-provider\": \"workspace:*\", \"@selvajs/local-provider\": \"workspace:*\", \"@selvajs/platform\": \"workspace:*\", \"@selvajs/schemas\": \"workspace:*\", \"@selvajs/supabase-provider\": \"workspace:*\", \"@selvajs/ui\": \"workspace:*\", \"@playwright/test\": \"catalog:\", \"@sveltejs/adapter-node\": \"^5.5.4\", \"@types/three\": \"catalog:\", \"rimraf\": \"catalog:\", \"tw-animate-css\": \"catalog:\", \"vitest\": \"catalog:\" };\nconst pkg = {\n  name,\n  version,\n  description,\n  license,\n  publishConfig,\n  type,\n  main,\n  files,\n  engines,\n  scripts,\n  dependencies,\n  devDependencies\n};\nexport {\n  pkg as p\n};\n"],"names":[],"mappings":"AAAA,MAAM,IAAI,GAAG,gBAAgB;AAC7B,MAAM,OAAO,GAAG,OAAO;AACvB,MAAM,WAAW,GAAG,yFAAyF;AAC7G,MAAM,OAAO,GAAG,KAAK;AACrB,MAAM,aAAa,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE;AAC5C,MAAM,IAAI,GAAG,QAAQ;AACrB,MAAM,IAAI,GAAG,kBAAkB;AAC/B,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC;AACpC,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE;AACtC,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,oEAAoE,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,wBAAwB,EAAE,SAAS,EAAE,4BAA4B,EAAE,OAAO,EAAE,4DAA4D,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,iBAAiB,EAAE;AAC7a,MAAM,YAAY,GAAG,EAAE,gBAAgB,EAAE,UAAU,EAAE,kBAAkB,EAAE,UAAU,EAAE,uBAAuB,EAAE,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,UAAU,EAAE,mBAAmB,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE;AAC1W,MAAM,eAAe,GAAG,EAAE,iBAAiB,EAAE,aAAa,EAAE,+BAA+B,EAAE,aAAa,EAAE,yBAAyB,EAAE,aAAa,EAAE,mBAAmB,EAAE,aAAa,EAAE,kBAAkB,EAAE,aAAa,EAAE,4BAA4B,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,kBAAkB,EAAE,UAAU,EAAE,wBAAwB,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE;AAC7c,MAAC,GAAG,GAAG;AACZ,EAAE,IAAI;AACN,EAAE,OAAO;AACT,EAAE,WAAW;AACb,EAAE,OAAO;AACT,EAAE,aAAa;AACf,EAAE,IAAI;AACN,EAAE,IAAI;AACN,EAAE,KAAK;AACP,EAAE,OAAO;AACT,EAAE,OAAO;AACT,EAAE,YAAY;AACd,EAAE;AACF;;;;"}
+{"version":3,"file":"package-K5EkWw87.js","sources":["../../../.svelte-kit/adapter-node/chunks/package.js"],"sourcesContent":["const name = \"@selvajs/selva\";\nconst version = \"4.5.1\";\nconst description = \"Selva — self-contained Grasshopper-driven web app. Install, configure via .env, deploy.\";\nconst license = \"MIT\";\nconst publishConfig = { \"access\": \"public\" };\nconst type = \"module\";\nconst main = \"./build/index.js\";\nconst files = [\"build\", \"templates\"];\nconst engines = { \"node\": \">=20.6.0\" };\nconst scripts = { \"dev\": \"vite dev\", \"build\": \"rimraf build && vite build && node ./scripts/generate-templates.js\", \"preview\": \"vite preview\", \"start\": \"node build/index.js\", \"clean\": \"rimraf build templates\", \"prepare\": \"svelte-kit sync || echo ''\", \"check\": \"svelte-kit sync && svelte-check --tsconfig ./tsconfig.json\", \"type-check\": \"tsc --noEmit\", \"test\": \"vitest run\", \"test:watch\": \"vitest\", \"test:e2e\": \"playwright test\" };\nconst dependencies = { \"@lucide/svelte\": \"catalog:\", \"@selvajs/compute\": \"catalog:\", \"@supabase/supabase-js\": \"^2.104.1\", \"@sveltejs/kit\": \"catalog:\", \"bits-ui\": \"^2.18.0\", \"clsx\": \"catalog:\", \"mode-watcher\": \"catalog:\", \"rhino3dm\": \"8.17.0\", \"sharp\": \"^0.34.5\", \"tailwind-merge\": \"catalog:\", \"tailwind-variants\": \"^3.2.2\", \"three\": \"catalog:\", \"zod\": \"^4.3.6\" };\nconst devDependencies = { \"@selvajs/config\": \"workspace:*\", \"@selvajs/header-auth-provider\": \"workspace:*\", \"@selvajs/local-provider\": \"workspace:*\", \"@selvajs/platform\": \"workspace:*\", \"@selvajs/schemas\": \"workspace:*\", \"@selvajs/supabase-provider\": \"workspace:*\", \"@selvajs/ui\": \"workspace:*\", \"@playwright/test\": \"catalog:\", \"@sveltejs/adapter-node\": \"^5.5.4\", \"@types/three\": \"catalog:\", \"rimraf\": \"catalog:\", \"tw-animate-css\": \"catalog:\", \"vitest\": \"catalog:\" };\nconst pkg = {\n  name,\n  version,\n  description,\n  license,\n  publishConfig,\n  type,\n  main,\n  files,\n  engines,\n  scripts,\n  dependencies,\n  devDependencies\n};\nexport {\n  pkg as p\n};\n"],"names":[],"mappings":"AAAA,MAAM,IAAI,GAAG,gBAAgB;AAC7B,MAAM,OAAO,GAAG,OAAO;AACvB,MAAM,WAAW,GAAG,yFAAyF;AAC7G,MAAM,OAAO,GAAG,KAAK;AACrB,MAAM,aAAa,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE;AAC5C,MAAM,IAAI,GAAG,QAAQ;AACrB,MAAM,IAAI,GAAG,kBAAkB;AAC/B,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC;AACpC,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE;AACtC,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,oEAAoE,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,wBAAwB,EAAE,SAAS,EAAE,4BAA4B,EAAE,OAAO,EAAE,4DAA4D,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,iBAAiB,EAAE;AAC7a,MAAM,YAAY,GAAG,EAAE,gBAAgB,EAAE,UAAU,EAAE,kBAAkB,EAAE,UAAU,EAAE,uBAAuB,EAAE,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,UAAU,EAAE,mBAAmB,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE;AAC1W,MAAM,eAAe,GAAG,EAAE,iBAAiB,EAAE,aAAa,EAAE,+BAA+B,EAAE,aAAa,EAAE,yBAAyB,EAAE,aAAa,EAAE,mBAAmB,EAAE,aAAa,EAAE,kBAAkB,EAAE,aAAa,EAAE,4BAA4B,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,kBAAkB,EAAE,UAAU,EAAE,wBAAwB,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE;AAC7c,MAAC,GAAG,GAAG;AACZ,EAAE,IAAI;AACN,EAAE,OAAO;AACT,EAAE,WAAW;AACb,EAAE,OAAO;AACT,EAAE,aAAa;AACf,EAAE,IAAI;AACN,EAAE,IAAI;AACN,EAAE,KAAK;AACP,EAAE,OAAO;AACT,EAAE,OAAO;AACT,EAAE,YAAY;AACd,EAAE;AACF;;;;"}

package/build/server/chunks/{permissions.server-D1KUdeD1.js → permissions.server-zs4XAJCp.js}

@@ -1,8 +1,8 @@
-import { l as getPermissionStore } from './providers.server-BYk2ehLM.js';
+import { l as getPermissionStore } from './providers.server-C3fQ7ZdV.js';
 
 async function setUserPlatformPermissions(ctx, userId, permissions) {
   return getPermissionStore().set(ctx, userId, permissions);
 }
 
 export { setUserPlatformPermissions as s };
-//# sourceMappingURL=permissions.server-D1KUdeD1.js.map
+//# sourceMappingURL=permissions.server-zs4XAJCp.js.map

package/build/server/chunks/{permissions.server-D1KUdeD1.js.map → permissions.server-zs4XAJCp.js.map}

@@ -1 +1 @@
-{"version":3,"file":"permissions.server-D1KUdeD1.js","sources":["../../../.svelte-kit/adapter-node/chunks/permissions.server.js"],"sourcesContent":["import { l as getPermissionStore } from \"./providers.server.js\";\nasync function setUserPlatformPermissions(ctx, userId, permissions) {\n  return getPermissionStore().set(ctx, userId, permissions);\n}\nexport {\n  setUserPlatformPermissions as s\n};\n"],"names":[],"mappings":";;AACA,eAAe,0BAA0B,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE;AACpE,EAAE,OAAO,kBAAkB,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC;AAC3D;;;;"}
+{"version":3,"file":"permissions.server-zs4XAJCp.js","sources":["../../../.svelte-kit/adapter-node/chunks/permissions.server.js"],"sourcesContent":["import { l as getPermissionStore } from \"./providers.server.js\";\nasync function setUserPlatformPermissions(ctx, userId, permissions) {\n  return getPermissionStore().set(ctx, userId, permissions);\n}\nexport {\n  setUserPlatformPermissions as s\n};\n"],"names":[],"mappings":";;AACA,eAAe,0BAA0B,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE;AACpE,EAAE,OAAO,kBAAkB,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC;AAC3D;;;;"}

package/build/server/chunks/{providers.server-BYk2ehLM.js → providers.server-C3fQ7ZdV.js}

@@ -79,6 +79,10 @@ class NoopEventSink {
   async emit(_event) {
   }
 }
+class NoopSolveMetricSink {
+  async record(_ctx, _metric) {
+  }
+}
 const nowIso = () => (/* @__PURE__ */ new Date()).toISOString();
 function auditUpdate(ctx, fallbackActor) {
   return {
@@ -3197,6 +3201,34 @@ class SupabaseEventSink {
     }
   }
 }
+class SupabaseSolveMetricSink {
+  constructor(clients) {
+    this.clients = clients;
+  }
+  clients;
+  async record(_ctx, metric) {
+    try {
+      const { error } = await this.clients.serviceClient.from("solve_metrics").insert({
+        actor_id: _ctx.userId || "system",
+        definition_url: metric.definitionUrl,
+        definition_id: metric.definitionId,
+        version_id: metric.versionId,
+        channel: metric.channel,
+        org_id: metric.orgId,
+        duration_ms: metric.durationMs,
+        ok: metric.ok,
+        failure_kind: metric.failureKind,
+        error_count: metric.errorCount,
+        warning_count: metric.warningCount
+      });
+      if (error) {
+        console.error("[SupabaseSolveMetricSink] insert failed:", error.message, { metric });
+      }
+    } catch (err) {
+      console.error("[SupabaseSolveMetricSink] unexpected error:", err, { metric });
+    }
+  }
+}
 const MAX_LIMIT = 200;
 const DEFAULT_LIMIT = 100;
 const ISO_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:?\d{2})$/;
@@ -3451,6 +3483,7 @@ const notImplementedGrantStore = {
 class SupabaseDataProvider {
   constructor(clients, events) {
     this.clients = clients;
+    this.solveMetrics = new SupabaseSolveMetricSink(clients);
     this.orgs = new SupabaseOrgStore(clients, events);
     this.projects = new SupabaseProjectStore(clients, events);
     this.definitions = new SupabaseDefinitionStore(clients, events);
@@ -3473,6 +3506,12 @@ class SupabaseDataProvider {
   permissions;
   platformProjectGrants;
   auditQuery;
+  /**
+   * Per-solve timing sink, built from the same client bundle. Exposed so the
+   * app's provider wiring can hand it to `SelvaConfig.solveMetrics` without
+   * constructing a second Supabase client.
+   */
+  solveMetrics;
   static fromEnv(env, events) {
     const supabaseUrl = env.SUPABASE_URL;
     const anonKey = env.SUPABASE_ANON_KEY;
@@ -4278,6 +4317,13 @@ function pickStorage(e) {
       throw new Error(`Unknown SELVA_STORAGE_PROVIDER="${choice}". Expected: local | supabase.`);
   }
 }
+function pickSolveMetrics(data) {
+  const candidate = data.solveMetrics;
+  if (candidate && typeof candidate.record === "function") {
+    return candidate;
+  }
+  return void 0;
+}
 function pickTenancy(e) {
   const choice = (e.SELVA_TENANCY ?? "single").toLowerCase();
   if (choice !== "single" && choice !== "multi") {
@@ -4285,25 +4331,29 @@ function pickTenancy(e) {
   }
   return choice;
 }
-const defaultConfig = defineConfig((e) => ({
-  tenancy: pickTenancy(e),
-  flags: {
-    ALLOW_CROSS_ORG_PUBLIC: envBool(e, "SELVA_FLAG_ALLOW_CROSS_ORG_PUBLIC"),
-    ALLOW_ORG_COMPUTE_OVERRIDE: envBool(e, "SELVA_FLAG_ALLOW_ORG_COMPUTE_OVERRIDE"),
-    ALLOW_ORG_CREATION: envBool(e, "SELVA_FLAG_ALLOW_ORG_CREATION"),
-    ENABLE_PLATFORM_PROJECTS: envBool(e, "SELVA_FLAG_ENABLE_PLATFORM_PROJECTS"),
-    ENABLE_SHARING: envBool(e, "SELVA_FLAG_ENABLE_SHARING")
-  },
-  branding: {
-    name: e.SELVA_BRAND_NAME,
-    copyrightName: e.SELVA_BRAND_COPYRIGHT_NAME,
-    tagline: e.SELVA_BRAND_TAGLINE,
-    description: e.SELVA_BRAND_DESCRIPTION
-  },
-  auth: pickAuth(e),
-  data: pickData(e),
-  storage: pickStorage(e)
-}));
+const defaultConfig = defineConfig((e) => {
+  const data = pickData(e);
+  return {
+    tenancy: pickTenancy(e),
+    flags: {
+      ALLOW_CROSS_ORG_PUBLIC: envBool(e, "SELVA_FLAG_ALLOW_CROSS_ORG_PUBLIC"),
+      ALLOW_ORG_COMPUTE_OVERRIDE: envBool(e, "SELVA_FLAG_ALLOW_ORG_COMPUTE_OVERRIDE"),
+      ALLOW_ORG_CREATION: envBool(e, "SELVA_FLAG_ALLOW_ORG_CREATION"),
+      ENABLE_PLATFORM_PROJECTS: envBool(e, "SELVA_FLAG_ENABLE_PLATFORM_PROJECTS"),
+      ENABLE_SHARING: envBool(e, "SELVA_FLAG_ENABLE_SHARING")
+    },
+    branding: {
+      name: e.SELVA_BRAND_NAME,
+      copyrightName: e.SELVA_BRAND_COPYRIGHT_NAME,
+      tagline: e.SELVA_BRAND_TAGLINE,
+      description: e.SELVA_BRAND_DESCRIPTION
+    },
+    auth: pickAuth(e),
+    data,
+    storage: pickStorage(e),
+    solveMetrics: pickSolveMetrics(data)
+  };
+});
 async function loadRawConfig() {
   const override = private_env.SELVA_CONFIG_PATH;
   if (!override) {
@@ -4391,9 +4441,16 @@ function getPermissionStore() {
 function getPlatformProjectGrantStore() {
   return resolveProviders().data.platformProjectGrants;
 }
+let _solveMetricSink;
+function getSolveMetricSink() {
+  if (!_solveMetricSink) {
+    _solveMetricSink = resolveProviders().solveMetrics ?? new NoopSolveMetricSink();
+  }
+  return _solveMetricSink;
+}
 function getAuditQuery() {
   return providers.data.auditQuery ?? null;
 }
 
-export { LocalComputeServerStore as L, MAX_PAGE_LIMIT as M, ProviderError as P, getAuthProvider as a, getBranding as b, getComputeServerConfigStore as c, definitionPaths as d, getDataProvider as e, flag as f, getAuditQuery as g, getDefinitionMeta as h, getDefinitionService as i, getInviteStore as j, getOrganizationProvider as k, getPermissionStore as l, getPlatformProjectGrantStore as m, getProjectProvider as n, getStorageProvider as o, getTenancy as p, getUserProfileStore as q, isOrgServer as r, isPlatformServer as s, providers as t };
-//# sourceMappingURL=providers.server-BYk2ehLM.js.map
+export { LocalComputeServerStore as L, MAX_PAGE_LIMIT as M, ProviderError as P, getAuthProvider as a, getBranding as b, getComputeServerConfigStore as c, definitionPaths as d, getDataProvider as e, flag as f, getAuditQuery as g, getDefinitionMeta as h, getDefinitionService as i, getInviteStore as j, getOrganizationProvider as k, getPermissionStore as l, getPlatformProjectGrantStore as m, getProjectProvider as n, getSolveMetricSink as o, getStorageProvider as p, getTenancy as q, getUserProfileStore as r, isOrgServer as s, isPlatformServer as t, providers as u };
+//# sourceMappingURL=providers.server-C3fQ7ZdV.js.map