@selvajs/selva 4.6.21-beta.0 → 4.7.0-beta.2

package/build/server/chunks/entries/endpoints/api/projects/_id_/{_server.ts.js-bIB33ABF.js.map → _server.ts.js-C6v2wqYB.js.map}

@@ -1 +1 @@
-{"version":3,"file":"_server.ts.js-bIB33ABF.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/projects/_id_/_server.ts.js"],"sourcesContent":["import { z } from \"zod\";\nimport { l as getProjectProvider, d as getOrganizationProvider } from \"../../../../../chunks/providers.server.js\";\nimport { q as requireCanManage, s as requireCanEditProjectSettings, w as withAdminBypass, t as canChangeVisibilityToPublic } from \"../../../../../chunks/access.server.js\";\nimport { a as apiError, h as handleApiError, t as throwZodError, A as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\nimport { s as slugify } from \"../../../../../chunks/slug.js\";\nimport { m as ProjectVisibilitySchema, v as validateProjectFlags } from \"../../../../../chunks/context.js\";\nconst UpdateProjectBody = z.object({\n  name: z.string().min(1).max(128).trim(),\n  description: z.string().max(2e3).nullish(),\n  visibility: ProjectVisibilitySchema,\n  autoJoinOnUpload: z.boolean()\n}).partial();\nconst PATCH = async ({ params, request, locals }) => {\n  const { id } = params;\n  if (!id) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing project ID\");\n  const { ctx, project: existing } = await requireCanEditProjectSettings(locals, id);\n  const body = await request.json().catch(() => null);\n  const parsed = UpdateProjectBody.safeParse(body);\n  if (!parsed.success) throwZodError(parsed.error);\n  if (parsed.data.visibility !== void 0 && parsed.data.visibility === \"public\" && existing.visibility !== \"public\") {\n    const orgMember = await getOrganizationProvider().getOrgMember(ctx, existing.orgId, ctx.userId);\n    const passes = withAdminBypass(\n      ctx.platformPermissions,\n      () => canChangeVisibilityToPublic({ orgMember })\n    );\n    if (!passes) {\n      apiError(403, ApiErrorCode.FORBIDDEN, \"Only org owners or admins can make a project public.\");\n    }\n  }\n  const mergedVisibility = parsed.data.visibility ?? existing.visibility;\n  const mergedAutoJoin = parsed.data.autoJoinOnUpload ?? existing.autoJoinOnUpload;\n  const flagIssues = validateProjectFlags({\n    visibility: mergedVisibility,\n    autoJoinOnUpload: mergedAutoJoin\n  });\n  if (flagIssues.length > 0) {\n    apiError(\n      400,\n      ApiErrorCode.VALIDATION_FAILED,\n      flagIssues.map((i) => `${i.path}: ${i.message}`).join(\"; \")\n    );\n  }\n  const patch = {};\n  if (parsed.data.name !== void 0) {\n    patch.name = parsed.data.name;\n    patch.slug = slugify(parsed.data.name);\n  }\n  if (parsed.data.description !== void 0) {\n    patch.description = parsed.data.description ?? void 0;\n  }\n  if (parsed.data.visibility !== void 0) patch.visibility = parsed.data.visibility;\n  if (parsed.data.autoJoinOnUpload !== void 0) {\n    patch.autoJoinOnUpload = parsed.data.autoJoinOnUpload;\n  }\n  try {\n    await getProjectProvider().updateProject(ctx, id, patch);\n    return new Response(null, { status: 204 });\n  } catch (err) {\n    handleApiError(err, \"Failed to update project\");\n  }\n};\nconst DELETE = async ({ params, locals }) => {\n  const { id } = params;\n  if (!id) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing project ID\");\n  await requireCanManage(locals, id);\n  const ctx = locals.ctx;\n  try {\n    await getProjectProvider().deleteProject(ctx, id);\n    return new Response(null, { status: 204 });\n  } catch (err) {\n    handleApiError(err, \"Failed to delete project\");\n  }\n};\nexport {\n  DELETE,\n  PATCH\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAMA,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;AACnC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;AACzC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE;AAC5C,EAAE,UAAU,EAAE,uBAAuB;AACrC,EAAE,gBAAgB,EAAE,CAAC,CAAC,OAAO;AAC7B,CAAC,CAAC,CAAC,OAAO,EAAE;AACP,MAAC,KAAK,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AACrD,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM;AACvB,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;AAC9E,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,6BAA6B,CAAC,MAAM,EAAE,EAAE,CAAC;AACpF,EAAE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;AACrD,EAAE,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC;AAClD,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AAClD,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,KAAK,QAAQ,EAAE;AACpH,IAAI,MAAM,SAAS,GAAG,MAAM,uBAAuB,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC;AACnG,IAAI,MAAM,MAAM,GAAG,eAAe;AAClC,MAAM,GAAG,CAAC,mBAAmB;AAC7B,MAAM,MAAM,2BAA2B,CAAC,EAAE,SAAS,EAAE;AACrD,KAAK;AACL,IAAI,IAAI,CAAC,MAAM,EAAE;AACjB,MAAM,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,sDAAsD,CAAC;AACnG,IAAI;AACJ,EAAE;AACF,EAAE,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU;AACxE,EAAE,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,QAAQ,CAAC,gBAAgB;AAClF,EAAE,MAAM,UAAU,GAAG,oBAAoB,CAAC;AAC1C,IAAI,UAAU,EAAE,gBAAgB;AAChC,IAAI,gBAAgB,EAAE;AACtB,GAAG,CAAC;AACJ,EAAE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE;AAC7B,IAAI,QAAQ;AACZ,MAAM,GAAG;AACT,MAAM,YAAY,CAAC,iBAAiB;AACpC,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI;AAChE,KAAK;AACL,EAAE;AACF,EAAE,MAAM,KAAK,GAAG,EAAE;AAClB,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE;AACnC,IAAI,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI;AACjC,IAAI,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;AAC1C,EAAE;AACF,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,MAAM,EAAE;AAC1C,IAAI,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,MAAM;AACzD,EAAE;AACF,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,MAAM,EAAE,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU;AAClF,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,gBAAgB,KAAK,MAAM,EAAE;AAC/C,IAAI,KAAK,CAAC,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB;AACzD,EAAE;AACF,EAAE,IAAI;AACN,IAAI,MAAM,kBAAkB,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC;AAC5D,IAAI,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC9C,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,cAAc,CAAC,GAAG,EAAE,0BAA0B,CAAC;AACnD,EAAE;AACF;AACK,MAAC,MAAM,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AAC7C,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM;AACvB,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;AAC9E,EAAE,MAAM,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC;AACpC,EAAE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACxB,EAAE,IAAI;AACN,IAAI,MAAM,kBAAkB,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,CAAC;AACrD,IAAI,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC9C,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,cAAc,CAAC,GAAG,EAAE,0BAA0B,CAAC;AACnD,EAAE;AACF;;;;"}
+{"version":3,"file":"_server.ts.js-C6v2wqYB.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/projects/_id_/_server.ts.js"],"sourcesContent":["import { z } from \"zod\";\nimport { m as getProjectProvider, e as getOrganizationProvider } from \"../../../../../chunks/providers.server.js\";\nimport { q as requireCanManage, s as requireCanEditProjectSettings, w as withAdminBypass, t as canChangeVisibilityToPublic } from \"../../../../../chunks/access.server.js\";\nimport { a as apiError, h as handleApiError, t as throwZodError, A as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\nimport { s as slugify } from \"../../../../../chunks/slug.js\";\nimport { m as ProjectVisibilitySchema, v as validateProjectFlags } from \"../../../../../chunks/context.js\";\nconst UpdateProjectBody = z.object({\n  name: z.string().min(1).max(128).trim(),\n  description: z.string().max(2e3).nullish(),\n  visibility: ProjectVisibilitySchema,\n  autoJoinOnUpload: z.boolean()\n}).partial();\nconst PATCH = async ({ params, request, locals }) => {\n  const { id } = params;\n  if (!id) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing project ID\");\n  const { ctx, project: existing } = await requireCanEditProjectSettings(locals, id);\n  const body = await request.json().catch(() => null);\n  const parsed = UpdateProjectBody.safeParse(body);\n  if (!parsed.success) throwZodError(parsed.error);\n  if (parsed.data.visibility !== void 0 && parsed.data.visibility === \"public\" && existing.visibility !== \"public\") {\n    const orgMember = await getOrganizationProvider().getOrgMember(ctx, existing.orgId, ctx.userId);\n    const passes = withAdminBypass(\n      ctx.platformPermissions,\n      () => canChangeVisibilityToPublic({ orgMember })\n    );\n    if (!passes) {\n      apiError(403, ApiErrorCode.FORBIDDEN, \"Only org owners or admins can make a project public.\");\n    }\n  }\n  const mergedVisibility = parsed.data.visibility ?? existing.visibility;\n  const mergedAutoJoin = parsed.data.autoJoinOnUpload ?? existing.autoJoinOnUpload;\n  const flagIssues = validateProjectFlags({\n    visibility: mergedVisibility,\n    autoJoinOnUpload: mergedAutoJoin\n  });\n  if (flagIssues.length > 0) {\n    apiError(\n      400,\n      ApiErrorCode.VALIDATION_FAILED,\n      flagIssues.map((i) => `${i.path}: ${i.message}`).join(\"; \")\n    );\n  }\n  const patch = {};\n  if (parsed.data.name !== void 0) {\n    patch.name = parsed.data.name;\n    patch.slug = slugify(parsed.data.name);\n  }\n  if (parsed.data.description !== void 0) {\n    patch.description = parsed.data.description ?? void 0;\n  }\n  if (parsed.data.visibility !== void 0) patch.visibility = parsed.data.visibility;\n  if (parsed.data.autoJoinOnUpload !== void 0) {\n    patch.autoJoinOnUpload = parsed.data.autoJoinOnUpload;\n  }\n  try {\n    await getProjectProvider().updateProject(ctx, id, patch);\n    return new Response(null, { status: 204 });\n  } catch (err) {\n    handleApiError(err, \"Failed to update project\");\n  }\n};\nconst DELETE = async ({ params, locals }) => {\n  const { id } = params;\n  if (!id) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing project ID\");\n  await requireCanManage(locals, id);\n  const ctx = locals.ctx;\n  try {\n    await getProjectProvider().deleteProject(ctx, id);\n    return new Response(null, { status: 204 });\n  } catch (err) {\n    handleApiError(err, \"Failed to delete project\");\n  }\n};\nexport {\n  DELETE,\n  PATCH\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAMA,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;AACnC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;AACzC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE;AAC5C,EAAE,UAAU,EAAE,uBAAuB;AACrC,EAAE,gBAAgB,EAAE,CAAC,CAAC,OAAO;AAC7B,CAAC,CAAC,CAAC,OAAO,EAAE;AACP,MAAC,KAAK,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AACrD,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM;AACvB,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;AAC9E,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,6BAA6B,CAAC,MAAM,EAAE,EAAE,CAAC;AACpF,EAAE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;AACrD,EAAE,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC;AAClD,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AAClD,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,KAAK,QAAQ,EAAE;AACpH,IAAI,MAAM,SAAS,GAAG,MAAM,uBAAuB,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC;AACnG,IAAI,MAAM,MAAM,GAAG,eAAe;AAClC,MAAM,GAAG,CAAC,mBAAmB;AAC7B,MAAM,MAAM,2BAA2B,CAAC,EAAE,SAAS,EAAE;AACrD,KAAK;AACL,IAAI,IAAI,CAAC,MAAM,EAAE;AACjB,MAAM,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,sDAAsD,CAAC;AACnG,IAAI;AACJ,EAAE;AACF,EAAE,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU;AACxE,EAAE,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,QAAQ,CAAC,gBAAgB;AAClF,EAAE,MAAM,UAAU,GAAG,oBAAoB,CAAC;AAC1C,IAAI,UAAU,EAAE,gBAAgB;AAChC,IAAI,gBAAgB,EAAE;AACtB,GAAG,CAAC;AACJ,EAAE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE;AAC7B,IAAI,QAAQ;AACZ,MAAM,GAAG;AACT,MAAM,YAAY,CAAC,iBAAiB;AACpC,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI;AAChE,KAAK;AACL,EAAE;AACF,EAAE,MAAM,KAAK,GAAG,EAAE;AAClB,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE;AACnC,IAAI,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI;AACjC,IAAI,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;AAC1C,EAAE;AACF,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,MAAM,EAAE;AAC1C,IAAI,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,MAAM;AACzD,EAAE;AACF,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,MAAM,EAAE,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU;AAClF,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,gBAAgB,KAAK,MAAM,EAAE;AAC/C,IAAI,KAAK,CAAC,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB;AACzD,EAAE;AACF,EAAE,IAAI;AACN,IAAI,MAAM,kBAAkB,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC;AAC5D,IAAI,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC9C,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,cAAc,CAAC,GAAG,EAAE,0BAA0B,CAAC;AACnD,EAAE;AACF;AACK,MAAC,MAAM,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AAC7C,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM;AACvB,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;AAC9E,EAAE,MAAM,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC;AACpC,EAAE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACxB,EAAE,IAAI;AACN,IAAI,MAAM,kBAAkB,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,CAAC;AACrD,IAAI,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC9C,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,cAAc,CAAC,GAAG,EAAE,0BAA0B,CAAC;AACnD,EAAE;AACF;;;;"}

package/build/server/chunks/entries/endpoints/api/projects/_id_/members/{_server.ts.js-B1AwpUGi.js → _server.ts.js-B3WPTw6C.js}

@@ -1,9 +1,9 @@
 import { json } from '@sveltejs/kit';
 import { z } from 'zod';
-import { e as getProjectProvider } from '../../../../../../chunks/providers.server.js-D0hpk-aq.js';
-import { u as requireCanManageMembers, v as requireTargetIsOrgMember } from '../../../../../../chunks/access.server.js-D99g5hZd.js';
-import { a as apiError, h as handleApiError, t as throwZodError, A as ApiErrorCode } from '../../../../../../chunks/api-errors.js-yRMzxqNi.js';
-import { m as ProjectRoleSchema } from '../../../../../../chunks/context.js-D8E0GFTw.js';
+import { e as getProjectProvider } from '../../../../../../chunks/providers.server.js-CIHOepKv.js';
+import { u as requireCanManageMembers, v as requireTargetIsOrgMember } from '../../../../../../chunks/access.server.js-_nJWuQcN.js';
+import { a as apiError, h as handleApiError, t as throwZodError, A as ApiErrorCode } from '../../../../../../chunks/api-errors.js-DlfcfPJs.js';
+import { m as ProjectRoleSchema } from '../../../../../../chunks/context.js-DsQGiS2x.js';
 import '../../../../../../chunks/shared-server.js-DaWdgxVh.js';
 import 'node:url';
 import 'node:path';
@@ -13,7 +13,7 @@ import 'node:fs/promises';
 import '@supabase/supabase-js';
 import '@selvajs/compute/core';
 import '../../../../../../chunks/schema.js-j3D3emog.js';
-import '../../../../../../chunks/utils4.js-BRotGwxx.js';
+import '../../../../../../chunks/utils4.js-8SHxuGTr.js';
 
 const AddMemberSchema = z.object({
   userId: z.string().min(1, "userId is required"),
@@ -61,4 +61,4 @@ const POST = async ({ params, request, locals }) => {
 };
 
 export { GET, POST };
-//# sourceMappingURL=_server.ts.js-B1AwpUGi.js.map
+//# sourceMappingURL=_server.ts.js-B3WPTw6C.js.map

package/build/server/chunks/entries/endpoints/api/projects/_id_/members/{_server.ts.js-B1AwpUGi.js.map → _server.ts.js-B3WPTw6C.js.map}

@@ -1 +1 @@
-{"version":3,"file":"_server.ts.js-B1AwpUGi.js","sources":["../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/projects/_id_/members/_server.ts.js"],"sourcesContent":["import { json } from \"@sveltejs/kit\";\nimport { z } from \"zod\";\nimport { l as getProjectProvider } from \"../../../../../../chunks/providers.server.js\";\nimport { u as requireCanManageMembers, v as requireTargetIsOrgMember } from \"../../../../../../chunks/access.server.js\";\nimport { a as apiError, h as handleApiError, t as throwZodError, A as ApiErrorCode } from \"../../../../../../chunks/api-errors.js\";\nimport { n as ProjectRoleSchema } from \"../../../../../../chunks/context.js\";\nconst AddMemberSchema = z.object({\n  userId: z.string().min(1, \"userId is required\"),\n  role: ProjectRoleSchema\n});\nconst GET = async ({ params, locals }) => {\n  const { id } = params;\n  if (!id) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing project ID\");\n  await requireCanManageMembers(locals, id);\n  const ctx = locals.ctx;\n  try {\n    const page = await getProjectProvider().listProjectMembers(ctx, id, { limit: 200 });\n    return json({ members: page.items });\n  } catch (err) {\n    handleApiError(err, \"Failed to load members\");\n  }\n};\nconst POST = async ({ params, request, locals }) => {\n  const { id } = params;\n  if (!id) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing project ID\");\n  await requireCanManageMembers(locals, id);\n  const ctx = locals.ctx;\n  const body = await request.json().catch(() => null);\n  const parsed = AddMemberSchema.safeParse(body);\n  if (!parsed.success) throwZodError(parsed.error);\n  const project = await getProjectProvider().getProject(ctx, id);\n  if (!project) apiError(404, ApiErrorCode.NOT_FOUND, \"Project not found\");\n  await requireTargetIsOrgMember(locals, project.orgId, parsed.data.userId);\n  const now = (/* @__PURE__ */ new Date()).toISOString();\n  const member = {\n    projectId: id,\n    userId: parsed.data.userId,\n    role: parsed.data.role,\n    joinedAt: now,\n    updatedAt: now,\n    updatedBy: ctx.userId || parsed.data.userId,\n    deletedAt: null\n  };\n  try {\n    await getProjectProvider().addProjectMember(ctx, member);\n    return json(member, { status: 201 });\n  } catch (err) {\n    handleApiError(err, \"Failed to add member\");\n  }\n};\nexport {\n  GET,\n  POST\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAMA,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;AACjC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,oBAAoB,CAAC;AACjD,EAAE,IAAI,EAAE;AACR,CAAC,CAAC;AACG,MAAC,GAAG,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AAC1C,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM;AACvB,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;AAC9E,EAAE,MAAM,uBAAuB,CAAC,MAAM,EAAE,EAAE,CAAC;AAC3C,EAAE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACxB,EAAE,IAAI;AACN,IAAI,MAAM,IAAI,GAAG,MAAM,kBAAkB,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACvF,IAAI,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;AACxC,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,cAAc,CAAC,GAAG,EAAE,wBAAwB,CAAC;AACjD,EAAE;AACF;AACK,MAAC,IAAI,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AACpD,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM;AACvB,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;AAC9E,EAAE,MAAM,uBAAuB,CAAC,MAAM,EAAE,EAAE,CAAC;AAC3C,EAAE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACxB,EAAE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;AACrD,EAAE,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC;AAChD,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AAClD,EAAE,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC;AAChE,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,mBAAmB,CAAC;AAC1E,EAAE,MAAM,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;AAC3E,EAAE,MAAM,GAAG,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACxD,EAAE,MAAM,MAAM,GAAG;AACjB,IAAI,SAAS,EAAE,EAAE;AACjB,IAAI,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;AAC9B,IAAI,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;AAC1B,IAAI,QAAQ,EAAE,GAAG;AACjB,IAAI,SAAS,EAAE,GAAG;AAClB,IAAI,SAAS,EAAE,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM;AAC/C,IAAI,SAAS,EAAE;AACf,GAAG;AACH,EAAE,IAAI;AACN,IAAI,MAAM,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC;AAC5D,IAAI,OAAO,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AACxC,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,cAAc,CAAC,GAAG,EAAE,sBAAsB,CAAC;AAC/C,EAAE;AACF;;;;"}
+{"version":3,"file":"_server.ts.js-B3WPTw6C.js","sources":["../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/projects/_id_/members/_server.ts.js"],"sourcesContent":["import { json } from \"@sveltejs/kit\";\nimport { z } from \"zod\";\nimport { m as getProjectProvider } from \"../../../../../../chunks/providers.server.js\";\nimport { u as requireCanManageMembers, v as requireTargetIsOrgMember } from \"../../../../../../chunks/access.server.js\";\nimport { a as apiError, h as handleApiError, t as throwZodError, A as ApiErrorCode } from \"../../../../../../chunks/api-errors.js\";\nimport { n as ProjectRoleSchema } from \"../../../../../../chunks/context.js\";\nconst AddMemberSchema = z.object({\n  userId: z.string().min(1, \"userId is required\"),\n  role: ProjectRoleSchema\n});\nconst GET = async ({ params, locals }) => {\n  const { id } = params;\n  if (!id) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing project ID\");\n  await requireCanManageMembers(locals, id);\n  const ctx = locals.ctx;\n  try {\n    const page = await getProjectProvider().listProjectMembers(ctx, id, { limit: 200 });\n    return json({ members: page.items });\n  } catch (err) {\n    handleApiError(err, \"Failed to load members\");\n  }\n};\nconst POST = async ({ params, request, locals }) => {\n  const { id } = params;\n  if (!id) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing project ID\");\n  await requireCanManageMembers(locals, id);\n  const ctx = locals.ctx;\n  const body = await request.json().catch(() => null);\n  const parsed = AddMemberSchema.safeParse(body);\n  if (!parsed.success) throwZodError(parsed.error);\n  const project = await getProjectProvider().getProject(ctx, id);\n  if (!project) apiError(404, ApiErrorCode.NOT_FOUND, \"Project not found\");\n  await requireTargetIsOrgMember(locals, project.orgId, parsed.data.userId);\n  const now = (/* @__PURE__ */ new Date()).toISOString();\n  const member = {\n    projectId: id,\n    userId: parsed.data.userId,\n    role: parsed.data.role,\n    joinedAt: now,\n    updatedAt: now,\n    updatedBy: ctx.userId || parsed.data.userId,\n    deletedAt: null\n  };\n  try {\n    await getProjectProvider().addProjectMember(ctx, member);\n    return json(member, { status: 201 });\n  } catch (err) {\n    handleApiError(err, \"Failed to add member\");\n  }\n};\nexport {\n  GET,\n  POST\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAMA,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;AACjC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,oBAAoB,CAAC;AACjD,EAAE,IAAI,EAAE;AACR,CAAC,CAAC;AACG,MAAC,GAAG,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AAC1C,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM;AACvB,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;AAC9E,EAAE,MAAM,uBAAuB,CAAC,MAAM,EAAE,EAAE,CAAC;AAC3C,EAAE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACxB,EAAE,IAAI;AACN,IAAI,MAAM,IAAI,GAAG,MAAM,kBAAkB,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACvF,IAAI,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;AACxC,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,cAAc,CAAC,GAAG,EAAE,wBAAwB,CAAC;AACjD,EAAE;AACF;AACK,MAAC,IAAI,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AACpD,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM;AACvB,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;AAC9E,EAAE,MAAM,uBAAuB,CAAC,MAAM,EAAE,EAAE,CAAC;AAC3C,EAAE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACxB,EAAE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;AACrD,EAAE,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC;AAChD,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AAClD,EAAE,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC;AAChE,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,mBAAmB,CAAC;AAC1E,EAAE,MAAM,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;AAC3E,EAAE,MAAM,GAAG,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACxD,EAAE,MAAM,MAAM,GAAG;AACjB,IAAI,SAAS,EAAE,EAAE;AACjB,IAAI,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;AAC9B,IAAI,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;AAC1B,IAAI,QAAQ,EAAE,GAAG;AACjB,IAAI,SAAS,EAAE,GAAG;AAClB,IAAI,SAAS,EAAE,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM;AAC/C,IAAI,SAAS,EAAE;AACf,GAAG;AACH,EAAE,IAAI;AACN,IAAI,MAAM,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC;AAC5D,IAAI,OAAO,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AACxC,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,cAAc,CAAC,GAAG,EAAE,sBAAsB,CAAC;AAC/C,EAAE;AACF;;;;"}

package/build/server/chunks/entries/endpoints/api/projects/_id_/members/_userId_/{_server.ts.js-DMl495J4.js → _server.ts.js-CY3ngc5p.js}

@@ -1,8 +1,8 @@
 import { z } from 'zod';
-import { e as getProjectProvider } from '../../../../../../../chunks/providers.server.js-D0hpk-aq.js';
-import { u as requireCanManageMembers, x as checkOwnerRemoval } from '../../../../../../../chunks/access.server.js-D99g5hZd.js';
-import { a as apiError, h as handleApiError, t as throwZodError, A as ApiErrorCode } from '../../../../../../../chunks/api-errors.js-yRMzxqNi.js';
-import { m as ProjectRoleSchema } from '../../../../../../../chunks/context.js-D8E0GFTw.js';
+import { e as getProjectProvider } from '../../../../../../../chunks/providers.server.js-CIHOepKv.js';
+import { u as requireCanManageMembers, x as checkOwnerRemoval } from '../../../../../../../chunks/access.server.js-_nJWuQcN.js';
+import { a as apiError, h as handleApiError, t as throwZodError, A as ApiErrorCode } from '../../../../../../../chunks/api-errors.js-DlfcfPJs.js';
+import { m as ProjectRoleSchema } from '../../../../../../../chunks/context.js-DsQGiS2x.js';
 import '../../../../../../../chunks/shared-server.js-DaWdgxVh.js';
 import 'node:url';
 import 'node:path';
@@ -13,7 +13,7 @@ import '@supabase/supabase-js';
 import '@sveltejs/kit';
 import '@selvajs/compute/core';
 import '../../../../../../../chunks/schema.js-j3D3emog.js';
-import '../../../../../../../chunks/utils4.js-BRotGwxx.js';
+import '../../../../../../../chunks/utils4.js-8SHxuGTr.js';
 
 const UpdateRoleSchema = z.object({ role: ProjectRoleSchema });
 const PATCH = async ({ params, request, locals }) => {
@@ -75,4 +75,4 @@ const DELETE = async ({ params, url, locals }) => {
 };
 
 export { DELETE, PATCH };
-//# sourceMappingURL=_server.ts.js-DMl495J4.js.map
+//# sourceMappingURL=_server.ts.js-CY3ngc5p.js.map

package/build/server/chunks/entries/endpoints/api/projects/_id_/members/_userId_/{_server.ts.js-DMl495J4.js.map → _server.ts.js-CY3ngc5p.js.map}

@@ -1 +1 @@
-{"version":3,"file":"_server.ts.js-DMl495J4.js","sources":["../../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/projects/_id_/members/_userId_/_server.ts.js"],"sourcesContent":["import { z } from \"zod\";\nimport { l as getProjectProvider } from \"../../../../../../../chunks/providers.server.js\";\nimport { u as requireCanManageMembers, x as checkOwnerRemoval } from \"../../../../../../../chunks/access.server.js\";\nimport { a as apiError, h as handleApiError, t as throwZodError, A as ApiErrorCode } from \"../../../../../../../chunks/api-errors.js\";\nimport { n as ProjectRoleSchema } from \"../../../../../../../chunks/context.js\";\nconst UpdateRoleSchema = z.object({ role: ProjectRoleSchema });\nconst PATCH = async ({ params, request, locals }) => {\n  const { id, userId } = params;\n  if (!id || !userId)\n    apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing project ID or user ID\");\n  await requireCanManageMembers(locals, id);\n  const ctx = locals.ctx;\n  const body = await request.json().catch(() => null);\n  const parsed = UpdateRoleSchema.safeParse(body);\n  if (!parsed.success) throwZodError(parsed.error);\n  try {\n    await getProjectProvider().updateProjectMemberRole(ctx, id, userId, parsed.data.role);\n    return new Response(null, { status: 204 });\n  } catch (err) {\n    handleApiError(err, \"Failed to update role\");\n  }\n};\nconst DELETE = async ({ params, url, locals }) => {\n  const { id, userId } = params;\n  if (!id || !userId)\n    apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing project ID or user ID\");\n  await requireCanManageMembers(locals, id);\n  const ctx = locals.ctx;\n  const confirmed = url.searchParams.get(\"confirm\") === \"true\";\n  const projects = getProjectProvider();\n  const target = await projects.getProjectMember(ctx, id, userId);\n  if (!target) {\n    return new Response(null, { status: 204 });\n  }\n  if (target.role === \"owner\") {\n    const page = await projects.listProjectMembers(ctx, id, { limit: 200 });\n    const decision = checkOwnerRemoval({\n      target: { role: target.role },\n      allMembers: page.items.map((m) => ({ role: m.role })),\n      confirmed\n    });\n    if (decision === \"sole_owner\") {\n      apiError(\n        409,\n        ApiErrorCode.CONFLICT,\n        \"Cannot remove the sole owner of a project. Assign another owner first, or use reclaim to add a co-owner.\"\n      );\n    }\n    if (decision === \"needs_confirm\") {\n      apiError(\n        409,\n        ApiErrorCode.CONFLICT,\n        \"Removing another project owner requires explicit confirmation. Retry with ?confirm=true.\"\n      );\n    }\n  }\n  try {\n    await projects.removeProjectMember(ctx, id, userId);\n    return new Response(null, { status: 204 });\n  } catch (err) {\n    handleApiError(err, \"Failed to remove member\");\n  }\n};\nexport {\n  DELETE,\n  PATCH\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAKA,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;AACzD,MAAC,KAAK,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AACrD,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM;AAC/B,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM;AACpB,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,+BAA+B,CAAC;AAClF,EAAE,MAAM,uBAAuB,CAAC,MAAM,EAAE,EAAE,CAAC;AAC3C,EAAE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACxB,EAAE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;AACrD,EAAE,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC;AACjD,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AAClD,EAAE,IAAI;AACN,IAAI,MAAM,kBAAkB,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;AACzF,IAAI,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC9C,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,cAAc,CAAC,GAAG,EAAE,uBAAuB,CAAC;AAChD,EAAE;AACF;AACK,MAAC,MAAM,GAAG,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK;AAClD,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM;AAC/B,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM;AACpB,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,+BAA+B,CAAC;AAClF,EAAE,MAAM,uBAAuB,CAAC,MAAM,EAAE,EAAE,CAAC;AAC3C,EAAE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACxB,EAAE,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,MAAM;AAC9D,EAAE,MAAM,QAAQ,GAAG,kBAAkB,EAAE;AACvC,EAAE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC;AACjE,EAAE,IAAI,CAAC,MAAM,EAAE;AACf,IAAI,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC9C,EAAE;AACF,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE;AAC/B,IAAI,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AAC3E,IAAI,MAAM,QAAQ,GAAG,iBAAiB,CAAC;AACvC,MAAM,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;AACnC,MAAM,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC3D,MAAM;AACN,KAAK,CAAC;AACN,IAAI,IAAI,QAAQ,KAAK,YAAY,EAAE;AACnC,MAAM,QAAQ;AACd,QAAQ,GAAG;AACX,QAAQ,YAAY,CAAC,QAAQ;AAC7B,QAAQ;AACR,OAAO;AACP,IAAI;AACJ,IAAI,IAAI,QAAQ,KAAK,eAAe,EAAE;AACtC,MAAM,QAAQ;AACd,QAAQ,GAAG;AACX,QAAQ,YAAY,CAAC,QAAQ;AAC7B,QAAQ;AACR,OAAO;AACP,IAAI;AACJ,EAAE;AACF,EAAE,IAAI;AACN,IAAI,MAAM,QAAQ,CAAC,mBAAmB,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC;AACvD,IAAI,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC9C,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,cAAc,CAAC,GAAG,EAAE,yBAAyB,CAAC;AAClD,EAAE;AACF;;;;"}
+{"version":3,"file":"_server.ts.js-CY3ngc5p.js","sources":["../../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/projects/_id_/members/_userId_/_server.ts.js"],"sourcesContent":["import { z } from \"zod\";\nimport { m as getProjectProvider } from \"../../../../../../../chunks/providers.server.js\";\nimport { u as requireCanManageMembers, x as checkOwnerRemoval } from \"../../../../../../../chunks/access.server.js\";\nimport { a as apiError, h as handleApiError, t as throwZodError, A as ApiErrorCode } from \"../../../../../../../chunks/api-errors.js\";\nimport { n as ProjectRoleSchema } from \"../../../../../../../chunks/context.js\";\nconst UpdateRoleSchema = z.object({ role: ProjectRoleSchema });\nconst PATCH = async ({ params, request, locals }) => {\n  const { id, userId } = params;\n  if (!id || !userId)\n    apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing project ID or user ID\");\n  await requireCanManageMembers(locals, id);\n  const ctx = locals.ctx;\n  const body = await request.json().catch(() => null);\n  const parsed = UpdateRoleSchema.safeParse(body);\n  if (!parsed.success) throwZodError(parsed.error);\n  try {\n    await getProjectProvider().updateProjectMemberRole(ctx, id, userId, parsed.data.role);\n    return new Response(null, { status: 204 });\n  } catch (err) {\n    handleApiError(err, \"Failed to update role\");\n  }\n};\nconst DELETE = async ({ params, url, locals }) => {\n  const { id, userId } = params;\n  if (!id || !userId)\n    apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing project ID or user ID\");\n  await requireCanManageMembers(locals, id);\n  const ctx = locals.ctx;\n  const confirmed = url.searchParams.get(\"confirm\") === \"true\";\n  const projects = getProjectProvider();\n  const target = await projects.getProjectMember(ctx, id, userId);\n  if (!target) {\n    return new Response(null, { status: 204 });\n  }\n  if (target.role === \"owner\") {\n    const page = await projects.listProjectMembers(ctx, id, { limit: 200 });\n    const decision = checkOwnerRemoval({\n      target: { role: target.role },\n      allMembers: page.items.map((m) => ({ role: m.role })),\n      confirmed\n    });\n    if (decision === \"sole_owner\") {\n      apiError(\n        409,\n        ApiErrorCode.CONFLICT,\n        \"Cannot remove the sole owner of a project. Assign another owner first, or use reclaim to add a co-owner.\"\n      );\n    }\n    if (decision === \"needs_confirm\") {\n      apiError(\n        409,\n        ApiErrorCode.CONFLICT,\n        \"Removing another project owner requires explicit confirmation. Retry with ?confirm=true.\"\n      );\n    }\n  }\n  try {\n    await projects.removeProjectMember(ctx, id, userId);\n    return new Response(null, { status: 204 });\n  } catch (err) {\n    handleApiError(err, \"Failed to remove member\");\n  }\n};\nexport {\n  DELETE,\n  PATCH\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAKA,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;AACzD,MAAC,KAAK,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AACrD,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM;AAC/B,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM;AACpB,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,+BAA+B,CAAC;AAClF,EAAE,MAAM,uBAAuB,CAAC,MAAM,EAAE,EAAE,CAAC;AAC3C,EAAE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACxB,EAAE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;AACrD,EAAE,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC;AACjD,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AAClD,EAAE,IAAI;AACN,IAAI,MAAM,kBAAkB,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;AACzF,IAAI,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC9C,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,cAAc,CAAC,GAAG,EAAE,uBAAuB,CAAC;AAChD,EAAE;AACF;AACK,MAAC,MAAM,GAAG,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK;AAClD,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM;AAC/B,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM;AACpB,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,+BAA+B,CAAC;AAClF,EAAE,MAAM,uBAAuB,CAAC,MAAM,EAAE,EAAE,CAAC;AAC3C,EAAE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACxB,EAAE,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,MAAM;AAC9D,EAAE,MAAM,QAAQ,GAAG,kBAAkB,EAAE;AACvC,EAAE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC;AACjE,EAAE,IAAI,CAAC,MAAM,EAAE;AACf,IAAI,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC9C,EAAE;AACF,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE;AAC/B,IAAI,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AAC3E,IAAI,MAAM,QAAQ,GAAG,iBAAiB,CAAC;AACvC,MAAM,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;AACnC,MAAM,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC3D,MAAM;AACN,KAAK,CAAC;AACN,IAAI,IAAI,QAAQ,KAAK,YAAY,EAAE;AACnC,MAAM,QAAQ;AACd,QAAQ,GAAG;AACX,QAAQ,YAAY,CAAC,QAAQ;AAC7B,QAAQ;AACR,OAAO;AACP,IAAI;AACJ,IAAI,IAAI,QAAQ,KAAK,eAAe,EAAE;AACtC,MAAM,QAAQ;AACd,QAAQ,GAAG;AACX,QAAQ,YAAY,CAAC,QAAQ;AAC7B,QAAQ;AACR,OAAO;AACP,IAAI;AACJ,EAAE;AACF,EAAE,IAAI;AACN,IAAI,MAAM,QAAQ,CAAC,mBAAmB,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC;AACvD,IAAI,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC9C,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,cAAc,CAAC,GAAG,EAAE,yBAAyB,CAAC;AAClD,EAAE;AACF;;;;"}

package/build/server/chunks/entries/endpoints/api/projects/_id_/reclaim/{_server.ts.js-DFJbS6RF.js → _server.ts.js-DMAeVu3R.js}

@@ -1,9 +1,9 @@
 import { json } from '@sveltejs/kit';
-import { e as getProjectProvider } from '../../../../../../chunks/providers.server.js-D0hpk-aq.js';
-import { y as requireCanReclaim } from '../../../../../../chunks/access.server.js-D99g5hZd.js';
-import { a as apiError, h as handleApiError, A as ApiErrorCode } from '../../../../../../chunks/api-errors.js-yRMzxqNi.js';
+import { e as getProjectProvider } from '../../../../../../chunks/providers.server.js-CIHOepKv.js';
+import { y as requireCanReclaim } from '../../../../../../chunks/access.server.js-_nJWuQcN.js';
+import { a as apiError, h as handleApiError, A as ApiErrorCode } from '../../../../../../chunks/api-errors.js-DlfcfPJs.js';
 import '../../../../../../chunks/shared-server.js-DaWdgxVh.js';
-import '../../../../../../chunks/context.js-D8E0GFTw.js';
+import '../../../../../../chunks/context.js-DsQGiS2x.js';
 import 'zod';
 import 'node:url';
 import 'node:path';
@@ -13,7 +13,7 @@ import 'node:fs/promises';
 import '@supabase/supabase-js';
 import '@selvajs/compute/core';
 import '../../../../../../chunks/schema.js-j3D3emog.js';
-import '../../../../../../chunks/utils4.js-BRotGwxx.js';
+import '../../../../../../chunks/utils4.js-8SHxuGTr.js';
 
 const POST = async ({ params, locals }) => {
   const { id } = params;
@@ -38,4 +38,4 @@ const POST = async ({ params, locals }) => {
 };
 
 export { POST };
-//# sourceMappingURL=_server.ts.js-DFJbS6RF.js.map
+//# sourceMappingURL=_server.ts.js-DMAeVu3R.js.map

package/build/server/chunks/entries/endpoints/api/projects/_id_/reclaim/{_server.ts.js-DFJbS6RF.js.map → _server.ts.js-DMAeVu3R.js.map}

@@ -1 +1 @@
-{"version":3,"file":"_server.ts.js-DFJbS6RF.js","sources":["../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/projects/_id_/reclaim/_server.ts.js"],"sourcesContent":["import { json } from \"@sveltejs/kit\";\nimport { l as getProjectProvider } from \"../../../../../../chunks/providers.server.js\";\nimport { y as requireCanReclaim } from \"../../../../../../chunks/access.server.js\";\nimport { a as apiError, h as handleApiError, A as ApiErrorCode } from \"../../../../../../chunks/api-errors.js\";\nconst POST = async ({ params, locals }) => {\n  const { id } = params;\n  if (!id) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing project ID\");\n  const { user, ctx } = await requireCanReclaim(locals, id);\n  const now = (/* @__PURE__ */ new Date()).toISOString();\n  const member = {\n    projectId: id,\n    userId: user.id,\n    role: \"owner\",\n    joinedAt: now,\n    updatedAt: now,\n    updatedBy: ctx.userId || user.id,\n    deletedAt: null\n  };\n  try {\n    await getProjectProvider().addProjectMember(ctx, member);\n    return json({ member }, { status: 201 });\n  } catch (err) {\n    handleApiError(err, \"Failed to reclaim project\");\n  }\n};\nexport {\n  POST\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAIK,MAAC,IAAI,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AAC3C,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM;AACvB,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;AAC9E,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,EAAE,CAAC;AAC3D,EAAE,MAAM,GAAG,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACxD,EAAE,MAAM,MAAM,GAAG;AACjB,IAAI,SAAS,EAAE,EAAE;AACjB,IAAI,MAAM,EAAE,IAAI,CAAC,EAAE;AACnB,IAAI,IAAI,EAAE,OAAO;AACjB,IAAI,QAAQ,EAAE,GAAG;AACjB,IAAI,SAAS,EAAE,GAAG;AAClB,IAAI,SAAS,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE;AACpC,IAAI,SAAS,EAAE;AACf,GAAG;AACH,EAAE,IAAI;AACN,IAAI,MAAM,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC;AAC5D,IAAI,OAAO,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC5C,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,cAAc,CAAC,GAAG,EAAE,2BAA2B,CAAC;AACpD,EAAE;AACF;;;;"}
+{"version":3,"file":"_server.ts.js-DMAeVu3R.js","sources":["../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/projects/_id_/reclaim/_server.ts.js"],"sourcesContent":["import { json } from \"@sveltejs/kit\";\nimport { m as getProjectProvider } from \"../../../../../../chunks/providers.server.js\";\nimport { y as requireCanReclaim } from \"../../../../../../chunks/access.server.js\";\nimport { a as apiError, h as handleApiError, A as ApiErrorCode } from \"../../../../../../chunks/api-errors.js\";\nconst POST = async ({ params, locals }) => {\n  const { id } = params;\n  if (!id) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing project ID\");\n  const { user, ctx } = await requireCanReclaim(locals, id);\n  const now = (/* @__PURE__ */ new Date()).toISOString();\n  const member = {\n    projectId: id,\n    userId: user.id,\n    role: \"owner\",\n    joinedAt: now,\n    updatedAt: now,\n    updatedBy: ctx.userId || user.id,\n    deletedAt: null\n  };\n  try {\n    await getProjectProvider().addProjectMember(ctx, member);\n    return json({ member }, { status: 201 });\n  } catch (err) {\n    handleApiError(err, \"Failed to reclaim project\");\n  }\n};\nexport {\n  POST\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAIK,MAAC,IAAI,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AAC3C,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM;AACvB,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;AAC9E,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,EAAE,CAAC;AAC3D,EAAE,MAAM,GAAG,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACxD,EAAE,MAAM,MAAM,GAAG;AACjB,IAAI,SAAS,EAAE,EAAE;AACjB,IAAI,MAAM,EAAE,IAAI,CAAC,EAAE;AACnB,IAAI,IAAI,EAAE,OAAO;AACjB,IAAI,QAAQ,EAAE,GAAG;AACjB,IAAI,SAAS,EAAE,GAAG;AAClB,IAAI,SAAS,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE;AACpC,IAAI,SAAS,EAAE;AACf,GAAG;AACH,EAAE,IAAI;AACN,IAAI,MAAM,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC;AAC5D,IAAI,OAAO,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC5C,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,cAAc,CAAC,GAAG,EAAE,2BAA2B,CAAC;AACpD,EAAE;AACF;;;;"}

package/build/server/chunks/entries/endpoints/api/projects/{_server.ts.js-Gcc5eHXJ.js → _server.ts.js-D32BzObk.js}

@@ -1,11 +1,11 @@
 import { json } from '@sveltejs/kit';
 import { z } from 'zod';
 import { randomUUID } from 'node:crypto';
-import { e as getProjectProvider, P as ProviderError } from '../../../../chunks/providers.server.js-D0hpk-aq.js';
-import { p as requireCanCreateProject } from '../../../../chunks/access.server.js-D99g5hZd.js';
-import { a as apiError, h as handleApiError, t as throwZodError, A as ApiErrorCode } from '../../../../chunks/api-errors.js-yRMzxqNi.js';
+import { e as getProjectProvider, P as ProviderError } from '../../../../chunks/providers.server.js-CIHOepKv.js';
+import { p as requireCanCreateProject } from '../../../../chunks/access.server.js-_nJWuQcN.js';
+import { a as apiError, h as handleApiError, t as throwZodError, A as ApiErrorCode } from '../../../../chunks/api-errors.js-DlfcfPJs.js';
 import { s as slugify } from '../../../../chunks/slug.js-BGuFQjqe.js';
-import { l as ProjectVisibilitySchema } from '../../../../chunks/context.js-D8E0GFTw.js';
+import { l as ProjectVisibilitySchema } from '../../../../chunks/context.js-DsQGiS2x.js';
 import '../../../../chunks/shared-server.js-DaWdgxVh.js';
 import 'node:url';
 import 'node:path';
@@ -14,7 +14,7 @@ import 'node:fs/promises';
 import '@supabase/supabase-js';
 import '@selvajs/compute/core';
 import '../../../../chunks/schema.js-j3D3emog.js';
-import '../../../../chunks/utils4.js-BRotGwxx.js';
+import '../../../../chunks/utils4.js-8SHxuGTr.js';
 
 const MAX_SLUG_ATTEMPTS = 25;
 function isSlugConflict(err) {
@@ -94,4 +94,4 @@ const POST = async ({ request, locals }) => {
 };
 
 export { GET, POST };
-//# sourceMappingURL=_server.ts.js-Gcc5eHXJ.js.map
+//# sourceMappingURL=_server.ts.js-D32BzObk.js.map

package/build/server/chunks/entries/endpoints/api/projects/{_server.ts.js-Gcc5eHXJ.js.map → _server.ts.js-D32BzObk.js.map}

@@ -1 +1 @@
-{"version":3,"file":"_server.ts.js-Gcc5eHXJ.js","sources":["../../../../../../../.svelte-kit/output/server/entries/endpoints/api/projects/_server.ts.js"],"sourcesContent":["import { json } from \"@sveltejs/kit\";\nimport { z } from \"zod\";\nimport { randomUUID } from \"node:crypto\";\nimport { l as getProjectProvider, P as ProviderError } from \"../../../../chunks/providers.server.js\";\nimport { p as requireCanCreateProject } from \"../../../../chunks/access.server.js\";\nimport { a as apiError, h as handleApiError, t as throwZodError, A as ApiErrorCode } from \"../../../../chunks/api-errors.js\";\nimport { s as slugify } from \"../../../../chunks/slug.js\";\nimport { m as ProjectVisibilitySchema } from \"../../../../chunks/context.js\";\nconst MAX_SLUG_ATTEMPTS = 25;\nfunction isSlugConflict(err) {\n  return err instanceof ProviderError && err.statusCode === 409 && /projects_org_id_slug_key/.test(err.message);\n}\nfunction isNameConflict(err) {\n  return err instanceof ProviderError && err.statusCode === 409 && /projects_org_name_unique/.test(err.message);\n}\nconst CreateProjectBody = z.object({\n  name: z.string().min(1, \"Project name is required\").max(128).trim(),\n  description: z.string().max(2e3).optional(),\n  visibility: ProjectVisibilitySchema.default(\"private\"),\n  autoJoinOnUpload: z.boolean().optional()\n});\nconst GET = async ({ locals }) => {\n  const ctx = locals.ctx;\n  if (!ctx.actingOrgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"No active organization\");\n  try {\n    const page = await getProjectProvider().listProjects(ctx, ctx.actingOrgId, { limit: 200 });\n    return json({ projects: page.items });\n  } catch (err) {\n    handleApiError(err, \"Failed to load projects\");\n  }\n};\nconst POST = async ({ request, locals }) => {\n  const ctx = locals.ctx;\n  if (!ctx.actingOrgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"No active organization\");\n  await requireCanCreateProject(locals, ctx.actingOrgId);\n  const body = await request.json().catch(() => null);\n  const parsed = CreateProjectBody.safeParse(body);\n  if (!parsed.success) throwZodError(parsed.error);\n  const autoJoinOnUpload = parsed.data.autoJoinOnUpload ?? false;\n  if (autoJoinOnUpload && parsed.data.visibility !== \"public\") {\n    apiError(400, ApiErrorCode.VALIDATION_FAILED, \"autoJoinOnUpload requires visibility=public\");\n  }\n  const projectStore = getProjectProvider();\n  const baseSlug = slugify(parsed.data.name) || \"project\";\n  const now = (/* @__PURE__ */ new Date()).toISOString();\n  const projectId = randomUUID();\n  for (let attempt = 0; attempt < MAX_SLUG_ATTEMPTS; attempt++) {\n    const slug = attempt === 0 ? baseSlug : `${baseSlug}-${attempt + 1}`;\n    const project = {\n      id: projectId,\n      orgId: ctx.actingOrgId,\n      name: parsed.data.name,\n      slug,\n      description: parsed.data.description,\n      visibility: parsed.data.visibility,\n      ownerId: locals.user.id,\n      createdBy: locals.user.id,\n      updatedBy: locals.user.id,\n      autoJoinOnUpload,\n      createdAt: now,\n      updatedAt: now,\n      deletedAt: null\n    };\n    try {\n      await projectStore.createProject(ctx, project);\n      return json(project, { status: 201 });\n    } catch (err) {\n      if (isNameConflict(err)) {\n        apiError(\n          409,\n          ApiErrorCode.CONFLICT,\n          \"A project with that name already exists in this organization.\"\n        );\n      }\n      if (isSlugConflict(err)) continue;\n      handleApiError(err, \"Failed to create project\");\n    }\n  }\n  apiError(\n    409,\n    ApiErrorCode.CONFLICT,\n    \"Could not pick a unique project slug after several attempts.\"\n  );\n};\nexport {\n  GET,\n  POST\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAQA,MAAM,iBAAiB,GAAG,EAAE;AAC5B,SAAS,cAAc,CAAC,GAAG,EAAE;AAC7B,EAAE,OAAO,GAAG,YAAY,aAAa,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;AAC/G;AACA,SAAS,cAAc,CAAC,GAAG,EAAE;AAC7B,EAAE,OAAO,GAAG,YAAY,aAAa,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;AAC/G;AACA,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;AACnC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;AACrE,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AAC7C,EAAE,UAAU,EAAE,uBAAuB,CAAC,OAAO,CAAC,SAAS,CAAC;AACxD,EAAE,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ;AACxC,CAAC,CAAC;AACG,MAAC,GAAG,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK;AAClC,EAAE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACxB,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;AAC/F,EAAE,IAAI;AACN,IAAI,MAAM,IAAI,GAAG,MAAM,kBAAkB,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AAC9F,IAAI,OAAO,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;AACzC,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,cAAc,CAAC,GAAG,EAAE,yBAAyB,CAAC;AAClD,EAAE;AACF;AACK,MAAC,IAAI,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AAC5C,EAAE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACxB,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;AAC/F,EAAE,MAAM,uBAAuB,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC;AACxD,EAAE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;AACrD,EAAE,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC;AAClD,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AAClD,EAAE,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,KAAK;AAChE,EAAE,IAAI,gBAAgB,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE;AAC/D,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,6CAA6C,CAAC;AAChG,EAAE;AACF,EAAE,MAAM,YAAY,GAAG,kBAAkB,EAAE;AAC3C,EAAE,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS;AACzD,EAAE,MAAM,GAAG,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACxD,EAAE,MAAM,SAAS,GAAG,UAAU,EAAE;AAChC,EAAE,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,iBAAiB,EAAE,OAAO,EAAE,EAAE;AAChE,IAAI,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;AACxE,IAAI,MAAM,OAAO,GAAG;AACpB,MAAM,EAAE,EAAE,SAAS;AACnB,MAAM,KAAK,EAAE,GAAG,CAAC,WAAW;AAC5B,MAAM,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;AAC5B,MAAM,IAAI;AACV,MAAM,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;AAC1C,MAAM,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU;AACxC,MAAM,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;AAC7B,MAAM,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;AAC/B,MAAM,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;AAC/B,MAAM,gBAAgB;AACtB,MAAM,SAAS,EAAE,GAAG;AACpB,MAAM,SAAS,EAAE,GAAG;AACpB,MAAM,SAAS,EAAE;AACjB,KAAK;AACL,IAAI,IAAI;AACR,MAAM,MAAM,YAAY,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC;AACpD,MAAM,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC3C,IAAI,CAAC,CAAC,OAAO,GAAG,EAAE;AAClB,MAAM,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE;AAC/B,QAAQ,QAAQ;AAChB,UAAU,GAAG;AACb,UAAU,YAAY,CAAC,QAAQ;AAC/B,UAAU;AACV,SAAS;AACT,MAAM;AACN,MAAM,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE;AAC/B,MAAM,cAAc,CAAC,GAAG,EAAE,0BAA0B,CAAC;AACrD,IAAI;AACJ,EAAE;AACF,EAAE,QAAQ;AACV,IAAI,GAAG;AACP,IAAI,YAAY,CAAC,QAAQ;AACzB,IAAI;AACJ,GAAG;AACH;;;;"}
+{"version":3,"file":"_server.ts.js-D32BzObk.js","sources":["../../../../../../../.svelte-kit/output/server/entries/endpoints/api/projects/_server.ts.js"],"sourcesContent":["import { json } from \"@sveltejs/kit\";\nimport { z } from \"zod\";\nimport { randomUUID } from \"node:crypto\";\nimport { m as getProjectProvider, P as ProviderError } from \"../../../../chunks/providers.server.js\";\nimport { p as requireCanCreateProject } from \"../../../../chunks/access.server.js\";\nimport { a as apiError, h as handleApiError, t as throwZodError, A as ApiErrorCode } from \"../../../../chunks/api-errors.js\";\nimport { s as slugify } from \"../../../../chunks/slug.js\";\nimport { m as ProjectVisibilitySchema } from \"../../../../chunks/context.js\";\nconst MAX_SLUG_ATTEMPTS = 25;\nfunction isSlugConflict(err) {\n  return err instanceof ProviderError && err.statusCode === 409 && /projects_org_id_slug_key/.test(err.message);\n}\nfunction isNameConflict(err) {\n  return err instanceof ProviderError && err.statusCode === 409 && /projects_org_name_unique/.test(err.message);\n}\nconst CreateProjectBody = z.object({\n  name: z.string().min(1, \"Project name is required\").max(128).trim(),\n  description: z.string().max(2e3).optional(),\n  visibility: ProjectVisibilitySchema.default(\"private\"),\n  autoJoinOnUpload: z.boolean().optional()\n});\nconst GET = async ({ locals }) => {\n  const ctx = locals.ctx;\n  if (!ctx.actingOrgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"No active organization\");\n  try {\n    const page = await getProjectProvider().listProjects(ctx, ctx.actingOrgId, { limit: 200 });\n    return json({ projects: page.items });\n  } catch (err) {\n    handleApiError(err, \"Failed to load projects\");\n  }\n};\nconst POST = async ({ request, locals }) => {\n  const ctx = locals.ctx;\n  if (!ctx.actingOrgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"No active organization\");\n  await requireCanCreateProject(locals, ctx.actingOrgId);\n  const body = await request.json().catch(() => null);\n  const parsed = CreateProjectBody.safeParse(body);\n  if (!parsed.success) throwZodError(parsed.error);\n  const autoJoinOnUpload = parsed.data.autoJoinOnUpload ?? false;\n  if (autoJoinOnUpload && parsed.data.visibility !== \"public\") {\n    apiError(400, ApiErrorCode.VALIDATION_FAILED, \"autoJoinOnUpload requires visibility=public\");\n  }\n  const projectStore = getProjectProvider();\n  const baseSlug = slugify(parsed.data.name) || \"project\";\n  const now = (/* @__PURE__ */ new Date()).toISOString();\n  const projectId = randomUUID();\n  for (let attempt = 0; attempt < MAX_SLUG_ATTEMPTS; attempt++) {\n    const slug = attempt === 0 ? baseSlug : `${baseSlug}-${attempt + 1}`;\n    const project = {\n      id: projectId,\n      orgId: ctx.actingOrgId,\n      name: parsed.data.name,\n      slug,\n      description: parsed.data.description,\n      visibility: parsed.data.visibility,\n      ownerId: locals.user.id,\n      createdBy: locals.user.id,\n      updatedBy: locals.user.id,\n      autoJoinOnUpload,\n      createdAt: now,\n      updatedAt: now,\n      deletedAt: null\n    };\n    try {\n      await projectStore.createProject(ctx, project);\n      return json(project, { status: 201 });\n    } catch (err) {\n      if (isNameConflict(err)) {\n        apiError(\n          409,\n          ApiErrorCode.CONFLICT,\n          \"A project with that name already exists in this organization.\"\n        );\n      }\n      if (isSlugConflict(err)) continue;\n      handleApiError(err, \"Failed to create project\");\n    }\n  }\n  apiError(\n    409,\n    ApiErrorCode.CONFLICT,\n    \"Could not pick a unique project slug after several attempts.\"\n  );\n};\nexport {\n  GET,\n  POST\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAQA,MAAM,iBAAiB,GAAG,EAAE;AAC5B,SAAS,cAAc,CAAC,GAAG,EAAE;AAC7B,EAAE,OAAO,GAAG,YAAY,aAAa,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;AAC/G;AACA,SAAS,cAAc,CAAC,GAAG,EAAE;AAC7B,EAAE,OAAO,GAAG,YAAY,aAAa,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;AAC/G;AACA,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;AACnC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;AACrE,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AAC7C,EAAE,UAAU,EAAE,uBAAuB,CAAC,OAAO,CAAC,SAAS,CAAC;AACxD,EAAE,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ;AACxC,CAAC,CAAC;AACG,MAAC,GAAG,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK;AAClC,EAAE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACxB,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;AAC/F,EAAE,IAAI;AACN,IAAI,MAAM,IAAI,GAAG,MAAM,kBAAkB,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AAC9F,IAAI,OAAO,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;AACzC,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,cAAc,CAAC,GAAG,EAAE,yBAAyB,CAAC;AAClD,EAAE;AACF;AACK,MAAC,IAAI,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AAC5C,EAAE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACxB,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;AAC/F,EAAE,MAAM,uBAAuB,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC;AACxD,EAAE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;AACrD,EAAE,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC;AAClD,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AAClD,EAAE,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,KAAK;AAChE,EAAE,IAAI,gBAAgB,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE;AAC/D,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,6CAA6C,CAAC;AAChG,EAAE;AACF,EAAE,MAAM,YAAY,GAAG,kBAAkB,EAAE;AAC3C,EAAE,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS;AACzD,EAAE,MAAM,GAAG,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACxD,EAAE,MAAM,SAAS,GAAG,UAAU,EAAE;AAChC,EAAE,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,iBAAiB,EAAE,OAAO,EAAE,EAAE;AAChE,IAAI,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;AACxE,IAAI,MAAM,OAAO,GAAG;AACpB,MAAM,EAAE,EAAE,SAAS;AACnB,MAAM,KAAK,EAAE,GAAG,CAAC,WAAW;AAC5B,MAAM,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;AAC5B,MAAM,IAAI;AACV,MAAM,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;AAC1C,MAAM,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU;AACxC,MAAM,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;AAC7B,MAAM,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;AAC/B,MAAM,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;AAC/B,MAAM,gBAAgB;AACtB,MAAM,SAAS,EAAE,GAAG;AACpB,MAAM,SAAS,EAAE,GAAG;AACpB,MAAM,SAAS,EAAE;AACjB,KAAK;AACL,IAAI,IAAI;AACR,MAAM,MAAM,YAAY,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC;AACpD,MAAM,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC3C,IAAI,CAAC,CAAC,OAAO,GAAG,EAAE;AAClB,MAAM,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE;AAC/B,QAAQ,QAAQ;AAChB,UAAU,GAAG;AACb,UAAU,YAAY,CAAC,QAAQ;AAC/B,UAAU;AACV,SAAS;AACT,MAAM;AACN,MAAM,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE;AAC/B,MAAM,cAAc,CAAC,GAAG,EAAE,0BAA0B,CAAC;AACrD,IAAI;AACJ,EAAE;AACF,EAAE,QAAQ;AACV,IAAI,GAAG;AACP,IAAI,YAAY,CAAC,QAAQ;AACzB,IAAI;AACJ,GAAG;AACH;;;;"}

package/build/server/chunks/entries/endpoints/auth/email/callback/{_server.ts.js-B7kvAKyV.js → _server.ts.js-DREl2Sbq.js}

@@ -1,13 +1,14 @@
 import { redirect } from '@sveltejs/kit';
-import { a as apiError, A as ApiErrorCode } from '../../../../../chunks/api-errors.js-yRMzxqNi.js';
-import { g as getAuthProvider } from '../../../../../chunks/providers.server.js-D0hpk-aq.js';
-import { b as bootstrapUserSession } from '../../../../../chunks/auth-bootstrap.server.js-BpQr_I_2.js';
-import { s as setSessionCookie, a as setRefreshCookie, d as safeRedirectTarget } from '../../../../../chunks/admin-auth.server.js-hCWF6Pqg.js';
-import '../../../../../chunks/context.js-D8E0GFTw.js';
+import { a as apiError, A as ApiErrorCode } from '../../../../../chunks/api-errors.js-DlfcfPJs.js';
+import { g as getAuthProvider } from '../../../../../chunks/providers.server.js-CIHOepKv.js';
+import { b as bootstrapUserSession } from '../../../../../chunks/auth-bootstrap.server.js-S-F5QI4m.js';
+import { s as setSessionCookie, a as setRefreshCookie } from '../../../../../chunks/admin-auth.server.js-CitjWnKM.js';
+import { s as safeRedirectTarget } from '../../../../../chunks/redirect.js-1CZ30qn2.js';
+import '../../../../../chunks/context.js-DsQGiS2x.js';
 import 'zod';
 import '@selvajs/compute/core';
 import '../../../../../chunks/schema.js-j3D3emog.js';
-import '../../../../../chunks/utils4.js-BRotGwxx.js';
+import '../../../../../chunks/utils4.js-8SHxuGTr.js';
 import '../../../../../chunks/shared-server.js-DaWdgxVh.js';
 import 'node:url';
 import 'node:path';
@@ -16,6 +17,10 @@ import 'node:crypto';
 import 'node:fs/promises';
 import '@supabase/supabase-js';
 import '../../../../../chunks/slug.js-BGuFQjqe.js';
+import '../../../../../chunks/solve-cache-key.js-BIwJfBG9.js';
+import '@selvajs/compute';
+import 'node:zlib';
+import 'node:util';
 
 const GET = async ({ url, cookies }) => {
   const emailLink = getAuthProvider().emailLink;
@@ -33,4 +38,4 @@ const GET = async ({ url, cookies }) => {
 };
 
 export { GET };
-//# sourceMappingURL=_server.ts.js-B7kvAKyV.js.map
+//# sourceMappingURL=_server.ts.js-DREl2Sbq.js.map

package/build/server/chunks/entries/endpoints/auth/email/callback/_server.ts.js-DREl2Sbq.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-DREl2Sbq.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/auth/email/callback/_server.ts.js"],"sourcesContent":["import { redirect } from \"@sveltejs/kit\";\nimport { a as apiError, A as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\nimport { b as getAuthProvider } from \"../../../../../chunks/providers.server.js\";\nimport { b as bootstrapUserSession } from \"../../../../../chunks/auth-bootstrap.server.js\";\nimport { s as setSessionCookie, a as setRefreshCookie } from \"../../../../../chunks/admin-auth.server.js\";\nimport { s as safeRedirectTarget } from \"../../../../../chunks/redirect.js\";\nconst GET = async ({ url, cookies }) => {\n  const emailLink = getAuthProvider().emailLink;\n  if (!emailLink) {\n    apiError(501, ApiErrorCode.INTERNAL, \"Email sign-in is not supported by this provider.\");\n  }\n  const result = await emailLink.verifyMagicLink(url.toString());\n  if (!result)\n    apiError(401, ApiErrorCode.UNAUTHORIZED, \"This sign-in link is invalid or has expired.\");\n  await bootstrapUserSession(result.user);\n  setSessionCookie(cookies, result.sessionToken);\n  if (result.refreshToken) setRefreshCookie(cookies, result.refreshToken);\n  const dest = safeRedirectTarget(url.searchParams.get(\"redirectTo\"), \"/library\");\n  redirect(303, dest);\n};\nexport {\n  GET\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAMK,MAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK;AACxC,EAAE,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC,SAAS;AAC/C,EAAE,IAAI,CAAC,SAAS,EAAE;AAClB,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,kDAAkD,CAAC;AAC5F,EAAE;AACF,EAAE,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;AAChE,EAAE,IAAI,CAAC,MAAM;AACb,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,8CAA8C,CAAC;AAC5F,EAAE,MAAM,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC;AACzC,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AAChD,EAAE,IAAI,MAAM,CAAC,YAAY,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AACzE,EAAE,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC;AACjF,EAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;AACrB;;;;"}

package/build/server/chunks/entries/endpoints/auth/supabase/callback/{_server.ts.js-3yXXN2SO.js → _server.ts.js-CmIWOQ81.js}

@@ -1,13 +1,14 @@
 import { redirect } from '@sveltejs/kit';
-import { a as apiError, A as ApiErrorCode } from '../../../../../chunks/api-errors.js-yRMzxqNi.js';
-import { g as getAuthProvider } from '../../../../../chunks/providers.server.js-D0hpk-aq.js';
-import { b as bootstrapUserSession } from '../../../../../chunks/auth-bootstrap.server.js-BpQr_I_2.js';
-import { s as setSessionCookie, a as setRefreshCookie, d as safeRedirectTarget } from '../../../../../chunks/admin-auth.server.js-hCWF6Pqg.js';
-import '../../../../../chunks/context.js-D8E0GFTw.js';
+import { a as apiError, A as ApiErrorCode } from '../../../../../chunks/api-errors.js-DlfcfPJs.js';
+import { g as getAuthProvider } from '../../../../../chunks/providers.server.js-CIHOepKv.js';
+import { b as bootstrapUserSession } from '../../../../../chunks/auth-bootstrap.server.js-S-F5QI4m.js';
+import { s as setSessionCookie, a as setRefreshCookie } from '../../../../../chunks/admin-auth.server.js-CitjWnKM.js';
+import { s as safeRedirectTarget } from '../../../../../chunks/redirect.js-1CZ30qn2.js';
+import '../../../../../chunks/context.js-DsQGiS2x.js';
 import 'zod';
 import '@selvajs/compute/core';
 import '../../../../../chunks/schema.js-j3D3emog.js';
-import '../../../../../chunks/utils4.js-BRotGwxx.js';
+import '../../../../../chunks/utils4.js-8SHxuGTr.js';
 import '../../../../../chunks/shared-server.js-DaWdgxVh.js';
 import 'node:url';
 import 'node:path';
@@ -16,6 +17,10 @@ import 'node:crypto';
 import 'node:fs/promises';
 import '@supabase/supabase-js';
 import '../../../../../chunks/slug.js-BGuFQjqe.js';
+import '../../../../../chunks/solve-cache-key.js-BIwJfBG9.js';
+import '@selvajs/compute';
+import 'node:zlib';
+import 'node:util';
 
 const GET = async ({ url, cookies }) => {
   const code = url.searchParams.get("code");
@@ -34,4 +39,4 @@ const GET = async ({ url, cookies }) => {
 };
 
 export { GET };
-//# sourceMappingURL=_server.ts.js-3yXXN2SO.js.map
+//# sourceMappingURL=_server.ts.js-CmIWOQ81.js.map

package/build/server/chunks/entries/endpoints/auth/supabase/callback/_server.ts.js-CmIWOQ81.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-CmIWOQ81.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/auth/supabase/callback/_server.ts.js"],"sourcesContent":["import { redirect } from \"@sveltejs/kit\";\nimport { a as apiError, A as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\nimport { b as getAuthProvider } from \"../../../../../chunks/providers.server.js\";\nimport { b as bootstrapUserSession } from \"../../../../../chunks/auth-bootstrap.server.js\";\nimport { s as setSessionCookie, a as setRefreshCookie } from \"../../../../../chunks/admin-auth.server.js\";\nimport { s as safeRedirectTarget } from \"../../../../../chunks/redirect.js\";\nconst GET = async ({ url, cookies }) => {\n  const code = url.searchParams.get(\"code\");\n  if (!code) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing authorization code\");\n  const oauth = getAuthProvider().oauth;\n  if (!oauth) {\n    apiError(501, ApiErrorCode.INTERNAL, \"OAuth is not supported by the configured auth provider.\");\n  }\n  const result = await oauth.exchangeOAuthCode(code);\n  if (!result) apiError(401, ApiErrorCode.UNAUTHORIZED, \"OAuth exchange failed\");\n  await bootstrapUserSession(result.user);\n  setSessionCookie(cookies, result.sessionToken);\n  setRefreshCookie(cookies, result.refreshToken);\n  const dest = safeRedirectTarget(url.searchParams.get(\"redirectTo\"), \"/library\");\n  redirect(303, dest);\n};\nexport {\n  GET\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAMK,MAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK;AACxC,EAAE,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;AAC3C,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,4BAA4B,CAAC;AACxF,EAAE,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC,KAAK;AACvC,EAAE,IAAI,CAAC,KAAK,EAAE;AACd,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,yDAAyD,CAAC;AACnG,EAAE;AACF,EAAE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC;AACpD,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,uBAAuB,CAAC;AAChF,EAAE,MAAM,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC;AACzC,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AAChD,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AAChD,EAAE,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC;AACjF,EAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;AACrB;;;;"}

package/build/server/chunks/entries/endpoints/auth/supabase/start/{_server.ts.js-1z1P1Ihi.js → _server.ts.js-D0O8rZwg.js}

@@ -1,11 +1,11 @@
 import { redirect } from '@sveltejs/kit';
-import { a as apiError, A as ApiErrorCode } from '../../../../../chunks/api-errors.js-yRMzxqNi.js';
-import { g as getAuthProvider } from '../../../../../chunks/providers.server.js-D0hpk-aq.js';
-import '../../../../../chunks/context.js-D8E0GFTw.js';
+import { a as apiError, A as ApiErrorCode } from '../../../../../chunks/api-errors.js-DlfcfPJs.js';
+import { g as getAuthProvider } from '../../../../../chunks/providers.server.js-CIHOepKv.js';
+import '../../../../../chunks/context.js-DsQGiS2x.js';
 import 'zod';
 import '@selvajs/compute/core';
 import '../../../../../chunks/schema.js-j3D3emog.js';
-import '../../../../../chunks/utils4.js-BRotGwxx.js';
+import '../../../../../chunks/utils4.js-8SHxuGTr.js';
 import '../../../../../chunks/shared-server.js-DaWdgxVh.js';
 import 'node:url';
 import 'node:path';
@@ -41,4 +41,4 @@ const GET = async ({ url }) => {
 };
 
 export { GET };
-//# sourceMappingURL=_server.ts.js-1z1P1Ihi.js.map
+//# sourceMappingURL=_server.ts.js-D0O8rZwg.js.map

package/build/server/chunks/entries/endpoints/auth/supabase/start/{_server.ts.js-1z1P1Ihi.js.map → _server.ts.js-D0O8rZwg.js.map}

@@ -1 +1 @@
-{"version":3,"file":"_server.ts.js-1z1P1Ihi.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/auth/supabase/start/_server.ts.js"],"sourcesContent":["import { redirect } from \"@sveltejs/kit\";\nimport { a as apiError, A as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\nimport { a as getAuthProvider } from \"../../../../../chunks/providers.server.js\";\nconst ALLOWED_PROVIDERS = [\"google\", \"github\", \"azure\", \"gitlab\"];\nfunction isAllowedProvider(value) {\n  return value !== null && ALLOWED_PROVIDERS.includes(value);\n}\nconst GET = async ({ url }) => {\n  const provider = url.searchParams.get(\"provider\");\n  if (!isAllowedProvider(provider)) {\n    apiError(\n      400,\n      ApiErrorCode.VALIDATION_FAILED,\n      `Invalid provider. Allowed: ${ALLOWED_PROVIDERS.join(\", \")}`\n    );\n  }\n  const oauth = getAuthProvider().oauth;\n  if (!oauth) {\n    apiError(501, ApiErrorCode.INTERNAL, \"OAuth is not supported by the configured auth provider.\");\n  }\n  const redirectTo = url.searchParams.get(\"redirectTo\") ?? \"/library\";\n  const callbackUrl = new URL(\"/auth/supabase/callback\", url.origin);\n  if (redirectTo.startsWith(\"/\")) {\n    callbackUrl.searchParams.set(\"redirectTo\", redirectTo);\n  }\n  const authorizationUrl = await oauth.getOAuthAuthorizationUrl(provider, callbackUrl.toString());\n  redirect(303, authorizationUrl);\n};\nexport {\n  GET\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAGA,MAAM,iBAAiB,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC;AACjE,SAAS,iBAAiB,CAAC,KAAK,EAAE;AAClC,EAAE,OAAO,KAAK,KAAK,IAAI,IAAI,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC;AAC5D;AACK,MAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,KAAK;AAC/B,EAAE,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC;AACnD,EAAE,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE;AACpC,IAAI,QAAQ;AACZ,MAAM,GAAG;AACT,MAAM,YAAY,CAAC,iBAAiB;AACpC,MAAM,CAAC,2BAA2B,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjE,KAAK;AACL,EAAE;AACF,EAAE,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC,KAAK;AACvC,EAAE,IAAI,CAAC,KAAK,EAAE;AACd,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,yDAAyD,CAAC;AACnG,EAAE;AACF,EAAE,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,UAAU;AACrE,EAAE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,yBAAyB,EAAE,GAAG,CAAC,MAAM,CAAC;AACpE,EAAE,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;AAClC,IAAI,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC;AAC1D,EAAE;AACF,EAAE,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,wBAAwB,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC;AACjG,EAAE,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;AACjC;;;;"}
+{"version":3,"file":"_server.ts.js-D0O8rZwg.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/auth/supabase/start/_server.ts.js"],"sourcesContent":["import { redirect } from \"@sveltejs/kit\";\nimport { a as apiError, A as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\nimport { b as getAuthProvider } from \"../../../../../chunks/providers.server.js\";\nconst ALLOWED_PROVIDERS = [\"google\", \"github\", \"azure\", \"gitlab\"];\nfunction isAllowedProvider(value) {\n  return value !== null && ALLOWED_PROVIDERS.includes(value);\n}\nconst GET = async ({ url }) => {\n  const provider = url.searchParams.get(\"provider\");\n  if (!isAllowedProvider(provider)) {\n    apiError(\n      400,\n      ApiErrorCode.VALIDATION_FAILED,\n      `Invalid provider. Allowed: ${ALLOWED_PROVIDERS.join(\", \")}`\n    );\n  }\n  const oauth = getAuthProvider().oauth;\n  if (!oauth) {\n    apiError(501, ApiErrorCode.INTERNAL, \"OAuth is not supported by the configured auth provider.\");\n  }\n  const redirectTo = url.searchParams.get(\"redirectTo\") ?? \"/library\";\n  const callbackUrl = new URL(\"/auth/supabase/callback\", url.origin);\n  if (redirectTo.startsWith(\"/\")) {\n    callbackUrl.searchParams.set(\"redirectTo\", redirectTo);\n  }\n  const authorizationUrl = await oauth.getOAuthAuthorizationUrl(provider, callbackUrl.toString());\n  redirect(303, authorizationUrl);\n};\nexport {\n  GET\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAGA,MAAM,iBAAiB,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC;AACjE,SAAS,iBAAiB,CAAC,KAAK,EAAE;AAClC,EAAE,OAAO,KAAK,KAAK,IAAI,IAAI,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC;AAC5D;AACK,MAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,KAAK;AAC/B,EAAE,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC;AACnD,EAAE,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE;AACpC,IAAI,QAAQ;AACZ,MAAM,GAAG;AACT,MAAM,YAAY,CAAC,iBAAiB;AACpC,MAAM,CAAC,2BAA2B,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjE,KAAK;AACL,EAAE;AACF,EAAE,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC,KAAK;AACvC,EAAE,IAAI,CAAC,KAAK,EAAE;AACd,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,yDAAyD,CAAC;AACnG,EAAE;AACF,EAAE,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,UAAU;AACrE,EAAE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,yBAAyB,EAAE,GAAG,CAAC,MAAM,CAAC;AACpE,EAAE,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;AAClC,IAAI,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC;AAC1D,EAAE;AACF,EAAE,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,wBAAwB,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC;AACjG,EAAE,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;AACjC;;;;"}

package/build/server/chunks/entries/{hooks.server.js-OUXv4_qA.js → hooks.server.js-DSn6v_nP.js}

@@ -1,22 +1,62 @@
 import { redirect, isHttpError } from '@sveltejs/kit';
-import { S as SYSTEM_CONTEXT } from '../chunks/context.js-D8E0GFTw.js';
-import { p as providers, f as getErrorReporter } from '../chunks/providers.server.js-D0hpk-aq.js';
-import { g as getBootHealth } from '../chunks/bootHealth.server.js-CxNJCaGf.js';
-import { w as wireHeaderAuthBootstrap, b as bootstrapUserSession } from '../chunks/auth-bootstrap.server.js-BpQr_I_2.js';
-import { g as getRefreshToken, s as setSessionCookie, a as setRefreshCookie, c as clearRefreshCookie } from '../chunks/admin-auth.server.js-hCWF6Pqg.js';
+import { S as SYSTEM_CONTEXT } from '../chunks/context.js-DsQGiS2x.js';
+import { p as providers, f as getErrorReporter, h as getEventSink } from '../chunks/providers.server.js-CIHOepKv.js';
+import { g as getBootHealth } from '../chunks/bootHealth.server.js-CvLSuL2x.js';
+import { b as private_env } from '../chunks/shared-server.js-DaWdgxVh.js';
+import { f as findDeploymentDir, s as startUpdateOutcomeReconciler } from '../chunks/selfUpdate.server.js-CXejyqIT.js';
+import { w as wireHeaderAuthBootstrap, b as bootstrapUserSession } from '../chunks/auth-bootstrap.server.js-S-F5QI4m.js';
+import { g as getRefreshToken, s as setSessionCookie, a as setRefreshCookie, c as clearRefreshCookie } from '../chunks/admin-auth.server.js-CitjWnKM.js';
 import 'zod';
-import '../chunks/shared-server.js-DaWdgxVh.js';
 import 'node:url';
 import 'node:path';
 import 'node:fs';
 import 'node:crypto';
 import 'node:fs/promises';
 import '@supabase/supabase-js';
+import '../chunks/update-outcome.js-mUyfVCnt.js';
 import '../chunks/slug.js-BGuFQjqe.js';
+import '../chunks/solve-cache-key.js-BIwJfBG9.js';
+import '@selvajs/compute';
+import 'node:zlib';
+import 'node:util';
 
 function emptyProfile(userId) {
   return { userId, starredDefinitions: [], recentRuns: [] };
 }
+function applySecurityHeaders(response, opts) {
+  response.headers.set("X-Content-Type-Options", "nosniff");
+  response.headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
+  response.headers.set(
+    "Permissions-Policy",
+    "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()"
+  );
+  if (opts.hsts) {
+    response.headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
+  }
+  return response;
+}
+function createRouteClassifier(config) {
+  const publicPages = new Set(config.publicPages ?? []);
+  const publicPrefixes = config.publicPrefixes ?? [];
+  const publicApis = new Set(config.publicApis ?? []);
+  const selfGatingPrefix = config.selfGatingPrefix;
+  const staticPrefixes = config.staticPrefixes ?? [];
+  const staticPaths = new Set(config.staticPaths ?? []);
+  function isStaticAsset2(pathname) {
+    if (staticPaths.has(pathname)) return true;
+    return staticPrefixes.some((p) => pathname.startsWith(p));
+  }
+  function isSelfGatingApiRoute2(pathname) {
+    return selfGatingPrefix !== void 0 && pathname.startsWith(selfGatingPrefix);
+  }
+  function isPublicRoute2(pathname) {
+    if (publicPages.has(pathname)) return true;
+    if (publicApis.has(pathname)) return true;
+    if (isSelfGatingApiRoute2(pathname)) return true;
+    return publicPrefixes.some((p) => pathname.startsWith(p));
+  }
+  return { isStaticAsset: isStaticAsset2, isSelfGatingApiRoute: isSelfGatingApiRoute2, isPublicRoute: isPublicRoute2 };
+}
 let headerAuthBootstrapWired = false;
 let bootHealthKicked = false;
 let proxyAuthLoginMissWarned = false;
@@ -65,24 +105,29 @@ const PUBLIC_PAGE_ROUTES = /* @__PURE__ */ new Set([
   "/setup",
   "/accept-invite"
 ]);
-const PUBLIC_PATH_PREFIXES = ["/auth/", "/logout"];
-const PUBLIC_API_ROUTES = /* @__PURE__ */ new Set(["/api/health"]);
-const SELF_GATING_API_PREFIX = "/api/files/";
-const STATIC_ASSET_PREFIXES = ["/_app/", "/favicon/"];
-const STATIC_ASSET_PATHS = /* @__PURE__ */ new Set(["/favicon.svg", "/robots.txt"]);
-function isStaticAsset(pathname) {
-  if (STATIC_ASSET_PATHS.has(pathname)) return true;
-  return STATIC_ASSET_PREFIXES.some((p) => pathname.startsWith(p));
-}
-function isSelfGatingApiRoute(pathname) {
-  return pathname.startsWith(SELF_GATING_API_PREFIX);
-}
-function isPublicRoute(pathname) {
-  if (PUBLIC_PAGE_ROUTES.has(pathname)) return true;
-  if (PUBLIC_API_ROUTES.has(pathname)) return true;
-  if (isSelfGatingApiRoute(pathname)) return true;
-  return PUBLIC_PATH_PREFIXES.some((p) => pathname.startsWith(p));
-}
+const routeClassifier = createRouteClassifier({
+  publicPages: PUBLIC_PAGE_ROUTES,
+  // `/auth/` covers the OAuth start + callback flow (the user has no session
+  // yet by definition). `/logout` is a form-action page — the action destroys
+  // the session, then redirects.
+  publicPrefixes: ["/auth/", "/logout"],
+  // Endpoints that must answer without a session — currently just the
+  // load-balancer health probe. Anything added here must be safe to expose
+  // to anonymous callers.
+  publicApis: ["/api/health"],
+  // The blob proxy is *self-gating*: `/api/files/[...path]` classifies every
+  // path against the asset-class registry and applies per-class auth itself —
+  // public branding (logo/favicon) serves to anyone, while org/project assets
+  // 401 when no session is attached. So the hook must NOT deny it up front;
+  // the route makes the real decision. This is the ONLY `/api/*` prefix
+  // allowed to carry its own authorization.
+  selfGatingPrefix: "/api/files/",
+  // Static-asset paths SvelteKit/adapter-node serves directly — recognized so
+  // the auth gate doesn't trip and cache-control headers can apply.
+  staticPrefixes: ["/_app/", "/favicon/"],
+  staticPaths: ["/favicon.svg", "/robots.txt"]
+});
+const { isStaticAsset, isSelfGatingApiRoute, isPublicRoute } = routeClassifier;
 const handle = async ({ event, resolve }) => {
   event.locals.providers = providers;
   if (!headerAuthBootstrapWired) {
@@ -92,20 +137,28 @@ const handle = async ({ event, resolve }) => {
   if (!bootHealthKicked) {
     bootHealthKicked = true;
     void getBootHealth();
+    const deploymentDir = findDeploymentDir(private_env);
+    if (deploymentDir) {
+      startUpdateOutcomeReconciler({
+        deploymentDir,
+        emit: (e) => getEventSink().emit(e),
+        report: (err) => getErrorReporter().capture(err, { tags: { origin: "selfUpdate" } })
+      });
+    }
   }
   const { pathname } = event.url;
   if (isStaticAsset(pathname)) {
-    return applySecurityHeaders(await resolve(event), pathname);
+    return applyResponseHeaders(await resolve(event), pathname);
   }
   if (pathname === "/api/health") {
-    return applySecurityHeaders(await resolve(event), pathname);
+    return applyResponseHeaders(await resolve(event), pathname);
   }
   const publicRoute = isPublicRoute(pathname);
   const isJsonApiRoute = pathname.startsWith("/api/") || pathname.startsWith("/admin/api/");
   if (!publicRoute) {
     if (await isFirstRun()) {
       if (isJsonApiRoute) {
-        return applySecurityHeaders(
+        return applyResponseHeaders(
           new Response(JSON.stringify({ message: "Setup required", code: "SETUP_REQUIRED" }), {
             status: 503,
             headers: { "Content-Type": "application/json" }
@@ -141,7 +194,7 @@ const handle = async ({ event, resolve }) => {
     }
     if (!user) {
       if (isJsonApiRoute) {
-        return applySecurityHeaders(
+        return applyResponseHeaders(
           new Response(
             JSON.stringify({
               message: "Your session has expired. Sign in again to continue.",
@@ -201,18 +254,13 @@ const handle = async ({ event, resolve }) => {
       event.locals.ctx = await buildContext(user, token, platformPermissions, membership);
     }
   }
-  return applySecurityHeaders(await resolve(event), pathname);
+  return applyResponseHeaders(await resolve(event), pathname);
 };
-function applySecurityHeaders(response, pathname) {
-  response.headers.set("X-Content-Type-Options", "nosniff");
-  response.headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
-  response.headers.set(
-    "Permissions-Policy",
-    "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()"
-  );
-  if (process.env.NODE_ENV === "production") {
-    response.headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
-  }
+function applyResponseHeaders(response, pathname) {
+  applySecurityHeaders(response, {
+    // eslint-disable-next-line no-restricted-properties -- NODE_ENV is OS-level, set by Node/Vite, not loaded from .env
+    hsts: process.env.NODE_ENV === "production"
+  });
   if (pathname.startsWith("/_app/")) {
     response.headers.set("Cache-Control", "public, max-age=31536000, immutable");
   } else if (pathname.startsWith("/favicon/") || pathname === "/favicon.svg" || pathname === "/robots.txt") {
@@ -255,4 +303,4 @@ const handleError = ({
 };
 
 export { buildContext, handle, handleError, isPublicRoute, isSelfGatingApiRoute, isStaticAsset };
-//# sourceMappingURL=hooks.server.js-OUXv4_qA.js.map
+//# sourceMappingURL=hooks.server.js-DSn6v_nP.js.map