@selvajs/selva 4.7.0-beta.4 → 4.7.0-beta.6

package/build/server/chunks/_server.ts-HN9AJemD.js

@@ -0,0 +1,53 @@
+import { q as getAuthProvider } from './providers.server-C1zmtRr7.js';
+import { a as apiError, A as ApiErrorCode } from './api-errors-BQbl4HI1.js';
+import { s as setSessionCookie, a as setRefreshCookie } from './admin-auth.server-DuW75w_u.js';
+import { s as safeRedirectTarget } from './redirect-B4i9gSkt.js';
+import { b as bootstrapUserSession } from './auth-bootstrap.server-Dvp4YNB1.js';
+import { redirect } from '@sveltejs/kit';
+import './index.js-NH2Q8xBT.js';
+import 'clsx';
+import '@sveltejs/kit/internal';
+import '@sveltejs/kit/internal/server';
+import './src-tWHhLCSB.js';
+import 'zod';
+import './limits-D8LKRL6A.js';
+import './chunk-Y3M7P3BW-CpcVbL4P.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import './utils2-D6nbl_7H.js';
+import './compute-B8HU5cQL.js';
+import 'node:zlib';
+import 'node:util';
+import 'node:dns/promises';
+import 'node:net';
+
+//#region src/routes/auth/supabase/callback/+server.ts
+/**
+* GET /auth/supabase/callback?code=...&redirectTo=/library
+*
+* Completes a Supabase OAuth round-trip. Exchanges the authorization code
+* for a session, sets the session cookie, and redirects to `redirectTo`.
+*
+* Post-verification flow (data-row seeding + first-admin bootstrap) lives in
+* `bootstrapUserSession` so the email-link and OAuth paths follow the same
+* sequence in the same order.
+*/
+var GET = async ({ url, cookies }) => {
+	const code = url.searchParams.get("code");
+	if (!code) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Missing authorization code");
+	const oauth = getAuthProvider().oauth;
+	if (!oauth) apiError(501, ApiErrorCode.INTERNAL, "OAuth is not supported by the configured auth provider.");
+	const result = await oauth.exchangeOAuthCode(code);
+	if (!result) apiError(401, ApiErrorCode.UNAUTHORIZED, "OAuth exchange failed");
+	await bootstrapUserSession(result.user);
+	setSessionCookie(cookies, result.sessionToken);
+	setRefreshCookie(cookies, result.refreshToken);
+	redirect(303, safeRedirectTarget(url.searchParams.get("redirectTo"), "/library"));
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts-HN9AJemD.js.map

package/build/server/chunks/_server.ts-HN9AJemD.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-HN9AJemD.js","sources":["../../../.svelte-kit/output/server/entries/endpoints/auth/supabase/callback/_server.ts.js"],"sourcesContent":["import { r as getAuthProvider } from \"../../../../../chunks/providers.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\nimport { c as setRefreshCookie, l as setSessionCookie } from \"../../../../../chunks/admin-auth.server.js\";\nimport \"../../../../../chunks/auth.server.js\";\nimport { t as safeRedirectTarget } from \"../../../../../chunks/redirect.js\";\nimport { t as bootstrapUserSession } from \"../../../../../chunks/auth-bootstrap.server.js\";\nimport { redirect } from \"@sveltejs/kit\";\n//#region src/routes/auth/supabase/callback/+server.ts\n/**\n* GET /auth/supabase/callback?code=...&redirectTo=/library\n*\n* Completes a Supabase OAuth round-trip. Exchanges the authorization code\n* for a session, sets the session cookie, and redirects to `redirectTo`.\n*\n* Post-verification flow (data-row seeding + first-admin bootstrap) lives in\n* `bootstrapUserSession` so the email-link and OAuth paths follow the same\n* sequence in the same order.\n*/\nvar GET = async ({ url, cookies }) => {\n\tconst code = url.searchParams.get(\"code\");\n\tif (!code) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing authorization code\");\n\tconst oauth = getAuthProvider().oauth;\n\tif (!oauth) apiError(501, ApiErrorCode.INTERNAL, \"OAuth is not supported by the configured auth provider.\");\n\tconst result = await oauth.exchangeOAuthCode(code);\n\tif (!result) apiError(401, ApiErrorCode.UNAUTHORIZED, \"OAuth exchange failed\");\n\tawait bootstrapUserSession(result.user);\n\tsetSessionCookie(cookies, result.sessionToken);\n\tsetRefreshCookie(cookies, result.refreshToken);\n\tredirect(303, safeRedirectTarget(url.searchParams.get(\"redirectTo\"), \"/library\"));\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAOA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK;AACtC,CAAC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;AAC1C,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,4BAA4B,CAAC;AACvF,CAAC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC,KAAK;AACtC,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,yDAAyD,CAAC;AAC5G,CAAC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC;AACnD,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,uBAAuB,CAAC;AAC/E,CAAC,MAAM,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC;AACxC,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AAC/C,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AAC/C,CAAC,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC,CAAC;AAClF;;;;"}

package/build/server/chunks/_server.ts-Ief6fYfl.js

@@ -0,0 +1,111 @@
+import './src-tWHhLCSB.js';
+import { e as getComputeServerConfigStore, z as isOrgServer, i as isPlatformServer, f as flag } from './providers.server-C1zmtRr7.js';
+import { s as serversVisibleTo } from './utils2-D6nbl_7H.js';
+import { k as requireManageOrgCompute } from './access.server-BWOmKi8Z.js';
+import { a as apiError, A as ApiErrorCode } from './api-errors-BQbl4HI1.js';
+import { e as evictChangedServers } from './evictChangedServers-BqI2ue7s.js';
+import { json } from '@sveltejs/kit';
+import 'zod';
+import './index.js-NH2Q8xBT.js';
+import 'clsx';
+import '@sveltejs/kit/internal';
+import '@sveltejs/kit/internal/server';
+import './limits-D8LKRL6A.js';
+import './chunk-Y3M7P3BW-CpcVbL4P.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import './clientCache.server-CM1IqDWH.js';
+import './compute-B8HU5cQL.js';
+import 'node:zlib';
+import 'node:util';
+import 'node:dns/promises';
+import 'node:net';
+import './computeLimits-DvrrqPiD.js';
+
+//#region src/routes/api/org/compute/+server.ts
+function requireFlag() {
+	if (!flag("ALLOW_ORG_COMPUTE_OVERRIDE")) apiError(403, ApiErrorCode.FORBIDDEN, "Per-org compute override is disabled on this instance (ALLOW_ORG_COMPUTE_OVERRIDE).");
+}
+var GET = async ({ locals }) => {
+	requireFlag();
+	requireManageOrgCompute(locals);
+	const ctx = locals.ctx;
+	if (!ctx.actingOrgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, "No active organization");
+	const config = await getComputeServerConfigStore().getConfig(ctx);
+	const orgId = ctx.actingOrgId;
+	const owned = config.servers.filter((s) => isOrgServer(s) && s.ownerOrgId === orgId).map((s) => {
+		const { apiKey: _apiKey, hasApiKey, ...rest } = s;
+		return {
+			...rest,
+			hasApiKey: !!hasApiKey
+		};
+	});
+	const catalog = serversVisibleTo(config, orgId).map((s) => ({
+		id: s.id,
+		label: s.label,
+		serverUrl: s.serverUrl,
+		scope: s.scope,
+		source: isPlatformServer(s) ? "platform" : "org",
+		timeoutMs: s.timeoutMs,
+		retryCount: s.retryCount
+	}));
+	return json({
+		servers: owned,
+		defaultServerId: config.orgDefaults?.[orgId] ?? null,
+		globalDefaultServerId: config.defaultServerId ?? null,
+		catalog
+	});
+};
+var PUT = async ({ request, locals }) => {
+	requireFlag();
+	requireManageOrgCompute(locals);
+	const ctx = locals.ctx;
+	if (!ctx.actingOrgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, "No active organization");
+	const orgId = ctx.actingOrgId;
+	const body = await request.json().catch(() => null);
+	if (!body || typeof body !== "object") apiError(400, ApiErrorCode.VALIDATION_FAILED, "Invalid request body");
+	const incoming = body;
+	if (!Array.isArray(incoming.servers)) apiError(400, ApiErrorCode.VALIDATION_FAILED, "servers must be an array");
+	for (const s of incoming.servers) {
+		if (!s.id || typeof s.id !== "string") apiError(400, ApiErrorCode.VALIDATION_FAILED, "Each server needs an id");
+		if (!s.label || typeof s.label !== "string") apiError(400, ApiErrorCode.VALIDATION_FAILED, "Each server needs a label");
+		if (!s.serverUrl || typeof s.serverUrl !== "string") apiError(400, ApiErrorCode.VALIDATION_FAILED, "Each server needs a serverUrl");
+		try {
+			new URL(s.serverUrl);
+		} catch {
+			apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid serverUrl: ${s.serverUrl}`);
+		}
+		if (s.apiKey !== void 0 && s.apiKey !== null && typeof s.apiKey !== "string") apiError(400, ApiErrorCode.VALIDATION_FAILED, "apiKey must be a string, null, or omitted");
+	}
+	const provider = getComputeServerConfigStore();
+	const existing = await provider.getConfig(ctx, { includeApiKeys: true });
+	const storedKeyById = new Map(existing.servers.filter((s) => isOrgServer(s) && s.ownerOrgId === orgId).map((s) => [s.id, s.apiKey]));
+	const next = incoming.servers.map((s) => ({
+		id: s.id,
+		scope: "org",
+		ownerOrgId: orgId,
+		label: s.label,
+		serverUrl: s.serverUrl,
+		timeoutMs: s.timeoutMs,
+		retryCount: s.retryCount,
+		apiKey: s.apiKey === null ? void 0 : s.apiKey ? s.apiKey : storedKeyById.get(s.id)
+	}));
+	if (typeof incoming.defaultServerId === "string") {
+		const projected = {
+			servers: [...existing.servers.filter((s) => !(isOrgServer(s) && s.ownerOrgId === orgId)), ...next],
+			defaultServerId: existing.defaultServerId,
+			orgDefaults: existing.orgDefaults
+		};
+		if (!new Set(serversVisibleTo(projected, orgId).map((s) => s.id)).has(incoming.defaultServerId)) apiError(400, ApiErrorCode.VALIDATION_FAILED, "defaultServerId must reference a server visible to this organization");
+	}
+	await provider.saveOrgServers(ctx, orgId, next, incoming.defaultServerId);
+	evictChangedServers(existing.servers.filter((s) => isOrgServer(s) && s.ownerOrgId === orgId), next);
+	return new Response(null, { status: 204 });
+};
+
+export { GET, PUT };
+//# sourceMappingURL=_server.ts-Ief6fYfl.js.map

package/build/server/chunks/_server.ts-Ief6fYfl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-Ief6fYfl.js","sources":["../../../.svelte-kit/output/server/entries/endpoints/api/org/compute/_server.ts.js"],"sourcesContent":["import \"../../../../../chunks/src.js\";\nimport { F as isPlatformServer, P as isOrgServer, a as getComputeServerConfigStore, t as flag } from \"../../../../../chunks/providers.server.js\";\nimport { a as serversVisibleTo } from \"../../../../../chunks/utils2.js\";\nimport { b as requireManageOrgCompute } from \"../../../../../chunks/access.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\nimport { t as evictChangedServers } from \"../../../../../chunks/evictChangedServers.js\";\nimport { json } from \"@sveltejs/kit\";\n//#region src/routes/api/org/compute/+server.ts\nfunction requireFlag() {\n\tif (!flag(\"ALLOW_ORG_COMPUTE_OVERRIDE\")) apiError(403, ApiErrorCode.FORBIDDEN, \"Per-org compute override is disabled on this instance (ALLOW_ORG_COMPUTE_OVERRIDE).\");\n}\nvar GET = async ({ locals }) => {\n\trequireFlag();\n\trequireManageOrgCompute(locals);\n\tconst ctx = locals.ctx;\n\tif (!ctx.actingOrgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"No active organization\");\n\tconst config = await getComputeServerConfigStore().getConfig(ctx);\n\tconst orgId = ctx.actingOrgId;\n\tconst owned = config.servers.filter((s) => isOrgServer(s) && s.ownerOrgId === orgId).map((s) => {\n\t\tconst { apiKey: _apiKey, hasApiKey, ...rest } = s;\n\t\treturn {\n\t\t\t...rest,\n\t\t\thasApiKey: !!hasApiKey\n\t\t};\n\t});\n\tconst catalog = serversVisibleTo(config, orgId).map((s) => ({\n\t\tid: s.id,\n\t\tlabel: s.label,\n\t\tserverUrl: s.serverUrl,\n\t\tscope: s.scope,\n\t\tsource: isPlatformServer(s) ? \"platform\" : \"org\",\n\t\ttimeoutMs: s.timeoutMs,\n\t\tretryCount: s.retryCount\n\t}));\n\treturn json({\n\t\tservers: owned,\n\t\tdefaultServerId: config.orgDefaults?.[orgId] ?? null,\n\t\tglobalDefaultServerId: config.defaultServerId ?? null,\n\t\tcatalog\n\t});\n};\nvar PUT = async ({ request, locals }) => {\n\trequireFlag();\n\trequireManageOrgCompute(locals);\n\tconst ctx = locals.ctx;\n\tif (!ctx.actingOrgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"No active organization\");\n\tconst orgId = ctx.actingOrgId;\n\tconst body = await request.json().catch(() => null);\n\tif (!body || typeof body !== \"object\") apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Invalid request body\");\n\tconst incoming = body;\n\tif (!Array.isArray(incoming.servers)) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"servers must be an array\");\n\tfor (const s of incoming.servers) {\n\t\tif (!s.id || typeof s.id !== \"string\") apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Each server needs an id\");\n\t\tif (!s.label || typeof s.label !== \"string\") apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Each server needs a label\");\n\t\tif (!s.serverUrl || typeof s.serverUrl !== \"string\") apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Each server needs a serverUrl\");\n\t\ttry {\n\t\t\tnew URL(s.serverUrl);\n\t\t} catch {\n\t\t\tapiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid serverUrl: ${s.serverUrl}`);\n\t\t}\n\t\tif (s.apiKey !== void 0 && s.apiKey !== null && typeof s.apiKey !== \"string\") apiError(400, ApiErrorCode.VALIDATION_FAILED, \"apiKey must be a string, null, or omitted\");\n\t}\n\tconst provider = getComputeServerConfigStore();\n\tconst existing = await provider.getConfig(ctx, { includeApiKeys: true });\n\tconst storedKeyById = new Map(existing.servers.filter((s) => isOrgServer(s) && s.ownerOrgId === orgId).map((s) => [s.id, s.apiKey]));\n\tconst next = incoming.servers.map((s) => ({\n\t\tid: s.id,\n\t\tscope: \"org\",\n\t\townerOrgId: orgId,\n\t\tlabel: s.label,\n\t\tserverUrl: s.serverUrl,\n\t\ttimeoutMs: s.timeoutMs,\n\t\tretryCount: s.retryCount,\n\t\tapiKey: s.apiKey === null ? void 0 : s.apiKey ? s.apiKey : storedKeyById.get(s.id)\n\t}));\n\tif (typeof incoming.defaultServerId === \"string\") {\n\t\tconst projected = {\n\t\t\tservers: [...existing.servers.filter((s) => !(isOrgServer(s) && s.ownerOrgId === orgId)), ...next],\n\t\t\tdefaultServerId: existing.defaultServerId,\n\t\t\torgDefaults: existing.orgDefaults\n\t\t};\n\t\tif (!new Set(serversVisibleTo(projected, orgId).map((s) => s.id)).has(incoming.defaultServerId)) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"defaultServerId must reference a server visible to this organization\");\n\t}\n\tawait provider.saveOrgServers(ctx, orgId, next, incoming.defaultServerId);\n\tevictChangedServers(existing.servers.filter((s) => isOrgServer(s) && s.ownerOrgId === orgId), next);\n\treturn new Response(null, { status: 204 });\n};\n//#endregion\nexport { GET, PUT };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAOA;AACA,SAAS,WAAW,GAAG;AACvB,CAAC,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,qFAAqF,CAAC;AACtK;AACG,IAAC,GAAG,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK;AAChC,CAAC,WAAW,EAAE;AACd,CAAC,uBAAuB,CAAC,MAAM,CAAC;AAChC,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACvB,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;AAC9F,CAAC,MAAM,MAAM,GAAG,MAAM,2BAA2B,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC;AAClE,CAAC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW;AAC9B,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK;AACjG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC;AACnD,EAAE,OAAO;AACT,GAAG,GAAG,IAAI;AACV,GAAG,SAAS,EAAE,CAAC,CAAC;AAChB,GAAG;AACH,CAAC,CAAC,CAAC;AACH,CAAC,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM;AAC7D,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE;AACV,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK;AAChB,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;AACxB,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK;AAChB,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,UAAU,GAAG,KAAK;AAClD,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;AACxB,EAAE,UAAU,EAAE,CAAC,CAAC;AAChB,EAAE,CAAC,CAAC;AACJ,CAAC,OAAO,IAAI,CAAC;AACb,EAAE,OAAO,EAAE,KAAK;AAChB,EAAE,eAAe,EAAE,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC,IAAI,IAAI;AACtD,EAAE,qBAAqB,EAAE,MAAM,CAAC,eAAe,IAAI,IAAI;AACvD,EAAE;AACF,EAAE,CAAC;AACH;AACG,IAAC,GAAG,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AACzC,CAAC,WAAW,EAAE;AACd,CAAC,uBAAuB,CAAC,MAAM,CAAC;AAChC,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACvB,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;AAC9F,CAAC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW;AAC9B,CAAC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;AACpD,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,sBAAsB,CAAC;AAC7G,CAAC,MAAM,QAAQ,GAAG,IAAI;AACtB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,0BAA0B,CAAC;AAChH,CAAC,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE;AACnC,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,yBAAyB,CAAC;AACjH,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,2BAA2B,CAAC;AACzH,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,+BAA+B,CAAC;AACrI,EAAE,IAAI;AACN,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACvB,EAAE,CAAC,CAAC,MAAM;AACV,GAAG,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,mBAAmB,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AACrF,EAAE;AACF,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,2CAA2C,CAAC;AAC1K,CAAC;AACD,CAAC,MAAM,QAAQ,GAAG,2BAA2B,EAAE;AAC/C,CAAC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;AACzE,CAAC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AACrI,CAAC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM;AAC3C,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE;AACV,EAAE,KAAK,EAAE,KAAK;AACd,EAAE,UAAU,EAAE,KAAK;AACnB,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK;AAChB,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;AACxB,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;AACxB,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU;AAC1B,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,IAAI,GAAG,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;AACnF,EAAE,CAAC,CAAC;AACJ,CAAC,IAAI,OAAO,QAAQ,CAAC,eAAe,KAAK,QAAQ,EAAE;AACnD,EAAE,MAAM,SAAS,GAAG;AACpB,GAAG,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC;AACrG,GAAG,eAAe,EAAE,QAAQ,CAAC,eAAe;AAC5C,GAAG,WAAW,EAAE,QAAQ,CAAC;AACzB,GAAG;AACH,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,sEAAsE,CAAC;AACxN,CAAC;AACD,CAAC,MAAM,QAAQ,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,eAAe,CAAC;AAC1E,CAAC,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,EAAE,IAAI,CAAC;AACpG,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC3C;;;;"}

package/build/server/chunks/_server.ts-Vhd5UmX6.js

@@ -0,0 +1,49 @@
+import { q as getAuthProvider } from './providers.server-C1zmtRr7.js';
+import { a as apiError, A as ApiErrorCode } from './api-errors-BQbl4HI1.js';
+import { s as setSessionCookie, a as setRefreshCookie } from './admin-auth.server-DuW75w_u.js';
+import { s as safeRedirectTarget } from './redirect-B4i9gSkt.js';
+import { b as bootstrapUserSession } from './auth-bootstrap.server-Dvp4YNB1.js';
+import { redirect } from '@sveltejs/kit';
+import './index.js-NH2Q8xBT.js';
+import 'clsx';
+import '@sveltejs/kit/internal';
+import '@sveltejs/kit/internal/server';
+import './src-tWHhLCSB.js';
+import 'zod';
+import './limits-D8LKRL6A.js';
+import './chunk-Y3M7P3BW-CpcVbL4P.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import './utils2-D6nbl_7H.js';
+import './compute-B8HU5cQL.js';
+import 'node:zlib';
+import 'node:util';
+import 'node:dns/promises';
+import 'node:net';
+
+//#region src/routes/auth/email/callback/+server.ts
+/**
+* GET /auth/email/callback?token_hash=...&type=...&redirectTo=/library
+*
+* The user clicked the magic link in their inbox. Hand the full URL to the
+* adapter (it knows its own token format), set cookies on success, redirect
+* to the destination. Mirrors `/auth/supabase/callback` but capability-named
+* — this route doesn't know which IdP brokered the email.
+*/
+var GET = async ({ url, cookies }) => {
+	const emailLink = getAuthProvider().emailLink;
+	if (!emailLink) apiError(501, ApiErrorCode.INTERNAL, "Email sign-in is not supported by this provider.");
+	const result = await emailLink.verifyMagicLink(url.toString());
+	if (!result) apiError(401, ApiErrorCode.UNAUTHORIZED, "This sign-in link is invalid or has expired.");
+	await bootstrapUserSession(result.user);
+	setSessionCookie(cookies, result.sessionToken);
+	if (result.refreshToken) setRefreshCookie(cookies, result.refreshToken);
+	redirect(303, safeRedirectTarget(url.searchParams.get("redirectTo"), "/library"));
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts-Vhd5UmX6.js.map

package/build/server/chunks/_server.ts-Vhd5UmX6.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-Vhd5UmX6.js","sources":["../../../.svelte-kit/output/server/entries/endpoints/auth/email/callback/_server.ts.js"],"sourcesContent":["import { r as getAuthProvider } from \"../../../../../chunks/providers.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\nimport { c as setRefreshCookie, l as setSessionCookie } from \"../../../../../chunks/admin-auth.server.js\";\nimport \"../../../../../chunks/auth.server.js\";\nimport { t as safeRedirectTarget } from \"../../../../../chunks/redirect.js\";\nimport { t as bootstrapUserSession } from \"../../../../../chunks/auth-bootstrap.server.js\";\nimport { redirect } from \"@sveltejs/kit\";\n//#region src/routes/auth/email/callback/+server.ts\n/**\n* GET /auth/email/callback?token_hash=...&type=...&redirectTo=/library\n*\n* The user clicked the magic link in their inbox. Hand the full URL to the\n* adapter (it knows its own token format), set cookies on success, redirect\n* to the destination. Mirrors `/auth/supabase/callback` but capability-named\n* — this route doesn't know which IdP brokered the email.\n*/\nvar GET = async ({ url, cookies }) => {\n\tconst emailLink = getAuthProvider().emailLink;\n\tif (!emailLink) apiError(501, ApiErrorCode.INTERNAL, \"Email sign-in is not supported by this provider.\");\n\tconst result = await emailLink.verifyMagicLink(url.toString());\n\tif (!result) apiError(401, ApiErrorCode.UNAUTHORIZED, \"This sign-in link is invalid or has expired.\");\n\tawait bootstrapUserSession(result.user);\n\tsetSessionCookie(cookies, result.sessionToken);\n\tif (result.refreshToken) setRefreshCookie(cookies, result.refreshToken);\n\tredirect(303, safeRedirectTarget(url.searchParams.get(\"redirectTo\"), \"/library\"));\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAOA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK;AACtC,CAAC,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC,SAAS;AAC9C,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,kDAAkD,CAAC;AACzG,CAAC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;AAC/D,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,8CAA8C,CAAC;AACtG,CAAC,MAAM,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC;AACxC,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AAC/C,CAAC,IAAI,MAAM,CAAC,YAAY,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AACxE,CAAC,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC,CAAC;AAClF;;;;"}

package/build/server/chunks/_server.ts-WrKWZCbL.js

@@ -0,0 +1,81 @@
+import { M as MEMBER_ASSIGNABLE_PERMISSIONS, a as ALL_ORG_PERMISSIONS, k as OrgRoleSchema } from './src-tWHhLCSB.js';
+import { b as getOrganizationProvider } from './providers.server-C1zmtRr7.js';
+import { c as requireManageOrgMembers } from './access.server-BWOmKi8Z.js';
+import { a as apiError, t as throwZodError, A as ApiErrorCode, h as handleApiError } from './api-errors-BQbl4HI1.js';
+import { z } from 'zod';
+import './index.js-NH2Q8xBT.js';
+import 'clsx';
+import '@sveltejs/kit/internal';
+import '@sveltejs/kit';
+import '@sveltejs/kit/internal/server';
+import './limits-D8LKRL6A.js';
+import './chunk-Y3M7P3BW-CpcVbL4P.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import './utils2-D6nbl_7H.js';
+
+//#region src/routes/api/orgs/[orgId]/members/[userId]/+server.ts
+/**
+* PATCH /api/orgs/[orgId]/members/[userId]
+*
+* Body accepts either or both:
+*   - `{ role: OrgRole }` — change the member's role. **Owner-only** per §3.
+*   - `{ permissions: OrgPermission[] }` — replace the member's grantable
+*     permissions. Owner/admin via `manage_org_members`. For `member`-role
+*     targets, only `MEMBER_ASSIGNABLE_PERMISSIONS` are accepted; promoting a
+*     member's permissions does NOT change their role (that's a separate
+*     branch, owner-only).
+*
+* Tenancy: the URL `orgId` must equal `ctx.actingOrgId`. Cross-org member
+* mutation is blocked even if the actor holds permissions in another org.
+*
+* Self-protection (sole-owner invariant, §10 spirit): the only owner of an
+* org cannot be demoted. Demoting yourself while you are the sole owner is
+* the most common way to discover this — handler returns 409.
+*/
+var PERMISSIONS_SCHEMA = z.array(z.enum(ALL_ORG_PERMISSIONS));
+var PatchSchema = z.object({
+	role: OrgRoleSchema.optional(),
+	permissions: PERMISSIONS_SCHEMA.optional()
+}).refine((b) => b.role !== void 0 || b.permissions !== void 0, { message: "Provide at least one of role, permissions" });
+var PATCH = async ({ params, request, locals }) => {
+	const { orgId, userId } = params;
+	if (!orgId || !userId) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Missing org ID or user ID");
+	requireManageOrgMembers(locals);
+	const ctx = locals.ctx;
+	if (ctx.actingOrgId !== orgId) apiError(403, ApiErrorCode.FORBIDDEN, "Acting org does not match the target org.");
+	const body = await request.json().catch(() => null);
+	const parsed = PatchSchema.safeParse(body);
+	if (!parsed.success) throwZodError(parsed.error);
+	const patch = parsed.data;
+	const orgs = getOrganizationProvider();
+	const [actorMember, target] = await Promise.all([orgs.getOrgMember(ctx, orgId, ctx.userId), orgs.getOrgMember(ctx, orgId, userId)]);
+	if (!target) apiError(404, ApiErrorCode.NOT_FOUND, "Member not found in this organization.");
+	if (!actorMember) apiError(403, ApiErrorCode.FORBIDDEN, "You are not a member of this organization.");
+	if (patch.role !== void 0 && patch.role !== target.role) {
+		if (actorMember.role !== "owner") apiError(403, ApiErrorCode.FORBIDDEN, "Only the org owner can change roles.");
+		if (target.role === "owner" && patch.role !== "owner") {
+			if ((await orgs.listOrgMembers(ctx, orgId, { limit: 200 })).items.filter((m) => m.role === "owner" && m.userId !== target.userId && !m.deletedAt).length === 0) apiError(409, ApiErrorCode.CONFLICT, "Cannot demote the sole owner of this organization. Promote another member to owner first.");
+		}
+		await orgs.updateOrgMemberRole(ctx, orgId, userId, patch.role);
+	}
+	if (patch.permissions !== void 0) {
+		const effectiveRole = patch.role ?? target.role;
+		const valid = effectiveRole === "member" ? new Set(MEMBER_ASSIGNABLE_PERMISSIONS) : new Set(ALL_ORG_PERMISSIONS);
+		const invalid = patch.permissions.filter((p) => !valid.has(p));
+		if (invalid.length > 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Permissions [${invalid.join(", ")}] cannot be assigned to a ${effectiveRole}.`);
+		try {
+			await orgs.updateOrgMemberPermissions(ctx, orgId, userId, patch.permissions);
+		} catch (err) {
+			handleApiError(err, "Failed to update permissions");
+		}
+	}
+	return new Response(null, { status: 204 });
+};
+
+export { PATCH };
+//# sourceMappingURL=_server.ts-WrKWZCbL.js.map

package/build/server/chunks/_server.ts-WrKWZCbL.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-WrKWZCbL.js","sources":["../../../.svelte-kit/output/server/entries/endpoints/api/orgs/_orgId_/members/_userId_/_server.ts.js"],"sourcesContent":["import { S as OrgRoleSchema, h as ALL_ORG_PERMISSIONS, v as MEMBER_ASSIGNABLE_PERMISSIONS } from \"../../../../../../../chunks/src.js\";\nimport { m as getOrganizationProvider } from \"../../../../../../../chunks/providers.server.js\";\nimport { x as requireManageOrgMembers } from \"../../../../../../../chunks/access.server.js\";\nimport { i as throwZodError, n as apiError, r as handleApiError, t as ApiErrorCode } from \"../../../../../../../chunks/api-errors.js\";\nimport { z } from \"zod\";\n//#region src/routes/api/orgs/[orgId]/members/[userId]/+server.ts\n/**\n* PATCH /api/orgs/[orgId]/members/[userId]\n*\n* Body accepts either or both:\n*   - `{ role: OrgRole }` — change the member's role. **Owner-only** per §3.\n*   - `{ permissions: OrgPermission[] }` — replace the member's grantable\n*     permissions. Owner/admin via `manage_org_members`. For `member`-role\n*     targets, only `MEMBER_ASSIGNABLE_PERMISSIONS` are accepted; promoting a\n*     member's permissions does NOT change their role (that's a separate\n*     branch, owner-only).\n*\n* Tenancy: the URL `orgId` must equal `ctx.actingOrgId`. Cross-org member\n* mutation is blocked even if the actor holds permissions in another org.\n*\n* Self-protection (sole-owner invariant, §10 spirit): the only owner of an\n* org cannot be demoted. Demoting yourself while you are the sole owner is\n* the most common way to discover this — handler returns 409.\n*/\nvar PERMISSIONS_SCHEMA = z.array(z.enum(ALL_ORG_PERMISSIONS));\nvar PatchSchema = z.object({\n\trole: OrgRoleSchema.optional(),\n\tpermissions: PERMISSIONS_SCHEMA.optional()\n}).refine((b) => b.role !== void 0 || b.permissions !== void 0, { message: \"Provide at least one of role, permissions\" });\nvar PATCH = async ({ params, request, locals }) => {\n\tconst { orgId, userId } = params;\n\tif (!orgId || !userId) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing org ID or user ID\");\n\trequireManageOrgMembers(locals);\n\tconst ctx = locals.ctx;\n\tif (ctx.actingOrgId !== orgId) apiError(403, ApiErrorCode.FORBIDDEN, \"Acting org does not match the target org.\");\n\tconst body = await request.json().catch(() => null);\n\tconst parsed = PatchSchema.safeParse(body);\n\tif (!parsed.success) throwZodError(parsed.error);\n\tconst patch = parsed.data;\n\tconst orgs = getOrganizationProvider();\n\tconst [actorMember, target] = await Promise.all([orgs.getOrgMember(ctx, orgId, ctx.userId), orgs.getOrgMember(ctx, orgId, userId)]);\n\tif (!target) apiError(404, ApiErrorCode.NOT_FOUND, \"Member not found in this organization.\");\n\tif (!actorMember) apiError(403, ApiErrorCode.FORBIDDEN, \"You are not a member of this organization.\");\n\tif (patch.role !== void 0 && patch.role !== target.role) {\n\t\tif (actorMember.role !== \"owner\") apiError(403, ApiErrorCode.FORBIDDEN, \"Only the org owner can change roles.\");\n\t\tif (target.role === \"owner\" && patch.role !== \"owner\") {\n\t\t\tif ((await orgs.listOrgMembers(ctx, orgId, { limit: 200 })).items.filter((m) => m.role === \"owner\" && m.userId !== target.userId && !m.deletedAt).length === 0) apiError(409, ApiErrorCode.CONFLICT, \"Cannot demote the sole owner of this organization. Promote another member to owner first.\");\n\t\t}\n\t\tawait orgs.updateOrgMemberRole(ctx, orgId, userId, patch.role);\n\t}\n\tif (patch.permissions !== void 0) {\n\t\tconst effectiveRole = patch.role ?? target.role;\n\t\tconst valid = effectiveRole === \"member\" ? new Set(MEMBER_ASSIGNABLE_PERMISSIONS) : new Set(ALL_ORG_PERMISSIONS);\n\t\tconst invalid = patch.permissions.filter((p) => !valid.has(p));\n\t\tif (invalid.length > 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Permissions [${invalid.join(\", \")}] cannot be assigned to a ${effectiveRole}.`);\n\t\ttry {\n\t\t\tawait orgs.updateOrgMemberPermissions(ctx, orgId, userId, patch.permissions);\n\t\t} catch (err) {\n\t\t\thandleApiError(err, \"Failed to update permissions\");\n\t\t}\n\t}\n\treturn new Response(null, { status: 204 });\n};\n//#endregion\nexport { PATCH };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAKA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AAC7D,IAAI,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;AAC3B,CAAC,IAAI,EAAE,aAAa,CAAC,QAAQ,EAAE;AAC/B,CAAC,WAAW,EAAE,kBAAkB,CAAC,QAAQ;AACzC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,MAAM,EAAE,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC;AACtH,IAAC,KAAK,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AACnD,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM;AACjC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,2BAA2B,CAAC;AAClG,CAAC,uBAAuB,CAAC,MAAM,CAAC;AAChC,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACvB,CAAC,IAAI,GAAG,CAAC,WAAW,KAAK,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,2CAA2C,CAAC;AAClH,CAAC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;AACpD,CAAC,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC;AAC3C,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AACjD,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI;AAC1B,CAAC,MAAM,IAAI,GAAG,uBAAuB,EAAE;AACvC,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AACpI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,wCAAwC,CAAC;AAC7F,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,4CAA4C,CAAC;AACtG,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE;AAC1D,EAAE,IAAI,WAAW,CAAC,IAAI,KAAK,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,sCAAsC,CAAC;AACjH,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE;AACzD,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,2FAA2F,CAAC;AACpS,EAAE;AACF,EAAE,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;AAChE,CAAC;AACD,CAAC,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM,EAAE;AACnC,EAAE,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI;AACjD,EAAE,MAAM,KAAK,GAAG,aAAa,KAAK,QAAQ,GAAG,IAAI,GAAG,CAAC,6BAA6B,CAAC,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC;AAClH,EAAE,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAChE,EAAE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,0BAA0B,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;AACxJ,EAAE,IAAI;AACN,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC;AAC/E,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,cAAc,CAAC,GAAG,EAAE,8BAA8B,CAAC;AACtD,EAAE;AACF,CAAC;AACD,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC3C;;;;"}

package/build/server/chunks/_server.ts-XiIlc3gv.js

@@ -0,0 +1,87 @@
+import { O as OrgAssetKindSchema } from './src-tWHhLCSB.js';
+import { j as getOrgAssetService, b as getOrganizationProvider } from './providers.server-C1zmtRr7.js';
+import { c as requireManageOrgMembers } from './access.server-BWOmKi8Z.js';
+import { h as handleApiError, a as apiError, A as ApiErrorCode } from './api-errors-BQbl4HI1.js';
+import { g as MAX_IMAGE_FILE_SIZE } from './computeLimits-DvrrqPiD.js';
+import { json } from '@sveltejs/kit';
+import 'zod';
+import './index.js-NH2Q8xBT.js';
+import 'clsx';
+import '@sveltejs/kit/internal';
+import '@sveltejs/kit/internal/server';
+import './limits-D8LKRL6A.js';
+import './chunk-Y3M7P3BW-CpcVbL4P.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import './utils2-D6nbl_7H.js';
+import './compute-B8HU5cQL.js';
+import 'node:zlib';
+import 'node:util';
+import 'node:dns/promises';
+import 'node:net';
+
+//#region src/routes/admin/api/orgs/[id]/assets/[kind]/+server.ts
+/**
+* Org branding-asset upload/removal, generic over asset kind (`logo`,
+* `favicon`, …). Gated on `manage_org_members` — managing org branding is an
+* org-admin action.
+*
+* Accepts raster images and SVG. Every input is rasterized to WebP by the
+* shared transcoder inside the storage provider, so SVG carries no XSS surface
+* — no vector blob is ever stored or served. The allowlist below is the HTTP
+* gate; the rasterization is the security control.
+*/
+var ALLOWED_CONTENT_TYPES = /* @__PURE__ */ new Set([
+	"image/png",
+	"image/jpeg",
+	"image/webp",
+	"image/gif",
+	"image/svg+xml"
+]);
+function parseParams(params) {
+	const id = params.id;
+	if (!id) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Missing org ID");
+	const kind = OrgAssetKindSchema.safeParse(params.kind);
+	if (!kind.success) apiError(404, ApiErrorCode.NOT_FOUND, `Unknown asset kind '${params.kind}'`);
+	return {
+		id,
+		kind: kind.data
+	};
+}
+var POST = async ({ params, request, locals }) => {
+	requireManageOrgMembers(locals);
+	const { id, kind } = parseParams(params);
+	const ctx = locals.ctx;
+	if (!await getOrganizationProvider().getOrg(ctx, id)) apiError(404, ApiErrorCode.NOT_FOUND, "Organization not found");
+	const file = (await request.formData()).get("image");
+	if (!(file instanceof File) || file.size === 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Image file is required");
+	if (!ALLOWED_CONTENT_TYPES.has(file.type)) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Unsupported image type. Allowed: PNG, JPG, WebP, GIF, SVG");
+	if (file.size > MAX_IMAGE_FILE_SIZE) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Image too large. Max size: ${MAX_IMAGE_FILE_SIZE / (1024 * 1024)} MB`);
+	try {
+		const bytes = new Uint8Array(await file.arrayBuffer());
+		return json({
+			kind,
+			url: await getOrgAssetService().saveAsset(ctx, id, kind, bytes, file.type)
+		});
+	} catch (err) {
+		handleApiError(err, "Failed to upload asset");
+	}
+};
+var DELETE = async ({ params, locals }) => {
+	requireManageOrgMembers(locals);
+	const { id, kind } = parseParams(params);
+	const ctx = locals.ctx;
+	try {
+		await getOrgAssetService().removeAsset(ctx, id, kind);
+		return new Response(null, { status: 204 });
+	} catch (err) {
+		handleApiError(err, "Failed to remove asset");
+	}
+};
+
+export { DELETE, POST };
+//# sourceMappingURL=_server.ts-XiIlc3gv.js.map

package/build/server/chunks/_server.ts-XiIlc3gv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-XiIlc3gv.js","sources":["../../../.svelte-kit/output/server/entries/endpoints/admin/api/orgs/_id_/assets/_kind_/_server.ts.js"],"sourcesContent":["import { b as OrgAssetKindSchema } from \"../../../../../../../../chunks/src.js\";\nimport { m as getOrganizationProvider, p as getOrgAssetService } from \"../../../../../../../../chunks/providers.server.js\";\nimport { x as requireManageOrgMembers } from \"../../../../../../../../chunks/access.server.js\";\nimport { n as apiError, r as handleApiError, t as ApiErrorCode } from \"../../../../../../../../chunks/api-errors.js\";\nimport { p as MAX_IMAGE_FILE_SIZE } from \"../../../../../../../../chunks/computeLimits.js\";\nimport \"../../../../../../../../chunks/admin-config.js\";\nimport { json } from \"@sveltejs/kit\";\n//#region src/routes/admin/api/orgs/[id]/assets/[kind]/+server.ts\n/**\n* Org branding-asset upload/removal, generic over asset kind (`logo`,\n* `favicon`, …). Gated on `manage_org_members` — managing org branding is an\n* org-admin action.\n*\n* Accepts raster images and SVG. Every input is rasterized to WebP by the\n* shared transcoder inside the storage provider, so SVG carries no XSS surface\n* — no vector blob is ever stored or served. The allowlist below is the HTTP\n* gate; the rasterization is the security control.\n*/\nvar ALLOWED_CONTENT_TYPES = /* @__PURE__ */ new Set([\n\t\"image/png\",\n\t\"image/jpeg\",\n\t\"image/webp\",\n\t\"image/gif\",\n\t\"image/svg+xml\"\n]);\nfunction parseParams(params) {\n\tconst id = params.id;\n\tif (!id) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing org ID\");\n\tconst kind = OrgAssetKindSchema.safeParse(params.kind);\n\tif (!kind.success) apiError(404, ApiErrorCode.NOT_FOUND, `Unknown asset kind '${params.kind}'`);\n\treturn {\n\t\tid,\n\t\tkind: kind.data\n\t};\n}\nvar POST = async ({ params, request, locals }) => {\n\trequireManageOrgMembers(locals);\n\tconst { id, kind } = parseParams(params);\n\tconst ctx = locals.ctx;\n\tif (!await getOrganizationProvider().getOrg(ctx, id)) apiError(404, ApiErrorCode.NOT_FOUND, \"Organization not found\");\n\tconst file = (await request.formData()).get(\"image\");\n\tif (!(file instanceof File) || file.size === 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Image file is required\");\n\tif (!ALLOWED_CONTENT_TYPES.has(file.type)) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Unsupported image type. Allowed: PNG, JPG, WebP, GIF, SVG\");\n\tif (file.size > MAX_IMAGE_FILE_SIZE) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Image too large. Max size: ${MAX_IMAGE_FILE_SIZE / (1024 * 1024)} MB`);\n\ttry {\n\t\tconst bytes = new Uint8Array(await file.arrayBuffer());\n\t\treturn json({\n\t\t\tkind,\n\t\t\turl: await getOrgAssetService().saveAsset(ctx, id, kind, bytes, file.type)\n\t\t});\n\t} catch (err) {\n\t\thandleApiError(err, \"Failed to upload asset\");\n\t}\n};\nvar DELETE = async ({ params, locals }) => {\n\trequireManageOrgMembers(locals);\n\tconst { id, kind } = parseParams(params);\n\tconst ctx = locals.ctx;\n\ttry {\n\t\tawait getOrgAssetService().removeAsset(ctx, id, kind);\n\t\treturn new Response(null, { status: 204 });\n\t} catch (err) {\n\t\thandleApiError(err, \"Failed to remove asset\");\n\t}\n};\n//#endregion\nexport { DELETE, POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAOA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,qBAAqB,mBAAmB,IAAI,GAAG,CAAC;AACpD,CAAC,WAAW;AACZ,CAAC,YAAY;AACb,CAAC,YAAY;AACb,CAAC,WAAW;AACZ,CAAC;AACD,CAAC,CAAC;AACF,SAAS,WAAW,CAAC,MAAM,EAAE;AAC7B,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE;AACrB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;AACzE,CAAC,MAAM,IAAI,GAAG,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;AACvD,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAChG,CAAC,OAAO;AACR,EAAE,EAAE;AACJ,EAAE,IAAI,EAAE,IAAI,CAAC;AACb,EAAE;AACF;AACG,IAAC,IAAI,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AAClD,CAAC,uBAAuB,CAAC,MAAM,CAAC;AAChC,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC;AACzC,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACvB,CAAC,IAAI,CAAC,MAAM,uBAAuB,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,wBAAwB,CAAC;AACtH,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC;AACrD,CAAC,IAAI,EAAE,IAAI,YAAY,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;AACxH,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,2DAA2D,CAAC;AACtJ,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,mBAAmB,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,2BAA2B,EAAE,mBAAmB,IAAI,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AAC3J,CAAC,IAAI;AACL,EAAE,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;AACxD,EAAE,OAAO,IAAI,CAAC;AACd,GAAG,IAAI;AACP,GAAG,GAAG,EAAE,MAAM,kBAAkB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI;AAC5E,GAAG,CAAC;AACJ,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,cAAc,CAAC,GAAG,EAAE,wBAAwB,CAAC;AAC/C,CAAC;AACD;AACG,IAAC,MAAM,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AAC3C,CAAC,uBAAuB,CAAC,MAAM,CAAC;AAChC,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC;AACzC,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACvB,CAAC,IAAI;AACL,EAAE,MAAM,kBAAkB,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC;AACvD,EAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC5C,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,cAAc,CAAC,GAAG,EAAE,wBAAwB,CAAC;AAC/C,CAAC;AACD;;;;"}

package/build/server/chunks/_server.ts-ZH-Zoyxa.js

@@ -0,0 +1,53 @@
+import { q as getAuthProvider } from './providers.server-C1zmtRr7.js';
+import { a as apiError, A as ApiErrorCode } from './api-errors-BQbl4HI1.js';
+import { redirect } from '@sveltejs/kit';
+import './index.js-NH2Q8xBT.js';
+import 'clsx';
+import '@sveltejs/kit/internal';
+import '@sveltejs/kit/internal/server';
+import './src-tWHhLCSB.js';
+import 'zod';
+import './limits-D8LKRL6A.js';
+import './chunk-Y3M7P3BW-CpcVbL4P.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import './utils2-D6nbl_7H.js';
+
+//#region src/routes/auth/supabase/start/+server.ts
+var ALLOWED_PROVIDERS = [
+	"google",
+	"github",
+	"azure",
+	"gitlab"
+];
+function isAllowedProvider(value) {
+	return value !== null && ALLOWED_PROVIDERS.includes(value);
+}
+/**
+* GET /auth/supabase/start?provider=google&redirectTo=/library
+*
+* Initiates an OAuth sign-in via Supabase Auth. The Supabase project must
+* have the named provider enabled in its dashboard. Bounces the browser to
+* the IdP's authorize endpoint; the IdP returns to `/auth/supabase/callback`
+* with a `?code=...`.
+*
+* `redirectTo` is preserved through the round trip via `?redirectTo=...` on
+* the callback URL we hand to Supabase.
+*/
+var GET = async ({ url }) => {
+	const provider = url.searchParams.get("provider");
+	if (!isAllowedProvider(provider)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid provider. Allowed: ${ALLOWED_PROVIDERS.join(", ")}`);
+	const oauth = getAuthProvider().oauth;
+	if (!oauth) apiError(501, ApiErrorCode.INTERNAL, "OAuth is not supported by the configured auth provider.");
+	const redirectTo = url.searchParams.get("redirectTo") ?? "/library";
+	const callbackUrl = new URL("/auth/supabase/callback", url.origin);
+	if (redirectTo.startsWith("/")) callbackUrl.searchParams.set("redirectTo", redirectTo);
+	redirect(303, await oauth.getOAuthAuthorizationUrl(provider, callbackUrl.toString()));
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts-ZH-Zoyxa.js.map

package/build/server/chunks/_server.ts-ZH-Zoyxa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-ZH-Zoyxa.js","sources":["../../../.svelte-kit/output/server/entries/endpoints/auth/supabase/start/_server.ts.js"],"sourcesContent":["import { r as getAuthProvider } from \"../../../../../chunks/providers.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\nimport \"../../../../../chunks/auth.server.js\";\nimport { redirect } from \"@sveltejs/kit\";\n//#region src/routes/auth/supabase/start/+server.ts\nvar ALLOWED_PROVIDERS = [\n\t\"google\",\n\t\"github\",\n\t\"azure\",\n\t\"gitlab\"\n];\nfunction isAllowedProvider(value) {\n\treturn value !== null && ALLOWED_PROVIDERS.includes(value);\n}\n/**\n* GET /auth/supabase/start?provider=google&redirectTo=/library\n*\n* Initiates an OAuth sign-in via Supabase Auth. The Supabase project must\n* have the named provider enabled in its dashboard. Bounces the browser to\n* the IdP's authorize endpoint; the IdP returns to `/auth/supabase/callback`\n* with a `?code=...`.\n*\n* `redirectTo` is preserved through the round trip via `?redirectTo=...` on\n* the callback URL we hand to Supabase.\n*/\nvar GET = async ({ url }) => {\n\tconst provider = url.searchParams.get(\"provider\");\n\tif (!isAllowedProvider(provider)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid provider. Allowed: ${ALLOWED_PROVIDERS.join(\", \")}`);\n\tconst oauth = getAuthProvider().oauth;\n\tif (!oauth) apiError(501, ApiErrorCode.INTERNAL, \"OAuth is not supported by the configured auth provider.\");\n\tconst redirectTo = url.searchParams.get(\"redirectTo\") ?? \"/library\";\n\tconst callbackUrl = new URL(\"/auth/supabase/callback\", url.origin);\n\tif (redirectTo.startsWith(\"/\")) callbackUrl.searchParams.set(\"redirectTo\", redirectTo);\n\tredirect(303, await oauth.getOAuthAuthorizationUrl(provider, callbackUrl.toString()));\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAIA;AACA,IAAI,iBAAiB,GAAG;AACxB,CAAC,QAAQ;AACT,CAAC,QAAQ;AACT,CAAC,OAAO;AACR,CAAC;AACD,CAAC;AACD,SAAS,iBAAiB,CAAC,KAAK,EAAE;AAClC,CAAC,OAAO,KAAK,KAAK,IAAI,IAAI,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC;AAC3D;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,KAAK;AAC7B,CAAC,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC;AAClD,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,2BAA2B,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC9I,CAAC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC,KAAK;AACtC,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,yDAAyD,CAAC;AAC5G,CAAC,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,UAAU;AACpE,CAAC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,yBAAyB,EAAE,GAAG,CAAC,MAAM,CAAC;AACnE,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC;AACvF,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC,wBAAwB,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;AACtF;;;;"}

package/build/server/chunks/_server.ts-qjSt_hgr.js

@@ -0,0 +1,51 @@
+import { y as getInviteStore } from './providers.server-C1zmtRr7.js';
+import { c as requireManageOrgMembers } from './access.server-BWOmKi8Z.js';
+import { a as apiError, A as ApiErrorCode, h as handleApiError } from './api-errors-BQbl4HI1.js';
+import './index.js-NH2Q8xBT.js';
+import 'clsx';
+import '@sveltejs/kit/internal';
+import '@sveltejs/kit';
+import '@sveltejs/kit/internal/server';
+import './src-tWHhLCSB.js';
+import 'zod';
+import './limits-D8LKRL6A.js';
+import './chunk-Y3M7P3BW-CpcVbL4P.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import './utils2-D6nbl_7H.js';
+
+//#region src/routes/api/invites/[id]/+server.ts
+var DELETE = async ({ params, locals }) => {
+	requireManageOrgMembers(locals);
+	const ctx = locals.ctx;
+	if (!ctx.actingOrgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, "No active organization");
+	const id = params.id;
+	try {
+		const store = getInviteStore();
+		let cursor;
+		let found = false;
+		do {
+			const page = await store.listByOrg(ctx, ctx.actingOrgId, {
+				limit: 200,
+				cursor
+			});
+			if (page.items.some((i) => i.id === id)) {
+				found = true;
+				break;
+			}
+			cursor = page.nextCursor ?? void 0;
+		} while (cursor);
+		if (!found) apiError(404, ApiErrorCode.NOT_FOUND, "Invite not found");
+		await store.revoke(ctx, id);
+		return new Response(null, { status: 204 });
+	} catch (err) {
+		handleApiError(err, "Failed to revoke invite");
+	}
+};
+
+export { DELETE };
+//# sourceMappingURL=_server.ts-qjSt_hgr.js.map

package/build/server/chunks/_server.ts-qjSt_hgr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-qjSt_hgr.js","sources":["../../../.svelte-kit/output/server/entries/endpoints/api/invites/_id_/_server.ts.js"],"sourcesContent":["import { d as getInviteStore } from \"../../../../../chunks/providers.server.js\";\nimport { x as requireManageOrgMembers } from \"../../../../../chunks/access.server.js\";\nimport { n as apiError, r as handleApiError, t as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\n//#region src/routes/api/invites/[id]/+server.ts\nvar DELETE = async ({ params, locals }) => {\n\trequireManageOrgMembers(locals);\n\tconst ctx = locals.ctx;\n\tif (!ctx.actingOrgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"No active organization\");\n\tconst id = params.id;\n\ttry {\n\t\tconst store = getInviteStore();\n\t\tlet cursor;\n\t\tlet found = false;\n\t\tdo {\n\t\t\tconst page = await store.listByOrg(ctx, ctx.actingOrgId, {\n\t\t\t\tlimit: 200,\n\t\t\t\tcursor\n\t\t\t});\n\t\t\tif (page.items.some((i) => i.id === id)) {\n\t\t\t\tfound = true;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcursor = page.nextCursor ?? void 0;\n\t\t} while (cursor);\n\t\tif (!found) apiError(404, ApiErrorCode.NOT_FOUND, \"Invite not found\");\n\t\tawait store.revoke(ctx, id);\n\t\treturn new Response(null, { status: 204 });\n\t} catch (err) {\n\t\thandleApiError(err, \"Failed to revoke invite\");\n\t}\n};\n//#endregion\nexport { DELETE };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAGA;AACG,IAAC,MAAM,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AAC3C,CAAC,uBAAuB,CAAC,MAAM,CAAC;AAChC,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACvB,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;AAC9F,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE;AACrB,CAAC,IAAI;AACL,EAAE,MAAM,KAAK,GAAG,cAAc,EAAE;AAChC,EAAE,IAAI,MAAM;AACZ,EAAE,IAAI,KAAK,GAAG,KAAK;AACnB,EAAE,GAAG;AACL,GAAG,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE;AAC5D,IAAI,KAAK,EAAE,GAAG;AACd,IAAI;AACJ,IAAI,CAAC;AACL,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE;AAC5C,IAAI,KAAK,GAAG,IAAI;AAChB,IAAI;AACJ,GAAG;AACH,GAAG,MAAM,GAAG,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC;AACrC,EAAE,CAAC,QAAQ,MAAM;AACjB,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,kBAAkB,CAAC;AACvE,EAAE,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC;AAC7B,EAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC5C,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,cAAc,CAAC,GAAG,EAAE,yBAAyB,CAAC;AAChD,CAAC;AACD;;;;"}