@selvajs/selva 4.7.0-beta.4 → 4.7.0-beta.6

package/build/server/chunks/selfUpdate.server-Dljv1StN.js

@@ -0,0 +1,152 @@
+import { d as getLogger, r as renderThrown } from './providers.server-C1zmtRr7.js';
+import { d as deriveOutcome } from './update-outcome-BOtdiviI.js';
+import { join } from 'node:path';
+import { existsSync, readFileSync, rmSync } from 'node:fs';
+
+//#region src/lib/server/selfUpdate.server.ts
+/**
+* Self-update observability (audit O2): durable log/state paths for the update
+* runner, plus post-restart reconciliation of the update's outcome into the
+* audit event log.
+*
+* The process that launches an update is killed mid-update (`pm2 stop
+* selva-compute` is a step of the update itself), so only the
+* `system.update.started` event can be emitted synchronously by the POST
+* handler. The terminal event (`finished` / `rolled_back` / `failed`) is
+* derived AFTER the app is back up: the POST persists a pending-update state
+* file next to the log, and the reconciler here polls the log until the
+* runner's `[EXIT] code=N` marker appears, classifies it via `deriveOutcome`,
+* emits the matching event, and consumes the state file. Kicked from both the
+* POST (covers the no-restart "already up to date" path) and the first request
+* after boot (covers the real update path, where the emitting process is new).
+*/
+function isDeploymentDir(dir) {
+	return existsSync(join(dir, "node_modules", "@selvajs", "selva", "package.json"));
+}
+function findDeploymentDir(env) {
+	if (env.INSTALL_DIR && isDeploymentDir(env.INSTALL_DIR)) return env.INSTALL_DIR;
+	let dir = process.cwd();
+	for (let i = 0; i < 6; i++) {
+		if (isDeploymentDir(dir)) return dir;
+		const parent = join(dir, "..");
+		if (parent === dir) break;
+		dir = parent;
+	}
+	return null;
+}
+/**
+* Where the update runner mirrors all its output. Lives in the deployment dir
+* so it survives reboots (it used to be `/tmp/selva-update.log`, wiped on
+* reboot — audit O2); the `/tmp` fallback only applies outside a deployment
+* (dev), where no update can actually run.
+*/
+function updateLogPath(deploymentDir) {
+	return deploymentDir ? join(deploymentDir, "selva-update.log") : "/tmp/selva-update.log";
+}
+/** Pending-update marker consumed by the reconciler. Sits next to the log. */
+function updateStatePath(deploymentDir) {
+	return join(deploymentDir, "selva-update-state.json");
+}
+/**
+* One reconciliation attempt. Reads the pending-update state file; if the log
+* carries the runner's terminal `[EXIT] code=N` marker, classifies the outcome,
+* emits the terminal audit event, reports rollback/failure to the error
+* tracker, and deletes the state file (exactly-once across restarts — the
+* state file is the emission token).
+*/
+async function reconcileUpdateOutcome(deps) {
+	const statePath = updateStatePath(deps.deploymentDir);
+	let state;
+	try {
+		state = JSON.parse(readFileSync(statePath, "utf8"));
+	} catch {
+		return "no_pending_update";
+	}
+	let logs = "";
+	try {
+		logs = readFileSync(updateLogPath(deps.deploymentDir), "utf8");
+	} catch {}
+	const exitMatch = /\[EXIT\] code=(\d+)/.exec(logs);
+	if (!exitMatch) return "still_running";
+	const exitCode = Number(exitMatch[1]);
+	const outcome = deriveOutcome(exitCode, logs);
+	const base = {
+		fromVersion: state.fromVersion ?? outcome.from,
+		toVersion: outcome.to,
+		actorId: state.actorId
+	};
+	let event;
+	if (outcome.severity === "critical") event = {
+		type: "system.update.failed",
+		...base,
+		detail: outcome.title
+	};
+	else if (exitCode === 5 || logs.includes("Rolled back")) event = {
+		type: "system.update.rolled_back",
+		...base,
+		detail: outcome.title
+	};
+	else if (outcome.severity === "success" || outcome.severity === "info") event = {
+		type: "system.update.finished",
+		...base
+	};
+	else event = {
+		type: "system.update.finished",
+		...base,
+		detail: outcome.title
+	};
+	await deps.emit(event);
+	if (event.type !== "system.update.finished") deps.report(/* @__PURE__ */ new Error(`[selfUpdate] ${outcome.title}`));
+	try {
+		rmSync(statePath);
+	} catch {}
+	return "reconciled";
+}
+var POLL_MS = 15e3;
+var MAX_POLLS = 80;
+var reconcilerActive = false;
+/**
+* Idempotently start polling for a pending update's terminal state. Safe to
+* call on every boot and on every update POST — it exits immediately when no
+* state file exists and never runs twice concurrently.
+*/
+function startUpdateOutcomeReconciler(deps) {
+	if (reconcilerActive) return;
+	if (!existsSync(updateStatePath(deps.deploymentDir))) return;
+	reconcilerActive = true;
+	let polls = 0;
+	const timer = setInterval(() => {
+		(async () => {
+			polls += 1;
+			let result;
+			try {
+				result = await reconcileUpdateOutcome(deps);
+			} catch (err) {
+				getLogger().error("Outcome reconciliation failed", {
+					component: "selfUpdate",
+					err: renderThrown(err)
+				});
+				result = "still_running";
+			}
+			if (result === "still_running" && polls < MAX_POLLS) return;
+			if (result === "still_running") try {
+				const statePath = updateStatePath(deps.deploymentDir);
+				const state = JSON.parse(readFileSync(statePath, "utf8"));
+				await deps.emit({
+					type: "system.update.failed",
+					fromVersion: state.fromVersion,
+					actorId: state.actorId,
+					detail: "No terminal marker in the update log within 20 minutes."
+				});
+				deps.report(/* @__PURE__ */ new Error("[selfUpdate] update never reached a terminal state"));
+				rmSync(statePath);
+			} catch {}
+			clearInterval(timer);
+			reconcilerActive = false;
+		})();
+	}, POLL_MS);
+	timer.unref?.();
+}
+
+export { updateStatePath as a, findDeploymentDir as f, startUpdateOutcomeReconciler as s, updateLogPath as u };
+//# sourceMappingURL=selfUpdate.server-Dljv1StN.js.map

package/build/server/chunks/selfUpdate.server-Dljv1StN.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"selfUpdate.server-Dljv1StN.js","sources":["../../../.svelte-kit/output/server/chunks/selfUpdate.server.js"],"sourcesContent":["import { T as renderThrown, f as getLogger } from \"./providers.server.js\";\nimport { t as deriveOutcome } from \"./update-outcome.js\";\nimport { join } from \"node:path\";\nimport { existsSync, readFileSync, rmSync } from \"node:fs\";\n//#region src/lib/server/selfUpdate.server.ts\n/**\n* Self-update observability (audit O2): durable log/state paths for the update\n* runner, plus post-restart reconciliation of the update's outcome into the\n* audit event log.\n*\n* The process that launches an update is killed mid-update (`pm2 stop\n* selva-compute` is a step of the update itself), so only the\n* `system.update.started` event can be emitted synchronously by the POST\n* handler. The terminal event (`finished` / `rolled_back` / `failed`) is\n* derived AFTER the app is back up: the POST persists a pending-update state\n* file next to the log, and the reconciler here polls the log until the\n* runner's `[EXIT] code=N` marker appears, classifies it via `deriveOutcome`,\n* emits the matching event, and consumes the state file. Kicked from both the\n* POST (covers the no-restart \"already up to date\" path) and the first request\n* after boot (covers the real update path, where the emitting process is new).\n*/\nfunction isDeploymentDir(dir) {\n\treturn existsSync(join(dir, \"node_modules\", \"@selvajs\", \"selva\", \"package.json\"));\n}\nfunction findDeploymentDir(env) {\n\tif (env.INSTALL_DIR && isDeploymentDir(env.INSTALL_DIR)) return env.INSTALL_DIR;\n\tlet dir = process.cwd();\n\tfor (let i = 0; i < 6; i++) {\n\t\tif (isDeploymentDir(dir)) return dir;\n\t\tconst parent = join(dir, \"..\");\n\t\tif (parent === dir) break;\n\t\tdir = parent;\n\t}\n\treturn null;\n}\n/**\n* Where the update runner mirrors all its output. Lives in the deployment dir\n* so it survives reboots (it used to be `/tmp/selva-update.log`, wiped on\n* reboot — audit O2); the `/tmp` fallback only applies outside a deployment\n* (dev), where no update can actually run.\n*/\nfunction updateLogPath(deploymentDir) {\n\treturn deploymentDir ? join(deploymentDir, \"selva-update.log\") : \"/tmp/selva-update.log\";\n}\n/** Pending-update marker consumed by the reconciler. Sits next to the log. */\nfunction updateStatePath(deploymentDir) {\n\treturn join(deploymentDir, \"selva-update-state.json\");\n}\n/**\n* One reconciliation attempt. Reads the pending-update state file; if the log\n* carries the runner's terminal `[EXIT] code=N` marker, classifies the outcome,\n* emits the terminal audit event, reports rollback/failure to the error\n* tracker, and deletes the state file (exactly-once across restarts — the\n* state file is the emission token).\n*/\nasync function reconcileUpdateOutcome(deps) {\n\tconst statePath = updateStatePath(deps.deploymentDir);\n\tlet state;\n\ttry {\n\t\tstate = JSON.parse(readFileSync(statePath, \"utf8\"));\n\t} catch {\n\t\treturn \"no_pending_update\";\n\t}\n\tlet logs = \"\";\n\ttry {\n\t\tlogs = readFileSync(updateLogPath(deps.deploymentDir), \"utf8\");\n\t} catch {}\n\tconst exitMatch = /\\[EXIT\\] code=(\\d+)/.exec(logs);\n\tif (!exitMatch) return \"still_running\";\n\tconst exitCode = Number(exitMatch[1]);\n\tconst outcome = deriveOutcome(exitCode, logs);\n\tconst base = {\n\t\tfromVersion: state.fromVersion ?? outcome.from,\n\t\ttoVersion: outcome.to,\n\t\tactorId: state.actorId\n\t};\n\tlet event;\n\tif (outcome.severity === \"critical\") event = {\n\t\ttype: \"system.update.failed\",\n\t\t...base,\n\t\tdetail: outcome.title\n\t};\n\telse if (exitCode === 5 || logs.includes(\"Rolled back\")) event = {\n\t\ttype: \"system.update.rolled_back\",\n\t\t...base,\n\t\tdetail: outcome.title\n\t};\n\telse if (outcome.severity === \"success\" || outcome.severity === \"info\") event = {\n\t\ttype: \"system.update.finished\",\n\t\t...base\n\t};\n\telse event = {\n\t\ttype: \"system.update.finished\",\n\t\t...base,\n\t\tdetail: outcome.title\n\t};\n\tawait deps.emit(event);\n\tif (event.type !== \"system.update.finished\") deps.report(/* @__PURE__ */ new Error(`[selfUpdate] ${outcome.title}`));\n\ttry {\n\t\trmSync(statePath);\n\t} catch {}\n\treturn \"reconciled\";\n}\nvar POLL_MS = 15e3;\nvar MAX_POLLS = 80;\nvar reconcilerActive = false;\n/**\n* Idempotently start polling for a pending update's terminal state. Safe to\n* call on every boot and on every update POST — it exits immediately when no\n* state file exists and never runs twice concurrently.\n*/\nfunction startUpdateOutcomeReconciler(deps) {\n\tif (reconcilerActive) return;\n\tif (!existsSync(updateStatePath(deps.deploymentDir))) return;\n\treconcilerActive = true;\n\tlet polls = 0;\n\tconst timer = setInterval(() => {\n\t\t(async () => {\n\t\t\tpolls += 1;\n\t\t\tlet result;\n\t\t\ttry {\n\t\t\t\tresult = await reconcileUpdateOutcome(deps);\n\t\t\t} catch (err) {\n\t\t\t\tgetLogger().error(\"Outcome reconciliation failed\", {\n\t\t\t\t\tcomponent: \"selfUpdate\",\n\t\t\t\t\terr: renderThrown(err)\n\t\t\t\t});\n\t\t\t\tresult = \"still_running\";\n\t\t\t}\n\t\t\tif (result === \"still_running\" && polls < MAX_POLLS) return;\n\t\t\tif (result === \"still_running\") try {\n\t\t\t\tconst statePath = updateStatePath(deps.deploymentDir);\n\t\t\t\tconst state = JSON.parse(readFileSync(statePath, \"utf8\"));\n\t\t\t\tawait deps.emit({\n\t\t\t\t\ttype: \"system.update.failed\",\n\t\t\t\t\tfromVersion: state.fromVersion,\n\t\t\t\t\tactorId: state.actorId,\n\t\t\t\t\tdetail: \"No terminal marker in the update log within 20 minutes.\"\n\t\t\t\t});\n\t\t\t\tdeps.report(/* @__PURE__ */ new Error(\"[selfUpdate] update never reached a terminal state\"));\n\t\t\t\trmSync(statePath);\n\t\t\t} catch {}\n\t\t\tclearInterval(timer);\n\t\t\treconcilerActive = false;\n\t\t})();\n\t}, POLL_MS);\n\ttimer.unref?.();\n}\n//#endregion\nexport { updateStatePath as i, startUpdateOutcomeReconciler as n, updateLogPath as r, findDeploymentDir as t };\n"],"names":[],"mappings":";;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,eAAe,CAAC,GAAG,EAAE;AAC9B,CAAC,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;AAClF;AACA,SAAS,iBAAiB,CAAC,GAAG,EAAE;AAChC,CAAC,IAAI,GAAG,CAAC,WAAW,IAAI,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,CAAC,WAAW;AAChF,CAAC,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;AACxB,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE;AAC7B,EAAE,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG;AACtC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC;AAChC,EAAE,IAAI,MAAM,KAAK,GAAG,EAAE;AACtB,EAAE,GAAG,GAAG,MAAM;AACd,CAAC;AACD,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,aAAa,EAAE;AACtC,CAAC,OAAO,aAAa,GAAG,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC,GAAG,uBAAuB;AACzF;AACA;AACA,SAAS,eAAe,CAAC,aAAa,EAAE;AACxC,CAAC,OAAO,IAAI,CAAC,aAAa,EAAE,yBAAyB,CAAC;AACtD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,sBAAsB,CAAC,IAAI,EAAE;AAC5C,CAAC,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC;AACtD,CAAC,IAAI,KAAK;AACV,CAAC,IAAI;AACL,EAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,mBAAmB;AAC5B,CAAC;AACD,CAAC,IAAI,IAAI,GAAG,EAAE;AACd,CAAC,IAAI;AACL,EAAE,IAAI,GAAG,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;AAChE,CAAC,CAAC,CAAC,MAAM,CAAC;AACV,CAAC,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;AACnD,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,eAAe;AACvC,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC;AAC9C,CAAC,MAAM,IAAI,GAAG;AACd,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,OAAO,CAAC,IAAI;AAChD,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE;AACvB,EAAE,OAAO,EAAE,KAAK,CAAC;AACjB,EAAE;AACF,CAAC,IAAI,KAAK;AACV,CAAC,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU,EAAE,KAAK,GAAG;AAC9C,EAAE,IAAI,EAAE,sBAAsB;AAC9B,EAAE,GAAG,IAAI;AACT,EAAE,MAAM,EAAE,OAAO,CAAC;AAClB,EAAE;AACF,MAAM,IAAI,QAAQ,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,KAAK,GAAG;AAClE,EAAE,IAAI,EAAE,2BAA2B;AACnC,EAAE,GAAG,IAAI;AACT,EAAE,MAAM,EAAE,OAAO,CAAC;AAClB,EAAE;AACF,MAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,EAAE,KAAK,GAAG;AACjF,EAAE,IAAI,EAAE,wBAAwB;AAChC,EAAE,GAAG;AACL,EAAE;AACF,MAAM,KAAK,GAAG;AACd,EAAE,IAAI,EAAE,wBAAwB;AAChC,EAAE,GAAG,IAAI;AACT,EAAE,MAAM,EAAE,OAAO,CAAC;AAClB,EAAE;AACF,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;AACvB,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,wBAAwB,EAAE,IAAI,CAAC,MAAM,iBAAiB,IAAI,KAAK,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACrH,CAAC,IAAI;AACL,EAAE,MAAM,CAAC,SAAS,CAAC;AACnB,CAAC,CAAC,CAAC,MAAM,CAAC;AACV,CAAC,OAAO,YAAY;AACpB;AACA,IAAI,OAAO,GAAG,IAAI;AAClB,IAAI,SAAS,GAAG,EAAE;AAClB,IAAI,gBAAgB,GAAG,KAAK;AAC5B;AACA;AACA;AACA;AACA;AACA,SAAS,4BAA4B,CAAC,IAAI,EAAE;AAC5C,CAAC,IAAI,gBAAgB,EAAE;AACvB,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE;AACvD,CAAC,gBAAgB,GAAG,IAAI;AACxB,CAAC,IAAI,KAAK,GAAG,CAAC;AACd,CAAC,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM;AACjC,EAAE,CAAC,YAAY;AACf,GAAG,KAAK,IAAI,CAAC;AACb,GAAG,IAAI,MAAM;AACb,GAAG,IAAI;AACP,IAAI,MAAM,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC;AAC/C,GAAG,CAAC,CAAC,OAAO,GAAG,EAAE;AACjB,IAAI,SAAS,EAAE,CAAC,KAAK,CAAC,+BAA+B,EAAE;AACvD,KAAK,SAAS,EAAE,YAAY;AAC5B,KAAK,GAAG,EAAE,YAAY,CAAC,GAAG;AAC1B,KAAK,CAAC;AACN,IAAI,MAAM,GAAG,eAAe;AAC5B,GAAG;AACH,GAAG,IAAI,MAAM,KAAK,eAAe,IAAI,KAAK,GAAG,SAAS,EAAE;AACxD,GAAG,IAAI,MAAM,KAAK,eAAe,EAAE,IAAI;AACvC,IAAI,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC;AACzD,IAAI,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AAC7D,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC;AACpB,KAAK,IAAI,EAAE,sBAAsB;AACjC,KAAK,WAAW,EAAE,KAAK,CAAC,WAAW;AACnC,KAAK,OAAO,EAAE,KAAK,CAAC,OAAO;AAC3B,KAAK,MAAM,EAAE;AACb,KAAK,CAAC;AACN,IAAI,IAAI,CAAC,MAAM,iBAAiB,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;AAChG,IAAI,MAAM,CAAC,SAAS,CAAC;AACrB,GAAG,CAAC,CAAC,MAAM,CAAC;AACZ,GAAG,aAAa,CAAC,KAAK,CAAC;AACvB,GAAG,gBAAgB,GAAG,KAAK;AAC3B,EAAE,CAAC,GAAG;AACN,CAAC,CAAC,EAAE,OAAO,CAAC;AACZ,CAAC,KAAK,CAAC,KAAK,IAAI;AAChB;;;;"}

package/build/server/chunks/server2-Stzl6qrW.js

@@ -0,0 +1,44 @@
+import { s as spread_props } from './index.js-NH2Q8xBT.js';
+import { I as Icon } from './utils3-DxMdQNFZ.js';
+
+//#region ../../node_modules/.pnpm/@lucide+svelte@1.21.0_svelt_40f46c49124aea7c18fd533a285f4a67/node_modules/@lucide/svelte/dist/icons/server.svelte
+function Server($$renderer, $$props) {
+	let { $$slots, $$events, ...props } = $$props;
+	Icon($$renderer, spread_props([
+		{ name: "server" },
+		props,
+		{ iconNode: [
+			["rect", {
+				"width": "20",
+				"height": "8",
+				"x": "2",
+				"y": "2",
+				"rx": "2",
+				"ry": "2"
+			}],
+			["rect", {
+				"width": "20",
+				"height": "8",
+				"x": "2",
+				"y": "14",
+				"rx": "2",
+				"ry": "2"
+			}],
+			["line", {
+				"x1": "6",
+				"x2": "6.01",
+				"y1": "6",
+				"y2": "6"
+			}],
+			["line", {
+				"x1": "6",
+				"x2": "6.01",
+				"y1": "18",
+				"y2": "18"
+			}]
+		] }
+	]));
+}
+
+export { Server as S };
+//# sourceMappingURL=server2-Stzl6qrW.js.map

package/build/server/chunks/server2-Stzl6qrW.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server2-Stzl6qrW.js","sources":["../../../.svelte-kit/output/server/chunks/server2.js"],"sourcesContent":["import { d as spread_props } from \"./server.js\";\nimport { n as Icon } from \"./utils3.js\";\n//#region ../../node_modules/.pnpm/@lucide+svelte@1.21.0_svelt_40f46c49124aea7c18fd533a285f4a67/node_modules/@lucide/svelte/dist/icons/server.svelte\nfunction Server($$renderer, $$props) {\n\tlet { $$slots, $$events, ...props } = $$props;\n\tIcon($$renderer, spread_props([\n\t\t{ name: \"server\" },\n\t\tprops,\n\t\t{ iconNode: [\n\t\t\t[\"rect\", {\n\t\t\t\t\"width\": \"20\",\n\t\t\t\t\"height\": \"8\",\n\t\t\t\t\"x\": \"2\",\n\t\t\t\t\"y\": \"2\",\n\t\t\t\t\"rx\": \"2\",\n\t\t\t\t\"ry\": \"2\"\n\t\t\t}],\n\t\t\t[\"rect\", {\n\t\t\t\t\"width\": \"20\",\n\t\t\t\t\"height\": \"8\",\n\t\t\t\t\"x\": \"2\",\n\t\t\t\t\"y\": \"14\",\n\t\t\t\t\"rx\": \"2\",\n\t\t\t\t\"ry\": \"2\"\n\t\t\t}],\n\t\t\t[\"line\", {\n\t\t\t\t\"x1\": \"6\",\n\t\t\t\t\"x2\": \"6.01\",\n\t\t\t\t\"y1\": \"6\",\n\t\t\t\t\"y2\": \"6\"\n\t\t\t}],\n\t\t\t[\"line\", {\n\t\t\t\t\"x1\": \"6\",\n\t\t\t\t\"x2\": \"6.01\",\n\t\t\t\t\"y1\": \"18\",\n\t\t\t\t\"y2\": \"18\"\n\t\t\t}]\n\t\t] }\n\t]));\n}\n//#endregion\nexport { Server as t };\n"],"names":[],"mappings":";;;AAEA;AACA,SAAS,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE;AACrC,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO;AAC9C,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC;AAC/B,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;AACpB,EAAE,KAAK;AACP,EAAE,EAAE,QAAQ,EAAE;AACd,GAAG,CAAC,MAAM,EAAE;AACZ,IAAI,OAAO,EAAE,IAAI;AACjB,IAAI,QAAQ,EAAE,GAAG;AACjB,IAAI,GAAG,EAAE,GAAG;AACZ,IAAI,GAAG,EAAE,GAAG;AACZ,IAAI,IAAI,EAAE,GAAG;AACb,IAAI,IAAI,EAAE;AACV,IAAI,CAAC;AACL,GAAG,CAAC,MAAM,EAAE;AACZ,IAAI,OAAO,EAAE,IAAI;AACjB,IAAI,QAAQ,EAAE,GAAG;AACjB,IAAI,GAAG,EAAE,GAAG;AACZ,IAAI,GAAG,EAAE,IAAI;AACb,IAAI,IAAI,EAAE,GAAG;AACb,IAAI,IAAI,EAAE;AACV,IAAI,CAAC;AACL,GAAG,CAAC,MAAM,EAAE;AACZ,IAAI,IAAI,EAAE,GAAG;AACb,IAAI,IAAI,EAAE,MAAM;AAChB,IAAI,IAAI,EAAE,GAAG;AACb,IAAI,IAAI,EAAE;AACV,IAAI,CAAC;AACL,GAAG,CAAC,MAAM,EAAE;AACZ,IAAI,IAAI,EAAE,GAAG;AACb,IAAI,IAAI,EAAE,MAAM;AAChB,IAAI,IAAI,EAAE,IAAI;AACd,IAAI,IAAI,EAAE;AACV,IAAI;AACJ,GAAG;AACH,EAAE,CAAC,CAAC;AACJ;;;;"}

package/build/server/chunks/settings-0Ih5rnSD.js

@@ -0,0 +1,19 @@
+import { s as spread_props } from './index.js-NH2Q8xBT.js';
+import { I as Icon } from './utils3-DxMdQNFZ.js';
+
+//#region ../../node_modules/.pnpm/@lucide+svelte@1.21.0_svelt_40f46c49124aea7c18fd533a285f4a67/node_modules/@lucide/svelte/dist/icons/settings.svelte
+function Settings($$renderer, $$props) {
+	let { $$slots, $$events, ...props } = $$props;
+	Icon($$renderer, spread_props([
+		{ name: "settings" },
+		props,
+		{ iconNode: [["path", { "d": "M9.671 4.136a2.34 2.34 0 0 1 4.659 0 2.34 2.34 0 0 0 3.319 1.915 2.34 2.34 0 0 1 2.33 4.033 2.34 2.34 0 0 0 0 3.831 2.34 2.34 0 0 1-2.33 4.033 2.34 2.34 0 0 0-3.319 1.915 2.34 2.34 0 0 1-4.659 0 2.34 2.34 0 0 0-3.32-1.915 2.34 2.34 0 0 1-2.33-4.033 2.34 2.34 0 0 0 0-3.831A2.34 2.34 0 0 1 6.35 6.051a2.34 2.34 0 0 0 3.319-1.915" }], ["circle", {
+			"cx": "12",
+			"cy": "12",
+			"r": "3"
+		}]] }
+	]));
+}
+
+export { Settings as S };
+//# sourceMappingURL=settings-0Ih5rnSD.js.map

package/build/server/chunks/settings-0Ih5rnSD.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings-0Ih5rnSD.js","sources":["../../../.svelte-kit/output/server/chunks/settings.js"],"sourcesContent":["import { d as spread_props } from \"./server.js\";\nimport { n as Icon } from \"./utils3.js\";\n//#region ../../node_modules/.pnpm/@lucide+svelte@1.21.0_svelt_40f46c49124aea7c18fd533a285f4a67/node_modules/@lucide/svelte/dist/icons/settings.svelte\nfunction Settings($$renderer, $$props) {\n\tlet { $$slots, $$events, ...props } = $$props;\n\tIcon($$renderer, spread_props([\n\t\t{ name: \"settings\" },\n\t\tprops,\n\t\t{ iconNode: [[\"path\", { \"d\": \"M9.671 4.136a2.34 2.34 0 0 1 4.659 0 2.34 2.34 0 0 0 3.319 1.915 2.34 2.34 0 0 1 2.33 4.033 2.34 2.34 0 0 0 0 3.831 2.34 2.34 0 0 1-2.33 4.033 2.34 2.34 0 0 0-3.319 1.915 2.34 2.34 0 0 1-4.659 0 2.34 2.34 0 0 0-3.32-1.915 2.34 2.34 0 0 1-2.33-4.033 2.34 2.34 0 0 0 0-3.831A2.34 2.34 0 0 1 6.35 6.051a2.34 2.34 0 0 0 3.319-1.915\" }], [\"circle\", {\n\t\t\t\"cx\": \"12\",\n\t\t\t\"cy\": \"12\",\n\t\t\t\"r\": \"3\"\n\t\t}]] }\n\t]));\n}\n//#endregion\nexport { Settings as t };\n"],"names":[],"mappings":";;;AAEA;AACA,SAAS,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE;AACvC,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO;AAC9C,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC;AAC/B,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;AACtB,EAAE,KAAK;AACP,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,yUAAyU,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE;AACxX,GAAG,IAAI,EAAE,IAAI;AACb,GAAG,IAAI,EAAE,IAAI;AACb,GAAG,GAAG,EAAE;AACR,GAAG,CAAC,CAAC;AACL,EAAE,CAAC,CAAC;AACJ;;;;"}

package/build/server/chunks/shield-check-BXDI7Kfm.js

@@ -0,0 +1,15 @@
+import { s as spread_props } from './index.js-NH2Q8xBT.js';
+import { I as Icon } from './utils3-DxMdQNFZ.js';
+
+//#region ../../node_modules/.pnpm/@lucide+svelte@1.21.0_svelt_40f46c49124aea7c18fd533a285f4a67/node_modules/@lucide/svelte/dist/icons/shield-check.svelte
+function Shield_check($$renderer, $$props) {
+	let { $$slots, $$events, ...props } = $$props;
+	Icon($$renderer, spread_props([
+		{ name: "shield-check" },
+		props,
+		{ iconNode: [["path", { "d": "M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z" }], ["path", { "d": "m9 12 2 2 4-4" }]] }
+	]));
+}
+
+export { Shield_check as S };
+//# sourceMappingURL=shield-check-BXDI7Kfm.js.map

package/build/server/chunks/shield-check-BXDI7Kfm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shield-check-BXDI7Kfm.js","sources":["../../../.svelte-kit/output/server/chunks/shield-check.js"],"sourcesContent":["import { d as spread_props } from \"./server.js\";\nimport { n as Icon } from \"./utils3.js\";\n//#region ../../node_modules/.pnpm/@lucide+svelte@1.21.0_svelt_40f46c49124aea7c18fd533a285f4a67/node_modules/@lucide/svelte/dist/icons/shield-check.svelte\nfunction Shield_check($$renderer, $$props) {\n\tlet { $$slots, $$events, ...props } = $$props;\n\tIcon($$renderer, spread_props([\n\t\t{ name: \"shield-check\" },\n\t\tprops,\n\t\t{ iconNode: [[\"path\", { \"d\": \"M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z\" }], [\"path\", { \"d\": \"m9 12 2 2 4-4\" }]] }\n\t]));\n}\n//#endregion\nexport { Shield_check as t };\n"],"names":[],"mappings":";;;AAEA;AACA,SAAS,YAAY,CAAC,UAAU,EAAE,OAAO,EAAE;AAC3C,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO;AAC9C,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC;AAC/B,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE;AAC1B,EAAE,KAAK;AACP,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,oKAAoK,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAC;AAC3O,EAAE,CAAC,CAAC;AACJ;;;;"}

package/build/server/chunks/shield-kT-iiBjg.js

@@ -0,0 +1,15 @@
+import { s as spread_props } from './index.js-NH2Q8xBT.js';
+import { I as Icon } from './utils3-DxMdQNFZ.js';
+
+//#region ../../node_modules/.pnpm/@lucide+svelte@1.21.0_svelt_40f46c49124aea7c18fd533a285f4a67/node_modules/@lucide/svelte/dist/icons/shield.svelte
+function Shield($$renderer, $$props) {
+	let { $$slots, $$events, ...props } = $$props;
+	Icon($$renderer, spread_props([
+		{ name: "shield" },
+		props,
+		{ iconNode: [["path", { "d": "M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z" }]] }
+	]));
+}
+
+export { Shield as S };
+//# sourceMappingURL=shield-kT-iiBjg.js.map

package/build/server/chunks/shield-kT-iiBjg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shield-kT-iiBjg.js","sources":["../../../.svelte-kit/output/server/chunks/shield.js"],"sourcesContent":["import { d as spread_props } from \"./server.js\";\nimport { n as Icon } from \"./utils3.js\";\n//#region ../../node_modules/.pnpm/@lucide+svelte@1.21.0_svelt_40f46c49124aea7c18fd533a285f4a67/node_modules/@lucide/svelte/dist/icons/shield.svelte\nfunction Shield($$renderer, $$props) {\n\tlet { $$slots, $$events, ...props } = $$props;\n\tIcon($$renderer, spread_props([\n\t\t{ name: \"shield\" },\n\t\tprops,\n\t\t{ iconNode: [[\"path\", { \"d\": \"M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z\" }]] }\n\t]));\n}\n//#endregion\nexport { Shield as t };\n"],"names":[],"mappings":";;;AAEA;AACA,SAAS,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE;AACrC,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO;AAC9C,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC;AAC/B,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;AACpB,EAAE,KAAK;AACP,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,oKAAoK,EAAE,CAAC,CAAC;AACvM,EAAE,CAAC,CAAC;AACJ;;;;"}

package/build/server/chunks/src-tWHhLCSB.js

@@ -0,0 +1,360 @@
+import { z } from 'zod';
+
+//#region ../platform/src/permissions/types.ts
+/**
+* Platform-scope permissions. Reserved for Selva-staff and instance operators;
+* regular users hold an empty array.
+*
+* - `instance_admin`        — superuser; implies every other permission.
+* - `manage_compute`        — configure the instance-wide Rhino.Compute pool.
+* - `manage_instance_users` — disable/enable any user on the instance.
+* - `manage_updates`        — run system updates.
+*/
+var PlatformPermissionSchema = z.enum([
+	"instance_admin",
+	"manage_compute",
+	"manage_instance_users",
+	"manage_updates"
+]);
+var ALL_PLATFORM_PERMISSIONS = PlatformPermissionSchema.options;
+var RESERVED_SLUG_SET = /* @__PURE__ */ new Set([
+	"o",
+	"api",
+	"admin",
+	"auth",
+	"login",
+	"logout",
+	"setup",
+	"team",
+	"library",
+	"projects",
+	"accept-invite"
+]);
+/**
+* Coerce an arbitrary name into a slug candidate: lowercase, non-alphanumeric
+* runs collapsed to single hyphens, trimmed of edge hyphens, capped at 63 chars.
+* Produces the shape `SlugSchema` validates — but does not itself guarantee
+* validity (a name of all-symbols yields `''`, and reserved words pass through);
+* run the result through `SlugSchema` where a valid slug is required.
+*/
+function slugify(name) {
+	return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 63);
+}
+/** Lowercase alphanumeric with internal hyphens, 3–63 chars, not a reserved word. */
+var SlugSchema = z.string().min(3, "Slug must be at least 3 characters").max(63, "Slug must be at most 63 characters").regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/, "Slug must be lowercase alphanumeric with hyphens (no leading/trailing/consecutive hyphens)").refine((s) => !RESERVED_SLUG_SET.has(s), { message: "Slug is reserved and cannot be used" });
+var OrgRoleSchema = z.enum([
+	"owner",
+	"admin",
+	"member"
+]);
+/**
+* Kinds of org-scoped branding asset. Adding a new kind is a single entry here
+* — the storage path, upload route, store, and UI are all generic over it.
+*/
+var OrgAssetKindSchema = z.enum(["logo", "favicon"]);
+var ALL_ORG_ASSET_KINDS = OrgAssetKindSchema.options;
+/** Org-scope permissions. A user may hold different sets in different orgs. */
+var OrgPermissionSchema = z.enum([
+	"manage_org_members",
+	"manage_org_compute",
+	"manage_definitions",
+	"manage_projects"
+]);
+var ALL_ORG_PERMISSIONS = OrgPermissionSchema.options;
+/** Governance perms — never grantable to `member`. */
+var OWNER_ADMIN_ONLY_PERMISSIONS = ["manage_org_members", "manage_org_compute"];
+var MEMBER_ASSIGNABLE_PERMISSIONS = ALL_ORG_PERMISSIONS.filter((p) => !OWNER_ADMIN_ONLY_PERMISSIONS.includes(p));
+/** Applied when adding a member without an explicit permissions list. */
+var DEFAULT_ORG_PERMISSIONS = {
+	owner: [...ALL_ORG_PERMISSIONS],
+	admin: [...ALL_ORG_PERMISSIONS],
+	member: []
+};
+var CreateOrgSchema = z.object({
+	name: z.string().min(1, "Organization name is required").max(128),
+	slug: SlugSchema
+});
+var UpdateOrgSchema = CreateOrgSchema.partial();
+//#endregion
+//#region ../platform/src/projects/schemas.ts
+var ProjectVisibilitySchema = z.enum([
+	"public",
+	"org",
+	"private",
+	"platform"
+]);
+var ProjectRoleSchema = z.enum([
+	"owner",
+	"editor",
+	"viewer"
+]);
+/** Cross-field check for PATCH flows. Call on the merged post-patch shape. */
+function validateProjectFlags(merged) {
+	const issues = [];
+	if (merged.autoJoinOnUpload && merged.visibility !== "public") issues.push({
+		path: "autoJoinOnUpload",
+		message: "autoJoinOnUpload requires visibility=public"
+	});
+	if (merged.visibility === "platform" && merged.autoJoinOnUpload) issues.push({
+		path: "autoJoinOnUpload",
+		message: "autoJoinOnUpload is not allowed on platform projects"
+	});
+	return issues;
+}
+//#endregion
+//#region ../platform/src/platformProjects/schemas.ts
+var PlatformProjectGranteeTypeSchema = z.enum(["org", "user"]);
+z.object({
+	id: z.string(),
+	projectId: z.string(),
+	granteeType: PlatformProjectGranteeTypeSchema,
+	granteeId: z.string(),
+	canSolve: z.boolean(),
+	createdBy: z.string(),
+	createdAt: z.string()
+});
+//#endregion
+//#region ../platform/src/definitions/types.ts
+var GH_EXTENSIONS = [".gh", ".ghx"];
+var COVER_IMAGE_EXTENSIONS = [
+	".jpg",
+	".jpeg",
+	".png",
+	".webp",
+	".gif"
+];
+var COVER_IMAGE_CONTENT_TYPES = {
+	".jpg": "image/jpeg",
+	".jpeg": "image/jpeg",
+	".png": "image/png",
+	".webp": "image/webp",
+	".gif": "image/gif"
+};
+var GuidSchema = z.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "Invalid GUID format");
+var DefinitionStatusSchema = z.enum([
+	"draft",
+	"published",
+	"archived"
+]);
+var DefinitionFileExtSchema = z.enum(["gh", "ghx"]);
+z.object({
+	id: GuidSchema,
+	definitionId: GuidSchema,
+	versionNumber: z.number().int().min(1),
+	fileExt: DefinitionFileExtSchema,
+	fileKey: z.string().min(1),
+	originalFilename: z.string().max(256).optional(),
+	uploadedBy: z.string().min(1),
+	uploadedAt: z.string(),
+	changeNote: z.string().max(1e3).optional(),
+	schema: z.record(z.string(), z.unknown()).optional(),
+	schemaExtractedAt: z.string().optional()
+});
+var DefinitionChannelSchema = z.enum(["live", "draft"]);
+/** HTTP-body validator for new-definition input. */
+var CreateDefinitionInputSchema = z.object({
+	displayName: z.string().min(1, "Display name is required").max(256),
+	description: z.string().max(2e3).optional(),
+	coverImage: z.string().max(2048).optional(),
+	category: z.string().max(128).optional(),
+	tags: z.array(z.string().max(64)).max(20).optional(),
+	projectId: GuidSchema,
+	computeServerId: GuidSchema.optional()
+});
+/**
+* PATCH validator. Field semantics match `DefinitionRecordPatch`:
+* - missing / `undefined` — leave unchanged
+* - `null` — clear (only on nullable fields)
+* - value — set
+*/
+var UpdateMetadataInputSchema = z.object({
+	displayName: z.string().min(1, "Display name is required").max(256).optional(),
+	description: z.string().max(2e3).nullable().optional(),
+	coverImage: z.string().max(2048).nullable().optional(),
+	category: z.string().max(128).nullable().optional(),
+	tags: z.array(z.string().max(64)).max(20).nullable().optional(),
+	projectId: GuidSchema.optional(),
+	computeServerId: GuidSchema.nullable().optional(),
+	solveCacheLimit: z.number().int().min(0).max(1e5).nullable().optional(),
+	status: DefinitionStatusSchema.optional()
+});
+/** Body for `POST /api/definitions/[guid]/publish`. */
+var PublishVersionInputSchema = z.object({ versionId: GuidSchema.optional() }).default({});
+//#endregion
+//#region ../platform/src/shareLinks/schemas.ts
+/**
+* HTTP body for `POST /api/definitions/[guid]/share-links`. The route returns
+* the raw token exactly once.
+*/
+var CreateShareLinkInputSchema = z.object({
+	channel: DefinitionChannelSchema.default("live"),
+	name: z.string().max(128).optional(),
+	allowSolve: z.boolean().default(true),
+	/**
+	* Null explicitly removes the cap. Omitted = apply default — null is the
+	* minter's deliberate "uncap" choice.
+	*/
+	maxSolves: z.number().int().min(1).nullable().optional(),
+	/** Optional ISO timestamp. Resolution compares to `now()`. */
+	expiresAt: z.iso.datetime().nullable().optional()
+});
+//#endregion
+//#region ../platform/src/storage/image.ts
+/**
+* Shared image-transcoding helper for `IStorageProvider` implementations.
+* Cover images are normalized to WebP at upload time (capped at 1200px,
+* quality 85) so storage/bandwidth stays predictable and the viewer path
+* is uniform.
+*
+* `sharp` is loaded via a dynamic import so the platform package has no
+* hard runtime dependency on it — install it in providers that need
+* transcoding (optional peer dependency).
+*/
+var IMAGE_MAX_WIDTH = 1200;
+/** True if the input looks like an image to process — by content type or path extension. */
+function isImageUpload(contentType, storagePath) {
+	if (contentType?.startsWith("image/")) return true;
+	return /\.(webp|png|jpe?g|gif|bmp|tif?f|svg)$/i.test(storagePath);
+}
+/**
+* Rewrite a path's extension to `.webp`. Unchanged if not a recognized image
+* extension. SVG is included: every upload (including SVG) is rasterized to
+* WebP, so a `.svg` input is stored as `.webp` — no vector blob is ever
+* persisted, which keeps the served bytes XSS-free without a sanitizer.
+*/
+function toWebpPath(storagePath) {
+	return storagePath.replace(/\.(png|jpe?g|gif|bmp|tif?f|svg)$/i, ".webp");
+}
+/**
+* If the input is an image, transcode to WebP (capped + re-encoded) and
+* return rewritten bytes/content-type/path. Non-images pass through, so
+* providers can call this unconditionally before `put`.
+*
+* Throws if `sharp` isn't installed — that's a config error, not a fallback.
+*/
+async function transcodeImageIfNeeded(data, contentType, storagePath) {
+	if (!isImageUpload(contentType, storagePath)) return {
+		data,
+		contentType: contentType ?? "application/octet-stream",
+		path: storagePath
+	};
+	const compressed = await (await loadSharp())(Buffer.from(data)).resize({
+		width: IMAGE_MAX_WIDTH,
+		withoutEnlargement: true
+	}).webp({ quality: 85 }).toBuffer();
+	return {
+		data: new Uint8Array(compressed),
+		contentType: "image/webp",
+		path: toWebpPath(storagePath)
+	};
+}
+var cachedSharp = null;
+async function loadSharp() {
+	if (cachedSharp) return cachedSharp;
+	try {
+		const mod = await import('sharp');
+		cachedSharp = mod.default ?? mod;
+		return cachedSharp;
+	} catch (err) {
+		throw new Error("Image transcoding requires `sharp` to be installed. Add it as a dependency in your provider package.", { cause: err });
+	}
+}
+//#endregion
+//#region ../platform/src/storage/assetClasses.ts
+var BRANDING_KINDS = ALL_ORG_ASSET_KINDS.join("|");
+var COVER_EXTS = COVER_IMAGE_EXTENSIONS.map((ext) => ext.replace(/^\./, "").replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|");
+var SAFE_SEGMENT = String.raw`[A-Za-z0-9._-]+`;
+var GUID = String.raw`[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}`;
+/**
+* The closed registry of servable asset classes. Order matters only for
+* readability — patterns are mutually exclusive by prefix. Anything that
+* matches no class is unservable (the route 404s), which keeps the proxy
+* default-deny: a new blob type is opt-in by adding an entry here.
+*/
+var ASSET_CLASSES = [
+	{
+		id: "org-branding",
+		visibility: "public",
+		scope: "none",
+		pattern: new RegExp(String.raw`^orgs\/(${SAFE_SEGMENT})\/branding\/(?:${BRANDING_KINDS})\.webp$`)
+	},
+	{
+		id: "org-private",
+		visibility: "org",
+		scope: "org",
+		pattern: new RegExp(String.raw`^orgs\/(${SAFE_SEGMENT})\/private\/${SAFE_SEGMENT}$`)
+	},
+	{
+		id: "definition-cover",
+		visibility: "project",
+		scope: "project",
+		pattern: new RegExp(String.raw`^definitions\/(${GUID})\/cover\.(?:${COVER_EXTS})$`, "i")
+	}
+];
+/**
+* Reject any path that contains a traversal, empty, or backslash segment
+* *before* it can match a class. The class patterns use a permissive segment
+* alphabet (`[A-Za-z0-9._-]+`) so dotted ids and filenames work, but that
+* alphabet also admits a bare `.` or `..` *as a whole segment* — which would
+* let `orgs/../branding/logo.webp` classify as public branding with `..`
+* captured as the orgId. This mirrors `assertSafeKey` in the path builders:
+* the registry is the read-side gate, those are the write-side gate, and both
+* forbid the same segments so a path that can't be *written* can't be *read*.
+*/
+function hasUnsafeSegment(storagePath) {
+	if (storagePath.includes("\\")) return true;
+	for (const segment of storagePath.split("/")) if (segment === "" || segment === "." || segment === "..") return true;
+	return false;
+}
+/**
+* Classify a storage path into its asset class and scope id, or null when no
+* class matches (or the path is unsafe). Callers — `getPublicUrl` (to pick CDN
+* vs proxy) and the serving route (to pick the auth check) — consult this so
+* URL generation and authorization never drift apart.
+*
+* For `org-branding` the orgId is captured as group 1 but the class is public,
+* so `scopeId` is reported as the captured id only when the class actually
+* authorizes against it (`scope !== 'none'`); public classes report null.
+*/
+function classifyAssetPath(storagePath) {
+	if (hasUnsafeSegment(storagePath)) return null;
+	for (const cls of ASSET_CLASSES) {
+		const m = cls.pattern.exec(storagePath);
+		if (!m) continue;
+		return {
+			class: cls,
+			scopeId: cls.scope === "none" ? null : m[1] ?? null
+		};
+	}
+	return null;
+}
+//#endregion
+//#region ../platform/src/context.ts
+/**
+* For server-internal operations outside any HTTP request (bootstrap,
+* janitors, migrations). Treated as fully authorized.
+*/
+var SYSTEM_CONTEXT = {
+	userId: "",
+	platformPermissions: [...ALL_PLATFORM_PERMISSIONS],
+	orgPermissions: [...ALL_ORG_PERMISSIONS],
+	system: true
+};
+/**
+* Does NOT cross-check `ctx.actingOrgId` — the caller builds a context scoped
+* to the org they're acting on. An org permission against a ctx without
+* `actingOrgId` returns false unless `instance_admin` or `system`.
+*/
+function hasPermission(ctx, permission) {
+	if (ctx.system) return true;
+	if (ctx.platformPermissions.includes("instance_admin")) return true;
+	if (isPlatformPermission(permission)) return ctx.platformPermissions.includes(permission);
+	return ctx.orgPermissions.includes(permission);
+}
+var PLATFORM_PERMISSION_VALUES = new Set(ALL_PLATFORM_PERMISSIONS);
+function isPlatformPermission(p) {
+	return PLATFORM_PERMISSION_VALUES.has(p);
+}
+
+export { ALL_PLATFORM_PERMISSIONS as A, CreateOrgSchema as C, DEFAULT_ORG_PERMISSIONS as D, GH_EXTENSIONS as G, MEMBER_ASSIGNABLE_PERMISSIONS as M, OrgAssetKindSchema as O, PlatformPermissionSchema as P, SYSTEM_CONTEXT as S, UpdateOrgSchema as U, ALL_ORG_PERMISSIONS as a, OrgPermissionSchema as b, CreateDefinitionInputSchema as c, GuidSchema as d, UpdateMetadataInputSchema as e, COVER_IMAGE_CONTENT_TYPES as f, PublishVersionInputSchema as g, hasPermission as h, CreateShareLinkInputSchema as i, classifyAssetPath as j, OrgRoleSchema as k, ProjectVisibilitySchema as l, ProjectRoleSchema as m, OWNER_ADMIN_ONLY_PERMISSIONS as n, slugify as s, transcodeImageIfNeeded as t, validateProjectFlags as v };
+//# sourceMappingURL=src-tWHhLCSB.js.map