@selvajs/selva 4.7.0-beta.5 → 4.7.0

package/build/server/chunks/chunks/admin-auth.server.js-CWv707EC.js

@@ -1,180 +0,0 @@
-import { b as private_env } from './shared-server.js-DA4m8f1m.js';
-import './compute.js-DJMNVamB.js';
-import { error } from '@sveltejs/kit';
-
-/**
-* Build a process-local fixed-window rate limiter. Each limiter owns its own
-* bucket `Map`, so distinct endpoints/keys-spaces don't collide.
-*/
-function createComputeRateLimiter(config) {
-	const { windowMs, maxPerWindow } = config;
-	const maxKeys = Math.max(1, Math.floor(config.maxKeys ?? 1e5));
-	const sweepIntervalMs = Math.max(0, Math.floor(config.sweepIntervalMs ?? windowMs));
-	const resolvedConfig = Object.freeze({
-		...config,
-		maxKeys,
-		sweepIntervalMs
-	});
-	const buckets = /* @__PURE__ */ new Map();
-	let nextSweepAt = Number.POSITIVE_INFINITY;
-	/**
-	* Drop dead buckets, then enforce the hard cap. Amortized onto `check`/`peek`
-	* so the limiter needs no timer of its own. Runs at most once per
-	* `sweepIntervalMs` — except when the cap is already breached, which must be
-	* enforced on the spot regardless of the sweep clock.
-	*
-	* `headroom` is how many buckets the caller is about to insert; the cap is
-	* enforced against the post-insert size so `maxKeys` is a true ceiling rather
-	* than one the very next write steps over.
-	*/
-	function maybeSweep(now, headroom = 0) {
-		const budget = Math.max(0, maxKeys - headroom);
-		if (!(sweepIntervalMs > 0 && now >= nextSweepAt) && buckets.size <= budget) return;
-		for (const [key, entry] of buckets) if (now > entry.resetAt) buckets.delete(key);
-		if (sweepIntervalMs > 0) nextSweepAt = now + sweepIntervalMs;
-		if (buckets.size > budget) {
-			const byResetAsc = [...buckets.entries()].sort((a, b) => a[1].resetAt - b[1].resetAt);
-			for (let i = 0; i < byResetAsc.length - budget; i++) buckets.delete(byResetAsc[i][0]);
-		}
-	}
-	return {
-		config: resolvedConfig,
-		check(key) {
-			const now = Date.now();
-			maybeSweep(now, buckets.has(key) ? 0 : 1);
-			const entry = buckets.get(key);
-			if (!entry || now > entry.resetAt) {
-				buckets.set(key, {
-					count: 1,
-					resetAt: now + windowMs
-				});
-				if (sweepIntervalMs > 0 && nextSweepAt === Number.POSITIVE_INFINITY) nextSweepAt = now + sweepIntervalMs;
-				return { allowed: true };
-			}
-			if (entry.count >= maxPerWindow) return {
-				allowed: false,
-				retryAfter: Math.ceil((entry.resetAt - now) / 1e3)
-			};
-			entry.count += 1;
-			return { allowed: true };
-		},
-		peek(key) {
-			const now = Date.now();
-			maybeSweep(now);
-			const entry = buckets.get(key);
-			if (!entry || now > entry.resetAt) return { allowed: true };
-			if (entry.count >= maxPerWindow) return {
-				allowed: false,
-				retryAfter: Math.ceil((entry.resetAt - now) / 1e3)
-			};
-			return { allowed: true };
-		},
-		clear(key) {
-			buckets.delete(key);
-		},
-		count(key) {
-			const entry = buckets.get(key);
-			if (!entry || Date.now() > entry.resetAt) return 0;
-			return entry.count;
-		},
-		reset() {
-			buckets.clear();
-			nextSweepAt = Number.POSITIVE_INFINITY;
-		},
-		size() {
-			return buckets.size;
-		}
-	};
-}
-//#endregion
-//#region ../server/src/http/body-size.ts
-/**
-* True when the request's declared `Content-Length` exceeds `maxBytes`.
-* Check BEFORE the body is read so a malicious client can't burn memory by
-* sending a huge payload to a small-body endpoint; the route maps a `true`
-* result to its transport's 413.
-*
-* Background: a global body-size limit (e.g. adapter-node's `BODY_SIZE_LIMIT`)
-* has to be set high enough for the largest legitimate upload, which means
-* smaller JSON endpoints inherit that ceiling by default. This check is the
-* per-route lower bound.
-*
-* Caveat: requests without `Content-Length` (chunked transfer encoding) bypass
-* this check. Most browsers and HTTP clients send Content-Length on POST/PUT.
-* The global limit is the backstop for those.
-*/
-function declaredBodySizeExceeds(headers, maxBytes) {
-	const declared = Number(headers.get("content-length"));
-	return Number.isFinite(declared) && declared > maxBytes;
-}
-//#endregion
-//#region src/lib/server/admin-auth.server.ts
-var SESSION_COOKIE_NAME = "admin_session";
-var SESSION_MAX_AGE_MS = 480 * 60 * 1e3;
-var REFRESH_COOKIE_NAME = "admin_refresh";
-var REFRESH_MAX_AGE_MS = 720 * 60 * 60 * 1e3;
-var loginRateLimiter = createComputeRateLimiter({
-	windowMs: 900 * 1e3,
-	maxPerWindow: 5
-});
-function checkRateLimit(ip) {
-	return loginRateLimiter.peek(ip);
-}
-function recordFailedAttempt(ip) {
-	loginRateLimiter.check(ip);
-}
-function clearRateLimit(ip) {
-	loginRateLimiter.clear(ip);
-}
-/**
-* Set the session cookie using a token produced by the auth provider. The
-* token is always minted by the provider (local = HMAC, Supabase = JWT) as
-* part of `verifyLogin` — this helper does cookie transport only.
-*/
-function setSessionCookie(cookies, sessionToken) {
-	const isSecure = process.env.NODE_ENV === "production" && private_env.ALLOW_INSECURE_COOKIES !== "true";
-	cookies.set(SESSION_COOKIE_NAME, sessionToken, {
-		path: "/",
-		httpOnly: true,
-		sameSite: "lax",
-		secure: isSecure,
-		maxAge: SESSION_MAX_AGE_MS / 1e3
-	});
-}
-function destroySession(cookies) {
-	cookies.delete(SESSION_COOKIE_NAME, { path: "/" });
-	cookies.delete(REFRESH_COOKIE_NAME, { path: "/" });
-}
-/**
-* Set the refresh-token cookie used by the OAuth/Supabase flow. The
-* session-refresh middleware in `hooks.server.ts` swaps an expired access
-* token for a fresh one using this. Local/HMAC sessions don't need it.
-*/
-function setRefreshCookie(cookies, refreshToken) {
-	const isSecure = process.env.NODE_ENV === "production" && private_env.ALLOW_INSECURE_COOKIES !== "true";
-	cookies.set(REFRESH_COOKIE_NAME, refreshToken, {
-		path: "/",
-		httpOnly: true,
-		sameSite: "lax",
-		secure: isSecure,
-		maxAge: REFRESH_MAX_AGE_MS / 1e3
-	});
-}
-function getRefreshToken(cookies) {
-	return cookies.get(REFRESH_COOKIE_NAME);
-}
-function clearRefreshCookie(cookies) {
-	cookies.delete(REFRESH_COOKIE_NAME, { path: "/" });
-}
-/**
-* Reject a request whose declared `Content-Length` exceeds `maxBytes` — the
-* per-route lower bound under the global adapter-node `BODY_SIZE_LIMIT`
-* (which must stay high enough for 50MB .gh uploads). Throws 413 BEFORE the
-* body is read; see `declaredBodySizeExceeds` for the chunked-encoding caveat.
-*/
-function requireMaxBodySize(request, maxBytes) {
-	if (declaredBodySizeExceeds(request.headers, maxBytes)) throw error(413, `Request body exceeds the limit for this endpoint.`);
-}
-
-export { setRefreshCookie as a, checkRateLimit as b, clearRefreshCookie as c, clearRateLimit as d, destroySession as e, requireMaxBodySize as f, getRefreshToken as g, createComputeRateLimiter as h, recordFailedAttempt as r, setSessionCookie as s };
-//# sourceMappingURL=admin-auth.server.js-CWv707EC.js.map

package/build/server/chunks/chunks/admin-auth.server.js-CWv707EC.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"admin-auth.server.js-CWv707EC.js","sources":["../../../../.svelte-kit/output/server/chunks/admin-auth.server.js"],"sourcesContent":["import { t as private_env } from \"./shared-server.js\";\nimport \"./compute.js\";\nimport { error } from \"@sveltejs/kit\";\n/**\n* Build a process-local fixed-window rate limiter. Each limiter owns its own\n* bucket `Map`, so distinct endpoints/keys-spaces don't collide.\n*/\nfunction createComputeRateLimiter(config) {\n\tconst { windowMs, maxPerWindow } = config;\n\tconst maxKeys = Math.max(1, Math.floor(config.maxKeys ?? 1e5));\n\tconst sweepIntervalMs = Math.max(0, Math.floor(config.sweepIntervalMs ?? windowMs));\n\tconst resolvedConfig = Object.freeze({\n\t\t...config,\n\t\tmaxKeys,\n\t\tsweepIntervalMs\n\t});\n\tconst buckets = /* @__PURE__ */ new Map();\n\tlet nextSweepAt = Number.POSITIVE_INFINITY;\n\t/**\n\t* Drop dead buckets, then enforce the hard cap. Amortized onto `check`/`peek`\n\t* so the limiter needs no timer of its own. Runs at most once per\n\t* `sweepIntervalMs` — except when the cap is already breached, which must be\n\t* enforced on the spot regardless of the sweep clock.\n\t*\n\t* `headroom` is how many buckets the caller is about to insert; the cap is\n\t* enforced against the post-insert size so `maxKeys` is a true ceiling rather\n\t* than one the very next write steps over.\n\t*/\n\tfunction maybeSweep(now, headroom = 0) {\n\t\tconst budget = Math.max(0, maxKeys - headroom);\n\t\tif (!(sweepIntervalMs > 0 && now >= nextSweepAt) && buckets.size <= budget) return;\n\t\tfor (const [key, entry] of buckets) if (now > entry.resetAt) buckets.delete(key);\n\t\tif (sweepIntervalMs > 0) nextSweepAt = now + sweepIntervalMs;\n\t\tif (buckets.size > budget) {\n\t\t\tconst byResetAsc = [...buckets.entries()].sort((a, b) => a[1].resetAt - b[1].resetAt);\n\t\t\tfor (let i = 0; i < byResetAsc.length - budget; i++) buckets.delete(byResetAsc[i][0]);\n\t\t}\n\t}\n\treturn {\n\t\tconfig: resolvedConfig,\n\t\tcheck(key) {\n\t\t\tconst now = Date.now();\n\t\t\tmaybeSweep(now, buckets.has(key) ? 0 : 1);\n\t\t\tconst entry = buckets.get(key);\n\t\t\tif (!entry || now > entry.resetAt) {\n\t\t\t\tbuckets.set(key, {\n\t\t\t\t\tcount: 1,\n\t\t\t\t\tresetAt: now + windowMs\n\t\t\t\t});\n\t\t\t\tif (sweepIntervalMs > 0 && nextSweepAt === Number.POSITIVE_INFINITY) nextSweepAt = now + sweepIntervalMs;\n\t\t\t\treturn { allowed: true };\n\t\t\t}\n\t\t\tif (entry.count >= maxPerWindow) return {\n\t\t\t\tallowed: false,\n\t\t\t\tretryAfter: Math.ceil((entry.resetAt - now) / 1e3)\n\t\t\t};\n\t\t\tentry.count += 1;\n\t\t\treturn { allowed: true };\n\t\t},\n\t\tpeek(key) {\n\t\t\tconst now = Date.now();\n\t\t\tmaybeSweep(now);\n\t\t\tconst entry = buckets.get(key);\n\t\t\tif (!entry || now > entry.resetAt) return { allowed: true };\n\t\t\tif (entry.count >= maxPerWindow) return {\n\t\t\t\tallowed: false,\n\t\t\t\tretryAfter: Math.ceil((entry.resetAt - now) / 1e3)\n\t\t\t};\n\t\t\treturn { allowed: true };\n\t\t},\n\t\tclear(key) {\n\t\t\tbuckets.delete(key);\n\t\t},\n\t\tcount(key) {\n\t\t\tconst entry = buckets.get(key);\n\t\t\tif (!entry || Date.now() > entry.resetAt) return 0;\n\t\t\treturn entry.count;\n\t\t},\n\t\treset() {\n\t\t\tbuckets.clear();\n\t\t\tnextSweepAt = Number.POSITIVE_INFINITY;\n\t\t},\n\t\tsize() {\n\t\t\treturn buckets.size;\n\t\t}\n\t};\n}\n//#endregion\n//#region ../server/src/http/body-size.ts\n/**\n* True when the request's declared `Content-Length` exceeds `maxBytes`.\n* Check BEFORE the body is read so a malicious client can't burn memory by\n* sending a huge payload to a small-body endpoint; the route maps a `true`\n* result to its transport's 413.\n*\n* Background: a global body-size limit (e.g. adapter-node's `BODY_SIZE_LIMIT`)\n* has to be set high enough for the largest legitimate upload, which means\n* smaller JSON endpoints inherit that ceiling by default. This check is the\n* per-route lower bound.\n*\n* Caveat: requests without `Content-Length` (chunked transfer encoding) bypass\n* this check. Most browsers and HTTP clients send Content-Length on POST/PUT.\n* The global limit is the backstop for those.\n*/\nfunction declaredBodySizeExceeds(headers, maxBytes) {\n\tconst declared = Number(headers.get(\"content-length\"));\n\treturn Number.isFinite(declared) && declared > maxBytes;\n}\n//#endregion\n//#region src/lib/server/admin-auth.server.ts\nvar SESSION_COOKIE_NAME = \"admin_session\";\nvar SESSION_MAX_AGE_MS = 480 * 60 * 1e3;\nvar REFRESH_COOKIE_NAME = \"admin_refresh\";\nvar REFRESH_MAX_AGE_MS = 720 * 60 * 60 * 1e3;\nvar loginRateLimiter = createComputeRateLimiter({\n\twindowMs: 900 * 1e3,\n\tmaxPerWindow: 5\n});\nfunction checkRateLimit(ip) {\n\treturn loginRateLimiter.peek(ip);\n}\nfunction recordFailedAttempt(ip) {\n\tloginRateLimiter.check(ip);\n}\nfunction clearRateLimit(ip) {\n\tloginRateLimiter.clear(ip);\n}\n/**\n* Set the session cookie using a token produced by the auth provider. The\n* token is always minted by the provider (local = HMAC, Supabase = JWT) as\n* part of `verifyLogin` — this helper does cookie transport only.\n*/\nfunction setSessionCookie(cookies, sessionToken) {\n\tconst isSecure = process.env.NODE_ENV === \"production\" && private_env.ALLOW_INSECURE_COOKIES !== \"true\";\n\tcookies.set(SESSION_COOKIE_NAME, sessionToken, {\n\t\tpath: \"/\",\n\t\thttpOnly: true,\n\t\tsameSite: \"lax\",\n\t\tsecure: isSecure,\n\t\tmaxAge: SESSION_MAX_AGE_MS / 1e3\n\t});\n}\nfunction destroySession(cookies) {\n\tcookies.delete(SESSION_COOKIE_NAME, { path: \"/\" });\n\tcookies.delete(REFRESH_COOKIE_NAME, { path: \"/\" });\n}\n/**\n* Set the refresh-token cookie used by the OAuth/Supabase flow. The\n* session-refresh middleware in `hooks.server.ts` swaps an expired access\n* token for a fresh one using this. Local/HMAC sessions don't need it.\n*/\nfunction setRefreshCookie(cookies, refreshToken) {\n\tconst isSecure = process.env.NODE_ENV === \"production\" && private_env.ALLOW_INSECURE_COOKIES !== \"true\";\n\tcookies.set(REFRESH_COOKIE_NAME, refreshToken, {\n\t\tpath: \"/\",\n\t\thttpOnly: true,\n\t\tsameSite: \"lax\",\n\t\tsecure: isSecure,\n\t\tmaxAge: REFRESH_MAX_AGE_MS / 1e3\n\t});\n}\nfunction getRefreshToken(cookies) {\n\treturn cookies.get(REFRESH_COOKIE_NAME);\n}\nfunction clearRefreshCookie(cookies) {\n\tcookies.delete(REFRESH_COOKIE_NAME, { path: \"/\" });\n}\n/**\n* Reject a request whose declared `Content-Length` exceeds `maxBytes` — the\n* per-route lower bound under the global adapter-node `BODY_SIZE_LIMIT`\n* (which must stay high enough for 50MB .gh uploads). Throws 413 BEFORE the\n* body is read; see `declaredBodySizeExceeds` for the chunked-encoding caveat.\n*/\nfunction requireMaxBodySize(request, maxBytes) {\n\tif (declaredBodySizeExceeds(request.headers, maxBytes)) throw error(413, `Request body exceeds the limit for this endpoint.`);\n}\n//#endregion\nexport { getRefreshToken as a, setRefreshCookie as c, destroySession as i, setSessionCookie as l, clearRateLimit as n, recordFailedAttempt as o, clearRefreshCookie as r, requireMaxBodySize as s, checkRateLimit as t, createComputeRateLimiter as u };\n"],"names":[],"mappings":";;;;AAGA;AACA;AACA;AACA;AACA,SAAS,wBAAwB,CAAC,MAAM,EAAE;AAC1C,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM;AAC1C,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC;AAC/D,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,IAAI,QAAQ,CAAC,CAAC;AACpF,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;AACtC,EAAE,GAAG,MAAM;AACX,EAAE,OAAO;AACT,EAAE;AACF,EAAE,CAAC;AACH,CAAC,MAAM,OAAO,mBAAmB,IAAI,GAAG,EAAE;AAC1C,CAAC,IAAI,WAAW,GAAG,MAAM,CAAC,iBAAiB;AAC3C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,SAAS,UAAU,CAAC,GAAG,EAAE,QAAQ,GAAG,CAAC,EAAE;AACxC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;AAChD,EAAE,IAAI,EAAE,eAAe,GAAG,CAAC,IAAI,GAAG,IAAI,WAAW,CAAC,IAAI,OAAO,CAAC,IAAI,IAAI,MAAM,EAAE;AAC9E,EAAE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;AAClF,EAAE,IAAI,eAAe,GAAG,CAAC,EAAE,WAAW,GAAG,GAAG,GAAG,eAAe;AAC9D,EAAE,IAAI,OAAO,CAAC,IAAI,GAAG,MAAM,EAAE;AAC7B,GAAG,MAAM,UAAU,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AACxF,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxF,EAAE;AACF,CAAC;AACD,CAAC,OAAO;AACR,EAAE,MAAM,EAAE,cAAc;AACxB,EAAE,KAAK,CAAC,GAAG,EAAE;AACb,GAAG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;AACzB,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC5C,GAAG,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;AACjC,GAAG,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE;AACtC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE;AACrB,KAAK,KAAK,EAAE,CAAC;AACb,KAAK,OAAO,EAAE,GAAG,GAAG;AACpB,KAAK,CAAC;AACN,IAAI,IAAI,eAAe,GAAG,CAAC,IAAI,WAAW,KAAK,MAAM,CAAC,iBAAiB,EAAE,WAAW,GAAG,GAAG,GAAG,eAAe;AAC5G,IAAI,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;AAC5B,GAAG;AACH,GAAG,IAAI,KAAK,CAAC,KAAK,IAAI,YAAY,EAAE,OAAO;AAC3C,IAAI,OAAO,EAAE,KAAK;AAClB,IAAI,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,IAAI,GAAG;AACrD,IAAI;AACJ,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC;AACnB,GAAG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;AAC3B,EAAE,CAAC;AACH,EAAE,IAAI,CAAC,GAAG,EAAE;AACZ,GAAG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;AACzB,GAAG,UAAU,CAAC,GAAG,CAAC;AAClB,GAAG,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;AACjC,GAAG,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;AAC9D,GAAG,IAAI,KAAK,CAAC,KAAK,IAAI,YAAY,EAAE,OAAO;AAC3C,IAAI,OAAO,EAAE,KAAK;AAClB,IAAI,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,IAAI,GAAG;AACrD,IAAI;AACJ,GAAG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;AAC3B,EAAE,CAAC;AACH,EAAE,KAAK,CAAC,GAAG,EAAE;AACb,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;AACtB,EAAE,CAAC;AACH,EAAE,KAAK,CAAC,GAAG,EAAE;AACb,GAAG,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;AACjC,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC;AACrD,GAAG,OAAO,KAAK,CAAC,KAAK;AACrB,EAAE,CAAC;AACH,EAAE,KAAK,GAAG;AACV,GAAG,OAAO,CAAC,KAAK,EAAE;AAClB,GAAG,WAAW,GAAG,MAAM,CAAC,iBAAiB;AACzC,EAAE,CAAC;AACH,EAAE,IAAI,GAAG;AACT,GAAG,OAAO,OAAO,CAAC,IAAI;AACtB,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,uBAAuB,CAAC,OAAO,EAAE,QAAQ,EAAE;AACpD,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AACvD,CAAC,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,QAAQ;AACxD;AACA;AACA;AACA,IAAI,mBAAmB,GAAG,eAAe;AACzC,IAAI,kBAAkB,GAAG,GAAG,GAAG,EAAE,GAAG,GAAG;AACvC,IAAI,mBAAmB,GAAG,eAAe;AACzC,IAAI,kBAAkB,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG;AAC5C,IAAI,gBAAgB,GAAG,wBAAwB,CAAC;AAChD,CAAC,QAAQ,EAAE,GAAG,GAAG,GAAG;AACpB,CAAC,YAAY,EAAE;AACf,CAAC,CAAC;AACF,SAAS,cAAc,CAAC,EAAE,EAAE;AAC5B,CAAC,OAAO,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;AACjC;AACA,SAAS,mBAAmB,CAAC,EAAE,EAAE;AACjC,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;AAC3B;AACA,SAAS,cAAc,CAAC,EAAE,EAAE;AAC5B,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;AAC3B;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE;AACjD,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,WAAW,CAAC,sBAAsB,KAAK,MAAM;AACxG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,YAAY,EAAE;AAChD,EAAE,IAAI,EAAE,GAAG;AACX,EAAE,QAAQ,EAAE,IAAI;AAChB,EAAE,QAAQ,EAAE,KAAK;AACjB,EAAE,MAAM,EAAE,QAAQ;AAClB,EAAE,MAAM,EAAE,kBAAkB,GAAG;AAC/B,EAAE,CAAC;AACH;AACA,SAAS,cAAc,CAAC,OAAO,EAAE;AACjC,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACnD,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACnD;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE;AACjD,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,WAAW,CAAC,sBAAsB,KAAK,MAAM;AACxG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,YAAY,EAAE;AAChD,EAAE,IAAI,EAAE,GAAG;AACX,EAAE,QAAQ,EAAE,IAAI;AAChB,EAAE,QAAQ,EAAE,KAAK;AACjB,EAAE,MAAM,EAAE,QAAQ;AAClB,EAAE,MAAM,EAAE,kBAAkB,GAAG;AAC/B,EAAE,CAAC;AACH;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AACxC;AACA,SAAS,kBAAkB,CAAC,OAAO,EAAE;AACrC,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACnD;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,kBAAkB,CAAC,OAAO,EAAE,QAAQ,EAAE;AAC/C,CAAC,IAAI,uBAAuB,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,iDAAiD,CAAC,CAAC;AAC9H;;;;"}

package/build/server/chunks/chunks/admin-config.js-DdCBspOh.js

@@ -1,3 +0,0 @@
-import './src.js-C5mUn1eC.js';
-import './computeLimits.js-BvAV5j60.js';
-//# sourceMappingURL=admin-config.js-DdCBspOh.js.map

package/build/server/chunks/chunks/admin-config.js-DdCBspOh.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"admin-config.js-DdCBspOh.js","sources":[],"sourcesContent":[],"names":[],"mappings":";"}

package/build/server/chunks/chunks/api-errors.js-BXNSPeAn.js

@@ -1,141 +0,0 @@
-import './src.js-C5mUn1eC.js';
-import { S as SchemaExtractionError, P as ProviderError, n as getComputeServerConfigStore } from './providers.server.js-DVrVQ227.js';
-import { r as resolveServerForOrg$1 } from './utils2.js-BeHcWGXn.js';
-import { error, isHttpError } from '@sveltejs/kit';
-
-//#region src/lib/server/compute/resolve.server.ts
-/**
-* Thrown when no compute server is configured or visible for the org — a
-* misconfiguration an operator must fix in `/admin/compute`, not a bug. Routes
-* map this to 503 with operator guidance instead of letting the pure helper's
-* plain `Error` surface as a generic 500. `handleApiError` recognizes it; the
-* two compute routes that don't route through `handleApiError` map it inline.
-*/
-var ComputeServerUnconfiguredError = class extends Error {
-	constructor(message = "No compute server configured. Ask an admin to add one in /admin/compute.") {
-		super(message);
-		this.name = "ComputeServerUnconfiguredError";
-	}
-};
-/**
-* Spec §3 — pick the right Rhino.Compute server for a (org, definition) pair.
-*
-* Resolution order, narrowest wins:
-*   1. `definitionPin` if it points at a server visible to `orgId`.
-*   2. `orgDefaults[orgId]` if set and visible.
-*   3. Global `defaultServerId`.
-*
-* The store returns the full config; the visibility predicate runs in the
-* pure helper so callers don't reimplement it. Re-throws the pure helper's
-* "nothing visible" failure as a typed `ComputeServerUnconfiguredError` so
-* callers can map it to a 503 with operator guidance.
-*
-* Selection reads a key-free config and fetches the `apiKey` only for the server
-* that actually wins (audit 4b) — resolving used to decrypt every configured
-* server's key on every solve to use exactly one of them.
-*/
-async function resolveServerForOrg(ctx, orgId, opts = {}) {
-	const store = getComputeServerConfigStore();
-	const config = await store.getConfig(ctx);
-	let server;
-	try {
-		server = resolveServerForOrg$1(config, orgId, { definitionPin: opts.definitionPin });
-	} catch (err) {
-		throw new ComputeServerUnconfiguredError(err instanceof Error ? err.message : void 0);
-	}
-	if (!server.hasApiKey) return server;
-	return {
-		...server,
-		apiKey: await store.getServerApiKey(ctx, server.id)
-	};
-}
-//#endregion
-//#region src/lib/server/api-errors.ts
-/** Stable, machine-readable error codes. Append-only — never renumber/rename. */
-var ApiErrorCode = {
-	VALIDATION_FAILED: "VALIDATION_FAILED",
-	UNAUTHORIZED: "UNAUTHORIZED",
-	FORBIDDEN: "FORBIDDEN",
-	NOT_FOUND: "NOT_FOUND",
-	CONFLICT: "CONFLICT",
-	UNPROCESSABLE: "UNPROCESSABLE",
-	COMPUTE_UNAVAILABLE: "COMPUTE_UNAVAILABLE",
-	SETUP_REQUIRED: "SETUP_REQUIRED",
-	INTERNAL: "INTERNAL"
-};
-/**
-* Raise a structured API error. Thin wrapper over SvelteKit's `error()` that
-* forces the `{ message, code }` envelope. Use this instead of
-* `error(status, 'message string')` so every error carries a code.
-*/
-function apiError(status, code, message, fields) {
-	throw error(status, fields ? {
-		message,
-		code,
-		fields
-	} : {
-		message,
-		code
-	});
-}
-/** Default code for a given HTTP status, used when mapping opaque errors. */
-function codeForStatus(status) {
-	switch (status) {
-		case 400: return ApiErrorCode.VALIDATION_FAILED;
-		case 401: return ApiErrorCode.UNAUTHORIZED;
-		case 403: return ApiErrorCode.FORBIDDEN;
-		case 404: return ApiErrorCode.NOT_FOUND;
-		case 409: return ApiErrorCode.CONFLICT;
-		case 422: return ApiErrorCode.UNPROCESSABLE;
-		case 503: return ApiErrorCode.COMPUTE_UNAVAILABLE;
-		default: return ApiErrorCode.INTERNAL;
-	}
-}
-var UNIQUE_CONSTRAINT_MESSAGES = {
-	projects_org_name_unique: "A project with that name already exists in this organization.",
-	projects_org_id_slug_key: "A project with that name already exists in this organization.",
-	orgs_slug_key: "An organization with that slug already exists.",
-	definitions_pkey: "A definition with that ID already exists."
-};
-function friendlyConstraintMessage(raw) {
-	for (const [name, msg] of Object.entries(UNIQUE_CONSTRAINT_MESSAGES)) if (raw.includes(name)) return msg;
-	return null;
-}
-/**
-* Normalize any error raised inside an API handler to a structured SvelteKit
-* HTTP error. Re-throws errors already raised via `apiError`/`error`, maps
-* ProviderError to its statusCode, and falls back to a 500 INTERNAL with the
-* provided message.
-*/
-function handleApiError(err, fallback) {
-	if (isHttpError(err)) throw err;
-	if (err instanceof SchemaExtractionError) {
-		if (err.kind === "unreachable") apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, err.message);
-		apiError(422, ApiErrorCode.UNPROCESSABLE, err.message);
-	}
-	if (err instanceof ComputeServerUnconfiguredError) apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, err.message);
-	if (err instanceof ProviderError) {
-		const friendly = friendlyConstraintMessage(err.message);
-		apiError(err.statusCode, codeForStatus(err.statusCode), friendly ?? err.message);
-	}
-	console.error(`[API] ${fallback}:`, err);
-	apiError(500, ApiErrorCode.INTERNAL, fallback);
-}
-/**
-* Throw a 400 VALIDATION_FAILED from a Zod error. The top-level `message` is
-* the first issue (human-friendly), and `fields` maps every issue's dotted
-* path to its message for machine consumption.
-*/
-function throwZodError(err) {
-	const fields = {};
-	for (const issue of err.issues) {
-		const key = issue.path.length ? issue.path.join(".") : "_";
-		if (!(key in fields)) fields[key] = issue.message;
-	}
-	const first = err.issues[0];
-	const path = first.path.length ? `${first.path.join(".")}: ` : "";
-	apiError(400, ApiErrorCode.VALIDATION_FAILED, `${path}${first.message}`, fields);
-}
-
-export { ApiErrorCode as A, ComputeServerUnconfiguredError as C, apiError as a, handleApiError as h, resolveServerForOrg as r, throwZodError as t };
-//# sourceMappingURL=api-errors.js-BXNSPeAn.js.map

package/build/server/chunks/chunks/api-errors.js-BXNSPeAn.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"api-errors.js-BXNSPeAn.js","sources":["../../../../.svelte-kit/output/server/chunks/api-errors.js"],"sourcesContent":["import \"./src.js\";\nimport { A as SchemaExtractionError, M as ProviderError, a as getComputeServerConfigStore } from \"./providers.server.js\";\nimport { i as resolveServerForOrg$1 } from \"./utils2.js\";\nimport { error, isHttpError } from \"@sveltejs/kit\";\n//#region src/lib/server/compute/resolve.server.ts\n/**\n* Thrown when no compute server is configured or visible for the org — a\n* misconfiguration an operator must fix in `/admin/compute`, not a bug. Routes\n* map this to 503 with operator guidance instead of letting the pure helper's\n* plain `Error` surface as a generic 500. `handleApiError` recognizes it; the\n* two compute routes that don't route through `handleApiError` map it inline.\n*/\nvar ComputeServerUnconfiguredError = class extends Error {\n\tconstructor(message = \"No compute server configured. Ask an admin to add one in /admin/compute.\") {\n\t\tsuper(message);\n\t\tthis.name = \"ComputeServerUnconfiguredError\";\n\t}\n};\n/**\n* Spec §3 — pick the right Rhino.Compute server for a (org, definition) pair.\n*\n* Resolution order, narrowest wins:\n*   1. `definitionPin` if it points at a server visible to `orgId`.\n*   2. `orgDefaults[orgId]` if set and visible.\n*   3. Global `defaultServerId`.\n*\n* The store returns the full config; the visibility predicate runs in the\n* pure helper so callers don't reimplement it. Re-throws the pure helper's\n* \"nothing visible\" failure as a typed `ComputeServerUnconfiguredError` so\n* callers can map it to a 503 with operator guidance.\n*\n* Selection reads a key-free config and fetches the `apiKey` only for the server\n* that actually wins (audit 4b) — resolving used to decrypt every configured\n* server's key on every solve to use exactly one of them.\n*/\nasync function resolveServerForOrg(ctx, orgId, opts = {}) {\n\tconst store = getComputeServerConfigStore();\n\tconst config = await store.getConfig(ctx);\n\tlet server;\n\ttry {\n\t\tserver = resolveServerForOrg$1(config, orgId, { definitionPin: opts.definitionPin });\n\t} catch (err) {\n\t\tthrow new ComputeServerUnconfiguredError(err instanceof Error ? err.message : void 0);\n\t}\n\tif (!server.hasApiKey) return server;\n\treturn {\n\t\t...server,\n\t\tapiKey: await store.getServerApiKey(ctx, server.id)\n\t};\n}\n//#endregion\n//#region src/lib/server/api-errors.ts\n/** Stable, machine-readable error codes. Append-only — never renumber/rename. */\nvar ApiErrorCode = {\n\tVALIDATION_FAILED: \"VALIDATION_FAILED\",\n\tUNAUTHORIZED: \"UNAUTHORIZED\",\n\tFORBIDDEN: \"FORBIDDEN\",\n\tNOT_FOUND: \"NOT_FOUND\",\n\tCONFLICT: \"CONFLICT\",\n\tUNPROCESSABLE: \"UNPROCESSABLE\",\n\tCOMPUTE_UNAVAILABLE: \"COMPUTE_UNAVAILABLE\",\n\tSETUP_REQUIRED: \"SETUP_REQUIRED\",\n\tINTERNAL: \"INTERNAL\"\n};\n/**\n* Raise a structured API error. Thin wrapper over SvelteKit's `error()` that\n* forces the `{ message, code }` envelope. Use this instead of\n* `error(status, 'message string')` so every error carries a code.\n*/\nfunction apiError(status, code, message, fields) {\n\tthrow error(status, fields ? {\n\t\tmessage,\n\t\tcode,\n\t\tfields\n\t} : {\n\t\tmessage,\n\t\tcode\n\t});\n}\n/** Default code for a given HTTP status, used when mapping opaque errors. */\nfunction codeForStatus(status) {\n\tswitch (status) {\n\t\tcase 400: return ApiErrorCode.VALIDATION_FAILED;\n\t\tcase 401: return ApiErrorCode.UNAUTHORIZED;\n\t\tcase 403: return ApiErrorCode.FORBIDDEN;\n\t\tcase 404: return ApiErrorCode.NOT_FOUND;\n\t\tcase 409: return ApiErrorCode.CONFLICT;\n\t\tcase 422: return ApiErrorCode.UNPROCESSABLE;\n\t\tcase 503: return ApiErrorCode.COMPUTE_UNAVAILABLE;\n\t\tdefault: return ApiErrorCode.INTERNAL;\n\t}\n}\nvar UNIQUE_CONSTRAINT_MESSAGES = {\n\tprojects_org_name_unique: \"A project with that name already exists in this organization.\",\n\tprojects_org_id_slug_key: \"A project with that name already exists in this organization.\",\n\torgs_slug_key: \"An organization with that slug already exists.\",\n\tdefinitions_pkey: \"A definition with that ID already exists.\"\n};\nfunction friendlyConstraintMessage(raw) {\n\tfor (const [name, msg] of Object.entries(UNIQUE_CONSTRAINT_MESSAGES)) if (raw.includes(name)) return msg;\n\treturn null;\n}\n/**\n* Normalize any error raised inside an API handler to a structured SvelteKit\n* HTTP error. Re-throws errors already raised via `apiError`/`error`, maps\n* ProviderError to its statusCode, and falls back to a 500 INTERNAL with the\n* provided message.\n*/\nfunction handleApiError(err, fallback) {\n\tif (isHttpError(err)) throw err;\n\tif (err instanceof SchemaExtractionError) {\n\t\tif (err.kind === \"unreachable\") apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, err.message);\n\t\tapiError(422, ApiErrorCode.UNPROCESSABLE, err.message);\n\t}\n\tif (err instanceof ComputeServerUnconfiguredError) apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, err.message);\n\tif (err instanceof ProviderError) {\n\t\tconst friendly = friendlyConstraintMessage(err.message);\n\t\tapiError(err.statusCode, codeForStatus(err.statusCode), friendly ?? err.message);\n\t}\n\tconsole.error(`[API] ${fallback}:`, err);\n\tapiError(500, ApiErrorCode.INTERNAL, fallback);\n}\n/**\n* Throw a 400 VALIDATION_FAILED from a Zod error. The top-level `message` is\n* the first issue (human-friendly), and `fields` maps every issue's dotted\n* path to its message for machine consumption.\n*/\nfunction throwZodError(err) {\n\tconst fields = {};\n\tfor (const issue of err.issues) {\n\t\tconst key = issue.path.length ? issue.path.join(\".\") : \"_\";\n\t\tif (!(key in fields)) fields[key] = issue.message;\n\t}\n\tconst first = err.issues[0];\n\tconst path = first.path.length ? `${first.path.join(\".\")}: ` : \"\";\n\tapiError(400, ApiErrorCode.VALIDATION_FAILED, `${path}${first.message}`, fields);\n}\n//#endregion\nexport { ComputeServerUnconfiguredError as a, throwZodError as i, apiError as n, resolveServerForOrg as o, handleApiError as r, ApiErrorCode as t };\n"],"names":[],"mappings":";;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,8BAA8B,GAAG,cAAc,KAAK,CAAC;AACzD,CAAC,WAAW,CAAC,OAAO,GAAG,0EAA0E,EAAE;AACnG,EAAE,KAAK,CAAC,OAAO,CAAC;AAChB,EAAE,IAAI,CAAC,IAAI,GAAG,gCAAgC;AAC9C,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE;AAC1D,CAAC,MAAM,KAAK,GAAG,2BAA2B,EAAE;AAC5C,CAAC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC;AAC1C,CAAC,IAAI,MAAM;AACX,CAAC,IAAI;AACL,EAAE,MAAM,GAAG,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;AACtF,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,MAAM,IAAI,8BAA8B,CAAC,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC;AACvF,CAAC;AACD,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,MAAM;AACrC,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,MAAM,EAAE,MAAM,KAAK,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE;AACpD,EAAE;AACF;AACA;AACA;AACA;AACG,IAAC,YAAY,GAAG;AACnB,CAAC,iBAAiB,EAAE,mBAAmB;AACvC,CAAC,YAAY,EAAE,cAAc;AAC7B,CAAC,SAAS,EAAE,WAAW;AACvB,CAAC,SAAS,EAAE,WAAW;AACvB,CAAC,QAAQ,EAAE,UAAU;AACrB,CAAC,aAAa,EAAE,eAAe;AAC/B,CAAC,mBAAmB,EAAE,qBAAqB;AAC3C,CAAC,cAAc,EAAE,gBAAgB;AACjC,CAAC,QAAQ,EAAE;AACX;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE;AACjD,CAAC,MAAM,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG;AAC9B,EAAE,OAAO;AACT,EAAE,IAAI;AACN,EAAE;AACF,EAAE,GAAG;AACL,EAAE,OAAO;AACT,EAAE;AACF,EAAE,CAAC;AACH;AACA;AACA,SAAS,aAAa,CAAC,MAAM,EAAE;AAC/B,CAAC,QAAQ,MAAM;AACf,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,iBAAiB;AACjD,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,YAAY;AAC5C,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,SAAS;AACzC,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,SAAS;AACzC,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,QAAQ;AACxC,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,aAAa;AAC7C,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,mBAAmB;AACnD,EAAE,SAAS,OAAO,YAAY,CAAC,QAAQ;AACvC;AACA;AACA,IAAI,0BAA0B,GAAG;AACjC,CAAC,wBAAwB,EAAE,+DAA+D;AAC1F,CAAC,wBAAwB,EAAE,+DAA+D;AAC1F,CAAC,aAAa,EAAE,gDAAgD;AAChE,CAAC,gBAAgB,EAAE;AACnB,CAAC;AACD,SAAS,yBAAyB,CAAC,GAAG,EAAE;AACxC,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG;AACzG,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,GAAG,EAAE,QAAQ,EAAE;AACvC,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG;AAChC,CAAC,IAAI,GAAG,YAAY,qBAAqB,EAAE;AAC3C,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,GAAG,CAAC,OAAO,CAAC;AAC9F,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC;AACxD,CAAC;AACD,CAAC,IAAI,GAAG,YAAY,8BAA8B,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,GAAG,CAAC,OAAO,CAAC;AAChH,CAAC,IAAI,GAAG,YAAY,aAAa,EAAE;AACnC,EAAE,MAAM,QAAQ,GAAG,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC;AACzD,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC;AAClF,CAAC;AACD,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;AACzC,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC;AAC/C;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,GAAG,EAAE;AAC5B,CAAC,MAAM,MAAM,GAAG,EAAE;AAClB,CAAC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE;AACjC,EAAE,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG;AAC5D,EAAE,IAAI,EAAE,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO;AACnD,CAAC;AACD,CAAC,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5B,CAAC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE;AAClE,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC;AACjF;;;;"}

package/build/server/chunks/chunks/auth-bootstrap.server.js-DRbumHNf.js

@@ -1,162 +0,0 @@
-import { b as private_env } from './shared-server.js-DA4m8f1m.js';
-import { S as SYSTEM_CONTEXT, A as ALL_PLATFORM_PERMISSIONS, s as slugify } from './src.js-C5mUn1eC.js';
-import { a as getAuthProvider, g as getLogger, b as getPermissionStore, c as getTenancy, d as getDataProvider, e as getOrganizationProvider, f as getProjectProvider } from './providers.server.js-DVrVQ227.js';
-import { randomUUID } from 'node:crypto';
-
-//#region src/lib/server/auth-bootstrap.server.ts
-/**
-* Shared post-verification flow used by every IdP-callback route (OAuth,
-* email link, future SAML, …). Order matters:
-*
-*   1. `data.ensureUser` — guarantee a user-data row exists for whatever ID
-*      the auth provider issued. Local-provider creates a JSON row;
-*      Supabase no-ops (its DB trigger has already fired).
-*   2. Bootstrap-admin grant — if no instance_admin exists yet AND the
-*      tenancy/env policy allows it, grant the signing-in user every
-*      platform permission so `/admin` becomes reachable.
-*   3. Single-tenant org seed — create the default Organization + Project
-*      owned by the new admin, mirroring what `/setup` does for password
-*      auth. Without this, org-scoped permissions (manage_projects,
-*      manage_definitions) silently drop on the floor because
-*      `actingOrgId` resolves to undefined.
-*
-* Returns nothing — failures throw. Cookie/redirect are the caller's job
-* since they vary by capability (OAuth has refresh tokens, magic-link does
-* sometimes, SAML doesn't).
-*/
-async function bootstrapUserSession(user) {
-	await getDataProvider().ensureUser(SYSTEM_CONTEXT, user.id);
-	const tenancy = getTenancy();
-	const perms = getPermissionStore();
-	const hasAdmin = await perms.hasInstanceAdmin(SYSTEM_CONTEXT);
-	let grantedAdminHere = false;
-	if (!hasAdmin) {
-		if (!shouldBootstrapAdmin(user, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, tenancy)) return;
-		await perms.set(SYSTEM_CONTEXT, user.id, [...ALL_PLATFORM_PERMISSIONS]);
-		grantedAdminHere = true;
-	}
-	if (tenancy !== "single") return;
-	if ((await getOrganizationProvider().listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items.length > 0) return;
-	if (!grantedAdminHere) {
-		if (!(await perms.getFor(SYSTEM_CONTEXT, user.id)).includes("instance_admin")) return;
-	}
-	await ensureSingleTenantDefaultOrg(user);
-}
-/**
-* Single-tenant deployments must have exactly one org for `actingOrgId` to
-* resolve. The `/setup` form creates it from user input; flows that skip
-* setup (header-auth, OAuth callback, future SAML) need the same seed or
-* org-scoped permissions can't be persisted.
-*
-* No-op outside single-tenant mode and once any org exists. Picks a slug
-* derived from the admin's email/displayName so the URL looks like the
-* deployment rather than a UUID; falls back to `default` for anonymous
-* UPN-only sign-ins.
-*/
-async function ensureSingleTenantDefaultOrg(user) {
-	if (getTenancy() !== "single") return;
-	const orgs = getOrganizationProvider();
-	if ((await orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items.length > 0) return;
-	const orgName = (typeof user.metadata?.displayName === "string" ? user.metadata.displayName : void 0)?.trim() || user.email?.split("@")[0]?.trim() || "Default";
-	const slug = slugify(orgName).length >= 3 ? slugify(orgName) : "default";
-	const now = (/* @__PURE__ */ new Date()).toISOString();
-	const org = {
-		id: randomUUID(),
-		name: orgName,
-		slug,
-		ownerId: user.id,
-		createdBy: user.id,
-		updatedBy: user.id,
-		createdAt: now,
-		updatedAt: now,
-		deletedAt: null
-	};
-	await orgs.createOrg(SYSTEM_CONTEXT, org);
-	const projects = getProjectProvider();
-	const project = {
-		id: randomUUID(),
-		orgId: org.id,
-		name: "Default",
-		slug: "default",
-		visibility: "public",
-		ownerId: user.id,
-		createdBy: user.id,
-		updatedBy: user.id,
-		autoJoinOnUpload: false,
-		createdAt: now,
-		updatedAt: now,
-		deletedAt: null
-	};
-	await projects.createProject(SYSTEM_CONTEXT, project);
-}
-/**
-* Decide whether the signing-in user qualifies for the first-admin grant
-* (Permissions.md §2). Pure — no I/O — so the policy is testable in
-* isolation.
-*
-* - `tenancy='single'` + no env var → first signer wins (fine for
-*   self-hosted fresh installs).
-* - `tenancy='single'` + env var set → only the named user qualifies.
-* - `tenancy='multi'` → env var REQUIRED; the named user must match the
-*   signer. Without it, the first random signup would become Selva staff.
-*
-* The env var also doubles as the break-glass recovery path
-* (Permissions.md §2) when admin is lost to backup restores or migration
-* drift.
-*/
-function shouldBootstrapAdmin(user, configuredEmail, mode) {
-	const expected = configuredEmail?.trim().toLowerCase();
-	if (mode === "multi" && !expected) return false;
-	if (!expected) return true;
-	const actual = user.email?.trim().toLowerCase();
-	return !!actual && actual === expected;
-}
-/**
-* Header-auth-specific variant of the bootstrap policy. Used by
-* `wireHeaderAuthBootstrap` to decide whether an unrecognized UPN arriving
-* through the proxy should be auto-allowlisted as the first admin.
-*
-* Same logic as `shouldBootstrapAdmin` but operates on the raw UPN/email
-* before any allowlist row exists. For Entra deployments UPN ≈ email; if
-* they differ, the proxy is expected to forward both and we prefer email
-* when present.
-*/
-function shouldBootstrapUpn(upn, email, configuredEmail, mode) {
-	const expected = configuredEmail?.trim().toLowerCase();
-	if (mode === "multi" && !expected) return false;
-	if (!expected) return true;
-	const candidate = (email ?? upn).trim().toLowerCase();
-	return !!candidate && candidate === expected;
-}
-/**
-* Wire a bootstrap-allowlist policy onto the auth provider if it supports
-* header-auth-style first-admin bootstrapping. Idempotent — safe to call on
-* every startup; the provider holds the policy until process exit.
-*
-* Header-auth deployments can't reach `/setup` (no password form, no OAuth
-* callback), so without this the first proxy-authenticated visitor is
-* silently rejected (UPN not in allowlist) and the operator has to
-* hand-write JSON files. With it, the first visit whose UPN/email matches
-* `BOOTSTRAP_INSTANCE_ADMIN_EMAIL` is auto-allowlisted, and the immediately
-* following `bootstrapUserSession` call grants instance_admin.
-*
-* The policy is gated by `hasInstanceAdmin` — once any admin exists, the
-* policy returns false and the strict allowlist-only behavior resumes.
-* Single-tenant deployments with no env var get the "first signer wins"
-* shape, matching the password/OAuth bootstrap policy.
-*/
-function wireHeaderAuthBootstrap() {
-	const auth = getAuthProvider();
-	if (!auth.proxyAuth) return;
-	if (typeof auth.setBootstrapAllowlistPolicy !== "function") {
-		if (private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL?.trim()) getLogger().warn("BOOTSTRAP_INSTANCE_ADMIN_EMAIL is set but the installed @selvajs/header-auth-provider does not expose setBootstrapAllowlistPolicy. Upgrade the provider, or hand-seed header-allowlist.json.", { component: "auth-bootstrap" });
-		return;
-	}
-	auth.setBootstrapAllowlistPolicy(async ({ upn, email }) => {
-		if (await getPermissionStore().hasInstanceAdmin(SYSTEM_CONTEXT)) return false;
-		return shouldBootstrapUpn(upn, email, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, getTenancy());
-	});
-}
-
-export { bootstrapUserSession as b, wireHeaderAuthBootstrap as w };
-//# sourceMappingURL=auth-bootstrap.server.js-DRbumHNf.js.map

package/build/server/chunks/chunks/auth-bootstrap.server.js-DRbumHNf.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-bootstrap.server.js-DRbumHNf.js","sources":["../../../../.svelte-kit/output/server/chunks/auth-bootstrap.server.js"],"sourcesContent":["import { t as private_env } from \"./shared-server.js\";\nimport { T as ALL_PLATFORM_PERMISSIONS, t as SYSTEM_CONTEXT, w as slugify } from \"./src.js\";\nimport { _ as getProjectProvider, b as getTenancy, f as getLogger, h as getPermissionStore, m as getOrganizationProvider, o as getDataProvider, r as getAuthProvider } from \"./providers.server.js\";\nimport { randomUUID } from \"node:crypto\";\n//#region src/lib/server/auth-bootstrap.server.ts\n/**\n* Shared post-verification flow used by every IdP-callback route (OAuth,\n* email link, future SAML, …). Order matters:\n*\n*   1. `data.ensureUser` — guarantee a user-data row exists for whatever ID\n*      the auth provider issued. Local-provider creates a JSON row;\n*      Supabase no-ops (its DB trigger has already fired).\n*   2. Bootstrap-admin grant — if no instance_admin exists yet AND the\n*      tenancy/env policy allows it, grant the signing-in user every\n*      platform permission so `/admin` becomes reachable.\n*   3. Single-tenant org seed — create the default Organization + Project\n*      owned by the new admin, mirroring what `/setup` does for password\n*      auth. Without this, org-scoped permissions (manage_projects,\n*      manage_definitions) silently drop on the floor because\n*      `actingOrgId` resolves to undefined.\n*\n* Returns nothing — failures throw. Cookie/redirect are the caller's job\n* since they vary by capability (OAuth has refresh tokens, magic-link does\n* sometimes, SAML doesn't).\n*/\nasync function bootstrapUserSession(user) {\n\tawait getDataProvider().ensureUser(SYSTEM_CONTEXT, user.id);\n\tconst tenancy = getTenancy();\n\tconst perms = getPermissionStore();\n\tconst hasAdmin = await perms.hasInstanceAdmin(SYSTEM_CONTEXT);\n\tlet grantedAdminHere = false;\n\tif (!hasAdmin) {\n\t\tif (!shouldBootstrapAdmin(user, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, tenancy)) return;\n\t\tawait perms.set(SYSTEM_CONTEXT, user.id, [...ALL_PLATFORM_PERMISSIONS]);\n\t\tgrantedAdminHere = true;\n\t}\n\tif (tenancy !== \"single\") return;\n\tif ((await getOrganizationProvider().listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items.length > 0) return;\n\tif (!grantedAdminHere) {\n\t\tif (!(await perms.getFor(SYSTEM_CONTEXT, user.id)).includes(\"instance_admin\")) return;\n\t}\n\tawait ensureSingleTenantDefaultOrg(user);\n}\n/**\n* Single-tenant deployments must have exactly one org for `actingOrgId` to\n* resolve. The `/setup` form creates it from user input; flows that skip\n* setup (header-auth, OAuth callback, future SAML) need the same seed or\n* org-scoped permissions can't be persisted.\n*\n* No-op outside single-tenant mode and once any org exists. Picks a slug\n* derived from the admin's email/displayName so the URL looks like the\n* deployment rather than a UUID; falls back to `default` for anonymous\n* UPN-only sign-ins.\n*/\nasync function ensureSingleTenantDefaultOrg(user) {\n\tif (getTenancy() !== \"single\") return;\n\tconst orgs = getOrganizationProvider();\n\tif ((await orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items.length > 0) return;\n\tconst orgName = (typeof user.metadata?.displayName === \"string\" ? user.metadata.displayName : void 0)?.trim() || user.email?.split(\"@\")[0]?.trim() || \"Default\";\n\tconst slug = slugify(orgName).length >= 3 ? slugify(orgName) : \"default\";\n\tconst now = (/* @__PURE__ */ new Date()).toISOString();\n\tconst org = {\n\t\tid: randomUUID(),\n\t\tname: orgName,\n\t\tslug,\n\t\townerId: user.id,\n\t\tcreatedBy: user.id,\n\t\tupdatedBy: user.id,\n\t\tcreatedAt: now,\n\t\tupdatedAt: now,\n\t\tdeletedAt: null\n\t};\n\tawait orgs.createOrg(SYSTEM_CONTEXT, org);\n\tconst projects = getProjectProvider();\n\tconst project = {\n\t\tid: randomUUID(),\n\t\torgId: org.id,\n\t\tname: \"Default\",\n\t\tslug: \"default\",\n\t\tvisibility: \"public\",\n\t\townerId: user.id,\n\t\tcreatedBy: user.id,\n\t\tupdatedBy: user.id,\n\t\tautoJoinOnUpload: false,\n\t\tcreatedAt: now,\n\t\tupdatedAt: now,\n\t\tdeletedAt: null\n\t};\n\tawait projects.createProject(SYSTEM_CONTEXT, project);\n}\n/**\n* Decide whether the signing-in user qualifies for the first-admin grant\n* (Permissions.md §2). Pure — no I/O — so the policy is testable in\n* isolation.\n*\n* - `tenancy='single'` + no env var → first signer wins (fine for\n*   self-hosted fresh installs).\n* - `tenancy='single'` + env var set → only the named user qualifies.\n* - `tenancy='multi'` → env var REQUIRED; the named user must match the\n*   signer. Without it, the first random signup would become Selva staff.\n*\n* The env var also doubles as the break-glass recovery path\n* (Permissions.md §2) when admin is lost to backup restores or migration\n* drift.\n*/\nfunction shouldBootstrapAdmin(user, configuredEmail, mode) {\n\tconst expected = configuredEmail?.trim().toLowerCase();\n\tif (mode === \"multi\" && !expected) return false;\n\tif (!expected) return true;\n\tconst actual = user.email?.trim().toLowerCase();\n\treturn !!actual && actual === expected;\n}\n/**\n* Header-auth-specific variant of the bootstrap policy. Used by\n* `wireHeaderAuthBootstrap` to decide whether an unrecognized UPN arriving\n* through the proxy should be auto-allowlisted as the first admin.\n*\n* Same logic as `shouldBootstrapAdmin` but operates on the raw UPN/email\n* before any allowlist row exists. For Entra deployments UPN ≈ email; if\n* they differ, the proxy is expected to forward both and we prefer email\n* when present.\n*/\nfunction shouldBootstrapUpn(upn, email, configuredEmail, mode) {\n\tconst expected = configuredEmail?.trim().toLowerCase();\n\tif (mode === \"multi\" && !expected) return false;\n\tif (!expected) return true;\n\tconst candidate = (email ?? upn).trim().toLowerCase();\n\treturn !!candidate && candidate === expected;\n}\n/**\n* Wire a bootstrap-allowlist policy onto the auth provider if it supports\n* header-auth-style first-admin bootstrapping. Idempotent — safe to call on\n* every startup; the provider holds the policy until process exit.\n*\n* Header-auth deployments can't reach `/setup` (no password form, no OAuth\n* callback), so without this the first proxy-authenticated visitor is\n* silently rejected (UPN not in allowlist) and the operator has to\n* hand-write JSON files. With it, the first visit whose UPN/email matches\n* `BOOTSTRAP_INSTANCE_ADMIN_EMAIL` is auto-allowlisted, and the immediately\n* following `bootstrapUserSession` call grants instance_admin.\n*\n* The policy is gated by `hasInstanceAdmin` — once any admin exists, the\n* policy returns false and the strict allowlist-only behavior resumes.\n* Single-tenant deployments with no env var get the \"first signer wins\"\n* shape, matching the password/OAuth bootstrap policy.\n*/\nfunction wireHeaderAuthBootstrap() {\n\tconst auth = getAuthProvider();\n\tif (!auth.proxyAuth) return;\n\tif (typeof auth.setBootstrapAllowlistPolicy !== \"function\") {\n\t\tif (private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL?.trim()) getLogger().warn(\"BOOTSTRAP_INSTANCE_ADMIN_EMAIL is set but the installed @selvajs/header-auth-provider does not expose setBootstrapAllowlistPolicy. Upgrade the provider, or hand-seed header-allowlist.json.\", { component: \"auth-bootstrap\" });\n\t\treturn;\n\t}\n\tauth.setBootstrapAllowlistPolicy(async ({ upn, email }) => {\n\t\tif (await getPermissionStore().hasInstanceAdmin(SYSTEM_CONTEXT)) return false;\n\t\treturn shouldBootstrapUpn(upn, email, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, getTenancy());\n\t});\n}\n//#endregion\nexport { wireHeaderAuthBootstrap as n, bootstrapUserSession as t };\n"],"names":[],"mappings":";;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,oBAAoB,CAAC,IAAI,EAAE;AAC1C,CAAC,MAAM,eAAe,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAC5D,CAAC,MAAM,OAAO,GAAG,UAAU,EAAE;AAC7B,CAAC,MAAM,KAAK,GAAG,kBAAkB,EAAE;AACnC,CAAC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,cAAc,CAAC;AAC9D,CAAC,IAAI,gBAAgB,GAAG,KAAK;AAC7B,CAAC,IAAI,CAAC,QAAQ,EAAE;AAChB,EAAE,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,WAAW,CAAC,8BAA8B,EAAE,OAAO,CAAC,EAAE;AACxF,EAAE,MAAM,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,wBAAwB,CAAC,CAAC;AACzE,EAAE,gBAAgB,GAAG,IAAI;AACzB,CAAC;AACD,CAAC,IAAI,OAAO,KAAK,QAAQ,EAAE;AAC3B,CAAC,IAAI,CAAC,MAAM,uBAAuB,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;AAChG,CAAC,IAAI,CAAC,gBAAgB,EAAE;AACxB,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE;AACjF,CAAC;AACD,CAAC,MAAM,4BAA4B,CAAC,IAAI,CAAC;AACzC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,4BAA4B,CAAC,IAAI,EAAE;AAClD,CAAC,IAAI,UAAU,EAAE,KAAK,QAAQ,EAAE;AAChC,CAAC,MAAM,IAAI,GAAG,uBAAuB,EAAE;AACvC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;AAC3E,CAAC,MAAM,OAAO,GAAG,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,WAAW,KAAK,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,GAAG,MAAM,GAAG,IAAI,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS;AAChK,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS;AACzE,CAAC,MAAM,GAAG,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACvD,CAAC,MAAM,GAAG,GAAG;AACb,EAAE,EAAE,EAAE,UAAU,EAAE;AAClB,EAAE,IAAI,EAAE,OAAO;AACf,EAAE,IAAI;AACN,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;AAClB,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;AACpB,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;AACpB,EAAE,SAAS,EAAE,GAAG;AAChB,EAAE,SAAS,EAAE,GAAG;AAChB,EAAE,SAAS,EAAE;AACb,EAAE;AACF,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,CAAC;AAC1C,CAAC,MAAM,QAAQ,GAAG,kBAAkB,EAAE;AACtC,CAAC,MAAM,OAAO,GAAG;AACjB,EAAE,EAAE,EAAE,UAAU,EAAE;AAClB,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE;AACf,EAAE,IAAI,EAAE,SAAS;AACjB,EAAE,IAAI,EAAE,SAAS;AACjB,EAAE,UAAU,EAAE,QAAQ;AACtB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;AAClB,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;AACpB,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;AACpB,EAAE,gBAAgB,EAAE,KAAK;AACzB,EAAE,SAAS,EAAE,GAAG;AAChB,EAAE,SAAS,EAAE,GAAG;AAChB,EAAE,SAAS,EAAE;AACb,EAAE;AACF,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,cAAc,EAAE,OAAO,CAAC;AACtD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,oBAAoB,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE;AAC3D,CAAC,MAAM,QAAQ,GAAG,eAAe,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACvD,CAAC,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,KAAK;AAChD,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI;AAC3B,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AAChD,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,MAAM,KAAK,QAAQ;AACvC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE;AAC/D,CAAC,MAAM,QAAQ,GAAG,eAAe,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACvD,CAAC,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,KAAK;AAChD,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI;AAC3B,CAAC,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACtD,CAAC,OAAO,CAAC,CAAC,SAAS,IAAI,SAAS,KAAK,QAAQ;AAC7C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,uBAAuB,GAAG;AACnC,CAAC,MAAM,IAAI,GAAG,eAAe,EAAE;AAC/B,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;AACtB,CAAC,IAAI,OAAO,IAAI,CAAC,2BAA2B,KAAK,UAAU,EAAE;AAC7D,EAAE,IAAI,WAAW,CAAC,8BAA8B,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,8LAA8L,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC;AAC3S,EAAE;AACF,CAAC;AACD,CAAC,IAAI,CAAC,2BAA2B,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK;AAC5D,EAAE,IAAI,MAAM,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,OAAO,KAAK;AAC/E,EAAE,OAAO,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,CAAC,8BAA8B,EAAE,UAAU,EAAE,CAAC;AACjG,CAAC,CAAC,CAAC;AACH;;;;"}

package/build/server/chunks/chunks/auth.server.js-D2zzXC2B.js

@@ -1,2 +0,0 @@
-import './providers.server.js-DVrVQ227.js';
-//# sourceMappingURL=auth.server.js-D2zzXC2B.js.map

package/build/server/chunks/chunks/auth.server.js-D2zzXC2B.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.server.js-D2zzXC2B.js","sources":[],"sourcesContent":[],"names":[],"mappings":""}