@selvajs/selva 4.7.0-beta.6 → 4.7.0

package/build/server/chunks/_server.ts-r2Qgi-oV.js

@@ -1,91 +0,0 @@
-import { j as classifyAssetPath, d as GuidSchema, f as COVER_IMAGE_CONTENT_TYPES } from './src-tWHhLCSB.js';
-import { g as getDefinitionMeta, x as definitionPaths, t as getStorageProvider } from './providers.server-C1zmtRr7.js';
-import { i as requireCanViewProject, j as requireCanViewOrg } from './access.server-BWOmKi8Z.js';
-import { a as apiError, A as ApiErrorCode } from './api-errors-BQbl4HI1.js';
-import 'zod';
-import './index.js-NH2Q8xBT.js';
-import 'clsx';
-import '@sveltejs/kit/internal';
-import '@sveltejs/kit';
-import '@sveltejs/kit/internal/server';
-import './limits-D8LKRL6A.js';
-import './chunk-Y3M7P3BW-CpcVbL4P.js';
-import 'node:crypto';
-import 'node:url';
-import 'node:path';
-import 'node:fs';
-import 'node:fs/promises';
-import '@supabase/supabase-js';
-import './utils2-D6nbl_7H.js';
-
-//#region src/routes/api/files/[...path]/+server.ts
-/**
-* Authenticated/­public blob proxy. The set of servable paths is the closed
-* asset-class registry (`classifyAssetPath` / `ASSET_CLASSES` in
-* `@selvajs/platform`). Each class declares a visibility; this route maps that
-* visibility to an authorization check:
-*
-*   - `public`  (org branding — logo/favicon): served to anyone, incl.
-*     logged-out visitors, with no auth. Cacheable. The bytes are always a
-*     rasterized WebP, so there is no XSS surface to gate.
-*   - `org`     (org-private blobs, e.g. pricing sheets under
-*     `orgs/{id}/private/*`): `requireCanViewOrg(orgId)`.
-*   - `project` (definition covers): `requireCanViewProject(projectId)` — the
-*     M5 hardening, unchanged.
-*
-* Anything that classifies to no asset class 404s. New blob types are opt-in:
-* add a registry entry with the right visibility — never a generic
-* "is the extension allowed" fallthrough. Authorization lives here (the route),
-* not in the storage layer, per `IStorageProvider`'s contract.
-*
-* Why a single proxy for all three: with the registry, the route is no longer a
-* pile of per-shape branches — it classifies once and dispatches on visibility,
-* so the cover-only contract that this route used to pin now generalizes
-* without re-opening the M5 hole.
-*/
-var CONTENT_TYPE_BY_EXT = {
-	...COVER_IMAGE_CONTENT_TYPES,
-	".pdf": "application/pdf"
-};
-function contentTypeFor(storagePath) {
-	const dot = storagePath.lastIndexOf(".");
-	return CONTENT_TYPE_BY_EXT[dot === -1 ? "" : storagePath.slice(dot).toLowerCase()] ?? "application/octet-stream";
-}
-var GET = async ({ params, locals }) => {
-	const storagePath = params.path;
-	if (!storagePath) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Missing path");
-	const match = classifyAssetPath(storagePath);
-	if (!match) apiError(404, ApiErrorCode.NOT_FOUND, "File not found");
-	let canonicalPath = storagePath;
-	switch (match.class.visibility) {
-		case "public": break;
-		case "org": {
-			if (!locals.ctx) apiError(401, ApiErrorCode.UNAUTHORIZED, "Unauthorized");
-			const orgId = match.scopeId;
-			if (!orgId) apiError(404, ApiErrorCode.NOT_FOUND, "File not found");
-			await requireCanViewOrg(locals, orgId);
-			break;
-		}
-		case "project": {
-			if (!locals.ctx) apiError(401, ApiErrorCode.UNAUTHORIZED, "Unauthorized");
-			const guid = match.scopeId;
-			const guidParsed = GuidSchema.safeParse(guid);
-			if (!guidParsed.success) apiError(404, ApiErrorCode.NOT_FOUND, "File not found");
-			const record = await getDefinitionMeta().get(locals.ctx, guidParsed.data);
-			if (!record) apiError(404, ApiErrorCode.NOT_FOUND, "File not found");
-			await requireCanViewProject(locals, record.projectId);
-			canonicalPath = definitionPaths.image(guidParsed.data);
-			break;
-		}
-	}
-	const bytes = await getStorageProvider().get(canonicalPath);
-	if (!bytes) apiError(404, ApiErrorCode.NOT_FOUND, "File not found");
-	const cacheControl = match.class.visibility === "public" ? "public, max-age=3600" : "private, max-age=3600";
-	return new Response(Buffer.from(bytes), { headers: {
-		"Content-Type": contentTypeFor(canonicalPath),
-		"Cache-Control": cacheControl
-	} });
-};
-
-export { GET };
-//# sourceMappingURL=_server.ts-r2Qgi-oV.js.map

package/build/server/chunks/_server.ts-r2Qgi-oV.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"_server.ts-r2Qgi-oV.js","sources":["../../../.svelte-kit/output/server/entries/endpoints/api/files/_...path_/_server.ts.js"],"sourcesContent":["import { r as classifyAssetPath, s as GuidSchema, u as COVER_IMAGE_CONTENT_TYPES } from \"../../../../../chunks/src.js\";\nimport { I as definitionPaths, s as getDefinitionMeta, y as getStorageProvider } from \"../../../../../chunks/providers.server.js\";\nimport { h as requireCanViewProject, m as requireCanViewOrg } from \"../../../../../chunks/access.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\n//#region src/routes/api/files/[...path]/+server.ts\n/**\n* Authenticated/­public blob proxy. The set of servable paths is the closed\n* asset-class registry (`classifyAssetPath` / `ASSET_CLASSES` in\n* `@selvajs/platform`). Each class declares a visibility; this route maps that\n* visibility to an authorization check:\n*\n*   - `public`  (org branding — logo/favicon): served to anyone, incl.\n*     logged-out visitors, with no auth. Cacheable. The bytes are always a\n*     rasterized WebP, so there is no XSS surface to gate.\n*   - `org`     (org-private blobs, e.g. pricing sheets under\n*     `orgs/{id}/private/*`): `requireCanViewOrg(orgId)`.\n*   - `project` (definition covers): `requireCanViewProject(projectId)` — the\n*     M5 hardening, unchanged.\n*\n* Anything that classifies to no asset class 404s. New blob types are opt-in:\n* add a registry entry with the right visibility — never a generic\n* \"is the extension allowed\" fallthrough. Authorization lives here (the route),\n* not in the storage layer, per `IStorageProvider`'s contract.\n*\n* Why a single proxy for all three: with the registry, the route is no longer a\n* pile of per-shape branches — it classifies once and dispatches on visibility,\n* so the cover-only contract that this route used to pin now generalizes\n* without re-opening the M5 hole.\n*/\nvar CONTENT_TYPE_BY_EXT = {\n\t...COVER_IMAGE_CONTENT_TYPES,\n\t\".pdf\": \"application/pdf\"\n};\nfunction contentTypeFor(storagePath) {\n\tconst dot = storagePath.lastIndexOf(\".\");\n\treturn CONTENT_TYPE_BY_EXT[dot === -1 ? \"\" : storagePath.slice(dot).toLowerCase()] ?? \"application/octet-stream\";\n}\nvar GET = async ({ params, locals }) => {\n\tconst storagePath = params.path;\n\tif (!storagePath) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing path\");\n\tconst match = classifyAssetPath(storagePath);\n\tif (!match) apiError(404, ApiErrorCode.NOT_FOUND, \"File not found\");\n\tlet canonicalPath = storagePath;\n\tswitch (match.class.visibility) {\n\t\tcase \"public\": break;\n\t\tcase \"org\": {\n\t\t\tif (!locals.ctx) apiError(401, ApiErrorCode.UNAUTHORIZED, \"Unauthorized\");\n\t\t\tconst orgId = match.scopeId;\n\t\t\tif (!orgId) apiError(404, ApiErrorCode.NOT_FOUND, \"File not found\");\n\t\t\tawait requireCanViewOrg(locals, orgId);\n\t\t\tbreak;\n\t\t}\n\t\tcase \"project\": {\n\t\t\tif (!locals.ctx) apiError(401, ApiErrorCode.UNAUTHORIZED, \"Unauthorized\");\n\t\t\tconst guid = match.scopeId;\n\t\t\tconst guidParsed = GuidSchema.safeParse(guid);\n\t\t\tif (!guidParsed.success) apiError(404, ApiErrorCode.NOT_FOUND, \"File not found\");\n\t\t\tconst record = await getDefinitionMeta().get(locals.ctx, guidParsed.data);\n\t\t\tif (!record) apiError(404, ApiErrorCode.NOT_FOUND, \"File not found\");\n\t\t\tawait requireCanViewProject(locals, record.projectId);\n\t\t\tcanonicalPath = definitionPaths.image(guidParsed.data);\n\t\t\tbreak;\n\t\t}\n\t}\n\tconst bytes = await getStorageProvider().get(canonicalPath);\n\tif (!bytes) apiError(404, ApiErrorCode.NOT_FOUND, \"File not found\");\n\tconst cacheControl = match.class.visibility === \"public\" ? \"public, max-age=3600\" : \"private, max-age=3600\";\n\treturn new Response(Buffer.from(bytes), { headers: {\n\t\t\"Content-Type\": contentTypeFor(canonicalPath),\n\t\t\"Cache-Control\": cacheControl\n\t} });\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,mBAAmB,GAAG;AAC1B,CAAC,GAAG,yBAAyB;AAC7B,CAAC,MAAM,EAAE;AACT,CAAC;AACD,SAAS,cAAc,CAAC,WAAW,EAAE;AACrC,CAAC,MAAM,GAAG,GAAG,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC;AACzC,CAAC,OAAO,mBAAmB,CAAC,GAAG,KAAK,EAAE,GAAG,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,0BAA0B;AACjH;AACG,IAAC,GAAG,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AACxC,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI;AAChC,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,cAAc,CAAC;AAChF,CAAC,MAAM,KAAK,GAAG,iBAAiB,CAAC,WAAW,CAAC;AAC7C,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gBAAgB,CAAC;AACpE,CAAC,IAAI,aAAa,GAAG,WAAW;AAChC,CAAC,QAAQ,KAAK,CAAC,KAAK,CAAC,UAAU;AAC/B,EAAE,KAAK,QAAQ,EAAE;AACjB,EAAE,KAAK,KAAK,EAAE;AACd,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC;AAC5E,GAAG,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO;AAC9B,GAAG,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gBAAgB,CAAC;AACtE,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC;AACzC,GAAG;AACH,EAAE;AACF,EAAE,KAAK,SAAS,EAAE;AAClB,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC;AAC5E,GAAG,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO;AAC7B,GAAG,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC;AAChD,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gBAAgB,CAAC;AACnF,GAAG,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC;AAC5E,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gBAAgB,CAAC;AACvE,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC;AACxD,GAAG,aAAa,GAAG,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;AACzD,GAAG;AACH,EAAE;AACF;AACA,CAAC,MAAM,KAAK,GAAG,MAAM,kBAAkB,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC;AAC5D,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gBAAgB,CAAC;AACpE,CAAC,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,KAAK,QAAQ,GAAG,sBAAsB,GAAG,uBAAuB;AAC5G,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE;AACpD,EAAE,cAAc,EAAE,cAAc,CAAC,aAAa,CAAC;AAC/C,EAAE,eAAe,EAAE;AACnB,EAAE,EAAE,CAAC;AACL;;;;"}

package/build/server/chunks/access.server-BWOmKi8Z.js

@@ -1,453 +0,0 @@
-import { h as hasPermission, A as ALL_PLATFORM_PERMISSIONS } from './src-tWHhLCSB.js';
-import { g as getDefinitionMeta, a as getProjectProvider, b as getOrganizationProvider, f as flag, c as getPlatformProjectGrantStore } from './providers.server-C1zmtRr7.js';
-import { error, redirect } from '@sveltejs/kit';
-
-//#region ../platform/src/access/rules.ts
-/**
-* Pure access-control rules — single source of truth for UI gating across
-* adapters. Mutating store methods MUST re-enforce the same predicate
-* independently (RLS in SQL, code in local/JSON).
-*
-* `instance_admin` bypass is NOT baked into rule bodies — wrap calls with
-* `withAdminBypass` at the call site.
-*/
-function isInstanceAdmin(platformPermissions) {
-	return platformPermissions.includes("instance_admin");
-}
-function withAdminBypass(platformPermissions, rule) {
-	if (isInstanceAdmin(platformPermissions)) return true;
-	return rule();
-}
-/**
-* Authenticated-user view rule. Anonymous access is delivered via share-link
-* tokens — the route resolves a valid token before this rule runs.
-*
-* For `platform` projects: `instance_admin` always passes; otherwise any
-* grant (view-only or canSolve) satisfies view access.
-*/
-function canView(input) {
-	const { project, member, orgMember, allowCrossOrgPublic, enablePlatformProjects, platformPermissions, platformGrants, actingOrgId, userId } = input;
-	if (!project) return false;
-	if (project.visibility === "platform") {
-		if (!enablePlatformProjects) return false;
-		if (isInstanceAdmin(platformPermissions)) return true;
-		return platformGrants.some((g) => g.granteeType === "user" && g.granteeId === userId || g.granteeType === "org" && g.granteeId === actingOrgId);
-	}
-	if (project.visibility === "private") return member !== null;
-	if (project.visibility === "org") return orgMember !== null;
-	if (project.visibility === "public") return allowCrossOrgPublic ? true : orgMember !== null;
-	return false;
-}
-/**
-* For non-platform projects: same as `canView` today — kept distinct for
-* future cost gating.
-*
-* For `platform` projects: `instance_admin` always passes; a view-only grant
-* satisfies `canView` but NOT `canSolve` — the grant must have `canSolve=true`.
-*/
-function canSolve(input) {
-	const { project, enablePlatformProjects, platformPermissions, platformGrants, actingOrgId, userId } = input;
-	if (!project) return false;
-	if (project.visibility === "platform") {
-		if (!enablePlatformProjects) return false;
-		if (isInstanceAdmin(platformPermissions)) return true;
-		return platformGrants.some((g) => g.canSolve && (g.granteeType === "user" && g.granteeId === userId || g.granteeType === "org" && g.granteeId === actingOrgId));
-	}
-	return canView(input);
-}
-/**
-* Platform projects: `instance_admin` only (they have no member rows).
-* All other visibilities: project owner/editor.
-*/
-function canEdit(input) {
-	const { member, project, enablePlatformProjects, platformPermissions } = input;
-	if (project?.visibility === "platform") {
-		if (!enablePlatformProjects) return false;
-		return isInstanceAdmin(platformPermissions);
-	}
-	return member?.role === "owner" || member?.role === "editor";
-}
-/** Platform projects: `instance_admin` only. All other visibilities: project owner. */
-function canManage(input) {
-	if (input.project?.visibility === "platform") {
-		if (!input.enablePlatformProjects) return false;
-		return isInstanceAdmin(input.platformPermissions);
-	}
-	return input.member?.role === "owner";
-}
-/** Platform projects: `instance_admin` only. All other visibilities: project owner. */
-function canEditProjectSettings(input) {
-	if (input.project?.visibility === "platform") {
-		if (!input.enablePlatformProjects) return false;
-		return isInstanceAdmin(input.platformPermissions);
-	}
-	return input.member?.role === "owner";
-}
-/**
-* Authorization to flip a project to `public`. The `ALLOW_CROSS_ORG_PUBLIC`
-* flag only changes what `public` means post-flip; the flip itself is gated
-* by org owner/admin role.
-*/
-function canChangeVisibilityToPublic(input) {
-	const role = input.orgMember?.role;
-	return role === "owner" || role === "admin";
-}
-/**
-* For platform projects: `instance_admin` only.
-* For all other projects: project editor/owner can always edit (moderation).
-* On commons projects (`autoJoinOnUpload=true`) the definition owner can edit their own.
-*/
-function canEditDefinition(input) {
-	const { project, definition, member, userId, platformPermissions, enablePlatformProjects } = input;
-	if (!project || !definition) return false;
-	if (project.visibility === "platform") {
-		if (!enablePlatformProjects) return false;
-		return isInstanceAdmin(platformPermissions);
-	}
-	if (member?.role === "owner" || member?.role === "editor") return true;
-	if (project.autoJoinOnUpload && userId === definition.ownerId) return true;
-	return false;
-}
-/**
-* Org leadership escape hatch. Reclaim adds the actor as co-owner; it does
-* NOT demote the existing owner. Tenancy must match.
-*
-* Platform projects cannot be reclaimed — `instance_admin` always has
-* management access to them without needing the Reclaim mechanism.
-*/
-function canReclaim(input) {
-	const { project, orgMember, actingOrgId } = input;
-	if (!project || !actingOrgId) return false;
-	if (project.visibility === "platform") return false;
-	if (actingOrgId !== project.orgId) return false;
-	const role = orgMember?.role;
-	return role === "owner" || role === "admin";
-}
-/**
-* Owner/admin can always create. A `member` needs `manage_projects` org
-* permission. Tenancy is enforced.
-*
-* Platform projects (`visibility='platform'`) are created via the admin API
-* and gated on `instance_admin` — this rule is not consulted for them.
-*/
-function canCreateProject(input) {
-	const { orgMember, orgPermissions, actingOrgId, targetOrgId } = input;
-	if (actingOrgId !== targetOrgId) return false;
-	const role = orgMember?.role;
-	if (role === "owner" || role === "admin") return true;
-	if (role === "member" && orgPermissions.includes("manage_projects")) return true;
-	return false;
-}
-function checkOwnerRemoval(input) {
-	if (input.target.role !== "owner") return "ok";
-	if (input.allMembers.filter((m) => m.role === "owner").length <= 1) return "sole_owner";
-	if (!input.confirmed) return "needs_confirm";
-	return "ok";
-}
-//#endregion
-//#region ../server/src/access/project-access-input.ts
-function createProjectAccessInputBuilder(deps) {
-	return {
-		async buildProjectAccessInput(ctx, project, overrides = {}) {
-			const { allowCrossOrgPublic, enablePlatformProjects } = deps.flags();
-			let member = null;
-			let orgMember = null;
-			let platformGrants = [];
-			if (project.visibility === "platform") {
-				if (enablePlatformProjects) platformGrants = await deps.listPlatformGrants(ctx, project.id);
-			} else if (project.visibility === "private") member = await deps.getProjectMember(ctx, project.id, ctx.userId);
-			else {
-				const skipOrgMember = project.visibility === "public" && allowCrossOrgPublic;
-				[member, orgMember] = await Promise.all([deps.getProjectMember(ctx, project.id, ctx.userId), skipOrgMember ? Promise.resolve(null) : deps.getOrgMember(ctx, project.orgId, ctx.userId)]);
-			}
-			return {
-				orgPermissions: ctx.orgPermissions,
-				platformPermissions: ctx.platformPermissions,
-				project,
-				member,
-				orgMember,
-				allowCrossOrgPublic,
-				enablePlatformProjects,
-				platformGrants,
-				actingOrgId: ctx.actingOrgId ?? null,
-				userId: ctx.userId,
-				...overrides
-			};
-		},
-		projectAccessInputFromRows(ctx, project, rows) {
-			const { allowCrossOrgPublic, enablePlatformProjects } = deps.flags();
-			return {
-				orgPermissions: ctx.orgPermissions,
-				platformPermissions: ctx.platformPermissions,
-				project,
-				member: rows.member ?? null,
-				orgMember: rows.orgMember ?? null,
-				allowCrossOrgPublic,
-				enablePlatformProjects,
-				platformGrants: rows.platformGrants ?? [],
-				actingOrgId: ctx.actingOrgId ?? null,
-				userId: ctx.userId
-			};
-		}
-	};
-}
-//#endregion
-//#region src/lib/server/access.server.ts
-function requireAuthed(locals) {
-	const { user, ctx } = locals;
-	if (!user || !ctx) throw error(401, "Unauthorized");
-	return {
-		user,
-		ctx
-	};
-}
-/** Throws 403 — use in API routes. */
-function requirePermission(locals, permission) {
-	const { user, ctx } = requireAuthed(locals);
-	if (!hasPermission(ctx, permission)) throw error(403, `You don't have permission to do this.`);
-	return user;
-}
-/** Redirects to /admin — use in page load functions. */
-function assertPagePermission(locals, permission) {
-	const { user, ctx } = requireAuthed(locals);
-	if (!hasPermission(ctx, permission)) redirect(303, "/admin");
-	return user;
-}
-var requireManageInstanceUsers = (locals) => requirePermission(locals, "manage_instance_users");
-var requireManageCompute = (locals) => requirePermission(locals, "manage_compute");
-var requireManageOrgMembers = (locals) => requirePermission(locals, "manage_org_members");
-var requireManageOrgCompute = (locals) => requirePermission(locals, "manage_org_compute");
-var assertManageInstanceUsers = (locals) => assertPagePermission(locals, "manage_instance_users");
-var assertManageCompute = (locals) => assertPagePermission(locals, "manage_compute");
-var requireInstanceAdmin = (locals) => requirePermission(locals, "instance_admin");
-/** Redirects to /library — use in page load functions on platform-scoped routes. */
-function assertAnyPlatformPermission(locals) {
-	const { user, ctx } = requireAuthed(locals);
-	if (!ALL_PLATFORM_PERMISSIONS.some((p) => hasPermission(ctx, p))) redirect(303, "/library");
-	return user;
-}
-/**
-* Management-scope bypass — used for org governance and project management
-* actions (Reclaim, create project, delete project, manage members, edit
-* settings). `instance_admin` bypasses these so platform staff can administer
-* the instance without being a member of every org.
-*
-* NOT used for content access (view, solve, edit definitions). See §2 of
-* Permissions.md: `instance_admin` follows the same `canView`/`canEdit` rules
-* as any other user for content — keeping blast radius small and ensuring
-* any content escalation goes through Reclaim, leaving an audit trail.
-*/
-async function managementBypassOrRun(ctx, check) {
-	if (hasPermission(ctx, "instance_admin")) return true;
-	return await check();
-}
-/**
-* Content-scope check — NO `instance_admin` bypass. `canView`, `canSolve`,
-* `canEdit`, and `canEditDefinition` run as-is regardless of platform role.
-* If platform staff need to access content, they use Reclaim first.
-*/
-async function contentCheck(check) {
-	return await check();
-}
-async function loadProjectOr404(ctx, projectId) {
-	const project = await getProjectProvider().getProject(ctx, projectId);
-	if (!project) throw error(404, "Project not found");
-	return project;
-}
-var accessInputs = createProjectAccessInputBuilder({
-	getProjectMember: (ctx, projectId, userId) => getProjectProvider().getProjectMember(ctx, projectId, userId),
-	getOrgMember: (ctx, orgId, userId) => getOrganizationProvider().getOrgMember(ctx, orgId, userId),
-	listPlatformGrants: (ctx, projectId) => getPlatformProjectGrantStore().listByProject(ctx, projectId),
-	flags: () => ({
-		allowCrossOrgPublic: flag("ALLOW_CROSS_ORG_PUBLIC"),
-		enablePlatformProjects: flag("ENABLE_PLATFORM_PROJECTS")
-	})
-});
-var buildProjectAccessInput = accessInputs.buildProjectAccessInput;
-var projectAccessInputFromRows = accessInputs.projectAccessInputFromRows;
-/**
-* Gate creation of a *new* definition. Container projects require project
-* owner/editor (canEdit). Commons projects (`autoJoinOnUpload=true`) accept
-* any authenticated user — the handler stamps `ownerId = user.id` so the
-* uploader becomes the definition owner.
-*/
-async function requireCanCreateDefinition(locals, projectId) {
-	const { user, ctx } = requireAuthed(locals);
-	const project = await loadProjectOr404(ctx, projectId);
-	if (!await contentCheck(async () => {
-		if (project.autoJoinOnUpload) return true;
-		return canEdit(await buildProjectAccessInput(ctx, project));
-	})) throw error(403, "You do not have permission to upload definitions to this project.");
-	return {
-		user,
-		ctx,
-		project
-	};
-}
-/**
-* Org-content gate — the caller must be a member of `orgId`. Used by the
-* file-serving proxy for org-private assets (e.g. pricing sheets under
-* `orgs/{id}/private/*`). Org membership is the only rule; this runs through
-* `contentCheck` (no `instance_admin` management bypass), matching the
-* content-scope policy of `requireCanViewProject` — platform staff use Reclaim
-* if they need access without membership.
-*
-* Throws 401 unauthenticated, 403 when not a member.
-*/
-async function requireCanViewOrg(locals, orgId) {
-	const { user, ctx } = requireAuthed(locals);
-	if (!await contentCheck(async () => {
-		return await getOrganizationProvider().getOrgMember(ctx, orgId, ctx.userId) !== null;
-	})) throw error(403, "You do not have access to this organization.");
-	return user;
-}
-/**
-* Project members must be members of the project's parent org (§4). Enforced
-* at the rule layer, not as a DB constraint, to leave room for cross-org
-* guests later without a schema migration.
-*/
-async function requireTargetIsOrgMember(locals, orgId, targetUserId) {
-	const { ctx } = requireAuthed(locals);
-	if (!await getOrganizationProvider().getOrgMember(ctx, orgId, targetUserId)) throw error(400, "User must be a member of this organization to be added to a project.");
-}
-/**
-* §5 `canReclaim` — org owner/admin escape hatch. Returns the project so the
-* handler can use its `orgId` without re-fetching.
-*/
-async function requireCanReclaim(locals, projectId) {
-	const { user, ctx } = requireAuthed(locals);
-	const project = await loadProjectOr404(ctx, projectId);
-	if (!await managementBypassOrRun(ctx, async () => {
-		const orgMember = await getOrganizationProvider().getOrgMember(ctx, project.orgId, ctx.userId);
-		return canReclaim({
-			project,
-			orgMember,
-			actingOrgId: ctx.actingOrgId ?? null
-		});
-	})) throw error(403, "Only org owners or admins of this project’s org can reclaim it.");
-	return {
-		user,
-		ctx,
-		project
-	};
-}
-/**
-* §5 `canCreateProject` — owner/admin always; member needs `manage_projects`.
-* Tenancy is enforced via `actingOrgId`.
-*/
-async function requireCanCreateProject(locals, targetOrgId) {
-	const { user, ctx } = requireAuthed(locals);
-	if (!await managementBypassOrRun(ctx, async () => {
-		const orgMember = await getOrganizationProvider().getOrgMember(ctx, targetOrgId, ctx.userId);
-		return canCreateProject({
-			orgPermissions: ctx.orgPermissions,
-			orgMember,
-			actingOrgId: ctx.actingOrgId ?? null,
-			targetOrgId
-		});
-	})) throw error(403, "You do not have permission to create projects in this org.");
-	return {
-		user,
-		ctx
-	};
-}
-async function requireCanManage(locals, projectId) {
-	const { user, ctx } = requireAuthed(locals);
-	if (!await managementBypassOrRun(ctx, async () => {
-		const project = await loadProjectOr404(ctx, projectId);
-		return canManage(await buildProjectAccessInput(ctx, project));
-	})) throw error(403, "Only project owners can manage this project.");
-	return user;
-}
-async function requireCanManageMembers(locals, projectId) {
-	const { user, ctx } = requireAuthed(locals);
-	if (!await managementBypassOrRun(ctx, async () => {
-		const project = await loadProjectOr404(ctx, projectId);
-		return canManage(await buildProjectAccessInput(ctx, project));
-	})) throw error(403, "Only project owners can manage members.");
-	return user;
-}
-/**
-* Owner-only gate for project settings. Centralized so PATCH /api/projects/[id]
-* matches the rest of the access layer (one place loads the entities + calls
-* the rule).
-*/
-async function requireCanEditProjectSettings(locals, projectId) {
-	const { user, ctx } = requireAuthed(locals);
-	const project = await loadProjectOr404(ctx, projectId);
-	if (!await managementBypassOrRun(ctx, async () => canEditProjectSettings(await buildProjectAccessInput(ctx, project)))) throw error(403, "Only project owners can edit project settings.");
-	return {
-		user,
-		ctx,
-		project
-	};
-}
-async function requireCanViewProject(locals, projectId) {
-	const { user, ctx } = requireAuthed(locals);
-	if (!await contentCheck(async () => {
-		const project = await loadProjectOr404(ctx, projectId);
-		return canView(await buildProjectAccessInput(ctx, project));
-	})) throw error(403, "You do not have access to this project.");
-	return user;
-}
-/**
-* Solve gating. Today `canSolve === canView` for non-platform projects, but
-* the rule lives in its own function so future cost-gating (quotas, rate
-* limits) lands without touching view semantics. `viewer` project role
-* passes. Platform projects narrow to grants with `canSolve=true`.
-*/
-async function requireCanSolve(locals, projectId, preloadedProject) {
-	const { user, ctx } = requireAuthed(locals);
-	const project = preloadedProject ?? await loadProjectOr404(ctx, projectId);
-	if (!await contentCheck(async () => canSolve(await buildProjectAccessInput(ctx, project)))) throw error(403, "You do not have access to this project.");
-	return {
-		user,
-		ctx,
-		project
-	};
-}
-/**
-* Loads the record and gates editing. Returns the record AND the project it
-* loads for the gate, so callers skip a re-fetch of either (§2b).
-*/
-async function requireEditableDefinition(locals, guid) {
-	const { ctx } = requireAuthed(locals);
-	const record = await getDefinitionMeta().get(ctx, guid);
-	if (!record) throw error(404, "Definition not found");
-	const [project, member] = await Promise.all([getProjectProvider().getProject(ctx, record.projectId), getProjectProvider().getProjectMember(ctx, record.projectId, ctx.userId)]);
-	if (!await contentCheck(async () => canEditDefinition({
-		project,
-		definition: record,
-		member,
-		userId: ctx.userId,
-		platformPermissions: ctx.platformPermissions,
-		enablePlatformProjects: flag("ENABLE_PLATFORM_PROJECTS")
-	}))) throw error(403, "You do not have permission to edit this definition.");
-	return {
-		record,
-		ctx,
-		project
-	};
-}
-async function requireCanEditDefinition(locals, projectId, definitionGuid, preloaded) {
-	const { user, ctx } = requireAuthed(locals);
-	if (!await contentCheck(async () => {
-		const [project, definition, member] = await Promise.all([
-			preloaded?.project !== void 0 ? Promise.resolve(preloaded.project) : getProjectProvider().getProject(ctx, projectId),
-			preloaded?.definition !== void 0 ? Promise.resolve(preloaded.definition) : getDefinitionMeta().get(ctx, definitionGuid),
-			getProjectProvider().getProjectMember(ctx, projectId, ctx.userId)
-		]);
-		return canEditDefinition({
-			project,
-			definition,
-			member,
-			userId: ctx.userId,
-			platformPermissions: ctx.platformPermissions,
-			enablePlatformProjects: flag("ENABLE_PLATFORM_PROJECTS")
-		});
-	})) throw error(403, "You do not have permission to edit this definition.");
-	return user;
-}
-
-export { projectAccessInputFromRows as A, canEdit as B, requireManageCompute as a, requireInstanceAdmin as b, requireManageOrgMembers as c, requirePermission as d, requireManageInstanceUsers as e, requireCanEditDefinition as f, requireCanSolve as g, requireCanCreateDefinition as h, requireCanViewProject as i, requireCanViewOrg as j, requireManageOrgCompute as k, requireCanCreateProject as l, requireCanManage as m, requireCanEditProjectSettings as n, canChangeVisibilityToPublic as o, requireCanManageMembers as p, requireTargetIsOrgMember as q, requireEditableDefinition as r, checkOwnerRemoval as s, requireCanReclaim as t, assertAnyPlatformPermission as u, assertPagePermission as v, withAdminBypass as w, assertManageCompute as x, assertManageInstanceUsers as y, canView as z };
-//# sourceMappingURL=access.server-BWOmKi8Z.js.map

package/build/server/chunks/access.server-BWOmKi8Z.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"access.server-BWOmKi8Z.js","sources":["../../../.svelte-kit/output/server/chunks/access.server.js"],"sourcesContent":["import { T as ALL_PLATFORM_PERMISSIONS, n as hasPermission } from \"./src.js\";\nimport { _ as getProjectProvider, g as getPlatformProjectGrantStore, m as getOrganizationProvider, s as getDefinitionMeta, t as flag } from \"./providers.server.js\";\nimport \"./api-errors.js\";\nimport { error, redirect } from \"@sveltejs/kit\";\n//#region ../platform/src/access/rules.ts\n/**\n* Pure access-control rules — single source of truth for UI gating across\n* adapters. Mutating store methods MUST re-enforce the same predicate\n* independently (RLS in SQL, code in local/JSON).\n*\n* `instance_admin` bypass is NOT baked into rule bodies — wrap calls with\n* `withAdminBypass` at the call site.\n*/\nfunction isInstanceAdmin(platformPermissions) {\n\treturn platformPermissions.includes(\"instance_admin\");\n}\nfunction withAdminBypass(platformPermissions, rule) {\n\tif (isInstanceAdmin(platformPermissions)) return true;\n\treturn rule();\n}\n/**\n* Authenticated-user view rule. Anonymous access is delivered via share-link\n* tokens — the route resolves a valid token before this rule runs.\n*\n* For `platform` projects: `instance_admin` always passes; otherwise any\n* grant (view-only or canSolve) satisfies view access.\n*/\nfunction canView(input) {\n\tconst { project, member, orgMember, allowCrossOrgPublic, enablePlatformProjects, platformPermissions, platformGrants, actingOrgId, userId } = input;\n\tif (!project) return false;\n\tif (project.visibility === \"platform\") {\n\t\tif (!enablePlatformProjects) return false;\n\t\tif (isInstanceAdmin(platformPermissions)) return true;\n\t\treturn platformGrants.some((g) => g.granteeType === \"user\" && g.granteeId === userId || g.granteeType === \"org\" && g.granteeId === actingOrgId);\n\t}\n\tif (project.visibility === \"private\") return member !== null;\n\tif (project.visibility === \"org\") return orgMember !== null;\n\tif (project.visibility === \"public\") return allowCrossOrgPublic ? true : orgMember !== null;\n\treturn false;\n}\n/**\n* For non-platform projects: same as `canView` today — kept distinct for\n* future cost gating.\n*\n* For `platform` projects: `instance_admin` always passes; a view-only grant\n* satisfies `canView` but NOT `canSolve` — the grant must have `canSolve=true`.\n*/\nfunction canSolve(input) {\n\tconst { project, enablePlatformProjects, platformPermissions, platformGrants, actingOrgId, userId } = input;\n\tif (!project) return false;\n\tif (project.visibility === \"platform\") {\n\t\tif (!enablePlatformProjects) return false;\n\t\tif (isInstanceAdmin(platformPermissions)) return true;\n\t\treturn platformGrants.some((g) => g.canSolve && (g.granteeType === \"user\" && g.granteeId === userId || g.granteeType === \"org\" && g.granteeId === actingOrgId));\n\t}\n\treturn canView(input);\n}\n/**\n* Platform projects: `instance_admin` only (they have no member rows).\n* All other visibilities: project owner/editor.\n*/\nfunction canEdit(input) {\n\tconst { member, project, enablePlatformProjects, platformPermissions } = input;\n\tif (project?.visibility === \"platform\") {\n\t\tif (!enablePlatformProjects) return false;\n\t\treturn isInstanceAdmin(platformPermissions);\n\t}\n\treturn member?.role === \"owner\" || member?.role === \"editor\";\n}\n/** Platform projects: `instance_admin` only. All other visibilities: project owner. */\nfunction canManage(input) {\n\tif (input.project?.visibility === \"platform\") {\n\t\tif (!input.enablePlatformProjects) return false;\n\t\treturn isInstanceAdmin(input.platformPermissions);\n\t}\n\treturn input.member?.role === \"owner\";\n}\n/** Platform projects: `instance_admin` only. All other visibilities: project owner. */\nfunction canEditProjectSettings(input) {\n\tif (input.project?.visibility === \"platform\") {\n\t\tif (!input.enablePlatformProjects) return false;\n\t\treturn isInstanceAdmin(input.platformPermissions);\n\t}\n\treturn input.member?.role === \"owner\";\n}\n/**\n* Authorization to flip a project to `public`. The `ALLOW_CROSS_ORG_PUBLIC`\n* flag only changes what `public` means post-flip; the flip itself is gated\n* by org owner/admin role.\n*/\nfunction canChangeVisibilityToPublic(input) {\n\tconst role = input.orgMember?.role;\n\treturn role === \"owner\" || role === \"admin\";\n}\n/**\n* For platform projects: `instance_admin` only.\n* For all other projects: project editor/owner can always edit (moderation).\n* On commons projects (`autoJoinOnUpload=true`) the definition owner can edit their own.\n*/\nfunction canEditDefinition(input) {\n\tconst { project, definition, member, userId, platformPermissions, enablePlatformProjects } = input;\n\tif (!project || !definition) return false;\n\tif (project.visibility === \"platform\") {\n\t\tif (!enablePlatformProjects) return false;\n\t\treturn isInstanceAdmin(platformPermissions);\n\t}\n\tif (member?.role === \"owner\" || member?.role === \"editor\") return true;\n\tif (project.autoJoinOnUpload && userId === definition.ownerId) return true;\n\treturn false;\n}\n/**\n* Org leadership escape hatch. Reclaim adds the actor as co-owner; it does\n* NOT demote the existing owner. Tenancy must match.\n*\n* Platform projects cannot be reclaimed — `instance_admin` always has\n* management access to them without needing the Reclaim mechanism.\n*/\nfunction canReclaim(input) {\n\tconst { project, orgMember, actingOrgId } = input;\n\tif (!project || !actingOrgId) return false;\n\tif (project.visibility === \"platform\") return false;\n\tif (actingOrgId !== project.orgId) return false;\n\tconst role = orgMember?.role;\n\treturn role === \"owner\" || role === \"admin\";\n}\n/**\n* Owner/admin can always create. A `member` needs `manage_projects` org\n* permission. Tenancy is enforced.\n*\n* Platform projects (`visibility='platform'`) are created via the admin API\n* and gated on `instance_admin` — this rule is not consulted for them.\n*/\nfunction canCreateProject(input) {\n\tconst { orgMember, orgPermissions, actingOrgId, targetOrgId } = input;\n\tif (actingOrgId !== targetOrgId) return false;\n\tconst role = orgMember?.role;\n\tif (role === \"owner\" || role === \"admin\") return true;\n\tif (role === \"member\" && orgPermissions.includes(\"manage_projects\")) return true;\n\treturn false;\n}\nfunction checkOwnerRemoval(input) {\n\tif (input.target.role !== \"owner\") return \"ok\";\n\tif (input.allMembers.filter((m) => m.role === \"owner\").length <= 1) return \"sole_owner\";\n\tif (!input.confirmed) return \"needs_confirm\";\n\treturn \"ok\";\n}\n//#endregion\n//#region ../server/src/access/project-access-input.ts\nfunction createProjectAccessInputBuilder(deps) {\n\treturn {\n\t\tasync buildProjectAccessInput(ctx, project, overrides = {}) {\n\t\t\tconst { allowCrossOrgPublic, enablePlatformProjects } = deps.flags();\n\t\t\tlet member = null;\n\t\t\tlet orgMember = null;\n\t\t\tlet platformGrants = [];\n\t\t\tif (project.visibility === \"platform\") {\n\t\t\t\tif (enablePlatformProjects) platformGrants = await deps.listPlatformGrants(ctx, project.id);\n\t\t\t} else if (project.visibility === \"private\") member = await deps.getProjectMember(ctx, project.id, ctx.userId);\n\t\t\telse {\n\t\t\t\tconst skipOrgMember = project.visibility === \"public\" && allowCrossOrgPublic;\n\t\t\t\t[member, orgMember] = await Promise.all([deps.getProjectMember(ctx, project.id, ctx.userId), skipOrgMember ? Promise.resolve(null) : deps.getOrgMember(ctx, project.orgId, ctx.userId)]);\n\t\t\t}\n\t\t\treturn {\n\t\t\t\torgPermissions: ctx.orgPermissions,\n\t\t\t\tplatformPermissions: ctx.platformPermissions,\n\t\t\t\tproject,\n\t\t\t\tmember,\n\t\t\t\torgMember,\n\t\t\t\tallowCrossOrgPublic,\n\t\t\t\tenablePlatformProjects,\n\t\t\t\tplatformGrants,\n\t\t\t\tactingOrgId: ctx.actingOrgId ?? null,\n\t\t\t\tuserId: ctx.userId,\n\t\t\t\t...overrides\n\t\t\t};\n\t\t},\n\t\tprojectAccessInputFromRows(ctx, project, rows) {\n\t\t\tconst { allowCrossOrgPublic, enablePlatformProjects } = deps.flags();\n\t\t\treturn {\n\t\t\t\torgPermissions: ctx.orgPermissions,\n\t\t\t\tplatformPermissions: ctx.platformPermissions,\n\t\t\t\tproject,\n\t\t\t\tmember: rows.member ?? null,\n\t\t\t\torgMember: rows.orgMember ?? null,\n\t\t\t\tallowCrossOrgPublic,\n\t\t\t\tenablePlatformProjects,\n\t\t\t\tplatformGrants: rows.platformGrants ?? [],\n\t\t\t\tactingOrgId: ctx.actingOrgId ?? null,\n\t\t\t\tuserId: ctx.userId\n\t\t\t};\n\t\t}\n\t};\n}\n//#endregion\n//#region src/lib/server/access.server.ts\nfunction requireAuthed(locals) {\n\tconst { user, ctx } = locals;\n\tif (!user || !ctx) throw error(401, \"Unauthorized\");\n\treturn {\n\t\tuser,\n\t\tctx\n\t};\n}\n/** Throws 403 — use in API routes. */\nfunction requirePermission(locals, permission) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tif (!hasPermission(ctx, permission)) throw error(403, `You don't have permission to do this.`);\n\treturn user;\n}\n/** Redirects to /admin — use in page load functions. */\nfunction assertPagePermission(locals, permission) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tif (!hasPermission(ctx, permission)) redirect(303, \"/admin\");\n\treturn user;\n}\nvar requireManageInstanceUsers = (locals) => requirePermission(locals, \"manage_instance_users\");\nvar requireManageCompute = (locals) => requirePermission(locals, \"manage_compute\");\nvar requireManageOrgMembers = (locals) => requirePermission(locals, \"manage_org_members\");\nvar requireManageOrgCompute = (locals) => requirePermission(locals, \"manage_org_compute\");\nvar assertManageInstanceUsers = (locals) => assertPagePermission(locals, \"manage_instance_users\");\nvar assertManageCompute = (locals) => assertPagePermission(locals, \"manage_compute\");\nvar requireInstanceAdmin = (locals) => requirePermission(locals, \"instance_admin\");\n/** Redirects to /library — use in page load functions on platform-scoped routes. */\nfunction assertAnyPlatformPermission(locals) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tif (!ALL_PLATFORM_PERMISSIONS.some((p) => hasPermission(ctx, p))) redirect(303, \"/library\");\n\treturn user;\n}\n/**\n* Management-scope bypass — used for org governance and project management\n* actions (Reclaim, create project, delete project, manage members, edit\n* settings). `instance_admin` bypasses these so platform staff can administer\n* the instance without being a member of every org.\n*\n* NOT used for content access (view, solve, edit definitions). See §2 of\n* Permissions.md: `instance_admin` follows the same `canView`/`canEdit` rules\n* as any other user for content — keeping blast radius small and ensuring\n* any content escalation goes through Reclaim, leaving an audit trail.\n*/\nasync function managementBypassOrRun(ctx, check) {\n\tif (hasPermission(ctx, \"instance_admin\")) return true;\n\treturn await check();\n}\n/**\n* Content-scope check — NO `instance_admin` bypass. `canView`, `canSolve`,\n* `canEdit`, and `canEditDefinition` run as-is regardless of platform role.\n* If platform staff need to access content, they use Reclaim first.\n*/\nasync function contentCheck(check) {\n\treturn await check();\n}\nasync function loadProjectOr404(ctx, projectId) {\n\tconst project = await getProjectProvider().getProject(ctx, projectId);\n\tif (!project) throw error(404, \"Project not found\");\n\treturn project;\n}\nvar accessInputs = createProjectAccessInputBuilder({\n\tgetProjectMember: (ctx, projectId, userId) => getProjectProvider().getProjectMember(ctx, projectId, userId),\n\tgetOrgMember: (ctx, orgId, userId) => getOrganizationProvider().getOrgMember(ctx, orgId, userId),\n\tlistPlatformGrants: (ctx, projectId) => getPlatformProjectGrantStore().listByProject(ctx, projectId),\n\tflags: () => ({\n\t\tallowCrossOrgPublic: flag(\"ALLOW_CROSS_ORG_PUBLIC\"),\n\t\tenablePlatformProjects: flag(\"ENABLE_PLATFORM_PROJECTS\")\n\t})\n});\nvar buildProjectAccessInput = accessInputs.buildProjectAccessInput;\nvar projectAccessInputFromRows = accessInputs.projectAccessInputFromRows;\n/**\n* Gate creation of a *new* definition. Container projects require project\n* owner/editor (canEdit). Commons projects (`autoJoinOnUpload=true`) accept\n* any authenticated user — the handler stamps `ownerId = user.id` so the\n* uploader becomes the definition owner.\n*/\nasync function requireCanCreateDefinition(locals, projectId) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tconst project = await loadProjectOr404(ctx, projectId);\n\tif (!await contentCheck(async () => {\n\t\tif (project.autoJoinOnUpload) return true;\n\t\treturn canEdit(await buildProjectAccessInput(ctx, project));\n\t})) throw error(403, \"You do not have permission to upload definitions to this project.\");\n\treturn {\n\t\tuser,\n\t\tctx,\n\t\tproject\n\t};\n}\n/**\n* Org-content gate — the caller must be a member of `orgId`. Used by the\n* file-serving proxy for org-private assets (e.g. pricing sheets under\n* `orgs/{id}/private/*`). Org membership is the only rule; this runs through\n* `contentCheck` (no `instance_admin` management bypass), matching the\n* content-scope policy of `requireCanViewProject` — platform staff use Reclaim\n* if they need access without membership.\n*\n* Throws 401 unauthenticated, 403 when not a member.\n*/\nasync function requireCanViewOrg(locals, orgId) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tif (!await contentCheck(async () => {\n\t\treturn await getOrganizationProvider().getOrgMember(ctx, orgId, ctx.userId) !== null;\n\t})) throw error(403, \"You do not have access to this organization.\");\n\treturn user;\n}\n/**\n* Project members must be members of the project's parent org (§4). Enforced\n* at the rule layer, not as a DB constraint, to leave room for cross-org\n* guests later without a schema migration.\n*/\nasync function requireTargetIsOrgMember(locals, orgId, targetUserId) {\n\tconst { ctx } = requireAuthed(locals);\n\tif (!await getOrganizationProvider().getOrgMember(ctx, orgId, targetUserId)) throw error(400, \"User must be a member of this organization to be added to a project.\");\n}\n/**\n* §5 `canReclaim` — org owner/admin escape hatch. Returns the project so the\n* handler can use its `orgId` without re-fetching.\n*/\nasync function requireCanReclaim(locals, projectId) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tconst project = await loadProjectOr404(ctx, projectId);\n\tif (!await managementBypassOrRun(ctx, async () => {\n\t\tconst orgMember = await getOrganizationProvider().getOrgMember(ctx, project.orgId, ctx.userId);\n\t\treturn canReclaim({\n\t\t\tproject,\n\t\t\torgMember,\n\t\t\tactingOrgId: ctx.actingOrgId ?? null\n\t\t});\n\t})) throw error(403, \"Only org owners or admins of this project’s org can reclaim it.\");\n\treturn {\n\t\tuser,\n\t\tctx,\n\t\tproject\n\t};\n}\n/**\n* §5 `canCreateProject` — owner/admin always; member needs `manage_projects`.\n* Tenancy is enforced via `actingOrgId`.\n*/\nasync function requireCanCreateProject(locals, targetOrgId) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tif (!await managementBypassOrRun(ctx, async () => {\n\t\tconst orgMember = await getOrganizationProvider().getOrgMember(ctx, targetOrgId, ctx.userId);\n\t\treturn canCreateProject({\n\t\t\torgPermissions: ctx.orgPermissions,\n\t\t\torgMember,\n\t\t\tactingOrgId: ctx.actingOrgId ?? null,\n\t\t\ttargetOrgId\n\t\t});\n\t})) throw error(403, \"You do not have permission to create projects in this org.\");\n\treturn {\n\t\tuser,\n\t\tctx\n\t};\n}\nasync function requireCanManage(locals, projectId) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tif (!await managementBypassOrRun(ctx, async () => {\n\t\tconst project = await loadProjectOr404(ctx, projectId);\n\t\treturn canManage(await buildProjectAccessInput(ctx, project));\n\t})) throw error(403, \"Only project owners can manage this project.\");\n\treturn user;\n}\nasync function requireCanManageMembers(locals, projectId) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tif (!await managementBypassOrRun(ctx, async () => {\n\t\tconst project = await loadProjectOr404(ctx, projectId);\n\t\treturn canManage(await buildProjectAccessInput(ctx, project));\n\t})) throw error(403, \"Only project owners can manage members.\");\n\treturn user;\n}\n/**\n* Owner-only gate for project settings. Centralized so PATCH /api/projects/[id]\n* matches the rest of the access layer (one place loads the entities + calls\n* the rule).\n*/\nasync function requireCanEditProjectSettings(locals, projectId) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tconst project = await loadProjectOr404(ctx, projectId);\n\tif (!await managementBypassOrRun(ctx, async () => canEditProjectSettings(await buildProjectAccessInput(ctx, project)))) throw error(403, \"Only project owners can edit project settings.\");\n\treturn {\n\t\tuser,\n\t\tctx,\n\t\tproject\n\t};\n}\nasync function requireCanViewProject(locals, projectId) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tif (!await contentCheck(async () => {\n\t\tconst project = await loadProjectOr404(ctx, projectId);\n\t\treturn canView(await buildProjectAccessInput(ctx, project));\n\t})) throw error(403, \"You do not have access to this project.\");\n\treturn user;\n}\n/**\n* Solve gating. Today `canSolve === canView` for non-platform projects, but\n* the rule lives in its own function so future cost-gating (quotas, rate\n* limits) lands without touching view semantics. `viewer` project role\n* passes. Platform projects narrow to grants with `canSolve=true`.\n*/\nasync function requireCanSolve(locals, projectId, preloadedProject) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tconst project = preloadedProject ?? await loadProjectOr404(ctx, projectId);\n\tif (!await contentCheck(async () => canSolve(await buildProjectAccessInput(ctx, project)))) throw error(403, \"You do not have access to this project.\");\n\treturn {\n\t\tuser,\n\t\tctx,\n\t\tproject\n\t};\n}\n/**\n* Loads the record and gates editing. Returns the record AND the project it\n* loads for the gate, so callers skip a re-fetch of either (§2b).\n*/\nasync function requireEditableDefinition(locals, guid) {\n\tconst { ctx } = requireAuthed(locals);\n\tconst record = await getDefinitionMeta().get(ctx, guid);\n\tif (!record) throw error(404, \"Definition not found\");\n\tconst [project, member] = await Promise.all([getProjectProvider().getProject(ctx, record.projectId), getProjectProvider().getProjectMember(ctx, record.projectId, ctx.userId)]);\n\tif (!await contentCheck(async () => canEditDefinition({\n\t\tproject,\n\t\tdefinition: record,\n\t\tmember,\n\t\tuserId: ctx.userId,\n\t\tplatformPermissions: ctx.platformPermissions,\n\t\tenablePlatformProjects: flag(\"ENABLE_PLATFORM_PROJECTS\")\n\t}))) throw error(403, \"You do not have permission to edit this definition.\");\n\treturn {\n\t\trecord,\n\t\tctx,\n\t\tproject\n\t};\n}\nasync function requireCanEditDefinition(locals, projectId, definitionGuid, preloaded) {\n\tconst { user, ctx } = requireAuthed(locals);\n\tif (!await contentCheck(async () => {\n\t\tconst [project, definition, member] = await Promise.all([\n\t\t\tpreloaded?.project !== void 0 ? Promise.resolve(preloaded.project) : getProjectProvider().getProject(ctx, projectId),\n\t\t\tpreloaded?.definition !== void 0 ? Promise.resolve(preloaded.definition) : getDefinitionMeta().get(ctx, definitionGuid),\n\t\t\tgetProjectProvider().getProjectMember(ctx, projectId, ctx.userId)\n\t\t]);\n\t\treturn canEditDefinition({\n\t\t\tproject,\n\t\t\tdefinition,\n\t\t\tmember,\n\t\t\tuserId: ctx.userId,\n\t\t\tplatformPermissions: ctx.platformPermissions,\n\t\t\tenablePlatformProjects: flag(\"ENABLE_PLATFORM_PROJECTS\")\n\t\t});\n\t})) throw error(403, \"You do not have permission to edit this definition.\");\n\treturn user;\n}\n//#endregion\nexport { requireTargetIsOrgMember as C, checkOwnerRemoval as D, canView as E, withAdminBypass as O, requirePermission as S, canEdit as T, requireInstanceAdmin as _, projectAccessInputFromRows as a, requireManageOrgCompute as b, requireCanEditDefinition as c, requireCanManageMembers as d, requireCanReclaim as f, requireEditableDefinition as g, requireCanViewProject as h, assertPagePermission as i, requireCanEditProjectSettings as l, requireCanViewOrg as m, assertManageCompute as n, requireCanCreateDefinition as o, requireCanSolve as p, assertManageInstanceUsers as r, requireCanCreateProject as s, assertAnyPlatformPermission as t, requireCanManage as u, requireManageCompute as v, canChangeVisibilityToPublic as w, requireManageOrgMembers as x, requireManageInstanceUsers as y };\n"],"names":[],"mappings":";;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,eAAe,CAAC,mBAAmB,EAAE;AAC9C,CAAC,OAAO,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC;AACtD;AACA,SAAS,eAAe,CAAC,mBAAmB,EAAE,IAAI,EAAE;AACpD,CAAC,IAAI,eAAe,CAAC,mBAAmB,CAAC,EAAE,OAAO,IAAI;AACtD,CAAC,OAAO,IAAI,EAAE;AACd;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,OAAO,CAAC,KAAK,EAAE;AACxB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,KAAK;AACpJ,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,KAAK;AAC3B,CAAC,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE;AACxC,EAAE,IAAI,CAAC,sBAAsB,EAAE,OAAO,KAAK;AAC3C,EAAE,IAAI,eAAe,CAAC,mBAAmB,CAAC,EAAE,OAAO,IAAI;AACvD,EAAE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,KAAK,IAAI,CAAC,CAAC,SAAS,KAAK,WAAW,CAAC;AACjJ,CAAC;AACD,CAAC,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,OAAO,MAAM,KAAK,IAAI;AAC7D,CAAC,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,EAAE,OAAO,SAAS,KAAK,IAAI;AAC5D,CAAC,IAAI,OAAO,CAAC,UAAU,KAAK,QAAQ,EAAE,OAAO,mBAAmB,GAAG,IAAI,GAAG,SAAS,KAAK,IAAI;AAC5F,CAAC,OAAO,KAAK;AACb;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,QAAQ,CAAC,KAAK,EAAE;AACzB,CAAC,MAAM,EAAE,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,KAAK;AAC5G,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,KAAK;AAC3B,CAAC,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE;AACxC,EAAE,IAAI,CAAC,sBAAsB,EAAE,OAAO,KAAK;AAC3C,EAAE,IAAI,eAAe,CAAC,mBAAmB,CAAC,EAAE,OAAO,IAAI;AACvD,EAAE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,KAAK,IAAI,CAAC,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC;AACjK,CAAC;AACD,CAAC,OAAO,OAAO,CAAC,KAAK,CAAC;AACtB;AACA;AACA;AACA;AACA;AACA,SAAS,OAAO,CAAC,KAAK,EAAE;AACxB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,GAAG,KAAK;AAC/E,CAAC,IAAI,OAAO,EAAE,UAAU,KAAK,UAAU,EAAE;AACzC,EAAE,IAAI,CAAC,sBAAsB,EAAE,OAAO,KAAK;AAC3C,EAAE,OAAO,eAAe,CAAC,mBAAmB,CAAC;AAC7C,CAAC;AACD,CAAC,OAAO,MAAM,EAAE,IAAI,KAAK,OAAO,IAAI,MAAM,EAAE,IAAI,KAAK,QAAQ;AAC7D;AACA;AACA,SAAS,SAAS,CAAC,KAAK,EAAE;AAC1B,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,UAAU,KAAK,UAAU,EAAE;AAC/C,EAAE,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,OAAO,KAAK;AACjD,EAAE,OAAO,eAAe,CAAC,KAAK,CAAC,mBAAmB,CAAC;AACnD,CAAC;AACD,CAAC,OAAO,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,OAAO;AACtC;AACA;AACA,SAAS,sBAAsB,CAAC,KAAK,EAAE;AACvC,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,UAAU,KAAK,UAAU,EAAE;AAC/C,EAAE,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,OAAO,KAAK;AACjD,EAAE,OAAO,eAAe,CAAC,KAAK,CAAC,mBAAmB,CAAC;AACnD,CAAC;AACD,CAAC,OAAO,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,OAAO;AACtC;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,2BAA2B,CAAC,KAAK,EAAE;AAC5C,CAAC,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,EAAE,IAAI;AACnC,CAAC,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO;AAC5C;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,KAAK,EAAE;AAClC,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,GAAG,KAAK;AACnG,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,EAAE,OAAO,KAAK;AAC1C,CAAC,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE;AACxC,EAAE,IAAI,CAAC,sBAAsB,EAAE,OAAO,KAAK;AAC3C,EAAE,OAAO,eAAe,CAAC,mBAAmB,CAAC;AAC7C,CAAC;AACD,CAAC,IAAI,MAAM,EAAE,IAAI,KAAK,OAAO,IAAI,MAAM,EAAE,IAAI,KAAK,QAAQ,EAAE,OAAO,IAAI;AACvE,CAAC,IAAI,OAAO,CAAC,gBAAgB,IAAI,MAAM,KAAK,UAAU,CAAC,OAAO,EAAE,OAAO,IAAI;AAC3E,CAAC,OAAO,KAAK;AACb;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,UAAU,CAAC,KAAK,EAAE;AAC3B,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,KAAK;AAClD,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,EAAE,OAAO,KAAK;AAC3C,CAAC,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,OAAO,KAAK;AACpD,CAAC,IAAI,WAAW,KAAK,OAAO,CAAC,KAAK,EAAE,OAAO,KAAK;AAChD,CAAC,MAAM,IAAI,GAAG,SAAS,EAAE,IAAI;AAC7B,CAAC,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO;AAC5C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,CAAC,KAAK,EAAE;AACjC,CAAC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,KAAK;AACtE,CAAC,IAAI,WAAW,KAAK,WAAW,EAAE,OAAO,KAAK;AAC9C,CAAC,MAAM,IAAI,GAAG,SAAS,EAAE,IAAI;AAC7B,CAAC,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,OAAO,IAAI;AACtD,CAAC,IAAI,IAAI,KAAK,QAAQ,IAAI,cAAc,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,IAAI;AACjF,CAAC,OAAO,KAAK;AACb;AACA,SAAS,iBAAiB,CAAC,KAAK,EAAE;AAClC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,OAAO,IAAI;AAC/C,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,OAAO,YAAY;AACxF,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,eAAe;AAC7C,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA,SAAS,+BAA+B,CAAC,IAAI,EAAE;AAC/C,CAAC,OAAO;AACR,EAAE,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,EAAE;AAC9D,GAAG,MAAM,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE;AACvE,GAAG,IAAI,MAAM,GAAG,IAAI;AACpB,GAAG,IAAI,SAAS,GAAG,IAAI;AACvB,GAAG,IAAI,cAAc,GAAG,EAAE;AAC1B,GAAG,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE;AAC1C,IAAI,IAAI,sBAAsB,EAAE,cAAc,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;AAC/F,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC;AACjH,QAAQ;AACR,IAAI,MAAM,aAAa,GAAG,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,mBAAmB;AAChF,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5L,GAAG;AACH,GAAG,OAAO;AACV,IAAI,cAAc,EAAE,GAAG,CAAC,cAAc;AACtC,IAAI,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;AAChD,IAAI,OAAO;AACX,IAAI,MAAM;AACV,IAAI,SAAS;AACb,IAAI,mBAAmB;AACvB,IAAI,sBAAsB;AAC1B,IAAI,cAAc;AAClB,IAAI,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;AACxC,IAAI,MAAM,EAAE,GAAG,CAAC,MAAM;AACtB,IAAI,GAAG;AACP,IAAI;AACJ,EAAE,CAAC;AACH,EAAE,0BAA0B,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;AACjD,GAAG,MAAM,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE;AACvE,GAAG,OAAO;AACV,IAAI,cAAc,EAAE,GAAG,CAAC,cAAc;AACtC,IAAI,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;AAChD,IAAI,OAAO;AACX,IAAI,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;AAC/B,IAAI,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;AACrC,IAAI,mBAAmB;AACvB,IAAI,sBAAsB;AAC1B,IAAI,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE;AAC7C,IAAI,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;AACxC,IAAI,MAAM,EAAE,GAAG,CAAC;AAChB,IAAI;AACJ,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA,SAAS,aAAa,CAAC,MAAM,EAAE;AAC/B,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM;AAC7B,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC;AACpD,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE;AACF,EAAE;AACF;AACA;AACA,SAAS,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE;AAC/C,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,qCAAqC,CAAC,CAAC;AAC/F,CAAC,OAAO,IAAI;AACZ;AACA;AACA,SAAS,oBAAoB,CAAC,MAAM,EAAE,UAAU,EAAE;AAClD,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;AAC7D,CAAC,OAAO,IAAI;AACZ;AACG,IAAC,0BAA0B,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,uBAAuB;AAC3F,IAAC,oBAAoB,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,gBAAgB;AAC9E,IAAC,uBAAuB,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,oBAAoB;AACrF,IAAC,uBAAuB,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,oBAAoB;AACrF,IAAC,yBAAyB,GAAG,CAAC,MAAM,KAAK,oBAAoB,CAAC,MAAM,EAAE,uBAAuB;AAC7F,IAAC,mBAAmB,GAAG,CAAC,MAAM,KAAK,oBAAoB,CAAC,MAAM,EAAE,gBAAgB;AAChF,IAAC,oBAAoB,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,gBAAgB;AACjF;AACA,SAAS,2BAA2B,CAAC,MAAM,EAAE;AAC7C,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;AAC5F,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE;AACjD,CAAC,IAAI,aAAa,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,OAAO,IAAI;AACtD,CAAC,OAAO,MAAM,KAAK,EAAE;AACrB;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,YAAY,CAAC,KAAK,EAAE;AACnC,CAAC,OAAO,MAAM,KAAK,EAAE;AACrB;AACA,eAAe,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE;AAChD,CAAC,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;AACtE,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,mBAAmB,CAAC;AACpD,CAAC,OAAO,OAAO;AACf;AACA,IAAI,YAAY,GAAG,+BAA+B,CAAC;AACnD,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,KAAK,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC;AAC5G,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,KAAK,uBAAuB,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC;AACjG,CAAC,kBAAkB,EAAE,CAAC,GAAG,EAAE,SAAS,KAAK,4BAA4B,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC;AACrG,CAAC,KAAK,EAAE,OAAO;AACf,EAAE,mBAAmB,EAAE,IAAI,CAAC,wBAAwB,CAAC;AACrD,EAAE,sBAAsB,EAAE,IAAI,CAAC,0BAA0B;AACzD,EAAE;AACF,CAAC,CAAC;AACF,IAAI,uBAAuB,GAAG,YAAY,CAAC,uBAAuB;AAC/D,IAAC,0BAA0B,GAAG,YAAY,CAAC;AAC9C;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,0BAA0B,CAAC,MAAM,EAAE,SAAS,EAAE;AAC7D,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC;AACvD,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,YAAY;AACrC,EAAE,IAAI,OAAO,CAAC,gBAAgB,EAAE,OAAO,IAAI;AAC3C,EAAE,OAAO,OAAO,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,mEAAmE,CAAC;AAC1F,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE,GAAG;AACL,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,iBAAiB,CAAC,MAAM,EAAE,KAAK,EAAE;AAChD,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,YAAY;AACrC,EAAE,OAAO,MAAM,uBAAuB,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI;AACtF,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,8CAA8C,CAAC;AACrE,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,wBAAwB,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE;AACrE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AACtC,CAAC,IAAI,CAAC,MAAM,uBAAuB,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,sEAAsE,CAAC;AACtK;AACA;AACA;AACA;AACA;AACA,eAAe,iBAAiB,CAAC,MAAM,EAAE,SAAS,EAAE;AACpD,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC;AACvD,CAAC,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,YAAY;AACnD,EAAE,MAAM,SAAS,GAAG,MAAM,uBAAuB,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC;AAChG,EAAE,OAAO,UAAU,CAAC;AACpB,GAAG,OAAO;AACV,GAAG,SAAS;AACZ,GAAG,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI;AACnC,GAAG,CAAC;AACJ,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,iEAAiE,CAAC;AACxF,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE,GAAG;AACL,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA,eAAe,uBAAuB,CAAC,MAAM,EAAE,WAAW,EAAE;AAC5D,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,YAAY;AACnD,EAAE,MAAM,SAAS,GAAG,MAAM,uBAAuB,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC;AAC9F,EAAE,OAAO,gBAAgB,CAAC;AAC1B,GAAG,cAAc,EAAE,GAAG,CAAC,cAAc;AACrC,GAAG,SAAS;AACZ,GAAG,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;AACvC,GAAG;AACH,GAAG,CAAC;AACJ,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,4DAA4D,CAAC;AACnF,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE;AACF,EAAE;AACF;AACA,eAAe,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE;AACnD,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,YAAY;AACnD,EAAE,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC;AACxD,EAAE,OAAO,SAAS,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC/D,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,8CAA8C,CAAC;AACrE,CAAC,OAAO,IAAI;AACZ;AACA,eAAe,uBAAuB,CAAC,MAAM,EAAE,SAAS,EAAE;AAC1D,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,YAAY;AACnD,EAAE,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC;AACxD,EAAE,OAAO,SAAS,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC/D,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,yCAAyC,CAAC;AAChE,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,6BAA6B,CAAC,MAAM,EAAE,SAAS,EAAE;AAChE,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC;AACvD,CAAC,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,EAAE,YAAY,sBAAsB,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,gDAAgD,CAAC;AAC3L,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE,GAAG;AACL,EAAE;AACF,EAAE;AACF;AACA,eAAe,qBAAqB,CAAC,MAAM,EAAE,SAAS,EAAE;AACxD,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,YAAY;AACrC,EAAE,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC;AACxD,EAAE,OAAO,OAAO,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,yCAAyC,CAAC;AAChE,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE;AACpE,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,MAAM,OAAO,GAAG,gBAAgB,IAAI,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC;AAC3E,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,YAAY,QAAQ,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,yCAAyC,CAAC;AACxJ,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE,GAAG;AACL,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA,eAAe,yBAAyB,CAAC,MAAM,EAAE,IAAI,EAAE;AACvD,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AACtC,CAAC,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC;AACxD,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,sBAAsB,CAAC;AACtD,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,kBAAkB,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAChL,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,YAAY,iBAAiB,CAAC;AACvD,EAAE,OAAO;AACT,EAAE,UAAU,EAAE,MAAM;AACpB,EAAE,MAAM;AACR,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM;AACpB,EAAE,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;AAC9C,EAAE,sBAAsB,EAAE,IAAI,CAAC,0BAA0B;AACzD,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,qDAAqD,CAAC;AAC7E,CAAC,OAAO;AACR,EAAE,MAAM;AACR,EAAE,GAAG;AACL,EAAE;AACF,EAAE;AACF;AACA,eAAe,wBAAwB,CAAC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE;AACtF,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC5C,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,YAAY;AACrC,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AAC1D,GAAG,SAAS,EAAE,OAAO,KAAK,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,kBAAkB,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;AACvH,GAAG,SAAS,EAAE,UAAU,KAAK,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,iBAAiB,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC;AAC1H,GAAG,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM;AACnE,GAAG,CAAC;AACJ,EAAE,OAAO,iBAAiB,CAAC;AAC3B,GAAG,OAAO;AACV,GAAG,UAAU;AACb,GAAG,MAAM;AACT,GAAG,MAAM,EAAE,GAAG,CAAC,MAAM;AACrB,GAAG,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;AAC/C,GAAG,sBAAsB,EAAE,IAAI,CAAC,0BAA0B;AAC1D,GAAG,CAAC;AACJ,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,qDAAqD,CAAC;AAC5E,CAAC,OAAO,IAAI;AACZ;;;;"}

package/build/server/chunks/access2.server-eKvDje88.js

@@ -1,22 +0,0 @@
-import { r as requireEditableDefinition } from './access.server-BWOmKi8Z.js';
-import './src-tWHhLCSB.js';
-import 'zod';
-import './providers.server-C1zmtRr7.js';
-import './index.js-NH2Q8xBT.js';
-import 'clsx';
-import '@sveltejs/kit/internal';
-import '@sveltejs/kit';
-import '@sveltejs/kit/internal/server';
-import './limits-D8LKRL6A.js';
-import './chunk-Y3M7P3BW-CpcVbL4P.js';
-import 'node:crypto';
-import 'node:url';
-import 'node:path';
-import 'node:fs';
-import 'node:fs/promises';
-import '@supabase/supabase-js';
-
-
-
-export { requireEditableDefinition };
-//# sourceMappingURL=access2.server-eKvDje88.js.map