@selvajs/selva 4.7.0-beta.6 → 4.7.0

package/build/server/chunks/entries/endpoints/api/definitions/_guid_/share-links/_linkId_/_server.ts.js-BBxUhG6I.js

@@ -0,0 +1,46 @@
+import { e as GuidSchema } from '../../../../../../../chunks/src.js-C5mUn1eC.js';
+import { k as flag, p as providers } from '../../../../../../../chunks/providers.server.js-BCmROUq1.js';
+import { n as requireEditableDefinition } from '../../../../../../../chunks/access.server.js-55bmpUSo.js';
+import { a as apiError, A as ApiErrorCode, h as handleApiError } from '../../../../../../../chunks/api-errors.js-BdoYiwnt.js';
+import 'zod';
+import '../../../../../../../chunks/shared-server.js-DA4m8f1m.js';
+import '../../../../../../../chunks/limits.js-BniDP5VZ.js';
+import '../../../../../../../chunks/chunk-Y3M7P3BW.js-qwxSY5dh.js';
+import '../../../../../../../chunks/schema.js-BhmknPcU.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '@sveltejs/kit';
+import '../../../../../../../chunks/utils2.js-V7yGq-Kd.js';
+
+//#region src/routes/api/definitions/[guid]/share-links/[linkId]/+server.ts
+/**
+* DELETE /api/definitions/[guid]/share-links/[linkId] — revoke (soft-delete).
+* Idempotent. Authorization gated by `canEditDefinition`.
+*
+* The handler also verifies the link belongs to this definition before
+* revoking — prevents one definition's editor from revoking another's
+* link via a guessed/leaked linkId.
+*/
+var DELETE = async ({ params, locals }) => {
+	if (!flag("ENABLE_SHARING")) apiError(404, ApiErrorCode.NOT_FOUND, "Share links are disabled on this instance (ENABLE_SHARING).");
+	const guidParsed = GuidSchema.safeParse(params.guid);
+	if (!guidParsed.success) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Invalid or missing GUID");
+	const linkParsed = GuidSchema.safeParse(params.linkId);
+	if (!linkParsed.success) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Invalid or missing link ID");
+	const { ctx } = await requireEditableDefinition(locals, guidParsed.data);
+	try {
+		const existing = await providers.data.shareLinks.getById(ctx, linkParsed.data);
+		if (!existing || existing.definitionId !== guidParsed.data) apiError(404, ApiErrorCode.NOT_FOUND, "Share link not found.");
+		await providers.data.shareLinks.revoke(ctx, linkParsed.data);
+		return new Response(null, { status: 204 });
+	} catch (err) {
+		handleApiError(err, "Failed to revoke share link");
+	}
+};
+
+export { DELETE };
+//# sourceMappingURL=_server.ts.js-BBxUhG6I.js.map

package/build/server/chunks/entries/endpoints/api/definitions/_guid_/share-links/_linkId_/_server.ts.js-BBxUhG6I.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-BBxUhG6I.js","sources":["../../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/definitions/_guid_/share-links/_linkId_/_server.ts.js"],"sourcesContent":["import { s as GuidSchema } from \"../../../../../../../chunks/src.js\";\nimport { C as providers, t as flag } from \"../../../../../../../chunks/providers.server.js\";\nimport { g as requireEditableDefinition } from \"../../../../../../../chunks/access.server.js\";\nimport { n as apiError, r as handleApiError, t as ApiErrorCode } from \"../../../../../../../chunks/api-errors.js\";\nimport \"../../../../../../../chunks/definitions.js\";\n//#region src/routes/api/definitions/[guid]/share-links/[linkId]/+server.ts\n/**\n* DELETE /api/definitions/[guid]/share-links/[linkId] — revoke (soft-delete).\n* Idempotent. Authorization gated by `canEditDefinition`.\n*\n* The handler also verifies the link belongs to this definition before\n* revoking — prevents one definition's editor from revoking another's\n* link via a guessed/leaked linkId.\n*/\nvar DELETE = async ({ params, locals }) => {\n\tif (!flag(\"ENABLE_SHARING\")) apiError(404, ApiErrorCode.NOT_FOUND, \"Share links are disabled on this instance (ENABLE_SHARING).\");\n\tconst guidParsed = GuidSchema.safeParse(params.guid);\n\tif (!guidParsed.success) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Invalid or missing GUID\");\n\tconst linkParsed = GuidSchema.safeParse(params.linkId);\n\tif (!linkParsed.success) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Invalid or missing link ID\");\n\tconst { ctx } = await requireEditableDefinition(locals, guidParsed.data);\n\ttry {\n\t\tconst existing = await providers.data.shareLinks.getById(ctx, linkParsed.data);\n\t\tif (!existing || existing.definitionId !== guidParsed.data) apiError(404, ApiErrorCode.NOT_FOUND, \"Share link not found.\");\n\t\tawait providers.data.shareLinks.revoke(ctx, linkParsed.data);\n\t\treturn new Response(null, { status: 204 });\n\t} catch (err) {\n\t\thandleApiError(err, \"Failed to revoke share link\");\n\t}\n};\n//#endregion\nexport { DELETE };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAKA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,MAAM,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AAC3C,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,6DAA6D,CAAC;AAClI,CAAC,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;AACrD,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,yBAAyB,CAAC;AAClG,CAAC,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;AACvD,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,4BAA4B,CAAC;AACrG,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC;AACzE,CAAC,IAAI;AACL,EAAE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC;AAChF,EAAE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,YAAY,KAAK,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,uBAAuB,CAAC;AAC5H,EAAE,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC;AAC9D,EAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC5C,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,cAAc,CAAC,GAAG,EAAE,6BAA6B,CAAC;AACpD,CAAC;AACD;;;;"}

package/build/server/chunks/entries/endpoints/api/definitions/_guid_/share-links/_server.ts.js-B2anGcET.js

@@ -0,0 +1,84 @@
+import { e as GuidSchema, j as CreateShareLinkInputSchema } from '../../../../../../chunks/src.js-C5mUn1eC.js';
+import { p as providers, k as flag } from '../../../../../../chunks/providers.server.js-BCmROUq1.js';
+import { D as DEFAULT_SHARE_LINK_MAX_SOLVES } from '../../../../../../chunks/types.js-B_zdqlv_.js';
+import { n as requireEditableDefinition } from '../../../../../../chunks/access.server.js-55bmpUSo.js';
+import { a as apiError, h as handleApiError, t as throwZodError, A as ApiErrorCode } from '../../../../../../chunks/api-errors.js-BdoYiwnt.js';
+import { m as mintRawToken, h as hashToken } from '../../../../../../chunks/token.server.js-C2Bim4Rh.js';
+import { json } from '@sveltejs/kit';
+import { randomUUID } from 'node:crypto';
+import 'zod';
+import '../../../../../../chunks/shared-server.js-DA4m8f1m.js';
+import '../../../../../../chunks/limits.js-BniDP5VZ.js';
+import '../../../../../../chunks/chunk-Y3M7P3BW.js-qwxSY5dh.js';
+import '../../../../../../chunks/schema.js-BhmknPcU.js';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '../../../../../../chunks/utils2.js-V7yGq-Kd.js';
+import '../../../../../../chunks/token-codec.js-CxK2DiO-.js';
+
+//#region src/routes/api/definitions/[guid]/share-links/+server.ts
+function assertSharingEnabled() {
+	if (!flag("ENABLE_SHARING")) apiError(404, ApiErrorCode.NOT_FOUND, "Share links are disabled on this instance (ENABLE_SHARING).");
+}
+function strip(link) {
+	const { tokenHash: _omit, ...rest } = link;
+	return {
+		...rest,
+		hasToken: true
+	};
+}
+var GET = async ({ params, locals }) => {
+	assertSharingEnabled();
+	const guidParsed = GuidSchema.safeParse(params.guid);
+	if (!guidParsed.success) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Invalid or missing GUID");
+	const { ctx } = await requireEditableDefinition(locals, guidParsed.data);
+	try {
+		const page = await providers.data.shareLinks.listByDefinition(ctx, guidParsed.data, { limit: 200 });
+		return json({
+			links: page.items.map(strip),
+			nextCursor: page.nextCursor
+		});
+	} catch (err) {
+		handleApiError(err, "Failed to list share links");
+	}
+};
+var POST = async ({ params, request, locals }) => {
+	assertSharingEnabled();
+	const guidParsed = GuidSchema.safeParse(params.guid);
+	if (!guidParsed.success) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Invalid or missing GUID");
+	const { ctx } = await requireEditableDefinition(locals, guidParsed.data);
+	const body = await request.json().catch(() => ({}));
+	const parsed = CreateShareLinkInputSchema.safeParse(body);
+	if (!parsed.success) throwZodError(parsed.error);
+	const raw = mintRawToken();
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const link = {
+		id: randomUUID(),
+		definitionId: guidParsed.data,
+		channel: parsed.data.channel,
+		tokenHash: hashToken(raw),
+		name: parsed.data.name,
+		createdBy: locals.user.id,
+		createdAt: now,
+		expiresAt: parsed.data.expiresAt ?? null,
+		revokedAt: null,
+		allowSolve: parsed.data.allowSolve,
+		maxSolves: parsed.data.maxSolves === void 0 ? DEFAULT_SHARE_LINK_MAX_SOLVES : parsed.data.maxSolves,
+		solveCount: 0
+	};
+	try {
+		await providers.data.shareLinks.create(ctx, link);
+		return json({
+			link: strip(link),
+			token: raw
+		}, { status: 201 });
+	} catch (err) {
+		handleApiError(err, "Failed to create share link");
+	}
+};
+
+export { GET, POST };
+//# sourceMappingURL=_server.ts.js-B2anGcET.js.map

package/build/server/chunks/entries/endpoints/api/definitions/_guid_/share-links/_server.ts.js-B2anGcET.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-B2anGcET.js","sources":["../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/definitions/_guid_/share-links/_server.ts.js"],"sourcesContent":["import { a as CreateShareLinkInputSchema, s as GuidSchema } from \"../../../../../../chunks/src.js\";\nimport { C as providers, t as flag } from \"../../../../../../chunks/providers.server.js\";\nimport { t as DEFAULT_SHARE_LINK_MAX_SOLVES } from \"../../../../../../chunks/types.js\";\nimport { g as requireEditableDefinition } from \"../../../../../../chunks/access.server.js\";\nimport { i as throwZodError, n as apiError, r as handleApiError, t as ApiErrorCode } from \"../../../../../../chunks/api-errors.js\";\nimport { r as mintRawToken, t as hashToken } from \"../../../../../../chunks/token.server.js\";\nimport \"../../../../../../chunks/definitions.js\";\nimport { json } from \"@sveltejs/kit\";\nimport { randomUUID } from \"node:crypto\";\n//#region src/routes/api/definitions/[guid]/share-links/+server.ts\nfunction assertSharingEnabled() {\n\tif (!flag(\"ENABLE_SHARING\")) apiError(404, ApiErrorCode.NOT_FOUND, \"Share links are disabled on this instance (ENABLE_SHARING).\");\n}\nfunction strip(link) {\n\tconst { tokenHash: _omit, ...rest } = link;\n\treturn {\n\t\t...rest,\n\t\thasToken: true\n\t};\n}\nvar GET = async ({ params, locals }) => {\n\tassertSharingEnabled();\n\tconst guidParsed = GuidSchema.safeParse(params.guid);\n\tif (!guidParsed.success) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Invalid or missing GUID\");\n\tconst { ctx } = await requireEditableDefinition(locals, guidParsed.data);\n\ttry {\n\t\tconst page = await providers.data.shareLinks.listByDefinition(ctx, guidParsed.data, { limit: 200 });\n\t\treturn json({\n\t\t\tlinks: page.items.map(strip),\n\t\t\tnextCursor: page.nextCursor\n\t\t});\n\t} catch (err) {\n\t\thandleApiError(err, \"Failed to list share links\");\n\t}\n};\nvar POST = async ({ params, request, locals }) => {\n\tassertSharingEnabled();\n\tconst guidParsed = GuidSchema.safeParse(params.guid);\n\tif (!guidParsed.success) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Invalid or missing GUID\");\n\tconst { ctx } = await requireEditableDefinition(locals, guidParsed.data);\n\tconst body = await request.json().catch(() => ({}));\n\tconst parsed = CreateShareLinkInputSchema.safeParse(body);\n\tif (!parsed.success) throwZodError(parsed.error);\n\tconst raw = mintRawToken();\n\tconst now = (/* @__PURE__ */ new Date()).toISOString();\n\tconst link = {\n\t\tid: randomUUID(),\n\t\tdefinitionId: guidParsed.data,\n\t\tchannel: parsed.data.channel,\n\t\ttokenHash: hashToken(raw),\n\t\tname: parsed.data.name,\n\t\tcreatedBy: locals.user.id,\n\t\tcreatedAt: now,\n\t\texpiresAt: parsed.data.expiresAt ?? null,\n\t\trevokedAt: null,\n\t\tallowSolve: parsed.data.allowSolve,\n\t\tmaxSolves: parsed.data.maxSolves === void 0 ? DEFAULT_SHARE_LINK_MAX_SOLVES : parsed.data.maxSolves,\n\t\tsolveCount: 0\n\t};\n\ttry {\n\t\tawait providers.data.shareLinks.create(ctx, link);\n\t\treturn json({\n\t\t\tlink: strip(link),\n\t\t\ttoken: raw\n\t\t}, { status: 201 });\n\t} catch (err) {\n\t\thandleApiError(err, \"Failed to create share link\");\n\t}\n};\n//#endregion\nexport { GET, POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AASA;AACA,SAAS,oBAAoB,GAAG;AAChC,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,6DAA6D,CAAC;AAClI;AACA,SAAS,KAAK,CAAC,IAAI,EAAE;AACrB,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI;AAC3C,CAAC,OAAO;AACR,EAAE,GAAG,IAAI;AACT,EAAE,QAAQ,EAAE;AACZ,EAAE;AACF;AACG,IAAC,GAAG,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AACxC,CAAC,oBAAoB,EAAE;AACvB,CAAC,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;AACrD,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,yBAAyB,CAAC;AAClG,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC;AACzE,CAAC,IAAI;AACL,EAAE,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACrG,EAAE,OAAO,IAAI,CAAC;AACd,GAAG,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC;AAC/B,GAAG,UAAU,EAAE,IAAI,CAAC;AACpB,GAAG,CAAC;AACJ,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,cAAc,CAAC,GAAG,EAAE,4BAA4B,CAAC;AACnD,CAAC;AACD;AACG,IAAC,IAAI,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AAClD,CAAC,oBAAoB,EAAE;AACvB,CAAC,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;AACrD,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,yBAAyB,CAAC;AAClG,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC;AACzE,CAAC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;AACpD,CAAC,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,CAAC,IAAI,CAAC;AAC1D,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AACjD,CAAC,MAAM,GAAG,GAAG,YAAY,EAAE;AAC3B,CAAC,MAAM,GAAG,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACvD,CAAC,MAAM,IAAI,GAAG;AACd,EAAE,EAAE,EAAE,UAAU,EAAE;AAClB,EAAE,YAAY,EAAE,UAAU,CAAC,IAAI;AAC/B,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO;AAC9B,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC;AAC3B,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;AACxB,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;AAC3B,EAAE,SAAS,EAAE,GAAG;AAChB,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI;AAC1C,EAAE,SAAS,EAAE,IAAI;AACjB,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU;AACpC,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,MAAM,GAAG,6BAA6B,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS;AACrG,EAAE,UAAU,EAAE;AACd,EAAE;AACF,CAAC,IAAI;AACL,EAAE,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC;AACnD,EAAE,OAAO,IAAI,CAAC;AACd,GAAG,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC;AACpB,GAAG,KAAK,EAAE;AACV,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AACrB,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,cAAc,CAAC,GAAG,EAAE,6BAA6B,CAAC;AACpD,CAAC;AACD;;;;"}

package/build/server/chunks/entries/endpoints/api/definitions/_guid_/versions/_server.ts.js-CxxJA6un.js

@@ -0,0 +1,47 @@
+import { e as GuidSchema } from '../../../../../../chunks/src.js-C5mUn1eC.js';
+import { o as getDefinitionMeta } from '../../../../../../chunks/providers.server.js-BCmROUq1.js';
+import { o as requireCanViewProject } from '../../../../../../chunks/access.server.js-55bmpUSo.js';
+import { a as apiError, A as ApiErrorCode, h as handleApiError } from '../../../../../../chunks/api-errors.js-BdoYiwnt.js';
+import { json } from '@sveltejs/kit';
+import 'zod';
+import '../../../../../../chunks/shared-server.js-DA4m8f1m.js';
+import '../../../../../../chunks/limits.js-BniDP5VZ.js';
+import '../../../../../../chunks/chunk-Y3M7P3BW.js-qwxSY5dh.js';
+import '../../../../../../chunks/schema.js-BhmknPcU.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '../../../../../../chunks/utils2.js-V7yGq-Kd.js';
+
+//#region src/routes/api/definitions/[guid]/versions/+server.ts
+var GET = async ({ params, locals, url }) => {
+	const guidParsed = GuidSchema.safeParse(params.guid);
+	if (!guidParsed.success) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Invalid or missing GUID");
+	if (!locals.ctx) apiError(401, ApiErrorCode.UNAUTHORIZED, "Unauthorized");
+	const rawLimit = Number(url.searchParams.get("limit") ?? 50);
+	const limit = Number.isFinite(rawLimit) ? Math.min(Math.max(rawLimit, 1), 200) : 50;
+	const cursor = url.searchParams.get("cursor") ?? void 0;
+	try {
+		const def = await getDefinitionMeta().get(locals.ctx, guidParsed.data);
+		if (!def) apiError(404, ApiErrorCode.NOT_FOUND, "Definition not found");
+		await requireCanViewProject(locals, def.projectId);
+		const page = await getDefinitionMeta().listVersions(locals.ctx, guidParsed.data, {
+			limit,
+			cursor
+		});
+		return json({
+			versions: page.items,
+			nextCursor: page.nextCursor,
+			liveVersionId: def.liveVersionId,
+			draftVersionId: def.draftVersionId
+		});
+	} catch (err) {
+		handleApiError(err, "Failed to list versions");
+	}
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts.js-CxxJA6un.js.map

package/build/server/chunks/entries/endpoints/api/definitions/_guid_/versions/_server.ts.js-CxxJA6un.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-CxxJA6un.js","sources":["../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/definitions/_guid_/versions/_server.ts.js"],"sourcesContent":["import { s as GuidSchema } from \"../../../../../../chunks/src.js\";\nimport { s as getDefinitionMeta } from \"../../../../../../chunks/providers.server.js\";\nimport { h as requireCanViewProject } from \"../../../../../../chunks/access.server.js\";\nimport { n as apiError, r as handleApiError, t as ApiErrorCode } from \"../../../../../../chunks/api-errors.js\";\nimport \"../../../../../../chunks/definitions.js\";\nimport { json } from \"@sveltejs/kit\";\n//#region src/routes/api/definitions/[guid]/versions/+server.ts\nvar GET = async ({ params, locals, url }) => {\n\tconst guidParsed = GuidSchema.safeParse(params.guid);\n\tif (!guidParsed.success) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Invalid or missing GUID\");\n\tif (!locals.ctx) apiError(401, ApiErrorCode.UNAUTHORIZED, \"Unauthorized\");\n\tconst rawLimit = Number(url.searchParams.get(\"limit\") ?? 50);\n\tconst limit = Number.isFinite(rawLimit) ? Math.min(Math.max(rawLimit, 1), 200) : 50;\n\tconst cursor = url.searchParams.get(\"cursor\") ?? void 0;\n\ttry {\n\t\tconst def = await getDefinitionMeta().get(locals.ctx, guidParsed.data);\n\t\tif (!def) apiError(404, ApiErrorCode.NOT_FOUND, \"Definition not found\");\n\t\tawait requireCanViewProject(locals, def.projectId);\n\t\tconst page = await getDefinitionMeta().listVersions(locals.ctx, guidParsed.data, {\n\t\t\tlimit,\n\t\t\tcursor\n\t\t});\n\t\treturn json({\n\t\t\tversions: page.items,\n\t\t\tnextCursor: page.nextCursor,\n\t\t\tliveVersionId: def.liveVersionId,\n\t\t\tdraftVersionId: def.draftVersionId\n\t\t});\n\t} catch (err) {\n\t\thandleApiError(err, \"Failed to list versions\");\n\t}\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAMA;AACG,IAAC,GAAG,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK;AAC7C,CAAC,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;AACrD,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,yBAAyB,CAAC;AAClG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC;AAC1E,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;AAC7D,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,EAAE;AACpF,CAAC,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM;AACxD,CAAC,IAAI;AACL,EAAE,MAAM,GAAG,GAAG,MAAM,iBAAiB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC;AACxE,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,sBAAsB,CAAC;AACzE,EAAE,MAAM,qBAAqB,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC;AACpD,EAAE,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,EAAE;AACnF,GAAG,KAAK;AACR,GAAG;AACH,GAAG,CAAC;AACJ,EAAE,OAAO,IAAI,CAAC;AACd,GAAG,QAAQ,EAAE,IAAI,CAAC,KAAK;AACvB,GAAG,UAAU,EAAE,IAAI,CAAC,UAAU;AAC9B,GAAG,aAAa,EAAE,GAAG,CAAC,aAAa;AACnC,GAAG,cAAc,EAAE,GAAG,CAAC;AACvB,GAAG,CAAC;AACJ,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,cAAc,CAAC,GAAG,EAAE,yBAAyB,CAAC;AAChD,CAAC;AACD;;;;"}

package/build/server/chunks/entries/endpoints/api/definitions/_guid_/versions/_versionId_/_server.ts.js-DbJbMiPZ.js

@@ -0,0 +1,40 @@
+import { e as GuidSchema } from '../../../../../../../chunks/src.js-C5mUn1eC.js';
+import { E as getDefinitionService } from '../../../../../../../chunks/providers.server.js-BCmROUq1.js';
+import { n as requireEditableDefinition } from '../../../../../../../chunks/access.server.js-55bmpUSo.js';
+import { a as apiError, h as handleApiError, A as ApiErrorCode } from '../../../../../../../chunks/api-errors.js-BdoYiwnt.js';
+import 'zod';
+import '../../../../../../../chunks/shared-server.js-DA4m8f1m.js';
+import '../../../../../../../chunks/limits.js-BniDP5VZ.js';
+import '../../../../../../../chunks/chunk-Y3M7P3BW.js-qwxSY5dh.js';
+import '../../../../../../../chunks/schema.js-BhmknPcU.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '@sveltejs/kit';
+import '../../../../../../../chunks/utils2.js-V7yGq-Kd.js';
+
+//#region src/routes/api/definitions/[guid]/versions/[versionId]/+server.ts
+/**
+* DELETE /api/definitions/[guid]/versions/[versionId] — delete an old version.
+* Spec §6 protection: the store throws 409 if the version is currently
+* referenced by `liveVersionId` or `draftVersionId`. Repoint first.
+*/
+var DELETE = async ({ params, locals }) => {
+	const guidParsed = GuidSchema.safeParse(params.guid);
+	if (!guidParsed.success) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Invalid or missing GUID");
+	const versionParsed = GuidSchema.safeParse(params.versionId);
+	if (!versionParsed.success) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Invalid or missing version ID");
+	const { ctx } = await requireEditableDefinition(locals, guidParsed.data);
+	try {
+		await getDefinitionService().deleteVersion(ctx, guidParsed.data, versionParsed.data);
+		return new Response(null, { status: 204 });
+	} catch (err) {
+		handleApiError(err, "Failed to delete version");
+	}
+};
+
+export { DELETE };
+//# sourceMappingURL=_server.ts.js-DbJbMiPZ.js.map

package/build/server/chunks/entries/endpoints/api/definitions/_guid_/versions/_versionId_/_server.ts.js-DbJbMiPZ.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-DbJbMiPZ.js","sources":["../../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/definitions/_guid_/versions/_versionId_/_server.ts.js"],"sourcesContent":["import { s as GuidSchema } from \"../../../../../../../chunks/src.js\";\nimport { c as getDefinitionService } from \"../../../../../../../chunks/providers.server.js\";\nimport { g as requireEditableDefinition } from \"../../../../../../../chunks/access.server.js\";\nimport { n as apiError, r as handleApiError, t as ApiErrorCode } from \"../../../../../../../chunks/api-errors.js\";\nimport \"../../../../../../../chunks/definitions.js\";\n//#region src/routes/api/definitions/[guid]/versions/[versionId]/+server.ts\n/**\n* DELETE /api/definitions/[guid]/versions/[versionId] — delete an old version.\n* Spec §6 protection: the store throws 409 if the version is currently\n* referenced by `liveVersionId` or `draftVersionId`. Repoint first.\n*/\nvar DELETE = async ({ params, locals }) => {\n\tconst guidParsed = GuidSchema.safeParse(params.guid);\n\tif (!guidParsed.success) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Invalid or missing GUID\");\n\tconst versionParsed = GuidSchema.safeParse(params.versionId);\n\tif (!versionParsed.success) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Invalid or missing version ID\");\n\tconst { ctx } = await requireEditableDefinition(locals, guidParsed.data);\n\ttry {\n\t\tawait getDefinitionService().deleteVersion(ctx, guidParsed.data, versionParsed.data);\n\t\treturn new Response(null, { status: 204 });\n\t} catch (err) {\n\t\thandleApiError(err, \"Failed to delete version\");\n\t}\n};\n//#endregion\nexport { DELETE };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAKA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,MAAM,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AAC3C,CAAC,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;AACrD,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,yBAAyB,CAAC;AAClG,CAAC,MAAM,aAAa,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC;AAC7D,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,+BAA+B,CAAC;AAC3G,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC;AACzE,CAAC,IAAI;AACL,EAAE,MAAM,oBAAoB,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC;AACtF,EAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC5C,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,cAAc,CAAC,GAAG,EAAE,0BAA0B,CAAC;AACjD,CAAC;AACD;;;;"}

package/build/server/chunks/entries/endpoints/api/definitions/_server.ts.js-Dojg7QIG.js

@@ -0,0 +1,94 @@
+import { G as GH_EXTENSIONS, d as CreateDefinitionInputSchema } from '../../../../chunks/src.js-C5mUn1eC.js';
+import { f as getProjectProvider, C as fetchSchemaFromCompute, E as getDefinitionService } from '../../../../chunks/providers.server.js-BCmROUq1.js';
+import { m as requireCanCreateDefinition } from '../../../../chunks/access.server.js-55bmpUSo.js';
+import { a as apiError, t as throwZodError, r as resolveServerForOrg, h as handleApiError, A as ApiErrorCode } from '../../../../chunks/api-errors.js-BdoYiwnt.js';
+import { c as MAX_GH_FILE_SIZE, M as MAX_IMAGE_FILE_SIZE } from '../../../../chunks/computeLimits.js-Bv2Kbjk8.js';
+import { json } from '@sveltejs/kit';
+import { randomUUID } from 'node:crypto';
+import 'zod';
+import '../../../../chunks/shared-server.js-DA4m8f1m.js';
+import '../../../../chunks/limits.js-BniDP5VZ.js';
+import '../../../../chunks/chunk-Y3M7P3BW.js-qwxSY5dh.js';
+import '../../../../chunks/schema.js-BhmknPcU.js';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '../../../../chunks/utils2.js-V7yGq-Kd.js';
+import '../../../../chunks/compute.js-_N5R8pkI.js';
+import '../../../../chunks/chunk-S3VUIIRE.js-CeBwYPAp.js';
+import 'node:zlib';
+import 'node:util';
+import 'node:dns/promises';
+import 'node:net';
+
+//#region src/routes/api/definitions/+server.ts
+function parseTags(raw) {
+	if (typeof raw !== "string" || !raw.trim()) return void 0;
+	const tags = raw.split(",").map((t) => t.trim()).filter(Boolean);
+	return tags.length ? tags : void 0;
+}
+var POST = async ({ request, locals }) => {
+	const ctx = locals.ctx;
+	const formData = await request.formData();
+	const file = formData.get("file");
+	if (!(file instanceof File)) apiError(400, ApiErrorCode.VALIDATION_FAILED, "A Grasshopper (.gh or .ghx) file is required");
+	const ext = file.name.slice(file.name.lastIndexOf(".")).toLowerCase();
+	if (!GH_EXTENSIONS.includes(ext)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `File type not allowed. Allowed: ${GH_EXTENSIONS.join(", ")}`);
+	if (file.size > MAX_GH_FILE_SIZE) apiError(400, ApiErrorCode.VALIDATION_FAILED, `File too large. Max size: ${MAX_GH_FILE_SIZE / (1024 * 1024)} MB`);
+	const imageFile = formData.get("image");
+	if (imageFile instanceof File && imageFile.size > MAX_IMAGE_FILE_SIZE) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Image too large. Max size: ${MAX_IMAGE_FILE_SIZE / (1024 * 1024)} MB`);
+	let projectId = formData.get("projectId");
+	if (typeof projectId !== "string" || !projectId) {
+		if (!ctx.actingOrgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, "No active organization");
+		const defaultProject = (await getProjectProvider().listProjects(ctx, ctx.actingOrgId, { limit: 1 })).items[0];
+		if (!defaultProject) apiError(500, ApiErrorCode.INTERNAL, "No project configured");
+		projectId = defaultProject.id;
+	}
+	const { project } = await requireCanCreateDefinition(locals, projectId);
+	const parsed = CreateDefinitionInputSchema.safeParse({
+		displayName: formData.get("displayName"),
+		description: formData.get("description") || void 0,
+		category: formData.get("category") || void 0,
+		coverImage: formData.get("coverImage") || void 0,
+		tags: parseTags(formData.get("tags")),
+		projectId,
+		computeServerId: formData.get("computeServerId") || void 0
+	});
+	if (!parsed.success) throwZodError(parsed.error);
+	const fileExt = ext.slice(1);
+	const guid = randomUUID();
+	try {
+		const fileData = new Uint8Array(await file.arrayBuffer());
+		const schema = await fetchSchemaFromCompute(fileData, await resolveServerForOrg(ctx, project.orgId, { definitionPin: parsed.data.computeServerId ?? null }));
+		const { record, version } = await getDefinitionService().create(ctx, {
+			guid,
+			projectId: parsed.data.projectId,
+			ownerId: locals.user.id,
+			fileExt,
+			originalFilename: file.name,
+			computeServerId: parsed.data.computeServerId,
+			displayName: parsed.data.displayName.trim(),
+			description: parsed.data.description,
+			category: parsed.data.category,
+			tags: parsed.data.tags,
+			coverImage: parsed.data.coverImage
+		}, fileData, schema);
+		let coverImage = record.coverImage;
+		if (imageFile instanceof File && imageFile.size > 0) {
+			const imageData = new Uint8Array(await imageFile.arrayBuffer());
+			coverImage = await getDefinitionService().saveCoverImage(ctx, guid, imageData);
+		}
+		return json({
+			guid,
+			version,
+			coverImage
+		}, { status: 201 });
+	} catch (err) {
+		handleApiError(err, "Failed to create definition");
+	}
+};
+
+export { POST };
+//# sourceMappingURL=_server.ts.js-Dojg7QIG.js.map

package/build/server/chunks/entries/endpoints/api/definitions/_server.ts.js-Dojg7QIG.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-Dojg7QIG.js","sources":["../../../../../../../.svelte-kit/output/server/entries/endpoints/api/definitions/_server.ts.js"],"sourcesContent":["import { d as GH_EXTENSIONS, o as CreateDefinitionInputSchema } from \"../../../../chunks/src.js\";\nimport { _ as getProjectProvider, c as getDefinitionService, j as fetchSchemaFromCompute } from \"../../../../chunks/providers.server.js\";\nimport { o as requireCanCreateDefinition } from \"../../../../chunks/access.server.js\";\nimport { i as throwZodError, n as apiError, o as resolveServerForOrg, r as handleApiError, t as ApiErrorCode } from \"../../../../chunks/api-errors.js\";\nimport { f as MAX_GH_FILE_SIZE, p as MAX_IMAGE_FILE_SIZE } from \"../../../../chunks/computeLimits.js\";\nimport \"../../../../chunks/admin-config.js\";\nimport \"../../../../chunks/definitions.js\";\nimport { json } from \"@sveltejs/kit\";\nimport { randomUUID } from \"node:crypto\";\n//#region src/routes/api/definitions/+server.ts\nfunction parseTags(raw) {\n\tif (typeof raw !== \"string\" || !raw.trim()) return void 0;\n\tconst tags = raw.split(\",\").map((t) => t.trim()).filter(Boolean);\n\treturn tags.length ? tags : void 0;\n}\nvar POST = async ({ request, locals }) => {\n\tconst ctx = locals.ctx;\n\tconst formData = await request.formData();\n\tconst file = formData.get(\"file\");\n\tif (!(file instanceof File)) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"A Grasshopper (.gh or .ghx) file is required\");\n\tconst ext = file.name.slice(file.name.lastIndexOf(\".\")).toLowerCase();\n\tif (!GH_EXTENSIONS.includes(ext)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `File type not allowed. Allowed: ${GH_EXTENSIONS.join(\", \")}`);\n\tif (file.size > MAX_GH_FILE_SIZE) apiError(400, ApiErrorCode.VALIDATION_FAILED, `File too large. Max size: ${MAX_GH_FILE_SIZE / (1024 * 1024)} MB`);\n\tconst imageFile = formData.get(\"image\");\n\tif (imageFile instanceof File && imageFile.size > MAX_IMAGE_FILE_SIZE) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Image too large. Max size: ${MAX_IMAGE_FILE_SIZE / (1024 * 1024)} MB`);\n\tlet projectId = formData.get(\"projectId\");\n\tif (typeof projectId !== \"string\" || !projectId) {\n\t\tif (!ctx.actingOrgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"No active organization\");\n\t\tconst defaultProject = (await getProjectProvider().listProjects(ctx, ctx.actingOrgId, { limit: 1 })).items[0];\n\t\tif (!defaultProject) apiError(500, ApiErrorCode.INTERNAL, \"No project configured\");\n\t\tprojectId = defaultProject.id;\n\t}\n\tconst { project } = await requireCanCreateDefinition(locals, projectId);\n\tconst parsed = CreateDefinitionInputSchema.safeParse({\n\t\tdisplayName: formData.get(\"displayName\"),\n\t\tdescription: formData.get(\"description\") || void 0,\n\t\tcategory: formData.get(\"category\") || void 0,\n\t\tcoverImage: formData.get(\"coverImage\") || void 0,\n\t\ttags: parseTags(formData.get(\"tags\")),\n\t\tprojectId,\n\t\tcomputeServerId: formData.get(\"computeServerId\") || void 0\n\t});\n\tif (!parsed.success) throwZodError(parsed.error);\n\tconst fileExt = ext.slice(1);\n\tconst guid = randomUUID();\n\ttry {\n\t\tconst fileData = new Uint8Array(await file.arrayBuffer());\n\t\tconst schema = await fetchSchemaFromCompute(fileData, await resolveServerForOrg(ctx, project.orgId, { definitionPin: parsed.data.computeServerId ?? null }));\n\t\tconst { record, version } = await getDefinitionService().create(ctx, {\n\t\t\tguid,\n\t\t\tprojectId: parsed.data.projectId,\n\t\t\townerId: locals.user.id,\n\t\t\tfileExt,\n\t\t\toriginalFilename: file.name,\n\t\t\tcomputeServerId: parsed.data.computeServerId,\n\t\t\tdisplayName: parsed.data.displayName.trim(),\n\t\t\tdescription: parsed.data.description,\n\t\t\tcategory: parsed.data.category,\n\t\t\ttags: parsed.data.tags,\n\t\t\tcoverImage: parsed.data.coverImage\n\t\t}, fileData, schema);\n\t\tlet coverImage = record.coverImage;\n\t\tif (imageFile instanceof File && imageFile.size > 0) {\n\t\t\tconst imageData = new Uint8Array(await imageFile.arrayBuffer());\n\t\t\tcoverImage = await getDefinitionService().saveCoverImage(ctx, guid, imageData);\n\t\t}\n\t\treturn json({\n\t\t\tguid,\n\t\t\tversion,\n\t\t\tcoverImage\n\t\t}, { status: 201 });\n\t} catch (err) {\n\t\thandleApiError(err, \"Failed to create definition\");\n\t}\n};\n//#endregion\nexport { POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AASA;AACA,SAAS,SAAS,CAAC,GAAG,EAAE;AACxB,CAAC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,MAAM;AAC1D,CAAC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;AACjE,CAAC,OAAO,IAAI,CAAC,MAAM,GAAG,IAAI,GAAG,MAAM;AACnC;AACG,IAAC,IAAI,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AAC1C,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACvB,CAAC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE;AAC1C,CAAC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;AAClC,CAAC,IAAI,EAAE,IAAI,YAAY,IAAI,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,8CAA8C,CAAC;AAC3H,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE;AACtE,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,gCAAgC,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC/I,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,gBAAgB,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,0BAA0B,EAAE,gBAAgB,IAAI,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AACpJ,CAAC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;AACxC,CAAC,IAAI,SAAS,YAAY,IAAI,IAAI,SAAS,CAAC,IAAI,GAAG,mBAAmB,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,2BAA2B,EAAE,mBAAmB,IAAI,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AAC7L,CAAC,IAAI,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1C,CAAC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,EAAE;AAClD,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;AAC/F,EAAE,MAAM,cAAc,GAAG,CAAC,MAAM,kBAAkB,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AAC/G,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,uBAAuB,CAAC;AACpF,EAAE,SAAS,GAAG,cAAc,CAAC,EAAE;AAC/B,CAAC;AACD,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,0BAA0B,CAAC,MAAM,EAAE,SAAS,CAAC;AACxE,CAAC,MAAM,MAAM,GAAG,2BAA2B,CAAC,SAAS,CAAC;AACtD,EAAE,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC;AAC1C,EAAE,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,MAAM;AACpD,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,MAAM;AAC9C,EAAE,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,MAAM;AAClD,EAAE,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACvC,EAAE,SAAS;AACX,EAAE,eAAe,EAAE,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI;AACtD,EAAE,CAAC;AACH,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AACjD,CAAC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7B,CAAC,MAAM,IAAI,GAAG,UAAU,EAAE;AAC1B,CAAC,IAAI;AACL,EAAE,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;AAC3D,EAAE,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,QAAQ,EAAE,MAAM,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,IAAI,IAAI,EAAE,CAAC,CAAC;AAC9J,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE;AACvE,GAAG,IAAI;AACP,GAAG,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;AACnC,GAAG,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;AAC1B,GAAG,OAAO;AACV,GAAG,gBAAgB,EAAE,IAAI,CAAC,IAAI;AAC9B,GAAG,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe;AAC/C,GAAG,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE;AAC9C,GAAG,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;AACvC,GAAG,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;AACjC,GAAG,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;AACzB,GAAG,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC;AAC3B,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC;AACtB,EAAE,IAAI,UAAU,GAAG,MAAM,CAAC,UAAU;AACpC,EAAE,IAAI,SAAS,YAAY,IAAI,IAAI,SAAS,CAAC,IAAI,GAAG,CAAC,EAAE;AACvD,GAAG,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,MAAM,SAAS,CAAC,WAAW,EAAE,CAAC;AAClE,GAAG,UAAU,GAAG,MAAM,oBAAoB,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC;AACjF,EAAE;AACF,EAAE,OAAO,IAAI,CAAC;AACd,GAAG,IAAI;AACP,GAAG,OAAO;AACV,GAAG;AACH,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AACrB,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,cAAc,CAAC,GAAG,EAAE,6BAA6B,CAAC;AACpD,CAAC;AACD;;;;"}

package/build/server/chunks/entries/endpoints/api/diag/throughput/_server.ts.js-B74eCnn7.js

@@ -0,0 +1,59 @@
+import { b as private_env } from '../../../../../chunks/shared-server.js-DA4m8f1m.js';
+import { a as apiError, A as ApiErrorCode } from '../../../../../chunks/api-errors.js-BdoYiwnt.js';
+import { randomFillSync } from 'node:crypto';
+import '../../../../../chunks/src.js-C5mUn1eC.js';
+import 'zod';
+import '../../../../../chunks/providers.server.js-BCmROUq1.js';
+import '../../../../../chunks/limits.js-BniDP5VZ.js';
+import '../../../../../chunks/chunk-Y3M7P3BW.js-qwxSY5dh.js';
+import '../../../../../chunks/schema.js-BhmknPcU.js';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '../../../../../chunks/utils2.js-V7yGq-Kd.js';
+import '@sveltejs/kit';
+
+//#region src/routes/api/diag/throughput/+server.ts
+var COMPUTE_DEBUG = [
+	"true",
+	"1",
+	"yes"
+].includes((private_env.SELVA_FLAG_COMPUTE_DEBUG ?? "").toLowerCase());
+var CHUNK_BYTES = 1024 * 1024;
+var DEFAULT_MB = 20;
+var MAX_MB = 64;
+var GET = async ({ locals, url }) => {
+	if (!COMPUTE_DEBUG) apiError(404, ApiErrorCode.NOT_FOUND, "Not found");
+	if (!locals.user) apiError(401, ApiErrorCode.UNAUTHORIZED, "Unauthorized");
+	const requested = Number(url.searchParams.get("mb"));
+	const mb = Math.min(MAX_MB, Math.max(1, Number.isFinite(requested) ? requested : DEFAULT_MB));
+	let sentChunks = 0;
+	const start = performance.now();
+	const stream = new ReadableStream({ pull(controller) {
+		if (sentChunks >= mb) {
+			controller.close();
+			const secs = (performance.now() - start) / 1e3;
+			locals.log.debug("Streamed throughput probe (server-side view)", {
+				component: "Compute/diag",
+				megabytes: mb,
+				durationSec: Number(secs.toFixed(1)),
+				throughputMbPerSec: Number((mb / secs).toFixed(1))
+			});
+			return;
+		}
+		const chunk = new Uint8Array(CHUNK_BYTES);
+		randomFillSync(chunk);
+		controller.enqueue(chunk);
+		sentChunks++;
+	} });
+	return new Response(stream, { headers: {
+		"Content-Type": "application/octet-stream",
+		"Content-Length": String(mb * CHUNK_BYTES),
+		"Cache-Control": "no-store"
+	} });
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts.js-B74eCnn7.js.map

package/build/server/chunks/entries/endpoints/api/diag/throughput/_server.ts.js-B74eCnn7.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-B74eCnn7.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/diag/throughput/_server.ts.js"],"sourcesContent":["import { t as private_env } from \"../../../../../chunks/shared-server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\nimport { randomFillSync } from \"node:crypto\";\n//#region src/routes/api/diag/throughput/+server.ts\nvar COMPUTE_DEBUG = [\n\t\"true\",\n\t\"1\",\n\t\"yes\"\n].includes((private_env.SELVA_FLAG_COMPUTE_DEBUG ?? \"\").toLowerCase());\nvar CHUNK_BYTES = 1024 * 1024;\nvar DEFAULT_MB = 20;\nvar MAX_MB = 64;\nvar GET = async ({ locals, url }) => {\n\tif (!COMPUTE_DEBUG) apiError(404, ApiErrorCode.NOT_FOUND, \"Not found\");\n\tif (!locals.user) apiError(401, ApiErrorCode.UNAUTHORIZED, \"Unauthorized\");\n\tconst requested = Number(url.searchParams.get(\"mb\"));\n\tconst mb = Math.min(MAX_MB, Math.max(1, Number.isFinite(requested) ? requested : DEFAULT_MB));\n\tlet sentChunks = 0;\n\tconst start = performance.now();\n\tconst stream = new ReadableStream({ pull(controller) {\n\t\tif (sentChunks >= mb) {\n\t\t\tcontroller.close();\n\t\t\tconst secs = (performance.now() - start) / 1e3;\n\t\t\tlocals.log.debug(\"Streamed throughput probe (server-side view)\", {\n\t\t\t\tcomponent: \"Compute/diag\",\n\t\t\t\tmegabytes: mb,\n\t\t\t\tdurationSec: Number(secs.toFixed(1)),\n\t\t\t\tthroughputMbPerSec: Number((mb / secs).toFixed(1))\n\t\t\t});\n\t\t\treturn;\n\t\t}\n\t\tconst chunk = new Uint8Array(CHUNK_BYTES);\n\t\trandomFillSync(chunk);\n\t\tcontroller.enqueue(chunk);\n\t\tsentChunks++;\n\t} });\n\treturn new Response(stream, { headers: {\n\t\t\"Content-Type\": \"application/octet-stream\",\n\t\t\"Content-Length\": String(mb * CHUNK_BYTES),\n\t\t\"Cache-Control\": \"no-store\"\n\t} });\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAGA;AACA,IAAI,aAAa,GAAG;AACpB,CAAC,MAAM;AACP,CAAC,GAAG;AACJ,CAAC;AACD,CAAC,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,wBAAwB,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC;AACtE,IAAI,WAAW,GAAG,IAAI,GAAG,IAAI;AAC7B,IAAI,UAAU,GAAG,EAAE;AACnB,IAAI,MAAM,GAAG,EAAE;AACZ,IAAC,GAAG,GAAG,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK;AACrC,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,WAAW,CAAC;AACvE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC;AAC3E,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACrD,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,SAAS,GAAG,UAAU,CAAC,CAAC;AAC9F,CAAC,IAAI,UAAU,GAAG,CAAC;AACnB,CAAC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;AAChC,CAAC,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE;AACtD,EAAE,IAAI,UAAU,IAAI,EAAE,EAAE;AACxB,GAAG,UAAU,CAAC,KAAK,EAAE;AACrB,GAAG,MAAM,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG;AACjD,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,8CAA8C,EAAE;AACpE,IAAI,SAAS,EAAE,cAAc;AAC7B,IAAI,SAAS,EAAE,EAAE;AACjB,IAAI,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACxC,IAAI,kBAAkB,EAAE,MAAM,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;AACrD,IAAI,CAAC;AACL,GAAG;AACH,EAAE;AACF,EAAE,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC;AAC3C,EAAE,cAAc,CAAC,KAAK,CAAC;AACvB,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;AAC3B,EAAE,UAAU,EAAE;AACd,CAAC,CAAC,EAAE,CAAC;AACL,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE;AACxC,EAAE,cAAc,EAAE,0BAA0B;AAC5C,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,GAAG,WAAW,CAAC;AAC5C,EAAE,eAAe,EAAE;AACnB,EAAE,EAAE,CAAC;AACL;;;;"}

package/build/server/chunks/entries/endpoints/api/files/_...path_/_server.ts.js-BzclyMf8.js

@@ -0,0 +1,89 @@
+import { c as classifyAssetPath, e as GuidSchema, g as COVER_IMAGE_CONTENT_TYPES } from '../../../../../chunks/src.js-C5mUn1eC.js';
+import { o as getDefinitionMeta, F as definitionPaths, x as getStorageProvider } from '../../../../../chunks/providers.server.js-BCmROUq1.js';
+import { o as requireCanViewProject, q as requireCanViewOrg } from '../../../../../chunks/access.server.js-55bmpUSo.js';
+import { a as apiError, A as ApiErrorCode } from '../../../../../chunks/api-errors.js-BdoYiwnt.js';
+import 'zod';
+import '../../../../../chunks/shared-server.js-DA4m8f1m.js';
+import '../../../../../chunks/limits.js-BniDP5VZ.js';
+import '../../../../../chunks/chunk-Y3M7P3BW.js-qwxSY5dh.js';
+import '../../../../../chunks/schema.js-BhmknPcU.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '@sveltejs/kit';
+import '../../../../../chunks/utils2.js-V7yGq-Kd.js';
+
+//#region src/routes/api/files/[...path]/+server.ts
+/**
+* Authenticated/­public blob proxy. The set of servable paths is the closed
+* asset-class registry (`classifyAssetPath` / `ASSET_CLASSES` in
+* `@selvajs/platform`). Each class declares a visibility; this route maps that
+* visibility to an authorization check:
+*
+*   - `public`  (org branding — logo/favicon): served to anyone, incl.
+*     logged-out visitors, with no auth. Cacheable. The bytes are always a
+*     rasterized WebP, so there is no XSS surface to gate.
+*   - `org`     (org-private blobs, e.g. pricing sheets under
+*     `orgs/{id}/private/*`): `requireCanViewOrg(orgId)`.
+*   - `project` (definition covers): `requireCanViewProject(projectId)` — the
+*     M5 hardening, unchanged.
+*
+* Anything that classifies to no asset class 404s. New blob types are opt-in:
+* add a registry entry with the right visibility — never a generic
+* "is the extension allowed" fallthrough. Authorization lives here (the route),
+* not in the storage layer, per `IStorageProvider`'s contract.
+*
+* Why a single proxy for all three: with the registry, the route is no longer a
+* pile of per-shape branches — it classifies once and dispatches on visibility,
+* so the cover-only contract that this route used to pin now generalizes
+* without re-opening the M5 hole.
+*/
+var CONTENT_TYPE_BY_EXT = {
+	...COVER_IMAGE_CONTENT_TYPES,
+	".pdf": "application/pdf"
+};
+function contentTypeFor(storagePath) {
+	const dot = storagePath.lastIndexOf(".");
+	return CONTENT_TYPE_BY_EXT[dot === -1 ? "" : storagePath.slice(dot).toLowerCase()] ?? "application/octet-stream";
+}
+var GET = async ({ params, locals }) => {
+	const storagePath = params.path;
+	if (!storagePath) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Missing path");
+	const match = classifyAssetPath(storagePath);
+	if (!match) apiError(404, ApiErrorCode.NOT_FOUND, "File not found");
+	let canonicalPath = storagePath;
+	switch (match.class.visibility) {
+		case "public": break;
+		case "org": {
+			if (!locals.ctx) apiError(401, ApiErrorCode.UNAUTHORIZED, "Unauthorized");
+			const orgId = match.scopeId;
+			if (!orgId) apiError(404, ApiErrorCode.NOT_FOUND, "File not found");
+			await requireCanViewOrg(locals, orgId);
+			break;
+		}
+		case "project": {
+			if (!locals.ctx) apiError(401, ApiErrorCode.UNAUTHORIZED, "Unauthorized");
+			const guid = match.scopeId;
+			const guidParsed = GuidSchema.safeParse(guid);
+			if (!guidParsed.success) apiError(404, ApiErrorCode.NOT_FOUND, "File not found");
+			const record = await getDefinitionMeta().get(locals.ctx, guidParsed.data);
+			if (!record) apiError(404, ApiErrorCode.NOT_FOUND, "File not found");
+			await requireCanViewProject(locals, record.projectId);
+			canonicalPath = definitionPaths.image(guidParsed.data);
+			break;
+		}
+	}
+	const bytes = await getStorageProvider().get(canonicalPath);
+	if (!bytes) apiError(404, ApiErrorCode.NOT_FOUND, "File not found");
+	const cacheControl = match.class.visibility === "public" ? "public, max-age=3600" : "private, max-age=3600";
+	return new Response(Buffer.from(bytes), { headers: {
+		"Content-Type": contentTypeFor(canonicalPath),
+		"Cache-Control": cacheControl
+	} });
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts.js-BzclyMf8.js.map

package/build/server/chunks/entries/endpoints/api/files/_...path_/_server.ts.js-BzclyMf8.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-BzclyMf8.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/files/_...path_/_server.ts.js"],"sourcesContent":["import { r as classifyAssetPath, s as GuidSchema, u as COVER_IMAGE_CONTENT_TYPES } from \"../../../../../chunks/src.js\";\nimport { I as definitionPaths, s as getDefinitionMeta, y as getStorageProvider } from \"../../../../../chunks/providers.server.js\";\nimport { h as requireCanViewProject, m as requireCanViewOrg } from \"../../../../../chunks/access.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\n//#region src/routes/api/files/[...path]/+server.ts\n/**\n* Authenticated/­public blob proxy. The set of servable paths is the closed\n* asset-class registry (`classifyAssetPath` / `ASSET_CLASSES` in\n* `@selvajs/platform`). Each class declares a visibility; this route maps that\n* visibility to an authorization check:\n*\n*   - `public`  (org branding — logo/favicon): served to anyone, incl.\n*     logged-out visitors, with no auth. Cacheable. The bytes are always a\n*     rasterized WebP, so there is no XSS surface to gate.\n*   - `org`     (org-private blobs, e.g. pricing sheets under\n*     `orgs/{id}/private/*`): `requireCanViewOrg(orgId)`.\n*   - `project` (definition covers): `requireCanViewProject(projectId)` — the\n*     M5 hardening, unchanged.\n*\n* Anything that classifies to no asset class 404s. New blob types are opt-in:\n* add a registry entry with the right visibility — never a generic\n* \"is the extension allowed\" fallthrough. Authorization lives here (the route),\n* not in the storage layer, per `IStorageProvider`'s contract.\n*\n* Why a single proxy for all three: with the registry, the route is no longer a\n* pile of per-shape branches — it classifies once and dispatches on visibility,\n* so the cover-only contract that this route used to pin now generalizes\n* without re-opening the M5 hole.\n*/\nvar CONTENT_TYPE_BY_EXT = {\n\t...COVER_IMAGE_CONTENT_TYPES,\n\t\".pdf\": \"application/pdf\"\n};\nfunction contentTypeFor(storagePath) {\n\tconst dot = storagePath.lastIndexOf(\".\");\n\treturn CONTENT_TYPE_BY_EXT[dot === -1 ? \"\" : storagePath.slice(dot).toLowerCase()] ?? \"application/octet-stream\";\n}\nvar GET = async ({ params, locals }) => {\n\tconst storagePath = params.path;\n\tif (!storagePath) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing path\");\n\tconst match = classifyAssetPath(storagePath);\n\tif (!match) apiError(404, ApiErrorCode.NOT_FOUND, \"File not found\");\n\tlet canonicalPath = storagePath;\n\tswitch (match.class.visibility) {\n\t\tcase \"public\": break;\n\t\tcase \"org\": {\n\t\t\tif (!locals.ctx) apiError(401, ApiErrorCode.UNAUTHORIZED, \"Unauthorized\");\n\t\t\tconst orgId = match.scopeId;\n\t\t\tif (!orgId) apiError(404, ApiErrorCode.NOT_FOUND, \"File not found\");\n\t\t\tawait requireCanViewOrg(locals, orgId);\n\t\t\tbreak;\n\t\t}\n\t\tcase \"project\": {\n\t\t\tif (!locals.ctx) apiError(401, ApiErrorCode.UNAUTHORIZED, \"Unauthorized\");\n\t\t\tconst guid = match.scopeId;\n\t\t\tconst guidParsed = GuidSchema.safeParse(guid);\n\t\t\tif (!guidParsed.success) apiError(404, ApiErrorCode.NOT_FOUND, \"File not found\");\n\t\t\tconst record = await getDefinitionMeta().get(locals.ctx, guidParsed.data);\n\t\t\tif (!record) apiError(404, ApiErrorCode.NOT_FOUND, \"File not found\");\n\t\t\tawait requireCanViewProject(locals, record.projectId);\n\t\t\tcanonicalPath = definitionPaths.image(guidParsed.data);\n\t\t\tbreak;\n\t\t}\n\t}\n\tconst bytes = await getStorageProvider().get(canonicalPath);\n\tif (!bytes) apiError(404, ApiErrorCode.NOT_FOUND, \"File not found\");\n\tconst cacheControl = match.class.visibility === \"public\" ? \"public, max-age=3600\" : \"private, max-age=3600\";\n\treturn new Response(Buffer.from(bytes), { headers: {\n\t\t\"Content-Type\": contentTypeFor(canonicalPath),\n\t\t\"Cache-Control\": cacheControl\n\t} });\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,mBAAmB,GAAG;AAC1B,CAAC,GAAG,yBAAyB;AAC7B,CAAC,MAAM,EAAE;AACT,CAAC;AACD,SAAS,cAAc,CAAC,WAAW,EAAE;AACrC,CAAC,MAAM,GAAG,GAAG,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC;AACzC,CAAC,OAAO,mBAAmB,CAAC,GAAG,KAAK,EAAE,GAAG,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,0BAA0B;AACjH;AACG,IAAC,GAAG,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AACxC,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI;AAChC,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,cAAc,CAAC;AAChF,CAAC,MAAM,KAAK,GAAG,iBAAiB,CAAC,WAAW,CAAC;AAC7C,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gBAAgB,CAAC;AACpE,CAAC,IAAI,aAAa,GAAG,WAAW;AAChC,CAAC,QAAQ,KAAK,CAAC,KAAK,CAAC,UAAU;AAC/B,EAAE,KAAK,QAAQ,EAAE;AACjB,EAAE,KAAK,KAAK,EAAE;AACd,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC;AAC5E,GAAG,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO;AAC9B,GAAG,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gBAAgB,CAAC;AACtE,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC;AACzC,GAAG;AACH,EAAE;AACF,EAAE,KAAK,SAAS,EAAE;AAClB,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC;AAC5E,GAAG,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO;AAC7B,GAAG,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC;AAChD,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gBAAgB,CAAC;AACnF,GAAG,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC;AAC5E,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gBAAgB,CAAC;AACvE,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC;AACxD,GAAG,aAAa,GAAG,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;AACzD,GAAG;AACH,EAAE;AACF;AACA,CAAC,MAAM,KAAK,GAAG,MAAM,kBAAkB,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC;AAC5D,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gBAAgB,CAAC;AACpE,CAAC,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,KAAK,QAAQ,GAAG,sBAAsB,GAAG,uBAAuB;AAC5G,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE;AACpD,EAAE,cAAc,EAAE,cAAc,CAAC,aAAa,CAAC;AAC/C,EAAE,eAAe,EAAE;AACnB,EAAE,EAAE,CAAC;AACL;;;;"}

package/build/server/chunks/entries/endpoints/api/health/_server.ts.js-A00t9oxG.js

@@ -0,0 +1,56 @@
+import { g as getBootHealth, i as isDegraded } from '../../../../chunks/bootHealth.server.js-s-jZ2KDW.js';
+import { json } from '@sveltejs/kit';
+import { randomUUID } from 'crypto';
+import { createRequire } from 'module';
+import '../../../../chunks/providers.server.js-BCmROUq1.js';
+import '../../../../chunks/shared-server.js-DA4m8f1m.js';
+import '../../../../chunks/src.js-C5mUn1eC.js';
+import 'zod';
+import '../../../../chunks/limits.js-BniDP5VZ.js';
+import '../../../../chunks/chunk-Y3M7P3BW.js-qwxSY5dh.js';
+import '../../../../chunks/schema.js-BhmknPcU.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+
+//#region src/routes/api/health/+server.ts
+var INSTANCE_ID = randomUUID();
+var RUNTIME_VERSION = (() => {
+	try {
+		return createRequire(import.meta.url)("@selvajs/selva/package.json").version;
+	} catch {
+		return null;
+	}
+})();
+/**
+* Health check endpoint for load balancers and orchestration systems.
+* Used by Docker healthchecks, Kubernetes liveness probes, and monitoring tools.
+*
+* The `instanceId` field is a per-boot fingerprint — clients polling after a
+* restart confirm the *new* process is responding (not the old one about to be
+* killed) by watching for the value to change.
+*
+* Returns 503 with `status: "degraded"` when boot-time integrity checks
+* failed (e.g. compute server apiKeys can't be decrypted under the current
+* `SELVA_AT_REST_KEY`). The body lists which servers and why, so an operator
+* curling the endpoint can diagnose without server-log access. The app
+* still serves requests in this state (per-row tolerance) — the 503 is
+* specifically a signal for load balancers / monitoring.
+*/
+var GET = async () => {
+	const boot = await getBootHealth();
+	const degraded = isDegraded(boot);
+	return json({
+		status: degraded ? "degraded" : "ok",
+		timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+		instanceId: INSTANCE_ID,
+		version: RUNTIME_VERSION,
+		boot
+	}, { status: degraded ? 503 : 200 });
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts.js-A00t9oxG.js.map

package/build/server/chunks/entries/endpoints/api/health/_server.ts.js-A00t9oxG.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-A00t9oxG.js","sources":["../../../../../../../.svelte-kit/output/server/entries/endpoints/api/health/_server.ts.js"],"sourcesContent":["import { n as isDegraded, t as getBootHealth } from \"../../../../chunks/bootHealth.server.js\";\nimport { json } from \"@sveltejs/kit\";\nimport { randomUUID } from \"crypto\";\nimport { createRequire } from \"module\";\n//#region src/routes/api/health/+server.ts\nvar INSTANCE_ID = randomUUID();\nvar RUNTIME_VERSION = (() => {\n\ttry {\n\t\treturn createRequire(import.meta.url)(\"@selvajs/selva/package.json\").version;\n\t} catch {\n\t\treturn null;\n\t}\n})();\n/**\n* Health check endpoint for load balancers and orchestration systems.\n* Used by Docker healthchecks, Kubernetes liveness probes, and monitoring tools.\n*\n* The `instanceId` field is a per-boot fingerprint — clients polling after a\n* restart confirm the *new* process is responding (not the old one about to be\n* killed) by watching for the value to change.\n*\n* Returns 503 with `status: \"degraded\"` when boot-time integrity checks\n* failed (e.g. compute server apiKeys can't be decrypted under the current\n* `SELVA_AT_REST_KEY`). The body lists which servers and why, so an operator\n* curling the endpoint can diagnose without server-log access. The app\n* still serves requests in this state (per-row tolerance) — the 503 is\n* specifically a signal for load balancers / monitoring.\n*/\nvar GET = async () => {\n\tconst boot = await getBootHealth();\n\tconst degraded = isDegraded(boot);\n\treturn json({\n\t\tstatus: degraded ? \"degraded\" : \"ok\",\n\t\ttimestamp: (/* @__PURE__ */ new Date()).toISOString(),\n\t\tinstanceId: INSTANCE_ID,\n\t\tversion: RUNTIME_VERSION,\n\t\tboot\n\t}, { status: degraded ? 503 : 200 });\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAIA;AACA,IAAI,WAAW,GAAG,UAAU,EAAE;AAC9B,IAAI,eAAe,GAAG,CAAC,MAAM;AAC7B,CAAC,IAAI;AACL,EAAE,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,6BAA6B,CAAC,CAAC,OAAO;AAC9E,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,IAAI;AACb,CAAC;AACD,CAAC,GAAG;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,GAAG,GAAG,YAAY;AACtB,CAAC,MAAM,IAAI,GAAG,MAAM,aAAa,EAAE;AACnC,CAAC,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC;AAClC,CAAC,OAAO,IAAI,CAAC;AACb,EAAE,MAAM,EAAE,QAAQ,GAAG,UAAU,GAAG,IAAI;AACtC,EAAE,SAAS,EAAE,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACvD,EAAE,UAAU,EAAE,WAAW;AACzB,EAAE,OAAO,EAAE,eAAe;AAC1B,EAAE;AACF,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,GAAG,GAAG,GAAG,GAAG,EAAE,CAAC;AACrC;;;;"}