@selvajs/selva 4.7.1 → 4.7.3

package/build/server/chunks/chunks/api-errors.js-DfP5l2xL.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-errors.js-DfP5l2xL.js","sources":["../../../../.svelte-kit/output/server/chunks/api-errors.js"],"sourcesContent":["import \"./src.js\";\nimport { A as SchemaExtractionError, M as ProviderError, a as getComputeServerConfigStore } from \"./providers.server.js\";\nimport { i as resolveServerForOrg$1 } from \"./utils2.js\";\nimport { error, isHttpError } from \"@sveltejs/kit\";\n//#region src/lib/server/compute/resolve.server.ts\n/**\n* Thrown when no compute server is configured or visible for the org — a\n* misconfiguration an operator must fix in `/admin/compute`, not a bug. Routes\n* map this to 503 with operator guidance instead of letting the pure helper's\n* plain `Error` surface as a generic 500. `handleApiError` recognizes it; the\n* two compute routes that don't route through `handleApiError` map it inline.\n*/\nvar ComputeServerUnconfiguredError = class extends Error {\n\tconstructor(message = \"No compute server configured. Ask an admin to add one in /admin/compute.\") {\n\t\tsuper(message);\n\t\tthis.name = \"ComputeServerUnconfiguredError\";\n\t}\n};\n/**\n* Spec §3 — pick the right Rhino.Compute server for a (org, definition) pair.\n*\n* Resolution order, narrowest wins:\n*   1. `definitionPin` if it points at a server visible to `orgId`.\n*   2. `orgDefaults[orgId]` if set and visible.\n*   3. Global `defaultServerId`.\n*\n* The store returns the full config; the visibility predicate runs in the\n* pure helper so callers don't reimplement it. Re-throws the pure helper's\n* \"nothing visible\" failure as a typed `ComputeServerUnconfiguredError` so\n* callers can map it to a 503 with operator guidance.\n*\n* Selection reads a key-free config and fetches the `apiKey` only for the server\n* that actually wins (audit 4b) — resolving used to decrypt every configured\n* server's key on every solve to use exactly one of them.\n*/\nasync function resolveServerForOrg(ctx, orgId, opts = {}) {\n\tconst store = getComputeServerConfigStore();\n\tconst config = await store.getConfig(ctx);\n\tlet server;\n\ttry {\n\t\tserver = resolveServerForOrg$1(config, orgId, { definitionPin: opts.definitionPin });\n\t} catch (err) {\n\t\tthrow new ComputeServerUnconfiguredError(err instanceof Error ? err.message : void 0);\n\t}\n\tif (!server.hasApiKey) return server;\n\treturn {\n\t\t...server,\n\t\tapiKey: await store.getServerApiKey(ctx, server.id)\n\t};\n}\n//#endregion\n//#region src/lib/server/api-errors.ts\n/** Stable, machine-readable error codes. Append-only — never renumber/rename. */\nvar ApiErrorCode = {\n\tVALIDATION_FAILED: \"VALIDATION_FAILED\",\n\tUNAUTHORIZED: \"UNAUTHORIZED\",\n\tFORBIDDEN: \"FORBIDDEN\",\n\tNOT_FOUND: \"NOT_FOUND\",\n\tCONFLICT: \"CONFLICT\",\n\tUNPROCESSABLE: \"UNPROCESSABLE\",\n\tCOMPUTE_UNAVAILABLE: \"COMPUTE_UNAVAILABLE\",\n\tSETUP_REQUIRED: \"SETUP_REQUIRED\",\n\tINTERNAL: \"INTERNAL\"\n};\n/**\n* Raise a structured API error. Thin wrapper over SvelteKit's `error()` that\n* forces the `{ message, code }` envelope. Use this instead of\n* `error(status, 'message string')` so every error carries a code.\n*/\nfunction apiError(status, code, message, fields) {\n\tthrow error(status, fields ? {\n\t\tmessage,\n\t\tcode,\n\t\tfields\n\t} : {\n\t\tmessage,\n\t\tcode\n\t});\n}\n/** Default code for a given HTTP status, used when mapping opaque errors. */\nfunction codeForStatus(status) {\n\tswitch (status) {\n\t\tcase 400: return ApiErrorCode.VALIDATION_FAILED;\n\t\tcase 401: return ApiErrorCode.UNAUTHORIZED;\n\t\tcase 403: return ApiErrorCode.FORBIDDEN;\n\t\tcase 404: return ApiErrorCode.NOT_FOUND;\n\t\tcase 409: return ApiErrorCode.CONFLICT;\n\t\tcase 422: return ApiErrorCode.UNPROCESSABLE;\n\t\tcase 503: return ApiErrorCode.COMPUTE_UNAVAILABLE;\n\t\tdefault: return ApiErrorCode.INTERNAL;\n\t}\n}\nvar UNIQUE_CONSTRAINT_MESSAGES = {\n\tprojects_org_name_unique: \"A project with that name already exists in this organization.\",\n\tprojects_org_id_slug_key: \"A project with that name already exists in this organization.\",\n\torgs_slug_key: \"An organization with that slug already exists.\",\n\tdefinitions_pkey: \"A definition with that ID already exists.\"\n};\nfunction friendlyConstraintMessage(raw) {\n\tfor (const [name, msg] of Object.entries(UNIQUE_CONSTRAINT_MESSAGES)) if (raw.includes(name)) return msg;\n\treturn null;\n}\n/**\n* Normalize any error raised inside an API handler to a structured SvelteKit\n* HTTP error. Re-throws errors already raised via `apiError`/`error`, maps\n* ProviderError to its statusCode, and falls back to a 500 INTERNAL with the\n* provided message.\n*/\nfunction handleApiError(err, fallback) {\n\tif (isHttpError(err)) throw err;\n\tif (err instanceof SchemaExtractionError) {\n\t\tif (err.kind === \"unreachable\") apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, err.message);\n\t\tapiError(422, ApiErrorCode.UNPROCESSABLE, err.message);\n\t}\n\tif (err instanceof ComputeServerUnconfiguredError) apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, err.message);\n\tif (err instanceof ProviderError) {\n\t\tconst friendly = friendlyConstraintMessage(err.message);\n\t\tapiError(err.statusCode, codeForStatus(err.statusCode), friendly ?? err.message);\n\t}\n\tconsole.error(`[API] ${fallback}:`, err);\n\tapiError(500, ApiErrorCode.INTERNAL, fallback);\n}\n/**\n* Throw a 400 VALIDATION_FAILED from a Zod error. The top-level `message` is\n* the first issue (human-friendly), and `fields` maps every issue's dotted\n* path to its message for machine consumption.\n*/\nfunction throwZodError(err) {\n\tconst fields = {};\n\tfor (const issue of err.issues) {\n\t\tconst key = issue.path.length ? issue.path.join(\".\") : \"_\";\n\t\tif (!(key in fields)) fields[key] = issue.message;\n\t}\n\tconst first = err.issues[0];\n\tconst path = first.path.length ? `${first.path.join(\".\")}: ` : \"\";\n\tapiError(400, ApiErrorCode.VALIDATION_FAILED, `${path}${first.message}`, fields);\n}\n//#endregion\nexport { ComputeServerUnconfiguredError as a, throwZodError as i, apiError as n, resolveServerForOrg as o, handleApiError as r, ApiErrorCode as t };\n"],"names":[],"mappings":";;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,8BAA8B,GAAG,cAAc,KAAK,CAAC;AACzD,CAAC,WAAW,CAAC,OAAO,GAAG,0EAA0E,EAAE;AACnG,EAAE,KAAK,CAAC,OAAO,CAAC;AAChB,EAAE,IAAI,CAAC,IAAI,GAAG,gCAAgC;AAC9C,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE;AAC1D,CAAC,MAAM,KAAK,GAAG,2BAA2B,EAAE;AAC5C,CAAC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC;AAC1C,CAAC,IAAI,MAAM;AACX,CAAC,IAAI;AACL,EAAE,MAAM,GAAG,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;AACtF,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,MAAM,IAAI,8BAA8B,CAAC,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC;AACvF,CAAC;AACD,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,MAAM;AACrC,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,MAAM,EAAE,MAAM,KAAK,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE;AACpD,EAAE;AACF;AACA;AACA;AACA;AACG,IAAC,YAAY,GAAG;AACnB,CAAC,iBAAiB,EAAE,mBAAmB;AACvC,CAAC,YAAY,EAAE,cAAc;AAC7B,CAAC,SAAS,EAAE,WAAW;AACvB,CAAC,SAAS,EAAE,WAAW;AACvB,CAAC,QAAQ,EAAE,UAAU;AACrB,CAAC,aAAa,EAAE,eAAe;AAC/B,CAAC,mBAAmB,EAAE,qBAAqB;AAC3C,CAAC,cAAc,EAAE,gBAAgB;AACjC,CAAC,QAAQ,EAAE;AACX;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE;AACjD,CAAC,MAAM,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG;AAC9B,EAAE,OAAO;AACT,EAAE,IAAI;AACN,EAAE;AACF,EAAE,GAAG;AACL,EAAE,OAAO;AACT,EAAE;AACF,EAAE,CAAC;AACH;AACA;AACA,SAAS,aAAa,CAAC,MAAM,EAAE;AAC/B,CAAC,QAAQ,MAAM;AACf,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,iBAAiB;AACjD,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,YAAY;AAC5C,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,SAAS;AACzC,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,SAAS;AACzC,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,QAAQ;AACxC,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,aAAa;AAC7C,EAAE,KAAK,GAAG,EAAE,OAAO,YAAY,CAAC,mBAAmB;AACnD,EAAE,SAAS,OAAO,YAAY,CAAC,QAAQ;AACvC;AACA;AACA,IAAI,0BAA0B,GAAG;AACjC,CAAC,wBAAwB,EAAE,+DAA+D;AAC1F,CAAC,wBAAwB,EAAE,+DAA+D;AAC1F,CAAC,aAAa,EAAE,gDAAgD;AAChE,CAAC,gBAAgB,EAAE;AACnB,CAAC;AACD,SAAS,yBAAyB,CAAC,GAAG,EAAE;AACxC,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG;AACzG,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,GAAG,EAAE,QAAQ,EAAE;AACvC,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG;AAChC,CAAC,IAAI,GAAG,YAAY,qBAAqB,EAAE;AAC3C,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,GAAG,CAAC,OAAO,CAAC;AAC9F,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC;AACxD,CAAC;AACD,CAAC,IAAI,GAAG,YAAY,8BAA8B,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,mBAAmB,EAAE,GAAG,CAAC,OAAO,CAAC;AAChH,CAAC,IAAI,GAAG,YAAY,aAAa,EAAE;AACnC,EAAE,MAAM,QAAQ,GAAG,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC;AACzD,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC;AAClF,CAAC;AACD,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;AACzC,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC;AAC/C;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,GAAG,EAAE;AAC5B,CAAC,MAAM,MAAM,GAAG,EAAE;AAClB,CAAC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE;AACjC,EAAE,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG;AAC5D,EAAE,IAAI,EAAE,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO;AACnD,CAAC;AACD,CAAC,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5B,CAAC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE;AAClE,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC;AACjF;;;;"}

package/build/server/chunks/chunks/arrow-left.js-4egdEDjX.js

@@ -0,0 +1,15 @@
+import { Z as spread_props } from './server.js-DO_t9YqN.js';
+import { I as Icon } from './utils3.js-CCFwAIqA.js';
+
+//#region ../../node_modules/.pnpm/@lucide+svelte@1.27.0_svelte@5.56.4_@typescript-eslint+types@8.65.0_/node_modules/@lucide/svelte/dist/icons/arrow-left.svelte
+function Arrow_left($$renderer, $$props) {
+	let { $$slots, $$events, ...props } = $$props;
+	Icon($$renderer, spread_props([
+		{ name: "arrow-left" },
+		props,
+		{ iconNode: [["path", { "d": "m12 19-7-7 7-7" }], ["path", { "d": "M19 12H5" }]] }
+	]));
+}
+
+export { Arrow_left as A };
+//# sourceMappingURL=arrow-left.js-4egdEDjX.js.map

package/build/server/chunks/chunks/arrow-left.js-4egdEDjX.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"arrow-left.js-4egdEDjX.js","sources":["../../../../.svelte-kit/output/server/chunks/arrow-left.js"],"sourcesContent":["import { d as spread_props } from \"./server.js\";\nimport { n as Icon } from \"./utils3.js\";\n//#region ../../node_modules/.pnpm/@lucide+svelte@1.27.0_svelte@5.56.4_@typescript-eslint+types@8.65.0_/node_modules/@lucide/svelte/dist/icons/arrow-left.svelte\nfunction Arrow_left($$renderer, $$props) {\n\tlet { $$slots, $$events, ...props } = $$props;\n\tIcon($$renderer, spread_props([\n\t\t{ name: \"arrow-left\" },\n\t\tprops,\n\t\t{ iconNode: [[\"path\", { \"d\": \"m12 19-7-7 7-7\" }], [\"path\", { \"d\": \"M19 12H5\" }]] }\n\t]));\n}\n//#endregion\nexport { Arrow_left as t };\n"],"names":[],"mappings":";;;AAEA;AACA,SAAS,UAAU,CAAC,UAAU,EAAE,OAAO,EAAE;AACzC,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO;AAC9C,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC;AAC/B,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE;AACxB,EAAE,KAAK;AACP,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;AAClF,EAAE,CAAC,CAAC;AACJ;;;;"}

package/build/server/chunks/chunks/arrow-right.js-B7ES5j_J.js

@@ -0,0 +1,15 @@
+import { Z as spread_props } from './server.js-DO_t9YqN.js';
+import { I as Icon } from './utils3.js-CCFwAIqA.js';
+
+//#region ../../node_modules/.pnpm/@lucide+svelte@1.27.0_svelte@5.56.4_@typescript-eslint+types@8.65.0_/node_modules/@lucide/svelte/dist/icons/arrow-right.svelte
+function Arrow_right($$renderer, $$props) {
+	let { $$slots, $$events, ...props } = $$props;
+	Icon($$renderer, spread_props([
+		{ name: "arrow-right" },
+		props,
+		{ iconNode: [["path", { "d": "M5 12h14" }], ["path", { "d": "m12 5 7 7-7 7" }]] }
+	]));
+}
+
+export { Arrow_right as A };
+//# sourceMappingURL=arrow-right.js-B7ES5j_J.js.map

package/build/server/chunks/chunks/arrow-right.js-B7ES5j_J.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"arrow-right.js-B7ES5j_J.js","sources":["../../../../.svelte-kit/output/server/chunks/arrow-right.js"],"sourcesContent":["import { d as spread_props } from \"./server.js\";\nimport { n as Icon } from \"./utils3.js\";\n//#region ../../node_modules/.pnpm/@lucide+svelte@1.27.0_svelte@5.56.4_@typescript-eslint+types@8.65.0_/node_modules/@lucide/svelte/dist/icons/arrow-right.svelte\nfunction Arrow_right($$renderer, $$props) {\n\tlet { $$slots, $$events, ...props } = $$props;\n\tIcon($$renderer, spread_props([\n\t\t{ name: \"arrow-right\" },\n\t\tprops,\n\t\t{ iconNode: [[\"path\", { \"d\": \"M5 12h14\" }], [\"path\", { \"d\": \"m12 5 7 7-7 7\" }]] }\n\t]));\n}\n//#endregion\nexport { Arrow_right as t };\n"],"names":[],"mappings":";;;AAEA;AACA,SAAS,WAAW,CAAC,UAAU,EAAE,OAAO,EAAE;AAC1C,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO;AAC9C,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC;AAC/B,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;AACzB,EAAE,KAAK;AACP,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAC;AACjF,EAAE,CAAC,CAAC;AACJ;;;;"}

package/build/server/chunks/chunks/auth-bootstrap.server.js-pfByC3Hy.js

@@ -0,0 +1,162 @@
+import { b as private_env } from './shared-server.js-DA8HLhRj.js';
+import { S as SYSTEM_CONTEXT, A as ALL_PLATFORM_PERMISSIONS, s as slugify } from './src.js-C5mUn1eC.js';
+import { a as getAuthProvider, g as getLogger, b as getPermissionStore, c as getTenancy, d as getDataProvider, e as getOrganizationProvider, f as getProjectProvider } from './providers.server.js-Bmrvi7Fi.js';
+import { randomUUID } from 'node:crypto';
+
+//#region src/lib/server/auth-bootstrap.server.ts
+/**
+* Shared post-verification flow used by every IdP-callback route (OAuth,
+* email link, future SAML, …). Order matters:
+*
+*   1. `data.ensureUser` — guarantee a user-data row exists for whatever ID
+*      the auth provider issued. Local-provider creates a JSON row;
+*      Supabase no-ops (its DB trigger has already fired).
+*   2. Bootstrap-admin grant — if no instance_admin exists yet AND the
+*      tenancy/env policy allows it, grant the signing-in user every
+*      platform permission so `/admin` becomes reachable.
+*   3. Single-tenant org seed — create the default Organization + Project
+*      owned by the new admin, mirroring what `/setup` does for password
+*      auth. Without this, org-scoped permissions (manage_projects,
+*      manage_definitions) silently drop on the floor because
+*      `actingOrgId` resolves to undefined.
+*
+* Returns nothing — failures throw. Cookie/redirect are the caller's job
+* since they vary by capability (OAuth has refresh tokens, magic-link does
+* sometimes, SAML doesn't).
+*/
+async function bootstrapUserSession(user) {
+	await getDataProvider().ensureUser(SYSTEM_CONTEXT, user.id);
+	const tenancy = getTenancy();
+	const perms = getPermissionStore();
+	const hasAdmin = await perms.hasInstanceAdmin(SYSTEM_CONTEXT);
+	let grantedAdminHere = false;
+	if (!hasAdmin) {
+		if (!shouldBootstrapAdmin(user, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, tenancy)) return;
+		await perms.set(SYSTEM_CONTEXT, user.id, [...ALL_PLATFORM_PERMISSIONS]);
+		grantedAdminHere = true;
+	}
+	if (tenancy !== "single") return;
+	if ((await getOrganizationProvider().listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items.length > 0) return;
+	if (!grantedAdminHere) {
+		if (!(await perms.getFor(SYSTEM_CONTEXT, user.id)).includes("instance_admin")) return;
+	}
+	await ensureSingleTenantDefaultOrg(user);
+}
+/**
+* Single-tenant deployments must have exactly one org for `actingOrgId` to
+* resolve. The `/setup` form creates it from user input; flows that skip
+* setup (header-auth, OAuth callback, future SAML) need the same seed or
+* org-scoped permissions can't be persisted.
+*
+* No-op outside single-tenant mode and once any org exists. Picks a slug
+* derived from the admin's email/displayName so the URL looks like the
+* deployment rather than a UUID; falls back to `default` for anonymous
+* UPN-only sign-ins.
+*/
+async function ensureSingleTenantDefaultOrg(user) {
+	if (getTenancy() !== "single") return;
+	const orgs = getOrganizationProvider();
+	if ((await orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items.length > 0) return;
+	const orgName = (typeof user.metadata?.displayName === "string" ? user.metadata.displayName : void 0)?.trim() || user.email?.split("@")[0]?.trim() || "Default";
+	const slug = slugify(orgName).length >= 3 ? slugify(orgName) : "default";
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const org = {
+		id: randomUUID(),
+		name: orgName,
+		slug,
+		ownerId: user.id,
+		createdBy: user.id,
+		updatedBy: user.id,
+		createdAt: now,
+		updatedAt: now,
+		deletedAt: null
+	};
+	await orgs.createOrg(SYSTEM_CONTEXT, org);
+	const projects = getProjectProvider();
+	const project = {
+		id: randomUUID(),
+		orgId: org.id,
+		name: "Default",
+		slug: "default",
+		visibility: "public",
+		ownerId: user.id,
+		createdBy: user.id,
+		updatedBy: user.id,
+		autoJoinOnUpload: false,
+		createdAt: now,
+		updatedAt: now,
+		deletedAt: null
+	};
+	await projects.createProject(SYSTEM_CONTEXT, project);
+}
+/**
+* Decide whether the signing-in user qualifies for the first-admin grant
+* (Permissions.md §2). Pure — no I/O — so the policy is testable in
+* isolation.
+*
+* - `tenancy='single'` + no env var → first signer wins (fine for
+*   self-hosted fresh installs).
+* - `tenancy='single'` + env var set → only the named user qualifies.
+* - `tenancy='multi'` → env var REQUIRED; the named user must match the
+*   signer. Without it, the first random signup would become Selva staff.
+*
+* The env var also doubles as the break-glass recovery path
+* (Permissions.md §2) when admin is lost to backup restores or migration
+* drift.
+*/
+function shouldBootstrapAdmin(user, configuredEmail, mode) {
+	const expected = configuredEmail?.trim().toLowerCase();
+	if (mode === "multi" && !expected) return false;
+	if (!expected) return true;
+	const actual = user.email?.trim().toLowerCase();
+	return !!actual && actual === expected;
+}
+/**
+* Header-auth-specific variant of the bootstrap policy. Used by
+* `wireHeaderAuthBootstrap` to decide whether an unrecognized UPN arriving
+* through the proxy should be auto-allowlisted as the first admin.
+*
+* Same logic as `shouldBootstrapAdmin` but operates on the raw UPN/email
+* before any allowlist row exists. For Entra deployments UPN ≈ email; if
+* they differ, the proxy is expected to forward both and we prefer email
+* when present.
+*/
+function shouldBootstrapUpn(upn, email, configuredEmail, mode) {
+	const expected = configuredEmail?.trim().toLowerCase();
+	if (mode === "multi" && !expected) return false;
+	if (!expected) return true;
+	const candidate = (email ?? upn).trim().toLowerCase();
+	return !!candidate && candidate === expected;
+}
+/**
+* Wire a bootstrap-allowlist policy onto the auth provider if it supports
+* header-auth-style first-admin bootstrapping. Idempotent — safe to call on
+* every startup; the provider holds the policy until process exit.
+*
+* Header-auth deployments can't reach `/setup` (no password form, no OAuth
+* callback), so without this the first proxy-authenticated visitor is
+* silently rejected (UPN not in allowlist) and the operator has to
+* hand-write JSON files. With it, the first visit whose UPN/email matches
+* `BOOTSTRAP_INSTANCE_ADMIN_EMAIL` is auto-allowlisted, and the immediately
+* following `bootstrapUserSession` call grants instance_admin.
+*
+* The policy is gated by `hasInstanceAdmin` — once any admin exists, the
+* policy returns false and the strict allowlist-only behavior resumes.
+* Single-tenant deployments with no env var get the "first signer wins"
+* shape, matching the password/OAuth bootstrap policy.
+*/
+function wireHeaderAuthBootstrap() {
+	const auth = getAuthProvider();
+	if (!auth.proxyAuth) return;
+	if (typeof auth.setBootstrapAllowlistPolicy !== "function") {
+		if (private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL?.trim()) getLogger().warn("BOOTSTRAP_INSTANCE_ADMIN_EMAIL is set but the installed @selvajs/header-auth-provider does not expose setBootstrapAllowlistPolicy. Upgrade the provider, or hand-seed header-allowlist.json.", { component: "auth-bootstrap" });
+		return;
+	}
+	auth.setBootstrapAllowlistPolicy(async ({ upn, email }) => {
+		if (await getPermissionStore().hasInstanceAdmin(SYSTEM_CONTEXT)) return false;
+		return shouldBootstrapUpn(upn, email, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, getTenancy());
+	});
+}
+
+export { bootstrapUserSession as b, wireHeaderAuthBootstrap as w };
+//# sourceMappingURL=auth-bootstrap.server.js-pfByC3Hy.js.map

package/build/server/chunks/chunks/auth-bootstrap.server.js-pfByC3Hy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-bootstrap.server.js-pfByC3Hy.js","sources":["../../../../.svelte-kit/output/server/chunks/auth-bootstrap.server.js"],"sourcesContent":["import { t as private_env } from \"./shared-server.js\";\nimport { T as ALL_PLATFORM_PERMISSIONS, t as SYSTEM_CONTEXT, w as slugify } from \"./src.js\";\nimport { _ as getProjectProvider, b as getTenancy, f as getLogger, h as getPermissionStore, m as getOrganizationProvider, o as getDataProvider, r as getAuthProvider } from \"./providers.server.js\";\nimport { randomUUID } from \"node:crypto\";\n//#region src/lib/server/auth-bootstrap.server.ts\n/**\n* Shared post-verification flow used by every IdP-callback route (OAuth,\n* email link, future SAML, …). Order matters:\n*\n*   1. `data.ensureUser` — guarantee a user-data row exists for whatever ID\n*      the auth provider issued. Local-provider creates a JSON row;\n*      Supabase no-ops (its DB trigger has already fired).\n*   2. Bootstrap-admin grant — if no instance_admin exists yet AND the\n*      tenancy/env policy allows it, grant the signing-in user every\n*      platform permission so `/admin` becomes reachable.\n*   3. Single-tenant org seed — create the default Organization + Project\n*      owned by the new admin, mirroring what `/setup` does for password\n*      auth. Without this, org-scoped permissions (manage_projects,\n*      manage_definitions) silently drop on the floor because\n*      `actingOrgId` resolves to undefined.\n*\n* Returns nothing — failures throw. Cookie/redirect are the caller's job\n* since they vary by capability (OAuth has refresh tokens, magic-link does\n* sometimes, SAML doesn't).\n*/\nasync function bootstrapUserSession(user) {\n\tawait getDataProvider().ensureUser(SYSTEM_CONTEXT, user.id);\n\tconst tenancy = getTenancy();\n\tconst perms = getPermissionStore();\n\tconst hasAdmin = await perms.hasInstanceAdmin(SYSTEM_CONTEXT);\n\tlet grantedAdminHere = false;\n\tif (!hasAdmin) {\n\t\tif (!shouldBootstrapAdmin(user, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, tenancy)) return;\n\t\tawait perms.set(SYSTEM_CONTEXT, user.id, [...ALL_PLATFORM_PERMISSIONS]);\n\t\tgrantedAdminHere = true;\n\t}\n\tif (tenancy !== \"single\") return;\n\tif ((await getOrganizationProvider().listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items.length > 0) return;\n\tif (!grantedAdminHere) {\n\t\tif (!(await perms.getFor(SYSTEM_CONTEXT, user.id)).includes(\"instance_admin\")) return;\n\t}\n\tawait ensureSingleTenantDefaultOrg(user);\n}\n/**\n* Single-tenant deployments must have exactly one org for `actingOrgId` to\n* resolve. The `/setup` form creates it from user input; flows that skip\n* setup (header-auth, OAuth callback, future SAML) need the same seed or\n* org-scoped permissions can't be persisted.\n*\n* No-op outside single-tenant mode and once any org exists. Picks a slug\n* derived from the admin's email/displayName so the URL looks like the\n* deployment rather than a UUID; falls back to `default` for anonymous\n* UPN-only sign-ins.\n*/\nasync function ensureSingleTenantDefaultOrg(user) {\n\tif (getTenancy() !== \"single\") return;\n\tconst orgs = getOrganizationProvider();\n\tif ((await orgs.listOrgs(SYSTEM_CONTEXT, { limit: 1 })).items.length > 0) return;\n\tconst orgName = (typeof user.metadata?.displayName === \"string\" ? user.metadata.displayName : void 0)?.trim() || user.email?.split(\"@\")[0]?.trim() || \"Default\";\n\tconst slug = slugify(orgName).length >= 3 ? slugify(orgName) : \"default\";\n\tconst now = (/* @__PURE__ */ new Date()).toISOString();\n\tconst org = {\n\t\tid: randomUUID(),\n\t\tname: orgName,\n\t\tslug,\n\t\townerId: user.id,\n\t\tcreatedBy: user.id,\n\t\tupdatedBy: user.id,\n\t\tcreatedAt: now,\n\t\tupdatedAt: now,\n\t\tdeletedAt: null\n\t};\n\tawait orgs.createOrg(SYSTEM_CONTEXT, org);\n\tconst projects = getProjectProvider();\n\tconst project = {\n\t\tid: randomUUID(),\n\t\torgId: org.id,\n\t\tname: \"Default\",\n\t\tslug: \"default\",\n\t\tvisibility: \"public\",\n\t\townerId: user.id,\n\t\tcreatedBy: user.id,\n\t\tupdatedBy: user.id,\n\t\tautoJoinOnUpload: false,\n\t\tcreatedAt: now,\n\t\tupdatedAt: now,\n\t\tdeletedAt: null\n\t};\n\tawait projects.createProject(SYSTEM_CONTEXT, project);\n}\n/**\n* Decide whether the signing-in user qualifies for the first-admin grant\n* (Permissions.md §2). Pure — no I/O — so the policy is testable in\n* isolation.\n*\n* - `tenancy='single'` + no env var → first signer wins (fine for\n*   self-hosted fresh installs).\n* - `tenancy='single'` + env var set → only the named user qualifies.\n* - `tenancy='multi'` → env var REQUIRED; the named user must match the\n*   signer. Without it, the first random signup would become Selva staff.\n*\n* The env var also doubles as the break-glass recovery path\n* (Permissions.md §2) when admin is lost to backup restores or migration\n* drift.\n*/\nfunction shouldBootstrapAdmin(user, configuredEmail, mode) {\n\tconst expected = configuredEmail?.trim().toLowerCase();\n\tif (mode === \"multi\" && !expected) return false;\n\tif (!expected) return true;\n\tconst actual = user.email?.trim().toLowerCase();\n\treturn !!actual && actual === expected;\n}\n/**\n* Header-auth-specific variant of the bootstrap policy. Used by\n* `wireHeaderAuthBootstrap` to decide whether an unrecognized UPN arriving\n* through the proxy should be auto-allowlisted as the first admin.\n*\n* Same logic as `shouldBootstrapAdmin` but operates on the raw UPN/email\n* before any allowlist row exists. For Entra deployments UPN ≈ email; if\n* they differ, the proxy is expected to forward both and we prefer email\n* when present.\n*/\nfunction shouldBootstrapUpn(upn, email, configuredEmail, mode) {\n\tconst expected = configuredEmail?.trim().toLowerCase();\n\tif (mode === \"multi\" && !expected) return false;\n\tif (!expected) return true;\n\tconst candidate = (email ?? upn).trim().toLowerCase();\n\treturn !!candidate && candidate === expected;\n}\n/**\n* Wire a bootstrap-allowlist policy onto the auth provider if it supports\n* header-auth-style first-admin bootstrapping. Idempotent — safe to call on\n* every startup; the provider holds the policy until process exit.\n*\n* Header-auth deployments can't reach `/setup` (no password form, no OAuth\n* callback), so without this the first proxy-authenticated visitor is\n* silently rejected (UPN not in allowlist) and the operator has to\n* hand-write JSON files. With it, the first visit whose UPN/email matches\n* `BOOTSTRAP_INSTANCE_ADMIN_EMAIL` is auto-allowlisted, and the immediately\n* following `bootstrapUserSession` call grants instance_admin.\n*\n* The policy is gated by `hasInstanceAdmin` — once any admin exists, the\n* policy returns false and the strict allowlist-only behavior resumes.\n* Single-tenant deployments with no env var get the \"first signer wins\"\n* shape, matching the password/OAuth bootstrap policy.\n*/\nfunction wireHeaderAuthBootstrap() {\n\tconst auth = getAuthProvider();\n\tif (!auth.proxyAuth) return;\n\tif (typeof auth.setBootstrapAllowlistPolicy !== \"function\") {\n\t\tif (private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL?.trim()) getLogger().warn(\"BOOTSTRAP_INSTANCE_ADMIN_EMAIL is set but the installed @selvajs/header-auth-provider does not expose setBootstrapAllowlistPolicy. Upgrade the provider, or hand-seed header-allowlist.json.\", { component: \"auth-bootstrap\" });\n\t\treturn;\n\t}\n\tauth.setBootstrapAllowlistPolicy(async ({ upn, email }) => {\n\t\tif (await getPermissionStore().hasInstanceAdmin(SYSTEM_CONTEXT)) return false;\n\t\treturn shouldBootstrapUpn(upn, email, private_env.BOOTSTRAP_INSTANCE_ADMIN_EMAIL, getTenancy());\n\t});\n}\n//#endregion\nexport { wireHeaderAuthBootstrap as n, bootstrapUserSession as t };\n"],"names":[],"mappings":";;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,oBAAoB,CAAC,IAAI,EAAE;AAC1C,CAAC,MAAM,eAAe,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;AAC5D,CAAC,MAAM,OAAO,GAAG,UAAU,EAAE;AAC7B,CAAC,MAAM,KAAK,GAAG,kBAAkB,EAAE;AACnC,CAAC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,cAAc,CAAC;AAC9D,CAAC,IAAI,gBAAgB,GAAG,KAAK;AAC7B,CAAC,IAAI,CAAC,QAAQ,EAAE;AAChB,EAAE,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,WAAW,CAAC,8BAA8B,EAAE,OAAO,CAAC,EAAE;AACxF,EAAE,MAAM,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,wBAAwB,CAAC,CAAC;AACzE,EAAE,gBAAgB,GAAG,IAAI;AACzB,CAAC;AACD,CAAC,IAAI,OAAO,KAAK,QAAQ,EAAE;AAC3B,CAAC,IAAI,CAAC,MAAM,uBAAuB,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;AAChG,CAAC,IAAI,CAAC,gBAAgB,EAAE;AACxB,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE;AACjF,CAAC;AACD,CAAC,MAAM,4BAA4B,CAAC,IAAI,CAAC;AACzC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,4BAA4B,CAAC,IAAI,EAAE;AAClD,CAAC,IAAI,UAAU,EAAE,KAAK,QAAQ,EAAE;AAChC,CAAC,MAAM,IAAI,GAAG,uBAAuB,EAAE;AACvC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;AAC3E,CAAC,MAAM,OAAO,GAAG,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,WAAW,KAAK,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,GAAG,MAAM,GAAG,IAAI,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS;AAChK,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS;AACzE,CAAC,MAAM,GAAG,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACvD,CAAC,MAAM,GAAG,GAAG;AACb,EAAE,EAAE,EAAE,UAAU,EAAE;AAClB,EAAE,IAAI,EAAE,OAAO;AACf,EAAE,IAAI;AACN,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;AAClB,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;AACpB,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;AACpB,EAAE,SAAS,EAAE,GAAG;AAChB,EAAE,SAAS,EAAE,GAAG;AAChB,EAAE,SAAS,EAAE;AACb,EAAE;AACF,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,CAAC;AAC1C,CAAC,MAAM,QAAQ,GAAG,kBAAkB,EAAE;AACtC,CAAC,MAAM,OAAO,GAAG;AACjB,EAAE,EAAE,EAAE,UAAU,EAAE;AAClB,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE;AACf,EAAE,IAAI,EAAE,SAAS;AACjB,EAAE,IAAI,EAAE,SAAS;AACjB,EAAE,UAAU,EAAE,QAAQ;AACtB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;AAClB,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;AACpB,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;AACpB,EAAE,gBAAgB,EAAE,KAAK;AACzB,EAAE,SAAS,EAAE,GAAG;AAChB,EAAE,SAAS,EAAE,GAAG;AAChB,EAAE,SAAS,EAAE;AACb,EAAE;AACF,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,cAAc,EAAE,OAAO,CAAC;AACtD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,oBAAoB,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE;AAC3D,CAAC,MAAM,QAAQ,GAAG,eAAe,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACvD,CAAC,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,KAAK;AAChD,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI;AAC3B,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AAChD,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,MAAM,KAAK,QAAQ;AACvC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE;AAC/D,CAAC,MAAM,QAAQ,GAAG,eAAe,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACvD,CAAC,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,KAAK;AAChD,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI;AAC3B,CAAC,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACtD,CAAC,OAAO,CAAC,CAAC,SAAS,IAAI,SAAS,KAAK,QAAQ;AAC7C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,uBAAuB,GAAG;AACnC,CAAC,MAAM,IAAI,GAAG,eAAe,EAAE;AAC/B,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;AACtB,CAAC,IAAI,OAAO,IAAI,CAAC,2BAA2B,KAAK,UAAU,EAAE;AAC7D,EAAE,IAAI,WAAW,CAAC,8BAA8B,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,8LAA8L,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC;AAC3S,EAAE;AACF,CAAC;AACD,CAAC,IAAI,CAAC,2BAA2B,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK;AAC5D,EAAE,IAAI,MAAM,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,OAAO,KAAK;AAC/E,EAAE,OAAO,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,CAAC,8BAA8B,EAAE,UAAU,EAAE,CAAC;AACjG,CAAC,CAAC,CAAC;AACH;;;;"}

package/build/server/chunks/chunks/auth.server.js-DkxnHvQS.js

@@ -0,0 +1,2 @@
+import './providers.server.js-Bmrvi7Fi.js';
+//# sourceMappingURL=auth.server.js-DkxnHvQS.js.map

package/build/server/chunks/chunks/auth.server.js-DkxnHvQS.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.server.js-DkxnHvQS.js","sources":[],"sourcesContent":[],"names":[],"mappings":""}

package/build/server/chunks/chunks/badge.js-Dt0SypsN.js

@@ -0,0 +1,35 @@
+import { a5 as element, a0 as attributes, a1 as clsx$1, a6 as bind_props } from './server.js-DO_t9YqN.js';
+import { c as cn } from './utils3.js-CCFwAIqA.js';
+import { tv } from 'tailwind-variants';
+
+//#region ../ui/dist/components/primitives/badge/badge.svelte
+var badgeVariants = tv({
+	base: "focus-visible:border-ring focus-visible:ring-ring/50 aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive inline-flex w-fit shrink-0 items-center justify-center gap-1 overflow-hidden rounded-full border px-2 py-0.5 text-xs font-medium whitespace-nowrap transition-[color,box-shadow] focus-visible:ring-[3px] [&>svg]:pointer-events-none [&>svg]:size-3",
+	variants: { variant: {
+		default: "bg-primary text-primary-foreground [a&]:hover:bg-primary/90 border-transparent",
+		secondary: "bg-secondary text-secondary-foreground [a&]:hover:bg-secondary/90 border-transparent",
+		destructive: "bg-destructive [a&]:hover:bg-destructive/90 focus-visible:ring-destructive/20 dark:focus-visible:ring-destructive/40 dark:bg-destructive/70 border-transparent text-white",
+		outline: "text-foreground [a&]:hover:bg-accent [a&]:hover:text-accent-foreground"
+	} },
+	defaultVariants: { variant: "default" }
+});
+function Badge($$renderer, $$props) {
+	$$renderer.component(($$renderer) => {
+		let { ref = null, href, class: className, variant = "default", children, $$slots, $$events, ...restProps } = $$props;
+		element($$renderer, href ? "a" : "span", () => {
+			$$renderer.push(`${attributes({
+				"data-slot": "badge",
+				href,
+				class: clsx$1(cn(badgeVariants({ variant }), className)),
+				...restProps
+			})}`);
+		}, () => {
+			children?.($$renderer);
+			$$renderer.push(`<!---->`);
+		});
+		bind_props($$props, { ref });
+	});
+}
+
+export { Badge as B };
+//# sourceMappingURL=badge.js-Dt0SypsN.js.map

package/build/server/chunks/chunks/badge.js-Dt0SypsN.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"badge.js-Dt0SypsN.js","sources":["../../../../.svelte-kit/output/server/chunks/badge.js"],"sourcesContent":["import { i as bind_props, k as clsx, o as element, r as attributes } from \"./server.js\";\nimport { t as cn } from \"./utils3.js\";\nimport { tv } from \"tailwind-variants\";\n//#region ../ui/dist/components/primitives/badge/badge.svelte\nvar badgeVariants = tv({\n\tbase: \"focus-visible:border-ring focus-visible:ring-ring/50 aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive inline-flex w-fit shrink-0 items-center justify-center gap-1 overflow-hidden rounded-full border px-2 py-0.5 text-xs font-medium whitespace-nowrap transition-[color,box-shadow] focus-visible:ring-[3px] [&>svg]:pointer-events-none [&>svg]:size-3\",\n\tvariants: { variant: {\n\t\tdefault: \"bg-primary text-primary-foreground [a&]:hover:bg-primary/90 border-transparent\",\n\t\tsecondary: \"bg-secondary text-secondary-foreground [a&]:hover:bg-secondary/90 border-transparent\",\n\t\tdestructive: \"bg-destructive [a&]:hover:bg-destructive/90 focus-visible:ring-destructive/20 dark:focus-visible:ring-destructive/40 dark:bg-destructive/70 border-transparent text-white\",\n\t\toutline: \"text-foreground [a&]:hover:bg-accent [a&]:hover:text-accent-foreground\"\n\t} },\n\tdefaultVariants: { variant: \"default\" }\n});\nfunction Badge($$renderer, $$props) {\n\t$$renderer.component(($$renderer) => {\n\t\tlet { ref = null, href, class: className, variant = \"default\", children, $$slots, $$events, ...restProps } = $$props;\n\t\telement($$renderer, href ? \"a\" : \"span\", () => {\n\t\t\t$$renderer.push(`${attributes({\n\t\t\t\t\"data-slot\": \"badge\",\n\t\t\t\thref,\n\t\t\t\tclass: clsx(cn(badgeVariants({ variant }), className)),\n\t\t\t\t...restProps\n\t\t\t})}`);\n\t\t}, () => {\n\t\t\tchildren?.($$renderer);\n\t\t\t$$renderer.push(`<!---->`);\n\t\t});\n\t\tbind_props($$props, { ref });\n\t});\n}\n//#endregion\nexport { Badge as t };\n"],"names":["clsx"],"mappings":";;;;AAGA;AACA,IAAI,aAAa,GAAG,EAAE,CAAC;AACvB,CAAC,IAAI,EAAE,kZAAkZ;AACzZ,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE;AACtB,EAAE,OAAO,EAAE,gFAAgF;AAC3F,EAAE,SAAS,EAAE,sFAAsF;AACnG,EAAE,WAAW,EAAE,2KAA2K;AAC1L,EAAE,OAAO,EAAE;AACX,EAAE,EAAE;AACJ,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,SAAS;AACtC,CAAC,CAAC;AACF,SAAS,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE;AACpC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,UAAU,KAAK;AACtC,EAAE,IAAI,EAAE,GAAG,GAAG,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,GAAG,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,SAAS,EAAE,GAAG,OAAO;AACtH,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,GAAG,GAAG,GAAG,MAAM,EAAE,MAAM;AACjD,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC;AACjC,IAAI,WAAW,EAAE,OAAO;AACxB,IAAI,IAAI;AACR,IAAI,KAAK,EAAEA,MAAI,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;AAC1D,IAAI,GAAG;AACP,IAAI,CAAC,CAAC,CAAC,CAAC;AACR,EAAE,CAAC,EAAE,MAAM;AACX,GAAG,QAAQ,GAAG,UAAU,CAAC;AACzB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;AAC7B,EAAE,CAAC,CAAC;AACJ,EAAE,UAAU,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC;AAC9B,CAAC,CAAC,CAAC;AACH;;;;"}

package/build/server/chunks/chunks/bootHealth.server.js-DD7VShf9.js

@@ -0,0 +1,91 @@
+import { p as providers, g as getLogger, r as renderThrown } from './providers.server.js-Bmrvi7Fi.js';
+
+//#region src/lib/server/bootHealth.server.ts
+var cached = null;
+var inflight = null;
+async function run() {
+	let atRestSecrets = null;
+	const store = providers.data.computeServer;
+	if (typeof store.verifySecrets === "function") try {
+		atRestSecrets = await store.verifySecrets();
+	} catch (err) {
+		getLogger().error("verifySecrets threw — treating as failure", {
+			component: "boot",
+			err: renderThrown(err)
+		});
+		atRestSecrets = {
+			ok: false,
+			plaintextFound: false,
+			failures: [{
+				serverId: "(unknown)",
+				serverLabel: "(unknown)",
+				reason: "key_mismatch",
+				cause: err instanceof Error ? err.message : String(err)
+			}]
+		};
+	}
+	if (atRestSecrets && !atRestSecrets.ok) {
+		for (const f of atRestSecrets.failures) getLogger().error("At-rest secret verification failed for compute server", {
+			component: "boot",
+			serverLabel: f.serverLabel,
+			serverId: f.serverId,
+			reason: f.reason,
+			cause: f.cause
+		});
+		getLogger().error("At-rest secret verification failed. /api/health will return 503. Recover by re-entering the affected apiKeys via /admin/compute, or by restoring the original SELVA_AT_REST_KEY. See docs/Troubleshooting.md.", { component: "boot" });
+	}
+	let schemaVersion = null;
+	const data = providers.data;
+	if (typeof data.verifySchemaVersion === "function") try {
+		schemaVersion = await data.verifySchemaVersion();
+	} catch (err) {
+		getLogger().error("verifySchemaVersion threw — treating as failure", {
+			component: "boot",
+			err: renderThrown(err)
+		});
+		schemaVersion = {
+			ok: false,
+			expected: "(unknown)",
+			actual: null,
+			message: err instanceof Error ? err.message : String(err)
+		};
+	}
+	if (schemaVersion && !schemaVersion.ok) getLogger().error("Database schema handshake failed. /api/health will return 503.", {
+		component: "boot",
+		expected: schemaVersion.expected,
+		actual: schemaVersion.actual ?? "unavailable",
+		detail: schemaVersion.message
+	});
+	return {
+		checkedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		atRestSecrets,
+		schemaVersion
+	};
+}
+/**
+* Returns the cached boot health report. Runs the underlying checks at most
+* once — subsequent callers receive the same result. Safe to call from many
+* routes concurrently; in-flight callers share a single promise.
+*
+* The report does NOT auto-refresh after an operator fixes the underlying
+* issue. Restart the process to re-run the boot check. (Conscious choice:
+* boot health represents the state at boot, by definition.)
+*/
+function getBootHealth() {
+	if (cached) return Promise.resolve(cached);
+	if (inflight) return inflight;
+	inflight = run().then((result) => {
+		cached = result;
+		inflight = null;
+		return result;
+	});
+	return inflight;
+}
+function isDegraded(report) {
+	if (report.atRestSecrets !== null && !report.atRestSecrets.ok) return true;
+	if (report.schemaVersion !== null && !report.schemaVersion.ok) return true;
+	return false;
+}
+
+export { getBootHealth as g, isDegraded as i };
+//# sourceMappingURL=bootHealth.server.js-DD7VShf9.js.map

package/build/server/chunks/chunks/bootHealth.server.js-DD7VShf9.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootHealth.server.js-DD7VShf9.js","sources":["../../../../.svelte-kit/output/server/chunks/bootHealth.server.js"],"sourcesContent":["import { C as providers, T as renderThrown, f as getLogger } from \"./providers.server.js\";\n//#region src/lib/server/bootHealth.server.ts\nvar cached = null;\nvar inflight = null;\nasync function run() {\n\tlet atRestSecrets = null;\n\tconst store = providers.data.computeServer;\n\tif (typeof store.verifySecrets === \"function\") try {\n\t\tatRestSecrets = await store.verifySecrets();\n\t} catch (err) {\n\t\tgetLogger().error(\"verifySecrets threw — treating as failure\", {\n\t\t\tcomponent: \"boot\",\n\t\t\terr: renderThrown(err)\n\t\t});\n\t\tatRestSecrets = {\n\t\t\tok: false,\n\t\t\tplaintextFound: false,\n\t\t\tfailures: [{\n\t\t\t\tserverId: \"(unknown)\",\n\t\t\t\tserverLabel: \"(unknown)\",\n\t\t\t\treason: \"key_mismatch\",\n\t\t\t\tcause: err instanceof Error ? err.message : String(err)\n\t\t\t}]\n\t\t};\n\t}\n\tif (atRestSecrets && !atRestSecrets.ok) {\n\t\tfor (const f of atRestSecrets.failures) getLogger().error(\"At-rest secret verification failed for compute server\", {\n\t\t\tcomponent: \"boot\",\n\t\t\tserverLabel: f.serverLabel,\n\t\t\tserverId: f.serverId,\n\t\t\treason: f.reason,\n\t\t\tcause: f.cause\n\t\t});\n\t\tgetLogger().error(\"At-rest secret verification failed. /api/health will return 503. Recover by re-entering the affected apiKeys via /admin/compute, or by restoring the original SELVA_AT_REST_KEY. See docs/Troubleshooting.md.\", { component: \"boot\" });\n\t}\n\tlet schemaVersion = null;\n\tconst data = providers.data;\n\tif (typeof data.verifySchemaVersion === \"function\") try {\n\t\tschemaVersion = await data.verifySchemaVersion();\n\t} catch (err) {\n\t\tgetLogger().error(\"verifySchemaVersion threw — treating as failure\", {\n\t\t\tcomponent: \"boot\",\n\t\t\terr: renderThrown(err)\n\t\t});\n\t\tschemaVersion = {\n\t\t\tok: false,\n\t\t\texpected: \"(unknown)\",\n\t\t\tactual: null,\n\t\t\tmessage: err instanceof Error ? err.message : String(err)\n\t\t};\n\t}\n\tif (schemaVersion && !schemaVersion.ok) getLogger().error(\"Database schema handshake failed. /api/health will return 503.\", {\n\t\tcomponent: \"boot\",\n\t\texpected: schemaVersion.expected,\n\t\tactual: schemaVersion.actual ?? \"unavailable\",\n\t\tdetail: schemaVersion.message\n\t});\n\treturn {\n\t\tcheckedAt: (/* @__PURE__ */ new Date()).toISOString(),\n\t\tatRestSecrets,\n\t\tschemaVersion\n\t};\n}\n/**\n* Returns the cached boot health report. Runs the underlying checks at most\n* once — subsequent callers receive the same result. Safe to call from many\n* routes concurrently; in-flight callers share a single promise.\n*\n* The report does NOT auto-refresh after an operator fixes the underlying\n* issue. Restart the process to re-run the boot check. (Conscious choice:\n* boot health represents the state at boot, by definition.)\n*/\nfunction getBootHealth() {\n\tif (cached) return Promise.resolve(cached);\n\tif (inflight) return inflight;\n\tinflight = run().then((result) => {\n\t\tcached = result;\n\t\tinflight = null;\n\t\treturn result;\n\t});\n\treturn inflight;\n}\nfunction isDegraded(report) {\n\tif (report.atRestSecrets !== null && !report.atRestSecrets.ok) return true;\n\tif (report.schemaVersion !== null && !report.schemaVersion.ok) return true;\n\treturn false;\n}\n//#endregion\nexport { isDegraded as n, getBootHealth as t };\n"],"names":[],"mappings":";;AACA;AACA,IAAI,MAAM,GAAG,IAAI;AACjB,IAAI,QAAQ,GAAG,IAAI;AACnB,eAAe,GAAG,GAAG;AACrB,CAAC,IAAI,aAAa,GAAG,IAAI;AACzB,CAAC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa;AAC3C,CAAC,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,UAAU,EAAE,IAAI;AACpD,EAAE,aAAa,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;AAC7C,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,2CAA2C,EAAE;AACjE,GAAG,SAAS,EAAE,MAAM;AACpB,GAAG,GAAG,EAAE,YAAY,CAAC,GAAG;AACxB,GAAG,CAAC;AACJ,EAAE,aAAa,GAAG;AAClB,GAAG,EAAE,EAAE,KAAK;AACZ,GAAG,cAAc,EAAE,KAAK;AACxB,GAAG,QAAQ,EAAE,CAAC;AACd,IAAI,QAAQ,EAAE,WAAW;AACzB,IAAI,WAAW,EAAE,WAAW;AAC5B,IAAI,MAAM,EAAE,cAAc;AAC1B,IAAI,KAAK,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG;AAC1D,IAAI;AACJ,GAAG;AACH,CAAC;AACD,CAAC,IAAI,aAAa,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE;AACzC,EAAE,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,uDAAuD,EAAE;AACrH,GAAG,SAAS,EAAE,MAAM;AACpB,GAAG,WAAW,EAAE,CAAC,CAAC,WAAW;AAC7B,GAAG,QAAQ,EAAE,CAAC,CAAC,QAAQ;AACvB,GAAG,MAAM,EAAE,CAAC,CAAC,MAAM;AACnB,GAAG,KAAK,EAAE,CAAC,CAAC;AACZ,GAAG,CAAC;AACJ,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,+MAA+M,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC3P,CAAC;AACD,CAAC,IAAI,aAAa,GAAG,IAAI;AACzB,CAAC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI;AAC5B,CAAC,IAAI,OAAO,IAAI,CAAC,mBAAmB,KAAK,UAAU,EAAE,IAAI;AACzD,EAAE,aAAa,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE;AAClD,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,iDAAiD,EAAE;AACvE,GAAG,SAAS,EAAE,MAAM;AACpB,GAAG,GAAG,EAAE,YAAY,CAAC,GAAG;AACxB,GAAG,CAAC;AACJ,EAAE,aAAa,GAAG;AAClB,GAAG,EAAE,EAAE,KAAK;AACZ,GAAG,QAAQ,EAAE,WAAW;AACxB,GAAG,MAAM,EAAE,IAAI;AACf,GAAG,OAAO,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG;AAC3D,GAAG;AACH,CAAC;AACD,CAAC,IAAI,aAAa,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,gEAAgE,EAAE;AAC7H,EAAE,SAAS,EAAE,MAAM;AACnB,EAAE,QAAQ,EAAE,aAAa,CAAC,QAAQ;AAClC,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,IAAI,aAAa;AAC/C,EAAE,MAAM,EAAE,aAAa,CAAC;AACxB,EAAE,CAAC;AACH,CAAC,OAAO;AACR,EAAE,SAAS,EAAE,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACvD,EAAE,aAAa;AACf,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,GAAG;AACzB,CAAC,IAAI,MAAM,EAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;AAC3C,CAAC,IAAI,QAAQ,EAAE,OAAO,QAAQ;AAC9B,CAAC,QAAQ,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK;AACnC,EAAE,MAAM,GAAG,MAAM;AACjB,EAAE,QAAQ,GAAG,IAAI;AACjB,EAAE,OAAO,MAAM;AACf,CAAC,CAAC,CAAC;AACH,CAAC,OAAO,QAAQ;AAChB;AACA,SAAS,UAAU,CAAC,MAAM,EAAE;AAC5B,CAAC,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,OAAO,IAAI;AAC3E,CAAC,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,OAAO,IAAI;AAC3E,CAAC,OAAO,KAAK;AACb;;;;"}

package/build/server/chunks/chunks/building-2.js-BhMwidYb.js

@@ -0,0 +1,21 @@
+import { Z as spread_props } from './server.js-DO_t9YqN.js';
+import { I as Icon } from './utils3.js-CCFwAIqA.js';
+
+//#region ../../node_modules/.pnpm/@lucide+svelte@1.27.0_svelte@5.56.4_@typescript-eslint+types@8.65.0_/node_modules/@lucide/svelte/dist/icons/building-2.svelte
+function Building_2($$renderer, $$props) {
+	let { $$slots, $$events, ...props } = $$props;
+	Icon($$renderer, spread_props([
+		{ name: "building-2" },
+		props,
+		{ iconNode: [
+			["path", { "d": "M10 12h4" }],
+			["path", { "d": "M10 8h4" }],
+			["path", { "d": "M14 21v-3a2 2 0 0 0-4 0v3" }],
+			["path", { "d": "M6 10H4a2 2 0 0 0-2 2v7a2 2 0 0 0 2 2h16a2 2 0 0 0 2-2V9a2 2 0 0 0-2-2h-2" }],
+			["path", { "d": "M6 21V5a2 2 0 0 1 2-2h8a2 2 0 0 1 2 2v16" }]
+		] }
+	]));
+}
+
+export { Building_2 as B };
+//# sourceMappingURL=building-2.js-BhMwidYb.js.map

package/build/server/chunks/chunks/building-2.js-BhMwidYb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"building-2.js-BhMwidYb.js","sources":["../../../../.svelte-kit/output/server/chunks/building-2.js"],"sourcesContent":["import { d as spread_props } from \"./server.js\";\nimport { n as Icon } from \"./utils3.js\";\n//#region ../../node_modules/.pnpm/@lucide+svelte@1.27.0_svelte@5.56.4_@typescript-eslint+types@8.65.0_/node_modules/@lucide/svelte/dist/icons/building-2.svelte\nfunction Building_2($$renderer, $$props) {\n\tlet { $$slots, $$events, ...props } = $$props;\n\tIcon($$renderer, spread_props([\n\t\t{ name: \"building-2\" },\n\t\tprops,\n\t\t{ iconNode: [\n\t\t\t[\"path\", { \"d\": \"M10 12h4\" }],\n\t\t\t[\"path\", { \"d\": \"M10 8h4\" }],\n\t\t\t[\"path\", { \"d\": \"M14 21v-3a2 2 0 0 0-4 0v3\" }],\n\t\t\t[\"path\", { \"d\": \"M6 10H4a2 2 0 0 0-2 2v7a2 2 0 0 0 2 2h16a2 2 0 0 0 2-2V9a2 2 0 0 0-2-2h-2\" }],\n\t\t\t[\"path\", { \"d\": \"M6 21V5a2 2 0 0 1 2-2h8a2 2 0 0 1 2 2v16\" }]\n\t\t] }\n\t]));\n}\n//#endregion\nexport { Building_2 as t };\n"],"names":[],"mappings":";;;AAEA;AACA,SAAS,UAAU,CAAC,UAAU,EAAE,OAAO,EAAE;AACzC,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO;AAC9C,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC;AAC/B,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE;AACxB,EAAE,KAAK;AACP,EAAE,EAAE,QAAQ,EAAE;AACd,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;AAChC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;AAC/B,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,2BAA2B,EAAE,CAAC;AACjD,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,2EAA2E,EAAE,CAAC;AACjG,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,0CAA0C,EAAE;AAC/D,GAAG;AACH,EAAE,CAAC,CAAC;AACJ;;;;"}

package/build/server/chunks/chunks/button.js-Cdo5lO8h.js

@@ -0,0 +1,71 @@
+import { a0 as attributes, a1 as clsx$1, a6 as bind_props } from './server.js-DO_t9YqN.js';
+import { c as cn } from './utils3.js-CCFwAIqA.js';
+import { tv } from 'tailwind-variants';
+
+//#region ../ui/dist/components/primitives/button/button.svelte
+var buttonVariants = tv({
+	base: "focus-visible:border-ring focus-visible:ring-ring/50 aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive inline-flex shrink-0 items-center justify-center gap-2 whitespace-nowrap rounded-md text-sm font-medium outline-none transition-all focus-visible:ring-[3px] disabled:pointer-events-none disabled:opacity-50 aria-disabled:pointer-events-none aria-disabled:opacity-50 [&_svg:not([class*='size-'])]:size-4 [&_svg]:pointer-events-none [&_svg]:shrink-0",
+	variants: {
+		variant: {
+			default: "bg-primary text-primary-foreground shadow-xs hover:bg-primary/90",
+			destructive: "bg-destructive shadow-xs hover:bg-destructive/90 focus-visible:ring-destructive/20 dark:focus-visible:ring-destructive/40 dark:bg-destructive/60 text-white",
+			outline: "bg-background shadow-xs hover:bg-accent hover:text-accent-foreground dark:bg-input/30 dark:border-input dark:hover:bg-input/50 border",
+			secondary: "bg-secondary text-secondary-foreground shadow-xs hover:bg-secondary/80",
+			ghost: "hover:bg-accent hover:text-accent-foreground dark:hover:bg-accent/50",
+			dashed: "border border-dashed border-input bg-background text-muted-foreground hover:bg-muted hover:text-foreground",
+			link: "text-primary underline-offset-4 hover:underline"
+		},
+		size: {
+			default: "h-9 px-4 py-2 has-[>svg]:px-3",
+			sm: "h-8 gap-1.5 rounded-md px-3 has-[>svg]:px-2.5",
+			lg: "h-10 rounded-md px-6 has-[>svg]:px-4",
+			icon: "size-9",
+			"icon-sm": "size-8",
+			"icon-lg": "size-10"
+		}
+	},
+	defaultVariants: {
+		variant: "default",
+		size: "default"
+	}
+});
+function Button($$renderer, $$props) {
+	$$renderer.component(($$renderer) => {
+		let { class: className, variant = "default", size = "default", ref = null, href = void 0, type = "button", disabled, children, $$slots, $$events, ...restProps } = $$props;
+		if (href) {
+			$$renderer.push("<!--[0-->");
+			$$renderer.push(`<a${attributes({
+				"data-slot": "button",
+				class: clsx$1(cn(buttonVariants({
+					variant,
+					size
+				}), className)),
+				href: disabled ? void 0 : href,
+				"aria-disabled": disabled,
+				"data-sveltekit-reload": true,
+				...restProps
+			})}>`);
+			children?.($$renderer);
+			$$renderer.push(`<!----></a>`);
+		} else {
+			$$renderer.push("<!--[-1-->");
+			$$renderer.push(`<button${attributes({
+				"data-slot": "button",
+				class: clsx$1(cn(buttonVariants({
+					variant,
+					size
+				}), className)),
+				type,
+				disabled,
+				...restProps
+			})}>`);
+			children?.($$renderer);
+			$$renderer.push(`<!----></button>`);
+		}
+		$$renderer.push(`<!--]-->`);
+		bind_props($$props, { ref });
+	});
+}
+
+export { Button as B, buttonVariants as b };
+//# sourceMappingURL=button.js-Cdo5lO8h.js.map

package/build/server/chunks/chunks/button.js-Cdo5lO8h.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"button.js-Cdo5lO8h.js","sources":["../../../../.svelte-kit/output/server/chunks/button.js"],"sourcesContent":["import { i as bind_props, k as clsx, r as attributes } from \"./server.js\";\nimport { t as cn } from \"./utils3.js\";\nimport { tv } from \"tailwind-variants\";\n//#region ../ui/dist/components/primitives/button/button.svelte\nvar buttonVariants = tv({\n\tbase: \"focus-visible:border-ring focus-visible:ring-ring/50 aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive inline-flex shrink-0 items-center justify-center gap-2 whitespace-nowrap rounded-md text-sm font-medium outline-none transition-all focus-visible:ring-[3px] disabled:pointer-events-none disabled:opacity-50 aria-disabled:pointer-events-none aria-disabled:opacity-50 [&_svg:not([class*='size-'])]:size-4 [&_svg]:pointer-events-none [&_svg]:shrink-0\",\n\tvariants: {\n\t\tvariant: {\n\t\t\tdefault: \"bg-primary text-primary-foreground shadow-xs hover:bg-primary/90\",\n\t\t\tdestructive: \"bg-destructive shadow-xs hover:bg-destructive/90 focus-visible:ring-destructive/20 dark:focus-visible:ring-destructive/40 dark:bg-destructive/60 text-white\",\n\t\t\toutline: \"bg-background shadow-xs hover:bg-accent hover:text-accent-foreground dark:bg-input/30 dark:border-input dark:hover:bg-input/50 border\",\n\t\t\tsecondary: \"bg-secondary text-secondary-foreground shadow-xs hover:bg-secondary/80\",\n\t\t\tghost: \"hover:bg-accent hover:text-accent-foreground dark:hover:bg-accent/50\",\n\t\t\tdashed: \"border border-dashed border-input bg-background text-muted-foreground hover:bg-muted hover:text-foreground\",\n\t\t\tlink: \"text-primary underline-offset-4 hover:underline\"\n\t\t},\n\t\tsize: {\n\t\t\tdefault: \"h-9 px-4 py-2 has-[>svg]:px-3\",\n\t\t\tsm: \"h-8 gap-1.5 rounded-md px-3 has-[>svg]:px-2.5\",\n\t\t\tlg: \"h-10 rounded-md px-6 has-[>svg]:px-4\",\n\t\t\ticon: \"size-9\",\n\t\t\t\"icon-sm\": \"size-8\",\n\t\t\t\"icon-lg\": \"size-10\"\n\t\t}\n\t},\n\tdefaultVariants: {\n\t\tvariant: \"default\",\n\t\tsize: \"default\"\n\t}\n});\nfunction Button($$renderer, $$props) {\n\t$$renderer.component(($$renderer) => {\n\t\tlet { class: className, variant = \"default\", size = \"default\", ref = null, href = void 0, type = \"button\", disabled, children, $$slots, $$events, ...restProps } = $$props;\n\t\tif (href) {\n\t\t\t$$renderer.push(\"<!--[0-->\");\n\t\t\t$$renderer.push(`<a${attributes({\n\t\t\t\t\"data-slot\": \"button\",\n\t\t\t\tclass: clsx(cn(buttonVariants({\n\t\t\t\t\tvariant,\n\t\t\t\t\tsize\n\t\t\t\t}), className)),\n\t\t\t\thref: disabled ? void 0 : href,\n\t\t\t\t\"aria-disabled\": disabled,\n\t\t\t\t\"data-sveltekit-reload\": true,\n\t\t\t\t...restProps\n\t\t\t})}>`);\n\t\t\tchildren?.($$renderer);\n\t\t\t$$renderer.push(`<!----></a>`);\n\t\t} else {\n\t\t\t$$renderer.push(\"<!--[-1-->\");\n\t\t\t$$renderer.push(`<button${attributes({\n\t\t\t\t\"data-slot\": \"button\",\n\t\t\t\tclass: clsx(cn(buttonVariants({\n\t\t\t\t\tvariant,\n\t\t\t\t\tsize\n\t\t\t\t}), className)),\n\t\t\t\ttype,\n\t\t\t\tdisabled,\n\t\t\t\t...restProps\n\t\t\t})}>`);\n\t\t\tchildren?.($$renderer);\n\t\t\t$$renderer.push(`<!----></button>`);\n\t\t}\n\t\t$$renderer.push(`<!--]-->`);\n\t\tbind_props($$props, { ref });\n\t});\n}\n//#endregion\nexport { buttonVariants as n, Button as t };\n"],"names":["clsx"],"mappings":";;;;AAGA;AACG,IAAC,cAAc,GAAG,EAAE,CAAC;AACxB,CAAC,IAAI,EAAE,wfAAwf;AAC/f,CAAC,QAAQ,EAAE;AACX,EAAE,OAAO,EAAE;AACX,GAAG,OAAO,EAAE,kEAAkE;AAC9E,GAAG,WAAW,EAAE,6JAA6J;AAC7K,GAAG,OAAO,EAAE,uIAAuI;AACnJ,GAAG,SAAS,EAAE,wEAAwE;AACtF,GAAG,KAAK,EAAE,sEAAsE;AAChF,GAAG,MAAM,EAAE,4GAA4G;AACvH,GAAG,IAAI,EAAE;AACT,GAAG;AACH,EAAE,IAAI,EAAE;AACR,GAAG,OAAO,EAAE,+BAA+B;AAC3C,GAAG,EAAE,EAAE,+CAA+C;AACtD,GAAG,EAAE,EAAE,sCAAsC;AAC7C,GAAG,IAAI,EAAE,QAAQ;AACjB,GAAG,SAAS,EAAE,QAAQ;AACtB,GAAG,SAAS,EAAE;AACd;AACA,EAAE;AACF,CAAC,eAAe,EAAE;AAClB,EAAE,OAAO,EAAE,SAAS;AACpB,EAAE,IAAI,EAAE;AACR;AACA,CAAC;AACD,SAAS,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE;AACrC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,UAAU,KAAK;AACtC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,GAAG,SAAS,EAAE,IAAI,GAAG,SAAS,EAAE,GAAG,GAAG,IAAI,EAAE,IAAI,GAAG,MAAM,EAAE,IAAI,GAAG,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,SAAS,EAAE,GAAG,OAAO;AAC5K,EAAE,IAAI,IAAI,EAAE;AACZ,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;AAC/B,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,UAAU,CAAC;AACnC,IAAI,WAAW,EAAE,QAAQ;AACzB,IAAI,KAAK,EAAEA,MAAI,CAAC,EAAE,CAAC,cAAc,CAAC;AAClC,KAAK,OAAO;AACZ,KAAK;AACL,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;AACnB,IAAI,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,IAAI;AAClC,IAAI,eAAe,EAAE,QAAQ;AAC7B,IAAI,uBAAuB,EAAE,IAAI;AACjC,IAAI,GAAG;AACP,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACT,GAAG,QAAQ,GAAG,UAAU,CAAC;AACzB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC;AACjC,EAAE,CAAC,MAAM;AACT,GAAG,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;AAChC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC;AACxC,IAAI,WAAW,EAAE,QAAQ;AACzB,IAAI,KAAK,EAAEA,MAAI,CAAC,EAAE,CAAC,cAAc,CAAC;AAClC,KAAK,OAAO;AACZ,KAAK;AACL,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;AACnB,IAAI,IAAI;AACR,IAAI,QAAQ;AACZ,IAAI,GAAG;AACP,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACT,GAAG,QAAQ,GAAG,UAAU,CAAC;AACzB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,CAAC;AACtC,EAAE;AACF,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;AAC7B,EAAE,UAAU,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC;AAC9B,CAAC,CAAC,CAAC;AACH;;;;"}

package/build/server/chunks/chunks/card-content.js-CoaQE3bg.js

@@ -0,0 +1,35 @@
+import { a0 as attributes, a1 as clsx$1, a6 as bind_props } from './server.js-DO_t9YqN.js';
+import { c as cn } from './utils3.js-CCFwAIqA.js';
+
+//#region ../ui/dist/components/primitives/card/card.svelte
+function Card($$renderer, $$props) {
+	$$renderer.component(($$renderer) => {
+		let { ref = null, class: className, children, $$slots, $$events, ...restProps } = $$props;
+		$$renderer.push(`<div${attributes({
+			"data-slot": "card",
+			class: clsx$1(cn("gap-6 py-6 shadow-sm flex flex-col rounded-xl border bg-card text-card-foreground", className)),
+			...restProps
+		})}>`);
+		children?.($$renderer);
+		$$renderer.push(`<!----></div>`);
+		bind_props($$props, { ref });
+	});
+}
+//#endregion
+//#region ../ui/dist/components/primitives/card/card-content.svelte
+function Card_content($$renderer, $$props) {
+	$$renderer.component(($$renderer) => {
+		let { ref = null, class: className, children, $$slots, $$events, ...restProps } = $$props;
+		$$renderer.push(`<div${attributes({
+			"data-slot": "card-content",
+			class: clsx$1(cn("px-6", className)),
+			...restProps
+		})}>`);
+		children?.($$renderer);
+		$$renderer.push(`<!----></div>`);
+		bind_props($$props, { ref });
+	});
+}
+
+export { Card as C, Card_content as a };
+//# sourceMappingURL=card-content.js-CoaQE3bg.js.map

package/build/server/chunks/chunks/card-content.js-CoaQE3bg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"card-content.js-CoaQE3bg.js","sources":["../../../../.svelte-kit/output/server/chunks/card-content.js"],"sourcesContent":["import { i as bind_props, k as clsx, r as attributes } from \"./server.js\";\nimport { t as cn } from \"./utils3.js\";\n//#region ../ui/dist/components/primitives/card/card.svelte\nfunction Card($$renderer, $$props) {\n\t$$renderer.component(($$renderer) => {\n\t\tlet { ref = null, class: className, children, $$slots, $$events, ...restProps } = $$props;\n\t\t$$renderer.push(`<div${attributes({\n\t\t\t\"data-slot\": \"card\",\n\t\t\tclass: clsx(cn(\"gap-6 py-6 shadow-sm flex flex-col rounded-xl border bg-card text-card-foreground\", className)),\n\t\t\t...restProps\n\t\t})}>`);\n\t\tchildren?.($$renderer);\n\t\t$$renderer.push(`<!----></div>`);\n\t\tbind_props($$props, { ref });\n\t});\n}\n//#endregion\n//#region ../ui/dist/components/primitives/card/card-content.svelte\nfunction Card_content($$renderer, $$props) {\n\t$$renderer.component(($$renderer) => {\n\t\tlet { ref = null, class: className, children, $$slots, $$events, ...restProps } = $$props;\n\t\t$$renderer.push(`<div${attributes({\n\t\t\t\"data-slot\": \"card-content\",\n\t\t\tclass: clsx(cn(\"px-6\", className)),\n\t\t\t...restProps\n\t\t})}>`);\n\t\tchildren?.($$renderer);\n\t\t$$renderer.push(`<!----></div>`);\n\t\tbind_props($$props, { ref });\n\t});\n}\n//#endregion\nexport { Card as n, Card_content as t };\n"],"names":["clsx"],"mappings":";;;AAEA;AACA,SAAS,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE;AACnC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,UAAU,KAAK;AACtC,EAAE,IAAI,EAAE,GAAG,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,SAAS,EAAE,GAAG,OAAO;AAC3F,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC;AACpC,GAAG,WAAW,EAAE,MAAM;AACtB,GAAG,KAAK,EAAEA,MAAI,CAAC,EAAE,CAAC,mFAAmF,EAAE,SAAS,CAAC,CAAC;AAClH,GAAG,GAAG;AACN,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACR,EAAE,QAAQ,GAAG,UAAU,CAAC;AACxB,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC;AAClC,EAAE,UAAU,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC;AAC9B,CAAC,CAAC,CAAC;AACH;AACA;AACA;AACA,SAAS,YAAY,CAAC,UAAU,EAAE,OAAO,EAAE;AAC3C,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,UAAU,KAAK;AACtC,EAAE,IAAI,EAAE,GAAG,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,SAAS,EAAE,GAAG,OAAO;AAC3F,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC;AACpC,GAAG,WAAW,EAAE,cAAc;AAC9B,GAAG,KAAK,EAAEA,MAAI,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AACrC,GAAG,GAAG;AACN,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACR,EAAE,QAAQ,GAAG,UAAU,CAAC;AACxB,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC;AAClC,EAAE,UAAU,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC;AAC9B,CAAC,CAAC,CAAC;AACH;;;;"}

package/build/server/chunks/chunks/card-description.js-O1bM-E6X.js

@@ -0,0 +1,20 @@
+import { a0 as attributes, a1 as clsx$1, a6 as bind_props } from './server.js-DO_t9YqN.js';
+import { c as cn } from './utils3.js-CCFwAIqA.js';
+
+//#region ../ui/dist/components/primitives/card/card-description.svelte
+function Card_description($$renderer, $$props) {
+	$$renderer.component(($$renderer) => {
+		let { ref = null, class: className, children, $$slots, $$events, ...restProps } = $$props;
+		$$renderer.push(`<p${attributes({
+			"data-slot": "card-description",
+			class: clsx$1(cn("text-sm text-muted-foreground", className)),
+			...restProps
+		})}>`);
+		children?.($$renderer);
+		$$renderer.push(`<!----></p>`);
+		bind_props($$props, { ref });
+	});
+}
+
+export { Card_description as C };
+//# sourceMappingURL=card-description.js-O1bM-E6X.js.map

package/build/server/chunks/chunks/card-description.js-O1bM-E6X.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"card-description.js-O1bM-E6X.js","sources":["../../../../.svelte-kit/output/server/chunks/card-description.js"],"sourcesContent":["import { i as bind_props, k as clsx, r as attributes } from \"./server.js\";\nimport { t as cn } from \"./utils3.js\";\n//#region ../ui/dist/components/primitives/card/card-description.svelte\nfunction Card_description($$renderer, $$props) {\n\t$$renderer.component(($$renderer) => {\n\t\tlet { ref = null, class: className, children, $$slots, $$events, ...restProps } = $$props;\n\t\t$$renderer.push(`<p${attributes({\n\t\t\t\"data-slot\": \"card-description\",\n\t\t\tclass: clsx(cn(\"text-sm text-muted-foreground\", className)),\n\t\t\t...restProps\n\t\t})}>`);\n\t\tchildren?.($$renderer);\n\t\t$$renderer.push(`<!----></p>`);\n\t\tbind_props($$props, { ref });\n\t});\n}\n//#endregion\nexport { Card_description as t };\n"],"names":["clsx"],"mappings":";;;AAEA;AACA,SAAS,gBAAgB,CAAC,UAAU,EAAE,OAAO,EAAE;AAC/C,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,UAAU,KAAK;AACtC,EAAE,IAAI,EAAE,GAAG,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,SAAS,EAAE,GAAG,OAAO;AAC3F,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,UAAU,CAAC;AAClC,GAAG,WAAW,EAAE,kBAAkB;AAClC,GAAG,KAAK,EAAEA,MAAI,CAAC,EAAE,CAAC,+BAA+B,EAAE,SAAS,CAAC,CAAC;AAC9D,GAAG,GAAG;AACN,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACR,EAAE,QAAQ,GAAG,UAAU,CAAC;AACxB,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC;AAChC,EAAE,UAAU,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC;AAC9B,CAAC,CAAC,CAAC;AACH;;;;"}