@selvajs/selva 4.7.3 → 4.7.4-beta.0

package/build/server/chunks/entries/endpoints/api/orgs/_orgId_/members/_userId_/_server.ts.js-CbJKAA75.js

@@ -0,0 +1,79 @@
+import { M as MEMBER_ASSIGNABLE_PERMISSIONS, a as ALL_ORG_PERMISSIONS, k as OrgRoleSchema } from '../../../../../../../chunks/src.js-C5mUn1eC.js';
+import { e as getOrganizationProvider } from '../../../../../../../chunks/providers.server.js-2HaeDkdE.js';
+import { j as requireManageOrgMembers } from '../../../../../../../chunks/access.server.js-CNK7b0lL.js';
+import { a as apiError, t as throwZodError, A as ApiErrorCode, h as handleApiError } from '../../../../../../../chunks/api-errors.js-qWNEcN6_.js';
+import { z } from 'zod';
+import '../../../../../../../chunks/shared-server.js-BjFXsyhJ.js';
+import '../../../../../../../chunks/limits.js-Dw3YYMI2.js';
+import '../../../../../../../chunks/chunk-XT3XWDDV.js-CgVdm1U0.js';
+import '../../../../../../../chunks/schema.js-BhmknPcU.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '@sveltejs/kit';
+import '../../../../../../../chunks/utils2.js-CuEJmHGN.js';
+
+//#region src/routes/api/orgs/[orgId]/members/[userId]/+server.ts
+/**
+* PATCH /api/orgs/[orgId]/members/[userId]
+*
+* Body accepts either or both:
+*   - `{ role: OrgRole }` — change the member's role. **Owner-only** per §3.
+*   - `{ permissions: OrgPermission[] }` — replace the member's grantable
+*     permissions. Owner/admin via `manage_org_members`. For `member`-role
+*     targets, only `MEMBER_ASSIGNABLE_PERMISSIONS` are accepted; promoting a
+*     member's permissions does NOT change their role (that's a separate
+*     branch, owner-only).
+*
+* Tenancy: the URL `orgId` must equal `ctx.actingOrgId`. Cross-org member
+* mutation is blocked even if the actor holds permissions in another org.
+*
+* Self-protection (sole-owner invariant, §10 spirit): the only owner of an
+* org cannot be demoted. Demoting yourself while you are the sole owner is
+* the most common way to discover this — handler returns 409.
+*/
+var PERMISSIONS_SCHEMA = z.array(z.enum(ALL_ORG_PERMISSIONS));
+var PatchSchema = z.object({
+	role: OrgRoleSchema.optional(),
+	permissions: PERMISSIONS_SCHEMA.optional()
+}).refine((b) => b.role !== void 0 || b.permissions !== void 0, { message: "Provide at least one of role, permissions" });
+var PATCH = async ({ params, request, locals }) => {
+	const { orgId, userId } = params;
+	if (!orgId || !userId) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Missing org ID or user ID");
+	requireManageOrgMembers(locals);
+	const ctx = locals.ctx;
+	if (ctx.actingOrgId !== orgId) apiError(403, ApiErrorCode.FORBIDDEN, "Acting org does not match the target org.");
+	const body = await request.json().catch(() => null);
+	const parsed = PatchSchema.safeParse(body);
+	if (!parsed.success) throwZodError(parsed.error);
+	const patch = parsed.data;
+	const orgs = getOrganizationProvider();
+	const [actorMember, target] = await Promise.all([orgs.getOrgMember(ctx, orgId, ctx.userId), orgs.getOrgMember(ctx, orgId, userId)]);
+	if (!target) apiError(404, ApiErrorCode.NOT_FOUND, "Member not found in this organization.");
+	if (!actorMember) apiError(403, ApiErrorCode.FORBIDDEN, "You are not a member of this organization.");
+	if (patch.role !== void 0 && patch.role !== target.role) {
+		if (actorMember.role !== "owner") apiError(403, ApiErrorCode.FORBIDDEN, "Only the org owner can change roles.");
+		if (target.role === "owner" && patch.role !== "owner") {
+			if ((await orgs.listOrgMembers(ctx, orgId, { limit: 200 })).items.filter((m) => m.role === "owner" && m.userId !== target.userId && !m.deletedAt).length === 0) apiError(409, ApiErrorCode.CONFLICT, "Cannot demote the sole owner of this organization. Promote another member to owner first.");
+		}
+		await orgs.updateOrgMemberRole(ctx, orgId, userId, patch.role);
+	}
+	if (patch.permissions !== void 0) {
+		const effectiveRole = patch.role ?? target.role;
+		const valid = effectiveRole === "member" ? new Set(MEMBER_ASSIGNABLE_PERMISSIONS) : new Set(ALL_ORG_PERMISSIONS);
+		const invalid = patch.permissions.filter((p) => !valid.has(p));
+		if (invalid.length > 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Permissions [${invalid.join(", ")}] cannot be assigned to a ${effectiveRole}.`);
+		try {
+			await orgs.updateOrgMemberPermissions(ctx, orgId, userId, patch.permissions);
+		} catch (err) {
+			handleApiError(err, "Failed to update permissions");
+		}
+	}
+	return new Response(null, { status: 204 });
+};
+
+export { PATCH };
+//# sourceMappingURL=_server.ts.js-CbJKAA75.js.map

package/build/server/chunks/entries/endpoints/api/orgs/_orgId_/members/_userId_/_server.ts.js-CbJKAA75.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-CbJKAA75.js","sources":["../../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/orgs/_orgId_/members/_userId_/_server.ts.js"],"sourcesContent":["import { S as OrgRoleSchema, h as ALL_ORG_PERMISSIONS, v as MEMBER_ASSIGNABLE_PERMISSIONS } from \"../../../../../../../chunks/src.js\";\nimport { m as getOrganizationProvider } from \"../../../../../../../chunks/providers.server.js\";\nimport { x as requireManageOrgMembers } from \"../../../../../../../chunks/access.server.js\";\nimport { i as throwZodError, n as apiError, r as handleApiError, t as ApiErrorCode } from \"../../../../../../../chunks/api-errors.js\";\nimport { z } from \"zod\";\n//#region src/routes/api/orgs/[orgId]/members/[userId]/+server.ts\n/**\n* PATCH /api/orgs/[orgId]/members/[userId]\n*\n* Body accepts either or both:\n*   - `{ role: OrgRole }` — change the member's role. **Owner-only** per §3.\n*   - `{ permissions: OrgPermission[] }` — replace the member's grantable\n*     permissions. Owner/admin via `manage_org_members`. For `member`-role\n*     targets, only `MEMBER_ASSIGNABLE_PERMISSIONS` are accepted; promoting a\n*     member's permissions does NOT change their role (that's a separate\n*     branch, owner-only).\n*\n* Tenancy: the URL `orgId` must equal `ctx.actingOrgId`. Cross-org member\n* mutation is blocked even if the actor holds permissions in another org.\n*\n* Self-protection (sole-owner invariant, §10 spirit): the only owner of an\n* org cannot be demoted. Demoting yourself while you are the sole owner is\n* the most common way to discover this — handler returns 409.\n*/\nvar PERMISSIONS_SCHEMA = z.array(z.enum(ALL_ORG_PERMISSIONS));\nvar PatchSchema = z.object({\n\trole: OrgRoleSchema.optional(),\n\tpermissions: PERMISSIONS_SCHEMA.optional()\n}).refine((b) => b.role !== void 0 || b.permissions !== void 0, { message: \"Provide at least one of role, permissions\" });\nvar PATCH = async ({ params, request, locals }) => {\n\tconst { orgId, userId } = params;\n\tif (!orgId || !userId) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing org ID or user ID\");\n\trequireManageOrgMembers(locals);\n\tconst ctx = locals.ctx;\n\tif (ctx.actingOrgId !== orgId) apiError(403, ApiErrorCode.FORBIDDEN, \"Acting org does not match the target org.\");\n\tconst body = await request.json().catch(() => null);\n\tconst parsed = PatchSchema.safeParse(body);\n\tif (!parsed.success) throwZodError(parsed.error);\n\tconst patch = parsed.data;\n\tconst orgs = getOrganizationProvider();\n\tconst [actorMember, target] = await Promise.all([orgs.getOrgMember(ctx, orgId, ctx.userId), orgs.getOrgMember(ctx, orgId, userId)]);\n\tif (!target) apiError(404, ApiErrorCode.NOT_FOUND, \"Member not found in this organization.\");\n\tif (!actorMember) apiError(403, ApiErrorCode.FORBIDDEN, \"You are not a member of this organization.\");\n\tif (patch.role !== void 0 && patch.role !== target.role) {\n\t\tif (actorMember.role !== \"owner\") apiError(403, ApiErrorCode.FORBIDDEN, \"Only the org owner can change roles.\");\n\t\tif (target.role === \"owner\" && patch.role !== \"owner\") {\n\t\t\tif ((await orgs.listOrgMembers(ctx, orgId, { limit: 200 })).items.filter((m) => m.role === \"owner\" && m.userId !== target.userId && !m.deletedAt).length === 0) apiError(409, ApiErrorCode.CONFLICT, \"Cannot demote the sole owner of this organization. Promote another member to owner first.\");\n\t\t}\n\t\tawait orgs.updateOrgMemberRole(ctx, orgId, userId, patch.role);\n\t}\n\tif (patch.permissions !== void 0) {\n\t\tconst effectiveRole = patch.role ?? target.role;\n\t\tconst valid = effectiveRole === \"member\" ? new Set(MEMBER_ASSIGNABLE_PERMISSIONS) : new Set(ALL_ORG_PERMISSIONS);\n\t\tconst invalid = patch.permissions.filter((p) => !valid.has(p));\n\t\tif (invalid.length > 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Permissions [${invalid.join(\", \")}] cannot be assigned to a ${effectiveRole}.`);\n\t\ttry {\n\t\t\tawait orgs.updateOrgMemberPermissions(ctx, orgId, userId, patch.permissions);\n\t\t} catch (err) {\n\t\t\thandleApiError(err, \"Failed to update permissions\");\n\t\t}\n\t}\n\treturn new Response(null, { status: 204 });\n};\n//#endregion\nexport { PATCH };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAKA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AAC7D,IAAI,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;AAC3B,CAAC,IAAI,EAAE,aAAa,CAAC,QAAQ,EAAE;AAC/B,CAAC,WAAW,EAAE,kBAAkB,CAAC,QAAQ;AACzC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,MAAM,EAAE,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC;AACtH,IAAC,KAAK,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AACnD,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM;AACjC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,2BAA2B,CAAC;AAClG,CAAC,uBAAuB,CAAC,MAAM,CAAC;AAChC,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACvB,CAAC,IAAI,GAAG,CAAC,WAAW,KAAK,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,2CAA2C,CAAC;AAClH,CAAC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;AACpD,CAAC,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC;AAC3C,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AACjD,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI;AAC1B,CAAC,MAAM,IAAI,GAAG,uBAAuB,EAAE;AACvC,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AACpI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,wCAAwC,CAAC;AAC7F,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,4CAA4C,CAAC;AACtG,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE;AAC1D,EAAE,IAAI,WAAW,CAAC,IAAI,KAAK,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,sCAAsC,CAAC;AACjH,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE;AACzD,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,2FAA2F,CAAC;AACpS,EAAE;AACF,EAAE,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;AAChE,CAAC;AACD,CAAC,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM,EAAE;AACnC,EAAE,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI;AACjD,EAAE,MAAM,KAAK,GAAG,aAAa,KAAK,QAAQ,GAAG,IAAI,GAAG,CAAC,6BAA6B,CAAC,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC;AAClH,EAAE,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAChE,EAAE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,0BAA0B,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;AACxJ,EAAE,IAAI;AACN,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC;AAC/E,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,cAAc,CAAC,GAAG,EAAE,8BAA8B,CAAC;AACtD,EAAE;AACF,CAAC;AACD,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC3C;;;;"}

package/build/server/chunks/entries/endpoints/api/projects/_id_/_server.ts.js-Djvh-K50.js

@@ -0,0 +1,71 @@
+import { v as validateProjectFlags, s as slugify, l as ProjectVisibilitySchema } from '../../../../../chunks/src.js-C5mUn1eC.js';
+import { f as getProjectProvider, e as getOrganizationProvider } from '../../../../../chunks/providers.server.js-2HaeDkdE.js';
+import { u as requireCanManage, v as requireCanEditProjectSettings, w as withAdminBypass, x as canChangeVisibilityToPublic } from '../../../../../chunks/access.server.js-CNK7b0lL.js';
+import { a as apiError, h as handleApiError, t as throwZodError, A as ApiErrorCode } from '../../../../../chunks/api-errors.js-qWNEcN6_.js';
+import { z } from 'zod';
+import '../../../../../chunks/shared-server.js-BjFXsyhJ.js';
+import '../../../../../chunks/limits.js-Dw3YYMI2.js';
+import '../../../../../chunks/chunk-XT3XWDDV.js-CgVdm1U0.js';
+import '../../../../../chunks/schema.js-BhmknPcU.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '@sveltejs/kit';
+import '../../../../../chunks/utils2.js-CuEJmHGN.js';
+
+//#region src/routes/api/projects/[id]/+server.ts
+var UpdateProjectBody = z.object({
+	name: z.string().min(1).max(128).trim(),
+	description: z.string().max(2e3).nullish(),
+	visibility: ProjectVisibilitySchema,
+	autoJoinOnUpload: z.boolean()
+}).partial();
+var PATCH = async ({ params, request, locals }) => {
+	const { id } = params;
+	if (!id) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Missing project ID");
+	const { ctx, project: existing } = await requireCanEditProjectSettings(locals, id);
+	const body = await request.json().catch(() => null);
+	const parsed = UpdateProjectBody.safeParse(body);
+	if (!parsed.success) throwZodError(parsed.error);
+	if (parsed.data.visibility !== void 0 && parsed.data.visibility === "public" && existing.visibility !== "public") {
+		const orgMember = await getOrganizationProvider().getOrgMember(ctx, existing.orgId, ctx.userId);
+		if (!withAdminBypass(ctx.platformPermissions, () => canChangeVisibilityToPublic({ orgMember }))) apiError(403, ApiErrorCode.FORBIDDEN, "Only org owners or admins can make a project public.");
+	}
+	const flagIssues = validateProjectFlags({
+		visibility: parsed.data.visibility ?? existing.visibility,
+		autoJoinOnUpload: parsed.data.autoJoinOnUpload ?? existing.autoJoinOnUpload
+	});
+	if (flagIssues.length > 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, flagIssues.map((i) => `${i.path}: ${i.message}`).join("; "));
+	const patch = {};
+	if (parsed.data.name !== void 0) {
+		patch.name = parsed.data.name;
+		patch.slug = slugify(parsed.data.name);
+	}
+	if (parsed.data.description !== void 0) patch.description = parsed.data.description ?? void 0;
+	if (parsed.data.visibility !== void 0) patch.visibility = parsed.data.visibility;
+	if (parsed.data.autoJoinOnUpload !== void 0) patch.autoJoinOnUpload = parsed.data.autoJoinOnUpload;
+	try {
+		await getProjectProvider().updateProject(ctx, id, patch);
+		return new Response(null, { status: 204 });
+	} catch (err) {
+		handleApiError(err, "Failed to update project");
+	}
+};
+var DELETE = async ({ params, locals }) => {
+	const { id } = params;
+	if (!id) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Missing project ID");
+	await requireCanManage(locals, id);
+	const ctx = locals.ctx;
+	try {
+		await getProjectProvider().deleteProject(ctx, id);
+		return new Response(null, { status: 204 });
+	} catch (err) {
+		handleApiError(err, "Failed to delete project");
+	}
+};
+
+export { DELETE, PATCH };
+//# sourceMappingURL=_server.ts.js-Djvh-K50.js.map

package/build/server/chunks/entries/endpoints/api/projects/_id_/_server.ts.js-Djvh-K50.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-Djvh-K50.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/projects/_id_/_server.ts.js"],"sourcesContent":["import { m as validateProjectFlags, p as ProjectVisibilitySchema, w as slugify } from \"../../../../../chunks/src.js\";\nimport { _ as getProjectProvider, m as getOrganizationProvider } from \"../../../../../chunks/providers.server.js\";\nimport { O as withAdminBypass, l as requireCanEditProjectSettings, u as requireCanManage, w as canChangeVisibilityToPublic } from \"../../../../../chunks/access.server.js\";\nimport { i as throwZodError, n as apiError, r as handleApiError, t as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\nimport { z } from \"zod\";\n//#region src/routes/api/projects/[id]/+server.ts\nvar UpdateProjectBody = z.object({\n\tname: z.string().min(1).max(128).trim(),\n\tdescription: z.string().max(2e3).nullish(),\n\tvisibility: ProjectVisibilitySchema,\n\tautoJoinOnUpload: z.boolean()\n}).partial();\nvar PATCH = async ({ params, request, locals }) => {\n\tconst { id } = params;\n\tif (!id) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing project ID\");\n\tconst { ctx, project: existing } = await requireCanEditProjectSettings(locals, id);\n\tconst body = await request.json().catch(() => null);\n\tconst parsed = UpdateProjectBody.safeParse(body);\n\tif (!parsed.success) throwZodError(parsed.error);\n\tif (parsed.data.visibility !== void 0 && parsed.data.visibility === \"public\" && existing.visibility !== \"public\") {\n\t\tconst orgMember = await getOrganizationProvider().getOrgMember(ctx, existing.orgId, ctx.userId);\n\t\tif (!withAdminBypass(ctx.platformPermissions, () => canChangeVisibilityToPublic({ orgMember }))) apiError(403, ApiErrorCode.FORBIDDEN, \"Only org owners or admins can make a project public.\");\n\t}\n\tconst flagIssues = validateProjectFlags({\n\t\tvisibility: parsed.data.visibility ?? existing.visibility,\n\t\tautoJoinOnUpload: parsed.data.autoJoinOnUpload ?? existing.autoJoinOnUpload\n\t});\n\tif (flagIssues.length > 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, flagIssues.map((i) => `${i.path}: ${i.message}`).join(\"; \"));\n\tconst patch = {};\n\tif (parsed.data.name !== void 0) {\n\t\tpatch.name = parsed.data.name;\n\t\tpatch.slug = slugify(parsed.data.name);\n\t}\n\tif (parsed.data.description !== void 0) patch.description = parsed.data.description ?? void 0;\n\tif (parsed.data.visibility !== void 0) patch.visibility = parsed.data.visibility;\n\tif (parsed.data.autoJoinOnUpload !== void 0) patch.autoJoinOnUpload = parsed.data.autoJoinOnUpload;\n\ttry {\n\t\tawait getProjectProvider().updateProject(ctx, id, patch);\n\t\treturn new Response(null, { status: 204 });\n\t} catch (err) {\n\t\thandleApiError(err, \"Failed to update project\");\n\t}\n};\nvar DELETE = async ({ params, locals }) => {\n\tconst { id } = params;\n\tif (!id) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing project ID\");\n\tawait requireCanManage(locals, id);\n\tconst ctx = locals.ctx;\n\ttry {\n\t\tawait getProjectProvider().deleteProject(ctx, id);\n\t\treturn new Response(null, { status: 204 });\n\t} catch (err) {\n\t\thandleApiError(err, \"Failed to delete project\");\n\t}\n};\n//#endregion\nexport { DELETE, PATCH };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAKA;AACA,IAAI,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;AACjC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;AACxC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE;AAC3C,CAAC,UAAU,EAAE,uBAAuB;AACpC,CAAC,gBAAgB,EAAE,CAAC,CAAC,OAAO;AAC5B,CAAC,CAAC,CAAC,OAAO,EAAE;AACT,IAAC,KAAK,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AACnD,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM;AACtB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;AAC7E,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,6BAA6B,CAAC,MAAM,EAAE,EAAE,CAAC;AACnF,CAAC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;AACpD,CAAC,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC;AACjD,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AACjD,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,KAAK,QAAQ,EAAE;AACnH,EAAE,MAAM,SAAS,GAAG,MAAM,uBAAuB,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC;AACjG,EAAE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,2BAA2B,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,sDAAsD,CAAC;AAChM,CAAC;AACD,CAAC,MAAM,UAAU,GAAG,oBAAoB,CAAC;AACzC,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU;AAC3D,EAAE,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,QAAQ,CAAC;AAC7D,EAAE,CAAC;AACH,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtI,CAAC,MAAM,KAAK,GAAG,EAAE;AACjB,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE;AAClC,EAAE,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI;AAC/B,EAAE,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;AACxC,CAAC;AACD,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,MAAM,EAAE,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,MAAM;AAC9F,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,MAAM,EAAE,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU;AACjF,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,gBAAgB,KAAK,MAAM,EAAE,KAAK,CAAC,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB;AACnG,CAAC,IAAI;AACL,EAAE,MAAM,kBAAkB,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC;AAC1D,EAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC5C,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,cAAc,CAAC,GAAG,EAAE,0BAA0B,CAAC;AACjD,CAAC;AACD;AACG,IAAC,MAAM,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AAC3C,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM;AACtB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;AAC7E,CAAC,MAAM,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC;AACnC,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACvB,CAAC,IAAI;AACL,EAAE,MAAM,kBAAkB,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,CAAC;AACnD,EAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC5C,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,cAAc,CAAC,GAAG,EAAE,0BAA0B,CAAC;AACjD,CAAC;AACD;;;;"}

package/build/server/chunks/entries/endpoints/api/projects/_id_/members/_server.ts.js-DDJWHB1r.js

@@ -0,0 +1,65 @@
+import { m as ProjectRoleSchema } from '../../../../../../chunks/src.js-C5mUn1eC.js';
+import { f as getProjectProvider } from '../../../../../../chunks/providers.server.js-2HaeDkdE.js';
+import { y as requireCanManageMembers, z as requireTargetIsOrgMember } from '../../../../../../chunks/access.server.js-CNK7b0lL.js';
+import { a as apiError, h as handleApiError, t as throwZodError, A as ApiErrorCode } from '../../../../../../chunks/api-errors.js-qWNEcN6_.js';
+import { json } from '@sveltejs/kit';
+import { z } from 'zod';
+import '../../../../../../chunks/shared-server.js-BjFXsyhJ.js';
+import '../../../../../../chunks/limits.js-Dw3YYMI2.js';
+import '../../../../../../chunks/chunk-XT3XWDDV.js-CgVdm1U0.js';
+import '../../../../../../chunks/schema.js-BhmknPcU.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '../../../../../../chunks/utils2.js-CuEJmHGN.js';
+
+//#region src/routes/api/projects/[id]/members/+server.ts
+var AddMemberSchema = z.object({
+	userId: z.string().min(1, "userId is required"),
+	role: ProjectRoleSchema
+});
+var GET = async ({ params, locals }) => {
+	const { id } = params;
+	if (!id) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Missing project ID");
+	await requireCanManageMembers(locals, id);
+	const ctx = locals.ctx;
+	try {
+		return json({ members: (await getProjectProvider().listProjectMembers(ctx, id, { limit: 200 })).items });
+	} catch (err) {
+		handleApiError(err, "Failed to load members");
+	}
+};
+var POST = async ({ params, request, locals }) => {
+	const { id } = params;
+	if (!id) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Missing project ID");
+	await requireCanManageMembers(locals, id);
+	const ctx = locals.ctx;
+	const body = await request.json().catch(() => null);
+	const parsed = AddMemberSchema.safeParse(body);
+	if (!parsed.success) throwZodError(parsed.error);
+	const project = await getProjectProvider().getProject(ctx, id);
+	if (!project) apiError(404, ApiErrorCode.NOT_FOUND, "Project not found");
+	await requireTargetIsOrgMember(locals, project.orgId, parsed.data.userId);
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const member = {
+		projectId: id,
+		userId: parsed.data.userId,
+		role: parsed.data.role,
+		joinedAt: now,
+		updatedAt: now,
+		updatedBy: ctx.userId || parsed.data.userId,
+		deletedAt: null
+	};
+	try {
+		await getProjectProvider().addProjectMember(ctx, member);
+		return json(member, { status: 201 });
+	} catch (err) {
+		handleApiError(err, "Failed to add member");
+	}
+};
+
+export { GET, POST };
+//# sourceMappingURL=_server.ts.js-DDJWHB1r.js.map

package/build/server/chunks/entries/endpoints/api/projects/_id_/members/_server.ts.js-DDJWHB1r.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-DDJWHB1r.js","sources":["../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/projects/_id_/members/_server.ts.js"],"sourcesContent":["import { f as ProjectRoleSchema } from \"../../../../../../chunks/src.js\";\nimport { _ as getProjectProvider } from \"../../../../../../chunks/providers.server.js\";\nimport { C as requireTargetIsOrgMember, d as requireCanManageMembers } from \"../../../../../../chunks/access.server.js\";\nimport { i as throwZodError, n as apiError, r as handleApiError, t as ApiErrorCode } from \"../../../../../../chunks/api-errors.js\";\nimport { json } from \"@sveltejs/kit\";\nimport { z } from \"zod\";\n//#region src/routes/api/projects/[id]/members/+server.ts\nvar AddMemberSchema = z.object({\n\tuserId: z.string().min(1, \"userId is required\"),\n\trole: ProjectRoleSchema\n});\nvar GET = async ({ params, locals }) => {\n\tconst { id } = params;\n\tif (!id) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing project ID\");\n\tawait requireCanManageMembers(locals, id);\n\tconst ctx = locals.ctx;\n\ttry {\n\t\treturn json({ members: (await getProjectProvider().listProjectMembers(ctx, id, { limit: 200 })).items });\n\t} catch (err) {\n\t\thandleApiError(err, \"Failed to load members\");\n\t}\n};\nvar POST = async ({ params, request, locals }) => {\n\tconst { id } = params;\n\tif (!id) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing project ID\");\n\tawait requireCanManageMembers(locals, id);\n\tconst ctx = locals.ctx;\n\tconst body = await request.json().catch(() => null);\n\tconst parsed = AddMemberSchema.safeParse(body);\n\tif (!parsed.success) throwZodError(parsed.error);\n\tconst project = await getProjectProvider().getProject(ctx, id);\n\tif (!project) apiError(404, ApiErrorCode.NOT_FOUND, \"Project not found\");\n\tawait requireTargetIsOrgMember(locals, project.orgId, parsed.data.userId);\n\tconst now = (/* @__PURE__ */ new Date()).toISOString();\n\tconst member = {\n\t\tprojectId: id,\n\t\tuserId: parsed.data.userId,\n\t\trole: parsed.data.role,\n\t\tjoinedAt: now,\n\t\tupdatedAt: now,\n\t\tupdatedBy: ctx.userId || parsed.data.userId,\n\t\tdeletedAt: null\n\t};\n\ttry {\n\t\tawait getProjectProvider().addProjectMember(ctx, member);\n\t\treturn json(member, { status: 201 });\n\t} catch (err) {\n\t\thandleApiError(err, \"Failed to add member\");\n\t}\n};\n//#endregion\nexport { GET, POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAMA;AACA,IAAI,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;AAC/B,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,oBAAoB,CAAC;AAChD,CAAC,IAAI,EAAE;AACP,CAAC,CAAC;AACC,IAAC,GAAG,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AACxC,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM;AACtB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;AAC7E,CAAC,MAAM,uBAAuB,CAAC,MAAM,EAAE,EAAE,CAAC;AAC1C,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACvB,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,kBAAkB,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;AAC1G,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,cAAc,CAAC,GAAG,EAAE,wBAAwB,CAAC;AAC/C,CAAC;AACD;AACG,IAAC,IAAI,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AAClD,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM;AACtB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;AAC7E,CAAC,MAAM,uBAAuB,CAAC,MAAM,EAAE,EAAE,CAAC;AAC1C,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACvB,CAAC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;AACpD,CAAC,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC;AAC/C,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AACjD,CAAC,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC;AAC/D,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,mBAAmB,CAAC;AACzE,CAAC,MAAM,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;AAC1E,CAAC,MAAM,GAAG,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACvD,CAAC,MAAM,MAAM,GAAG;AAChB,EAAE,SAAS,EAAE,EAAE;AACf,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;AAC5B,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;AACxB,EAAE,QAAQ,EAAE,GAAG;AACf,EAAE,SAAS,EAAE,GAAG;AAChB,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM;AAC7C,EAAE,SAAS,EAAE;AACb,EAAE;AACF,CAAC,IAAI;AACL,EAAE,MAAM,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC;AAC1D,EAAE,OAAO,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AACtC,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,cAAc,CAAC,GAAG,EAAE,sBAAsB,CAAC;AAC7C,CAAC;AACD;;;;"}

package/build/server/chunks/entries/endpoints/api/projects/_id_/members/_userId_/_server.ts.js-Cn8FpuhA.js

@@ -0,0 +1,64 @@
+import { m as ProjectRoleSchema } from '../../../../../../../chunks/src.js-C5mUn1eC.js';
+import { f as getProjectProvider } from '../../../../../../../chunks/providers.server.js-2HaeDkdE.js';
+import { y as requireCanManageMembers, A as checkOwnerRemoval } from '../../../../../../../chunks/access.server.js-CNK7b0lL.js';
+import { a as apiError, h as handleApiError, t as throwZodError, A as ApiErrorCode } from '../../../../../../../chunks/api-errors.js-qWNEcN6_.js';
+import { z } from 'zod';
+import '../../../../../../../chunks/shared-server.js-BjFXsyhJ.js';
+import '../../../../../../../chunks/limits.js-Dw3YYMI2.js';
+import '../../../../../../../chunks/chunk-XT3XWDDV.js-CgVdm1U0.js';
+import '../../../../../../../chunks/schema.js-BhmknPcU.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '@sveltejs/kit';
+import '../../../../../../../chunks/utils2.js-CuEJmHGN.js';
+
+//#region src/routes/api/projects/[id]/members/[userId]/+server.ts
+var UpdateRoleSchema = z.object({ role: ProjectRoleSchema });
+var PATCH = async ({ params, request, locals }) => {
+	const { id, userId } = params;
+	if (!id || !userId) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Missing project ID or user ID");
+	await requireCanManageMembers(locals, id);
+	const ctx = locals.ctx;
+	const body = await request.json().catch(() => null);
+	const parsed = UpdateRoleSchema.safeParse(body);
+	if (!parsed.success) throwZodError(parsed.error);
+	try {
+		await getProjectProvider().updateProjectMemberRole(ctx, id, userId, parsed.data.role);
+		return new Response(null, { status: 204 });
+	} catch (err) {
+		handleApiError(err, "Failed to update role");
+	}
+};
+var DELETE = async ({ params, url, locals }) => {
+	const { id, userId } = params;
+	if (!id || !userId) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Missing project ID or user ID");
+	await requireCanManageMembers(locals, id);
+	const ctx = locals.ctx;
+	const confirmed = url.searchParams.get("confirm") === "true";
+	const projects = getProjectProvider();
+	const target = await projects.getProjectMember(ctx, id, userId);
+	if (!target) return new Response(null, { status: 204 });
+	if (target.role === "owner") {
+		const page = await projects.listProjectMembers(ctx, id, { limit: 200 });
+		const decision = checkOwnerRemoval({
+			target: { role: target.role },
+			allMembers: page.items.map((m) => ({ role: m.role })),
+			confirmed
+		});
+		if (decision === "sole_owner") apiError(409, ApiErrorCode.CONFLICT, "Cannot remove the sole owner of a project. Assign another owner first, or use reclaim to add a co-owner.");
+		if (decision === "needs_confirm") apiError(409, ApiErrorCode.CONFLICT, "Removing another project owner requires explicit confirmation. Retry with ?confirm=true.");
+	}
+	try {
+		await projects.removeProjectMember(ctx, id, userId);
+		return new Response(null, { status: 204 });
+	} catch (err) {
+		handleApiError(err, "Failed to remove member");
+	}
+};
+
+export { DELETE, PATCH };
+//# sourceMappingURL=_server.ts.js-Cn8FpuhA.js.map

package/build/server/chunks/entries/endpoints/api/projects/_id_/members/_userId_/_server.ts.js-Cn8FpuhA.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-Cn8FpuhA.js","sources":["../../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/projects/_id_/members/_userId_/_server.ts.js"],"sourcesContent":["import { f as ProjectRoleSchema } from \"../../../../../../../chunks/src.js\";\nimport { _ as getProjectProvider } from \"../../../../../../../chunks/providers.server.js\";\nimport { D as checkOwnerRemoval, d as requireCanManageMembers } from \"../../../../../../../chunks/access.server.js\";\nimport { i as throwZodError, n as apiError, r as handleApiError, t as ApiErrorCode } from \"../../../../../../../chunks/api-errors.js\";\nimport { z } from \"zod\";\n//#region src/routes/api/projects/[id]/members/[userId]/+server.ts\nvar UpdateRoleSchema = z.object({ role: ProjectRoleSchema });\nvar PATCH = async ({ params, request, locals }) => {\n\tconst { id, userId } = params;\n\tif (!id || !userId) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing project ID or user ID\");\n\tawait requireCanManageMembers(locals, id);\n\tconst ctx = locals.ctx;\n\tconst body = await request.json().catch(() => null);\n\tconst parsed = UpdateRoleSchema.safeParse(body);\n\tif (!parsed.success) throwZodError(parsed.error);\n\ttry {\n\t\tawait getProjectProvider().updateProjectMemberRole(ctx, id, userId, parsed.data.role);\n\t\treturn new Response(null, { status: 204 });\n\t} catch (err) {\n\t\thandleApiError(err, \"Failed to update role\");\n\t}\n};\nvar DELETE = async ({ params, url, locals }) => {\n\tconst { id, userId } = params;\n\tif (!id || !userId) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing project ID or user ID\");\n\tawait requireCanManageMembers(locals, id);\n\tconst ctx = locals.ctx;\n\tconst confirmed = url.searchParams.get(\"confirm\") === \"true\";\n\tconst projects = getProjectProvider();\n\tconst target = await projects.getProjectMember(ctx, id, userId);\n\tif (!target) return new Response(null, { status: 204 });\n\tif (target.role === \"owner\") {\n\t\tconst page = await projects.listProjectMembers(ctx, id, { limit: 200 });\n\t\tconst decision = checkOwnerRemoval({\n\t\t\ttarget: { role: target.role },\n\t\t\tallMembers: page.items.map((m) => ({ role: m.role })),\n\t\t\tconfirmed\n\t\t});\n\t\tif (decision === \"sole_owner\") apiError(409, ApiErrorCode.CONFLICT, \"Cannot remove the sole owner of a project. Assign another owner first, or use reclaim to add a co-owner.\");\n\t\tif (decision === \"needs_confirm\") apiError(409, ApiErrorCode.CONFLICT, \"Removing another project owner requires explicit confirmation. Retry with ?confirm=true.\");\n\t}\n\ttry {\n\t\tawait projects.removeProjectMember(ctx, id, userId);\n\t\treturn new Response(null, { status: 204 });\n\t} catch (err) {\n\t\thandleApiError(err, \"Failed to remove member\");\n\t}\n};\n//#endregion\nexport { DELETE, PATCH };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAKA;AACA,IAAI,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;AACzD,IAAC,KAAK,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AACnD,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM;AAC9B,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,+BAA+B,CAAC;AACnG,CAAC,MAAM,uBAAuB,CAAC,MAAM,EAAE,EAAE,CAAC;AAC1C,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACvB,CAAC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;AACpD,CAAC,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC;AAChD,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AACjD,CAAC,IAAI;AACL,EAAE,MAAM,kBAAkB,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;AACvF,EAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC5C,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,cAAc,CAAC,GAAG,EAAE,uBAAuB,CAAC;AAC9C,CAAC;AACD;AACG,IAAC,MAAM,GAAG,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK;AAChD,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM;AAC9B,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,+BAA+B,CAAC;AACnG,CAAC,MAAM,uBAAuB,CAAC,MAAM,EAAE,EAAE,CAAC;AAC1C,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACvB,CAAC,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,MAAM;AAC7D,CAAC,MAAM,QAAQ,GAAG,kBAAkB,EAAE;AACtC,CAAC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC;AAChE,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AACxD,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE;AAC9B,EAAE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACzE,EAAE,MAAM,QAAQ,GAAG,iBAAiB,CAAC;AACrC,GAAG,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;AAChC,GAAG,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACxD,GAAG;AACH,GAAG,CAAC;AACJ,EAAE,IAAI,QAAQ,KAAK,YAAY,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,0GAA0G,CAAC;AACjL,EAAE,IAAI,QAAQ,KAAK,eAAe,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,0FAA0F,CAAC;AACpK,CAAC;AACD,CAAC,IAAI;AACL,EAAE,MAAM,QAAQ,CAAC,mBAAmB,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC;AACrD,EAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC5C,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,cAAc,CAAC,GAAG,EAAE,yBAAyB,CAAC;AAChD,CAAC;AACD;;;;"}

package/build/server/chunks/entries/endpoints/api/projects/_id_/reclaim/_server.ts.js-BqvmtPy9.js

@@ -0,0 +1,48 @@
+import { f as getProjectProvider } from '../../../../../../chunks/providers.server.js-2HaeDkdE.js';
+import { B as requireCanReclaim } from '../../../../../../chunks/access.server.js-CNK7b0lL.js';
+import { a as apiError, h as handleApiError, A as ApiErrorCode } from '../../../../../../chunks/api-errors.js-qWNEcN6_.js';
+import { json } from '@sveltejs/kit';
+import '../../../../../../chunks/shared-server.js-BjFXsyhJ.js';
+import '../../../../../../chunks/src.js-C5mUn1eC.js';
+import 'zod';
+import '../../../../../../chunks/limits.js-Dw3YYMI2.js';
+import '../../../../../../chunks/chunk-XT3XWDDV.js-CgVdm1U0.js';
+import '../../../../../../chunks/schema.js-BhmknPcU.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '../../../../../../chunks/utils2.js-CuEJmHGN.js';
+
+//#region src/routes/api/projects/[id]/reclaim/+server.ts
+/**
+* §5 — org owner/admin escape hatch. Adds the actor as a co-owner; does
+* NOT demote the existing owner. Idempotent: reclaiming twice is a no-op
+* because `addProjectMember` reactivates a soft-deleted row in place.
+*/
+var POST = async ({ params, locals }) => {
+	const { id } = params;
+	if (!id) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Missing project ID");
+	const { user, ctx } = await requireCanReclaim(locals, id);
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const member = {
+		projectId: id,
+		userId: user.id,
+		role: "owner",
+		joinedAt: now,
+		updatedAt: now,
+		updatedBy: ctx.userId || user.id,
+		deletedAt: null
+	};
+	try {
+		await getProjectProvider().addProjectMember(ctx, member);
+		return json({ member }, { status: 201 });
+	} catch (err) {
+		handleApiError(err, "Failed to reclaim project");
+	}
+};
+
+export { POST };
+//# sourceMappingURL=_server.ts.js-BqvmtPy9.js.map

package/build/server/chunks/entries/endpoints/api/projects/_id_/reclaim/_server.ts.js-BqvmtPy9.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-BqvmtPy9.js","sources":["../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/projects/_id_/reclaim/_server.ts.js"],"sourcesContent":["import { _ as getProjectProvider } from \"../../../../../../chunks/providers.server.js\";\nimport { f as requireCanReclaim } from \"../../../../../../chunks/access.server.js\";\nimport { n as apiError, r as handleApiError, t as ApiErrorCode } from \"../../../../../../chunks/api-errors.js\";\nimport { json } from \"@sveltejs/kit\";\n//#region src/routes/api/projects/[id]/reclaim/+server.ts\n/**\n* §5 — org owner/admin escape hatch. Adds the actor as a co-owner; does\n* NOT demote the existing owner. Idempotent: reclaiming twice is a no-op\n* because `addProjectMember` reactivates a soft-deleted row in place.\n*/\nvar POST = async ({ params, locals }) => {\n\tconst { id } = params;\n\tif (!id) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing project ID\");\n\tconst { user, ctx } = await requireCanReclaim(locals, id);\n\tconst now = (/* @__PURE__ */ new Date()).toISOString();\n\tconst member = {\n\t\tprojectId: id,\n\t\tuserId: user.id,\n\t\trole: \"owner\",\n\t\tjoinedAt: now,\n\t\tupdatedAt: now,\n\t\tupdatedBy: ctx.userId || user.id,\n\t\tdeletedAt: null\n\t};\n\ttry {\n\t\tawait getProjectProvider().addProjectMember(ctx, member);\n\t\treturn json({ member }, { status: 201 });\n\t} catch (err) {\n\t\thandleApiError(err, \"Failed to reclaim project\");\n\t}\n};\n//#endregion\nexport { POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,IAAI,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AACzC,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM;AACtB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;AAC7E,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,EAAE,CAAC;AAC1D,CAAC,MAAM,GAAG,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACvD,CAAC,MAAM,MAAM,GAAG;AAChB,EAAE,SAAS,EAAE,EAAE;AACf,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;AACjB,EAAE,IAAI,EAAE,OAAO;AACf,EAAE,QAAQ,EAAE,GAAG;AACf,EAAE,SAAS,EAAE,GAAG;AAChB,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE;AAClC,EAAE,SAAS,EAAE;AACb,EAAE;AACF,CAAC,IAAI;AACL,EAAE,MAAM,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC;AAC1D,EAAE,OAAO,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC1C,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,cAAc,CAAC,GAAG,EAAE,2BAA2B,CAAC;AAClD,CAAC;AACD;;;;"}

package/build/server/chunks/entries/endpoints/api/projects/_server.ts.js-5od3tYNg.js

@@ -0,0 +1,85 @@
+import { s as slugify, l as ProjectVisibilitySchema } from '../../../../chunks/src.js-C5mUn1eC.js';
+import { f as getProjectProvider, P as ProviderError } from '../../../../chunks/providers.server.js-2HaeDkdE.js';
+import { t as requireCanCreateProject } from '../../../../chunks/access.server.js-CNK7b0lL.js';
+import { a as apiError, h as handleApiError, t as throwZodError, A as ApiErrorCode } from '../../../../chunks/api-errors.js-qWNEcN6_.js';
+import { json } from '@sveltejs/kit';
+import { z } from 'zod';
+import { randomUUID } from 'node:crypto';
+import '../../../../chunks/shared-server.js-BjFXsyhJ.js';
+import '../../../../chunks/limits.js-Dw3YYMI2.js';
+import '../../../../chunks/chunk-XT3XWDDV.js-CgVdm1U0.js';
+import '../../../../chunks/schema.js-BhmknPcU.js';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '../../../../chunks/utils2.js-CuEJmHGN.js';
+
+//#region src/routes/api/projects/+server.ts
+var MAX_SLUG_ATTEMPTS = 25;
+function isSlugConflict(err) {
+	return err instanceof ProviderError && err.statusCode === 409 && /projects_org_id_slug_key/.test(err.message);
+}
+function isNameConflict(err) {
+	return err instanceof ProviderError && err.statusCode === 409 && /projects_org_name_unique/.test(err.message);
+}
+var CreateProjectBody = z.object({
+	name: z.string().min(1, "Project name is required").max(128).trim(),
+	description: z.string().max(2e3).optional(),
+	visibility: ProjectVisibilitySchema.default("private"),
+	autoJoinOnUpload: z.boolean().optional()
+});
+var GET = async ({ locals }) => {
+	const ctx = locals.ctx;
+	if (!ctx.actingOrgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, "No active organization");
+	try {
+		return json({ projects: (await getProjectProvider().listProjects(ctx, ctx.actingOrgId, { limit: 200 })).items });
+	} catch (err) {
+		handleApiError(err, "Failed to load projects");
+	}
+};
+var POST = async ({ request, locals }) => {
+	const ctx = locals.ctx;
+	if (!ctx.actingOrgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, "No active organization");
+	await requireCanCreateProject(locals, ctx.actingOrgId);
+	const body = await request.json().catch(() => null);
+	const parsed = CreateProjectBody.safeParse(body);
+	if (!parsed.success) throwZodError(parsed.error);
+	const autoJoinOnUpload = parsed.data.autoJoinOnUpload ?? false;
+	if (autoJoinOnUpload && parsed.data.visibility !== "public") apiError(400, ApiErrorCode.VALIDATION_FAILED, "autoJoinOnUpload requires visibility=public");
+	const projectStore = getProjectProvider();
+	const baseSlug = slugify(parsed.data.name) || "project";
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const projectId = randomUUID();
+	for (let attempt = 0; attempt < MAX_SLUG_ATTEMPTS; attempt++) {
+		const slug = attempt === 0 ? baseSlug : `${baseSlug}-${attempt + 1}`;
+		const project = {
+			id: projectId,
+			orgId: ctx.actingOrgId,
+			name: parsed.data.name,
+			slug,
+			description: parsed.data.description,
+			visibility: parsed.data.visibility,
+			ownerId: locals.user.id,
+			createdBy: locals.user.id,
+			updatedBy: locals.user.id,
+			autoJoinOnUpload,
+			createdAt: now,
+			updatedAt: now,
+			deletedAt: null
+		};
+		try {
+			await projectStore.createProject(ctx, project);
+			return json(project, { status: 201 });
+		} catch (err) {
+			if (isNameConflict(err)) apiError(409, ApiErrorCode.CONFLICT, "A project with that name already exists in this organization.");
+			if (isSlugConflict(err)) continue;
+			handleApiError(err, "Failed to create project");
+		}
+	}
+	apiError(409, ApiErrorCode.CONFLICT, "Could not pick a unique project slug after several attempts.");
+};
+
+export { GET, POST };
+//# sourceMappingURL=_server.ts.js-5od3tYNg.js.map

package/build/server/chunks/entries/endpoints/api/projects/_server.ts.js-5od3tYNg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-5od3tYNg.js","sources":["../../../../../../../.svelte-kit/output/server/entries/endpoints/api/projects/_server.ts.js"],"sourcesContent":["import { p as ProjectVisibilitySchema, w as slugify } from \"../../../../chunks/src.js\";\nimport { M as ProviderError, _ as getProjectProvider } from \"../../../../chunks/providers.server.js\";\nimport { s as requireCanCreateProject } from \"../../../../chunks/access.server.js\";\nimport { i as throwZodError, n as apiError, r as handleApiError, t as ApiErrorCode } from \"../../../../chunks/api-errors.js\";\nimport { json } from \"@sveltejs/kit\";\nimport { z } from \"zod\";\nimport { randomUUID } from \"node:crypto\";\n//#region src/routes/api/projects/+server.ts\nvar MAX_SLUG_ATTEMPTS = 25;\nfunction isSlugConflict(err) {\n\treturn err instanceof ProviderError && err.statusCode === 409 && /projects_org_id_slug_key/.test(err.message);\n}\nfunction isNameConflict(err) {\n\treturn err instanceof ProviderError && err.statusCode === 409 && /projects_org_name_unique/.test(err.message);\n}\nvar CreateProjectBody = z.object({\n\tname: z.string().min(1, \"Project name is required\").max(128).trim(),\n\tdescription: z.string().max(2e3).optional(),\n\tvisibility: ProjectVisibilitySchema.default(\"private\"),\n\tautoJoinOnUpload: z.boolean().optional()\n});\nvar GET = async ({ locals }) => {\n\tconst ctx = locals.ctx;\n\tif (!ctx.actingOrgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"No active organization\");\n\ttry {\n\t\treturn json({ projects: (await getProjectProvider().listProjects(ctx, ctx.actingOrgId, { limit: 200 })).items });\n\t} catch (err) {\n\t\thandleApiError(err, \"Failed to load projects\");\n\t}\n};\nvar POST = async ({ request, locals }) => {\n\tconst ctx = locals.ctx;\n\tif (!ctx.actingOrgId) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"No active organization\");\n\tawait requireCanCreateProject(locals, ctx.actingOrgId);\n\tconst body = await request.json().catch(() => null);\n\tconst parsed = CreateProjectBody.safeParse(body);\n\tif (!parsed.success) throwZodError(parsed.error);\n\tconst autoJoinOnUpload = parsed.data.autoJoinOnUpload ?? false;\n\tif (autoJoinOnUpload && parsed.data.visibility !== \"public\") apiError(400, ApiErrorCode.VALIDATION_FAILED, \"autoJoinOnUpload requires visibility=public\");\n\tconst projectStore = getProjectProvider();\n\tconst baseSlug = slugify(parsed.data.name) || \"project\";\n\tconst now = (/* @__PURE__ */ new Date()).toISOString();\n\tconst projectId = randomUUID();\n\tfor (let attempt = 0; attempt < MAX_SLUG_ATTEMPTS; attempt++) {\n\t\tconst slug = attempt === 0 ? baseSlug : `${baseSlug}-${attempt + 1}`;\n\t\tconst project = {\n\t\t\tid: projectId,\n\t\t\torgId: ctx.actingOrgId,\n\t\t\tname: parsed.data.name,\n\t\t\tslug,\n\t\t\tdescription: parsed.data.description,\n\t\t\tvisibility: parsed.data.visibility,\n\t\t\townerId: locals.user.id,\n\t\t\tcreatedBy: locals.user.id,\n\t\t\tupdatedBy: locals.user.id,\n\t\t\tautoJoinOnUpload,\n\t\t\tcreatedAt: now,\n\t\t\tupdatedAt: now,\n\t\t\tdeletedAt: null\n\t\t};\n\t\ttry {\n\t\t\tawait projectStore.createProject(ctx, project);\n\t\t\treturn json(project, { status: 201 });\n\t\t} catch (err) {\n\t\t\tif (isNameConflict(err)) apiError(409, ApiErrorCode.CONFLICT, \"A project with that name already exists in this organization.\");\n\t\t\tif (isSlugConflict(err)) continue;\n\t\t\thandleApiError(err, \"Failed to create project\");\n\t\t}\n\t}\n\tapiError(409, ApiErrorCode.CONFLICT, \"Could not pick a unique project slug after several attempts.\");\n};\n//#endregion\nexport { GET, POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAOA;AACA,IAAI,iBAAiB,GAAG,EAAE;AAC1B,SAAS,cAAc,CAAC,GAAG,EAAE;AAC7B,CAAC,OAAO,GAAG,YAAY,aAAa,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;AAC9G;AACA,SAAS,cAAc,CAAC,GAAG,EAAE;AAC7B,CAAC,OAAO,GAAG,YAAY,aAAa,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;AAC9G;AACA,IAAI,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;AACjC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;AACpE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;AAC5C,CAAC,UAAU,EAAE,uBAAuB,CAAC,OAAO,CAAC,SAAS,CAAC;AACvD,CAAC,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ;AACvC,CAAC,CAAC;AACC,IAAC,GAAG,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK;AAChC,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACvB,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;AAC9F,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,MAAM,kBAAkB,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;AAClH,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,cAAc,CAAC,GAAG,EAAE,yBAAyB,CAAC;AAChD,CAAC;AACD;AACG,IAAC,IAAI,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AAC1C,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG;AACvB,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;AAC9F,CAAC,MAAM,uBAAuB,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC;AACvD,CAAC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;AACpD,CAAC,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC;AACjD,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AACjD,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,KAAK;AAC/D,CAAC,IAAI,gBAAgB,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,6CAA6C,CAAC;AAC1J,CAAC,MAAM,YAAY,GAAG,kBAAkB,EAAE;AAC1C,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS;AACxD,CAAC,MAAM,GAAG,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACvD,CAAC,MAAM,SAAS,GAAG,UAAU,EAAE;AAC/B,CAAC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,iBAAiB,EAAE,OAAO,EAAE,EAAE;AAC/D,EAAE,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;AACtE,EAAE,MAAM,OAAO,GAAG;AAClB,GAAG,EAAE,EAAE,SAAS;AAChB,GAAG,KAAK,EAAE,GAAG,CAAC,WAAW;AACzB,GAAG,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;AACzB,GAAG,IAAI;AACP,GAAG,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;AACvC,GAAG,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU;AACrC,GAAG,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;AAC1B,GAAG,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;AAC5B,GAAG,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;AAC5B,GAAG,gBAAgB;AACnB,GAAG,SAAS,EAAE,GAAG;AACjB,GAAG,SAAS,EAAE,GAAG;AACjB,GAAG,SAAS,EAAE;AACd,GAAG;AACH,EAAE,IAAI;AACN,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC;AACjD,GAAG,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AACxC,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,+DAA+D,CAAC;AACjI,GAAG,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE;AAC5B,GAAG,cAAc,CAAC,GAAG,EAAE,0BAA0B,CAAC;AAClD,EAAE;AACF,CAAC;AACD,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,8DAA8D,CAAC;AACrG;;;;"}

package/build/server/chunks/entries/endpoints/auth/email/callback/_server.ts.js-sKrQa5bB.js

@@ -0,0 +1,44 @@
+import { a as getAuthProvider } from '../../../../../chunks/providers.server.js-2HaeDkdE.js';
+import { a as apiError, A as ApiErrorCode } from '../../../../../chunks/api-errors.js-qWNEcN6_.js';
+import { s as setSessionCookie, a as setRefreshCookie } from '../../../../../chunks/admin-auth.server.js-B0irjBkg.js';
+import { s as safeRedirectTarget } from '../../../../../chunks/redirect.js-B4i9gSkt.js';
+import { b as bootstrapUserSession } from '../../../../../chunks/auth-bootstrap.server.js-CDv98EHF.js';
+import { redirect } from '@sveltejs/kit';
+import '../../../../../chunks/shared-server.js-BjFXsyhJ.js';
+import '../../../../../chunks/src.js-C5mUn1eC.js';
+import 'zod';
+import '../../../../../chunks/limits.js-Dw3YYMI2.js';
+import '../../../../../chunks/chunk-XT3XWDDV.js-CgVdm1U0.js';
+import '../../../../../chunks/schema.js-BhmknPcU.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '../../../../../chunks/utils2.js-CuEJmHGN.js';
+import 'node:dns/promises';
+import 'node:net';
+
+//#region src/routes/auth/email/callback/+server.ts
+/**
+* GET /auth/email/callback?token_hash=...&type=...&redirectTo=/library
+*
+* The user clicked the magic link in their inbox. Hand the full URL to the
+* adapter (it knows its own token format), set cookies on success, redirect
+* to the destination. Mirrors `/auth/supabase/callback` but capability-named
+* — this route doesn't know which IdP brokered the email.
+*/
+var GET = async ({ url, cookies }) => {
+	const emailLink = getAuthProvider().emailLink;
+	if (!emailLink) apiError(501, ApiErrorCode.INTERNAL, "Email sign-in is not supported by this provider.");
+	const result = await emailLink.verifyMagicLink(url.toString());
+	if (!result) apiError(401, ApiErrorCode.UNAUTHORIZED, "This sign-in link is invalid or has expired.");
+	await bootstrapUserSession(result.user);
+	setSessionCookie(cookies, result.sessionToken);
+	if (result.refreshToken) setRefreshCookie(cookies, result.refreshToken);
+	redirect(303, safeRedirectTarget(url.searchParams.get("redirectTo"), "/library"));
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts.js-sKrQa5bB.js.map

package/build/server/chunks/entries/endpoints/auth/email/callback/_server.ts.js-sKrQa5bB.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-sKrQa5bB.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/auth/email/callback/_server.ts.js"],"sourcesContent":["import { r as getAuthProvider } from \"../../../../../chunks/providers.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\nimport { c as setRefreshCookie, l as setSessionCookie } from \"../../../../../chunks/admin-auth.server.js\";\nimport \"../../../../../chunks/auth.server.js\";\nimport { t as safeRedirectTarget } from \"../../../../../chunks/redirect.js\";\nimport { t as bootstrapUserSession } from \"../../../../../chunks/auth-bootstrap.server.js\";\nimport { redirect } from \"@sveltejs/kit\";\n//#region src/routes/auth/email/callback/+server.ts\n/**\n* GET /auth/email/callback?token_hash=...&type=...&redirectTo=/library\n*\n* The user clicked the magic link in their inbox. Hand the full URL to the\n* adapter (it knows its own token format), set cookies on success, redirect\n* to the destination. Mirrors `/auth/supabase/callback` but capability-named\n* — this route doesn't know which IdP brokered the email.\n*/\nvar GET = async ({ url, cookies }) => {\n\tconst emailLink = getAuthProvider().emailLink;\n\tif (!emailLink) apiError(501, ApiErrorCode.INTERNAL, \"Email sign-in is not supported by this provider.\");\n\tconst result = await emailLink.verifyMagicLink(url.toString());\n\tif (!result) apiError(401, ApiErrorCode.UNAUTHORIZED, \"This sign-in link is invalid or has expired.\");\n\tawait bootstrapUserSession(result.user);\n\tsetSessionCookie(cookies, result.sessionToken);\n\tif (result.refreshToken) setRefreshCookie(cookies, result.refreshToken);\n\tredirect(303, safeRedirectTarget(url.searchParams.get(\"redirectTo\"), \"/library\"));\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAOA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK;AACtC,CAAC,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC,SAAS;AAC9C,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,kDAAkD,CAAC;AACzG,CAAC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;AAC/D,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,8CAA8C,CAAC;AACtG,CAAC,MAAM,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC;AACxC,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AAC/C,CAAC,IAAI,MAAM,CAAC,YAAY,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AACxE,CAAC,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC,CAAC;AAClF;;;;"}

package/build/server/chunks/entries/endpoints/auth/supabase/callback/_server.ts.js-LFbyI81K.js

@@ -0,0 +1,48 @@
+import { a as getAuthProvider } from '../../../../../chunks/providers.server.js-2HaeDkdE.js';
+import { a as apiError, A as ApiErrorCode } from '../../../../../chunks/api-errors.js-qWNEcN6_.js';
+import { s as setSessionCookie, a as setRefreshCookie } from '../../../../../chunks/admin-auth.server.js-B0irjBkg.js';
+import { s as safeRedirectTarget } from '../../../../../chunks/redirect.js-B4i9gSkt.js';
+import { b as bootstrapUserSession } from '../../../../../chunks/auth-bootstrap.server.js-CDv98EHF.js';
+import { redirect } from '@sveltejs/kit';
+import '../../../../../chunks/shared-server.js-BjFXsyhJ.js';
+import '../../../../../chunks/src.js-C5mUn1eC.js';
+import 'zod';
+import '../../../../../chunks/limits.js-Dw3YYMI2.js';
+import '../../../../../chunks/chunk-XT3XWDDV.js-CgVdm1U0.js';
+import '../../../../../chunks/schema.js-BhmknPcU.js';
+import 'node:crypto';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '../../../../../chunks/utils2.js-CuEJmHGN.js';
+import 'node:dns/promises';
+import 'node:net';
+
+//#region src/routes/auth/supabase/callback/+server.ts
+/**
+* GET /auth/supabase/callback?code=...&redirectTo=/library
+*
+* Completes a Supabase OAuth round-trip. Exchanges the authorization code
+* for a session, sets the session cookie, and redirects to `redirectTo`.
+*
+* Post-verification flow (data-row seeding + first-admin bootstrap) lives in
+* `bootstrapUserSession` so the email-link and OAuth paths follow the same
+* sequence in the same order.
+*/
+var GET = async ({ url, cookies }) => {
+	const code = url.searchParams.get("code");
+	if (!code) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Missing authorization code");
+	const oauth = getAuthProvider().oauth;
+	if (!oauth) apiError(501, ApiErrorCode.INTERNAL, "OAuth is not supported by the configured auth provider.");
+	const result = await oauth.exchangeOAuthCode(code);
+	if (!result) apiError(401, ApiErrorCode.UNAUTHORIZED, "OAuth exchange failed");
+	await bootstrapUserSession(result.user);
+	setSessionCookie(cookies, result.sessionToken);
+	setRefreshCookie(cookies, result.refreshToken);
+	redirect(303, safeRedirectTarget(url.searchParams.get("redirectTo"), "/library"));
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts.js-LFbyI81K.js.map

package/build/server/chunks/entries/endpoints/auth/supabase/callback/_server.ts.js-LFbyI81K.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts.js-LFbyI81K.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/auth/supabase/callback/_server.ts.js"],"sourcesContent":["import { r as getAuthProvider } from \"../../../../../chunks/providers.server.js\";\nimport { n as apiError, t as ApiErrorCode } from \"../../../../../chunks/api-errors.js\";\nimport { c as setRefreshCookie, l as setSessionCookie } from \"../../../../../chunks/admin-auth.server.js\";\nimport \"../../../../../chunks/auth.server.js\";\nimport { t as safeRedirectTarget } from \"../../../../../chunks/redirect.js\";\nimport { t as bootstrapUserSession } from \"../../../../../chunks/auth-bootstrap.server.js\";\nimport { redirect } from \"@sveltejs/kit\";\n//#region src/routes/auth/supabase/callback/+server.ts\n/**\n* GET /auth/supabase/callback?code=...&redirectTo=/library\n*\n* Completes a Supabase OAuth round-trip. Exchanges the authorization code\n* for a session, sets the session cookie, and redirects to `redirectTo`.\n*\n* Post-verification flow (data-row seeding + first-admin bootstrap) lives in\n* `bootstrapUserSession` so the email-link and OAuth paths follow the same\n* sequence in the same order.\n*/\nvar GET = async ({ url, cookies }) => {\n\tconst code = url.searchParams.get(\"code\");\n\tif (!code) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing authorization code\");\n\tconst oauth = getAuthProvider().oauth;\n\tif (!oauth) apiError(501, ApiErrorCode.INTERNAL, \"OAuth is not supported by the configured auth provider.\");\n\tconst result = await oauth.exchangeOAuthCode(code);\n\tif (!result) apiError(401, ApiErrorCode.UNAUTHORIZED, \"OAuth exchange failed\");\n\tawait bootstrapUserSession(result.user);\n\tsetSessionCookie(cookies, result.sessionToken);\n\tsetRefreshCookie(cookies, result.refreshToken);\n\tredirect(303, safeRedirectTarget(url.searchParams.get(\"redirectTo\"), \"/library\"));\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAOA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK;AACtC,CAAC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;AAC1C,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,4BAA4B,CAAC;AACvF,CAAC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC,KAAK;AACtC,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,yDAAyD,CAAC;AAC5G,CAAC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC;AACnD,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,uBAAuB,CAAC;AAC/E,CAAC,MAAM,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC;AACxC,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AAC/C,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;AAC/C,CAAC,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC,CAAC;AAClF;;;;"}