@selvajs/selva 4.8.0-beta.3 → 4.8.0-beta.4

package/build/server/chunks/chunks/resolve.server.js-CAyChPui.js

@@ -1,62 +0,0 @@
-import { S as SYSTEM_CONTEXT } from './src.js-BYv4z3-l.js';
-import { p as providers, o as getDefinitionMeta, f as getProjectProvider, k as flag } from './providers.server.js-DCnhO862.js';
-import { h as hashToken, l as looksLikeShareToken } from './token.server.js-UMCt7jB6.js';
-import { error } from '@sveltejs/kit';
-
-//#region src/lib/server/shareLinks/resolve.server.ts
-/**
-* Extract a candidate share-link token from the request.
-*   - `?token=share_…` query param (most embeddable)
-*   - `Authorization: Bearer share_…` header (server-to-server)
-*
-* Returns the raw token string, or null when none present. Does NOT validate.
-*/
-function readShareToken(request, url) {
-	if (!flag("ENABLE_SHARING")) return null;
-	const q = url.searchParams.get("token");
-	if (q && looksLikeShareToken(q)) return q;
-	const auth = request.headers.get("authorization");
-	if (auth?.startsWith("Bearer ")) {
-		const candidate = auth.slice(7).trim();
-		if (looksLikeShareToken(candidate)) return candidate;
-	}
-	return null;
-}
-/**
-* Spec §7 token-resolution path. Run before user-based auth on definition-
-* scoped routes. Returns the resolved link + a synthetic ctx on success.
-*
-* Throws only when a token is *present but invalid* for the current request
-* (wrong definition, wrong channel, expired, revoked, view-only when solve
-* was requested) — those are deliberate 401/403/429 responses to a
-* misbehaving consumer. When no token is present at all, returns null and
-* the caller falls through to the user-based auth gate.
-*/
-async function tryResolveShareToken(request, url, requestedDefinitionId, requestedChannel, opts) {
-	const raw = readShareToken(request, url);
-	if (!raw) return null;
-	const tokenHash = hashToken(raw);
-	const link = await providers.data.shareLinks.getByTokenHash(SYSTEM_CONTEXT, tokenHash);
-	if (!link) throw error(401, "Invalid or revoked share token.");
-	if (link.expiresAt && new Date(link.expiresAt).getTime() <= Date.now()) throw error(401, "Share token has expired.");
-	if (link.definitionId !== requestedDefinitionId) throw error(403, "Share token is not valid for this definition.");
-	if (link.channel !== requestedChannel) throw error(403, `Share token is for the '${link.channel}' channel only.`);
-	if (opts.requireSolve && !link.allowSolve) throw error(403, "Share token grants view-only access.");
-	const def = await getDefinitionMeta().get(SYSTEM_CONTEXT, link.definitionId);
-	if (!def) throw error(401, "Share token target no longer exists.");
-	const project = await getProjectProvider().getProject(SYSTEM_CONTEXT, def.projectId);
-	if (!project) throw error(401, "Share token target no longer exists.");
-	return {
-		link,
-		ctx: {
-			userId: "",
-			actingOrgId: project.orgId,
-			platformPermissions: [],
-			orgPermissions: [],
-			system: true
-		}
-	};
-}
-
-export { tryResolveShareToken as t };
-//# sourceMappingURL=resolve.server.js-CAyChPui.js.map

package/build/server/chunks/chunks/resolve.server.js-CAyChPui.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolve.server.js-CAyChPui.js","sources":["../../../../.svelte-kit/output/server/chunks/resolve.server.js"],"sourcesContent":["import { t as SYSTEM_CONTEXT } from \"./src.js\";\nimport { C as providers, _ as getProjectProvider, s as getDefinitionMeta, t as flag } from \"./providers.server.js\";\nimport { n as looksLikeShareToken, t as hashToken } from \"./token.server.js\";\nimport { error } from \"@sveltejs/kit\";\n//#region src/lib/server/shareLinks/resolve.server.ts\n/**\n* Extract a candidate share-link token from the request.\n*   - `?token=share_…` query param (most embeddable)\n*   - `Authorization: Bearer share_…` header (server-to-server)\n*\n* Returns the raw token string, or null when none present. Does NOT validate.\n*/\nfunction readShareToken(request, url) {\n\tif (!flag(\"ENABLE_SHARING\")) return null;\n\tconst q = url.searchParams.get(\"token\");\n\tif (q && looksLikeShareToken(q)) return q;\n\tconst auth = request.headers.get(\"authorization\");\n\tif (auth?.startsWith(\"Bearer \")) {\n\t\tconst candidate = auth.slice(7).trim();\n\t\tif (looksLikeShareToken(candidate)) return candidate;\n\t}\n\treturn null;\n}\n/**\n* Spec §7 token-resolution path. Run before user-based auth on definition-\n* scoped routes. Returns the resolved link + a synthetic ctx on success.\n*\n* Throws only when a token is *present but invalid* for the current request\n* (wrong definition, wrong channel, expired, revoked, view-only when solve\n* was requested) — those are deliberate 401/403/429 responses to a\n* misbehaving consumer. When no token is present at all, returns null and\n* the caller falls through to the user-based auth gate.\n*/\nasync function tryResolveShareToken(request, url, requestedDefinitionId, requestedChannel, opts) {\n\tconst raw = readShareToken(request, url);\n\tif (!raw) return null;\n\tconst tokenHash = hashToken(raw);\n\tconst link = await providers.data.shareLinks.getByTokenHash(SYSTEM_CONTEXT, tokenHash);\n\tif (!link) throw error(401, \"Invalid or revoked share token.\");\n\tif (link.expiresAt && new Date(link.expiresAt).getTime() <= Date.now()) throw error(401, \"Share token has expired.\");\n\tif (link.definitionId !== requestedDefinitionId) throw error(403, \"Share token is not valid for this definition.\");\n\tif (link.channel !== requestedChannel) throw error(403, `Share token is for the '${link.channel}' channel only.`);\n\tif (opts.requireSolve && !link.allowSolve) throw error(403, \"Share token grants view-only access.\");\n\tconst def = await getDefinitionMeta().get(SYSTEM_CONTEXT, link.definitionId);\n\tif (!def) throw error(401, \"Share token target no longer exists.\");\n\tconst project = await getProjectProvider().getProject(SYSTEM_CONTEXT, def.projectId);\n\tif (!project) throw error(401, \"Share token target no longer exists.\");\n\treturn {\n\t\tlink,\n\t\tctx: {\n\t\t\tuserId: \"\",\n\t\t\tactingOrgId: project.orgId,\n\t\t\tplatformPermissions: [],\n\t\t\torgPermissions: [],\n\t\t\tsystem: true\n\t\t}\n\t};\n}\n//#endregion\nexport { tryResolveShareToken as t };\n"],"names":[],"mappings":";;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE;AACtC,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,OAAO,IAAI;AACzC,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;AACxC,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;AAC1C,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;AAClD,CAAC,IAAI,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE;AAClC,EAAE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;AACxC,EAAE,IAAI,mBAAmB,CAAC,SAAS,CAAC,EAAE,OAAO,SAAS;AACtD,CAAC;AACD,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,oBAAoB,CAAC,OAAO,EAAE,GAAG,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,IAAI,EAAE;AACjG,CAAC,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC;AACzC,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,IAAI;AACtB,CAAC,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC;AACjC,CAAC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,cAAc,EAAE,SAAS,CAAC;AACvF,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,iCAAiC,CAAC;AAC/D,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,0BAA0B,CAAC;AACrH,CAAC,IAAI,IAAI,CAAC,YAAY,KAAK,qBAAqB,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,+CAA+C,CAAC;AACnH,CAAC,IAAI,IAAI,CAAC,OAAO,KAAK,gBAAgB,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,wBAAwB,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;AAClH,CAAC,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,sCAAsC,CAAC;AACpG,CAAC,MAAM,GAAG,GAAG,MAAM,iBAAiB,EAAE,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC;AAC7E,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,sCAAsC,CAAC;AACnE,CAAC,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,GAAG,CAAC,SAAS,CAAC;AACrF,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,sCAAsC,CAAC;AACvE,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE,GAAG,EAAE;AACP,GAAG,MAAM,EAAE,EAAE;AACb,GAAG,WAAW,EAAE,OAAO,CAAC,KAAK;AAC7B,GAAG,mBAAmB,EAAE,EAAE;AAC1B,GAAG,cAAc,EAAE,EAAE;AACrB,GAAG,MAAM,EAAE;AACX;AACA,EAAE;AACF;;;;"}

package/build/server/chunks/chunks/route.js-aKOAfzq_.js

@@ -1,185 +0,0 @@
-import { h as handleApiError, a as apiError, A as ApiErrorCode, t as throwZodError } from './api-errors.js-79b_3bHg.js';
-import { json } from '@sveltejs/kit';
-
-//#region src/lib/server/api/v1/route.ts
-/**
-* The shared shape of a v1 route handler.
-*
-* Every handler in this tree does the same four things — validate the path,
-* parse the body, do the work, serialize — and before these helpers existed
-* each one spelled all four out. That is 2000 lines across 27 files in which
-* the interesting part is a few lines deep, and where the boilerplate had
-* already drifted: path params were validated two different ways, and four
-* list endpoints hand-rolled a pagination clamp that disagreed with the shared
-* one they were documented as using.
-*
-* The rule these helpers exist to enforce: **a route handler parses, guards,
-* delegates and serializes — nothing else.** Anything two endpoints must agree
-* on lives here or in `@selvajs/server`, never copied into both.
-*/
-/**
-* The authenticated caller, or 401.
-*
-* Routes used to write `if (!locals.ctx) apiError(401, …)` and then reach for
-* `locals.ctx!` further down — thirteen checks and eleven non-null assertions
-* for one fact. Returning the narrowed pair means the assertion disappears: if
-* you have the result, the context exists.
-*
-* Guards in `access.server.ts` do their own 401 as a side effect of checking a
-* permission. This is for the handlers that need an identity without one — the
-* `/me` routes, and reads whose authorization is a visibility filter.
-*/
-function requireCaller(locals) {
-	if (!locals.ctx || !locals.user) apiError(401, ApiErrorCode.UNAUTHORIZED, "Unauthorized");
-	return {
-		ctx: locals.ctx,
-		user: locals.user
-	};
-}
-/**
-* Read required path params, 400ing on any that is missing or blank.
-*
-* SvelteKit types every param as `string`, but a route can be reached with an
-* empty segment, so the non-null assertion handlers used to write was a lie the
-* type system endorsed. Returning a narrowed record means the caller gets real
-* strings without asserting.
-*
-* This does **not** validate format — a guid-shaped param still goes through
-* `GuidSchema` where the route cares. It replaces the `if (!id) apiError(...)`
-* preamble, not the schema check.
-*/
-function requireParams(params, ...names) {
-	const out = {};
-	const missing = [];
-	for (const name of names) {
-		const value = params[name];
-		if (!value) {
-			missing.push(name);
-			continue;
-		}
-		out[name] = value;
-	}
-	if (missing.length) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Missing path parameter${missing.length > 1 ? "s" : ""}: ${missing.join(", ")}`);
-	return out;
-}
-/**
-* Read a path param through a Zod schema, 400ing on a bad value.
-*
-* The format-checking counterpart to `requireParams` — for guids, enum-shaped
-* segments, and anything else where "present" is not the same as "valid".
-*/
-function parseParam(value, schema, name) {
-	const parsed = schema.safeParse(value);
-	if (!parsed.success) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid or missing ${name}`);
-	return parsed.data;
-}
-/**
-* Parse and validate a JSON body.
-*
-* A malformed body becomes `null` rather than throwing, so it fails the schema
-* and reports as a validation error — a client sending broken JSON should see
-* a 400 naming the problem, not a 500 from `request.json()`.
-*
-* `missingAs` covers the endpoints whose fields are all optional: passing `{}`
-* lets an empty request body mean "no changes" instead of a validation failure.
-*/
-async function parseBody(request, schema, { missingAs } = {}) {
-	const raw = await request.json().catch(() => null);
-	const parsed = schema.safeParse(raw ?? missingAs ?? null);
-	if (!parsed.success) throwZodError(parsed.error);
-	return parsed.data;
-}
-/**
-* Pull a required file out of a multipart body and check its size and, where
-* given, its extension.
-*
-* The extension allowlist and the size cap were written out at five call sites,
-* each formatting the same "Max size: N MB" message — one of the places where
-* two endpoints must agree and nothing made them. The caps themselves stay in
-* `admin-config`; this only applies them.
-*
-* The size check is a second line of defence, not the first: `requireMaxBodySize`
-* rejects an oversized request before it is buffered. This catches a file that
-* is individually too large inside a request that is not.
-*/
-function requireUpload(form, field, { maxBytes, extensions, contentTypes, label = "File" }) {
-	const file = form.get(field);
-	if (!(file instanceof File) || file.size === 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, `A ${label.toLowerCase()} is required`);
-	const extension = file.name.slice(file.name.lastIndexOf(".")).toLowerCase();
-	if (extensions && !extensions.includes(extension)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `File type not allowed. Allowed: ${extensions.join(", ")}`);
-	if (contentTypes && !contentTypes.allowed.has(file.type)) apiError(400, ApiErrorCode.VALIDATION_FAILED, contentTypes.message);
-	if (file.size > maxBytes) apiError(400, ApiErrorCode.VALIDATION_FAILED, `${label} too large. Max size: ${maxBytes / 1048576} MB`);
-	return {
-		file,
-		extension
-	};
-}
-/** A multipart text field, trimmed and length-capped. Absent stays `undefined`. */
-function formText(form, field, { maxLength } = {}) {
-	const raw = form.get(field);
-	if (typeof raw !== "string") return void 0;
-	const trimmed = raw.trim();
-	if (!trimmed) return void 0;
-	return maxLength ? trimmed.slice(0, maxLength) : trimmed;
-}
-/** A paginated collection. The one envelope every v1 list endpoint returns. */
-function collection(page) {
-	return json({
-		items: page.items,
-		nextCursor: page.nextCursor
-	});
-}
-/** A created resource. */
-function created(body) {
-	return json(body, { status: 201 });
-}
-/** A successful mutation with nothing to say. */
-function noContent() {
-	return new Response(null, { status: 204 });
-}
-/**
-* Serialize a payload through an explicit response schema.
-*
-* **This is what keeps a secret from reaching a client by accident.** Several
-* responses are store records with a credential removed — `tokenHash` on a
-* share link or invite, `apiKey` on an org compute server — and until now the
-* removal was a destructuring line a future edit could drop. Adding a field to
-* the store type would then publish it, silently, with nothing failing.
-*
-* Parsing through a schema inverts that: the response carries what the schema
-* names and nothing else, so a new field on the stored type is invisible until
-* someone adds it here deliberately.
-*/
-function shaped(schema, payload, status = 200) {
-	return json(schema.parse(payload), { status });
-}
-/** `shaped`, mapped over a page of records. */
-function shapedCollection(schema, page) {
-	return json({
-		items: page.items.map((item) => schema.parse(item)),
-		nextCursor: page.nextCursor
-	});
-}
-/**
-* Wrap a handler so an unhandled error becomes a structured API error.
-*
-* Every route used to end in the same `try { … } catch (err) { handleApiError(
-* err, '…') }` — 59 of them. The wrapper hoists it, which is not only less to
-* read: a handler that forgot the try/catch surfaced a raw 500 with a provider
-* message in it, and nothing flagged the omission.
-*
-* `fallback` is the message used when the error carries none of its own; it is
-* required because "something went wrong" tells a caller nothing.
-*/
-function apiRoute(fallback, handler) {
-	return async (event) => {
-		try {
-			return await handler(event);
-		} catch (err) {
-			handleApiError(err, fallback);
-		}
-	};
-}
-
-export { apiRoute as a, requireUpload as b, collection as c, created as d, parseBody as e, formText as f, shaped as g, requireParams as h, noContent as n, parseParam as p, requireCaller as r, shapedCollection as s };
-//# sourceMappingURL=route.js-aKOAfzq_.js.map

package/build/server/chunks/chunks/route.js-aKOAfzq_.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"route.js-aKOAfzq_.js","sources":["../../../../.svelte-kit/output/server/chunks/route.js"],"sourcesContent":["import { i as throwZodError, n as apiError, r as handleApiError, t as ApiErrorCode } from \"./api-errors.js\";\nimport { json } from \"@sveltejs/kit\";\n//#region src/lib/server/api/v1/route.ts\n/**\n* The shared shape of a v1 route handler.\n*\n* Every handler in this tree does the same four things — validate the path,\n* parse the body, do the work, serialize — and before these helpers existed\n* each one spelled all four out. That is 2000 lines across 27 files in which\n* the interesting part is a few lines deep, and where the boilerplate had\n* already drifted: path params were validated two different ways, and four\n* list endpoints hand-rolled a pagination clamp that disagreed with the shared\n* one they were documented as using.\n*\n* The rule these helpers exist to enforce: **a route handler parses, guards,\n* delegates and serializes — nothing else.** Anything two endpoints must agree\n* on lives here or in `@selvajs/server`, never copied into both.\n*/\n/**\n* The authenticated caller, or 401.\n*\n* Routes used to write `if (!locals.ctx) apiError(401, …)` and then reach for\n* `locals.ctx!` further down — thirteen checks and eleven non-null assertions\n* for one fact. Returning the narrowed pair means the assertion disappears: if\n* you have the result, the context exists.\n*\n* Guards in `access.server.ts` do their own 401 as a side effect of checking a\n* permission. This is for the handlers that need an identity without one — the\n* `/me` routes, and reads whose authorization is a visibility filter.\n*/\nfunction requireCaller(locals) {\n\tif (!locals.ctx || !locals.user) apiError(401, ApiErrorCode.UNAUTHORIZED, \"Unauthorized\");\n\treturn {\n\t\tctx: locals.ctx,\n\t\tuser: locals.user\n\t};\n}\n/**\n* Read required path params, 400ing on any that is missing or blank.\n*\n* SvelteKit types every param as `string`, but a route can be reached with an\n* empty segment, so the non-null assertion handlers used to write was a lie the\n* type system endorsed. Returning a narrowed record means the caller gets real\n* strings without asserting.\n*\n* This does **not** validate format — a guid-shaped param still goes through\n* `GuidSchema` where the route cares. It replaces the `if (!id) apiError(...)`\n* preamble, not the schema check.\n*/\nfunction requireParams(params, ...names) {\n\tconst out = {};\n\tconst missing = [];\n\tfor (const name of names) {\n\t\tconst value = params[name];\n\t\tif (!value) {\n\t\t\tmissing.push(name);\n\t\t\tcontinue;\n\t\t}\n\t\tout[name] = value;\n\t}\n\tif (missing.length) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Missing path parameter${missing.length > 1 ? \"s\" : \"\"}: ${missing.join(\", \")}`);\n\treturn out;\n}\n/**\n* Read a path param through a Zod schema, 400ing on a bad value.\n*\n* The format-checking counterpart to `requireParams` — for guids, enum-shaped\n* segments, and anything else where \"present\" is not the same as \"valid\".\n*/\nfunction parseParam(value, schema, name) {\n\tconst parsed = schema.safeParse(value);\n\tif (!parsed.success) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid or missing ${name}`);\n\treturn parsed.data;\n}\n/**\n* Parse and validate a JSON body.\n*\n* A malformed body becomes `null` rather than throwing, so it fails the schema\n* and reports as a validation error — a client sending broken JSON should see\n* a 400 naming the problem, not a 500 from `request.json()`.\n*\n* `missingAs` covers the endpoints whose fields are all optional: passing `{}`\n* lets an empty request body mean \"no changes\" instead of a validation failure.\n*/\nasync function parseBody(request, schema, { missingAs } = {}) {\n\tconst raw = await request.json().catch(() => null);\n\tconst parsed = schema.safeParse(raw ?? missingAs ?? null);\n\tif (!parsed.success) throwZodError(parsed.error);\n\treturn parsed.data;\n}\n/**\n* Pull a required file out of a multipart body and check its size and, where\n* given, its extension.\n*\n* The extension allowlist and the size cap were written out at five call sites,\n* each formatting the same \"Max size: N MB\" message — one of the places where\n* two endpoints must agree and nothing made them. The caps themselves stay in\n* `admin-config`; this only applies them.\n*\n* The size check is a second line of defence, not the first: `requireMaxBodySize`\n* rejects an oversized request before it is buffered. This catches a file that\n* is individually too large inside a request that is not.\n*/\nfunction requireUpload(form, field, { maxBytes, extensions, contentTypes, label = \"File\" }) {\n\tconst file = form.get(field);\n\tif (!(file instanceof File) || file.size === 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, `A ${label.toLowerCase()} is required`);\n\tconst extension = file.name.slice(file.name.lastIndexOf(\".\")).toLowerCase();\n\tif (extensions && !extensions.includes(extension)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `File type not allowed. Allowed: ${extensions.join(\", \")}`);\n\tif (contentTypes && !contentTypes.allowed.has(file.type)) apiError(400, ApiErrorCode.VALIDATION_FAILED, contentTypes.message);\n\tif (file.size > maxBytes) apiError(400, ApiErrorCode.VALIDATION_FAILED, `${label} too large. Max size: ${maxBytes / 1048576} MB`);\n\treturn {\n\t\tfile,\n\t\textension\n\t};\n}\n/** A multipart text field, trimmed and length-capped. Absent stays `undefined`. */\nfunction formText(form, field, { maxLength } = {}) {\n\tconst raw = form.get(field);\n\tif (typeof raw !== \"string\") return void 0;\n\tconst trimmed = raw.trim();\n\tif (!trimmed) return void 0;\n\treturn maxLength ? trimmed.slice(0, maxLength) : trimmed;\n}\n/** A paginated collection. The one envelope every v1 list endpoint returns. */\nfunction collection(page) {\n\treturn json({\n\t\titems: page.items,\n\t\tnextCursor: page.nextCursor\n\t});\n}\n/** A created resource. */\nfunction created(body) {\n\treturn json(body, { status: 201 });\n}\n/** A successful mutation with nothing to say. */\nfunction noContent() {\n\treturn new Response(null, { status: 204 });\n}\n/**\n* Serialize a payload through an explicit response schema.\n*\n* **This is what keeps a secret from reaching a client by accident.** Several\n* responses are store records with a credential removed — `tokenHash` on a\n* share link or invite, `apiKey` on an org compute server — and until now the\n* removal was a destructuring line a future edit could drop. Adding a field to\n* the store type would then publish it, silently, with nothing failing.\n*\n* Parsing through a schema inverts that: the response carries what the schema\n* names and nothing else, so a new field on the stored type is invisible until\n* someone adds it here deliberately.\n*/\nfunction shaped(schema, payload, status = 200) {\n\treturn json(schema.parse(payload), { status });\n}\n/** `shaped`, mapped over a page of records. */\nfunction shapedCollection(schema, page) {\n\treturn json({\n\t\titems: page.items.map((item) => schema.parse(item)),\n\t\tnextCursor: page.nextCursor\n\t});\n}\n/**\n* Wrap a handler so an unhandled error becomes a structured API error.\n*\n* Every route used to end in the same `try { … } catch (err) { handleApiError(\n* err, '…') }` — 59 of them. The wrapper hoists it, which is not only less to\n* read: a handler that forgot the try/catch surfaced a raw 500 with a provider\n* message in it, and nothing flagged the omission.\n*\n* `fallback` is the message used when the error carries none of its own; it is\n* required because \"something went wrong\" tells a caller nothing.\n*/\nfunction apiRoute(fallback, handler) {\n\treturn async (event) => {\n\t\ttry {\n\t\t\treturn await handler(event);\n\t\t} catch (err) {\n\t\t\thandleApiError(err, fallback);\n\t\t}\n\t};\n}\n//#endregion\nexport { noContent as a, requireCaller as c, shaped as d, shapedCollection as f, formText as i, requireParams as l, collection as n, parseBody as o, created as r, parseParam as s, apiRoute as t, requireUpload as u };\n"],"names":[],"mappings":";;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,MAAM,EAAE;AAC/B,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC;AAC1F,CAAC,OAAO;AACR,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG;AACjB,EAAE,IAAI,EAAE,MAAM,CAAC;AACf,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,MAAM,EAAE,GAAG,KAAK,EAAE;AACzC,CAAC,MAAM,GAAG,GAAG,EAAE;AACf,CAAC,MAAM,OAAO,GAAG,EAAE;AACnB,CAAC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE;AAC3B,EAAE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;AAC5B,EAAE,IAAI,CAAC,KAAK,EAAE;AACd,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;AACrB,GAAG;AACH,EAAE;AACF,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK;AACnB,CAAC;AACD,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,sBAAsB,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACnJ,CAAC,OAAO,GAAG;AACX;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;AACzC,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;AACvC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC,CAAC;AACjG,CAAC,OAAO,MAAM,CAAC,IAAI;AACnB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE;AAC9D,CAAC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;AACnD,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,SAAS,IAAI,IAAI,CAAC;AAC1D,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AACjD,CAAC,OAAO,MAAM,CAAC,IAAI;AACnB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,GAAG,MAAM,EAAE,EAAE;AAC5F,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;AAC7B,CAAC,IAAI,EAAE,IAAI,YAAY,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,YAAY,CAAC,CAAC;AACtI,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE;AAC5E,CAAC,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,gCAAgC,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC7J,CAAC,IAAI,YAAY,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,YAAY,CAAC,OAAO,CAAC;AAC9H,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,EAAE,KAAK,CAAC,sBAAsB,EAAE,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;AAClI,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE;AACF,EAAE;AACF;AACA;AACA,SAAS,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE;AACnD,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;AAC5B,CAAC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,OAAO,MAAM;AAC3C,CAAC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE;AAC3B,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,MAAM;AAC5B,CAAC,OAAO,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,OAAO;AACzD;AACA;AACA,SAAS,UAAU,CAAC,IAAI,EAAE;AAC1B,CAAC,OAAO,IAAI,CAAC;AACb,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK;AACnB,EAAE,UAAU,EAAE,IAAI,CAAC;AACnB,EAAE,CAAC;AACH;AACA;AACA,SAAS,OAAO,CAAC,IAAI,EAAE;AACvB,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AACnC;AACA;AACA,SAAS,SAAS,GAAG;AACrB,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC3C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,GAAG,EAAE;AAC/C,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC;AAC/C;AACA;AACA,SAAS,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE;AACxC,CAAC,OAAO,IAAI,CAAC;AACb,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACrD,EAAE,UAAU,EAAE,IAAI,CAAC;AACnB,EAAE,CAAC;AACH;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE;AACrC,CAAC,OAAO,OAAO,KAAK,KAAK;AACzB,EAAE,IAAI;AACN,GAAG,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC;AAC9B,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC;AAChC,EAAE;AACF,CAAC,CAAC;AACF;;;;"}

package/build/server/chunks/chunks/selfUpdate.server.js-DrtIhtIx.js

@@ -1,152 +0,0 @@
-import { g as getLogger, r as renderThrown } from './providers.server.js-DCnhO862.js';
-import { d as deriveOutcome } from './update-outcome.js-BOtdiviI.js';
-import { join } from 'node:path';
-import { existsSync, readFileSync, rmSync } from 'node:fs';
-
-//#region src/lib/server/selfUpdate.server.ts
-/**
-* Self-update observability (audit O2): durable log/state paths for the update
-* runner, plus post-restart reconciliation of the update's outcome into the
-* audit event log.
-*
-* The process that launches an update is killed mid-update (`pm2 stop
-* selva-compute` is a step of the update itself), so only the
-* `system.update.started` event can be emitted synchronously by the POST
-* handler. The terminal event (`finished` / `rolled_back` / `failed`) is
-* derived AFTER the app is back up: the POST persists a pending-update state
-* file next to the log, and the reconciler here polls the log until the
-* runner's `[EXIT] code=N` marker appears, classifies it via `deriveOutcome`,
-* emits the matching event, and consumes the state file. Kicked from both the
-* POST (covers the no-restart "already up to date" path) and the first request
-* after boot (covers the real update path, where the emitting process is new).
-*/
-function isDeploymentDir(dir) {
-	return existsSync(join(dir, "node_modules", "@selvajs", "selva", "package.json"));
-}
-function findDeploymentDir(env) {
-	if (env.INSTALL_DIR && isDeploymentDir(env.INSTALL_DIR)) return env.INSTALL_DIR;
-	let dir = process.cwd();
-	for (let i = 0; i < 6; i++) {
-		if (isDeploymentDir(dir)) return dir;
-		const parent = join(dir, "..");
-		if (parent === dir) break;
-		dir = parent;
-	}
-	return null;
-}
-/**
-* Where the update runner mirrors all its output. Lives in the deployment dir
-* so it survives reboots (it used to be `/tmp/selva-update.log`, wiped on
-* reboot — audit O2); the `/tmp` fallback only applies outside a deployment
-* (dev), where no update can actually run.
-*/
-function updateLogPath(deploymentDir) {
-	return deploymentDir ? join(deploymentDir, "selva-update.log") : "/tmp/selva-update.log";
-}
-/** Pending-update marker consumed by the reconciler. Sits next to the log. */
-function updateStatePath(deploymentDir) {
-	return join(deploymentDir, "selva-update-state.json");
-}
-/**
-* One reconciliation attempt. Reads the pending-update state file; if the log
-* carries the runner's terminal `[EXIT] code=N` marker, classifies the outcome,
-* emits the terminal audit event, reports rollback/failure to the error
-* tracker, and deletes the state file (exactly-once across restarts — the
-* state file is the emission token).
-*/
-async function reconcileUpdateOutcome(deps) {
-	const statePath = updateStatePath(deps.deploymentDir);
-	let state;
-	try {
-		state = JSON.parse(readFileSync(statePath, "utf8"));
-	} catch {
-		return "no_pending_update";
-	}
-	let logs = "";
-	try {
-		logs = readFileSync(updateLogPath(deps.deploymentDir), "utf8");
-	} catch {}
-	const exitMatch = /\[EXIT\] code=(\d+)/.exec(logs);
-	if (!exitMatch) return "still_running";
-	const exitCode = Number(exitMatch[1]);
-	const outcome = deriveOutcome(exitCode, logs);
-	const base = {
-		fromVersion: state.fromVersion ?? outcome.from,
-		toVersion: outcome.to,
-		actorId: state.actorId
-	};
-	let event;
-	if (outcome.severity === "critical") event = {
-		type: "system.update.failed",
-		...base,
-		detail: outcome.title
-	};
-	else if (exitCode === 5 || logs.includes("Rolled back")) event = {
-		type: "system.update.rolled_back",
-		...base,
-		detail: outcome.title
-	};
-	else if (outcome.severity === "success" || outcome.severity === "info") event = {
-		type: "system.update.finished",
-		...base
-	};
-	else event = {
-		type: "system.update.finished",
-		...base,
-		detail: outcome.title
-	};
-	await deps.emit(event);
-	if (event.type !== "system.update.finished") deps.report(/* @__PURE__ */ new Error(`[selfUpdate] ${outcome.title}`));
-	try {
-		rmSync(statePath);
-	} catch {}
-	return "reconciled";
-}
-var POLL_MS = 15e3;
-var MAX_POLLS = 80;
-var reconcilerActive = false;
-/**
-* Idempotently start polling for a pending update's terminal state. Safe to
-* call on every boot and on every update POST — it exits immediately when no
-* state file exists and never runs twice concurrently.
-*/
-function startUpdateOutcomeReconciler(deps) {
-	if (reconcilerActive) return;
-	if (!existsSync(updateStatePath(deps.deploymentDir))) return;
-	reconcilerActive = true;
-	let polls = 0;
-	const timer = setInterval(() => {
-		(async () => {
-			polls += 1;
-			let result;
-			try {
-				result = await reconcileUpdateOutcome(deps);
-			} catch (err) {
-				getLogger().error("Outcome reconciliation failed", {
-					component: "selfUpdate",
-					err: renderThrown(err)
-				});
-				result = "still_running";
-			}
-			if (result === "still_running" && polls < MAX_POLLS) return;
-			if (result === "still_running") try {
-				const statePath = updateStatePath(deps.deploymentDir);
-				const state = JSON.parse(readFileSync(statePath, "utf8"));
-				await deps.emit({
-					type: "system.update.failed",
-					fromVersion: state.fromVersion,
-					actorId: state.actorId,
-					detail: "No terminal marker in the update log within 20 minutes."
-				});
-				deps.report(/* @__PURE__ */ new Error("[selfUpdate] update never reached a terminal state"));
-				rmSync(statePath);
-			} catch {}
-			clearInterval(timer);
-			reconcilerActive = false;
-		})();
-	}, POLL_MS);
-	timer.unref?.();
-}
-
-export { updateStatePath as a, findDeploymentDir as f, startUpdateOutcomeReconciler as s, updateLogPath as u };
-//# sourceMappingURL=selfUpdate.server.js-DrtIhtIx.js.map

package/build/server/chunks/chunks/selfUpdate.server.js-DrtIhtIx.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"selfUpdate.server.js-DrtIhtIx.js","sources":["../../../../.svelte-kit/output/server/chunks/selfUpdate.server.js"],"sourcesContent":["import { T as renderThrown, f as getLogger } from \"./providers.server.js\";\nimport { t as deriveOutcome } from \"./update-outcome.js\";\nimport { join } from \"node:path\";\nimport { existsSync, readFileSync, rmSync } from \"node:fs\";\n//#region src/lib/server/selfUpdate.server.ts\n/**\n* Self-update observability (audit O2): durable log/state paths for the update\n* runner, plus post-restart reconciliation of the update's outcome into the\n* audit event log.\n*\n* The process that launches an update is killed mid-update (`pm2 stop\n* selva-compute` is a step of the update itself), so only the\n* `system.update.started` event can be emitted synchronously by the POST\n* handler. The terminal event (`finished` / `rolled_back` / `failed`) is\n* derived AFTER the app is back up: the POST persists a pending-update state\n* file next to the log, and the reconciler here polls the log until the\n* runner's `[EXIT] code=N` marker appears, classifies it via `deriveOutcome`,\n* emits the matching event, and consumes the state file. Kicked from both the\n* POST (covers the no-restart \"already up to date\" path) and the first request\n* after boot (covers the real update path, where the emitting process is new).\n*/\nfunction isDeploymentDir(dir) {\n\treturn existsSync(join(dir, \"node_modules\", \"@selvajs\", \"selva\", \"package.json\"));\n}\nfunction findDeploymentDir(env) {\n\tif (env.INSTALL_DIR && isDeploymentDir(env.INSTALL_DIR)) return env.INSTALL_DIR;\n\tlet dir = process.cwd();\n\tfor (let i = 0; i < 6; i++) {\n\t\tif (isDeploymentDir(dir)) return dir;\n\t\tconst parent = join(dir, \"..\");\n\t\tif (parent === dir) break;\n\t\tdir = parent;\n\t}\n\treturn null;\n}\n/**\n* Where the update runner mirrors all its output. Lives in the deployment dir\n* so it survives reboots (it used to be `/tmp/selva-update.log`, wiped on\n* reboot — audit O2); the `/tmp` fallback only applies outside a deployment\n* (dev), where no update can actually run.\n*/\nfunction updateLogPath(deploymentDir) {\n\treturn deploymentDir ? join(deploymentDir, \"selva-update.log\") : \"/tmp/selva-update.log\";\n}\n/** Pending-update marker consumed by the reconciler. Sits next to the log. */\nfunction updateStatePath(deploymentDir) {\n\treturn join(deploymentDir, \"selva-update-state.json\");\n}\n/**\n* One reconciliation attempt. Reads the pending-update state file; if the log\n* carries the runner's terminal `[EXIT] code=N` marker, classifies the outcome,\n* emits the terminal audit event, reports rollback/failure to the error\n* tracker, and deletes the state file (exactly-once across restarts — the\n* state file is the emission token).\n*/\nasync function reconcileUpdateOutcome(deps) {\n\tconst statePath = updateStatePath(deps.deploymentDir);\n\tlet state;\n\ttry {\n\t\tstate = JSON.parse(readFileSync(statePath, \"utf8\"));\n\t} catch {\n\t\treturn \"no_pending_update\";\n\t}\n\tlet logs = \"\";\n\ttry {\n\t\tlogs = readFileSync(updateLogPath(deps.deploymentDir), \"utf8\");\n\t} catch {}\n\tconst exitMatch = /\\[EXIT\\] code=(\\d+)/.exec(logs);\n\tif (!exitMatch) return \"still_running\";\n\tconst exitCode = Number(exitMatch[1]);\n\tconst outcome = deriveOutcome(exitCode, logs);\n\tconst base = {\n\t\tfromVersion: state.fromVersion ?? outcome.from,\n\t\ttoVersion: outcome.to,\n\t\tactorId: state.actorId\n\t};\n\tlet event;\n\tif (outcome.severity === \"critical\") event = {\n\t\ttype: \"system.update.failed\",\n\t\t...base,\n\t\tdetail: outcome.title\n\t};\n\telse if (exitCode === 5 || logs.includes(\"Rolled back\")) event = {\n\t\ttype: \"system.update.rolled_back\",\n\t\t...base,\n\t\tdetail: outcome.title\n\t};\n\telse if (outcome.severity === \"success\" || outcome.severity === \"info\") event = {\n\t\ttype: \"system.update.finished\",\n\t\t...base\n\t};\n\telse event = {\n\t\ttype: \"system.update.finished\",\n\t\t...base,\n\t\tdetail: outcome.title\n\t};\n\tawait deps.emit(event);\n\tif (event.type !== \"system.update.finished\") deps.report(/* @__PURE__ */ new Error(`[selfUpdate] ${outcome.title}`));\n\ttry {\n\t\trmSync(statePath);\n\t} catch {}\n\treturn \"reconciled\";\n}\nvar POLL_MS = 15e3;\nvar MAX_POLLS = 80;\nvar reconcilerActive = false;\n/**\n* Idempotently start polling for a pending update's terminal state. Safe to\n* call on every boot and on every update POST — it exits immediately when no\n* state file exists and never runs twice concurrently.\n*/\nfunction startUpdateOutcomeReconciler(deps) {\n\tif (reconcilerActive) return;\n\tif (!existsSync(updateStatePath(deps.deploymentDir))) return;\n\treconcilerActive = true;\n\tlet polls = 0;\n\tconst timer = setInterval(() => {\n\t\t(async () => {\n\t\t\tpolls += 1;\n\t\t\tlet result;\n\t\t\ttry {\n\t\t\t\tresult = await reconcileUpdateOutcome(deps);\n\t\t\t} catch (err) {\n\t\t\t\tgetLogger().error(\"Outcome reconciliation failed\", {\n\t\t\t\t\tcomponent: \"selfUpdate\",\n\t\t\t\t\terr: renderThrown(err)\n\t\t\t\t});\n\t\t\t\tresult = \"still_running\";\n\t\t\t}\n\t\t\tif (result === \"still_running\" && polls < MAX_POLLS) return;\n\t\t\tif (result === \"still_running\") try {\n\t\t\t\tconst statePath = updateStatePath(deps.deploymentDir);\n\t\t\t\tconst state = JSON.parse(readFileSync(statePath, \"utf8\"));\n\t\t\t\tawait deps.emit({\n\t\t\t\t\ttype: \"system.update.failed\",\n\t\t\t\t\tfromVersion: state.fromVersion,\n\t\t\t\t\tactorId: state.actorId,\n\t\t\t\t\tdetail: \"No terminal marker in the update log within 20 minutes.\"\n\t\t\t\t});\n\t\t\t\tdeps.report(/* @__PURE__ */ new Error(\"[selfUpdate] update never reached a terminal state\"));\n\t\t\t\trmSync(statePath);\n\t\t\t} catch {}\n\t\t\tclearInterval(timer);\n\t\t\treconcilerActive = false;\n\t\t})();\n\t}, POLL_MS);\n\ttimer.unref?.();\n}\n//#endregion\nexport { updateStatePath as i, startUpdateOutcomeReconciler as n, updateLogPath as r, findDeploymentDir as t };\n"],"names":[],"mappings":";;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,eAAe,CAAC,GAAG,EAAE;AAC9B,CAAC,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;AAClF;AACA,SAAS,iBAAiB,CAAC,GAAG,EAAE;AAChC,CAAC,IAAI,GAAG,CAAC,WAAW,IAAI,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,CAAC,WAAW;AAChF,CAAC,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;AACxB,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE;AAC7B,EAAE,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG;AACtC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC;AAChC,EAAE,IAAI,MAAM,KAAK,GAAG,EAAE;AACtB,EAAE,GAAG,GAAG,MAAM;AACd,CAAC;AACD,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,aAAa,EAAE;AACtC,CAAC,OAAO,aAAa,GAAG,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC,GAAG,uBAAuB;AACzF;AACA;AACA,SAAS,eAAe,CAAC,aAAa,EAAE;AACxC,CAAC,OAAO,IAAI,CAAC,aAAa,EAAE,yBAAyB,CAAC;AACtD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,sBAAsB,CAAC,IAAI,EAAE;AAC5C,CAAC,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC;AACtD,CAAC,IAAI,KAAK;AACV,CAAC,IAAI;AACL,EAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,mBAAmB;AAC5B,CAAC;AACD,CAAC,IAAI,IAAI,GAAG,EAAE;AACd,CAAC,IAAI;AACL,EAAE,IAAI,GAAG,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;AAChE,CAAC,CAAC,CAAC,MAAM,CAAC;AACV,CAAC,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;AACnD,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,eAAe;AACvC,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC;AAC9C,CAAC,MAAM,IAAI,GAAG;AACd,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,OAAO,CAAC,IAAI;AAChD,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE;AACvB,EAAE,OAAO,EAAE,KAAK,CAAC;AACjB,EAAE;AACF,CAAC,IAAI,KAAK;AACV,CAAC,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU,EAAE,KAAK,GAAG;AAC9C,EAAE,IAAI,EAAE,sBAAsB;AAC9B,EAAE,GAAG,IAAI;AACT,EAAE,MAAM,EAAE,OAAO,CAAC;AAClB,EAAE;AACF,MAAM,IAAI,QAAQ,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,KAAK,GAAG;AAClE,EAAE,IAAI,EAAE,2BAA2B;AACnC,EAAE,GAAG,IAAI;AACT,EAAE,MAAM,EAAE,OAAO,CAAC;AAClB,EAAE;AACF,MAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,EAAE,KAAK,GAAG;AACjF,EAAE,IAAI,EAAE,wBAAwB;AAChC,EAAE,GAAG;AACL,EAAE;AACF,MAAM,KAAK,GAAG;AACd,EAAE,IAAI,EAAE,wBAAwB;AAChC,EAAE,GAAG,IAAI;AACT,EAAE,MAAM,EAAE,OAAO,CAAC;AAClB,EAAE;AACF,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;AACvB,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,wBAAwB,EAAE,IAAI,CAAC,MAAM,iBAAiB,IAAI,KAAK,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACrH,CAAC,IAAI;AACL,EAAE,MAAM,CAAC,SAAS,CAAC;AACnB,CAAC,CAAC,CAAC,MAAM,CAAC;AACV,CAAC,OAAO,YAAY;AACpB;AACA,IAAI,OAAO,GAAG,IAAI;AAClB,IAAI,SAAS,GAAG,EAAE;AAClB,IAAI,gBAAgB,GAAG,KAAK;AAC5B;AACA;AACA;AACA;AACA;AACA,SAAS,4BAA4B,CAAC,IAAI,EAAE;AAC5C,CAAC,IAAI,gBAAgB,EAAE;AACvB,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE;AACvD,CAAC,gBAAgB,GAAG,IAAI;AACxB,CAAC,IAAI,KAAK,GAAG,CAAC;AACd,CAAC,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM;AACjC,EAAE,CAAC,YAAY;AACf,GAAG,KAAK,IAAI,CAAC;AACb,GAAG,IAAI,MAAM;AACb,GAAG,IAAI;AACP,IAAI,MAAM,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC;AAC/C,GAAG,CAAC,CAAC,OAAO,GAAG,EAAE;AACjB,IAAI,SAAS,EAAE,CAAC,KAAK,CAAC,+BAA+B,EAAE;AACvD,KAAK,SAAS,EAAE,YAAY;AAC5B,KAAK,GAAG,EAAE,YAAY,CAAC,GAAG;AAC1B,KAAK,CAAC;AACN,IAAI,MAAM,GAAG,eAAe;AAC5B,GAAG;AACH,GAAG,IAAI,MAAM,KAAK,eAAe,IAAI,KAAK,GAAG,SAAS,EAAE;AACxD,GAAG,IAAI,MAAM,KAAK,eAAe,EAAE,IAAI;AACvC,IAAI,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC;AACzD,IAAI,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AAC7D,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC;AACpB,KAAK,IAAI,EAAE,sBAAsB;AACjC,KAAK,WAAW,EAAE,KAAK,CAAC,WAAW;AACnC,KAAK,OAAO,EAAE,KAAK,CAAC,OAAO;AAC3B,KAAK,MAAM,EAAE;AACb,KAAK,CAAC;AACN,IAAI,IAAI,CAAC,MAAM,iBAAiB,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;AAChG,IAAI,MAAM,CAAC,SAAS,CAAC;AACrB,GAAG,CAAC,CAAC,MAAM,CAAC;AACZ,GAAG,aAAa,CAAC,KAAK,CAAC;AACvB,GAAG,gBAAgB,GAAG,KAAK;AAC3B,EAAE,CAAC,GAAG;AACN,CAAC,CAAC,EAAE,OAAO,CAAC;AACZ,CAAC,KAAK,CAAC,KAAK,IAAI;AAChB;;;;"}

package/build/server/chunks/chunks/serverConfigWrite.js-BfjHOb52.js

@@ -1,89 +0,0 @@
-import { a as apiError, A as ApiErrorCode } from './api-errors.js-79b_3bHg.js';
-import { e as evictComputeClient } from './engine.server.js-fezh3ucS.js';
-
-//#region src/lib/server/compute/evictChangedServers.ts
-/**
-* Compute-client cache invalidation on config write (ADR 0004 Consequences).
-*
-* The client cache keys on server `id`, so a rotated `serverUrl`/`apiKey` keeps
-* the SAME key with stale connection details — it no longer ages out on its own
-* the way the old URL-keyed cache did. The config-write path must therefore
-* evict explicitly: this helper diffs the previous scoped server set against the
-* next one and drops the warm client for every server whose connection details
-* changed or that was removed. Unchanged servers keep their warm client.
-*/
-/**
-* Evict warm clients for servers whose connection details changed or that were
-* removed. `prev` and `next` are the scoped server sets before/after the write.
-*/
-function evictChangedServers(prev, next) {
-	const nextById = new Map(next.map((s) => [s.id, s]));
-	for (const before of prev) if (!nextById.has(before.id)) evictComputeClient(before.id);
-	const prevById = new Map(prev.map((s) => [s.id, s]));
-	for (const after of next) {
-		const before = prevById.get(after.id);
-		if (before && (before.serverUrl !== after.serverUrl || before.apiKey !== after.apiKey)) evictComputeClient(after.id);
-	}
-}
-//#endregion
-//#region src/lib/server/compute/serverConfigWrite.ts
-/**
-* Shared write-path rules for compute server config.
-*
-* Two routes accept a server set: `/api/admin/compute` (platform scope,
-* `manage_compute`) and `/api/v1/orgs/{orgId}/compute` (org scope,
-* `manage_org_compute`). They differ in who may call them, what extra fields
-* they carry (`sharedWith` vs `ownerOrgId`), and how they validate the default
-* selection — but the field validation and the apiKey merge below must behave
-* identically in both, so they live here rather than in either handler.
-*
-* The apiKey merge is the reason this file exists: a divergence between the two
-* copies silently clears or leaks a stored credential, and nothing fails at
-* build time.
-*/
-/**
-* Validate the scope-independent fields of every submitted server. Throws the
-* first failure as a 400; scope-specific fields (`sharedWith`, `ownerOrgId`)
-* are the caller's business.
-*/
-function validateIncomingServers(servers) {
-	for (const s of servers) {
-		if (!s.id || typeof s.id !== "string") apiError(400, ApiErrorCode.VALIDATION_FAILED, "Each server needs an id");
-		if (!s.label || typeof s.label !== "string") apiError(400, ApiErrorCode.VALIDATION_FAILED, "Each server needs a label");
-		if (!s.serverUrl || typeof s.serverUrl !== "string") apiError(400, ApiErrorCode.VALIDATION_FAILED, "Each server needs a serverUrl");
-		try {
-			new URL(s.serverUrl);
-		} catch {
-			apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid serverUrl: ${s.serverUrl}`);
-		}
-		if (s.apiKey !== void 0 && s.apiKey !== null && typeof s.apiKey !== "string") apiError(400, ApiErrorCode.VALIDATION_FAILED, "apiKey must be a string, null, or omitted");
-	}
-}
-/**
-* Resolve the key to persist for one server.
-*
-* The UI never receives stored keys — it sends back `hasApiKey` and omits the
-* field for servers the operator didn't touch. So "omitted" cannot mean "clear":
-* it has to preserve, or every save through the settings form would wipe the
-* keys of every server the operator left alone. Clearing is therefore explicit
-* (`null`), and an empty string is treated as "not provided" because that is
-* what an untouched password input submits.
-*
-* @param submitted the `apiKey` field as it arrived
-* @param storedKey the key currently persisted for this server id, if any
-*/
-function resolveApiKey(submitted, storedKey) {
-	if (submitted === null) return void 0;
-	return submitted ? submitted : storedKey;
-}
-/**
-* Build the id → stored-key lookup the merge reads. The caller passes only the
-* servers in its own scope, so one scope's write can never resolve a key from
-* another's rows.
-*/
-function storedKeysById(scopedServers) {
-	return new Map(scopedServers.map((s) => [s.id, s.apiKey]));
-}
-
-export { evictChangedServers as e, resolveApiKey as r, storedKeysById as s, validateIncomingServers as v };
-//# sourceMappingURL=serverConfigWrite.js-BfjHOb52.js.map

package/build/server/chunks/chunks/serverConfigWrite.js-BfjHOb52.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"serverConfigWrite.js-BfjHOb52.js","sources":["../../../../.svelte-kit/output/server/chunks/serverConfigWrite.js"],"sourcesContent":["import { n as apiError, t as ApiErrorCode } from \"./api-errors.js\";\nimport { i as evictComputeClient } from \"./engine.server.js\";\n//#region src/lib/server/compute/evictChangedServers.ts\n/**\n* Compute-client cache invalidation on config write (ADR 0004 Consequences).\n*\n* The client cache keys on server `id`, so a rotated `serverUrl`/`apiKey` keeps\n* the SAME key with stale connection details — it no longer ages out on its own\n* the way the old URL-keyed cache did. The config-write path must therefore\n* evict explicitly: this helper diffs the previous scoped server set against the\n* next one and drops the warm client for every server whose connection details\n* changed or that was removed. Unchanged servers keep their warm client.\n*/\n/**\n* Evict warm clients for servers whose connection details changed or that were\n* removed. `prev` and `next` are the scoped server sets before/after the write.\n*/\nfunction evictChangedServers(prev, next) {\n\tconst nextById = new Map(next.map((s) => [s.id, s]));\n\tfor (const before of prev) if (!nextById.has(before.id)) evictComputeClient(before.id);\n\tconst prevById = new Map(prev.map((s) => [s.id, s]));\n\tfor (const after of next) {\n\t\tconst before = prevById.get(after.id);\n\t\tif (before && (before.serverUrl !== after.serverUrl || before.apiKey !== after.apiKey)) evictComputeClient(after.id);\n\t}\n}\n//#endregion\n//#region src/lib/server/compute/serverConfigWrite.ts\n/**\n* Shared write-path rules for compute server config.\n*\n* Two routes accept a server set: `/api/admin/compute` (platform scope,\n* `manage_compute`) and `/api/v1/orgs/{orgId}/compute` (org scope,\n* `manage_org_compute`). They differ in who may call them, what extra fields\n* they carry (`sharedWith` vs `ownerOrgId`), and how they validate the default\n* selection — but the field validation and the apiKey merge below must behave\n* identically in both, so they live here rather than in either handler.\n*\n* The apiKey merge is the reason this file exists: a divergence between the two\n* copies silently clears or leaks a stored credential, and nothing fails at\n* build time.\n*/\n/**\n* Validate the scope-independent fields of every submitted server. Throws the\n* first failure as a 400; scope-specific fields (`sharedWith`, `ownerOrgId`)\n* are the caller's business.\n*/\nfunction validateIncomingServers(servers) {\n\tfor (const s of servers) {\n\t\tif (!s.id || typeof s.id !== \"string\") apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Each server needs an id\");\n\t\tif (!s.label || typeof s.label !== \"string\") apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Each server needs a label\");\n\t\tif (!s.serverUrl || typeof s.serverUrl !== \"string\") apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Each server needs a serverUrl\");\n\t\ttry {\n\t\t\tnew URL(s.serverUrl);\n\t\t} catch {\n\t\t\tapiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid serverUrl: ${s.serverUrl}`);\n\t\t}\n\t\tif (s.apiKey !== void 0 && s.apiKey !== null && typeof s.apiKey !== \"string\") apiError(400, ApiErrorCode.VALIDATION_FAILED, \"apiKey must be a string, null, or omitted\");\n\t}\n}\n/**\n* Resolve the key to persist for one server.\n*\n* The UI never receives stored keys — it sends back `hasApiKey` and omits the\n* field for servers the operator didn't touch. So \"omitted\" cannot mean \"clear\":\n* it has to preserve, or every save through the settings form would wipe the\n* keys of every server the operator left alone. Clearing is therefore explicit\n* (`null`), and an empty string is treated as \"not provided\" because that is\n* what an untouched password input submits.\n*\n* @param submitted the `apiKey` field as it arrived\n* @param storedKey the key currently persisted for this server id, if any\n*/\nfunction resolveApiKey(submitted, storedKey) {\n\tif (submitted === null) return void 0;\n\treturn submitted ? submitted : storedKey;\n}\n/**\n* Build the id → stored-key lookup the merge reads. The caller passes only the\n* servers in its own scope, so one scope's write can never resolve a key from\n* another's rows.\n*/\nfunction storedKeysById(scopedServers) {\n\treturn new Map(scopedServers.map((s) => [s.id, s.apiKey]));\n}\n//#endregion\nexport { evictChangedServers as i, storedKeysById as n, validateIncomingServers as r, resolveApiKey as t };\n"],"names":[],"mappings":";;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE;AACzC,CAAC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;AACvF,CAAC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE;AAC3B,EAAE,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;AACvC,EAAE,IAAI,MAAM,KAAK,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;AACtH,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,uBAAuB,CAAC,OAAO,EAAE;AAC1C,CAAC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE;AAC1B,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,yBAAyB,CAAC;AACjH,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,2BAA2B,CAAC;AACzH,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,+BAA+B,CAAC;AACrI,EAAE,IAAI;AACN,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACvB,EAAE,CAAC,CAAC,MAAM;AACV,GAAG,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,mBAAmB,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AACrF,EAAE;AACF,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,2CAA2C,CAAC;AAC1K,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE;AAC7C,CAAC,IAAI,SAAS,KAAK,IAAI,EAAE,OAAO,MAAM;AACtC,CAAC,OAAO,SAAS,GAAG,SAAS,GAAG,SAAS;AACzC;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,aAAa,EAAE;AACvC,CAAC,OAAO,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3D;;;;"}