@selvajs/selva 4.8.0-beta.4 → 4.8.0-beta.7

package/build/server/chunks/chunks/resolve.server.js-BCLpAodl.js

@@ -0,0 +1,62 @@
+import { S as SYSTEM_CONTEXT } from './src.js-BYv4z3-l.js';
+import { p as providers, o as getDefinitionMeta, f as getProjectProvider, k as flag } from './providers.server.js-BoM2upme.js';
+import { h as hashToken, l as looksLikeShareToken } from './token.server.js-UMCt7jB6.js';
+import { error } from '@sveltejs/kit';
+
+//#region src/lib/server/shareLinks/resolve.server.ts
+/**
+* Extract a candidate share-link token from the request.
+*   - `?token=share_…` query param (most embeddable)
+*   - `Authorization: Bearer share_…` header (server-to-server)
+*
+* Returns the raw token string, or null when none present. Does NOT validate.
+*/
+function readShareToken(request, url) {
+	if (!flag("ENABLE_SHARING")) return null;
+	const q = url.searchParams.get("token");
+	if (q && looksLikeShareToken(q)) return q;
+	const auth = request.headers.get("authorization");
+	if (auth?.startsWith("Bearer ")) {
+		const candidate = auth.slice(7).trim();
+		if (looksLikeShareToken(candidate)) return candidate;
+	}
+	return null;
+}
+/**
+* Spec §7 token-resolution path. Run before user-based auth on definition-
+* scoped routes. Returns the resolved link + a synthetic ctx on success.
+*
+* Throws only when a token is *present but invalid* for the current request
+* (wrong definition, wrong channel, expired, revoked, view-only when solve
+* was requested) — those are deliberate 401/403/429 responses to a
+* misbehaving consumer. When no token is present at all, returns null and
+* the caller falls through to the user-based auth gate.
+*/
+async function tryResolveShareToken(request, url, requestedDefinitionId, requestedChannel, opts) {
+	const raw = readShareToken(request, url);
+	if (!raw) return null;
+	const tokenHash = hashToken(raw);
+	const link = await providers.data.shareLinks.getByTokenHash(SYSTEM_CONTEXT, tokenHash);
+	if (!link) throw error(401, "Invalid or revoked share token.");
+	if (link.expiresAt && new Date(link.expiresAt).getTime() <= Date.now()) throw error(401, "Share token has expired.");
+	if (link.definitionId !== requestedDefinitionId) throw error(403, "Share token is not valid for this definition.");
+	if (link.channel !== requestedChannel) throw error(403, `Share token is for the '${link.channel}' channel only.`);
+	if (opts.requireSolve && !link.allowSolve) throw error(403, "Share token grants view-only access.");
+	const def = await getDefinitionMeta().get(SYSTEM_CONTEXT, link.definitionId);
+	if (!def) throw error(401, "Share token target no longer exists.");
+	const project = await getProjectProvider().getProject(SYSTEM_CONTEXT, def.projectId);
+	if (!project) throw error(401, "Share token target no longer exists.");
+	return {
+		link,
+		ctx: {
+			userId: "",
+			actingOrgId: project.orgId,
+			platformPermissions: [],
+			orgPermissions: [],
+			system: true
+		}
+	};
+}
+
+export { tryResolveShareToken as t };
+//# sourceMappingURL=resolve.server.js-BCLpAodl.js.map

package/build/server/chunks/chunks/resolve.server.js-BCLpAodl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.server.js-BCLpAodl.js","sources":["../../../../.svelte-kit/output/server/chunks/resolve.server.js"],"sourcesContent":["import { t as SYSTEM_CONTEXT } from \"./src.js\";\nimport { C as providers, _ as getProjectProvider, s as getDefinitionMeta, t as flag } from \"./providers.server.js\";\nimport { n as looksLikeShareToken, t as hashToken } from \"./token.server.js\";\nimport { error } from \"@sveltejs/kit\";\n//#region src/lib/server/shareLinks/resolve.server.ts\n/**\n* Extract a candidate share-link token from the request.\n*   - `?token=share_…` query param (most embeddable)\n*   - `Authorization: Bearer share_…` header (server-to-server)\n*\n* Returns the raw token string, or null when none present. Does NOT validate.\n*/\nfunction readShareToken(request, url) {\n\tif (!flag(\"ENABLE_SHARING\")) return null;\n\tconst q = url.searchParams.get(\"token\");\n\tif (q && looksLikeShareToken(q)) return q;\n\tconst auth = request.headers.get(\"authorization\");\n\tif (auth?.startsWith(\"Bearer \")) {\n\t\tconst candidate = auth.slice(7).trim();\n\t\tif (looksLikeShareToken(candidate)) return candidate;\n\t}\n\treturn null;\n}\n/**\n* Spec §7 token-resolution path. Run before user-based auth on definition-\n* scoped routes. Returns the resolved link + a synthetic ctx on success.\n*\n* Throws only when a token is *present but invalid* for the current request\n* (wrong definition, wrong channel, expired, revoked, view-only when solve\n* was requested) — those are deliberate 401/403/429 responses to a\n* misbehaving consumer. When no token is present at all, returns null and\n* the caller falls through to the user-based auth gate.\n*/\nasync function tryResolveShareToken(request, url, requestedDefinitionId, requestedChannel, opts) {\n\tconst raw = readShareToken(request, url);\n\tif (!raw) return null;\n\tconst tokenHash = hashToken(raw);\n\tconst link = await providers.data.shareLinks.getByTokenHash(SYSTEM_CONTEXT, tokenHash);\n\tif (!link) throw error(401, \"Invalid or revoked share token.\");\n\tif (link.expiresAt && new Date(link.expiresAt).getTime() <= Date.now()) throw error(401, \"Share token has expired.\");\n\tif (link.definitionId !== requestedDefinitionId) throw error(403, \"Share token is not valid for this definition.\");\n\tif (link.channel !== requestedChannel) throw error(403, `Share token is for the '${link.channel}' channel only.`);\n\tif (opts.requireSolve && !link.allowSolve) throw error(403, \"Share token grants view-only access.\");\n\tconst def = await getDefinitionMeta().get(SYSTEM_CONTEXT, link.definitionId);\n\tif (!def) throw error(401, \"Share token target no longer exists.\");\n\tconst project = await getProjectProvider().getProject(SYSTEM_CONTEXT, def.projectId);\n\tif (!project) throw error(401, \"Share token target no longer exists.\");\n\treturn {\n\t\tlink,\n\t\tctx: {\n\t\t\tuserId: \"\",\n\t\t\tactingOrgId: project.orgId,\n\t\t\tplatformPermissions: [],\n\t\t\torgPermissions: [],\n\t\t\tsystem: true\n\t\t}\n\t};\n}\n//#endregion\nexport { tryResolveShareToken as t };\n"],"names":[],"mappings":";;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE;AACtC,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,OAAO,IAAI;AACzC,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;AACxC,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;AAC1C,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;AAClD,CAAC,IAAI,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE;AAClC,EAAE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;AACxC,EAAE,IAAI,mBAAmB,CAAC,SAAS,CAAC,EAAE,OAAO,SAAS;AACtD,CAAC;AACD,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,oBAAoB,CAAC,OAAO,EAAE,GAAG,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,IAAI,EAAE;AACjG,CAAC,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC;AACzC,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,IAAI;AACtB,CAAC,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC;AACjC,CAAC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,cAAc,EAAE,SAAS,CAAC;AACvF,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,iCAAiC,CAAC;AAC/D,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,0BAA0B,CAAC;AACrH,CAAC,IAAI,IAAI,CAAC,YAAY,KAAK,qBAAqB,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,+CAA+C,CAAC;AACnH,CAAC,IAAI,IAAI,CAAC,OAAO,KAAK,gBAAgB,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,wBAAwB,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;AAClH,CAAC,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,sCAAsC,CAAC;AACpG,CAAC,MAAM,GAAG,GAAG,MAAM,iBAAiB,EAAE,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC;AAC7E,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,sCAAsC,CAAC;AACnE,CAAC,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,GAAG,CAAC,SAAS,CAAC;AACrF,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,sCAAsC,CAAC;AACvE,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE,GAAG,EAAE;AACP,GAAG,MAAM,EAAE,EAAE;AACb,GAAG,WAAW,EAAE,OAAO,CAAC,KAAK;AAC7B,GAAG,mBAAmB,EAAE,EAAE;AAC1B,GAAG,cAAc,EAAE,EAAE;AACrB,GAAG,MAAM,EAAE;AACX;AACA,EAAE;AACF;;;;"}

package/build/server/chunks/chunks/route.js-D0Ymk04r.js

@@ -0,0 +1,185 @@
+import { h as handleApiError, a as apiError, A as ApiErrorCode, t as throwZodError } from './api-errors.js-7Mw49fQc.js';
+import { json } from '@sveltejs/kit';
+
+//#region src/lib/server/api/v1/route.ts
+/**
+* The shared shape of a v1 route handler.
+*
+* Every handler in this tree does the same four things — validate the path,
+* parse the body, do the work, serialize — and before these helpers existed
+* each one spelled all four out. That is 2000 lines across 27 files in which
+* the interesting part is a few lines deep, and where the boilerplate had
+* already drifted: path params were validated two different ways, and four
+* list endpoints hand-rolled a pagination clamp that disagreed with the shared
+* one they were documented as using.
+*
+* The rule these helpers exist to enforce: **a route handler parses, guards,
+* delegates and serializes — nothing else.** Anything two endpoints must agree
+* on lives here or in `@selvajs/server`, never copied into both.
+*/
+/**
+* The authenticated caller, or 401.
+*
+* Routes used to write `if (!locals.ctx) apiError(401, …)` and then reach for
+* `locals.ctx!` further down — thirteen checks and eleven non-null assertions
+* for one fact. Returning the narrowed pair means the assertion disappears: if
+* you have the result, the context exists.
+*
+* Guards in `access.server.ts` do their own 401 as a side effect of checking a
+* permission. This is for the handlers that need an identity without one — the
+* `/me` routes, and reads whose authorization is a visibility filter.
+*/
+function requireCaller(locals) {
+	if (!locals.ctx || !locals.user) apiError(401, ApiErrorCode.UNAUTHORIZED, "Unauthorized");
+	return {
+		ctx: locals.ctx,
+		user: locals.user
+	};
+}
+/**
+* Read required path params, 400ing on any that is missing or blank.
+*
+* SvelteKit types every param as `string`, but a route can be reached with an
+* empty segment, so the non-null assertion handlers used to write was a lie the
+* type system endorsed. Returning a narrowed record means the caller gets real
+* strings without asserting.
+*
+* This does **not** validate format — a guid-shaped param still goes through
+* `GuidSchema` where the route cares. It replaces the `if (!id) apiError(...)`
+* preamble, not the schema check.
+*/
+function requireParams(params, ...names) {
+	const out = {};
+	const missing = [];
+	for (const name of names) {
+		const value = params[name];
+		if (!value) {
+			missing.push(name);
+			continue;
+		}
+		out[name] = value;
+	}
+	if (missing.length) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Missing path parameter${missing.length > 1 ? "s" : ""}: ${missing.join(", ")}`);
+	return out;
+}
+/**
+* Read a path param through a Zod schema, 400ing on a bad value.
+*
+* The format-checking counterpart to `requireParams` — for guids, enum-shaped
+* segments, and anything else where "present" is not the same as "valid".
+*/
+function parseParam(value, schema, name) {
+	const parsed = schema.safeParse(value);
+	if (!parsed.success) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid or missing ${name}`);
+	return parsed.data;
+}
+/**
+* Parse and validate a JSON body.
+*
+* A malformed body becomes `null` rather than throwing, so it fails the schema
+* and reports as a validation error — a client sending broken JSON should see
+* a 400 naming the problem, not a 500 from `request.json()`.
+*
+* `missingAs` covers the endpoints whose fields are all optional: passing `{}`
+* lets an empty request body mean "no changes" instead of a validation failure.
+*/
+async function parseBody(request, schema, { missingAs } = {}) {
+	const raw = await request.json().catch(() => null);
+	const parsed = schema.safeParse(raw ?? missingAs ?? null);
+	if (!parsed.success) throwZodError(parsed.error);
+	return parsed.data;
+}
+/**
+* Pull a required file out of a multipart body and check its size and, where
+* given, its extension.
+*
+* The extension allowlist and the size cap were written out at five call sites,
+* each formatting the same "Max size: N MB" message — one of the places where
+* two endpoints must agree and nothing made them. The caps themselves stay in
+* `admin-config`; this only applies them.
+*
+* The size check is a second line of defence, not the first: `requireMaxBodySize`
+* rejects an oversized request before it is buffered. This catches a file that
+* is individually too large inside a request that is not.
+*/
+function requireUpload(form, field, { maxBytes, extensions, contentTypes, label = "File" }) {
+	const file = form.get(field);
+	if (!(file instanceof File) || file.size === 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, `A ${label.toLowerCase()} is required`);
+	const extension = file.name.slice(file.name.lastIndexOf(".")).toLowerCase();
+	if (extensions && !extensions.includes(extension)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `File type not allowed. Allowed: ${extensions.join(", ")}`);
+	if (contentTypes && !contentTypes.allowed.has(file.type)) apiError(400, ApiErrorCode.VALIDATION_FAILED, contentTypes.message);
+	if (file.size > maxBytes) apiError(400, ApiErrorCode.VALIDATION_FAILED, `${label} too large. Max size: ${maxBytes / 1048576} MB`);
+	return {
+		file,
+		extension
+	};
+}
+/** A multipart text field, trimmed and length-capped. Absent stays `undefined`. */
+function formText(form, field, { maxLength } = {}) {
+	const raw = form.get(field);
+	if (typeof raw !== "string") return void 0;
+	const trimmed = raw.trim();
+	if (!trimmed) return void 0;
+	return maxLength ? trimmed.slice(0, maxLength) : trimmed;
+}
+/** A paginated collection. The one envelope every v1 list endpoint returns. */
+function collection(page) {
+	return json({
+		items: page.items,
+		nextCursor: page.nextCursor
+	});
+}
+/** A created resource. */
+function created(body) {
+	return json(body, { status: 201 });
+}
+/** A successful mutation with nothing to say. */
+function noContent() {
+	return new Response(null, { status: 204 });
+}
+/**
+* Serialize a payload through an explicit response schema.
+*
+* **This is what keeps a secret from reaching a client by accident.** Several
+* responses are store records with a credential removed — `tokenHash` on a
+* share link or invite, `apiKey` on an org compute server — and until now the
+* removal was a destructuring line a future edit could drop. Adding a field to
+* the store type would then publish it, silently, with nothing failing.
+*
+* Parsing through a schema inverts that: the response carries what the schema
+* names and nothing else, so a new field on the stored type is invisible until
+* someone adds it here deliberately.
+*/
+function shaped(schema, payload, status = 200) {
+	return json(schema.parse(payload), { status });
+}
+/** `shaped`, mapped over a page of records. */
+function shapedCollection(schema, page) {
+	return json({
+		items: page.items.map((item) => schema.parse(item)),
+		nextCursor: page.nextCursor
+	});
+}
+/**
+* Wrap a handler so an unhandled error becomes a structured API error.
+*
+* Every route used to end in the same `try { … } catch (err) { handleApiError(
+* err, '…') }` — 59 of them. The wrapper hoists it, which is not only less to
+* read: a handler that forgot the try/catch surfaced a raw 500 with a provider
+* message in it, and nothing flagged the omission.
+*
+* `fallback` is the message used when the error carries none of its own; it is
+* required because "something went wrong" tells a caller nothing.
+*/
+function apiRoute(fallback, handler) {
+	return async (event) => {
+		try {
+			return await handler(event);
+		} catch (err) {
+			handleApiError(err, fallback);
+		}
+	};
+}
+
+export { apiRoute as a, requireUpload as b, collection as c, created as d, parseBody as e, formText as f, shaped as g, requireParams as h, noContent as n, parseParam as p, requireCaller as r, shapedCollection as s };
+//# sourceMappingURL=route.js-D0Ymk04r.js.map

package/build/server/chunks/chunks/route.js-D0Ymk04r.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.js-D0Ymk04r.js","sources":["../../../../.svelte-kit/output/server/chunks/route.js"],"sourcesContent":["import { i as throwZodError, n as apiError, r as handleApiError, t as ApiErrorCode } from \"./api-errors.js\";\nimport { json } from \"@sveltejs/kit\";\n//#region src/lib/server/api/v1/route.ts\n/**\n* The shared shape of a v1 route handler.\n*\n* Every handler in this tree does the same four things — validate the path,\n* parse the body, do the work, serialize — and before these helpers existed\n* each one spelled all four out. That is 2000 lines across 27 files in which\n* the interesting part is a few lines deep, and where the boilerplate had\n* already drifted: path params were validated two different ways, and four\n* list endpoints hand-rolled a pagination clamp that disagreed with the shared\n* one they were documented as using.\n*\n* The rule these helpers exist to enforce: **a route handler parses, guards,\n* delegates and serializes — nothing else.** Anything two endpoints must agree\n* on lives here or in `@selvajs/server`, never copied into both.\n*/\n/**\n* The authenticated caller, or 401.\n*\n* Routes used to write `if (!locals.ctx) apiError(401, …)` and then reach for\n* `locals.ctx!` further down — thirteen checks and eleven non-null assertions\n* for one fact. Returning the narrowed pair means the assertion disappears: if\n* you have the result, the context exists.\n*\n* Guards in `access.server.ts` do their own 401 as a side effect of checking a\n* permission. This is for the handlers that need an identity without one — the\n* `/me` routes, and reads whose authorization is a visibility filter.\n*/\nfunction requireCaller(locals) {\n\tif (!locals.ctx || !locals.user) apiError(401, ApiErrorCode.UNAUTHORIZED, \"Unauthorized\");\n\treturn {\n\t\tctx: locals.ctx,\n\t\tuser: locals.user\n\t};\n}\n/**\n* Read required path params, 400ing on any that is missing or blank.\n*\n* SvelteKit types every param as `string`, but a route can be reached with an\n* empty segment, so the non-null assertion handlers used to write was a lie the\n* type system endorsed. Returning a narrowed record means the caller gets real\n* strings without asserting.\n*\n* This does **not** validate format — a guid-shaped param still goes through\n* `GuidSchema` where the route cares. It replaces the `if (!id) apiError(...)`\n* preamble, not the schema check.\n*/\nfunction requireParams(params, ...names) {\n\tconst out = {};\n\tconst missing = [];\n\tfor (const name of names) {\n\t\tconst value = params[name];\n\t\tif (!value) {\n\t\t\tmissing.push(name);\n\t\t\tcontinue;\n\t\t}\n\t\tout[name] = value;\n\t}\n\tif (missing.length) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Missing path parameter${missing.length > 1 ? \"s\" : \"\"}: ${missing.join(\", \")}`);\n\treturn out;\n}\n/**\n* Read a path param through a Zod schema, 400ing on a bad value.\n*\n* The format-checking counterpart to `requireParams` — for guids, enum-shaped\n* segments, and anything else where \"present\" is not the same as \"valid\".\n*/\nfunction parseParam(value, schema, name) {\n\tconst parsed = schema.safeParse(value);\n\tif (!parsed.success) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid or missing ${name}`);\n\treturn parsed.data;\n}\n/**\n* Parse and validate a JSON body.\n*\n* A malformed body becomes `null` rather than throwing, so it fails the schema\n* and reports as a validation error — a client sending broken JSON should see\n* a 400 naming the problem, not a 500 from `request.json()`.\n*\n* `missingAs` covers the endpoints whose fields are all optional: passing `{}`\n* lets an empty request body mean \"no changes\" instead of a validation failure.\n*/\nasync function parseBody(request, schema, { missingAs } = {}) {\n\tconst raw = await request.json().catch(() => null);\n\tconst parsed = schema.safeParse(raw ?? missingAs ?? null);\n\tif (!parsed.success) throwZodError(parsed.error);\n\treturn parsed.data;\n}\n/**\n* Pull a required file out of a multipart body and check its size and, where\n* given, its extension.\n*\n* The extension allowlist and the size cap were written out at five call sites,\n* each formatting the same \"Max size: N MB\" message — one of the places where\n* two endpoints must agree and nothing made them. The caps themselves stay in\n* `admin-config`; this only applies them.\n*\n* The size check is a second line of defence, not the first: `requireMaxBodySize`\n* rejects an oversized request before it is buffered. This catches a file that\n* is individually too large inside a request that is not.\n*/\nfunction requireUpload(form, field, { maxBytes, extensions, contentTypes, label = \"File\" }) {\n\tconst file = form.get(field);\n\tif (!(file instanceof File) || file.size === 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, `A ${label.toLowerCase()} is required`);\n\tconst extension = file.name.slice(file.name.lastIndexOf(\".\")).toLowerCase();\n\tif (extensions && !extensions.includes(extension)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `File type not allowed. Allowed: ${extensions.join(\", \")}`);\n\tif (contentTypes && !contentTypes.allowed.has(file.type)) apiError(400, ApiErrorCode.VALIDATION_FAILED, contentTypes.message);\n\tif (file.size > maxBytes) apiError(400, ApiErrorCode.VALIDATION_FAILED, `${label} too large. Max size: ${maxBytes / 1048576} MB`);\n\treturn {\n\t\tfile,\n\t\textension\n\t};\n}\n/** A multipart text field, trimmed and length-capped. Absent stays `undefined`. */\nfunction formText(form, field, { maxLength } = {}) {\n\tconst raw = form.get(field);\n\tif (typeof raw !== \"string\") return void 0;\n\tconst trimmed = raw.trim();\n\tif (!trimmed) return void 0;\n\treturn maxLength ? trimmed.slice(0, maxLength) : trimmed;\n}\n/** A paginated collection. The one envelope every v1 list endpoint returns. */\nfunction collection(page) {\n\treturn json({\n\t\titems: page.items,\n\t\tnextCursor: page.nextCursor\n\t});\n}\n/** A created resource. */\nfunction created(body) {\n\treturn json(body, { status: 201 });\n}\n/** A successful mutation with nothing to say. */\nfunction noContent() {\n\treturn new Response(null, { status: 204 });\n}\n/**\n* Serialize a payload through an explicit response schema.\n*\n* **This is what keeps a secret from reaching a client by accident.** Several\n* responses are store records with a credential removed — `tokenHash` on a\n* share link or invite, `apiKey` on an org compute server — and until now the\n* removal was a destructuring line a future edit could drop. Adding a field to\n* the store type would then publish it, silently, with nothing failing.\n*\n* Parsing through a schema inverts that: the response carries what the schema\n* names and nothing else, so a new field on the stored type is invisible until\n* someone adds it here deliberately.\n*/\nfunction shaped(schema, payload, status = 200) {\n\treturn json(schema.parse(payload), { status });\n}\n/** `shaped`, mapped over a page of records. */\nfunction shapedCollection(schema, page) {\n\treturn json({\n\t\titems: page.items.map((item) => schema.parse(item)),\n\t\tnextCursor: page.nextCursor\n\t});\n}\n/**\n* Wrap a handler so an unhandled error becomes a structured API error.\n*\n* Every route used to end in the same `try { … } catch (err) { handleApiError(\n* err, '…') }` — 59 of them. The wrapper hoists it, which is not only less to\n* read: a handler that forgot the try/catch surfaced a raw 500 with a provider\n* message in it, and nothing flagged the omission.\n*\n* `fallback` is the message used when the error carries none of its own; it is\n* required because \"something went wrong\" tells a caller nothing.\n*/\nfunction apiRoute(fallback, handler) {\n\treturn async (event) => {\n\t\ttry {\n\t\t\treturn await handler(event);\n\t\t} catch (err) {\n\t\t\thandleApiError(err, fallback);\n\t\t}\n\t};\n}\n//#endregion\nexport { noContent as a, requireCaller as c, shaped as d, shapedCollection as f, formText as i, requireParams as l, collection as n, parseBody as o, created as r, parseParam as s, apiRoute as t, requireUpload as u };\n"],"names":[],"mappings":";;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,MAAM,EAAE;AAC/B,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC;AAC1F,CAAC,OAAO;AACR,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG;AACjB,EAAE,IAAI,EAAE,MAAM,CAAC;AACf,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,MAAM,EAAE,GAAG,KAAK,EAAE;AACzC,CAAC,MAAM,GAAG,GAAG,EAAE;AACf,CAAC,MAAM,OAAO,GAAG,EAAE;AACnB,CAAC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE;AAC3B,EAAE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;AAC5B,EAAE,IAAI,CAAC,KAAK,EAAE;AACd,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;AACrB,GAAG;AACH,EAAE;AACF,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK;AACnB,CAAC;AACD,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,sBAAsB,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACnJ,CAAC,OAAO,GAAG;AACX;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;AACzC,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;AACvC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC,CAAC;AACjG,CAAC,OAAO,MAAM,CAAC,IAAI;AACnB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE;AAC9D,CAAC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;AACnD,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,SAAS,IAAI,IAAI,CAAC;AAC1D,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AACjD,CAAC,OAAO,MAAM,CAAC,IAAI;AACnB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,GAAG,MAAM,EAAE,EAAE;AAC5F,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;AAC7B,CAAC,IAAI,EAAE,IAAI,YAAY,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,YAAY,CAAC,CAAC;AACtI,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE;AAC5E,CAAC,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,gCAAgC,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC7J,CAAC,IAAI,YAAY,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,YAAY,CAAC,OAAO,CAAC;AAC9H,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,EAAE,KAAK,CAAC,sBAAsB,EAAE,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;AAClI,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE;AACF,EAAE;AACF;AACA;AACA,SAAS,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE;AACnD,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;AAC5B,CAAC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,OAAO,MAAM;AAC3C,CAAC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE;AAC3B,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,MAAM;AAC5B,CAAC,OAAO,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,OAAO;AACzD;AACA;AACA,SAAS,UAAU,CAAC,IAAI,EAAE;AAC1B,CAAC,OAAO,IAAI,CAAC;AACb,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK;AACnB,EAAE,UAAU,EAAE,IAAI,CAAC;AACnB,EAAE,CAAC;AACH;AACA;AACA,SAAS,OAAO,CAAC,IAAI,EAAE;AACvB,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AACnC;AACA;AACA,SAAS,SAAS,GAAG;AACrB,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC3C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,GAAG,EAAE;AAC/C,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC;AAC/C;AACA;AACA,SAAS,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE;AACxC,CAAC,OAAO,IAAI,CAAC;AACb,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACrD,EAAE,UAAU,EAAE,IAAI,CAAC;AACnB,EAAE,CAAC;AACH;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE;AACrC,CAAC,OAAO,OAAO,KAAK,KAAK;AACzB,EAAE,IAAI;AACN,GAAG,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC;AAC9B,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC;AAChC,EAAE;AACF,CAAC,CAAC;AACF;;;;"}