@selvajs/selva 2.0.0

package/build/server/chunks/access.server-GvriCjXN.js

@@ -0,0 +1,389 @@
+import { error, redirect } from '@sveltejs/kit';
+import { h as hasPermission, A as ALL_PLATFORM_PERMISSIONS } from './context-9tV9WxQ5.js';
+import { i as getDefinitionMeta, c as getOrganizationProvider, f as flag, h as getProjectProvider, k as getPlatformProjectGrantStore } from './providers.server-C32WKtDL.js';
+import { h as handleApiError } from './api-errors-Dk5z97zb.js';
+import 'zod';
+import './shared-server-DaWdgxVh.js';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:crypto';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+
+function isInstanceAdmin(platformPermissions) {
+  return platformPermissions.includes("instance_admin");
+}
+function withAdminBypass(platformPermissions, rule) {
+  if (isInstanceAdmin(platformPermissions))
+    return true;
+  return rule();
+}
+function canView(input) {
+  const { project, member, orgMember, allowCrossOrgPublic, platformPermissions, platformGrants, actingOrgId, userId } = input;
+  if (!project)
+    return false;
+  if (project.visibility === "platform") {
+    if (isInstanceAdmin(platformPermissions))
+      return true;
+    return platformGrants.some((g) => g.granteeType === "user" && g.granteeId === userId || g.granteeType === "org" && g.granteeId === actingOrgId);
+  }
+  if (project.visibility === "private")
+    return member !== null;
+  if (project.visibility === "org")
+    return orgMember !== null;
+  if (project.visibility === "public")
+    return allowCrossOrgPublic ? true : orgMember !== null;
+  return false;
+}
+function canSolve(input) {
+  const { project, platformPermissions, platformGrants, actingOrgId, userId } = input;
+  if (!project)
+    return false;
+  if (project.visibility === "platform") {
+    if (isInstanceAdmin(platformPermissions))
+      return true;
+    return platformGrants.some((g) => g.canSolve && (g.granteeType === "user" && g.granteeId === userId || g.granteeType === "org" && g.granteeId === actingOrgId));
+  }
+  return canView(input);
+}
+function canEdit(input) {
+  const { member, project, platformPermissions } = input;
+  if (project?.visibility === "platform")
+    return isInstanceAdmin(platformPermissions);
+  return member?.role === "owner" || member?.role === "editor";
+}
+function canManage(input) {
+  if (input.project?.visibility === "platform")
+    return isInstanceAdmin(input.platformPermissions);
+  return input.member?.role === "owner";
+}
+function canEditProjectSettings(input) {
+  if (input.project?.visibility === "platform")
+    return isInstanceAdmin(input.platformPermissions);
+  return input.member?.role === "owner";
+}
+function canChangeVisibilityToPublic(input) {
+  const role = input.orgMember?.role;
+  return role === "owner" || role === "admin";
+}
+function canEditDefinition(input) {
+  const { project, definition, member, userId, platformPermissions } = input;
+  if (!project || !definition)
+    return false;
+  if (project.visibility === "platform") {
+    return isInstanceAdmin(platformPermissions);
+  }
+  if (member?.role === "owner" || member?.role === "editor")
+    return true;
+  if (project.autoJoinOnUpload && userId === definition.ownerId)
+    return true;
+  return false;
+}
+function canReclaim(input) {
+  const { project, orgMember, actingOrgId } = input;
+  if (!project || !actingOrgId)
+    return false;
+  if (project.visibility === "platform")
+    return false;
+  if (actingOrgId !== project.orgId)
+    return false;
+  const role = orgMember?.role;
+  return role === "owner" || role === "admin";
+}
+function canCreateProject(input) {
+  const { orgMember, orgPermissions, actingOrgId, targetOrgId } = input;
+  if (actingOrgId !== targetOrgId)
+    return false;
+  const role = orgMember?.role;
+  if (role === "owner" || role === "admin")
+    return true;
+  if (role === "member" && orgPermissions.includes("manage_projects"))
+    return true;
+  return false;
+}
+function checkOwnerRemoval(input) {
+  if (input.target.role !== "owner")
+    return "ok";
+  const ownerCount = input.allMembers.filter((m) => m.role === "owner").length;
+  if (ownerCount <= 1)
+    return "sole_owner";
+  if (!input.confirmed)
+    return "needs_confirm";
+  return "ok";
+}
+const throwProviderError = handleApiError;
+function requireAuthed(locals) {
+  const { user, ctx } = locals;
+  if (!user || !ctx) throw error(401, "Unauthorized");
+  return { user, ctx };
+}
+function requirePermission(locals, permission) {
+  const { user, ctx } = requireAuthed(locals);
+  if (!hasPermission(ctx, permission)) {
+    throw error(403, `You don't have permission to do this.`);
+  }
+  return user;
+}
+function assertPagePermission(locals, permission) {
+  const { user, ctx } = requireAuthed(locals);
+  if (!hasPermission(ctx, permission)) {
+    redirect(303, "/admin");
+  }
+  return user;
+}
+const requireManageInstanceUsers = (locals) => requirePermission(locals, "manage_instance_users");
+const requireManageCompute = (locals) => requirePermission(locals, "manage_compute");
+const requireManageOrgMembers = (locals) => requirePermission(locals, "manage_org_members");
+const requireManageOrgCompute = (locals) => requirePermission(locals, "manage_org_compute");
+const requireManageDefinitions = (locals) => requirePermission(locals, "manage_definitions");
+const requireManageProjects = (locals) => requirePermission(locals, "manage_projects");
+const assertManageInstanceUsers = (locals) => assertPagePermission(locals, "manage_instance_users");
+const assertManageCompute = (locals) => assertPagePermission(locals, "manage_compute");
+const assertManageDefinitions = (locals) => assertPagePermission(locals, "manage_definitions");
+const assertManageProjects = (locals) => assertPagePermission(locals, "manage_projects");
+const requireInstanceAdmin = (locals) => requirePermission(locals, "instance_admin");
+function requireAnyPlatformPermission(locals) {
+  const { user, ctx } = requireAuthed(locals);
+  const allowed = ALL_PLATFORM_PERMISSIONS.some((p) => hasPermission(ctx, p));
+  if (!allowed) throw error(403, `You don't have permission to do this.`);
+  return user;
+}
+function assertAnyPlatformPermission(locals) {
+  const { user, ctx } = requireAuthed(locals);
+  const allowed = ALL_PLATFORM_PERMISSIONS.some((p) => hasPermission(ctx, p));
+  if (!allowed) redirect(303, "/library");
+  return user;
+}
+async function managementBypassOrRun(ctx, check) {
+  if (hasPermission(ctx, "instance_admin")) return true;
+  return await check();
+}
+async function contentCheck(check) {
+  return await check();
+}
+async function loadProjectOr404(ctx, projectId) {
+  const project = await getProjectProvider().getProject(ctx, projectId);
+  if (!project) throw error(404, "Project not found");
+  return project;
+}
+async function buildProjectAccessInput(ctx, project, overrides = {}) {
+  const allowCrossOrgPublic = flag("ALLOW_CROSS_ORG_PUBLIC");
+  let member = null;
+  let orgMember = null;
+  let platformGrants = [];
+  if (project.visibility === "platform") {
+    platformGrants = await getPlatformProjectGrantStore().listByProject(ctx, project.id);
+  } else if (project.visibility === "private") {
+    member = await getProjectProvider().getProjectMember(ctx, project.id, ctx.userId);
+  } else {
+    const skipOrgMember = project.visibility === "public" && allowCrossOrgPublic;
+    [member, orgMember] = await Promise.all([
+      getProjectProvider().getProjectMember(ctx, project.id, ctx.userId),
+      skipOrgMember ? Promise.resolve(null) : getOrganizationProvider().getOrgMember(ctx, project.orgId, ctx.userId)
+    ]);
+  }
+  return {
+    orgPermissions: ctx.orgPermissions,
+    platformPermissions: ctx.platformPermissions,
+    project,
+    member,
+    orgMember,
+    allowCrossOrgPublic,
+    platformGrants,
+    actingOrgId: ctx.actingOrgId ?? null,
+    userId: ctx.userId,
+    ...overrides
+  };
+}
+function projectAccessInputFromRows(ctx, project, rows) {
+  return {
+    orgPermissions: ctx.orgPermissions,
+    platformPermissions: ctx.platformPermissions,
+    project,
+    member: rows.member ?? null,
+    orgMember: rows.orgMember ?? null,
+    allowCrossOrgPublic: flag("ALLOW_CROSS_ORG_PUBLIC"),
+    platformGrants: rows.platformGrants ?? [],
+    actingOrgId: ctx.actingOrgId ?? null,
+    userId: ctx.userId
+  };
+}
+async function requireCanEdit(locals, projectId) {
+  const { user, ctx } = requireAuthed(locals);
+  const allowed = await contentCheck(async () => {
+    const project = await loadProjectOr404(ctx, projectId);
+    return canEdit(await buildProjectAccessInput(ctx, project));
+  });
+  if (!allowed) throw error(403, "You do not have permission to edit this project.");
+  return user;
+}
+async function requireCanCreateDefinition(locals, projectId) {
+  const { user, ctx } = requireAuthed(locals);
+  const project = await loadProjectOr404(ctx, projectId);
+  const allowed = await contentCheck(async () => {
+    if (project.autoJoinOnUpload) return true;
+    return canEdit(await buildProjectAccessInput(ctx, project));
+  });
+  if (!allowed) {
+    throw error(403, "You do not have permission to upload definitions to this project.");
+  }
+  return { user, ctx, project };
+}
+async function requireTargetIsOrgMember(locals, orgId, targetUserId) {
+  const { ctx } = requireAuthed(locals);
+  const member = await getOrganizationProvider().getOrgMember(ctx, orgId, targetUserId);
+  if (!member) {
+    throw error(400, "User must be a member of this organization to be added to a project.");
+  }
+}
+async function requireCanReclaim(locals, projectId) {
+  const { user, ctx } = requireAuthed(locals);
+  const project = await loadProjectOr404(ctx, projectId);
+  const allowed = await managementBypassOrRun(ctx, async () => {
+    const orgMember = await getOrganizationProvider().getOrgMember(ctx, project.orgId, ctx.userId);
+    return canReclaim({
+      project,
+      orgMember,
+      actingOrgId: ctx.actingOrgId ?? null
+    });
+  });
+  if (!allowed) {
+    throw error(403, "Only org owners or admins of this project’s org can reclaim it.");
+  }
+  return { user, ctx, project };
+}
+async function requireCanCreateProject(locals, targetOrgId) {
+  const { user, ctx } = requireAuthed(locals);
+  const allowed = await managementBypassOrRun(ctx, async () => {
+    const orgMember = await getOrganizationProvider().getOrgMember(ctx, targetOrgId, ctx.userId);
+    return canCreateProject({
+      orgPermissions: ctx.orgPermissions,
+      orgMember,
+      actingOrgId: ctx.actingOrgId ?? null,
+      targetOrgId
+    });
+  });
+  if (!allowed) throw error(403, "You do not have permission to create projects in this org.");
+  return { user, ctx };
+}
+async function requireCanManage(locals, projectId) {
+  const { user, ctx } = requireAuthed(locals);
+  const allowed = await managementBypassOrRun(ctx, async () => {
+    const project = await loadProjectOr404(ctx, projectId);
+    return canManage(await buildProjectAccessInput(ctx, project));
+  });
+  if (!allowed) throw error(403, "Only project owners can manage this project.");
+  return user;
+}
+async function requireCanManageMembers(locals, projectId) {
+  const { user, ctx } = requireAuthed(locals);
+  const allowed = await managementBypassOrRun(ctx, async () => {
+    const project = await loadProjectOr404(ctx, projectId);
+    return canManage(await buildProjectAccessInput(ctx, project));
+  });
+  if (!allowed) throw error(403, "Only project owners can manage members.");
+  return user;
+}
+async function requireCanEditProjectSettings(locals, projectId) {
+  const { user, ctx } = requireAuthed(locals);
+  const project = await loadProjectOr404(ctx, projectId);
+  const allowed = await managementBypassOrRun(
+    ctx,
+    async () => canEditProjectSettings(await buildProjectAccessInput(ctx, project))
+  );
+  if (!allowed) throw error(403, "Only project owners can edit project settings.");
+  return { user, ctx, project };
+}
+async function requireCanViewProject(locals, projectId) {
+  const { user, ctx } = requireAuthed(locals);
+  const allowed = await contentCheck(async () => {
+    const project = await loadProjectOr404(ctx, projectId);
+    return canView(await buildProjectAccessInput(ctx, project));
+  });
+  if (!allowed) throw error(403, "You do not have access to this project.");
+  return user;
+}
+async function requireCanSolve(locals, projectId) {
+  const { user, ctx } = requireAuthed(locals);
+  const project = await loadProjectOr404(ctx, projectId);
+  const allowed = await contentCheck(
+    async () => canSolve(await buildProjectAccessInput(ctx, project))
+  );
+  if (!allowed) throw error(403, "You do not have access to this project.");
+  return { user, ctx, project };
+}
+async function requireEditableDefinition(locals, guid) {
+  const { ctx } = requireAuthed(locals);
+  const record = await getDefinitionMeta().get(ctx, guid);
+  if (!record) throw error(404, "Definition not found");
+  const allowed = await contentCheck(async () => {
+    const [project, member] = await Promise.all([
+      getProjectProvider().getProject(ctx, record.projectId),
+      getProjectProvider().getProjectMember(ctx, record.projectId, ctx.userId)
+    ]);
+    return canEditDefinition({
+      project,
+      definition: record,
+      member,
+      userId: ctx.userId,
+      platformPermissions: ctx.platformPermissions
+    });
+  });
+  if (!allowed) throw error(403, "You do not have permission to edit this definition.");
+  return { record, ctx };
+}
+async function requireCanEditDefinition(locals, projectId, definitionGuid) {
+  const { user, ctx } = requireAuthed(locals);
+  const allowed = await contentCheck(async () => {
+    const [project, definition, member] = await Promise.all([
+      getProjectProvider().getProject(ctx, projectId),
+      getDefinitionMeta().get(ctx, definitionGuid),
+      getProjectProvider().getProjectMember(ctx, projectId, ctx.userId)
+    ]);
+    return canEditDefinition({
+      project,
+      definition,
+      member,
+      userId: ctx.userId,
+      platformPermissions: ctx.platformPermissions
+    });
+  });
+  if (!allowed) throw error(403, "You do not have permission to edit this definition.");
+  return user;
+}
+const access_server = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
+  __proto__: null,
+  assertAnyPlatformPermission,
+  assertManageCompute,
+  assertManageDefinitions,
+  assertManageInstanceUsers,
+  assertManageProjects,
+  assertPagePermission,
+  projectAccessInputFromRows,
+  requireAnyPlatformPermission,
+  requireCanCreateDefinition,
+  requireCanCreateProject,
+  requireCanEdit,
+  requireCanEditDefinition,
+  requireCanEditProjectSettings,
+  requireCanManage,
+  requireCanManageMembers,
+  requireCanReclaim,
+  requireCanSolve,
+  requireCanViewProject,
+  requireEditableDefinition,
+  requireInstanceAdmin,
+  requireManageCompute,
+  requireManageDefinitions,
+  requireManageInstanceUsers,
+  requireManageOrgCompute,
+  requireManageOrgMembers,
+  requireManageProjects,
+  requirePermission,
+  requireTargetIsOrgMember,
+  throwProviderError
+}, Symbol.toStringTag, { value: "Module" }));
+
+export { canEdit as A, access_server as B, requireInstanceAdmin as a, requirePermission as b, requireManageInstanceUsers as c, requireCanEditDefinition as d, requireCanSolve as e, requireCanCreateDefinition as f, requireEditableDefinition as g, requireCanViewProject as h, requireManageOrgMembers as i, requireManageOrgCompute as j, requireCanCreateProject as k, requireCanManage as l, requireCanEditProjectSettings as m, canChangeVisibilityToPublic as n, requireCanManageMembers as o, requireTargetIsOrgMember as p, checkOwnerRemoval as q, requireManageCompute as r, requireCanReclaim as s, assertAnyPlatformPermission as t, assertPagePermission as u, assertManageCompute as v, withAdminBypass as w, assertManageInstanceUsers as x, canView as y, projectAccessInputFromRows as z };
+//# sourceMappingURL=access.server-GvriCjXN.js.map

package/build/server/chunks/access.server-GvriCjXN.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.server-GvriCjXN.js","sources":["../../../.svelte-kit/adapter-node/chunks/access.server.js"],"sourcesContent":["import { error, redirect } from \"@sveltejs/kit\";\nimport { h as hasPermission, f as ALL_PLATFORM_PERMISSIONS } from \"./context.js\";\nimport { k as getDefinitionMeta, a as getOrganizationProvider, m as flag, b as getProjectProvider, c as getPlatformProjectGrantStore } from \"./providers.server.js\";\nimport { h as handleApiError } from \"./api-errors.js\";\nfunction isInstanceAdmin(platformPermissions) {\n  return platformPermissions.includes(\"instance_admin\");\n}\nfunction withAdminBypass(platformPermissions, rule) {\n  if (isInstanceAdmin(platformPermissions))\n    return true;\n  return rule();\n}\nfunction canView(input) {\n  const { project, member, orgMember, allowCrossOrgPublic, platformPermissions, platformGrants, actingOrgId, userId } = input;\n  if (!project)\n    return false;\n  if (project.visibility === \"platform\") {\n    if (isInstanceAdmin(platformPermissions))\n      return true;\n    return platformGrants.some((g) => g.granteeType === \"user\" && g.granteeId === userId || g.granteeType === \"org\" && g.granteeId === actingOrgId);\n  }\n  if (project.visibility === \"private\")\n    return member !== null;\n  if (project.visibility === \"org\")\n    return orgMember !== null;\n  if (project.visibility === \"public\")\n    return allowCrossOrgPublic ? true : orgMember !== null;\n  return false;\n}\nfunction canSolve(input) {\n  const { project, platformPermissions, platformGrants, actingOrgId, userId } = input;\n  if (!project)\n    return false;\n  if (project.visibility === \"platform\") {\n    if (isInstanceAdmin(platformPermissions))\n      return true;\n    return platformGrants.some((g) => g.canSolve && (g.granteeType === \"user\" && g.granteeId === userId || g.granteeType === \"org\" && g.granteeId === actingOrgId));\n  }\n  return canView(input);\n}\nfunction canEdit(input) {\n  const { member, project, platformPermissions } = input;\n  if (project?.visibility === \"platform\")\n    return isInstanceAdmin(platformPermissions);\n  return member?.role === \"owner\" || member?.role === \"editor\";\n}\nfunction canManage(input) {\n  if (input.project?.visibility === \"platform\")\n    return isInstanceAdmin(input.platformPermissions);\n  return input.member?.role === \"owner\";\n}\nfunction canEditProjectSettings(input) {\n  if (input.project?.visibility === \"platform\")\n    return isInstanceAdmin(input.platformPermissions);\n  return input.member?.role === \"owner\";\n}\nfunction canChangeVisibilityToPublic(input) {\n  const role = input.orgMember?.role;\n  return role === \"owner\" || role === \"admin\";\n}\nfunction canEditDefinition(input) {\n  const { project, definition, member, userId, platformPermissions } = input;\n  if (!project || !definition)\n    return false;\n  if (project.visibility === \"platform\") {\n    return isInstanceAdmin(platformPermissions);\n  }\n  if (member?.role === \"owner\" || member?.role === \"editor\")\n    return true;\n  if (project.autoJoinOnUpload && userId === definition.ownerId)\n    return true;\n  return false;\n}\nfunction canReclaim(input) {\n  const { project, orgMember, actingOrgId } = input;\n  if (!project || !actingOrgId)\n    return false;\n  if (project.visibility === \"platform\")\n    return false;\n  if (actingOrgId !== project.orgId)\n    return false;\n  const role = orgMember?.role;\n  return role === \"owner\" || role === \"admin\";\n}\nfunction canCreateProject(input) {\n  const { orgMember, orgPermissions, actingOrgId, targetOrgId } = input;\n  if (actingOrgId !== targetOrgId)\n    return false;\n  const role = orgMember?.role;\n  if (role === \"owner\" || role === \"admin\")\n    return true;\n  if (role === \"member\" && orgPermissions.includes(\"manage_projects\"))\n    return true;\n  return false;\n}\nfunction checkOwnerRemoval(input) {\n  if (input.target.role !== \"owner\")\n    return \"ok\";\n  const ownerCount = input.allMembers.filter((m) => m.role === \"owner\").length;\n  if (ownerCount <= 1)\n    return \"sole_owner\";\n  if (!input.confirmed)\n    return \"needs_confirm\";\n  return \"ok\";\n}\nconst throwProviderError = handleApiError;\nfunction requireAuthed(locals) {\n  const { user, ctx } = locals;\n  if (!user || !ctx) throw error(401, \"Unauthorized\");\n  return { user, ctx };\n}\nfunction requirePermission(locals, permission) {\n  const { user, ctx } = requireAuthed(locals);\n  if (!hasPermission(ctx, permission)) {\n    throw error(403, `You don't have permission to do this.`);\n  }\n  return user;\n}\nfunction assertPagePermission(locals, permission) {\n  const { user, ctx } = requireAuthed(locals);\n  if (!hasPermission(ctx, permission)) {\n    redirect(303, \"/admin\");\n  }\n  return user;\n}\nconst requireManageInstanceUsers = (locals) => requirePermission(locals, \"manage_instance_users\");\nconst requireManageCompute = (locals) => requirePermission(locals, \"manage_compute\");\nconst requireManageOrgMembers = (locals) => requirePermission(locals, \"manage_org_members\");\nconst requireManageOrgCompute = (locals) => requirePermission(locals, \"manage_org_compute\");\nconst requireManageDefinitions = (locals) => requirePermission(locals, \"manage_definitions\");\nconst requireManageProjects = (locals) => requirePermission(locals, \"manage_projects\");\nconst assertManageInstanceUsers = (locals) => assertPagePermission(locals, \"manage_instance_users\");\nconst assertManageCompute = (locals) => assertPagePermission(locals, \"manage_compute\");\nconst assertManageDefinitions = (locals) => assertPagePermission(locals, \"manage_definitions\");\nconst assertManageProjects = (locals) => assertPagePermission(locals, \"manage_projects\");\nconst requireInstanceAdmin = (locals) => requirePermission(locals, \"instance_admin\");\nfunction requireAnyPlatformPermission(locals) {\n  const { user, ctx } = requireAuthed(locals);\n  const allowed = ALL_PLATFORM_PERMISSIONS.some((p) => hasPermission(ctx, p));\n  if (!allowed) throw error(403, `You don't have permission to do this.`);\n  return user;\n}\nfunction assertAnyPlatformPermission(locals) {\n  const { user, ctx } = requireAuthed(locals);\n  const allowed = ALL_PLATFORM_PERMISSIONS.some((p) => hasPermission(ctx, p));\n  if (!allowed) redirect(303, \"/library\");\n  return user;\n}\nasync function managementBypassOrRun(ctx, check) {\n  if (hasPermission(ctx, \"instance_admin\")) return true;\n  return await check();\n}\nasync function contentCheck(check) {\n  return await check();\n}\nasync function loadProjectOr404(ctx, projectId) {\n  const project = await getProjectProvider().getProject(ctx, projectId);\n  if (!project) throw error(404, \"Project not found\");\n  return project;\n}\nasync function buildProjectAccessInput(ctx, project, overrides = {}) {\n  const allowCrossOrgPublic = flag(\"ALLOW_CROSS_ORG_PUBLIC\");\n  let member = null;\n  let orgMember = null;\n  let platformGrants = [];\n  if (project.visibility === \"platform\") {\n    platformGrants = await getPlatformProjectGrantStore().listByProject(ctx, project.id);\n  } else if (project.visibility === \"private\") {\n    member = await getProjectProvider().getProjectMember(ctx, project.id, ctx.userId);\n  } else {\n    const skipOrgMember = project.visibility === \"public\" && allowCrossOrgPublic;\n    [member, orgMember] = await Promise.all([\n      getProjectProvider().getProjectMember(ctx, project.id, ctx.userId),\n      skipOrgMember ? Promise.resolve(null) : getOrganizationProvider().getOrgMember(ctx, project.orgId, ctx.userId)\n    ]);\n  }\n  return {\n    orgPermissions: ctx.orgPermissions,\n    platformPermissions: ctx.platformPermissions,\n    project,\n    member,\n    orgMember,\n    allowCrossOrgPublic,\n    platformGrants,\n    actingOrgId: ctx.actingOrgId ?? null,\n    userId: ctx.userId,\n    ...overrides\n  };\n}\nfunction projectAccessInputFromRows(ctx, project, rows) {\n  return {\n    orgPermissions: ctx.orgPermissions,\n    platformPermissions: ctx.platformPermissions,\n    project,\n    member: rows.member ?? null,\n    orgMember: rows.orgMember ?? null,\n    allowCrossOrgPublic: flag(\"ALLOW_CROSS_ORG_PUBLIC\"),\n    platformGrants: rows.platformGrants ?? [],\n    actingOrgId: ctx.actingOrgId ?? null,\n    userId: ctx.userId\n  };\n}\nasync function requireCanEdit(locals, projectId) {\n  const { user, ctx } = requireAuthed(locals);\n  const allowed = await contentCheck(async () => {\n    const project = await loadProjectOr404(ctx, projectId);\n    return canEdit(await buildProjectAccessInput(ctx, project));\n  });\n  if (!allowed) throw error(403, \"You do not have permission to edit this project.\");\n  return user;\n}\nasync function requireCanCreateDefinition(locals, projectId) {\n  const { user, ctx } = requireAuthed(locals);\n  const project = await loadProjectOr404(ctx, projectId);\n  const allowed = await contentCheck(async () => {\n    if (project.autoJoinOnUpload) return true;\n    return canEdit(await buildProjectAccessInput(ctx, project));\n  });\n  if (!allowed) {\n    throw error(403, \"You do not have permission to upload definitions to this project.\");\n  }\n  return { user, ctx, project };\n}\nasync function requireTargetIsOrgMember(locals, orgId, targetUserId) {\n  const { ctx } = requireAuthed(locals);\n  const member = await getOrganizationProvider().getOrgMember(ctx, orgId, targetUserId);\n  if (!member) {\n    throw error(400, \"User must be a member of this organization to be added to a project.\");\n  }\n}\nasync function requireCanReclaim(locals, projectId) {\n  const { user, ctx } = requireAuthed(locals);\n  const project = await loadProjectOr404(ctx, projectId);\n  const allowed = await managementBypassOrRun(ctx, async () => {\n    const orgMember = await getOrganizationProvider().getOrgMember(ctx, project.orgId, ctx.userId);\n    return canReclaim({\n      project,\n      orgMember,\n      actingOrgId: ctx.actingOrgId ?? null\n    });\n  });\n  if (!allowed) {\n    throw error(403, \"Only org owners or admins of this project’s org can reclaim it.\");\n  }\n  return { user, ctx, project };\n}\nasync function requireCanCreateProject(locals, targetOrgId) {\n  const { user, ctx } = requireAuthed(locals);\n  const allowed = await managementBypassOrRun(ctx, async () => {\n    const orgMember = await getOrganizationProvider().getOrgMember(ctx, targetOrgId, ctx.userId);\n    return canCreateProject({\n      orgPermissions: ctx.orgPermissions,\n      orgMember,\n      actingOrgId: ctx.actingOrgId ?? null,\n      targetOrgId\n    });\n  });\n  if (!allowed) throw error(403, \"You do not have permission to create projects in this org.\");\n  return { user, ctx };\n}\nasync function requireCanManage(locals, projectId) {\n  const { user, ctx } = requireAuthed(locals);\n  const allowed = await managementBypassOrRun(ctx, async () => {\n    const project = await loadProjectOr404(ctx, projectId);\n    return canManage(await buildProjectAccessInput(ctx, project));\n  });\n  if (!allowed) throw error(403, \"Only project owners can manage this project.\");\n  return user;\n}\nasync function requireCanManageMembers(locals, projectId) {\n  const { user, ctx } = requireAuthed(locals);\n  const allowed = await managementBypassOrRun(ctx, async () => {\n    const project = await loadProjectOr404(ctx, projectId);\n    return canManage(await buildProjectAccessInput(ctx, project));\n  });\n  if (!allowed) throw error(403, \"Only project owners can manage members.\");\n  return user;\n}\nasync function requireCanEditProjectSettings(locals, projectId) {\n  const { user, ctx } = requireAuthed(locals);\n  const project = await loadProjectOr404(ctx, projectId);\n  const allowed = await managementBypassOrRun(\n    ctx,\n    async () => canEditProjectSettings(await buildProjectAccessInput(ctx, project))\n  );\n  if (!allowed) throw error(403, \"Only project owners can edit project settings.\");\n  return { user, ctx, project };\n}\nasync function requireCanViewProject(locals, projectId) {\n  const { user, ctx } = requireAuthed(locals);\n  const allowed = await contentCheck(async () => {\n    const project = await loadProjectOr404(ctx, projectId);\n    return canView(await buildProjectAccessInput(ctx, project));\n  });\n  if (!allowed) throw error(403, \"You do not have access to this project.\");\n  return user;\n}\nasync function requireCanSolve(locals, projectId) {\n  const { user, ctx } = requireAuthed(locals);\n  const project = await loadProjectOr404(ctx, projectId);\n  const allowed = await contentCheck(\n    async () => canSolve(await buildProjectAccessInput(ctx, project))\n  );\n  if (!allowed) throw error(403, \"You do not have access to this project.\");\n  return { user, ctx, project };\n}\nasync function requireEditableDefinition(locals, guid) {\n  const { ctx } = requireAuthed(locals);\n  const record = await getDefinitionMeta().get(ctx, guid);\n  if (!record) throw error(404, \"Definition not found\");\n  const allowed = await contentCheck(async () => {\n    const [project, member] = await Promise.all([\n      getProjectProvider().getProject(ctx, record.projectId),\n      getProjectProvider().getProjectMember(ctx, record.projectId, ctx.userId)\n    ]);\n    return canEditDefinition({\n      project,\n      definition: record,\n      member,\n      userId: ctx.userId,\n      platformPermissions: ctx.platformPermissions\n    });\n  });\n  if (!allowed) throw error(403, \"You do not have permission to edit this definition.\");\n  return { record, ctx };\n}\nasync function requireCanEditDefinition(locals, projectId, definitionGuid) {\n  const { user, ctx } = requireAuthed(locals);\n  const allowed = await contentCheck(async () => {\n    const [project, definition, member] = await Promise.all([\n      getProjectProvider().getProject(ctx, projectId),\n      getDefinitionMeta().get(ctx, definitionGuid),\n      getProjectProvider().getProjectMember(ctx, projectId, ctx.userId)\n    ]);\n    return canEditDefinition({\n      project,\n      definition,\n      member,\n      userId: ctx.userId,\n      platformPermissions: ctx.platformPermissions\n    });\n  });\n  if (!allowed) throw error(403, \"You do not have permission to edit this definition.\");\n  return user;\n}\nconst access_server = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({\n  __proto__: null,\n  assertAnyPlatformPermission,\n  assertManageCompute,\n  assertManageDefinitions,\n  assertManageInstanceUsers,\n  assertManageProjects,\n  assertPagePermission,\n  projectAccessInputFromRows,\n  requireAnyPlatformPermission,\n  requireCanCreateDefinition,\n  requireCanCreateProject,\n  requireCanEdit,\n  requireCanEditDefinition,\n  requireCanEditProjectSettings,\n  requireCanManage,\n  requireCanManageMembers,\n  requireCanReclaim,\n  requireCanSolve,\n  requireCanViewProject,\n  requireEditableDefinition,\n  requireInstanceAdmin,\n  requireManageCompute,\n  requireManageDefinitions,\n  requireManageInstanceUsers,\n  requireManageOrgCompute,\n  requireManageOrgMembers,\n  requireManageProjects,\n  requirePermission,\n  requireTargetIsOrgMember,\n  throwProviderError\n}, Symbol.toStringTag, { value: \"Module\" }));\nexport {\n  canEdit as A,\n  access_server as B,\n  requireInstanceAdmin as a,\n  requirePermission as b,\n  requireManageInstanceUsers as c,\n  requireCanEditDefinition as d,\n  requireCanSolve as e,\n  requireCanCreateDefinition as f,\n  requireEditableDefinition as g,\n  requireCanViewProject as h,\n  requireManageOrgMembers as i,\n  requireManageOrgCompute as j,\n  requireCanCreateProject as k,\n  requireCanManage as l,\n  requireCanEditProjectSettings as m,\n  canChangeVisibilityToPublic as n,\n  requireCanManageMembers as o,\n  requireTargetIsOrgMember as p,\n  checkOwnerRemoval as q,\n  requireManageCompute as r,\n  requireCanReclaim as s,\n  assertAnyPlatformPermission as t,\n  assertPagePermission as u,\n  assertManageCompute as v,\n  withAdminBypass as w,\n  assertManageInstanceUsers as x,\n  canView as y,\n  projectAccessInputFromRows as z\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;AAIA,SAAS,eAAe,CAAC,mBAAmB,EAAE;AAC9C,EAAE,OAAO,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC;AACvD;AACA,SAAS,eAAe,CAAC,mBAAmB,EAAE,IAAI,EAAE;AACpD,EAAE,IAAI,eAAe,CAAC,mBAAmB,CAAC;AAC1C,IAAI,OAAO,IAAI;AACf,EAAE,OAAO,IAAI,EAAE;AACf;AACA,SAAS,OAAO,CAAC,KAAK,EAAE;AACxB,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,KAAK;AAC7H,EAAE,IAAI,CAAC,OAAO;AACd,IAAI,OAAO,KAAK;AAChB,EAAE,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE;AACzC,IAAI,IAAI,eAAe,CAAC,mBAAmB,CAAC;AAC5C,MAAM,OAAO,IAAI;AACjB,IAAI,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,KAAK,IAAI,CAAC,CAAC,SAAS,KAAK,WAAW,CAAC;AACnJ,EAAE;AACF,EAAE,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;AACtC,IAAI,OAAO,MAAM,KAAK,IAAI;AAC1B,EAAE,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK;AAClC,IAAI,OAAO,SAAS,KAAK,IAAI;AAC7B,EAAE,IAAI,OAAO,CAAC,UAAU,KAAK,QAAQ;AACrC,IAAI,OAAO,mBAAmB,GAAG,IAAI,GAAG,SAAS,KAAK,IAAI;AAC1D,EAAE,OAAO,KAAK;AACd;AACA,SAAS,QAAQ,CAAC,KAAK,EAAE;AACzB,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,KAAK;AACrF,EAAE,IAAI,CAAC,OAAO;AACd,IAAI,OAAO,KAAK;AAChB,EAAE,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE;AACzC,IAAI,IAAI,eAAe,CAAC,mBAAmB,CAAC;AAC5C,MAAM,OAAO,IAAI;AACjB,IAAI,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,KAAK,IAAI,CAAC,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC;AACnK,EAAE;AACF,EAAE,OAAO,OAAO,CAAC,KAAK,CAAC;AACvB;AACA,SAAS,OAAO,CAAC,KAAK,EAAE;AACxB,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,GAAG,KAAK;AACxD,EAAE,IAAI,OAAO,EAAE,UAAU,KAAK,UAAU;AACxC,IAAI,OAAO,eAAe,CAAC,mBAAmB,CAAC;AAC/C,EAAE,OAAO,MAAM,EAAE,IAAI,KAAK,OAAO,IAAI,MAAM,EAAE,IAAI,KAAK,QAAQ;AAC9D;AACA,SAAS,SAAS,CAAC,KAAK,EAAE;AAC1B,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,UAAU,KAAK,UAAU;AAC9C,IAAI,OAAO,eAAe,CAAC,KAAK,CAAC,mBAAmB,CAAC;AACrD,EAAE,OAAO,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,OAAO;AACvC;AACA,SAAS,sBAAsB,CAAC,KAAK,EAAE;AACvC,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,UAAU,KAAK,UAAU;AAC9C,IAAI,OAAO,eAAe,CAAC,KAAK,CAAC,mBAAmB,CAAC;AACrD,EAAE,OAAO,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,OAAO;AACvC;AACA,SAAS,2BAA2B,CAAC,KAAK,EAAE;AAC5C,EAAE,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,EAAE,IAAI;AACpC,EAAE,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO;AAC7C;AACA,SAAS,iBAAiB,CAAC,KAAK,EAAE;AAClC,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,KAAK;AAC5E,EAAE,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU;AAC7B,IAAI,OAAO,KAAK;AAChB,EAAE,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE;AACzC,IAAI,OAAO,eAAe,CAAC,mBAAmB,CAAC;AAC/C,EAAE;AACF,EAAE,IAAI,MAAM,EAAE,IAAI,KAAK,OAAO,IAAI,MAAM,EAAE,IAAI,KAAK,QAAQ;AAC3D,IAAI,OAAO,IAAI;AACf,EAAE,IAAI,OAAO,CAAC,gBAAgB,IAAI,MAAM,KAAK,UAAU,CAAC,OAAO;AAC/D,IAAI,OAAO,IAAI;AACf,EAAE,OAAO,KAAK;AACd;AACA,SAAS,UAAU,CAAC,KAAK,EAAE;AAC3B,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,KAAK;AACnD,EAAE,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW;AAC9B,IAAI,OAAO,KAAK;AAChB,EAAE,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU;AACvC,IAAI,OAAO,KAAK;AAChB,EAAE,IAAI,WAAW,KAAK,OAAO,CAAC,KAAK;AACnC,IAAI,OAAO,KAAK;AAChB,EAAE,MAAM,IAAI,GAAG,SAAS,EAAE,IAAI;AAC9B,EAAE,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO;AAC7C;AACA,SAAS,gBAAgB,CAAC,KAAK,EAAE;AACjC,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,KAAK;AACvE,EAAE,IAAI,WAAW,KAAK,WAAW;AACjC,IAAI,OAAO,KAAK;AAChB,EAAE,MAAM,IAAI,GAAG,SAAS,EAAE,IAAI;AAC9B,EAAE,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO;AAC1C,IAAI,OAAO,IAAI;AACf,EAAE,IAAI,IAAI,KAAK,QAAQ,IAAI,cAAc,CAAC,QAAQ,CAAC,iBAAiB,CAAC;AACrE,IAAI,OAAO,IAAI;AACf,EAAE,OAAO,KAAK;AACd;AACA,SAAS,iBAAiB,CAAC,KAAK,EAAE;AAClC,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO;AACnC,IAAI,OAAO,IAAI;AACf,EAAE,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,MAAM;AAC9E,EAAE,IAAI,UAAU,IAAI,CAAC;AACrB,IAAI,OAAO,YAAY;AACvB,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS;AACtB,IAAI,OAAO,eAAe;AAC1B,EAAE,OAAO,IAAI;AACb;AACA,MAAM,kBAAkB,GAAG,cAAc;AACzC,SAAS,aAAa,CAAC,MAAM,EAAE;AAC/B,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM;AAC9B,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC;AACrD,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE;AACtB;AACA,SAAS,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE;AAC/C,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE;AACvC,IAAI,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,qCAAqC,CAAC,CAAC;AAC7D,EAAE;AACF,EAAE,OAAO,IAAI;AACb;AACA,SAAS,oBAAoB,CAAC,MAAM,EAAE,UAAU,EAAE;AAClD,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE;AACvC,IAAI,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;AAC3B,EAAE;AACF,EAAE,OAAO,IAAI;AACb;AACK,MAAC,0BAA0B,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,uBAAuB;AAC3F,MAAC,oBAAoB,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,gBAAgB;AAC9E,MAAC,uBAAuB,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,oBAAoB;AACrF,MAAC,uBAAuB,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,oBAAoB;AAC1F,MAAM,wBAAwB,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,oBAAoB,CAAC;AAC5F,MAAM,qBAAqB,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,CAAC;AACjF,MAAC,yBAAyB,GAAG,CAAC,MAAM,KAAK,oBAAoB,CAAC,MAAM,EAAE,uBAAuB;AAC7F,MAAC,mBAAmB,GAAG,CAAC,MAAM,KAAK,oBAAoB,CAAC,MAAM,EAAE,gBAAgB;AACrF,MAAM,uBAAuB,GAAG,CAAC,MAAM,KAAK,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,CAAC;AAC9F,MAAM,oBAAoB,GAAG,CAAC,MAAM,KAAK,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,CAAC;AACnF,MAAC,oBAAoB,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,gBAAgB;AACnF,SAAS,4BAA4B,CAAC,MAAM,EAAE;AAC9C,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AAC7E,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,qCAAqC,CAAC,CAAC;AACzE,EAAE,OAAO,IAAI;AACb;AACA,SAAS,2BAA2B,CAAC,MAAM,EAAE;AAC7C,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AAC7E,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;AACzC,EAAE,OAAO,IAAI;AACb;AACA,eAAe,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE;AACjD,EAAE,IAAI,aAAa,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,OAAO,IAAI;AACvD,EAAE,OAAO,MAAM,KAAK,EAAE;AACtB;AACA,eAAe,YAAY,CAAC,KAAK,EAAE;AACnC,EAAE,OAAO,MAAM,KAAK,EAAE;AACtB;AACA,eAAe,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE;AAChD,EAAE,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;AACvE,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,mBAAmB,CAAC;AACrD,EAAE,OAAO,OAAO;AAChB;AACA,eAAe,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,EAAE;AACrE,EAAE,MAAM,mBAAmB,GAAG,IAAI,CAAC,wBAAwB,CAAC;AAC5D,EAAE,IAAI,MAAM,GAAG,IAAI;AACnB,EAAE,IAAI,SAAS,GAAG,IAAI;AACtB,EAAE,IAAI,cAAc,GAAG,EAAE;AACzB,EAAE,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE;AACzC,IAAI,cAAc,GAAG,MAAM,4BAA4B,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;AACxF,EAAE,CAAC,MAAM,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE;AAC/C,IAAI,MAAM,GAAG,MAAM,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC;AACrF,EAAE,CAAC,MAAM;AACT,IAAI,MAAM,aAAa,GAAG,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,mBAAmB;AAChF,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AAC5C,MAAM,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC;AACxE,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,uBAAuB,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM;AACnH,KAAK,CAAC;AACN,EAAE;AACF,EAAE,OAAO;AACT,IAAI,cAAc,EAAE,GAAG,CAAC,cAAc;AACtC,IAAI,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;AAChD,IAAI,OAAO;AACX,IAAI,MAAM;AACV,IAAI,SAAS;AACb,IAAI,mBAAmB;AACvB,IAAI,cAAc;AAClB,IAAI,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;AACxC,IAAI,MAAM,EAAE,GAAG,CAAC,MAAM;AACtB,IAAI,GAAG;AACP,GAAG;AACH;AACA,SAAS,0BAA0B,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;AACxD,EAAE,OAAO;AACT,IAAI,cAAc,EAAE,GAAG,CAAC,cAAc;AACtC,IAAI,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;AAChD,IAAI,OAAO;AACX,IAAI,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;AAC/B,IAAI,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;AACrC,IAAI,mBAAmB,EAAE,IAAI,CAAC,wBAAwB,CAAC;AACvD,IAAI,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE;AAC7C,IAAI,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;AACxC,IAAI,MAAM,EAAE,GAAG,CAAC;AAChB,GAAG;AACH;AACA,eAAe,cAAc,CAAC,MAAM,EAAE,SAAS,EAAE;AACjD,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,YAAY;AACjD,IAAI,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC;AAC1D,IAAI,OAAO,OAAO,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC/D,EAAE,CAAC,CAAC;AACJ,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,kDAAkD,CAAC;AACpF,EAAE,OAAO,IAAI;AACb;AACA,eAAe,0BAA0B,CAAC,MAAM,EAAE,SAAS,EAAE;AAC7D,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC;AACxD,EAAE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,YAAY;AACjD,IAAI,IAAI,OAAO,CAAC,gBAAgB,EAAE,OAAO,IAAI;AAC7C,IAAI,OAAO,OAAO,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC/D,EAAE,CAAC,CAAC;AACJ,EAAE,IAAI,CAAC,OAAO,EAAE;AAChB,IAAI,MAAM,KAAK,CAAC,GAAG,EAAE,mEAAmE,CAAC;AACzF,EAAE;AACF,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE;AAC/B;AACA,eAAe,wBAAwB,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE;AACrE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AACvC,EAAE,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC;AACvF,EAAE,IAAI,CAAC,MAAM,EAAE;AACf,IAAI,MAAM,KAAK,CAAC,GAAG,EAAE,sEAAsE,CAAC;AAC5F,EAAE;AACF;AACA,eAAe,iBAAiB,CAAC,MAAM,EAAE,SAAS,EAAE;AACpD,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC;AACxD,EAAE,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,YAAY;AAC/D,IAAI,MAAM,SAAS,GAAG,MAAM,uBAAuB,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC;AAClG,IAAI,OAAO,UAAU,CAAC;AACtB,MAAM,OAAO;AACb,MAAM,SAAS;AACf,MAAM,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI;AACtC,KAAK,CAAC;AACN,EAAE,CAAC,CAAC;AACJ,EAAE,IAAI,CAAC,OAAO,EAAE;AAChB,IAAI,MAAM,KAAK,CAAC,GAAG,EAAE,iEAAiE,CAAC;AACvF,EAAE;AACF,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE;AAC/B;AACA,eAAe,uBAAuB,CAAC,MAAM,EAAE,WAAW,EAAE;AAC5D,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,YAAY;AAC/D,IAAI,MAAM,SAAS,GAAG,MAAM,uBAAuB,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC;AAChG,IAAI,OAAO,gBAAgB,CAAC;AAC5B,MAAM,cAAc,EAAE,GAAG,CAAC,cAAc;AACxC,MAAM,SAAS;AACf,MAAM,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;AAC1C,MAAM;AACN,KAAK,CAAC;AACN,EAAE,CAAC,CAAC;AACJ,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,4DAA4D,CAAC;AAC9F,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE;AACtB;AACA,eAAe,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE;AACnD,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,YAAY;AAC/D,IAAI,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC;AAC1D,IAAI,OAAO,SAAS,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AACjE,EAAE,CAAC,CAAC;AACJ,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,8CAA8C,CAAC;AAChF,EAAE,OAAO,IAAI;AACb;AACA,eAAe,uBAAuB,CAAC,MAAM,EAAE,SAAS,EAAE;AAC1D,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,YAAY;AAC/D,IAAI,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC;AAC1D,IAAI,OAAO,SAAS,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AACjE,EAAE,CAAC,CAAC;AACJ,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,yCAAyC,CAAC;AAC3E,EAAE,OAAO,IAAI;AACb;AACA,eAAe,6BAA6B,CAAC,MAAM,EAAE,SAAS,EAAE;AAChE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC;AACxD,EAAE,MAAM,OAAO,GAAG,MAAM,qBAAqB;AAC7C,IAAI,GAAG;AACP,IAAI,YAAY,sBAAsB,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC;AAClF,GAAG;AACH,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,gDAAgD,CAAC;AAClF,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE;AAC/B;AACA,eAAe,qBAAqB,CAAC,MAAM,EAAE,SAAS,EAAE;AACxD,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,YAAY;AACjD,IAAI,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC;AAC1D,IAAI,OAAO,OAAO,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC/D,EAAE,CAAC,CAAC;AACJ,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,yCAAyC,CAAC;AAC3E,EAAE,OAAO,IAAI;AACb;AACA,eAAe,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE;AAClD,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC;AACxD,EAAE,MAAM,OAAO,GAAG,MAAM,YAAY;AACpC,IAAI,YAAY,QAAQ,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC;AACpE,GAAG;AACH,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,yCAAyC,CAAC;AAC3E,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE;AAC/B;AACA,eAAe,yBAAyB,CAAC,MAAM,EAAE,IAAI,EAAE;AACvD,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AACvC,EAAE,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC;AACzD,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,sBAAsB,CAAC;AACvD,EAAE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,YAAY;AACjD,IAAI,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AAChD,MAAM,kBAAkB,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC;AAC5D,MAAM,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM;AAC7E,KAAK,CAAC;AACN,IAAI,OAAO,iBAAiB,CAAC;AAC7B,MAAM,OAAO;AACb,MAAM,UAAU,EAAE,MAAM;AACxB,MAAM,MAAM;AACZ,MAAM,MAAM,EAAE,GAAG,CAAC,MAAM;AACxB,MAAM,mBAAmB,EAAE,GAAG,CAAC;AAC/B,KAAK,CAAC;AACN,EAAE,CAAC,CAAC;AACJ,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,qDAAqD,CAAC;AACvF,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE;AACxB;AACA,eAAe,wBAAwB,CAAC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE;AAC3E,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,YAAY;AACjD,IAAI,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AAC5D,MAAM,kBAAkB,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;AACrD,MAAM,iBAAiB,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC;AAClD,MAAM,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM;AACtE,KAAK,CAAC;AACN,IAAI,OAAO,iBAAiB,CAAC;AAC7B,MAAM,OAAO;AACb,MAAM,UAAU;AAChB,MAAM,MAAM;AACZ,MAAM,MAAM,EAAE,GAAG,CAAC,MAAM;AACxB,MAAM,mBAAmB,EAAE,GAAG,CAAC;AAC/B,KAAK,CAAC;AACN,EAAE,CAAC,CAAC;AACJ,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,qDAAqD,CAAC;AACvF,EAAE,OAAO,IAAI;AACb;AACK,MAAC,aAAa,mBAAmB,MAAM,CAAC,MAAM,iBAAiB,MAAM,CAAC,cAAc,CAAC;AAC1F,EAAE,SAAS,EAAE,IAAI;AACjB,EAAE,2BAA2B;AAC7B,EAAE,mBAAmB;AACrB,EAAE,uBAAuB;AACzB,EAAE,yBAAyB;AAC3B,EAAE,oBAAoB;AACtB,EAAE,oBAAoB;AACtB,EAAE,0BAA0B;AAC5B,EAAE,4BAA4B;AAC9B,EAAE,0BAA0B;AAC5B,EAAE,uBAAuB;AACzB,EAAE,cAAc;AAChB,EAAE,wBAAwB;AAC1B,EAAE,6BAA6B;AAC/B,EAAE,gBAAgB;AAClB,EAAE,uBAAuB;AACzB,EAAE,iBAAiB;AACnB,EAAE,eAAe;AACjB,EAAE,qBAAqB;AACvB,EAAE,yBAAyB;AAC3B,EAAE,oBAAoB;AACtB,EAAE,oBAAoB;AACtB,EAAE,wBAAwB;AAC1B,EAAE,0BAA0B;AAC5B,EAAE,uBAAuB;AACzB,EAAE,uBAAuB;AACzB,EAAE,qBAAqB;AACvB,EAAE,iBAAiB;AACnB,EAAE,wBAAwB;AAC1B,EAAE;AACF,CAAC,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;;;;"}

package/build/server/chunks/activity-5BrQjmZv.js

@@ -0,0 +1,18 @@
+import { af as spread_props } from './renderer-BFEBS3DQ.js';
+import { I as Icon } from './utils3-AZ8FPfBW.js';
+
+function Activity($$renderer, $$props) {
+  let { $$slots, $$events, ...props } = $$props;
+  const iconNode = [
+    [
+      "path",
+      {
+        "d": "M22 12h-2.48a2 2 0 0 0-1.93 1.46l-2.35 8.36a.25.25 0 0 1-.48 0L9.24 2.18a.25.25 0 0 0-.48 0l-2.35 8.36A2 2 0 0 1 4.49 12H2"
+      }
+    ]
+  ];
+  Icon($$renderer, spread_props([{ name: "activity" }, props, { iconNode }]));
+}
+
+export { Activity as A };
+//# sourceMappingURL=activity-5BrQjmZv.js.map

package/build/server/chunks/activity-5BrQjmZv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"activity-5BrQjmZv.js","sources":["../../../.svelte-kit/adapter-node/chunks/activity.js"],"sourcesContent":["import { ac as spread_props } from \"./renderer.js\";\nimport { I as Icon } from \"./utils3.js\";\nfunction Activity($$renderer, $$props) {\n  let { $$slots, $$events, ...props } = $$props;\n  const iconNode = [\n    [\n      \"path\",\n      {\n        \"d\": \"M22 12h-2.48a2 2 0 0 0-1.93 1.46l-2.35 8.36a.25.25 0 0 1-.48 0L9.24 2.18a.25.25 0 0 0-.48 0l-2.35 8.36A2 2 0 0 1 4.49 12H2\"\n      }\n    ]\n  ];\n  Icon($$renderer, spread_props([{ name: \"activity\" }, props, { iconNode }]));\n}\nexport {\n  Activity as A\n};\n"],"names":[],"mappings":";;;AAEA,SAAS,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE;AACvC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO;AAC/C,EAAE,MAAM,QAAQ,GAAG;AACnB,IAAI;AACJ,MAAM,MAAM;AACZ,MAAM;AACN,QAAQ,GAAG,EAAE;AACb;AACA;AACA,GAAG;AACH,EAAE,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;AAC7E;;;;"}

package/build/server/chunks/admin-auth.server-CdTfBMI5.js

@@ -0,0 +1,78 @@
+import { error } from '@sveltejs/kit';
+
+const SESSION_COOKIE_NAME = "admin_session";
+const SESSION_MAX_AGE_MS = 8 * 60 * 60 * 1e3;
+const REFRESH_COOKIE_NAME = "admin_refresh";
+const REFRESH_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1e3;
+const RATE_LIMIT_MAX = 5;
+const RATE_LIMIT_WINDOW_MS = 15 * 60 * 1e3;
+const rateLimitStore = /* @__PURE__ */ new Map();
+function checkRateLimit(ip) {
+  const now = Date.now();
+  const entry = rateLimitStore.get(ip);
+  if (!entry || now > entry.resetAt) {
+    return { allowed: true };
+  }
+  if (entry.count >= RATE_LIMIT_MAX) {
+    const retryAfter = Math.ceil((entry.resetAt - now) / 1e3);
+    return { allowed: false, retryAfter };
+  }
+  return { allowed: true };
+}
+function recordFailedAttempt(ip) {
+  const now = Date.now();
+  const entry = rateLimitStore.get(ip);
+  if (!entry || now > entry.resetAt) {
+    rateLimitStore.set(ip, { count: 1, resetAt: now + RATE_LIMIT_WINDOW_MS });
+  } else {
+    entry.count += 1;
+  }
+}
+function clearRateLimit(ip) {
+  rateLimitStore.delete(ip);
+}
+function setSessionCookie(cookies, sessionToken) {
+  const isSecure = process.env.NODE_ENV === "production" && process.env.ALLOW_INSECURE_COOKIES !== "true";
+  cookies.set(SESSION_COOKIE_NAME, sessionToken, {
+    path: "/",
+    httpOnly: true,
+    sameSite: "lax",
+    secure: isSecure,
+    maxAge: SESSION_MAX_AGE_MS / 1e3
+  });
+}
+function destroySession(cookies) {
+  cookies.delete(SESSION_COOKIE_NAME, { path: "/" });
+  cookies.delete(REFRESH_COOKIE_NAME, { path: "/" });
+}
+function setRefreshCookie(cookies, refreshToken) {
+  const isSecure = process.env.NODE_ENV === "production" && process.env.ALLOW_INSECURE_COOKIES !== "true";
+  cookies.set(REFRESH_COOKIE_NAME, refreshToken, {
+    path: "/",
+    httpOnly: true,
+    sameSite: "lax",
+    secure: isSecure,
+    maxAge: REFRESH_MAX_AGE_MS / 1e3
+  });
+}
+function getRefreshToken(cookies) {
+  return cookies.get(REFRESH_COOKIE_NAME);
+}
+function clearRefreshCookie(cookies) {
+  cookies.delete(REFRESH_COOKIE_NAME, { path: "/" });
+}
+function requireMaxBodySize(request, maxBytes) {
+  const declared = Number(request.headers.get("content-length"));
+  if (Number.isFinite(declared) && declared > maxBytes) {
+    throw error(413, `Request body exceeds the limit for this endpoint.`);
+  }
+}
+function safeRedirectTarget(raw, fallback) {
+  if (typeof raw !== "string" || raw.length < 2) return fallback;
+  if (raw[0] !== "/") return fallback;
+  if (raw[1] === "/" || raw[1] === "\\") return fallback;
+  return raw;
+}
+
+export { setRefreshCookie as a, checkRateLimit as b, clearRefreshCookie as c, safeRedirectTarget as d, clearRateLimit as e, destroySession as f, getRefreshToken as g, requireMaxBodySize as h, recordFailedAttempt as r, setSessionCookie as s };
+//# sourceMappingURL=admin-auth.server-CdTfBMI5.js.map

package/build/server/chunks/admin-auth.server-CdTfBMI5.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-auth.server-CdTfBMI5.js","sources":["../../../.svelte-kit/adapter-node/chunks/admin-auth.server.js"],"sourcesContent":["import { error } from \"@sveltejs/kit\";\nconst SESSION_COOKIE_NAME = \"admin_session\";\nconst SESSION_MAX_AGE_MS = 8 * 60 * 60 * 1e3;\nconst REFRESH_COOKIE_NAME = \"admin_refresh\";\nconst REFRESH_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1e3;\nconst RATE_LIMIT_MAX = 5;\nconst RATE_LIMIT_WINDOW_MS = 15 * 60 * 1e3;\nconst rateLimitStore = /* @__PURE__ */ new Map();\nfunction checkRateLimit(ip) {\n  const now = Date.now();\n  const entry = rateLimitStore.get(ip);\n  if (!entry || now > entry.resetAt) {\n    return { allowed: true };\n  }\n  if (entry.count >= RATE_LIMIT_MAX) {\n    const retryAfter = Math.ceil((entry.resetAt - now) / 1e3);\n    return { allowed: false, retryAfter };\n  }\n  return { allowed: true };\n}\nfunction recordFailedAttempt(ip) {\n  const now = Date.now();\n  const entry = rateLimitStore.get(ip);\n  if (!entry || now > entry.resetAt) {\n    rateLimitStore.set(ip, { count: 1, resetAt: now + RATE_LIMIT_WINDOW_MS });\n  } else {\n    entry.count += 1;\n  }\n}\nfunction clearRateLimit(ip) {\n  rateLimitStore.delete(ip);\n}\nfunction setSessionCookie(cookies, sessionToken) {\n  const isSecure = process.env.NODE_ENV === \"production\" && process.env.ALLOW_INSECURE_COOKIES !== \"true\";\n  cookies.set(SESSION_COOKIE_NAME, sessionToken, {\n    path: \"/\",\n    httpOnly: true,\n    sameSite: \"lax\",\n    secure: isSecure,\n    maxAge: SESSION_MAX_AGE_MS / 1e3\n  });\n}\nfunction destroySession(cookies) {\n  cookies.delete(SESSION_COOKIE_NAME, { path: \"/\" });\n  cookies.delete(REFRESH_COOKIE_NAME, { path: \"/\" });\n}\nfunction setRefreshCookie(cookies, refreshToken) {\n  const isSecure = process.env.NODE_ENV === \"production\" && process.env.ALLOW_INSECURE_COOKIES !== \"true\";\n  cookies.set(REFRESH_COOKIE_NAME, refreshToken, {\n    path: \"/\",\n    httpOnly: true,\n    sameSite: \"lax\",\n    secure: isSecure,\n    maxAge: REFRESH_MAX_AGE_MS / 1e3\n  });\n}\nfunction getRefreshToken(cookies) {\n  return cookies.get(REFRESH_COOKIE_NAME);\n}\nfunction clearRefreshCookie(cookies) {\n  cookies.delete(REFRESH_COOKIE_NAME, { path: \"/\" });\n}\nfunction requireMaxBodySize(request, maxBytes) {\n  const declared = Number(request.headers.get(\"content-length\"));\n  if (Number.isFinite(declared) && declared > maxBytes) {\n    throw error(413, `Request body exceeds the limit for this endpoint.`);\n  }\n}\nfunction safeRedirectTarget(raw, fallback) {\n  if (typeof raw !== \"string\" || raw.length < 2) return fallback;\n  if (raw[0] !== \"/\") return fallback;\n  if (raw[1] === \"/\" || raw[1] === \"\\\\\") return fallback;\n  return raw;\n}\nexport {\n  setRefreshCookie as a,\n  safeRedirectTarget as b,\n  checkRateLimit as c,\n  recordFailedAttempt as d,\n  clearRateLimit as e,\n  destroySession as f,\n  getRefreshToken as g,\n  clearRefreshCookie as h,\n  requireMaxBodySize as r,\n  setSessionCookie as s\n};\n"],"names":[],"mappings":";;AACA,MAAM,mBAAmB,GAAG,eAAe;AAC3C,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG;AAC5C,MAAM,mBAAmB,GAAG,eAAe;AAC3C,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG;AAClD,MAAM,cAAc,GAAG,CAAC;AACxB,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG;AAC1C,MAAM,cAAc,mBAAmB,IAAI,GAAG,EAAE;AAChD,SAAS,cAAc,CAAC,EAAE,EAAE;AAC5B,EAAE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;AACxB,EAAE,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;AACtC,EAAE,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE;AACrC,IAAI,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;AAC5B,EAAE;AACF,EAAE,IAAI,KAAK,CAAC,KAAK,IAAI,cAAc,EAAE;AACrC,IAAI,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,IAAI,GAAG,CAAC;AAC7D,IAAI,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE;AACzC,EAAE;AACF,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;AAC1B;AACA,SAAS,mBAAmB,CAAC,EAAE,EAAE;AACjC,EAAE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;AACxB,EAAE,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;AACtC,EAAE,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE;AACrC,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,oBAAoB,EAAE,CAAC;AAC7E,EAAE,CAAC,MAAM;AACT,IAAI,KAAK,CAAC,KAAK,IAAI,CAAC;AACpB,EAAE;AACF;AACA,SAAS,cAAc,CAAC,EAAE,EAAE;AAC5B,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;AAC3B;AACA,SAAS,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE;AACjD,EAAE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,MAAM;AACzG,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,YAAY,EAAE;AACjD,IAAI,IAAI,EAAE,GAAG;AACb,IAAI,QAAQ,EAAE,IAAI;AAClB,IAAI,QAAQ,EAAE,KAAK;AACnB,IAAI,MAAM,EAAE,QAAQ;AACpB,IAAI,MAAM,EAAE,kBAAkB,GAAG;AACjC,GAAG,CAAC;AACJ;AACA,SAAS,cAAc,CAAC,OAAO,EAAE;AACjC,EAAE,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACpD,EAAE,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACpD;AACA,SAAS,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE;AACjD,EAAE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,MAAM;AACzG,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,YAAY,EAAE;AACjD,IAAI,IAAI,EAAE,GAAG;AACb,IAAI,QAAQ,EAAE,IAAI;AAClB,IAAI,QAAQ,EAAE,KAAK;AACnB,IAAI,MAAM,EAAE,QAAQ;AACpB,IAAI,MAAM,EAAE,kBAAkB,GAAG;AACjC,GAAG,CAAC;AACJ;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,EAAE,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AACzC;AACA,SAAS,kBAAkB,CAAC,OAAO,EAAE;AACrC,EAAE,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACpD;AACA,SAAS,kBAAkB,CAAC,OAAO,EAAE,QAAQ,EAAE;AAC/C,EAAE,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AAChE,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,QAAQ,EAAE;AACxD,IAAI,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,iDAAiD,CAAC,CAAC;AACzE,EAAE;AACF;AACA,SAAS,kBAAkB,CAAC,GAAG,EAAE,QAAQ,EAAE;AAC3C,EAAE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,OAAO,QAAQ;AAChE,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,OAAO,QAAQ;AACrC,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,OAAO,QAAQ;AACxD,EAAE,OAAO,GAAG;AACZ;;;;"}

package/build/server/chunks/alert-description-CJHDA62x.js

@@ -0,0 +1,59 @@
+import { aj as attributes, ak as clsx, ar as bind_props } from './renderer-BFEBS3DQ.js';
+import { c as cn } from './utils3-AZ8FPfBW.js';
+import { tv } from 'tailwind-variants';
+
+const alertVariants = tv({
+  base: "relative grid w-full grid-cols-[0_1fr] items-start gap-y-0.5 rounded-lg border px-4 py-3 text-sm has-[>svg]:grid-cols-[calc(var(--spacing)*4)_1fr] has-[>svg]:gap-x-3 [&>svg]:size-4 [&>svg]:translate-y-0.5 [&>svg]:text-current",
+  variants: {
+    variant: {
+      default: "bg-card text-card-foreground",
+      destructive: "text-destructive bg-card *:data-[slot=alert-description]:text-destructive/90 [&>svg]:text-current"
+    }
+  },
+  defaultVariants: { variant: "default" }
+});
+function Alert($$renderer, $$props) {
+  $$renderer.component(($$renderer2) => {
+    let {
+      ref = null,
+      class: className,
+      variant = "default",
+      children,
+      $$slots,
+      $$events,
+      ...restProps
+    } = $$props;
+    $$renderer2.push(`<div${attributes({
+      "data-slot": "alert",
+      class: clsx(cn(alertVariants({ variant }), className)),
+      ...restProps,
+      role: "alert"
+    })}>`);
+    children?.($$renderer2);
+    $$renderer2.push(`<!----></div>`);
+    bind_props($$props, { ref });
+  });
+}
+function Alert_description($$renderer, $$props) {
+  $$renderer.component(($$renderer2) => {
+    let {
+      ref = null,
+      class: className,
+      children,
+      $$slots,
+      $$events,
+      ...restProps
+    } = $$props;
+    $$renderer2.push(`<div${attributes({
+      "data-slot": "alert-description",
+      class: clsx(cn("gap-1 text-sm [&_p]:leading-relaxed col-start-2 grid justify-items-start text-muted-foreground", className)),
+      ...restProps
+    })}>`);
+    children?.($$renderer2);
+    $$renderer2.push(`<!----></div>`);
+    bind_props($$props, { ref });
+  });
+}
+
+export { Alert as A, Alert_description as a };
+//# sourceMappingURL=alert-description-CJHDA62x.js.map

package/build/server/chunks/alert-description-CJHDA62x.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alert-description-CJHDA62x.js","sources":["../../../.svelte-kit/adapter-node/chunks/alert-description.js"],"sourcesContent":["import { af as attributes, a7 as clsx, ah as bind_props } from \"./renderer.js\";\nimport { c as cn } from \"./utils3.js\";\nimport { tv } from \"tailwind-variants\";\nconst alertVariants = tv({\n  base: \"relative grid w-full grid-cols-[0_1fr] items-start gap-y-0.5 rounded-lg border px-4 py-3 text-sm has-[>svg]:grid-cols-[calc(var(--spacing)*4)_1fr] has-[>svg]:gap-x-3 [&>svg]:size-4 [&>svg]:translate-y-0.5 [&>svg]:text-current\",\n  variants: {\n    variant: {\n      default: \"bg-card text-card-foreground\",\n      destructive: \"text-destructive bg-card *:data-[slot=alert-description]:text-destructive/90 [&>svg]:text-current\"\n    }\n  },\n  defaultVariants: { variant: \"default\" }\n});\nfunction Alert($$renderer, $$props) {\n  $$renderer.component(($$renderer2) => {\n    let {\n      ref = null,\n      class: className,\n      variant = \"default\",\n      children,\n      $$slots,\n      $$events,\n      ...restProps\n    } = $$props;\n    $$renderer2.push(`<div${attributes({\n      \"data-slot\": \"alert\",\n      class: clsx(cn(alertVariants({ variant }), className)),\n      ...restProps,\n      role: \"alert\"\n    })}>`);\n    children?.($$renderer2);\n    $$renderer2.push(`<!----></div>`);\n    bind_props($$props, { ref });\n  });\n}\nfunction Alert_description($$renderer, $$props) {\n  $$renderer.component(($$renderer2) => {\n    let {\n      ref = null,\n      class: className,\n      children,\n      $$slots,\n      $$events,\n      ...restProps\n    } = $$props;\n    $$renderer2.push(`<div${attributes({\n      \"data-slot\": \"alert-description\",\n      class: clsx(cn(\"gap-1 text-sm [&_p]:leading-relaxed col-start-2 grid justify-items-start text-muted-foreground\", className)),\n      ...restProps\n    })}>`);\n    children?.($$renderer2);\n    $$renderer2.push(`<!----></div>`);\n    bind_props($$props, { ref });\n  });\n}\nexport {\n  Alert as A,\n  Alert_description as a\n};\n"],"names":[],"mappings":";;;;AAGA,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,EAAE,IAAI,EAAE,mOAAmO;AAC3O,EAAE,QAAQ,EAAE;AACZ,IAAI,OAAO,EAAE;AACb,MAAM,OAAO,EAAE,8BAA8B;AAC7C,MAAM,WAAW,EAAE;AACnB;AACA,GAAG;AACH,EAAE,eAAe,EAAE,EAAE,OAAO,EAAE,SAAS;AACvC,CAAC,CAAC;AACF,SAAS,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE;AACpC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,WAAW,KAAK;AACxC,IAAI,IAAI;AACR,MAAM,GAAG,GAAG,IAAI;AAChB,MAAM,KAAK,EAAE,SAAS;AACtB,MAAM,OAAO,GAAG,SAAS;AACzB,MAAM,QAAQ;AACd,MAAM,OAAO;AACb,MAAM,QAAQ;AACd,MAAM,GAAG;AACT,KAAK,GAAG,OAAO;AACf,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC;AACvC,MAAM,WAAW,EAAE,OAAO;AAC1B,MAAM,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;AAC5D,MAAM,GAAG,SAAS;AAClB,MAAM,IAAI,EAAE;AACZ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACV,IAAI,QAAQ,GAAG,WAAW,CAAC;AAC3B,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC;AACrC,IAAI,UAAU,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC;AAChC,EAAE,CAAC,CAAC;AACJ;AACA,SAAS,iBAAiB,CAAC,UAAU,EAAE,OAAO,EAAE;AAChD,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,WAAW,KAAK;AACxC,IAAI,IAAI;AACR,MAAM,GAAG,GAAG,IAAI;AAChB,MAAM,KAAK,EAAE,SAAS;AACtB,MAAM,QAAQ;AACd,MAAM,OAAO;AACb,MAAM,QAAQ;AACd,MAAM,GAAG;AACT,KAAK,GAAG,OAAO;AACf,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC;AACvC,MAAM,WAAW,EAAE,mBAAmB;AACtC,MAAM,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,gGAAgG,EAAE,SAAS,CAAC,CAAC;AAClI,MAAM,GAAG;AACT,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACV,IAAI,QAAQ,GAAG,WAAW,CAAC;AAC3B,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC;AACrC,IAAI,UAAU,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC;AAChC,EAAE,CAAC,CAAC;AACJ;;;;"}