@selvajs/selva 4.20.0-beta.12 → 4.20.0-beta.13

package/build/server/chunks/chunks/SideNav.js-CIu2x_eb.js

@@ -1,194 +0,0 @@
-import { aq as attr_class, as as escape_html, an as ensure_array_like, ai as attr, ao as attributes, ah as derived, al as spread_props } from './server.js-Bn3s-cVB.js';
-import { I as Icon } from './utils2.js-BMDNJPPH.js';
-import { D as Dropdown_menu, a as Dropdown_menu_trigger, b as Dropdown_menu_content, c as Dropdown_menu_item } from './SettingsMenu.js-DbC1KIEF.js';
-import { C as Check } from './popper-layer-force-mount.js-B_6OYm07.js';
-import { p as page } from './state.js-BoE3eRiB.js';
-
-// ../../node_modules/.pnpm/@lucide+svelte@1.61.0_svelte@5.57.2_@typescript-eslint+types@8.72.0_/node_modules/@lucide/svelte/dist/icons/chevrons-up-down.svelte
-var __iconData = {
-	"name": "chevrons-up-down",
-	"size": 24,
-	"node": [["path", { "d": "m7 15 5 5 5-5" }], ["path", { "d": "m7 9 5-5 5 5" }]]
-};
-__iconData.node;
-function Chevrons_up_down($$renderer, $$props) {
-	let { $$slots, $$events, ...props } = $$props;
-	Icon($$renderer, spread_props([props, { icon: __iconData }]));
-}
-// ../ui/dist/components/layout/SideNav.svelte
-function SideNav($$renderer, $$props) {
-	$$renderer.component(($$renderer) => {
-		/**
-		* Off when the divider is drawn by the surrounding layout instead — a sticky sidenav
-		* only reaches as far as its own content, so its border would stop mid-page.
-		*/
-		let { items, eyebrow, header, footer, border = true, class: className = "" } = $$props;
-		function isActive(item) {
-			const path = page.url.pathname;
-			if (item.match === "prefix") return path.startsWith(item.href);
-			return path === item.href;
-		}
-		const activeItem = derived(() => items.find(isActive));
-		$$renderer.push(`<aside${attr_class(`sm:h-full sm:w-60 sm:overflow-y-auto sm:border-b-0 flex w-full shrink-0 flex-col border-b border-border bg-background ${border ? "sm:border-r" : ""} ${className}`)}>`);
-		if (eyebrow) $$renderer.push(`<!--[0--><div class="px-4 pt-5 pb-3 sm:block hidden"><span class="text-xs font-medium tracking-wider text-muted-foreground uppercase">${escape_html(eyebrow)}</span></div>`);
-		else $$renderer.push("<!--[-1-->");
-		$$renderer.push(`<!--]--> `);
-		if (header) {
-			$$renderer.push(`<!--[0--><div class="px-3 pb-3 sm:block hidden">`);
-			header($$renderer);
-			$$renderer.push(`<!----></div>`);
-		} else $$renderer.push("<!--[-1-->");
-		$$renderer.push(`<!--]--> <div class="py-2 sm:hidden px-(--page-px)">`);
-		if (Dropdown_menu) {
-			$$renderer.push("<!--[-->");
-			Dropdown_menu($$renderer, {
-				children: ($$renderer) => {
-					{
-						function child($$renderer, { props }) {
-							$$renderer.push(`<button${attributes({
-								...props,
-								class: "min-h-11 gap-3 px-3 text-sm font-medium flex w-full items-center rounded-md border border-border bg-card text-left"
-							})}>`);
-							if (activeItem()?.icon) {
-								$$renderer.push("<!--[0-->");
-								const Icon = activeItem().icon;
-								if (Icon) {
-									$$renderer.push("<!--[-->");
-									Icon($$renderer, { class: "size-4 shrink-0 opacity-70" });
-									$$renderer.push("<!--]-->");
-								} else {
-									$$renderer.push("<!--[!-->");
-									$$renderer.push("<!--]-->");
-								}
-							} else $$renderer.push("<!--[-1-->");
-							$$renderer.push(`<!--]--> <span class="min-w-0 flex-1 truncate">`);
-							if (eyebrow) $$renderer.push(`<!--[0--><span class="text-muted-foreground">${escape_html(eyebrow)} /</span>`);
-							else $$renderer.push("<!--[-1-->");
-							$$renderer.push(`<!--]--> ${escape_html(activeItem()?.label ?? "")}</span> `);
-							Chevrons_up_down($$renderer, { class: "size-4 shrink-0 opacity-60" });
-							$$renderer.push(`<!----></button>`);
-						}
-						if (Dropdown_menu_trigger) {
-							$$renderer.push("<!--[-->");
-							Dropdown_menu_trigger($$renderer, {
-								child,
-								$$slots: { child: true }
-							});
-							$$renderer.push("<!--]-->");
-						} else {
-							$$renderer.push("<!--[!-->");
-							$$renderer.push("<!--]-->");
-						}
-					}
-					$$renderer.push(` `);
-					if (Dropdown_menu_content) {
-						$$renderer.push("<!--[-->");
-						Dropdown_menu_content($$renderer, {
-							sideOffset: 4,
-							children: ($$renderer) => {
-								$$renderer.push(`<!--[-->`);
-								const each_array = ensure_array_like(items);
-								for (let $$index = 0, $$length = each_array.length; $$index < $$length; $$index++) {
-									let item = each_array[$$index];
-									const active = isActive(item);
-									const Icon = item.icon;
-									{
-										function child($$renderer, { props }) {
-											$$renderer.push(`<a${attributes({
-												href: item.href,
-												"aria-current": active ? "page" : void 0,
-												...props
-											})}>`);
-											if (Icon) {
-												$$renderer.push("<!--[0-->");
-												if (Icon) {
-													$$renderer.push("<!--[-->");
-													Icon($$renderer, { class: "size-4 opacity-70" });
-													$$renderer.push("<!--]-->");
-												} else {
-													$$renderer.push("<!--[!-->");
-													$$renderer.push("<!--]-->");
-												}
-											} else $$renderer.push("<!--[-1-->");
-											$$renderer.push(`<!--]--> <span class="flex-1">${escape_html(item.label)}</span> `);
-											if (item.badge !== void 0) $$renderer.push(`<!--[0--><span class="font-mono text-2xs tabular-nums opacity-60">${escape_html(item.badge)}</span>`);
-											else $$renderer.push("<!--[-1-->");
-											$$renderer.push(`<!--]--> `);
-											if (active) {
-												$$renderer.push("<!--[0-->");
-												Check($$renderer, {
-													class: "size-4",
-													"aria-hidden": "true"
-												});
-											} else $$renderer.push("<!--[-1-->");
-											$$renderer.push(`<!--]--></a>`);
-										}
-										if (Dropdown_menu_item) {
-											$$renderer.push("<!--[-->");
-											Dropdown_menu_item($$renderer, {
-												class: "min-h-11",
-												child,
-												$$slots: { child: true }
-											});
-											$$renderer.push("<!--]-->");
-										} else {
-											$$renderer.push("<!--[!-->");
-											$$renderer.push("<!--]-->");
-										}
-									}
-								}
-								$$renderer.push(`<!--]-->`);
-							},
-							$$slots: { default: true }
-						});
-						$$renderer.push("<!--]-->");
-					} else {
-						$$renderer.push("<!--[!-->");
-						$$renderer.push("<!--]-->");
-					}
-				},
-				$$slots: { default: true }
-			});
-			$$renderer.push("<!--]-->");
-		} else {
-			$$renderer.push("<!--[!-->");
-			$$renderer.push("<!--]-->");
-		}
-		$$renderer.push(`</div> <nav class="pb-4 pr-2 sm:block hidden flex-1 space-y-px"><!--[-->`);
-		const each_array_1 = ensure_array_like(items);
-		for (let $$index_1 = 0, $$length = each_array_1.length; $$index_1 < $$length; $$index_1++) {
-			let item = each_array_1[$$index_1];
-			const active = isActive(item);
-			const Icon = item.icon;
-			$$renderer.push(`<a${attr("href", item.href)}${attr("aria-current", active ? "page" : void 0)}${attr_class(`group gap-2 py-1.5 pr-2.5 relative flex w-full items-center text-left transition-colors ${active ? "pl-4 rounded-r-md bg-accent text-accent-foreground" : "mx-2 pl-2.5 rounded-md text-muted-foreground hover:bg-muted/60 hover:text-foreground"}`)}>`);
-			if (active) $$renderer.push(`<!--[0--><span class="left-0 top-0 bottom-0 w-0.75 absolute bg-primary" aria-hidden="true"></span>`);
-			else $$renderer.push("<!--[-1-->");
-			$$renderer.push(`<!--]--> `);
-			if (Icon) {
-				$$renderer.push("<!--[0-->");
-				if (Icon) {
-					$$renderer.push("<!--[-->");
-					Icon($$renderer, { class: "h-3.5 w-3.5 shrink-0 opacity-70" });
-					$$renderer.push("<!--]-->");
-				} else {
-					$$renderer.push("<!--[!-->");
-					$$renderer.push("<!--]-->");
-				}
-			} else $$renderer.push("<!--[-1-->");
-			$$renderer.push(`<!--]--> <span class="text-sm font-medium flex-1 truncate">${escape_html(item.label)}</span> `);
-			if (item.badge !== void 0) $$renderer.push(`<!--[0--><span class="font-mono shrink-0 text-2xs tabular-nums opacity-60">${escape_html(item.badge)}</span>`);
-			else $$renderer.push("<!--[-1-->");
-			$$renderer.push(`<!--]--></a>`);
-		}
-		$$renderer.push(`<!--]--></nav> `);
-		if (footer) {
-			$$renderer.push(`<!--[0--><div class="px-3 py-3 sm:block hidden border-t border-border/60">`);
-			footer($$renderer);
-			$$renderer.push(`<!----></div>`);
-		} else $$renderer.push("<!--[-1-->");
-		$$renderer.push(`<!--]--></aside>`);
-	});
-}
-
-export { SideNav as S };
-//# sourceMappingURL=SideNav.js-CIu2x_eb.js.map

package/build/server/chunks/chunks/SideNav.js-CIu2x_eb.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"SideNav.js-CIu2x_eb.js","sources":["../../../../.svelte-kit/output/server/chunks/SideNav.js"],"sourcesContent":["import { D as attr, a as derived, d as spread_props, k as escape_html, r as attributes, s as ensure_array_like, t as attr_class } from \"./server.js\";\nimport { n as Icon } from \"./utils2.js\";\nimport { f as Dropdown_menu_item, l as Dropdown_menu, p as Dropdown_menu_content, u as Dropdown_menu_trigger } from \"./SettingsMenu.js\";\nimport { o as Check } from \"./popper-layer-force-mount.js\";\nimport { t as page } from \"./state.js\";\n// ../../node_modules/.pnpm/@lucide+svelte@1.61.0_svelte@5.57.2_@typescript-eslint+types@8.72.0_/node_modules/@lucide/svelte/dist/icons/chevrons-up-down.svelte\nvar __iconData = {\n\t\"name\": \"chevrons-up-down\",\n\t\"size\": 24,\n\t\"node\": [[\"path\", { \"d\": \"m7 15 5 5 5-5\" }], [\"path\", { \"d\": \"m7 9 5-5 5 5\" }]]\n};\n__iconData.node;\nfunction Chevrons_up_down($$renderer, $$props) {\n\tlet { $$slots, $$events, ...props } = $$props;\n\tIcon($$renderer, spread_props([props, { icon: __iconData }]));\n}\n// ../ui/dist/components/layout/SideNav.svelte\nfunction SideNav($$renderer, $$props) {\n\t$$renderer.component(($$renderer) => {\n\t\t/**\n\t\t* Off when the divider is drawn by the surrounding layout instead — a sticky sidenav\n\t\t* only reaches as far as its own content, so its border would stop mid-page.\n\t\t*/\n\t\tlet { items, eyebrow, header, footer, border = true, class: className = \"\" } = $$props;\n\t\tfunction isActive(item) {\n\t\t\tconst path = page.url.pathname;\n\t\t\tif (item.match === \"prefix\") return path.startsWith(item.href);\n\t\t\treturn path === item.href;\n\t\t}\n\t\tconst activeItem = derived(() => items.find(isActive));\n\t\t$$renderer.push(`<aside${attr_class(`sm:h-full sm:w-60 sm:overflow-y-auto sm:border-b-0 flex w-full shrink-0 flex-col border-b border-border bg-background ${border ? \"sm:border-r\" : \"\"} ${className}`)}>`);\n\t\tif (eyebrow) $$renderer.push(`<!--[0--><div class=\"px-4 pt-5 pb-3 sm:block hidden\"><span class=\"text-xs font-medium tracking-wider text-muted-foreground uppercase\">${escape_html(eyebrow)}</span></div>`);\n\t\telse $$renderer.push(\"<!--[-1-->\");\n\t\t$$renderer.push(`<!--]--> `);\n\t\tif (header) {\n\t\t\t$$renderer.push(`<!--[0--><div class=\"px-3 pb-3 sm:block hidden\">`);\n\t\t\theader($$renderer);\n\t\t\t$$renderer.push(`<!----></div>`);\n\t\t} else $$renderer.push(\"<!--[-1-->\");\n\t\t$$renderer.push(`<!--]--> <div class=\"py-2 sm:hidden px-(--page-px)\">`);\n\t\tif (Dropdown_menu) {\n\t\t\t$$renderer.push(\"<!--[-->\");\n\t\t\tDropdown_menu($$renderer, {\n\t\t\t\tchildren: ($$renderer) => {\n\t\t\t\t\t{\n\t\t\t\t\t\tfunction child($$renderer, { props }) {\n\t\t\t\t\t\t\t$$renderer.push(`<button${attributes({\n\t\t\t\t\t\t\t\t...props,\n\t\t\t\t\t\t\t\tclass: \"min-h-11 gap-3 px-3 text-sm font-medium flex w-full items-center rounded-md border border-border bg-card text-left\"\n\t\t\t\t\t\t\t})}>`);\n\t\t\t\t\t\t\tif (activeItem()?.icon) {\n\t\t\t\t\t\t\t\t$$renderer.push(\"<!--[0-->\");\n\t\t\t\t\t\t\t\tconst Icon = activeItem().icon;\n\t\t\t\t\t\t\t\tif (Icon) {\n\t\t\t\t\t\t\t\t\t$$renderer.push(\"<!--[-->\");\n\t\t\t\t\t\t\t\t\tIcon($$renderer, { class: \"size-4 shrink-0 opacity-70\" });\n\t\t\t\t\t\t\t\t\t$$renderer.push(\"<!--]-->\");\n\t\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\t\t$$renderer.push(\"<!--[!-->\");\n\t\t\t\t\t\t\t\t\t$$renderer.push(\"<!--]-->\");\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t} else $$renderer.push(\"<!--[-1-->\");\n\t\t\t\t\t\t\t$$renderer.push(`<!--]--> <span class=\"min-w-0 flex-1 truncate\">`);\n\t\t\t\t\t\t\tif (eyebrow) $$renderer.push(`<!--[0--><span class=\"text-muted-foreground\">${escape_html(eyebrow)} /</span>`);\n\t\t\t\t\t\t\telse $$renderer.push(\"<!--[-1-->\");\n\t\t\t\t\t\t\t$$renderer.push(`<!--]--> ${escape_html(activeItem()?.label ?? \"\")}</span> `);\n\t\t\t\t\t\t\tChevrons_up_down($$renderer, { class: \"size-4 shrink-0 opacity-60\" });\n\t\t\t\t\t\t\t$$renderer.push(`<!----></button>`);\n\t\t\t\t\t\t}\n\t\t\t\t\t\tif (Dropdown_menu_trigger) {\n\t\t\t\t\t\t\t$$renderer.push(\"<!--[-->\");\n\t\t\t\t\t\t\tDropdown_menu_trigger($$renderer, {\n\t\t\t\t\t\t\t\tchild,\n\t\t\t\t\t\t\t\t$$slots: { child: true }\n\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\t$$renderer.push(\"<!--]-->\");\n\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t$$renderer.push(\"<!--[!-->\");\n\t\t\t\t\t\t\t$$renderer.push(\"<!--]-->\");\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\t$$renderer.push(` `);\n\t\t\t\t\tif (Dropdown_menu_content) {\n\t\t\t\t\t\t$$renderer.push(\"<!--[-->\");\n\t\t\t\t\t\tDropdown_menu_content($$renderer, {\n\t\t\t\t\t\t\tsideOffset: 4,\n\t\t\t\t\t\t\tchildren: ($$renderer) => {\n\t\t\t\t\t\t\t\t$$renderer.push(`<!--[-->`);\n\t\t\t\t\t\t\t\tconst each_array = ensure_array_like(items);\n\t\t\t\t\t\t\t\tfor (let $$index = 0, $$length = each_array.length; $$index < $$length; $$index++) {\n\t\t\t\t\t\t\t\t\tlet item = each_array[$$index];\n\t\t\t\t\t\t\t\t\tconst active = isActive(item);\n\t\t\t\t\t\t\t\t\tconst Icon = item.icon;\n\t\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t\tfunction child($$renderer, { props }) {\n\t\t\t\t\t\t\t\t\t\t\t$$renderer.push(`<a${attributes({\n\t\t\t\t\t\t\t\t\t\t\t\thref: item.href,\n\t\t\t\t\t\t\t\t\t\t\t\t\"aria-current\": active ? \"page\" : void 0,\n\t\t\t\t\t\t\t\t\t\t\t\t...props\n\t\t\t\t\t\t\t\t\t\t\t})}>`);\n\t\t\t\t\t\t\t\t\t\t\tif (Icon) {\n\t\t\t\t\t\t\t\t\t\t\t\t$$renderer.push(\"<!--[0-->\");\n\t\t\t\t\t\t\t\t\t\t\t\tif (Icon) {\n\t\t\t\t\t\t\t\t\t\t\t\t\t$$renderer.push(\"<!--[-->\");\n\t\t\t\t\t\t\t\t\t\t\t\t\tIcon($$renderer, { class: \"size-4 opacity-70\" });\n\t\t\t\t\t\t\t\t\t\t\t\t\t$$renderer.push(\"<!--]-->\");\n\t\t\t\t\t\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\t\t\t\t\t\t$$renderer.push(\"<!--[!-->\");\n\t\t\t\t\t\t\t\t\t\t\t\t\t$$renderer.push(\"<!--]-->\");\n\t\t\t\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\t\t\t} else $$renderer.push(\"<!--[-1-->\");\n\t\t\t\t\t\t\t\t\t\t\t$$renderer.push(`<!--]--> <span class=\"flex-1\">${escape_html(item.label)}</span> `);\n\t\t\t\t\t\t\t\t\t\t\tif (item.badge !== void 0) $$renderer.push(`<!--[0--><span class=\"font-mono text-2xs tabular-nums opacity-60\">${escape_html(item.badge)}</span>`);\n\t\t\t\t\t\t\t\t\t\t\telse $$renderer.push(\"<!--[-1-->\");\n\t\t\t\t\t\t\t\t\t\t\t$$renderer.push(`<!--]--> `);\n\t\t\t\t\t\t\t\t\t\t\tif (active) {\n\t\t\t\t\t\t\t\t\t\t\t\t$$renderer.push(\"<!--[0-->\");\n\t\t\t\t\t\t\t\t\t\t\t\tCheck($$renderer, {\n\t\t\t\t\t\t\t\t\t\t\t\t\tclass: \"size-4\",\n\t\t\t\t\t\t\t\t\t\t\t\t\t\"aria-hidden\": \"true\"\n\t\t\t\t\t\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\t\t\t\t\t} else $$renderer.push(\"<!--[-1-->\");\n\t\t\t\t\t\t\t\t\t\t\t$$renderer.push(`<!--]--></a>`);\n\t\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\t\tif (Dropdown_menu_item) {\n\t\t\t\t\t\t\t\t\t\t\t$$renderer.push(\"<!--[-->\");\n\t\t\t\t\t\t\t\t\t\t\tDropdown_menu_item($$renderer, {\n\t\t\t\t\t\t\t\t\t\t\t\tclass: \"min-h-11\",\n\t\t\t\t\t\t\t\t\t\t\t\tchild,\n\t\t\t\t\t\t\t\t\t\t\t\t$$slots: { child: true }\n\t\t\t\t\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\t\t\t\t\t$$renderer.push(\"<!--]-->\");\n\t\t\t\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\t\t\t\t$$renderer.push(\"<!--[!-->\");\n\t\t\t\t\t\t\t\t\t\t\t$$renderer.push(\"<!--]-->\");\n\t\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t$$renderer.push(`<!--]-->`);\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t$$slots: { default: true }\n\t\t\t\t\t\t});\n\t\t\t\t\t\t$$renderer.push(\"<!--]-->\");\n\t\t\t\t\t} else {\n\t\t\t\t\t\t$$renderer.push(\"<!--[!-->\");\n\t\t\t\t\t\t$$renderer.push(\"<!--]-->\");\n\t\t\t\t\t}\n\t\t\t\t},\n\t\t\t\t$$slots: { default: true }\n\t\t\t});\n\t\t\t$$renderer.push(\"<!--]-->\");\n\t\t} else {\n\t\t\t$$renderer.push(\"<!--[!-->\");\n\t\t\t$$renderer.push(\"<!--]-->\");\n\t\t}\n\t\t$$renderer.push(`</div> <nav class=\"pb-4 pr-2 sm:block hidden flex-1 space-y-px\"><!--[-->`);\n\t\tconst each_array_1 = ensure_array_like(items);\n\t\tfor (let $$index_1 = 0, $$length = each_array_1.length; $$index_1 < $$length; $$index_1++) {\n\t\t\tlet item = each_array_1[$$index_1];\n\t\t\tconst active = isActive(item);\n\t\t\tconst Icon = item.icon;\n\t\t\t$$renderer.push(`<a${attr(\"href\", item.href)}${attr(\"aria-current\", active ? \"page\" : void 0)}${attr_class(`group gap-2 py-1.5 pr-2.5 relative flex w-full items-center text-left transition-colors ${active ? \"pl-4 rounded-r-md bg-accent text-accent-foreground\" : \"mx-2 pl-2.5 rounded-md text-muted-foreground hover:bg-muted/60 hover:text-foreground\"}`)}>`);\n\t\t\tif (active) $$renderer.push(`<!--[0--><span class=\"left-0 top-0 bottom-0 w-0.75 absolute bg-primary\" aria-hidden=\"true\"></span>`);\n\t\t\telse $$renderer.push(\"<!--[-1-->\");\n\t\t\t$$renderer.push(`<!--]--> `);\n\t\t\tif (Icon) {\n\t\t\t\t$$renderer.push(\"<!--[0-->\");\n\t\t\t\tif (Icon) {\n\t\t\t\t\t$$renderer.push(\"<!--[-->\");\n\t\t\t\t\tIcon($$renderer, { class: \"h-3.5 w-3.5 shrink-0 opacity-70\" });\n\t\t\t\t\t$$renderer.push(\"<!--]-->\");\n\t\t\t\t} else {\n\t\t\t\t\t$$renderer.push(\"<!--[!-->\");\n\t\t\t\t\t$$renderer.push(\"<!--]-->\");\n\t\t\t\t}\n\t\t\t} else $$renderer.push(\"<!--[-1-->\");\n\t\t\t$$renderer.push(`<!--]--> <span class=\"text-sm font-medium flex-1 truncate\">${escape_html(item.label)}</span> `);\n\t\t\tif (item.badge !== void 0) $$renderer.push(`<!--[0--><span class=\"font-mono shrink-0 text-2xs tabular-nums opacity-60\">${escape_html(item.badge)}</span>`);\n\t\t\telse $$renderer.push(\"<!--[-1-->\");\n\t\t\t$$renderer.push(`<!--]--></a>`);\n\t\t}\n\t\t$$renderer.push(`<!--]--></nav> `);\n\t\tif (footer) {\n\t\t\t$$renderer.push(`<!--[0--><div class=\"px-3 py-3 sm:block hidden border-t border-border/60\">`);\n\t\t\tfooter($$renderer);\n\t\t\t$$renderer.push(`<!----></div>`);\n\t\t} else $$renderer.push(\"<!--[-1-->\");\n\t\t$$renderer.push(`<!--]--></aside>`);\n\t});\n}\nexport { SideNav as t };\n"],"names":[],"mappings":";;;;;;AAKA;AACA,IAAI,UAAU,GAAG;AACjB,CAAC,MAAM,EAAE,kBAAkB;AAC3B,CAAC,MAAM,EAAE,EAAE;AACX,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;AAC/E,CAAC;AACD,UAAU,CAAC,IAAI;AACf,SAAS,gBAAgB,CAAC,UAAU,EAAE,OAAO,EAAE;AAC/C,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO;AAC9C,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;AAC9D;AACA;AACA,SAAS,OAAO,CAAC,UAAU,EAAE,OAAO,EAAE;AACtC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,UAAU,KAAK;AACtC;AACA;AACA;AACA;AACA,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,GAAG,EAAE,EAAE,GAAG,OAAO;AACxF,EAAE,SAAS,QAAQ,CAAC,IAAI,EAAE;AAC1B,GAAG,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ;AACjC,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;AACjE,GAAG,OAAO,IAAI,KAAK,IAAI,CAAC,IAAI;AAC5B,EAAE;AACF,EAAE,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACxD,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,sHAAsH,EAAE,MAAM,GAAG,aAAa,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9M,EAAE,IAAI,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,sIAAsI,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC;AAC5M,OAAO,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;AACpC,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC;AAC9B,EAAE,IAAI,MAAM,EAAE;AACd,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,gDAAgD,CAAC,CAAC;AACtE,GAAG,MAAM,CAAC,UAAU,CAAC;AACrB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC;AACnC,EAAE,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;AACtC,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,oDAAoD,CAAC,CAAC;AACzE,EAAE,IAAI,aAAa,EAAE;AACrB,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AAC9B,GAAG,aAAa,CAAC,UAAU,EAAE;AAC7B,IAAI,QAAQ,EAAE,CAAC,UAAU,KAAK;AAC9B,KAAK;AACL,MAAM,SAAS,KAAK,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE;AAC5C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC;AAC5C,QAAQ,GAAG,KAAK;AAChB,QAAQ,KAAK,EAAE;AACf,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACb,OAAO,IAAI,UAAU,EAAE,EAAE,IAAI,EAAE;AAC/B,QAAQ,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;AACpC,QAAQ,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC,IAAI;AACtC,QAAQ,IAAI,IAAI,EAAE;AAClB,SAAS,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AACpC,SAAS,IAAI,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;AAClE,SAAS,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AACpC,QAAQ,CAAC,MAAM;AACf,SAAS,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;AACrC,SAAS,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AACpC,QAAQ;AACR,OAAO,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;AAC3C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,+CAA+C,CAAC,CAAC;AACzE,OAAO,IAAI,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,6CAA6C,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC;AACpH,YAAY,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;AACzC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,UAAU,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;AACpF,OAAO,gBAAgB,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;AAC5E,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,CAAC;AAC1C,MAAM;AACN,MAAM,IAAI,qBAAqB,EAAE;AACjC,OAAO,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AAClC,OAAO,qBAAqB,CAAC,UAAU,EAAE;AACzC,QAAQ,KAAK;AACb,QAAQ,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI;AAC9B,QAAQ,CAAC;AACT,OAAO,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AAClC,MAAM,CAAC,MAAM;AACb,OAAO,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;AACnC,OAAO,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AAClC,MAAM;AACN,KAAK;AACL,KAAK,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACzB,KAAK,IAAI,qBAAqB,EAAE;AAChC,MAAM,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AACjC,MAAM,qBAAqB,CAAC,UAAU,EAAE;AACxC,OAAO,UAAU,EAAE,CAAC;AACpB,OAAO,QAAQ,EAAE,CAAC,UAAU,KAAK;AACjC,QAAQ,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;AACnC,QAAQ,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC;AACnD,QAAQ,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC,MAAM,EAAE,OAAO,GAAG,QAAQ,EAAE,OAAO,EAAE,EAAE;AAC3F,SAAS,IAAI,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC;AACvC,SAAS,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC;AACtC,SAAS,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI;AAC/B,SAAS;AACT,UAAU,SAAS,KAAK,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE;AAChD,WAAW,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,UAAU,CAAC;AAC3C,YAAY,IAAI,EAAE,IAAI,CAAC,IAAI;AAC3B,YAAY,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM;AACpD,YAAY,GAAG;AACf,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;AACjB,WAAW,IAAI,IAAI,EAAE;AACrB,YAAY,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;AACxC,YAAY,IAAI,IAAI,EAAE;AACtB,aAAa,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AACxC,aAAa,IAAI,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;AAC7D,aAAa,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AACxC,YAAY,CAAC,MAAM;AACnB,aAAa,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;AACzC,aAAa,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AACxC,YAAY;AACZ,WAAW,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;AAC/C,WAAW,UAAU,CAAC,IAAI,CAAC,CAAC,8BAA8B,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC;AAC9F,WAAW,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,kEAAkE,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC;AAC5J,gBAAgB,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;AAC7C,WAAW,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC;AACvC,WAAW,IAAI,MAAM,EAAE;AACvB,YAAY,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;AACxC,YAAY,KAAK,CAAC,UAAU,EAAE;AAC9B,aAAa,KAAK,EAAE,QAAQ;AAC5B,aAAa,aAAa,EAAE;AAC5B,aAAa,CAAC;AACd,WAAW,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;AAC/C,WAAW,UAAU,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC;AAC1C,UAAU;AACV,UAAU,IAAI,kBAAkB,EAAE;AAClC,WAAW,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AACtC,WAAW,kBAAkB,CAAC,UAAU,EAAE;AAC1C,YAAY,KAAK,EAAE,UAAU;AAC7B,YAAY,KAAK;AACjB,YAAY,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI;AAClC,YAAY,CAAC;AACb,WAAW,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AACtC,UAAU,CAAC,MAAM;AACjB,WAAW,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;AACvC,WAAW,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AACtC,UAAU;AACV,SAAS;AACT,QAAQ;AACR,QAAQ,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;AACnC,OAAO,CAAC;AACR,OAAO,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI;AAC/B,OAAO,CAAC;AACR,MAAM,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AACjC,KAAK,CAAC,MAAM;AACZ,MAAM,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;AAClC,MAAM,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AACjC,KAAK;AACL,IAAI,CAAC;AACL,IAAI,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI;AAC5B,IAAI,CAAC;AACL,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AAC9B,EAAE,CAAC,MAAM;AACT,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;AAC/B,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AAC9B,EAAE;AACF,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,wEAAwE,CAAC,CAAC;AAC7F,EAAE,MAAM,YAAY,GAAG,iBAAiB,CAAC,KAAK,CAAC;AAC/C,EAAE,KAAK,IAAI,SAAS,GAAG,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,SAAS,GAAG,QAAQ,EAAE,SAAS,EAAE,EAAE;AAC7F,GAAG,IAAI,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC;AACrC,GAAG,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC;AAChC,GAAG,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI;AACzB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,wFAAwF,EAAE,MAAM,GAAG,oDAAoD,GAAG,sFAAsF,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtW,GAAG,IAAI,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,kGAAkG,CAAC,CAAC;AACpI,QAAQ,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;AACrC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC;AAC/B,GAAG,IAAI,IAAI,EAAE;AACb,IAAI,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;AAChC,IAAI,IAAI,IAAI,EAAE;AACd,KAAK,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AAChC,KAAK,IAAI,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;AACnE,KAAK,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AAChC,IAAI,CAAC,MAAM;AACX,KAAK,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;AACjC,KAAK,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;AAChC,IAAI;AACJ,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;AACvC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,2DAA2D,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC;AACnH,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,2EAA2E,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC;AAC7J,QAAQ,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;AACrC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC;AAClC,EAAE;AACF,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,CAAC;AACpC,EAAE,IAAI,MAAM,EAAE;AACd,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,0EAA0E,CAAC,CAAC;AAChG,GAAG,MAAM,CAAC,UAAU,CAAC;AACrB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC;AACnC,EAAE,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;AACtC,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,CAAC;AACrC,CAAC,CAAC,CAAC;AACH;;;;"}

package/build/server/chunks/chunks/admin-auth.server.js-CUudS1QN.js

@@ -1,324 +0,0 @@
-import { b as private_env } from './shared-server.js-CJsQadj4.js';
-import { S as SYSTEM_CONTEXT, n as narrowApiTokenContext } from './src.js-BQFsdJf3.js';
-import { A as ApiErrorCode } from './access.js-DbWaEG7Y.js';
-import { c as createComputeRateLimiter } from './rate-limit.js-Br3luBbc.js';
-import { l as looksLikeApiToken } from './api-token-codec.js--hQdn1xG.js';
-import { c as canHoldApiTokens } from './tokens.js-Btk3HBnU.js';
-import { b as buildRequestContext } from './request-context.js-BlxaBgml.js';
-import { error } from '@sveltejs/kit';
-
-// ../server/src/http/csrf.ts
-/**
-* SvelteKit's form-submission CSRF check, with the two exemptions it can't
-* express. A host turns the framework's own check off and calls this first.
-*
-* - A Selva API key in `Authorization`: a cross-site form can't set the header,
-*   and a `selva_` bearer never falls back to the cookie. API-token uploads are
-*   multipart with no `Origin`, which the framework check refuses. Any other
-*   `Authorization` (a proxy's id token) still gets checked: the request may run
-*   as the cookie session.
-* - `exemptPaths`: endpoints that take a form body from servers, which send no
-*   `Origin` (the OAuth token endpoint, per RFC 6749).
-*/
-var UNSAFE_METHODS = /* @__PURE__ */ new Set([
-	"POST",
-	"PUT",
-	"PATCH",
-	"DELETE"
-]);
-var FORM_TYPES = [
-	"application/x-www-form-urlencoded",
-	"multipart/form-data",
-	"text/plain",
-	"application/x-sveltekit-formdata"
-];
-function isCrossSiteFormSubmission(request, options = {}) {
-	if (!UNSAFE_METHODS.has(request.method)) return false;
-	const type = (request.headers.get("content-type") ?? "").split(";")[0].trim().toLowerCase();
-	if (!FORM_TYPES.includes(type)) return false;
-	if ((/^Bearer\s+(\S+)/i.exec(request.headers.get("authorization") ?? "")?.[1])?.startsWith("selva_")) return false;
-	const url = new URL(request.url);
-	if (options.exemptPaths?.includes(url.pathname)) return false;
-	return request.headers.get("origin") !== url.origin;
-}
-// ../server/src/http/body-size.ts
-/**
-* True when the request's declared `Content-Length` exceeds `maxBytes`. Call it
-* BEFORE reading the body, so a huge payload aimed at a small-body endpoint
-* can't burn memory; the route maps `true` to its transport's 413.
-*
-* This is the per-route lower bound. A global limit (e.g. adapter-node's
-* `BODY_SIZE_LIMIT`) has to clear the largest legitimate upload, so every small
-* JSON endpoint would otherwise inherit that ceiling.
-*
-* Requests without `Content-Length` (chunked encoding) slip past this check —
-* the global limit is the backstop there.
-*/
-function declaredBodySizeExceeds(headers, maxBytes) {
-	const declared = Number(headers.get("content-length"));
-	return Number.isFinite(declared) && declared > maxBytes;
-}
-// ../server/src/http/login-rate-limit.ts
-/**
-* Login rate limiting: two buckets per attempt, because neither dimension
-* covers the other.
-*
-*   - **Per-address** bounds one client hammering the form. It is only
-*     meaningful when the host resolves a real client address. Behind a reverse
-*     proxy that is not configured to forward one, every request reports the
-*     socket peer — `127.0.0.1` for all of them — which collapses the whole key
-*     space into a single bucket: five failed logins from anywhere lock out the
-*     entire instance, and only a success clears it, which nobody can now
-*     reach. That failure is completely silent, hence
-*     {@link addressKeysCollapsed}.
-*   - **Per-account** bounds a targeted guessing attack, which address limiting
-*     does not: an attacker spread across many source IPs contends with no
-*     shared counter at all, leaving password-hash cost as the only real bound
-*     on online guessing.
-*
-* An attempt must clear both and a failure charges both. A success clears the
-* account bucket and the calling address's — a *different* address that failed
-* against the same account keeps its own penalty.
-*
-* The flow counts failures rather than attempts: `check` gates without spending
-* budget, `recordFailure` spends, and `clear` forgives. A successful login
-* therefore costs nothing, so an ordinary user typing one wrong password never
-* walks toward a lockout.
-*/
-/** Loopback in the three spellings a Node server actually reports. */
-var LOOPBACK = /* @__PURE__ */ new Set([
-	"127.0.0.1",
-	"::1",
-	"::ffff:127.0.0.1"
-]);
-/** Normalized so case tricks (`Alice@` vs `alice@`) share one bucket. */
-function accountKey(email) {
-	return `account:${email.trim().toLowerCase()}`;
-}
-function createLoginRateLimiter(config = {}) {
-	const windowMs = config.windowMs ?? 9e5;
-	const byAddress = createComputeRateLimiter({
-		windowMs,
-		maxPerWindow: config.maxPerAddress ?? 5
-	});
-	const byAccount = createComputeRateLimiter({
-		windowMs,
-		maxPerWindow: config.maxPerAccount ?? 20
-	});
-	return {
-		check(address, email) {
-			const address_ = byAddress.peek(address);
-			if (!address_.allowed || !email) return address_;
-			return byAccount.peek(accountKey(email));
-		},
-		recordFailure(address, email) {
-			byAddress.check(address);
-			if (email) byAccount.check(accountKey(email));
-		},
-		clear(address, email) {
-			byAddress.clear(address);
-			if (email) byAccount.clear(accountKey(email));
-		},
-		reset() {
-			byAddress.reset();
-			byAccount.reset();
-		}
-	};
-}
-/**
-* Whether per-address limiting has degenerated into one shared bucket.
-*
-* True when the host reports a loopback address for a request it did not
-* originate — which means it sits behind a proxy and is reading the socket peer
-* instead of a forwarded client address. The host decides what to do about it;
-* warning once at startup is enough, and warning per request is not.
-*
-* `addressHeaderConfigured` is the host's answer to "am I reading a forwarded
-* header at all", since which header and how many hops to trust are deployment
-* config that no package can resolve for it.
-*/
-function addressKeysCollapsed(address, addressHeaderConfigured) {
-	if (addressHeaderConfigured) return false;
-	return LOOPBACK.has(address);
-}
-// ../server/src/http/api-token.ts
-/** `lastUsedAt` is written at most this often per token, so a busy key isn't a write per request. */
-var LAST_USED_WRITE_INTERVAL_MS = 3e5;
-var UNAUTHORIZED = {
-	kind: "rejected",
-	status: 401,
-	code: ApiErrorCode.UNAUTHORIZED,
-	message: "This API token is invalid, expired or revoked."
-};
-var UNAVAILABLE = {
-	kind: "rejected",
-	status: 503,
-	code: ApiErrorCode.API_TOKENS_UNAVAILABLE,
-	message: "API tokens are not available on this server."
-};
-var HOLDER_REFUSED = {
-	kind: "rejected",
-	status: 403,
-	code: ApiErrorCode.API_TOKEN_HOLDER_REFUSED,
-	message: "This API token’s owner may no longer use API tokens in this org."
-};
-/**
-* Authenticate a request by its `Authorization: Bearer selva_…` header.
-*
-* Call it before any cookie or proxy sign-in. Once a `selva_` key is sent the
-* outcome is final: a bad key gets 401 even if a valid session cookie rides
-* along, because running the request as the cookie's user would hide the
-* broken key and act as someone else.
-*
-* The owner is re-checked on every request (disabled, still a member of the
-* token's org, still allowed to hold keys), then their live context is
-* narrowed to the token's scopes.
-*/
-async function resolveApiToken(request, deps, { pathPrefix = "/api/v1/" } = {}) {
-	const url = new URL(request.url);
-	for (const value of url.searchParams.values()) if (looksLikeApiToken(value)) return {
-		kind: "rejected",
-		status: 400,
-		code: ApiErrorCode.VALIDATION_FAILED,
-		message: "API tokens go in the Authorization header, never the URL. URLs end up in logs and browser history; revoke this key."
-	};
-	const raw = bearerOf(request);
-	if (!raw?.startsWith("selva_")) return { kind: "none" };
-	if (!url.pathname.startsWith(pathPrefix)) return {
-		kind: "rejected",
-		status: 403,
-		code: ApiErrorCode.FORBIDDEN,
-		message: `API tokens only work under ${pathPrefix}.`
-	};
-	const store = deps.data.apiTokens;
-	if (!deps.codec || !store) return UNAVAILABLE;
-	const delegated = deps.auth.delegatedSession;
-	if (delegated && !(await delegated.status()).ok) return UNAVAILABLE;
-	if (!deps.codec.hasValidChecksum(raw)) return UNAUTHORIZED;
-	const token = await store.getByTokenHash(SYSTEM_CONTEXT, deps.codec.hashToken(raw));
-	if (!token) return UNAUTHORIZED;
-	const [user, member, platformPermissions] = await Promise.all([
-		deps.auth.getUser(token.userId),
-		deps.data.orgs.getOrgMember(SYSTEM_CONTEXT, token.orgId, token.userId),
-		deps.data.permissions.getFor(SYSTEM_CONTEXT, token.userId)
-	]);
-	if (!user || user.disabled || !member) return UNAUTHORIZED;
-	const live = await buildRequestContext({
-		user,
-		platformPermissions,
-		membership: member,
-		pinOrg: true
-	}, { orgs: deps.data.orgs });
-	if (!await canHoldApiTokens(live, token.scopes, {
-		policy: deps.mayHoldApiTokens,
-		deps: {
-			orgs: deps.data.orgs,
-			projects: deps.data.projects,
-			platformProjectGrants: deps.data.platformProjectGrants,
-			definitionMeta: deps.data.definitions,
-			flag: deps.flag ?? (() => false)
-		}
-	})) return HOLDER_REFUSED;
-	let ctx = narrowApiTokenContext(live, token);
-	if (delegated) {
-		const sessionToken = await delegated.mint(user.id, { orgId: token.orgId });
-		ctx = {
-			...ctx,
-			adapterContext: { sessionToken }
-		};
-	}
-	const now = deps.now?.() ?? Date.now();
-	if (!token.lastUsedAt || now - Date.parse(token.lastUsedAt) >= LAST_USED_WRITE_INTERVAL_MS) store.touchLastUsed(SYSTEM_CONTEXT, token.id, new Date(now).toISOString()).catch((err) => {
-		deps.log?.warn("Failed to record API token use", {
-			component: "apiToken",
-			tokenId: token.id,
-			err: err instanceof Error ? err.message : String(err)
-		});
-	});
-	return {
-		kind: "ok",
-		user,
-		ctx,
-		token
-	};
-}
-function bearerOf(request) {
-	const header = request.headers.get("authorization");
-	if (!header) return null;
-	const match = /^Bearer\s+(\S+)\s*$/i.exec(header);
-	return match ? match[1] : null;
-}
-// src/lib/server/admin-auth.server.ts
-var SESSION_COOKIE_NAME = "admin_session";
-var SESSION_MAX_AGE_MS = 288e5;
-var REFRESH_COOKIE_NAME = "admin_refresh";
-var REFRESH_MAX_AGE_MS = 2592e6;
-var loginRateLimiter = createLoginRateLimiter();
-function checkRateLimit(ip, email) {
-	return loginRateLimiter.check(ip, email);
-}
-function recordFailedAttempt(ip, email) {
-	loginRateLimiter.recordFailure(ip, email);
-}
-function clearRateLimit(ip, email) {
-	loginRateLimiter.clear(ip, email);
-}
-var addressWarningIssued = false;
-function warnIfAddressKeysCollapse(ip, log) {
-	if (addressWarningIssued) return;
-	if (!private_env.ORIGIN) return;
-	if (!addressKeysCollapsed(ip, Boolean(private_env.ADDRESS_HEADER))) return;
-	addressWarningIssued = true;
-	log.warn("Login rate limiting is keyed to the loopback address for every request. The app is behind a proxy but ADDRESS_HEADER is unset, so getClientAddress() returns the socket peer and all clients share one bucket — five failed logins lock out the whole instance. Set ADDRESS_HEADER=X-Forwarded-For and XFF_DEPTH to your proxy count (see .env.example).", { component: "auth/rate-limit" });
-}
-function setSessionCookie(cookies, sessionToken) {
-	const isSecure = process.env.NODE_ENV === "production" && private_env.ALLOW_INSECURE_COOKIES !== "true";
-	cookies.set(SESSION_COOKIE_NAME, sessionToken, {
-		path: "/",
-		httpOnly: true,
-		sameSite: "lax",
-		secure: isSecure,
-		maxAge: SESSION_MAX_AGE_MS / 1e3
-	});
-}
-/** Call before `destroySession` — logout needs the token to revoke it provider-side. */
-function getSessionToken(cookies) {
-	return cookies.get(SESSION_COOKIE_NAME);
-}
-function destroySession(cookies) {
-	cookies.delete(SESSION_COOKIE_NAME, { path: "/" });
-	cookies.delete(REFRESH_COOKIE_NAME, { path: "/" });
-}
-/**
-* Refresh-token cookie for the OAuth/Supabase flow — `hooks.server.ts`'s
-* session-refresh middleware swaps an expired access token for a fresh one
-* using this. Local/HMAC sessions don't need it.
-*/
-function setRefreshCookie(cookies, refreshToken) {
-	const isSecure = process.env.NODE_ENV === "production" && private_env.ALLOW_INSECURE_COOKIES !== "true";
-	cookies.set(REFRESH_COOKIE_NAME, refreshToken, {
-		path: "/",
-		httpOnly: true,
-		sameSite: "lax",
-		secure: isSecure,
-		maxAge: REFRESH_MAX_AGE_MS / 1e3
-	});
-}
-function getRefreshToken(cookies) {
-	return cookies.get(REFRESH_COOKIE_NAME);
-}
-function clearRefreshCookie(cookies) {
-	cookies.delete(REFRESH_COOKIE_NAME, { path: "/" });
-}
-/**
-* Rejects a request whose declared `Content-Length` exceeds `maxBytes` — a
-* per-route lower bound under the global adapter-node `BODY_SIZE_LIMIT`
-* (which must stay high enough for 50MB .gh uploads). Throws 413 before the
-* body is read; see `declaredBodySizeExceeds` for the chunked-encoding caveat.
-*/
-function requireMaxBodySize(request, maxBytes) {
-	if (declaredBodySizeExceeds(request.headers, maxBytes)) throw error(413, `Request body exceeds the limit for this endpoint.`);
-}
-
-export { setRefreshCookie as a, checkRateLimit as b, clearRefreshCookie as c, recordFailedAttempt as d, clearRateLimit as e, getSessionToken as f, getRefreshToken as g, destroySession as h, isCrossSiteFormSubmission as i, requireMaxBodySize as j, resolveApiToken as r, setSessionCookie as s, warnIfAddressKeysCollapse as w };
-//# sourceMappingURL=admin-auth.server.js-CUudS1QN.js.map

package/build/server/chunks/chunks/admin-auth.server.js-CUudS1QN.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"admin-auth.server.js-CUudS1QN.js","sources":["../../../../.svelte-kit/output/server/chunks/admin-auth.server.js"],"sourcesContent":["import { t as private_env } from \"./shared-server.js\";\nimport { t as SYSTEM_CONTEXT, y as narrowApiTokenContext } from \"./src.js\";\nimport { O as ApiErrorCode } from \"./access.js\";\nimport { t as createComputeRateLimiter } from \"./rate-limit.js\";\nimport { r as looksLikeApiToken } from \"./api-token-codec.js\";\nimport { t as canHoldApiTokens } from \"./tokens.js\";\nimport { t as buildRequestContext } from \"./request-context.js\";\nimport { error } from \"@sveltejs/kit\";\n// ../server/src/http/csrf.ts\n/**\n* SvelteKit's form-submission CSRF check, with the two exemptions it can't\n* express. A host turns the framework's own check off and calls this first.\n*\n* - A Selva API key in `Authorization`: a cross-site form can't set the header,\n*   and a `selva_` bearer never falls back to the cookie. API-token uploads are\n*   multipart with no `Origin`, which the framework check refuses. Any other\n*   `Authorization` (a proxy's id token) still gets checked: the request may run\n*   as the cookie session.\n* - `exemptPaths`: endpoints that take a form body from servers, which send no\n*   `Origin` (the OAuth token endpoint, per RFC 6749).\n*/\nvar UNSAFE_METHODS = /* @__PURE__ */ new Set([\n\t\"POST\",\n\t\"PUT\",\n\t\"PATCH\",\n\t\"DELETE\"\n]);\nvar FORM_TYPES = [\n\t\"application/x-www-form-urlencoded\",\n\t\"multipart/form-data\",\n\t\"text/plain\",\n\t\"application/x-sveltekit-formdata\"\n];\nfunction isCrossSiteFormSubmission(request, options = {}) {\n\tif (!UNSAFE_METHODS.has(request.method)) return false;\n\tconst type = (request.headers.get(\"content-type\") ?? \"\").split(\";\")[0].trim().toLowerCase();\n\tif (!FORM_TYPES.includes(type)) return false;\n\tif ((/^Bearer\\s+(\\S+)/i.exec(request.headers.get(\"authorization\") ?? \"\")?.[1])?.startsWith(\"selva_\")) return false;\n\tconst url = new URL(request.url);\n\tif (options.exemptPaths?.includes(url.pathname)) return false;\n\treturn request.headers.get(\"origin\") !== url.origin;\n}\n// ../server/src/http/body-size.ts\n/**\n* True when the request's declared `Content-Length` exceeds `maxBytes`. Call it\n* BEFORE reading the body, so a huge payload aimed at a small-body endpoint\n* can't burn memory; the route maps `true` to its transport's 413.\n*\n* This is the per-route lower bound. A global limit (e.g. adapter-node's\n* `BODY_SIZE_LIMIT`) has to clear the largest legitimate upload, so every small\n* JSON endpoint would otherwise inherit that ceiling.\n*\n* Requests without `Content-Length` (chunked encoding) slip past this check —\n* the global limit is the backstop there.\n*/\nfunction declaredBodySizeExceeds(headers, maxBytes) {\n\tconst declared = Number(headers.get(\"content-length\"));\n\treturn Number.isFinite(declared) && declared > maxBytes;\n}\n// ../server/src/http/login-rate-limit.ts\n/**\n* Login rate limiting: two buckets per attempt, because neither dimension\n* covers the other.\n*\n*   - **Per-address** bounds one client hammering the form. It is only\n*     meaningful when the host resolves a real client address. Behind a reverse\n*     proxy that is not configured to forward one, every request reports the\n*     socket peer — `127.0.0.1` for all of them — which collapses the whole key\n*     space into a single bucket: five failed logins from anywhere lock out the\n*     entire instance, and only a success clears it, which nobody can now\n*     reach. That failure is completely silent, hence\n*     {@link addressKeysCollapsed}.\n*   - **Per-account** bounds a targeted guessing attack, which address limiting\n*     does not: an attacker spread across many source IPs contends with no\n*     shared counter at all, leaving password-hash cost as the only real bound\n*     on online guessing.\n*\n* An attempt must clear both and a failure charges both. A success clears the\n* account bucket and the calling address's — a *different* address that failed\n* against the same account keeps its own penalty.\n*\n* The flow counts failures rather than attempts: `check` gates without spending\n* budget, `recordFailure` spends, and `clear` forgives. A successful login\n* therefore costs nothing, so an ordinary user typing one wrong password never\n* walks toward a lockout.\n*/\n/** Loopback in the three spellings a Node server actually reports. */\nvar LOOPBACK = /* @__PURE__ */ new Set([\n\t\"127.0.0.1\",\n\t\"::1\",\n\t\"::ffff:127.0.0.1\"\n]);\n/** Normalized so case tricks (`Alice@` vs `alice@`) share one bucket. */\nfunction accountKey(email) {\n\treturn `account:${email.trim().toLowerCase()}`;\n}\nfunction createLoginRateLimiter(config = {}) {\n\tconst windowMs = config.windowMs ?? 9e5;\n\tconst byAddress = createComputeRateLimiter({\n\t\twindowMs,\n\t\tmaxPerWindow: config.maxPerAddress ?? 5\n\t});\n\tconst byAccount = createComputeRateLimiter({\n\t\twindowMs,\n\t\tmaxPerWindow: config.maxPerAccount ?? 20\n\t});\n\treturn {\n\t\tcheck(address, email) {\n\t\t\tconst address_ = byAddress.peek(address);\n\t\t\tif (!address_.allowed || !email) return address_;\n\t\t\treturn byAccount.peek(accountKey(email));\n\t\t},\n\t\trecordFailure(address, email) {\n\t\t\tbyAddress.check(address);\n\t\t\tif (email) byAccount.check(accountKey(email));\n\t\t},\n\t\tclear(address, email) {\n\t\t\tbyAddress.clear(address);\n\t\t\tif (email) byAccount.clear(accountKey(email));\n\t\t},\n\t\treset() {\n\t\t\tbyAddress.reset();\n\t\t\tbyAccount.reset();\n\t\t}\n\t};\n}\n/**\n* Whether per-address limiting has degenerated into one shared bucket.\n*\n* True when the host reports a loopback address for a request it did not\n* originate — which means it sits behind a proxy and is reading the socket peer\n* instead of a forwarded client address. The host decides what to do about it;\n* warning once at startup is enough, and warning per request is not.\n*\n* `addressHeaderConfigured` is the host's answer to \"am I reading a forwarded\n* header at all\", since which header and how many hops to trust are deployment\n* config that no package can resolve for it.\n*/\nfunction addressKeysCollapsed(address, addressHeaderConfigured) {\n\tif (addressHeaderConfigured) return false;\n\treturn LOOPBACK.has(address);\n}\n// ../server/src/http/api-token.ts\n/** `lastUsedAt` is written at most this often per token, so a busy key isn't a write per request. */\nvar LAST_USED_WRITE_INTERVAL_MS = 3e5;\nvar UNAUTHORIZED = {\n\tkind: \"rejected\",\n\tstatus: 401,\n\tcode: ApiErrorCode.UNAUTHORIZED,\n\tmessage: \"This API token is invalid, expired or revoked.\"\n};\nvar UNAVAILABLE = {\n\tkind: \"rejected\",\n\tstatus: 503,\n\tcode: ApiErrorCode.API_TOKENS_UNAVAILABLE,\n\tmessage: \"API tokens are not available on this server.\"\n};\nvar HOLDER_REFUSED = {\n\tkind: \"rejected\",\n\tstatus: 403,\n\tcode: ApiErrorCode.API_TOKEN_HOLDER_REFUSED,\n\tmessage: \"This API token’s owner may no longer use API tokens in this org.\"\n};\n/**\n* Authenticate a request by its `Authorization: Bearer selva_…` header.\n*\n* Call it before any cookie or proxy sign-in. Once a `selva_` key is sent the\n* outcome is final: a bad key gets 401 even if a valid session cookie rides\n* along, because running the request as the cookie's user would hide the\n* broken key and act as someone else.\n*\n* The owner is re-checked on every request (disabled, still a member of the\n* token's org, still allowed to hold keys), then their live context is\n* narrowed to the token's scopes.\n*/\nasync function resolveApiToken(request, deps, { pathPrefix = \"/api/v1/\" } = {}) {\n\tconst url = new URL(request.url);\n\tfor (const value of url.searchParams.values()) if (looksLikeApiToken(value)) return {\n\t\tkind: \"rejected\",\n\t\tstatus: 400,\n\t\tcode: ApiErrorCode.VALIDATION_FAILED,\n\t\tmessage: \"API tokens go in the Authorization header, never the URL. URLs end up in logs and browser history; revoke this key.\"\n\t};\n\tconst raw = bearerOf(request);\n\tif (!raw?.startsWith(\"selva_\")) return { kind: \"none\" };\n\tif (!url.pathname.startsWith(pathPrefix)) return {\n\t\tkind: \"rejected\",\n\t\tstatus: 403,\n\t\tcode: ApiErrorCode.FORBIDDEN,\n\t\tmessage: `API tokens only work under ${pathPrefix}.`\n\t};\n\tconst store = deps.data.apiTokens;\n\tif (!deps.codec || !store) return UNAVAILABLE;\n\tconst delegated = deps.auth.delegatedSession;\n\tif (delegated && !(await delegated.status()).ok) return UNAVAILABLE;\n\tif (!deps.codec.hasValidChecksum(raw)) return UNAUTHORIZED;\n\tconst token = await store.getByTokenHash(SYSTEM_CONTEXT, deps.codec.hashToken(raw));\n\tif (!token) return UNAUTHORIZED;\n\tconst [user, member, platformPermissions] = await Promise.all([\n\t\tdeps.auth.getUser(token.userId),\n\t\tdeps.data.orgs.getOrgMember(SYSTEM_CONTEXT, token.orgId, token.userId),\n\t\tdeps.data.permissions.getFor(SYSTEM_CONTEXT, token.userId)\n\t]);\n\tif (!user || user.disabled || !member) return UNAUTHORIZED;\n\tconst live = await buildRequestContext({\n\t\tuser,\n\t\tplatformPermissions,\n\t\tmembership: member,\n\t\tpinOrg: true\n\t}, { orgs: deps.data.orgs });\n\tif (!await canHoldApiTokens(live, token.scopes, {\n\t\tpolicy: deps.mayHoldApiTokens,\n\t\tdeps: {\n\t\t\torgs: deps.data.orgs,\n\t\t\tprojects: deps.data.projects,\n\t\t\tplatformProjectGrants: deps.data.platformProjectGrants,\n\t\t\tdefinitionMeta: deps.data.definitions,\n\t\t\tflag: deps.flag ?? (() => false)\n\t\t}\n\t})) return HOLDER_REFUSED;\n\tlet ctx = narrowApiTokenContext(live, token);\n\tif (delegated) {\n\t\tconst sessionToken = await delegated.mint(user.id, { orgId: token.orgId });\n\t\tctx = {\n\t\t\t...ctx,\n\t\t\tadapterContext: { sessionToken }\n\t\t};\n\t}\n\tconst now = deps.now?.() ?? Date.now();\n\tif (!token.lastUsedAt || now - Date.parse(token.lastUsedAt) >= LAST_USED_WRITE_INTERVAL_MS) store.touchLastUsed(SYSTEM_CONTEXT, token.id, new Date(now).toISOString()).catch((err) => {\n\t\tdeps.log?.warn(\"Failed to record API token use\", {\n\t\t\tcomponent: \"apiToken\",\n\t\t\ttokenId: token.id,\n\t\t\terr: err instanceof Error ? err.message : String(err)\n\t\t});\n\t});\n\treturn {\n\t\tkind: \"ok\",\n\t\tuser,\n\t\tctx,\n\t\ttoken\n\t};\n}\nfunction bearerOf(request) {\n\tconst header = request.headers.get(\"authorization\");\n\tif (!header) return null;\n\tconst match = /^Bearer\\s+(\\S+)\\s*$/i.exec(header);\n\treturn match ? match[1] : null;\n}\n// src/lib/server/admin-auth.server.ts\nvar SESSION_COOKIE_NAME = \"admin_session\";\nvar SESSION_MAX_AGE_MS = 288e5;\nvar REFRESH_COOKIE_NAME = \"admin_refresh\";\nvar REFRESH_MAX_AGE_MS = 2592e6;\nvar loginRateLimiter = createLoginRateLimiter();\nfunction checkRateLimit(ip, email) {\n\treturn loginRateLimiter.check(ip, email);\n}\nfunction recordFailedAttempt(ip, email) {\n\tloginRateLimiter.recordFailure(ip, email);\n}\nfunction clearRateLimit(ip, email) {\n\tloginRateLimiter.clear(ip, email);\n}\nvar addressWarningIssued = false;\nfunction warnIfAddressKeysCollapse(ip, log) {\n\tif (addressWarningIssued) return;\n\tif (!private_env.ORIGIN) return;\n\tif (!addressKeysCollapsed(ip, Boolean(private_env.ADDRESS_HEADER))) return;\n\taddressWarningIssued = true;\n\tlog.warn(\"Login rate limiting is keyed to the loopback address for every request. The app is behind a proxy but ADDRESS_HEADER is unset, so getClientAddress() returns the socket peer and all clients share one bucket — five failed logins lock out the whole instance. Set ADDRESS_HEADER=X-Forwarded-For and XFF_DEPTH to your proxy count (see .env.example).\", { component: \"auth/rate-limit\" });\n}\nfunction setSessionCookie(cookies, sessionToken) {\n\tconst isSecure = process.env.NODE_ENV === \"production\" && private_env.ALLOW_INSECURE_COOKIES !== \"true\";\n\tcookies.set(SESSION_COOKIE_NAME, sessionToken, {\n\t\tpath: \"/\",\n\t\thttpOnly: true,\n\t\tsameSite: \"lax\",\n\t\tsecure: isSecure,\n\t\tmaxAge: SESSION_MAX_AGE_MS / 1e3\n\t});\n}\n/** Call before `destroySession` — logout needs the token to revoke it provider-side. */\nfunction getSessionToken(cookies) {\n\treturn cookies.get(SESSION_COOKIE_NAME);\n}\nfunction destroySession(cookies) {\n\tcookies.delete(SESSION_COOKIE_NAME, { path: \"/\" });\n\tcookies.delete(REFRESH_COOKIE_NAME, { path: \"/\" });\n}\n/**\n* Refresh-token cookie for the OAuth/Supabase flow — `hooks.server.ts`'s\n* session-refresh middleware swaps an expired access token for a fresh one\n* using this. Local/HMAC sessions don't need it.\n*/\nfunction setRefreshCookie(cookies, refreshToken) {\n\tconst isSecure = process.env.NODE_ENV === \"production\" && private_env.ALLOW_INSECURE_COOKIES !== \"true\";\n\tcookies.set(REFRESH_COOKIE_NAME, refreshToken, {\n\t\tpath: \"/\",\n\t\thttpOnly: true,\n\t\tsameSite: \"lax\",\n\t\tsecure: isSecure,\n\t\tmaxAge: REFRESH_MAX_AGE_MS / 1e3\n\t});\n}\nfunction getRefreshToken(cookies) {\n\treturn cookies.get(REFRESH_COOKIE_NAME);\n}\nfunction clearRefreshCookie(cookies) {\n\tcookies.delete(REFRESH_COOKIE_NAME, { path: \"/\" });\n}\n/**\n* Rejects a request whose declared `Content-Length` exceeds `maxBytes` — a\n* per-route lower bound under the global adapter-node `BODY_SIZE_LIMIT`\n* (which must stay high enough for 50MB .gh uploads). Throws 413 before the\n* body is read; see `declaredBodySizeExceeds` for the chunked-encoding caveat.\n*/\nfunction requireMaxBodySize(request, maxBytes) {\n\tif (declaredBodySizeExceeds(request.headers, maxBytes)) throw error(413, `Request body exceeds the limit for this endpoint.`);\n}\nexport { getRefreshToken as a, requireMaxBodySize as c, warnIfAddressKeysCollapse as d, resolveApiToken as f, destroySession as i, setRefreshCookie as l, clearRateLimit as n, getSessionToken as o, isCrossSiteFormSubmission as p, clearRefreshCookie as r, recordFailedAttempt as s, checkRateLimit as t, setSessionCookie as u };\n"],"names":[],"mappings":";;;;;;;;;AAQA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,cAAc,mBAAmB,IAAI,GAAG,CAAC;AAC7C,CAAC,MAAM;AACP,CAAC,KAAK;AACN,CAAC,OAAO;AACR,CAAC;AACD,CAAC,CAAC;AACF,IAAI,UAAU,GAAG;AACjB,CAAC,mCAAmC;AACpC,CAAC,qBAAqB;AACtB,CAAC,YAAY;AACb,CAAC;AACD,CAAC;AACD,SAAS,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,EAAE,EAAE;AAC1D,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,KAAK;AACtD,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;AAC5F,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,KAAK;AAC7C,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,EAAE,OAAO,KAAK;AACnH,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;AACjC,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,KAAK;AAC9D,CAAC,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,MAAM;AACpD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,uBAAuB,CAAC,OAAO,EAAE,QAAQ,EAAE;AACpD,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AACvD,CAAC,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,QAAQ;AACxD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,QAAQ,mBAAmB,IAAI,GAAG,CAAC;AACvC,CAAC,WAAW;AACZ,CAAC,KAAK;AACN,CAAC;AACD,CAAC,CAAC;AACF;AACA,SAAS,UAAU,CAAC,KAAK,EAAE;AAC3B,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AAC/C;AACA,SAAS,sBAAsB,CAAC,MAAM,GAAG,EAAE,EAAE;AAC7C,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,GAAG;AACxC,CAAC,MAAM,SAAS,GAAG,wBAAwB,CAAC;AAC5C,EAAE,QAAQ;AACV,EAAE,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI;AACxC,EAAE,CAAC;AACH,CAAC,MAAM,SAAS,GAAG,wBAAwB,CAAC;AAC5C,EAAE,QAAQ;AACV,EAAE,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI;AACxC,EAAE,CAAC;AACH,CAAC,OAAO;AACR,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE;AACxB,GAAG,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;AAC3C,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,OAAO,QAAQ;AACnD,GAAG,OAAO,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;AAC3C,EAAE,CAAC;AACH,EAAE,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE;AAChC,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;AAC3B,GAAG,IAAI,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;AAChD,EAAE,CAAC;AACH,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE;AACxB,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;AAC3B,GAAG,IAAI,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;AAChD,EAAE,CAAC;AACH,EAAE,KAAK,GAAG;AACV,GAAG,SAAS,CAAC,KAAK,EAAE;AACpB,GAAG,SAAS,CAAC,KAAK,EAAE;AACpB,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,oBAAoB,CAAC,OAAO,EAAE,uBAAuB,EAAE;AAChE,CAAC,IAAI,uBAAuB,EAAE,OAAO,KAAK;AAC1C,CAAC,OAAO,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;AAC7B;AACA;AACA;AACA,IAAI,2BAA2B,GAAG,GAAG;AACrC,IAAI,YAAY,GAAG;AACnB,CAAC,IAAI,EAAE,UAAU;AACjB,CAAC,MAAM,EAAE,GAAG;AACZ,CAAC,IAAI,EAAE,YAAY,CAAC,YAAY;AAChC,CAAC,OAAO,EAAE;AACV,CAAC;AACD,IAAI,WAAW,GAAG;AAClB,CAAC,IAAI,EAAE,UAAU;AACjB,CAAC,MAAM,EAAE,GAAG;AACZ,CAAC,IAAI,EAAE,YAAY,CAAC,sBAAsB;AAC1C,CAAC,OAAO,EAAE;AACV,CAAC;AACD,IAAI,cAAc,GAAG;AACrB,CAAC,IAAI,EAAE,UAAU;AACjB,CAAC,MAAM,EAAE,GAAG;AACZ,CAAC,IAAI,EAAE,YAAY,CAAC,wBAAwB;AAC5C,CAAC,OAAO,EAAE;AACV,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,UAAU,GAAG,UAAU,EAAE,GAAG,EAAE,EAAE;AAChF,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;AACjC,CAAC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,OAAO;AACrF,EAAE,IAAI,EAAE,UAAU;AAClB,EAAE,MAAM,EAAE,GAAG;AACb,EAAE,IAAI,EAAE,YAAY,CAAC,iBAAiB;AACtC,EAAE,OAAO,EAAE;AACX,EAAE;AACF,CAAC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC;AAC9B,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE;AACxD,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,OAAO;AAClD,EAAE,IAAI,EAAE,UAAU;AAClB,EAAE,MAAM,EAAE,GAAG;AACb,EAAE,IAAI,EAAE,YAAY,CAAC,SAAS;AAC9B,EAAE,OAAO,EAAE,CAAC,2BAA2B,EAAE,UAAU,CAAC,CAAC;AACrD,EAAE;AACF,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS;AAClC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,OAAO,WAAW;AAC9C,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB;AAC7C,CAAC,IAAI,SAAS,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,WAAW;AACpE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,YAAY;AAC3D,CAAC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;AACpF,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,YAAY;AAChC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,mBAAmB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AAC/D,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;AACjC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC;AACxE,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM;AAC3D,EAAE,CAAC;AACH,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,OAAO,YAAY;AAC3D,CAAC,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC;AACxC,EAAE,IAAI;AACN,EAAE,mBAAmB;AACrB,EAAE,UAAU,EAAE,MAAM;AACpB,EAAE,MAAM,EAAE;AACV,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;AAC7B,CAAC,IAAI,CAAC,MAAM,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE;AACjD,EAAE,MAAM,EAAE,IAAI,CAAC,gBAAgB;AAC/B,EAAE,IAAI,EAAE;AACR,GAAG,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;AACvB,GAAG,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;AAC/B,GAAG,qBAAqB,EAAE,IAAI,CAAC,IAAI,CAAC,qBAAqB;AACzD,GAAG,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;AACxC,GAAG,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,MAAM,KAAK;AAClC;AACA,EAAE,CAAC,EAAE,OAAO,cAAc;AAC1B,CAAC,IAAI,GAAG,GAAG,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC;AAC7C,CAAC,IAAI,SAAS,EAAE;AAChB,EAAE,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;AAC5E,EAAE,GAAG,GAAG;AACR,GAAG,GAAG,GAAG;AACT,GAAG,cAAc,EAAE,EAAE,YAAY;AACjC,GAAG;AACH,CAAC;AACD,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE;AACvC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,2BAA2B,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK;AACvL,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,gCAAgC,EAAE;AACnD,GAAG,SAAS,EAAE,UAAU;AACxB,GAAG,OAAO,EAAE,KAAK,CAAC,EAAE;AACpB,GAAG,GAAG,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG;AACvD,GAAG,CAAC;AACJ,CAAC,CAAC,CAAC;AACH,CAAC,OAAO;AACR,EAAE,IAAI,EAAE,IAAI;AACZ,EAAE,IAAI;AACN,EAAE,GAAG;AACL,EAAE;AACF,EAAE;AACF;AACA,SAAS,QAAQ,CAAC,OAAO,EAAE;AAC3B,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;AACpD,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI;AACzB,CAAC,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC;AAClD,CAAC,OAAO,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI;AAC/B;AACA;AACA,IAAI,mBAAmB,GAAG,eAAe;AACzC,IAAI,kBAAkB,GAAG,KAAK;AAC9B,IAAI,mBAAmB,GAAG,eAAe;AACzC,IAAI,kBAAkB,GAAG,MAAM;AAC/B,IAAI,gBAAgB,GAAG,sBAAsB,EAAE;AAC/C,SAAS,cAAc,CAAC,EAAE,EAAE,KAAK,EAAE;AACnC,CAAC,OAAO,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC;AACzC;AACA,SAAS,mBAAmB,CAAC,EAAE,EAAE,KAAK,EAAE;AACxC,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,KAAK,CAAC;AAC1C;AACA,SAAS,cAAc,CAAC,EAAE,EAAE,KAAK,EAAE;AACnC,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC;AAClC;AACA,IAAI,oBAAoB,GAAG,KAAK;AAChC,SAAS,yBAAyB,CAAC,EAAE,EAAE,GAAG,EAAE;AAC5C,CAAC,IAAI,oBAAoB,EAAE;AAC3B,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE;AAC1B,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAAE,EAAE,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,EAAE;AACrE,CAAC,oBAAoB,GAAG,IAAI;AAC5B,CAAC,GAAG,CAAC,IAAI,CAAC,0VAA0V,EAAE,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;AACvY;AACA,SAAS,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE;AACjD,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,WAAW,CAAC,sBAAsB,KAAK,MAAM;AACxG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,YAAY,EAAE;AAChD,EAAE,IAAI,EAAE,GAAG;AACX,EAAE,QAAQ,EAAE,IAAI;AAChB,EAAE,QAAQ,EAAE,KAAK;AACjB,EAAE,MAAM,EAAE,QAAQ;AAClB,EAAE,MAAM,EAAE,kBAAkB,GAAG;AAC/B,EAAE,CAAC;AACH;AACA;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AACxC;AACA,SAAS,cAAc,CAAC,OAAO,EAAE;AACjC,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACnD,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACnD;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE;AACjD,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,WAAW,CAAC,sBAAsB,KAAK,MAAM;AACxG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,YAAY,EAAE;AAChD,EAAE,IAAI,EAAE,GAAG;AACX,EAAE,QAAQ,EAAE,IAAI;AAChB,EAAE,QAAQ,EAAE,KAAK;AACjB,EAAE,MAAM,EAAE,QAAQ;AAClB,EAAE,MAAM,EAAE,kBAAkB,GAAG;AAC/B,EAAE,CAAC;AACH;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AACxC;AACA,SAAS,kBAAkB,CAAC,OAAO,EAAE;AACrC,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACnD;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,kBAAkB,CAAC,OAAO,EAAE,QAAQ,EAAE;AAC/C,CAAC,IAAI,uBAAuB,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,iDAAiD,CAAC,CAAC;AAC9H;;;;"}