@selvajs/selva 4.6.20 → 4.6.21-beta.1

package/build/server/chunks/chunks/access.server.js-DmuVt13u.js

@@ -0,0 +1,434 @@
+import { error, redirect } from '@sveltejs/kit';
+import { h as hasPermission, A as ALL_PLATFORM_PERMISSIONS } from './context.js-D8E0GFTw.js';
+import { m as getDefinitionMeta, e as getProjectProvider, d as getOrganizationProvider, i as flag, n as getPlatformProjectGrantStore } from './providers.server.js-BKhwGvoh.js';
+import { h as handleApiError } from './api-errors.js-CwTBBHWD.js';
+import 'zod';
+import './shared-server.js-DaWdgxVh.js';
+import 'node:url';
+import 'node:path';
+import 'node:fs';
+import 'node:crypto';
+import 'node:fs/promises';
+import '@supabase/supabase-js';
+import '@selvajs/compute/core';
+import './schema.js-j3D3emog.js';
+import './utils4.js-C-poIiFQ.js';
+
+function isInstanceAdmin(platformPermissions) {
+  return platformPermissions.includes("instance_admin");
+}
+function withAdminBypass(platformPermissions, rule) {
+  if (isInstanceAdmin(platformPermissions)) return true;
+  return rule();
+}
+function canView(input) {
+  const {
+    project,
+    member,
+    orgMember,
+    allowCrossOrgPublic,
+    enablePlatformProjects,
+    platformPermissions,
+    platformGrants,
+    actingOrgId,
+    userId
+  } = input;
+  if (!project) return false;
+  if (project.visibility === "platform") {
+    if (!enablePlatformProjects) return false;
+    if (isInstanceAdmin(platformPermissions)) return true;
+    return platformGrants.some(
+      (g) => g.granteeType === "user" && g.granteeId === userId || g.granteeType === "org" && g.granteeId === actingOrgId
+    );
+  }
+  if (project.visibility === "private") return member !== null;
+  if (project.visibility === "org") return orgMember !== null;
+  if (project.visibility === "public") return allowCrossOrgPublic ? true : orgMember !== null;
+  return false;
+}
+function canSolve(input) {
+  const {
+    project,
+    enablePlatformProjects,
+    platformPermissions,
+    platformGrants,
+    actingOrgId,
+    userId
+  } = input;
+  if (!project) return false;
+  if (project.visibility === "platform") {
+    if (!enablePlatformProjects) return false;
+    if (isInstanceAdmin(platformPermissions)) return true;
+    return platformGrants.some(
+      (g) => g.canSolve && (g.granteeType === "user" && g.granteeId === userId || g.granteeType === "org" && g.granteeId === actingOrgId)
+    );
+  }
+  return canView(input);
+}
+function canEdit(input) {
+  const { member, project, enablePlatformProjects, platformPermissions } = input;
+  if (project?.visibility === "platform") {
+    if (!enablePlatformProjects) return false;
+    return isInstanceAdmin(platformPermissions);
+  }
+  return member?.role === "owner" || member?.role === "editor";
+}
+function canManage(input) {
+  if (input.project?.visibility === "platform") {
+    if (!input.enablePlatformProjects) return false;
+    return isInstanceAdmin(input.platformPermissions);
+  }
+  return input.member?.role === "owner";
+}
+function canEditProjectSettings(input) {
+  if (input.project?.visibility === "platform") {
+    if (!input.enablePlatformProjects) return false;
+    return isInstanceAdmin(input.platformPermissions);
+  }
+  return input.member?.role === "owner";
+}
+function canChangeVisibilityToPublic(input) {
+  const role = input.orgMember?.role;
+  return role === "owner" || role === "admin";
+}
+function canEditDefinition(input) {
+  const { project, definition, member, userId, platformPermissions, enablePlatformProjects } = input;
+  if (!project || !definition) return false;
+  if (project.visibility === "platform") {
+    if (!enablePlatformProjects) return false;
+    return isInstanceAdmin(platformPermissions);
+  }
+  if (member?.role === "owner" || member?.role === "editor") return true;
+  if (project.autoJoinOnUpload && userId === definition.ownerId) return true;
+  return false;
+}
+function canReclaim(input) {
+  const { project, orgMember, actingOrgId } = input;
+  if (!project || !actingOrgId) return false;
+  if (project.visibility === "platform") return false;
+  if (actingOrgId !== project.orgId) return false;
+  const role = orgMember?.role;
+  return role === "owner" || role === "admin";
+}
+function canCreateProject(input) {
+  const { orgMember, orgPermissions, actingOrgId, targetOrgId } = input;
+  if (actingOrgId !== targetOrgId) return false;
+  const role = orgMember?.role;
+  if (role === "owner" || role === "admin") return true;
+  if (role === "member" && orgPermissions.includes("manage_projects")) return true;
+  return false;
+}
+function checkOwnerRemoval(input) {
+  if (input.target.role !== "owner") return "ok";
+  const ownerCount = input.allMembers.filter((m) => m.role === "owner").length;
+  if (ownerCount <= 1) return "sole_owner";
+  if (!input.confirmed) return "needs_confirm";
+  return "ok";
+}
+function createProjectAccessInputBuilder(deps) {
+  return {
+    async buildProjectAccessInput(ctx, project, overrides = {}) {
+      const { allowCrossOrgPublic, enablePlatformProjects } = deps.flags();
+      let member = null;
+      let orgMember = null;
+      let platformGrants = [];
+      if (project.visibility === "platform") {
+        if (enablePlatformProjects) {
+          platformGrants = await deps.listPlatformGrants(ctx, project.id);
+        }
+      } else if (project.visibility === "private") {
+        member = await deps.getProjectMember(ctx, project.id, ctx.userId);
+      } else {
+        const skipOrgMember = project.visibility === "public" && allowCrossOrgPublic;
+        [member, orgMember] = await Promise.all([
+          deps.getProjectMember(ctx, project.id, ctx.userId),
+          skipOrgMember ? Promise.resolve(null) : deps.getOrgMember(ctx, project.orgId, ctx.userId)
+        ]);
+      }
+      return {
+        orgPermissions: ctx.orgPermissions,
+        platformPermissions: ctx.platformPermissions,
+        project,
+        member,
+        orgMember,
+        allowCrossOrgPublic,
+        enablePlatformProjects,
+        platformGrants,
+        actingOrgId: ctx.actingOrgId ?? null,
+        userId: ctx.userId,
+        ...overrides
+      };
+    },
+    projectAccessInputFromRows(ctx, project, rows) {
+      const { allowCrossOrgPublic, enablePlatformProjects } = deps.flags();
+      return {
+        orgPermissions: ctx.orgPermissions,
+        platformPermissions: ctx.platformPermissions,
+        project,
+        member: rows.member ?? null,
+        orgMember: rows.orgMember ?? null,
+        allowCrossOrgPublic,
+        enablePlatformProjects,
+        platformGrants: rows.platformGrants ?? [],
+        actingOrgId: ctx.actingOrgId ?? null,
+        userId: ctx.userId
+      };
+    }
+  };
+}
+const throwProviderError = handleApiError;
+function requireAuthed(locals) {
+  const { user, ctx } = locals;
+  if (!user || !ctx) throw error(401, "Unauthorized");
+  return { user, ctx };
+}
+function requirePermission(locals, permission) {
+  const { user, ctx } = requireAuthed(locals);
+  if (!hasPermission(ctx, permission)) {
+    throw error(403, `You don't have permission to do this.`);
+  }
+  return user;
+}
+function assertPagePermission(locals, permission) {
+  const { user, ctx } = requireAuthed(locals);
+  if (!hasPermission(ctx, permission)) {
+    redirect(303, "/admin");
+  }
+  return user;
+}
+const requireManageInstanceUsers = (locals) => requirePermission(locals, "manage_instance_users");
+const requireManageCompute = (locals) => requirePermission(locals, "manage_compute");
+const requireManageOrgMembers = (locals) => requirePermission(locals, "manage_org_members");
+const requireManageOrgCompute = (locals) => requirePermission(locals, "manage_org_compute");
+const requireManageDefinitions = (locals) => requirePermission(locals, "manage_definitions");
+const requireManageProjects = (locals) => requirePermission(locals, "manage_projects");
+const assertManageInstanceUsers = (locals) => assertPagePermission(locals, "manage_instance_users");
+const assertManageCompute = (locals) => assertPagePermission(locals, "manage_compute");
+const assertManageDefinitions = (locals) => assertPagePermission(locals, "manage_definitions");
+const assertManageProjects = (locals) => assertPagePermission(locals, "manage_projects");
+const requireInstanceAdmin = (locals) => requirePermission(locals, "instance_admin");
+function requireAnyPlatformPermission(locals) {
+  const { user, ctx } = requireAuthed(locals);
+  const allowed = ALL_PLATFORM_PERMISSIONS.some((p) => hasPermission(ctx, p));
+  if (!allowed) throw error(403, `You don't have permission to do this.`);
+  return user;
+}
+function assertAnyPlatformPermission(locals) {
+  const { user, ctx } = requireAuthed(locals);
+  const allowed = ALL_PLATFORM_PERMISSIONS.some((p) => hasPermission(ctx, p));
+  if (!allowed) redirect(303, "/library");
+  return user;
+}
+async function managementBypassOrRun(ctx, check) {
+  if (hasPermission(ctx, "instance_admin")) return true;
+  return await check();
+}
+async function contentCheck(check) {
+  return await check();
+}
+async function loadProjectOr404(ctx, projectId) {
+  const project = await getProjectProvider().getProject(ctx, projectId);
+  if (!project) throw error(404, "Project not found");
+  return project;
+}
+const accessInputs = createProjectAccessInputBuilder({
+  getProjectMember: (ctx, projectId, userId) => getProjectProvider().getProjectMember(ctx, projectId, userId),
+  getOrgMember: (ctx, orgId, userId) => getOrganizationProvider().getOrgMember(ctx, orgId, userId),
+  listPlatformGrants: (ctx, projectId) => getPlatformProjectGrantStore().listByProject(ctx, projectId),
+  flags: () => ({
+    allowCrossOrgPublic: flag("ALLOW_CROSS_ORG_PUBLIC"),
+    enablePlatformProjects: flag("ENABLE_PLATFORM_PROJECTS")
+  })
+});
+const buildProjectAccessInput = accessInputs.buildProjectAccessInput;
+const projectAccessInputFromRows = accessInputs.projectAccessInputFromRows;
+async function requireCanEdit(locals, projectId) {
+  const { user, ctx } = requireAuthed(locals);
+  const allowed = await contentCheck(async () => {
+    const project = await loadProjectOr404(ctx, projectId);
+    return canEdit(await buildProjectAccessInput(ctx, project));
+  });
+  if (!allowed) throw error(403, "You do not have permission to edit this project.");
+  return user;
+}
+async function requireCanCreateDefinition(locals, projectId) {
+  const { user, ctx } = requireAuthed(locals);
+  const project = await loadProjectOr404(ctx, projectId);
+  const allowed = await contentCheck(async () => {
+    if (project.autoJoinOnUpload) return true;
+    return canEdit(await buildProjectAccessInput(ctx, project));
+  });
+  if (!allowed) {
+    throw error(403, "You do not have permission to upload definitions to this project.");
+  }
+  return { user, ctx, project };
+}
+async function requireCanViewOrg(locals, orgId) {
+  const { user, ctx } = requireAuthed(locals);
+  const allowed = await contentCheck(async () => {
+    const member = await getOrganizationProvider().getOrgMember(ctx, orgId, ctx.userId);
+    return member !== null;
+  });
+  if (!allowed) throw error(403, "You do not have access to this organization.");
+  return user;
+}
+async function requireTargetIsOrgMember(locals, orgId, targetUserId) {
+  const { ctx } = requireAuthed(locals);
+  const member = await getOrganizationProvider().getOrgMember(ctx, orgId, targetUserId);
+  if (!member) {
+    throw error(400, "User must be a member of this organization to be added to a project.");
+  }
+}
+async function requireCanReclaim(locals, projectId) {
+  const { user, ctx } = requireAuthed(locals);
+  const project = await loadProjectOr404(ctx, projectId);
+  const allowed = await managementBypassOrRun(ctx, async () => {
+    const orgMember = await getOrganizationProvider().getOrgMember(ctx, project.orgId, ctx.userId);
+    return canReclaim({
+      project,
+      orgMember,
+      actingOrgId: ctx.actingOrgId ?? null
+    });
+  });
+  if (!allowed) {
+    throw error(403, "Only org owners or admins of this project’s org can reclaim it.");
+  }
+  return { user, ctx, project };
+}
+async function requireCanCreateProject(locals, targetOrgId) {
+  const { user, ctx } = requireAuthed(locals);
+  const allowed = await managementBypassOrRun(ctx, async () => {
+    const orgMember = await getOrganizationProvider().getOrgMember(ctx, targetOrgId, ctx.userId);
+    return canCreateProject({
+      orgPermissions: ctx.orgPermissions,
+      orgMember,
+      actingOrgId: ctx.actingOrgId ?? null,
+      targetOrgId
+    });
+  });
+  if (!allowed) throw error(403, "You do not have permission to create projects in this org.");
+  return { user, ctx };
+}
+async function requireCanManage(locals, projectId) {
+  const { user, ctx } = requireAuthed(locals);
+  const allowed = await managementBypassOrRun(ctx, async () => {
+    const project = await loadProjectOr404(ctx, projectId);
+    return canManage(await buildProjectAccessInput(ctx, project));
+  });
+  if (!allowed) throw error(403, "Only project owners can manage this project.");
+  return user;
+}
+async function requireCanManageMembers(locals, projectId) {
+  const { user, ctx } = requireAuthed(locals);
+  const allowed = await managementBypassOrRun(ctx, async () => {
+    const project = await loadProjectOr404(ctx, projectId);
+    return canManage(await buildProjectAccessInput(ctx, project));
+  });
+  if (!allowed) throw error(403, "Only project owners can manage members.");
+  return user;
+}
+async function requireCanEditProjectSettings(locals, projectId) {
+  const { user, ctx } = requireAuthed(locals);
+  const project = await loadProjectOr404(ctx, projectId);
+  const allowed = await managementBypassOrRun(
+    ctx,
+    async () => canEditProjectSettings(await buildProjectAccessInput(ctx, project))
+  );
+  if (!allowed) throw error(403, "Only project owners can edit project settings.");
+  return { user, ctx, project };
+}
+async function requireCanViewProject(locals, projectId) {
+  const { user, ctx } = requireAuthed(locals);
+  const allowed = await contentCheck(async () => {
+    const project = await loadProjectOr404(ctx, projectId);
+    return canView(await buildProjectAccessInput(ctx, project));
+  });
+  if (!allowed) throw error(403, "You do not have access to this project.");
+  return user;
+}
+async function requireCanSolve(locals, projectId, preloadedProject) {
+  const { user, ctx } = requireAuthed(locals);
+  const project = preloadedProject ?? await loadProjectOr404(ctx, projectId);
+  const allowed = await contentCheck(
+    async () => canSolve(await buildProjectAccessInput(ctx, project))
+  );
+  if (!allowed) throw error(403, "You do not have access to this project.");
+  return { user, ctx, project };
+}
+async function requireEditableDefinition(locals, guid) {
+  const { ctx } = requireAuthed(locals);
+  const record = await getDefinitionMeta().get(ctx, guid);
+  if (!record) throw error(404, "Definition not found");
+  const [project, member] = await Promise.all([
+    getProjectProvider().getProject(ctx, record.projectId),
+    getProjectProvider().getProjectMember(ctx, record.projectId, ctx.userId)
+  ]);
+  const allowed = await contentCheck(
+    async () => canEditDefinition({
+      project,
+      definition: record,
+      member,
+      userId: ctx.userId,
+      platformPermissions: ctx.platformPermissions,
+      enablePlatformProjects: flag("ENABLE_PLATFORM_PROJECTS")
+    })
+  );
+  if (!allowed) throw error(403, "You do not have permission to edit this definition.");
+  return { record, ctx, project };
+}
+async function requireCanEditDefinition(locals, projectId, definitionGuid, preloaded) {
+  const { user, ctx } = requireAuthed(locals);
+  const allowed = await contentCheck(async () => {
+    const [project, definition, member] = await Promise.all([
+      preloaded?.project !== void 0 ? Promise.resolve(preloaded.project) : getProjectProvider().getProject(ctx, projectId),
+      preloaded?.definition !== void 0 ? Promise.resolve(preloaded.definition) : getDefinitionMeta().get(ctx, definitionGuid),
+      getProjectProvider().getProjectMember(ctx, projectId, ctx.userId)
+    ]);
+    return canEditDefinition({
+      project,
+      definition,
+      member,
+      userId: ctx.userId,
+      platformPermissions: ctx.platformPermissions,
+      enablePlatformProjects: flag("ENABLE_PLATFORM_PROJECTS")
+    });
+  });
+  if (!allowed) throw error(403, "You do not have permission to edit this definition.");
+  return user;
+}
+const access_server = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
+  __proto__: null,
+  assertAnyPlatformPermission,
+  assertManageCompute,
+  assertManageDefinitions,
+  assertManageInstanceUsers,
+  assertManageProjects,
+  assertPagePermission,
+  projectAccessInputFromRows,
+  requireAnyPlatformPermission,
+  requireCanCreateDefinition,
+  requireCanCreateProject,
+  requireCanEdit,
+  requireCanEditDefinition,
+  requireCanEditProjectSettings,
+  requireCanManage,
+  requireCanManageMembers,
+  requireCanReclaim,
+  requireCanSolve,
+  requireCanViewOrg,
+  requireCanViewProject,
+  requireEditableDefinition,
+  requireInstanceAdmin,
+  requireManageCompute,
+  requireManageDefinitions,
+  requireManageInstanceUsers,
+  requireManageOrgCompute,
+  requireManageOrgMembers,
+  requireManageProjects,
+  requirePermission,
+  requireTargetIsOrgMember,
+  throwProviderError
+}, Symbol.toStringTag, { value: "Module" }));
+
+export { projectAccessInputFromRows as A, canEdit as B, access_server as C, assertAnyPlatformPermission as a, requireInstanceAdmin as b, requireManageOrgMembers as c, requirePermission as d, requireManageInstanceUsers as e, assertPagePermission as f, assertManageCompute as g, assertManageInstanceUsers as h, requireCanEditDefinition as i, requireCanSolve as j, requireCanCreateDefinition as k, requireEditableDefinition as l, requireCanViewProject as m, requireCanViewOrg as n, requireManageOrgCompute as o, requireCanCreateProject as p, requireCanManage as q, requireManageCompute as r, requireCanEditProjectSettings as s, canChangeVisibilityToPublic as t, requireCanManageMembers as u, requireTargetIsOrgMember as v, withAdminBypass as w, checkOwnerRemoval as x, requireCanReclaim as y, canView as z };
+//# sourceMappingURL=access.server.js-DmuVt13u.js.map

package/build/server/chunks/chunks/access.server.js-DmuVt13u.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.server.js-DmuVt13u.js","sources":["../../../../.svelte-kit/output/server/chunks/access.server.js"],"sourcesContent":["import { redirect, error } from \"@sveltejs/kit\";\nimport { A as ALL_PLATFORM_PERMISSIONS, h as hasPermission } from \"./context.js\";\nimport { s as getDefinitionMeta, m as getProjectProvider, e as getOrganizationProvider, f as flag, n as getPlatformProjectGrantStore } from \"./providers.server.js\";\nimport { h as handleApiError } from \"./api-errors.js\";\nfunction isInstanceAdmin(platformPermissions) {\n  return platformPermissions.includes(\"instance_admin\");\n}\nfunction withAdminBypass(platformPermissions, rule) {\n  if (isInstanceAdmin(platformPermissions)) return true;\n  return rule();\n}\nfunction canView(input) {\n  const {\n    project,\n    member,\n    orgMember,\n    allowCrossOrgPublic,\n    enablePlatformProjects,\n    platformPermissions,\n    platformGrants,\n    actingOrgId,\n    userId\n  } = input;\n  if (!project) return false;\n  if (project.visibility === \"platform\") {\n    if (!enablePlatformProjects) return false;\n    if (isInstanceAdmin(platformPermissions)) return true;\n    return platformGrants.some(\n      (g) => g.granteeType === \"user\" && g.granteeId === userId || g.granteeType === \"org\" && g.granteeId === actingOrgId\n    );\n  }\n  if (project.visibility === \"private\") return member !== null;\n  if (project.visibility === \"org\") return orgMember !== null;\n  if (project.visibility === \"public\") return allowCrossOrgPublic ? true : orgMember !== null;\n  return false;\n}\nfunction canSolve(input) {\n  const {\n    project,\n    enablePlatformProjects,\n    platformPermissions,\n    platformGrants,\n    actingOrgId,\n    userId\n  } = input;\n  if (!project) return false;\n  if (project.visibility === \"platform\") {\n    if (!enablePlatformProjects) return false;\n    if (isInstanceAdmin(platformPermissions)) return true;\n    return platformGrants.some(\n      (g) => g.canSolve && (g.granteeType === \"user\" && g.granteeId === userId || g.granteeType === \"org\" && g.granteeId === actingOrgId)\n    );\n  }\n  return canView(input);\n}\nfunction canEdit(input) {\n  const { member, project, enablePlatformProjects, platformPermissions } = input;\n  if (project?.visibility === \"platform\") {\n    if (!enablePlatformProjects) return false;\n    return isInstanceAdmin(platformPermissions);\n  }\n  return member?.role === \"owner\" || member?.role === \"editor\";\n}\nfunction canManage(input) {\n  if (input.project?.visibility === \"platform\") {\n    if (!input.enablePlatformProjects) return false;\n    return isInstanceAdmin(input.platformPermissions);\n  }\n  return input.member?.role === \"owner\";\n}\nfunction canEditProjectSettings(input) {\n  if (input.project?.visibility === \"platform\") {\n    if (!input.enablePlatformProjects) return false;\n    return isInstanceAdmin(input.platformPermissions);\n  }\n  return input.member?.role === \"owner\";\n}\nfunction canChangeVisibilityToPublic(input) {\n  const role = input.orgMember?.role;\n  return role === \"owner\" || role === \"admin\";\n}\nfunction canEditDefinition(input) {\n  const { project, definition, member, userId, platformPermissions, enablePlatformProjects } = input;\n  if (!project || !definition) return false;\n  if (project.visibility === \"platform\") {\n    if (!enablePlatformProjects) return false;\n    return isInstanceAdmin(platformPermissions);\n  }\n  if (member?.role === \"owner\" || member?.role === \"editor\") return true;\n  if (project.autoJoinOnUpload && userId === definition.ownerId) return true;\n  return false;\n}\nfunction canReclaim(input) {\n  const { project, orgMember, actingOrgId } = input;\n  if (!project || !actingOrgId) return false;\n  if (project.visibility === \"platform\") return false;\n  if (actingOrgId !== project.orgId) return false;\n  const role = orgMember?.role;\n  return role === \"owner\" || role === \"admin\";\n}\nfunction canCreateProject(input) {\n  const { orgMember, orgPermissions, actingOrgId, targetOrgId } = input;\n  if (actingOrgId !== targetOrgId) return false;\n  const role = orgMember?.role;\n  if (role === \"owner\" || role === \"admin\") return true;\n  if (role === \"member\" && orgPermissions.includes(\"manage_projects\")) return true;\n  return false;\n}\nfunction checkOwnerRemoval(input) {\n  if (input.target.role !== \"owner\") return \"ok\";\n  const ownerCount = input.allMembers.filter((m) => m.role === \"owner\").length;\n  if (ownerCount <= 1) return \"sole_owner\";\n  if (!input.confirmed) return \"needs_confirm\";\n  return \"ok\";\n}\nfunction createProjectAccessInputBuilder(deps) {\n  return {\n    async buildProjectAccessInput(ctx, project, overrides = {}) {\n      const { allowCrossOrgPublic, enablePlatformProjects } = deps.flags();\n      let member = null;\n      let orgMember = null;\n      let platformGrants = [];\n      if (project.visibility === \"platform\") {\n        if (enablePlatformProjects) {\n          platformGrants = await deps.listPlatformGrants(ctx, project.id);\n        }\n      } else if (project.visibility === \"private\") {\n        member = await deps.getProjectMember(ctx, project.id, ctx.userId);\n      } else {\n        const skipOrgMember = project.visibility === \"public\" && allowCrossOrgPublic;\n        [member, orgMember] = await Promise.all([\n          deps.getProjectMember(ctx, project.id, ctx.userId),\n          skipOrgMember ? Promise.resolve(null) : deps.getOrgMember(ctx, project.orgId, ctx.userId)\n        ]);\n      }\n      return {\n        orgPermissions: ctx.orgPermissions,\n        platformPermissions: ctx.platformPermissions,\n        project,\n        member,\n        orgMember,\n        allowCrossOrgPublic,\n        enablePlatformProjects,\n        platformGrants,\n        actingOrgId: ctx.actingOrgId ?? null,\n        userId: ctx.userId,\n        ...overrides\n      };\n    },\n    projectAccessInputFromRows(ctx, project, rows) {\n      const { allowCrossOrgPublic, enablePlatformProjects } = deps.flags();\n      return {\n        orgPermissions: ctx.orgPermissions,\n        platformPermissions: ctx.platformPermissions,\n        project,\n        member: rows.member ?? null,\n        orgMember: rows.orgMember ?? null,\n        allowCrossOrgPublic,\n        enablePlatformProjects,\n        platformGrants: rows.platformGrants ?? [],\n        actingOrgId: ctx.actingOrgId ?? null,\n        userId: ctx.userId\n      };\n    }\n  };\n}\nconst throwProviderError = handleApiError;\nfunction requireAuthed(locals) {\n  const { user, ctx } = locals;\n  if (!user || !ctx) throw error(401, \"Unauthorized\");\n  return { user, ctx };\n}\nfunction requirePermission(locals, permission) {\n  const { user, ctx } = requireAuthed(locals);\n  if (!hasPermission(ctx, permission)) {\n    throw error(403, `You don't have permission to do this.`);\n  }\n  return user;\n}\nfunction assertPagePermission(locals, permission) {\n  const { user, ctx } = requireAuthed(locals);\n  if (!hasPermission(ctx, permission)) {\n    redirect(303, \"/admin\");\n  }\n  return user;\n}\nconst requireManageInstanceUsers = (locals) => requirePermission(locals, \"manage_instance_users\");\nconst requireManageCompute = (locals) => requirePermission(locals, \"manage_compute\");\nconst requireManageOrgMembers = (locals) => requirePermission(locals, \"manage_org_members\");\nconst requireManageOrgCompute = (locals) => requirePermission(locals, \"manage_org_compute\");\nconst requireManageDefinitions = (locals) => requirePermission(locals, \"manage_definitions\");\nconst requireManageProjects = (locals) => requirePermission(locals, \"manage_projects\");\nconst assertManageInstanceUsers = (locals) => assertPagePermission(locals, \"manage_instance_users\");\nconst assertManageCompute = (locals) => assertPagePermission(locals, \"manage_compute\");\nconst assertManageDefinitions = (locals) => assertPagePermission(locals, \"manage_definitions\");\nconst assertManageProjects = (locals) => assertPagePermission(locals, \"manage_projects\");\nconst requireInstanceAdmin = (locals) => requirePermission(locals, \"instance_admin\");\nfunction requireAnyPlatformPermission(locals) {\n  const { user, ctx } = requireAuthed(locals);\n  const allowed = ALL_PLATFORM_PERMISSIONS.some((p) => hasPermission(ctx, p));\n  if (!allowed) throw error(403, `You don't have permission to do this.`);\n  return user;\n}\nfunction assertAnyPlatformPermission(locals) {\n  const { user, ctx } = requireAuthed(locals);\n  const allowed = ALL_PLATFORM_PERMISSIONS.some((p) => hasPermission(ctx, p));\n  if (!allowed) redirect(303, \"/library\");\n  return user;\n}\nasync function managementBypassOrRun(ctx, check) {\n  if (hasPermission(ctx, \"instance_admin\")) return true;\n  return await check();\n}\nasync function contentCheck(check) {\n  return await check();\n}\nasync function loadProjectOr404(ctx, projectId) {\n  const project = await getProjectProvider().getProject(ctx, projectId);\n  if (!project) throw error(404, \"Project not found\");\n  return project;\n}\nconst accessInputs = createProjectAccessInputBuilder({\n  getProjectMember: (ctx, projectId, userId) => getProjectProvider().getProjectMember(ctx, projectId, userId),\n  getOrgMember: (ctx, orgId, userId) => getOrganizationProvider().getOrgMember(ctx, orgId, userId),\n  listPlatformGrants: (ctx, projectId) => getPlatformProjectGrantStore().listByProject(ctx, projectId),\n  flags: () => ({\n    allowCrossOrgPublic: flag(\"ALLOW_CROSS_ORG_PUBLIC\"),\n    enablePlatformProjects: flag(\"ENABLE_PLATFORM_PROJECTS\")\n  })\n});\nconst buildProjectAccessInput = accessInputs.buildProjectAccessInput;\nconst projectAccessInputFromRows = accessInputs.projectAccessInputFromRows;\nasync function requireCanEdit(locals, projectId) {\n  const { user, ctx } = requireAuthed(locals);\n  const allowed = await contentCheck(async () => {\n    const project = await loadProjectOr404(ctx, projectId);\n    return canEdit(await buildProjectAccessInput(ctx, project));\n  });\n  if (!allowed) throw error(403, \"You do not have permission to edit this project.\");\n  return user;\n}\nasync function requireCanCreateDefinition(locals, projectId) {\n  const { user, ctx } = requireAuthed(locals);\n  const project = await loadProjectOr404(ctx, projectId);\n  const allowed = await contentCheck(async () => {\n    if (project.autoJoinOnUpload) return true;\n    return canEdit(await buildProjectAccessInput(ctx, project));\n  });\n  if (!allowed) {\n    throw error(403, \"You do not have permission to upload definitions to this project.\");\n  }\n  return { user, ctx, project };\n}\nasync function requireCanViewOrg(locals, orgId) {\n  const { user, ctx } = requireAuthed(locals);\n  const allowed = await contentCheck(async () => {\n    const member = await getOrganizationProvider().getOrgMember(ctx, orgId, ctx.userId);\n    return member !== null;\n  });\n  if (!allowed) throw error(403, \"You do not have access to this organization.\");\n  return user;\n}\nasync function requireTargetIsOrgMember(locals, orgId, targetUserId) {\n  const { ctx } = requireAuthed(locals);\n  const member = await getOrganizationProvider().getOrgMember(ctx, orgId, targetUserId);\n  if (!member) {\n    throw error(400, \"User must be a member of this organization to be added to a project.\");\n  }\n}\nasync function requireCanReclaim(locals, projectId) {\n  const { user, ctx } = requireAuthed(locals);\n  const project = await loadProjectOr404(ctx, projectId);\n  const allowed = await managementBypassOrRun(ctx, async () => {\n    const orgMember = await getOrganizationProvider().getOrgMember(ctx, project.orgId, ctx.userId);\n    return canReclaim({\n      project,\n      orgMember,\n      actingOrgId: ctx.actingOrgId ?? null\n    });\n  });\n  if (!allowed) {\n    throw error(403, \"Only org owners or admins of this project’s org can reclaim it.\");\n  }\n  return { user, ctx, project };\n}\nasync function requireCanCreateProject(locals, targetOrgId) {\n  const { user, ctx } = requireAuthed(locals);\n  const allowed = await managementBypassOrRun(ctx, async () => {\n    const orgMember = await getOrganizationProvider().getOrgMember(ctx, targetOrgId, ctx.userId);\n    return canCreateProject({\n      orgPermissions: ctx.orgPermissions,\n      orgMember,\n      actingOrgId: ctx.actingOrgId ?? null,\n      targetOrgId\n    });\n  });\n  if (!allowed) throw error(403, \"You do not have permission to create projects in this org.\");\n  return { user, ctx };\n}\nasync function requireCanManage(locals, projectId) {\n  const { user, ctx } = requireAuthed(locals);\n  const allowed = await managementBypassOrRun(ctx, async () => {\n    const project = await loadProjectOr404(ctx, projectId);\n    return canManage(await buildProjectAccessInput(ctx, project));\n  });\n  if (!allowed) throw error(403, \"Only project owners can manage this project.\");\n  return user;\n}\nasync function requireCanManageMembers(locals, projectId) {\n  const { user, ctx } = requireAuthed(locals);\n  const allowed = await managementBypassOrRun(ctx, async () => {\n    const project = await loadProjectOr404(ctx, projectId);\n    return canManage(await buildProjectAccessInput(ctx, project));\n  });\n  if (!allowed) throw error(403, \"Only project owners can manage members.\");\n  return user;\n}\nasync function requireCanEditProjectSettings(locals, projectId) {\n  const { user, ctx } = requireAuthed(locals);\n  const project = await loadProjectOr404(ctx, projectId);\n  const allowed = await managementBypassOrRun(\n    ctx,\n    async () => canEditProjectSettings(await buildProjectAccessInput(ctx, project))\n  );\n  if (!allowed) throw error(403, \"Only project owners can edit project settings.\");\n  return { user, ctx, project };\n}\nasync function requireCanViewProject(locals, projectId) {\n  const { user, ctx } = requireAuthed(locals);\n  const allowed = await contentCheck(async () => {\n    const project = await loadProjectOr404(ctx, projectId);\n    return canView(await buildProjectAccessInput(ctx, project));\n  });\n  if (!allowed) throw error(403, \"You do not have access to this project.\");\n  return user;\n}\nasync function requireCanSolve(locals, projectId, preloadedProject) {\n  const { user, ctx } = requireAuthed(locals);\n  const project = preloadedProject ?? await loadProjectOr404(ctx, projectId);\n  const allowed = await contentCheck(\n    async () => canSolve(await buildProjectAccessInput(ctx, project))\n  );\n  if (!allowed) throw error(403, \"You do not have access to this project.\");\n  return { user, ctx, project };\n}\nasync function requireEditableDefinition(locals, guid) {\n  const { ctx } = requireAuthed(locals);\n  const record = await getDefinitionMeta().get(ctx, guid);\n  if (!record) throw error(404, \"Definition not found\");\n  const [project, member] = await Promise.all([\n    getProjectProvider().getProject(ctx, record.projectId),\n    getProjectProvider().getProjectMember(ctx, record.projectId, ctx.userId)\n  ]);\n  const allowed = await contentCheck(\n    async () => canEditDefinition({\n      project,\n      definition: record,\n      member,\n      userId: ctx.userId,\n      platformPermissions: ctx.platformPermissions,\n      enablePlatformProjects: flag(\"ENABLE_PLATFORM_PROJECTS\")\n    })\n  );\n  if (!allowed) throw error(403, \"You do not have permission to edit this definition.\");\n  return { record, ctx, project };\n}\nasync function requireCanEditDefinition(locals, projectId, definitionGuid, preloaded) {\n  const { user, ctx } = requireAuthed(locals);\n  const allowed = await contentCheck(async () => {\n    const [project, definition, member] = await Promise.all([\n      preloaded?.project !== void 0 ? Promise.resolve(preloaded.project) : getProjectProvider().getProject(ctx, projectId),\n      preloaded?.definition !== void 0 ? Promise.resolve(preloaded.definition) : getDefinitionMeta().get(ctx, definitionGuid),\n      getProjectProvider().getProjectMember(ctx, projectId, ctx.userId)\n    ]);\n    return canEditDefinition({\n      project,\n      definition,\n      member,\n      userId: ctx.userId,\n      platformPermissions: ctx.platformPermissions,\n      enablePlatformProjects: flag(\"ENABLE_PLATFORM_PROJECTS\")\n    });\n  });\n  if (!allowed) throw error(403, \"You do not have permission to edit this definition.\");\n  return user;\n}\nconst access_server = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({\n  __proto__: null,\n  assertAnyPlatformPermission,\n  assertManageCompute,\n  assertManageDefinitions,\n  assertManageInstanceUsers,\n  assertManageProjects,\n  assertPagePermission,\n  projectAccessInputFromRows,\n  requireAnyPlatformPermission,\n  requireCanCreateDefinition,\n  requireCanCreateProject,\n  requireCanEdit,\n  requireCanEditDefinition,\n  requireCanEditProjectSettings,\n  requireCanManage,\n  requireCanManageMembers,\n  requireCanReclaim,\n  requireCanSolve,\n  requireCanViewOrg,\n  requireCanViewProject,\n  requireEditableDefinition,\n  requireInstanceAdmin,\n  requireManageCompute,\n  requireManageDefinitions,\n  requireManageInstanceUsers,\n  requireManageOrgCompute,\n  requireManageOrgMembers,\n  requireManageProjects,\n  requirePermission,\n  requireTargetIsOrgMember,\n  throwProviderError\n}, Symbol.toStringTag, { value: \"Module\" }));\nexport {\n  projectAccessInputFromRows as A,\n  canEdit as B,\n  access_server as C,\n  assertAnyPlatformPermission as a,\n  requireInstanceAdmin as b,\n  requireManageOrgMembers as c,\n  requirePermission as d,\n  requireManageInstanceUsers as e,\n  assertPagePermission as f,\n  assertManageCompute as g,\n  assertManageInstanceUsers as h,\n  requireCanEditDefinition as i,\n  requireCanSolve as j,\n  requireCanCreateDefinition as k,\n  requireEditableDefinition as l,\n  requireCanViewProject as m,\n  requireCanViewOrg as n,\n  requireManageOrgCompute as o,\n  requireCanCreateProject as p,\n  requireCanManage as q,\n  requireManageCompute as r,\n  requireCanEditProjectSettings as s,\n  canChangeVisibilityToPublic as t,\n  requireCanManageMembers as u,\n  requireTargetIsOrgMember as v,\n  withAdminBypass as w,\n  checkOwnerRemoval as x,\n  requireCanReclaim as y,\n  canView as z\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAIA,SAAS,eAAe,CAAC,mBAAmB,EAAE;AAC9C,EAAE,OAAO,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC;AACvD;AACA,SAAS,eAAe,CAAC,mBAAmB,EAAE,IAAI,EAAE;AACpD,EAAE,IAAI,eAAe,CAAC,mBAAmB,CAAC,EAAE,OAAO,IAAI;AACvD,EAAE,OAAO,IAAI,EAAE;AACf;AACA,SAAS,OAAO,CAAC,KAAK,EAAE;AACxB,EAAE,MAAM;AACR,IAAI,OAAO;AACX,IAAI,MAAM;AACV,IAAI,SAAS;AACb,IAAI,mBAAmB;AACvB,IAAI,sBAAsB;AAC1B,IAAI,mBAAmB;AACvB,IAAI,cAAc;AAClB,IAAI,WAAW;AACf,IAAI;AACJ,GAAG,GAAG,KAAK;AACX,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,KAAK;AAC5B,EAAE,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE;AACzC,IAAI,IAAI,CAAC,sBAAsB,EAAE,OAAO,KAAK;AAC7C,IAAI,IAAI,eAAe,CAAC,mBAAmB,CAAC,EAAE,OAAO,IAAI;AACzD,IAAI,OAAO,cAAc,CAAC,IAAI;AAC9B,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,KAAK,IAAI,CAAC,CAAC,SAAS,KAAK;AAC9G,KAAK;AACL,EAAE;AACF,EAAE,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,OAAO,MAAM,KAAK,IAAI;AAC9D,EAAE,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,EAAE,OAAO,SAAS,KAAK,IAAI;AAC7D,EAAE,IAAI,OAAO,CAAC,UAAU,KAAK,QAAQ,EAAE,OAAO,mBAAmB,GAAG,IAAI,GAAG,SAAS,KAAK,IAAI;AAC7F,EAAE,OAAO,KAAK;AACd;AACA,SAAS,QAAQ,CAAC,KAAK,EAAE;AACzB,EAAE,MAAM;AACR,IAAI,OAAO;AACX,IAAI,sBAAsB;AAC1B,IAAI,mBAAmB;AACvB,IAAI,cAAc;AAClB,IAAI,WAAW;AACf,IAAI;AACJ,GAAG,GAAG,KAAK;AACX,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,KAAK;AAC5B,EAAE,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE;AACzC,IAAI,IAAI,CAAC,sBAAsB,EAAE,OAAO,KAAK;AAC7C,IAAI,IAAI,eAAe,CAAC,mBAAmB,CAAC,EAAE,OAAO,IAAI;AACzD,IAAI,OAAO,cAAc,CAAC,IAAI;AAC9B,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,KAAK,IAAI,CAAC,CAAC,SAAS,KAAK,WAAW;AACxI,KAAK;AACL,EAAE;AACF,EAAE,OAAO,OAAO,CAAC,KAAK,CAAC;AACvB;AACA,SAAS,OAAO,CAAC,KAAK,EAAE;AACxB,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,GAAG,KAAK;AAChF,EAAE,IAAI,OAAO,EAAE,UAAU,KAAK,UAAU,EAAE;AAC1C,IAAI,IAAI,CAAC,sBAAsB,EAAE,OAAO,KAAK;AAC7C,IAAI,OAAO,eAAe,CAAC,mBAAmB,CAAC;AAC/C,EAAE;AACF,EAAE,OAAO,MAAM,EAAE,IAAI,KAAK,OAAO,IAAI,MAAM,EAAE,IAAI,KAAK,QAAQ;AAC9D;AACA,SAAS,SAAS,CAAC,KAAK,EAAE;AAC1B,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,UAAU,KAAK,UAAU,EAAE;AAChD,IAAI,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,OAAO,KAAK;AACnD,IAAI,OAAO,eAAe,CAAC,KAAK,CAAC,mBAAmB,CAAC;AACrD,EAAE;AACF,EAAE,OAAO,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,OAAO;AACvC;AACA,SAAS,sBAAsB,CAAC,KAAK,EAAE;AACvC,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,UAAU,KAAK,UAAU,EAAE;AAChD,IAAI,IAAI,CAAC,KAAK,CAAC,sBAAsB,EAAE,OAAO,KAAK;AACnD,IAAI,OAAO,eAAe,CAAC,KAAK,CAAC,mBAAmB,CAAC;AACrD,EAAE;AACF,EAAE,OAAO,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,OAAO;AACvC;AACA,SAAS,2BAA2B,CAAC,KAAK,EAAE;AAC5C,EAAE,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,EAAE,IAAI;AACpC,EAAE,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO;AAC7C;AACA,SAAS,iBAAiB,CAAC,KAAK,EAAE;AAClC,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,GAAG,KAAK;AACpG,EAAE,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,EAAE,OAAO,KAAK;AAC3C,EAAE,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE;AACzC,IAAI,IAAI,CAAC,sBAAsB,EAAE,OAAO,KAAK;AAC7C,IAAI,OAAO,eAAe,CAAC,mBAAmB,CAAC;AAC/C,EAAE;AACF,EAAE,IAAI,MAAM,EAAE,IAAI,KAAK,OAAO,IAAI,MAAM,EAAE,IAAI,KAAK,QAAQ,EAAE,OAAO,IAAI;AACxE,EAAE,IAAI,OAAO,CAAC,gBAAgB,IAAI,MAAM,KAAK,UAAU,CAAC,OAAO,EAAE,OAAO,IAAI;AAC5E,EAAE,OAAO,KAAK;AACd;AACA,SAAS,UAAU,CAAC,KAAK,EAAE;AAC3B,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,KAAK;AACnD,EAAE,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,EAAE,OAAO,KAAK;AAC5C,EAAE,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,OAAO,KAAK;AACrD,EAAE,IAAI,WAAW,KAAK,OAAO,CAAC,KAAK,EAAE,OAAO,KAAK;AACjD,EAAE,MAAM,IAAI,GAAG,SAAS,EAAE,IAAI;AAC9B,EAAE,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO;AAC7C;AACA,SAAS,gBAAgB,CAAC,KAAK,EAAE;AACjC,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,KAAK;AACvE,EAAE,IAAI,WAAW,KAAK,WAAW,EAAE,OAAO,KAAK;AAC/C,EAAE,MAAM,IAAI,GAAG,SAAS,EAAE,IAAI;AAC9B,EAAE,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,OAAO,IAAI;AACvD,EAAE,IAAI,IAAI,KAAK,QAAQ,IAAI,cAAc,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,IAAI;AAClF,EAAE,OAAO,KAAK;AACd;AACA,SAAS,iBAAiB,CAAC,KAAK,EAAE;AAClC,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,OAAO,IAAI;AAChD,EAAE,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,MAAM;AAC9E,EAAE,IAAI,UAAU,IAAI,CAAC,EAAE,OAAO,YAAY;AAC1C,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,eAAe;AAC9C,EAAE,OAAO,IAAI;AACb;AACA,SAAS,+BAA+B,CAAC,IAAI,EAAE;AAC/C,EAAE,OAAO;AACT,IAAI,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE,EAAE;AAChE,MAAM,MAAM,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE;AAC1E,MAAM,IAAI,MAAM,GAAG,IAAI;AACvB,MAAM,IAAI,SAAS,GAAG,IAAI;AAC1B,MAAM,IAAI,cAAc,GAAG,EAAE;AAC7B,MAAM,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE;AAC7C,QAAQ,IAAI,sBAAsB,EAAE;AACpC,UAAU,cAAc,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;AACzE,QAAQ;AACR,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE;AACnD,QAAQ,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC;AACzE,MAAM,CAAC,MAAM;AACb,QAAQ,MAAM,aAAa,GAAG,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,mBAAmB;AACpF,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AAChD,UAAU,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC;AAC5D,UAAU,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM;AAClG,SAAS,CAAC;AACV,MAAM;AACN,MAAM,OAAO;AACb,QAAQ,cAAc,EAAE,GAAG,CAAC,cAAc;AAC1C,QAAQ,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;AACpD,QAAQ,OAAO;AACf,QAAQ,MAAM;AACd,QAAQ,SAAS;AACjB,QAAQ,mBAAmB;AAC3B,QAAQ,sBAAsB;AAC9B,QAAQ,cAAc;AACtB,QAAQ,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;AAC5C,QAAQ,MAAM,EAAE,GAAG,CAAC,MAAM;AAC1B,QAAQ,GAAG;AACX,OAAO;AACP,IAAI,CAAC;AACL,IAAI,0BAA0B,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;AACnD,MAAM,MAAM,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE;AAC1E,MAAM,OAAO;AACb,QAAQ,cAAc,EAAE,GAAG,CAAC,cAAc;AAC1C,QAAQ,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;AACpD,QAAQ,OAAO;AACf,QAAQ,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;AACnC,QAAQ,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;AACzC,QAAQ,mBAAmB;AAC3B,QAAQ,sBAAsB;AAC9B,QAAQ,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE;AACjD,QAAQ,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;AAC5C,QAAQ,MAAM,EAAE,GAAG,CAAC;AACpB,OAAO;AACP,IAAI;AACJ,GAAG;AACH;AACA,MAAM,kBAAkB,GAAG,cAAc;AACzC,SAAS,aAAa,CAAC,MAAM,EAAE;AAC/B,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM;AAC9B,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC;AACrD,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE;AACtB;AACA,SAAS,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE;AAC/C,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE;AACvC,IAAI,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,qCAAqC,CAAC,CAAC;AAC7D,EAAE;AACF,EAAE,OAAO,IAAI;AACb;AACA,SAAS,oBAAoB,CAAC,MAAM,EAAE,UAAU,EAAE;AAClD,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE;AACvC,IAAI,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;AAC3B,EAAE;AACF,EAAE,OAAO,IAAI;AACb;AACK,MAAC,0BAA0B,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,uBAAuB;AAC3F,MAAC,oBAAoB,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,gBAAgB;AAC9E,MAAC,uBAAuB,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,oBAAoB;AACrF,MAAC,uBAAuB,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,oBAAoB;AAC1F,MAAM,wBAAwB,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,oBAAoB,CAAC;AAC5F,MAAM,qBAAqB,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,CAAC;AACjF,MAAC,yBAAyB,GAAG,CAAC,MAAM,KAAK,oBAAoB,CAAC,MAAM,EAAE,uBAAuB;AAC7F,MAAC,mBAAmB,GAAG,CAAC,MAAM,KAAK,oBAAoB,CAAC,MAAM,EAAE,gBAAgB;AACrF,MAAM,uBAAuB,GAAG,CAAC,MAAM,KAAK,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,CAAC;AAC9F,MAAM,oBAAoB,GAAG,CAAC,MAAM,KAAK,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,CAAC;AACnF,MAAC,oBAAoB,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,gBAAgB;AACnF,SAAS,4BAA4B,CAAC,MAAM,EAAE;AAC9C,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AAC7E,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,qCAAqC,CAAC,CAAC;AACzE,EAAE,OAAO,IAAI;AACb;AACA,SAAS,2BAA2B,CAAC,MAAM,EAAE;AAC7C,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AAC7E,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;AACzC,EAAE,OAAO,IAAI;AACb;AACA,eAAe,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE;AACjD,EAAE,IAAI,aAAa,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,OAAO,IAAI;AACvD,EAAE,OAAO,MAAM,KAAK,EAAE;AACtB;AACA,eAAe,YAAY,CAAC,KAAK,EAAE;AACnC,EAAE,OAAO,MAAM,KAAK,EAAE;AACtB;AACA,eAAe,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE;AAChD,EAAE,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;AACvE,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,mBAAmB,CAAC;AACrD,EAAE,OAAO,OAAO;AAChB;AACA,MAAM,YAAY,GAAG,+BAA+B,CAAC;AACrD,EAAE,gBAAgB,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,KAAK,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC;AAC7G,EAAE,YAAY,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,KAAK,uBAAuB,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC;AAClG,EAAE,kBAAkB,EAAE,CAAC,GAAG,EAAE,SAAS,KAAK,4BAA4B,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC;AACtG,EAAE,KAAK,EAAE,OAAO;AAChB,IAAI,mBAAmB,EAAE,IAAI,CAAC,wBAAwB,CAAC;AACvD,IAAI,sBAAsB,EAAE,IAAI,CAAC,0BAA0B;AAC3D,GAAG;AACH,CAAC,CAAC;AACF,MAAM,uBAAuB,GAAG,YAAY,CAAC,uBAAuB;AAC/D,MAAC,0BAA0B,GAAG,YAAY,CAAC;AAChD,eAAe,cAAc,CAAC,MAAM,EAAE,SAAS,EAAE;AACjD,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,YAAY;AACjD,IAAI,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC;AAC1D,IAAI,OAAO,OAAO,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC/D,EAAE,CAAC,CAAC;AACJ,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,kDAAkD,CAAC;AACpF,EAAE,OAAO,IAAI;AACb;AACA,eAAe,0BAA0B,CAAC,MAAM,EAAE,SAAS,EAAE;AAC7D,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC;AACxD,EAAE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,YAAY;AACjD,IAAI,IAAI,OAAO,CAAC,gBAAgB,EAAE,OAAO,IAAI;AAC7C,IAAI,OAAO,OAAO,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC/D,EAAE,CAAC,CAAC;AACJ,EAAE,IAAI,CAAC,OAAO,EAAE;AAChB,IAAI,MAAM,KAAK,CAAC,GAAG,EAAE,mEAAmE,CAAC;AACzF,EAAE;AACF,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE;AAC/B;AACA,eAAe,iBAAiB,CAAC,MAAM,EAAE,KAAK,EAAE;AAChD,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,YAAY;AACjD,IAAI,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC;AACvF,IAAI,OAAO,MAAM,KAAK,IAAI;AAC1B,EAAE,CAAC,CAAC;AACJ,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,8CAA8C,CAAC;AAChF,EAAE,OAAO,IAAI;AACb;AACA,eAAe,wBAAwB,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE;AACrE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AACvC,EAAE,MAAM,MAAM,GAAG,MAAM,uBAAuB,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC;AACvF,EAAE,IAAI,CAAC,MAAM,EAAE;AACf,IAAI,MAAM,KAAK,CAAC,GAAG,EAAE,sEAAsE,CAAC;AAC5F,EAAE;AACF;AACA,eAAe,iBAAiB,CAAC,MAAM,EAAE,SAAS,EAAE;AACpD,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC;AACxD,EAAE,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,YAAY;AAC/D,IAAI,MAAM,SAAS,GAAG,MAAM,uBAAuB,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC;AAClG,IAAI,OAAO,UAAU,CAAC;AACtB,MAAM,OAAO;AACb,MAAM,SAAS;AACf,MAAM,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI;AACtC,KAAK,CAAC;AACN,EAAE,CAAC,CAAC;AACJ,EAAE,IAAI,CAAC,OAAO,EAAE;AAChB,IAAI,MAAM,KAAK,CAAC,GAAG,EAAE,iEAAiE,CAAC;AACvF,EAAE;AACF,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE;AAC/B;AACA,eAAe,uBAAuB,CAAC,MAAM,EAAE,WAAW,EAAE;AAC5D,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,YAAY;AAC/D,IAAI,MAAM,SAAS,GAAG,MAAM,uBAAuB,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC;AAChG,IAAI,OAAO,gBAAgB,CAAC;AAC5B,MAAM,cAAc,EAAE,GAAG,CAAC,cAAc;AACxC,MAAM,SAAS;AACf,MAAM,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;AAC1C,MAAM;AACN,KAAK,CAAC;AACN,EAAE,CAAC,CAAC;AACJ,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,4DAA4D,CAAC;AAC9F,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE;AACtB;AACA,eAAe,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE;AACnD,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,YAAY;AAC/D,IAAI,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC;AAC1D,IAAI,OAAO,SAAS,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AACjE,EAAE,CAAC,CAAC;AACJ,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,8CAA8C,CAAC;AAChF,EAAE,OAAO,IAAI;AACb;AACA,eAAe,uBAAuB,CAAC,MAAM,EAAE,SAAS,EAAE;AAC1D,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,YAAY;AAC/D,IAAI,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC;AAC1D,IAAI,OAAO,SAAS,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AACjE,EAAE,CAAC,CAAC;AACJ,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,yCAAyC,CAAC;AAC3E,EAAE,OAAO,IAAI;AACb;AACA,eAAe,6BAA6B,CAAC,MAAM,EAAE,SAAS,EAAE;AAChE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC;AACxD,EAAE,MAAM,OAAO,GAAG,MAAM,qBAAqB;AAC7C,IAAI,GAAG;AACP,IAAI,YAAY,sBAAsB,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC;AAClF,GAAG;AACH,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,gDAAgD,CAAC;AAClF,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE;AAC/B;AACA,eAAe,qBAAqB,CAAC,MAAM,EAAE,SAAS,EAAE;AACxD,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,YAAY;AACjD,IAAI,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC;AAC1D,IAAI,OAAO,OAAO,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC/D,EAAE,CAAC,CAAC;AACJ,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,yCAAyC,CAAC;AAC3E,EAAE,OAAO,IAAI;AACb;AACA,eAAe,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE;AACpE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,gBAAgB,IAAI,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC;AAC5E,EAAE,MAAM,OAAO,GAAG,MAAM,YAAY;AACpC,IAAI,YAAY,QAAQ,CAAC,MAAM,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC;AACpE,GAAG;AACH,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,yCAAyC,CAAC;AAC3E,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE;AAC/B;AACA,eAAe,yBAAyB,CAAC,MAAM,EAAE,IAAI,EAAE;AACvD,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AACvC,EAAE,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC;AACzD,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,sBAAsB,CAAC;AACvD,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AAC9C,IAAI,kBAAkB,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC;AAC1D,IAAI,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM;AAC3E,GAAG,CAAC;AACJ,EAAE,MAAM,OAAO,GAAG,MAAM,YAAY;AACpC,IAAI,YAAY,iBAAiB,CAAC;AAClC,MAAM,OAAO;AACb,MAAM,UAAU,EAAE,MAAM;AACxB,MAAM,MAAM;AACZ,MAAM,MAAM,EAAE,GAAG,CAAC,MAAM;AACxB,MAAM,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;AAClD,MAAM,sBAAsB,EAAE,IAAI,CAAC,0BAA0B;AAC7D,KAAK;AACL,GAAG;AACH,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,qDAAqD,CAAC;AACvF,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE;AACjC;AACA,eAAe,wBAAwB,CAAC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE;AACtF,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC;AAC7C,EAAE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,YAAY;AACjD,IAAI,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AAC5D,MAAM,SAAS,EAAE,OAAO,KAAK,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,kBAAkB,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;AAC1H,MAAM,SAAS,EAAE,UAAU,KAAK,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,iBAAiB,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC;AAC7H,MAAM,kBAAkB,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM;AACtE,KAAK,CAAC;AACN,IAAI,OAAO,iBAAiB,CAAC;AAC7B,MAAM,OAAO;AACb,MAAM,UAAU;AAChB,MAAM,MAAM;AACZ,MAAM,MAAM,EAAE,GAAG,CAAC,MAAM;AACxB,MAAM,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;AAClD,MAAM,sBAAsB,EAAE,IAAI,CAAC,0BAA0B;AAC7D,KAAK,CAAC;AACN,EAAE,CAAC,CAAC;AACJ,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,qDAAqD,CAAC;AACvF,EAAE,OAAO,IAAI;AACb;AACK,MAAC,aAAa,mBAAmB,MAAM,CAAC,MAAM,iBAAiB,MAAM,CAAC,cAAc,CAAC;AAC1F,EAAE,SAAS,EAAE,IAAI;AACjB,EAAE,2BAA2B;AAC7B,EAAE,mBAAmB;AACrB,EAAE,uBAAuB;AACzB,EAAE,yBAAyB;AAC3B,EAAE,oBAAoB;AACtB,EAAE,oBAAoB;AACtB,EAAE,0BAA0B;AAC5B,EAAE,4BAA4B;AAC9B,EAAE,0BAA0B;AAC5B,EAAE,uBAAuB;AACzB,EAAE,cAAc;AAChB,EAAE,wBAAwB;AAC1B,EAAE,6BAA6B;AAC/B,EAAE,gBAAgB;AAClB,EAAE,uBAAuB;AACzB,EAAE,iBAAiB;AACnB,EAAE,eAAe;AACjB,EAAE,iBAAiB;AACnB,EAAE,qBAAqB;AACvB,EAAE,yBAAyB;AAC3B,EAAE,oBAAoB;AACtB,EAAE,oBAAoB;AACtB,EAAE,wBAAwB;AAC1B,EAAE,0BAA0B;AAC5B,EAAE,uBAAuB;AACzB,EAAE,uBAAuB;AACzB,EAAE,qBAAqB;AACvB,EAAE,iBAAiB;AACnB,EAAE,wBAAwB;AAC1B,EAAE;AACF,CAAC,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;;;;"}

package/build/server/chunks/chunks/activity.js-DDbwF0Dy.js

@@ -0,0 +1,18 @@
+import { a7 as spread_props } from './index3.js-1TgPl-ig.js';
+import { I as Icon } from './utils3.js-DyHrfoD2.js';
+
+function Activity($$renderer, $$props) {
+  let { $$slots, $$events, ...props } = $$props;
+  const iconNode = [
+    [
+      "path",
+      {
+        "d": "M22 12h-2.48a2 2 0 0 0-1.93 1.46l-2.35 8.36a.25.25 0 0 1-.48 0L9.24 2.18a.25.25 0 0 0-.48 0l-2.35 8.36A2 2 0 0 1 4.49 12H2"
+      }
+    ]
+  ];
+  Icon($$renderer, spread_props([{ name: "activity" }, props, { iconNode }]));
+}
+
+export { Activity as A };
+//# sourceMappingURL=activity.js-DDbwF0Dy.js.map

package/build/server/chunks/chunks/activity.js-DDbwF0Dy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"activity.js-DDbwF0Dy.js","sources":["../../../../.svelte-kit/output/server/chunks/activity.js"],"sourcesContent":["import { j as spread_props } from \"./index3.js\";\nimport { I as Icon } from \"./utils3.js\";\nfunction Activity($$renderer, $$props) {\n  let { $$slots, $$events, ...props } = $$props;\n  const iconNode = [\n    [\n      \"path\",\n      {\n        \"d\": \"M22 12h-2.48a2 2 0 0 0-1.93 1.46l-2.35 8.36a.25.25 0 0 1-.48 0L9.24 2.18a.25.25 0 0 0-.48 0l-2.35 8.36A2 2 0 0 1 4.49 12H2\"\n      }\n    ]\n  ];\n  Icon($$renderer, spread_props([{ name: \"activity\" }, props, { iconNode }]));\n}\nexport {\n  Activity as A\n};\n"],"names":[],"mappings":";;;AAEA,SAAS,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE;AACvC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO;AAC/C,EAAE,MAAM,QAAQ,GAAG;AACnB,IAAI;AACJ,MAAM,MAAM;AACZ,MAAM;AACN,QAAQ,GAAG,EAAE;AACb;AACA;AACA,GAAG;AACH,EAAE,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;AAC7E;;;;"}

package/build/server/chunks/chunks/admin-auth.server.js-BAXmH56n.js

@@ -0,0 +1,106 @@
+import { error } from '@sveltejs/kit';
+import { b as private_env } from './shared-server.js-DaWdgxVh.js';
+
+function declaredBodySizeExceeds(headers, maxBytes) {
+  const declared = Number(headers.get("content-length"));
+  return Number.isFinite(declared) && declared > maxBytes;
+}
+function createComputeRateLimiter(config) {
+  const { windowMs, maxPerWindow } = config;
+  const buckets = /* @__PURE__ */ new Map();
+  return {
+    config,
+    check(key) {
+      const now = Date.now();
+      const entry = buckets.get(key);
+      if (!entry || now > entry.resetAt) {
+        buckets.set(key, { count: 1, resetAt: now + windowMs });
+        return { allowed: true };
+      }
+      if (entry.count >= maxPerWindow) {
+        return { allowed: false, retryAfter: Math.ceil((entry.resetAt - now) / 1e3) };
+      }
+      entry.count += 1;
+      return { allowed: true };
+    },
+    peek(key) {
+      const now = Date.now();
+      const entry = buckets.get(key);
+      if (!entry || now > entry.resetAt) {
+        return { allowed: true };
+      }
+      if (entry.count >= maxPerWindow) {
+        return { allowed: false, retryAfter: Math.ceil((entry.resetAt - now) / 1e3) };
+      }
+      return { allowed: true };
+    },
+    clear(key) {
+      buckets.delete(key);
+    },
+    reset() {
+      buckets.clear();
+    }
+  };
+}
+const SESSION_COOKIE_NAME = "admin_session";
+const SESSION_MAX_AGE_MS = 8 * 60 * 60 * 1e3;
+const REFRESH_COOKIE_NAME = "admin_refresh";
+const REFRESH_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1e3;
+const loginRateLimiter = createComputeRateLimiter({
+  windowMs: 15 * 60 * 1e3,
+  // 15 minutes
+  maxPerWindow: 5
+});
+function checkRateLimit(ip) {
+  return loginRateLimiter.peek(ip);
+}
+function recordFailedAttempt(ip) {
+  loginRateLimiter.check(ip);
+}
+function clearRateLimit(ip) {
+  loginRateLimiter.clear(ip);
+}
+function setSessionCookie(cookies, sessionToken) {
+  const isSecure = (
+    // eslint-disable-next-line no-restricted-properties -- NODE_ENV is OS-level, set by Node/Vite, not loaded from .env
+    process.env.NODE_ENV === "production" && private_env.ALLOW_INSECURE_COOKIES !== "true"
+  );
+  cookies.set(SESSION_COOKIE_NAME, sessionToken, {
+    path: "/",
+    httpOnly: true,
+    sameSite: "lax",
+    secure: isSecure,
+    maxAge: SESSION_MAX_AGE_MS / 1e3
+  });
+}
+function destroySession(cookies) {
+  cookies.delete(SESSION_COOKIE_NAME, { path: "/" });
+  cookies.delete(REFRESH_COOKIE_NAME, { path: "/" });
+}
+function setRefreshCookie(cookies, refreshToken) {
+  const isSecure = (
+    // eslint-disable-next-line no-restricted-properties -- NODE_ENV is OS-level, set by Node/Vite, not loaded from .env
+    process.env.NODE_ENV === "production" && private_env.ALLOW_INSECURE_COOKIES !== "true"
+  );
+  cookies.set(REFRESH_COOKIE_NAME, refreshToken, {
+    path: "/",
+    httpOnly: true,
+    sameSite: "lax",
+    secure: isSecure,
+    maxAge: REFRESH_MAX_AGE_MS / 1e3
+  });
+}
+function getRefreshToken(cookies) {
+  return cookies.get(REFRESH_COOKIE_NAME);
+}
+function clearRefreshCookie(cookies) {
+  cookies.delete(REFRESH_COOKIE_NAME, { path: "/" });
+}
+function requireMaxBodySize(request, maxBytes) {
+  if (declaredBodySizeExceeds(request.headers, maxBytes)) {
+    throw error(413, `Request body exceeds the limit for this endpoint.`);
+  }
+}
+
+export { setRefreshCookie as a, checkRateLimit as b, clearRefreshCookie as c, clearRateLimit as d, destroySession as e, requireMaxBodySize as f, getRefreshToken as g, createComputeRateLimiter as h, recordFailedAttempt as r, setSessionCookie as s };
+//# sourceMappingURL=admin-auth.server.js-BAXmH56n.js.map

package/build/server/chunks/chunks/admin-auth.server.js-BAXmH56n.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-auth.server.js-BAXmH56n.js","sources":["../../../../.svelte-kit/output/server/chunks/admin-auth.server.js"],"sourcesContent":["import { error } from \"@sveltejs/kit\";\nimport { b as private_env } from \"./shared-server.js\";\nfunction declaredBodySizeExceeds(headers, maxBytes) {\n  const declared = Number(headers.get(\"content-length\"));\n  return Number.isFinite(declared) && declared > maxBytes;\n}\nfunction createComputeRateLimiter(config) {\n  const { windowMs, maxPerWindow } = config;\n  const buckets = /* @__PURE__ */ new Map();\n  return {\n    config,\n    check(key) {\n      const now = Date.now();\n      const entry = buckets.get(key);\n      if (!entry || now > entry.resetAt) {\n        buckets.set(key, { count: 1, resetAt: now + windowMs });\n        return { allowed: true };\n      }\n      if (entry.count >= maxPerWindow) {\n        return { allowed: false, retryAfter: Math.ceil((entry.resetAt - now) / 1e3) };\n      }\n      entry.count += 1;\n      return { allowed: true };\n    },\n    peek(key) {\n      const now = Date.now();\n      const entry = buckets.get(key);\n      if (!entry || now > entry.resetAt) {\n        return { allowed: true };\n      }\n      if (entry.count >= maxPerWindow) {\n        return { allowed: false, retryAfter: Math.ceil((entry.resetAt - now) / 1e3) };\n      }\n      return { allowed: true };\n    },\n    clear(key) {\n      buckets.delete(key);\n    },\n    reset() {\n      buckets.clear();\n    }\n  };\n}\nconst SESSION_COOKIE_NAME = \"admin_session\";\nconst SESSION_MAX_AGE_MS = 8 * 60 * 60 * 1e3;\nconst REFRESH_COOKIE_NAME = \"admin_refresh\";\nconst REFRESH_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1e3;\nconst loginRateLimiter = createComputeRateLimiter({\n  windowMs: 15 * 60 * 1e3,\n  // 15 minutes\n  maxPerWindow: 5\n});\nfunction checkRateLimit(ip) {\n  return loginRateLimiter.peek(ip);\n}\nfunction recordFailedAttempt(ip) {\n  loginRateLimiter.check(ip);\n}\nfunction clearRateLimit(ip) {\n  loginRateLimiter.clear(ip);\n}\nfunction setSessionCookie(cookies, sessionToken) {\n  const isSecure = (\n    // eslint-disable-next-line no-restricted-properties -- NODE_ENV is OS-level, set by Node/Vite, not loaded from .env\n    process.env.NODE_ENV === \"production\" && private_env.ALLOW_INSECURE_COOKIES !== \"true\"\n  );\n  cookies.set(SESSION_COOKIE_NAME, sessionToken, {\n    path: \"/\",\n    httpOnly: true,\n    sameSite: \"lax\",\n    secure: isSecure,\n    maxAge: SESSION_MAX_AGE_MS / 1e3\n  });\n}\nfunction destroySession(cookies) {\n  cookies.delete(SESSION_COOKIE_NAME, { path: \"/\" });\n  cookies.delete(REFRESH_COOKIE_NAME, { path: \"/\" });\n}\nfunction setRefreshCookie(cookies, refreshToken) {\n  const isSecure = (\n    // eslint-disable-next-line no-restricted-properties -- NODE_ENV is OS-level, set by Node/Vite, not loaded from .env\n    process.env.NODE_ENV === \"production\" && private_env.ALLOW_INSECURE_COOKIES !== \"true\"\n  );\n  cookies.set(REFRESH_COOKIE_NAME, refreshToken, {\n    path: \"/\",\n    httpOnly: true,\n    sameSite: \"lax\",\n    secure: isSecure,\n    maxAge: REFRESH_MAX_AGE_MS / 1e3\n  });\n}\nfunction getRefreshToken(cookies) {\n  return cookies.get(REFRESH_COOKIE_NAME);\n}\nfunction clearRefreshCookie(cookies) {\n  cookies.delete(REFRESH_COOKIE_NAME, { path: \"/\" });\n}\nfunction requireMaxBodySize(request, maxBytes) {\n  if (declaredBodySizeExceeds(request.headers, maxBytes)) {\n    throw error(413, `Request body exceeds the limit for this endpoint.`);\n  }\n}\nexport {\n  setRefreshCookie as a,\n  createComputeRateLimiter as b,\n  clearRefreshCookie as c,\n  checkRateLimit as d,\n  recordFailedAttempt as e,\n  clearRateLimit as f,\n  getRefreshToken as g,\n  destroySession as h,\n  requireMaxBodySize as r,\n  setSessionCookie as s\n};\n"],"names":[],"mappings":";;;AAEA,SAAS,uBAAuB,CAAC,OAAO,EAAE,QAAQ,EAAE;AACpD,EAAE,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AACxD,EAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,QAAQ;AACzD;AACA,SAAS,wBAAwB,CAAC,MAAM,EAAE;AAC1C,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM;AAC3C,EAAE,MAAM,OAAO,mBAAmB,IAAI,GAAG,EAAE;AAC3C,EAAE,OAAO;AACT,IAAI,MAAM;AACV,IAAI,KAAK,CAAC,GAAG,EAAE;AACf,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;AAC5B,MAAM,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;AACpC,MAAM,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE;AACzC,QAAQ,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,QAAQ,EAAE,CAAC;AAC/D,QAAQ,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;AAChC,MAAM;AACN,MAAM,IAAI,KAAK,CAAC,KAAK,IAAI,YAAY,EAAE;AACvC,QAAQ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,IAAI,GAAG,CAAC,EAAE;AACrF,MAAM;AACN,MAAM,KAAK,CAAC,KAAK,IAAI,CAAC;AACtB,MAAM,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;AAC9B,IAAI,CAAC;AACL,IAAI,IAAI,CAAC,GAAG,EAAE;AACd,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;AAC5B,MAAM,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;AACpC,MAAM,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE;AACzC,QAAQ,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;AAChC,MAAM;AACN,MAAM,IAAI,KAAK,CAAC,KAAK,IAAI,YAAY,EAAE;AACvC,QAAQ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,IAAI,GAAG,CAAC,EAAE;AACrF,MAAM;AACN,MAAM,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;AAC9B,IAAI,CAAC;AACL,IAAI,KAAK,CAAC,GAAG,EAAE;AACf,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;AACzB,IAAI,CAAC;AACL,IAAI,KAAK,GAAG;AACZ,MAAM,OAAO,CAAC,KAAK,EAAE;AACrB,IAAI;AACJ,GAAG;AACH;AACA,MAAM,mBAAmB,GAAG,eAAe;AAC3C,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG;AAC5C,MAAM,mBAAmB,GAAG,eAAe;AAC3C,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG;AAClD,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AAClD,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,GAAG;AACzB;AACA,EAAE,YAAY,EAAE;AAChB,CAAC,CAAC;AACF,SAAS,cAAc,CAAC,EAAE,EAAE;AAC5B,EAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;AAClC;AACA,SAAS,mBAAmB,CAAC,EAAE,EAAE;AACjC,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;AAC5B;AACA,SAAS,cAAc,CAAC,EAAE,EAAE;AAC5B,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;AAC5B;AACA,SAAS,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE;AACjD,EAAE,MAAM,QAAQ;AAChB;AACA,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,WAAW,CAAC,sBAAsB,KAAK;AACpF,GAAG;AACH,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,YAAY,EAAE;AACjD,IAAI,IAAI,EAAE,GAAG;AACb,IAAI,QAAQ,EAAE,IAAI;AAClB,IAAI,QAAQ,EAAE,KAAK;AACnB,IAAI,MAAM,EAAE,QAAQ;AACpB,IAAI,MAAM,EAAE,kBAAkB,GAAG;AACjC,GAAG,CAAC;AACJ;AACA,SAAS,cAAc,CAAC,OAAO,EAAE;AACjC,EAAE,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACpD,EAAE,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACpD;AACA,SAAS,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE;AACjD,EAAE,MAAM,QAAQ;AAChB;AACA,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,WAAW,CAAC,sBAAsB,KAAK;AACpF,GAAG;AACH,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,YAAY,EAAE;AACjD,IAAI,IAAI,EAAE,GAAG;AACb,IAAI,QAAQ,EAAE,IAAI;AAClB,IAAI,QAAQ,EAAE,KAAK;AACnB,IAAI,MAAM,EAAE,QAAQ;AACpB,IAAI,MAAM,EAAE,kBAAkB,GAAG;AACjC,GAAG,CAAC;AACJ;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,EAAE,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AACzC;AACA,SAAS,kBAAkB,CAAC,OAAO,EAAE;AACrC,EAAE,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACpD;AACA,SAAS,kBAAkB,CAAC,OAAO,EAAE,QAAQ,EAAE;AAC/C,EAAE,IAAI,uBAAuB,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE;AAC1D,IAAI,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,iDAAiD,CAAC,CAAC;AACzE,EAAE;AACF;;;;"}