@selvajs/selva 4.7.3 → 4.7.4-beta.0

package/build/server/chunks/chunks/admin-auth.server.js-B0irjBkg.js

@@ -0,0 +1,182 @@
+import { b as private_env } from './shared-server.js-BjFXsyhJ.js';
+import './src.js-C5mUn1eC.js';
+import 'node:dns/promises';
+import 'node:net';
+import { error } from '@sveltejs/kit';
+
+/**
+* Build a process-local fixed-window rate limiter. Each limiter owns its own
+* bucket `Map`, so distinct endpoints/keys-spaces don't collide.
+*/
+function createComputeRateLimiter(config) {
+	const { windowMs, maxPerWindow } = config;
+	const maxKeys = Math.max(1, Math.floor(config.maxKeys ?? 1e5));
+	const sweepIntervalMs = Math.max(0, Math.floor(config.sweepIntervalMs ?? windowMs));
+	const resolvedConfig = Object.freeze({
+		...config,
+		maxKeys,
+		sweepIntervalMs
+	});
+	const buckets = /* @__PURE__ */ new Map();
+	let nextSweepAt = Number.POSITIVE_INFINITY;
+	/**
+	* Drop dead buckets, then enforce the hard cap. Amortized onto `check`/`peek`
+	* so the limiter needs no timer of its own. Runs at most once per
+	* `sweepIntervalMs` — except when the cap is already breached, which must be
+	* enforced on the spot regardless of the sweep clock.
+	*
+	* `headroom` is how many buckets the caller is about to insert; the cap is
+	* enforced against the post-insert size so `maxKeys` is a true ceiling rather
+	* than one the very next write steps over.
+	*/
+	function maybeSweep(now, headroom = 0) {
+		const budget = Math.max(0, maxKeys - headroom);
+		if (!(sweepIntervalMs > 0 && now >= nextSweepAt) && buckets.size <= budget) return;
+		for (const [key, entry] of buckets) if (now > entry.resetAt) buckets.delete(key);
+		if (sweepIntervalMs > 0) nextSweepAt = now + sweepIntervalMs;
+		if (buckets.size > budget) {
+			const byResetAsc = [...buckets.entries()].sort((a, b) => a[1].resetAt - b[1].resetAt);
+			for (let i = 0; i < byResetAsc.length - budget; i++) buckets.delete(byResetAsc[i][0]);
+		}
+	}
+	return {
+		config: resolvedConfig,
+		check(key) {
+			const now = Date.now();
+			maybeSweep(now, buckets.has(key) ? 0 : 1);
+			const entry = buckets.get(key);
+			if (!entry || now > entry.resetAt) {
+				buckets.set(key, {
+					count: 1,
+					resetAt: now + windowMs
+				});
+				if (sweepIntervalMs > 0 && nextSweepAt === Number.POSITIVE_INFINITY) nextSweepAt = now + sweepIntervalMs;
+				return { allowed: true };
+			}
+			if (entry.count >= maxPerWindow) return {
+				allowed: false,
+				retryAfter: Math.ceil((entry.resetAt - now) / 1e3)
+			};
+			entry.count += 1;
+			return { allowed: true };
+		},
+		peek(key) {
+			const now = Date.now();
+			maybeSweep(now);
+			const entry = buckets.get(key);
+			if (!entry || now > entry.resetAt) return { allowed: true };
+			if (entry.count >= maxPerWindow) return {
+				allowed: false,
+				retryAfter: Math.ceil((entry.resetAt - now) / 1e3)
+			};
+			return { allowed: true };
+		},
+		clear(key) {
+			buckets.delete(key);
+		},
+		count(key) {
+			const entry = buckets.get(key);
+			if (!entry || Date.now() > entry.resetAt) return 0;
+			return entry.count;
+		},
+		reset() {
+			buckets.clear();
+			nextSweepAt = Number.POSITIVE_INFINITY;
+		},
+		size() {
+			return buckets.size;
+		}
+	};
+}
+//#endregion
+//#region ../server/src/http/body-size.ts
+/**
+* True when the request's declared `Content-Length` exceeds `maxBytes`.
+* Check BEFORE the body is read so a malicious client can't burn memory by
+* sending a huge payload to a small-body endpoint; the route maps a `true`
+* result to its transport's 413.
+*
+* Background: a global body-size limit (e.g. adapter-node's `BODY_SIZE_LIMIT`)
+* has to be set high enough for the largest legitimate upload, which means
+* smaller JSON endpoints inherit that ceiling by default. This check is the
+* per-route lower bound.
+*
+* Caveat: requests without `Content-Length` (chunked transfer encoding) bypass
+* this check. Most browsers and HTTP clients send Content-Length on POST/PUT.
+* The global limit is the backstop for those.
+*/
+function declaredBodySizeExceeds(headers, maxBytes) {
+	const declared = Number(headers.get("content-length"));
+	return Number.isFinite(declared) && declared > maxBytes;
+}
+//#endregion
+//#region src/lib/server/admin-auth.server.ts
+var SESSION_COOKIE_NAME = "admin_session";
+var SESSION_MAX_AGE_MS = 480 * 60 * 1e3;
+var REFRESH_COOKIE_NAME = "admin_refresh";
+var REFRESH_MAX_AGE_MS = 720 * 60 * 60 * 1e3;
+var loginRateLimiter = createComputeRateLimiter({
+	windowMs: 900 * 1e3,
+	maxPerWindow: 5
+});
+function checkRateLimit(ip) {
+	return loginRateLimiter.peek(ip);
+}
+function recordFailedAttempt(ip) {
+	loginRateLimiter.check(ip);
+}
+function clearRateLimit(ip) {
+	loginRateLimiter.clear(ip);
+}
+/**
+* Set the session cookie using a token produced by the auth provider. The
+* token is always minted by the provider (local = HMAC, Supabase = JWT) as
+* part of `verifyLogin` — this helper does cookie transport only.
+*/
+function setSessionCookie(cookies, sessionToken) {
+	const isSecure = process.env.NODE_ENV === "production" && private_env.ALLOW_INSECURE_COOKIES !== "true";
+	cookies.set(SESSION_COOKIE_NAME, sessionToken, {
+		path: "/",
+		httpOnly: true,
+		sameSite: "lax",
+		secure: isSecure,
+		maxAge: SESSION_MAX_AGE_MS / 1e3
+	});
+}
+function destroySession(cookies) {
+	cookies.delete(SESSION_COOKIE_NAME, { path: "/" });
+	cookies.delete(REFRESH_COOKIE_NAME, { path: "/" });
+}
+/**
+* Set the refresh-token cookie used by the OAuth/Supabase flow. The
+* session-refresh middleware in `hooks.server.ts` swaps an expired access
+* token for a fresh one using this. Local/HMAC sessions don't need it.
+*/
+function setRefreshCookie(cookies, refreshToken) {
+	const isSecure = process.env.NODE_ENV === "production" && private_env.ALLOW_INSECURE_COOKIES !== "true";
+	cookies.set(REFRESH_COOKIE_NAME, refreshToken, {
+		path: "/",
+		httpOnly: true,
+		sameSite: "lax",
+		secure: isSecure,
+		maxAge: REFRESH_MAX_AGE_MS / 1e3
+	});
+}
+function getRefreshToken(cookies) {
+	return cookies.get(REFRESH_COOKIE_NAME);
+}
+function clearRefreshCookie(cookies) {
+	cookies.delete(REFRESH_COOKIE_NAME, { path: "/" });
+}
+/**
+* Reject a request whose declared `Content-Length` exceeds `maxBytes` — the
+* per-route lower bound under the global adapter-node `BODY_SIZE_LIMIT`
+* (which must stay high enough for 50MB .gh uploads). Throws 413 BEFORE the
+* body is read; see `declaredBodySizeExceeds` for the chunked-encoding caveat.
+*/
+function requireMaxBodySize(request, maxBytes) {
+	if (declaredBodySizeExceeds(request.headers, maxBytes)) throw error(413, `Request body exceeds the limit for this endpoint.`);
+}
+
+export { setRefreshCookie as a, checkRateLimit as b, clearRefreshCookie as c, clearRateLimit as d, destroySession as e, requireMaxBodySize as f, getRefreshToken as g, createComputeRateLimiter as h, recordFailedAttempt as r, setSessionCookie as s };
+//# sourceMappingURL=admin-auth.server.js-B0irjBkg.js.map

package/build/server/chunks/chunks/admin-auth.server.js-B0irjBkg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-auth.server.js-B0irjBkg.js","sources":["../../../../.svelte-kit/output/server/chunks/admin-auth.server.js"],"sourcesContent":["import { t as private_env } from \"./shared-server.js\";\nimport \"./compute.js\";\nimport { error } from \"@sveltejs/kit\";\n/**\n* Build a process-local fixed-window rate limiter. Each limiter owns its own\n* bucket `Map`, so distinct endpoints/keys-spaces don't collide.\n*/\nfunction createComputeRateLimiter(config) {\n\tconst { windowMs, maxPerWindow } = config;\n\tconst maxKeys = Math.max(1, Math.floor(config.maxKeys ?? 1e5));\n\tconst sweepIntervalMs = Math.max(0, Math.floor(config.sweepIntervalMs ?? windowMs));\n\tconst resolvedConfig = Object.freeze({\n\t\t...config,\n\t\tmaxKeys,\n\t\tsweepIntervalMs\n\t});\n\tconst buckets = /* @__PURE__ */ new Map();\n\tlet nextSweepAt = Number.POSITIVE_INFINITY;\n\t/**\n\t* Drop dead buckets, then enforce the hard cap. Amortized onto `check`/`peek`\n\t* so the limiter needs no timer of its own. Runs at most once per\n\t* `sweepIntervalMs` — except when the cap is already breached, which must be\n\t* enforced on the spot regardless of the sweep clock.\n\t*\n\t* `headroom` is how many buckets the caller is about to insert; the cap is\n\t* enforced against the post-insert size so `maxKeys` is a true ceiling rather\n\t* than one the very next write steps over.\n\t*/\n\tfunction maybeSweep(now, headroom = 0) {\n\t\tconst budget = Math.max(0, maxKeys - headroom);\n\t\tif (!(sweepIntervalMs > 0 && now >= nextSweepAt) && buckets.size <= budget) return;\n\t\tfor (const [key, entry] of buckets) if (now > entry.resetAt) buckets.delete(key);\n\t\tif (sweepIntervalMs > 0) nextSweepAt = now + sweepIntervalMs;\n\t\tif (buckets.size > budget) {\n\t\t\tconst byResetAsc = [...buckets.entries()].sort((a, b) => a[1].resetAt - b[1].resetAt);\n\t\t\tfor (let i = 0; i < byResetAsc.length - budget; i++) buckets.delete(byResetAsc[i][0]);\n\t\t}\n\t}\n\treturn {\n\t\tconfig: resolvedConfig,\n\t\tcheck(key) {\n\t\t\tconst now = Date.now();\n\t\t\tmaybeSweep(now, buckets.has(key) ? 0 : 1);\n\t\t\tconst entry = buckets.get(key);\n\t\t\tif (!entry || now > entry.resetAt) {\n\t\t\t\tbuckets.set(key, {\n\t\t\t\t\tcount: 1,\n\t\t\t\t\tresetAt: now + windowMs\n\t\t\t\t});\n\t\t\t\tif (sweepIntervalMs > 0 && nextSweepAt === Number.POSITIVE_INFINITY) nextSweepAt = now + sweepIntervalMs;\n\t\t\t\treturn { allowed: true };\n\t\t\t}\n\t\t\tif (entry.count >= maxPerWindow) return {\n\t\t\t\tallowed: false,\n\t\t\t\tretryAfter: Math.ceil((entry.resetAt - now) / 1e3)\n\t\t\t};\n\t\t\tentry.count += 1;\n\t\t\treturn { allowed: true };\n\t\t},\n\t\tpeek(key) {\n\t\t\tconst now = Date.now();\n\t\t\tmaybeSweep(now);\n\t\t\tconst entry = buckets.get(key);\n\t\t\tif (!entry || now > entry.resetAt) return { allowed: true };\n\t\t\tif (entry.count >= maxPerWindow) return {\n\t\t\t\tallowed: false,\n\t\t\t\tretryAfter: Math.ceil((entry.resetAt - now) / 1e3)\n\t\t\t};\n\t\t\treturn { allowed: true };\n\t\t},\n\t\tclear(key) {\n\t\t\tbuckets.delete(key);\n\t\t},\n\t\tcount(key) {\n\t\t\tconst entry = buckets.get(key);\n\t\t\tif (!entry || Date.now() > entry.resetAt) return 0;\n\t\t\treturn entry.count;\n\t\t},\n\t\treset() {\n\t\t\tbuckets.clear();\n\t\t\tnextSweepAt = Number.POSITIVE_INFINITY;\n\t\t},\n\t\tsize() {\n\t\t\treturn buckets.size;\n\t\t}\n\t};\n}\n//#endregion\n//#region ../server/src/http/body-size.ts\n/**\n* True when the request's declared `Content-Length` exceeds `maxBytes`.\n* Check BEFORE the body is read so a malicious client can't burn memory by\n* sending a huge payload to a small-body endpoint; the route maps a `true`\n* result to its transport's 413.\n*\n* Background: a global body-size limit (e.g. adapter-node's `BODY_SIZE_LIMIT`)\n* has to be set high enough for the largest legitimate upload, which means\n* smaller JSON endpoints inherit that ceiling by default. This check is the\n* per-route lower bound.\n*\n* Caveat: requests without `Content-Length` (chunked transfer encoding) bypass\n* this check. Most browsers and HTTP clients send Content-Length on POST/PUT.\n* The global limit is the backstop for those.\n*/\nfunction declaredBodySizeExceeds(headers, maxBytes) {\n\tconst declared = Number(headers.get(\"content-length\"));\n\treturn Number.isFinite(declared) && declared > maxBytes;\n}\n//#endregion\n//#region src/lib/server/admin-auth.server.ts\nvar SESSION_COOKIE_NAME = \"admin_session\";\nvar SESSION_MAX_AGE_MS = 480 * 60 * 1e3;\nvar REFRESH_COOKIE_NAME = \"admin_refresh\";\nvar REFRESH_MAX_AGE_MS = 720 * 60 * 60 * 1e3;\nvar loginRateLimiter = createComputeRateLimiter({\n\twindowMs: 900 * 1e3,\n\tmaxPerWindow: 5\n});\nfunction checkRateLimit(ip) {\n\treturn loginRateLimiter.peek(ip);\n}\nfunction recordFailedAttempt(ip) {\n\tloginRateLimiter.check(ip);\n}\nfunction clearRateLimit(ip) {\n\tloginRateLimiter.clear(ip);\n}\n/**\n* Set the session cookie using a token produced by the auth provider. The\n* token is always minted by the provider (local = HMAC, Supabase = JWT) as\n* part of `verifyLogin` — this helper does cookie transport only.\n*/\nfunction setSessionCookie(cookies, sessionToken) {\n\tconst isSecure = process.env.NODE_ENV === \"production\" && private_env.ALLOW_INSECURE_COOKIES !== \"true\";\n\tcookies.set(SESSION_COOKIE_NAME, sessionToken, {\n\t\tpath: \"/\",\n\t\thttpOnly: true,\n\t\tsameSite: \"lax\",\n\t\tsecure: isSecure,\n\t\tmaxAge: SESSION_MAX_AGE_MS / 1e3\n\t});\n}\nfunction destroySession(cookies) {\n\tcookies.delete(SESSION_COOKIE_NAME, { path: \"/\" });\n\tcookies.delete(REFRESH_COOKIE_NAME, { path: \"/\" });\n}\n/**\n* Set the refresh-token cookie used by the OAuth/Supabase flow. The\n* session-refresh middleware in `hooks.server.ts` swaps an expired access\n* token for a fresh one using this. Local/HMAC sessions don't need it.\n*/\nfunction setRefreshCookie(cookies, refreshToken) {\n\tconst isSecure = process.env.NODE_ENV === \"production\" && private_env.ALLOW_INSECURE_COOKIES !== \"true\";\n\tcookies.set(REFRESH_COOKIE_NAME, refreshToken, {\n\t\tpath: \"/\",\n\t\thttpOnly: true,\n\t\tsameSite: \"lax\",\n\t\tsecure: isSecure,\n\t\tmaxAge: REFRESH_MAX_AGE_MS / 1e3\n\t});\n}\nfunction getRefreshToken(cookies) {\n\treturn cookies.get(REFRESH_COOKIE_NAME);\n}\nfunction clearRefreshCookie(cookies) {\n\tcookies.delete(REFRESH_COOKIE_NAME, { path: \"/\" });\n}\n/**\n* Reject a request whose declared `Content-Length` exceeds `maxBytes` — the\n* per-route lower bound under the global adapter-node `BODY_SIZE_LIMIT`\n* (which must stay high enough for 50MB .gh uploads). Throws 413 BEFORE the\n* body is read; see `declaredBodySizeExceeds` for the chunked-encoding caveat.\n*/\nfunction requireMaxBodySize(request, maxBytes) {\n\tif (declaredBodySizeExceeds(request.headers, maxBytes)) throw error(413, `Request body exceeds the limit for this endpoint.`);\n}\n//#endregion\nexport { getRefreshToken as a, setRefreshCookie as c, destroySession as i, setSessionCookie as l, clearRateLimit as n, recordFailedAttempt as o, clearRefreshCookie as r, requireMaxBodySize as s, checkRateLimit as t, createComputeRateLimiter as u };\n"],"names":[],"mappings":";;;;;;AAGA;AACA;AACA;AACA;AACA,SAAS,wBAAwB,CAAC,MAAM,EAAE;AAC1C,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM;AAC1C,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC;AAC/D,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,IAAI,QAAQ,CAAC,CAAC;AACpF,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;AACtC,EAAE,GAAG,MAAM;AACX,EAAE,OAAO;AACT,EAAE;AACF,EAAE,CAAC;AACH,CAAC,MAAM,OAAO,mBAAmB,IAAI,GAAG,EAAE;AAC1C,CAAC,IAAI,WAAW,GAAG,MAAM,CAAC,iBAAiB;AAC3C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,SAAS,UAAU,CAAC,GAAG,EAAE,QAAQ,GAAG,CAAC,EAAE;AACxC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;AAChD,EAAE,IAAI,EAAE,eAAe,GAAG,CAAC,IAAI,GAAG,IAAI,WAAW,CAAC,IAAI,OAAO,CAAC,IAAI,IAAI,MAAM,EAAE;AAC9E,EAAE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;AAClF,EAAE,IAAI,eAAe,GAAG,CAAC,EAAE,WAAW,GAAG,GAAG,GAAG,eAAe;AAC9D,EAAE,IAAI,OAAO,CAAC,IAAI,GAAG,MAAM,EAAE;AAC7B,GAAG,MAAM,UAAU,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AACxF,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxF,EAAE;AACF,CAAC;AACD,CAAC,OAAO;AACR,EAAE,MAAM,EAAE,cAAc;AACxB,EAAE,KAAK,CAAC,GAAG,EAAE;AACb,GAAG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;AACzB,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC5C,GAAG,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;AACjC,GAAG,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE;AACtC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE;AACrB,KAAK,KAAK,EAAE,CAAC;AACb,KAAK,OAAO,EAAE,GAAG,GAAG;AACpB,KAAK,CAAC;AACN,IAAI,IAAI,eAAe,GAAG,CAAC,IAAI,WAAW,KAAK,MAAM,CAAC,iBAAiB,EAAE,WAAW,GAAG,GAAG,GAAG,eAAe;AAC5G,IAAI,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;AAC5B,GAAG;AACH,GAAG,IAAI,KAAK,CAAC,KAAK,IAAI,YAAY,EAAE,OAAO;AAC3C,IAAI,OAAO,EAAE,KAAK;AAClB,IAAI,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,IAAI,GAAG;AACrD,IAAI;AACJ,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC;AACnB,GAAG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;AAC3B,EAAE,CAAC;AACH,EAAE,IAAI,CAAC,GAAG,EAAE;AACZ,GAAG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;AACzB,GAAG,UAAU,CAAC,GAAG,CAAC;AAClB,GAAG,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;AACjC,GAAG,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;AAC9D,GAAG,IAAI,KAAK,CAAC,KAAK,IAAI,YAAY,EAAE,OAAO;AAC3C,IAAI,OAAO,EAAE,KAAK;AAClB,IAAI,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,IAAI,GAAG;AACrD,IAAI;AACJ,GAAG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;AAC3B,EAAE,CAAC;AACH,EAAE,KAAK,CAAC,GAAG,EAAE;AACb,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;AACtB,EAAE,CAAC;AACH,EAAE,KAAK,CAAC,GAAG,EAAE;AACb,GAAG,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;AACjC,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC;AACrD,GAAG,OAAO,KAAK,CAAC,KAAK;AACrB,EAAE,CAAC;AACH,EAAE,KAAK,GAAG;AACV,GAAG,OAAO,CAAC,KAAK,EAAE;AAClB,GAAG,WAAW,GAAG,MAAM,CAAC,iBAAiB;AACzC,EAAE,CAAC;AACH,EAAE,IAAI,GAAG;AACT,GAAG,OAAO,OAAO,CAAC,IAAI;AACtB,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,uBAAuB,CAAC,OAAO,EAAE,QAAQ,EAAE;AACpD,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AACvD,CAAC,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,QAAQ;AACxD;AACA;AACA;AACA,IAAI,mBAAmB,GAAG,eAAe;AACzC,IAAI,kBAAkB,GAAG,GAAG,GAAG,EAAE,GAAG,GAAG;AACvC,IAAI,mBAAmB,GAAG,eAAe;AACzC,IAAI,kBAAkB,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG;AAC5C,IAAI,gBAAgB,GAAG,wBAAwB,CAAC;AAChD,CAAC,QAAQ,EAAE,GAAG,GAAG,GAAG;AACpB,CAAC,YAAY,EAAE;AACf,CAAC,CAAC;AACF,SAAS,cAAc,CAAC,EAAE,EAAE;AAC5B,CAAC,OAAO,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;AACjC;AACA,SAAS,mBAAmB,CAAC,EAAE,EAAE;AACjC,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;AAC3B;AACA,SAAS,cAAc,CAAC,EAAE,EAAE;AAC5B,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;AAC3B;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE;AACjD,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,WAAW,CAAC,sBAAsB,KAAK,MAAM;AACxG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,YAAY,EAAE;AAChD,EAAE,IAAI,EAAE,GAAG;AACX,EAAE,QAAQ,EAAE,IAAI;AAChB,EAAE,QAAQ,EAAE,KAAK;AACjB,EAAE,MAAM,EAAE,QAAQ;AAClB,EAAE,MAAM,EAAE,kBAAkB,GAAG;AAC/B,EAAE,CAAC;AACH;AACA,SAAS,cAAc,CAAC,OAAO,EAAE;AACjC,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACnD,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACnD;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE;AACjD,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,WAAW,CAAC,sBAAsB,KAAK,MAAM;AACxG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,YAAY,EAAE;AAChD,EAAE,IAAI,EAAE,GAAG;AACX,EAAE,QAAQ,EAAE,IAAI;AAChB,EAAE,QAAQ,EAAE,KAAK;AACjB,EAAE,MAAM,EAAE,QAAQ;AAClB,EAAE,MAAM,EAAE,kBAAkB,GAAG;AAC/B,EAAE,CAAC;AACH;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AACxC;AACA,SAAS,kBAAkB,CAAC,OAAO,EAAE;AACrC,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACnD;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,kBAAkB,CAAC,OAAO,EAAE,QAAQ,EAAE;AAC/C,CAAC,IAAI,uBAAuB,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,iDAAiD,CAAC,CAAC;AAC9H;;;;"}

package/build/server/chunks/chunks/admin-config.js-COfYx-KG.js

@@ -0,0 +1,3 @@
+import './src.js-C5mUn1eC.js';
+import './computeLimits.js-DxTgrkcX.js';
+//# sourceMappingURL=admin-config.js-COfYx-KG.js.map

package/build/server/chunks/chunks/admin-config.js-COfYx-KG.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-config.js-COfYx-KG.js","sources":[],"sourcesContent":[],"names":[],"mappings":";"}

package/build/server/chunks/chunks/alert-dialog.js-CLOtTVio.js

@@ -0,0 +1,462 @@
+import { a6 as bind_props, Z as spread_props, a8 as props_id, a0 as attributes, T as derived, a1 as clsx$1 } from './server.js-DO_t9YqN.js';
+import { a as boxWith, q as createId, p as mergeProps } from './create-id.js-OOOdbJ6-.js';
+import { c as cn } from './utils3.js-CCFwAIqA.js';
+import { b as buttonVariants } from './button.js-Cdo5lO8h.js';
+import { n as noop } from './noop.js-CbEPlDqv.js';
+import { a as Portal, F as Focus_scope, i as afterSleep, E as Escape_layer, D as Dismissible_layer, T as Text_selection_layer, S as Scroll_lock } from './scroll-lock.js-DtHIDXcM.js';
+import { D as DialogRootState, a as DialogContentState, c as Dialog_overlay, d as Dialog_title, e as Dialog_description, A as AlertDialogCancelState, g as DialogActionState } from './dialog-description.js-B8Vlj_GI.js';
+
+//#region ../../node_modules/.pnpm/bits-ui@2.18.1_@internationalized+date@3.12.2_@sveltejs+kit@2.69.1_@opentelemetry+api@1_536bdab56e24ce595713fec42a808233/node_modules/bits-ui/dist/bits/alert-dialog/components/alert-dialog.svelte
+function Alert_dialog($$renderer, $$props) {
+	$$renderer.component(($$renderer) => {
+		let { open = false, onOpenChange = noop, onOpenChangeComplete = noop, children } = $$props;
+		DialogRootState.create({
+			variant: boxWith(() => "alert-dialog"),
+			open: boxWith(() => open, (v) => {
+				open = v;
+				onOpenChange(v);
+			}),
+			onOpenChangeComplete: boxWith(() => onOpenChangeComplete)
+		});
+		children?.($$renderer);
+		$$renderer.push(`<!---->`);
+		bind_props($$props, { open });
+	});
+}
+//#endregion
+//#region ../../node_modules/.pnpm/bits-ui@2.18.1_@internationalized+date@3.12.2_@sveltejs+kit@2.69.1_@opentelemetry+api@1_536bdab56e24ce595713fec42a808233/node_modules/bits-ui/dist/bits/alert-dialog/components/alert-dialog-action.svelte
+function Alert_dialog_action$1($$renderer, $$props) {
+	$$renderer.component(($$renderer) => {
+		const uid = props_id($$renderer);
+		let { children, child, id = createId(uid), ref = null, $$slots, $$events, ...restProps } = $$props;
+		const actionState = DialogActionState.create({
+			id: boxWith(() => id),
+			ref: boxWith(() => ref, (v) => ref = v)
+		});
+		const mergedProps = derived(() => mergeProps(restProps, actionState.props));
+		if (child) {
+			$$renderer.push("<!--[0-->");
+			child($$renderer, { props: mergedProps() });
+			$$renderer.push(`<!---->`);
+		} else {
+			$$renderer.push("<!--[-1-->");
+			$$renderer.push(`<button${attributes({ ...mergedProps() })}>`);
+			children?.($$renderer);
+			$$renderer.push(`<!----></button>`);
+		}
+		$$renderer.push(`<!--]-->`);
+		bind_props($$props, { ref });
+	});
+}
+//#endregion
+//#region ../../node_modules/.pnpm/bits-ui@2.18.1_@internationalized+date@3.12.2_@sveltejs+kit@2.69.1_@opentelemetry+api@1_536bdab56e24ce595713fec42a808233/node_modules/bits-ui/dist/bits/alert-dialog/components/alert-dialog-cancel.svelte
+function Alert_dialog_cancel$1($$renderer, $$props) {
+	$$renderer.component(($$renderer) => {
+		const uid = props_id($$renderer);
+		let { id = createId(uid), ref = null, children, child, disabled = false, $$slots, $$events, ...restProps } = $$props;
+		const cancelState = AlertDialogCancelState.create({
+			id: boxWith(() => id),
+			ref: boxWith(() => ref, (v) => ref = v),
+			disabled: boxWith(() => Boolean(disabled))
+		});
+		const mergedProps = derived(() => mergeProps(restProps, cancelState.props));
+		if (child) {
+			$$renderer.push("<!--[0-->");
+			child($$renderer, { props: mergedProps() });
+			$$renderer.push(`<!---->`);
+		} else {
+			$$renderer.push("<!--[-1-->");
+			$$renderer.push(`<button${attributes({ ...mergedProps() })}>`);
+			children?.($$renderer);
+			$$renderer.push(`<!----></button>`);
+		}
+		$$renderer.push(`<!--]-->`);
+		bind_props($$props, { ref });
+	});
+}
+//#endregion
+//#region ../../node_modules/.pnpm/bits-ui@2.18.1_@internationalized+date@3.12.2_@sveltejs+kit@2.69.1_@opentelemetry+api@1_536bdab56e24ce595713fec42a808233/node_modules/bits-ui/dist/bits/alert-dialog/components/alert-dialog-content.svelte
+function Alert_dialog_content$1($$renderer, $$props) {
+	$$renderer.component(($$renderer) => {
+		const uid = props_id($$renderer);
+		let { id = createId(uid), children, child, ref = null, forceMount = false, interactOutsideBehavior = "ignore", onCloseAutoFocus = noop, onEscapeKeydown = noop, onOpenAutoFocus = noop, onInteractOutside = noop, preventScroll = true, trapFocus = true, restoreScrollDelay = null, $$slots, $$events, ...restProps } = $$props;
+		const contentState = DialogContentState.create({
+			id: boxWith(() => id),
+			ref: boxWith(() => ref, (v) => ref = v)
+		});
+		const mergedProps = derived(() => mergeProps(restProps, contentState.props));
+		if (contentState.shouldRender || forceMount) {
+			$$renderer.push("<!--[0-->");
+			{
+				function focusScope($$renderer, { props: focusScopeProps }) {
+					Escape_layer($$renderer, spread_props([mergedProps(), {
+						enabled: contentState.root.opts.open.current,
+						ref: contentState.opts.ref,
+						onEscapeKeydown: (e) => {
+							onEscapeKeydown(e);
+							if (e.defaultPrevented) return;
+							contentState.root.handleClose();
+						},
+						children: ($$renderer) => {
+							Dismissible_layer($$renderer, spread_props([mergedProps(), {
+								ref: contentState.opts.ref,
+								enabled: contentState.root.opts.open.current,
+								interactOutsideBehavior,
+								onInteractOutside: (e) => {
+									onInteractOutside(e);
+									if (e.defaultPrevented) return;
+									contentState.root.handleClose();
+								},
+								children: ($$renderer) => {
+									Text_selection_layer($$renderer, spread_props([mergedProps(), {
+										ref: contentState.opts.ref,
+										enabled: contentState.root.opts.open.current,
+										children: ($$renderer) => {
+											if (child) {
+												$$renderer.push("<!--[0-->");
+												if (contentState.root.opts.open.current) {
+													$$renderer.push("<!--[0-->");
+													Scroll_lock($$renderer, {
+														preventScroll,
+														restoreScrollDelay
+													});
+												} else $$renderer.push("<!--[-1-->");
+												$$renderer.push(`<!--]--> `);
+												child($$renderer, {
+													props: mergeProps(mergedProps(), focusScopeProps),
+													...contentState.snippetProps
+												});
+												$$renderer.push(`<!---->`);
+											} else {
+												$$renderer.push("<!--[-1-->");
+												Scroll_lock($$renderer, { preventScroll });
+												$$renderer.push(`<!----> <div${attributes({ ...mergeProps(mergedProps(), focusScopeProps) })}>`);
+												children?.($$renderer);
+												$$renderer.push(`<!----></div>`);
+											}
+											$$renderer.push(`<!--]-->`);
+										},
+										$$slots: { default: true }
+									}]));
+								},
+								$$slots: { default: true }
+							}]));
+						},
+						$$slots: { default: true }
+					}]));
+				}
+				Focus_scope($$renderer, {
+					ref: contentState.opts.ref,
+					loop: true,
+					trapFocus,
+					enabled: contentState.root.opts.open.current,
+					onCloseAutoFocus,
+					onOpenAutoFocus: (e) => {
+						onOpenAutoFocus(e);
+						if (e.defaultPrevented) return;
+						e.preventDefault();
+						afterSleep(0, () => contentState.opts.ref.current?.focus());
+					},
+					focusScope});
+			}
+		} else $$renderer.push("<!--[-1-->");
+		$$renderer.push(`<!--]-->`);
+		bind_props($$props, { ref });
+	});
+}
+//#endregion
+//#region ../ui/dist/components/primitives/alert-dialog/alert-dialog-title.svelte
+function Alert_dialog_title($$renderer, $$props) {
+	$$renderer.component(($$renderer) => {
+		let { ref = null, class: className, $$slots, $$events, ...restProps } = $$props;
+		let $$settled = true;
+		let $$inner_renderer;
+		function $$render_inner($$renderer) {
+			if (Dialog_title) {
+				$$renderer.push("<!--[-->");
+				Dialog_title($$renderer, spread_props([
+					{
+						"data-slot": "alert-dialog-title",
+						class: cn("text-lg font-semibold", className)
+					},
+					restProps,
+					{
+						get ref() {
+							return ref;
+						},
+						set ref($$value) {
+							ref = $$value;
+							$$settled = false;
+						}
+					}
+				]));
+				$$renderer.push("<!--]-->");
+			} else {
+				$$renderer.push("<!--[!-->");
+				$$renderer.push("<!--]-->");
+			}
+		}
+		do {
+			$$settled = true;
+			$$inner_renderer = $$renderer.copy();
+			$$render_inner($$inner_renderer);
+		} while (!$$settled);
+		$$renderer.subsume($$inner_renderer);
+		bind_props($$props, { ref });
+	});
+}
+//#endregion
+//#region ../ui/dist/components/primitives/alert-dialog/alert-dialog-action.svelte
+function Alert_dialog_action($$renderer, $$props) {
+	$$renderer.component(($$renderer) => {
+		let { ref = null, class: className, $$slots, $$events, ...restProps } = $$props;
+		let $$settled = true;
+		let $$inner_renderer;
+		function $$render_inner($$renderer) {
+			if (Alert_dialog_action$1) {
+				$$renderer.push("<!--[-->");
+				Alert_dialog_action$1($$renderer, spread_props([
+					{
+						"data-slot": "alert-dialog-action",
+						class: cn(buttonVariants(), className)
+					},
+					restProps,
+					{
+						get ref() {
+							return ref;
+						},
+						set ref($$value) {
+							ref = $$value;
+							$$settled = false;
+						}
+					}
+				]));
+				$$renderer.push("<!--]-->");
+			} else {
+				$$renderer.push("<!--[!-->");
+				$$renderer.push("<!--]-->");
+			}
+		}
+		do {
+			$$settled = true;
+			$$inner_renderer = $$renderer.copy();
+			$$render_inner($$inner_renderer);
+		} while (!$$settled);
+		$$renderer.subsume($$inner_renderer);
+		bind_props($$props, { ref });
+	});
+}
+//#endregion
+//#region ../ui/dist/components/primitives/alert-dialog/alert-dialog-cancel.svelte
+function Alert_dialog_cancel($$renderer, $$props) {
+	$$renderer.component(($$renderer) => {
+		let { ref = null, class: className, $$slots, $$events, ...restProps } = $$props;
+		let $$settled = true;
+		let $$inner_renderer;
+		function $$render_inner($$renderer) {
+			if (Alert_dialog_cancel$1) {
+				$$renderer.push("<!--[-->");
+				Alert_dialog_cancel$1($$renderer, spread_props([
+					{
+						"data-slot": "alert-dialog-cancel",
+						class: cn(buttonVariants({ variant: "outline" }), className)
+					},
+					restProps,
+					{
+						get ref() {
+							return ref;
+						},
+						set ref($$value) {
+							ref = $$value;
+							$$settled = false;
+						}
+					}
+				]));
+				$$renderer.push("<!--]-->");
+			} else {
+				$$renderer.push("<!--[!-->");
+				$$renderer.push("<!--]-->");
+			}
+		}
+		do {
+			$$settled = true;
+			$$inner_renderer = $$renderer.copy();
+			$$render_inner($$inner_renderer);
+		} while (!$$settled);
+		$$renderer.subsume($$inner_renderer);
+		bind_props($$props, { ref });
+	});
+}
+//#endregion
+//#region ../ui/dist/components/primitives/alert-dialog/alert-dialog-footer.svelte
+function Alert_dialog_footer($$renderer, $$props) {
+	$$renderer.component(($$renderer) => {
+		let { ref = null, class: className, children, $$slots, $$events, ...restProps } = $$props;
+		$$renderer.push(`<div${attributes({
+			"data-slot": "alert-dialog-footer",
+			class: clsx$1(cn("gap-2 sm:flex-row sm:justify-end flex flex-col-reverse", className)),
+			...restProps
+		})}>`);
+		children?.($$renderer);
+		$$renderer.push(`<!----></div>`);
+		bind_props($$props, { ref });
+	});
+}
+//#endregion
+//#region ../ui/dist/components/primitives/alert-dialog/alert-dialog-header.svelte
+function Alert_dialog_header($$renderer, $$props) {
+	$$renderer.component(($$renderer) => {
+		let { ref = null, class: className, children, $$slots, $$events, ...restProps } = $$props;
+		$$renderer.push(`<div${attributes({
+			"data-slot": "alert-dialog-header",
+			class: clsx$1(cn("gap-2 sm:text-start flex flex-col text-center", className)),
+			...restProps
+		})}>`);
+		children?.($$renderer);
+		$$renderer.push(`<!----></div>`);
+		bind_props($$props, { ref });
+	});
+}
+//#endregion
+//#region ../ui/dist/components/primitives/alert-dialog/alert-dialog-overlay.svelte
+function Alert_dialog_overlay($$renderer, $$props) {
+	$$renderer.component(($$renderer) => {
+		let { ref = null, class: className, $$slots, $$events, ...restProps } = $$props;
+		let $$settled = true;
+		let $$inner_renderer;
+		function $$render_inner($$renderer) {
+			if (Dialog_overlay) {
+				$$renderer.push("<!--[-->");
+				Dialog_overlay($$renderer, spread_props([
+					{
+						"data-slot": "alert-dialog-overlay",
+						class: cn("data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 inset-0 bg-black/50 fixed z-50", className)
+					},
+					restProps,
+					{
+						get ref() {
+							return ref;
+						},
+						set ref($$value) {
+							ref = $$value;
+							$$settled = false;
+						}
+					}
+				]));
+				$$renderer.push("<!--]-->");
+			} else {
+				$$renderer.push("<!--[!-->");
+				$$renderer.push("<!--]-->");
+			}
+		}
+		do {
+			$$settled = true;
+			$$inner_renderer = $$renderer.copy();
+			$$render_inner($$inner_renderer);
+		} while (!$$settled);
+		$$renderer.subsume($$inner_renderer);
+		bind_props($$props, { ref });
+	});
+}
+//#endregion
+//#region ../ui/dist/components/primitives/alert-dialog/alert-dialog-content.svelte
+function Alert_dialog_content($$renderer, $$props) {
+	$$renderer.component(($$renderer) => {
+		let { ref = null, class: className, portalProps, $$slots, $$events, ...restProps } = $$props;
+		let $$settled = true;
+		let $$inner_renderer;
+		function $$render_inner($$renderer) {
+			if (Portal) {
+				$$renderer.push("<!--[-->");
+				Portal($$renderer, spread_props([portalProps, {
+					children: ($$renderer) => {
+						Alert_dialog_overlay($$renderer, {});
+						$$renderer.push(`<!----> `);
+						if (Alert_dialog_content$1) {
+							$$renderer.push("<!--[-->");
+							Alert_dialog_content$1($$renderer, spread_props([
+								{
+									"data-slot": "alert-dialog-content",
+									class: cn("data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 gap-4 p-6 shadow-lg sm:max-w-lg fixed start-[50%] top-[50%] z-50 grid w-full max-w-[calc(100%-2rem)] translate-x-[-50%] translate-y-[-50%] rounded-lg border bg-background duration-200", className)
+								},
+								restProps,
+								{
+									get ref() {
+										return ref;
+									},
+									set ref($$value) {
+										ref = $$value;
+										$$settled = false;
+									}
+								}
+							]));
+							$$renderer.push("<!--]-->");
+						} else {
+							$$renderer.push("<!--[!-->");
+							$$renderer.push("<!--]-->");
+						}
+					},
+					$$slots: { default: true }
+				}]));
+				$$renderer.push("<!--]-->");
+			} else {
+				$$renderer.push("<!--[!-->");
+				$$renderer.push("<!--]-->");
+			}
+		}
+		do {
+			$$settled = true;
+			$$inner_renderer = $$renderer.copy();
+			$$render_inner($$inner_renderer);
+		} while (!$$settled);
+		$$renderer.subsume($$inner_renderer);
+		bind_props($$props, { ref });
+	});
+}
+//#endregion
+//#region ../ui/dist/components/primitives/alert-dialog/alert-dialog-description.svelte
+function Alert_dialog_description($$renderer, $$props) {
+	$$renderer.component(($$renderer) => {
+		let { ref = null, class: className, $$slots, $$events, ...restProps } = $$props;
+		let $$settled = true;
+		let $$inner_renderer;
+		function $$render_inner($$renderer) {
+			if (Dialog_description) {
+				$$renderer.push("<!--[-->");
+				Dialog_description($$renderer, spread_props([
+					{
+						"data-slot": "alert-dialog-description",
+						class: cn("text-sm text-muted-foreground", className)
+					},
+					restProps,
+					{
+						get ref() {
+							return ref;
+						},
+						set ref($$value) {
+							ref = $$value;
+							$$settled = false;
+						}
+					}
+				]));
+				$$renderer.push("<!--]-->");
+			} else {
+				$$renderer.push("<!--[!-->");
+				$$renderer.push("<!--]-->");
+			}
+		}
+		do {
+			$$settled = true;
+			$$inner_renderer = $$renderer.copy();
+			$$render_inner($$inner_renderer);
+		} while (!$$settled);
+		$$renderer.subsume($$inner_renderer);
+		bind_props($$props, { ref });
+	});
+}
+//#endregion
+//#region ../ui/dist/components/primitives/alert-dialog/index.js
+var Root = Alert_dialog;
+
+export { Alert_dialog_content as A, Root as R, Alert_dialog_header as a, Alert_dialog_footer as b, Alert_dialog_title as c, Alert_dialog_description as d, Alert_dialog_cancel as e, Alert_dialog_action as f };
+//# sourceMappingURL=alert-dialog.js-CLOtTVio.js.map