@remnic/core 9.69.56 → 9.69.57

package/dist/chunk-2QZJ4P27.js

@@ -1,203 +0,0 @@
-import {
-  resolveCorpusNamespaceRoots
-} from "./chunk-7QVYVSEH.js";
-import {
-  capabilityAllowsNamespace
-} from "./chunk-MZWSOLMT.js";
-import {
-  normalizeNamespaceIdentity
-} from "./chunk-VUFL7X3H.js";
-import {
-  resolveNamespaceCapabilities
-} from "./chunk-JUOZ62Y7.js";
-
-// src/orchestration/extraction-watermark.ts
-import path from "path";
-function readFailure(reason) {
-  return {
-    lastExtractionAt: null,
-    readFailed: true,
-    readError: reason
-  };
-}
-function errorMessage(error) {
-  return error instanceof Error ? error.message : String(error);
-}
-var ISO_TIMESTAMP_PATTERN = /^([+-]?\d{4,6})-(\d{2})-(\d{2})T(\d{2}):(\d{2})(?::(\d{2}))?(?:\.(\d+))?(Z|[+-]\d{2}:?\d{2})$/i;
-function validatedTimestampMs(value) {
-  const match = ISO_TIMESTAMP_PATTERN.exec(value);
-  const parsed = Date.parse(value);
-  if (!match || !Number.isFinite(parsed)) return null;
-  const [, yearText, monthText, dayText, hourText, minuteText, secondText, fraction, zone] = match;
-  const normalizedZone = zone.toUpperCase();
-  const offsetMinuteText = normalizedZone.includes(":") ? normalizedZone.slice(4, 6) : normalizedZone.slice(3, 5);
-  const year = Number(yearText);
-  const month = Number(monthText);
-  const day = Number(dayText);
-  const hour = Number(hourText);
-  const minute = Number(minuteText);
-  const second = secondText !== void 0 ? Number(secondText) : 0;
-  const leapYear = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
-  const daysInMonth = [31, leapYear ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
-  if (month < 1 || month > 12 || day < 1 || day > daysInMonth[month - 1]) return null;
-  if (hour === 24) {
-    const isEndOfDay = minute === 0 && second === 0 && /^0*$/.test(fraction ?? "");
-    return isEndOfDay ? parsed : null;
-  }
-  const zoneSign = normalizedZone === "Z" || normalizedZone[0] === "+" ? 1 : -1;
-  const offsetMinutes = normalizedZone === "Z" ? 0 : zoneSign * (Number(normalizedZone.slice(1, 3)) * 60 + Number(offsetMinuteText));
-  const representedCalendar = new Date(parsed + offsetMinutes * 6e4);
-  const millisecond = Number((fraction ?? "").padEnd(3, "0").slice(0, 3));
-  const expected = [
-    year,
-    month,
-    day,
-    hour,
-    minute,
-    second,
-    millisecond
-  ];
-  const actual = [
-    representedCalendar.getUTCFullYear(),
-    representedCalendar.getUTCMonth() + 1,
-    representedCalendar.getUTCDate(),
-    representedCalendar.getUTCHours(),
-    representedCalendar.getUTCMinutes(),
-    representedCalendar.getUTCSeconds(),
-    representedCalendar.getUTCMilliseconds()
-  ];
-  return actual.every((part, index) => part === expected[index]) ? parsed : null;
-}
-function mergeRootStats(current, candidate) {
-  if (!current && !candidate) return void 0;
-  const currentCount = current?.extractionCount;
-  const candidateCount = candidate?.extractionCount;
-  const extractionCount = currentCount === void 0 && candidateCount === void 0 ? void 0 : (currentCount ?? 0) + (candidateCount ?? 0);
-  const currentConsolidation = current?.lastConsolidationAt;
-  const candidateConsolidation = candidate?.lastConsolidationAt;
-  const hasConsolidation = currentConsolidation !== void 0 || candidateConsolidation !== void 0;
-  return {
-    ...extractionCount === void 0 ? {} : { extractionCount },
-    ...hasConsolidation ? {
-      lastConsolidationAt: newerWatermark(
-        currentConsolidation ?? null,
-        candidateConsolidation ?? null
-      )
-    } : {}
-  };
-}
-function watermarkFromMeta(meta, name) {
-  if (meta.lastExtractionAt !== null && meta.lastExtractionAt !== void 0 && validatedTimestampMs(meta.lastExtractionAt) === null) {
-    return readFailure(`${name} watermark timestamp invalid`);
-  }
-  if (meta.lastConsolidationAt !== null && meta.lastConsolidationAt !== void 0 && validatedTimestampMs(meta.lastConsolidationAt) === null) {
-    return readFailure(`${name} consolidation timestamp invalid`);
-  }
-  const hasRootStats = meta.extractionCount !== void 0 || meta.lastConsolidationAt !== void 0;
-  return {
-    lastExtractionAt: meta.lastExtractionAt ?? null,
-    readFailed: false,
-    ...hasRootStats ? {
-      rootStats: {
-        extractionCount: meta.extractionCount,
-        lastConsolidationAt: meta.lastConsolidationAt
-      }
-    } : {}
-  };
-}
-async function readWatermark(storage, name) {
-  try {
-    return watermarkFromMeta(await storage.loadMeta(), name);
-  } catch (error) {
-    return readFailure(`${name} watermark unreadable: ${errorMessage(error)}`);
-  }
-}
-async function resolveRoots(options) {
-  const compute = () => resolveCorpusNamespaceRoots({
-    config: options.config,
-    propagateDiscoveryErrors: true
-  });
-  if (options.rootsCache) {
-    const { roots, refreshError } = options.rootsCache.getResolvedRootsStatus(compute);
-    if (refreshError !== void 0) {
-      return readFailure(`namespace watermark enumeration failed: ${errorMessage(refreshError)}`);
-    }
-    return roots ?? { lastExtractionAt: null, readFailed: false, pending: true };
-  }
-  try {
-    return await compute();
-  } catch (error) {
-    return readFailure(`namespace watermark enumeration failed: ${errorMessage(error)}`);
-  }
-}
-function isReadFailure(value) {
-  return !Array.isArray(value);
-}
-function newerWatermark(current, candidate) {
-  if (candidate === null) return current;
-  const candidateMs = validatedTimestampMs(candidate);
-  if (candidateMs === null) return current;
-  if (current === null) return candidate;
-  const currentMs = validatedTimestampMs(current);
-  return currentMs === null || candidateMs > currentMs ? candidate : current;
-}
-async function readAggregateExtractionWatermark(options) {
-  if (!resolveNamespaceCapabilities(options.config).namespaces) {
-    return options.rootMeta ? watermarkFromMeta(options.rootMeta, "root store") : readWatermark(options.rootStorage, "root store");
-  }
-  const resolved = await resolveRoots(options);
-  if (isReadFailure(resolved)) return resolved;
-  const rootDir = path.resolve(options.rootStorage.dir);
-  const seenDirs = /* @__PURE__ */ new Set([rootDir]);
-  const targets = [];
-  for (const root of resolved) {
-    if (options.caps && !root.namespaces.some(
-      (ns) => capabilityAllowsNamespace(options.caps, normalizeNamespaceIdentity(ns))
-    )) {
-      continue;
-    }
-    const resolvedDir = path.resolve(root.rootDir);
-    if (seenDirs.has(resolvedDir)) continue;
-    seenDirs.add(resolvedDir);
-    targets.push(root);
-  }
-  const defaultNamespace = normalizeNamespaceIdentity(options.config.defaultNamespace);
-  const hasMigratedDefault = resolved.some(
-    (root) => path.resolve(root.rootDir) !== rootDir && root.namespaces.some((namespace) => normalizeNamespaceIdentity(namespace) === defaultNamespace)
-  );
-  const canAccessRoot = !hasMigratedDefault && (!options.caps || capabilityAllowsNamespace(options.caps, defaultNamespace));
-  let rootRead = { lastExtractionAt: null, readFailed: false };
-  if (canAccessRoot) {
-    rootRead = options.rootMeta ? watermarkFromMeta(options.rootMeta, "root store") : await readWatermark(options.rootStorage, "root store");
-    if (rootRead.readFailed) return rootRead;
-  }
-  let lastExtractionAt = rootRead.lastExtractionAt;
-  let rootStats = rootRead.rootStats;
-  const reads = await Promise.all(
-    targets.map(async (target) => {
-      try {
-        const storage = await options.storageForNamespace(target.namespace, target.rootDir);
-        return await readWatermark(storage, "namespace");
-      } catch (error) {
-        return readFailure(`namespace watermark storage unavailable: ${errorMessage(error)}`);
-      }
-    })
-  );
-  for (const read of reads) {
-    if (read.readFailed) {
-      return readFailure(read.readError ?? "namespace watermark unreadable");
-    }
-    lastExtractionAt = newerWatermark(lastExtractionAt, read.lastExtractionAt);
-    rootStats = mergeRootStats(rootStats, read.rootStats);
-  }
-  return {
-    lastExtractionAt,
-    readFailed: false,
-    ...rootStats ? { rootStats } : {}
-  };
-}
-
-export {
-  readAggregateExtractionWatermark
-};
-//# sourceMappingURL=chunk-2QZJ4P27.js.map

package/dist/chunk-2SIKTXWX.js

@@ -1,502 +0,0 @@
-import {
-  SupportPassportError,
-  getOperation
-} from "./chunk-ZBYVR5W4.js";
-import {
-  abortError,
-  isAbortError
-} from "./chunk-BTTPKDIL.js";
-
-// src/support-passport/public-http.ts
-import { createHash } from "crypto";
-import { isIP } from "net";
-var PUBLIC_RATE_LIMIT_MAX_KEYS = 2e4;
-var PUBLIC_AUTH_MAX_IN_FLIGHT_PER_NETWORK = 8;
-var PUBLIC_AUTH_MAX_IN_FLIGHT_TOTAL = 256;
-var PUBLIC_MODEL_MAX_IN_FLIGHT_PER_NETWORK = 8;
-var PUBLIC_MODEL_MAX_IN_FLIGHT_TOTAL = 256;
-var SUPPORT_PASSPORT_PUBLIC_HTTP_ROUTES = [
-  {
-    method: "GET",
-    pathname: "/engram/v1/support-passport/public/grants/:id",
-    operation: "support_passport_grant_read"
-  },
-  {
-    method: "POST",
-    pathname: "/engram/v1/support-passport/public/grants/:id/ask",
-    operation: "support_passport_grant_ask"
-  }
-];
-var UnreadSupportPassportRequestError = class extends Error {
-  constructor(response) {
-    super(response.message);
-    this.response = response;
-    this.name = "UnreadSupportPassportRequestError";
-  }
-  response;
-};
-var FixedWindowLimiter = class {
-  constructor(limit, windowMs, now) {
-    this.limit = limit;
-    this.windowMs = windowMs;
-    this.now = now;
-  }
-  limit;
-  windowMs;
-  now;
-  entries = /* @__PURE__ */ new Map();
-  consume(key) {
-    const reservation = this.reserve(key);
-    if (!reservation) return false;
-    reservation.commit();
-    return true;
-  }
-  reserve(key) {
-    const now = this.now();
-    let entry = this.entries.get(key);
-    if (!entry || entry.resetAt <= now) {
-      if (!entry && this.entries.size >= PUBLIC_RATE_LIMIT_MAX_KEYS) {
-        this.prune(now);
-        if (this.entries.size >= PUBLIC_RATE_LIMIT_MAX_KEYS) return void 0;
-      }
-      entry = { count: 0, resetAt: now + this.windowMs };
-      this.entries.set(key, entry);
-    }
-    if (entry.count >= this.limit) return void 0;
-    entry.count += 1;
-    let active = true;
-    return {
-      commit: () => {
-        active = false;
-      },
-      release: () => {
-        if (!active) return;
-        active = false;
-        if (this.entries.get(key) !== entry) return;
-        entry.count -= 1;
-        if (entry.count === 0) this.entries.delete(key);
-      }
-    };
-  }
-  allows(key) {
-    const now = this.now();
-    const current = this.entries.get(key);
-    if (current && current.resetAt > now) return current.count < this.limit;
-    if (!current && this.entries.size >= PUBLIC_RATE_LIMIT_MAX_KEYS) {
-      this.prune(now);
-      if (this.entries.size >= PUBLIC_RATE_LIMIT_MAX_KEYS) return false;
-    }
-    return true;
-  }
-  prune(now) {
-    for (const [key, entry] of this.entries) {
-      if (entry.resetAt <= now) this.entries.delete(key);
-    }
-  }
-};
-var InFlightLimiter = class {
-  constructor(perKeyLimit, totalLimit) {
-    this.perKeyLimit = perKeyLimit;
-    this.totalLimit = totalLimit;
-  }
-  perKeyLimit;
-  totalLimit;
-  counts = /* @__PURE__ */ new Map();
-  total = 0;
-  reserve(key) {
-    const current = this.counts.get(key) ?? 0;
-    if (current >= this.perKeyLimit || this.total >= this.totalLimit) return void 0;
-    this.counts.set(key, current + 1);
-    this.total += 1;
-    let active = true;
-    return () => {
-      if (!active) return;
-      active = false;
-      const count = this.counts.get(key) ?? 0;
-      if (count <= 1) this.counts.delete(key);
-      else this.counts.set(key, count - 1);
-      this.total -= 1;
-    };
-  }
-};
-function createRateLimits(now) {
-  return {
-    authentications: new InFlightLimiter(PUBLIC_AUTH_MAX_IN_FLIGHT_PER_NETWORK, PUBLIC_AUTH_MAX_IN_FLIGHT_TOTAL),
-    modelCalls: new InFlightLimiter(PUBLIC_MODEL_MAX_IN_FLIGHT_PER_NETWORK, PUBLIC_MODEL_MAX_IN_FLIGHT_TOTAL),
-    grantReads: new FixedWindowLimiter(60, 6e4, now),
-    networkReads: new FixedWindowLimiter(60, 6e4, now),
-    networkReadFailures: new FixedWindowLimiter(60, 6e4, now),
-    grantQuestions: new FixedWindowLimiter(20, 10 * 6e4, now),
-    networkQuestions: new FixedWindowLimiter(20, 10 * 6e4, now),
-    networkQuestionFailures: new FixedWindowLimiter(20, 10 * 6e4, now)
-  };
-}
-function rateLimited() {
-  return new SupportPassportError("rate_limited", "Too many helper requests.", 429);
-}
-async function runPublicOperation(service, name, input, signal) {
-  const operation = getOperation(name);
-  if (!operation) throw new Error(`access-boundary: operation not registered: ${name}`);
-  const output = await operation.run(input, {
-    service,
-    ...signal ? { abortSignal: signal } : {}
-  });
-  return output.result;
-}
-function reserveAuthenticatedLimits(networkLimiter, grantLimiter, networkKey, grantId) {
-  const network = networkLimiter.reserve(networkKey);
-  if (!network) throw rateLimited();
-  const grant = grantLimiter.reserve(grantId);
-  if (!grant) {
-    network.release();
-    throw rateLimited();
-  }
-  let active = true;
-  return {
-    commit: () => {
-      if (!active) return;
-      active = false;
-      network.commit();
-      grant.commit();
-    },
-    release: () => {
-      if (!active) return;
-      active = false;
-      grant.release();
-      network.release();
-    }
-  };
-}
-async function readGrantUnderAuthenticationReservation(service, grantId, secret, networkKey, networkLimiter, grantLimiter, failureLimiter) {
-  if (!failureLimiter.allows(networkKey)) throw rateLimited();
-  const limits = reserveAuthenticatedLimits(networkLimiter, grantLimiter, networkKey, grantId);
-  let guide;
-  try {
-    guide = await runPublicOperation(service, "support_passport_grant_read", { grantId, secret });
-  } catch (error) {
-    if (error instanceof SupportPassportError) {
-      if (error.code === "grant_not_found") {
-        limits.release();
-        if (!failureLimiter.consume(networkKey)) throw rateLimited();
-      } else {
-        limits.commit();
-      }
-    } else {
-      limits.release();
-    }
-    throw error;
-  }
-  limits.commit();
-  return guide;
-}
-async function readGrantWithRateLimits(service, grantId, secret, networkKey, networkLimiter, grantLimiter, failureLimiter, authenticationLimiter) {
-  const releaseAuthentication = authenticationLimiter.reserve(networkKey);
-  if (!releaseAuthentication) throw rateLimited();
-  try {
-    return await readGrantUnderAuthenticationReservation(
-      service,
-      grantId,
-      secret,
-      networkKey,
-      networkLimiter,
-      grantLimiter,
-      failureLimiter
-    );
-  } finally {
-    releaseAuthentication();
-  }
-}
-function normalizeSupportPassportNetworkAddress(value) {
-  if (!value) return void 0;
-  const address = value.trim().toLowerCase();
-  const family = isIP(address);
-  if (family === 0) return void 0;
-  if (family === 4) return address;
-  const canonical = new URL(`http://[${address}]/`).hostname.slice(1, -1);
-  const mapped = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(canonical);
-  if (!mapped) return canonical;
-  const high = Number.parseInt(mapped[1] ?? "", 16);
-  const low = Number.parseInt(mapped[2] ?? "", 16);
-  return `${high >>> 8}.${high & 255}.${low >>> 8}.${low & 255}`;
-}
-function requestNetworkAddress(req, trustedProxyAddresses) {
-  const directAddress = normalizeSupportPassportNetworkAddress(req.socket.remoteAddress) ?? "unknown";
-  if (!trustedProxyAddresses.has(directAddress)) return directAddress;
-  const forwarded = req.headers["x-forwarded-for"];
-  if (typeof forwarded !== "string") return directAddress;
-  const rawAddresses = forwarded.split(",");
-  if (rawAddresses.length < 1 || rawAddresses.length > 32) return directAddress;
-  const addresses = rawAddresses.map((address) => normalizeSupportPassportNetworkAddress(address));
-  if (addresses.some((address) => address === void 0)) return directAddress;
-  for (let index = addresses.length - 1; index >= 0; index -= 1) {
-    const address = addresses[index];
-    if (address && !trustedProxyAddresses.has(address)) return address;
-  }
-  return addresses[0] ?? directAddress;
-}
-function networkDigest(req, trustedProxyAddresses) {
-  return createHash("sha256").update(requestNetworkAddress(req, trustedProxyAddresses)).digest("hex");
-}
-function parseSecret(req) {
-  const raw = req.headers.authorization;
-  if (typeof raw !== "string") return void 0;
-  const match = /^(\S+)[ \t]+(\S+)$/.exec(raw);
-  if (!match || match[1]?.toLowerCase() !== "supportpassport") return void 0;
-  const secret = match[2] ?? "";
-  if (!/^[A-Za-z0-9_-]{32,256}$/.test(secret)) return void 0;
-  return secret;
-}
-function requestDeclaresBody(req) {
-  const contentLength = req.headers["content-length"];
-  const transferEncoding = req.headers["transfer-encoding"];
-  return transferEncoding !== void 0 || contentLength !== void 0 && contentLength !== "0";
-}
-function respondJson(res, status, payload) {
-  const body = JSON.stringify(payload);
-  res.statusCode = status;
-  res.setHeader("cache-control", "private, no-store");
-  res.setHeader("vary", "Authorization");
-  res.setHeader("content-type", "application/json; charset=utf-8");
-  res.setHeader("content-length", String(Buffer.byteLength(body)));
-  res.end(body);
-}
-function respondJsonAndCloseUnreadRequest(req, res, status, payload) {
-  res.shouldKeepAlive = false;
-  res.setHeader("connection", "close");
-  res.once("finish", () => req.destroy());
-  respondJson(res, status, payload);
-}
-function respondBeforeReadingBody(req, res, status, payload) {
-  if (requestDeclaresBody(req)) {
-    respondJsonAndCloseUnreadRequest(req, res, status, payload);
-    return;
-  }
-  respondJson(res, status, payload);
-}
-async function readQuestionBody(req, signal) {
-  const content = await new Promise((resolve, reject) => {
-    const chunks = [];
-    let bytes = 0;
-    let settled = false;
-    const cleanup = () => {
-      req.off("data", onData);
-      req.off("end", onEnd);
-      req.off("error", onError);
-      req.off("aborted", onAborted);
-      signal.removeEventListener("abort", onSignalAbort);
-    };
-    const fail = (error) => {
-      if (settled) return;
-      settled = true;
-      cleanup();
-      reject(error);
-    };
-    const helperLeft = () => isAbortError(signal.reason) ? signal.reason : abortError("The helper left.");
-    const onData = (chunk) => {
-      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-      bytes += buffer.length;
-      if (bytes > 4096) {
-        req.pause();
-        fail(
-          new UnreadSupportPassportRequestError(
-            new SupportPassportError("invalid_input", "The helper question is invalid.", 400)
-          )
-        );
-        return;
-      }
-      chunks.push(buffer);
-    };
-    const onEnd = () => {
-      if (settled) return;
-      settled = true;
-      cleanup();
-      resolve(Buffer.concat(chunks, bytes));
-    };
-    const onError = (error) => fail(signal.aborted || req.aborted ? helperLeft() : error);
-    const onAborted = () => fail(helperLeft());
-    const onSignalAbort = () => fail(helperLeft());
-    req.on("data", onData);
-    req.once("end", onEnd);
-    req.once("error", onError);
-    req.once("aborted", onAborted);
-    signal.addEventListener("abort", onSignalAbort, { once: true });
-    if (signal.aborted) onSignalAbort();
-  });
-  let parsed;
-  try {
-    parsed = JSON.parse(content.toString("utf8"));
-  } catch {
-    throw new SupportPassportError("invalid_input", "The helper question is invalid.", 400);
-  }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new SupportPassportError("invalid_input", "The helper question is invalid.", 400);
-  }
-  const body = parsed;
-  if (Object.keys(body).length !== 1 || typeof body.question !== "string") {
-    throw new SupportPassportError("invalid_input", "The helper question is invalid.", 400);
-  }
-  const question = body.question.trim();
-  if (question.length < 1 || question.length > 500) {
-    throw new SupportPassportError("invalid_input", "The helper question is invalid.", 400);
-  }
-  return question;
-}
-function requestSignal(req, res) {
-  const controller = new AbortController();
-  const abort = () => {
-    if (!res.writableFinished && !controller.signal.aborted) controller.abort(abortError("The helper left."));
-  };
-  req.once("aborted", abort);
-  res.once("close", abort);
-  return {
-    signal: controller.signal,
-    cleanup: () => {
-      req.off("aborted", abort);
-      res.off("close", abort);
-    }
-  };
-}
-function decodeGrantId(raw) {
-  try {
-    const value = decodeURIComponent(raw);
-    return /^[A-Za-z0-9_-]{1,128}$/.test(value) ? value.toLowerCase() : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function buildSupportPassportPublicRequestHandler(service, options = {}) {
-  const rateLimits = createRateLimits(options.now ?? Date.now);
-  const trustedProxyAddresses = new Set(
-    (options.trustedProxyAddresses ?? []).map((address) => normalizeSupportPassportNetworkAddress(address)).filter((address) => address !== void 0)
-  );
-  return async (req, res) => {
-    let parsed;
-    try {
-      parsed = new URL(req.url ?? "/", "http://placeholder");
-    } catch {
-      return false;
-    }
-    const readMatch = /^\/engram\/v1\/support-passport\/public\/grants\/([^/]+)$/.exec(parsed.pathname);
-    const askMatch = /^\/engram\/v1\/support-passport\/public\/grants\/([^/]+)\/ask$/.exec(parsed.pathname);
-    const ownedRead = req.method === "GET" && readMatch;
-    const ownedQuestion = req.method === "POST" && askMatch;
-    if (!ownedRead && !ownedQuestion) return false;
-    res.setHeader("cache-control", "private, no-store");
-    res.setHeader("vary", "Authorization");
-    const grantId = decodeGrantId((ownedRead ? readMatch?.[1] : askMatch?.[1]) ?? "");
-    const secret = parseSecret(req);
-    if (parsed.search.length > 0) {
-      respondBeforeReadingBody(req, res, 400, {
-        error: "The share link request is invalid.",
-        code: "invalid_input"
-      });
-      return true;
-    }
-    if (ownedRead && requestDeclaresBody(req)) {
-      respondJsonAndCloseUnreadRequest(req, res, 400, {
-        error: "The share link request is invalid.",
-        code: "invalid_input"
-      });
-      return true;
-    }
-    if (!grantId || !secret) {
-      respondBeforeReadingBody(req, res, 404, {
-        error: "The share link was not found.",
-        code: "grant_not_found"
-      });
-      return true;
-    }
-    const lifecycle = requestSignal(req, res);
-    try {
-      const digest = networkDigest(req, trustedProxyAddresses);
-      if (ownedRead) {
-        const guide = await readGrantWithRateLimits(
-          service,
-          grantId,
-          secret,
-          digest,
-          rateLimits.networkReads,
-          rateLimits.grantReads,
-          rateLimits.networkReadFailures,
-          rateLimits.authentications
-        );
-        respondJson(res, 200, guide);
-      } else {
-        let releaseAuthentication = rateLimits.authentications.reserve(digest);
-        if (!releaseAuthentication) throw new UnreadSupportPassportRequestError(rateLimited());
-        try {
-          let question;
-          const bodyFailure = rateLimits.networkQuestionFailures.reserve(digest);
-          if (!bodyFailure) throw new UnreadSupportPassportRequestError(rateLimited());
-          try {
-            question = await readQuestionBody(req, lifecycle.signal);
-            bodyFailure.release();
-          } catch (error) {
-            const supportError = error instanceof UnreadSupportPassportRequestError ? error.response : error;
-            if (supportError instanceof SupportPassportError && supportError.code === "invalid_input") {
-              bodyFailure.commit();
-            } else {
-              bodyFailure.release();
-            }
-            throw error;
-          }
-          const releaseModelCall = rateLimits.modelCalls.reserve(digest);
-          if (!releaseModelCall) throw rateLimited();
-          try {
-            await readGrantUnderAuthenticationReservation(
-              service,
-              grantId,
-              secret,
-              digest,
-              rateLimits.networkQuestions,
-              rateLimits.grantQuestions,
-              rateLimits.networkQuestionFailures
-            );
-            releaseAuthentication();
-            releaseAuthentication = void 0;
-            const answer = await runPublicOperation(
-              service,
-              "support_passport_grant_ask",
-              { grantId, secret, question },
-              lifecycle.signal
-            );
-            respondJson(res, 200, answer);
-          } finally {
-            releaseModelCall();
-          }
-        } finally {
-          releaseAuthentication?.();
-        }
-      }
-    } catch (error) {
-      if (error instanceof UnreadSupportPassportRequestError) {
-        respondJsonAndCloseUnreadRequest(req, res, error.response.status, {
-          error: error.response.message,
-          code: error.response.code
-        });
-        return true;
-      }
-      if (!(error instanceof SupportPassportError)) throw error;
-      respondJson(res, error.status, { error: error.message, code: error.code });
-    } finally {
-      lifecycle.cleanup();
-    }
-    return true;
-  };
-}
-function composeSupportPassportExternalRequestHandlers(...handlers) {
-  return async (req, res, ctx) => {
-    for (const handler of handlers) {
-      if (handler && await handler(req, res, ctx)) return true;
-    }
-    return false;
-  };
-}
-
-export {
-  SUPPORT_PASSPORT_PUBLIC_HTTP_ROUTES,
-  normalizeSupportPassportNetworkAddress,
-  buildSupportPassportPublicRequestHandler,
-  composeSupportPassportExternalRequestHandlers
-};
-//# sourceMappingURL=chunk-2SIKTXWX.js.map