@selvajs/selva 4.15.0 → 4.16.1

package/build/server/chunks/chunks/selfUpdate.server.js-DVjJ-O6e.js

@@ -1,149 +0,0 @@
-import { g as getLogger, r as renderThrown } from './providers.server.js-CGtbhqJ3.js';
-import { d as deriveOutcome } from './update-outcome.js-Dl8LwqJM.js';
-import { join } from 'node:path';
-import { existsSync, readFileSync, rmSync } from 'node:fs';
-
-//#region src/lib/server/selfUpdate.server.ts
-/**
-* Durable log/state paths for the update runner, plus post-restart
-* reconciliation of the update's outcome into the audit event log.
-*
-* The process that launches an update is killed mid-update (`pm2 stop
-* selva-compute` is a step of the update itself), so only the
-* `system.update.started` event can be emitted synchronously by the POST
-* handler. The terminal event (`finished` / `rolled_back` / `failed`) is
-* derived AFTER the app is back up: the POST persists a pending-update state
-* file next to the log, and the reconciler here polls the log until the
-* runner's `[EXIT] code=N` marker appears, classifies it via `deriveOutcome`,
-* emits the matching event, and consumes the state file. Kicked from both the
-* POST (covers the no-restart "already up to date" path) and the first request
-* after boot (covers the real update path, where the emitting process is new).
-*/
-function isDeploymentDir(dir) {
-	return existsSync(join(dir, "node_modules", "@selvajs", "selva", "package.json"));
-}
-function findDeploymentDir(env) {
-	if (env.INSTALL_DIR && isDeploymentDir(env.INSTALL_DIR)) return env.INSTALL_DIR;
-	let dir = process.cwd();
-	for (let i = 0; i < 6; i++) {
-		if (isDeploymentDir(dir)) return dir;
-		const parent = join(dir, "..");
-		if (parent === dir) break;
-		dir = parent;
-	}
-	return null;
-}
-/**
-* Where the update runner mirrors all its output. Lives in the deployment dir
-* so it survives reboots; the `/tmp` fallback only applies outside a
-* deployment (dev), where no update can actually run.
-*/
-function updateLogPath(deploymentDir) {
-	return deploymentDir ? join(deploymentDir, "selva-update.log") : "/tmp/selva-update.log";
-}
-/** Pending-update marker consumed by the reconciler. Sits next to the log. */
-function updateStatePath(deploymentDir) {
-	return join(deploymentDir, "selva-update-state.json");
-}
-/**
-* One reconciliation attempt. Reads the pending-update state file; if the log
-* carries the runner's terminal `[EXIT] code=N` marker, classifies the outcome,
-* emits the terminal audit event, reports rollback/failure to the error
-* tracker, and deletes the state file (exactly-once across restarts — the
-* state file is the emission token).
-*/
-async function reconcileUpdateOutcome(deps) {
-	const statePath = updateStatePath(deps.deploymentDir);
-	let state;
-	try {
-		state = JSON.parse(readFileSync(statePath, "utf8"));
-	} catch {
-		return "no_pending_update";
-	}
-	let logs = "";
-	try {
-		logs = readFileSync(updateLogPath(deps.deploymentDir), "utf8");
-	} catch {}
-	const exitMatch = /\[EXIT\] code=(\d+)/.exec(logs);
-	if (!exitMatch) return "still_running";
-	const exitCode = Number(exitMatch[1]);
-	const outcome = deriveOutcome(exitCode, logs);
-	const base = {
-		fromVersion: state.fromVersion ?? outcome.from,
-		toVersion: outcome.to,
-		actorId: state.actorId
-	};
-	let event;
-	if (outcome.severity === "critical") event = {
-		type: "system.update.failed",
-		...base,
-		detail: outcome.title
-	};
-	else if (exitCode === 5 || logs.includes("Rolled back")) event = {
-		type: "system.update.rolled_back",
-		...base,
-		detail: outcome.title
-	};
-	else if (outcome.severity === "success" || outcome.severity === "info") event = {
-		type: "system.update.finished",
-		...base
-	};
-	else event = {
-		type: "system.update.finished",
-		...base,
-		detail: outcome.title
-	};
-	await deps.emit(event);
-	if (event.type !== "system.update.finished") deps.report(/* @__PURE__ */ new Error(`[selfUpdate] ${outcome.title}`));
-	try {
-		rmSync(statePath);
-	} catch {}
-	return "reconciled";
-}
-var POLL_MS = 15e3;
-var MAX_POLLS = 80;
-var reconcilerActive = false;
-/**
-* Idempotent: safe to call on every boot and on every update POST — exits
-* immediately when no state file exists and never runs twice concurrently.
-*/
-function startUpdateOutcomeReconciler(deps) {
-	if (reconcilerActive) return;
-	if (!existsSync(updateStatePath(deps.deploymentDir))) return;
-	reconcilerActive = true;
-	let polls = 0;
-	const timer = setInterval(() => {
-		(async () => {
-			polls += 1;
-			let result;
-			try {
-				result = await reconcileUpdateOutcome(deps);
-			} catch (err) {
-				getLogger().error("Outcome reconciliation failed", {
-					component: "selfUpdate",
-					err: renderThrown(err)
-				});
-				result = "still_running";
-			}
-			if (result === "still_running" && polls < MAX_POLLS) return;
-			if (result === "still_running") try {
-				const statePath = updateStatePath(deps.deploymentDir);
-				const state = JSON.parse(readFileSync(statePath, "utf8"));
-				await deps.emit({
-					type: "system.update.failed",
-					fromVersion: state.fromVersion,
-					actorId: state.actorId,
-					detail: "No terminal marker in the update log within 20 minutes."
-				});
-				deps.report(/* @__PURE__ */ new Error("[selfUpdate] update never reached a terminal state"));
-				rmSync(statePath);
-			} catch {}
-			clearInterval(timer);
-			reconcilerActive = false;
-		})();
-	}, POLL_MS);
-	timer.unref?.();
-}
-
-export { updateStatePath as a, findDeploymentDir as f, startUpdateOutcomeReconciler as s, updateLogPath as u };
-//# sourceMappingURL=selfUpdate.server.js-DVjJ-O6e.js.map

package/build/server/chunks/chunks/selfUpdate.server.js-DVjJ-O6e.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"selfUpdate.server.js-DVjJ-O6e.js","sources":["../../../../.svelte-kit/output/server/chunks/selfUpdate.server.js"],"sourcesContent":["import { F as renderThrown, f as getLogger } from \"./providers.server.js\";\nimport { t as deriveOutcome } from \"./update-outcome.js\";\nimport { join } from \"node:path\";\nimport { existsSync, readFileSync, rmSync } from \"node:fs\";\n//#region src/lib/server/selfUpdate.server.ts\n/**\n* Durable log/state paths for the update runner, plus post-restart\n* reconciliation of the update's outcome into the audit event log.\n*\n* The process that launches an update is killed mid-update (`pm2 stop\n* selva-compute` is a step of the update itself), so only the\n* `system.update.started` event can be emitted synchronously by the POST\n* handler. The terminal event (`finished` / `rolled_back` / `failed`) is\n* derived AFTER the app is back up: the POST persists a pending-update state\n* file next to the log, and the reconciler here polls the log until the\n* runner's `[EXIT] code=N` marker appears, classifies it via `deriveOutcome`,\n* emits the matching event, and consumes the state file. Kicked from both the\n* POST (covers the no-restart \"already up to date\" path) and the first request\n* after boot (covers the real update path, where the emitting process is new).\n*/\nfunction isDeploymentDir(dir) {\n\treturn existsSync(join(dir, \"node_modules\", \"@selvajs\", \"selva\", \"package.json\"));\n}\nfunction findDeploymentDir(env) {\n\tif (env.INSTALL_DIR && isDeploymentDir(env.INSTALL_DIR)) return env.INSTALL_DIR;\n\tlet dir = process.cwd();\n\tfor (let i = 0; i < 6; i++) {\n\t\tif (isDeploymentDir(dir)) return dir;\n\t\tconst parent = join(dir, \"..\");\n\t\tif (parent === dir) break;\n\t\tdir = parent;\n\t}\n\treturn null;\n}\n/**\n* Where the update runner mirrors all its output. Lives in the deployment dir\n* so it survives reboots; the `/tmp` fallback only applies outside a\n* deployment (dev), where no update can actually run.\n*/\nfunction updateLogPath(deploymentDir) {\n\treturn deploymentDir ? join(deploymentDir, \"selva-update.log\") : \"/tmp/selva-update.log\";\n}\n/** Pending-update marker consumed by the reconciler. Sits next to the log. */\nfunction updateStatePath(deploymentDir) {\n\treturn join(deploymentDir, \"selva-update-state.json\");\n}\n/**\n* One reconciliation attempt. Reads the pending-update state file; if the log\n* carries the runner's terminal `[EXIT] code=N` marker, classifies the outcome,\n* emits the terminal audit event, reports rollback/failure to the error\n* tracker, and deletes the state file (exactly-once across restarts — the\n* state file is the emission token).\n*/\nasync function reconcileUpdateOutcome(deps) {\n\tconst statePath = updateStatePath(deps.deploymentDir);\n\tlet state;\n\ttry {\n\t\tstate = JSON.parse(readFileSync(statePath, \"utf8\"));\n\t} catch {\n\t\treturn \"no_pending_update\";\n\t}\n\tlet logs = \"\";\n\ttry {\n\t\tlogs = readFileSync(updateLogPath(deps.deploymentDir), \"utf8\");\n\t} catch {}\n\tconst exitMatch = /\\[EXIT\\] code=(\\d+)/.exec(logs);\n\tif (!exitMatch) return \"still_running\";\n\tconst exitCode = Number(exitMatch[1]);\n\tconst outcome = deriveOutcome(exitCode, logs);\n\tconst base = {\n\t\tfromVersion: state.fromVersion ?? outcome.from,\n\t\ttoVersion: outcome.to,\n\t\tactorId: state.actorId\n\t};\n\tlet event;\n\tif (outcome.severity === \"critical\") event = {\n\t\ttype: \"system.update.failed\",\n\t\t...base,\n\t\tdetail: outcome.title\n\t};\n\telse if (exitCode === 5 || logs.includes(\"Rolled back\")) event = {\n\t\ttype: \"system.update.rolled_back\",\n\t\t...base,\n\t\tdetail: outcome.title\n\t};\n\telse if (outcome.severity === \"success\" || outcome.severity === \"info\") event = {\n\t\ttype: \"system.update.finished\",\n\t\t...base\n\t};\n\telse event = {\n\t\ttype: \"system.update.finished\",\n\t\t...base,\n\t\tdetail: outcome.title\n\t};\n\tawait deps.emit(event);\n\tif (event.type !== \"system.update.finished\") deps.report(/* @__PURE__ */ new Error(`[selfUpdate] ${outcome.title}`));\n\ttry {\n\t\trmSync(statePath);\n\t} catch {}\n\treturn \"reconciled\";\n}\nvar POLL_MS = 15e3;\nvar MAX_POLLS = 80;\nvar reconcilerActive = false;\n/**\n* Idempotent: safe to call on every boot and on every update POST — exits\n* immediately when no state file exists and never runs twice concurrently.\n*/\nfunction startUpdateOutcomeReconciler(deps) {\n\tif (reconcilerActive) return;\n\tif (!existsSync(updateStatePath(deps.deploymentDir))) return;\n\treconcilerActive = true;\n\tlet polls = 0;\n\tconst timer = setInterval(() => {\n\t\t(async () => {\n\t\t\tpolls += 1;\n\t\t\tlet result;\n\t\t\ttry {\n\t\t\t\tresult = await reconcileUpdateOutcome(deps);\n\t\t\t} catch (err) {\n\t\t\t\tgetLogger().error(\"Outcome reconciliation failed\", {\n\t\t\t\t\tcomponent: \"selfUpdate\",\n\t\t\t\t\terr: renderThrown(err)\n\t\t\t\t});\n\t\t\t\tresult = \"still_running\";\n\t\t\t}\n\t\t\tif (result === \"still_running\" && polls < MAX_POLLS) return;\n\t\t\tif (result === \"still_running\") try {\n\t\t\t\tconst statePath = updateStatePath(deps.deploymentDir);\n\t\t\t\tconst state = JSON.parse(readFileSync(statePath, \"utf8\"));\n\t\t\t\tawait deps.emit({\n\t\t\t\t\ttype: \"system.update.failed\",\n\t\t\t\t\tfromVersion: state.fromVersion,\n\t\t\t\t\tactorId: state.actorId,\n\t\t\t\t\tdetail: \"No terminal marker in the update log within 20 minutes.\"\n\t\t\t\t});\n\t\t\t\tdeps.report(/* @__PURE__ */ new Error(\"[selfUpdate] update never reached a terminal state\"));\n\t\t\t\trmSync(statePath);\n\t\t\t} catch {}\n\t\t\tclearInterval(timer);\n\t\t\treconcilerActive = false;\n\t\t})();\n\t}, POLL_MS);\n\ttimer.unref?.();\n}\n//#endregion\nexport { updateStatePath as i, startUpdateOutcomeReconciler as n, updateLogPath as r, findDeploymentDir as t };\n"],"names":[],"mappings":";;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,eAAe,CAAC,GAAG,EAAE;AAC9B,CAAC,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;AAClF;AACA,SAAS,iBAAiB,CAAC,GAAG,EAAE;AAChC,CAAC,IAAI,GAAG,CAAC,WAAW,IAAI,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,CAAC,WAAW;AAChF,CAAC,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;AACxB,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE;AAC7B,EAAE,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG;AACtC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC;AAChC,EAAE,IAAI,MAAM,KAAK,GAAG,EAAE;AACtB,EAAE,GAAG,GAAG,MAAM;AACd,CAAC;AACD,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,aAAa,EAAE;AACtC,CAAC,OAAO,aAAa,GAAG,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC,GAAG,uBAAuB;AACzF;AACA;AACA,SAAS,eAAe,CAAC,aAAa,EAAE;AACxC,CAAC,OAAO,IAAI,CAAC,aAAa,EAAE,yBAAyB,CAAC;AACtD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,sBAAsB,CAAC,IAAI,EAAE;AAC5C,CAAC,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC;AACtD,CAAC,IAAI,KAAK;AACV,CAAC,IAAI;AACL,EAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,mBAAmB;AAC5B,CAAC;AACD,CAAC,IAAI,IAAI,GAAG,EAAE;AACd,CAAC,IAAI;AACL,EAAE,IAAI,GAAG,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;AAChE,CAAC,CAAC,CAAC,MAAM,CAAC;AACV,CAAC,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;AACnD,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,eAAe;AACvC,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC;AAC9C,CAAC,MAAM,IAAI,GAAG;AACd,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,OAAO,CAAC,IAAI;AAChD,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE;AACvB,EAAE,OAAO,EAAE,KAAK,CAAC;AACjB,EAAE;AACF,CAAC,IAAI,KAAK;AACV,CAAC,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU,EAAE,KAAK,GAAG;AAC9C,EAAE,IAAI,EAAE,sBAAsB;AAC9B,EAAE,GAAG,IAAI;AACT,EAAE,MAAM,EAAE,OAAO,CAAC;AAClB,EAAE;AACF,MAAM,IAAI,QAAQ,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,KAAK,GAAG;AAClE,EAAE,IAAI,EAAE,2BAA2B;AACnC,EAAE,GAAG,IAAI;AACT,EAAE,MAAM,EAAE,OAAO,CAAC;AAClB,EAAE;AACF,MAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,EAAE,KAAK,GAAG;AACjF,EAAE,IAAI,EAAE,wBAAwB;AAChC,EAAE,GAAG;AACL,EAAE;AACF,MAAM,KAAK,GAAG;AACd,EAAE,IAAI,EAAE,wBAAwB;AAChC,EAAE,GAAG,IAAI;AACT,EAAE,MAAM,EAAE,OAAO,CAAC;AAClB,EAAE;AACF,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;AACvB,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,wBAAwB,EAAE,IAAI,CAAC,MAAM,iBAAiB,IAAI,KAAK,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACrH,CAAC,IAAI;AACL,EAAE,MAAM,CAAC,SAAS,CAAC;AACnB,CAAC,CAAC,CAAC,MAAM,CAAC;AACV,CAAC,OAAO,YAAY;AACpB;AACA,IAAI,OAAO,GAAG,IAAI;AAClB,IAAI,SAAS,GAAG,EAAE;AAClB,IAAI,gBAAgB,GAAG,KAAK;AAC5B;AACA;AACA;AACA;AACA,SAAS,4BAA4B,CAAC,IAAI,EAAE;AAC5C,CAAC,IAAI,gBAAgB,EAAE;AACvB,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE;AACvD,CAAC,gBAAgB,GAAG,IAAI;AACxB,CAAC,IAAI,KAAK,GAAG,CAAC;AACd,CAAC,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM;AACjC,EAAE,CAAC,YAAY;AACf,GAAG,KAAK,IAAI,CAAC;AACb,GAAG,IAAI,MAAM;AACb,GAAG,IAAI;AACP,IAAI,MAAM,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC;AAC/C,GAAG,CAAC,CAAC,OAAO,GAAG,EAAE;AACjB,IAAI,SAAS,EAAE,CAAC,KAAK,CAAC,+BAA+B,EAAE;AACvD,KAAK,SAAS,EAAE,YAAY;AAC5B,KAAK,GAAG,EAAE,YAAY,CAAC,GAAG;AAC1B,KAAK,CAAC;AACN,IAAI,MAAM,GAAG,eAAe;AAC5B,GAAG;AACH,GAAG,IAAI,MAAM,KAAK,eAAe,IAAI,KAAK,GAAG,SAAS,EAAE;AACxD,GAAG,IAAI,MAAM,KAAK,eAAe,EAAE,IAAI;AACvC,IAAI,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC;AACzD,IAAI,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AAC7D,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC;AACpB,KAAK,IAAI,EAAE,sBAAsB;AACjC,KAAK,WAAW,EAAE,KAAK,CAAC,WAAW;AACnC,KAAK,OAAO,EAAE,KAAK,CAAC,OAAO;AAC3B,KAAK,MAAM,EAAE;AACb,KAAK,CAAC;AACN,IAAI,IAAI,CAAC,MAAM,iBAAiB,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;AAChG,IAAI,MAAM,CAAC,SAAS,CAAC;AACrB,GAAG,CAAC,CAAC,MAAM,CAAC;AACZ,GAAG,aAAa,CAAC,KAAK,CAAC;AACvB,GAAG,gBAAgB,GAAG,KAAK;AAC3B,EAAE,CAAC,GAAG;AACN,CAAC,CAAC,EAAE,OAAO,CAAC;AACZ,CAAC,KAAK,CAAC,KAAK,IAAI;AAChB;;;;"}

package/build/server/chunks/chunks/serverConfigWrite.js-BbjK9tr4.js

@@ -1,116 +0,0 @@
-import { a as apiError, A as ApiErrorCode } from './api-errors.js-D-tV7sBR.js';
-import { e as evictComputeClient } from './engine.server.js-BkCqJs2J.js';
-import { i as isLinkLocalUrl } from './compute.js-B08Flkxe.js';
-
-//#region src/lib/server/compute/evictChangedServers.ts
-/**
-* The client cache keys on server `id`, so a rotated `serverUrl`/`apiKey` keeps
-* the same key with stale connection details — it won't age out on its own. The
-* config-write path must evict explicitly: this diffs the previous scoped server
-* set against the next one and drops the warm client for every server whose
-* connection details changed or that was removed. Unchanged servers are untouched.
-*/
-/**
-* `prev` and `next` are the scoped server sets before/after the write.
-*/
-function evictChangedServers(prev, next) {
-	const nextById = new Map(next.map((s) => [s.id, s]));
-	for (const before of prev) if (!nextById.has(before.id)) evictComputeClient(before.id);
-	const prevById = new Map(prev.map((s) => [s.id, s]));
-	for (const after of next) {
-		const before = prevById.get(after.id);
-		if (before && (before.serverUrl !== after.serverUrl || before.apiKey !== after.apiKey)) evictComputeClient(after.id);
-	}
-}
-//#endregion
-//#region src/lib/server/compute/serverConfigWrite.ts
-/**
-* Shared write-path rules for compute server config.
-*
-* Two routes accept a server set: `/api/admin/compute` (platform scope,
-* `manage_compute`) and `/api/v1/orgs/{orgId}/compute` (org scope,
-* `manage_org_compute`). They differ in who may call them, what extra fields
-* they carry (`sharedWith` vs `ownerOrgId`), and how they validate the default
-* selection — but the field validation and the apiKey merge below must behave
-* identically in both, so they live here rather than in either handler.
-*
-* The apiKey merge is why this file exists: if the two copies disagree, a
-* stored credential silently gets cleared or leaked, and nothing fails at
-* build time.
-*/
-/**
-* A stored `serverUrl` is fetched server-side on every status probe, every
-* purge/shutdown action, and every solve, so an unfiltered one is an SSRF
-* primitive handed to whoever holds `manage_compute`. Two rules:
-*
-*   - Scheme allowlist: `http`/`https`. `file:`, `gopher:` and friends are never
-*     a Rhino.Compute endpoint.
-*   - Link-local (`169.254.0.0/16`) is refused. That range carries the cloud
-*     metadata service at `169.254.169.254`, which hands out the host's own IAM
-*     credentials to anything running on the box.
-*
-* **Loopback and RFC1918 are deliberately allowed.** Running compute on
-* `localhost:6500` or a LAN box is the ordinary self-hosted layout, not an
-* attack — most deployments reach their compute server over exactly those
-* addresses. Blocking them by default would break those instances on upgrade
-* and push every operator toward an opt-out flag, and a guard that everyone
-* disables protects nobody. So the check is narrowed to the range where no
-* legitimate compute server ever lives.
-*
-* What this does not stop: a privileged admin pointing the app at an internal
-* host to probe it. That is a real but much weaker concern than credential
-* theft, it needs `manage_compute` already, and it is inseparable from the
-* legitimate case. Revisit if `manage_org_compute` is ever delegated widely on
-* a multi-tenant instance.
-*
-* `isLinkLocalUrl` is reused rather than hand-rolled because a string compare
-* against `169.254.169.254` misses the encodings that reach the same address:
-* `http://2852039166/`, `http://0xa9fea9fe/`, `http://0251.0376.0251.0376/`.
-*/
-function assertUsableServerUrl(serverUrl) {
-	let parsed;
-	try {
-		parsed = new URL(serverUrl);
-	} catch {
-		apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid serverUrl: ${serverUrl}`);
-	}
-	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") apiError(400, ApiErrorCode.VALIDATION_FAILED, `serverUrl must use http or https: ${serverUrl}`);
-	if (isLinkLocalUrl(serverUrl)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `serverUrl points at the link-local range, which carries the cloud metadata service: ${serverUrl}`);
-}
-/**
-* Validates the scope-independent fields of every submitted server. Throws the
-* first failure as a 400; scope-specific fields (`sharedWith`, `ownerOrgId`)
-* are the caller's business.
-*/
-function validateIncomingServers(servers) {
-	for (const s of servers) {
-		if (!s.id || typeof s.id !== "string") apiError(400, ApiErrorCode.VALIDATION_FAILED, "Each server needs an id");
-		if (!s.label || typeof s.label !== "string") apiError(400, ApiErrorCode.VALIDATION_FAILED, "Each server needs a label");
-		if (!s.serverUrl || typeof s.serverUrl !== "string") apiError(400, ApiErrorCode.VALIDATION_FAILED, "Each server needs a serverUrl");
-		assertUsableServerUrl(s.serverUrl);
-		if (s.apiKey !== void 0 && s.apiKey !== null && typeof s.apiKey !== "string") apiError(400, ApiErrorCode.VALIDATION_FAILED, "apiKey must be a string, null, or omitted");
-	}
-}
-/**
-* The UI never receives stored keys — it sends back `hasApiKey` and omits the
-* field for servers the operator didn't touch. So "omitted" cannot mean "clear":
-* it has to preserve, or every save through the settings form would wipe the
-* keys of every server the operator left alone. Clearing is explicit (`null`);
-* an empty string is treated as "not provided" since that's what an untouched
-* password input submits.
-*/
-function resolveApiKey(submitted, storedKey) {
-	if (submitted === null) return void 0;
-	return submitted ? submitted : storedKey;
-}
-/**
-* Builds the id → stored-key lookup the merge reads. The caller passes only the
-* servers in its own scope, so one scope's write can never resolve a key from
-* another's rows.
-*/
-function storedKeysById(scopedServers) {
-	return new Map(scopedServers.map((s) => [s.id, s.apiKey]));
-}
-
-export { evictChangedServers as e, resolveApiKey as r, storedKeysById as s, validateIncomingServers as v };
-//# sourceMappingURL=serverConfigWrite.js-BbjK9tr4.js.map

package/build/server/chunks/chunks/serverConfigWrite.js-BbjK9tr4.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"serverConfigWrite.js-BbjK9tr4.js","sources":["../../../../.svelte-kit/output/server/chunks/serverConfigWrite.js"],"sourcesContent":["import { n as apiError, t as ApiErrorCode } from \"./api-errors.js\";\nimport { i as evictComputeClient } from \"./engine.server.js\";\nimport { n as isLinkLocalUrl } from \"./compute.js\";\n//#region src/lib/server/compute/evictChangedServers.ts\n/**\n* The client cache keys on server `id`, so a rotated `serverUrl`/`apiKey` keeps\n* the same key with stale connection details — it won't age out on its own. The\n* config-write path must evict explicitly: this diffs the previous scoped server\n* set against the next one and drops the warm client for every server whose\n* connection details changed or that was removed. Unchanged servers are untouched.\n*/\n/**\n* `prev` and `next` are the scoped server sets before/after the write.\n*/\nfunction evictChangedServers(prev, next) {\n\tconst nextById = new Map(next.map((s) => [s.id, s]));\n\tfor (const before of prev) if (!nextById.has(before.id)) evictComputeClient(before.id);\n\tconst prevById = new Map(prev.map((s) => [s.id, s]));\n\tfor (const after of next) {\n\t\tconst before = prevById.get(after.id);\n\t\tif (before && (before.serverUrl !== after.serverUrl || before.apiKey !== after.apiKey)) evictComputeClient(after.id);\n\t}\n}\n//#endregion\n//#region src/lib/server/compute/serverConfigWrite.ts\n/**\n* Shared write-path rules for compute server config.\n*\n* Two routes accept a server set: `/api/admin/compute` (platform scope,\n* `manage_compute`) and `/api/v1/orgs/{orgId}/compute` (org scope,\n* `manage_org_compute`). They differ in who may call them, what extra fields\n* they carry (`sharedWith` vs `ownerOrgId`), and how they validate the default\n* selection — but the field validation and the apiKey merge below must behave\n* identically in both, so they live here rather than in either handler.\n*\n* The apiKey merge is why this file exists: if the two copies disagree, a\n* stored credential silently gets cleared or leaked, and nothing fails at\n* build time.\n*/\n/**\n* A stored `serverUrl` is fetched server-side on every status probe, every\n* purge/shutdown action, and every solve, so an unfiltered one is an SSRF\n* primitive handed to whoever holds `manage_compute`. Two rules:\n*\n*   - Scheme allowlist: `http`/`https`. `file:`, `gopher:` and friends are never\n*     a Rhino.Compute endpoint.\n*   - Link-local (`169.254.0.0/16`) is refused. That range carries the cloud\n*     metadata service at `169.254.169.254`, which hands out the host's own IAM\n*     credentials to anything running on the box.\n*\n* **Loopback and RFC1918 are deliberately allowed.** Running compute on\n* `localhost:6500` or a LAN box is the ordinary self-hosted layout, not an\n* attack — most deployments reach their compute server over exactly those\n* addresses. Blocking them by default would break those instances on upgrade\n* and push every operator toward an opt-out flag, and a guard that everyone\n* disables protects nobody. So the check is narrowed to the range where no\n* legitimate compute server ever lives.\n*\n* What this does not stop: a privileged admin pointing the app at an internal\n* host to probe it. That is a real but much weaker concern than credential\n* theft, it needs `manage_compute` already, and it is inseparable from the\n* legitimate case. Revisit if `manage_org_compute` is ever delegated widely on\n* a multi-tenant instance.\n*\n* `isLinkLocalUrl` is reused rather than hand-rolled because a string compare\n* against `169.254.169.254` misses the encodings that reach the same address:\n* `http://2852039166/`, `http://0xa9fea9fe/`, `http://0251.0376.0251.0376/`.\n*/\nfunction assertUsableServerUrl(serverUrl) {\n\tlet parsed;\n\ttry {\n\t\tparsed = new URL(serverUrl);\n\t} catch {\n\t\tapiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid serverUrl: ${serverUrl}`);\n\t}\n\tif (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") apiError(400, ApiErrorCode.VALIDATION_FAILED, `serverUrl must use http or https: ${serverUrl}`);\n\tif (isLinkLocalUrl(serverUrl)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `serverUrl points at the link-local range, which carries the cloud metadata service: ${serverUrl}`);\n}\n/**\n* Validates the scope-independent fields of every submitted server. Throws the\n* first failure as a 400; scope-specific fields (`sharedWith`, `ownerOrgId`)\n* are the caller's business.\n*/\nfunction validateIncomingServers(servers) {\n\tfor (const s of servers) {\n\t\tif (!s.id || typeof s.id !== \"string\") apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Each server needs an id\");\n\t\tif (!s.label || typeof s.label !== \"string\") apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Each server needs a label\");\n\t\tif (!s.serverUrl || typeof s.serverUrl !== \"string\") apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Each server needs a serverUrl\");\n\t\tassertUsableServerUrl(s.serverUrl);\n\t\tif (s.apiKey !== void 0 && s.apiKey !== null && typeof s.apiKey !== \"string\") apiError(400, ApiErrorCode.VALIDATION_FAILED, \"apiKey must be a string, null, or omitted\");\n\t}\n}\n/**\n* The UI never receives stored keys — it sends back `hasApiKey` and omits the\n* field for servers the operator didn't touch. So \"omitted\" cannot mean \"clear\":\n* it has to preserve, or every save through the settings form would wipe the\n* keys of every server the operator left alone. Clearing is explicit (`null`);\n* an empty string is treated as \"not provided\" since that's what an untouched\n* password input submits.\n*/\nfunction resolveApiKey(submitted, storedKey) {\n\tif (submitted === null) return void 0;\n\treturn submitted ? submitted : storedKey;\n}\n/**\n* Builds the id → stored-key lookup the merge reads. The caller passes only the\n* servers in its own scope, so one scope's write can never resolve a key from\n* another's rows.\n*/\nfunction storedKeysById(scopedServers) {\n\treturn new Map(scopedServers.map((s) => [s.id, s.apiKey]));\n}\n//#endregion\nexport { evictChangedServers as i, storedKeysById as n, validateIncomingServers as r, resolveApiKey as t };\n"],"names":[],"mappings":";;;;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE;AACzC,CAAC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;AACvF,CAAC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE;AAC3B,EAAE,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;AACvC,EAAE,IAAI,MAAM,KAAK,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;AACtH,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,SAAS,EAAE;AAC1C,CAAC,IAAI,MAAM;AACX,CAAC,IAAI;AACL,EAAE,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC;AAC7B,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC,CAAC;AAClF,CAAC;AACD,CAAC,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,kCAAkC,EAAE,SAAS,CAAC,CAAC,CAAC;AACjK,CAAC,IAAI,cAAc,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,oFAAoF,EAAE,SAAS,CAAC,CAAC,CAAC;AACjL;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,uBAAuB,CAAC,OAAO,EAAE;AAC1C,CAAC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE;AAC1B,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,yBAAyB,CAAC;AACjH,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,2BAA2B,CAAC;AACzH,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,+BAA+B,CAAC;AACrI,EAAE,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC;AACpC,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,2CAA2C,CAAC;AAC1K,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE;AAC7C,CAAC,IAAI,SAAS,KAAK,IAAI,EAAE,OAAO,MAAM;AACtC,CAAC,OAAO,SAAS,GAAG,SAAS,GAAG,SAAS;AACzC;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,aAAa,EAAE;AACvC,CAAC,OAAO,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3D;;;;"}

package/build/server/chunks/chunks/solve.server.js-BDmbQZi6.js

@@ -1,300 +0,0 @@
-import { A as getStorageProvider, p as providers, r as renderThrown, K as fetchSchemaFromCompute, M as getSolveMetricSink, x as lazyLogger } from './providers.server.js-CGtbhqJ3.js';
-import { o as requireCanEditDefinition, f as requireCanSolve } from './access.server.js-Fg4zaw5v.js';
-import { a as apiError, A as ApiErrorCode, r as resolveServerForOrg, C as ComputeServerUnconfiguredError } from './api-errors.js-D-tV7sBR.js';
-import { a as engine, C as COMPUTE_DEBUG } from './engine.server.js-BkCqJs2J.js';
-import { h as createComputeRateLimiter } from './admin-auth.server.js-DsArAgnk.js';
-import { c as createRemoteDefinitionFetcher } from './compute.js-B08Flkxe.js';
-import { h as RATE_LIMIT_MAX_REQUESTS, i as RATE_LIMIT_WINDOW_MS, R as REMOTE_DEFINITION_CACHE_TTL_MS, b as REMOTE_DEFINITION_FETCH_TIMEOUT_MS, d as REMOTE_DEFINITION_MAX_BYTES } from './computeLimits.js-DSmUJ5Af.js';
-import { isHttpError } from '@sveltejs/kit';
-
-//#region src/lib/server/compute/remoteDefinition.server.ts
-/**
-* App-wide instance of the remote-definition fetcher (SSRF guard, size cap,
-* deadline, TTL cache all live in `@selvajs/server`'s `createRemoteDefinitionFetcher`).
-*/
-var fetcher = createRemoteDefinitionFetcher({
-	maxBytes: REMOTE_DEFINITION_MAX_BYTES,
-	fetchTimeoutMs: REMOTE_DEFINITION_FETCH_TIMEOUT_MS,
-	cacheTtlMs: REMOTE_DEFINITION_CACHE_TTL_MS,
-	now: () => Date.now(),
-	logger: lazyLogger
-});
-/** Fetch (or return cached) remote `.gh` bytes. Throws on unsafe host / oversized / timeout. */
-function loadRemoteDefinition(url) {
-	return fetcher.load(url);
-}
-//#endregion
-//#region src/lib/server/computeRateLimit.server.ts
-/**
-* App-wide instance of the compute-solve rate limiter (fixed-window, per-key,
-* process-local; `@selvajs/server`'s `createComputeRateLimiter`), wired with the
-* window + cap from `computeLimits.ts`.
-*
-* Keyed by caller — `user:{userId}` for authenticated solves, `share:{linkId}`
-* for share-token solves so anonymous consumers of one link don't share a
-* bucket with the link's owner.
-*/
-var limiter = createComputeRateLimiter({
-	windowMs: RATE_LIMIT_WINDOW_MS,
-	maxPerWindow: RATE_LIMIT_MAX_REQUESTS
-});
-/** Returns `{ allowed: false, retryAfter }` once the bucket for `key` is full. */
-function checkComputeRateLimit(key) {
-	return limiter.check(key);
-}
-//#endregion
-//#region src/lib/server/compute/solve.server.ts
-/**
-* The body-independent core of a solve request, shared by `POST /api/v1/compute`
-* (share-token and remote-URL capable) and `POST /api/v1/definitions/{guid}/solve`
-* (tenant-scoped, cookie or PAT).
-*
-* **Share-token resolution stays outside this module, in the route.** The caller
-* hands in an already-decided `SolveAccess`; the definition-addressed route only
-* ever constructs the `user` variant, so it cannot inherit the anonymous branch
-* by accident. Adding a token lookup here would silently give it one.
-*
-* What lives here: rate limiting, definition/version resolution, access checks,
-* compute-server routing, schema backfill, the engine call, metric recording, the
-* debug breakdown. What stays in a route: parsing its own body shape and deciding
-* who the caller is.
-*/
-/**
-* Run a solve and return the HTTP response.
-*
-* Throws `HttpError` (via `apiError`) for every refusal, and lets engine/network
-* failures propagate for the caller's outer catch to map — the two routes share
-* that mapping through `mapSolveError`.
-*/
-async function runSolve(params) {
-	const { access, definitionUrl, inputs, values, channel, versionId: explicitVersionId, request, locals, loadStart, prepMarks, concealAccessFailure = false } = params;
-	const storage = getStorageProvider();
-	const sharedAccess = access.kind === "share" ? access : null;
-	const solveCtx = access.ctx;
-	let prevMark = performance.now();
-	const mark = (label) => {
-		prepMarks.push([label, performance.now() - prevMark]);
-		prevMark = performance.now();
-	};
-	let definitionSource;
-	let localDefinitionRef = null;
-	let localVersionForBackfill = null;
-	let solveOrgId = null;
-	let definitionPin = null;
-	let metricDefinitionId = null;
-	let metricVersionId = null;
-	const isLocal = definitionUrl.startsWith("local:");
-	const guid = isLocal ? definitionUrl.substring(6) : null;
-	const recordMetric = (failureKind, extra = {}) => {
-		getSolveMetricSink().record(solveCtx, {
-			definitionUrl,
-			definitionId: metricDefinitionId,
-			versionId: metricVersionId,
-			channel,
-			orgId: solveOrgId,
-			durationMs: extra.durationMs ?? 0,
-			ok: failureKind === "ok",
-			failureKind,
-			errorCount: extra.errorCount ?? 0,
-			warningCount: extra.warningCount ?? 0
-		}).catch((err) => locals.log.error("Solve-metric record failed", {
-			component: "API/Compute",
-			err: renderThrown(err)
-		}));
-	};
-	const rateLimit = checkComputeRateLimit(access.rateLimitKey);
-	if (!rateLimit.allowed) {
-		recordMetric("rate_limited");
-		const retryAfter = rateLimit.retryAfter ?? 1;
-		return new Response(JSON.stringify({
-			message: `Too many compute requests. Retry in ${retryAfter}s.`,
-			retryAfter
-		}), {
-			status: 429,
-			headers: {
-				"Content-Type": "application/json",
-				"Retry-After": String(retryAfter)
-			}
-		});
-	}
-	if (isLocal && guid) {
-		let record;
-		try {
-			record = await providers.data.definitions.get(solveCtx, guid);
-		} catch (err) {
-			locals.log.error("Failed to load local definition", {
-				component: "API/Compute",
-				guid,
-				err: renderThrown(err)
-			});
-			apiError(404, ApiErrorCode.NOT_FOUND, `Definition '${guid}' not found`);
-		}
-		if (!record) apiError(404, ApiErrorCode.NOT_FOUND, `Definition '${guid}' not found`);
-		mark("defRecord");
-		const project = await providers.data.projects.getProject(solveCtx, record.projectId);
-		solveOrgId = project?.orgId ?? null;
-		definitionPin = record.computeServerId ?? null;
-		mark("project");
-		if (!sharedAccess) try {
-			if (channel === "draft" || explicitVersionId) await requireCanEditDefinition(locals, record.projectId, guid, {
-				project,
-				definition: record
-			});
-			else await requireCanSolve(locals, record.projectId, project ?? void 0);
-		} catch (err) {
-			if (concealAccessFailure && isHttpError(err) && err.status === 403) apiError(404, ApiErrorCode.NOT_FOUND, `Definition '${guid}' not found`);
-			throw err;
-		}
-		mark("access");
-		const versionId = explicitVersionId ?? (channel === "live" ? record.liveVersionId : record.draftVersionId);
-		if (!versionId) apiError(404, ApiErrorCode.NOT_FOUND, `Definition '${guid}' has no ${channel} version yet`);
-		const version = await providers.data.definitions.getVersion(solveCtx, versionId);
-		if (!version || version.definitionId !== guid) apiError(404, ApiErrorCode.NOT_FOUND, `Definition '${guid}' version is missing`);
-		localVersionForBackfill = {
-			id: version.id,
-			hasSchema: version.schema !== void 0
-		};
-		metricDefinitionId = guid;
-		metricVersionId = version.id;
-		mark("version");
-		localDefinitionRef = engine.definitionRef(version.id, async () => {
-			const bytes = await storage.get(version.fileKey);
-			if (!bytes) throw new Error(`Version blob missing: ${version.fileKey}`);
-			return bytes;
-		});
-		definitionSource = localDefinitionRef;
-		mark("blob");
-	} else {
-		try {
-			definitionSource = await loadRemoteDefinition(definitionUrl);
-		} catch (err) {
-			locals.log.error("Failed to fetch remote definition", {
-				component: "API/Compute",
-				definitionUrl,
-				err: renderThrown(err)
-			});
-			apiError(400, ApiErrorCode.VALIDATION_FAILED, `Failed to load definition: ${err instanceof Error ? err.message : String(err)}`);
-		}
-		mark("remoteDef");
-	}
-	const defLoadMs = performance.now() - loadStart;
-	if (sharedAccess) {
-		if (await providers.data.shareLinks.tryIncrementSolveCount(solveCtx, sharedAccess.link.id) === null) {
-			recordMetric("share_cap");
-			apiError(429, ApiErrorCode.INTERNAL, "Share link solve cap reached.");
-		}
-		mark("shareCap");
-	}
-	const serverConfig = await resolveServerForOrg(solveCtx, solveOrgId, { definitionPin });
-	mark("resolveServer");
-	if (localVersionForBackfill && !localVersionForBackfill.hasSchema && localDefinitionRef) {
-		const versionId = localVersionForBackfill.id;
-		try {
-			const bytes = await localDefinitionRef.load();
-			const schema = await fetchSchemaFromCompute(bytes, serverConfig);
-			await providers.data.definitions.setVersionSchema(solveCtx, versionId, schema);
-		} catch (err) {
-			locals.log.warn("Schema backfill failed", {
-				component: "API/Compute",
-				versionId,
-				err: renderThrown(err)
-			});
-		}
-		mark("schemaBackfill");
-	}
-	const outcome = await engine.solve({
-		server: serverConfig,
-		definitionSource,
-		definitionKey: isLocal ? void 0 : definitionUrl,
-		inputs,
-		values,
-		signal: request.signal,
-		acceptEncoding: request.headers.get("accept-encoding") ?? "",
-		definitionGuid: guid ?? void 0,
-		loadStartMs: loadStart,
-		defLoadMs,
-		prepMarks
-	});
-	mark("solve");
-	if (outcome.kind === "timeout") recordMetric("timeout", { durationMs: outcome.durationMs });
-	else if (outcome.kind === "client_abort") recordMetric("client_abort", { durationMs: outcome.durationMs });
-	else if (outcome.kind === "too_large") recordMetric("too_large");
-	else if (outcome.kind === "shed") recordMetric("shed", { durationMs: outcome.durationMs });
-	else if (outcome.kind === "ok") {
-		recordMetric("ok", {
-			durationMs: outcome.solveMs,
-			errorCount: outcome.errorCount,
-			warningCount: outcome.warningCount
-		});
-		if (metricDefinitionId) providers.data.definitions.incrementSolveCount(solveCtx, metricDefinitionId).catch((err) => locals.log.warn("solveCount increment failed", {
-			component: "API/Compute",
-			definitionId: metricDefinitionId,
-			err: renderThrown(err)
-		}));
-		if (COMPUTE_DEBUG) logDebugBreakdown(locals, request, outcome, defLoadMs, prepMarks);
-	}
-	return engine.toWebResponse(outcome);
-}
-/**
-* Both solve routes share this so they cannot drift on which failures read as
-* "compute is down" (503) versus a server bug (500).
-*/
-function mapSolveError(err, locals) {
-	if (isHttpError(err)) throw err;
-	if (err instanceof ComputeServerUnconfiguredError) apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, err.message);
-	const message = err instanceof Error ? err.message : "Unknown error";
-	locals.log.error("Solve request failed", {
-		component: "API/Compute",
-		err: renderThrown(err)
-	});
-	if (err instanceof TypeError && message === "fetch failed") apiError(503, ApiErrorCode.COMPUTE_UNAVAILABLE, "Compute server is unreachable");
-	apiError(500, ApiErrorCode.INTERNAL, message);
-}
-/**
-* DEBUG (SELVA_FLAG_COMPUTE_DEBUG): the server-side overhead the solve metric's
-* `durationMs` doesn't capture. `load` = auth + DB + definition fetch; `tree` =
-* input tree build; `serialize` = JSON.stringify of the result.
-*/
-function logDebugBreakdown(locals, request, outcome, defLoadMs, prepMarks) {
-	const { metrics } = outcome.envelope;
-	locals.log.debug("Solve server-side phase breakdown", {
-		component: "Compute/server",
-		loadMs: Math.round(defLoadMs),
-		treeBuildMs: Math.round(metrics.treeBuildMs),
-		solveMs: Math.round(metrics.solveMs),
-		serializeMs: Math.round(metrics.serializeMs),
-		gzipMs: Math.round(metrics.gzipMs),
-		serverTotalMs: Math.round(metrics.serverTotalMs),
-		serializedBytes: metrics.serializedBytes
-	});
-	if (metrics.compressedBytes !== null) locals.log.debug("Response gzipped", {
-		component: "Compute/server",
-		serializedBytes: metrics.serializedBytes,
-		compressedBytes: metrics.compressedBytes,
-		ratio: Number((metrics.serializedBytes / metrics.compressedBytes).toFixed(1))
-	});
-	else {
-		const acceptEncoding = request.headers.get("accept-encoding") ?? "";
-		locals.log.debug("Compression skipped", {
-			component: "Compute/server",
-			acceptEncoding,
-			hasAcceptEncoding: acceptEncoding !== ""
-		});
-	}
-	locals.log.debug("Prep breakdown", {
-		component: "Compute/server",
-		...Object.fromEntries(prepMarks.map(([label, ms]) => [`p_${label}Ms`, Math.round(ms)]))
-	});
-	const db = engine.stats().definitionBytes;
-	locals.log.debug("Definition byte-cache counters", {
-		component: "Compute/def-bytes",
-		hits: db.hits,
-		misses: db.misses,
-		evictions: db.evictions,
-		entries: db.entries,
-		retainedBytes: db.bytes
-	});
-}
-
-export { mapSolveError as m, runSolve as r };
-//# sourceMappingURL=solve.server.js-BDmbQZi6.js.map