@selvajs/selva 4.20.0-beta.1 → 4.20.0-beta.3

package/build/server/chunks/chunks/request.js-pcyvnviG.js

@@ -0,0 +1,119 @@
+import { a as apiError, A as ApiErrorCode } from './schema-extraction.js-_C5meGta.js';
+
+//#region ../server/src/api/request.ts
+/**
+* The authenticated caller, or a 401.
+*
+* `ctx` and `user` are optional on `ApiRequest` because a host builds one for
+* anonymous requests too (share-token solves reach handlers with a `ctx` and no
+* `user`). Every handler that needs an identity narrows it here rather than
+* asserting the fields non-null, so the unauthenticated path fails as a denial
+* instead of a crash.
+*/
+function requireCaller(req) {
+	if (!req.ctx || !req.user) apiError(401, ApiErrorCode.UNAUTHORIZED, "Unauthorized");
+	return {
+		ctx: req.ctx,
+		user: req.user
+	};
+}
+/**
+* Fail with a Zod error's messages, one per field.
+*
+* The top-level `message` names the first problem so a human reading the
+* response learns something without parsing `fields`.
+*/
+function throwZodError(err) {
+	const fields = {};
+	for (const issue of err.issues) {
+		const key = issue.path.length ? issue.path.join(".") : "_";
+		if (!(key in fields)) fields[key] = issue.message;
+	}
+	const first = err.issues[0];
+	const path = first.path.length ? `${first.path.join(".")}: ` : "";
+	apiError(400, ApiErrorCode.VALIDATION_FAILED, `${path}${first.message}`, fields);
+}
+/**
+* Read required path params, 400ing on any that is missing or blank.
+*
+* A router types every param as `string`, but a route can be reached with an
+* empty segment — this catches that instead of letting a stale non-null
+* assertion paper over it.
+*
+* Does **not** validate format — a guid-shaped param still goes through a
+* schema where the route cares. Replaces the `if (!id) apiError(...)` preamble,
+* not the schema check.
+*/
+function requireParams(params, ...names) {
+	const out = {};
+	const missing = [];
+	for (const name of names) {
+		const value = params[name];
+		if (!value) {
+			missing.push(name);
+			continue;
+		}
+		out[name] = value;
+	}
+	if (missing.length) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Missing path parameter${missing.length > 1 ? "s" : ""}: ${missing.join(", ")}`);
+	return out;
+}
+/**
+* Read a path param through a Zod schema, 400ing on a bad value.
+*
+* The format-checking counterpart to `requireParams` — for guids, enum-shaped
+* segments, anything where "present" isn't the same as "valid".
+*/
+function parseParam(value, schema, name) {
+	const parsed = schema.safeParse(value);
+	if (!parsed.success) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid or missing ${name}`);
+	return parsed.data;
+}
+/**
+* Parse and validate a JSON body. A malformed body becomes `null` rather than
+* throwing, so it fails the schema as a validation error — broken JSON gets a
+* 400 naming the problem, not a 500 from `request.json()`.
+*
+* `missingAs` covers endpoints whose fields are all optional: passing `{}` lets
+* an empty body mean "no changes" instead of a validation failure.
+*/
+async function parseBody(request, schema, { missingAs } = {}) {
+	const raw = await request.json().catch(() => null);
+	const parsed = schema.safeParse(raw ?? missingAs ?? null);
+	if (!parsed.success) throwZodError(parsed.error);
+	return parsed.data;
+}
+/**
+* Pull a required file out of a multipart body and check its size and, where
+* given, its extension.
+*
+* A second line of defence, not the first: a host's body-size guard should
+* reject an oversized request before it is buffered. This catches a file that
+* is individually too large inside a request that isn't.
+*
+* Caps are passed in rather than read here — they are deployment config, and a
+* package that resolved them would pin every host to one source of truth.
+*/
+function requireUpload(form, field, { maxBytes, extensions, contentTypes, label = "File" }) {
+	const file = form.get(field);
+	if (!(file instanceof File) || file.size === 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, `A ${label.toLowerCase()} is required`);
+	const extension = file.name.slice(file.name.lastIndexOf(".")).toLowerCase();
+	if (extensions && !extensions.includes(extension)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `File type not allowed. Allowed: ${extensions.join(", ")}`);
+	if (contentTypes && !contentTypes.allowed.has(file.type)) apiError(400, ApiErrorCode.VALIDATION_FAILED, contentTypes.message);
+	if (file.size > maxBytes) apiError(400, ApiErrorCode.VALIDATION_FAILED, `${label} too large. Max size: ${maxBytes / 1048576} MB`);
+	return {
+		file,
+		extension
+	};
+}
+/** A multipart text field, trimmed and length-capped. Absent stays `undefined`. */
+function formText(form, field, { maxLength } = {}) {
+	const raw = form.get(field);
+	if (typeof raw !== "string") return void 0;
+	const trimmed = raw.trim();
+	if (!trimmed) return void 0;
+	return maxLength ? trimmed.slice(0, maxLength) : trimmed;
+}
+
+export { requireCaller as a, requireUpload as b, parseParam as c, formText as f, parseBody as p, requireParams as r, throwZodError as t };
+//# sourceMappingURL=request.js-pcyvnviG.js.map

package/build/server/chunks/chunks/request.js-pcyvnviG.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.js-pcyvnviG.js","sources":["../../../../.svelte-kit/output/server/chunks/request.js"],"sourcesContent":["import { d as apiError, u as ApiErrorCode } from \"./schema-extraction.js\";\n//#region ../server/src/api/request.ts\n/**\n* The authenticated caller, or a 401.\n*\n* `ctx` and `user` are optional on `ApiRequest` because a host builds one for\n* anonymous requests too (share-token solves reach handlers with a `ctx` and no\n* `user`). Every handler that needs an identity narrows it here rather than\n* asserting the fields non-null, so the unauthenticated path fails as a denial\n* instead of a crash.\n*/\nfunction requireCaller(req) {\n\tif (!req.ctx || !req.user) apiError(401, ApiErrorCode.UNAUTHORIZED, \"Unauthorized\");\n\treturn {\n\t\tctx: req.ctx,\n\t\tuser: req.user\n\t};\n}\n/**\n* Fail with a Zod error's messages, one per field.\n*\n* The top-level `message` names the first problem so a human reading the\n* response learns something without parsing `fields`.\n*/\nfunction throwZodError(err) {\n\tconst fields = {};\n\tfor (const issue of err.issues) {\n\t\tconst key = issue.path.length ? issue.path.join(\".\") : \"_\";\n\t\tif (!(key in fields)) fields[key] = issue.message;\n\t}\n\tconst first = err.issues[0];\n\tconst path = first.path.length ? `${first.path.join(\".\")}: ` : \"\";\n\tapiError(400, ApiErrorCode.VALIDATION_FAILED, `${path}${first.message}`, fields);\n}\n/**\n* Read required path params, 400ing on any that is missing or blank.\n*\n* A router types every param as `string`, but a route can be reached with an\n* empty segment — this catches that instead of letting a stale non-null\n* assertion paper over it.\n*\n* Does **not** validate format — a guid-shaped param still goes through a\n* schema where the route cares. Replaces the `if (!id) apiError(...)` preamble,\n* not the schema check.\n*/\nfunction requireParams(params, ...names) {\n\tconst out = {};\n\tconst missing = [];\n\tfor (const name of names) {\n\t\tconst value = params[name];\n\t\tif (!value) {\n\t\t\tmissing.push(name);\n\t\t\tcontinue;\n\t\t}\n\t\tout[name] = value;\n\t}\n\tif (missing.length) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Missing path parameter${missing.length > 1 ? \"s\" : \"\"}: ${missing.join(\", \")}`);\n\treturn out;\n}\n/**\n* Read a path param through a Zod schema, 400ing on a bad value.\n*\n* The format-checking counterpart to `requireParams` — for guids, enum-shaped\n* segments, anything where \"present\" isn't the same as \"valid\".\n*/\nfunction parseParam(value, schema, name) {\n\tconst parsed = schema.safeParse(value);\n\tif (!parsed.success) apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid or missing ${name}`);\n\treturn parsed.data;\n}\n/**\n* Parse and validate a JSON body. A malformed body becomes `null` rather than\n* throwing, so it fails the schema as a validation error — broken JSON gets a\n* 400 naming the problem, not a 500 from `request.json()`.\n*\n* `missingAs` covers endpoints whose fields are all optional: passing `{}` lets\n* an empty body mean \"no changes\" instead of a validation failure.\n*/\nasync function parseBody(request, schema, { missingAs } = {}) {\n\tconst raw = await request.json().catch(() => null);\n\tconst parsed = schema.safeParse(raw ?? missingAs ?? null);\n\tif (!parsed.success) throwZodError(parsed.error);\n\treturn parsed.data;\n}\n/**\n* Pull a required file out of a multipart body and check its size and, where\n* given, its extension.\n*\n* A second line of defence, not the first: a host's body-size guard should\n* reject an oversized request before it is buffered. This catches a file that\n* is individually too large inside a request that isn't.\n*\n* Caps are passed in rather than read here — they are deployment config, and a\n* package that resolved them would pin every host to one source of truth.\n*/\nfunction requireUpload(form, field, { maxBytes, extensions, contentTypes, label = \"File\" }) {\n\tconst file = form.get(field);\n\tif (!(file instanceof File) || file.size === 0) apiError(400, ApiErrorCode.VALIDATION_FAILED, `A ${label.toLowerCase()} is required`);\n\tconst extension = file.name.slice(file.name.lastIndexOf(\".\")).toLowerCase();\n\tif (extensions && !extensions.includes(extension)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `File type not allowed. Allowed: ${extensions.join(\", \")}`);\n\tif (contentTypes && !contentTypes.allowed.has(file.type)) apiError(400, ApiErrorCode.VALIDATION_FAILED, contentTypes.message);\n\tif (file.size > maxBytes) apiError(400, ApiErrorCode.VALIDATION_FAILED, `${label} too large. Max size: ${maxBytes / 1048576} MB`);\n\treturn {\n\t\tfile,\n\t\textension\n\t};\n}\n/** A multipart text field, trimmed and length-capped. Absent stays `undefined`. */\nfunction formText(form, field, { maxLength } = {}) {\n\tconst raw = form.get(field);\n\tif (typeof raw !== \"string\") return void 0;\n\tconst trimmed = raw.trim();\n\tif (!trimmed) return void 0;\n\treturn maxLength ? trimmed.slice(0, maxLength) : trimmed;\n}\n//#endregion\nexport { requireParams as a, requireCaller as i, parseBody as n, requireUpload as o, parseParam as r, throwZodError as s, formText as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,GAAG,EAAE;AAC5B,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC;AACpF,CAAC,OAAO;AACR,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG;AACd,EAAE,IAAI,EAAE,GAAG,CAAC;AACZ,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,GAAG,EAAE;AAC5B,CAAC,MAAM,MAAM,GAAG,EAAE;AAClB,CAAC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE;AACjC,EAAE,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG;AAC5D,EAAE,IAAI,EAAE,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO;AACnD,CAAC;AACD,CAAC,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5B,CAAC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE;AAClE,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC;AACjF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,MAAM,EAAE,GAAG,KAAK,EAAE;AACzC,CAAC,MAAM,GAAG,GAAG,EAAE;AACf,CAAC,MAAM,OAAO,GAAG,EAAE;AACnB,CAAC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE;AAC3B,EAAE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;AAC5B,EAAE,IAAI,CAAC,KAAK,EAAE;AACd,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;AACrB,GAAG;AACH,EAAE;AACF,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK;AACnB,CAAC;AACD,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,sBAAsB,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACnJ,CAAC,OAAO,GAAG;AACX;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;AACzC,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;AACvC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC,CAAC;AACjG,CAAC,OAAO,MAAM,CAAC,IAAI;AACnB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE;AAC9D,CAAC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;AACnD,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,SAAS,IAAI,IAAI,CAAC;AAC1D,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AACjD,CAAC,OAAO,MAAM,CAAC,IAAI;AACnB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,GAAG,MAAM,EAAE,EAAE;AAC5F,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;AAC7B,CAAC,IAAI,EAAE,IAAI,YAAY,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,YAAY,CAAC,CAAC;AACtI,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE;AAC5E,CAAC,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,gCAAgC,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC7J,CAAC,IAAI,YAAY,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,YAAY,CAAC,OAAO,CAAC;AAC9H,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,EAAE,KAAK,CAAC,sBAAsB,EAAE,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;AAClI,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE;AACF,EAAE;AACF;AACA;AACA,SAAS,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE;AACnD,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;AAC5B,CAAC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,OAAO,MAAM;AAC3C,CAAC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE;AAC3B,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,MAAM;AAC5B,CAAC,OAAO,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,OAAO;AACzD;;;;"}

package/build/server/chunks/chunks/resolve.server.js-D29d3984.js

@@ -0,0 +1,59 @@
+import { S as SYSTEM_CONTEXT } from './src.js-bYgw0r8C.js';
+import { p as providers, o as getDefinitionMeta, f as getProjectProvider, j as flag } from './providers.server.js-w28aoEzQ.js';
+import { h as hashToken, l as looksLikeShareToken } from './token2.server.js-dXKS8zg3.js';
+import { error } from '@sveltejs/kit';
+
+//#region src/lib/server/shareLinks/resolve.server.ts
+/**
+* Extracts a candidate share-link token from the request — `?token=share_…`
+* query param, or `Authorization: Bearer share_…` header. Returns the raw
+* token, or null when none present. Does NOT validate.
+*/
+function readShareToken(request, url) {
+	if (!flag("ENABLE_SHARING")) return null;
+	const q = url.searchParams.get("token");
+	if (q && looksLikeShareToken(q)) return q;
+	const auth = request.headers.get("authorization");
+	if (auth?.startsWith("Bearer ")) {
+		const candidate = auth.slice(7).trim();
+		if (looksLikeShareToken(candidate)) return candidate;
+	}
+	return null;
+}
+/**
+* Runs before user-based auth on definition-scoped routes.
+*
+* Throws only when a token is *present but invalid* (wrong definition, wrong
+* channel, expired, revoked, view-only when solve was requested) — deliberate
+* 401/403/429 responses to a misbehaving consumer. When no token is present
+* at all, returns null and the caller falls through to user-based auth.
+*/
+async function tryResolveShareToken(request, url, requestedDefinitionId, requestedChannel, opts) {
+	const raw = readShareToken(request, url);
+	if (!raw) return null;
+	const tokenHash = hashToken(raw);
+	const link = await providers.data.shareLinks.getByTokenHash(SYSTEM_CONTEXT, tokenHash);
+	if (!link) throw error(401, "Invalid or revoked share token.");
+	if (link.expiresAt && new Date(link.expiresAt).getTime() <= Date.now()) throw error(401, "Share token has expired.");
+	if (link.definitionId !== requestedDefinitionId) throw error(403, "Share token is not valid for this definition.");
+	if (link.channel !== requestedChannel) throw error(403, `Share token is for the '${link.channel}' channel only.`);
+	if (opts.requireSolve && !link.allowSolve) throw error(403, "Share token grants view-only access.");
+	const def = await getDefinitionMeta().get(SYSTEM_CONTEXT, link.definitionId);
+	if (!def) throw error(401, "Share token target no longer exists.");
+	const project = await getProjectProvider().getProject(SYSTEM_CONTEXT, def.projectId);
+	if (!project) throw error(401, "Share token target no longer exists.");
+	return {
+		link,
+		ctx: {
+			userId: `share:${link.id}`,
+			actingOrgId: project.orgId,
+			platformPermissions: [],
+			orgPermissions: [],
+			system: true,
+			shareLinkId: link.id
+		}
+	};
+}
+
+export { tryResolveShareToken as t };
+//# sourceMappingURL=resolve.server.js-D29d3984.js.map

package/build/server/chunks/chunks/resolve.server.js-D29d3984.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.server.js-D29d3984.js","sources":["../../../../.svelte-kit/output/server/chunks/resolve.server.js"],"sourcesContent":["import { t as SYSTEM_CONTEXT } from \"./src.js\";\nimport { T as providers, s as getDefinitionMeta, t as flag, v as getProjectProvider } from \"./providers.server.js\";\nimport { n as looksLikeShareToken, t as hashToken } from \"./token2.server.js\";\nimport { error } from \"@sveltejs/kit\";\n//#region src/lib/server/shareLinks/resolve.server.ts\n/**\n* Extracts a candidate share-link token from the request — `?token=share_…`\n* query param, or `Authorization: Bearer share_…` header. Returns the raw\n* token, or null when none present. Does NOT validate.\n*/\nfunction readShareToken(request, url) {\n\tif (!flag(\"ENABLE_SHARING\")) return null;\n\tconst q = url.searchParams.get(\"token\");\n\tif (q && looksLikeShareToken(q)) return q;\n\tconst auth = request.headers.get(\"authorization\");\n\tif (auth?.startsWith(\"Bearer \")) {\n\t\tconst candidate = auth.slice(7).trim();\n\t\tif (looksLikeShareToken(candidate)) return candidate;\n\t}\n\treturn null;\n}\n/**\n* Runs before user-based auth on definition-scoped routes.\n*\n* Throws only when a token is *present but invalid* (wrong definition, wrong\n* channel, expired, revoked, view-only when solve was requested) — deliberate\n* 401/403/429 responses to a misbehaving consumer. When no token is present\n* at all, returns null and the caller falls through to user-based auth.\n*/\nasync function tryResolveShareToken(request, url, requestedDefinitionId, requestedChannel, opts) {\n\tconst raw = readShareToken(request, url);\n\tif (!raw) return null;\n\tconst tokenHash = hashToken(raw);\n\tconst link = await providers.data.shareLinks.getByTokenHash(SYSTEM_CONTEXT, tokenHash);\n\tif (!link) throw error(401, \"Invalid or revoked share token.\");\n\tif (link.expiresAt && new Date(link.expiresAt).getTime() <= Date.now()) throw error(401, \"Share token has expired.\");\n\tif (link.definitionId !== requestedDefinitionId) throw error(403, \"Share token is not valid for this definition.\");\n\tif (link.channel !== requestedChannel) throw error(403, `Share token is for the '${link.channel}' channel only.`);\n\tif (opts.requireSolve && !link.allowSolve) throw error(403, \"Share token grants view-only access.\");\n\tconst def = await getDefinitionMeta().get(SYSTEM_CONTEXT, link.definitionId);\n\tif (!def) throw error(401, \"Share token target no longer exists.\");\n\tconst project = await getProjectProvider().getProject(SYSTEM_CONTEXT, def.projectId);\n\tif (!project) throw error(401, \"Share token target no longer exists.\");\n\treturn {\n\t\tlink,\n\t\tctx: {\n\t\t\tuserId: `share:${link.id}`,\n\t\t\tactingOrgId: project.orgId,\n\t\t\tplatformPermissions: [],\n\t\t\torgPermissions: [],\n\t\t\tsystem: true,\n\t\t\tshareLinkId: link.id\n\t\t}\n\t};\n}\n//#endregion\nexport { tryResolveShareToken as t };\n"],"names":[],"mappings":";;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE;AACtC,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,OAAO,IAAI;AACzC,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;AACxC,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;AAC1C,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;AAClD,CAAC,IAAI,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE;AAClC,EAAE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;AACxC,EAAE,IAAI,mBAAmB,CAAC,SAAS,CAAC,EAAE,OAAO,SAAS;AACtD,CAAC;AACD,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,oBAAoB,CAAC,OAAO,EAAE,GAAG,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,IAAI,EAAE;AACjG,CAAC,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC;AACzC,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,IAAI;AACtB,CAAC,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC;AACjC,CAAC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,cAAc,EAAE,SAAS,CAAC;AACvF,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,iCAAiC,CAAC;AAC/D,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,0BAA0B,CAAC;AACrH,CAAC,IAAI,IAAI,CAAC,YAAY,KAAK,qBAAqB,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,+CAA+C,CAAC;AACnH,CAAC,IAAI,IAAI,CAAC,OAAO,KAAK,gBAAgB,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,wBAAwB,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;AAClH,CAAC,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,sCAAsC,CAAC;AACpG,CAAC,MAAM,GAAG,GAAG,MAAM,iBAAiB,EAAE,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC;AAC7E,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,sCAAsC,CAAC;AACnE,CAAC,MAAM,OAAO,GAAG,MAAM,kBAAkB,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,GAAG,CAAC,SAAS,CAAC;AACrF,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,sCAAsC,CAAC;AACvE,CAAC,OAAO;AACR,EAAE,IAAI;AACN,EAAE,GAAG,EAAE;AACP,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;AAC7B,GAAG,WAAW,EAAE,OAAO,CAAC,KAAK;AAC7B,GAAG,mBAAmB,EAAE,EAAE;AAC1B,GAAG,cAAc,EAAE,EAAE;AACrB,GAAG,MAAM,EAAE,IAAI;AACf,GAAG,WAAW,EAAE,IAAI,CAAC;AACrB;AACA,EAAE;AACF;;;;"}

package/build/server/chunks/chunks/rolldown-runtime.js-gLLCT7Mu.js

@@ -0,0 +1,43 @@
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esmMin = (fn, res, err) => () => {
+	if (err) throw err[0];
+	try {
+		return fn && (res = fn(fn = 0)), res;
+	} catch (e) {
+		throw err = [e], e;
+	}
+};
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	__defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(__defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) , mod));
+var __toCommonJS = (mod) => __hasOwnProp.call(mod, "module.exports") ? mod["module.exports"] : __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+export { __exportAll as _, __commonJSMin as a, __toESM as b, __toCommonJS as c, __esmMin as d };
+//# sourceMappingURL=rolldown-runtime.js-gLLCT7Mu.js.map

package/build/server/chunks/chunks/rolldown-runtime.js-gLLCT7Mu.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rolldown-runtime.js-gLLCT7Mu.js","sources":["../../../../.svelte-kit/output/server/chunks/rolldown-runtime.js"],"sourcesContent":["//#region \\0rolldown/runtime.js\nvar __create = Object.create;\nvar __defProp = Object.defineProperty;\nvar __getOwnPropDesc = Object.getOwnPropertyDescriptor;\nvar __getOwnPropNames = Object.getOwnPropertyNames;\nvar __getProtoOf = Object.getPrototypeOf;\nvar __hasOwnProp = Object.prototype.hasOwnProperty;\nvar __esmMin = (fn, res, err) => () => {\n\tif (err) throw err[0];\n\ttry {\n\t\treturn fn && (res = fn(fn = 0)), res;\n\t} catch (e) {\n\t\tthrow err = [e], e;\n\t}\n};\nvar __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);\nvar __exportAll = (all, no_symbols) => {\n\tlet target = {};\n\tfor (var name in all) __defProp(target, name, {\n\t\tget: all[name],\n\t\tenumerable: true\n\t});\n\tif (!no_symbols) __defProp(target, Symbol.toStringTag, { value: \"Module\" });\n\treturn target;\n};\nvar __copyProps = (to, from, except, desc) => {\n\tif (from && typeof from === \"object\" || typeof from === \"function\") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {\n\t\tkey = keys[i];\n\t\tif (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {\n\t\t\tget: ((k) => from[k]).bind(null, key),\n\t\t\tenumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable\n\t\t});\n\t}\n\treturn to;\n};\nvar __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, \"default\") ? __defProp(target, \"default\", {\n\tvalue: mod,\n\tenumerable: true\n}) : target, mod));\nvar __toCommonJS = (mod) => __hasOwnProp.call(mod, \"module.exports\") ? mod[\"module.exports\"] : __copyProps(__defProp({}, \"__esModule\", { value: true }), mod);\n//#endregion\nexport { __toESM as a, __toCommonJS as i, __esmMin as n, __exportAll as r, __commonJSMin as t };\n"],"names":[],"mappings":"AAAA;AACA,IAAI,QAAQ,GAAG,MAAM,CAAC,MAAM;AAC5B,IAAI,SAAS,GAAG,MAAM,CAAC,cAAc;AACrC,IAAI,gBAAgB,GAAG,MAAM,CAAC,wBAAwB;AACtD,IAAI,iBAAiB,GAAG,MAAM,CAAC,mBAAmB;AAClD,IAAI,YAAY,GAAG,MAAM,CAAC,cAAc;AACxC,IAAI,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc;AAC/C,IAAC,QAAQ,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,KAAK,MAAM;AACvC,CAAC,IAAI,GAAG,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;AACtB,CAAC,IAAI;AACL,EAAE,OAAO,EAAE,KAAK,GAAG,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG;AACtC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;AACb,EAAE,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AACpB,CAAC;AACD;AACG,IAAC,aAAa,GAAG,CAAC,EAAE,EAAE,GAAG,KAAK,OAAO,GAAG,KAAK,EAAE,CAAC,CAAC,GAAG,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE,GAAG,CAAC,OAAO;AAC9G,IAAC,WAAW,GAAG,CAAC,GAAG,EAAE,UAAU,KAAK;AACvC,CAAC,IAAI,MAAM,GAAG,EAAE;AAChB,CAAC,KAAK,IAAI,IAAI,IAAI,GAAG,EAAE,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE;AAC/C,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC;AAChB,EAAE,UAAU,EAAE;AACd,EAAE,CAAC;AACH,CAAkB,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC5E,CAAC,OAAO,MAAM;AACd;AACA,IAAI,WAAW,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,KAAK;AAC9C,CAAC,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,KAAK,IAAI,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE;AACvJ,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC;AACf,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,GAAG,KAAK,MAAM,EAAE,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE;AACxE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC;AACxC,GAAG,UAAU,EAAE,EAAE,IAAI,GAAG,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;AAC7D,GAAG,CAAC;AACJ,CAAC;AACD,CAAC,OAAO,EAAE;AACV,CAAC;AACE,IAAC,OAAO,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,MAAM,MAAM,GAAG,GAAG,IAAI,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,CAA+E,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE;AAC5N,CAAC,KAAK,EAAE,GAAG;AACX,CAAC,UAAU,EAAE;AACb,CAAC,CAAC,CAAS,EAAE,GAAG,CAAC;AACd,IAAC,YAAY,GAAG,CAAC,GAAG,KAAK,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,GAAG,GAAG,CAAC,gBAAgB,CAAC,GAAG,WAAW,CAAC,SAAS,CAAC,EAAE,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG;;;;"}

package/build/server/chunks/chunks/rotate-ccw.js-BPGRTlNw.js

@@ -0,0 +1,15 @@
+import { ai as spread_props } from './server.js-CUv4onuj.js';
+import { I as Icon } from './utils3.js-D4hQ3EdJ.js';
+
+//#region ../../node_modules/.pnpm/@lucide+svelte@1.48.0_svelte@5.57.1_@typescript-eslint+types@8.70.1_/node_modules/@lucide/svelte/dist/icons/rotate-ccw.svelte
+function Rotate_ccw($$renderer, $$props) {
+	let { $$slots, $$events, ...props } = $$props;
+	Icon($$renderer, spread_props([props, { icon: {
+		"name": "rotate-ccw",
+		"size": 24,
+		"node": [["path", { "d": "M3 12a9 9 0 1 0 9-9 9.75 9.75 0 0 0-6.74 2.74L3 8" }], ["path", { "d": "M3 3v5h5" }]]
+	} }]));
+}
+
+export { Rotate_ccw as R };
+//# sourceMappingURL=rotate-ccw.js-BPGRTlNw.js.map

package/build/server/chunks/chunks/rotate-ccw.js-BPGRTlNw.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotate-ccw.js-BPGRTlNw.js","sources":["../../../../.svelte-kit/output/server/chunks/rotate-ccw.js"],"sourcesContent":["import { d as spread_props } from \"./server.js\";\nimport { n as Icon } from \"./utils3.js\";\n//#region ../../node_modules/.pnpm/@lucide+svelte@1.48.0_svelte@5.57.1_@typescript-eslint+types@8.70.1_/node_modules/@lucide/svelte/dist/icons/rotate-ccw.svelte\nfunction Rotate_ccw($$renderer, $$props) {\n\tlet { $$slots, $$events, ...props } = $$props;\n\tIcon($$renderer, spread_props([props, { icon: {\n\t\t\"name\": \"rotate-ccw\",\n\t\t\"size\": 24,\n\t\t\"node\": [[\"path\", { \"d\": \"M3 12a9 9 0 1 0 9-9 9.75 9.75 0 0 0-6.74 2.74L3 8\" }], [\"path\", { \"d\": \"M3 3v5h5\" }]]\n\t} }]));\n}\n//#endregion\nexport { Rotate_ccw as t };\n"],"names":[],"mappings":";;;AAEA;AACA,SAAS,UAAU,CAAC,UAAU,EAAE,OAAO,EAAE;AACzC,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO;AAC9C,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE;AAC/C,EAAE,MAAM,EAAE,YAAY;AACtB,EAAE,MAAM,EAAE,EAAE;AACZ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,mDAAmD,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;AAChH,EAAE,EAAE,CAAC,CAAC,CAAC;AACP;;;;"}

package/build/server/chunks/chunks/schema-extraction.js-_C5meGta.js

@@ -0,0 +1,358 @@
+import './src.js-bYgw0r8C.js';
+import { t as tt, Z as Ze, U as UI_SCHEMA_VERSION } from './schema.js-CPjRq84j.js';
+
+//#region ../platform/src/events/interface.ts
+/**
+* `ctx.userId === ''` is the `SYSTEM_CONTEXT` convention for a server-internal
+* caller (bootstrap, janitors, migrations), which resolves to `'system'` here.
+*/
+function actorFrom(ctx) {
+	return ctx.userId || "system";
+}
+/** `actorId` plus, for an API-token request, `tokenId`. Spread into an event. */
+function actorOf(ctx) {
+	const actorId = actorFrom(ctx);
+	return ctx.apiScope ? {
+		actorId,
+		tokenId: ctx.apiScope.tokenId
+	} : { actorId };
+}
+/** Discards every event. Used when `SelvaConfig.events` is omitted. */
+var NoopEventSink = class {
+	async emit(_event) {}
+};
+//#endregion
+//#region ../platform/src/logging/interface.ts
+/**
+* Default `ILogger` — discards everything. Lets library code log
+* unconditionally without a configured backend, and keeps test output clean.
+* The app wires a real logger at its composition root; a consumer that wires
+* nothing gets silence rather than unsolicited stdout writes.
+*/
+var NoopLogger = class {
+	debug(_message, _fields) {}
+	info(_message, _fields) {}
+	warn(_message, _fields) {}
+	error(_message, _fields) {}
+	child(_fields) {
+		return this;
+	}
+};
+//#endregion
+//#region ../platform/src/config.ts
+function isFlagEnabled(config, flag) {
+	return Boolean(config.flags?.[flag]);
+}
+//#endregion
+//#region ../server/src/api/errors.ts
+/**
+* The transport-free error type every API handler raises.
+*
+* `apiError` used to throw SvelteKit's `error()` directly, which welded all 151
+* of its call sites to one framework. `ApiError` carries the same envelope as a
+* plain exception; the host adapter converts it to whatever its framework
+* expects (see `toApiResponse`). Call sites are unchanged — only the throw
+* site and the boundary know the difference.
+*/
+/** Stable, machine-readable error codes. Append-only — never renumber/rename. */
+var ApiErrorCode = {
+	VALIDATION_FAILED: "VALIDATION_FAILED",
+	UNAUTHORIZED: "UNAUTHORIZED",
+	FORBIDDEN: "FORBIDDEN",
+	NOT_FOUND: "NOT_FOUND",
+	CONFLICT: "CONFLICT",
+	UNPROCESSABLE: "UNPROCESSABLE",
+	COMPUTE_UNAVAILABLE: "COMPUTE_UNAVAILABLE",
+	SETUP_REQUIRED: "SETUP_REQUIRED",
+	INTERNAL: "INTERNAL",
+	/** API tokens are switched off or misconfigured here; browser sessions still work. */
+	API_TOKENS_UNAVAILABLE: "API_TOKENS_UNAVAILABLE",
+	/** Too many requests, or a share link's solve cap is spent. `Retry-After`, when sent, says when to retry. */
+	RATE_LIMITED: "RATE_LIMITED",
+	/** The key is valid, but the host's holder policy no longer lets its owner hold API tokens. */
+	API_TOKEN_HOLDER_REFUSED: "API_TOKEN_HOLDER_REFUSED"
+};
+var ApiError = class extends Error {
+	status;
+	code;
+	/** Per-field validation messages, keyed by dotted path. Only on VALIDATION_FAILED. */
+	fields;
+	/** Machine-readable context, e.g. `requiredScope` on a scope refusal. */
+	details;
+	constructor(status, code, message, fields, details) {
+		super(message);
+		this.name = "ApiError";
+		this.status = status;
+		this.code = code;
+		this.fields = fields;
+		this.details = details;
+	}
+};
+function toErrorBody(err) {
+	const body = {
+		message: err.message,
+		code: err.code
+	};
+	if (err.fields) body.fields = err.fields;
+	if (err.details) body.details = err.details;
+	return body;
+}
+function isApiError(err) {
+	return err instanceof ApiError;
+}
+/** Raise a structured API error. The only way handlers should fail. */
+function apiError(status, code, message, fields, details) {
+	throw new ApiError(status, code, message, fields, details);
+}
+/** Default code for a status, for mapping errors that carry no code of their own. */
+function codeForStatus(status) {
+	switch (status) {
+		case 400: return ApiErrorCode.VALIDATION_FAILED;
+		case 401: return ApiErrorCode.UNAUTHORIZED;
+		case 403: return ApiErrorCode.FORBIDDEN;
+		case 404: return ApiErrorCode.NOT_FOUND;
+		case 409: return ApiErrorCode.CONFLICT;
+		case 422: return ApiErrorCode.UNPROCESSABLE;
+		case 429: return ApiErrorCode.RATE_LIMITED;
+		case 503: return ApiErrorCode.COMPUTE_UNAVAILABLE;
+		default: return ApiErrorCode.INTERNAL;
+	}
+}
+//#endregion
+//#region ../server/src/compute/limits.ts
+/**
+* Compute/solve server limits, resolved from an injected env map.
+*
+* Env comes in as a parameter — nothing ambient is read — so this is importable
+* from any runtime and testable without env plumbing. Defaults are sized for
+* typical interactive use (sliders + small uploads).
+*
+* Client-side counterparts (the in-flight compute throttle and slider debounce)
+* are bundled into the client in `@selvajs/ui` and can't read env — they carry
+* their own defaults.
+*/
+var MB = 1048576;
+/**
+* Default logger for the env-parsing warnings below. This is library code, so an
+* embedder that wires nothing gets silence rather than unsolicited stdout writes.
+*/
+var noop = new NoopLogger();
+/** Parse a positive integer env value; absent, or present but not finite and positive, falls back. */
+function readPositiveInt(env, name, fallback, logger = noop) {
+	const raw = env[name];
+	if (!raw) return fallback;
+	const parsed = Number(raw);
+	if (!Number.isFinite(parsed) || parsed <= 0) {
+		logger.warn("Invalid env value, falling back to default", {
+			component: "selva",
+			envVar: name,
+			value: raw,
+			fallback
+		});
+		return fallback;
+	}
+	return Math.floor(parsed);
+}
+/** Like {@link readPositiveInt}, but `0` is valid — knobs where it means "disable". */
+function readNonNegativeInt(env, name, fallback, logger = noop) {
+	const raw = env[name];
+	if (!raw) return fallback;
+	const parsed = Number(raw);
+	if (!Number.isFinite(parsed) || parsed < 0) {
+		logger.warn("Invalid env value, falling back to default", {
+			component: "selva",
+			envVar: name,
+			value: raw,
+			fallback
+		});
+		return fallback;
+	}
+	return Math.floor(parsed);
+}
+/**
+* Fall back to a variable's previous name, warning when the old one is used.
+* Setting both is not an error: the new name wins silently, which is what an
+* operator mid-migration expects.
+*
+* A var that quietly stops being read looks exactly like one that is working —
+* the failure only surfaces as a memory number nobody is watching.
+*/
+function readRenamed(env, name, oldName, logger) {
+	if (env[name] !== void 0 || env[oldName] === void 0) return env;
+	logger.warn("Deprecated env var: rename it", {
+		component: "selva",
+		envVar: oldName,
+		renamedTo: name
+	});
+	return {
+		...env,
+		[name]: env[oldName]
+	};
+}
+/**
+* Parse a boolean env flag. Accepts `true/1/yes/on` and `false/0/no/off`
+* (case-insensitive); any other spelling warns and falls back.
+*/
+function readBool(env, name, fallback, logger = noop) {
+	const raw = env[name];
+	if (raw == null || raw === "") return fallback;
+	const v = raw.trim().toLowerCase();
+	if (v === "true" || v === "1" || v === "yes" || v === "on") return true;
+	if (v === "false" || v === "0" || v === "no" || v === "off") return false;
+	logger.warn("Invalid env value, falling back to default", {
+		component: "selva",
+		envVar: name,
+		value: raw,
+		fallback
+	});
+	return fallback;
+}
+/**
+* Resolve every server-side compute limit from an env map. The app calls this
+* once at its composition root with `$env/dynamic/private`.
+*/
+function resolveComputeLimits(env, logger = noop) {
+	env = readRenamed(env, "COMPUTE_DEFINITION_CACHE_MB", "COMPUTE_DEFINITION_BYTE_CACHE_MB", logger);
+	env = readRenamed(env, "COMPUTE_SOLVE_CACHE_MB", "COMPUTE_RESPONSE_CACHE_MB", logger);
+	env = readRenamed(env, "REMOTE_DEFINITION_CACHE_TTL_MS", "DEFINITION_CACHE_TTL_MS", logger);
+	env = readRenamed(env, "COMPUTE_SOLVE_DEADLINE_MS", "MAX_SOLVE_DURATION_MS", logger);
+	const maxDefinitionFileSize = readPositiveInt(env, "MAX_DEFINITION_FILE_SIZE_BYTES", 50 * MB, logger);
+	return {
+		solveDeadlineMs: readPositiveInt(env, "COMPUTE_SOLVE_DEADLINE_MS", 1e5, logger),
+		rateLimitWindowMs: readPositiveInt(env, "COMPUTE_RATE_LIMIT_WINDOW_MS", 1e5, logger),
+		rateLimitMaxRequests: readPositiveInt(env, "COMPUTE_RATE_LIMIT_MAX", 120, logger),
+		maxDefinitionFileSize,
+		maxImageFileSize: readPositiveInt(env, "MAX_IMAGE_FILE_SIZE_BYTES", 10 * MB, logger),
+		computeRequestMaxBytes: readPositiveInt(env, "COMPUTE_REQUEST_MAX_BYTES", 256 * MB, logger),
+		computeResponseMaxBytes: readPositiveInt(env, "COMPUTE_RESPONSE_MAX_BYTES", 300 * MB, logger),
+		remoteDefinitionMaxBytes: maxDefinitionFileSize,
+		remoteDefinitionFetchTimeoutMs: readPositiveInt(env, "REMOTE_DEFINITION_FETCH_TIMEOUT_MS", 3e4, logger),
+		remoteDefinitionCacheTtlMs: readPositiveInt(env, "REMOTE_DEFINITION_CACHE_TTL_MS", 3e5, logger),
+		computeReuseDefinitionCache: readBool(env, "COMPUTE_REUSE_DEFINITION_CACHE", true, logger),
+		computeServerCachesolve: readBool(env, "COMPUTE_SERVER_CACHESOLVE", true, logger),
+		computeCacheErroredSolves: readBool(env, "COMPUTE_CACHE_ERRORED_SOLVES", false, logger),
+		computeMaxQueueDepth: readNonNegativeInt(env, "COMPUTE_MAX_QUEUE_DEPTH", 0, logger),
+		computeQueueWaitMs: readNonNegativeInt(env, "COMPUTE_QUEUE_WAIT_MS", 0, logger),
+		computeDefinitionCacheBytes: readNonNegativeInt(env, "COMPUTE_DEFINITION_CACHE_MB", 256, logger) * MB,
+		computeSolveCacheBytes: readNonNegativeInt(env, "COMPUTE_SOLVE_CACHE_MB", 256, logger) * MB
+	};
+}
+//#endregion
+//#region ../server/src/definitions/schema-extraction.ts
+/** Thin re-export of @selvajs/compute's unwrap, typed to `UISchema`. */
+function readSchemaResults(raw) {
+	return Ze(raw);
+}
+/** Thrown when compute is reachable but the definition yields no usable schema. */
+var SchemaExtractionError = class extends Error {
+	kind;
+	constructor(kind, message) {
+		super(message);
+		this.kind = kind;
+		this.name = "SchemaExtractionError";
+	}
+};
+/**
+* Rejects a schema whose keys are not camelCase by the time it reaches a consumer.
+*
+* Compute serializes the plugin's `UISchema` POCO, whose camelCase names live in
+* `[JsonProperty]` attributes. `Selva.gha` ILRepack-merges Newtonsoft, so those
+* attributes have type `Selva!Newtonsoft.Json.JsonPropertyAttribute`; a compute
+* server serializing with its OWN Newtonsoft does not recognize them, reads no
+* attributes, and falls back to raw CLR member names — `Inputs`, `Layout`.
+* Nothing throws on the wire: every consumer just reads `schema.inputs` as
+* undefined and renders a definition with no inputs.
+*
+* `postSchemaFormData` repairs that casing via `normalizeUISchemaCasing`, so a
+* schema fresh off the wire never trips this. It stays because schemas are also
+* PERSISTED: a row cached before the normalizer existed still holds PascalCase,
+* and it reaches consumers without passing through `postSchemaFormData` again.
+* A schema with no `inputs` in any casing lands here too. It is a backstop, not
+* the primary defense — which is why it names the missing key rather than telling
+* the operator to go update their compute server.
+*
+* Checked structurally rather than by plugin version, because the casing depends
+* on which assembly serialized the schema, not on any version number.
+*/
+function assertCamelCaseSchema(schema) {
+	const raw = schema;
+	if (Array.isArray(raw.inputs)) return;
+	const pascalKeys = [
+		"Inputs",
+		"Outputs",
+		"Layout",
+		"SchemaVersion"
+	].filter((k) => k in raw);
+	if (pascalKeys.length > 0) throw new SchemaExtractionError("malformed", `Schema keys are PascalCase (found ${pascalKeys.join(", ")}), so every property name is wrong and the definition would render with no inputs. Compute serialized it with its own Newtonsoft instead of the one merged into Selva.gha. Fresh responses are normalized, so this is most likely a schema cached before that fix — re-save the definition version to re-extract it.`);
+	throw new SchemaExtractionError("malformed", `Compute returned a schema with no 'inputs' array (got keys: ${Object.keys(raw).slice(0, 12).join(", ")}).`);
+}
+function parseSemver(version) {
+	const m = /^(\d+)\.(\d+)\.(\d+)$/.exec(version);
+	return m ? [
+		Number(m[1]),
+		Number(m[2]),
+		Number(m[3])
+	] : null;
+}
+/**
+* Rejects a schema from a NEWER plugin than this app was built against — its
+* shape may contain constructs the renderer doesn't know. Older (or missing)
+* versions pass: the compute-side C# migrator always emits its own current
+* version, and an older shape only lacks optional additions.
+*/
+function assertSupportedSchemaVersion(schema) {
+	const version = schema.schemaVersion;
+	if (!version) return;
+	const extracted = parseSemver(version);
+	const supported = parseSemver(UI_SCHEMA_VERSION);
+	if (!extracted || !supported) return;
+	if (extracted[0] > supported[0] || extracted[0] === supported[0] && (extracted[1] > supported[1] || extracted[1] === supported[1] && extracted[2] > supported[2])) throw new SchemaExtractionError("unsupported", `This definition was authored with a newer Selva plugin (schema format ${version}); this server supports schema format ≤ ${UI_SCHEMA_VERSION}. Update the server, or re-save the definition with a matching plugin version.`);
+}
+/**
+* POSTs a multipart form to Rhino Compute's `/grasshopper/schema` endpoint (no
+* solve required). Throws 'unreachable' on a network failure or non-2xx. The
+* per-file `error` Compute reports on its 200-with-no-schemas case is left to
+* the caller — single-file and multi-file callers want different messages.
+*/
+async function postSchemaFormData(formData, server) {
+	const schemaUrl = new URL("/grasshopper/schema", server.serverUrl).toString();
+	const headers = {};
+	if (server.apiKey) headers["RhinoComputeKey"] = server.apiKey;
+	let response;
+	try {
+		response = await fetch(schemaUrl, {
+			method: "POST",
+			headers,
+			body: formData
+		});
+	} catch (err) {
+		throw new SchemaExtractionError("unreachable", `Compute server is unreachable: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	if (!response.ok) throw new SchemaExtractionError("unreachable", `Schema endpoint returned ${response.status}: ${response.statusText}`);
+	return readSchemaResults(await response.json()).map((result) => ({
+		...result,
+		schemas: result.schemas?.map((schema) => tt(schema))
+	}));
+}
+/**
+* Throws `SchemaExtractionError` so callers can map to the right HTTP status:
+* 503 unreachable / 422 invalid or unsupported.
+*/
+async function fetchSchemaFromCompute(definitionBytes, server) {
+	const formData = new FormData();
+	const blob = new Blob([new Uint8Array(definitionBytes)], { type: "application/octet-stream" });
+	formData.append("file", blob, "definition.gh");
+	const results = await postSchemaFormData(formData, server);
+	const schemas = results.flatMap((r) => r.schemas ?? []);
+	if (schemas.length === 0) {
+		const diagnosis = results.map((r) => r.error).filter(Boolean);
+		if (diagnosis.length > 0) throw new SchemaExtractionError("invalid", diagnosis.join("\n"));
+		throw new SchemaExtractionError("invalid", "No schemas found in definition.\n\nIn Grasshopper, verify a Context Bake component with the output name \"Schema\" is present and wired to the solver.");
+	}
+	assertSupportedSchemaVersion(schemas[0]);
+	assertCamelCaseSchema(schemas[0]);
+	return schemas[0];
+}
+
+export { ApiErrorCode as A, NoopLogger as N, SchemaExtractionError as S, apiError as a, NoopEventSink as b, actorOf as c, ApiError as d, isApiError as e, fetchSchemaFromCompute as f, readNonNegativeInt as g, readPositiveInt as h, isFlagEnabled as i, codeForStatus as j, actorFrom as k, resolveComputeLimits as l, assertCamelCaseSchema as m, postSchemaFormData as p, readBool as r, toErrorBody as t };
+//# sourceMappingURL=schema-extraction.js-_C5meGta.js.map