@selvajs/selva 4.20.0-beta.15 → 4.20.0-beta.16

package/build/server/chunks/chunks/compute.js-a66mA6Yl.js

@@ -1,501 +0,0 @@
-import './src.js-DYeCa7A9.js';
-import { d as apiError, A as ApiErrorCode, C as ComputeServerUnconfiguredError, N as NoopLogger } from './access.js-BZIkVfZv.js';
-import { lookup } from 'node:dns/promises';
-import { isIP } from 'node:net';
-
-// ../platform/src/computeServer/types.ts
-function isPlatformServer(s) {
-	return s.scope === "platform";
-}
-function isOrgServer(s) {
-	return s.scope === "org";
-}
-// ../platform/src/computeServer/utils.ts
-/**
-* Servers an org can see in pickers and use for solves:
-* platform servers shared with this org (or `'all'`, or the global default)
-* ∪ org-private servers owned by this org.
-*/
-function serversVisibleTo(config, orgId) {
-	return config.servers.filter((s) => {
-		if (isPlatformServer(s)) {
-			if (s.id === config.defaultServerId) return true;
-			if (s.sharedWith === "all") return true;
-			if (orgId && s.sharedWith.includes(orgId)) return true;
-			return false;
-		}
-		return !!orgId && s.ownerOrgId === orgId;
-	});
-}
-/**
-* Resolves the default server id for an org: per-org override, then global
-* default. Returns `undefined` if neither is set or visible.
-*/
-function defaultServerIdFor(config, orgId) {
-	const visible = serversVisibleTo(config, orgId);
-	const visibleIds = new Set(visible.map((s) => s.id));
-	if (orgId) {
-		const orgChoice = config.orgDefaults?.[orgId];
-		if (orgChoice && visibleIds.has(orgChoice)) return orgChoice;
-	}
-	if (config.defaultServerId && visibleIds.has(config.defaultServerId)) return config.defaultServerId;
-}
-function resolveServerForOrg$1(config, orgId, opts = {}) {
-	const visible = serversVisibleTo(config, orgId);
-	if (visible.length === 0) throw new Error("No compute servers are configured or visible for this org.");
-	if (opts.definitionPin) {
-		const pinned = visible.find((s) => s.id === opts.definitionPin);
-		if (pinned) return pinned;
-	}
-	const defaultId = defaultServerIdFor(config, orgId);
-	if (defaultId) {
-		const found = visible.find((s) => s.id === defaultId);
-		if (found) return found;
-	}
-	return visible[0];
-}
-/**
-* The config as one org may see it: visible servers only, `orgDefaults` reduced
-* to this org's own entry, and `defaultServerId` dropped when the global default
-* is not visible here.
-*
-* Applied inside `getConfig` when `scopeToOrgId` is passed, so an org-facing
-* caller cannot forget the filter and leak other orgs' server URLs or the
-* instance's default choice.
-*/
-function scopeConfigToOrg(config, orgId) {
-	const servers = serversVisibleTo(config, orgId);
-	const visibleIds = new Set(servers.map((s) => s.id));
-	const orgDefault = config.orgDefaults?.[orgId];
-	return {
-		servers,
-		defaultServerId: config.defaultServerId && visibleIds.has(config.defaultServerId) ? config.defaultServerId : void 0,
-		orgDefaults: orgDefault ? { [orgId]: orgDefault } : {}
-	};
-}
-/** Lookup by id, ignoring scope or visibility — for admin contexts that display a server outside the visibility filter. */
-function findServerById(config, id) {
-	return config.servers.find((s) => s.id === id);
-}
-function platformServers(config) {
-	return config.servers.filter(isPlatformServer);
-}
-// ../server/src/compute/safe-url.ts
-/**
-* SSRF guard for the remote-definition fetch. Without it an authenticated user
-* could submit `http://169.254.169.254/...` (cloud metadata) or any intranet
-* endpoint and the server would fetch it on their behalf.
-*
-* Two layers:
-*
-*   1. `isSafeRemoteDefinitionUrl` — synchronous, DNS-free literal filter.
-*      Rejects the protocol, hostname literals, and every IP *encoding* that
-*      maps to a blocked address: dotted-decimal, integer, octal, hex,
-*      short-form, IPv4-mapped IPv6.
-*   2. `assertSafeRemoteDefinitionUrl` — resolves the hostname and re-checks the
-*      *resolved* IP, catching a public name that points at a private one.
-*
-* Neither is bulletproof against DNS rebinding — the IP can change between our
-* lookup and fetch's own. Closing that needs the caller to connect to the
-* resolved IP directly, a much larger change; these two layers close the
-* bypasses an attacker actually reaches for (literal encodings, and a public
-* name whose record points inward).
-*/
-/**
-* True when `ip` (a normalized IPv4 or IPv6 literal from `isIP`/`dns.lookup`)
-* is loopback, private, link-local, or otherwise must-not-fetch. IPv4-mapped
-* IPv6 (`::ffff:a.b.c.d`) is unwrapped first so the v4 rules apply.
-*/
-function isBlockedIp(ip) {
-	let addr = ip.toLowerCase();
-	const mappedDotted = /^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/.exec(addr);
-	if (mappedDotted) addr = mappedDotted[1];
-	else {
-		const mappedHex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(addr);
-		if (mappedHex) {
-			const hi = parseInt(mappedHex[1], 16);
-			const lo = parseInt(mappedHex[2], 16);
-			addr = [
-				hi >> 8 & 255,
-				hi & 255,
-				lo >> 8 & 255,
-				lo & 255
-			].join(".");
-		}
-	}
-	if (isIP(addr) === 4) {
-		const octets = addr.split(".").map(Number);
-		if (octets.length !== 4 || octets.some((o) => o > 255)) return true;
-		const [a, b] = octets;
-		if (a === 0) return true;
-		if (a === 127) return true;
-		if (a === 10) return true;
-		if (a === 192 && b === 168) return true;
-		if (a === 172 && b >= 16 && b <= 31) return true;
-		if (a === 169 && b === 254) return true;
-		return false;
-	}
-	if (addr === "::1" || addr === "::") return true;
-	if (/^(fc|fd)[0-9a-f]{0,2}:/.test(addr)) return true;
-	if (/^fe[89ab][0-9a-f]:/.test(addr)) return true;
-	return false;
-}
-/**
-* Parse a bare-IPv4 hostname in any encoding browsers/glibc accept — integer
-* (`2130706433`), octal (`0177.0.0.1`), hex (`0x7f000001`), and short forms
-* (`127.1`) — into canonical dotted-decimal. An already-valid dotted-quad comes
-* back unchanged. Returns null only when the host is not a numeric IPv4 literal
-* at all, i.e. it's a real name — which is what callers use to decide whether
-* DNS resolution is needed.
-*/
-function canonicalizeNumericIpv4(host) {
-	if (isIP(host) === 4) return host;
-	const rawParts = host.split(".");
-	if (rawParts.length === 0 || rawParts.length > 4) return null;
-	const parseUInt = (s) => {
-		if (s === "") return null;
-		let n;
-		if (/^0x[0-9a-f]+$/i.test(s)) n = parseInt(s, 16);
-		else if (/^0[0-7]+$/.test(s)) n = parseInt(s, 8);
-		else if (/^[0-9]+$/.test(s)) n = parseInt(s, 10);
-		else return null;
-		return Number.isFinite(n) ? n : null;
-	};
-	const nums = rawParts.map(parseUInt);
-	if (nums.some((n) => n === null)) return null;
-	const parts = nums;
-	let value;
-	switch (parts.length) {
-		case 1:
-			value = parts[0];
-			break;
-		case 2:
-			if (parts[0] > 255 || parts[1] > 16777215) return null;
-			value = parts[0] << 24 | parts[1];
-			break;
-		case 3:
-			if (parts[0] > 255 || parts[1] > 255 || parts[2] > 65535) return null;
-			value = parts[0] << 24 | parts[1] << 16 | parts[2];
-			break;
-		default:
-			if (parts.some((p) => p > 255)) return null;
-			value = parts[0] << 24 | parts[1] << 16 | parts[2] << 8 | parts[3];
-	}
-	value = value >>> 0;
-	if (value > 4294967295) return null;
-	return [
-		value >>> 24 & 255,
-		value >>> 16 & 255,
-		value >>> 8 & 255,
-		value & 255
-	].join(".");
-}
-/**
-* Synchronous literal pre-filter: rejects bad schemes, loopback hostnames, and
-* any IP literal (in any encoding) that maps to a blocked address. Does NOT
-* perform DNS — a public *name* that points at a private IP passes here and is
-* caught only by `assertSafeRemoteDefinitionUrl`.
-*/
-function isSafeRemoteDefinitionUrl(raw) {
-	let parsed;
-	try {
-		parsed = new URL(raw);
-	} catch {
-		return false;
-	}
-	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return false;
-	let host = parsed.hostname.toLowerCase();
-	if (!host) return false;
-	if (host === "localhost" || host.endsWith(".localhost")) return false;
-	if (host.startsWith("[") && host.endsWith("]")) host = host.slice(1, -1);
-	if (isIP(host) === 6) return !isBlockedIp(host);
-	const canonical = canonicalizeNumericIpv4(host);
-	if (canonical) return !isBlockedIp(canonical);
-	return true;
-}
-/**
-* True when `raw` targets the link-local range (`169.254.0.0/16`), which
-* carries the cloud metadata service at `169.254.169.254` — the endpoint that
-* hands out a host's own IAM credentials to anything on the box.
-*
-* A far narrower judgement than {@link isSafeRemoteDefinitionUrl}, for the one
-* caller that must tolerate private addresses: an operator's own compute server
-* legitimately lives on `localhost` or a LAN, so blocking RFC1918 there would
-* reject the ordinary self-hosted layout. Nothing legitimate is ever reached
-* over link-local, so this stays blocked with no opt-out.
-*
-* Shares `canonicalizeNumericIpv4`, so the encodings that bypass a naive string
-* comparison — `http://2852039166/`, `http://0251.0376.0251.0376/`,
-* `http://0xa9fea9fe/` — all resolve to the same verdict.
-*/
-function isLinkLocalUrl(raw) {
-	let host;
-	try {
-		host = new URL(raw).hostname.toLowerCase();
-	} catch {
-		return false;
-	}
-	if (!host) return false;
-	if (host.startsWith("[") && host.endsWith("]")) host = host.slice(1, -1);
-	if (isIP(host) === 6) return /^fe[89ab][0-9a-f]:/.test(host);
-	const canonical = canonicalizeNumericIpv4(host);
-	if (!canonical) return false;
-	const [a, b] = canonical.split(".").map(Number);
-	return a === 169 && b === 254;
-}
-/**
-* Full SSRF check: literal pre-filter, then resolve every A/AAAA record and
-* reject if *any* resolved IP is blocked. Returns the original URL on success
-* so callers can `await assertSafeRemoteDefinitionUrl(url)` inline.
-*
-* Every rejection throws the same generic message so the caller gets no oracle;
-* which host was blocked and by which layer is logged server-side instead.
-*/
-async function assertSafeRemoteDefinitionUrl(raw, logger = new NoopLogger()) {
-	if (!isSafeRemoteDefinitionUrl(raw)) {
-		logger.warn("Blocked remote definition URL", {
-			component: "Compute/ssrf",
-			reason: "literal-filter",
-			host: hostOf(raw)
-		});
-		throw new Error("Remote definition URL is not allowed");
-	}
-	const host = new URL(raw).hostname.toLowerCase().replace(/^\[|\]$/g, "");
-	if (isIP(host) !== 0 || canonicalizeNumericIpv4(host)) return raw;
-	let resolved;
-	try {
-		resolved = await lookup(host, { all: true });
-	} catch {
-		logger.warn("Blocked remote definition URL", {
-			component: "Compute/ssrf",
-			reason: "dns-lookup-failed",
-			host
-		});
-		throw new Error("Remote definition URL is not allowed");
-	}
-	if (resolved.length === 0 || resolved.some((r) => isBlockedIp(r.address))) {
-		const blocked = resolved.filter((r) => isBlockedIp(r.address)).map((r) => r.address);
-		logger.warn("Blocked remote definition URL", {
-			component: "Compute/ssrf",
-			reason: "resolves-to-blocked-ip",
-			host,
-			blockedIps: blocked
-		});
-		throw new Error("Remote definition URL is not allowed");
-	}
-	return raw;
-}
-/** Best-effort hostname for logging; falls back to a truncated raw string. */
-function hostOf(raw) {
-	try {
-		return new URL(raw).hostname;
-	} catch {
-		return raw.slice(0, 120);
-	}
-}
-// ../server/src/compute/remote-definition.ts
-/**
-* Remote-definition fetch: SSRF-guarded, size-capped, timed, and TTL-cached.
-*
-* A solve can reference its `.gh` by remote URL instead of a stored blob, and
-* that URL is attacker-controllable — a share-token caller supplies
-* `definitionUrl`. Hence {@link assertSafeRemoteDefinitionUrl}, the early size
-* cap, and the deadline.
-*/
-/** Once the cache exceeds this many entries, evict the oldest 10 by `fetchedAt`. */
-var CACHE_MAX_ENTRIES = 50;
-var CACHE_EVICT_BATCH = 10;
-/**
-* Read a response body into memory, aborting (and throwing) as soon as the
-* running byte total exceeds `maxBytes`. Falls back to `arrayBuffer()` only when
-* the body isn't a readable stream (older fetch impls).
-*/
-async function readBodyWithCap(response, maxBytes, controller) {
-	if (!response.body) {
-		const buffer = await response.arrayBuffer();
-		if (buffer.byteLength > maxBytes) throw new Error("Remote definition exceeds size limit");
-		return new Uint8Array(buffer);
-	}
-	const reader = response.body.getReader();
-	const chunks = [];
-	let total = 0;
-	while (true) {
-		const { done, value } = await reader.read();
-		if (done) break;
-		total += value.byteLength;
-		if (total > maxBytes) {
-			controller.abort();
-			throw new Error("Remote definition exceeds size limit");
-		}
-		chunks.push(value);
-	}
-	const out = new Uint8Array(total);
-	let offset = 0;
-	for (const chunk of chunks) {
-		out.set(chunk, offset);
-		offset += chunk.byteLength;
-	}
-	return out;
-}
-/**
-* Build a remote-definition fetcher owning its own TTL cache. Each fetcher's
-* cache is independent, so one per process shares warm bytes while test fetchers
-* stay isolated.
-*/
-function createRemoteDefinitionFetcher(config) {
-	const cache = /* @__PURE__ */ new Map();
-	const logger = config.logger ?? new NoopLogger();
-	return { async load(url) {
-		await assertSafeRemoteDefinitionUrl(url, logger);
-		const now = config.now();
-		const cached = cache.get(url);
-		if (cached && now - cached.fetchedAt < config.cacheTtlMs) return cached.data;
-		const controller = new AbortController();
-		const timeout = setTimeout(() => controller.abort(), config.fetchTimeoutMs);
-		let data;
-		try {
-			const response = await fetch(url, {
-				signal: controller.signal,
-				redirect: "error"
-			});
-			if (!response.ok) throw new Error(`HTTP ${response.status}: ${response.statusText}`);
-			const declared = Number(response.headers.get("content-length"));
-			if (Number.isFinite(declared) && declared > config.maxBytes) throw new Error("Remote definition exceeds size limit");
-			data = await readBodyWithCap(response, config.maxBytes, controller);
-		} finally {
-			clearTimeout(timeout);
-		}
-		cache.set(url, {
-			data,
-			fetchedAt: now
-		});
-		if (cache.size > CACHE_MAX_ENTRIES) {
-			const entries = Array.from(cache.entries());
-			entries.sort((a, b) => a[1].fetchedAt - b[1].fetchedAt);
-			for (let i = 0; i < CACHE_EVICT_BATCH; i++) cache.delete(entries[i][0]);
-		}
-		return data;
-	} };
-}
-// ../server/src/compute/resolve-server.ts
-/**
-* Pick the right Rhino.Compute server for an (org, definition) pair.
-*
-* Resolution order, narrowest wins:
-*   1. `definitionPin` if it points at a server visible to `orgId`.
-*   2. `orgDefaults[orgId]` if set and visible.
-*   3. Global `defaultServerId`.
-*
-* The store returns the full config; the visibility predicate runs in the pure
-* helper so callers don't reimplement it. Re-throws the pure helper's "nothing
-* visible" failure as a typed `ComputeServerUnconfiguredError`.
-*
-* Reads a key-free config and fetches the `apiKey` only for the server that
-* actually wins, instead of decrypting every configured server's key to use
-* exactly one of them.
-*/
-async function resolveServerForOrg(ctx, orgId, store, opts = {}) {
-	const config = await store.getConfig(ctx);
-	let server;
-	try {
-		server = resolveServerForOrg$1(config, orgId, { definitionPin: opts.definitionPin });
-	} catch (err) {
-		throw new ComputeServerUnconfiguredError(err instanceof Error ? err.message : void 0);
-	}
-	if (!server.hasApiKey) return server;
-	return {
-		...server,
-		apiKey: await store.getServerApiKey(ctx, server.id)
-	};
-}
-// ../server/src/compute/server-config-write.ts
-/**
-* Shared write-path rules for compute server config.
-*
-* Two routes accept a server set: `/api/admin/compute` (platform scope,
-* `manage_compute`) and `/api/v1/orgs/{orgId}/compute` (org scope,
-* `manage_org_compute`). They differ in who may call them, what extra fields
-* they carry (`sharedWith` vs `ownerOrgId`), and how they validate the default
-* selection — but the field validation and the apiKey merge below must behave
-* identically in both, so they live here rather than in either handler.
-*
-* The apiKey merge is why this file exists: if the two copies disagree, a
-* stored credential silently gets cleared or leaked, and nothing fails at
-* build time.
-*/
-/**
-* A stored `serverUrl` is fetched server-side on every status probe, every
-* purge/shutdown action, and every solve, so an unfiltered one is an SSRF
-* primitive handed to whoever holds `manage_compute`. Two rules:
-*
-*   - Scheme allowlist: `http`/`https`. `file:`, `gopher:` and friends are never
-*     a Rhino.Compute endpoint.
-*   - Link-local (`169.254.0.0/16`) is refused. That range carries the cloud
-*     metadata service at `169.254.169.254`, which hands out the host's own IAM
-*     credentials to anything running on the box.
-*
-* **Loopback and RFC1918 are deliberately allowed.** Running compute on
-* `localhost:6500` or a LAN box is the ordinary self-hosted layout, not an
-* attack — most deployments reach their compute server over exactly those
-* addresses. Blocking them by default would break those instances on upgrade
-* and push every operator toward an opt-out flag, and a guard that everyone
-* disables protects nobody. So the check is narrowed to the range where no
-* legitimate compute server ever lives.
-*
-* What this does not stop: a privileged admin pointing the app at an internal
-* host to probe it. That is a real but much weaker concern than credential
-* theft, it needs `manage_compute` already, and it is inseparable from the
-* legitimate case. Revisit if `manage_org_compute` is ever delegated widely on
-* a multi-tenant instance.
-*
-* `isLinkLocalUrl` is reused rather than hand-rolled because a string compare
-* against `169.254.169.254` misses the encodings that reach the same address:
-* `http://2852039166/`, `http://0xa9fea9fe/`, `http://0251.0376.0251.0376/`.
-*/
-function assertUsableServerUrl(serverUrl) {
-	let parsed;
-	try {
-		parsed = new URL(serverUrl);
-	} catch {
-		apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid serverUrl: ${serverUrl}`);
-	}
-	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") apiError(400, ApiErrorCode.VALIDATION_FAILED, `serverUrl must use http or https: ${serverUrl}`);
-	if (isLinkLocalUrl(serverUrl)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `serverUrl points at the link-local range, which carries the cloud metadata service: ${serverUrl}`);
-}
-/**
-* Validates the scope-independent fields of every submitted server. Throws the
-* first failure as a 400; scope-specific fields (`sharedWith`, `ownerOrgId`)
-* are the caller's business.
-*/
-function validateIncomingServers(servers) {
-	for (const s of servers) {
-		if (!s.id || typeof s.id !== "string") apiError(400, ApiErrorCode.VALIDATION_FAILED, "Each server needs an id");
-		if (!s.label || typeof s.label !== "string") apiError(400, ApiErrorCode.VALIDATION_FAILED, "Each server needs a label");
-		if (!s.serverUrl || typeof s.serverUrl !== "string") apiError(400, ApiErrorCode.VALIDATION_FAILED, "Each server needs a serverUrl");
-		assertUsableServerUrl(s.serverUrl);
-		if (s.apiKey !== void 0 && s.apiKey !== null && typeof s.apiKey !== "string") apiError(400, ApiErrorCode.VALIDATION_FAILED, "apiKey must be a string, null, or omitted");
-	}
-}
-/**
-* The UI never receives stored keys — it sends back `hasApiKey` and omits the
-* field for servers the operator didn't touch. So "omitted" cannot mean "clear":
-* it has to preserve, or every save through the settings form would wipe the
-* keys of every server the operator left alone. Clearing is explicit (`null`);
-* an empty string is treated as "not provided" since that's what an untouched
-* password input submits.
-*/
-function resolveApiKey(submitted, storedKey) {
-	if (submitted === null) return void 0;
-	return submitted ? submitted : storedKey;
-}
-/**
-* Builds the id → stored-key lookup the merge reads. The caller passes only the
-* servers in its own scope, so one scope's write can never resolve a key from
-* another's rows.
-*/
-function storedKeysById(scopedServers) {
-	return new Map(scopedServers.map((s) => [s.id, s.apiKey]));
-}
-
-export { isOrgServer as a, assertSafeRemoteDefinitionUrl as b, resolveServerForOrg as c, storedKeysById as d, resolveApiKey as e, serversVisibleTo as f, defaultServerIdFor as g, findServerById as h, isPlatformServer as i, createRemoteDefinitionFetcher as j, platformServers as p, readBodyWithCap as r, scopeConfigToOrg as s, validateIncomingServers as v };
-//# sourceMappingURL=compute.js-a66mA6Yl.js.map

package/build/server/chunks/chunks/compute.js-a66mA6Yl.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"compute.js-a66mA6Yl.js","sources":["../../../../.svelte-kit/output/server/chunks/compute.js"],"sourcesContent":["import \"./src.js\";\nimport { N as ComputeServerUnconfiguredError, O as ApiErrorCode, k as apiError, z as NoopLogger } from \"./access.js\";\nimport { lookup } from \"node:dns/promises\";\nimport { isIP } from \"node:net\";\n// ../platform/src/computeServer/types.ts\nfunction isPlatformServer(s) {\n\treturn s.scope === \"platform\";\n}\nfunction isOrgServer(s) {\n\treturn s.scope === \"org\";\n}\n// ../platform/src/computeServer/utils.ts\n/**\n* Servers an org can see in pickers and use for solves:\n* platform servers shared with this org (or `'all'`, or the global default)\n* ∪ org-private servers owned by this org.\n*/\nfunction serversVisibleTo(config, orgId) {\n\treturn config.servers.filter((s) => {\n\t\tif (isPlatformServer(s)) {\n\t\t\tif (s.id === config.defaultServerId) return true;\n\t\t\tif (s.sharedWith === \"all\") return true;\n\t\t\tif (orgId && s.sharedWith.includes(orgId)) return true;\n\t\t\treturn false;\n\t\t}\n\t\treturn !!orgId && s.ownerOrgId === orgId;\n\t});\n}\n/**\n* Resolves the default server id for an org: per-org override, then global\n* default. Returns `undefined` if neither is set or visible.\n*/\nfunction defaultServerIdFor(config, orgId) {\n\tconst visible = serversVisibleTo(config, orgId);\n\tconst visibleIds = new Set(visible.map((s) => s.id));\n\tif (orgId) {\n\t\tconst orgChoice = config.orgDefaults?.[orgId];\n\t\tif (orgChoice && visibleIds.has(orgChoice)) return orgChoice;\n\t}\n\tif (config.defaultServerId && visibleIds.has(config.defaultServerId)) return config.defaultServerId;\n}\nfunction resolveServerForOrg$1(config, orgId, opts = {}) {\n\tconst visible = serversVisibleTo(config, orgId);\n\tif (visible.length === 0) throw new Error(\"No compute servers are configured or visible for this org.\");\n\tif (opts.definitionPin) {\n\t\tconst pinned = visible.find((s) => s.id === opts.definitionPin);\n\t\tif (pinned) return pinned;\n\t}\n\tconst defaultId = defaultServerIdFor(config, orgId);\n\tif (defaultId) {\n\t\tconst found = visible.find((s) => s.id === defaultId);\n\t\tif (found) return found;\n\t}\n\treturn visible[0];\n}\n/**\n* The config as one org may see it: visible servers only, `orgDefaults` reduced\n* to this org's own entry, and `defaultServerId` dropped when the global default\n* is not visible here.\n*\n* Applied inside `getConfig` when `scopeToOrgId` is passed, so an org-facing\n* caller cannot forget the filter and leak other orgs' server URLs or the\n* instance's default choice.\n*/\nfunction scopeConfigToOrg(config, orgId) {\n\tconst servers = serversVisibleTo(config, orgId);\n\tconst visibleIds = new Set(servers.map((s) => s.id));\n\tconst orgDefault = config.orgDefaults?.[orgId];\n\treturn {\n\t\tservers,\n\t\tdefaultServerId: config.defaultServerId && visibleIds.has(config.defaultServerId) ? config.defaultServerId : void 0,\n\t\torgDefaults: orgDefault ? { [orgId]: orgDefault } : {}\n\t};\n}\n/** Lookup by id, ignoring scope or visibility — for admin contexts that display a server outside the visibility filter. */\nfunction findServerById(config, id) {\n\treturn config.servers.find((s) => s.id === id);\n}\nfunction platformServers(config) {\n\treturn config.servers.filter(isPlatformServer);\n}\n// ../server/src/compute/safe-url.ts\n/**\n* SSRF guard for the remote-definition fetch. Without it an authenticated user\n* could submit `http://169.254.169.254/...` (cloud metadata) or any intranet\n* endpoint and the server would fetch it on their behalf.\n*\n* Two layers:\n*\n*   1. `isSafeRemoteDefinitionUrl` — synchronous, DNS-free literal filter.\n*      Rejects the protocol, hostname literals, and every IP *encoding* that\n*      maps to a blocked address: dotted-decimal, integer, octal, hex,\n*      short-form, IPv4-mapped IPv6.\n*   2. `assertSafeRemoteDefinitionUrl` — resolves the hostname and re-checks the\n*      *resolved* IP, catching a public name that points at a private one.\n*\n* Neither is bulletproof against DNS rebinding — the IP can change between our\n* lookup and fetch's own. Closing that needs the caller to connect to the\n* resolved IP directly, a much larger change; these two layers close the\n* bypasses an attacker actually reaches for (literal encodings, and a public\n* name whose record points inward).\n*/\n/**\n* True when `ip` (a normalized IPv4 or IPv6 literal from `isIP`/`dns.lookup`)\n* is loopback, private, link-local, or otherwise must-not-fetch. IPv4-mapped\n* IPv6 (`::ffff:a.b.c.d`) is unwrapped first so the v4 rules apply.\n*/\nfunction isBlockedIp(ip) {\n\tlet addr = ip.toLowerCase();\n\tconst mappedDotted = /^::ffff:(\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})$/.exec(addr);\n\tif (mappedDotted) addr = mappedDotted[1];\n\telse {\n\t\tconst mappedHex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(addr);\n\t\tif (mappedHex) {\n\t\t\tconst hi = parseInt(mappedHex[1], 16);\n\t\t\tconst lo = parseInt(mappedHex[2], 16);\n\t\t\taddr = [\n\t\t\t\thi >> 8 & 255,\n\t\t\t\thi & 255,\n\t\t\t\tlo >> 8 & 255,\n\t\t\t\tlo & 255\n\t\t\t].join(\".\");\n\t\t}\n\t}\n\tif (isIP(addr) === 4) {\n\t\tconst octets = addr.split(\".\").map(Number);\n\t\tif (octets.length !== 4 || octets.some((o) => o > 255)) return true;\n\t\tconst [a, b] = octets;\n\t\tif (a === 0) return true;\n\t\tif (a === 127) return true;\n\t\tif (a === 10) return true;\n\t\tif (a === 192 && b === 168) return true;\n\t\tif (a === 172 && b >= 16 && b <= 31) return true;\n\t\tif (a === 169 && b === 254) return true;\n\t\treturn false;\n\t}\n\tif (addr === \"::1\" || addr === \"::\") return true;\n\tif (/^(fc|fd)[0-9a-f]{0,2}:/.test(addr)) return true;\n\tif (/^fe[89ab][0-9a-f]:/.test(addr)) return true;\n\treturn false;\n}\n/**\n* Parse a bare-IPv4 hostname in any encoding browsers/glibc accept — integer\n* (`2130706433`), octal (`0177.0.0.1`), hex (`0x7f000001`), and short forms\n* (`127.1`) — into canonical dotted-decimal. An already-valid dotted-quad comes\n* back unchanged. Returns null only when the host is not a numeric IPv4 literal\n* at all, i.e. it's a real name — which is what callers use to decide whether\n* DNS resolution is needed.\n*/\nfunction canonicalizeNumericIpv4(host) {\n\tif (isIP(host) === 4) return host;\n\tconst rawParts = host.split(\".\");\n\tif (rawParts.length === 0 || rawParts.length > 4) return null;\n\tconst parseUInt = (s) => {\n\t\tif (s === \"\") return null;\n\t\tlet n;\n\t\tif (/^0x[0-9a-f]+$/i.test(s)) n = parseInt(s, 16);\n\t\telse if (/^0[0-7]+$/.test(s)) n = parseInt(s, 8);\n\t\telse if (/^[0-9]+$/.test(s)) n = parseInt(s, 10);\n\t\telse return null;\n\t\treturn Number.isFinite(n) ? n : null;\n\t};\n\tconst nums = rawParts.map(parseUInt);\n\tif (nums.some((n) => n === null)) return null;\n\tconst parts = nums;\n\tlet value;\n\tswitch (parts.length) {\n\t\tcase 1:\n\t\t\tvalue = parts[0];\n\t\t\tbreak;\n\t\tcase 2:\n\t\t\tif (parts[0] > 255 || parts[1] > 16777215) return null;\n\t\t\tvalue = parts[0] << 24 | parts[1];\n\t\t\tbreak;\n\t\tcase 3:\n\t\t\tif (parts[0] > 255 || parts[1] > 255 || parts[2] > 65535) return null;\n\t\t\tvalue = parts[0] << 24 | parts[1] << 16 | parts[2];\n\t\t\tbreak;\n\t\tdefault:\n\t\t\tif (parts.some((p) => p > 255)) return null;\n\t\t\tvalue = parts[0] << 24 | parts[1] << 16 | parts[2] << 8 | parts[3];\n\t}\n\tvalue = value >>> 0;\n\tif (value > 4294967295) return null;\n\treturn [\n\t\tvalue >>> 24 & 255,\n\t\tvalue >>> 16 & 255,\n\t\tvalue >>> 8 & 255,\n\t\tvalue & 255\n\t].join(\".\");\n}\n/**\n* Synchronous literal pre-filter: rejects bad schemes, loopback hostnames, and\n* any IP literal (in any encoding) that maps to a blocked address. Does NOT\n* perform DNS — a public *name* that points at a private IP passes here and is\n* caught only by `assertSafeRemoteDefinitionUrl`.\n*/\nfunction isSafeRemoteDefinitionUrl(raw) {\n\tlet parsed;\n\ttry {\n\t\tparsed = new URL(raw);\n\t} catch {\n\t\treturn false;\n\t}\n\tif (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") return false;\n\tlet host = parsed.hostname.toLowerCase();\n\tif (!host) return false;\n\tif (host === \"localhost\" || host.endsWith(\".localhost\")) return false;\n\tif (host.startsWith(\"[\") && host.endsWith(\"]\")) host = host.slice(1, -1);\n\tif (isIP(host) === 6) return !isBlockedIp(host);\n\tconst canonical = canonicalizeNumericIpv4(host);\n\tif (canonical) return !isBlockedIp(canonical);\n\treturn true;\n}\n/**\n* True when `raw` targets the link-local range (`169.254.0.0/16`), which\n* carries the cloud metadata service at `169.254.169.254` — the endpoint that\n* hands out a host's own IAM credentials to anything on the box.\n*\n* A far narrower judgement than {@link isSafeRemoteDefinitionUrl}, for the one\n* caller that must tolerate private addresses: an operator's own compute server\n* legitimately lives on `localhost` or a LAN, so blocking RFC1918 there would\n* reject the ordinary self-hosted layout. Nothing legitimate is ever reached\n* over link-local, so this stays blocked with no opt-out.\n*\n* Shares `canonicalizeNumericIpv4`, so the encodings that bypass a naive string\n* comparison — `http://2852039166/`, `http://0251.0376.0251.0376/`,\n* `http://0xa9fea9fe/` — all resolve to the same verdict.\n*/\nfunction isLinkLocalUrl(raw) {\n\tlet host;\n\ttry {\n\t\thost = new URL(raw).hostname.toLowerCase();\n\t} catch {\n\t\treturn false;\n\t}\n\tif (!host) return false;\n\tif (host.startsWith(\"[\") && host.endsWith(\"]\")) host = host.slice(1, -1);\n\tif (isIP(host) === 6) return /^fe[89ab][0-9a-f]:/.test(host);\n\tconst canonical = canonicalizeNumericIpv4(host);\n\tif (!canonical) return false;\n\tconst [a, b] = canonical.split(\".\").map(Number);\n\treturn a === 169 && b === 254;\n}\n/**\n* Full SSRF check: literal pre-filter, then resolve every A/AAAA record and\n* reject if *any* resolved IP is blocked. Returns the original URL on success\n* so callers can `await assertSafeRemoteDefinitionUrl(url)` inline.\n*\n* Every rejection throws the same generic message so the caller gets no oracle;\n* which host was blocked and by which layer is logged server-side instead.\n*/\nasync function assertSafeRemoteDefinitionUrl(raw, logger = new NoopLogger()) {\n\tif (!isSafeRemoteDefinitionUrl(raw)) {\n\t\tlogger.warn(\"Blocked remote definition URL\", {\n\t\t\tcomponent: \"Compute/ssrf\",\n\t\t\treason: \"literal-filter\",\n\t\t\thost: hostOf(raw)\n\t\t});\n\t\tthrow new Error(\"Remote definition URL is not allowed\");\n\t}\n\tconst host = new URL(raw).hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n\tif (isIP(host) !== 0 || canonicalizeNumericIpv4(host)) return raw;\n\tlet resolved;\n\ttry {\n\t\tresolved = await lookup(host, { all: true });\n\t} catch {\n\t\tlogger.warn(\"Blocked remote definition URL\", {\n\t\t\tcomponent: \"Compute/ssrf\",\n\t\t\treason: \"dns-lookup-failed\",\n\t\t\thost\n\t\t});\n\t\tthrow new Error(\"Remote definition URL is not allowed\");\n\t}\n\tif (resolved.length === 0 || resolved.some((r) => isBlockedIp(r.address))) {\n\t\tconst blocked = resolved.filter((r) => isBlockedIp(r.address)).map((r) => r.address);\n\t\tlogger.warn(\"Blocked remote definition URL\", {\n\t\t\tcomponent: \"Compute/ssrf\",\n\t\t\treason: \"resolves-to-blocked-ip\",\n\t\t\thost,\n\t\t\tblockedIps: blocked\n\t\t});\n\t\tthrow new Error(\"Remote definition URL is not allowed\");\n\t}\n\treturn raw;\n}\n/** Best-effort hostname for logging; falls back to a truncated raw string. */\nfunction hostOf(raw) {\n\ttry {\n\t\treturn new URL(raw).hostname;\n\t} catch {\n\t\treturn raw.slice(0, 120);\n\t}\n}\n// ../server/src/compute/remote-definition.ts\n/**\n* Remote-definition fetch: SSRF-guarded, size-capped, timed, and TTL-cached.\n*\n* A solve can reference its `.gh` by remote URL instead of a stored blob, and\n* that URL is attacker-controllable — a share-token caller supplies\n* `definitionUrl`. Hence {@link assertSafeRemoteDefinitionUrl}, the early size\n* cap, and the deadline.\n*/\n/** Once the cache exceeds this many entries, evict the oldest 10 by `fetchedAt`. */\nvar CACHE_MAX_ENTRIES = 50;\nvar CACHE_EVICT_BATCH = 10;\n/**\n* Read a response body into memory, aborting (and throwing) as soon as the\n* running byte total exceeds `maxBytes`. Falls back to `arrayBuffer()` only when\n* the body isn't a readable stream (older fetch impls).\n*/\nasync function readBodyWithCap(response, maxBytes, controller) {\n\tif (!response.body) {\n\t\tconst buffer = await response.arrayBuffer();\n\t\tif (buffer.byteLength > maxBytes) throw new Error(\"Remote definition exceeds size limit\");\n\t\treturn new Uint8Array(buffer);\n\t}\n\tconst reader = response.body.getReader();\n\tconst chunks = [];\n\tlet total = 0;\n\twhile (true) {\n\t\tconst { done, value } = await reader.read();\n\t\tif (done) break;\n\t\ttotal += value.byteLength;\n\t\tif (total > maxBytes) {\n\t\t\tcontroller.abort();\n\t\t\tthrow new Error(\"Remote definition exceeds size limit\");\n\t\t}\n\t\tchunks.push(value);\n\t}\n\tconst out = new Uint8Array(total);\n\tlet offset = 0;\n\tfor (const chunk of chunks) {\n\t\tout.set(chunk, offset);\n\t\toffset += chunk.byteLength;\n\t}\n\treturn out;\n}\n/**\n* Build a remote-definition fetcher owning its own TTL cache. Each fetcher's\n* cache is independent, so one per process shares warm bytes while test fetchers\n* stay isolated.\n*/\nfunction createRemoteDefinitionFetcher(config) {\n\tconst cache = /* @__PURE__ */ new Map();\n\tconst logger = config.logger ?? new NoopLogger();\n\treturn { async load(url) {\n\t\tawait assertSafeRemoteDefinitionUrl(url, logger);\n\t\tconst now = config.now();\n\t\tconst cached = cache.get(url);\n\t\tif (cached && now - cached.fetchedAt < config.cacheTtlMs) return cached.data;\n\t\tconst controller = new AbortController();\n\t\tconst timeout = setTimeout(() => controller.abort(), config.fetchTimeoutMs);\n\t\tlet data;\n\t\ttry {\n\t\t\tconst response = await fetch(url, {\n\t\t\t\tsignal: controller.signal,\n\t\t\t\tredirect: \"error\"\n\t\t\t});\n\t\t\tif (!response.ok) throw new Error(`HTTP ${response.status}: ${response.statusText}`);\n\t\t\tconst declared = Number(response.headers.get(\"content-length\"));\n\t\t\tif (Number.isFinite(declared) && declared > config.maxBytes) throw new Error(\"Remote definition exceeds size limit\");\n\t\t\tdata = await readBodyWithCap(response, config.maxBytes, controller);\n\t\t} finally {\n\t\t\tclearTimeout(timeout);\n\t\t}\n\t\tcache.set(url, {\n\t\t\tdata,\n\t\t\tfetchedAt: now\n\t\t});\n\t\tif (cache.size > CACHE_MAX_ENTRIES) {\n\t\t\tconst entries = Array.from(cache.entries());\n\t\t\tentries.sort((a, b) => a[1].fetchedAt - b[1].fetchedAt);\n\t\t\tfor (let i = 0; i < CACHE_EVICT_BATCH; i++) cache.delete(entries[i][0]);\n\t\t}\n\t\treturn data;\n\t} };\n}\n// ../server/src/compute/resolve-server.ts\n/**\n* Pick the right Rhino.Compute server for an (org, definition) pair.\n*\n* Resolution order, narrowest wins:\n*   1. `definitionPin` if it points at a server visible to `orgId`.\n*   2. `orgDefaults[orgId]` if set and visible.\n*   3. Global `defaultServerId`.\n*\n* The store returns the full config; the visibility predicate runs in the pure\n* helper so callers don't reimplement it. Re-throws the pure helper's \"nothing\n* visible\" failure as a typed `ComputeServerUnconfiguredError`.\n*\n* Reads a key-free config and fetches the `apiKey` only for the server that\n* actually wins, instead of decrypting every configured server's key to use\n* exactly one of them.\n*/\nasync function resolveServerForOrg(ctx, orgId, store, opts = {}) {\n\tconst config = await store.getConfig(ctx);\n\tlet server;\n\ttry {\n\t\tserver = resolveServerForOrg$1(config, orgId, { definitionPin: opts.definitionPin });\n\t} catch (err) {\n\t\tthrow new ComputeServerUnconfiguredError(err instanceof Error ? err.message : void 0);\n\t}\n\tif (!server.hasApiKey) return server;\n\treturn {\n\t\t...server,\n\t\tapiKey: await store.getServerApiKey(ctx, server.id)\n\t};\n}\n// ../server/src/compute/server-config-write.ts\n/**\n* Shared write-path rules for compute server config.\n*\n* Two routes accept a server set: `/api/admin/compute` (platform scope,\n* `manage_compute`) and `/api/v1/orgs/{orgId}/compute` (org scope,\n* `manage_org_compute`). They differ in who may call them, what extra fields\n* they carry (`sharedWith` vs `ownerOrgId`), and how they validate the default\n* selection — but the field validation and the apiKey merge below must behave\n* identically in both, so they live here rather than in either handler.\n*\n* The apiKey merge is why this file exists: if the two copies disagree, a\n* stored credential silently gets cleared or leaked, and nothing fails at\n* build time.\n*/\n/**\n* A stored `serverUrl` is fetched server-side on every status probe, every\n* purge/shutdown action, and every solve, so an unfiltered one is an SSRF\n* primitive handed to whoever holds `manage_compute`. Two rules:\n*\n*   - Scheme allowlist: `http`/`https`. `file:`, `gopher:` and friends are never\n*     a Rhino.Compute endpoint.\n*   - Link-local (`169.254.0.0/16`) is refused. That range carries the cloud\n*     metadata service at `169.254.169.254`, which hands out the host's own IAM\n*     credentials to anything running on the box.\n*\n* **Loopback and RFC1918 are deliberately allowed.** Running compute on\n* `localhost:6500` or a LAN box is the ordinary self-hosted layout, not an\n* attack — most deployments reach their compute server over exactly those\n* addresses. Blocking them by default would break those instances on upgrade\n* and push every operator toward an opt-out flag, and a guard that everyone\n* disables protects nobody. So the check is narrowed to the range where no\n* legitimate compute server ever lives.\n*\n* What this does not stop: a privileged admin pointing the app at an internal\n* host to probe it. That is a real but much weaker concern than credential\n* theft, it needs `manage_compute` already, and it is inseparable from the\n* legitimate case. Revisit if `manage_org_compute` is ever delegated widely on\n* a multi-tenant instance.\n*\n* `isLinkLocalUrl` is reused rather than hand-rolled because a string compare\n* against `169.254.169.254` misses the encodings that reach the same address:\n* `http://2852039166/`, `http://0xa9fea9fe/`, `http://0251.0376.0251.0376/`.\n*/\nfunction assertUsableServerUrl(serverUrl) {\n\tlet parsed;\n\ttry {\n\t\tparsed = new URL(serverUrl);\n\t} catch {\n\t\tapiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid serverUrl: ${serverUrl}`);\n\t}\n\tif (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") apiError(400, ApiErrorCode.VALIDATION_FAILED, `serverUrl must use http or https: ${serverUrl}`);\n\tif (isLinkLocalUrl(serverUrl)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `serverUrl points at the link-local range, which carries the cloud metadata service: ${serverUrl}`);\n}\n/**\n* Validates the scope-independent fields of every submitted server. Throws the\n* first failure as a 400; scope-specific fields (`sharedWith`, `ownerOrgId`)\n* are the caller's business.\n*/\nfunction validateIncomingServers(servers) {\n\tfor (const s of servers) {\n\t\tif (!s.id || typeof s.id !== \"string\") apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Each server needs an id\");\n\t\tif (!s.label || typeof s.label !== \"string\") apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Each server needs a label\");\n\t\tif (!s.serverUrl || typeof s.serverUrl !== \"string\") apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Each server needs a serverUrl\");\n\t\tassertUsableServerUrl(s.serverUrl);\n\t\tif (s.apiKey !== void 0 && s.apiKey !== null && typeof s.apiKey !== \"string\") apiError(400, ApiErrorCode.VALIDATION_FAILED, \"apiKey must be a string, null, or omitted\");\n\t}\n}\n/**\n* The UI never receives stored keys — it sends back `hasApiKey` and omits the\n* field for servers the operator didn't touch. So \"omitted\" cannot mean \"clear\":\n* it has to preserve, or every save through the settings form would wipe the\n* keys of every server the operator left alone. Clearing is explicit (`null`);\n* an empty string is treated as \"not provided\" since that's what an untouched\n* password input submits.\n*/\nfunction resolveApiKey(submitted, storedKey) {\n\tif (submitted === null) return void 0;\n\treturn submitted ? submitted : storedKey;\n}\n/**\n* Builds the id → stored-key lookup the merge reads. The caller passes only the\n* servers in its own scope, so one scope's write can never resolve a key from\n* another's rows.\n*/\nfunction storedKeysById(scopedServers) {\n\treturn new Map(scopedServers.map((s) => [s.id, s.apiKey]));\n}\nexport { createRemoteDefinitionFetcher as a, defaultServerIdFor as c, scopeConfigToOrg as d, serversVisibleTo as f, resolveServerForOrg as i, findServerById as l, isPlatformServer as m, storedKeysById as n, readBodyWithCap as o, isOrgServer as p, validateIncomingServers as r, assertSafeRemoteDefinitionUrl as s, resolveApiKey as t, platformServers as u };\n"],"names":[],"mappings":";;;;;AAIA;AACA,SAAS,gBAAgB,CAAC,CAAC,EAAE;AAC7B,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,UAAU;AAC9B;AACA,SAAS,WAAW,CAAC,CAAC,EAAE;AACxB,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,KAAK;AACzB;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,CAAC,MAAM,EAAE,KAAK,EAAE;AACzC,CAAC,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;AACrC,EAAE,IAAI,gBAAgB,CAAC,CAAC,CAAC,EAAE;AAC3B,GAAG,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,eAAe,EAAE,OAAO,IAAI;AACnD,GAAG,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,EAAE,OAAO,IAAI;AAC1C,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,IAAI;AACzD,GAAG,OAAO,KAAK;AACf,EAAE;AACF,EAAE,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK;AAC1C,CAAC,CAAC,CAAC;AACH;AACA;AACA;AACA;AACA;AACA,SAAS,kBAAkB,CAAC,MAAM,EAAE,KAAK,EAAE;AAC3C,CAAC,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC;AAChD,CAAC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;AACrD,CAAC,IAAI,KAAK,EAAE;AACZ,EAAE,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC;AAC/C,EAAE,IAAI,SAAS,IAAI,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,OAAO,SAAS;AAC9D,CAAC;AACD,CAAC,IAAI,MAAM,CAAC,eAAe,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,OAAO,MAAM,CAAC,eAAe;AACpG;AACA,SAAS,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE;AACzD,CAAC,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC;AAChD,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC;AACxG,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE;AACzB,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,aAAa,CAAC;AACjE,EAAE,IAAI,MAAM,EAAE,OAAO,MAAM;AAC3B,CAAC;AACD,CAAC,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC;AACpD,CAAC,IAAI,SAAS,EAAE;AAChB,EAAE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC;AACvD,EAAE,IAAI,KAAK,EAAE,OAAO,KAAK;AACzB,CAAC;AACD,CAAC,OAAO,OAAO,CAAC,CAAC,CAAC;AAClB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,CAAC,MAAM,EAAE,KAAK,EAAE;AACzC,CAAC,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC;AAChD,CAAC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;AACrD,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC;AAC/C,CAAC,OAAO;AACR,EAAE,OAAO;AACT,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,MAAM,CAAC,eAAe,GAAG,MAAM;AACrH,EAAE,WAAW,EAAE,UAAU,GAAG,EAAE,CAAC,KAAK,GAAG,UAAU,EAAE,GAAG;AACtD,EAAE;AACF;AACA;AACA,SAAS,cAAc,CAAC,MAAM,EAAE,EAAE,EAAE;AACpC,CAAC,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;AAC/C;AACA,SAAS,eAAe,CAAC,MAAM,EAAE;AACjC,CAAC,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC;AAC/C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,WAAW,CAAC,EAAE,EAAE;AACzB,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,WAAW,EAAE;AAC5B,CAAC,MAAM,YAAY,GAAG,+CAA+C,CAAC,IAAI,CAAC,IAAI,CAAC;AAChF,CAAC,IAAI,YAAY,EAAE,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC;AACzC,MAAM;AACN,EAAE,MAAM,SAAS,GAAG,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC;AACzE,EAAE,IAAI,SAAS,EAAE;AACjB,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACxC,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACxC,GAAG,IAAI,GAAG;AACV,IAAI,EAAE,IAAI,CAAC,GAAG,GAAG;AACjB,IAAI,EAAE,GAAG,GAAG;AACZ,IAAI,EAAE,IAAI,CAAC,GAAG,GAAG;AACjB,IAAI,EAAE,GAAG;AACT,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACd,EAAE;AACF,CAAC;AACD,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;AACvB,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;AAC5C,EAAE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,EAAE,OAAO,IAAI;AACrE,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM;AACvB,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,IAAI;AAC1B,EAAE,IAAI,CAAC,KAAK,GAAG,EAAE,OAAO,IAAI;AAC5B,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,OAAO,IAAI;AAC3B,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,OAAO,IAAI;AACzC,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,IAAI;AAClD,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,OAAO,IAAI;AACzC,EAAE,OAAO,KAAK;AACd,CAAC;AACD,CAAC,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI,EAAE,OAAO,IAAI;AACjD,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,IAAI;AACrD,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,IAAI;AACjD,CAAC,OAAO,KAAK;AACb;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,uBAAuB,CAAC,IAAI,EAAE;AACvC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,IAAI;AAClC,CAAC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;AACjC,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,OAAO,IAAI;AAC9D,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK;AAC1B,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,OAAO,IAAI;AAC3B,EAAE,IAAI,CAAC;AACP,EAAE,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC;AACnD,OAAO,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;AAClD,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC;AAClD,OAAO,OAAO,IAAI;AAClB,EAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI;AACtC,CAAC,CAAC;AACF,CAAC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;AACrC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,EAAE,OAAO,IAAI;AAC9C,CAAC,MAAM,KAAK,GAAG,IAAI;AACnB,CAAC,IAAI,KAAK;AACV,CAAC,QAAQ,KAAK,CAAC,MAAM;AACrB,EAAE,KAAK,CAAC;AACR,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC;AACnB,GAAG;AACH,EAAE,KAAK,CAAC;AACR,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,EAAE,OAAO,IAAI;AACzD,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;AACpC,GAAG;AACH,EAAE,KAAK,CAAC;AACR,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,OAAO,IAAI;AACxE,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;AACrD,GAAG;AACH,EAAE;AACF,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,EAAE,OAAO,IAAI;AAC9C,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;AACrE;AACA,CAAC,KAAK,GAAG,KAAK,KAAK,CAAC;AACpB,CAAC,IAAI,KAAK,GAAG,UAAU,EAAE,OAAO,IAAI;AACpC,CAAC,OAAO;AACR,EAAE,KAAK,KAAK,EAAE,GAAG,GAAG;AACpB,EAAE,KAAK,KAAK,EAAE,GAAG,GAAG;AACpB,EAAE,KAAK,KAAK,CAAC,GAAG,GAAG;AACnB,EAAE,KAAK,GAAG;AACV,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,yBAAyB,CAAC,GAAG,EAAE;AACxC,CAAC,IAAI,MAAM;AACX,CAAC,IAAI;AACL,EAAE,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC;AACvB,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD,CAAC,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,OAAO,KAAK;AAC9E,CAAC,IAAI,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE;AACzC,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,KAAK;AACxB,CAAC,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,KAAK;AACtE,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;AACzE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;AAChD,CAAC,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,CAAC;AAChD,CAAC,IAAI,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC;AAC9C,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,GAAG,EAAE;AAC7B,CAAC,IAAI,IAAI;AACT,CAAC,IAAI;AACL,EAAE,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE;AAC5C,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,KAAK;AACxB,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;AACzE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;AAC7D,CAAC,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,CAAC;AAChD,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,KAAK;AAC7B,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;AAChD,CAAC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;AAC9B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,6BAA6B,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,UAAU,EAAE,EAAE;AAC7E,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,EAAE;AACtC,EAAE,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;AAC/C,GAAG,SAAS,EAAE,cAAc;AAC5B,GAAG,MAAM,EAAE,gBAAgB;AAC3B,GAAG,IAAI,EAAE,MAAM,CAAC,GAAG;AACnB,GAAG,CAAC;AACJ,EAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC;AACzD,CAAC;AACD,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;AACzE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG;AAClE,CAAC,IAAI,QAAQ;AACb,CAAC,IAAI;AACL,EAAE,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AAC9C,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;AAC/C,GAAG,SAAS,EAAE,cAAc;AAC5B,GAAG,MAAM,EAAE,mBAAmB;AAC9B,GAAG;AACH,GAAG,CAAC;AACJ,EAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC;AACzD,CAAC;AACD,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE;AAC5E,EAAE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AACtF,EAAE,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;AAC/C,GAAG,SAAS,EAAE,cAAc;AAC5B,GAAG,MAAM,EAAE,wBAAwB;AACnC,GAAG,IAAI;AACP,GAAG,UAAU,EAAE;AACf,GAAG,CAAC;AACJ,EAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC;AACzD,CAAC;AACD,CAAC,OAAO,GAAG;AACX;AACA;AACA,SAAS,MAAM,CAAC,GAAG,EAAE;AACrB,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ;AAC9B,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;AAC1B,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,iBAAiB,GAAG,EAAE;AAC1B,IAAI,iBAAiB,GAAG,EAAE;AAC1B;AACA;AACA;AACA;AACA;AACA,eAAe,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE;AAC/D,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;AACrB,EAAE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE;AAC7C,EAAE,IAAI,MAAM,CAAC,UAAU,GAAG,QAAQ,EAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC;AAC3F,EAAE,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC;AAC/B,CAAC;AACD,CAAC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE;AACzC,CAAC,MAAM,MAAM,GAAG,EAAE;AAClB,CAAC,IAAI,KAAK,GAAG,CAAC;AACd,CAAC,OAAO,IAAI,EAAE;AACd,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE;AAC7C,EAAE,IAAI,IAAI,EAAE;AACZ,EAAE,KAAK,IAAI,KAAK,CAAC,UAAU;AAC3B,EAAE,IAAI,KAAK,GAAG,QAAQ,EAAE;AACxB,GAAG,UAAU,CAAC,KAAK,EAAE;AACrB,GAAG,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC;AAC1D,EAAE;AACF,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AACD,CAAC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC;AAClC,CAAC,IAAI,MAAM,GAAG,CAAC;AACf,CAAC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE;AAC7B,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC;AACxB,EAAE,MAAM,IAAI,KAAK,CAAC,UAAU;AAC5B,CAAC;AACD,CAAC,OAAO,GAAG;AACX;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,6BAA6B,CAAC,MAAM,EAAE;AAC/C,CAAC,MAAM,KAAK,mBAAmB,IAAI,GAAG,EAAE;AACxC,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,UAAU,EAAE;AACjD,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,GAAG,EAAE;AAC1B,EAAE,MAAM,6BAA6B,CAAC,GAAG,EAAE,MAAM,CAAC;AAClD,EAAE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE;AAC1B,EAAE,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;AAC/B,EAAE,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,OAAO,MAAM,CAAC,IAAI;AAC9E,EAAE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE;AAC1C,EAAE,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,cAAc,CAAC;AAC7E,EAAE,IAAI,IAAI;AACV,EAAE,IAAI;AACN,GAAG,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;AACrC,IAAI,MAAM,EAAE,UAAU,CAAC,MAAM;AAC7B,IAAI,QAAQ,EAAE;AACd,IAAI,CAAC;AACL,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;AACvF,GAAG,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AAClE,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC;AACvH,GAAG,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC;AACtE,EAAE,CAAC,SAAS;AACZ,GAAG,YAAY,CAAC,OAAO,CAAC;AACxB,EAAE;AACF,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;AACjB,GAAG,IAAI;AACP,GAAG,SAAS,EAAE;AACd,GAAG,CAAC;AACJ,EAAE,IAAI,KAAK,CAAC,IAAI,GAAG,iBAAiB,EAAE;AACtC,GAAG,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;AAC9C,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1D,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,iBAAiB,EAAE,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1E,EAAE;AACF,EAAE,OAAO,IAAI;AACb,CAAC,CAAC,EAAE;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE;AACjE,CAAC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC;AAC1C,CAAC,IAAI,MAAM;AACX,CAAC,IAAI;AACL,EAAE,MAAM,GAAG,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;AACtF,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,MAAM,IAAI,8BAA8B,CAAC,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC;AACvF,CAAC;AACD,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,MAAM;AACrC,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,MAAM,EAAE,MAAM,KAAK,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE;AACpD,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,SAAS,EAAE;AAC1C,CAAC,IAAI,MAAM;AACX,CAAC,IAAI;AACL,EAAE,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC;AAC7B,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC,CAAC;AAClF,CAAC;AACD,CAAC,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,kCAAkC,EAAE,SAAS,CAAC,CAAC,CAAC;AACjK,CAAC,IAAI,cAAc,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,CAAC,oFAAoF,EAAE,SAAS,CAAC,CAAC,CAAC;AACjL;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,uBAAuB,CAAC,OAAO,EAAE;AAC1C,CAAC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE;AAC1B,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,yBAAyB,CAAC;AACjH,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,2BAA2B,CAAC;AACzH,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,+BAA+B,CAAC;AACrI,EAAE,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC;AACpC,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,2CAA2C,CAAC;AAC1K,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE;AAC7C,CAAC,IAAI,SAAS,KAAK,IAAI,EAAE,OAAO,MAAM;AACtC,CAAC,OAAO,SAAS,GAAG,SAAS,GAAG,SAAS;AACzC;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,aAAa,EAAE;AACvC,CAAC,OAAO,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3D;;;;"}

package/build/server/chunks/chunks/computeLimits.js-rJ4DCFVA.js

@@ -1,44 +0,0 @@
-import { b as private_env } from './shared-server.js-CJsQadj4.js';
-import { k as lazyLogger } from './providers.server.js-D30wnnA4.js';
-import './src.js-DYeCa7A9.js';
-import { e as resolveComputeLimits } from './access.js-BZIkVfZv.js';
-import 'node:dns/promises';
-import 'node:net';
-
-// src/lib/server/computeLimits.ts
-/**
-* Thin adapter over `@selvajs/server`'s `resolveComputeLimits`: reads SvelteKit's
-* dynamic private env once and re-exports the resolved values as named constants.
-*
-* Uses `$env/dynamic/private`, not bare `process.env`: under `vite dev`, Vite
-* loads `.env` into this module but does NOT mirror it into `process.env`, so a
-* raw `process.env[name]` is undefined in dev and every knob silently falls back
-* to its default regardless of `.env`.
-*
-* Client-side counterparts (in-flight compute throttle, slider debounce) are
-* bundled into the client and can't read env — see `async-throttle.ts` in
-* `@selvajs/solve/client` and the input components.
-*/
-var limits = resolveComputeLimits(private_env, lazyLogger);
-/** The whole resolved object — passed wholesale to `SolveEngine` (`compute/engine.server.ts`). */
-var computeLimits = limits;
-var SOLVE_DEADLINE_MS = limits.solveDeadlineMs;
-var RATE_LIMIT_WINDOW_MS = limits.rateLimitWindowMs;
-var RATE_LIMIT_MAX_REQUESTS = limits.rateLimitMaxRequests;
-var MAX_DEFINITION_FILE_SIZE = limits.maxDefinitionFileSize;
-var MAX_IMAGE_FILE_SIZE = limits.maxImageFileSize;
-var COMPUTE_REQUEST_MAX_BYTES = limits.computeRequestMaxBytes;
-var COMPUTE_RESPONSE_MAX_BYTES = limits.computeResponseMaxBytes;
-var REMOTE_DEFINITION_MAX_BYTES = limits.remoteDefinitionMaxBytes;
-var REMOTE_DEFINITION_FETCH_TIMEOUT_MS = limits.remoteDefinitionFetchTimeoutMs;
-var REMOTE_DEFINITION_CACHE_TTL_MS = limits.remoteDefinitionCacheTtlMs;
-limits.computeReuseDefinitionCache;
-limits.computeServerCachesolve;
-limits.computeCacheErroredSolves;
-limits.computeMaxQueueDepth;
-limits.computeQueueWaitMs;
-var COMPUTE_DEFINITION_CACHE_BYTES = limits.computeDefinitionCacheBytes;
-var COMPUTE_SOLVE_CACHE_BYTES = limits.computeSolveCacheBytes;
-
-export { COMPUTE_DEFINITION_CACHE_BYTES as C, MAX_IMAGE_FILE_SIZE as M, RATE_LIMIT_MAX_REQUESTS as R, SOLVE_DEADLINE_MS as S, RATE_LIMIT_WINDOW_MS as a, MAX_DEFINITION_FILE_SIZE as b, computeLimits as c, COMPUTE_SOLVE_CACHE_BYTES as d, REMOTE_DEFINITION_CACHE_TTL_MS as e, REMOTE_DEFINITION_FETCH_TIMEOUT_MS as f, REMOTE_DEFINITION_MAX_BYTES as g, COMPUTE_RESPONSE_MAX_BYTES as h, COMPUTE_REQUEST_MAX_BYTES as i };
-//# sourceMappingURL=computeLimits.js-rJ4DCFVA.js.map

package/build/server/chunks/chunks/computeLimits.js-rJ4DCFVA.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"computeLimits.js-rJ4DCFVA.js","sources":["../../../../.svelte-kit/output/server/chunks/computeLimits.js"],"sourcesContent":["import { t as private_env } from \"./shared-server.js\";\nimport { w as lazyLogger } from \"./providers.server.js\";\nimport \"./compute.js\";\nimport { L as resolveComputeLimits } from \"./access.js\";\n// src/lib/server/computeLimits.ts\n/**\n* Thin adapter over `@selvajs/server`'s `resolveComputeLimits`: reads SvelteKit's\n* dynamic private env once and re-exports the resolved values as named constants.\n*\n* Uses `$env/dynamic/private`, not bare `process.env`: under `vite dev`, Vite\n* loads `.env` into this module but does NOT mirror it into `process.env`, so a\n* raw `process.env[name]` is undefined in dev and every knob silently falls back\n* to its default regardless of `.env`.\n*\n* Client-side counterparts (in-flight compute throttle, slider debounce) are\n* bundled into the client and can't read env — see `async-throttle.ts` in\n* `@selvajs/solve/client` and the input components.\n*/\nvar limits = resolveComputeLimits(private_env, lazyLogger);\n/** The whole resolved object — passed wholesale to `SolveEngine` (`compute/engine.server.ts`). */\nvar computeLimits = limits;\nvar SOLVE_DEADLINE_MS = limits.solveDeadlineMs;\nvar RATE_LIMIT_WINDOW_MS = limits.rateLimitWindowMs;\nvar RATE_LIMIT_MAX_REQUESTS = limits.rateLimitMaxRequests;\nvar MAX_DEFINITION_FILE_SIZE = limits.maxDefinitionFileSize;\nvar MAX_IMAGE_FILE_SIZE = limits.maxImageFileSize;\nvar COMPUTE_REQUEST_MAX_BYTES = limits.computeRequestMaxBytes;\nvar COMPUTE_RESPONSE_MAX_BYTES = limits.computeResponseMaxBytes;\nvar REMOTE_DEFINITION_MAX_BYTES = limits.remoteDefinitionMaxBytes;\nvar REMOTE_DEFINITION_FETCH_TIMEOUT_MS = limits.remoteDefinitionFetchTimeoutMs;\nvar REMOTE_DEFINITION_CACHE_TTL_MS = limits.remoteDefinitionCacheTtlMs;\nlimits.computeReuseDefinitionCache;\nlimits.computeServerCachesolve;\nlimits.computeCacheErroredSolves;\nlimits.computeMaxQueueDepth;\nlimits.computeQueueWaitMs;\nvar COMPUTE_DEFINITION_CACHE_BYTES = limits.computeDefinitionCacheBytes;\nvar COMPUTE_SOLVE_CACHE_BYTES = limits.computeSolveCacheBytes;\nexport { MAX_DEFINITION_FILE_SIZE as a, RATE_LIMIT_WINDOW_MS as c, REMOTE_DEFINITION_MAX_BYTES as d, SOLVE_DEADLINE_MS as f, COMPUTE_SOLVE_CACHE_BYTES as i, REMOTE_DEFINITION_CACHE_TTL_MS as l, COMPUTE_REQUEST_MAX_BYTES as n, MAX_IMAGE_FILE_SIZE as o, computeLimits as p, COMPUTE_RESPONSE_MAX_BYTES as r, RATE_LIMIT_MAX_REQUESTS as s, COMPUTE_DEFINITION_CACHE_BYTES as t, REMOTE_DEFINITION_FETCH_TIMEOUT_MS as u };\n"],"names":[],"mappings":";;;;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,MAAM,GAAG,oBAAoB,CAAC,WAAW,EAAE,UAAU,CAAC;AAC1D;AACG,IAAC,aAAa,GAAG;AACjB,IAAC,iBAAiB,GAAG,MAAM,CAAC;AAC5B,IAAC,oBAAoB,GAAG,MAAM,CAAC;AAC/B,IAAC,uBAAuB,GAAG,MAAM,CAAC;AAClC,IAAC,wBAAwB,GAAG,MAAM,CAAC;AACnC,IAAC,mBAAmB,GAAG,MAAM,CAAC;AAC9B,IAAC,yBAAyB,GAAG,MAAM,CAAC;AACpC,IAAC,0BAA0B,GAAG,MAAM,CAAC;AACrC,IAAC,2BAA2B,GAAG,MAAM,CAAC;AACtC,IAAC,kCAAkC,GAAG,MAAM,CAAC;AAC7C,IAAC,8BAA8B,GAAG,MAAM,CAAC;AAC5C,MAAM,CAAC,2BAA2B;AAClC,MAAM,CAAC,uBAAuB;AAC9B,MAAM,CAAC,yBAAyB;AAChC,MAAM,CAAC,oBAAoB;AAC3B,MAAM,CAAC,kBAAkB;AACtB,IAAC,8BAA8B,GAAG,MAAM,CAAC;AACzC,IAAC,yBAAyB,GAAG,MAAM,CAAC;;;;"}

package/build/server/chunks/chunks/computeRateLimit.server.js-CitLvqXR.js

@@ -1,31 +0,0 @@
-import { b as private_env } from './shared-server.js-CJsQadj4.js';
-import { k as lazyLogger } from './providers.server.js-D30wnnA4.js';
-import './src.js-DYeCa7A9.js';
-import './access.js-BZIkVfZv.js';
-import 'node:dns/promises';
-import 'node:net';
-import { c as createComputeRateLimiter } from './rate-limit.js-Br3luBbc.js';
-import { x as createApiRateLimiter, y as resolveApiRateLimitConfig } from './api.js-Z7amRz4t.js';
-import { R as RATE_LIMIT_MAX_REQUESTS, a as RATE_LIMIT_WINDOW_MS } from './computeLimits.js-rJ4DCFVA.js';
-
-// src/lib/server/computeRateLimit.server.ts
-/**
-* App-wide instance of the compute-solve rate limiter (fixed-window, per-key,
-* process-local; `@selvajs/server`'s `createComputeRateLimiter`), wired with the
-* window + cap from `computeLimits.ts`.
-*
-* Keyed by caller — `user:{userId}` for authenticated solves, `share:{linkId}`
-* for share-token solves so anonymous consumers of one link don't share a
-* bucket with the link's owner.
-*/
-var limiter = createComputeRateLimiter({
-	windowMs: RATE_LIMIT_WINDOW_MS,
-	maxPerWindow: RATE_LIMIT_MAX_REQUESTS
-});
-function checkComputeRateLimit(key) {
-	return limiter.check(key);
-}
-var apiRateLimiter = createApiRateLimiter(resolveApiRateLimitConfig(private_env, lazyLogger));
-
-export { apiRateLimiter as a, checkComputeRateLimit as c };
-//# sourceMappingURL=computeRateLimit.server.js-CitLvqXR.js.map