@selvajs/selva 4.20.0-beta.2 → 4.20.0-beta.3

package/build/server/chunks/entries/endpoints/api/admin/system/health/_server.ts.js-tfn0ELz6.js

@@ -1,363 +0,0 @@
-import { b as private_env } from '../../../../../../chunks/shared-server.js-BGs15m2r.js';
-import '../../../../../../chunks/src.js-bYgw0r8C.js';
-import { p as providers, r as getComputeServerConfigStore, L as LocalComputeServerStore } from '../../../../../../chunks/providers.server.js-Wp14z2ES.js';
-import { f as findServerById } from '../../../../../../chunks/utils2.js-C9XYOWak.js';
-import { q as requirePermission } from '../../../../../../chunks/access.js-DR4cexvJ.js';
-import { h } from '../../../../../../chunks/schema.js-CPjRq84j.js';
-import '../../../../../../chunks/api.js-pA5_VXdB.js';
-import { json } from '@sveltejs/kit';
-import { randomUUID } from 'node:crypto';
-import { resolve, join } from 'node:path';
-import { mkdir, writeFile, unlink } from 'node:fs/promises';
-import 'zod';
-import '../../../../../../chunks/definitions.js-CI90mQ1G.js';
-import 'node:url';
-import 'node:fs';
-import '@supabase/supabase-js';
-import '../../../../../../chunks/rate-limit.js-Br3luBbc.js';
-
-//#region ../server/src/ops/deploymentConfig.ts
-/**
-* Parse a `BODY_SIZE_LIMIT` the way adapter-node does, so this agrees with the
-* thing that actually rejects the request.
-*
-* The quirk is load-bearing: adapter-node reads only the LAST character as the
-* suffix, so `60mb` parses as the digits `60m` and happens to mean 60 MB, while
-* `60xy` silently becomes NaN. Returns bytes, or null when the value is one
-* adapter-node can't use.
-*/
-function parseBodySizeLimit(raw) {
-	if (raw == null || raw === "") return null;
-	const value = String(raw).trim();
-	if (value === "") return null;
-	const multiplier = {
-		K: 1024,
-		M: 1048576,
-		G: 1073741824
-	}[value.at(-1).toUpperCase()] ?? 1;
-	const bytes = Number(multiplier !== 1 ? value.slice(0, -1) : value) * multiplier;
-	if (!Number.isFinite(bytes) || bytes <= 0) return null;
-	return bytes;
-}
-/** The app's own default for COMPUTE_REQUEST_MAX_BYTES (compute/limits.ts). */
-var COMPUTE_REQUEST_DEFAULT_BYTES = 268435456;
-var asMb = (bytes) => `${Math.round(bytes / 1048576)} MB`;
-/**
-* BODY_SIZE_LIMIT has to clear the compute request cap, or adapter-node's global
-* backstop rejects the upload first — with a non-JSON body the app never sees
-* and cannot log. Unset is the dangerous case, not a neutral one: adapter-node
-* falls back to 512 KB, so every upload 413s on a deployment that looks fine.
-*/
-function checkBodySizeLimit(env) {
-	const base = {
-		id: "body-size-limit",
-		label: "Upload size limit"
-	};
-	const raw = env.BODY_SIZE_LIMIT;
-	const requestCap = Number(env.COMPUTE_REQUEST_MAX_BYTES) || COMPUTE_REQUEST_DEFAULT_BYTES;
-	if (raw == null || raw === "") return {
-		...base,
-		verdict: "fail",
-		summary: "BODY_SIZE_LIMIT is unset — adapter-node falls back to 512 KB, so uploads over that fail with an opaque 413 no app log records.",
-		remediation: `Set BODY_SIZE_LIMIT to at least ${asMb(requestCap)} (the compute request cap) and restart.`
-	};
-	const bytes = parseBodySizeLimit(raw);
-	if (bytes === null) return {
-		...base,
-		verdict: "fail",
-		summary: `BODY_SIZE_LIMIT="${raw}" — adapter-node cannot parse this and throws on boot.`,
-		remediation: "Use a byte count or a single K/M/G suffix, e.g. \"256M\"."
-	};
-	if (bytes < requestCap) return {
-		...base,
-		verdict: "warn",
-		summary: `BODY_SIZE_LIMIT=${raw} (${asMb(bytes)}) is below COMPUTE_REQUEST_MAX_BYTES (${asMb(requestCap)}) — the global cap rejects first, making the compute cap dead config.`,
-		remediation: `Raise BODY_SIZE_LIMIT to at least ${asMb(requestCap)} and restart.`
-	};
-	return {
-		...base,
-		verdict: "ok",
-		summary: `BODY_SIZE_LIMIT=${raw} clears the compute request cap.`
-	};
-}
-/**
-* `ADDRESS_HEADER` / `XFF_DEPTH` are read by adapter-node, not by Selva, and
-* unset they are invisible: nothing fails, nothing logs, and the deployment
-* looks healthy.
-*
-* What actually happens is that `getClientAddress()` returns the socket peer,
-* which behind a reverse proxy is the proxy — `127.0.0.1` for every request
-* from every user. Login rate limiting keys on that, so the whole instance
-* shares one bucket: five failed logins from anywhere return 429 to everyone,
-* and only a *successful* login clears a bucket, which nobody can then reach.
-*
-* `ORIGIN` is the proxy tell. It is only needed when the app is served under a
-* public URL it can't derive from its own socket, so its presence means a proxy
-* is terminating requests. Without it we say nothing: on a directly-reachable
-* app these settings are a footgun, since `X-Forwarded-For` is client-supplied
-* and anyone could then pick their own rate-limit bucket.
-*/
-function checkClientAddress(env) {
-	const base = {
-		id: "client-address",
-		label: "Client IP behind proxy"
-	};
-	const header = env.ADDRESS_HEADER;
-	const depth = env.XFF_DEPTH;
-	if (!env.ORIGIN) return {
-		...base,
-		verdict: "ok",
-		summary: "ADDRESS_HEADER is not needed — ORIGIN is unset, so no reverse proxy is in play."
-	};
-	if (!header) return {
-		...base,
-		verdict: "fail",
-		summary: "ADDRESS_HEADER is unset while ORIGIN is set — every request looks like it came from the proxy, so all users share ONE login rate-limit bucket. Five failed logins from anyone locks out the whole instance for 15 minutes.",
-		remediation: "Set ADDRESS_HEADER=X-Forwarded-For and XFF_DEPTH=<number of proxies>, then restart. To count your proxies, see docs/self-hosting/deployment/reverse-proxy.md."
-	};
-	if (header.toLowerCase() === "x-forwarded-for" && !depth) return {
-		...base,
-		verdict: "warn",
-		summary: `ADDRESS_HEADER=${header} but XFF_DEPTH is unset. X-Forwarded-For is a client-appendable list, so a caller can prepend fake entries — adapter-node needs the proxy count to know which entry is real.`,
-		remediation: "Set XFF_DEPTH=1 for a single reverse proxy, 2 if a CDN or load balancer sits in front of it. Unsure? docs/self-hosting/deployment/reverse-proxy.md shows how to read the header the app actually receives."
-	};
-	if (depth !== void 0 && !/^[1-9][0-9]*$/.test(depth)) return {
-		...base,
-		verdict: "fail",
-		summary: `XFF_DEPTH="${depth}" is not a positive integer.`,
-		remediation: "It counts proxies from the outside in — use 1 for a single reverse proxy."
-	};
-	return {
-		...base,
-		verdict: "ok",
-		summary: `ADDRESS_HEADER=${header}${depth ? ` (XFF_DEPTH=${depth})` : ""}.`
-	};
-}
-/** Every deployment-config rule, in report order. */
-function checkDeploymentConfig(env) {
-	return [checkClientAddress(env), checkBodySizeLimit(env)];
-}
-//#endregion
-//#region src/routes/api/admin/system/health/+server.ts
-function atRestSecretsCheck(report) {
-	const base = {
-		id: "at-rest-secrets",
-		label: "Compute server secrets"
-	};
-	if (report === null) return {
-		...base,
-		status: "not_applicable",
-		summary: "The active data provider does not encrypt secrets at this layer — nothing to verify."
-	};
-	if (report.ok) return {
-		...base,
-		status: "ok",
-		summary: "All stored compute server API keys decrypt under the current SELVA_AT_REST_KEY."
-	};
-	const failed = report.failures.map((f) => `"${f.serverLabel}" (${f.reason}${f.cause ? `: ${f.cause}` : ""})`).join(", ");
-	const plaintext = report.plaintextFound;
-	return {
-		...base,
-		status: "degraded",
-		summary: `${report.failures.length} compute server key(s) could not be loaded: ${failed}.`,
-		remediation: plaintext ? "A key is stored in plaintext on disk — re-enter it via /admin/compute so it is encrypted." : "The stored ciphertext does not match the current SELVA_AT_REST_KEY (rotated key or restored backup). Re-enter the affected keys via /admin/compute, or restore the original SELVA_AT_REST_KEY, then run this check again."
-	};
-}
-function schemaVersionCheck(report) {
-	const base = {
-		id: "schema-version",
-		label: "Database schema"
-	};
-	if (report === null) return {
-		...base,
-		status: "not_applicable",
-		summary: "The active data provider migrates with the app — there is no separate schema to verify."
-	};
-	if (report.ok) return {
-		...base,
-		status: "ok",
-		summary: `Database migration head ${report.actual} satisfies the app's expected ${report.expected}.`
-	};
-	return {
-		...base,
-		status: "degraded",
-		summary: report.message ?? `Database migration head ${report.actual ?? "unavailable"} is behind the app's expected ${report.expected}.`,
-		remediation: "Sync the provider migrations into your Supabase project and run `npx supabase db push`, then restart the app. `selva doctor` runs the same check from the CLI."
-	};
-}
-/** API tokens on a provider with row security need a signing key Supabase trusts. */
-async function delegatedSessionCheck() {
-	const base = {
-		id: "api-token-sessions",
-		label: "API token sessions"
-	};
-	const delegated = providers.auth.delegatedSession;
-	if (!delegated) return {
-		...base,
-		status: "not_applicable",
-		summary: "The active auth provider needs no signed sessions for API tokens."
-	};
-	const status = await delegated.status();
-	if (status.ok) return {
-		...base,
-		status: "ok",
-		summary: "API tokens can act as their owners."
-	};
-	return {
-		...base,
-		status: "degraded",
-		summary: `API tokens are off: ${status.message}`,
-		remediation: "Set SUPABASE_JWT_SIGNING_KEY to the private ES256 JWK your Supabase project signs with (see the Supabase provider docs), then restart. Browser sign-in is unaffected."
-	};
-}
-var COMPUTE_PING_TIMEOUT_MS = 8e3;
-/**
-* Ping the global default compute server's liveness root (`GET /` — the
-* rhino.compute proxy has no `/healthcheck` route). We probe the default
-* specifically because that's the server every solve falls back to;
-* a degraded default breaks the baseline for all orgs. Org-private and
-* non-default platform servers are out of scope here — they have their own
-* per-server status probe at /api/admin/compute/status.
-*/
-async function computeReachabilityCheck(locals) {
-	const base = {
-		id: "compute-reachable",
-		label: "Default compute server"
-	};
-	let config;
-	try {
-		config = await getComputeServerConfigStore().getConfig(locals.ctx);
-	} catch (err) {
-		return {
-			...base,
-			status: "error",
-			summary: `Could not read compute config: ${err instanceof Error ? err.message : String(err)}`
-		};
-	}
-	const server = config.defaultServerId ? findServerById(config, config.defaultServerId) : void 0;
-	if (!server) return {
-		...base,
-		status: "not_applicable",
-		summary: "No default compute server is configured — nothing to reach.",
-		remediation: "Add a server and set it as default in /admin/compute."
-	};
-	const apiKey = server.hasApiKey ? await getComputeServerConfigStore().getServerApiKey(locals.ctx, server.id) : void 0;
-	const stats = new h(server.serverUrl, apiKey ?? void 0);
-	try {
-		if (await stats.isServerOnline(COMPUTE_PING_TIMEOUT_MS)) return {
-			...base,
-			status: "ok",
-			summary: `"${server.label}" is reachable.`
-		};
-		return {
-			...base,
-			status: "degraded",
-			summary: `"${server.label}" did not respond within ${COMPUTE_PING_TIMEOUT_MS / 1e3}s or answered with an error.`,
-			remediation: `Confirm the Rhino.Compute host is running, ${server.serverUrl} is correct, and the API key in /admin/compute is valid.`
-		};
-	} finally {
-		await stats.dispose();
-	}
-}
-/**
-* Write + delete a temp file under DATA_PATH to prove the local provider can
-* still persist. The JSON stores read-modify-write without a fallback, so a
-* full disk or a permission change (e.g. ownership drift after a restore)
-* corrupts data on the next write — catch it here while it's still just a
-* failed health check.
-*/
-async function dataPathWritableCheck() {
-	const base = {
-		id: "data-path-writable",
-		label: "Data path writable"
-	};
-	if (!(providers.data.computeServer instanceof LocalComputeServerStore)) return {
-		...base,
-		status: "not_applicable",
-		summary: "The active data provider does not persist to a local DATA_PATH."
-	};
-	const dataPath = private_env.DATA_PATH;
-	if (!dataPath) return {
-		...base,
-		status: "error",
-		summary: "DATA_PATH is unset but the local provider is active.",
-		remediation: "Set DATA_PATH in .env and restart."
-	};
-	const absolute = resolve(dataPath);
-	const probe = join(absolute, `.health-probe-${randomUUID()}`);
-	try {
-		await mkdir(absolute, { recursive: true });
-		await writeFile(probe, "ok");
-		await unlink(probe);
-		return {
-			...base,
-			status: "ok",
-			summary: `DATA_PATH (${dataPath}) is writable.`
-		};
-	} catch (err) {
-		return {
-			...base,
-			status: "degraded",
-			summary: `DATA_PATH (${dataPath}) is not writable: ${err instanceof Error ? err.message : String(err)}.`,
-			remediation: "Check free disk space and that the directory is owned by the user running the app (`df -h`, `ls -la`)."
-		};
-	}
-}
-/**
-* Deployment-config rules run against the live process env, which is what
-* adapter-node itself read at boot — not a re-parse of `.env`, so a var
-* overridden by the service manager is judged as it actually applies.
-*
-* A `fail` maps to `error` rather than `degraded`: these are the same verdicts
-* that exit `selva doctor` non-zero, and the panel should not soften them.
-*/
-function deploymentConfigChecks() {
-	return checkDeploymentConfig(private_env).map((finding) => ({
-		id: finding.id,
-		label: finding.label,
-		status: finding.verdict === "fail" ? "error" : finding.verdict === "warn" ? "degraded" : "ok",
-		summary: finding.summary,
-		remediation: finding.remediation
-	}));
-}
-var GET = async ({ locals }) => {
-	requirePermission(locals, "instance_admin");
-	const checks = [];
-	const store = providers.data.computeServer;
-	if (typeof store.verifySecrets === "function") try {
-		checks.push(atRestSecretsCheck(await store.verifySecrets()));
-	} catch (err) {
-		checks.push({
-			id: "at-rest-secrets",
-			label: "Compute server secrets",
-			status: "error",
-			summary: `Verification threw: ${err instanceof Error ? err.message : String(err)}`,
-			remediation: "Check server logs (`pm2 logs selva-compute`) for the underlying error."
-		});
-	}
-	else checks.push(atRestSecretsCheck(null));
-	const data = providers.data;
-	if (typeof data.verifySchemaVersion === "function") checks.push(schemaVersionCheck(await data.verifySchemaVersion()));
-	else checks.push(schemaVersionCheck(null));
-	checks.push(...await Promise.all([
-		computeReachabilityCheck(locals),
-		dataPathWritableCheck(),
-		delegatedSessionCheck()
-	]));
-	checks.push(...deploymentConfigChecks());
-	const rank = {
-		ok: 0,
-		not_applicable: 0,
-		degraded: 2,
-		error: 3
-	};
-	const overall = checks.reduce((worst, c) => rank[c.status] > rank[worst] ? c.status : worst, "ok");
-	return json({
-		overall,
-		checkedAt: (/* @__PURE__ */ new Date()).toISOString(),
-		checks
-	});
-};
-
-export { GET };
-//# sourceMappingURL=_server.ts.js-tfn0ELz6.js.map

package/build/server/chunks/entries/endpoints/api/admin/system/health/_server.ts.js-tfn0ELz6.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"_server.ts.js-tfn0ELz6.js","sources":["../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/admin/system/health/_server.ts.js"],"sourcesContent":["import { t as private_env } from \"../../../../../../chunks/shared-server.js\";\nimport \"../../../../../../chunks/src.js\";\nimport { D as LocalComputeServerStore, T as providers, a as getComputeServerConfigStore } from \"../../../../../../chunks/providers.server.js\";\nimport { n as findServerById } from \"../../../../../../chunks/utils2.js\";\nimport { C as requirePermission } from \"../../../../../../chunks/access.js\";\nimport { p as h } from \"../../../../../../chunks/schema.js\";\nimport \"../../../../../../chunks/access2.server.js\";\nimport { json } from \"@sveltejs/kit\";\nimport { randomUUID } from \"node:crypto\";\nimport { join, resolve } from \"node:path\";\nimport { mkdir, unlink, writeFile } from \"node:fs/promises\";\n//#region ../server/src/ops/deploymentConfig.ts\n/**\n* Parse a `BODY_SIZE_LIMIT` the way adapter-node does, so this agrees with the\n* thing that actually rejects the request.\n*\n* The quirk is load-bearing: adapter-node reads only the LAST character as the\n* suffix, so `60mb` parses as the digits `60m` and happens to mean 60 MB, while\n* `60xy` silently becomes NaN. Returns bytes, or null when the value is one\n* adapter-node can't use.\n*/\nfunction parseBodySizeLimit(raw) {\n\tif (raw == null || raw === \"\") return null;\n\tconst value = String(raw).trim();\n\tif (value === \"\") return null;\n\tconst multiplier = {\n\t\tK: 1024,\n\t\tM: 1048576,\n\t\tG: 1073741824\n\t}[value.at(-1).toUpperCase()] ?? 1;\n\tconst bytes = Number(multiplier !== 1 ? value.slice(0, -1) : value) * multiplier;\n\tif (!Number.isFinite(bytes) || bytes <= 0) return null;\n\treturn bytes;\n}\n/** The app's own default for COMPUTE_REQUEST_MAX_BYTES (compute/limits.ts). */\nvar COMPUTE_REQUEST_DEFAULT_BYTES = 268435456;\nvar asMb = (bytes) => `${Math.round(bytes / 1048576)} MB`;\n/**\n* BODY_SIZE_LIMIT has to clear the compute request cap, or adapter-node's global\n* backstop rejects the upload first — with a non-JSON body the app never sees\n* and cannot log. Unset is the dangerous case, not a neutral one: adapter-node\n* falls back to 512 KB, so every upload 413s on a deployment that looks fine.\n*/\nfunction checkBodySizeLimit(env) {\n\tconst base = {\n\t\tid: \"body-size-limit\",\n\t\tlabel: \"Upload size limit\"\n\t};\n\tconst raw = env.BODY_SIZE_LIMIT;\n\tconst requestCap = Number(env.COMPUTE_REQUEST_MAX_BYTES) || COMPUTE_REQUEST_DEFAULT_BYTES;\n\tif (raw == null || raw === \"\") return {\n\t\t...base,\n\t\tverdict: \"fail\",\n\t\tsummary: \"BODY_SIZE_LIMIT is unset — adapter-node falls back to 512 KB, so uploads over that fail with an opaque 413 no app log records.\",\n\t\tremediation: `Set BODY_SIZE_LIMIT to at least ${asMb(requestCap)} (the compute request cap) and restart.`\n\t};\n\tconst bytes = parseBodySizeLimit(raw);\n\tif (bytes === null) return {\n\t\t...base,\n\t\tverdict: \"fail\",\n\t\tsummary: `BODY_SIZE_LIMIT=\"${raw}\" — adapter-node cannot parse this and throws on boot.`,\n\t\tremediation: \"Use a byte count or a single K/M/G suffix, e.g. \\\"256M\\\".\"\n\t};\n\tif (bytes < requestCap) return {\n\t\t...base,\n\t\tverdict: \"warn\",\n\t\tsummary: `BODY_SIZE_LIMIT=${raw} (${asMb(bytes)}) is below COMPUTE_REQUEST_MAX_BYTES (${asMb(requestCap)}) — the global cap rejects first, making the compute cap dead config.`,\n\t\tremediation: `Raise BODY_SIZE_LIMIT to at least ${asMb(requestCap)} and restart.`\n\t};\n\treturn {\n\t\t...base,\n\t\tverdict: \"ok\",\n\t\tsummary: `BODY_SIZE_LIMIT=${raw} clears the compute request cap.`\n\t};\n}\n/**\n* `ADDRESS_HEADER` / `XFF_DEPTH` are read by adapter-node, not by Selva, and\n* unset they are invisible: nothing fails, nothing logs, and the deployment\n* looks healthy.\n*\n* What actually happens is that `getClientAddress()` returns the socket peer,\n* which behind a reverse proxy is the proxy — `127.0.0.1` for every request\n* from every user. Login rate limiting keys on that, so the whole instance\n* shares one bucket: five failed logins from anywhere return 429 to everyone,\n* and only a *successful* login clears a bucket, which nobody can then reach.\n*\n* `ORIGIN` is the proxy tell. It is only needed when the app is served under a\n* public URL it can't derive from its own socket, so its presence means a proxy\n* is terminating requests. Without it we say nothing: on a directly-reachable\n* app these settings are a footgun, since `X-Forwarded-For` is client-supplied\n* and anyone could then pick their own rate-limit bucket.\n*/\nfunction checkClientAddress(env) {\n\tconst base = {\n\t\tid: \"client-address\",\n\t\tlabel: \"Client IP behind proxy\"\n\t};\n\tconst header = env.ADDRESS_HEADER;\n\tconst depth = env.XFF_DEPTH;\n\tif (!env.ORIGIN) return {\n\t\t...base,\n\t\tverdict: \"ok\",\n\t\tsummary: \"ADDRESS_HEADER is not needed — ORIGIN is unset, so no reverse proxy is in play.\"\n\t};\n\tif (!header) return {\n\t\t...base,\n\t\tverdict: \"fail\",\n\t\tsummary: \"ADDRESS_HEADER is unset while ORIGIN is set — every request looks like it came from the proxy, so all users share ONE login rate-limit bucket. Five failed logins from anyone locks out the whole instance for 15 minutes.\",\n\t\tremediation: \"Set ADDRESS_HEADER=X-Forwarded-For and XFF_DEPTH=<number of proxies>, then restart. To count your proxies, see docs/self-hosting/deployment/reverse-proxy.md.\"\n\t};\n\tif (header.toLowerCase() === \"x-forwarded-for\" && !depth) return {\n\t\t...base,\n\t\tverdict: \"warn\",\n\t\tsummary: `ADDRESS_HEADER=${header} but XFF_DEPTH is unset. X-Forwarded-For is a client-appendable list, so a caller can prepend fake entries — adapter-node needs the proxy count to know which entry is real.`,\n\t\tremediation: \"Set XFF_DEPTH=1 for a single reverse proxy, 2 if a CDN or load balancer sits in front of it. Unsure? docs/self-hosting/deployment/reverse-proxy.md shows how to read the header the app actually receives.\"\n\t};\n\tif (depth !== void 0 && !/^[1-9][0-9]*$/.test(depth)) return {\n\t\t...base,\n\t\tverdict: \"fail\",\n\t\tsummary: `XFF_DEPTH=\"${depth}\" is not a positive integer.`,\n\t\tremediation: \"It counts proxies from the outside in — use 1 for a single reverse proxy.\"\n\t};\n\treturn {\n\t\t...base,\n\t\tverdict: \"ok\",\n\t\tsummary: `ADDRESS_HEADER=${header}${depth ? ` (XFF_DEPTH=${depth})` : \"\"}.`\n\t};\n}\n/** Every deployment-config rule, in report order. */\nfunction checkDeploymentConfig(env) {\n\treturn [checkClientAddress(env), checkBodySizeLimit(env)];\n}\n//#endregion\n//#region src/routes/api/admin/system/health/+server.ts\nfunction atRestSecretsCheck(report) {\n\tconst base = {\n\t\tid: \"at-rest-secrets\",\n\t\tlabel: \"Compute server secrets\"\n\t};\n\tif (report === null) return {\n\t\t...base,\n\t\tstatus: \"not_applicable\",\n\t\tsummary: \"The active data provider does not encrypt secrets at this layer — nothing to verify.\"\n\t};\n\tif (report.ok) return {\n\t\t...base,\n\t\tstatus: \"ok\",\n\t\tsummary: \"All stored compute server API keys decrypt under the current SELVA_AT_REST_KEY.\"\n\t};\n\tconst failed = report.failures.map((f) => `\"${f.serverLabel}\" (${f.reason}${f.cause ? `: ${f.cause}` : \"\"})`).join(\", \");\n\tconst plaintext = report.plaintextFound;\n\treturn {\n\t\t...base,\n\t\tstatus: \"degraded\",\n\t\tsummary: `${report.failures.length} compute server key(s) could not be loaded: ${failed}.`,\n\t\tremediation: plaintext ? \"A key is stored in plaintext on disk — re-enter it via /admin/compute so it is encrypted.\" : \"The stored ciphertext does not match the current SELVA_AT_REST_KEY (rotated key or restored backup). Re-enter the affected keys via /admin/compute, or restore the original SELVA_AT_REST_KEY, then run this check again.\"\n\t};\n}\nfunction schemaVersionCheck(report) {\n\tconst base = {\n\t\tid: \"schema-version\",\n\t\tlabel: \"Database schema\"\n\t};\n\tif (report === null) return {\n\t\t...base,\n\t\tstatus: \"not_applicable\",\n\t\tsummary: \"The active data provider migrates with the app — there is no separate schema to verify.\"\n\t};\n\tif (report.ok) return {\n\t\t...base,\n\t\tstatus: \"ok\",\n\t\tsummary: `Database migration head ${report.actual} satisfies the app's expected ${report.expected}.`\n\t};\n\treturn {\n\t\t...base,\n\t\tstatus: \"degraded\",\n\t\tsummary: report.message ?? `Database migration head ${report.actual ?? \"unavailable\"} is behind the app's expected ${report.expected}.`,\n\t\tremediation: \"Sync the provider migrations into your Supabase project and run `npx supabase db push`, then restart the app. `selva doctor` runs the same check from the CLI.\"\n\t};\n}\n/** API tokens on a provider with row security need a signing key Supabase trusts. */\nasync function delegatedSessionCheck() {\n\tconst base = {\n\t\tid: \"api-token-sessions\",\n\t\tlabel: \"API token sessions\"\n\t};\n\tconst delegated = providers.auth.delegatedSession;\n\tif (!delegated) return {\n\t\t...base,\n\t\tstatus: \"not_applicable\",\n\t\tsummary: \"The active auth provider needs no signed sessions for API tokens.\"\n\t};\n\tconst status = await delegated.status();\n\tif (status.ok) return {\n\t\t...base,\n\t\tstatus: \"ok\",\n\t\tsummary: \"API tokens can act as their owners.\"\n\t};\n\treturn {\n\t\t...base,\n\t\tstatus: \"degraded\",\n\t\tsummary: `API tokens are off: ${status.message}`,\n\t\tremediation: \"Set SUPABASE_JWT_SIGNING_KEY to the private ES256 JWK your Supabase project signs with (see the Supabase provider docs), then restart. Browser sign-in is unaffected.\"\n\t};\n}\nvar COMPUTE_PING_TIMEOUT_MS = 8e3;\n/**\n* Ping the global default compute server's liveness root (`GET /` — the\n* rhino.compute proxy has no `/healthcheck` route). We probe the default\n* specifically because that's the server every solve falls back to;\n* a degraded default breaks the baseline for all orgs. Org-private and\n* non-default platform servers are out of scope here — they have their own\n* per-server status probe at /api/admin/compute/status.\n*/\nasync function computeReachabilityCheck(locals) {\n\tconst base = {\n\t\tid: \"compute-reachable\",\n\t\tlabel: \"Default compute server\"\n\t};\n\tlet config;\n\ttry {\n\t\tconfig = await getComputeServerConfigStore().getConfig(locals.ctx);\n\t} catch (err) {\n\t\treturn {\n\t\t\t...base,\n\t\t\tstatus: \"error\",\n\t\t\tsummary: `Could not read compute config: ${err instanceof Error ? err.message : String(err)}`\n\t\t};\n\t}\n\tconst server = config.defaultServerId ? findServerById(config, config.defaultServerId) : void 0;\n\tif (!server) return {\n\t\t...base,\n\t\tstatus: \"not_applicable\",\n\t\tsummary: \"No default compute server is configured — nothing to reach.\",\n\t\tremediation: \"Add a server and set it as default in /admin/compute.\"\n\t};\n\tconst apiKey = server.hasApiKey ? await getComputeServerConfigStore().getServerApiKey(locals.ctx, server.id) : void 0;\n\tconst stats = new h(server.serverUrl, apiKey ?? void 0);\n\ttry {\n\t\tif (await stats.isServerOnline(COMPUTE_PING_TIMEOUT_MS)) return {\n\t\t\t...base,\n\t\t\tstatus: \"ok\",\n\t\t\tsummary: `\"${server.label}\" is reachable.`\n\t\t};\n\t\treturn {\n\t\t\t...base,\n\t\t\tstatus: \"degraded\",\n\t\t\tsummary: `\"${server.label}\" did not respond within ${COMPUTE_PING_TIMEOUT_MS / 1e3}s or answered with an error.`,\n\t\t\tremediation: `Confirm the Rhino.Compute host is running, ${server.serverUrl} is correct, and the API key in /admin/compute is valid.`\n\t\t};\n\t} finally {\n\t\tawait stats.dispose();\n\t}\n}\n/**\n* Write + delete a temp file under DATA_PATH to prove the local provider can\n* still persist. The JSON stores read-modify-write without a fallback, so a\n* full disk or a permission change (e.g. ownership drift after a restore)\n* corrupts data on the next write — catch it here while it's still just a\n* failed health check.\n*/\nasync function dataPathWritableCheck() {\n\tconst base = {\n\t\tid: \"data-path-writable\",\n\t\tlabel: \"Data path writable\"\n\t};\n\tif (!(providers.data.computeServer instanceof LocalComputeServerStore)) return {\n\t\t...base,\n\t\tstatus: \"not_applicable\",\n\t\tsummary: \"The active data provider does not persist to a local DATA_PATH.\"\n\t};\n\tconst dataPath = private_env.DATA_PATH;\n\tif (!dataPath) return {\n\t\t...base,\n\t\tstatus: \"error\",\n\t\tsummary: \"DATA_PATH is unset but the local provider is active.\",\n\t\tremediation: \"Set DATA_PATH in .env and restart.\"\n\t};\n\tconst absolute = resolve(dataPath);\n\tconst probe = join(absolute, `.health-probe-${randomUUID()}`);\n\ttry {\n\t\tawait mkdir(absolute, { recursive: true });\n\t\tawait writeFile(probe, \"ok\");\n\t\tawait unlink(probe);\n\t\treturn {\n\t\t\t...base,\n\t\t\tstatus: \"ok\",\n\t\t\tsummary: `DATA_PATH (${dataPath}) is writable.`\n\t\t};\n\t} catch (err) {\n\t\treturn {\n\t\t\t...base,\n\t\t\tstatus: \"degraded\",\n\t\t\tsummary: `DATA_PATH (${dataPath}) is not writable: ${err instanceof Error ? err.message : String(err)}.`,\n\t\t\tremediation: \"Check free disk space and that the directory is owned by the user running the app (`df -h`, `ls -la`).\"\n\t\t};\n\t}\n}\n/**\n* Deployment-config rules run against the live process env, which is what\n* adapter-node itself read at boot — not a re-parse of `.env`, so a var\n* overridden by the service manager is judged as it actually applies.\n*\n* A `fail` maps to `error` rather than `degraded`: these are the same verdicts\n* that exit `selva doctor` non-zero, and the panel should not soften them.\n*/\nfunction deploymentConfigChecks() {\n\treturn checkDeploymentConfig(private_env).map((finding) => ({\n\t\tid: finding.id,\n\t\tlabel: finding.label,\n\t\tstatus: finding.verdict === \"fail\" ? \"error\" : finding.verdict === \"warn\" ? \"degraded\" : \"ok\",\n\t\tsummary: finding.summary,\n\t\tremediation: finding.remediation\n\t}));\n}\nvar GET = async ({ locals }) => {\n\trequirePermission(locals, \"instance_admin\");\n\tconst checks = [];\n\tconst store = providers.data.computeServer;\n\tif (typeof store.verifySecrets === \"function\") try {\n\t\tchecks.push(atRestSecretsCheck(await store.verifySecrets()));\n\t} catch (err) {\n\t\tchecks.push({\n\t\t\tid: \"at-rest-secrets\",\n\t\t\tlabel: \"Compute server secrets\",\n\t\t\tstatus: \"error\",\n\t\t\tsummary: `Verification threw: ${err instanceof Error ? err.message : String(err)}`,\n\t\t\tremediation: \"Check server logs (`pm2 logs selva-compute`) for the underlying error.\"\n\t\t});\n\t}\n\telse checks.push(atRestSecretsCheck(null));\n\tconst data = providers.data;\n\tif (typeof data.verifySchemaVersion === \"function\") checks.push(schemaVersionCheck(await data.verifySchemaVersion()));\n\telse checks.push(schemaVersionCheck(null));\n\tchecks.push(...await Promise.all([\n\t\tcomputeReachabilityCheck(locals),\n\t\tdataPathWritableCheck(),\n\t\tdelegatedSessionCheck()\n\t]));\n\tchecks.push(...deploymentConfigChecks());\n\tconst rank = {\n\t\tok: 0,\n\t\tnot_applicable: 0,\n\t\tdegraded: 2,\n\t\terror: 3\n\t};\n\tconst overall = checks.reduce((worst, c) => rank[c.status] > rank[worst] ? c.status : worst, \"ok\");\n\treturn json({\n\t\toverall,\n\t\tcheckedAt: (/* @__PURE__ */ new Date()).toISOString(),\n\t\tchecks\n\t});\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAWA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,kBAAkB,CAAC,GAAG,EAAE;AACjC,CAAC,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK,EAAE,EAAE,OAAO,IAAI;AAC3C,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;AACjC,CAAC,IAAI,KAAK,KAAK,EAAE,EAAE,OAAO,IAAI;AAC9B,CAAC,MAAM,UAAU,GAAG;AACpB,EAAE,CAAC,EAAE,IAAI;AACT,EAAE,CAAC,EAAE,OAAO;AACZ,EAAE,CAAC,EAAE;AACL,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC;AACnC,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,GAAG,UAAU;AACjF,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,OAAO,IAAI;AACvD,CAAC,OAAO,KAAK;AACb;AACA;AACA,IAAI,6BAA6B,GAAG,SAAS;AAC7C,IAAI,IAAI,GAAG,CAAC,KAAK,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC;AACzD;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,kBAAkB,CAAC,GAAG,EAAE;AACjC,CAAC,MAAM,IAAI,GAAG;AACd,EAAE,EAAE,EAAE,iBAAiB;AACvB,EAAE,KAAK,EAAE;AACT,EAAE;AACF,CAAC,MAAM,GAAG,GAAG,GAAG,CAAC,eAAe;AAChC,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC,IAAI,6BAA6B;AAC1F,CAAC,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK,EAAE,EAAE,OAAO;AACvC,EAAE,GAAG,IAAI;AACT,EAAE,OAAO,EAAE,MAAM;AACjB,EAAE,OAAO,EAAE,gIAAgI;AAC3I,EAAE,WAAW,EAAE,CAAC,gCAAgC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,uCAAuC;AAC1G,EAAE;AACF,CAAC,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC;AACtC,CAAC,IAAI,KAAK,KAAK,IAAI,EAAE,OAAO;AAC5B,EAAE,GAAG,IAAI;AACT,EAAE,OAAO,EAAE,MAAM;AACjB,EAAE,OAAO,EAAE,CAAC,iBAAiB,EAAE,GAAG,CAAC,sDAAsD,CAAC;AAC1F,EAAE,WAAW,EAAE;AACf,EAAE;AACF,CAAC,IAAI,KAAK,GAAG,UAAU,EAAE,OAAO;AAChC,EAAE,GAAG,IAAI;AACT,EAAE,OAAO,EAAE,MAAM;AACjB,EAAE,OAAO,EAAE,CAAC,gBAAgB,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,sCAAsC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,qEAAqE,CAAC;AACjL,EAAE,WAAW,EAAE,CAAC,kCAAkC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,aAAa;AAClF,EAAE;AACF,CAAC,OAAO;AACR,EAAE,GAAG,IAAI;AACT,EAAE,OAAO,EAAE,IAAI;AACf,EAAE,OAAO,EAAE,CAAC,gBAAgB,EAAE,GAAG,CAAC,gCAAgC;AAClE,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,kBAAkB,CAAC,GAAG,EAAE;AACjC,CAAC,MAAM,IAAI,GAAG;AACd,EAAE,EAAE,EAAE,gBAAgB;AACtB,EAAE,KAAK,EAAE;AACT,EAAE;AACF,CAAC,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc;AAClC,CAAC,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS;AAC5B,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO;AACzB,EAAE,GAAG,IAAI;AACT,EAAE,OAAO,EAAE,IAAI;AACf,EAAE,OAAO,EAAE;AACX,EAAE;AACF,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO;AACrB,EAAE,GAAG,IAAI;AACT,EAAE,OAAO,EAAE,MAAM;AACjB,EAAE,OAAO,EAAE,4NAA4N;AACvO,EAAE,WAAW,EAAE;AACf,EAAE;AACF,CAAC,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,iBAAiB,IAAI,CAAC,KAAK,EAAE,OAAO;AAClE,EAAE,GAAG,IAAI;AACT,EAAE,OAAO,EAAE,MAAM;AACjB,EAAE,OAAO,EAAE,CAAC,eAAe,EAAE,MAAM,CAAC,4KAA4K,CAAC;AACjN,EAAE,WAAW,EAAE;AACf,EAAE;AACF,CAAC,IAAI,KAAK,KAAK,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO;AAC9D,EAAE,GAAG,IAAI;AACT,EAAE,OAAO,EAAE,MAAM;AACjB,EAAE,OAAO,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,4BAA4B,CAAC;AAC5D,EAAE,WAAW,EAAE;AACf,EAAE;AACF,CAAC,OAAO;AACR,EAAE,GAAG,IAAI;AACT,EAAE,OAAO,EAAE,IAAI;AACf,EAAE,OAAO,EAAE,CAAC,eAAe,EAAE,MAAM,CAAC,EAAE,KAAK,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;AAC5E,EAAE;AACF;AACA;AACA,SAAS,qBAAqB,CAAC,GAAG,EAAE;AACpC,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC;AAC1D;AACA;AACA;AACA,SAAS,kBAAkB,CAAC,MAAM,EAAE;AACpC,CAAC,MAAM,IAAI,GAAG;AACd,EAAE,EAAE,EAAE,iBAAiB;AACvB,EAAE,KAAK,EAAE;AACT,EAAE;AACF,CAAC,IAAI,MAAM,KAAK,IAAI,EAAE,OAAO;AAC7B,EAAE,GAAG,IAAI;AACT,EAAE,MAAM,EAAE,gBAAgB;AAC1B,EAAE,OAAO,EAAE;AACX,EAAE;AACF,CAAC,IAAI,MAAM,CAAC,EAAE,EAAE,OAAO;AACvB,EAAE,GAAG,IAAI;AACT,EAAE,MAAM,EAAE,IAAI;AACd,EAAE,OAAO,EAAE;AACX,EAAE;AACF,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;AACzH,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc;AACxC,CAAC,OAAO;AACR,EAAE,GAAG,IAAI;AACT,EAAE,MAAM,EAAE,UAAU;AACpB,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,4CAA4C,EAAE,MAAM,CAAC,CAAC,CAAC;AAC5F,EAAE,WAAW,EAAE,SAAS,GAAG,2FAA2F,GAAG;AACzH,EAAE;AACF;AACA,SAAS,kBAAkB,CAAC,MAAM,EAAE;AACpC,CAAC,MAAM,IAAI,GAAG;AACd,EAAE,EAAE,EAAE,gBAAgB;AACtB,EAAE,KAAK,EAAE;AACT,EAAE;AACF,CAAC,IAAI,MAAM,KAAK,IAAI,EAAE,OAAO;AAC7B,EAAE,GAAG,IAAI;AACT,EAAE,MAAM,EAAE,gBAAgB;AAC1B,EAAE,OAAO,EAAE;AACX,EAAE;AACF,CAAC,IAAI,MAAM,CAAC,EAAE,EAAE,OAAO;AACvB,EAAE,GAAG,IAAI;AACT,EAAE,MAAM,EAAE,IAAI;AACd,EAAE,OAAO,EAAE,CAAC,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC,8BAA8B,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;AACrG,EAAE;AACF,CAAC,OAAO;AACR,EAAE,GAAG,IAAI;AACT,EAAE,MAAM,EAAE,UAAU;AACpB,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,CAAC,wBAAwB,EAAE,MAAM,CAAC,MAAM,IAAI,aAAa,CAAC,8BAA8B,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;AACzI,EAAE,WAAW,EAAE;AACf,EAAE;AACF;AACA;AACA,eAAe,qBAAqB,GAAG;AACvC,CAAC,MAAM,IAAI,GAAG;AACd,EAAE,EAAE,EAAE,oBAAoB;AAC1B,EAAE,KAAK,EAAE;AACT,EAAE;AACF,CAAC,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,gBAAgB;AAClD,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO;AACxB,EAAE,GAAG,IAAI;AACT,EAAE,MAAM,EAAE,gBAAgB;AAC1B,EAAE,OAAO,EAAE;AACX,EAAE;AACF,CAAC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE;AACxC,CAAC,IAAI,MAAM,CAAC,EAAE,EAAE,OAAO;AACvB,EAAE,GAAG,IAAI;AACT,EAAE,MAAM,EAAE,IAAI;AACd,EAAE,OAAO,EAAE;AACX,EAAE;AACF,CAAC,OAAO;AACR,EAAE,GAAG,IAAI;AACT,EAAE,MAAM,EAAE,UAAU;AACpB,EAAE,OAAO,EAAE,CAAC,oBAAoB,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;AAClD,EAAE,WAAW,EAAE;AACf,EAAE;AACF;AACA,IAAI,uBAAuB,GAAG,GAAG;AACjC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,wBAAwB,CAAC,MAAM,EAAE;AAChD,CAAC,MAAM,IAAI,GAAG;AACd,EAAE,EAAE,EAAE,mBAAmB;AACzB,EAAE,KAAK,EAAE;AACT,EAAE;AACF,CAAC,IAAI,MAAM;AACX,CAAC,IAAI;AACL,EAAE,MAAM,GAAG,MAAM,2BAA2B,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC;AACpE,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,OAAO;AACT,GAAG,GAAG,IAAI;AACV,GAAG,MAAM,EAAE,OAAO;AAClB,GAAG,OAAO,EAAE,CAAC,+BAA+B,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;AAC/F,GAAG;AACH,CAAC;AACD,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,eAAe,CAAC,GAAG,MAAM;AAChG,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO;AACrB,EAAE,GAAG,IAAI;AACT,EAAE,MAAM,EAAE,gBAAgB;AAC1B,EAAE,OAAO,EAAE,6DAA6D;AACxE,EAAE,WAAW,EAAE;AACf,EAAE;AACF,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,GAAG,MAAM,2BAA2B,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,MAAM;AACtH,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,IAAI,MAAM,CAAC;AACxD,CAAC,IAAI;AACL,EAAE,IAAI,MAAM,KAAK,CAAC,cAAc,CAAC,uBAAuB,CAAC,EAAE,OAAO;AAClE,GAAG,GAAG,IAAI;AACV,GAAG,MAAM,EAAE,IAAI;AACf,GAAG,OAAO,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,eAAe;AAC5C,GAAG;AACH,EAAE,OAAO;AACT,GAAG,GAAG,IAAI;AACV,GAAG,MAAM,EAAE,UAAU;AACrB,GAAG,OAAO,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,uBAAuB,GAAG,GAAG,CAAC,4BAA4B,CAAC;AACnH,GAAG,WAAW,EAAE,CAAC,2CAA2C,EAAE,MAAM,CAAC,SAAS,CAAC,wDAAwD;AACvI,GAAG;AACH,CAAC,CAAC,SAAS;AACX,EAAE,MAAM,KAAK,CAAC,OAAO,EAAE;AACvB,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,qBAAqB,GAAG;AACvC,CAAC,MAAM,IAAI,GAAG;AACd,EAAE,EAAE,EAAE,oBAAoB;AAC1B,EAAE,KAAK,EAAE;AACT,EAAE;AACF,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,aAAa,YAAY,uBAAuB,CAAC,EAAE,OAAO;AAChF,EAAE,GAAG,IAAI;AACT,EAAE,MAAM,EAAE,gBAAgB;AAC1B,EAAE,OAAO,EAAE;AACX,EAAE;AACF,CAAC,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS;AACvC,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO;AACvB,EAAE,GAAG,IAAI;AACT,EAAE,MAAM,EAAE,OAAO;AACjB,EAAE,OAAO,EAAE,sDAAsD;AACjE,EAAE,WAAW,EAAE;AACf,EAAE;AACF,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;AACnC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;AAC9D,CAAC,IAAI;AACL,EAAE,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC5C,EAAE,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC;AAC9B,EAAE,MAAM,MAAM,CAAC,KAAK,CAAC;AACrB,EAAE,OAAO;AACT,GAAG,GAAG,IAAI;AACV,GAAG,MAAM,EAAE,IAAI;AACf,GAAG,OAAO,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC,cAAc;AACjD,GAAG;AACH,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,OAAO;AACT,GAAG,GAAG,IAAI;AACV,GAAG,MAAM,EAAE,UAAU;AACrB,GAAG,OAAO,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC,mBAAmB,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC3G,GAAG,WAAW,EAAE;AAChB,GAAG;AACH,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,sBAAsB,GAAG;AAClC,CAAC,OAAO,qBAAqB,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,MAAM;AAC7D,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE;AAChB,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK;AACtB,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,KAAK,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,KAAK,MAAM,GAAG,UAAU,GAAG,IAAI;AAC/F,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO;AAC1B,EAAE,WAAW,EAAE,OAAO,CAAC;AACvB,EAAE,CAAC,CAAC;AACJ;AACG,IAAC,GAAG,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK;AAChC,CAAC,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,CAAC;AAC5C,CAAC,MAAM,MAAM,GAAG,EAAE;AAClB,CAAC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,aAAa;AAC3C,CAAC,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,UAAU,EAAE,IAAI;AACpD,EAAE,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;AAC9D,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,MAAM,CAAC,IAAI,CAAC;AACd,GAAG,EAAE,EAAE,iBAAiB;AACxB,GAAG,KAAK,EAAE,wBAAwB;AAClC,GAAG,MAAM,EAAE,OAAO;AAClB,GAAG,OAAO,EAAE,CAAC,oBAAoB,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AACrF,GAAG,WAAW,EAAE;AAChB,GAAG,CAAC;AACJ,CAAC;AACD,MAAM,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI;AAC5B,CAAC,IAAI,OAAO,IAAI,CAAC,mBAAmB,KAAK,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC;AACtH,MAAM,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AAClC,EAAE,wBAAwB,CAAC,MAAM,CAAC;AAClC,EAAE,qBAAqB,EAAE;AACzB,EAAE,qBAAqB;AACvB,EAAE,CAAC,CAAC;AACJ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,sBAAsB,EAAE,CAAC;AACzC,CAAC,MAAM,IAAI,GAAG;AACd,EAAE,EAAE,EAAE,CAAC;AACP,EAAE,cAAc,EAAE,CAAC;AACnB,EAAE,QAAQ,EAAE,CAAC;AACb,EAAE,KAAK,EAAE;AACT,EAAE;AACF,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,KAAK,EAAE,IAAI,CAAC;AACnG,CAAC,OAAO,IAAI,CAAC;AACb,EAAE,OAAO;AACT,EAAE,SAAS,EAAE,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACvD,EAAE;AACF,EAAE,CAAC;AACH;;;;"}

package/build/server/chunks/entries/endpoints/api/admin/system/throughput/_server.ts.js-CknEUFMa.js

@@ -1,85 +0,0 @@
-import { q as requirePermission, e as ApiErrorCode } from '../../../../../../chunks/access.js-DR4cexvJ.js';
-import { a as apiError } from '../../../../../../chunks/api-errors.js-m3Ryxc96.js';
-import '../../../../../../chunks/src.js-bYgw0r8C.js';
-import '../../../../../../chunks/api.js-pA5_VXdB.js';
-import { json } from '@sveltejs/kit';
-import { randomFillSync } from 'node:crypto';
-import '../../../../../../chunks/schema.js-CPjRq84j.js';
-import '../../../../../../chunks/definitions.js-CI90mQ1G.js';
-import 'node:dns/promises';
-import 'node:net';
-import 'zod';
-import '../../../../../../chunks/rate-limit.js-Br3luBbc.js';
-
-//#region src/routes/api/admin/system/throughput/+server.ts
-/**
-* Network throughput probe for the /admin/system page. Measures the transport
-* path between the operator's browser and this server — through whatever
-* proxies/tunnels sit in between (reverse proxy, SSO relays such as Azure App
-* Proxy) — with zero compute involvement:
-*
-*   GET  ?mb=N  → streams N MB of random bytes (download direction)
-*   POST        → consumes and discards the request body, returns the
-*                 server-side receive duration (upload direction)
-*
-* Random bytes are deliberately incompressible so proxy compression can't fake
-* a fast transfer. `instance_admin` only — a bandwidth probe is an operator
-* tool, and the download side is a data faucet.
-*
-* A curl-friendly, env-flag-gated sibling exists at /api/diag/throughput for
-* shell-based testing (documented in docs/deployment/app-proxy-migration.md);
-* this endpoint is the browser/UI counterpart that also works behind SSO
-* proxies where curl can't authenticate.
-*/
-var CHUNK_BYTES = 1048576;
-var DOWNLOAD_DEFAULT_MB = 20;
-var DOWNLOAD_MAX_MB = 256;
-var UPLOAD_MAX_BYTES = 268435456;
-var GET = async ({ locals, url }) => {
-	requirePermission(locals, "instance_admin");
-	const requested = Number(url.searchParams.get("mb"));
-	const mb = Math.min(DOWNLOAD_MAX_MB, Math.max(1, Number.isFinite(requested) ? requested : DOWNLOAD_DEFAULT_MB));
-	let sentChunks = 0;
-	const stream = new ReadableStream({ pull(controller) {
-		if (sentChunks >= mb) {
-			controller.close();
-			return;
-		}
-		const chunk = new Uint8Array(CHUNK_BYTES);
-		randomFillSync(chunk);
-		controller.enqueue(chunk);
-		sentChunks++;
-	} });
-	return new Response(stream, { headers: {
-		"Content-Type": "application/octet-stream",
-		"Content-Length": String(mb * CHUNK_BYTES),
-		"Cache-Control": "no-store"
-	} });
-};
-var POST = async ({ locals, request }) => {
-	requirePermission(locals, "instance_admin");
-	const declared = Number(request.headers.get("content-length"));
-	if (Number.isFinite(declared) && declared > UPLOAD_MAX_BYTES) apiError(413, ApiErrorCode.VALIDATION_FAILED, "Upload exceeds the 256 MB probe limit");
-	if (!request.body) apiError(400, ApiErrorCode.VALIDATION_FAILED, "Missing request body");
-	const start = performance.now();
-	const reader = request.body.getReader();
-	let bytes = 0;
-	while (true) {
-		const { done, value } = await reader.read();
-		if (done) break;
-		bytes += value.byteLength;
-		if (bytes > UPLOAD_MAX_BYTES) {
-			await reader.cancel();
-			apiError(413, ApiErrorCode.VALIDATION_FAILED, "Upload exceeds the 256 MB probe limit");
-		}
-	}
-	const ms = performance.now() - start;
-	return json({
-		bytes,
-		ms: Math.round(ms),
-		mbps: ms > 0 ? Number((bytes / 1048576 / (ms / 1e3)).toFixed(2)) : null
-	});
-};
-
-export { GET, POST };
-//# sourceMappingURL=_server.ts.js-CknEUFMa.js.map

package/build/server/chunks/entries/endpoints/api/admin/system/throughput/_server.ts.js-CknEUFMa.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"_server.ts.js-CknEUFMa.js","sources":["../../../../../../../../../.svelte-kit/output/server/entries/endpoints/api/admin/system/throughput/_server.ts.js"],"sourcesContent":["import { C as requirePermission, I as ApiErrorCode } from \"../../../../../../chunks/access.js\";\nimport { t as apiError } from \"../../../../../../chunks/api-errors.js\";\nimport \"../../../../../../chunks/access2.server.js\";\nimport { json } from \"@sveltejs/kit\";\nimport { randomFillSync } from \"node:crypto\";\n//#region src/routes/api/admin/system/throughput/+server.ts\n/**\n* Network throughput probe for the /admin/system page. Measures the transport\n* path between the operator's browser and this server — through whatever\n* proxies/tunnels sit in between (reverse proxy, SSO relays such as Azure App\n* Proxy) — with zero compute involvement:\n*\n*   GET  ?mb=N  → streams N MB of random bytes (download direction)\n*   POST        → consumes and discards the request body, returns the\n*                 server-side receive duration (upload direction)\n*\n* Random bytes are deliberately incompressible so proxy compression can't fake\n* a fast transfer. `instance_admin` only — a bandwidth probe is an operator\n* tool, and the download side is a data faucet.\n*\n* A curl-friendly, env-flag-gated sibling exists at /api/diag/throughput for\n* shell-based testing (documented in docs/deployment/app-proxy-migration.md);\n* this endpoint is the browser/UI counterpart that also works behind SSO\n* proxies where curl can't authenticate.\n*/\nvar CHUNK_BYTES = 1048576;\nvar DOWNLOAD_DEFAULT_MB = 20;\nvar DOWNLOAD_MAX_MB = 256;\nvar UPLOAD_MAX_BYTES = 268435456;\nvar GET = async ({ locals, url }) => {\n\trequirePermission(locals, \"instance_admin\");\n\tconst requested = Number(url.searchParams.get(\"mb\"));\n\tconst mb = Math.min(DOWNLOAD_MAX_MB, Math.max(1, Number.isFinite(requested) ? requested : DOWNLOAD_DEFAULT_MB));\n\tlet sentChunks = 0;\n\tconst stream = new ReadableStream({ pull(controller) {\n\t\tif (sentChunks >= mb) {\n\t\t\tcontroller.close();\n\t\t\treturn;\n\t\t}\n\t\tconst chunk = new Uint8Array(CHUNK_BYTES);\n\t\trandomFillSync(chunk);\n\t\tcontroller.enqueue(chunk);\n\t\tsentChunks++;\n\t} });\n\treturn new Response(stream, { headers: {\n\t\t\"Content-Type\": \"application/octet-stream\",\n\t\t\"Content-Length\": String(mb * CHUNK_BYTES),\n\t\t\"Cache-Control\": \"no-store\"\n\t} });\n};\nvar POST = async ({ locals, request }) => {\n\trequirePermission(locals, \"instance_admin\");\n\tconst declared = Number(request.headers.get(\"content-length\"));\n\tif (Number.isFinite(declared) && declared > UPLOAD_MAX_BYTES) apiError(413, ApiErrorCode.VALIDATION_FAILED, \"Upload exceeds the 256 MB probe limit\");\n\tif (!request.body) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing request body\");\n\tconst start = performance.now();\n\tconst reader = request.body.getReader();\n\tlet bytes = 0;\n\twhile (true) {\n\t\tconst { done, value } = await reader.read();\n\t\tif (done) break;\n\t\tbytes += value.byteLength;\n\t\tif (bytes > UPLOAD_MAX_BYTES) {\n\t\t\tawait reader.cancel();\n\t\t\tapiError(413, ApiErrorCode.VALIDATION_FAILED, \"Upload exceeds the 256 MB probe limit\");\n\t\t}\n\t}\n\tconst ms = performance.now() - start;\n\treturn json({\n\t\tbytes,\n\t\tms: Math.round(ms),\n\t\tmbps: ms > 0 ? Number((bytes / 1048576 / (ms / 1e3)).toFixed(2)) : null\n\t});\n};\n//#endregion\nexport { GET, POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;AAKA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,WAAW,GAAG,OAAO;AACzB,IAAI,mBAAmB,GAAG,EAAE;AAC5B,IAAI,eAAe,GAAG,GAAG;AACzB,IAAI,gBAAgB,GAAG,SAAS;AAC7B,IAAC,GAAG,GAAG,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK;AACrC,CAAC,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,CAAC;AAC5C,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACrD,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,SAAS,GAAG,mBAAmB,CAAC,CAAC;AAChH,CAAC,IAAI,UAAU,GAAG,CAAC;AACnB,CAAC,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE;AACtD,EAAE,IAAI,UAAU,IAAI,EAAE,EAAE;AACxB,GAAG,UAAU,CAAC,KAAK,EAAE;AACrB,GAAG;AACH,EAAE;AACF,EAAE,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC;AAC3C,EAAE,cAAc,CAAC,KAAK,CAAC;AACvB,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;AAC3B,EAAE,UAAU,EAAE;AACd,CAAC,CAAC,EAAE,CAAC;AACL,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE;AACxC,EAAE,cAAc,EAAE,0BAA0B;AAC5C,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,GAAG,WAAW,CAAC;AAC5C,EAAE,eAAe,EAAE;AACnB,EAAE,EAAE,CAAC;AACL;AACG,IAAC,IAAI,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK;AAC1C,CAAC,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,CAAC;AAC5C,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AAC/D,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,gBAAgB,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,uCAAuC,CAAC;AACrJ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,sBAAsB,CAAC;AACzF,CAAC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;AAChC,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE;AACxC,CAAC,IAAI,KAAK,GAAG,CAAC;AACd,CAAC,OAAO,IAAI,EAAE;AACd,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE;AAC7C,EAAE,IAAI,IAAI,EAAE;AACZ,EAAE,KAAK,IAAI,KAAK,CAAC,UAAU;AAC3B,EAAE,IAAI,KAAK,GAAG,gBAAgB,EAAE;AAChC,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE;AACxB,GAAG,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,uCAAuC,CAAC;AACzF,EAAE;AACF,CAAC;AACD,CAAC,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;AACrC,CAAC,OAAO,IAAI,CAAC;AACb,EAAE,KAAK;AACP,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;AACpB,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,GAAG,OAAO,IAAI,EAAE,GAAG,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG;AACrE,EAAE,CAAC;AACH;;;;"}