@selvajs/selva 4.20.0-beta.3 → 4.20.0-beta.4

package/build/server/chunks/chunks/card-header.js-OVZMze6e.js

@@ -0,0 +1,20 @@
+import { al as attributes, am as clsx$1, at as bind_props } from './server.js-CUv4onuj.js';
+import { c as cn } from './utils3.js-D4hQ3EdJ.js';
+
+//#region ../ui/dist/components/primitives/card/card-header.svelte
+function Card_header($$renderer, $$props) {
+	$$renderer.component(($$renderer) => {
+		let { ref = null, class: className, children, $$slots, $$events, ...restProps } = $$props;
+		$$renderer.push(`<div${attributes({
+			"data-slot": "card-header",
+			class: clsx$1(cn("gap-1.5 px-6 [.border-b]:pb-6 @container/card-header grid auto-rows-min items-start", className)),
+			...restProps
+		})}>`);
+		children?.($$renderer);
+		$$renderer.push(`<!----></div>`);
+		bind_props($$props, { ref });
+	});
+}
+
+export { Card_header as C };
+//# sourceMappingURL=card-header.js-OVZMze6e.js.map

package/build/server/chunks/chunks/card-header.js-OVZMze6e.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"card-header.js-OVZMze6e.js","sources":["../../../../.svelte-kit/output/server/chunks/card-header.js"],"sourcesContent":["import { O as clsx, i as bind_props, r as attributes } from \"./server.js\";\nimport { t as cn } from \"./utils3.js\";\n//#region ../ui/dist/components/primitives/card/card-header.svelte\nfunction Card_header($$renderer, $$props) {\n\t$$renderer.component(($$renderer) => {\n\t\tlet { ref = null, class: className, children, $$slots, $$events, ...restProps } = $$props;\n\t\t$$renderer.push(`<div${attributes({\n\t\t\t\"data-slot\": \"card-header\",\n\t\t\tclass: clsx(cn(\"gap-1.5 px-6 [.border-b]:pb-6 @container/card-header grid auto-rows-min items-start\", className)),\n\t\t\t...restProps\n\t\t})}>`);\n\t\tchildren?.($$renderer);\n\t\t$$renderer.push(`<!----></div>`);\n\t\tbind_props($$props, { ref });\n\t});\n}\n//#endregion\nexport { Card_header as t };\n"],"names":["clsx"],"mappings":";;;AAEA;AACA,SAAS,WAAW,CAAC,UAAU,EAAE,OAAO,EAAE;AAC1C,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,UAAU,KAAK;AACtC,EAAE,IAAI,EAAE,GAAG,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,SAAS,EAAE,GAAG,OAAO;AAC3F,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC;AACpC,GAAG,WAAW,EAAE,aAAa;AAC7B,GAAG,KAAK,EAAEA,MAAI,CAAC,EAAE,CAAC,qFAAqF,EAAE,SAAS,CAAC,CAAC;AACpH,GAAG,GAAG;AACN,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACR,EAAE,QAAQ,GAAG,UAAU,CAAC;AACxB,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC;AAClC,EAAE,UAAU,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC;AAC9B,CAAC,CAAC,CAAC;AACH;;;;"}

package/build/server/chunks/chunks/card-title.js-BlOlXRF4.js

@@ -0,0 +1,20 @@
+import { al as attributes, am as clsx$1, at as bind_props } from './server.js-CUv4onuj.js';
+import { c as cn } from './utils3.js-D4hQ3EdJ.js';
+
+//#region ../ui/dist/components/primitives/card/card-title.svelte
+function Card_title($$renderer, $$props) {
+	$$renderer.component(($$renderer) => {
+		let { ref = null, class: className, children, $$slots, $$events, ...restProps } = $$props;
+		$$renderer.push(`<div${attributes({
+			"data-slot": "card-title",
+			class: clsx$1(cn("font-semibold leading-none", className)),
+			...restProps
+		})}>`);
+		children?.($$renderer);
+		$$renderer.push(`<!----></div>`);
+		bind_props($$props, { ref });
+	});
+}
+
+export { Card_title as C };
+//# sourceMappingURL=card-title.js-BlOlXRF4.js.map

package/build/server/chunks/chunks/card-title.js-BlOlXRF4.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"card-title.js-BlOlXRF4.js","sources":["../../../../.svelte-kit/output/server/chunks/card-title.js"],"sourcesContent":["import { O as clsx, i as bind_props, r as attributes } from \"./server.js\";\nimport { t as cn } from \"./utils3.js\";\n//#region ../ui/dist/components/primitives/card/card-title.svelte\nfunction Card_title($$renderer, $$props) {\n\t$$renderer.component(($$renderer) => {\n\t\tlet { ref = null, class: className, children, $$slots, $$events, ...restProps } = $$props;\n\t\t$$renderer.push(`<div${attributes({\n\t\t\t\"data-slot\": \"card-title\",\n\t\t\tclass: clsx(cn(\"font-semibold leading-none\", className)),\n\t\t\t...restProps\n\t\t})}>`);\n\t\tchildren?.($$renderer);\n\t\t$$renderer.push(`<!----></div>`);\n\t\tbind_props($$props, { ref });\n\t});\n}\n//#endregion\nexport { Card_title as t };\n"],"names":["clsx"],"mappings":";;;AAEA;AACA,SAAS,UAAU,CAAC,UAAU,EAAE,OAAO,EAAE;AACzC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,UAAU,KAAK;AACtC,EAAE,IAAI,EAAE,GAAG,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,SAAS,EAAE,GAAG,OAAO;AAC3F,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC;AACpC,GAAG,WAAW,EAAE,YAAY;AAC5B,GAAG,KAAK,EAAEA,MAAI,CAAC,EAAE,CAAC,4BAA4B,EAAE,SAAS,CAAC,CAAC;AAC3D,GAAG,GAAG;AACN,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACR,EAAE,QAAQ,GAAG,UAAU,CAAC;AACxB,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC;AAClC,EAAE,UAAU,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC;AAC9B,CAAC,CAAC,CAAC;AACH;;;;"}

package/build/server/chunks/chunks/card.js-Bl5RdI5W.js

@@ -0,0 +1,29 @@
+import { al as attributes, am as clsx$1, at as bind_props } from './server.js-CUv4onuj.js';
+import { c as cn } from './utils3.js-D4hQ3EdJ.js';
+import { tv } from 'tailwind-variants';
+
+//#region ../ui/dist/components/primitives/card/card.svelte
+var cardVariants = tv({
+	base: "shadow-sm flex flex-col rounded-xl border bg-card text-card-foreground",
+	variants: { variant: {
+		default: "gap-6 py-6",
+		flush: "gap-0 overflow-hidden"
+	} },
+	defaultVariants: { variant: "default" }
+});
+function Card($$renderer, $$props) {
+	$$renderer.component(($$renderer) => {
+		let { ref = null, class: className, variant = "default", children, $$slots, $$events, ...restProps } = $$props;
+		$$renderer.push(`<div${attributes({
+			"data-slot": "card",
+			class: clsx$1(cn(cardVariants({ variant }), className)),
+			...restProps
+		})}>`);
+		children?.($$renderer);
+		$$renderer.push(`<!----></div>`);
+		bind_props($$props, { ref });
+	});
+}
+
+export { Card as C };
+//# sourceMappingURL=card.js-Bl5RdI5W.js.map

package/build/server/chunks/chunks/card.js-Bl5RdI5W.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"card.js-Bl5RdI5W.js","sources":["../../../../.svelte-kit/output/server/chunks/card.js"],"sourcesContent":["import { O as clsx, i as bind_props, r as attributes } from \"./server.js\";\nimport { t as cn } from \"./utils3.js\";\nimport { tv } from \"tailwind-variants\";\n//#region ../ui/dist/components/primitives/card/card.svelte\nvar cardVariants = tv({\n\tbase: \"shadow-sm flex flex-col rounded-xl border bg-card text-card-foreground\",\n\tvariants: { variant: {\n\t\tdefault: \"gap-6 py-6\",\n\t\tflush: \"gap-0 overflow-hidden\"\n\t} },\n\tdefaultVariants: { variant: \"default\" }\n});\nfunction Card($$renderer, $$props) {\n\t$$renderer.component(($$renderer) => {\n\t\tlet { ref = null, class: className, variant = \"default\", children, $$slots, $$events, ...restProps } = $$props;\n\t\t$$renderer.push(`<div${attributes({\n\t\t\t\"data-slot\": \"card\",\n\t\t\tclass: clsx(cn(cardVariants({ variant }), className)),\n\t\t\t...restProps\n\t\t})}>`);\n\t\tchildren?.($$renderer);\n\t\t$$renderer.push(`<!----></div>`);\n\t\tbind_props($$props, { ref });\n\t});\n}\n//#endregion\nexport { Card as t };\n"],"names":["clsx"],"mappings":";;;;AAGA;AACA,IAAI,YAAY,GAAG,EAAE,CAAC;AACtB,CAAC,IAAI,EAAE,wEAAwE;AAC/E,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE;AACtB,EAAE,OAAO,EAAE,YAAY;AACvB,EAAE,KAAK,EAAE;AACT,EAAE,EAAE;AACJ,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,SAAS;AACtC,CAAC,CAAC;AACF,SAAS,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE;AACnC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,UAAU,KAAK;AACtC,EAAE,IAAI,EAAE,GAAG,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,GAAG,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,SAAS,EAAE,GAAG,OAAO;AAChH,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC;AACpC,GAAG,WAAW,EAAE,MAAM;AACtB,GAAG,KAAK,EAAEA,MAAI,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;AACxD,GAAG,GAAG;AACN,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACR,EAAE,QAAQ,GAAG,UAAU,CAAC;AACxB,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC;AAClC,EAAE,UAAU,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC;AAC9B,CAAC,CAAC,CAAC;AACH;;;;"}

package/build/server/chunks/chunks/chevron-left.js-s4JiO_z2.js

@@ -0,0 +1,15 @@
+import { ai as spread_props } from './server.js-CUv4onuj.js';
+import { I as Icon } from './utils3.js-D4hQ3EdJ.js';
+
+//#region ../../node_modules/.pnpm/@lucide+svelte@1.48.0_svelte@5.57.1_@typescript-eslint+types@8.70.1_/node_modules/@lucide/svelte/dist/icons/chevron-left.svelte
+function Chevron_left($$renderer, $$props) {
+	let { $$slots, $$events, ...props } = $$props;
+	Icon($$renderer, spread_props([props, { icon: {
+		"name": "chevron-left",
+		"size": 24,
+		"node": [["path", { "d": "m15 18-6-6 6-6" }]]
+	} }]));
+}
+
+export { Chevron_left as C };
+//# sourceMappingURL=chevron-left.js-s4JiO_z2.js.map

package/build/server/chunks/chunks/chevron-left.js-s4JiO_z2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chevron-left.js-s4JiO_z2.js","sources":["../../../../.svelte-kit/output/server/chunks/chevron-left.js"],"sourcesContent":["import { d as spread_props } from \"./server.js\";\nimport { n as Icon } from \"./utils3.js\";\n//#region ../../node_modules/.pnpm/@lucide+svelte@1.48.0_svelte@5.57.1_@typescript-eslint+types@8.70.1_/node_modules/@lucide/svelte/dist/icons/chevron-left.svelte\nfunction Chevron_left($$renderer, $$props) {\n\tlet { $$slots, $$events, ...props } = $$props;\n\tIcon($$renderer, spread_props([props, { icon: {\n\t\t\"name\": \"chevron-left\",\n\t\t\"size\": 24,\n\t\t\"node\": [[\"path\", { \"d\": \"m15 18-6-6 6-6\" }]]\n\t} }]));\n}\n//#endregion\nexport { Chevron_left as t };\n"],"names":[],"mappings":";;;AAEA;AACA,SAAS,YAAY,CAAC,UAAU,EAAE,OAAO,EAAE;AAC3C,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO;AAC9C,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE;AAC/C,EAAE,MAAM,EAAE,cAAc;AACxB,EAAE,MAAM,EAAE,EAAE;AACZ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC;AAC9C,EAAE,EAAE,CAAC,CAAC,CAAC;AACP;;;;"}

package/build/server/chunks/chunks/client.js-BwRu_P83.js

@@ -0,0 +1,59 @@
+import './shared.js-BStsS1ju.js';
+import './exports.js-DurfUvtz.js';
+import './routing.js-CvcjLFt6.js';
+import { n as noop } from './server.js-CUv4onuj.js';
+import { i as index_server_exports } from './index-server.js-CMohmRjd.js';
+import './internal2.js-CnbcJNuO.js';
+import '@sveltejs/kit/internal/server';
+import '@sveltejs/kit/internal';
+
+var is_legacy = noop.toString().includes("$$") || /function \w+\(\) \{\}/.test(noop.toString());
+var placeholder_url = "a:";
+if (is_legacy) {
+	({
+		data: {},
+		form: null,
+		error: null,
+		params: {},
+		route: { id: null },
+		state: {},
+		status: -1,
+		url: new URL(placeholder_url)
+	});
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@sveltejs+kit@2.70.3_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.3.1_svelte_9172e0e9363bf3f5d5e1b1085ec23abb/node_modules/@sveltejs/kit/src/runtime/client/client.js
+/** @import { RemoteFunctionDataNode, ServerNodesResponse, ServerRedirectNode } from 'types' */
+/** @import { CacheEntry } from './remote-functions/cache.svelte.js' */
+/** @import { Query } from './remote-functions/query/instance.svelte.js' */
+/** @import { LiveQuery } from './remote-functions/query-live/instance.svelte.js' */
+var { onMount, tick } = index_server_exports;
+/**
+* Allows you to navigate programmatically to a given route, with options such as keeping the current element focused.
+* Returns a Promise that resolves when SvelteKit navigates (or fails to navigate, in which case the promise rejects) to the specified `url`.
+*
+* For external URLs, use `window.location = url` instead of calling `goto(url)`.
+*
+* @param {string | URL} url Where to navigate to. Note that if you've set [`config.kit.paths.base`](https://svelte.dev/docs/kit/configuration#paths) and the URL is root-relative, you need to prepend the base path if you want to navigate within the app.
+* @param {Object} [opts] Options related to the navigation
+* @param {boolean} [opts.replaceState] If `true`, will replace the current `history` entry rather than creating a new one with `pushState`
+* @param {boolean} [opts.noScroll] If `true`, the browser will maintain its scroll position rather than scrolling to the top of the page after navigation
+* @param {boolean} [opts.keepFocus] If `true`, the currently focused element will retain focus after navigation. Otherwise, focus will be reset to the body
+* @param {boolean} [opts.invalidateAll] If `true`, all `load` functions of the page will be rerun. See https://svelte.dev/docs/kit/load#rerunning-load-functions for more info on invalidation.
+* @param {Array<string | URL | ((url: URL) => boolean)>} [opts.invalidate] Causes any load functions to re-run if they depend on one of the urls
+* @param {App.PageState} [opts.state] An optional object that will be available as `page.state`
+* @returns {Promise<void>}
+*/
+function goto(url, opts = {}) {
+	throw new Error("Cannot call goto(...) on the server");
+}
+/**
+* Causes all `load` and `query` functions belonging to the currently active page to re-run. Returns a `Promise` that resolves when the page is subsequently updated.
+* @returns {Promise<void>}
+*/
+function invalidateAll() {
+	throw new Error("Cannot call invalidateAll() on the server");
+}
+
+export { goto as g, invalidateAll as i };
+//# sourceMappingURL=client.js-BwRu_P83.js.map

package/build/server/chunks/chunks/client.js-BwRu_P83.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js-BwRu_P83.js","sources":["../../../../.svelte-kit/output/server/chunks/client.js"],"sourcesContent":["import { x as noop } from \"./shared.js\";\nimport \"./internal.js\";\nimport \"./exports.js\";\nimport \"./routing.js\";\nimport { Ht as noop$1 } from \"./server.js\";\nimport { n as writable } from \"./shared2.js\";\nimport { t as index_server_exports } from \"./index-server.js\";\nimport \"./paths.js\";\nimport \"@sveltejs/kit/internal\";\nvar PRELOAD_PRIORITIES = {\n\ttap: 1,\n\thover: 2,\n\tviewport: 3,\n\teager: 4,\n\toff: -1,\n\tfalse: -1\n};\n({ ...PRELOAD_PRIORITIES }), PRELOAD_PRIORITIES.hover;\n/** @param {any} value */\nfunction notifiable_store(value) {\n\tconst store = writable(value);\n\tlet ready = true;\n\tfunction notify() {\n\t\tready = true;\n\t\tstore.update((val) => val);\n\t}\n\t/** @param {any} new_value */\n\tfunction set(new_value) {\n\t\tready = false;\n\t\tstore.set(new_value);\n\t}\n\t/** @param {(value: any) => void} run */\n\tfunction subscribe(run) {\n\t\t/** @type {any} */\n\t\tlet old_value;\n\t\treturn store.subscribe((new_value) => {\n\t\t\tif (old_value === void 0 || ready && new_value !== old_value) run(old_value = new_value);\n\t\t});\n\t}\n\treturn {\n\t\tnotify,\n\t\tset,\n\t\tsubscribe\n\t};\n}\nvar updated_listener = { v: noop };\nfunction create_updated_store() {\n\tconst { set, subscribe } = writable(false);\n\treturn {\n\t\tsubscribe,\n\t\tcheck: async () => false\n\t};\n}\n//#endregion\n//#region ../../node_modules/.pnpm/@sveltejs+kit@2.70.3_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.3.1_svelte_9172e0e9363bf3f5d5e1b1085ec23abb/node_modules/@sveltejs/kit/src/runtime/client/state.svelte.js\nvar page;\nvar navigating;\nvar updated;\nvar is_legacy = noop$1.toString().includes(\"$$\") || /function \\w+\\(\\) \\{\\}/.test(noop$1.toString());\nvar placeholder_url = \"a:\";\nif (is_legacy) {\n\tpage = {\n\t\tdata: {},\n\t\tform: null,\n\t\terror: null,\n\t\tparams: {},\n\t\troute: { id: null },\n\t\tstate: {},\n\t\tstatus: -1,\n\t\turl: new URL(placeholder_url)\n\t};\n\tnavigating = { current: null };\n\tupdated = { current: false };\n} else {\n\tpage = new class Page {\n\t\tdata = {};\n\t\tform = null;\n\t\terror = null;\n\t\tparams = {};\n\t\troute = { id: null };\n\t\tstate = {};\n\t\tstatus = -1;\n\t\turl = new URL(placeholder_url);\n\t}();\n\tnavigating = new class Navigating {\n\t\tcurrent = null;\n\t}();\n\tupdated = new class Updated {\n\t\tcurrent = false;\n\t}();\n\tupdated_listener.v = () => updated.current = true;\n}\n//#endregion\n//#region ../../node_modules/.pnpm/@sveltejs+kit@2.70.3_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.3.1_svelte_9172e0e9363bf3f5d5e1b1085ec23abb/node_modules/@sveltejs/kit/src/runtime/client/client.js\n/** @import { RemoteFunctionDataNode, ServerNodesResponse, ServerRedirectNode } from 'types' */\n/** @import { CacheEntry } from './remote-functions/cache.svelte.js' */\n/** @import { Query } from './remote-functions/query/instance.svelte.js' */\n/** @import { LiveQuery } from './remote-functions/query-live/instance.svelte.js' */\nvar { onMount, tick } = index_server_exports;\nvar stores = {\n\turl: /* @__PURE__ */ notifiable_store({}),\n\tpage: /* @__PURE__ */ notifiable_store({}),\n\tnavigating: /* @__PURE__ */ writable(null),\n\tupdated: /* @__PURE__ */ create_updated_store()\n};\n/**\n* Allows you to navigate programmatically to a given route, with options such as keeping the current element focused.\n* Returns a Promise that resolves when SvelteKit navigates (or fails to navigate, in which case the promise rejects) to the specified `url`.\n*\n* For external URLs, use `window.location = url` instead of calling `goto(url)`.\n*\n* @param {string | URL} url Where to navigate to. Note that if you've set [`config.kit.paths.base`](https://svelte.dev/docs/kit/configuration#paths) and the URL is root-relative, you need to prepend the base path if you want to navigate within the app.\n* @param {Object} [opts] Options related to the navigation\n* @param {boolean} [opts.replaceState] If `true`, will replace the current `history` entry rather than creating a new one with `pushState`\n* @param {boolean} [opts.noScroll] If `true`, the browser will maintain its scroll position rather than scrolling to the top of the page after navigation\n* @param {boolean} [opts.keepFocus] If `true`, the currently focused element will retain focus after navigation. Otherwise, focus will be reset to the body\n* @param {boolean} [opts.invalidateAll] If `true`, all `load` functions of the page will be rerun. See https://svelte.dev/docs/kit/load#rerunning-load-functions for more info on invalidation.\n* @param {Array<string | URL | ((url: URL) => boolean)>} [opts.invalidate] Causes any load functions to re-run if they depend on one of the urls\n* @param {App.PageState} [opts.state] An optional object that will be available as `page.state`\n* @returns {Promise<void>}\n*/\nfunction goto(url, opts = {}) {\n\tthrow new Error(\"Cannot call goto(...) on the server\");\n}\n/**\n* Causes all `load` and `query` functions belonging to the currently active page to re-run. Returns a `Promise` that resolves when the page is subsequently updated.\n* @returns {Promise<void>}\n*/\nfunction invalidateAll() {\n\tthrow new Error(\"Cannot call invalidateAll() on the server\");\n}\n//#endregion\nexport { page as a, navigating as i, invalidateAll as n, stores as r, goto as t };\n"],"names":["noop$1"],"mappings":";;;;;;;;;AA0DA,IAAI,SAAS,GAAGA,IAAM,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAACA,IAAM,CAAC,QAAQ,EAAE,CAAC;AACnG,IAAI,eAAe,GAAG,IAAI;AAC1B,IAAI,SAAS,EAAE;AACf,EAAQ;AACR,EAAE,IAAI,EAAE,EAAE;AACV,EAAE,IAAI,EAAE,IAAI;AACZ,EAAE,KAAK,EAAE,IAAI;AACb,EAAE,MAAM,EAAE,EAAE;AACZ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;AACrB,EAAE,KAAK,EAAE,EAAE;AACX,EAAE,MAAM,EAAE,EAAE;AACZ,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,eAAe;AAC9B,GAAE;AAGF;AAmBA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,oBAAoB;AAO5C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,IAAI,CAAC,GAAG,EAAE,IAAI,GAAG,EAAE,EAAE;AAC9B,CAAC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC;AACvD;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,GAAG;AACzB,CAAC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC;AAC7D;;;;"}

package/build/server/chunks/chunks/compute.js-DtVZD_ty.js

@@ -0,0 +1,429 @@
+import './src.js-bYgw0r8C.js';
+import { r as resolveServerForOrg$1 } from './utils2.js-C9XYOWak.js';
+import { a as apiError, A as ApiErrorCode, N as NoopLogger } from './schema-extraction.js-B-qWNPpJ.js';
+import { f as ComputeServerUnconfiguredError } from './api.js-DGA_Gpu6.js';
+import { lookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
+
+//#region ../server/src/compute/safe-url.ts
+/**
+* SSRF guard for the remote-definition fetch. Without it an authenticated user
+* could submit `http://169.254.169.254/...` (cloud metadata) or any intranet
+* endpoint and the server would fetch it on their behalf.
+*
+* Two layers:
+*
+*   1. `isSafeRemoteDefinitionUrl` — synchronous, DNS-free literal filter.
+*      Rejects the protocol, hostname literals, and every IP *encoding* that
+*      maps to a blocked address: dotted-decimal, integer, octal, hex,
+*      short-form, IPv4-mapped IPv6.
+*   2. `assertSafeRemoteDefinitionUrl` — resolves the hostname and re-checks the
+*      *resolved* IP, catching a public name that points at a private one.
+*
+* Neither is bulletproof against DNS rebinding — the IP can change between our
+* lookup and fetch's own. Closing that needs the caller to connect to the
+* resolved IP directly, a much larger change; these two layers close the
+* bypasses an attacker actually reaches for (literal encodings, and a public
+* name whose record points inward).
+*/
+/**
+* True when `ip` (a normalized IPv4 or IPv6 literal from `isIP`/`dns.lookup`)
+* is loopback, private, link-local, or otherwise must-not-fetch. IPv4-mapped
+* IPv6 (`::ffff:a.b.c.d`) is unwrapped first so the v4 rules apply.
+*/
+function isBlockedIp(ip) {
+	let addr = ip.toLowerCase();
+	const mappedDotted = /^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/.exec(addr);
+	if (mappedDotted) addr = mappedDotted[1];
+	else {
+		const mappedHex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(addr);
+		if (mappedHex) {
+			const hi = parseInt(mappedHex[1], 16);
+			const lo = parseInt(mappedHex[2], 16);
+			addr = [
+				hi >> 8 & 255,
+				hi & 255,
+				lo >> 8 & 255,
+				lo & 255
+			].join(".");
+		}
+	}
+	if (isIP(addr) === 4) {
+		const octets = addr.split(".").map(Number);
+		if (octets.length !== 4 || octets.some((o) => o > 255)) return true;
+		const [a, b] = octets;
+		if (a === 0) return true;
+		if (a === 127) return true;
+		if (a === 10) return true;
+		if (a === 192 && b === 168) return true;
+		if (a === 172 && b >= 16 && b <= 31) return true;
+		if (a === 169 && b === 254) return true;
+		return false;
+	}
+	if (addr === "::1" || addr === "::") return true;
+	if (/^(fc|fd)[0-9a-f]{0,2}:/.test(addr)) return true;
+	if (/^fe[89ab][0-9a-f]:/.test(addr)) return true;
+	return false;
+}
+/**
+* Parse a bare-IPv4 hostname in any encoding browsers/glibc accept — integer
+* (`2130706433`), octal (`0177.0.0.1`), hex (`0x7f000001`), and short forms
+* (`127.1`) — into canonical dotted-decimal. An already-valid dotted-quad comes
+* back unchanged. Returns null only when the host is not a numeric IPv4 literal
+* at all, i.e. it's a real name — which is what callers use to decide whether
+* DNS resolution is needed.
+*/
+function canonicalizeNumericIpv4(host) {
+	if (isIP(host) === 4) return host;
+	const rawParts = host.split(".");
+	if (rawParts.length === 0 || rawParts.length > 4) return null;
+	const parseUInt = (s) => {
+		if (s === "") return null;
+		let n;
+		if (/^0x[0-9a-f]+$/i.test(s)) n = parseInt(s, 16);
+		else if (/^0[0-7]+$/.test(s)) n = parseInt(s, 8);
+		else if (/^[0-9]+$/.test(s)) n = parseInt(s, 10);
+		else return null;
+		return Number.isFinite(n) ? n : null;
+	};
+	const nums = rawParts.map(parseUInt);
+	if (nums.some((n) => n === null)) return null;
+	const parts = nums;
+	let value;
+	switch (parts.length) {
+		case 1:
+			value = parts[0];
+			break;
+		case 2:
+			if (parts[0] > 255 || parts[1] > 16777215) return null;
+			value = parts[0] << 24 | parts[1];
+			break;
+		case 3:
+			if (parts[0] > 255 || parts[1] > 255 || parts[2] > 65535) return null;
+			value = parts[0] << 24 | parts[1] << 16 | parts[2];
+			break;
+		default:
+			if (parts.some((p) => p > 255)) return null;
+			value = parts[0] << 24 | parts[1] << 16 | parts[2] << 8 | parts[3];
+	}
+	value = value >>> 0;
+	if (value > 4294967295) return null;
+	return [
+		value >>> 24 & 255,
+		value >>> 16 & 255,
+		value >>> 8 & 255,
+		value & 255
+	].join(".");
+}
+/**
+* Synchronous literal pre-filter: rejects bad schemes, loopback hostnames, and
+* any IP literal (in any encoding) that maps to a blocked address. Does NOT
+* perform DNS — a public *name* that points at a private IP passes here and is
+* caught only by `assertSafeRemoteDefinitionUrl`.
+*/
+function isSafeRemoteDefinitionUrl(raw) {
+	let parsed;
+	try {
+		parsed = new URL(raw);
+	} catch {
+		return false;
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return false;
+	let host = parsed.hostname.toLowerCase();
+	if (!host) return false;
+	if (host === "localhost" || host.endsWith(".localhost")) return false;
+	if (host.startsWith("[") && host.endsWith("]")) host = host.slice(1, -1);
+	if (isIP(host) === 6) return !isBlockedIp(host);
+	const canonical = canonicalizeNumericIpv4(host);
+	if (canonical) return !isBlockedIp(canonical);
+	return true;
+}
+/**
+* True when `raw` targets the link-local range (`169.254.0.0/16`), which
+* carries the cloud metadata service at `169.254.169.254` — the endpoint that
+* hands out a host's own IAM credentials to anything on the box.
+*
+* A far narrower judgement than {@link isSafeRemoteDefinitionUrl}, for the one
+* caller that must tolerate private addresses: an operator's own compute server
+* legitimately lives on `localhost` or a LAN, so blocking RFC1918 there would
+* reject the ordinary self-hosted layout. Nothing legitimate is ever reached
+* over link-local, so this stays blocked with no opt-out.
+*
+* Shares `canonicalizeNumericIpv4`, so the encodings that bypass a naive string
+* comparison — `http://2852039166/`, `http://0251.0376.0251.0376/`,
+* `http://0xa9fea9fe/` — all resolve to the same verdict.
+*/
+function isLinkLocalUrl(raw) {
+	let host;
+	try {
+		host = new URL(raw).hostname.toLowerCase();
+	} catch {
+		return false;
+	}
+	if (!host) return false;
+	if (host.startsWith("[") && host.endsWith("]")) host = host.slice(1, -1);
+	if (isIP(host) === 6) return /^fe[89ab][0-9a-f]:/.test(host);
+	const canonical = canonicalizeNumericIpv4(host);
+	if (!canonical) return false;
+	const [a, b] = canonical.split(".").map(Number);
+	return a === 169 && b === 254;
+}
+/**
+* Full SSRF check: literal pre-filter, then resolve every A/AAAA record and
+* reject if *any* resolved IP is blocked. Returns the original URL on success
+* so callers can `await assertSafeRemoteDefinitionUrl(url)` inline.
+*
+* Every rejection throws the same generic message so the caller gets no oracle;
+* which host was blocked and by which layer is logged server-side instead.
+*/
+async function assertSafeRemoteDefinitionUrl(raw, logger = new NoopLogger()) {
+	if (!isSafeRemoteDefinitionUrl(raw)) {
+		logger.warn("Blocked remote definition URL", {
+			component: "Compute/ssrf",
+			reason: "literal-filter",
+			host: hostOf(raw)
+		});
+		throw new Error("Remote definition URL is not allowed");
+	}
+	const host = new URL(raw).hostname.toLowerCase().replace(/^\[|\]$/g, "");
+	if (isIP(host) !== 0 || canonicalizeNumericIpv4(host)) return raw;
+	let resolved;
+	try {
+		resolved = await lookup(host, { all: true });
+	} catch {
+		logger.warn("Blocked remote definition URL", {
+			component: "Compute/ssrf",
+			reason: "dns-lookup-failed",
+			host
+		});
+		throw new Error("Remote definition URL is not allowed");
+	}
+	if (resolved.length === 0 || resolved.some((r) => isBlockedIp(r.address))) {
+		const blocked = resolved.filter((r) => isBlockedIp(r.address)).map((r) => r.address);
+		logger.warn("Blocked remote definition URL", {
+			component: "Compute/ssrf",
+			reason: "resolves-to-blocked-ip",
+			host,
+			blockedIps: blocked
+		});
+		throw new Error("Remote definition URL is not allowed");
+	}
+	return raw;
+}
+/** Best-effort hostname for logging; falls back to a truncated raw string. */
+function hostOf(raw) {
+	try {
+		return new URL(raw).hostname;
+	} catch {
+		return raw.slice(0, 120);
+	}
+}
+//#endregion
+//#region ../server/src/compute/remote-definition.ts
+/**
+* Remote-definition fetch: SSRF-guarded, size-capped, timed, and TTL-cached.
+*
+* A solve can reference its `.gh` by remote URL instead of a stored blob, and
+* that URL is attacker-controllable — a share-token caller supplies
+* `definitionUrl`. Hence {@link assertSafeRemoteDefinitionUrl}, the early size
+* cap, and the deadline.
+*/
+/** Once the cache exceeds this many entries, evict the oldest 10 by `fetchedAt`. */
+var CACHE_MAX_ENTRIES = 50;
+var CACHE_EVICT_BATCH = 10;
+/**
+* Read a response body into memory, aborting (and throwing) as soon as the
+* running byte total exceeds `maxBytes`. Falls back to `arrayBuffer()` only when
+* the body isn't a readable stream (older fetch impls).
+*/
+async function readBodyWithCap(response, maxBytes, controller) {
+	if (!response.body) {
+		const buffer = await response.arrayBuffer();
+		if (buffer.byteLength > maxBytes) throw new Error("Remote definition exceeds size limit");
+		return new Uint8Array(buffer);
+	}
+	const reader = response.body.getReader();
+	const chunks = [];
+	let total = 0;
+	while (true) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		total += value.byteLength;
+		if (total > maxBytes) {
+			controller.abort();
+			throw new Error("Remote definition exceeds size limit");
+		}
+		chunks.push(value);
+	}
+	const out = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		out.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return out;
+}
+/**
+* Build a remote-definition fetcher owning its own TTL cache. Each fetcher's
+* cache is independent, so one per process shares warm bytes while test fetchers
+* stay isolated.
+*/
+function createRemoteDefinitionFetcher(config) {
+	const cache = /* @__PURE__ */ new Map();
+	const logger = config.logger ?? new NoopLogger();
+	return { async load(url) {
+		await assertSafeRemoteDefinitionUrl(url, logger);
+		const now = config.now();
+		const cached = cache.get(url);
+		if (cached && now - cached.fetchedAt < config.cacheTtlMs) return cached.data;
+		const controller = new AbortController();
+		const timeout = setTimeout(() => controller.abort(), config.fetchTimeoutMs);
+		let data;
+		try {
+			const response = await fetch(url, {
+				signal: controller.signal,
+				redirect: "error"
+			});
+			if (!response.ok) throw new Error(`HTTP ${response.status}: ${response.statusText}`);
+			const declared = Number(response.headers.get("content-length"));
+			if (Number.isFinite(declared) && declared > config.maxBytes) throw new Error("Remote definition exceeds size limit");
+			data = await readBodyWithCap(response, config.maxBytes, controller);
+		} finally {
+			clearTimeout(timeout);
+		}
+		cache.set(url, {
+			data,
+			fetchedAt: now
+		});
+		if (cache.size > CACHE_MAX_ENTRIES) {
+			const entries = Array.from(cache.entries());
+			entries.sort((a, b) => a[1].fetchedAt - b[1].fetchedAt);
+			for (let i = 0; i < CACHE_EVICT_BATCH; i++) cache.delete(entries[i][0]);
+		}
+		return data;
+	} };
+}
+//#endregion
+//#region ../server/src/compute/resolve-server.ts
+/**
+* Pick the right Rhino.Compute server for an (org, definition) pair.
+*
+* Resolution order, narrowest wins:
+*   1. `definitionPin` if it points at a server visible to `orgId`.
+*   2. `orgDefaults[orgId]` if set and visible.
+*   3. Global `defaultServerId`.
+*
+* The store returns the full config; the visibility predicate runs in the pure
+* helper so callers don't reimplement it. Re-throws the pure helper's "nothing
+* visible" failure as a typed `ComputeServerUnconfiguredError`.
+*
+* Reads a key-free config and fetches the `apiKey` only for the server that
+* actually wins, instead of decrypting every configured server's key to use
+* exactly one of them.
+*/
+async function resolveServerForOrg(ctx, orgId, store, opts = {}) {
+	const config = await store.getConfig(ctx);
+	let server;
+	try {
+		server = resolveServerForOrg$1(config, orgId, { definitionPin: opts.definitionPin });
+	} catch (err) {
+		throw new ComputeServerUnconfiguredError(err instanceof Error ? err.message : void 0);
+	}
+	if (!server.hasApiKey) return server;
+	return {
+		...server,
+		apiKey: await store.getServerApiKey(ctx, server.id)
+	};
+}
+//#endregion
+//#region ../server/src/compute/server-config-write.ts
+/**
+* Shared write-path rules for compute server config.
+*
+* Two routes accept a server set: `/api/admin/compute` (platform scope,
+* `manage_compute`) and `/api/v1/orgs/{orgId}/compute` (org scope,
+* `manage_org_compute`). They differ in who may call them, what extra fields
+* they carry (`sharedWith` vs `ownerOrgId`), and how they validate the default
+* selection — but the field validation and the apiKey merge below must behave
+* identically in both, so they live here rather than in either handler.
+*
+* The apiKey merge is why this file exists: if the two copies disagree, a
+* stored credential silently gets cleared or leaked, and nothing fails at
+* build time.
+*/
+/**
+* A stored `serverUrl` is fetched server-side on every status probe, every
+* purge/shutdown action, and every solve, so an unfiltered one is an SSRF
+* primitive handed to whoever holds `manage_compute`. Two rules:
+*
+*   - Scheme allowlist: `http`/`https`. `file:`, `gopher:` and friends are never
+*     a Rhino.Compute endpoint.
+*   - Link-local (`169.254.0.0/16`) is refused. That range carries the cloud
+*     metadata service at `169.254.169.254`, which hands out the host's own IAM
+*     credentials to anything running on the box.
+*
+* **Loopback and RFC1918 are deliberately allowed.** Running compute on
+* `localhost:6500` or a LAN box is the ordinary self-hosted layout, not an
+* attack — most deployments reach their compute server over exactly those
+* addresses. Blocking them by default would break those instances on upgrade
+* and push every operator toward an opt-out flag, and a guard that everyone
+* disables protects nobody. So the check is narrowed to the range where no
+* legitimate compute server ever lives.
+*
+* What this does not stop: a privileged admin pointing the app at an internal
+* host to probe it. That is a real but much weaker concern than credential
+* theft, it needs `manage_compute` already, and it is inseparable from the
+* legitimate case. Revisit if `manage_org_compute` is ever delegated widely on
+* a multi-tenant instance.
+*
+* `isLinkLocalUrl` is reused rather than hand-rolled because a string compare
+* against `169.254.169.254` misses the encodings that reach the same address:
+* `http://2852039166/`, `http://0xa9fea9fe/`, `http://0251.0376.0251.0376/`.
+*/
+function assertUsableServerUrl(serverUrl) {
+	let parsed;
+	try {
+		parsed = new URL(serverUrl);
+	} catch {
+		apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid serverUrl: ${serverUrl}`);
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") apiError(400, ApiErrorCode.VALIDATION_FAILED, `serverUrl must use http or https: ${serverUrl}`);
+	if (isLinkLocalUrl(serverUrl)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `serverUrl points at the link-local range, which carries the cloud metadata service: ${serverUrl}`);
+}
+/**
+* Validates the scope-independent fields of every submitted server. Throws the
+* first failure as a 400; scope-specific fields (`sharedWith`, `ownerOrgId`)
+* are the caller's business.
+*/
+function validateIncomingServers(servers) {
+	for (const s of servers) {
+		if (!s.id || typeof s.id !== "string") apiError(400, ApiErrorCode.VALIDATION_FAILED, "Each server needs an id");
+		if (!s.label || typeof s.label !== "string") apiError(400, ApiErrorCode.VALIDATION_FAILED, "Each server needs a label");
+		if (!s.serverUrl || typeof s.serverUrl !== "string") apiError(400, ApiErrorCode.VALIDATION_FAILED, "Each server needs a serverUrl");
+		assertUsableServerUrl(s.serverUrl);
+		if (s.apiKey !== void 0 && s.apiKey !== null && typeof s.apiKey !== "string") apiError(400, ApiErrorCode.VALIDATION_FAILED, "apiKey must be a string, null, or omitted");
+	}
+}
+/**
+* The UI never receives stored keys — it sends back `hasApiKey` and omits the
+* field for servers the operator didn't touch. So "omitted" cannot mean "clear":
+* it has to preserve, or every save through the settings form would wipe the
+* keys of every server the operator left alone. Clearing is explicit (`null`);
+* an empty string is treated as "not provided" since that's what an untouched
+* password input submits.
+*/
+function resolveApiKey(submitted, storedKey) {
+	if (submitted === null) return void 0;
+	return submitted ? submitted : storedKey;
+}
+/**
+* Builds the id → stored-key lookup the merge reads. The caller passes only the
+* servers in its own scope, so one scope's write can never resolve a key from
+* another's rows.
+*/
+function storedKeysById(scopedServers) {
+	return new Map(scopedServers.map((s) => [s.id, s.apiKey]));
+}
+
+export { resolveApiKey as a, createRemoteDefinitionFetcher as c, resolveServerForOrg as r, storedKeysById as s, validateIncomingServers as v };
+//# sourceMappingURL=compute.js-DtVZD_ty.js.map