@selvajs/selva 4.20.0-beta.6 → 4.20.0-beta.7

package/build/server/chunks/chunks/button.js-CjcDLdvS.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"button.js-CjcDLdvS.js","sources":["../../../../.svelte-kit/output/server/chunks/button.js"],"sourcesContent":["import { O as clsx, i as bind_props, r as attributes } from \"./server.js\";\nimport { t as cn } from \"./utils2.js\";\nimport { tv } from \"tailwind-variants\";\n//#region ../ui/dist/components/primitives/button/button.svelte\nvar buttonVariants = tv({\n\tbase: \"focus-visible:border-ring focus-visible:ring-ring aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive inline-flex shrink-0 items-center justify-center gap-2 whitespace-nowrap rounded-md text-sm font-medium outline-none transition-all focus-visible:ring-3 disabled:pointer-events-none disabled:opacity-50 aria-disabled:pointer-events-none aria-disabled:opacity-50 [&_svg:not([class*='size-'])]:size-4 [&_svg]:pointer-events-none [&_svg]:shrink-0\",\n\tvariants: {\n\t\tvariant: {\n\t\t\tdefault: \"bg-primary text-primary-foreground shadow-xs hover:bg-primary/90\",\n\t\t\tdestructive: \"bg-destructive shadow-xs hover:bg-destructive/90 dark:bg-destructive/60 text-destructive-foreground\",\n\t\t\toutline: \"bg-background shadow-xs hover:bg-accent hover:text-accent-foreground dark:bg-input/30 dark:border-input dark:hover:bg-input/50 border\",\n\t\t\tsecondary: \"bg-secondary text-secondary-foreground shadow-xs hover:bg-secondary/80\",\n\t\t\tghost: \"hover:bg-accent hover:text-accent-foreground dark:hover:bg-accent/50\",\n\t\t\tdashed: \"border border-dashed border-input bg-background text-muted-foreground hover:bg-muted hover:text-foreground\",\n\t\t\tlink: \"text-primary underline-offset-4 hover:underline\"\n\t\t},\n\t\tsize: {\n\t\t\tdefault: \"h-9 px-4 py-2 has-[>svg]:px-3\",\n\t\t\txs: \"h-7 gap-1 rounded-md px-3 text-xs has-[>svg]:px-2\",\n\t\t\tsm: \"h-8 gap-1.5 rounded-md px-3 has-[>svg]:px-2.5\",\n\t\t\tlg: \"h-10 rounded-md px-6 has-[>svg]:px-4\",\n\t\t\ticon: \"size-9\",\n\t\t\t\"icon-sm\": \"size-8\",\n\t\t\t\"icon-lg\": \"size-10\"\n\t\t}\n\t},\n\tdefaultVariants: {\n\t\tvariant: \"default\",\n\t\tsize: \"default\"\n\t}\n});\nfunction Button($$renderer, $$props) {\n\t$$renderer.component(($$renderer) => {\n\t\tlet { class: className, variant = \"default\", size = \"default\", ref = null, href = void 0, type = \"button\", disabled, children, $$slots, $$events, ...restProps } = $$props;\n\t\tif (href) {\n\t\t\t$$renderer.push(`<!--[0--><a${attributes({\n\t\t\t\t\"data-slot\": \"button\",\n\t\t\t\tclass: clsx(cn(buttonVariants({\n\t\t\t\t\tvariant,\n\t\t\t\t\tsize\n\t\t\t\t}), className)),\n\t\t\t\thref: disabled ? void 0 : href,\n\t\t\t\t\"aria-disabled\": disabled,\n\t\t\t\t\"data-sveltekit-reload\": true,\n\t\t\t\t...restProps\n\t\t\t})}>`);\n\t\t\tchildren?.($$renderer);\n\t\t\t$$renderer.push(`<!----></a>`);\n\t\t} else {\n\t\t\t$$renderer.push(`<!--[-1--><button${attributes({\n\t\t\t\t\"data-slot\": \"button\",\n\t\t\t\tclass: clsx(cn(buttonVariants({\n\t\t\t\t\tvariant,\n\t\t\t\t\tsize\n\t\t\t\t}), className)),\n\t\t\t\ttype,\n\t\t\t\tdisabled,\n\t\t\t\t...restProps\n\t\t\t})}>`);\n\t\t\tchildren?.($$renderer);\n\t\t\t$$renderer.push(`<!----></button>`);\n\t\t}\n\t\t$$renderer.push(`<!--]-->`);\n\t\tbind_props($$props, { ref });\n\t});\n}\n//#endregion\nexport { buttonVariants as n, Button as t };\n"],"names":["clsx"],"mappings":";;;;AAGA;AACG,IAAC,cAAc,GAAG,EAAE,CAAC;AACxB,CAAC,IAAI,EAAE,ifAAif;AACxf,CAAC,QAAQ,EAAE;AACX,EAAE,OAAO,EAAE;AACX,GAAG,OAAO,EAAE,kEAAkE;AAC9E,GAAG,WAAW,EAAE,qGAAqG;AACrH,GAAG,OAAO,EAAE,uIAAuI;AACnJ,GAAG,SAAS,EAAE,wEAAwE;AACtF,GAAG,KAAK,EAAE,sEAAsE;AAChF,GAAG,MAAM,EAAE,4GAA4G;AACvH,GAAG,IAAI,EAAE;AACT,GAAG;AACH,EAAE,IAAI,EAAE;AACR,GAAG,OAAO,EAAE,+BAA+B;AAC3C,GAAG,EAAE,EAAE,mDAAmD;AAC1D,GAAG,EAAE,EAAE,+CAA+C;AACtD,GAAG,EAAE,EAAE,sCAAsC;AAC7C,GAAG,IAAI,EAAE,QAAQ;AACjB,GAAG,SAAS,EAAE,QAAQ;AACtB,GAAG,SAAS,EAAE;AACd;AACA,EAAE;AACF,CAAC,eAAe,EAAE;AAClB,EAAE,OAAO,EAAE,SAAS;AACpB,EAAE,IAAI,EAAE;AACR;AACA,CAAC;AACD,SAAS,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE;AACrC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,UAAU,KAAK;AACtC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,GAAG,SAAS,EAAE,IAAI,GAAG,SAAS,EAAE,GAAG,GAAG,IAAI,EAAE,IAAI,GAAG,MAAM,EAAE,IAAI,GAAG,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,SAAS,EAAE,GAAG,OAAO;AAC5K,EAAE,IAAI,IAAI,EAAE;AACZ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,UAAU,CAAC;AAC5C,IAAI,WAAW,EAAE,QAAQ;AACzB,IAAI,KAAK,EAAEA,MAAI,CAAC,EAAE,CAAC,cAAc,CAAC;AAClC,KAAK,OAAO;AACZ,KAAK;AACL,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;AACnB,IAAI,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,IAAI;AAClC,IAAI,eAAe,EAAE,QAAQ;AAC7B,IAAI,uBAAuB,EAAE,IAAI;AACjC,IAAI,GAAG;AACP,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACT,GAAG,QAAQ,GAAG,UAAU,CAAC;AACzB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC;AACjC,EAAE,CAAC,MAAM;AACT,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,UAAU,CAAC;AAClD,IAAI,WAAW,EAAE,QAAQ;AACzB,IAAI,KAAK,EAAEA,MAAI,CAAC,EAAE,CAAC,cAAc,CAAC;AAClC,KAAK,OAAO;AACZ,KAAK;AACL,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;AACnB,IAAI,IAAI;AACR,IAAI,QAAQ;AACZ,IAAI,GAAG;AACP,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACT,GAAG,QAAQ,GAAG,UAAU,CAAC;AACzB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,CAAC;AACtC,EAAE;AACF,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;AAC7B,EAAE,UAAU,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC;AAC9B,CAAC,CAAC,CAAC;AACH;;;;"}

package/build/server/chunks/chunks/client.js-B5cNNyu2.js

@@ -0,0 +1,59 @@
+import { i as index_server_exports } from './index-server.js-B4lHrS_U.js';
+import './shared.js-BStsS1ju.js';
+import './exports.js-DurfUvtz.js';
+import './routing.js-CvcjLFt6.js';
+import { n as noop } from './server.js-eNE8c09e.js';
+import './internal2.js-BOHwnFs6.js';
+import '@sveltejs/kit/internal/server';
+import '@sveltejs/kit/internal';
+
+var is_legacy = noop.toString().includes("$$") || /function \w+\(\) \{\}/.test(noop.toString());
+var placeholder_url = "a:";
+if (is_legacy) {
+	({
+		data: {},
+		form: null,
+		error: null,
+		params: {},
+		route: { id: null },
+		state: {},
+		status: -1,
+		url: new URL(placeholder_url)
+	});
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@sveltejs+kit@2.70.3_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.3.1_svelte_9172e0e9363bf3f5d5e1b1085ec23abb/node_modules/@sveltejs/kit/src/runtime/client/client.js
+/** @import { RemoteFunctionDataNode, ServerNodesResponse, ServerRedirectNode } from 'types' */
+/** @import { CacheEntry } from './remote-functions/cache.svelte.js' */
+/** @import { Query } from './remote-functions/query/instance.svelte.js' */
+/** @import { LiveQuery } from './remote-functions/query-live/instance.svelte.js' */
+var { onMount, tick } = index_server_exports;
+/**
+* Allows you to navigate programmatically to a given route, with options such as keeping the current element focused.
+* Returns a Promise that resolves when SvelteKit navigates (or fails to navigate, in which case the promise rejects) to the specified `url`.
+*
+* For external URLs, use `window.location = url` instead of calling `goto(url)`.
+*
+* @param {string | URL} url Where to navigate to. Note that if you've set [`config.kit.paths.base`](https://svelte.dev/docs/kit/configuration#paths) and the URL is root-relative, you need to prepend the base path if you want to navigate within the app.
+* @param {Object} [opts] Options related to the navigation
+* @param {boolean} [opts.replaceState] If `true`, will replace the current `history` entry rather than creating a new one with `pushState`
+* @param {boolean} [opts.noScroll] If `true`, the browser will maintain its scroll position rather than scrolling to the top of the page after navigation
+* @param {boolean} [opts.keepFocus] If `true`, the currently focused element will retain focus after navigation. Otherwise, focus will be reset to the body
+* @param {boolean} [opts.invalidateAll] If `true`, all `load` functions of the page will be rerun. See https://svelte.dev/docs/kit/load#rerunning-load-functions for more info on invalidation.
+* @param {Array<string | URL | ((url: URL) => boolean)>} [opts.invalidate] Causes any load functions to re-run if they depend on one of the urls
+* @param {App.PageState} [opts.state] An optional object that will be available as `page.state`
+* @returns {Promise<void>}
+*/
+function goto(url, opts = {}) {
+	throw new Error("Cannot call goto(...) on the server");
+}
+/**
+* Causes all `load` and `query` functions belonging to the currently active page to re-run. Returns a `Promise` that resolves when the page is subsequently updated.
+* @returns {Promise<void>}
+*/
+function invalidateAll() {
+	throw new Error("Cannot call invalidateAll() on the server");
+}
+
+export { goto as g, invalidateAll as i };
+//# sourceMappingURL=client.js-B5cNNyu2.js.map

package/build/server/chunks/chunks/client.js-B5cNNyu2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js-B5cNNyu2.js","sources":["../../../../.svelte-kit/output/server/chunks/client.js"],"sourcesContent":["import { t as index_server_exports } from \"./index-server.js\";\nimport { x as noop } from \"./shared.js\";\nimport \"./internal.js\";\nimport \"./exports.js\";\nimport \"./routing.js\";\nimport { Ht as noop$1 } from \"./server.js\";\nimport { n as writable } from \"./shared2.js\";\nimport \"./paths.js\";\nimport \"@sveltejs/kit/internal\";\nvar PRELOAD_PRIORITIES = {\n\ttap: 1,\n\thover: 2,\n\tviewport: 3,\n\teager: 4,\n\toff: -1,\n\tfalse: -1\n};\n({ ...PRELOAD_PRIORITIES }), PRELOAD_PRIORITIES.hover;\n/** @param {any} value */\nfunction notifiable_store(value) {\n\tconst store = writable(value);\n\tlet ready = true;\n\tfunction notify() {\n\t\tready = true;\n\t\tstore.update((val) => val);\n\t}\n\t/** @param {any} new_value */\n\tfunction set(new_value) {\n\t\tready = false;\n\t\tstore.set(new_value);\n\t}\n\t/** @param {(value: any) => void} run */\n\tfunction subscribe(run) {\n\t\t/** @type {any} */\n\t\tlet old_value;\n\t\treturn store.subscribe((new_value) => {\n\t\t\tif (old_value === void 0 || ready && new_value !== old_value) run(old_value = new_value);\n\t\t});\n\t}\n\treturn {\n\t\tnotify,\n\t\tset,\n\t\tsubscribe\n\t};\n}\nvar updated_listener = { v: noop };\nfunction create_updated_store() {\n\tconst { set, subscribe } = writable(false);\n\treturn {\n\t\tsubscribe,\n\t\tcheck: async () => false\n\t};\n}\n//#endregion\n//#region ../../node_modules/.pnpm/@sveltejs+kit@2.70.3_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.3.1_svelte_9172e0e9363bf3f5d5e1b1085ec23abb/node_modules/@sveltejs/kit/src/runtime/client/state.svelte.js\nvar page;\nvar navigating;\nvar updated;\nvar is_legacy = noop$1.toString().includes(\"$$\") || /function \\w+\\(\\) \\{\\}/.test(noop$1.toString());\nvar placeholder_url = \"a:\";\nif (is_legacy) {\n\tpage = {\n\t\tdata: {},\n\t\tform: null,\n\t\terror: null,\n\t\tparams: {},\n\t\troute: { id: null },\n\t\tstate: {},\n\t\tstatus: -1,\n\t\turl: new URL(placeholder_url)\n\t};\n\tnavigating = { current: null };\n\tupdated = { current: false };\n} else {\n\tpage = new class Page {\n\t\tdata = {};\n\t\tform = null;\n\t\terror = null;\n\t\tparams = {};\n\t\troute = { id: null };\n\t\tstate = {};\n\t\tstatus = -1;\n\t\turl = new URL(placeholder_url);\n\t}();\n\tnavigating = new class Navigating {\n\t\tcurrent = null;\n\t}();\n\tupdated = new class Updated {\n\t\tcurrent = false;\n\t}();\n\tupdated_listener.v = () => updated.current = true;\n}\n//#endregion\n//#region ../../node_modules/.pnpm/@sveltejs+kit@2.70.3_@opentelemetry+api@1.9.1_@sveltejs+vite-plugin-svelte@7.3.1_svelte_9172e0e9363bf3f5d5e1b1085ec23abb/node_modules/@sveltejs/kit/src/runtime/client/client.js\n/** @import { RemoteFunctionDataNode, ServerNodesResponse, ServerRedirectNode } from 'types' */\n/** @import { CacheEntry } from './remote-functions/cache.svelte.js' */\n/** @import { Query } from './remote-functions/query/instance.svelte.js' */\n/** @import { LiveQuery } from './remote-functions/query-live/instance.svelte.js' */\nvar { onMount, tick } = index_server_exports;\nvar stores = {\n\turl: /* @__PURE__ */ notifiable_store({}),\n\tpage: /* @__PURE__ */ notifiable_store({}),\n\tnavigating: /* @__PURE__ */ writable(null),\n\tupdated: /* @__PURE__ */ create_updated_store()\n};\n/**\n* Allows you to navigate programmatically to a given route, with options such as keeping the current element focused.\n* Returns a Promise that resolves when SvelteKit navigates (or fails to navigate, in which case the promise rejects) to the specified `url`.\n*\n* For external URLs, use `window.location = url` instead of calling `goto(url)`.\n*\n* @param {string | URL} url Where to navigate to. Note that if you've set [`config.kit.paths.base`](https://svelte.dev/docs/kit/configuration#paths) and the URL is root-relative, you need to prepend the base path if you want to navigate within the app.\n* @param {Object} [opts] Options related to the navigation\n* @param {boolean} [opts.replaceState] If `true`, will replace the current `history` entry rather than creating a new one with `pushState`\n* @param {boolean} [opts.noScroll] If `true`, the browser will maintain its scroll position rather than scrolling to the top of the page after navigation\n* @param {boolean} [opts.keepFocus] If `true`, the currently focused element will retain focus after navigation. Otherwise, focus will be reset to the body\n* @param {boolean} [opts.invalidateAll] If `true`, all `load` functions of the page will be rerun. See https://svelte.dev/docs/kit/load#rerunning-load-functions for more info on invalidation.\n* @param {Array<string | URL | ((url: URL) => boolean)>} [opts.invalidate] Causes any load functions to re-run if they depend on one of the urls\n* @param {App.PageState} [opts.state] An optional object that will be available as `page.state`\n* @returns {Promise<void>}\n*/\nfunction goto(url, opts = {}) {\n\tthrow new Error(\"Cannot call goto(...) on the server\");\n}\n/**\n* Causes all `load` and `query` functions belonging to the currently active page to re-run. Returns a `Promise` that resolves when the page is subsequently updated.\n* @returns {Promise<void>}\n*/\nfunction invalidateAll() {\n\tthrow new Error(\"Cannot call invalidateAll() on the server\");\n}\n//#endregion\nexport { page as a, navigating as i, invalidateAll as n, stores as r, goto as t };\n"],"names":["noop$1"],"mappings":";;;;;;;;;AA0DA,IAAI,SAAS,GAAGA,IAAM,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAACA,IAAM,CAAC,QAAQ,EAAE,CAAC;AACnG,IAAI,eAAe,GAAG,IAAI;AAC1B,IAAI,SAAS,EAAE;AACf,EAAQ;AACR,EAAE,IAAI,EAAE,EAAE;AACV,EAAE,IAAI,EAAE,IAAI;AACZ,EAAE,KAAK,EAAE,IAAI;AACb,EAAE,MAAM,EAAE,EAAE;AACZ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;AACrB,EAAE,KAAK,EAAE,EAAE;AACX,EAAE,MAAM,EAAE,EAAE;AACZ,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,eAAe;AAC9B,GAAE;AAGF;AAmBA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,oBAAoB;AAO5C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,IAAI,CAAC,GAAG,EAAE,IAAI,GAAG,EAAE,EAAE;AAC9B,CAAC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC;AACvD;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,GAAG;AACzB,CAAC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC;AAC7D;;;;"}

package/build/server/chunks/chunks/compute.js-Bb_Yprms.js

@@ -0,0 +1,506 @@
+import './src.js-CkFJvvTE.js';
+import { d as apiError, A as ApiErrorCode, C as ComputeServerUnconfiguredError, N as NoopLogger } from './access.js-BataxwA1.js';
+import { lookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
+
+//#region ../platform/src/computeServer/types.ts
+function isPlatformServer(s) {
+	return s.scope === "platform";
+}
+function isOrgServer(s) {
+	return s.scope === "org";
+}
+//#endregion
+//#region ../platform/src/computeServer/utils.ts
+/**
+* Servers an org can see in pickers and use for solves:
+* platform servers shared with this org (or `'all'`, or the global default)
+* ∪ org-private servers owned by this org.
+*/
+function serversVisibleTo(config, orgId) {
+	return config.servers.filter((s) => {
+		if (isPlatformServer(s)) {
+			if (s.id === config.defaultServerId) return true;
+			if (s.sharedWith === "all") return true;
+			if (orgId && s.sharedWith.includes(orgId)) return true;
+			return false;
+		}
+		return !!orgId && s.ownerOrgId === orgId;
+	});
+}
+/**
+* Resolves the default server id for an org: per-org override, then global
+* default. Returns `undefined` if neither is set or visible.
+*/
+function defaultServerIdFor(config, orgId) {
+	const visible = serversVisibleTo(config, orgId);
+	const visibleIds = new Set(visible.map((s) => s.id));
+	if (orgId) {
+		const orgChoice = config.orgDefaults?.[orgId];
+		if (orgChoice && visibleIds.has(orgChoice)) return orgChoice;
+	}
+	if (config.defaultServerId && visibleIds.has(config.defaultServerId)) return config.defaultServerId;
+}
+function resolveServerForOrg$1(config, orgId, opts = {}) {
+	const visible = serversVisibleTo(config, orgId);
+	if (visible.length === 0) throw new Error("No compute servers are configured or visible for this org.");
+	if (opts.definitionPin) {
+		const pinned = visible.find((s) => s.id === opts.definitionPin);
+		if (pinned) return pinned;
+	}
+	const defaultId = defaultServerIdFor(config, orgId);
+	if (defaultId) {
+		const found = visible.find((s) => s.id === defaultId);
+		if (found) return found;
+	}
+	return visible[0];
+}
+/**
+* The config as one org may see it: visible servers only, `orgDefaults` reduced
+* to this org's own entry, and `defaultServerId` dropped when the global default
+* is not visible here.
+*
+* Applied inside `getConfig` when `scopeToOrgId` is passed, so an org-facing
+* caller cannot forget the filter and leak other orgs' server URLs or the
+* instance's default choice.
+*/
+function scopeConfigToOrg(config, orgId) {
+	const servers = serversVisibleTo(config, orgId);
+	const visibleIds = new Set(servers.map((s) => s.id));
+	const orgDefault = config.orgDefaults?.[orgId];
+	return {
+		servers,
+		defaultServerId: config.defaultServerId && visibleIds.has(config.defaultServerId) ? config.defaultServerId : void 0,
+		orgDefaults: orgDefault ? { [orgId]: orgDefault } : {}
+	};
+}
+/** Lookup by id, ignoring scope or visibility — for admin contexts that display a server outside the visibility filter. */
+function findServerById(config, id) {
+	return config.servers.find((s) => s.id === id);
+}
+function platformServers(config) {
+	return config.servers.filter(isPlatformServer);
+}
+//#endregion
+//#region ../server/src/compute/safe-url.ts
+/**
+* SSRF guard for the remote-definition fetch. Without it an authenticated user
+* could submit `http://169.254.169.254/...` (cloud metadata) or any intranet
+* endpoint and the server would fetch it on their behalf.
+*
+* Two layers:
+*
+*   1. `isSafeRemoteDefinitionUrl` — synchronous, DNS-free literal filter.
+*      Rejects the protocol, hostname literals, and every IP *encoding* that
+*      maps to a blocked address: dotted-decimal, integer, octal, hex,
+*      short-form, IPv4-mapped IPv6.
+*   2. `assertSafeRemoteDefinitionUrl` — resolves the hostname and re-checks the
+*      *resolved* IP, catching a public name that points at a private one.
+*
+* Neither is bulletproof against DNS rebinding — the IP can change between our
+* lookup and fetch's own. Closing that needs the caller to connect to the
+* resolved IP directly, a much larger change; these two layers close the
+* bypasses an attacker actually reaches for (literal encodings, and a public
+* name whose record points inward).
+*/
+/**
+* True when `ip` (a normalized IPv4 or IPv6 literal from `isIP`/`dns.lookup`)
+* is loopback, private, link-local, or otherwise must-not-fetch. IPv4-mapped
+* IPv6 (`::ffff:a.b.c.d`) is unwrapped first so the v4 rules apply.
+*/
+function isBlockedIp(ip) {
+	let addr = ip.toLowerCase();
+	const mappedDotted = /^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/.exec(addr);
+	if (mappedDotted) addr = mappedDotted[1];
+	else {
+		const mappedHex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(addr);
+		if (mappedHex) {
+			const hi = parseInt(mappedHex[1], 16);
+			const lo = parseInt(mappedHex[2], 16);
+			addr = [
+				hi >> 8 & 255,
+				hi & 255,
+				lo >> 8 & 255,
+				lo & 255
+			].join(".");
+		}
+	}
+	if (isIP(addr) === 4) {
+		const octets = addr.split(".").map(Number);
+		if (octets.length !== 4 || octets.some((o) => o > 255)) return true;
+		const [a, b] = octets;
+		if (a === 0) return true;
+		if (a === 127) return true;
+		if (a === 10) return true;
+		if (a === 192 && b === 168) return true;
+		if (a === 172 && b >= 16 && b <= 31) return true;
+		if (a === 169 && b === 254) return true;
+		return false;
+	}
+	if (addr === "::1" || addr === "::") return true;
+	if (/^(fc|fd)[0-9a-f]{0,2}:/.test(addr)) return true;
+	if (/^fe[89ab][0-9a-f]:/.test(addr)) return true;
+	return false;
+}
+/**
+* Parse a bare-IPv4 hostname in any encoding browsers/glibc accept — integer
+* (`2130706433`), octal (`0177.0.0.1`), hex (`0x7f000001`), and short forms
+* (`127.1`) — into canonical dotted-decimal. An already-valid dotted-quad comes
+* back unchanged. Returns null only when the host is not a numeric IPv4 literal
+* at all, i.e. it's a real name — which is what callers use to decide whether
+* DNS resolution is needed.
+*/
+function canonicalizeNumericIpv4(host) {
+	if (isIP(host) === 4) return host;
+	const rawParts = host.split(".");
+	if (rawParts.length === 0 || rawParts.length > 4) return null;
+	const parseUInt = (s) => {
+		if (s === "") return null;
+		let n;
+		if (/^0x[0-9a-f]+$/i.test(s)) n = parseInt(s, 16);
+		else if (/^0[0-7]+$/.test(s)) n = parseInt(s, 8);
+		else if (/^[0-9]+$/.test(s)) n = parseInt(s, 10);
+		else return null;
+		return Number.isFinite(n) ? n : null;
+	};
+	const nums = rawParts.map(parseUInt);
+	if (nums.some((n) => n === null)) return null;
+	const parts = nums;
+	let value;
+	switch (parts.length) {
+		case 1:
+			value = parts[0];
+			break;
+		case 2:
+			if (parts[0] > 255 || parts[1] > 16777215) return null;
+			value = parts[0] << 24 | parts[1];
+			break;
+		case 3:
+			if (parts[0] > 255 || parts[1] > 255 || parts[2] > 65535) return null;
+			value = parts[0] << 24 | parts[1] << 16 | parts[2];
+			break;
+		default:
+			if (parts.some((p) => p > 255)) return null;
+			value = parts[0] << 24 | parts[1] << 16 | parts[2] << 8 | parts[3];
+	}
+	value = value >>> 0;
+	if (value > 4294967295) return null;
+	return [
+		value >>> 24 & 255,
+		value >>> 16 & 255,
+		value >>> 8 & 255,
+		value & 255
+	].join(".");
+}
+/**
+* Synchronous literal pre-filter: rejects bad schemes, loopback hostnames, and
+* any IP literal (in any encoding) that maps to a blocked address. Does NOT
+* perform DNS — a public *name* that points at a private IP passes here and is
+* caught only by `assertSafeRemoteDefinitionUrl`.
+*/
+function isSafeRemoteDefinitionUrl(raw) {
+	let parsed;
+	try {
+		parsed = new URL(raw);
+	} catch {
+		return false;
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return false;
+	let host = parsed.hostname.toLowerCase();
+	if (!host) return false;
+	if (host === "localhost" || host.endsWith(".localhost")) return false;
+	if (host.startsWith("[") && host.endsWith("]")) host = host.slice(1, -1);
+	if (isIP(host) === 6) return !isBlockedIp(host);
+	const canonical = canonicalizeNumericIpv4(host);
+	if (canonical) return !isBlockedIp(canonical);
+	return true;
+}
+/**
+* True when `raw` targets the link-local range (`169.254.0.0/16`), which
+* carries the cloud metadata service at `169.254.169.254` — the endpoint that
+* hands out a host's own IAM credentials to anything on the box.
+*
+* A far narrower judgement than {@link isSafeRemoteDefinitionUrl}, for the one
+* caller that must tolerate private addresses: an operator's own compute server
+* legitimately lives on `localhost` or a LAN, so blocking RFC1918 there would
+* reject the ordinary self-hosted layout. Nothing legitimate is ever reached
+* over link-local, so this stays blocked with no opt-out.
+*
+* Shares `canonicalizeNumericIpv4`, so the encodings that bypass a naive string
+* comparison — `http://2852039166/`, `http://0251.0376.0251.0376/`,
+* `http://0xa9fea9fe/` — all resolve to the same verdict.
+*/
+function isLinkLocalUrl(raw) {
+	let host;
+	try {
+		host = new URL(raw).hostname.toLowerCase();
+	} catch {
+		return false;
+	}
+	if (!host) return false;
+	if (host.startsWith("[") && host.endsWith("]")) host = host.slice(1, -1);
+	if (isIP(host) === 6) return /^fe[89ab][0-9a-f]:/.test(host);
+	const canonical = canonicalizeNumericIpv4(host);
+	if (!canonical) return false;
+	const [a, b] = canonical.split(".").map(Number);
+	return a === 169 && b === 254;
+}
+/**
+* Full SSRF check: literal pre-filter, then resolve every A/AAAA record and
+* reject if *any* resolved IP is blocked. Returns the original URL on success
+* so callers can `await assertSafeRemoteDefinitionUrl(url)` inline.
+*
+* Every rejection throws the same generic message so the caller gets no oracle;
+* which host was blocked and by which layer is logged server-side instead.
+*/
+async function assertSafeRemoteDefinitionUrl(raw, logger = new NoopLogger()) {
+	if (!isSafeRemoteDefinitionUrl(raw)) {
+		logger.warn("Blocked remote definition URL", {
+			component: "Compute/ssrf",
+			reason: "literal-filter",
+			host: hostOf(raw)
+		});
+		throw new Error("Remote definition URL is not allowed");
+	}
+	const host = new URL(raw).hostname.toLowerCase().replace(/^\[|\]$/g, "");
+	if (isIP(host) !== 0 || canonicalizeNumericIpv4(host)) return raw;
+	let resolved;
+	try {
+		resolved = await lookup(host, { all: true });
+	} catch {
+		logger.warn("Blocked remote definition URL", {
+			component: "Compute/ssrf",
+			reason: "dns-lookup-failed",
+			host
+		});
+		throw new Error("Remote definition URL is not allowed");
+	}
+	if (resolved.length === 0 || resolved.some((r) => isBlockedIp(r.address))) {
+		const blocked = resolved.filter((r) => isBlockedIp(r.address)).map((r) => r.address);
+		logger.warn("Blocked remote definition URL", {
+			component: "Compute/ssrf",
+			reason: "resolves-to-blocked-ip",
+			host,
+			blockedIps: blocked
+		});
+		throw new Error("Remote definition URL is not allowed");
+	}
+	return raw;
+}
+/** Best-effort hostname for logging; falls back to a truncated raw string. */
+function hostOf(raw) {
+	try {
+		return new URL(raw).hostname;
+	} catch {
+		return raw.slice(0, 120);
+	}
+}
+//#endregion
+//#region ../server/src/compute/remote-definition.ts
+/**
+* Remote-definition fetch: SSRF-guarded, size-capped, timed, and TTL-cached.
+*
+* A solve can reference its `.gh` by remote URL instead of a stored blob, and
+* that URL is attacker-controllable — a share-token caller supplies
+* `definitionUrl`. Hence {@link assertSafeRemoteDefinitionUrl}, the early size
+* cap, and the deadline.
+*/
+/** Once the cache exceeds this many entries, evict the oldest 10 by `fetchedAt`. */
+var CACHE_MAX_ENTRIES = 50;
+var CACHE_EVICT_BATCH = 10;
+/**
+* Read a response body into memory, aborting (and throwing) as soon as the
+* running byte total exceeds `maxBytes`. Falls back to `arrayBuffer()` only when
+* the body isn't a readable stream (older fetch impls).
+*/
+async function readBodyWithCap(response, maxBytes, controller) {
+	if (!response.body) {
+		const buffer = await response.arrayBuffer();
+		if (buffer.byteLength > maxBytes) throw new Error("Remote definition exceeds size limit");
+		return new Uint8Array(buffer);
+	}
+	const reader = response.body.getReader();
+	const chunks = [];
+	let total = 0;
+	while (true) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		total += value.byteLength;
+		if (total > maxBytes) {
+			controller.abort();
+			throw new Error("Remote definition exceeds size limit");
+		}
+		chunks.push(value);
+	}
+	const out = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		out.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return out;
+}
+/**
+* Build a remote-definition fetcher owning its own TTL cache. Each fetcher's
+* cache is independent, so one per process shares warm bytes while test fetchers
+* stay isolated.
+*/
+function createRemoteDefinitionFetcher(config) {
+	const cache = /* @__PURE__ */ new Map();
+	const logger = config.logger ?? new NoopLogger();
+	return { async load(url) {
+		await assertSafeRemoteDefinitionUrl(url, logger);
+		const now = config.now();
+		const cached = cache.get(url);
+		if (cached && now - cached.fetchedAt < config.cacheTtlMs) return cached.data;
+		const controller = new AbortController();
+		const timeout = setTimeout(() => controller.abort(), config.fetchTimeoutMs);
+		let data;
+		try {
+			const response = await fetch(url, {
+				signal: controller.signal,
+				redirect: "error"
+			});
+			if (!response.ok) throw new Error(`HTTP ${response.status}: ${response.statusText}`);
+			const declared = Number(response.headers.get("content-length"));
+			if (Number.isFinite(declared) && declared > config.maxBytes) throw new Error("Remote definition exceeds size limit");
+			data = await readBodyWithCap(response, config.maxBytes, controller);
+		} finally {
+			clearTimeout(timeout);
+		}
+		cache.set(url, {
+			data,
+			fetchedAt: now
+		});
+		if (cache.size > CACHE_MAX_ENTRIES) {
+			const entries = Array.from(cache.entries());
+			entries.sort((a, b) => a[1].fetchedAt - b[1].fetchedAt);
+			for (let i = 0; i < CACHE_EVICT_BATCH; i++) cache.delete(entries[i][0]);
+		}
+		return data;
+	} };
+}
+//#endregion
+//#region ../server/src/compute/resolve-server.ts
+/**
+* Pick the right Rhino.Compute server for an (org, definition) pair.
+*
+* Resolution order, narrowest wins:
+*   1. `definitionPin` if it points at a server visible to `orgId`.
+*   2. `orgDefaults[orgId]` if set and visible.
+*   3. Global `defaultServerId`.
+*
+* The store returns the full config; the visibility predicate runs in the pure
+* helper so callers don't reimplement it. Re-throws the pure helper's "nothing
+* visible" failure as a typed `ComputeServerUnconfiguredError`.
+*
+* Reads a key-free config and fetches the `apiKey` only for the server that
+* actually wins, instead of decrypting every configured server's key to use
+* exactly one of them.
+*/
+async function resolveServerForOrg(ctx, orgId, store, opts = {}) {
+	const config = await store.getConfig(ctx);
+	let server;
+	try {
+		server = resolveServerForOrg$1(config, orgId, { definitionPin: opts.definitionPin });
+	} catch (err) {
+		throw new ComputeServerUnconfiguredError(err instanceof Error ? err.message : void 0);
+	}
+	if (!server.hasApiKey) return server;
+	return {
+		...server,
+		apiKey: await store.getServerApiKey(ctx, server.id)
+	};
+}
+//#endregion
+//#region ../server/src/compute/server-config-write.ts
+/**
+* Shared write-path rules for compute server config.
+*
+* Two routes accept a server set: `/api/admin/compute` (platform scope,
+* `manage_compute`) and `/api/v1/orgs/{orgId}/compute` (org scope,
+* `manage_org_compute`). They differ in who may call them, what extra fields
+* they carry (`sharedWith` vs `ownerOrgId`), and how they validate the default
+* selection — but the field validation and the apiKey merge below must behave
+* identically in both, so they live here rather than in either handler.
+*
+* The apiKey merge is why this file exists: if the two copies disagree, a
+* stored credential silently gets cleared or leaked, and nothing fails at
+* build time.
+*/
+/**
+* A stored `serverUrl` is fetched server-side on every status probe, every
+* purge/shutdown action, and every solve, so an unfiltered one is an SSRF
+* primitive handed to whoever holds `manage_compute`. Two rules:
+*
+*   - Scheme allowlist: `http`/`https`. `file:`, `gopher:` and friends are never
+*     a Rhino.Compute endpoint.
+*   - Link-local (`169.254.0.0/16`) is refused. That range carries the cloud
+*     metadata service at `169.254.169.254`, which hands out the host's own IAM
+*     credentials to anything running on the box.
+*
+* **Loopback and RFC1918 are deliberately allowed.** Running compute on
+* `localhost:6500` or a LAN box is the ordinary self-hosted layout, not an
+* attack — most deployments reach their compute server over exactly those
+* addresses. Blocking them by default would break those instances on upgrade
+* and push every operator toward an opt-out flag, and a guard that everyone
+* disables protects nobody. So the check is narrowed to the range where no
+* legitimate compute server ever lives.
+*
+* What this does not stop: a privileged admin pointing the app at an internal
+* host to probe it. That is a real but much weaker concern than credential
+* theft, it needs `manage_compute` already, and it is inseparable from the
+* legitimate case. Revisit if `manage_org_compute` is ever delegated widely on
+* a multi-tenant instance.
+*
+* `isLinkLocalUrl` is reused rather than hand-rolled because a string compare
+* against `169.254.169.254` misses the encodings that reach the same address:
+* `http://2852039166/`, `http://0xa9fea9fe/`, `http://0251.0376.0251.0376/`.
+*/
+function assertUsableServerUrl(serverUrl) {
+	let parsed;
+	try {
+		parsed = new URL(serverUrl);
+	} catch {
+		apiError(400, ApiErrorCode.VALIDATION_FAILED, `Invalid serverUrl: ${serverUrl}`);
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") apiError(400, ApiErrorCode.VALIDATION_FAILED, `serverUrl must use http or https: ${serverUrl}`);
+	if (isLinkLocalUrl(serverUrl)) apiError(400, ApiErrorCode.VALIDATION_FAILED, `serverUrl points at the link-local range, which carries the cloud metadata service: ${serverUrl}`);
+}
+/**
+* Validates the scope-independent fields of every submitted server. Throws the
+* first failure as a 400; scope-specific fields (`sharedWith`, `ownerOrgId`)
+* are the caller's business.
+*/
+function validateIncomingServers(servers) {
+	for (const s of servers) {
+		if (!s.id || typeof s.id !== "string") apiError(400, ApiErrorCode.VALIDATION_FAILED, "Each server needs an id");
+		if (!s.label || typeof s.label !== "string") apiError(400, ApiErrorCode.VALIDATION_FAILED, "Each server needs a label");
+		if (!s.serverUrl || typeof s.serverUrl !== "string") apiError(400, ApiErrorCode.VALIDATION_FAILED, "Each server needs a serverUrl");
+		assertUsableServerUrl(s.serverUrl);
+		if (s.apiKey !== void 0 && s.apiKey !== null && typeof s.apiKey !== "string") apiError(400, ApiErrorCode.VALIDATION_FAILED, "apiKey must be a string, null, or omitted");
+	}
+}
+/**
+* The UI never receives stored keys — it sends back `hasApiKey` and omits the
+* field for servers the operator didn't touch. So "omitted" cannot mean "clear":
+* it has to preserve, or every save through the settings form would wipe the
+* keys of every server the operator left alone. Clearing is explicit (`null`);
+* an empty string is treated as "not provided" since that's what an untouched
+* password input submits.
+*/
+function resolveApiKey(submitted, storedKey) {
+	if (submitted === null) return void 0;
+	return submitted ? submitted : storedKey;
+}
+/**
+* Builds the id → stored-key lookup the merge reads. The caller passes only the
+* servers in its own scope, so one scope's write can never resolve a key from
+* another's rows.
+*/
+function storedKeysById(scopedServers) {
+	return new Map(scopedServers.map((s) => [s.id, s.apiKey]));
+}
+
+export { isOrgServer as a, assertSafeRemoteDefinitionUrl as b, resolveServerForOrg as c, storedKeysById as d, resolveApiKey as e, serversVisibleTo as f, defaultServerIdFor as g, findServerById as h, isPlatformServer as i, createRemoteDefinitionFetcher as j, platformServers as p, readBodyWithCap as r, scopeConfigToOrg as s, validateIncomingServers as v };
+//# sourceMappingURL=compute.js-Bb_Yprms.js.map