@selvajs/selva 4.7.0-beta.2 → 4.7.0-beta.4

package/build/server/chunks/chunks/compute.js-DGTy3YjO.js

@@ -0,0 +1,747 @@
+import './src.js-BeFXhqDJ.js';
+import { N as NoopLogger } from './limits.js-DfZnOKg5.js';
+import { p, l } from './chunk-Y3M7P3BW.js-qwxSY5dh.js';
+import { B, k as ke, $ } from './chunk-6TMSTNHN.js-3Bz2KNTb.js';
+import { createHash } from 'node:crypto';
+import { gzip, gunzipSync } from 'node:zlib';
+import { promisify } from 'node:util';
+import { lookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
+
+//#region ../server/src/compute/transform-input.ts
+/**
+* Adapt a persisted `SchemaInput` (plus the user's chosen value) into the package's
+* raw `InputParamSchema`, then let `@selvajs/compute`'s own `processInput` produce the
+* typed `InputParam`. The package handles every paramType (Number/Integer/Text/Boolean/
+* ValueList/Geometry/File/Color), normalizes the lowercase UI paramType to its
+* PascalCase form, and falls back gracefully on underspecified inputs — so we no longer
+* maintain a parallel hand-rolled transform that silently coerced valueList/file/color
+* to Text and drifted from the package (whose consumers already delegate here).
+* `values`/`acceptedFormats` are absent on `SchemaInput` (they live on the layout
+* item's config), so valueList/file inputs fall back to carrying the selected value with
+* no option list — the same value that reaches Grasshopper.
+*/
+function transformInputParameter(input, value) {
+	const processed = ke({
+		id: input.id,
+		name: input.nickname,
+		nickname: input.nickname || null,
+		description: input.description || "",
+		paramType: input.paramType === "dynamicValueList" ? "valueList" : input.paramType,
+		treeAccess: input.inputStructure === "tree",
+		minimum: input.minimum ?? null,
+		maximum: input.maximum ?? null,
+		atLeast: 1,
+		atMost: 1,
+		stepSize: input.stepSize,
+		default: value ?? input.default
+	});
+	const effective = value ?? input.default;
+	if (processed.default == null && effective != null) {
+		if (Array.isArray(effective)) processed.default = effective;
+		else if (processed.paramType === "ValueList" && typeof effective !== "object") processed.default = effective;
+	}
+	return processed;
+}
+//#endregion
+//#region ../server/src/compute/solve-cache-envelope.ts
+/**
+* L2 cache entry format (R6). An entry is the gzipped response body plus a tiny
+* metadata header, so a hit is near-CPU-free: no `JSON.stringify`, no re-solve —
+* gzip clients get the stored bytes verbatim, and the header carries just enough
+* to rebuild the `ok` outcome (error/warning counts for the metric, uncompressed
+* length for the `Content-Length` on a gunzip fallback).
+*
+* Wire layout (opaque to the `ISolveResultCache` backend, which sees only bytes):
+*
+*   [ 4 bytes: header length N, big-endian uint32 ]
+*   [ N bytes: UTF-8 JSON EnvelopeHeader ]
+*   [ rest:    gzipped JSON response body ]
+*
+* The `algo` echo (M3) is already stripped at the source in the package's
+* `runSolve`, so the body never carries the base64 definition — entries stay
+* small without a strip step here.
+*/
+/**
+* Encode a cache entry from the gzipped body + header. The body MUST already be
+* gzipped (the pipeline gzips before storing so every hit serves compressed
+* bytes; a rare non-gzip client gunzips on read).
+*/
+function encodeSolveCacheEntry(header, gzippedBody) {
+	const headerJson = Buffer.from(JSON.stringify(header), "utf8");
+	const out = Buffer.allocUnsafe(4 + headerJson.byteLength + gzippedBody.byteLength);
+	out.writeUInt32BE(headerJson.byteLength, 0);
+	headerJson.copy(out, 4);
+	Buffer.from(gzippedBody.buffer, gzippedBody.byteOffset, gzippedBody.byteLength).copy(out, 4 + headerJson.byteLength);
+	return out;
+}
+/**
+* Decode a cache entry. Returns `null` on any malformed input (truncated, bad
+* length prefix, non-JSON header) — a corrupt entry is treated as a miss, never
+* an error, matching the best-effort cache contract.
+*/
+function decodeSolveCacheEntry(bytes) {
+	if (bytes.byteLength < 4) return null;
+	const buf = Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+	const headerEnd = 4 + buf.readUInt32BE(0);
+	if (headerEnd > buf.byteLength) return null;
+	let header;
+	try {
+		header = JSON.parse(buf.toString("utf8", 4, headerEnd));
+	} catch {
+		return null;
+	}
+	if (typeof header?.errorCount !== "number" || typeof header?.warningCount !== "number" || typeof header?.serializedBytes !== "number" || typeof header?.inputHash !== "string") return null;
+	const gzippedBody = new Uint8Array(bytes.buffer, bytes.byteOffset + headerEnd, bytes.byteLength - headerEnd);
+	return {
+		header,
+		gzippedBody
+	};
+}
+/** Gunzip a stored body back to the JSON string, for a non-gzip client (rare). */
+function gunzipEntryBody(gzippedBody) {
+	return gunzipSync(gzippedBody).toString("utf8");
+}
+//#endregion
+//#region ../server/src/compute/solve-pipeline.ts
+/**
+* Transport-agnostic solve pipeline — the callable core lifted out of the app's
+* `/api/compute` route (embeddable-server-layer plan, K3).
+*
+* Given an already-resolved solve context — the `.gh` bytes, the input params +
+* user values, and a warm `SolveScheduler` (from `createClientCache`) — this
+* runs the framework-free half of a solve:
+*
+*   input tree build → scheduler.solve (with abort/timeout classification) →
+*   JSON serialize (size-guarded) → optional gzip → Server-Timing envelope.
+*
+* It returns a discriminated {@link SolveOutcome}: `ok` carries the ready-to-send
+* {@link SolveEnvelope} (body + headers + phase metrics), while the error
+* variants (`timeout`, `client_abort`, `too_large`, `compute_error`) name a
+* failure the transport maps to its own status code. Nothing here throws for an
+* expected failure and nothing here touches auth, the database, share tokens,
+* rate limits, or metric sinks — those stay app policy in the route.
+*
+* The Server-Timing string it emits IS the versioned wire contract (audit D5):
+* see {@link COMPUTE_CONTRACT_VERSION} and {@link COMPUTE_VERSION_HEADER}.
+*/
+/** Async gzip (audit B8) — off the event loop, unlike the old `gzipSync`. */
+var gzipAsync = promisify(gzip);
+/** Response header carrying {@link COMPUTE_CONTRACT_VERSION}. */
+var COMPUTE_VERSION_HEADER = "X-Selva-Compute-Version";
+/**
+* Run the framework-free half of a solve and produce a typed outcome. See the
+* module doc for the phase sequence and the app/library boundary.
+*/
+async function runSolvePipeline(args) {
+	const { client, signal } = args;
+	const treeBuildStart = performance.now();
+	const inputTree = B.fromInputParams(args.inputs.filter((input) => input.paramType).map((input) => transformInputParameter(input, args.values[input.id])));
+	const treeBuildMs = performance.now() - treeBuildStart;
+	let inputKey = null;
+	if (args.solveCache) {
+		inputKey = deriveSolveCacheInputKey(inputTree, args.solveCache.configSubset).hash;
+		let stored = null;
+		try {
+			stored = await args.solveCache.lookup(inputKey);
+		} catch {
+			stored = null;
+		}
+		if (stored) {
+			const hit = buildEnvelopeFromCacheEntry(stored, inputKey, args);
+			if (hit) return hit;
+			(args.logger ?? new NoopLogger()).warn("Discarding corrupt or hash-mismatched L2 cache entry, solving fresh", {
+				component: "Compute/l2-cache",
+				inputKeyPrefix: inputKey.slice(0, 16)
+			});
+		}
+	}
+	const settleSeqBefore = client.solveMeta.seq;
+	const rhinoSeqBefore = client.rhinoTiming.seq;
+	let result;
+	const solveStart = performance.now();
+	try {
+		result = await client.scheduler.solve(args.definitionSource, inputTree, { signal });
+	} catch (err) {
+		const durationMs = performance.now() - solveStart;
+		if (err instanceof Error && err.name === "AbortError") {
+			if (signal.aborted) return {
+				kind: "client_abort",
+				durationMs
+			};
+			return {
+				kind: "timeout",
+				durationMs,
+				message: `Solve exceeded the ${Math.round(args.maxSolveDurationMs / 1e3)}s deadline.`
+			};
+		}
+		if (err instanceof p) {
+			if (err.code === l.QUEUE_FULL) return {
+				kind: "shed",
+				durationMs,
+				reason: "queue_full",
+				retryAfterSeconds: 1,
+				message: "Compute server is at capacity. Retry shortly."
+			};
+			if (err.code === l.QUEUE_TIMEOUT) return {
+				kind: "shed",
+				durationMs,
+				reason: "queue_timeout",
+				retryAfterSeconds: 1,
+				message: "Compute request waited too long in the queue. Retry shortly."
+			};
+		}
+		return {
+			kind: "compute_error",
+			durationMs,
+			error: err
+		};
+	}
+	const solveMs = performance.now() - solveStart;
+	const serializeStart = performance.now();
+	let serialized;
+	try {
+		serialized = JSON.stringify(result);
+	} catch (err) {
+		if (err instanceof RangeError) return { kind: "too_large" };
+		throw err;
+	}
+	if (serialized.length > args.responseMaxBytes) return { kind: "too_large" };
+	const serializeMs = performance.now() - serializeStart;
+	const worthSendingGzip = /\bgzip\b/i.test(args.acceptEncoding) && serialized.length > 1024;
+	const willCache = args.solveCache != null;
+	let compressed = null;
+	let gzipMs = 0;
+	if (worthSendingGzip || willCache) {
+		const gzipStart = performance.now();
+		compressed = await gzipAsync(Buffer.from(serialized));
+		gzipMs = performance.now() - gzipStart;
+	}
+	if (args.solveCache && inputKey && compressed) {
+		const entry = encodeSolveCacheEntry({
+			errorCount: result.errors?.length ?? 0,
+			warningCount: result.warnings?.length ?? 0,
+			serializedBytes: serialized.length,
+			inputHash: inputKey
+		}, new Uint8Array(compressed));
+		args.solveCache.store(inputKey, entry);
+	}
+	const serverTotalMs = performance.now() - args.loadStartMs;
+	const settle = client.solveMeta.seq === settleSeqBefore + 1 ? client.solveMeta.last : null;
+	const rhino = settle && !settle.fromCache && client.rhinoTiming.seq === rhinoSeqBefore + 1 ? client.rhinoTiming.last : null;
+	const sendCompressed = compressed && worthSendingGzip ? compressed : null;
+	const headers = {
+		"Content-Type": "application/json",
+		"Server-Timing": buildServerTiming({
+			defLoadMs: args.defLoadMs,
+			treeBuildMs,
+			solveMs,
+			serializeMs,
+			gzipMs,
+			serverTotalMs,
+			rhino,
+			settle,
+			byteRefOutcome: args.byteRefOutcome,
+			l2CacheHit: args.solveCache ? false : null,
+			prepMarks: args.prepMarks ?? []
+		}),
+		[COMPUTE_VERSION_HEADER]: String(1),
+		Vary: "Accept-Encoding"
+	};
+	const metrics = {
+		treeBuildMs,
+		solveMs,
+		serializeMs,
+		gzipMs,
+		serverTotalMs,
+		serializedBytes: serialized.length,
+		compressedBytes: sendCompressed?.byteLength ?? null,
+		l2CacheHit: args.solveCache ? false : null
+	};
+	let envelope;
+	if (sendCompressed) {
+		headers["Content-Encoding"] = "gzip";
+		headers["Content-Length"] = String(sendCompressed.byteLength);
+		envelope = {
+			body: new Uint8Array(sendCompressed),
+			encoding: "gzip",
+			headers,
+			result,
+			metrics
+		};
+	} else {
+		headers["Content-Length"] = String(Buffer.byteLength(serialized));
+		envelope = {
+			body: serialized,
+			headers,
+			result,
+			metrics
+		};
+	}
+	return {
+		kind: "ok",
+		envelope,
+		solveMs,
+		errorCount: result.errors?.length ?? 0,
+		warningCount: result.warnings?.length ?? 0
+	};
+}
+/**
+* Re-key a coalesced envelope to a single waiter's `Accept-Encoding` (audit C5).
+*
+* The single-flight coalescer (R4) runs ONE pipeline execution for N identical
+* concurrent solves and hands every waiter the same {@link SolveEnvelope}. That
+* envelope's wire form — gzip body + `Content-Encoding: gzip`, or the plain JSON
+* string — is baked from the FIRST caller's `Accept-Encoding`. A later waiter
+* with a different `Accept-Encoding` would otherwise receive a body labelled with
+* the wrong encoding: a non-gzip client joining a gzip flight gets gzip bytes it
+* cannot decode (`Vary` can't help — this is one object shared across waiters,
+* not a cache lookup). Encoding is not in the coalesce key by design, so mixed
+* clients still coalesce; this adapts the shared result to each waiter instead.
+*
+* Returns the body + headers to send THIS waiter. Only the correctness-critical
+* direction is adapted — a gzip envelope served to a non-gzip waiter is gunzipped
+* back to JSON. The reverse (a plain-JSON envelope to a gzip-capable waiter) is
+* left uncompressed: gzip is an optimisation the client advertises, never a
+* requirement, so sending it plain is correct, just not maximally small. The
+* common all-gzip case returns the envelope's own body/headers untouched.
+*/
+function adaptEnvelopeToEncoding(envelope, acceptEncoding) {
+	const waiterWantsGzip = /\bgzip\b/i.test(acceptEncoding);
+	if (envelope.encoding === "gzip" && !waiterWantsGzip) {
+		const json = gunzipSync(envelope.body instanceof Uint8Array ? envelope.body : Buffer.from(envelope.body)).toString("utf8");
+		const headers = { ...envelope.headers };
+		delete headers["Content-Encoding"];
+		headers["Content-Length"] = String(Buffer.byteLength(json));
+		return {
+			body: json,
+			headers
+		};
+	}
+	return {
+		body: envelope.body,
+		headers: envelope.headers
+	};
+}
+/**
+* Build the `ok` outcome from a stored L2 entry — the near-CPU-free hit path (no
+* solve, no `JSON.stringify`, no gzip). Returns `null` when the entry is corrupt
+* or its stored `inputHash` doesn't match the requesting key (defense-in-depth
+* against a wide-hash collision), so the caller falls through and solves.
+*/
+function buildEnvelopeFromCacheEntry(entryBytes, inputKey, args) {
+	const decoded = decodeSolveCacheEntry(entryBytes);
+	if (!decoded || decoded.header.inputHash !== inputKey) return null;
+	const { header, gzippedBody } = decoded;
+	const clientWantsGzip = /\bgzip\b/i.test(args.acceptEncoding);
+	const serverTotalMs = performance.now() - args.loadStartMs;
+	const headers = {
+		"Content-Type": "application/json",
+		"Server-Timing": buildServerTiming({
+			defLoadMs: args.defLoadMs,
+			treeBuildMs: 0,
+			solveMs: 0,
+			serializeMs: 0,
+			gzipMs: 0,
+			serverTotalMs,
+			rhino: null,
+			settle: null,
+			byteRefOutcome: args.byteRefOutcome,
+			l2CacheHit: true,
+			prepMarks: args.prepMarks ?? []
+		}),
+		[COMPUTE_VERSION_HEADER]: String(1),
+		Vary: "Accept-Encoding"
+	};
+	const metrics = {
+		treeBuildMs: 0,
+		solveMs: 0,
+		serializeMs: 0,
+		gzipMs: 0,
+		serverTotalMs,
+		serializedBytes: header.serializedBytes,
+		compressedBytes: clientWantsGzip ? gzippedBody.byteLength : null,
+		l2CacheHit: true
+	};
+	let envelope;
+	if (clientWantsGzip) {
+		headers["Content-Encoding"] = "gzip";
+		headers["Content-Length"] = String(gzippedBody.byteLength);
+		envelope = {
+			body: new Uint8Array(gzippedBody),
+			encoding: "gzip",
+			headers,
+			metrics
+		};
+	} else {
+		const json = gunzipEntryBody(gzippedBody);
+		headers["Content-Length"] = String(Buffer.byteLength(json));
+		envelope = {
+			body: json,
+			headers,
+			metrics
+		};
+	}
+	return {
+		kind: "ok",
+		envelope,
+		solveMs: 0,
+		errorCount: header.errorCount,
+		warningCount: header.warningCount
+	};
+}
+/**
+* Assemble the `Server-Timing` header. The browser reads these to attribute its
+* round-trip: `total` here == the server's headers-to-out wall time, so browser
+* `ttfb − total` ≈ network+send latency. When the compute server reported its
+* own decode/solve/encode (VektorNode fork), `rhino_*` is time ON the compute
+* server and `compute_link` is everything between (network + queue wait). Prep
+* sub-phases ride as `p_*`; cache verdicts as 0/1 `selva_cache`/`def_reupload`.
+*/
+function buildServerTiming(parts) {
+	let header = `load;dur=${parts.defLoadMs.toFixed(1)}, tree;dur=${parts.treeBuildMs.toFixed(1)}, solve;dur=${parts.solveMs.toFixed(1)}, serialize;dur=${parts.serializeMs.toFixed(1)}, gzip;dur=${parts.gzipMs.toFixed(1)}, total;dur=${parts.serverTotalMs.toFixed(1)}`;
+	const rhino = parts.rhino;
+	if (rhino) {
+		const onRhinoMs = rhino.decode + rhino.solve + rhino.encode;
+		const computeLinkMs = Math.max(0, parts.solveMs - onRhinoMs);
+		header += `, rhino_decode;dur=${rhino.decode.toFixed(1)}, rhino_solve;dur=${rhino.solve.toFixed(1)}, rhino_encode;dur=${rhino.encode.toFixed(1)}, compute_link;dur=${computeLinkMs.toFixed(1)}`;
+	}
+	for (const [label, ms] of parts.prepMarks) header += `, p_${label};dur=${ms.toFixed(1)}`;
+	const settle = parts.settle;
+	if (settle) {
+		header += `, selva_cache;dur=${settle.fromCache ? 1 : 0}`;
+		if (settle.definitionReuploaded !== void 0) header += `, def_reupload;dur=${settle.definitionReuploaded ? 1 : 0}`;
+	}
+	const byteRef = parts.byteRefOutcome;
+	if (byteRef) {
+		const verdict = !byteRef.loaded ? "skipped" : byteRef.fromCache ? "hit" : "miss";
+		header += `, def_bytes;desc=${verdict}`;
+	}
+	if (parts.l2CacheHit !== null) header += `, l2_cache;dur=${parts.l2CacheHit ? 1 : 0}`;
+	return header;
+}
+//#endregion
+//#region ../server/src/compute/solve-cache-key.ts
+/**
+* Durable L2 cache-key derivation (H2 / R8 / R13).
+*
+* The in-process L1 cache keys on a 32-bit FNV hash — fine for a 20-entry Map,
+* unsafe for a durable, cross-user cache where a collision serves user A's
+* geometry to user B (CONTEXT.md L92–97 records exactly this bug shipping once).
+* So the L2 key is a wide SHA-256 hash (SHA-256 collisions aren't a realistic
+* threat, so hash-to-hash comparison at hit time is defense-in-depth enough —
+* no byte-for-byte preimage comparison is done or needed).
+*
+* What goes into the key:
+*   - The **transformed** input tree (R13) — the exact tree handed to the
+*     scheduler, canonicalized with the package's exported `stableStringify` so
+*     the L2 key parity-matches the L1 canonicalization path.
+*   - A **config subset** (R8): everything OTHER than definition+inputs that
+*     changes a solve's result — model units, tolerances, `dataversion`, the
+*     compute contract version, and (when known) the Rhino server identity. A
+*     durable key of `(versionId, inputHash)` alone would collide across
+*     differing server configs or Rhino versions.
+*
+* `versionId`, `definitionId`, and `orgId` are NOT hashed in here — they're
+* separate parts of the {@link SolveCacheKey} tuple so the backend can scope its
+* keyspace (per-definition quota, per-org isolation) without unpacking the hash.
+*/
+/**
+* Derive the durable `inputKey` from the transformed input tree and the solve
+* config subset. Deterministic and stable across processes/instances: the same
+* tree + config always produce the same hash, which is what lets a shared cache
+* hit across app instances.
+*
+* @param transformedTree the tree AFTER `transformInputParameter`/`TreeBuilder`
+*   (R13) — the exact object handed to `scheduler.solve`.
+* @param config solve-affecting config (R8); `COMPUTE_CONTRACT_VERSION` is folded
+*   in automatically so a wire-contract bump invalidates old entries for free.
+*/
+function deriveSolveCacheInputKey(transformedTree, config) {
+	const canonical = $({
+		v: 1,
+		tree: transformedTree,
+		config
+	});
+	return { hash: createHash("sha256").update(canonical).digest("hex") };
+}
+//#endregion
+//#region ../server/src/compute/safe-url.ts
+/**
+* SSRF guard for `loadRemoteDefinition`. Without it an authenticated user could
+* submit `http://169.254.169.254/...` (cloud metadata) or any intranet endpoint
+* and the server would fetch it on their behalf.
+*
+* Two layers:
+*
+*   1. `isSafeRemoteDefinitionUrl` — synchronous literal pre-filter. Rejects
+*      protocol, hostname literals, and every IP *encoding* that maps to a
+*      blocked address (dotted-decimal, integer, octal, hex, short-form,
+*      IPv4-mapped IPv6). Fast and DNS-free; safe to call anywhere.
+*
+*   2. `assertSafeRemoteDefinitionUrl` — resolves the hostname via DNS and
+*      re-checks the *resolved* IP. This is the real defense: it catches a
+*      public name that resolves to a private IP, which the literal filter
+*      can't see. Still not bulletproof against rebinding (the IP can change
+*      between this lookup and fetch's own); for that the caller would have to
+*      connect to the resolved IP directly. Connecting by IP is a larger change
+*      — this closes the practical bypasses (literal encodings + a DNS record
+*      that points inward) which is what an attacker actually reaches for.
+*/
+/**
+* True when `ip` (a normalized IPv4 or IPv6 literal from `isIP`/`dns.lookup`)
+* is loopback, private, link-local, or otherwise must-not-fetch. IPv4-mapped
+* IPv6 (`::ffff:a.b.c.d`) is unwrapped to its embedded IPv4 first so the v4
+* rules apply.
+*/
+function isBlockedIp(ip) {
+	let addr = ip.toLowerCase();
+	const mappedDotted = /^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/.exec(addr);
+	if (mappedDotted) addr = mappedDotted[1];
+	else {
+		const mappedHex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(addr);
+		if (mappedHex) {
+			const hi = parseInt(mappedHex[1], 16);
+			const lo = parseInt(mappedHex[2], 16);
+			addr = [
+				hi >> 8 & 255,
+				hi & 255,
+				lo >> 8 & 255,
+				lo & 255
+			].join(".");
+		}
+	}
+	if (isIP(addr) === 4) {
+		const octets = addr.split(".").map(Number);
+		if (octets.length !== 4 || octets.some((o) => o > 255)) return true;
+		const [a, b] = octets;
+		if (a === 0) return true;
+		if (a === 127) return true;
+		if (a === 10) return true;
+		if (a === 192 && b === 168) return true;
+		if (a === 172 && b >= 16 && b <= 31) return true;
+		if (a === 169 && b === 254) return true;
+		return false;
+	}
+	if (addr === "::1" || addr === "::") return true;
+	if (/^(fc|fd)[0-9a-f]{0,2}:/.test(addr)) return true;
+	if (/^fe[89ab][0-9a-f]:/.test(addr)) return true;
+	return false;
+}
+/**
+* Parse a bare-IPv4 hostname in any encoding browsers/glibc accept — integer
+* (`2130706433`), octal (`0177.0.0.1`), hex (`0x7f000001`), and short forms
+* (`127.1`) — into a canonical dotted-decimal string. Returns null when the
+* host is not a numeric IPv4 literal (i.e. it's a real name or already-valid
+* dotted-quad, which callers handle separately).
+*/
+function canonicalizeNumericIpv4(host) {
+	if (isIP(host) === 4) return host;
+	const rawParts = host.split(".");
+	if (rawParts.length === 0 || rawParts.length > 4) return null;
+	const parseUInt = (s) => {
+		if (s === "") return null;
+		let n;
+		if (/^0x[0-9a-f]+$/i.test(s)) n = parseInt(s, 16);
+		else if (/^0[0-7]+$/.test(s)) n = parseInt(s, 8);
+		else if (/^[0-9]+$/.test(s)) n = parseInt(s, 10);
+		else return null;
+		return Number.isFinite(n) ? n : null;
+	};
+	const nums = rawParts.map(parseUInt);
+	if (nums.some((n) => n === null)) return null;
+	const parts = nums;
+	let value;
+	switch (parts.length) {
+		case 1:
+			value = parts[0];
+			break;
+		case 2:
+			if (parts[0] > 255 || parts[1] > 16777215) return null;
+			value = parts[0] << 24 | parts[1];
+			break;
+		case 3:
+			if (parts[0] > 255 || parts[1] > 255 || parts[2] > 65535) return null;
+			value = parts[0] << 24 | parts[1] << 16 | parts[2];
+			break;
+		default:
+			if (parts.some((p) => p > 255)) return null;
+			value = parts[0] << 24 | parts[1] << 16 | parts[2] << 8 | parts[3];
+	}
+	value = value >>> 0;
+	if (value > 4294967295) return null;
+	return [
+		value >>> 24 & 255,
+		value >>> 16 & 255,
+		value >>> 8 & 255,
+		value & 255
+	].join(".");
+}
+/**
+* Synchronous literal pre-filter. Rejects bad schemes, loopback hostnames, and
+* any IP literal (in any encoding) that resolves to a blocked address. Does NOT
+* perform DNS — a public *name* that points at a private IP passes here and is
+* caught by `assertSafeRemoteDefinitionUrl`.
+*/
+function isSafeRemoteDefinitionUrl(raw) {
+	let parsed;
+	try {
+		parsed = new URL(raw);
+	} catch {
+		return false;
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return false;
+	let host = parsed.hostname.toLowerCase();
+	if (!host) return false;
+	if (host === "localhost" || host.endsWith(".localhost")) return false;
+	if (host.startsWith("[") && host.endsWith("]")) host = host.slice(1, -1);
+	if (isIP(host) === 6) return !isBlockedIp(host);
+	const canonical = canonicalizeNumericIpv4(host);
+	if (canonical) return !isBlockedIp(canonical);
+	return true;
+}
+/**
+* Full SSRF check: literal pre-filter, then resolve every A/AAAA record and
+* reject if *any* resolved IP is blocked. Returns the original URL on success
+* so callers can `await assertSafeRemoteDefinitionUrl(url)` inline. Throws on
+* any rejection.
+*/
+async function assertSafeRemoteDefinitionUrl(raw, logger = new NoopLogger()) {
+	if (!isSafeRemoteDefinitionUrl(raw)) {
+		logger.warn("Blocked remote definition URL", {
+			component: "Compute/ssrf",
+			reason: "literal-filter",
+			host: hostOf(raw)
+		});
+		throw new Error("Remote definition URL is not allowed");
+	}
+	const host = new URL(raw).hostname.toLowerCase().replace(/^\[|\]$/g, "");
+	if (isIP(host) !== 0 || canonicalizeNumericIpv4(host)) return raw;
+	let resolved;
+	try {
+		resolved = await lookup(host, { all: true });
+	} catch {
+		logger.warn("Blocked remote definition URL", {
+			component: "Compute/ssrf",
+			reason: "dns-lookup-failed",
+			host
+		});
+		throw new Error("Remote definition URL is not allowed");
+	}
+	if (resolved.length === 0 || resolved.some((r) => isBlockedIp(r.address))) {
+		const blocked = resolved.filter((r) => isBlockedIp(r.address)).map((r) => r.address);
+		logger.warn("Blocked remote definition URL", {
+			component: "Compute/ssrf",
+			reason: "resolves-to-blocked-ip",
+			host,
+			blockedIps: blocked
+		});
+		throw new Error("Remote definition URL is not allowed");
+	}
+	return raw;
+}
+/** Best-effort hostname for logging; falls back to a truncated raw string. */
+function hostOf(raw) {
+	try {
+		return new URL(raw).hostname;
+	} catch {
+		return raw.slice(0, 120);
+	}
+}
+//#endregion
+//#region ../server/src/compute/remote-definition.ts
+/**
+* Remote-definition fetch: SSRF-guarded, size-capped, timed, and TTL-cached.
+*
+* A solve can reference its `.gh` by remote URL instead of a stored blob. That
+* URL is attacker-controllable (a share-token caller supplies `definitionUrl`),
+* so every fetch runs through {@link assertSafeRemoteDefinitionUrl} (literal +
+* DNS host validation, blocking private/loopback/link-local targets and
+* literal-encoding bypasses), streams the body with an early size cap, and
+* bounds the wall time with a deadline.
+*
+* The TTL cache is a per-fetcher `Map<url, {data, fetchedAt}>` so repeated
+* solves of the same remote definition skip the network. It's created by
+* {@link createRemoteDefinitionFetcher} rather than being module-global, so a
+* consuming app can hold one fetcher per process (the app binding does) or
+* several isolated ones (tests) without shared state leaking across them.
+*/
+/** Once the cache exceeds this many entries, evict the oldest 10 by `fetchedAt`. */
+var CACHE_MAX_ENTRIES = 50;
+var CACHE_EVICT_BATCH = 10;
+/**
+* Read a response body into memory, aborting (and throwing) as soon as the
+* running byte total exceeds `maxBytes`. Falls back to `arrayBuffer()` only when
+* the body isn't a readable stream (older fetch impls). Exported for direct use
+* and reuse; the fetcher below wraps it with SSRF + TTL.
+*/
+async function readBodyWithCap(response, maxBytes, controller) {
+	if (!response.body) {
+		const buffer = await response.arrayBuffer();
+		if (buffer.byteLength > maxBytes) throw new Error("Remote definition exceeds size limit");
+		return new Uint8Array(buffer);
+	}
+	const reader = response.body.getReader();
+	const chunks = [];
+	let total = 0;
+	while (true) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		total += value.byteLength;
+		if (total > maxBytes) {
+			controller.abort();
+			throw new Error("Remote definition exceeds size limit");
+		}
+		chunks.push(value);
+	}
+	const out = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		out.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return out;
+}
+/**
+* Build a remote-definition fetcher owning its own TTL cache. Each fetcher's
+* cache is independent, so one per process shares warm bytes while test fetchers
+* stay isolated.
+*/
+function createRemoteDefinitionFetcher(config) {
+	const cache = /* @__PURE__ */ new Map();
+	const logger = config.logger ?? new NoopLogger();
+	return { async load(url) {
+		await assertSafeRemoteDefinitionUrl(url, logger);
+		const now = config.now();
+		const cached = cache.get(url);
+		if (cached && now - cached.fetchedAt < config.cacheTtlMs) return cached.data;
+		const controller = new AbortController();
+		const timeout = setTimeout(() => controller.abort(), config.fetchTimeoutMs);
+		let data;
+		try {
+			const response = await fetch(url, {
+				signal: controller.signal,
+				redirect: "error"
+			});
+			if (!response.ok) throw new Error(`HTTP ${response.status}: ${response.statusText}`);
+			const declared = Number(response.headers.get("content-length"));
+			if (Number.isFinite(declared) && declared > config.maxBytes) throw new Error("Remote definition exceeds size limit");
+			data = await readBodyWithCap(response, config.maxBytes, controller);
+		} finally {
+			clearTimeout(timeout);
+		}
+		cache.set(url, {
+			data,
+			fetchedAt: now
+		});
+		if (cache.size > CACHE_MAX_ENTRIES) {
+			const entries = Array.from(cache.entries());
+			entries.sort((a, b) => a[1].fetchedAt - b[1].fetchedAt);
+			for (let i = 0; i < CACHE_EVICT_BATCH; i++) cache.delete(entries[i][0]);
+		}
+		return data;
+	} };
+}
+
+export { adaptEnvelopeToEncoding as a, createRemoteDefinitionFetcher as c, runSolvePipeline as r };
+//# sourceMappingURL=compute.js-DGTy3YjO.js.map