@selvajs/selva 4.7.0-beta.4 → 4.7.0-beta.6

package/build/server/chunks/chunks/compute.js-DGTy3YjO.js

@@ -1,747 +0,0 @@
-import './src.js-BeFXhqDJ.js';
-import { N as NoopLogger } from './limits.js-DfZnOKg5.js';
-import { p, l } from './chunk-Y3M7P3BW.js-qwxSY5dh.js';
-import { B, k as ke, $ } from './chunk-6TMSTNHN.js-3Bz2KNTb.js';
-import { createHash } from 'node:crypto';
-import { gzip, gunzipSync } from 'node:zlib';
-import { promisify } from 'node:util';
-import { lookup } from 'node:dns/promises';
-import { isIP } from 'node:net';
-
-//#region ../server/src/compute/transform-input.ts
-/**
-* Adapt a persisted `SchemaInput` (plus the user's chosen value) into the package's
-* raw `InputParamSchema`, then let `@selvajs/compute`'s own `processInput` produce the
-* typed `InputParam`. The package handles every paramType (Number/Integer/Text/Boolean/
-* ValueList/Geometry/File/Color), normalizes the lowercase UI paramType to its
-* PascalCase form, and falls back gracefully on underspecified inputs — so we no longer
-* maintain a parallel hand-rolled transform that silently coerced valueList/file/color
-* to Text and drifted from the package (whose consumers already delegate here).
-* `values`/`acceptedFormats` are absent on `SchemaInput` (they live on the layout
-* item's config), so valueList/file inputs fall back to carrying the selected value with
-* no option list — the same value that reaches Grasshopper.
-*/
-function transformInputParameter(input, value) {
-	const processed = ke({
-		id: input.id,
-		name: input.nickname,
-		nickname: input.nickname || null,
-		description: input.description || "",
-		paramType: input.paramType === "dynamicValueList" ? "valueList" : input.paramType,
-		treeAccess: input.inputStructure === "tree",
-		minimum: input.minimum ?? null,
-		maximum: input.maximum ?? null,
-		atLeast: 1,
-		atMost: 1,
-		stepSize: input.stepSize,
-		default: value ?? input.default
-	});
-	const effective = value ?? input.default;
-	if (processed.default == null && effective != null) {
-		if (Array.isArray(effective)) processed.default = effective;
-		else if (processed.paramType === "ValueList" && typeof effective !== "object") processed.default = effective;
-	}
-	return processed;
-}
-//#endregion
-//#region ../server/src/compute/solve-cache-envelope.ts
-/**
-* L2 cache entry format (R6). An entry is the gzipped response body plus a tiny
-* metadata header, so a hit is near-CPU-free: no `JSON.stringify`, no re-solve —
-* gzip clients get the stored bytes verbatim, and the header carries just enough
-* to rebuild the `ok` outcome (error/warning counts for the metric, uncompressed
-* length for the `Content-Length` on a gunzip fallback).
-*
-* Wire layout (opaque to the `ISolveResultCache` backend, which sees only bytes):
-*
-*   [ 4 bytes: header length N, big-endian uint32 ]
-*   [ N bytes: UTF-8 JSON EnvelopeHeader ]
-*   [ rest:    gzipped JSON response body ]
-*
-* The `algo` echo (M3) is already stripped at the source in the package's
-* `runSolve`, so the body never carries the base64 definition — entries stay
-* small without a strip step here.
-*/
-/**
-* Encode a cache entry from the gzipped body + header. The body MUST already be
-* gzipped (the pipeline gzips before storing so every hit serves compressed
-* bytes; a rare non-gzip client gunzips on read).
-*/
-function encodeSolveCacheEntry(header, gzippedBody) {
-	const headerJson = Buffer.from(JSON.stringify(header), "utf8");
-	const out = Buffer.allocUnsafe(4 + headerJson.byteLength + gzippedBody.byteLength);
-	out.writeUInt32BE(headerJson.byteLength, 0);
-	headerJson.copy(out, 4);
-	Buffer.from(gzippedBody.buffer, gzippedBody.byteOffset, gzippedBody.byteLength).copy(out, 4 + headerJson.byteLength);
-	return out;
-}
-/**
-* Decode a cache entry. Returns `null` on any malformed input (truncated, bad
-* length prefix, non-JSON header) — a corrupt entry is treated as a miss, never
-* an error, matching the best-effort cache contract.
-*/
-function decodeSolveCacheEntry(bytes) {
-	if (bytes.byteLength < 4) return null;
-	const buf = Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength);
-	const headerEnd = 4 + buf.readUInt32BE(0);
-	if (headerEnd > buf.byteLength) return null;
-	let header;
-	try {
-		header = JSON.parse(buf.toString("utf8", 4, headerEnd));
-	} catch {
-		return null;
-	}
-	if (typeof header?.errorCount !== "number" || typeof header?.warningCount !== "number" || typeof header?.serializedBytes !== "number" || typeof header?.inputHash !== "string") return null;
-	const gzippedBody = new Uint8Array(bytes.buffer, bytes.byteOffset + headerEnd, bytes.byteLength - headerEnd);
-	return {
-		header,
-		gzippedBody
-	};
-}
-/** Gunzip a stored body back to the JSON string, for a non-gzip client (rare). */
-function gunzipEntryBody(gzippedBody) {
-	return gunzipSync(gzippedBody).toString("utf8");
-}
-//#endregion
-//#region ../server/src/compute/solve-pipeline.ts
-/**
-* Transport-agnostic solve pipeline — the callable core lifted out of the app's
-* `/api/compute` route (embeddable-server-layer plan, K3).
-*
-* Given an already-resolved solve context — the `.gh` bytes, the input params +
-* user values, and a warm `SolveScheduler` (from `createClientCache`) — this
-* runs the framework-free half of a solve:
-*
-*   input tree build → scheduler.solve (with abort/timeout classification) →
-*   JSON serialize (size-guarded) → optional gzip → Server-Timing envelope.
-*
-* It returns a discriminated {@link SolveOutcome}: `ok` carries the ready-to-send
-* {@link SolveEnvelope} (body + headers + phase metrics), while the error
-* variants (`timeout`, `client_abort`, `too_large`, `compute_error`) name a
-* failure the transport maps to its own status code. Nothing here throws for an
-* expected failure and nothing here touches auth, the database, share tokens,
-* rate limits, or metric sinks — those stay app policy in the route.
-*
-* The Server-Timing string it emits IS the versioned wire contract (audit D5):
-* see {@link COMPUTE_CONTRACT_VERSION} and {@link COMPUTE_VERSION_HEADER}.
-*/
-/** Async gzip (audit B8) — off the event loop, unlike the old `gzipSync`. */
-var gzipAsync = promisify(gzip);
-/** Response header carrying {@link COMPUTE_CONTRACT_VERSION}. */
-var COMPUTE_VERSION_HEADER = "X-Selva-Compute-Version";
-/**
-* Run the framework-free half of a solve and produce a typed outcome. See the
-* module doc for the phase sequence and the app/library boundary.
-*/
-async function runSolvePipeline(args) {
-	const { client, signal } = args;
-	const treeBuildStart = performance.now();
-	const inputTree = B.fromInputParams(args.inputs.filter((input) => input.paramType).map((input) => transformInputParameter(input, args.values[input.id])));
-	const treeBuildMs = performance.now() - treeBuildStart;
-	let inputKey = null;
-	if (args.solveCache) {
-		inputKey = deriveSolveCacheInputKey(inputTree, args.solveCache.configSubset).hash;
-		let stored = null;
-		try {
-			stored = await args.solveCache.lookup(inputKey);
-		} catch {
-			stored = null;
-		}
-		if (stored) {
-			const hit = buildEnvelopeFromCacheEntry(stored, inputKey, args);
-			if (hit) return hit;
-			(args.logger ?? new NoopLogger()).warn("Discarding corrupt or hash-mismatched L2 cache entry, solving fresh", {
-				component: "Compute/l2-cache",
-				inputKeyPrefix: inputKey.slice(0, 16)
-			});
-		}
-	}
-	const settleSeqBefore = client.solveMeta.seq;
-	const rhinoSeqBefore = client.rhinoTiming.seq;
-	let result;
-	const solveStart = performance.now();
-	try {
-		result = await client.scheduler.solve(args.definitionSource, inputTree, { signal });
-	} catch (err) {
-		const durationMs = performance.now() - solveStart;
-		if (err instanceof Error && err.name === "AbortError") {
-			if (signal.aborted) return {
-				kind: "client_abort",
-				durationMs
-			};
-			return {
-				kind: "timeout",
-				durationMs,
-				message: `Solve exceeded the ${Math.round(args.maxSolveDurationMs / 1e3)}s deadline.`
-			};
-		}
-		if (err instanceof p) {
-			if (err.code === l.QUEUE_FULL) return {
-				kind: "shed",
-				durationMs,
-				reason: "queue_full",
-				retryAfterSeconds: 1,
-				message: "Compute server is at capacity. Retry shortly."
-			};
-			if (err.code === l.QUEUE_TIMEOUT) return {
-				kind: "shed",
-				durationMs,
-				reason: "queue_timeout",
-				retryAfterSeconds: 1,
-				message: "Compute request waited too long in the queue. Retry shortly."
-			};
-		}
-		return {
-			kind: "compute_error",
-			durationMs,
-			error: err
-		};
-	}
-	const solveMs = performance.now() - solveStart;
-	const serializeStart = performance.now();
-	let serialized;
-	try {
-		serialized = JSON.stringify(result);
-	} catch (err) {
-		if (err instanceof RangeError) return { kind: "too_large" };
-		throw err;
-	}
-	if (serialized.length > args.responseMaxBytes) return { kind: "too_large" };
-	const serializeMs = performance.now() - serializeStart;
-	const worthSendingGzip = /\bgzip\b/i.test(args.acceptEncoding) && serialized.length > 1024;
-	const willCache = args.solveCache != null;
-	let compressed = null;
-	let gzipMs = 0;
-	if (worthSendingGzip || willCache) {
-		const gzipStart = performance.now();
-		compressed = await gzipAsync(Buffer.from(serialized));
-		gzipMs = performance.now() - gzipStart;
-	}
-	if (args.solveCache && inputKey && compressed) {
-		const entry = encodeSolveCacheEntry({
-			errorCount: result.errors?.length ?? 0,
-			warningCount: result.warnings?.length ?? 0,
-			serializedBytes: serialized.length,
-			inputHash: inputKey
-		}, new Uint8Array(compressed));
-		args.solveCache.store(inputKey, entry);
-	}
-	const serverTotalMs = performance.now() - args.loadStartMs;
-	const settle = client.solveMeta.seq === settleSeqBefore + 1 ? client.solveMeta.last : null;
-	const rhino = settle && !settle.fromCache && client.rhinoTiming.seq === rhinoSeqBefore + 1 ? client.rhinoTiming.last : null;
-	const sendCompressed = compressed && worthSendingGzip ? compressed : null;
-	const headers = {
-		"Content-Type": "application/json",
-		"Server-Timing": buildServerTiming({
-			defLoadMs: args.defLoadMs,
-			treeBuildMs,
-			solveMs,
-			serializeMs,
-			gzipMs,
-			serverTotalMs,
-			rhino,
-			settle,
-			byteRefOutcome: args.byteRefOutcome,
-			l2CacheHit: args.solveCache ? false : null,
-			prepMarks: args.prepMarks ?? []
-		}),
-		[COMPUTE_VERSION_HEADER]: String(1),
-		Vary: "Accept-Encoding"
-	};
-	const metrics = {
-		treeBuildMs,
-		solveMs,
-		serializeMs,
-		gzipMs,
-		serverTotalMs,
-		serializedBytes: serialized.length,
-		compressedBytes: sendCompressed?.byteLength ?? null,
-		l2CacheHit: args.solveCache ? false : null
-	};
-	let envelope;
-	if (sendCompressed) {
-		headers["Content-Encoding"] = "gzip";
-		headers["Content-Length"] = String(sendCompressed.byteLength);
-		envelope = {
-			body: new Uint8Array(sendCompressed),
-			encoding: "gzip",
-			headers,
-			result,
-			metrics
-		};
-	} else {
-		headers["Content-Length"] = String(Buffer.byteLength(serialized));
-		envelope = {
-			body: serialized,
-			headers,
-			result,
-			metrics
-		};
-	}
-	return {
-		kind: "ok",
-		envelope,
-		solveMs,
-		errorCount: result.errors?.length ?? 0,
-		warningCount: result.warnings?.length ?? 0
-	};
-}
-/**
-* Re-key a coalesced envelope to a single waiter's `Accept-Encoding` (audit C5).
-*
-* The single-flight coalescer (R4) runs ONE pipeline execution for N identical
-* concurrent solves and hands every waiter the same {@link SolveEnvelope}. That
-* envelope's wire form — gzip body + `Content-Encoding: gzip`, or the plain JSON
-* string — is baked from the FIRST caller's `Accept-Encoding`. A later waiter
-* with a different `Accept-Encoding` would otherwise receive a body labelled with
-* the wrong encoding: a non-gzip client joining a gzip flight gets gzip bytes it
-* cannot decode (`Vary` can't help — this is one object shared across waiters,
-* not a cache lookup). Encoding is not in the coalesce key by design, so mixed
-* clients still coalesce; this adapts the shared result to each waiter instead.
-*
-* Returns the body + headers to send THIS waiter. Only the correctness-critical
-* direction is adapted — a gzip envelope served to a non-gzip waiter is gunzipped
-* back to JSON. The reverse (a plain-JSON envelope to a gzip-capable waiter) is
-* left uncompressed: gzip is an optimisation the client advertises, never a
-* requirement, so sending it plain is correct, just not maximally small. The
-* common all-gzip case returns the envelope's own body/headers untouched.
-*/
-function adaptEnvelopeToEncoding(envelope, acceptEncoding) {
-	const waiterWantsGzip = /\bgzip\b/i.test(acceptEncoding);
-	if (envelope.encoding === "gzip" && !waiterWantsGzip) {
-		const json = gunzipSync(envelope.body instanceof Uint8Array ? envelope.body : Buffer.from(envelope.body)).toString("utf8");
-		const headers = { ...envelope.headers };
-		delete headers["Content-Encoding"];
-		headers["Content-Length"] = String(Buffer.byteLength(json));
-		return {
-			body: json,
-			headers
-		};
-	}
-	return {
-		body: envelope.body,
-		headers: envelope.headers
-	};
-}
-/**
-* Build the `ok` outcome from a stored L2 entry — the near-CPU-free hit path (no
-* solve, no `JSON.stringify`, no gzip). Returns `null` when the entry is corrupt
-* or its stored `inputHash` doesn't match the requesting key (defense-in-depth
-* against a wide-hash collision), so the caller falls through and solves.
-*/
-function buildEnvelopeFromCacheEntry(entryBytes, inputKey, args) {
-	const decoded = decodeSolveCacheEntry(entryBytes);
-	if (!decoded || decoded.header.inputHash !== inputKey) return null;
-	const { header, gzippedBody } = decoded;
-	const clientWantsGzip = /\bgzip\b/i.test(args.acceptEncoding);
-	const serverTotalMs = performance.now() - args.loadStartMs;
-	const headers = {
-		"Content-Type": "application/json",
-		"Server-Timing": buildServerTiming({
-			defLoadMs: args.defLoadMs,
-			treeBuildMs: 0,
-			solveMs: 0,
-			serializeMs: 0,
-			gzipMs: 0,
-			serverTotalMs,
-			rhino: null,
-			settle: null,
-			byteRefOutcome: args.byteRefOutcome,
-			l2CacheHit: true,
-			prepMarks: args.prepMarks ?? []
-		}),
-		[COMPUTE_VERSION_HEADER]: String(1),
-		Vary: "Accept-Encoding"
-	};
-	const metrics = {
-		treeBuildMs: 0,
-		solveMs: 0,
-		serializeMs: 0,
-		gzipMs: 0,
-		serverTotalMs,
-		serializedBytes: header.serializedBytes,
-		compressedBytes: clientWantsGzip ? gzippedBody.byteLength : null,
-		l2CacheHit: true
-	};
-	let envelope;
-	if (clientWantsGzip) {
-		headers["Content-Encoding"] = "gzip";
-		headers["Content-Length"] = String(gzippedBody.byteLength);
-		envelope = {
-			body: new Uint8Array(gzippedBody),
-			encoding: "gzip",
-			headers,
-			metrics
-		};
-	} else {
-		const json = gunzipEntryBody(gzippedBody);
-		headers["Content-Length"] = String(Buffer.byteLength(json));
-		envelope = {
-			body: json,
-			headers,
-			metrics
-		};
-	}
-	return {
-		kind: "ok",
-		envelope,
-		solveMs: 0,
-		errorCount: header.errorCount,
-		warningCount: header.warningCount
-	};
-}
-/**
-* Assemble the `Server-Timing` header. The browser reads these to attribute its
-* round-trip: `total` here == the server's headers-to-out wall time, so browser
-* `ttfb − total` ≈ network+send latency. When the compute server reported its
-* own decode/solve/encode (VektorNode fork), `rhino_*` is time ON the compute
-* server and `compute_link` is everything between (network + queue wait). Prep
-* sub-phases ride as `p_*`; cache verdicts as 0/1 `selva_cache`/`def_reupload`.
-*/
-function buildServerTiming(parts) {
-	let header = `load;dur=${parts.defLoadMs.toFixed(1)}, tree;dur=${parts.treeBuildMs.toFixed(1)}, solve;dur=${parts.solveMs.toFixed(1)}, serialize;dur=${parts.serializeMs.toFixed(1)}, gzip;dur=${parts.gzipMs.toFixed(1)}, total;dur=${parts.serverTotalMs.toFixed(1)}`;
-	const rhino = parts.rhino;
-	if (rhino) {
-		const onRhinoMs = rhino.decode + rhino.solve + rhino.encode;
-		const computeLinkMs = Math.max(0, parts.solveMs - onRhinoMs);
-		header += `, rhino_decode;dur=${rhino.decode.toFixed(1)}, rhino_solve;dur=${rhino.solve.toFixed(1)}, rhino_encode;dur=${rhino.encode.toFixed(1)}, compute_link;dur=${computeLinkMs.toFixed(1)}`;
-	}
-	for (const [label, ms] of parts.prepMarks) header += `, p_${label};dur=${ms.toFixed(1)}`;
-	const settle = parts.settle;
-	if (settle) {
-		header += `, selva_cache;dur=${settle.fromCache ? 1 : 0}`;
-		if (settle.definitionReuploaded !== void 0) header += `, def_reupload;dur=${settle.definitionReuploaded ? 1 : 0}`;
-	}
-	const byteRef = parts.byteRefOutcome;
-	if (byteRef) {
-		const verdict = !byteRef.loaded ? "skipped" : byteRef.fromCache ? "hit" : "miss";
-		header += `, def_bytes;desc=${verdict}`;
-	}
-	if (parts.l2CacheHit !== null) header += `, l2_cache;dur=${parts.l2CacheHit ? 1 : 0}`;
-	return header;
-}
-//#endregion
-//#region ../server/src/compute/solve-cache-key.ts
-/**
-* Durable L2 cache-key derivation (H2 / R8 / R13).
-*
-* The in-process L1 cache keys on a 32-bit FNV hash — fine for a 20-entry Map,
-* unsafe for a durable, cross-user cache where a collision serves user A's
-* geometry to user B (CONTEXT.md L92–97 records exactly this bug shipping once).
-* So the L2 key is a wide SHA-256 hash (SHA-256 collisions aren't a realistic
-* threat, so hash-to-hash comparison at hit time is defense-in-depth enough —
-* no byte-for-byte preimage comparison is done or needed).
-*
-* What goes into the key:
-*   - The **transformed** input tree (R13) — the exact tree handed to the
-*     scheduler, canonicalized with the package's exported `stableStringify` so
-*     the L2 key parity-matches the L1 canonicalization path.
-*   - A **config subset** (R8): everything OTHER than definition+inputs that
-*     changes a solve's result — model units, tolerances, `dataversion`, the
-*     compute contract version, and (when known) the Rhino server identity. A
-*     durable key of `(versionId, inputHash)` alone would collide across
-*     differing server configs or Rhino versions.
-*
-* `versionId`, `definitionId`, and `orgId` are NOT hashed in here — they're
-* separate parts of the {@link SolveCacheKey} tuple so the backend can scope its
-* keyspace (per-definition quota, per-org isolation) without unpacking the hash.
-*/
-/**
-* Derive the durable `inputKey` from the transformed input tree and the solve
-* config subset. Deterministic and stable across processes/instances: the same
-* tree + config always produce the same hash, which is what lets a shared cache
-* hit across app instances.
-*
-* @param transformedTree the tree AFTER `transformInputParameter`/`TreeBuilder`
-*   (R13) — the exact object handed to `scheduler.solve`.
-* @param config solve-affecting config (R8); `COMPUTE_CONTRACT_VERSION` is folded
-*   in automatically so a wire-contract bump invalidates old entries for free.
-*/
-function deriveSolveCacheInputKey(transformedTree, config) {
-	const canonical = $({
-		v: 1,
-		tree: transformedTree,
-		config
-	});
-	return { hash: createHash("sha256").update(canonical).digest("hex") };
-}
-//#endregion
-//#region ../server/src/compute/safe-url.ts
-/**
-* SSRF guard for `loadRemoteDefinition`. Without it an authenticated user could
-* submit `http://169.254.169.254/...` (cloud metadata) or any intranet endpoint
-* and the server would fetch it on their behalf.
-*
-* Two layers:
-*
-*   1. `isSafeRemoteDefinitionUrl` — synchronous literal pre-filter. Rejects
-*      protocol, hostname literals, and every IP *encoding* that maps to a
-*      blocked address (dotted-decimal, integer, octal, hex, short-form,
-*      IPv4-mapped IPv6). Fast and DNS-free; safe to call anywhere.
-*
-*   2. `assertSafeRemoteDefinitionUrl` — resolves the hostname via DNS and
-*      re-checks the *resolved* IP. This is the real defense: it catches a
-*      public name that resolves to a private IP, which the literal filter
-*      can't see. Still not bulletproof against rebinding (the IP can change
-*      between this lookup and fetch's own); for that the caller would have to
-*      connect to the resolved IP directly. Connecting by IP is a larger change
-*      — this closes the practical bypasses (literal encodings + a DNS record
-*      that points inward) which is what an attacker actually reaches for.
-*/
-/**
-* True when `ip` (a normalized IPv4 or IPv6 literal from `isIP`/`dns.lookup`)
-* is loopback, private, link-local, or otherwise must-not-fetch. IPv4-mapped
-* IPv6 (`::ffff:a.b.c.d`) is unwrapped to its embedded IPv4 first so the v4
-* rules apply.
-*/
-function isBlockedIp(ip) {
-	let addr = ip.toLowerCase();
-	const mappedDotted = /^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/.exec(addr);
-	if (mappedDotted) addr = mappedDotted[1];
-	else {
-		const mappedHex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(addr);
-		if (mappedHex) {
-			const hi = parseInt(mappedHex[1], 16);
-			const lo = parseInt(mappedHex[2], 16);
-			addr = [
-				hi >> 8 & 255,
-				hi & 255,
-				lo >> 8 & 255,
-				lo & 255
-			].join(".");
-		}
-	}
-	if (isIP(addr) === 4) {
-		const octets = addr.split(".").map(Number);
-		if (octets.length !== 4 || octets.some((o) => o > 255)) return true;
-		const [a, b] = octets;
-		if (a === 0) return true;
-		if (a === 127) return true;
-		if (a === 10) return true;
-		if (a === 192 && b === 168) return true;
-		if (a === 172 && b >= 16 && b <= 31) return true;
-		if (a === 169 && b === 254) return true;
-		return false;
-	}
-	if (addr === "::1" || addr === "::") return true;
-	if (/^(fc|fd)[0-9a-f]{0,2}:/.test(addr)) return true;
-	if (/^fe[89ab][0-9a-f]:/.test(addr)) return true;
-	return false;
-}
-/**
-* Parse a bare-IPv4 hostname in any encoding browsers/glibc accept — integer
-* (`2130706433`), octal (`0177.0.0.1`), hex (`0x7f000001`), and short forms
-* (`127.1`) — into a canonical dotted-decimal string. Returns null when the
-* host is not a numeric IPv4 literal (i.e. it's a real name or already-valid
-* dotted-quad, which callers handle separately).
-*/
-function canonicalizeNumericIpv4(host) {
-	if (isIP(host) === 4) return host;
-	const rawParts = host.split(".");
-	if (rawParts.length === 0 || rawParts.length > 4) return null;
-	const parseUInt = (s) => {
-		if (s === "") return null;
-		let n;
-		if (/^0x[0-9a-f]+$/i.test(s)) n = parseInt(s, 16);
-		else if (/^0[0-7]+$/.test(s)) n = parseInt(s, 8);
-		else if (/^[0-9]+$/.test(s)) n = parseInt(s, 10);
-		else return null;
-		return Number.isFinite(n) ? n : null;
-	};
-	const nums = rawParts.map(parseUInt);
-	if (nums.some((n) => n === null)) return null;
-	const parts = nums;
-	let value;
-	switch (parts.length) {
-		case 1:
-			value = parts[0];
-			break;
-		case 2:
-			if (parts[0] > 255 || parts[1] > 16777215) return null;
-			value = parts[0] << 24 | parts[1];
-			break;
-		case 3:
-			if (parts[0] > 255 || parts[1] > 255 || parts[2] > 65535) return null;
-			value = parts[0] << 24 | parts[1] << 16 | parts[2];
-			break;
-		default:
-			if (parts.some((p) => p > 255)) return null;
-			value = parts[0] << 24 | parts[1] << 16 | parts[2] << 8 | parts[3];
-	}
-	value = value >>> 0;
-	if (value > 4294967295) return null;
-	return [
-		value >>> 24 & 255,
-		value >>> 16 & 255,
-		value >>> 8 & 255,
-		value & 255
-	].join(".");
-}
-/**
-* Synchronous literal pre-filter. Rejects bad schemes, loopback hostnames, and
-* any IP literal (in any encoding) that resolves to a blocked address. Does NOT
-* perform DNS — a public *name* that points at a private IP passes here and is
-* caught by `assertSafeRemoteDefinitionUrl`.
-*/
-function isSafeRemoteDefinitionUrl(raw) {
-	let parsed;
-	try {
-		parsed = new URL(raw);
-	} catch {
-		return false;
-	}
-	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return false;
-	let host = parsed.hostname.toLowerCase();
-	if (!host) return false;
-	if (host === "localhost" || host.endsWith(".localhost")) return false;
-	if (host.startsWith("[") && host.endsWith("]")) host = host.slice(1, -1);
-	if (isIP(host) === 6) return !isBlockedIp(host);
-	const canonical = canonicalizeNumericIpv4(host);
-	if (canonical) return !isBlockedIp(canonical);
-	return true;
-}
-/**
-* Full SSRF check: literal pre-filter, then resolve every A/AAAA record and
-* reject if *any* resolved IP is blocked. Returns the original URL on success
-* so callers can `await assertSafeRemoteDefinitionUrl(url)` inline. Throws on
-* any rejection.
-*/
-async function assertSafeRemoteDefinitionUrl(raw, logger = new NoopLogger()) {
-	if (!isSafeRemoteDefinitionUrl(raw)) {
-		logger.warn("Blocked remote definition URL", {
-			component: "Compute/ssrf",
-			reason: "literal-filter",
-			host: hostOf(raw)
-		});
-		throw new Error("Remote definition URL is not allowed");
-	}
-	const host = new URL(raw).hostname.toLowerCase().replace(/^\[|\]$/g, "");
-	if (isIP(host) !== 0 || canonicalizeNumericIpv4(host)) return raw;
-	let resolved;
-	try {
-		resolved = await lookup(host, { all: true });
-	} catch {
-		logger.warn("Blocked remote definition URL", {
-			component: "Compute/ssrf",
-			reason: "dns-lookup-failed",
-			host
-		});
-		throw new Error("Remote definition URL is not allowed");
-	}
-	if (resolved.length === 0 || resolved.some((r) => isBlockedIp(r.address))) {
-		const blocked = resolved.filter((r) => isBlockedIp(r.address)).map((r) => r.address);
-		logger.warn("Blocked remote definition URL", {
-			component: "Compute/ssrf",
-			reason: "resolves-to-blocked-ip",
-			host,
-			blockedIps: blocked
-		});
-		throw new Error("Remote definition URL is not allowed");
-	}
-	return raw;
-}
-/** Best-effort hostname for logging; falls back to a truncated raw string. */
-function hostOf(raw) {
-	try {
-		return new URL(raw).hostname;
-	} catch {
-		return raw.slice(0, 120);
-	}
-}
-//#endregion
-//#region ../server/src/compute/remote-definition.ts
-/**
-* Remote-definition fetch: SSRF-guarded, size-capped, timed, and TTL-cached.
-*
-* A solve can reference its `.gh` by remote URL instead of a stored blob. That
-* URL is attacker-controllable (a share-token caller supplies `definitionUrl`),
-* so every fetch runs through {@link assertSafeRemoteDefinitionUrl} (literal +
-* DNS host validation, blocking private/loopback/link-local targets and
-* literal-encoding bypasses), streams the body with an early size cap, and
-* bounds the wall time with a deadline.
-*
-* The TTL cache is a per-fetcher `Map<url, {data, fetchedAt}>` so repeated
-* solves of the same remote definition skip the network. It's created by
-* {@link createRemoteDefinitionFetcher} rather than being module-global, so a
-* consuming app can hold one fetcher per process (the app binding does) or
-* several isolated ones (tests) without shared state leaking across them.
-*/
-/** Once the cache exceeds this many entries, evict the oldest 10 by `fetchedAt`. */
-var CACHE_MAX_ENTRIES = 50;
-var CACHE_EVICT_BATCH = 10;
-/**
-* Read a response body into memory, aborting (and throwing) as soon as the
-* running byte total exceeds `maxBytes`. Falls back to `arrayBuffer()` only when
-* the body isn't a readable stream (older fetch impls). Exported for direct use
-* and reuse; the fetcher below wraps it with SSRF + TTL.
-*/
-async function readBodyWithCap(response, maxBytes, controller) {
-	if (!response.body) {
-		const buffer = await response.arrayBuffer();
-		if (buffer.byteLength > maxBytes) throw new Error("Remote definition exceeds size limit");
-		return new Uint8Array(buffer);
-	}
-	const reader = response.body.getReader();
-	const chunks = [];
-	let total = 0;
-	while (true) {
-		const { done, value } = await reader.read();
-		if (done) break;
-		total += value.byteLength;
-		if (total > maxBytes) {
-			controller.abort();
-			throw new Error("Remote definition exceeds size limit");
-		}
-		chunks.push(value);
-	}
-	const out = new Uint8Array(total);
-	let offset = 0;
-	for (const chunk of chunks) {
-		out.set(chunk, offset);
-		offset += chunk.byteLength;
-	}
-	return out;
-}
-/**
-* Build a remote-definition fetcher owning its own TTL cache. Each fetcher's
-* cache is independent, so one per process shares warm bytes while test fetchers
-* stay isolated.
-*/
-function createRemoteDefinitionFetcher(config) {
-	const cache = /* @__PURE__ */ new Map();
-	const logger = config.logger ?? new NoopLogger();
-	return { async load(url) {
-		await assertSafeRemoteDefinitionUrl(url, logger);
-		const now = config.now();
-		const cached = cache.get(url);
-		if (cached && now - cached.fetchedAt < config.cacheTtlMs) return cached.data;
-		const controller = new AbortController();
-		const timeout = setTimeout(() => controller.abort(), config.fetchTimeoutMs);
-		let data;
-		try {
-			const response = await fetch(url, {
-				signal: controller.signal,
-				redirect: "error"
-			});
-			if (!response.ok) throw new Error(`HTTP ${response.status}: ${response.statusText}`);
-			const declared = Number(response.headers.get("content-length"));
-			if (Number.isFinite(declared) && declared > config.maxBytes) throw new Error("Remote definition exceeds size limit");
-			data = await readBodyWithCap(response, config.maxBytes, controller);
-		} finally {
-			clearTimeout(timeout);
-		}
-		cache.set(url, {
-			data,
-			fetchedAt: now
-		});
-		if (cache.size > CACHE_MAX_ENTRIES) {
-			const entries = Array.from(cache.entries());
-			entries.sort((a, b) => a[1].fetchedAt - b[1].fetchedAt);
-			for (let i = 0; i < CACHE_EVICT_BATCH; i++) cache.delete(entries[i][0]);
-		}
-		return data;
-	} };
-}
-
-export { adaptEnvelopeToEncoding as a, createRemoteDefinitionFetcher as c, runSolvePipeline as r };
-//# sourceMappingURL=compute.js-DGTy3YjO.js.map