@selvajs/server 0.2.0-beta.2 → 0.2.0-beta.3

package/src/compute/limits.ts

@@ -38,6 +38,23 @@ export function readPositiveInt(env: EnvRecord, name: string, fallback: number):
 	return Math.floor(parsed);
 }
 
+/**
+ * Parse a non-negative integer env value — like {@link readPositiveInt} but `0`
+ * is a valid value (used by knobs where `0` means "disable", e.g. a cache
+ * budget). Returns `fallback` when absent, and warns + falls back when present
+ * but not a finite non-negative number.
+ */
+export function readNonNegativeInt(env: EnvRecord, name: string, fallback: number): number {
+	const raw = env[name];
+	if (!raw) return fallback;
+	const parsed = Number(raw);
+	if (!Number.isFinite(parsed) || parsed < 0) {
+		console.warn(`[selva] Invalid ${name}=${raw}, falling back to ${fallback}`);
+		return fallback;
+	}
+	return Math.floor(parsed);
+}
+
 /**
  * Parse a boolean env flag. Accepts `true/1/yes/on` (case-insensitive) as true
  * and `false/0/no/off` as false; any other / absent value falls back.
@@ -125,6 +142,51 @@ export interface ComputeLimits {
 	 * app instances each apply their own cap.
 	 */
 	computeMaxConcurrentSolves: number;
+	/**
+	 * Backpressure — max solves allowed to WAIT in the per-server FIFO queue (i.e.
+	 * excluding the `computeMaxConcurrentSolves` already in flight). A solve that
+	 * arrives to a full queue is shed immediately (scheduler `QUEUE_FULL`, mapped
+	 * to HTTP 503 + `Retry-After`) instead of piling up unbounded. `0` = unbounded
+	 * (the pre-shedding default): the queue grows without limit, matching prior
+	 * behavior. Size it to roughly 2–3× `computeMaxConcurrentSolves` once the
+	 * Rhino pool's real capacity is known — shedding fast beats a hung request.
+	 */
+	computeMaxQueueDepth: number;
+	/**
+	 * Backpressure — longest (ms) a solve may sit QUEUED before it starts
+	 * executing; still-waiting past this it's shed (scheduler `QUEUE_TIMEOUT` →
+	 * HTTP 503 + `Retry-After`) rather than burning compute on a stale request.
+	 * Bounds tail latency: the scheduler's `timeoutMs` clock starts at execution,
+	 * so without this a solve's total wait is unbounded and invisible. `0` = no
+	 * queue deadline (the default). A sensible tuned value is ≈ `maxSolveDurationMs`.
+	 */
+	computeQueueWaitMs: number;
+	/**
+	 * Total-byte budget (bytes) for the in-process definition-byte cache keyed on
+	 * immutable version id. A warm entry lets a solve skip `storage.get` entirely,
+	 * and a pointer-known solve never loads bytes at all. `0` disables the cache
+	 * (every solve re-reads storage). Sized as a total-byte LRU because definitions
+	 * span KB→hundreds of MB; env value is MB, converted here.
+	 */
+	computeDefinitionByteCacheBytes: number;
+	/**
+	 * Default per-definition entry quota for the durable L2 solve cache (H1), used
+	 * when a definition's `solveCacheLimit` is absent (inherit). A definition may
+	 * override this; `0` on the definition turns caching off for it. This global
+	 * default `0` means the L2 is effectively off until an operator sets a quota —
+	 * safe because the memory backend also ships only under
+	 * `SOLVE_CACHE_PROVIDER=memory`. Counts, not bytes: authors think in "how many
+	 * solves to remember"; the byte backstop below is the operator's memory guard.
+	 */
+	solveCacheDefaultMaxEntries: number;
+	/**
+	 * Global byte backstop (bytes) across ALL definitions' L2 entries, evicted
+	 * global-LRU regardless of per-definition counts. Entries range KB→100s of MB,
+	 * so a count quota alone can't bound memory. `0` disables the backstop (rely on
+	 * per-definition counts only — not recommended in the memory backend). Env value
+	 * is MB, converted here. On Redis this moves to `maxmemory allkeys-lru`.
+	 */
+	solveCacheMaxTotalBytes: number;
 }
 
 /**
@@ -154,6 +216,22 @@ export function resolveComputeLimits(env: EnvRecord): ComputeLimits {
 		computeServerCachesolve: readBool(env, 'COMPUTE_SERVER_CACHESOLVE', true),
 		computeCacheErroredSolves: readBool(env, 'COMPUTE_CACHE_ERRORED_SOLVES', false),
 		// 4 matches rhino.compute's default --childcount; tune to the actual VM.
-		computeMaxConcurrentSolves: readPositiveInt(env, 'COMPUTE_MAX_CONCURRENT', 4)
+		computeMaxConcurrentSolves: readPositiveInt(env, 'COMPUTE_MAX_CONCURRENT', 4),
+		// Both 0 (unbounded / no deadline) by default — nothing sheds until an
+		// operator who's measured their pool opts in. readNonNegativeInt so `0` is a
+		// valid "disabled" value, not treated as invalid.
+		computeMaxQueueDepth: readNonNegativeInt(env, 'COMPUTE_MAX_QUEUE_DEPTH', 0),
+		computeQueueWaitMs: readNonNegativeInt(env, 'COMPUTE_QUEUE_WAIT_MS', 0),
+		// Env is MB; 0 disables. Default 256 MB holds a handful of typical
+		// definitions warm without pinning gigabytes. readNonNegativeInt so `0`
+		// (disable) is honored rather than treated as invalid.
+		computeDefinitionByteCacheBytes:
+			readNonNegativeInt(env, 'COMPUTE_DEFINITION_BYTE_CACHE_MB', 256) * MB,
+		// L2 durable solve cache (H1). Default per-definition quota 0 = inherit-to-off
+		// until an operator opts in; the memory backend also only mounts under
+		// SOLVE_CACHE_PROVIDER=memory, so nothing caches by accident. Byte backstop
+		// 512 MB caps total heap use across all definitions (env is MB).
+		solveCacheDefaultMaxEntries: readNonNegativeInt(env, 'SOLVE_CACHE_DEFAULT_MAX_ENTRIES', 0),
+		solveCacheMaxTotalBytes: readNonNegativeInt(env, 'SOLVE_CACHE_MAX_TOTAL_MB', 512) * MB
 	};
 }

package/src/compute/solve-cache-envelope.ts

@@ -0,0 +1,98 @@
+/**
+ * L2 cache entry format (R6). An entry is the gzipped response body plus a tiny
+ * metadata header, so a hit is near-CPU-free: no `JSON.stringify`, no re-solve —
+ * gzip clients get the stored bytes verbatim, and the header carries just enough
+ * to rebuild the `ok` outcome (error/warning counts for the metric, uncompressed
+ * length for the `Content-Length` on a gunzip fallback).
+ *
+ * Wire layout (opaque to the `ISolveResultCache` backend, which sees only bytes):
+ *
+ *   [ 4 bytes: header length N, big-endian uint32 ]
+ *   [ N bytes: UTF-8 JSON EnvelopeHeader ]
+ *   [ rest:    gzipped JSON response body ]
+ *
+ * The `algo` echo (M3) is already stripped at the source in the package's
+ * `runSolve`, so the body never carries the base64 definition — entries stay
+ * small without a strip step here.
+ */
+
+import { gunzipSync } from 'node:zlib';
+
+/** Metadata stored beside the gzipped body. Small; parsed on every hit. */
+export interface EnvelopeHeader {
+	/** Grasshopper runtime error count, for the solve metric. */
+	errorCount: number;
+	/** Grasshopper runtime warning count, for the solve metric. */
+	warningCount: number;
+	/** Uncompressed JSON body length in bytes (Content-Length for a gunzip fallback). */
+	serializedBytes: number;
+	/**
+	 * SHA-256 hex of the canonical input preimage (H2 defense-in-depth). A hit
+	 * verifies this equals the requesting key's hash before serving — a wide-hash
+	 * collision that produced the same storage key still can't serve the wrong
+	 * geometry.
+	 */
+	inputHash: string;
+}
+
+/**
+ * Encode a cache entry from the gzipped body + header. The body MUST already be
+ * gzipped (the pipeline gzips before storing so every hit serves compressed
+ * bytes; a rare non-gzip client gunzips on read).
+ */
+export function encodeSolveCacheEntry(header: EnvelopeHeader, gzippedBody: Uint8Array): Uint8Array {
+	const headerJson = Buffer.from(JSON.stringify(header), 'utf8');
+	const out = Buffer.allocUnsafe(4 + headerJson.byteLength + gzippedBody.byteLength);
+	out.writeUInt32BE(headerJson.byteLength, 0);
+	headerJson.copy(out, 4);
+	Buffer.from(gzippedBody.buffer, gzippedBody.byteOffset, gzippedBody.byteLength).copy(
+		out,
+		4 + headerJson.byteLength
+	);
+	return out;
+}
+
+/** A decoded entry: the parsed header + the still-gzipped body slice. */
+export interface DecodedSolveCacheEntry {
+	header: EnvelopeHeader;
+	gzippedBody: Uint8Array;
+}
+
+/**
+ * Decode a cache entry. Returns `null` on any malformed input (truncated, bad
+ * length prefix, non-JSON header) — a corrupt entry is treated as a miss, never
+ * an error, matching the best-effort cache contract.
+ */
+export function decodeSolveCacheEntry(bytes: Uint8Array): DecodedSolveCacheEntry | null {
+	if (bytes.byteLength < 4) return null;
+	const buf = Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+	const headerLen = buf.readUInt32BE(0);
+	const headerEnd = 4 + headerLen;
+	if (headerEnd > buf.byteLength) return null;
+	let header: EnvelopeHeader;
+	try {
+		header = JSON.parse(buf.toString('utf8', 4, headerEnd)) as EnvelopeHeader;
+	} catch {
+		return null;
+	}
+	if (
+		typeof header?.errorCount !== 'number' ||
+		typeof header?.warningCount !== 'number' ||
+		typeof header?.serializedBytes !== 'number' ||
+		typeof header?.inputHash !== 'string'
+	) {
+		return null;
+	}
+	// Slice (view, no copy) of the gzipped remainder.
+	const gzippedBody = new Uint8Array(
+		bytes.buffer,
+		bytes.byteOffset + headerEnd,
+		bytes.byteLength - headerEnd
+	);
+	return { header, gzippedBody };
+}
+
+/** Gunzip a stored body back to the JSON string, for a non-gzip client (rare). */
+export function gunzipEntryBody(gzippedBody: Uint8Array): string {
+	return gunzipSync(gzippedBody).toString('utf8');
+}

package/src/compute/solve-cache-key.ts

@@ -0,0 +1,85 @@
+/**
+ * Durable L2 cache-key derivation (H2 / R8 / R13).
+ *
+ * The in-process L1 cache keys on a 32-bit FNV hash — fine for a 20-entry Map,
+ * unsafe for a durable, cross-user cache where a collision serves user A's
+ * geometry to user B (CONTEXT.md L92–97 records exactly this bug shipping once).
+ * So the L2 key is a wide SHA-256 hash, and the entry stores the canonical
+ * preimage so a hit can compare it byte-for-byte (defense-in-depth).
+ *
+ * What goes into the key:
+ *   - The **transformed** input tree (R13) — the exact tree handed to the
+ *     scheduler, canonicalized with the package's exported `stableStringify` so
+ *     the L2 key parity-matches the L1 canonicalization path.
+ *   - A **config subset** (R8): everything OTHER than definition+inputs that
+ *     changes a solve's result — model units, tolerances, `dataversion`, the
+ *     compute contract version, and (when known) the Rhino server identity. A
+ *     durable key of `(versionId, inputHash)` alone would collide across
+ *     differing server configs or Rhino versions.
+ *
+ * `versionId`, `definitionId`, and `orgId` are NOT hashed in here — they're
+ * separate parts of the {@link SolveCacheKey} tuple so the backend can scope its
+ * keyspace (per-definition quota, per-org isolation) without unpacking the hash.
+ */
+
+import { createHash } from 'node:crypto';
+import { stableStringify } from '@selvajs/compute';
+import { COMPUTE_CONTRACT_VERSION } from './solve-pipeline.js';
+
+/**
+ * Solve-affecting configuration folded into the key alongside the input tree.
+ * Every field here is something that, if it changed, would legitimately change
+ * the solve output for the SAME definition + inputs. Assemble it from the app's
+ * resolved solve config; unset fields are simply absent from the canonical form.
+ */
+export interface SolveCacheConfigSubset {
+	/** Rhino model unit system, if the app pins one (else the definition/server default). */
+	modelUnits?: string;
+	/** Absolute tolerance, if pinned. */
+	absoluteTolerance?: number;
+	/** Angle tolerance, if pinned. */
+	angleTolerance?: number;
+	/** Grasshopper `dataversion` / data-tree schema version, if pinned. */
+	dataVersion?: number | string;
+	/**
+	 * Compute-server identity (id or URL). Folds in because two servers can run
+	 * different Rhino/plugin versions that yield different geometry for the same
+	 * inputs. Optional — omit for a single-pool deployment where it's constant.
+	 */
+	computeServerId?: string;
+}
+
+/** The canonical preimage + its SHA-256 digest. Store both in the L2 entry header. */
+export interface SolveCacheInputKey {
+	/** The canonical string that was hashed (for hit-time byte comparison). */
+	canonical: string;
+	/** SHA-256 hex of {@link canonical} — the `inputKey` part of the storage key. */
+	hash: string;
+}
+
+/**
+ * Derive the durable `inputKey` from the transformed input tree and the solve
+ * config subset. Deterministic and stable across processes/instances: the same
+ * tree + config always produce the same hash, which is what lets a shared cache
+ * hit across app instances.
+ *
+ * @param transformedTree the tree AFTER `transformInputParameter`/`TreeBuilder`
+ *   (R13) — the exact object handed to `scheduler.solve`.
+ * @param config solve-affecting config (R8); `COMPUTE_CONTRACT_VERSION` is folded
+ *   in automatically so a wire-contract bump invalidates old entries for free.
+ */
+export function deriveSolveCacheInputKey(
+	transformedTree: unknown,
+	config: SolveCacheConfigSubset
+): SolveCacheInputKey {
+	// stableStringify sorts keys deterministically — same content, same string,
+	// regardless of property insertion order. Tag each part so a value can't shift
+	// across the tree/config boundary and collide (e.g. tree "]" meeting config "[").
+	const canonical = stableStringify({
+		v: COMPUTE_CONTRACT_VERSION,
+		tree: transformedTree,
+		config
+	});
+	const hash = createHash('sha256').update(canonical).digest('hex');
+	return { canonical, hash };
+}

package/src/compute/solve-cache-single-flight.ts

@@ -0,0 +1,59 @@
+/**
+ * In-process single-flight (R4) — dogpile protection above the L2 cache.
+ *
+ * N identical live solves arriving while the first is still running would each
+ * enqueue and each hit Rhino (the scheduler has no in-flight coalescing, and
+ * Rhino's `cachesolve` still costs a round trip per repeat). The classic cold-key
+ * stampede: a hot public definition + a deploy = a thundering herd onto compute.
+ *
+ * This coalesces them: the first caller for a key runs the work; concurrent
+ * callers for the SAME key await the same promise and share its result. Once the
+ * work settles (resolve OR reject), the key is released so the next request runs
+ * fresh — the map never retains a settled entry, so it can't serve a stale
+ * result or leak memory.
+ *
+ * It sits ABOVE the `ISolveResultCache` interface (in-process, per app instance).
+ * A cross-instance lease (Redis `SET NX`) is a later backend capability; this is
+ * the free first slice that covers the common same-instance burst.
+ *
+ * Correctness note: the shared promise resolves to ONE value for all waiters, so
+ * the wrapped work must return an immutable / independently-serializable result
+ * (the solve pipeline returns a fresh envelope object — safe to share by
+ * reference here because the app serializes it per response).
+ */
+
+export interface SolveCacheSingleFlight {
+	/**
+	 * Run `work` under `key`, coalescing concurrent identical calls. The first
+	 * caller executes; overlapping callers for the same key await the same promise.
+	 * The key is freed as soon as the promise settles (success or failure).
+	 */
+	run<T>(key: string, work: () => Promise<T>): Promise<T>;
+	/** Number of keys currently in flight (observability / tests). */
+	inFlight(): number;
+}
+
+export function createSolveCacheSingleFlight(): SolveCacheSingleFlight {
+	const inflight = new Map<string, Promise<unknown>>();
+
+	return {
+		run<T>(key: string, work: () => Promise<T>): Promise<T> {
+			const existing = inflight.get(key);
+			if (existing) return existing as Promise<T>;
+
+			// `.finally` releases the key on both settle paths. Start the work inside
+			// the promise chain so a synchronous throw in `work` still rejects the
+			// shared promise (and still frees the key) rather than escaping.
+			const p = (async () => work())().finally(() => {
+				// Only delete if it's still OUR promise — a key freed and re-taken by a
+				// later caller must not be clobbered.
+				if (inflight.get(key) === p) inflight.delete(key);
+			});
+			inflight.set(key, p);
+			return p;
+		},
+		inFlight(): number {
+			return inflight.size;
+		}
+	};
+}