@selvajs/server 0.2.0-beta.3 → 0.2.0-beta.5

package/src/compute/index.ts

@@ -1,82 +0,0 @@
-// Compute/solve server building blocks — transport-agnostic, env-injected.
-
-export {
-	resolveComputeLimits,
-	readPositiveInt,
-	readNonNegativeInt,
-	readBool,
-	type ComputeLimits,
-	type EnvRecord
-} from './limits.js';
-
-export {
-	createDefinitionByteCache,
-	type DefinitionByteCache,
-	type ByteCacheRef,
-	type ByteCacheStats
-} from './definition-byte-cache.js';
-
-export {
-	createMemorySolveResultCache,
-	type MemorySolveResultCache,
-	type SolveCacheStats
-} from './memory-solve-cache.js';
-
-export {
-	deriveSolveCacheInputKey,
-	type SolveCacheConfigSubset,
-	type SolveCacheInputKey
-} from './solve-cache-key.js';
-
-export {
-	encodeSolveCacheEntry,
-	decodeSolveCacheEntry,
-	gunzipEntryBody,
-	type EnvelopeHeader,
-	type DecodedSolveCacheEntry
-} from './solve-cache-envelope.js';
-
-export {
-	createSolveCacheSingleFlight,
-	type SolveCacheSingleFlight
-} from './solve-cache-single-flight.js';
-
-export {
-	createComputeRateLimiter,
-	type ComputeRateLimiter,
-	type ComputeRateLimiterConfig,
-	type RateLimitResult
-} from './rate-limit.js';
-
-export { isSafeRemoteDefinitionUrl, assertSafeRemoteDefinitionUrl } from './safe-url.js';
-
-export { transformInputParameter } from './transform-input.js';
-
-export {
-	createClientCache,
-	serverIdentity,
-	type ClientCache,
-	type ClientCacheConfig,
-	type CachedClient,
-	type ResolvedServer,
-	type ServerIdentity
-} from './client-cache.js';
-
-export {
-	createRemoteDefinitionFetcher,
-	readBodyWithCap,
-	type RemoteDefinitionFetcher,
-	type RemoteDefinitionConfig
-} from './remote-definition.js';
-
-export {
-	runSolvePipeline,
-	COMPUTE_CONTRACT_VERSION,
-	COMPUTE_VERSION_HEADER,
-	type SolvePipelineArgs,
-	type SolvePipelineCacheHook,
-	type SolveOutcome,
-	type SolveEnvelope,
-	type SolvePhaseMetrics,
-	type PipelineInput
-} from './solve-pipeline.js';

package/src/compute/limits.ts

@@ -1,237 +0,0 @@
-/**
- * Compute/solve server limits, resolved from an injected env map.
- *
- * This is the transport- and framework-agnostic core: it takes a plain
- * `Record<string, string | undefined>` (the caller passes SvelteKit's
- * `$env/dynamic/private`, `process.env`, or any config source) and returns a
- * fully-resolved `ComputeLimits` object. No ambient `$env` / `process.env`
- * read happens here, so the module is importable from any runtime and testable
- * without env plumbing.
- *
- * Every knob is env-overridable so deployments can tune without code changes;
- * the defaults are sized for typical interactive use (sliders + small uploads).
- * Centralizing them surfaces the tradeoffs (raise the rate cap → also consider
- * the body cap) at one glance.
- *
- * Client-side counterparts (the in-flight compute throttle and slider debounce)
- * live in `@selvajs/ui` and are bundled into the client, so they can't read
- * env — they carry their own defaults.
- */
-
-const MB = 1024 * 1024;
-
-/** Env source: any string→string map. `$env/dynamic/private` satisfies this. */
-export type EnvRecord = Record<string, string | undefined>;
-
-/**
- * Parse a positive integer env value. Returns `fallback` when absent, and warns
- * + falls back when present but not a finite positive number.
- */
-export function readPositiveInt(env: EnvRecord, name: string, fallback: number): number {
-	const raw = env[name];
-	if (!raw) return fallback;
-	const parsed = Number(raw);
-	if (!Number.isFinite(parsed) || parsed <= 0) {
-		console.warn(`[selva] Invalid ${name}=${raw}, falling back to ${fallback}`);
-		return fallback;
-	}
-	return Math.floor(parsed);
-}
-
-/**
- * Parse a non-negative integer env value — like {@link readPositiveInt} but `0`
- * is a valid value (used by knobs where `0` means "disable", e.g. a cache
- * budget). Returns `fallback` when absent, and warns + falls back when present
- * but not a finite non-negative number.
- */
-export function readNonNegativeInt(env: EnvRecord, name: string, fallback: number): number {
-	const raw = env[name];
-	if (!raw) return fallback;
-	const parsed = Number(raw);
-	if (!Number.isFinite(parsed) || parsed < 0) {
-		console.warn(`[selva] Invalid ${name}=${raw}, falling back to ${fallback}`);
-		return fallback;
-	}
-	return Math.floor(parsed);
-}
-
-/**
- * Parse a boolean env flag. Accepts `true/1/yes/on` (case-insensitive) as true
- * and `false/0/no/off` as false; any other / absent value falls back.
- */
-export function readBool(env: EnvRecord, name: string, fallback: boolean): boolean {
-	const raw = env[name];
-	if (raw == null || raw === '') return fallback;
-	const v = raw.trim().toLowerCase();
-	if (v === 'true' || v === '1' || v === 'yes' || v === 'on') return true;
-	if (v === 'false' || v === '0' || v === 'no' || v === 'off') return false;
-	console.warn(`[selva] Invalid ${name}=${raw}, falling back to ${fallback}`);
-	return fallback;
-}
-
-/** Fully-resolved server-side compute limits. */
-export interface ComputeLimits {
-	/**
-	 * Longest the app waits for one solve. Enforced by the SolveScheduler
-	 * (`@selvajs/compute`), which propagates AbortSignal into the upstream
-	 * Compute call — a timeout actually cancels the work. Forwarded to the
-	 * client to drive the in-browser AbortController.
-	 *
-	 * Caveat: bounds only the parts of the stack we own. A reverse proxy or
-	 * serverless platform cap may shoot the request sooner; bumping past those
-	 * caps produces 502s, not longer solves.
-	 */
-	maxSolveDurationMs: number;
-	/** Fixed-window cap on /api/compute: window length + max requests per window. */
-	rateLimitWindowMs: number;
-	rateLimitMaxRequests: number;
-	/**
-	 * Largest .gh definition accepted on upload AND the largest remote definition
-	 * fetched for compute — kept in lockstep so a remote URL can't smuggle a file
-	 * past the upload cap.
-	 */
-	maxGhFileSize: number;
-	maxImageFileSize: number;
-	/**
-	 * /api/compute JSON *request* body cap (inputs + values, not the .gh). A
-	 * `file`-widget input embeds geometry as base64 in `values`; must stay <=
-	 * the adapter-node global BODY_SIZE_LIMIT or the global backstop rejects first.
-	 */
-	computeRequestMaxBytes: number;
-	/**
-	 * /api/compute JSON *response* cap. A `file`-typed output is base64-embedded
-	 * in the response; guards V8's ~512 MB single-string wall (a `JSON.stringify`
-	 * `RangeError`) and browser-tab OOM. Defensive backstop → clear 413 instead of
-	 * an opaque crash (real fix is out-of-band streaming, ADR 0003).
-	 */
-	computeResponseMaxBytes: number;
-	/** Hard cap on fetching a remote definition — tracks `maxGhFileSize`. */
-	remoteDefinitionMaxBytes: number;
-	/** Deadline on fetching a remote definition (slow-loris protection). */
-	remoteDefinitionFetchTimeoutMs: number;
-	/** In-process cache TTL for remote-fetched .gh bytes. */
-	definitionCacheTtlMs: number;
-	/**
-	 * Reuse the server's cached definition via a pointer instead of re-uploading
-	 * the binary each solve. SAFE only on a compute server that signals a
-	 * stale-pointer miss (VektorNode fork / a fork that throws) — a server that
-	 * returns an empty 200 would silently yield EMPTY geometry. Off for unknown
-	 * / standard rhino.compute.
-	 */
-	computeReuseDefinitionCache: boolean;
-	/**
-	 * Ask Rhino.Compute to cache solve RESULTS keyed on the full request and
-	 * return a cached result on an identical repeat. Server-wide (survives Selva
-	 * restarts, spans instances). Only helps IDENTICAL re-solves.
-	 */
-	computeServerCachesolve: boolean;
-	/**
-	 * Also cache solves that reported Grasshopper errors — correct for
-	 * error-by-design definitions (guarded Python, pruned branches) that still
-	 * produce valid geometry. Requires `computeServerCachesolve` and a server
-	 * honoring the flag. Conservative default off.
-	 */
-	computeCacheErroredSolves: boolean;
-	/**
-	 * Max in-flight solves this app instance sends to ONE compute server
-	 * (forwarded as the SolveScheduler's `maxConcurrent`; excess solves FIFO-queue).
-	 * Size it to the server's `compute.geometry` child count — Rhino.Compute
-	 * spawns N children per VM precisely to run N solves concurrently, and a
-	 * lower value idles that capacity while users queue (audit B6: the scheduler's
-	 * queue-mode default is 1, which serialized ALL solves per server). Multiple
-	 * app instances each apply their own cap.
-	 */
-	computeMaxConcurrentSolves: number;
-	/**
-	 * Backpressure — max solves allowed to WAIT in the per-server FIFO queue (i.e.
-	 * excluding the `computeMaxConcurrentSolves` already in flight). A solve that
-	 * arrives to a full queue is shed immediately (scheduler `QUEUE_FULL`, mapped
-	 * to HTTP 503 + `Retry-After`) instead of piling up unbounded. `0` = unbounded
-	 * (the pre-shedding default): the queue grows without limit, matching prior
-	 * behavior. Size it to roughly 2–3× `computeMaxConcurrentSolves` once the
-	 * Rhino pool's real capacity is known — shedding fast beats a hung request.
-	 */
-	computeMaxQueueDepth: number;
-	/**
-	 * Backpressure — longest (ms) a solve may sit QUEUED before it starts
-	 * executing; still-waiting past this it's shed (scheduler `QUEUE_TIMEOUT` →
-	 * HTTP 503 + `Retry-After`) rather than burning compute on a stale request.
-	 * Bounds tail latency: the scheduler's `timeoutMs` clock starts at execution,
-	 * so without this a solve's total wait is unbounded and invisible. `0` = no
-	 * queue deadline (the default). A sensible tuned value is ≈ `maxSolveDurationMs`.
-	 */
-	computeQueueWaitMs: number;
-	/**
-	 * Total-byte budget (bytes) for the in-process definition-byte cache keyed on
-	 * immutable version id. A warm entry lets a solve skip `storage.get` entirely,
-	 * and a pointer-known solve never loads bytes at all. `0` disables the cache
-	 * (every solve re-reads storage). Sized as a total-byte LRU because definitions
-	 * span KB→hundreds of MB; env value is MB, converted here.
-	 */
-	computeDefinitionByteCacheBytes: number;
-	/**
-	 * Default per-definition entry quota for the durable L2 solve cache (H1), used
-	 * when a definition's `solveCacheLimit` is absent (inherit). A definition may
-	 * override this; `0` on the definition turns caching off for it. This global
-	 * default `0` means the L2 is effectively off until an operator sets a quota —
-	 * safe because the memory backend also ships only under
-	 * `SOLVE_CACHE_PROVIDER=memory`. Counts, not bytes: authors think in "how many
-	 * solves to remember"; the byte backstop below is the operator's memory guard.
-	 */
-	solveCacheDefaultMaxEntries: number;
-	/**
-	 * Global byte backstop (bytes) across ALL definitions' L2 entries, evicted
-	 * global-LRU regardless of per-definition counts. Entries range KB→100s of MB,
-	 * so a count quota alone can't bound memory. `0` disables the backstop (rely on
-	 * per-definition counts only — not recommended in the memory backend). Env value
-	 * is MB, converted here. On Redis this moves to `maxmemory allkeys-lru`.
-	 */
-	solveCacheMaxTotalBytes: number;
-}
-
-/**
- * Resolve every server-side compute limit from an env map. Pure: the same env
- * always yields the same limits, and nothing is read ambiently. The app calls
- * this once at its composition root with `$env/dynamic/private`.
- */
-export function resolveComputeLimits(env: EnvRecord): ComputeLimits {
-	const maxGhFileSize = readPositiveInt(env, 'MAX_GH_FILE_SIZE_BYTES', 300 * MB);
-	return {
-		maxSolveDurationMs: readPositiveInt(env, 'MAX_SOLVE_DURATION_MS', 100_000),
-		rateLimitWindowMs: readPositiveInt(env, 'COMPUTE_RATE_LIMIT_WINDOW_MS', 100_000),
-		rateLimitMaxRequests: readPositiveInt(env, 'COMPUTE_RATE_LIMIT_MAX', 120),
-		maxGhFileSize,
-		maxImageFileSize: readPositiveInt(env, 'MAX_IMAGE_FILE_SIZE_BYTES', 10 * MB),
-		computeRequestMaxBytes: readPositiveInt(env, 'COMPUTE_REQUEST_MAX_BYTES', 300 * MB),
-		computeResponseMaxBytes: readPositiveInt(env, 'COMPUTE_RESPONSE_MAX_BYTES', 300 * MB),
-		// Tracks the upload cap so a remote URL can't smuggle a larger file.
-		remoteDefinitionMaxBytes: maxGhFileSize,
-		remoteDefinitionFetchTimeoutMs: readPositiveInt(
-			env,
-			'REMOTE_DEFINITION_FETCH_TIMEOUT_MS',
-			30_000
-		),
-		definitionCacheTtlMs: readPositiveInt(env, 'DEFINITION_CACHE_TTL_MS', 5 * 60 * 1000),
-		computeReuseDefinitionCache: readBool(env, 'COMPUTE_REUSE_DEFINITION_CACHE', true),
-		computeServerCachesolve: readBool(env, 'COMPUTE_SERVER_CACHESOLVE', true),
-		computeCacheErroredSolves: readBool(env, 'COMPUTE_CACHE_ERRORED_SOLVES', false),
-		// 4 matches rhino.compute's default --childcount; tune to the actual VM.
-		computeMaxConcurrentSolves: readPositiveInt(env, 'COMPUTE_MAX_CONCURRENT', 4),
-		// Both 0 (unbounded / no deadline) by default — nothing sheds until an
-		// operator who's measured their pool opts in. readNonNegativeInt so `0` is a
-		// valid "disabled" value, not treated as invalid.
-		computeMaxQueueDepth: readNonNegativeInt(env, 'COMPUTE_MAX_QUEUE_DEPTH', 0),
-		computeQueueWaitMs: readNonNegativeInt(env, 'COMPUTE_QUEUE_WAIT_MS', 0),
-		// Env is MB; 0 disables. Default 256 MB holds a handful of typical
-		// definitions warm without pinning gigabytes. readNonNegativeInt so `0`
-		// (disable) is honored rather than treated as invalid.
-		computeDefinitionByteCacheBytes:
-			readNonNegativeInt(env, 'COMPUTE_DEFINITION_BYTE_CACHE_MB', 256) * MB,
-		// L2 durable solve cache (H1). Default per-definition quota 0 = inherit-to-off
-		// until an operator opts in; the memory backend also only mounts under
-		// SOLVE_CACHE_PROVIDER=memory, so nothing caches by accident. Byte backstop
-		// 512 MB caps total heap use across all definitions (env is MB).
-		solveCacheDefaultMaxEntries: readNonNegativeInt(env, 'SOLVE_CACHE_DEFAULT_MAX_ENTRIES', 0),
-		solveCacheMaxTotalBytes: readNonNegativeInt(env, 'SOLVE_CACHE_MAX_TOTAL_MB', 512) * MB
-	};
-}

package/src/compute/rate-limit.ts

@@ -1,110 +0,0 @@
-/**
- * Per-key fixed-window rate limiter for the compute-solve endpoint. Compute
- * solves are the one expensive endpoint in a Selva-engine app — without a cap a
- * single authenticated user (or share-link consumer) can burn through compute
- * budget far faster than any other surface allows.
- *
- * Design:
- *  - Process-local `Map`. Multi-instance deployments see N× the per-key rate —
- *    acceptable as a first line; a distributed limiter is a follow-up. The state
- *    lives behind this factory so a shared-store implementation can slot in
- *    later without changing the call sites.
- *  - Fixed window (vs sliding) — simpler, no per-request bookkeeping; the
- *    "burst at window edges" mode is fine here (share-link `maxSolves` and
- *    per-user auth already prevent unbounded abuse — this flattens short spikes).
- *  - Keyed by caller — the app passes `user:{userId}` for authenticated solves,
- *    `share:{linkId}` for share-token solves, so anonymous consumers of one link
- *    don't share a bucket with the link's owner.
- *
- * The window + cap are injected (they live in `ComputeLimits`), so this module
- * reads no env of its own.
- *
- * Not compute-only despite the name: `peek` + `clear` make it usable for
- * failure-counting flows too (login limiting keys by IP, records only failed
- * attempts via `check`, and forgives on success via `clear`).
- */
-
-export interface RateLimitResult {
-	allowed: boolean;
-	/** Seconds until the bucket resets, when not allowed. */
-	retryAfter?: number;
-}
-
-export interface ComputeRateLimiterConfig {
-	/** Fixed-window length in ms. */
-	windowMs: number;
-	/** Max requests admitted per key per window. */
-	maxPerWindow: number;
-}
-
-export interface ComputeRateLimiter {
-	/**
-	 * Check + record one request against `key`. Increments the counter on allow.
-	 * Returns `{ allowed: false, retryAfter }` once the bucket is full.
-	 */
-	check(key: string): RateLimitResult;
-	/**
-	 * Check WITHOUT recording. For flows that only count selected outcomes —
-	 * e.g. login limiting, where `peek` gates the attempt and `check` records
-	 * only failures (a success calls `clear` instead).
-	 */
-	peek(key: string): RateLimitResult;
-	/** Drop `key`'s bucket — e.g. a successful login forgives prior failures. */
-	clear(key: string): void;
-	/** Test seam — wipes in-memory state. Production code never calls this. */
-	reset(): void;
-	/** The resolved config, exposed for time-based test assertions. */
-	readonly config: Readonly<ComputeRateLimiterConfig>;
-}
-
-interface BucketEntry {
-	count: number;
-	resetAt: number;
-}
-
-/**
- * Build a process-local fixed-window rate limiter. Each limiter owns its own
- * bucket `Map`, so distinct endpoints/keys-spaces don't collide.
- */
-export function createComputeRateLimiter(config: ComputeRateLimiterConfig): ComputeRateLimiter {
-	const { windowMs, maxPerWindow } = config;
-	const buckets = new Map<string, BucketEntry>();
-
-	return {
-		config,
-		check(key: string): RateLimitResult {
-			const now = Date.now();
-			const entry = buckets.get(key);
-
-			if (!entry || now > entry.resetAt) {
-				buckets.set(key, { count: 1, resetAt: now + windowMs });
-				return { allowed: true };
-			}
-
-			if (entry.count >= maxPerWindow) {
-				return { allowed: false, retryAfter: Math.ceil((entry.resetAt - now) / 1000) };
-			}
-
-			entry.count += 1;
-			return { allowed: true };
-		},
-		peek(key: string): RateLimitResult {
-			const now = Date.now();
-			const entry = buckets.get(key);
-
-			if (!entry || now > entry.resetAt) {
-				return { allowed: true };
-			}
-			if (entry.count >= maxPerWindow) {
-				return { allowed: false, retryAfter: Math.ceil((entry.resetAt - now) / 1000) };
-			}
-			return { allowed: true };
-		},
-		clear(key: string): void {
-			buckets.delete(key);
-		},
-		reset(): void {
-			buckets.clear();
-		}
-	};
-}

package/src/compute/remote-definition.ts

@@ -1,149 +0,0 @@
-/**
- * Remote-definition fetch: SSRF-guarded, size-capped, timed, and TTL-cached.
- *
- * A solve can reference its `.gh` by remote URL instead of a stored blob. That
- * URL is attacker-controllable (a share-token caller supplies `definitionUrl`),
- * so every fetch runs through {@link assertSafeRemoteDefinitionUrl} (literal +
- * DNS host validation, blocking private/loopback/link-local targets and
- * literal-encoding bypasses), streams the body with an early size cap, and
- * bounds the wall time with a deadline.
- *
- * The TTL cache is a per-fetcher `Map<url, {data, fetchedAt}>` so repeated
- * solves of the same remote definition skip the network. It's created by
- * {@link createRemoteDefinitionFetcher} rather than being module-global, so a
- * consuming app can hold one fetcher per process (the app binding does) or
- * several isolated ones (tests) without shared state leaking across them.
- */
-
-import { assertSafeRemoteDefinitionUrl } from './safe-url.js';
-
-/** Injected limits — the app derives these from its env-resolved `ComputeLimits`. */
-export interface RemoteDefinitionConfig {
-	/** Hard cap on the fetched body; a lying/absent content-length can't exceed it. */
-	maxBytes: number;
-	/** Deadline on the fetch (slow-loris protection). */
-	fetchTimeoutMs: number;
-	/** How long a fetched definition stays warm in the in-process cache. */
-	cacheTtlMs: number;
-	/**
-	 * Current epoch millis. Injected (not read via `Date.now()` ambiently) so the
-	 * TTL is testable and the module stays side-effect-free. The app binding
-	 * passes `() => Date.now()`.
-	 */
-	now: () => number;
-}
-
-export interface RemoteDefinitionFetcher {
-	/**
-	 * Fetch (or return cached) `.gh` bytes for a remote URL. Throws on an unsafe
-	 * host, a non-2xx response, an oversized body, or a timeout — the caller maps
-	 * the failure to a 400.
-	 */
-	load(url: string): Promise<Uint8Array>;
-}
-
-/** Once the cache exceeds this many entries, evict the oldest 10 by `fetchedAt`. */
-const CACHE_MAX_ENTRIES = 50;
-const CACHE_EVICT_BATCH = 10;
-
-/**
- * Read a response body into memory, aborting (and throwing) as soon as the
- * running byte total exceeds `maxBytes`. Falls back to `arrayBuffer()` only when
- * the body isn't a readable stream (older fetch impls). Exported for direct use
- * and reuse; the fetcher below wraps it with SSRF + TTL.
- */
-export async function readBodyWithCap(
-	response: Response,
-	maxBytes: number,
-	controller: AbortController
-): Promise<Uint8Array> {
-	if (!response.body) {
-		const buffer = await response.arrayBuffer();
-		if (buffer.byteLength > maxBytes) throw new Error('Remote definition exceeds size limit');
-		return new Uint8Array(buffer);
-	}
-
-	const reader = response.body.getReader();
-	const chunks: Uint8Array[] = [];
-	let total = 0;
-	while (true) {
-		const { done, value } = await reader.read();
-		if (done) break;
-		total += value.byteLength;
-		if (total > maxBytes) {
-			controller.abort();
-			throw new Error('Remote definition exceeds size limit');
-		}
-		chunks.push(value);
-	}
-
-	const out = new Uint8Array(total);
-	let offset = 0;
-	for (const chunk of chunks) {
-		out.set(chunk, offset);
-		offset += chunk.byteLength;
-	}
-	return out;
-}
-
-/**
- * Build a remote-definition fetcher owning its own TTL cache. Each fetcher's
- * cache is independent, so one per process shares warm bytes while test fetchers
- * stay isolated.
- */
-export function createRemoteDefinitionFetcher(
-	config: RemoteDefinitionConfig
-): RemoteDefinitionFetcher {
-	const cache = new Map<string, { data: Uint8Array; fetchedAt: number }>();
-
-	return {
-		async load(url: string): Promise<Uint8Array> {
-			// Resolves the host and rejects when any resolved IP is private/loopback/
-			// link-local — covers literal-encoding bypasses (integer/octal/hex/short-form,
-			// IPv4-mapped IPv6) and public names that point inward. Throws on rejection.
-			await assertSafeRemoteDefinitionUrl(url);
-
-			const now = config.now();
-			const cached = cache.get(url);
-			if (cached && now - cached.fetchedAt < config.cacheTtlMs) {
-				return cached.data;
-			}
-
-			const controller = new AbortController();
-			const timeout = setTimeout(() => controller.abort(), config.fetchTimeoutMs);
-			let data: Uint8Array;
-			try {
-				const response = await fetch(url, {
-					signal: controller.signal,
-					redirect: 'error'
-				});
-				if (!response.ok) {
-					throw new Error(`HTTP ${response.status}: ${response.statusText}`);
-				}
-				// Reject early when the server declares an oversized body.
-				const declared = Number(response.headers.get('content-length'));
-				if (Number.isFinite(declared) && declared > config.maxBytes) {
-					throw new Error('Remote definition exceeds size limit');
-				}
-				// Stream and count rather than `arrayBuffer()` — a missing/lying
-				// content-length must not let an unbounded body buffer into memory
-				// before the cap is checked. Abort the moment we cross the limit.
-				data = await readBodyWithCap(response, config.maxBytes, controller);
-			} finally {
-				clearTimeout(timeout);
-			}
-
-			cache.set(url, { data, fetchedAt: now });
-
-			if (cache.size > CACHE_MAX_ENTRIES) {
-				const entries = Array.from(cache.entries());
-				entries.sort((a, b) => a[1].fetchedAt - b[1].fetchedAt);
-				for (let i = 0; i < CACHE_EVICT_BATCH; i++) {
-					cache.delete(entries[i][0]);
-				}
-			}
-
-			return data;
-		}
-	};
-}