@selvajs/server 1.0.0-beta.8 → 1.0.0

package/README.md

@@ -9,12 +9,11 @@ single-flight, client and definition-byte caches. This package does not re-expor
 not depend on it. What stays here is HTTP _request policy_, which is a different job from running a
 solve.
 
-Logging follows the same rule as the rest of the package: nothing here logs unless you wire
-it. Modules that emit diagnostics take an optional `logger?: ILogger` and default to
-`NoopLogger`, so an embedder that wires nothing gets silence rather than unsolicited stdout
-writes. `@selvajs/server/logging` provides a pino-backed implementation (`createLogger`);
-`pino` is an **optional** peer dependency, and without it `createLogger` falls back to a
-console-backed logger rather than failing.
+Nothing here logs unless you wire it. Modules that emit diagnostics take an optional
+`logger?: ILogger` defaulting to `NoopLogger`, so an embedder that wires nothing gets silence
+rather than unsolicited stdout writes. `@selvajs/server/logging` provides a pino-backed
+`createLogger`; `pino` is an **optional** peer dependency, and without it `createLogger` falls
+back to a console-backed logger rather than failing.
 
 ## Install
 
@@ -25,20 +24,19 @@ pnpm add @selvajs/server
 ## Subpath exports
 
 **There is no root export.** Import from a subpath — `import … from '@selvajs/server'` fails to
-resolve, on purpose. A root barrel re-exporting all nine subpaths put 41 symbols in one namespace and
-hid which slice a consumer actually depended on; nothing in this repo used it.
-
-| Export                        | Contents                                                           |
-| ----------------------------- | ------------------------------------------------------------------ |
-| `@selvajs/server/compute`     | Compute limits, rate limiting, SSRF guard, remote-definition fetch |
-| `@selvajs/server/definitions` | Definition service + render loader                                 |
-| `@selvajs/server/providers`   | Provider composition helpers                                       |
-| `@selvajs/server/tokens`      | Mints and verifies personal API tokens                             |
-| `@selvajs/server/errors`      | Shared error types                                                 |
-| `@selvajs/server/logging`     | pino-backed `ILogger` + request-id correlation                     |
-| `@selvajs/server/http`        | Security headers, request limits, route classification             |
-| `@selvajs/server/access`      | Access/permission checks                                           |
-| `@selvajs/server/ops`         | Operational utilities                                              |
+resolve, on purpose, so it stays visible which slice a consumer depends on.
+
+| Export                        | Contents                                                                        |
+| ----------------------------- | ------------------------------------------------------------------------------- |
+| `@selvajs/server/compute`     | Compute limits, rate limiting, idempotency, SSRF guard, remote-definition fetch |
+| `@selvajs/server/definitions` | Definition service, compute-schema extraction, render loader                    |
+| `@selvajs/server/providers`   | Env-driven provider selection over a caller-supplied registry                   |
+| `@selvajs/server/tokens`      | HMAC codec for capability-URL tokens (share links, invites)                     |
+| `@selvajs/server/errors`      | Sentry-backed `IErrorReporter`                                                  |
+| `@selvajs/server/logging`     | pino-backed `ILogger` + request-id correlation                                  |
+| `@selvajs/server/http`        | Security headers, body-size and redirect guards, route classification           |
+| `@selvajs/server/access`      | Builds the input platform's project access rules consume                        |
+| `@selvajs/server/ops`         | Channel-aware semver comparison                                                 |
 
 Requires a `@selvajs/platform` provider (e.g. `@selvajs/local-provider` or
 `@selvajs/supabase-provider`) for data/storage/auth.

package/dist/access/project-access-input.d.ts

@@ -1,19 +1,18 @@
 import type { Project, ProjectAccessInput, RequestContext } from '@selvajs/platform';
 /**
- * Assembly of `ProjectAccessInput` — the marshalling layer between an app's
- * providers and platform's pure access rules (`canView`/`canEdit`/`canSolve`/
- * `canManage`/…). The rules are pure functions over one input shape; the
- * knowledge captured here is **which rows each project visibility needs**, so
- * a consuming app doesn't reimplement (and mis-fetch) it:
+ * Marshals an app's providers into the one input shape platform's pure access
+ * rules (`canView`/`canEdit`/`canSolve`/`canManage`/…) read. What lives here is
+ * **which rows each visibility needs**, so a consuming app doesn't reimplement
+ * and mis-fetch it:
  *
  * - `platform` → grants (skipped entirely while the feature flag is off)
  * - `private`  → caller's project member row
  * - `org` / `public` → caller's project member row (for canEdit/canManage) and
  *   org member row (for canView). Cross-org public skips the org row.
  *
- * Wiring is injected: row lookups as functions (so lazily-initialized
- * providers work unchanged) and flags read per call (so runtime flag flips
- * behave like the app's own `flag()` reads).
+ * Row lookups are injected as functions so lazily-initialized providers work
+ * unchanged, and flags are read per call so runtime flips behave like the app's
+ * own `flag()` reads.
  */
 export interface ProjectAccessFlags {
     /** `ALLOW_CROSS_ORG_PUBLIC` — public visibility spans orgs when true. */
@@ -30,17 +29,15 @@ export interface ProjectAccessInputDeps {
 }
 export interface ProjectAccessInputBuilder {
     /**
-     * Build the rule input for any project-scope rule, fetching exactly the
-     * rows the rule will consult based on `project.visibility`. Other fields
-     * default to safe values; pass `overrides` for the rare callers that
-     * already loaded a row (e.g. tests, batched listing pages).
+     * Fetches exactly the rows the rule will consult, based on
+     * `project.visibility`. Other fields default to safe values; `overrides` is
+     * for the rare caller that already loaded a row (tests, batched listings).
      */
     buildProjectAccessInput(ctx: RequestContext, project: Project, overrides?: Partial<ProjectAccessInput>): Promise<ProjectAccessInput>;
     /**
-     * Build a `ProjectAccessInput` from caller-provided rows without any I/O.
-     * Used by listing pages that have already batch-loaded membership for many
-     * projects; the per-row predicate calls this instead of
-     * `buildProjectAccessInput` to avoid an N+1 fetch.
+     * Same input, from caller-provided rows and no I/O. A listing page that has
+     * batch-loaded membership calls this per row instead of
+     * `buildProjectAccessInput`, which would fetch N+1 times.
      */
     projectAccessInputFromRows(ctx: RequestContext, project: Project, rows: {
         member?: ProjectAccessInput['member'];

package/dist/access/project-access-input.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-access-input.d.ts","sourceRoot":"","sources":["../../src/access/project-access-input.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAErF;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,WAAW,kBAAkB;IAClC,yEAAyE;IACzE,mBAAmB,EAAE,OAAO,CAAC;IAC7B,0EAA0E;IAC1E,sBAAsB,EAAE,OAAO,CAAC;CAChC;AAED,MAAM,WAAW,sBAAsB;IACtC,gBAAgB,CACf,GAAG,EAAE,cAAc,EACnB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACZ,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzC,YAAY,CACX,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACZ,OAAO,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5C,kBAAkB,CACjB,GAAG,EAAE,cAAc,EACnB,SAAS,EAAE,MAAM,GACf,OAAO,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACjD,4EAA4E;IAC5E,KAAK,IAAI,kBAAkB,CAAC;CAC5B;AAED,MAAM,WAAW,yBAAyB;IACzC;;;;;OAKG;IACH,uBAAuB,CACtB,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,EAChB,SAAS,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,GACrC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/B;;;;;OAKG;IACH,0BAA0B,CACzB,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE;QACL,MAAM,CAAC,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACtC,SAAS,CAAC,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAC5C,cAAc,CAAC,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;KACtD,GACC,kBAAkB,CAAC;CACtB;AAED,wBAAgB,+BAA+B,CAC9C,IAAI,EAAE,sBAAsB,GAC1B,yBAAyB,CAoE3B"}
+{"version":3,"file":"project-access-input.d.ts","sourceRoot":"","sources":["../../src/access/project-access-input.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAErF;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,kBAAkB;IAClC,yEAAyE;IACzE,mBAAmB,EAAE,OAAO,CAAC;IAC7B,0EAA0E;IAC1E,sBAAsB,EAAE,OAAO,CAAC;CAChC;AAED,MAAM,WAAW,sBAAsB;IACtC,gBAAgB,CACf,GAAG,EAAE,cAAc,EACnB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACZ,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzC,YAAY,CACX,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACZ,OAAO,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5C,kBAAkB,CACjB,GAAG,EAAE,cAAc,EACnB,SAAS,EAAE,MAAM,GACf,OAAO,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACjD,4EAA4E;IAC5E,KAAK,IAAI,kBAAkB,CAAC;CAC5B;AAED,MAAM,WAAW,yBAAyB;IACzC;;;;OAIG;IACH,uBAAuB,CACtB,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,EAChB,SAAS,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,GACrC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/B;;;;OAIG;IACH,0BAA0B,CACzB,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE;QACL,MAAM,CAAC,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACtC,SAAS,CAAC,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAC5C,cAAc,CAAC,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;KACtD,GACC,kBAAkB,CAAC;CACtB;AAED,wBAAgB,+BAA+B,CAC9C,IAAI,EAAE,sBAAsB,GAC1B,yBAAyB,CAoE3B"}

package/dist/access/project-access-input.js

@@ -6,8 +6,8 @@ export function createProjectAccessInputBuilder(deps) {
             let orgMember = null;
             let platformGrants = [];
             if (project.visibility === 'platform') {
-                // When the flag is off the rule short-circuits before reading grants —
-                // skip the lookup to keep "feature disabled" cheap.
+                // With the flag off every rule returns false before reading grants,
+                // so the lookup would be wasted I/O.
                 if (enablePlatformProjects) {
                     platformGrants = await deps.listPlatformGrants(ctx, project.id);
                 }

package/dist/access/project-access-input.js.map

@@ -1 +1 @@
-{"version":3,"file":"project-access-input.js","sourceRoot":"","sources":["../../src/access/project-access-input.ts"],"names":[],"mappings":"AA0EA,MAAM,UAAU,+BAA+B,CAC9C,IAA4B;IAE5B,OAAO;QACN,KAAK,CAAC,uBAAuB,CAC5B,GAAmB,EACnB,OAAgB,EAChB,YAAyC,EAAE;YAE3C,MAAM,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YAErE,IAAI,MAAM,GAAiC,IAAI,CAAC;YAChD,IAAI,SAAS,GAAoC,IAAI,CAAC;YACtD,IAAI,cAAc,GAAyC,EAAE,CAAC;YAE9D,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;gBACvC,uEAAuE;gBACvE,oDAAoD;gBACpD,IAAI,sBAAsB,EAAE,CAAC;oBAC5B,cAAc,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;gBACjE,CAAC;YACF,CAAC;iBAAM,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7C,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACnE,CAAC;iBAAM,CAAC;gBACP,MAAM,aAAa,GAAG,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,mBAAmB,CAAC;gBAC7E,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBACvC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC;oBAClD,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC;iBACzF,CAAC,CAAC;YACJ,CAAC;YAED,OAAO;gBACN,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;gBAC5C,OAAO;gBACP,MAAM;gBACN,SAAS;gBACT,mBAAmB;gBACnB,sBAAsB;gBACtB,cAAc;gBACd,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;gBACpC,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,GAAG,SAAS;aACZ,CAAC;QACH,CAAC;QAED,0BAA0B,CACzB,GAAmB,EACnB,OAAgB,EAChB,IAIC;YAED,MAAM,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YACrE,OAAO;gBACN,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;gBAC5C,OAAO;gBACP,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;gBAC3B,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;gBACjC,mBAAmB;gBACnB,sBAAsB;gBACtB,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE;gBACzC,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;gBACpC,MAAM,EAAE,GAAG,CAAC,MAAM;aAClB,CAAC;QACH,CAAC;KACD,CAAC;AACH,CAAC"}
+{"version":3,"file":"project-access-input.js","sourceRoot":"","sources":["../../src/access/project-access-input.ts"],"names":[],"mappings":"AAuEA,MAAM,UAAU,+BAA+B,CAC9C,IAA4B;IAE5B,OAAO;QACN,KAAK,CAAC,uBAAuB,CAC5B,GAAmB,EACnB,OAAgB,EAChB,YAAyC,EAAE;YAE3C,MAAM,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YAErE,IAAI,MAAM,GAAiC,IAAI,CAAC;YAChD,IAAI,SAAS,GAAoC,IAAI,CAAC;YACtD,IAAI,cAAc,GAAyC,EAAE,CAAC;YAE9D,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;gBACvC,oEAAoE;gBACpE,qCAAqC;gBACrC,IAAI,sBAAsB,EAAE,CAAC;oBAC5B,cAAc,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;gBACjE,CAAC;YACF,CAAC;iBAAM,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7C,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACnE,CAAC;iBAAM,CAAC;gBACP,MAAM,aAAa,GAAG,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,mBAAmB,CAAC;gBAC7E,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBACvC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC;oBAClD,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC;iBACzF,CAAC,CAAC;YACJ,CAAC;YAED,OAAO;gBACN,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;gBAC5C,OAAO;gBACP,MAAM;gBACN,SAAS;gBACT,mBAAmB;gBACnB,sBAAsB;gBACtB,cAAc;gBACd,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;gBACpC,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,GAAG,SAAS;aACZ,CAAC;QACH,CAAC;QAED,0BAA0B,CACzB,GAAmB,EACnB,OAAgB,EAChB,IAIC;YAED,MAAM,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YACrE,OAAO;gBACN,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;gBAC5C,OAAO;gBACP,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;gBAC3B,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;gBACjC,mBAAmB;gBACnB,sBAAsB;gBACtB,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE;gBACzC,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;gBACpC,MAAM,EAAE,GAAG,CAAC,MAAM;aAClB,CAAC;QACH,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/compute/idempotency.d.ts

@@ -4,27 +4,25 @@
  *
  * **This absorbs client retries; it is not a result cache.** The TTL is short
  * and the store is process-local, so a retry that lands on another instance
- * (or after the TTL) re-solves. That is acceptable — a duplicate solve costs
- * compute, not correctness. What it must never do is return one caller's result
- * to another, hence the caller identity in the key.
+ * (or after the TTL) re-solves — a duplicate solve costs compute, not
+ * correctness. What it must never do is return one caller's result to another,
+ * hence the caller identity in the key.
  *
- * Concurrency matters more than the hit rate. A client that retries on timeout
- * usually retries *while the first solve is still running*, so the store holds a
- * **promise**, reserved before the work starts: the second request awaits the
- * first rather than starting a second solve. A reservation that rejects is
- * dropped, so a failed solve is retryable rather than a cached error.
+ * The store holds a **promise**, reserved before the work starts, because a
+ * client that retries on timeout usually retries while the first solve is still
+ * running: the second request awaits the first instead of starting a second solve.
  *
- * Bounded the same way as the rate limiter: amortized sweep plus a hard cap, both
- * driven by `run` rather than a timer — a timer would keep the event loop alive
- * and give this module a lifecycle its callers don't have.
+ * Sweep and cap are both driven by `run` rather than a timer — a timer would keep
+ * the event loop alive and give this module a lifecycle its callers don't have.
  */
 export interface IdempotencyStoreConfig {
     /** How long a completed response stays replayable, in ms. */
     ttlMs: number;
     /**
-     * Max retained entries. Once live entries exceed this, the ones nearest
-     * expiry are evicted. Evicting only costs a re-solve on a retry, so size this
-     * above the plausible number of in-flight + recent keys.
+     * Max retained entries; once exceeded, the ones nearest expiry are evicted.
+     * Evicting only costs a re-solve on a retry, so size this above the plausible
+     * number of in-flight + recent keys. Defaults to
+     * {@link DEFAULT_IDEMPOTENCY_MAX_KEYS}.
      */
     maxKeys?: number;
     /**
@@ -42,22 +40,20 @@ export interface IdempotencyOutcome<T> {
 }
 export interface IdempotencyStore<T> {
     /**
-     * Run `fn` under `key`, or join/replay the entry already stored there.
-     *
-     * The entry is reserved before `fn` starts, so a concurrent retry awaits the
-     * first run instead of starting its own. A rejection drops the reservation.
+     * Run `fn` under `key`, or join/replay the entry already stored there. The
+     * entry is reserved before `fn` starts, so a concurrent retry awaits the first
+     * run; a rejection drops the reservation.
      */
     run(key: string, fn: () => Promise<T>): Promise<IdempotencyOutcome<T>>;
     /** Test seam — wipes in-memory state. Production code never calls this. */
     reset(): void;
-    /** Retained entry count, including any not yet swept. For tests/observability. */
+    /** Retained entry count, including entries not yet swept. */
     size(): number;
     readonly config: Readonly<IdempotencyStoreConfig>;
 }
 /**
- * Build a process-local idempotency store. `T` is whatever the caller replays;
- * the solve route stores a serialized response snapshot rather than a `Response`,
- * because a `Response` body can only be read once.
+ * `T` is whatever the caller replays. It must not be a `Response` — a body can
+ * only be read once, so the solve route stores a serialized snapshot instead.
  */
 export declare function createIdempotencyStore<T>(config: IdempotencyStoreConfig): IdempotencyStore<T>;
 //# sourceMappingURL=idempotency.d.ts.map

package/dist/compute/idempotency.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"idempotency.d.ts","sourceRoot":"","sources":["../../src/compute/idempotency.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,WAAW,sBAAsB;IACtC,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,sDAAsD;AACtD,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAEnD,MAAM,WAAW,kBAAkB,CAAC,CAAC;IACpC,KAAK,EAAE,CAAC,CAAC;IACT,8EAA8E;IAC9E,QAAQ,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB,CAAC,CAAC;IAClC;;;;;OAKG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,2EAA2E;IAC3E,KAAK,IAAI,IAAI,CAAC;IACd,kFAAkF;IAClF,IAAI,IAAI,MAAM,CAAC;IACf,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,sBAAsB,CAAC,CAAC;CAClD;AAYD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,MAAM,EAAE,sBAAsB,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAwE7F"}
+{"version":3,"file":"idempotency.d.ts","sourceRoot":"","sources":["../../src/compute/idempotency.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,sBAAsB;IACtC,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,sDAAsD;AACtD,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAEnD,MAAM,WAAW,kBAAkB,CAAC,CAAC;IACpC,KAAK,EAAE,CAAC,CAAC;IACT,8EAA8E;IAC9E,QAAQ,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB,CAAC,CAAC;IAClC;;;;OAIG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,2EAA2E;IAC3E,KAAK,IAAI,IAAI,CAAC;IACd,6DAA6D;IAC7D,IAAI,IAAI,MAAM,CAAC;IACf,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,sBAAsB,CAAC,CAAC;CAClD;AAYD;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,MAAM,EAAE,sBAAsB,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAwE7F"}

package/dist/compute/idempotency.js

@@ -4,26 +4,22 @@
  *
  * **This absorbs client retries; it is not a result cache.** The TTL is short
  * and the store is process-local, so a retry that lands on another instance
- * (or after the TTL) re-solves. That is acceptable — a duplicate solve costs
- * compute, not correctness. What it must never do is return one caller's result
- * to another, hence the caller identity in the key.
+ * (or after the TTL) re-solves — a duplicate solve costs compute, not
+ * correctness. What it must never do is return one caller's result to another,
+ * hence the caller identity in the key.
  *
- * Concurrency matters more than the hit rate. A client that retries on timeout
- * usually retries *while the first solve is still running*, so the store holds a
- * **promise**, reserved before the work starts: the second request awaits the
- * first rather than starting a second solve. A reservation that rejects is
- * dropped, so a failed solve is retryable rather than a cached error.
+ * The store holds a **promise**, reserved before the work starts, because a
+ * client that retries on timeout usually retries while the first solve is still
+ * running: the second request awaits the first instead of starting a second solve.
  *
- * Bounded the same way as the rate limiter: amortized sweep plus a hard cap, both
- * driven by `run` rather than a timer — a timer would keep the event loop alive
- * and give this module a lifecycle its callers don't have.
+ * Sweep and cap are both driven by `run` rather than a timer — a timer would keep
+ * the event loop alive and give this module a lifecycle its callers don't have.
  */
 /** Default {@link IdempotencyStoreConfig.maxKeys}. */
 export const DEFAULT_IDEMPOTENCY_MAX_KEYS = 10_000;
 /**
- * Build a process-local idempotency store. `T` is whatever the caller replays;
- * the solve route stores a serialized response snapshot rather than a `Response`,
- * because a `Response` body can only be read once.
+ * `T` is whatever the caller replays. It must not be a `Response` — a body can
+ * only be read once, so the solve route stores a serialized snapshot instead.
  */
 export function createIdempotencyStore(config) {
     const ttlMs = Math.max(0, Math.floor(config.ttlMs));

package/dist/compute/idempotency.js.map

@@ -1 +1 @@
-{"version":3,"file":"idempotency.js","sourceRoot":"","sources":["../../src/compute/idempotency.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAkBH,sDAAsD;AACtD,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAiCnD;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAI,MAA8B;IACvE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,4BAA4B,CAAC,CAAC,CAAC;IACxF,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,IAAI,KAAK,CAAC,CAAC,CAAC;IACjF,MAAM,cAAc,GAAqC,MAAM,CAAC,MAAM,CAAC;QACtE,GAAG,MAAM;QACT,KAAK;QACL,OAAO;QACP,eAAe;KACf,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC5C,IAAI,WAAW,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAE3C,SAAS,UAAU,CAAC,GAAW,EAAE,QAAQ,GAAG,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC,CAAC;QAC/C,MAAM,WAAW,GAAG,eAAe,GAAG,CAAC,IAAI,GAAG,IAAI,WAAW,CAAC;QAC9D,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,IAAI,IAAI,MAAM;YAAE,OAAO;QAEnD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YACpC,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,eAAe,GAAG,CAAC;YAAE,WAAW,GAAG,GAAG,GAAG,eAAe,CAAC;QAE7D,IAAI,OAAO,CAAC,IAAI,GAAG,MAAM,EAAE,CAAC;YAC3B,qEAAqE;YACrE,oEAAoE;YACpE,MAAM,WAAW,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAC9C,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC,CACrE,CAAC;YACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,EAAE;gBAAE,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzF,CAAC;IACF,CAAC;IAED,OAAO;QACN,MAAM,EAAE,cAAc;QACtB,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,EAAoB;YAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5E,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAC1D,CAAC;YAED,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAE1C,MAAM,OAAO,GAAG,EAAE,EAAE,CAAC;YACrB,MAAM,KAAK,GAAa,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YACrD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACxB,IAAI,eAAe,GAAG,CAAC,IAAI,WAAW,KAAK,MAAM,CAAC,iBAAiB,EAAE,CAAC;gBACrE,WAAW,GAAG,GAAG,GAAG,eAAe,CAAC;YACrC,CAAC;YAED,IAAI,CAAC;gBACJ,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC;gBAC5B,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;gBACrC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YACnC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,iEAAiE;gBACjE,sEAAsE;gBACtE,yDAAyD;gBACzD,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK;oBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACpD,MAAM,GAAG,CAAC;YACX,CAAC;QACF,CAAC;QACD,KAAK;YACJ,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,WAAW,GAAG,MAAM,CAAC,iBAAiB,CAAC;QACxC,CAAC;QACD,IAAI;YACH,OAAO,OAAO,CAAC,IAAI,CAAC;QACrB,CAAC;KACD,CAAC;AACH,CAAC"}
+{"version":3,"file":"idempotency.js","sourceRoot":"","sources":["../../src/compute/idempotency.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAmBH,sDAAsD;AACtD,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAgCnD;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAI,MAA8B;IACvE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,4BAA4B,CAAC,CAAC,CAAC;IACxF,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,IAAI,KAAK,CAAC,CAAC,CAAC;IACjF,MAAM,cAAc,GAAqC,MAAM,CAAC,MAAM,CAAC;QACtE,GAAG,MAAM;QACT,KAAK;QACL,OAAO;QACP,eAAe;KACf,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC5C,IAAI,WAAW,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAE3C,SAAS,UAAU,CAAC,GAAW,EAAE,QAAQ,GAAG,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC,CAAC;QAC/C,MAAM,WAAW,GAAG,eAAe,GAAG,CAAC,IAAI,GAAG,IAAI,WAAW,CAAC;QAC9D,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,IAAI,IAAI,MAAM;YAAE,OAAO;QAEnD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YACpC,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,eAAe,GAAG,CAAC;YAAE,WAAW,GAAG,GAAG,GAAG,eAAe,CAAC;QAE7D,IAAI,OAAO,CAAC,IAAI,GAAG,MAAM,EAAE,CAAC;YAC3B,qEAAqE;YACrE,oEAAoE;YACpE,MAAM,WAAW,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAC9C,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC,CACrE,CAAC;YACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,EAAE;gBAAE,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzF,CAAC;IACF,CAAC;IAED,OAAO;QACN,MAAM,EAAE,cAAc;QACtB,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,EAAoB;YAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5E,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAC1D,CAAC;YAED,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAE1C,MAAM,OAAO,GAAG,EAAE,EAAE,CAAC;YACrB,MAAM,KAAK,GAAa,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YACrD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACxB,IAAI,eAAe,GAAG,CAAC,IAAI,WAAW,KAAK,MAAM,CAAC,iBAAiB,EAAE,CAAC;gBACrE,WAAW,GAAG,GAAG,GAAG,eAAe,CAAC;YACrC,CAAC;YAED,IAAI,CAAC;gBACJ,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC;gBAC5B,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;gBACrC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YACnC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,iEAAiE;gBACjE,sEAAsE;gBACtE,yDAAyD;gBACzD,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK;oBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACpD,MAAM,GAAG,CAAC;YACX,CAAC;QACF,CAAC;QACD,KAAK;YACJ,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,WAAW,GAAG,MAAM,CAAC,iBAAiB,CAAC;QACxC,CAAC;QACD,IAAI;YACH,OAAO,OAAO,CAAC,IAAI,CAAC;QACrB,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/compute/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/compute/index.ts"],"names":[],"mappings":"AAaA,OAAO,EACN,oBAAoB,EACpB,eAAe,EACf,kBAAkB,EAClB,QAAQ,EACR,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,MAAM,aAAa,CAAC;AAErB,OAAO,EACN,wBAAwB,EACxB,gBAAgB,EAChB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACN,sBAAsB,EACtB,4BAA4B,EAC5B,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,MAAM,eAAe,CAAC;AAEzF,OAAO,EACN,6BAA6B,EAC7B,eAAe,EACf,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/compute/index.ts"],"names":[],"mappings":"AAWA,OAAO,EACN,oBAAoB,EACpB,eAAe,EACf,kBAAkB,EAClB,QAAQ,EACR,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,MAAM,aAAa,CAAC;AAErB,OAAO,EACN,wBAAwB,EACxB,gBAAgB,EAChB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACN,sBAAsB,EACtB,4BAA4B,EAC5B,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,MAAM,eAAe,CAAC;AAEzF,OAAO,EACN,6BAA6B,EAC7B,eAAe,EACf,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,MAAM,wBAAwB,CAAC"}

package/dist/compute/index.js

@@ -5,11 +5,9 @@
 // from running one.
 //
 // **The solve core is not here.** Pipeline, L2 result cache, single-flight, and the client /
-// definition-byte caches live in `@selvajs/solve/server`, which owns the solve flow on both sides of
-// the wire. This sub-path deliberately does NOT re-export them: a compat shim was built during the
-// extraction and removed before release, because it left this barrel at 24 exports of which 14 were
-// borrowed — a surface that no longer described what the package does. `@selvajs/server` does not
-// depend on `@selvajs/solve`.
+// definition-byte caches live in `@selvajs/solve/server`. Do not re-export them through this
+// barrel: `@selvajs/server` does not depend on `@selvajs/solve`, and a borrowed surface stops
+// describing what this package does.
 export { resolveComputeLimits, readPositiveInt, readNonNegativeInt, readBool } from './limits.js';
 export { createComputeRateLimiter, DEFAULT_MAX_KEYS } from './rate-limit.js';
 export { createIdempotencyStore, DEFAULT_IDEMPOTENCY_MAX_KEYS } from './idempotency.js';

package/dist/compute/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/compute/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,EAAE;AACF,kGAAkG;AAClG,mGAAmG;AACnG,oBAAoB;AACpB,EAAE;AACF,6FAA6F;AAC7F,qGAAqG;AACrG,mGAAmG;AACnG,oGAAoG;AACpG,kGAAkG;AAClG,8BAA8B;AAE9B,OAAO,EACN,oBAAoB,EACpB,eAAe,EACf,kBAAkB,EAClB,QAAQ,EAGR,MAAM,aAAa,CAAC;AAErB,OAAO,EACN,wBAAwB,EACxB,gBAAgB,EAIhB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACN,sBAAsB,EACtB,4BAA4B,EAI5B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,MAAM,eAAe,CAAC;AAEzF,OAAO,EACN,6BAA6B,EAC7B,eAAe,EAGf,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/compute/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,EAAE;AACF,kGAAkG;AAClG,mGAAmG;AACnG,oBAAoB;AACpB,EAAE;AACF,6FAA6F;AAC7F,6FAA6F;AAC7F,8FAA8F;AAC9F,qCAAqC;AAErC,OAAO,EACN,oBAAoB,EACpB,eAAe,EACf,kBAAkB,EAClB,QAAQ,EAGR,MAAM,aAAa,CAAC;AAErB,OAAO,EACN,wBAAwB,EACxB,gBAAgB,EAIhB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACN,sBAAsB,EACtB,4BAA4B,EAI5B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,MAAM,eAAe,CAAC;AAEzF,OAAO,EACN,6BAA6B,EAC7B,eAAe,EAGf,MAAM,wBAAwB,CAAC"}

package/dist/compute/limits.d.ts

@@ -1,88 +1,73 @@
 /**
  * Compute/solve server limits, resolved from an injected env map.
  *
- * This is the transport- and framework-agnostic core: it takes a plain
- * `Record<string, string | undefined>` (the caller passes SvelteKit's
- * `$env/dynamic/private`, `process.env`, or any config source) and returns a
- * fully-resolved `ComputeLimits` object. No ambient `$env` / `process.env`
- * read happens here, so the module is importable from any runtime and testable
- * without env plumbing.
- *
- * Every knob is env-overridable so deployments can tune without code changes;
- * the defaults are sized for typical interactive use (sliders + small uploads).
- * Centralizing them surfaces the tradeoffs (raise the rate cap → also consider
- * the body cap) at one glance.
+ * Env comes in as a parameter — nothing ambient is read — so this is importable
+ * from any runtime and testable without env plumbing. Defaults are sized for
+ * typical interactive use (sliders + small uploads).
  *
  * Client-side counterparts (the in-flight compute throttle and slider debounce)
- * live in `@selvajs/ui` and are bundled into the client, so they can't read
- * env — they carry their own defaults.
+ * are bundled into the client in `@selvajs/ui` and can't read env — they carry
+ * their own defaults.
  */
 import { type ILogger } from '@selvajs/platform';
 /** Env source: any string→string map. `$env/dynamic/private` satisfies this. */
 export type EnvRecord = Record<string, string | undefined>;
-/**
- * Parse a positive integer env value. Returns `fallback` when absent, and warns
- * + falls back when present but not a finite positive number.
- */
+/** Parse a positive integer env value; absent, or present but not finite and positive, falls back. */
 export declare function readPositiveInt(env: EnvRecord, name: string, fallback: number, logger?: ILogger): number;
-/**
- * Parse a non-negative integer env value — like {@link readPositiveInt} but `0`
- * is a valid value (used by knobs where `0` means "disable", e.g. a cache
- * budget). Returns `fallback` when absent, and warns + falls back when present
- * but not a finite non-negative number.
- */
+/** Like {@link readPositiveInt}, but `0` is valid — knobs where it means "disable". */
 export declare function readNonNegativeInt(env: EnvRecord, name: string, fallback: number, logger?: ILogger): number;
 /**
- * Parse a boolean env flag. Accepts `true/1/yes/on` (case-insensitive) as true
- * and `false/0/no/off` as false; any other / absent value falls back.
+ * Parse a boolean env flag. Accepts `true/1/yes/on` and `false/0/no/off`
+ * (case-insensitive); any other spelling warns and falls back.
  */
 export declare function readBool(env: EnvRecord, name: string, fallback: boolean, logger?: ILogger): boolean;
 /** Fully-resolved server-side compute limits. */
 export interface ComputeLimits {
     /**
-     * Longest the app waits for one solve. Enforced by the SolveScheduler
-     * (`@selvajs/compute`), which propagates AbortSignal into the upstream
-     * Compute call — a timeout actually cancels the work. Forwarded to the
-     * client to drive the in-browser AbortController.
+     * Longest the app waits for one solve. The SolveScheduler (`@selvajs/compute`)
+     * propagates an AbortSignal into the upstream Compute call, so a timeout
+     * actually cancels the work. Also forwarded to the client, where it drives the
+     * in-browser AbortController.
      *
-     * Caveat: bounds only the parts of the stack we own. A reverse proxy or
-     * serverless platform cap may shoot the request sooner; bumping past those
-     * caps produces 502s, not longer solves.
+     * Bounds only the parts of the stack we own. A reverse proxy or serverless
+     * platform cap may shoot the request sooner; raising this past those caps
+     * produces 502s, not longer solves.
      */
     solveDeadlineMs: number;
     /** Fixed-window cap on /api/v1/compute: window length + max requests per window. */
     rateLimitWindowMs: number;
     rateLimitMaxRequests: number;
     /**
-     * Largest .gh definition accepted on upload AND the largest remote definition
-     * fetched for compute — kept in lockstep so a remote URL can't smuggle a file
-     * past the upload cap. Defaults to 50 MB to match Rhino.Compute's own
-     * `RHINO_COMPUTE_MAX_REQUEST_SIZE` default: a larger file 413s at compute
+     * Largest .gh definition accepted on upload. 50 MB matches Rhino.Compute's own
+     * `RHINO_COMPUTE_MAX_REQUEST_SIZE` default — a larger file 413s at compute
      * regardless, so accepting it here only defers the failure.
      */
     maxDefinitionFileSize: number;
+    /** Largest cover image accepted on upload. */
     maxImageFileSize: number;
     /**
-     * /api/v1/compute JSON *request* body cap (inputs + values, not the .gh). A
-     * `file`-widget input embeds geometry as base64 in `values`; must stay <=
-     * the adapter-node global BODY_SIZE_LIMIT or the global backstop rejects first.
-     * Defaults to 210 MB: the client allows a 150 MB raw file, base64 inflates it
-     * to ~200 MB on the wire, plus JSON envelope slack — and it matches the
-     * `BODY_SIZE_LIMIT=210M` shipped in `.env.example`.
+     * /api/v1/compute JSON *request* body cap (inputs + values, not the .gh). Must
+     * stay <= adapter-node's global `BODY_SIZE_LIMIT` or that backstop rejects
+     * first. 210 MB matches the `BODY_SIZE_LIMIT=210M` shipped in `.env.example`:
+     * a `file` widget embeds geometry as base64 in `values`, so the client's
+     * 150 MB raw file inflates to ~200 MB on the wire, plus JSON envelope slack.
      */
     computeRequestMaxBytes: number;
     /**
      * /api/v1/compute JSON *response* cap. A `file`-typed output is base64-embedded
-     * in the response; guards V8's ~512 MB single-string wall (a `JSON.stringify`
-     * `RangeError`) and browser-tab OOM. Defensive backstop → clear 413 instead of
-     * an opaque crash (real fix is out-of-band streaming, ADR 0003).
+     * in the response; this guards V8's ~512 MB single-string wall (a
+     * `JSON.stringify` `RangeError`) and browser-tab OOM, turning an opaque crash
+     * into a clear 413. The real fix is out-of-band streaming.
      *
-     * 300 MB is intentional and NOT a dev leftover — sized above any legitimate
-     * inline payload but below the V8 string wall. Unlike the request cap it is
-     * not bounded by BODY_SIZE_LIMIT, which only applies to inbound bodies.
+     * 300 MB is deliberate, not a dev leftover — above any legitimate inline
+     * payload, below the V8 string wall. Unlike the request cap it is not bounded
+     * by `BODY_SIZE_LIMIT`, which only covers inbound bodies.
      */
     computeResponseMaxBytes: number;
-    /** Hard cap on fetching a remote definition — tracks `maxDefinitionFileSize`. */
+    /**
+     * Hard cap on fetching a remote definition. Tracks `maxDefinitionFileSize` so a
+     * remote URL can't smuggle a file past the upload cap.
+     */
     remoteDefinitionMaxBytes: number;
     /** Deadline on fetching a remote definition (slow-loris protection). */
     remoteDefinitionFetchTimeoutMs: number;
@@ -90,17 +75,17 @@ export interface ComputeLimits {
      * TTL for the in-process cache of .gh bytes fetched from a REMOTE URL.
      *
      * Only the remote path is TTL'd, and the name says so deliberately: the other
-     * definition cache is keyed on an immutable version id, where expiry would be a
-     * bug (it can only ever throw away valid work). A URL's owner can swap the file
-     * underneath us, so that one needs a freshness bound and this is it.
+     * definition cache is keyed on an immutable version id, where expiry could only
+     * ever throw away valid work. A URL's owner can swap the file underneath us, so
+     * that path needs a freshness bound and this is it.
      */
     remoteDefinitionCacheTtlMs: number;
     /**
      * Reuse the server's cached definition via a pointer instead of re-uploading
      * the binary each solve. SAFE only on a compute server that signals a
-     * stale-pointer miss (VektorNode fork / a fork that throws) — a server that
-     * returns an empty 200 would silently yield EMPTY geometry. Off for unknown
-     * / standard rhino.compute.
+     * stale-pointer miss (the VektorNode fork, or any fork that throws) — a server
+     * that returns an empty 200 instead would silently yield EMPTY geometry. Off
+     * for unknown / standard rhino.compute.
      */
     computeReuseDefinitionCache: boolean;
     /**
@@ -117,53 +102,52 @@ export interface ComputeLimits {
      */
     computeCacheErroredSolves: boolean;
     /**
-     * Backpressure — max solves allowed to WAIT in the per-server FIFO queue (i.e.
-     * excluding the in-flight solves, capped at the scheduler's `maxConcurrent`,
-     * itself auto-detected from the compute server's active child count). A solve
-     * that arrives to a full queue is rejected immediately (scheduler `QUEUE_FULL`,
-     * mapped to HTTP 503 + `Retry-After`) instead of piling up unbounded. `0` =
-     * unbounded (the pre-backpressure default): the queue grows without limit,
-     * matching prior behavior. Size it to roughly 2–3× the compute server's
-     * child count once the Rhino pool's real capacity is known — rejecting fast
-     * beats a hung request.
+     * Backpressure — max solves allowed to WAIT in the per-server FIFO queue. This
+     * excludes in-flight solves, which the scheduler caps at `maxConcurrent`,
+     * auto-detected from the compute server's active child count. A solve arriving
+     * at a full queue is rejected on the spot (scheduler `QUEUE_FULL` → HTTP 503 +
+     * `Retry-After`) instead of piling up. `0` = unbounded, the default.
+     *
+     * Size it to roughly 2–3× the compute server's child count once you know the
+     * Rhino pool's real capacity — rejecting fast beats a hung request.
      */
     computeMaxQueueDepth: number;
     /**
      * Backpressure — longest (ms) a solve may sit QUEUED before it starts
-     * executing; still-waiting past this it's rejected (scheduler `QUEUE_TIMEOUT` →
-     * HTTP 503 + `Retry-After`) rather than burning compute on a stale request.
+     * executing. Still waiting past this, it's rejected (scheduler `QUEUE_TIMEOUT`
+     * → HTTP 503 + `Retry-After`) rather than burning compute on a stale request.
+     * `0` = no queue deadline, the default.
+     *
      * Bounds tail latency: the scheduler's `timeoutMs` clock starts at execution,
-     * so without this a solve's total wait is unbounded and invisible. `0` = no
-     * queue deadline (the default). A sensible tuned value is ≈ `solveDeadlineMs`.
+     * so without this a solve's total wait is unbounded and invisible. Tune it to
+     * ≈ `solveDeadlineMs`.
      */
     computeQueueWaitMs: number;
     /**
-     * **Definition cache** — total-byte budget (bytes) for the in-process cache of
-     * .gh bytes keyed on immutable version id. A warm entry lets a solve skip
-     * `storage.get` entirely, and a pointer-known solve never loads bytes at all.
-     * `0` disables it (every solve re-reads storage). A total-byte LRU rather than
-     * an entry count because definitions span KB→hundreds of MB. Env value is MB.
+     * **Definition cache** — total-byte budget for the in-process cache of .gh bytes
+     * keyed on immutable version id. A warm entry lets a solve skip `storage.get`;
+     * `0` disables it, so every solve re-reads storage. A byte LRU rather than an
+     * entry count because definitions span KB→hundreds of MB. Env value is MB.
      */
     computeDefinitionCacheBytes: number;
     /**
-     * **Solve cache** — total-byte budget (bytes) for EACH warm client's in-process
-     * cache of solve results (the `fromCache` layer in front of Rhino.Compute).
-     * Results range KB→100s of MB (`computeResponseMaxBytes` allows 300 MB), so an
-     * entry-count cap alone can't bound heap; this adds a byte LRU on top. `0`
-     * disables it (every solve goes to compute). Env value is MB.
+     * **Solve cache** — total-byte budget for EACH warm client's in-process cache of
+     * solve results (the `fromCache` layer in front of Rhino.Compute). `0` disables
+     * it, so every solve goes to compute. Results span KB→100s of MB
+     * (`computeResponseMaxBytes` allows 300 MB), so an entry count alone can't bound
+     * heap; this adds a byte LRU on top. Env value is MB.
      *
-     * **This is per warm client, so the worst case multiplies.** Selva keeps up to
-     * `maxWarmComputeServers` (default 16) distinct compute servers warm, so the true
-     * ceiling is this × 16 — 4 GB at the default. Real deployments run 1–2 servers,
-     * which is why the default is comfortable, but a deployment that fans out
-     * across many servers on a small VPS is exactly the case this knob exists for.
+     * **Per warm client, so the worst case multiplies.** Selva keeps up to
+     * `maxWarmComputeServers` (default 16) compute servers warm, making the real
+     * ceiling this × 16 — 4 GB at the default. Most deployments run 1–2 servers,
+     * which is why the default is comfortable; a fan-out across many servers on a
+     * small VPS is the case this knob exists for.
      */
     computeSolveCacheBytes: number;
 }
 /**
- * Resolve every server-side compute limit from an env map. Pure: the same env
- * always yields the same limits, and nothing is read ambiently. The app calls
- * this once at its composition root with `$env/dynamic/private`.
+ * Resolve every server-side compute limit from an env map. The app calls this
+ * once at its composition root with `$env/dynamic/private`.
  */
 export declare function resolveComputeLimits(env: EnvRecord, logger?: ILogger): ComputeLimits;
 //# sourceMappingURL=limits.d.ts.map

package/dist/compute/limits.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../../src/compute/limits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAc,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAI7D,gFAAgF;AAChF,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAS3D;;;GAGG;AACH,wBAAgB,eAAe,CAC9B,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,OAAc,GACpB,MAAM,CAcR;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CACjC,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,OAAc,GACpB,MAAM,CAcR;AAwBD;;;GAGG;AACH,wBAAgB,QAAQ,CACvB,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,OAAO,EACjB,MAAM,GAAE,OAAc,GACpB,OAAO,CAaT;AAED,iDAAiD;AACjD,MAAM,WAAW,aAAa;IAC7B;;;;;;;;;OASG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,oFAAoF;IACpF,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oBAAoB,EAAE,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAC9B,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,sBAAsB,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;OASG;IACH,uBAAuB,EAAE,MAAM,CAAC;IAChC,iFAAiF;IACjF,wBAAwB,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,8BAA8B,EAAE,MAAM,CAAC;IACvC;;;;;;;OAOG;IACH,0BAA0B,EAAE,MAAM,CAAC;IACnC;;;;;;OAMG;IACH,2BAA2B,EAAE,OAAO,CAAC;IACrC;;;;OAIG;IACH,uBAAuB,EAAE,OAAO,CAAC;IACjC;;;;;OAKG;IACH,yBAAyB,EAAE,OAAO,CAAC;IACnC;;;;;;;;;;OAUG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAC7B;;;;;;;OAOG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,2BAA2B,EAAE,MAAM,CAAC;IACpC;;;;;;;;;;;;OAYG;IACH,sBAAsB,EAAE,MAAM,CAAC;CAC/B;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,GAAE,OAAc,GAAG,aAAa,CA0D1F"}
+{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../../src/compute/limits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAc,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAI7D,gFAAgF;AAChF,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAQ3D,sGAAsG;AACtG,wBAAgB,eAAe,CAC9B,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,OAAc,GACpB,MAAM,CAcR;AAED,uFAAuF;AACvF,wBAAgB,kBAAkB,CACjC,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,OAAc,GACpB,MAAM,CAcR;AAoBD;;;GAGG;AACH,wBAAgB,QAAQ,CACvB,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,OAAO,EACjB,MAAM,GAAE,OAAc,GACpB,OAAO,CAaT;AAED,iDAAiD;AACjD,MAAM,WAAW,aAAa;IAC7B;;;;;;;;;OASG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,oFAAoF;IACpF,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oBAAoB,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAC9B,8CAA8C;IAC9C,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,sBAAsB,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;OASG;IACH,uBAAuB,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,wBAAwB,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,8BAA8B,EAAE,MAAM,CAAC;IACvC;;;;;;;OAOG;IACH,0BAA0B,EAAE,MAAM,CAAC;IACnC;;;;;;OAMG;IACH,2BAA2B,EAAE,OAAO,CAAC;IACrC;;;;OAIG;IACH,uBAAuB,EAAE,OAAO,CAAC;IACjC;;;;;OAKG;IACH,yBAAyB,EAAE,OAAO,CAAC;IACnC;;;;;;;;;OASG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;OASG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,2BAA2B,EAAE,MAAM,CAAC;IACpC;;;;;;;;;;;;OAYG;IACH,sBAAsB,EAAE,MAAM,CAAC;CAC/B;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,GAAE,OAAc,GAAG,aAAa,CAmD1F"}