@selvajs/server 1.0.0-beta.9 → 1.0.1

package/dist/compute/limits.js

@@ -1,34 +1,22 @@
 /**
  * Compute/solve server limits, resolved from an injected env map.
  *
- * This is the transport- and framework-agnostic core: it takes a plain
- * `Record<string, string | undefined>` (the caller passes SvelteKit's
- * `$env/dynamic/private`, `process.env`, or any config source) and returns a
- * fully-resolved `ComputeLimits` object. No ambient `$env` / `process.env`
- * read happens here, so the module is importable from any runtime and testable
- * without env plumbing.
- *
- * Every knob is env-overridable so deployments can tune without code changes;
- * the defaults are sized for typical interactive use (sliders + small uploads).
- * Centralizing them surfaces the tradeoffs (raise the rate cap → also consider
- * the body cap) at one glance.
+ * Env comes in as a parameter — nothing ambient is read — so this is importable
+ * from any runtime and testable without env plumbing. Defaults are sized for
+ * typical interactive use (sliders + small uploads).
  *
  * Client-side counterparts (the in-flight compute throttle and slider debounce)
- * live in `@selvajs/ui` and are bundled into the client, so they can't read
- * env — they carry their own defaults.
+ * are bundled into the client in `@selvajs/ui` and can't read env — they carry
+ * their own defaults.
  */
 import { NoopLogger } from '@selvajs/platform';
 const MB = 1024 * 1024;
 /**
- * Optional structured logger for the env-parsing diagnostics below. Defaults to
- * `NoopLogger`: this is library code, so an embedder that wires nothing gets
- * silence rather than unsolicited stdout writes. The app passes its real logger.
+ * Default logger for the env-parsing warnings below. This is library code, so an
+ * embedder that wires nothing gets silence rather than unsolicited stdout writes.
  */
 const noop = new NoopLogger();
-/**
- * Parse a positive integer env value. Returns `fallback` when absent, and warns
- * + falls back when present but not a finite positive number.
- */
+/** Parse a positive integer env value; absent, or present but not finite and positive, falls back. */
 export function readPositiveInt(env, name, fallback, logger = noop) {
     const raw = env[name];
     if (!raw)
@@ -45,12 +33,7 @@ export function readPositiveInt(env, name, fallback, logger = noop) {
     }
     return Math.floor(parsed);
 }
-/**
- * Parse a non-negative integer env value — like {@link readPositiveInt} but `0`
- * is a valid value (used by knobs where `0` means "disable", e.g. a cache
- * budget). Returns `fallback` when absent, and warns + falls back when present
- * but not a finite non-negative number.
- */
+/** Like {@link readPositiveInt}, but `0` is valid — knobs where it means "disable". */
 export function readNonNegativeInt(env, name, fallback, logger = noop) {
     const raw = env[name];
     if (!raw)
@@ -68,16 +51,12 @@ export function readNonNegativeInt(env, name, fallback, logger = noop) {
     return Math.floor(parsed);
 }
 /**
- * Read a renamed variable, honouring its previous name for one minor version.
- *
- * Returns the env map's value under `name`, or — when that is unset and the old
- * name is present — the old value plus a warning naming both. Setting both is not
- * an error: the new name wins silently, which is what an operator mid-migration
- * expects.
+ * Fall back to a variable's previous name, warning when the old one is used.
+ * Setting both is not an error: the new name wins silently, which is what an
+ * operator mid-migration expects.
  *
- * This exists so a rename is never a silent behaviour change. A var that quietly
- * stops being read looks exactly like a var that is working, and the failure only
- * surfaces as a memory number nobody is watching.
+ * A var that quietly stops being read looks exactly like one that is working —
+ * the failure only surfaces as a memory number nobody is watching.
  */
 function readRenamed(env, name, oldName, logger) {
     if (env[name] !== undefined || env[oldName] === undefined)
@@ -90,8 +69,8 @@ function readRenamed(env, name, oldName, logger) {
     return { ...env, [name]: env[oldName] };
 }
 /**
- * Parse a boolean env flag. Accepts `true/1/yes/on` (case-insensitive) as true
- * and `false/0/no/off` as false; any other / absent value falls back.
+ * Parse a boolean env flag. Accepts `true/1/yes/on` and `false/0/no/off`
+ * (case-insensitive); any other spelling warns and falls back.
  */
 export function readBool(env, name, fallback, logger = noop) {
     const raw = env[name];
@@ -111,20 +90,17 @@ export function readBool(env, name, fallback, logger = noop) {
     return fallback;
 }
 /**
- * Resolve every server-side compute limit from an env map. Pure: the same env
- * always yields the same limits, and nothing is read ambiently. The app calls
- * this once at its composition root with `$env/dynamic/private`.
+ * Resolve every server-side compute limit from an env map. The app calls this
+ * once at its composition root with `$env/dynamic/private`.
  */
 export function resolveComputeLimits(env, logger = noop) {
-    // Renamed 2026-07 so each cache var says what it HOLDS. Old names still read,
-    // with a boot warning; drop this shim one minor version on.
+    // Deprecation shims, so each var says what it HOLDS and what it bounds — one
+    // solve — rather than a vague "duration". Drop one minor version on.
     env = readRenamed(env, 'COMPUTE_DEFINITION_CACHE_MB', 'COMPUTE_DEFINITION_BYTE_CACHE_MB', logger);
     env = readRenamed(env, 'COMPUTE_SOLVE_CACHE_MB', 'COMPUTE_RESPONSE_CACHE_MB', logger);
     env = readRenamed(env, 'REMOTE_DEFINITION_CACHE_TTL_MS', 'DEFINITION_CACHE_TTL_MS', logger);
-    // Renamed 2026-08 into the COMPUTE_* namespace it belongs to, and to say what it
-    // bounds — one solve — rather than a vague "duration".
     env = readRenamed(env, 'COMPUTE_SOLVE_DEADLINE_MS', 'MAX_SOLVE_DURATION_MS', logger);
-    // Intentional clean-cut rename (no old-name dual-read): pre-1.0 breaking change.
+    // Clean-cut rename with no old-name dual-read: deliberate pre-1.0 breaking change.
     const maxDefinitionFileSize = readPositiveInt(env, 'MAX_DEFINITION_FILE_SIZE_BYTES', 50 * MB, logger);
     return {
         solveDeadlineMs: readPositiveInt(env, 'COMPUTE_SOLVE_DEADLINE_MS', 100_000, logger),
@@ -134,26 +110,21 @@ export function resolveComputeLimits(env, logger = noop) {
         maxImageFileSize: readPositiveInt(env, 'MAX_IMAGE_FILE_SIZE_BYTES', 10 * MB, logger),
         computeRequestMaxBytes: readPositiveInt(env, 'COMPUTE_REQUEST_MAX_BYTES', 210 * MB, logger),
         computeResponseMaxBytes: readPositiveInt(env, 'COMPUTE_RESPONSE_MAX_BYTES', 300 * MB, logger),
-        // Tracks the upload cap so a remote URL can't smuggle a larger file.
         remoteDefinitionMaxBytes: maxDefinitionFileSize,
         remoteDefinitionFetchTimeoutMs: readPositiveInt(env, 'REMOTE_DEFINITION_FETCH_TIMEOUT_MS', 30_000, logger),
         remoteDefinitionCacheTtlMs: readPositiveInt(env, 'REMOTE_DEFINITION_CACHE_TTL_MS', 5 * 60 * 1000, logger),
         computeReuseDefinitionCache: readBool(env, 'COMPUTE_REUSE_DEFINITION_CACHE', true, logger),
         computeServerCachesolve: readBool(env, 'COMPUTE_SERVER_CACHESOLVE', true, logger),
         computeCacheErroredSolves: readBool(env, 'COMPUTE_CACHE_ERRORED_SOLVES', false, logger),
-        // Both 0 (unbounded / no deadline) by default — nothing is rejected until an
-        // operator who's measured their pool opts in. readNonNegativeInt so `0` is a
-        // valid "disabled" value, not treated as invalid.
+        // Both default to off — nothing is rejected until an operator who has measured
+        // their pool opts in. readNonNegativeInt throughout, so `0` reads as "disabled"
+        // rather than as an invalid value that falls back.
         computeMaxQueueDepth: readNonNegativeInt(env, 'COMPUTE_MAX_QUEUE_DEPTH', 0, logger),
         computeQueueWaitMs: readNonNegativeInt(env, 'COMPUTE_QUEUE_WAIT_MS', 0, logger),
-        // Env is MB; 0 disables. Default 256 MB holds a handful of typical
-        // definitions warm without pinning gigabytes. readNonNegativeInt so `0`
-        // (disable) is honored rather than treated as invalid.
+        // 256 MB holds a handful of typical definitions warm without pinning gigabytes.
         computeDefinitionCacheBytes: readNonNegativeInt(env, 'COMPUTE_DEFINITION_CACHE_MB', 256, logger) * MB,
-        // Per-warm-client solve cache budget. Env is MB; 0 disables it. Default
-        // 256 MB: enough to keep a scrub session's recent solves warm without
-        // letting worst-case entries pin gigabytes (audit C2). PER warm client —
-        // see the field doc for the ×16 worst case.
+        // 256 MB keeps a scrub session's recent solves warm; PER warm client, so see
+        // the field doc for the ×16 worst case.
         computeSolveCacheBytes: readNonNegativeInt(env, 'COMPUTE_SOLVE_CACHE_MB', 256, logger) * MB
     };
 }

package/dist/compute/limits.js.map

@@ -1 +1 @@
-{"version":3,"file":"limits.js","sourceRoot":"","sources":["../../src/compute/limits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAgB,MAAM,mBAAmB,CAAC;AAE7D,MAAM,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAKvB;;;;GAIG;AACH,MAAM,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC;AAE9B;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC9B,GAAc,EACd,IAAY,EACZ,QAAgB,EAChB,SAAkB,IAAI;IAEtB,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE;YACzD,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,GAAG;YACV,QAAQ;SACR,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CACjC,GAAc,EACd,IAAY,EACZ,QAAgB,EAChB,SAAkB,IAAI;IAEtB,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE;YACzD,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,GAAG;YACV,QAAQ;SACR,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,WAAW,CAAC,GAAc,EAAE,IAAY,EAAE,OAAe,EAAE,MAAe;IAClF,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IACtE,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;QAC5C,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,OAAO;QACf,SAAS,EAAE,IAAI;KACf,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CACvB,GAAc,EACd,IAAY,EACZ,QAAiB,EACjB,SAAkB,IAAI;IAEtB,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC/C,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACxE,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAC1E,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE;QACzD,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,GAAG;QACV,QAAQ;KACR,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AACjB,CAAC;AA8HD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAc,EAAE,SAAkB,IAAI;IAC1E,8EAA8E;IAC9E,4DAA4D;IAC5D,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,6BAA6B,EAAE,kCAAkC,EAAE,MAAM,CAAC,CAAC;IAClG,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,CAAC,CAAC;IACtF,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,gCAAgC,EAAE,yBAAyB,EAAE,MAAM,CAAC,CAAC;IAC5F,iFAAiF;IACjF,uDAAuD;IACvD,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,MAAM,CAAC,CAAC;IAErF,iFAAiF;IACjF,MAAM,qBAAqB,GAAG,eAAe,CAC5C,GAAG,EACH,gCAAgC,EAChC,EAAE,GAAG,EAAE,EACP,MAAM,CACN,CAAC;IACF,OAAO;QACN,eAAe,EAAE,eAAe,CAAC,GAAG,EAAE,2BAA2B,EAAE,OAAO,EAAE,MAAM,CAAC;QACnF,iBAAiB,EAAE,eAAe,CAAC,GAAG,EAAE,8BAA8B,EAAE,OAAO,EAAE,MAAM,CAAC;QACxF,oBAAoB,EAAE,eAAe,CAAC,GAAG,EAAE,wBAAwB,EAAE,GAAG,EAAE,MAAM,CAAC;QACjF,qBAAqB;QACrB,gBAAgB,EAAE,eAAe,CAAC,GAAG,EAAE,2BAA2B,EAAE,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC;QACpF,sBAAsB,EAAE,eAAe,CAAC,GAAG,EAAE,2BAA2B,EAAE,GAAG,GAAG,EAAE,EAAE,MAAM,CAAC;QAC3F,uBAAuB,EAAE,eAAe,CAAC,GAAG,EAAE,4BAA4B,EAAE,GAAG,GAAG,EAAE,EAAE,MAAM,CAAC;QAC7F,qEAAqE;QACrE,wBAAwB,EAAE,qBAAqB;QAC/C,8BAA8B,EAAE,eAAe,CAC9C,GAAG,EACH,oCAAoC,EACpC,MAAM,EACN,MAAM,CACN;QACD,0BAA0B,EAAE,eAAe,CAC1C,GAAG,EACH,gCAAgC,EAChC,CAAC,GAAG,EAAE,GAAG,IAAI,EACb,MAAM,CACN;QACD,2BAA2B,EAAE,QAAQ,CAAC,GAAG,EAAE,gCAAgC,EAAE,IAAI,EAAE,MAAM,CAAC;QAC1F,uBAAuB,EAAE,QAAQ,CAAC,GAAG,EAAE,2BAA2B,EAAE,IAAI,EAAE,MAAM,CAAC;QACjF,yBAAyB,EAAE,QAAQ,CAAC,GAAG,EAAE,8BAA8B,EAAE,KAAK,EAAE,MAAM,CAAC;QACvF,6EAA6E;QAC7E,6EAA6E;QAC7E,kDAAkD;QAClD,oBAAoB,EAAE,kBAAkB,CAAC,GAAG,EAAE,yBAAyB,EAAE,CAAC,EAAE,MAAM,CAAC;QACnF,kBAAkB,EAAE,kBAAkB,CAAC,GAAG,EAAE,uBAAuB,EAAE,CAAC,EAAE,MAAM,CAAC;QAC/E,mEAAmE;QACnE,wEAAwE;QACxE,uDAAuD;QACvD,2BAA2B,EAC1B,kBAAkB,CAAC,GAAG,EAAE,6BAA6B,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE;QACzE,wEAAwE;QACxE,sEAAsE;QACtE,yEAAyE;QACzE,4CAA4C;QAC5C,sBAAsB,EAAE,kBAAkB,CAAC,GAAG,EAAE,wBAAwB,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE;KAC3F,CAAC;AACH,CAAC"}
+{"version":3,"file":"limits.js","sourceRoot":"","sources":["../../src/compute/limits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAgB,MAAM,mBAAmB,CAAC;AAE7D,MAAM,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAKvB;;;GAGG;AACH,MAAM,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC;AAE9B,sGAAsG;AACtG,MAAM,UAAU,eAAe,CAC9B,GAAc,EACd,IAAY,EACZ,QAAgB,EAChB,SAAkB,IAAI;IAEtB,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE;YACzD,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,GAAG;YACV,QAAQ;SACR,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,kBAAkB,CACjC,GAAc,EACd,IAAY,EACZ,QAAgB,EAChB,SAAkB,IAAI;IAEtB,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE;YACzD,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,GAAG;YACV,QAAQ;SACR,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,GAAc,EAAE,IAAY,EAAE,OAAe,EAAE,MAAe;IAClF,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IACtE,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;QAC5C,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,OAAO;QACf,SAAS,EAAE,IAAI;KACf,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CACvB,GAAc,EACd,IAAY,EACZ,QAAiB,EACjB,SAAkB,IAAI;IAEtB,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC/C,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACxE,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAC1E,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE;QACzD,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,GAAG;QACV,QAAQ;KACR,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AACjB,CAAC;AA+HD;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAc,EAAE,SAAkB,IAAI;IAC1E,6EAA6E;IAC7E,qEAAqE;IACrE,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,6BAA6B,EAAE,kCAAkC,EAAE,MAAM,CAAC,CAAC;IAClG,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,CAAC,CAAC;IACtF,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,gCAAgC,EAAE,yBAAyB,EAAE,MAAM,CAAC,CAAC;IAC5F,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,MAAM,CAAC,CAAC;IAErF,mFAAmF;IACnF,MAAM,qBAAqB,GAAG,eAAe,CAC5C,GAAG,EACH,gCAAgC,EAChC,EAAE,GAAG,EAAE,EACP,MAAM,CACN,CAAC;IACF,OAAO;QACN,eAAe,EAAE,eAAe,CAAC,GAAG,EAAE,2BAA2B,EAAE,OAAO,EAAE,MAAM,CAAC;QACnF,iBAAiB,EAAE,eAAe,CAAC,GAAG,EAAE,8BAA8B,EAAE,OAAO,EAAE,MAAM,CAAC;QACxF,oBAAoB,EAAE,eAAe,CAAC,GAAG,EAAE,wBAAwB,EAAE,GAAG,EAAE,MAAM,CAAC;QACjF,qBAAqB;QACrB,gBAAgB,EAAE,eAAe,CAAC,GAAG,EAAE,2BAA2B,EAAE,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC;QACpF,sBAAsB,EAAE,eAAe,CAAC,GAAG,EAAE,2BAA2B,EAAE,GAAG,GAAG,EAAE,EAAE,MAAM,CAAC;QAC3F,uBAAuB,EAAE,eAAe,CAAC,GAAG,EAAE,4BAA4B,EAAE,GAAG,GAAG,EAAE,EAAE,MAAM,CAAC;QAC7F,wBAAwB,EAAE,qBAAqB;QAC/C,8BAA8B,EAAE,eAAe,CAC9C,GAAG,EACH,oCAAoC,EACpC,MAAM,EACN,MAAM,CACN;QACD,0BAA0B,EAAE,eAAe,CAC1C,GAAG,EACH,gCAAgC,EAChC,CAAC,GAAG,EAAE,GAAG,IAAI,EACb,MAAM,CACN;QACD,2BAA2B,EAAE,QAAQ,CAAC,GAAG,EAAE,gCAAgC,EAAE,IAAI,EAAE,MAAM,CAAC;QAC1F,uBAAuB,EAAE,QAAQ,CAAC,GAAG,EAAE,2BAA2B,EAAE,IAAI,EAAE,MAAM,CAAC;QACjF,yBAAyB,EAAE,QAAQ,CAAC,GAAG,EAAE,8BAA8B,EAAE,KAAK,EAAE,MAAM,CAAC;QACvF,+EAA+E;QAC/E,gFAAgF;QAChF,mDAAmD;QACnD,oBAAoB,EAAE,kBAAkB,CAAC,GAAG,EAAE,yBAAyB,EAAE,CAAC,EAAE,MAAM,CAAC;QACnF,kBAAkB,EAAE,kBAAkB,CAAC,GAAG,EAAE,uBAAuB,EAAE,CAAC,EAAE,MAAM,CAAC;QAC/E,gFAAgF;QAChF,2BAA2B,EAC1B,kBAAkB,CAAC,GAAG,EAAE,6BAA6B,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE;QACzE,6EAA6E;QAC7E,wCAAwC;QACxC,sBAAsB,EAAE,kBAAkB,CAAC,GAAG,EAAE,wBAAwB,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE;KAC3F,CAAC;AACH,CAAC"}

package/dist/compute/rate-limit.d.ts

@@ -1,41 +1,37 @@
 /**
- * Per-key fixed-window rate limiter for the compute-solve endpoint. Compute
- * solves are the one expensive endpoint in a Selva-engine app — without a cap a
- * single authenticated user (or share-link consumer) can burn through compute
- * budget far faster than any other surface allows.
+ * Per-key fixed-window rate limiter for the compute-solve endpoint. Solves are
+ * the one expensive endpoint in a Selva-engine app — without a cap a single user
+ * or share-link consumer burns compute budget far faster than any other surface
+ * allows.
  *
  * Design:
  *  - Process-local `Map`. Multi-instance deployments see N× the per-key rate —
- *    acceptable as a first line; a distributed limiter is a follow-up. The state
- *    lives behind this factory so a shared-store implementation can slot in
- *    later without changing the call sites.
- *  - Bounded. A key is only interesting until its window expires, but nothing
- *    revisits a bucket that is never checked again — so an unswept `Map` grows
- *    with the number of distinct keys ever seen (every user, share link and
- *    login IP, forever). Two inline mechanisms keep it bounded, both driven by
+ *    acceptable as a first line. State lives behind this factory so a shared-store
+ *    implementation can slot in later without touching call sites.
+ *  - Bounded. Nothing revisits a bucket that is never checked again, so an
+ *    unswept `Map` grows with every distinct key ever seen — every user, share
+ *    link and login IP, forever. Two mechanisms keep it bounded, both driven by
  *    `check`/`peek` rather than a timer: a timer would keep the event loop alive
  *    and give this module a lifecycle its callers don't have.
  *      1. Amortized sweep — every `sweepIntervalMs` (default: one window), drop
- *         every expired bucket. Expired buckets are semantically dead: `check`
- *         already treats them as absent, so dropping them changes no verdict.
- *      2. Hard cap — if live buckets alone exceed `maxKeys`, evict the entries
- *         closest to resetting. Those are the ones with the least budget left to
- *         protect, so a distinct-key flood can't pin unbounded memory. Eviction
+ *         expired buckets. `check` already treats them as absent, so dropping
+ *         them changes no verdict.
+ *      2. Hard cap — if live buckets alone exceed `maxKeys`, evict those closest
+ *         to resetting; they have the least budget left to protect. Eviction
  *         forgives a key's counter, so `maxKeys` is sized to be unreachable in
  *         normal operation and only bites under a key-space attack.
- *  - Fixed window (vs sliding) — simpler, no per-request bookkeeping; the
- *    "burst at window edges" mode is fine here (share-link `maxSolves` and
- *    per-user auth already prevent unbounded abuse — this flattens short spikes).
- *  - Keyed by caller — the app passes `user:{userId}` for authenticated solves,
- *    `share:{linkId}` for share-token solves, so anonymous consumers of one link
- *    don't share a bucket with the link's owner.
+ *  - Fixed window rather than sliding — simpler, no per-request bookkeeping. The
+ *    burst-at-window-edges behaviour is fine here: share-link `maxSolves` and
+ *    per-user auth already prevent unbounded abuse, and this flattens spikes.
+ *  - Keyed by caller — the app passes `user:{userId}` for authenticated solves
+ *    and `share:{linkId}` for share-token solves, so anonymous consumers of one
+ *    link don't share a bucket with the link's owner.
  *
- * The window + cap are injected (they live in `ComputeLimits`), so this module
- * reads no env of its own.
+ * Window and cap are injected from `ComputeLimits`; this module reads no env.
  *
- * Not compute-only despite the name: `peek` + `clear` make it usable for
- * failure-counting flows too (login limiting keys by IP, records only failed
- * attempts via `check`, and forgives on success via `clear`).
+ * Not compute-only despite the name: `peek` + `clear` also serve failure-counting
+ * flows — login limiting keys by IP, records only failures via `check`, and
+ * forgives on success via `clear`.
  */
 export interface RateLimitResult {
     allowed: boolean;
@@ -48,54 +44,46 @@ export interface ComputeRateLimiterConfig {
     /** Max requests admitted per key per window. */
     maxPerWindow: number;
     /**
-     * Max retained buckets. Once live (unexpired) buckets exceed this, the ones
-     * nearest their reset are evicted. Evicting forgives that key's counter, so
-     * this is a memory backstop against a distinct-key flood, not a tuning knob:
-     * size it well above the plausible number of concurrently-active keys.
-     * Defaults to {@link DEFAULT_MAX_KEYS}.
+     * Max retained buckets; defaults to {@link DEFAULT_MAX_KEYS}. Evicting forgives
+     * that key's counter, so this is a memory backstop against a distinct-key
+     * flood, not a tuning knob — size it well above the plausible number of
+     * concurrently-active keys.
      */
     maxKeys?: number;
     /**
-     * How often (ms) to sweep expired buckets, amortized onto `check`/`peek`.
-     * Defaults to `windowMs` — every bucket swept is already past its reset, so
-     * sweeping more often than a window buys nothing. `0` disables the sweep,
-     * leaving only the `maxKeys` cap (test seam).
+     * How often (ms) to sweep expired buckets. Defaults to `windowMs` — every
+     * bucket swept is already past its reset, so sweeping more often buys nothing.
+     * `0` disables the sweep, leaving only the `maxKeys` cap (test seam).
      */
     sweepIntervalMs?: number;
 }
 /** Default {@link ComputeRateLimiterConfig.maxKeys}. */
 export declare const DEFAULT_MAX_KEYS = 100000;
 export interface ComputeRateLimiter {
-    /**
-     * Check + record one request against `key`. Increments the counter on allow.
-     * Returns `{ allowed: false, retryAfter }` once the bucket is full.
-     */
+    /** Check and record one request against `key`, incrementing the counter on allow. */
     check(key: string): RateLimitResult;
     /**
-     * Check WITHOUT recording. For flows that only count selected outcomes —
-     * e.g. login limiting, where `peek` gates the attempt and `check` records
-     * only failures (a success calls `clear` instead).
+     * Check WITHOUT recording — for flows that count only selected outcomes. Login
+     * limiting gates the attempt with `peek`, records failures with `check`, and
+     * calls `clear` on success.
      */
     peek(key: string): RateLimitResult;
-    /** Drop `key`'s bucket — e.g. a successful login forgives prior failures. */
+    /** Drop `key`'s bucket — a successful login forgives prior failures. */
     clear(key: string): void;
     /**
-     * Requests recorded against `key` in the current window; `0` when the bucket
-     * is absent or expired. Observability/test seam — which key a caller charges
-     * is a security property (an anonymous share solve must not spend the link
-     * owner's budget), and a bare allow/deny verdict can't express it.
+     * Requests recorded against `key` this window; `0` when the bucket is absent or
+     * expired. Which key a caller charges is a security property — an anonymous
+     * share solve must not spend the link owner's budget — and an allow/deny
+     * verdict alone can't express it.
      */
     count(key: string): number;
     /** Test seam — wipes in-memory state. Production code never calls this. */
     reset(): void;
-    /** Retained bucket count, including any not yet swept. For tests/observability. */
+    /** Retained bucket count, including any not yet swept. Tests/observability. */
     size(): number;
     /** The resolved config, exposed for time-based test assertions. */
     readonly config: Readonly<ComputeRateLimiterConfig>;
 }
-/**
- * Build a process-local fixed-window rate limiter. Each limiter owns its own
- * bucket `Map`, so distinct endpoints/keys-spaces don't collide.
- */
+/** Each limiter owns its own bucket `Map`, so distinct key-spaces don't collide. */
 export declare function createComputeRateLimiter(config: ComputeRateLimiterConfig): ComputeRateLimiter;
 //# sourceMappingURL=rate-limit.d.ts.map

package/dist/compute/rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/compute/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,MAAM,WAAW,eAAe;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,wBAAwB;IACxC,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,wDAAwD;AACxD,eAAO,MAAM,gBAAgB,SAAU,CAAC;AAExC,MAAM,WAAW,kBAAkB;IAClC;;;OAGG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAAC;IACpC;;;;OAIG;IACH,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAAC;IACnC,6EAA6E;IAC7E,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;;OAKG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,2EAA2E;IAC3E,KAAK,IAAI,IAAI,CAAC;IACd,mFAAmF;IACnF,IAAI,IAAI,MAAM,CAAC;IACf,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,wBAAwB,CAAC,CAAC;CACpD;AAOD;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,wBAAwB,GAAG,kBAAkB,CA8F7F"}
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/compute/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,MAAM,WAAW,eAAe;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,wBAAwB;IACxC,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,wDAAwD;AACxD,eAAO,MAAM,gBAAgB,SAAU,CAAC;AAExC,MAAM,WAAW,kBAAkB;IAClC,qFAAqF;IACrF,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAAC;IACpC;;;;OAIG;IACH,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAAC;IACnC,wEAAwE;IACxE,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;;OAKG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,2EAA2E;IAC3E,KAAK,IAAI,IAAI,CAAC;IACd,+EAA+E;IAC/E,IAAI,IAAI,MAAM,CAAC;IACf,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,wBAAwB,CAAC,CAAC;CACpD;AAOD,oFAAoF;AACpF,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,wBAAwB,GAAG,kBAAkB,CA6F7F"}

package/dist/compute/rate-limit.js

@@ -1,48 +1,41 @@
 /**
- * Per-key fixed-window rate limiter for the compute-solve endpoint. Compute
- * solves are the one expensive endpoint in a Selva-engine app — without a cap a
- * single authenticated user (or share-link consumer) can burn through compute
- * budget far faster than any other surface allows.
+ * Per-key fixed-window rate limiter for the compute-solve endpoint. Solves are
+ * the one expensive endpoint in a Selva-engine app — without a cap a single user
+ * or share-link consumer burns compute budget far faster than any other surface
+ * allows.
  *
  * Design:
  *  - Process-local `Map`. Multi-instance deployments see N× the per-key rate —
- *    acceptable as a first line; a distributed limiter is a follow-up. The state
- *    lives behind this factory so a shared-store implementation can slot in
- *    later without changing the call sites.
- *  - Bounded. A key is only interesting until its window expires, but nothing
- *    revisits a bucket that is never checked again — so an unswept `Map` grows
- *    with the number of distinct keys ever seen (every user, share link and
- *    login IP, forever). Two inline mechanisms keep it bounded, both driven by
+ *    acceptable as a first line. State lives behind this factory so a shared-store
+ *    implementation can slot in later without touching call sites.
+ *  - Bounded. Nothing revisits a bucket that is never checked again, so an
+ *    unswept `Map` grows with every distinct key ever seen — every user, share
+ *    link and login IP, forever. Two mechanisms keep it bounded, both driven by
  *    `check`/`peek` rather than a timer: a timer would keep the event loop alive
  *    and give this module a lifecycle its callers don't have.
  *      1. Amortized sweep — every `sweepIntervalMs` (default: one window), drop
- *         every expired bucket. Expired buckets are semantically dead: `check`
- *         already treats them as absent, so dropping them changes no verdict.
- *      2. Hard cap — if live buckets alone exceed `maxKeys`, evict the entries
- *         closest to resetting. Those are the ones with the least budget left to
- *         protect, so a distinct-key flood can't pin unbounded memory. Eviction
+ *         expired buckets. `check` already treats them as absent, so dropping
+ *         them changes no verdict.
+ *      2. Hard cap — if live buckets alone exceed `maxKeys`, evict those closest
+ *         to resetting; they have the least budget left to protect. Eviction
  *         forgives a key's counter, so `maxKeys` is sized to be unreachable in
  *         normal operation and only bites under a key-space attack.
- *  - Fixed window (vs sliding) — simpler, no per-request bookkeeping; the
- *    "burst at window edges" mode is fine here (share-link `maxSolves` and
- *    per-user auth already prevent unbounded abuse — this flattens short spikes).
- *  - Keyed by caller — the app passes `user:{userId}` for authenticated solves,
- *    `share:{linkId}` for share-token solves, so anonymous consumers of one link
- *    don't share a bucket with the link's owner.
+ *  - Fixed window rather than sliding — simpler, no per-request bookkeeping. The
+ *    burst-at-window-edges behaviour is fine here: share-link `maxSolves` and
+ *    per-user auth already prevent unbounded abuse, and this flattens spikes.
+ *  - Keyed by caller — the app passes `user:{userId}` for authenticated solves
+ *    and `share:{linkId}` for share-token solves, so anonymous consumers of one
+ *    link don't share a bucket with the link's owner.
  *
- * The window + cap are injected (they live in `ComputeLimits`), so this module
- * reads no env of its own.
+ * Window and cap are injected from `ComputeLimits`; this module reads no env.
  *
- * Not compute-only despite the name: `peek` + `clear` make it usable for
- * failure-counting flows too (login limiting keys by IP, records only failed
- * attempts via `check`, and forgives on success via `clear`).
+ * Not compute-only despite the name: `peek` + `clear` also serve failure-counting
+ * flows — login limiting keys by IP, records only failures via `check`, and
+ * forgives on success via `clear`.
  */
 /** Default {@link ComputeRateLimiterConfig.maxKeys}. */
 export const DEFAULT_MAX_KEYS = 100_000;
-/**
- * Build a process-local fixed-window rate limiter. Each limiter owns its own
- * bucket `Map`, so distinct endpoints/keys-spaces don't collide.
- */
+/** Each limiter owns its own bucket `Map`, so distinct key-spaces don't collide. */
 export function createComputeRateLimiter(config) {
     const { windowMs, maxPerWindow } = config;
     const maxKeys = Math.max(1, Math.floor(config.maxKeys ?? DEFAULT_MAX_KEYS));
@@ -55,13 +48,12 @@ export function createComputeRateLimiter(config) {
     const buckets = new Map();
     let nextSweepAt = Number.POSITIVE_INFINITY;
     /**
-     * Drop dead buckets, then enforce the hard cap. Amortized onto `check`/`peek`
-     * so the limiter needs no timer of its own. Runs at most once per
+     * Drop dead buckets, then enforce the hard cap. Runs at most once per
      * `sweepIntervalMs` — except when the cap is already breached, which must be
      * enforced on the spot regardless of the sweep clock.
      *
-     * `headroom` is how many buckets the caller is about to insert; the cap is
-     * enforced against the post-insert size so `maxKeys` is a true ceiling rather
+     * `headroom` is how many buckets the caller is about to insert. The cap is
+     * enforced against the post-insert size, so `maxKeys` is a true ceiling rather
      * than one the very next write steps over.
      */
     function maybeSweep(now, headroom = 0) {

package/dist/compute/rate-limit.js.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../src/compute/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AA8BH,wDAAwD;AACxD,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAoCxC;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAgC;IACxE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,CAAC;IAC5E,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,IAAI,QAAQ,CAAC,CAAC,CAAC;IACpF,MAAM,cAAc,GAAuC,MAAM,CAAC,MAAM,CAAC;QACxE,GAAG,MAAM;QACT,OAAO;QACP,eAAe;KACf,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC/C,IAAI,WAAW,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAE3C;;;;;;;;;OASG;IACH,SAAS,UAAU,CAAC,GAAW,EAAE,QAAQ,GAAG,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC,CAAC;QAC/C,MAAM,WAAW,GAAG,eAAe,GAAG,CAAC,IAAI,GAAG,IAAI,WAAW,CAAC;QAC9D,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,IAAI,IAAI,MAAM;YAAE,OAAO;QAEnD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YACpC,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,eAAe,GAAG,CAAC;YAAE,WAAW,GAAG,GAAG,GAAG,eAAe,CAAC;QAE7D,0EAA0E;QAC1E,iEAAiE;QACjE,IAAI,OAAO,CAAC,IAAI,GAAG,MAAM,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACtF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,EAAE;gBAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvF,CAAC;IACF,CAAC;IAED,OAAO;QACN,MAAM,EAAE,cAAc;QACtB,KAAK,CAAC,GAAW;YAChB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,oDAAoD;YACpD,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAE/B,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;gBACnC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,QAAQ,EAAE,CAAC,CAAC;gBACxD,IAAI,eAAe,GAAG,CAAC,IAAI,WAAW,KAAK,MAAM,CAAC,iBAAiB,EAAE,CAAC;oBACrE,WAAW,GAAG,GAAG,GAAG,eAAe,CAAC;gBACrC,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC1B,CAAC;YAED,IAAI,KAAK,CAAC,KAAK,IAAI,YAAY,EAAE,CAAC;gBACjC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;YAChF,CAAC;YAED,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;YACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,GAAW;YACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,UAAU,CAAC,GAAG,CAAC,CAAC;YAChB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAE/B,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;gBACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC1B,CAAC;YACD,IAAI,KAAK,CAAC,KAAK,IAAI,YAAY,EAAE,CAAC;gBACjC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;YAChF,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,GAAW;YAChB,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QACD,KAAK,CAAC,GAAW;YAChB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/B,wEAAwE;YACxE,2DAA2D;YAC3D,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO;gBAAE,OAAO,CAAC,CAAC;YACnD,OAAO,KAAK,CAAC,KAAK,CAAC;QACpB,CAAC;QACD,KAAK;YACJ,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,WAAW,GAAG,MAAM,CAAC,iBAAiB,CAAC;QACxC,CAAC;QACD,IAAI;YACH,OAAO,OAAO,CAAC,IAAI,CAAC;QACrB,CAAC;KACD,CAAC;AACH,CAAC"}
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../src/compute/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AA4BH,wDAAwD;AACxD,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAiCxC,oFAAoF;AACpF,MAAM,UAAU,wBAAwB,CAAC,MAAgC;IACxE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,CAAC;IAC5E,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,IAAI,QAAQ,CAAC,CAAC,CAAC;IACpF,MAAM,cAAc,GAAuC,MAAM,CAAC,MAAM,CAAC;QACxE,GAAG,MAAM;QACT,OAAO;QACP,eAAe;KACf,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC/C,IAAI,WAAW,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAE3C;;;;;;;;OAQG;IACH,SAAS,UAAU,CAAC,GAAW,EAAE,QAAQ,GAAG,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC,CAAC;QAC/C,MAAM,WAAW,GAAG,eAAe,GAAG,CAAC,IAAI,GAAG,IAAI,WAAW,CAAC;QAC9D,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,IAAI,IAAI,MAAM;YAAE,OAAO;QAEnD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YACpC,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,eAAe,GAAG,CAAC;YAAE,WAAW,GAAG,GAAG,GAAG,eAAe,CAAC;QAE7D,0EAA0E;QAC1E,iEAAiE;QACjE,IAAI,OAAO,CAAC,IAAI,GAAG,MAAM,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACtF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,EAAE;gBAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvF,CAAC;IACF,CAAC;IAED,OAAO;QACN,MAAM,EAAE,cAAc;QACtB,KAAK,CAAC,GAAW;YAChB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,oDAAoD;YACpD,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAE/B,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;gBACnC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,QAAQ,EAAE,CAAC,CAAC;gBACxD,IAAI,eAAe,GAAG,CAAC,IAAI,WAAW,KAAK,MAAM,CAAC,iBAAiB,EAAE,CAAC;oBACrE,WAAW,GAAG,GAAG,GAAG,eAAe,CAAC;gBACrC,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC1B,CAAC;YAED,IAAI,KAAK,CAAC,KAAK,IAAI,YAAY,EAAE,CAAC;gBACjC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;YAChF,CAAC;YAED,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;YACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,GAAW;YACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,UAAU,CAAC,GAAG,CAAC,CAAC;YAChB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAE/B,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;gBACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC1B,CAAC;YACD,IAAI,KAAK,CAAC,KAAK,IAAI,YAAY,EAAE,CAAC;gBACjC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;YAChF,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,GAAW;YAChB,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QACD,KAAK,CAAC,GAAW;YAChB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/B,wEAAwE;YACxE,2DAA2D;YAC3D,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO;gBAAE,OAAO,CAAC,CAAC;YACnD,OAAO,KAAK,CAAC,KAAK,CAAC;QACpB,CAAC;QACD,KAAK;YACJ,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,WAAW,GAAG,MAAM,CAAC,iBAAiB,CAAC;QACxC,CAAC;QACD,IAAI;YACH,OAAO,OAAO,CAAC,IAAI,CAAC;QACrB,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/compute/remote-definition.d.ts

@@ -1,18 +1,10 @@
 /**
  * Remote-definition fetch: SSRF-guarded, size-capped, timed, and TTL-cached.
  *
- * A solve can reference its `.gh` by remote URL instead of a stored blob. That
- * URL is attacker-controllable (a share-token caller supplies `definitionUrl`),
- * so every fetch runs through {@link assertSafeRemoteDefinitionUrl} (literal +
- * DNS host validation, blocking private/loopback/link-local targets and
- * literal-encoding bypasses), streams the body with an early size cap, and
- * bounds the wall time with a deadline.
- *
- * The TTL cache is a per-fetcher `Map<url, {data, fetchedAt}>` so repeated
- * solves of the same remote definition skip the network. It's created by
- * {@link createRemoteDefinitionFetcher} rather than being module-global, so a
- * consuming app can hold one fetcher per process (the app binding does) or
- * several isolated ones (tests) without shared state leaking across them.
+ * A solve can reference its `.gh` by remote URL instead of a stored blob, and
+ * that URL is attacker-controllable — a share-token caller supplies
+ * `definitionUrl`. Hence {@link assertSafeRemoteDefinitionUrl}, the early size
+ * cap, and the deadline.
  */
 import { type ILogger } from '@selvajs/platform';
 /** Injected limits — the app derives these from its env-resolved `ComputeLimits`. */
@@ -23,16 +15,11 @@ export interface RemoteDefinitionConfig {
     fetchTimeoutMs: number;
     /** How long a fetched definition stays warm in the in-process cache. */
     cacheTtlMs: number;
-    /**
-     * Current epoch millis. Injected (not read via `Date.now()` ambiently) so the
-     * TTL is testable and the module stays side-effect-free. The app binding
-     * passes `() => Date.now()`.
-     */
+    /** Current epoch millis. Injected so the TTL is testable; the app passes `() => Date.now()`. */
     now: () => number;
     /**
-     * Structured logger for the SSRF guard's block diagnostics. Optional; defaults
-     * to `NoopLogger` so an embedder that wires nothing gets silence rather than
-     * unsolicited stdout writes.
+     * Receives the SSRF guard's block diagnostics. Defaults to `NoopLogger` so an
+     * embedder that wires nothing gets silence rather than unsolicited stdout writes.
      */
     logger?: ILogger;
 }
@@ -47,8 +34,7 @@ export interface RemoteDefinitionFetcher {
 /**
  * Read a response body into memory, aborting (and throwing) as soon as the
  * running byte total exceeds `maxBytes`. Falls back to `arrayBuffer()` only when
- * the body isn't a readable stream (older fetch impls). Exported for direct use
- * and reuse; the fetcher below wraps it with SSRF + TTL.
+ * the body isn't a readable stream (older fetch impls).
  */
 export declare function readBodyWithCap(response: Response, maxBytes: number, controller: AbortController): Promise<Uint8Array>;
 /**

package/dist/compute/remote-definition.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-definition.d.ts","sourceRoot":"","sources":["../../src/compute/remote-definition.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAc,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAE7D,qFAAqF;AACrF,MAAM,WAAW,sBAAsB;IACtC,mFAAmF;IACnF,QAAQ,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,cAAc,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACvC;;;;OAIG;IACH,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACvC;AAMD;;;;;GAKG;AACH,wBAAsB,eAAe,CACpC,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,eAAe,GACzB,OAAO,CAAC,UAAU,CAAC,CA4BrB;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC5C,MAAM,EAAE,sBAAsB,GAC5B,uBAAuB,CAsDzB"}
+{"version":3,"file":"remote-definition.d.ts","sourceRoot":"","sources":["../../src/compute/remote-definition.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAc,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAE7D,qFAAqF;AACrF,MAAM,WAAW,sBAAsB;IACtC,mFAAmF;IACnF,QAAQ,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,cAAc,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,gGAAgG;IAChG,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACvC;;;;OAIG;IACH,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACvC;AAMD;;;;GAIG;AACH,wBAAsB,eAAe,CACpC,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,eAAe,GACzB,OAAO,CAAC,UAAU,CAAC,CA4BrB;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC5C,MAAM,EAAE,sBAAsB,GAC5B,uBAAuB,CAqDzB"}

package/dist/compute/remote-definition.js

@@ -1,18 +1,10 @@
 /**
  * Remote-definition fetch: SSRF-guarded, size-capped, timed, and TTL-cached.
  *
- * A solve can reference its `.gh` by remote URL instead of a stored blob. That
- * URL is attacker-controllable (a share-token caller supplies `definitionUrl`),
- * so every fetch runs through {@link assertSafeRemoteDefinitionUrl} (literal +
- * DNS host validation, blocking private/loopback/link-local targets and
- * literal-encoding bypasses), streams the body with an early size cap, and
- * bounds the wall time with a deadline.
- *
- * The TTL cache is a per-fetcher `Map<url, {data, fetchedAt}>` so repeated
- * solves of the same remote definition skip the network. It's created by
- * {@link createRemoteDefinitionFetcher} rather than being module-global, so a
- * consuming app can hold one fetcher per process (the app binding does) or
- * several isolated ones (tests) without shared state leaking across them.
+ * A solve can reference its `.gh` by remote URL instead of a stored blob, and
+ * that URL is attacker-controllable — a share-token caller supplies
+ * `definitionUrl`. Hence {@link assertSafeRemoteDefinitionUrl}, the early size
+ * cap, and the deadline.
  */
 import { assertSafeRemoteDefinitionUrl } from './safe-url.js';
 import { NoopLogger } from '@selvajs/platform';
@@ -22,8 +14,7 @@ const CACHE_EVICT_BATCH = 10;
 /**
  * Read a response body into memory, aborting (and throwing) as soon as the
  * running byte total exceeds `maxBytes`. Falls back to `arrayBuffer()` only when
- * the body isn't a readable stream (older fetch impls). Exported for direct use
- * and reuse; the fetcher below wraps it with SSRF + TTL.
+ * the body isn't a readable stream (older fetch impls).
  */
 export async function readBodyWithCap(response, maxBytes, controller) {
     if (!response.body) {
@@ -64,9 +55,8 @@ export function createRemoteDefinitionFetcher(config) {
     const logger = config.logger ?? new NoopLogger();
     return {
         async load(url) {
-            // Resolves the host and rejects when any resolved IP is private/loopback/
-            // link-local — covers literal-encoding bypasses (integer/octal/hex/short-form,
-            // IPv4-mapped IPv6) and public names that point inward. Throws on rejection.
+            // Before the cache read, not after: a URL must never serve warm bytes
+            // without passing the guard.
             await assertSafeRemoteDefinitionUrl(url, logger);
             const now = config.now();
             const cached = cache.get(url);
@@ -89,9 +79,9 @@ export function createRemoteDefinitionFetcher(config) {
                 if (Number.isFinite(declared) && declared > config.maxBytes) {
                     throw new Error('Remote definition exceeds size limit');
                 }
-                // Stream and count rather than `arrayBuffer()` — a missing/lying
+                // Stream and count rather than `arrayBuffer()` — a missing or lying
                 // content-length must not let an unbounded body buffer into memory
-                // before the cap is checked. Abort the moment we cross the limit.
+                // before the cap is checked. Aborts the moment we cross the limit.
                 data = await readBodyWithCap(response, config.maxBytes, controller);
             }
             finally {

package/dist/compute/remote-definition.js.map

@@ -1 +1 @@
-{"version":3,"file":"remote-definition.js","sourceRoot":"","sources":["../../src/compute/remote-definition.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,6BAA6B,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAgB,MAAM,mBAAmB,CAAC;AAiC7D,oFAAoF;AACpF,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,QAAkB,EAClB,QAAgB,EAChB,UAA2B;IAE3B,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,UAAU,GAAG,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1F,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,IAAI,EAAE,CAAC;QACb,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;QAC1B,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;YACtB,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;IAC5B,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC5C,MAA8B;IAE9B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmD,CAAC;IACzE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;IAEjD,OAAO;QACN,KAAK,CAAC,IAAI,CAAC,GAAW;YACrB,0EAA0E;YAC1E,+EAA+E;YAC/E,6EAA6E;YAC7E,MAAM,6BAA6B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC1D,OAAO,MAAM,CAAC,IAAI,CAAC;YACpB,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;YAC5E,IAAI,IAAgB,CAAC;YACrB,IAAI,CAAC;gBACJ,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;oBACjC,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,QAAQ,EAAE,OAAO;iBACjB,CAAC,CAAC;gBACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBAClB,MAAM,IAAI,KAAK,CAAC,QAAQ,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;gBACpE,CAAC;gBACD,2DAA2D;gBAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBAChE,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;oBAC7D,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;gBACzD,CAAC;gBACD,iEAAiE;gBACjE,mEAAmE;gBACnE,kEAAkE;gBAClE,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YACrE,CAAC;oBAAS,CAAC;gBACV,YAAY,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;YAED,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;YAEzC,IAAI,KAAK,CAAC,IAAI,GAAG,iBAAiB,EAAE,CAAC;gBACpC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBACxD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,iBAAiB,EAAE,CAAC,EAAE,EAAE,CAAC;oBAC5C,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC7B,CAAC;YACF,CAAC;YAED,OAAO,IAAI,CAAC;QACb,CAAC;KACD,CAAC;AACH,CAAC"}
+{"version":3,"file":"remote-definition.js","sourceRoot":"","sources":["../../src/compute/remote-definition.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,6BAA6B,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAgB,MAAM,mBAAmB,CAAC;AA4B7D,oFAAoF;AACpF,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,QAAkB,EAClB,QAAgB,EAChB,UAA2B;IAE3B,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,UAAU,GAAG,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1F,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,IAAI,EAAE,CAAC;QACb,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;QAC1B,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;YACtB,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;IAC5B,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC5C,MAA8B;IAE9B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmD,CAAC;IACzE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;IAEjD,OAAO;QACN,KAAK,CAAC,IAAI,CAAC,GAAW;YACrB,sEAAsE;YACtE,6BAA6B;YAC7B,MAAM,6BAA6B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC1D,OAAO,MAAM,CAAC,IAAI,CAAC;YACpB,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;YAC5E,IAAI,IAAgB,CAAC;YACrB,IAAI,CAAC;gBACJ,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;oBACjC,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,QAAQ,EAAE,OAAO;iBACjB,CAAC,CAAC;gBACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBAClB,MAAM,IAAI,KAAK,CAAC,QAAQ,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;gBACpE,CAAC;gBACD,2DAA2D;gBAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBAChE,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;oBAC7D,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;gBACzD,CAAC;gBACD,oEAAoE;gBACpE,mEAAmE;gBACnE,mEAAmE;gBACnE,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YACrE,CAAC;oBAAS,CAAC;gBACV,YAAY,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;YAED,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;YAEzC,IAAI,KAAK,CAAC,IAAI,GAAG,iBAAiB,EAAE,CAAC;gBACpC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBACxD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,iBAAiB,EAAE,CAAC,EAAE,EAAE,CAAC;oBAC5C,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC7B,CAAC;YACF,CAAC;YAED,OAAO,IAAI,CAAC;QACb,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/compute/safe-url.d.ts

@@ -1,16 +1,18 @@
 import { type ILogger } from '@selvajs/platform';
 /**
- * Synchronous literal pre-filter. Rejects bad schemes, loopback hostnames, and
- * any IP literal (in any encoding) that resolves to a blocked address. Does NOT
+ * Synchronous literal pre-filter: rejects bad schemes, loopback hostnames, and
+ * any IP literal (in any encoding) that maps to a blocked address. Does NOT
  * perform DNS — a public *name* that points at a private IP passes here and is
- * caught by `assertSafeRemoteDefinitionUrl`.
+ * caught only by `assertSafeRemoteDefinitionUrl`.
  */
 export declare function isSafeRemoteDefinitionUrl(raw: string): boolean;
 /**
  * Full SSRF check: literal pre-filter, then resolve every A/AAAA record and
  * reject if *any* resolved IP is blocked. Returns the original URL on success
- * so callers can `await assertSafeRemoteDefinitionUrl(url)` inline. Throws on
- * any rejection.
+ * so callers can `await assertSafeRemoteDefinitionUrl(url)` inline.
+ *
+ * Every rejection throws the same generic message so the caller gets no oracle;
+ * which host was blocked and by which layer is logged server-side instead.
  */
 export declare function assertSafeRemoteDefinitionUrl(raw: string, logger?: ILogger): Promise<string>;
 //# sourceMappingURL=safe-url.d.ts.map

package/dist/compute/safe-url.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"safe-url.d.ts","sourceRoot":"","sources":["../../src/compute/safe-url.ts"],"names":[],"mappings":"AAEA,OAAO,EAAc,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AA2H7D;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CA2B9D;AAED;;;;;GAKG;AACH,wBAAsB,6BAA6B,CAClD,GAAG,EAAE,MAAM,EACX,MAAM,GAAE,OAA0B,GAChC,OAAO,CAAC,MAAM,CAAC,CAwCjB"}
+{"version":3,"file":"safe-url.d.ts","sourceRoot":"","sources":["../../src/compute/safe-url.ts"],"names":[],"mappings":"AAEA,OAAO,EAAc,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AA0H7D;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CA2B9D;AAED;;;;;;;GAOG;AACH,wBAAsB,6BAA6B,CAClD,GAAG,EAAE,MAAM,EACX,MAAM,GAAE,OAA0B,GAChC,OAAO,CAAC,MAAM,CAAC,CAqCjB"}